# changelog

author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.12.1.el8_9]
changelog:
  - net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve (Davide Caratti) [RHEL-16858 RHEL-14032] {CVE-2023-4623}
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Davide Caratti) [RHEL-16858 RHEL-14032] {CVE-2023-4623}
  - net: sched: sch_qfq: Use non-work-conserving warning handler (Davide Caratti) [RHEL-14423 RHEL-14032] {CVE-2023-4921}
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (Davide Caratti) [RHEL-14423 RHEL-14032] {CVE-2023-4921}
  - net/tls: Remove the context from the list in tls_device_down (Jay Shin) [RHEL-17813 RHEL-17301]
  - tls: Fix context leak on tls_device_down (Jay Shin) [RHEL-17813 RHEL-17301]
  - igb: set max size RX buffer when store bad packet is enabled (Wander Lairson Costa) [RHEL-15187 RHEL-15188] {CVE-2023-45871}


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.13.1.el8_9]
changelog:
  - Fix double fget() in vhost_net_set_backend() (Jon Maloy) [RHEL-13212 RHEL-7162] {CVE-2023-1838}
  - can: af_can: fix NULL pointer dereference in can_rcv_filter (Ricardo Robaina) [RHEL-19462 RHEL-6429] {CVE-2023-2166}
  - RDMA/core: Update CMA destination address on rdma_resolve_addr (Kamal Heib) [RHEL-19328 RHEL-1032] {CVE-2023-2176}
  - RDMA/core: Refactor rdma_bind_addr (Kamal Heib) [RHEL-19328 RHEL-1032] {CVE-2023-2176}
  - net: fix net device address assign type (Michal Schmidt) [RHEL-17296 RHEL-6383]
  - net: add check for current MAC address in dev_set_mac_address (Michal Schmidt) [RHEL-17296 RHEL-6383]
  - perf/core: Fix potential NULL deref (Wander Lairson Costa) [RHEL-18004 RHEL-14982] {CVE-2023-5717}
  - perf: Disallow mis-matched inherited group reads (Wander Lairson Costa) [RHEL-18004 RHEL-14982] {CVE-2023-5717}
  - drivers: net: slip: fix NPD bug in sl_tx_timeout() (Michal Schmidt) [RHEL-18583 RHEL-6655] {CVE-2022-41858}


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.14.1.el8_9]
changelog:
  - nfp: fix use-after-free in area_cache_get() (Ricardo Robaina) [RHEL-19452 RHEL-6567] {CVE-2022-3545}
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (David Marlin) [RHEL-18999 RHEL-1231] {CVE-2023-40283}
  - md/raid5: release batch_last before waiting for another stripe_head (Nigel Croxon) [RHEL-12284 RHEL-9875]


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.15.1.el8_9]
changelog:
  - IB/ipoib: Fix mcast list locking (Daniel Vacek) [RHEL-19699 RHEL-19244]
  - RDMA/IPoIB: Fix error code return in ipoib_mcast_join (Daniel Vacek) [RHEL-19699 RHEL-19244]
  - x86/sev: Check for user-space IOIO pointing to kernel space (Wander Lairson Costa) [RHEL-18014 RHEL-14978] {CVE-2023-46813}
  - x86/sev: Check IOBM for IOIO exceptions from user-space (Wander Lairson Costa) [RHEL-18014 RHEL-14978] {CVE-2023-46813}
  - x86/sev: Disable MMIO emulation from user mode (Wander Lairson Costa) [RHEL-18014 RHEL-14978] {CVE-2023-46813}
  - x86/sev-es: Fix SEV-ES OUT/IN immediate opcode vc handling (Wander Lairson Costa) [RHEL-18014 RHEL-14978] {CVE-2023-46813}


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.16.1.el8_9]
changelog:
  - tracing/timerlat: Add user-space interface (Chris White) [RHEL-20362 RHEL-15142]
  - tracing/osnoise: Skip running osnoise if all instances are off (Chris White) [RHEL-20362 RHEL-15142]
  - tracing/osnoise: Switch from PF_NO_SETAFFINITY to migrate_disable (Chris White) [RHEL-20362 RHEL-15142]
  - tracing/timerlat: Always wakeup the timerlat thread (Chris White) [RHEL-20362 RHEL-15142]
  - tracing/osnoise: Fix notify new tracing_max_latency (Chris White) [RHEL-20362 RHEL-15142]
  - tracing/timerlat: Notify new max thread latency (Chris White) [RHEL-20362 RHEL-15142]
  - trace/osnoise: make use of the helper function kthread_run_on_cpu() (Chris White) [RHEL-20362 RHEL-15142]
  - kthread: add the helper function kthread_run_on_cpu() (Chris White) [RHEL-20362 RHEL-15142]
  - x86/apic: Mark _all_ legacy interrupts when IO/APIC is missing (Prarit Bhargava) [RHEL-7238 RHEL-4244]
  - HID: check empty report_list in hid_validate_values() (Desnes Nunes) [RHEL-19274 RHEL-19237] {CVE-2023-1073}
  - s390/dasd: print copy pair message only for the correct error (Tobias Huschle) [RHEL-9444 RHEL-2831]
  - blk-mq: don't count completed flush data request as inflight in case of quiesce (Ming Lei) [RHEL-19111 RHEL-18055]


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.17.1.el8_9]
changelog:
  - redhat: rewrite genlog and support Y- tags (Jan Stancek)
  - smb: client: fix OOB in smbCalcSize() (Scott Mayhew) [RHEL-21662 RHEL-18990] {CVE-2023-6606}
  - s390/qeth: Don't call dev_close/dev_open (DOWN/UP) (Tobias Huschle) [RHEL-17884 RHEL-2410]
  - blk-mq: use quiesced elevator switch when reinitializing queues (Ming Lei) [RHEL-21785 RHEL-19944]
  - lib/group_cpus.c: avoid acquiring cpu hotplug lock in group_cpus_evenly (Ming Lei) [RHEL-20232 RHEL-8128]


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.18.1.el8_9]
changelog:
  - net: tls, update curr on splice as well (Sabrina Dubroca) [RHEL-22091 RHEL-19065] {CVE-2024-0646}
  - smb: client: fix potential OOB in smb2_dump_detail() (Scott Mayhew) [RHEL-21672 RHEL-19144] {CVE-2023-6610}
  - smb: client: fix potential OOB in cifs_dump_detail() (Scott Mayhew) [RHEL-21672 RHEL-19144] {CVE-2023-6610}
  - nvmet-tcp: Fix the H2C expected PDU len calculation (Maurizio Lombardi) [RHEL-22299 RHEL-22637 RHEL-22641 RHEL-19155 RHEL-19161 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
  - nvmet-tcp: remove boilerplate code (Maurizio Lombardi) [RHEL-22299 RHEL-22637 RHEL-22641 RHEL-19155 RHEL-19161 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
  - nvmet-tcp: fix a crash in nvmet_req_complete() (Maurizio Lombardi) [RHEL-22299 RHEL-22637 RHEL-22641 RHEL-19155 RHEL-19161 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
  - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length (Maurizio Lombardi) [RHEL-22299 RHEL-22637 RHEL-22641 RHEL-19155 RHEL-19161 RHEL-19167] {CVE-2023-6535 CVE-2023-6356 CVE-2023-6536}
  - net-sysfs: add check for netdevice being present to speed_show (Michal Schmidt) [RHEL-20924 RHEL-16007]
  - netfilter: nft_set_pipapo: skip inactive elements during set walk (Florian Westphal) [RHEL-20698 RHEL-19721] {CVE-2023-6817}


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.10.1.el8_9]
changelog:
  - pNFS/filelayout: treat GETDEVICEINFO errors as layout failure (Scott Mayhew) [RHEL-16407 RHEL-4969]
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Chris Leech) [RHEL-12082 RHEL-8992] {CVE-2023-2162}
  - scsi: iscsi_tcp: Fix UAF during logout when accessing the shost ipaddress (Chris Leech) [RHEL-12082 RHEL-8992] {CVE-2023-2162}
  - KVM: x86/mmu: Fix an sign-extension bug with mmu_seq that hangs vCPUs (Peter Xu) [RHEL-15121 RHEL-7210]
  - netfilter: conntrack: Fix gre tunneling over ipv6 (Florian Westphal) [RHEL-15259 RHEL-12497]
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Florian Westphal) [RHEL-8443 RHEL-8444] {CVE-2023-42753}
  - tcp: enforce receive buffer memory limits by allowing the tcp window to shrink (Felix Maurer) [RHEL-15096 RHEL-15023]
  - redhat: change builder image to rhel-8.9 (Michael Hofmann)
  - net: openvswitch: add support for l4 symmetric hashing (Antoine Tenart) [RHEL-12746 RHEL-10498]
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Guillaume Nault) [RHEL-16388 RHEL-2574] {CVE-2023-4622}


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.19.1.el8_9]
changelog:
  - libceph: fix potential use-after-free on linger ping and resends (Jay Shin) [RHEL-21394 RHEL-20390]
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters (Florian Westphal) [RHEL-24010 RHEL-23506] {CVE-2024-1086}


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.20.1.el8_9]
changelog:
  - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts (Jocelyn Falempe) [RHEL-22766 RHEL-3179] {CVE-2022-38096}
  - drm/mgag200: Fix gamma lut not initialized for G200ER, G200EV, G200SE (Jocelyn Falempe) [RHEL-21055 RHEL-21054]


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.21.1.el8_9]
changelog:
  - rbd: don't move requests to the running list on errors (Ilya Dryomov) [RHEL-24204 RHEL-21941]
  - drm/amdgpu: Fix potential fence use-after-free v2 (Jorge San Emeterio) [RHEL-24479 RHEL-22504] {CVE-2023-51042}
  - perf: Fix perf_event_validate_size() lockdep splat (Michael Petlan) [RHEL-22930 RHEL-17968] {CVE-2023-6931}
  - perf: Fix perf_event_validate_size() (Michael Petlan) [RHEL-22930 RHEL-17968] {CVE-2023-6931}
  - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-22077 RHEL-21685] {CVE-2024-0565}
  - ibmveth: Remove condition to recompute TCP header checksum. (Mamatha Inamdar) [RHEL-20822 RHEL-12553]


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.22.1.el8_9]
changelog:
  - s390/qeth: Fix vipa deletion (Tobias Huschle) [RHEL-25811 RHEL-11194]
  - smsc95xx: fix stalled rx after link change (Izabela Bakollari) [RHEL-25719 RHEL-22312]
  - ceph: don't let check_caps skip sending responses for revoke msgs (Xiubo Li) [RHEL-20909 RHEL-16412]
  - ceph: issue a cap release immediately if no cap exists (Xiubo Li) [RHEL-20909 RHEL-16412]
  - ceph: trigger to flush the buffer when making snapshot (Xiubo Li) [RHEL-20909 RHEL-16412]
  - ceph: force updating the msg pointer in non-split case (Xiubo Li) [RHEL-20909 RHEL-16412]
  - ceph: flush cap releases when the session is flushed (Xiubo Li) [RHEL-20909 RHEL-16412]
  - ceph: reorder fields in 'struct ceph_snapid_map' (Xiubo Li) [RHEL-20909 RHEL-16412]
  - ceph: voluntarily drop Xx caps for requests those touch parent mtime (Xiubo Li) [RHEL-20909 RHEL-16412]
  - KVM: x86: Constrain guest-supported xfeatures only at KVM_GET_XSAVE{2} (Bandan Das) [RHEL-23063 RHEL-7558]
  - x86/fpu: Allow caller to constrain xfeatures when copying to uabi buffer (Bandan Das) [RHEL-23063 RHEL-7558]
  - dm-crypt, dm-verity: disable tasklets (Benjamin Marzinski) [RHEL-26101 RHEL-22232]
  - dm verity: initialize fec io before freeing it (Benjamin Marzinski) [RHEL-26101 RHEL-22232]
  - dm-verity: don't use blocking calls from tasklets (Benjamin Marzinski) [RHEL-26101 RHEL-22232]


author: Patrick Talbert <ptalbert@redhat.com> [4.18.0-513.23.1.el8_9]
changelog:
  - scsi: smartpqi: Fix disable_managed_interrupts (Tomas Henzl) [RHEL-26139 RHEL-25747]
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()' (Carlos Maiolino) [RHEL-26331 RHEL-23386] {CVE-2021-33631}
  - serial: core: return early on unsupported ioctls (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - lib/hexdump: make print_hex_dump_bytes() a nop on !DEBUG builds (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix race condition in status line change on dead connections (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - Revert "tty: n_gsm: fix UAF in gsm_cleanup_mux" (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix UAF in gsm_cleanup_mux (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: add parameter negotiation support (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: add parameters used with parameter negotiation (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: introduce macro for minimal unit size (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: name the debug bits (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: introduce gsm_control_command() function (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: replace use of gsm_read_ea() with gsm_read_ea_val() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: name gsm tty device minors (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: initialize more members at gsm_alloc_mux() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix flow control handling in tx path (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix resource allocation order in gsm_activate_mux() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix deadlock and link starvation in outgoing data path (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix race condition in gsmld_write() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix non flow control frames during mux flow off (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix missing timer to handle stalled links (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix tty registration before control channel open (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix user open not possible at responder until initiator open (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Debug output allocation must use GFP_ATOMIC (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Fix packet data hex dump output (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix buffer over-read in gsm_dlci_data() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix sometimes uninitialized warning in gsm_dlci_modem_output() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix software flow control handling (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix invalid use of MSC in advanced option (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix broken virtual tty handling (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix missing update of modem controls after DLCI open (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix reset fifo race condition (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix missing tty wakeup in convergence layer type 2 (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong signal octets encoding in MSC (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong command frame length field encoding (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong command retry handling (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix missing explicit ldisc flush (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong DLCI release order (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix insufficient txframe size (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix frame reception handling (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2 (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix mux cleanup after unregister tty device (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix decoupled mux resource (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix restart handling via CLD command (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix deadlock in gsmtty_open() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong modem processing in convergence layer type 2 (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix wrong tty control line for flow control (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix NULL pointer access due to DLCI release (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix encoding of command/response bit (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: fix SW flow control encoding/handling (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: remove tty parameter from mxser_receive_chars_new() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: don't throttle manually (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: make mxser_port::ldisc_stop_rx a bool (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Don't ignore write return value in gsmld_output() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: clean up indenting in gsm_queue() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Save dlci address open status when config requester (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Modify gsmtty driver register method when config requester (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Delete gsmtty open SABM frame when config requester (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Modify CR,PF bit printk info when config requester (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Modify CR,PF bit when config requester (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: stop using alloc_tty_driver (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: don't store semi-state into tty drivers (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - hvsi: don't panic on tty_register_driver failure (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - amiserial: switch rs_table to a single state (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - amiserial: expand "custom" (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - amiserial: use memset to zero serial_state (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - amiserial: remove serial_* strings (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: drop mxser_port::custom_divisor (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: drop mxser_port::baud_base (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: remove unused mxser_port::stop_rx (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: don't allocate MXSER_PORTS + 1 (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: remove cnt from mxser_receive_chars (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_GETMSTATUS ioctl (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_GETDATACOUNT ioctl (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_CHKPORTENABLE ioctl (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_ASPP_LSTATUS ioctl (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_ASPP_MON and friends (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_SET_BAUD_METHOD ioctl (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: remove MOXA_GET_MAJOR deprecated ioctl (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: drop unused MOXA_DIAGNOSE macro (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: drop UART_MCR_AFE and UART_LSR_SPECIAL defines (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: remove else from LSR bits checks (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: extract mxser_receive_chars_old (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: extract mxser_receive_chars_new (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: simplify mxser_interrupt and drop mxser_board::vector_mask (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: extract port ISR (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: cleanup LSR handling in mxser_receive_chars (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: remove nonsense from ISR (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: drop constant board::uart_type (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: introduce enum mxser_must_hwid (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: rename mxser_board::chip_flag to must_hwid (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: rename CheckIsMoxaMust to mxser_get_must_hwid (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: cleanup Gpci_uart_info struct (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: integrate mxser.h into .c (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: drop ISA support (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - n_gsm: use goto-failpaths in gsm_init (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: mxser: drop low-latency workaround (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: check error while registering tty devices (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: mxser: fix TIOCSSERIAL jiffies conversions (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm, remove duplicates of parameters (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: do not check tty_unregister_driver's return value (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: nozomi, remove init/exit messages (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty_port: drop last traces of low_latency (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Demote obvious abuse of kernel-doc and supply other missing docss (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm, eliminate indirection for gsm->{output,error}() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Fix bogus i++ in gsm_data_kick (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Remove unnecessary test in gsm_print_packet() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Fix waking up upper tty layer when room available (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Fix SOF skipping (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Improve debug output (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - n_gsm: switch constipated to bool (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - n_gsm: switch throttled to bool (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - n_gsm: switch dead to bool (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - n_gsm: introduce enum gsm_dlci_mode (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - n_gsm: introduce enum gsm_dlci_state (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - n_gsm: drop unneeded gsm_dlci->fifo field (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Replace zero-length array with flexible-array member (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: avoid recursive locking with async port hangup (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: add helpers to convert mux-num to/from tty-base (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - docs: serial: move it to the driver-api (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - docs: serial: convert docs to ReST and rename to *.rst (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Mark expected switch fall-throughs (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - n_gsm: Constify u8 and unsigned char usage (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty: n_gsm: Add copy_config() and gsm_config() to prepare for serdev (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - mxser: switch to ->[sg]et_serial() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - amiserial: switch to ->[sg]et_serial() (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}
  - tty/serial_core: add ISO7816 infrastructure (Wander Lairson Costa) [RHEL-19954 RHEL-19955] {CVE-2023-6546}


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-513.24.1.el8_9]
changelog:
  - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-27496 RHEL-21760]
  - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-27496 RHEL-21760]
  - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-27496 RHEL-21760]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-511.el8]
changelog:
  - xfrm: add NULL check in xfrm_update_ae_params (Daniel Mendes) [2218948] {CVE-2023-3772}
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Cathy Avery) [1986067]
  - netfilter: xt_owner: Add supplementary groups option (Phil Sutter) [2136194]
  - netfilter: nf_tables: can't schedule in nft_chain_validate (Florian Westphal) [2230460]
  - drm/nouveau/nvkm/dp: Add workaround to fix DP 1.3+ DPCD issues (Karol Herbst) [2229989]
  - net: deprecate PF_KEY (Sabrina Dubroca) [RHEL-1257]
  - KVM: SEV: remove ghcb variable declarations (Vitaly Kuznetsov) [2213807]
  - KVM: SEV: only access GHCB fields once (Vitaly Kuznetsov) [2213807] {CVE-2023-4155}
  - KVM: SEV: snapshot the GHCB before accessing it (Vitaly Kuznetsov) [2213807] {CVE-2023-4155}
  - Documentation/x86: Fix backwards on/off logic about YMM support (Waiman Long) [2229884] {CVE-2022-40982}
  - KVM: Add GDS_NO support to KVM (Waiman Long) [2229884] {CVE-2022-40982}
  - x86/speculation: Add Kconfig option for GDS (Waiman Long) [2229884] {CVE-2022-40982}
  - x86/speculation: Add force option to GDS mitigation (Waiman Long) [2229884] {CVE-2022-40982}
  - x86/speculation: Add Gather Data Sampling mitigation (Waiman Long) [2229884] {CVE-2022-40982}
  - x86/bugs: Use sysfs_emit() (Waiman Long) [2229884]
  - Documentation/ABI: Mention retbleed vulnerability info file for sysfs (Waiman Long) [2229884]
  - docs/kernel-parameters: Update descriptions for "mitigations=" param with retbleed (Waiman Long) [2229884]
  - arm64: correct the effect of mitigations off on kpti (Waiman Long) [2229884]
  - x86/speculation: Add missing srbds=off to the mitigations= help text (Waiman Long) [2229884]
  - usb: typec: ucsi: Mark dGPUs as DEVICE scope (Desnes Nunes) [2222463]
  - i2c: nvidia-gpu: Remove ccgx,firmware-build property (Desnes Nunes) [2222463]
  - usb: typec: ucsi_ccg: Add OF support (Desnes Nunes) [2222463]
  - usb: typec: ucsi/ucsi_ccg: Convert to i2c's .probe_new() (Desnes Nunes) [2222463]
  - i2c: nvidia-gpu: Add ACPI property to align with device-tree (Desnes Nunes) [2222463]
  - dt-bindings: usb: Add Cypress cypd4226 Type-C controller (Desnes Nunes) [2222463]
  - i2c: designware-pci: Switch to use i2c_new_ccgx_ucsi() (Desnes Nunes) [2222463]
  - i2c: nvidia-gpu: Convert to use dev_err_probe() (Desnes Nunes) [2222463]
  - i2c: nvidia-gpu: Use temporary variable for struct device (Desnes Nunes) [2222463]
  - i2c: nvidia-gpu: Switch to use i2c_new_ccgx_ucsi() (Desnes Nunes) [2222463]
  - i2c: Remove support for dangling device properties (Desnes Nunes) [2222463]
  - i2c: nvidia-gpu: Constify the software node (Desnes Nunes) [2222463]
  - i2c: nvidia-gpu: Use PTR_ERR_OR_ZERO() to simplify code (Desnes Nunes) [2222463]
  - i2c: nvidia-gpu: convert to use i2c_new_client_device() (Desnes Nunes) [2222463]
  - i2c: Add support for software nodes (Desnes Nunes) [2222463]
  - i2c: Introduce common module to instantiate CCGx UCSI (Desnes Nunes) [2222463]
  - power: supply: Fix logic checking if system is running from battery (Desnes Nunes) [2222463]
  - redhat: support virtio-mem on x86-64 as tech-preview (David Hildenbrand) [2229123]
  - virtio/virtio_mem: handle a possible NULL as a memcpy parameter (David Hildenbrand) [2229123]
  - virtio-mem: support VIRTIO_MEM_F_UNPLUGGED_INACCESSIBLE (David Hildenbrand) [2229123]
  - virtio-mem: disallow mapping virtio-mem memory via /dev/mem (David Hildenbrand) [2229123]
  - kernel/resource: disallow access to exclusive system RAM regions (David Hildenbrand) [2229123]
  - kernel/resource: clean up and optimize iomem_is_exclusive() (David Hildenbrand) [2229123]
  - virtio-mem: kdump mode to sanitize /proc/vmcore access (David Hildenbrand) [2229123]
  - virtio-mem: factor out hotplug specifics from virtio_mem_remove() into virtio_mem_deinit_hotplug() (David Hildenbrand) [2229123]
  - virtio-mem: factor out hotplug specifics from virtio_mem_probe() into virtio_mem_init_hotplug() (David Hildenbrand) [2229123]
  - virtio-mem: factor out hotplug specifics from virtio_mem_init() into virtio_mem_init_hotplug() (David Hildenbrand) [2229123]
  - proc/vmcore: fix possible deadlock on concurrent mmap and read (David Hildenbrand) [2229123]
  - proc/vmcore: don't fake reading zeroes on surprise vmcore_cb unregistration (David Hildenbrand) [2229123]
  - proc/vmcore: fix clearing user buffer by properly using clear_user() (David Hildenbrand) [2229123]
  - proc/vmcore: convert oldmem_pfn_is_ram callback to more generic vmcore callbacks (David Hildenbrand) [2229123]
  - proc/vmcore: let pfn_is_ram() return a bool (David Hildenbrand) [2229123]
  - x86/xen: print a warning when HVMOP_get_mem_type fails (David Hildenbrand) [2229123]
  - x86/xen: simplify xen_oldmem_pfn_is_ram() (David Hildenbrand) [2229123]
  - x86/xen: update xen_oldmem_pfn_is_ram() documentation (David Hildenbrand) [2229123]
  - virtio-mem: fix sleeping in RCU read side section in virtio_mem_online_page_cb() (David Hildenbrand) [2229123]
  - virtio-mem: prioritize unplug from ZONE_MOVABLE in Big Block Mode (David Hildenbrand) [2229123]
  - virtio-mem: simplify high-level unplug handling in Big Block Mode (David Hildenbrand) [2229123]
  - virtio-mem: prioritize unplug from ZONE_MOVABLE in Sub Block Mode (David Hildenbrand) [2229123]
  - virtio-mem: simplify high-level unplug handling in Sub Block Mode (David Hildenbrand) [2229123]
  - virtio-mem: simplify high-level plug handling in Sub Block Mode (David Hildenbrand) [2229123]
  - virtio-mem: use page_zonenum() in virtio_mem_fake_offline() (David Hildenbrand) [2229123]
  - virtio-mem: don't read big block size in Sub Block Mode (David Hildenbrand) [2229123]
  - fs/proc/kcore: use page_offline_(freeze|thaw) (David Hildenbrand) [2229123]
  - virtio-mem: use page_offline_(start|end) when setting PageOffline() (David Hildenbrand) [2229123]
  - mm: introduce page_offline_(begin|end|freeze|thaw) to synchronize setting PageOffline() (David Hildenbrand) [2229123]
  - fs/proc/kcore: don't read offline sections, logically offline pages and hwpoisoned pages (David Hildenbrand) [2229123]
  - fs/proc/kcore: pfn_is_ram check only applies to KCORE_RAM (David Hildenbrand) [2229123]
  - fs/proc/kcore: drop KCORE_REMAP and KCORE_OTHER (David Hildenbrand) [2229123]
  - proc/kcore: Remove unused kclist_add_remap() (David Hildenbrand) [2229123]
  - x86/gart: Exclude GART aperture from kcore (David Hildenbrand) [2229123]
  - kernel/resource: remove first_lvl / siblings_only logic (David Hildenbrand) [2229123]
  - kernel/resource: make walk_mem_res() find all busy IORESOURCE_MEM resources (David Hildenbrand) [2229123]
  - kernel/resource: make walk_system_ram_res() find all busy IORESOURCE_SYSTEM_RAM resources (David Hildenbrand) [2229123]
  - kernel/resource.c: fix kernel-doc markups (David Hildenbrand) [2229123]
  - resource: avoid unnecessary lookups in find_next_iomem_res() (David Hildenbrand) [2229123]
  - resource: fix locking in find_next_iomem_res() (David Hildenbrand) [2229123]
  - virtio-mem: check against mhp_get_pluggable_range() which memory we can hotplug (David Hildenbrand) [2229123]
  - virtio-mem: Assign boolean values to a bool variable (David Hildenbrand) [2229123]
  - mm/memory_hotplug: MEMHP_MERGE_RESOURCE -> MHP_MERGE_RESOURCE (David Hildenbrand) [2229123]
  - virtio-mem: Big Block Mode (BBM) - safe memory hotunplug (David Hildenbrand) [2229123]
  - virtio-mem: Big Block Mode (BBM) - basic memory hotunplug (David Hildenbrand) [2229123]
  - mm/memory_hotplug: extend offline_and_remove_memory() to handle more than one memory block (David Hildenbrand) [2229123]
  - virtio-mem: allow to force Big Block Mode (BBM) and set the big block size (David Hildenbrand) [2229123]
  - virtio-mem: Big Block Mode (BBM) memory hotplug (David Hildenbrand) [2229123]
  - virtio-mem: factor out adding/removing memory from Linux (David Hildenbrand) [2229123]
  - virtio-mem: memory notifier callbacks are specific to Sub Block Mode (SBM) (David Hildenbrand) [2229123]
  - virito-mem: existing (un)plug functions are specific to Sub Block Mode (SBM) (David Hildenbrand) [2229123]
  - virtio-mem: memory block ids are specific to Sub Block Mode (SBM) (David Hildenbrand) [2229123]
  - virtio-mem: nb_sb_per_mb and subblock_size are specific to Sub Block Mode (SBM) (David Hildenbrand) [2229123]
  - virito-mem: subblock states are specific to Sub Block Mode (SBM) (David Hildenbrand) [2229123]
  - virtio-mem: memory block states are specific to Sub Block Mode (SBM) (David Hildenbrand) [2229123]
  - virito-mem: document Sub Block Mode (SBM) (David Hildenbrand) [2229123]
  - virtio-mem: generalize handling when memory is getting onlined deferred (David Hildenbrand) [2229123]
  - virtio-mem: don't always trigger the workqueue when offlining memory (David Hildenbrand) [2229123]
  - virtio-mem: drop last_mb_id (David Hildenbrand) [2229123]
  - virtio-mem: generalize virtio_mem_overlaps_range() (David Hildenbrand) [2229123]
  - virtio-mem: generalize virtio_mem_owned_mb() (David Hildenbrand) [2229123]
  - virtio-mem: generalize check for added memory (David Hildenbrand) [2229123]
  - virtio-mem: retry fake-offlining via alloc_contig_range() on ZONE_MOVABLE (David Hildenbrand) [2229123]
  - virtio-mem: factor out handling of fake-offline pages in memory notifier (David Hildenbrand) [2229123]
  - virtio-mem: factor out fake-offlining into virtio_mem_fake_offline() (David Hildenbrand) [2229123]
  - virtio-mem: print debug messages from virtio_mem_send_*_request() (David Hildenbrand) [2229123]
  - virtio-mem: factor out calculation of the bit number within the subblock bitmap (David Hildenbrand) [2229123]
  - virtio-mem: use "unsigned long" for nr_pages when fake onlining/offlining (David Hildenbrand) [2229123]
  - virtio-mem: drop rc2 in virtio_mem_mb_plug_and_add() (David Hildenbrand) [2229123]
  - virtio-mem: simplify MAX_ORDER - 1 / pageblock_order handling (David Hildenbrand) [2229123]
  - virtio-mem: more precise calculation in virtio_mem_mb_state_prepare_next_mb() (David Hildenbrand) [2229123]
  - virtio-mem: determine nid only once using memory_add_physaddr_to_nid() (David Hildenbrand) [2229123]
  - MAINTAINERS: add URL for virtio-mem (David Hildenbrand) [2229123]
  - virtio-mem: Constify mem_id_table (David Hildenbrand) [2229123]
  - kernel/resource: make iomem_resource implicit in release_mem_region_adjustable() (David Hildenbrand) [2229123]
  - virtio-mem: try to merge system ram resources (David Hildenbrand) [2229123]
  - mm/memory_hotplug: MEMHP_MERGE_RESOURCE to specify merging of System RAM resources (David Hildenbrand) [2229123]
  - mm/memory_hotplug: prepare passing flags to add_memory() and friends (David Hildenbrand) [2229123]
  - mm/memory_hotplug: guard more declarations by CONFIG_MEMORY_HOTPLUG (David Hildenbrand) [2229123]
  - include/linux/memory_hotplug.h: move definitions of {set,clear}_zone_contiguous (David Hildenbrand) [2229123]
  - kernel/resource: make release_mem_region_adjustable() never fail (David Hildenbrand) [2229123]
  - virtio-mem: don't special-case ZONE_MOVABLE (David Hildenbrand) [2229123]
  - virtio_mem: convert to LE accessors (David Hildenbrand) [2229123]
  - virtio_mem: correct tags for config space fields (David Hildenbrand) [2229123]
  - virtio-mem: Fix build error due to improper use 'select' (David Hildenbrand) [2229123]
  - virtio-mem: add memory via add_memory_driver_managed() (David Hildenbrand) [2229123]
  - virtio-mem: silence a static checker warning (David Hildenbrand) [2229123]
  - virtio_mem: convert device block size into 64bit (David Hildenbrand) [2229123]
  - virtio-mem: drop unnecessary initialization (David Hildenbrand) [2229123]
  - virtio-mem: Don't rely on implicit compiler padding for requests (David Hildenbrand) [2229123]
  - virtio-mem: Try to unplug the complete online memory block first (David Hildenbrand) [2229123]
  - virtio-mem: Use -ETXTBSY as error code if the device is busy (David Hildenbrand) [2229123]
  - virtio-mem: Unplug subblocks right-to-left (David Hildenbrand) [2229123]
  - virtio-mem: Drop manual check for already present memory (David Hildenbrand) [2229123]
  - virtio-mem: Add parent resource for all added "System RAM" (David Hildenbrand) [2229123]
  - virtio-mem: Better retry handling (David Hildenbrand) [2229123]
  - virtio-mem: Offline and remove completely unplugged memory blocks (David Hildenbrand) [2229123]
  - mm/memory_hotplug: Introduce offline_and_remove_memory() (David Hildenbrand) [2229123]
  - virtio-mem: Allow to offline partially unplugged memory blocks (David Hildenbrand) [2229123]
  - virtio-mem: Paravirtualized memory hotunplug part 2 (David Hildenbrand) [2229123]
  - virtio-mem: Paravirtualized memory hotunplug part 1 (David Hildenbrand) [2229123]
  - virtio-mem: Allow to specify an ACPI PXM as nid (David Hildenbrand) [2229123]
  - MAINTAINERS: Add myself as virtio-mem maintainer (David Hildenbrand) [2229123]
  - virtio-mem: Paravirtualized memory hotplug (David Hildenbrand) [2229123]
  - Revert "drm/amd/display: edp do not add non-edid timings" (Jocelyn Falempe) [RHEL-845]
  - Revert "drm/amd/display: reallocate DET for dual displays with high pixel rate ratio" (Jocelyn Falempe) [RHEL-845]
  - drm/client: Fix memory leak in drm_client_modeset_probe (Jocelyn Falempe) [RHEL-845]
  - drm/client: Fix memory leak in drm_client_target_cloned (Jocelyn Falempe) [RHEL-845]
  - drm/atomic: Fix potential use-after-free in nonblocking commits (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: conditionally disable pcie lane/speed switching for SMU13 (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: share the code around SMU13 pcie parameters update (Jocelyn Falempe) [RHEL-845]
  - drm/ttm: Don't leak a resource on swapout move error (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: avoid restore process run into dead loop. (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Correct `DMUB_FW_VERSION` macro (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Fix 128b132b link loss handling (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: add a NULL pointer check (Jocelyn Falempe) [RHEL-845]
  - drm/amd: Disable PSR-SU on Parade 0803 TCON (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: fix clearing mappings for BOs that are always valid in VM (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: disable seamless boot if force_odm_combine is enabled (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Remove Phantom Pipe Check When Calculating K1 and K2 (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: fix seamless odm transitions (Jocelyn Falempe) [RHEL-845]
  - drm/dp_mst: Clear MSG_RDY flag before sending new message (Jocelyn Falempe) [RHEL-845]
  - drm/atomic: Allow vblank-enabled + self-refresh "disable" (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: perform a bounds check before filling dirty rectangles (Jocelyn Falempe) [RHEL-845]
  - drm/nouveau: bring back blit subchannel for pre nv50 GPUs (Jocelyn Falempe) [RHEL-845]
  - drm/nouveau/disp/g94: enable HDMI (Jocelyn Falempe) [RHEL-845]
  - drm/nouveau/disp: fix HDMI on gt215+ (Jocelyn Falempe) [RHEL-845]
  - drm/i915: Fix one wrong caching mode enum usage (Jocelyn Falempe) [RHEL-845]
  - drm/i915: Don't preserve dpll_hw_state for slave crtc in Bigjoiner (Jocelyn Falempe) [RHEL-845]
  - drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: ti-sn65dsi86: Fix auxiliary bus lifetime (Jocelyn Falempe) [RHEL-845]
  - drm/panel: simple: Add connector_type for innolux_at043tn24 (Jocelyn Falempe) [RHEL-845]
  - drm/nouveau/acr: Abort loading ACR if no firmware was found (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: add RAS POISON interrupt funcs for jpeg_v4_0 (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: add RAS POISON interrupt funcs for jpeg_v2_6 (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: separate ras irq from jpeg instance irq for UVD_POISON (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: Move jpeg ras block init to ras sw_init (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: add RAS POISON interrupt funcs for vcn_v4_0 (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: add RAS POISON interrupt funcs for vcn_v2_6 (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: separate ras irq from vcn instance irq for UVD_POISON (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: Move vcn ras block init to ras sw_init (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: Fix usage of UMC fill record in RAS (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: Fix memcpy() in sienna_cichlid_append_powerplay_table function. (Jocelyn Falempe) [RHEL-845]
  - amdgpu: validate offset_in_bo of drm_amdgpu_gem_va (Jocelyn Falempe) [RHEL-845]
  - drm/radeon: fix possible division-by-zero errors (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Fix artifacting on eDP panels when engaging freesync video mode (Jocelyn Falempe) [RHEL-845]
  - drm/amdkfd: Fix potential deallocation of previously deallocated memory. (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Fix a test dml32_rq_dlg_get_rq_reg() (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Fix a test CalculatePrefetchSchedule() (Jocelyn Falempe) [RHEL-845]
  - drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: ti-sn65dsi83: Fix enable/disable flow to meet spec (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: anx7625: Prevent endless probe loop (Jocelyn Falempe) [RHEL-845]
  - drm/nouveau: dispnv50: fix missing-prototypes warning (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: tc358767: Switch to devm MIPI-DSI helpers (Jocelyn Falempe) [RHEL-845]
  - drm/vkms: Fix RGB565 pixel conversion (Jocelyn Falempe) [RHEL-845]
  - drm: Add fixed-point helper to get rounded integer values (Jocelyn Falempe) [RHEL-845]
  - drm/vkms: isolate pixel conversion functionality (Jocelyn Falempe) [RHEL-845]
  - drm/panel: sharp-ls043t1le01: adjust mode settings (Jocelyn Falempe) [RHEL-845]
  - drm/vram-helper: fix function names in vram helper doc (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: tc358768: fix THS_TRAILCNT computation (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: tc358768: fix TXTAGOCNT computation (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: tc358768: fix THS_ZEROCNT computation (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: tc358768: fix TCLK_TRAILCNT computation (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: tc358768: fix TCLK_ZEROCNT computation (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: tc358768: fix PLL target frequency (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: tc358768: fix PLL parameters computation (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: tc358768: always enable HS video mode (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: ti-sn65dsi83: Fix enable error path (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: it6505: Move a variable assignment behind a null pointer check in receive_timing_debugfs_show() (Jocelyn Falempe) [RHEL-845]
  - drm/i915/guc/slpc: Provide sysfs for efficient freq (Jocelyn Falempe) [RHEL-845]
  - drm/i915/guc: More debug print updates - GuC SLPC (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Explicitly specify update type per plane info change (Jocelyn Falempe) [RHEL-845]
  - radeon: avoid double free in ci_dpm_init() (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: fix is_timing_changed() prototype (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Add logging for display MALL refresh setting (Jocelyn Falempe) [RHEL-845]
  - drm: use mgr->dev in drm_dbg_kms in drm_dp_add_payload_part2 (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Ensure vmin and vmax adjust for DCE (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: Validate VM ioctl flags. (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Do not update DRR while BW optimizations pending (Jocelyn Falempe) [RHEL-845]
  - drm/radeon: fix race condition UAF in radeon_gem_set_domain_ioctl (Jocelyn Falempe) [RHEL-845]
  - udmabuf: revert 'Add support for mapping hugepages (v4)' (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: fix the system hang while disable PSR (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Add wrapper to call planes and stream update (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Use dc_update_planes_and_stream (Jocelyn Falempe) [RHEL-845]
  - drm/nouveau: add nv_encoder pointer check for NULL (Jocelyn Falempe) [RHEL-845]
  - drm/nouveau/dp: check for NULL nv_connector->native_mode (Jocelyn Falempe) [RHEL-845]
  - drm/bridge: ti-sn65dsi86: Avoid possible buffer overflow (Jocelyn Falempe) [RHEL-845]
  - drm/nouveau: don't detect DSM for non-NVIDIA device (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: Modify indirect buffer packages for resubmission (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: Implement gfx9 patch functions for resubmission (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: Program gds backup address as zero if no gds allocated (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: Reset CP_VMID_PREEMPT after trailing fence signaled (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: add missing radeon secondary PCI ID (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: workaround for compute workload type on some skus (Jocelyn Falempe) [RHEL-845]
  - drm/amd: Tighten permissions on VBIOS flashing attributes (Jocelyn Falempe) [RHEL-845]
  - drm/amd: Make sure image is written to trigger VBIOS image update flow (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: edp do not add non-edid timings (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: limit DPIA link rate to HBR3 (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: vcn_4_0 set instance 0 init sched score to 1 (Jocelyn Falempe) [RHEL-845]
  - Revert "drm/amdgpu: remove TOPDOWN flags when allocating VRAM in large bar system" (Jocelyn Falempe) [RHEL-845]
  - drm:amd:amdgpu: Fix missing buffer object unlock in failure path (Jocelyn Falempe) [RHEL-845]
  - drm: panel-orientation-quirks: Change Air's quirk to support Air Plus (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: add ODM case when looking for first split pipe (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Reduce sdp bw after urgent to 90% (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: Fix power context allocation in SMU13 (Jocelyn Falempe) [RHEL-845]
  - drm/amd: Disallow s0ix without BIOS support again (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: change reserved vram info print (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: fix xclk freq on CHIP_STONEY (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs (Jocelyn Falempe) [RHEL-845]
  - drm/i915/gt: Use the correct error value when kernel_context() fails (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: fix Null pointer dereference error in amdgpu_device_recover_vram (Jocelyn Falempe) [RHEL-845]
  - drm/i915/selftests: Add some missing error propagation (Jocelyn Falempe) [RHEL-845]
  - drm/i915: Use 18 fast wake AUX sync len (Jocelyn Falempe) [RHEL-845]
  - drm/i915: Explain the magic numbers for AUX SYNC/precharge length (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: reverse mclk and fclk clocks levels for renoir (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: reverse mclk clocks levels for SMU v13.0.5 (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: resolve reboot exception for si oland (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: reverse mclk and fclk clocks levels for vangogh (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: reverse mclk and fclk clocks levels for SMU v13.0.4 (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: enable tmz by default for GC 11.0.1 (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Only wait for blank completion if OTG active (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: set gfx9 onwards APU atomics support to be true (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu/nv: update VCN 3 max HEVC encoding resolution (Jocelyn Falempe) [RHEL-845]
  - drm/ast: Fix ARM compatibility (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: Use the default reset when loading or reloading the driver (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: fix memleak in aconnector->timing_requested (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: release gpu full access after "amdgpu_device_ip_late_init" (Jocelyn Falempe) [RHEL-845]
  - drm/i915: Fix PIPEDMC disabling for a bigjoiner configuration (Jocelyn Falempe) [RHEL-845]
  - drm/i915: Disable DPLLs before disconnecting the TC PHY (Jocelyn Falempe) [RHEL-845]
  - drm/i915: Move shared DPLL disabling into CRTC disable hook (Jocelyn Falempe) [RHEL-845]
  - drm: fix drmm_mutex_init() (Jocelyn Falempe) [RHEL-845]
  - drm/amd/amdgpu: limit one queue per gang (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: Fix output of pp_od_clk_voltage (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: add missing NotifyPowerSource message mapping for SMU13.0.7 (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: don't enable secure display on incompatible platforms (Jocelyn Falempe) [RHEL-845]
  - drm/radeon: reintroduce radeon_dp_work_func content (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Have Payload Properly Created After Resume (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: reserve the old gc_11_0_*_mes.bin (Jocelyn Falempe) [RHEL-845]
  - drm/amd/amdgpu: introduce gc_*_mes_2.bin v2 (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu/gfx11: update gpu_clock_counter logic (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: refine get gpu clock counter method (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu/gfx11: Adjust gfxoff before powergating on gfx11 as well (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu/gfx10: Disable gfxoff before disabling powergating. (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu/gmc11: implement get_vbios_fb_size() (Jocelyn Falempe) [RHEL-845]
  - drm/amd/pm: fix possible power mode mismatch between driver and PMFW (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: Enable IH retry CAM on GFX9 (Jocelyn Falempe) [RHEL-845]
  - drm/amdgpu: Fix sdma v4 sw fini error (Jocelyn Falempe) [RHEL-845]
  - drm/amd: Fix an out of bounds error in BIOS parser (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Correct DML calculation to follow HW SPEC (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: fixed dcn30+ underflow issue (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: reallocate DET for dual displays with high pixel rate ratio (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Use DC_LOG_DC in the trasform pixel function (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Enable HostVM based on rIOMMU active (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: enable DPG when disabling plane for phantom pipe (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: Correct DML calculation to align HW formula (Jocelyn Falempe) [RHEL-845]
  - drm/amd/display: populate subvp cmd info only for the top pipe (Jocelyn Falempe) [RHEL-845]
  - drm/displayid: add displayid_get_header() and check bounds better (Jocelyn Falempe) [RHEL-845]
  - drm/i915: taint kernel when force probing unsupported devices (Jocelyn Falempe) [RHEL-845]
  - drm/i915/dp: prevent potential div-by-zero (Jocelyn Falempe) [RHEL-845]
  - drm/i915: Fix NULL ptr deref by checking new_crtc_state (Jocelyn Falempe) [RHEL-845]
  - drm/i915/guc: Don't capture Gen8 regs on Xe devices (Jocelyn Falempe) [RHEL-845]
  - drm/sched: Check scheduler work queue before calling timeout handling (Jocelyn Falempe) [RHEL-845]
  - drm/mipi-dsi: Set the fwnode for mipi_dsi_device (Jocelyn Falempe) [RHEL-845]
  - drm/nouveau/disp: More DP_RECEIVER_CAP_SIZE array fixes (Jocelyn Falempe) [RHEL-845]
  - drm/dsc: fix DP_DSC_MAX_BPP_DELTA_* macro values (Jocelyn Falempe) [RHEL-845]
  - drm/fbdev-generic: prohibit potential out-of-bounds access (Jocelyn Falempe) [RHEL-845]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-505.el8]
changelog:
  - gfs2: Don't deref jdesc in evict (Bob Peterson) [2214356] {CVE-2023-3212}
  - md/raid5: Don't do accounting for non-align read io (Nigel Croxon) [2183033]
  - powerpc: Don't select HAVE_IRQ_EXIT_ON_IRQ_STACK (Mamatha Inamdar) [2218348]
  - NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION (Benjamin Coddington) [2217963]
  - proc: Use PIDTYPE_TGID in next_tgid (Brian Foster) [2047252]
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Phil Sutter) [2214963] {CVE-2023-3390}
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Phil Sutter) [2214963] {CVE-2023-3390}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (Phil Sutter) [2214963] {CVE-2023-3390}
  - fanotify,audit: Allow audit to use the full permission event response (Richard Guy Briggs) [2055328]
  - fanotify: define struct members to hold response decision context (Richard Guy Briggs) [2055328]
  - fanotify: Ensure consistent variable type for response (Richard Guy Briggs) [2055328]
  - RDMA/mlx4: Prevent shift wrapping in set_user_sq_size() (Amir Tzin) [2166019]
  - RDMA/mlx: Calling qp event handler in workqueue context (mlx4 hunks only) (Amir Tzin) [2166019]
  - net/mlx4: small optimization in mlx4_en_xmit() (Amir Tzin) [2166019]
  - net/mlx4: rename two constants (Amir Tzin) [2166019]
  - RDMA/mlx4: Remove NULL check before dev_{put, hold} (Amir Tzin) [2166019]
  - ptp: mlx4: convert to .adjfine and adjust_by_scaled_ppm (Amir Tzin) [2166019]
  - mlx4: Do type_clear() for devlink ports when type_set() was called previously (Amir Tzin) [2166019]
  - cgroup: Reorganize css_set_lock and kernfs path processing (Waiman Long) [2193485]
  - cgroup: Fix build failure when CONFIG_SHRINKER_DEBUG (Waiman Long) [2193485]
  - cgroup: fix missing cpus_read_{lock,unlock}() in cgroup_transfer_tasks() (Waiman Long) [2193485]
  - cgroup: Make cgroup_get_from_id() prettier (Waiman Long) [2193485]
  - cgroup: remove obsolete comment on cgroup_on_dfl() (Waiman Long) [2193485]
  - cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach() (Waiman Long) [2193485]
  - kselftests: cgroup: update kmem test precision tolerance (Waiman Long) [2193485]
  - cgroup/cpuset: Improve cpuset_css_alloc() description (Waiman Long) [2193485]
  - selftests: cgroup: fix unsigned comparison with less than zero (Waiman Long) [2193485]
  - device_cgroup: Roll back to original exceptions after copy failure (Waiman Long) [2193485]
  - cgroup/cpuset: use hotplug_memory_notifier() directly (Waiman Long) [2193485]
  - mm: memcontrol: don't allocate cgroup swap arrays when memcg is disabled (Waiman Long) [2193485]
  - cgroup: cgroup_get_from_id() must check the looked-up kn is a directory (Waiman Long) [2193485]
  - sched/psi: Don't create cgroup PSI files when psi_disabled (Waiman Long) [2193485]
  - cgroup: Homogenize cgroup_get_from_id() return value (Waiman Long) [2193485]
  - cgroup: cgroup: Honor caller's cgroup NS when resolving cgroup id (Waiman Long) [2193485]
  - cgroup: Honor caller's cgroup NS when resolving path (Waiman Long) [2193485]
  - mm: memcontrol: introduce mem_cgroup_ino() and mem_cgroup_get_from_ino() (Waiman Long) [2193485]
  - cgroup: Use separate src/dst nodes when preloading css_sets for migration (Waiman Long) [2193485]
  - cgroup.c: add helper __cset_cgroup_from_root to cleanup duplicated codes (Waiman Long) [2193485]
  - cgroup/rstat: check updated_next only for root (Waiman Long) [2193485]
  - cgroup: rstat: explicitly put loop variant in while (Waiman Long) [2193485]
  - cgroup: return early if it is already on preloaded list (Waiman Long) [2193485]
  - cgroup: Trace event cgroup id fields should be u64 (Waiman Long) [2193485]
  - cgroup: fix a typo in comment (Waiman Long) [2193485]
  - hugetlb_cgroup: remove unused hugetlb_cgroup_from_counter macro (Waiman Long) [2193485]
  - cgroup: Make rebind_subsystems() disable v2 controllers all at once (Waiman Long) [2193485]
  - cgroup: Avoid compiler warnings with no subsystems (Waiman Long) [2193485]
  - cgroup: Fix kernel-doc (Waiman Long) [2193485]
  - kernfs: use 64bit inos if ino_t is 64bit (Waiman Long) [2193485]
  - kernfs: implement custom exportfs ops and fid type (Waiman Long) [2193485]
  - kernfs: combine ino/id lookup functions into kernfs_find_and_get_node_by_id() (Waiman Long) [2193485]
  - kernfs: kernfs_find_and_get_node_by_ino() should only look up activated nodes (Waiman Long) [2193485]
  - kernfs: use dumber locking for kernfs_find_and_get_node_by_ino() (Waiman Long) [2193485]
  - kernfs: fix ino wrap-around detection (Waiman Long) [2193485]
  - ice: prevent NULL pointer deref during reload (Petr Oros) [2153356]
  - ice: Unregister netdev and devlink_port only once (Petr Oros) [2153356]
  - ice: Fix ice module unload (Petr Oros) [2153356]
  - ice: Fix tx queue rate limit when TCs are configured (Petr Oros) [2153356]
  - ice: Fix max_rate check while configuring TX rate limits (Petr Oros) [2153356]
  - ice: Fix XDP memory leak when NIC is brought up and down (Petr Oros) [2153356]
  - ice: remove comment about not supporting driver reinit (Petr Oros) [2153356]
  - ice: block LAN in case of VF to VF offload (Petr Oros) [2153356]
  - ice: Fix stats after PF reset (Petr Oros) [2153356]
  - ice: Reset FDIR counter in FDIR init stage (Petr Oros) [2153356]
  - ice: fix wrong fallback logic for FDIR (Petr Oros) [2153356]
  - ice: add profile conflict check for AVF FDIR (Petr Oros) [2153356]
  - ice: Fix ice_cfg_rdma_fltr() to only update relevant fields (Petr Oros) [2153356]
  - ice: remove filters only if VSI is deleted (Petr Oros) [2153356]
  - ice: check if VF exists before mode check (Petr Oros) [2153356]
  - ice: xsk: disable txq irq before flushing hw (Petr Oros) [2153356]
  - ice: avoid bonding causing auxiliary plug/unplug under RTNL lock (Petr Oros) [2153356]
  - ethernet: ice: avoid gcc-9 integer overflow warning (Petr Oros) [2153356]
  - ice: don't ignore return codes in VSI related code (Petr Oros) [2153356]
  - ice: Fix DSCP PFC TLV creation (Petr Oros) [2153356]
  - ice: copy last block omitted in ice_get_module_eeprom() (Petr Oros) [2153356]
  - ice: properly alloc ICE_VSI_LB (Petr Oros) [2153356]
  - ice: xsk: Fix cleaning of XDP_TX frames (Petr Oros) [2153356]
  - ice: Mention CEE DCBX in code comment (Petr Oros) [2153356]
  - ice: Change ice_vsi_realloc_stat_arrays() to void (Petr Oros) [2153356]
  - ice: Add GPIO pin support for E823 products (Petr Oros) [2153356]
  - ice: switch: fix potential memleak in ice_add_adv_recipe() (Petr Oros) [2153356]
  - ice: Fix off by one in ice_tc_forward_to_queue() (Petr Oros) [2153356]
  - ice: Fix disabling Rx VLAN filtering with port VLAN enabled (Petr Oros) [2153356]
  - ice: fix out-of-bounds KASAN warning in virtchnl (Petr Oros) [2153356]
  - ice: Do not use WQ_MEM_RECLAIM flag for workqueue (Petr Oros) [2153356]
  - ice: remove unnecessary virtchnl_ether_addr struct use (Petr Oros) [2153356]
  - ice: introduce .irq_close VF operation (Petr Oros) [2153356]
  - ice: introduce clear_reset_state operation (Petr Oros) [2153356]
  - ice: convert vf_ops .vsi_rebuild to .create_vsi (Petr Oros) [2153356]
  - ice: introduce ice_vf_init_host_cfg function (Petr Oros) [2153356]
  - ice: add a function to initialize vf entry (Petr Oros) [2153356]
  - ice: Pull common tasks into ice_vf_post_vsi_rebuild (Petr Oros) [2153356]
  - ice: move ice_vf_vsi_release into ice_vf_lib.c (Petr Oros) [2153356]
  - ice: move vsi_type assignment from ice_vsi_alloc to ice_vsi_cfg (Petr Oros) [2153356]
  - ice: refactor VSI setup to use parameter structure (Petr Oros) [2153356]
  - ice: drop unnecessary VF parameter from several VSI functions (Petr Oros) [2153356]
  - ice: fix function comment referring to ice_vsi_alloc (Petr Oros) [2153356]
  - ice: Add more usage of existing function ice_get_vf_vsi(vf) (Petr Oros) [2153356]
  - ice: implement devlink reinit action (Petr Oros) [2153356]
  - ice: update VSI instead of init in some case (Petr Oros) [2153356]
  - ice: move VSI delete outside deconfig (Petr Oros) [2153356]
  - ice: sync netdev filters after clearing VSI (Petr Oros) [2153356]
  - ice: split probe into smaller functions (Petr Oros) [2153356]
  - ice: stop hard coding the ICE_VSI_CTRL location (Petr Oros) [2153356]
  - ice: split ice_vsi_setup into smaller functions (Petr Oros) [2153356]
  - ice: cleanup in VSI config/deconfig code (Petr Oros) [2153356]
  - ice: alloc id for RDMA using xa_array (Petr Oros) [2153356]
  - ice: move RDMA init to ice_idc.c (Petr Oros) [2153356]
  - ice: Prevent set_channel from changing queues while RDMA active (Petr Oros) [2153356]
  - ice: Remove redundant pci_enable_pcie_error_reporting() (Petr Oros) [2153356]
  - ice: move devlink port creation/deletion (Petr Oros) [2153356]
  - ice: Remove excess space (Petr Oros) [2153356]
  - ice: Introduce local var for readability (Petr Oros) [2153356]
  - ice: Match parameter name for ice_cfg_phy_fc() (Petr Oros) [2153356]
  - ice: Explicitly return 0 (Petr Oros) [2153356]
  - ice: Reduce scope of variables (Petr Oros) [2153356]
  - ice: Move support DDP code out of ice_flex_pipe.c (Petr Oros) [2153356]
  - ice: Remove cppcheck suppressions (Petr Oros) [2153356]
  - ice: combine cases in ice_ksettings_find_adv_link_speed() (Petr Oros) [2153356]
  - ice: Add support for 100G KR2/CR2/SR2 link reporting (Petr Oros) [2153356]
  - ice: add missing checks for PF vsi type (Petr Oros) [2153356]
  - ice: remove redundant non-null check in ice_setup_pf_sw() (Petr Oros) [2153356]
  - ice: restrict PTP HW clock freq adjustments to 100, 000, 000 PPB (Petr Oros) [2153356]
  - ice: Support drop action (Petr Oros) [2153356]
  - ice: Handle LLDP MIB Pending change (Petr Oros) [2153356]
  - ice: Add 'Execute Pending LLDP MIB' Admin Queue command (Petr Oros) [2153356]
  - ice: xsk: do not use xdp_return_frame() on tx_buf->raw_buf (Petr Oros) [2153356]
  - ice: Use ICE_RLAN_BASE_S instead of magic number (Petr Oros) [2153356]
  - ice: Accumulate ring statistics over reset (Petr Oros) [2153356]
  - ice: Accumulate HW and Netdev statistics over reset (Petr Oros) [2153356]
  - ice: Remove and replace ice speed defines with ethtool.h versions (Petr Oros) [2153356]
  - ice: Check for PTP HW lock more frequently (Petr Oros) [2153356]
  - ice: Fix spurious interrupt during removal of trusted VF (Petr Oros) [2153356]
  - ice: Enable RX queue selection using skbedit action (Petr Oros) [2153356]
  - ice: Add support for VLAN priority filters in switchdev (Petr Oros) [2153356]
  - ice: support features on new E810T variants (Petr Oros) [2153356]
  - ice: xsk: drop power of 2 ring size restriction for AF_XDP (Petr Oros) [2153356]
  - ice: xsk: change batched Tx descriptor cleaning (Petr Oros) [2153356]
  - ice: reorder PF/representor devlink port register/unregister flows (Petr Oros) [2153356]
  - ice: Add L2TPv3 hardware offload support (Petr Oros) [2153356]
  - ice: Simplify memory allocation in ice_sched_init_port() (Petr Oros) [2153356]
  - ice: switch: Simplify memory allocation (Petr Oros) [2153356]
  - ice: add helper function to check FW API version (Petr Oros) [2153356]
  - ice: Print human-friendly PHY types (Petr Oros) [2153356]
  - ice: Add support for ip TTL & ToS offload (Petr Oros) [2153356]
  - ice: xsk: use Rx ring's XDP ring when picking NAPI context (Petr Oros) [2153356]
  - ice: xsk: prohibit usage of non-balanced queue id (Petr Oros) [2153356]
  - ice: remove non-inclusive language (Petr Oros) [2153356]
  - ice: Remove ucast_shared (Petr Oros) [2153356]
  - ice: Allow 100M speeds for some devices (Petr Oros) [2153356]
  - ice: Implement FCS/CRC and VLAN stripping co-existence policy (Petr Oros) [2153356]
  - ice: Implement control of FCS/CRC stripping (Petr Oros) [2153356]
  - ice: initialize cached_phctime when creating Rx rings (Petr Oros) [2153356]
  - ice: set tx_tstamps when creating new Tx rings via ethtool (Petr Oros) [2153356]
  - ice: link representors to PCI device (Petr Oros) [2153356]
  - ice, xsk: Avoid refilling single Rx descriptors (Petr Oros) [2153356]
  - ice, xsk: Diversify return values from xsk_wakeup call paths (Petr Oros) [2153356]
  - ice, xsk: Terminate Rx side of NAPI when XSK Rx queue gets full (Petr Oros) [2153356]
  - ice, xsk: Decorate ICE_XDP_REDIR with likely() (Petr Oros) [2153356]
  - ice: xsk: check if Rx ring was filled up to the end (Petr Oros) [2153356]
  - ice: xsk: Eliminate unnecessary loop iteration (Petr Oros) [2153356]
  - ice: xsk: fix GCC version checking against pragma unroll presence (Petr Oros) [2153356]
  - ice: xsk: Borrow xdp_tx_active logic from i40e (Petr Oros) [2153356]
  - ice: xsk: Improve AF_XDP ZC Tx and use batching API (Petr Oros) [2153356]
  - ice: xsk: Avoid potential dead AF_XDP Tx processing (Petr Oros) [2153356]
  - ice: Make Tx threshold dependent on ring length (Petr Oros) [2153356]
  - ice: xsk: Handle SW XDP ring wrap and bump tail more often (Petr Oros) [2153356]
  - ice: xsk: Force rings to be sized to power of 2 (Petr Oros) [2153356]
  - ice: xsk: do not clear status_error0 for ntu + nb_buffs descriptor (Petr Oros) [2153356]
  - ice: remove dead store on XSK hotpath (Petr Oros) [2153356]
  - ice: xsk: clear status_error0 for each allocated desc (Petr Oros) [2153356]
  - intel: Simplify bool conversion (Petr Oros) [2153356]
  - ice: Use the xsk batched rx allocation interface (Petr Oros) [2153356]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-506.el8]
changelog:
  - libceph: harden msgr2.1 frame segment length checks (Ilya Dryomov) [2222256]
  - netfilter: nf_conntrack_netlink: need to hold rcu readlock when doing l4proto lookup (Florian Westphal) [2188230]
  - net/mlx5: Expose steering dropped packets counter (Amir Tzin) [2223198]
  - net/mlx5: Expose vnic diagnostic counters for eswitch managed vports (Amir Tzin) [2223198]
  - igbvf: add PCI reset handler functions (Corinna Vinschen) [2153365]
  - igbvf: Regard vf reset nack as success (Corinna Vinschen) [2153365]
  - intel/igbvf: free irq on the error path in igbvf_request_msix() (Corinna Vinschen) [2153365]
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_disconnect_{req,rsp} (Ricardo Robaina) [2139617] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix build errors in some archs (Ricardo Robaina) [2139617] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix l2cap_global_chan_by_psm regression (Ricardo Robaina) [2139617] {CVE-2022-3640}
  - Bluetooth: L2CAP: fix use-after-free in l2cap_conn_del() (Ricardo Robaina) [2139617] {CVE-2022-3640}
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (Ricardo Robaina) [2139617] {CVE-2022-3640}
  - iavf: fix reset task race with iavf_remove() (Petr Oros) [2223604]
  - iavf: fix a deadlock caused by rtnl and driver's lock circular dependencies (Petr Oros) [2223604]
  - Revert "iavf: Do not restart Tx queues after reset task failure" (Petr Oros) [2223604]
  - Revert "iavf: Detach device during reset task" (Petr Oros) [2223604]
  - iavf: Wait for reset in callbacks which trigger it (Petr Oros) [2223604]
  - iavf: use internal state to free traffic IRQs (Petr Oros) [2223604]
  - iavf: Fix out-of-bounds when setting channels on remove (Petr Oros) [2223604]
  - iavf: Fix use-after-free in free_netdev (Petr Oros) [2223604]
  - iavf: make functions static where possible (Petr Oros) [2223604]
  - iavf: fix err handling for MAC replace (Petr Oros) [2223604]
  - iavf: remove some unused functions and pointless wrappers (Petr Oros) [2223604]
  - iavf: remove mask from iavf_irq_enable_queues() (Petr Oros) [2223604]
  - iavf: send VLAN offloading caps once after VFR (Petr Oros) [2223604]
  - cpufreq: Fix parameter in parse_perf_domain() (Mark Langsdorf) [2181273]
  - cpufreq: intel_pstate: remove MODULE_LICENSE in non-modules (Mark Langsdorf) [2181273]
  - cpufreq: intel_pstate: Adjust balance_performance EPP for Sapphire Rapids (Mark Langsdorf) [2181273]
  - cpufreq: Make kobj_type structure constant (Mark Langsdorf) [2181273]
  - driver core: make kobj_type constant. (Mark Langsdorf) [2181273]
  - cpufreq: Make cpufreq_unregister_driver() return void (Mark Langsdorf) [2181273]
  - drivers/cpufreq: Remove "select SRCU" (Mark Langsdorf) [2181273]
  - cpufreq: intel_pstate: Drop ACPI _PSS states table patching (Mark Langsdorf) [2181273]
  - cpufreq: stats: Convert to use sysfs_emit_at() API (Mark Langsdorf) [2181273]
  - cpufreq: Init completion before kobject_init_and_add() (Mark Langsdorf) [2181273]
  - cpufreq: intel_pstate: Allow EPP 0x80 setting by the firmware (Mark Langsdorf) [2181273]
  - cpufreq: ACPI: Use str_enabled_disabled() helper (Mark Langsdorf) [2181273]
  - cpufreq: Generalize of_perf_domain_get_sharing_cpumask phandle format (Mark Langsdorf) [2181273]
  - cpufreq: Add of_perf_domain_get_sharing_cpumask (Mark Langsdorf) [2181273]
  - cpufreq: intel_pstate: Read all MSRs on the target CPU (Mark Langsdorf) [2181273]
  - ACPI: CPPC: Add ACPI disabled check to acpi_cpc_valid() (Mark Langsdorf) [2181273]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-507.el8]
changelog:
  - Revert "NFSv4: Retry LOCK on OLD_STATEID during delegation return" (Benjamin Coddington) [2217658]
  - powerpc/pseries/vas: Hold mmap_mutex after mmap lock during window close (Mamatha Inamdar) [2224883]
  - KVM: x86/mmu: Fix race condition in direct_page_fault (Jon Maloy) [2179929] {CVE-2022-45869}
  - x86/speculation: Allow enabling STIBP with legacy IBRS (Ricardo Robaina) [2187268] {CVE-2023-1998}
  - ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep() (Mark Langsdorf) [2215625]
  - locking/semaphore: Add might_sleep() to down_*() family (Mark Langsdorf) [2215625]
  - perf stat: Support hybrid --topdown option (Michael Petlan) [2088833]
  - i40e: Wait for pending VF reset in VF set callbacks (Ivan Vecera) [2203921]
  - i40e: Add helper for VF inited state check with timeout (Ivan Vecera) [2203921]
  - tracing: Have filter accept "common_cpu" to be consistent (Jerome Marchand) [2210711]
  - tracing/histogram: Fix sorting on old "cpu" value (Jerome Marchand) [2210711]
  - tracing: Dump stacktrace trigger to the corresponding instance (Jerome Marchand) [2210711]
  - tracing/histogram: Rename "cpu" to "common_cpu" (Jerome Marchand) [2210711]
  - docs: histogram.txt: convert it to ReST file format (Jerome Marchand) [2210711]
  - bonding: add software tx timestamping support (Hangbin Liu) [2181339]
  - bonding: fix missed rcu protection (Hangbin Liu) [2181339]
  - bonding: use rcu_dereference_rtnl when get bonding active slave (Hangbin Liu) [2181339]
  - Bonding: return HWTSTAMP_FLAG_BONDED_PHC_INDEX to notify user space (Hangbin Liu) [2181339]
  - Bonding: force user to add HWTSTAMP_FLAG_BONDED_PHC_INDEX when get/set HWTSTAMP (Hangbin Liu) [2181339]
  - bond: pass get_ts_info and SIOC[SG]HWTSTAMP ioctl to active device (Hangbin Liu) [2181339]
  - mm/page_alloc: fix incorrect PGFREE and PGALLOC for high-order page (Chris von Recklinghausen) [2100592]
  - mm/page_alloc: check high-order pages for corruption during PCP operations (Chris von Recklinghausen) [2100592]
  - mm/page_alloc: do not prefetch buddies during bulk free (Chris von Recklinghausen) [2100592]
  - mm/page_alloc: free pages in a single pass during bulk free (Chris von Recklinghausen) [2100592]
  - mm/page_alloc: drain the requested list first during bulk free (Chris von Recklinghausen) [2100592]
  - mm/page_alloc: simplify how many pages are selected per pcp list during bulk free (Chris von Recklinghausen) [2100592]
  - mm/page_alloc: track range of active PCP lists during bulk free (Chris von Recklinghausen) [2100592]
  - mm/page_alloc: fetch the correct pcp buddy during bulk free (Chris von Recklinghausen) [2100592]
  - mm/page_alloc: allow high-order pages to be stored on the per-cpu lists (Chris von Recklinghausen) [2100592]
  - mm/page_alloc: move free_the_page (Chris von Recklinghausen) [2100592]
  - mm,memory_hotplug: factor out adjusting present pages into adjust_present_page_count() (Chris von Recklinghausen) [2100592]
  - mm, meminit: recalculate pcpu batch and high limits after init completes (Chris von Recklinghausen) [2100592]
  - compiler_attributes.h: Add kABI workaround (Waiman Long) [2215801]
  - linux/compiler-clang.h: define HAVE_BUILTIN_BSWAP* (Waiman Long) [2215801]
  - compiler.h: fix barrier_data() on clang (Waiman Long) [2215801]
  - compiler_types.h: Add __no_sanitize_{address,undefined} to noinstr (Waiman Long) [2215801]
  - x86, kcsan: Add __no_kcsan to noinstr (Waiman Long) [2215801]
  - kcsan: Add __no_kcsan function attribute (Waiman Long) [2215801]
  - kcsan: Reorganize compiler.h (Waiman Long) [2215801]
  - include/linux/compiler*.h: fix OPTIMIZER_HIDE_VAR (Waiman Long) [2215801]
  - include/linux/compiler_types.h: don't pollute userspace with macro definitions (Waiman Long) [2215801]
  - include/linux/compiler*.h: define asm_volatile_goto (Waiman Long) [2215801]
  - Compiler Attributes: use feature checks instead of version checks (Waiman Long) [2215801]
  - Compiler Attributes: remove unneeded sparse (__CHECKER__) tests (Waiman Long) [2215801]
  - Compiler Attributes: homogenize __must_be_array (Waiman Long) [2215801]
  - Compiler Attributes: remove unneeded tests (Waiman Long) [2215801]
  - Compiler Attributes: always use the extra-underscores syntax (Waiman Long) [2215801]
  - Compiler Attributes: remove unused attributes (Waiman Long) [2215801]
  - Compiler Attributes: naked can be shared (Waiman Long) [2215801]
  - Compiler Attributes: naked was fixed in gcc 4.6 (Waiman Long) [2215801]
  - include/linux/compiler*.h: make compiler-*.h mutually exclusive (Waiman Long) [2215801]
  - Raise the minimum required gcc version to 4.6 (Waiman Long) [2215801]
  - deprecate the '__deprecated' attribute warnings entirely and for good (Waiman Long) [2215801]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-508.el8]
changelog:
  - HID: betop: check shape of output reports (Desnes Nunes) [2212164] {CVE-2023-1073}
  - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() (Desnes Nunes) [2153575] {CVE-2022-45887}
  - selinux: make labeled NFS work when mounted before policy load (Juraj Marcin) [1753646]
  - Revert "xfs: expose the blockgc workqueue knobs publicly" (Bill O'Donnell) [2223260]
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Dean Nelson) [2215904] {CVE-2023-35824}
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Dean Nelson) [2213142] {CVE-2023-31084}
  - drm/ast: report connection status on Display Port. (Jocelyn Falempe) [2189645]
  - drm/ast: Add BMC virtual connector (Jocelyn Falempe) [2189645]
  - x86/cpu/amd: Add a Zenbleed fix (Waiman Long) [2226832] {CVE-2023-20593}
  - x86/cpu/amd: Move the errata checking functionality up (Waiman Long) [2226832] {CVE-2023-20593}
  - x86/amd: Cache debug register values in percpu variables (Waiman Long) [2226832] {CVE-2023-20593}
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Waiman Long) [2226832] {CVE-2023-20593}
  - x86/sev: Change snp_guest_issue_request()'s fw_err argument (John Allen) [2216284]
  - virt/coco/sev-guest: Double-buffer messages (John Allen) [2216284]
  - virt/coco/sev-guest: Add throttling awareness (John Allen) [2216284]
  - virt/coco/sev-guest: Convert the sw_exit_info_2 checking to a switch-case (John Allen) [2216284]
  - virt/coco/sev-guest: Do some code style cleanups (John Allen) [2216284]
  - virt/coco/sev-guest: Carve out the request issuing logic into a helper (John Allen) [2216284]
  - virt/coco/sev-guest: Remove the disable_vmpck label in handle_guest_request() (John Allen) [2216284]
  - virt/coco/sev-guest: Simplify extended guest request handling (John Allen) [2216284]
  - virt/coco/sev-guest: Check SEV_SNP attribute at probe time (John Allen) [2216284]
  - virt/sev-guest: Return -EIO if certificate buffer is not large enough (John Allen) [2216284]
  - x86/sev: Mark snp_abort() noreturn (John Allen) [2216284]
  - s390/uv: Update query for secret-UVCs (Cédric Le Goater) [2111749]
  - s390/uv: replace scnprintf with sysfs_emit (Cédric Le Goater) [2111749]
  - s390: Add attestation query information (Cédric Le Goater) [2111749]
  - s390/uvdevice: Add 'Lock Secret Store' UVC (Cédric Le Goater) [2111749]
  - s390/uvdevice: Add 'List Secrets' UVC (Cédric Le Goater) [2111749]
  - s390/uvdevice: Add 'Add Secret' UVC (Cédric Le Goater) [2111749]
  - s390/uvdevice: Add info IOCTL (Cédric Le Goater) [2111749]
  - s390/uv: Always export uv_info (Cédric Le Goater) [2111749]
  - s390/kasan: support protvirt with 4-level paging (Cédric Le Goater) [2111749]
  - s390/protvirt: support ultravisor without secure storage limit (Cédric Le Goater) [2111749]
  - s390/protvirt: parse prot_virt option in the decompressor (Cédric Le Goater) [2111749]
  - s390/mm: avoid trimming to MAX_ORDER (Cédric Le Goater) [2111749]
  - net/mlx5e: TC, CT: Offload ct clear only once (Amir Tzin) [2159233]
  - net/mlx5: DR, Fix wrong action data allocation in decap action (Amir Tzin) [2159233]
  - net/mlx5: DR, Support SW created encap actions for FW table (Amir Tzin) [2159233]
  - net/mlx5e: TC, Cleanup ct resources for nic flow (Amir Tzin) [2159233]
  - net/mlx5e: TC, Add null pointer check for hardware miss support (Amir Tzin) [2159233]
  - RDMA/mlx5: Fix affinity assignment (Amir Tzin) [2159233]
  - RDMA/mlx5: Create an indirect flow table for steering anchor (Amir Tzin) [2159233]
  - RDMA/mlx5: Initiate dropless RQ for RAW Ethernet functions (Amir Tzin) [2159233]
  - net/mlx5: DR, Add missing mutex init/destroy in pattern manager (Amir Tzin) [2117777]
  - net/mlx5: Read embedded cpu after init bit cleared (Amir Tzin) [2159233]
  - net/mlx5e: Fix error handling in mlx5e_refresh_tirs (Amir Tzin) [2159233]
  - net/mlx5e: Don't attach netdev profile while handling internal error (Amir Tzin) [2159233]
  - net/mlx5: Fix post parse infra to only parse every action once (Amir Tzin) [2159233]
  - net/mlx5: fw_tracer, Fix event handling (Amir Tzin) [2159233]
  - net/mlx5: SF, Drain health before removing device (Amir Tzin) [2159233]
  - net/mlx5e: Consider internal buffers size in port buffer calculations (Amir Tzin) [2159233]
  - net/mlx5e: Prevent encap offload when neigh update is running (Amir Tzin) [2159233]
  - net/mlx5e: Extract remaining tunnel encap code to dedicated file (Amir Tzin) [2159233]
  - net/mlx5e: TC, Remove sample and ct limitation (Amir Tzin) [2159233]
  - net/mlx5e: TC, Remove mirror and ct limitation (Amir Tzin) [2159233]
  - net/mlx5e: TC, Remove tuple rewrite and ct limitation (Amir Tzin) [2159233]
  - net/mlx5e: TC, Remove multiple ct actions limitation (Amir Tzin) [2159233]
  - net/mlx5e: TC, Remove special handling of CT action (Amir Tzin) [2159233]
  - net/mlx5e: TC, Remove CT action reordering (Amir Tzin) [2159233]
  - net/mlx5e: CT: Use per action stats (Amir Tzin) [2159233]
  - net/mlx5e: TC, Move main flow attribute cleanup to helper func (Amir Tzin) [2159233]
  - net/mlx5e: TC, Remove unused vf_tun variable (Amir Tzin) [2159233]
  - net/mlx5e: Set default can_offload action (Amir Tzin) [2159233]
  - net/mlx5: Devcom, serialize devcom registration (Amir Tzin) [2159233]
  - net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device (Amir Tzin) [2159233]
  - net/mlx5e: Fix SQ wake logic in ptp napi_poll context (Amir Tzin) [2159233]
  - net/mlx5e: Fix deadlock in tc route query code (Amir Tzin) [2159233]
  - net/mlx5: Fix error message when failing to allocate device memory (Amir Tzin) [2159233]
  - net/mlx5e: Use correct encap attribute during invalidation (Amir Tzin) [2159233]
  - net/mlx5: DR, Check force-loopback RC QP capability independently from RoCE (Amir Tzin) [2159233]
  - net/mlx5: DR, Fix crc32 calculation to work on big-endian (BE) CPUs (Amir Tzin) [2159233]
  - net/mlx5: Handle pairing of E-switch via uplink un/load APIs (Amir Tzin) [2159233]
  - net/mlx5: Collect command failures data only for known commands (Amir Tzin) [2159233]
  - net/mlx5e: do as little as possible in napi poll when budget is 0 (Amir Tzin) [2159233]
  - net/mlx5: Use recovery timeout on sync reset flow (Amir Tzin) [2159233]
  - net/mlx5: DR, Add memory statistics for domain object (Amir Tzin) [2117777]
  - net/mlx5: DR, Add more info in domain dbg dump (Amir Tzin) [2117777]
  - net/mlx5: DR, Calculate sync threshold of each pool according to its type (Amir Tzin) [2117777]
  - net/mlx5: DR, Fix dumping of legacy modify_hdr in debug dump (Amir Tzin) [2117777]
  - net/mlx5: DR, Enable patterns and arguments for supporting devices (Amir Tzin) [2117777]
  - net/mlx5: DR, Add support for the pattern/arg parameters in debug dump (Amir Tzin) [2117777]
  - net/mlx5: DR, Modify header action of size 1 optimization (Amir Tzin) [2117777]
  - net/mlx5: DR, Support decap L3 action using pattern / arg mechanism (Amir Tzin) [2117777]
  - net/mlx5: DR, Apply new accelerated modify action and decapl3 (Amir Tzin) [2117777]
  - net/mlx5: DR, Add modify header argument pointer to actions attributes (Amir Tzin) [2117777]
  - net/mlx5: DR, Add modify header arg pool mechanism (Amir Tzin) [2117777]
  - net/mlx5: DR, Fix QP continuous allocation (Amir Tzin) [2117777]
  - net/mlx5: DR, Read ICM memory into dedicated buffer (Amir Tzin) [2117777]
  - net/mlx5: DR, Add support for writing modify header argument (Amir Tzin) [2117777]
  - net/mlx5: DR, Add create/destroy for modify-header-argument general object (Amir Tzin) [2117777]
  - net/mlx5: DR, Check for modify_header_argument device capabilities (Amir Tzin) [2117777]
  - net/mlx5: DR, Split chunk allocation to HW-dependent ways (Amir Tzin) [2117777]
  - net/mlx5: DR, Add cache for modify header pattern (Amir Tzin) [2117777]
  - net/mlx5: DR, Move ACTION_CACHE_LINE_SIZE macro to header (Amir Tzin) [2117777]
  - net/mlx5: DR, Add modify-header-pattern ICM pool (Amir Tzin) [2117777]
  - net/mlx5: DR, Prepare sending new WQE type (Amir Tzin) [2117777]
  - net/mlx5: Add new WQE for updating flow table (Amir Tzin) [2117777]
  - net/mlx5: Add mlx5_ifc bits for modify header argument (Amir Tzin) [2117777]
  - net/mlx5: DR, Set counter ID on the last STE for STEv1 TX (Amir Tzin) [2117777]
  - net/mlx5e: TC, Remove redundant parse_attr argument (Amir Tzin) [2165908]
  - net/mlx5e: Use a simpler comparison for uplink rep (Amir Tzin) [2165908]
  - net/mlx5: Lag, Add single RDMA device in multiport mode (Amir Tzin) [2165908]
  - net/mlx5: Lag, set different uplink vport metadata in multiport eswitch mode (Amir Tzin) [2165908]
  - net/mlx5: E-Switch, rename bond update function to be reused (Amir Tzin) [2165908]
  - net/mlx5e: TC, Add peer flow in mpesw mode (Amir Tzin) [2165908]
  - net/mlx5: Lag, Control MultiPort E-Switch single FDB mode (Amir Tzin) [2165908]
  - net/mlx5e: Add devlink fdb_large_groups parameter (Add missing Documentation) (Amir Tzin) [2165908]
  - SUNRPC: Fix READ_PLUS crasher (Benjamin Coddington) [2218539]
  - SUNRPC: Remove pointer type casts from xdr_get_next_encode_buffer() (Benjamin Coddington) [2218539]
  - SUNRPC: Clean up xdr_get_next_encode_buffer() (Benjamin Coddington) [2218539]
  - NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION (Benjamin Coddington) [2218539]
  - NFSv4.2: fix wrong shrinker_id (Benjamin Coddington) [2218539]
  - svcrdma: Prevent page release when nothing was received (Benjamin Coddington) [2218539]
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (Benjamin Coddington) [2218539]
  - nfsd: fix double fget() bug in __write_ports_addfd() (Benjamin Coddington) [2218539]
  - SUNRPC: Fix trace_svc_register() call site (Benjamin Coddington) [2218539]
  - SUNRPC: remove the maximum number of retries in call_bind_status (Benjamin Coddington) [2218539]
  - NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease (Benjamin Coddington) [2218539]
  - NFSD: callback request does not use correct credential for AUTH_SYS (Benjamin Coddington) [2218539]
  - sunrpc: only free unix grouplist after RCU settles (Benjamin Coddington) [2218539]
  - nfsd: call op_release, even when op_func returns an error (Benjamin Coddington) [2218539]
  - NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL (Benjamin Coddington) [2218539]
  - SUNRPC: fix shutdown of NFS TCP client socket (Benjamin Coddington) [2218539]
  - NFSv4: Fix hangs when recovering open state after a server reboot (Benjamin Coddington) [2218539]
  - NFSD: Protect against filesystem freezing (Benjamin Coddington) [2218539]
  - nfsd: fix race to check ls_layouts (Benjamin Coddington) [2218539]
  - nfs4trace: fix state manager flag printing (Benjamin Coddington) [2218539]
  - SUNRPC: ensure the matching upcall is in-flight upon downcall (Benjamin Coddington) [2218539]
  - nfsd: under NFSv4.1, fix double svc_xprt_put on rpc_create failure (Benjamin Coddington) [2218539]
  - SUNRPC: Don't leak netobj memory when gss_read_proxy_verf() fails (Benjamin Coddington) [2218539]
  - NFSv4.x: Fail client initialisation if state manager thread can't run (Benjamin Coddington) [2218539]
  - SUNRPC: Fix missing release socket in rpc_sockname() (Benjamin Coddington) [2218539]
  - xprtrdma: Fix regbuf data not freed in rpcrdma_req_create() (Benjamin Coddington) [2218539]
  - NFSD: Finish converting the NFSv3 GETACL result encoder (Benjamin Coddington) [2218539]
  - NFSD: Finish converting the NFSv2 GETACL result encoder (Benjamin Coddington) [2218539]
  - SUNRPC: Return true/false (not 1/0) from bool functions (Benjamin Coddington) [2218539]
  - NFS: Fix an Oops in nfs_d_automount() (Benjamin Coddington) [2218539]
  - NFSv4: Fix a deadlock between nfs4_open_recover_helper() and delegreturn (Benjamin Coddington) [2218539]
  - NFSv4: Fix a credential leak in _nfs4_discover_trunking() (Benjamin Coddington) [2218539]
  - NFSv4.2: Fix initialisation of struct nfs4_label (Benjamin Coddington) [2218539]
  - NFSv4.2: Fix a memory stomp in decode_attr_security_label (Benjamin Coddington) [2218539]
  - NFSv4.2: Always decode the security label (Benjamin Coddington) [2218539]
  - NFSv4.2: Clear FATTR4_WORD2_SECURITY_LABEL when done decoding (Benjamin Coddington) [2218539]
  - nfs4: Fix kmemleak when allocate slot failed (Benjamin Coddington) [2218539]
  - NFSv4.2: Fixup CLONE dest file size for zero-length count (Benjamin Coddington) [2218539]
  - SUNRPC: Fix null-ptr-deref when xps sysfs alloc failed (Benjamin Coddington) [2218539]
  - NFSv4.1: We must always send RECLAIM_COMPLETE after a reboot (Benjamin Coddington) [2218539]
  - NFSv4.1: Handle RECLAIM_COMPLETE trunking errors (Benjamin Coddington) [2218539]
  - NFSv4: Fix a potential state reclaim deadlock (Benjamin Coddington) [2218539]
  - NFSv4/pNFS: Always return layout stats on layout return for flexfiles (Benjamin Coddington) [2218539]
  - NFSD: Fix handling of oversized NFSv4 COMPOUND requests (Benjamin Coddington) [2218539]
  - nfsd: Fix a memory leak in an error handling path (Benjamin Coddington) [2218539]
  - Revert "SUNRPC: Remove unreachable error condition" (Benjamin Coddington) [2218539]
  - NFSv4: Turn off open-by-filehandle and NFS re-export for NFSv4.0 (Benjamin Coddington) [2218539]
  - SUNRPC: RPC level errors should set task->tk_rpc_status (Benjamin Coddington) [2218539]
  - NFS: Fix another fsync() issue after a server reboot (Benjamin Coddington) [2218539]
  - net/sunrpc: fix potential memory leaks in rpc_sysfs_xprt_state_change() (Benjamin Coddington) [2218539]
  - SUNRPC: Fix xdr_encode_bool() (Benjamin Coddington) [2218539]
  - SUNRPC: Reinitialise the backchannel request buffers before reuse (Benjamin Coddington) [2218539]
  - NFSv4.1: RECLAIM_COMPLETE must handle EACCES (Benjamin Coddington) [2218539]
  - sunrpc: fix expiry of auth creds (Benjamin Coddington) [2218539]
  - pNFS/flexfiles: Report RDMA connection errors to the server (Benjamin Coddington) [2218539]
  - Revert "pNFS: nfs3_set_ds_client should set NFS_CS_NOPING" (Benjamin Coddington) [2218539]
  - SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() (Benjamin Coddington) [2218539]
  - pNFS: Avoid a live lock condition in pnfs_update_layout() (Benjamin Coddington) [2218539]
  - pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE (Benjamin Coddington) [2218539]
  - SUNRPC: Trap RDMA segment overflows (Benjamin Coddington) [2218539]
  - nfsd: Fix null-ptr-deref in nfsd_fill_super() (Benjamin Coddington) [2218539]
  - NFS: Further fixes to the writeback error handling (Benjamin Coddington) [2218539]
  - NFS: clean up a needless assignment in nfs_file_write() (Benjamin Coddington) [2218539]
  - NFS: remove redundant code in nfs_file_write() (Benjamin Coddington) [2218539]
  - NFS: Add support for eager writes (Benjamin Coddington) [2218539]
  - NFS: 'flags' field should be unsigned in struct nfs_server (Benjamin Coddington) [2218539]
  - NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout (Benjamin Coddington) [2218539]
  - NFS: Memory allocation failures are not server fatal errors (Benjamin Coddington) [2218539]
  - SUNRPC: Ensure that the gssproxy client can start in a connected state (Benjamin Coddington) [2218539]
  - Revert "SUNRPC: Ensure gss-proxy connects on setup" (Benjamin Coddington) [2218539]
  - SUNRPC: Ensure gss-proxy connects on setup (Benjamin Coddington) [2218539]
  - NFSv4: Don't invalidate inode attributes on delegation return (Benjamin Coddington) [2218539]
  - SUNRPC: svc_tcp_sendmsg() should handle errors from xdr_alloc_bvec() (Benjamin Coddington) [2218539]
  - SUNRPC: Handle low memory situations in call_status() (Benjamin Coddington) [2218539]
  - SUNRPC: Handle ENOMEM in call_transmit_status() (Benjamin Coddington) [2218539]
  - SUNRPC: Fix the svc_deferred_event trace class (Benjamin Coddington) [2218539]
  - NFSv4: fix open failure with O_ACCMODE flag (Benjamin Coddington) [2218539]
  - NFSv4/pNFS: Fix another issue with a list iterator pointing to the head (Benjamin Coddington) [2218539]
  - NFSv4.1: Fix uninitialised variable in devicenotify (Benjamin Coddington) [2218539]
  - NFSv4.1: don't retry BIND_CONN_TO_SESSION on session error (Benjamin Coddington) [2218539]
  - NFS: remove unneeded check in decode_devicenotify_args() (Benjamin Coddington) [2218539]
  - NFS: NFSv2/v3 clients should never be setting NFS_CAP_XATTR (Benjamin Coddington) [2218539]
  - NFS: Do not report writeback errors in nfs_getattr() (Benjamin Coddington) [2218539]
  - NFS: Remove an incorrect revalidation in nfs4_update_changeattr_locked() (Benjamin Coddington) [2218539]
  - nfsd: nfsd4_setclientid_confirm mistakenly expires confirmed client. (Benjamin Coddington) [2218539]
  - SUNRPC: Fix sockaddr handling in svcsock_accept_class trace points (Benjamin Coddington) [2218539]
  - SUNRPC: Fix sockaddr handling in the svc_xprt_create_error trace point (Benjamin Coddington) [2218539]
  - NFSD: Fix zero-length NFSv3 WRITEs (Benjamin Coddington) [2218539]
  - NFS: Ensure the server has an up to date ctime before renaming (Benjamin Coddington) [2218539]
  - NFS: Ensure the server has an up to date ctime before hardlinking (Benjamin Coddington) [2218539]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-509.el8]
changelog:
  - cifs: fix for following DFS links where sharename is the same as prepath (Ronnie Sahlberg) [2130474]
  - crypto: rng - Fix lock imbalance in crypto_del_rng (Herbert Xu) [2229700]
  - ibmvnic: Do not reset dql stats on NON_FATAL err (Mamatha Inamdar) [2227904]
  - mptcp: Correct the sock::sk_lock.owned lockdep annotations (Felix Maurer) [2228890]
  - gpio: name PCA953x gpio chips after device name (Steve Best) [2226775]
  - scsi: storvsc: Handle SRB status value 0x30 (Cathy Avery) [2218133]
  - netfilter: nft_set_pipapo: fix improper element removal (Phil Sutter) [2225276] {CVE-2023-4004}
  - macvlan: add forgotten nla_policy for IFLA_MACVLAN_BC_CUTOFF (Xin Long) [2226791]
  - tcp: Reduce chance of collisions in inet6_hashfn(). (Felix Maurer) [2176119] {CVE-2023-1206}
  - ipv6: fix locking issues with loops over idev->addr_list (Jiri Benc) [2123305]
  - relayfs: fix out-of-bounds access in relay_file_read (Bill O'Donnell) [2215510] {CVE-2023-3268}
  - kernel/relay.c: fix read_pos error when multiple readers (Bill O'Donnell) [2215510]
  - seq_buf: Make trace_seq_putmem_hex() support data longer than 8 (Ricardo Robaina) [2212208] {CVE-2023-28772}
  - seq_buf: Fix overflow in seq_buf_putmem_hex() (Ricardo Robaina) [2212208] {CVE-2023-28772}
  - tools/power/x86/intel-speed-select: Support more than 8 sockets. (Frank Ramsay) [2212508]
  - platform/x86: ISST: Remove 8 socket limit (Frank Ramsay) [2212508]
  - media: saa7134: fix use after free bug in saa7134_finidev due to race condition (Wander Lairson Costa) [2215902] {CVE-2023-35823}
  - Bluetooth: btmtksdio: fix possible FW initialization failure (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: fix the reset takes too long (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: mask out interrupt status (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btusb: Add support for Foxconn QCA 0xe0d0 (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btusb: Add two more Bluetooth parts for WCN6855 (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btusb: Add protocol for MediaTek bluetooth devices(MT7922) (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btusb: Add support for Foxconn MT7922A (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: Fix kernel oops when sdio suspend. (David Marlin) [2142489 2144730 2145097]
  - Enable MTK BT Support for RHEL (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btusb: Add a new PID/VID 13d3/3567 for MT7921 (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: mt7921s: support bluetooth reset mechanism (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: mt7921s: fix btmtksdio_[drv|fw]_pmctrl() (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: refactor btmtksdio_runtime_[suspend|resume]() (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: mt7921s: fix bus hang with wrong privilege (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: mt7921s: fix firmware coredump retrieve (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: mt7921s: Enable SCO over I2S (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: mt7921s: Support wake on bluetooth (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: rename btsdio_mtk_reg_read (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: enable AOSP extension for MT7921 (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: enable msft opcode (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: fix resume failure (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: handle runtime pm only when sdio_func is available (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: drop the unnecessary variable created (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: add support of processing firmware coredump and log (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: add MT7921s Bluetooth support (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: transmit packet according to status TX_EMPTY (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: use register CRPLR to read packet length (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: update register CSDIOCSR operation (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: move interrupt service to work (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: explicitly set WHISR as write-1-clear (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksdio: add .set_bdaddr support (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btmtksido: rely on BT_MTK module (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: mediatek: add BT_MTK module (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btusb: Support public address configuration for MediaTek Chip. (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btusb: Support Bluetooth Reset for Mediatek Chip(MT7921) (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btusb: Add support for Foxconn Mediatek Chip (David Marlin) [2142489 2144730 2145097]
  - Bluetooth: btusb: fix blacklist_table context (David Marlin) [2142489 2144730 2145097]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-510.el8]
changelog:
  - x86/show_trace_log_lvl: Ensure stack pointer is aligned, again (Oleg Nesterov) [2188093]
  - ahci: Add support for Dell S140 and later controllers (Tomas Henzl) [2222879]
  - s390/time: steer clocksource on STP syncs for CLOCK_MONOTONIC (Tobias Huschle) [2177649]
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Wander Lairson Costa) [2215906] {CVE-2023-35825}
  - scsi: zfcp: Defer fc_rport blocking until after ADISC response (Tobias Huschle) [2230241]
  - RDMA/efa: Add EFA 0xefa2 PCI ID (Izabela Bakollari) [2170086]
  - RDMA/efa: Support CQ receive entries with source GID (Izabela Bakollari) [2170086]
  - Revert "isystem: ship and use stdarg.h" (Jocelyn Falempe) [2229185]
  - drm/drm_print: Use system include for <stdargs.h> (Jocelyn Falempe) [2229185]
  - x86/mm: Do not shuffle CPU entry areas without KASLR (Rafael Aquini) [2165931] {CVE-2023-0597}
  - x86/mm: Randomize per-cpu entry area (Rafael Aquini) [2165931] {CVE-2023-0597}
  - x86/kasan: Map shadow for percpu pages on demand (Rafael Aquini) [2165931] {CVE-2023-0597}
  - x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise (Rafael Aquini) [2165931] {CVE-2023-0597}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.8.1.el8_10]
changelog:
  - udf: Fix NULL pointer dereference in udf_symlink function (Pavel Reichl) [RHEL-37769] {CVE-2021-47353}
  - net: ti: fix UAF in tlan_remove_one (Jose Ignacio Tornos Martinez) [RHEL-38940] {CVE-2021-47310}
  - ARM: footbridge: fix PCI interrupt mapping (Myron Stowe) [RHEL-26971] {CVE-2021-46909}
  - i40e: Do not use WQ_MEM_RECLAIM flag for workqueue (Kamal Heib) [RHEL-37454] {CVE-2024-36004}
  - net/mlx5e: Fix mlx5e_priv_init() cleanup flow (Kamal Heib) [RHEL-37424] {CVE-2024-35959}
  - net/mlx5: Properly link new fs rules into the tree (Kamal Heib) [RHEL-37420] {CVE-2024-35960}
  - net/mlx5e: fix a potential double-free in fs_any_create_groups (Kamal Heib) [RHEL-37091] {CVE-2023-52667}
  - net: ena: Fix incorrect descriptor free behavior (Kamal Heib) [RHEL-37428] {CVE-2024-35958}
  - mISDN: hfcpci: Fix use-after-free bug in hfcpci_softirq (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356}
  - mISDN: fix possible use-after-free in HFC_cleanup() (Jose Ignacio Tornos Martinez) [RHEL-37763] {CVE-2021-47356}
  - crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak (Vladis Dronov) [RHEL-35106] {CVE-2024-26974}
  - crypto: qat - implement dh fallback for primes > 4K (Vladis Dronov) [RHEL-35106]
  - crypto: qat - avoid division by zero (Vladis Dronov) [RHEL-35106]
  - crypto: qat - resolve race condition during AER recovery (Vladis Dronov) [RHEL-35106] {CVE-2024-26974}
  - crypto: qat - use kcalloc_node() instead of kzalloc_node() (Vladis Dronov) [RHEL-35106]
  - [rt] Enable CONFIG_DRM_MGAG200_DISABLE_WRITECOMBINE (Jocelyn Falempe) [RHEL-36172]
  - drm/mgag200: Add an option to disable Write-Combine (Jocelyn Falempe) [RHEL-36172]
  - drm/mgag200: Fix caching setup for remapped video memory (Jocelyn Falempe) [RHEL-36172]
  - Revert "drm/mgag200: Add a workaround for low-latency" (Jocelyn Falempe) [RHEL-36172]
  - mptcp: fix data re-injection from stale subflow (Davide Caratti) [RHEL-33133] {CVE-2024-26826}
  - ipv6: sr: fix incorrect unregister order (Hangbin Liu) [RHEL-31730]
  - ipv6: sr: fix possible use-after-free and null-ptr-deref (Hangbin Liu) [RHEL-31730] {CVE-2024-26735}
  - net/bnx2x: Prevent access to a freed page in page_pool (Michal Schmidt) [RHEL-14195 RHEL-33243] {CVE-2024-26859}
  - bnx2x: new flag for track HW resource allocation (Michal Schmidt) [RHEL-14195 RHEL-33243]
  - bnx2x: fix page fault following EEH recovery (Michal Schmidt) [RHEL-14195 RHEL-33243]
  - x86: KVM: SVM: always update the x2avic msr interception (Maxim Levitsky) [RHEL-15495] {CVE-2023-5090}
  - EDAC/thunderx: Fix possible out-of-bounds string access (Aristeu Rozanski) [RHEL-26573] {CVE-2023-52464}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.9.1.el8_10]
changelog:
  - x86/mce: Make sure to grab mce_sysfs_mutex in set_bank() (Steve Best) [RHEL-37262] {CVE-2024-35876}
  - net/sched: flower: Fix chain template offload (Xin Long) [RHEL-31313] {CVE-2024-26669}
  - SUNRPC: fix a memleak in gss_import_v2_context (Scott Mayhew) [RHEL-35195] {CVE-2023-52653}
  - efivarfs: force RO when remounting if SetVariable is not supported (Pavel Reichl) [RHEL-26564] {CVE-2023-52463}
  - dmaengine: idxd: add a write() method for applications to submit work (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823}
  - dmaengine: idxd: add a new security check to deal with a hardware erratum (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823}
  - VFIO: Add the SPR_DSA and SPR_IAX devices to the denylist (Jerry Snitselaar) [RHEL-35826] {CVE-2024-21823}
  - quota: Fix potential NULL pointer dereference (Pavel Reichl) [RHEL-33219] {CVE-2024-26878}
  - locking/lockdep: Fix overflow in presentation of average lock-time (Čestmír Kalina) [RHEL-17678]
  - blk-cgroup: Properly propagate the iostat update up the hierarchy (Ming Lei) [RHEL-40939]
  - proc: Use new_inode not new_inode_pseudo (Ian Kent) [RHEL-40167]
  - stmmac: Clear variable when destroying workqueue (Izabela Bakollari) [RHEL-31822] {CVE-2024-26802}
  - powerpc/pseries/memhp: Fix access beyond end of drmem array (Mamatha Inamdar) [RHEL-26495] {CVE-2023-52451}
  - platform/x86: wmi: Fix opening of char device (David Arcari) [RHEL-38258] {CVE-2023-52864}
  - Revert "net/mlx5: Block entering switchdev mode with ns inconsistency" (Kamal Heib) [RHEL-36908] {CVE-2023-52658}
  - hv_netvsc: Register VF in netvsc_probe if NET_DEVICE_REGISTER missed (Cathy Avery) [RHEL-39074]
  - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove (Cathy Avery) [RHEL-39074]
  - hv_netvsc: Calculate correct ring size when PAGE_SIZE is not 4 Kbytes (Cathy Avery) [RHEL-39074]
  - hv_netvsc: remove duplicated including of slab.h (Cathy Avery) [RHEL-39074]
  - hv_netvsc: rndis_filter needs to select NLS (Cathy Avery) [RHEL-39074]
  - hv_netvsc: Mark VF as slave before exposing it to user-mode (Cathy Avery) [RHEL-39074]
  - hv_netvsc: Fix race of register_netdevice_notifier and VF register (Cathy Avery) [RHEL-39074]
  - hv_netvsc: fix race of netvsc and VF register_netdevice (Cathy Avery) [RHEL-39074]
  - hv_netvsc: fix netvsc_send_completion to avoid multiple message length checks (Cathy Avery) [RHEL-39074]
  - hv_netvsc: Allocate rx indirection table size dynamically (Cathy Avery) [RHEL-39074]
  - net: hv_netvsc: Fix a warning triggered by memcpy in rndis_filter (Cathy Avery) [RHEL-39074]
  - gfs2: Fix lru_count accounting (Andreas Gruenbacher) [RHEL-32941]
  - gfs2: Fix "Make glock lru list scanning safer" (Andreas Gruenbacher) [RHEL-32941]
  - gfs2: Fix "ignore unlock failures after withdraw" (Andreas Gruenbacher) [RHEL-32941]
  - gfs2: Don't set GLF_LOCK in gfs2_dispose_glock_lru (Andreas Gruenbacher) [RHEL-32941]
  - gfs2: Don't forget to complete delayed withdraw (Andreas Gruenbacher) [RHEL-32941]
  - gfs2: Delay withdraw from atomic context (Andreas Gruenbacher) [RHEL-32941]
  - gfs2: trivial clean up of gfs2_ail_error (Andreas Gruenbacher) [RHEL-32941]
  - ext4: fix corruption during on-line resize (Carlos Maiolino) [RHEL-36974] {CVE-2024-35807}
  - ext4: correct offset of gdb backup in non meta_bg group to update_backups (Carlos Maiolino) [RHEL-36974]
  - ext4: avoid online resizing failures due to oversized flex bg (Carlos Maiolino) [RHEL-30507] {CVE-2023-52622}
  - ext4: use time_is_before_jiffies() instead of open coding it (Carlos Maiolino) [RHEL-30507]
  - ext4: unify the type of flexbg_size to unsigned int (Carlos Maiolino) [RHEL-30507]
  - ext4: remove unnecessary check from alloc_flex_gd() (Carlos Maiolino) [RHEL-30507]
  - tracing: Do no increment trace_clock_global() by one (Jerome Marchand) [RHEL-27107] {CVE-2021-46939}
  - tracing: Restructure trace_clock_global() to never block (Jerome Marchand) [RHEL-27107] {CVE-2021-46939}
  - net/sched: act_skbmod: prevent kernel-infoleak (Xin Long) [RHEL-37220] {CVE-2024-35893}
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING (Xin Long) [RHEL-38307] {CVE-2023-52845}
  - redhat: remove the merge subtrees script (Derek Barbosa)
  - redhat: rhdocs: delete .get_maintainer.conf (Derek Barbosa)
  - redhat: rhdocs: Remove the rhdocs directory (Derek Barbosa)
  - dyndbg: fix old BUG_ON in >control parser (Waiman Long) [RHEL-37111] {CVE-2024-35947}
  - dyndbg: let query-modname override actual module name (Waiman Long) [RHEL-37111]
  - dyndbg: make dyndbg a known cli param (Waiman Long) [RHEL-37111]
  - lan78xx: Fix exception on link speed change (Jamie Bainbridge) [RHEL-33437]
  - net: usb: lan78xx: don't modify phy_device state concurrently (Jamie Bainbridge) [RHEL-33437]
  - efi: runtime: Fix potential overflow of soft-reserved region size (Lenny Szubowicz) [RHEL-33096] {CVE-2024-26843}
  - perf/arm-cmn: Fail DTC counter allocation correctly (Michael Petlan) [RHEL-23841]
  - perf/arm-cmn: Rework DTC counters (again) (Michael Petlan) [RHEL-23841]
  - perf/arm-cmn: Fix DTC domain detection (Michael Petlan) [RHEL-23841]
  - perf/arm-cmn: Revamp model detection (Michael Petlan) [RHEL-23841]
  - perf/arm-cmn: Fix port detection for CMN-700 (Michael Petlan) [RHEL-23841]
  - perf/arm-cmn: Move overlapping wp_combine field (Michael Petlan) [RHEL-23841]
  - Partially revert "perf/arm-cmn: Optimise DTC counter accesses" (Michael Petlan) [RHEL-23841]
  - drivers/perf: Compile with gnu99 standard (Michael Petlan) [RHEL-23841]
  - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD (Steve Best) [RHEL-36994] {CVE-2024-35801}
  - watchdog: softdog: Add options 'soft_reboot_cmd' and 'soft_active_on_boot' (Waiman Long) [RHEL-19723]
  - tipc: fix UAF in error path (Xin Long) [RHEL-34278] {CVE-2024-36886}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.10.1.el8_10]
changelog:
  - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries (Scott Mayhew) [RHEL-38264] {CVE-2023-52803}
  - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() (Ewan D. Milne) [RHEL-39717] {CVE-2024-36025}
  - tcp: add sanity checks to rx zerocopy (Guillaume Nault) [RHEL-29494] {CVE-2024-26640}
  - SUNRPC: fix some memleaks in gssx_dec_option_array (Scott Mayhew) [RHEL-35209] {CVE-2024-27388}
  - wifi: nl80211: don't free NULL coalescing rule (Jose Ignacio Tornos Martinez) [RHEL-39752] {CVE-2024-36941}
  - nfs: fix UAF in direct writes (Scott Mayhew) [RHEL-34975] {CVE-2024-26958}
  - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 (Scott Mayhew) [RHEL-33228] {CVE-2024-26870}
  - drm/amd/pm: Fix error of MACO flag setting code (Michel Dänzer) [RHEL-15928]
  - scsi: aacraid: fix io hangs and improve performance (John Meneghini) [RHEL-23913]
  - block: prevent division by zero in blk_rq_stat_sum() (Ming Lei) [RHEL-37279] {CVE-2024-35925}
  - block: fix overflow in blk_ioctl_discard() (Ming Lei) [RHEL-39811] {CVE-2024-36917}
  - virtio-blk: fix implicit overflow on virtio_max_dma_size (Ming Lei) [RHEL-38131] {CVE-2023-52762}
  - nbd: null check for nla_nest_start (Ming Lei) [RHEL-35176] {CVE-2024-27025}
  - isdn: mISDN: netjet: Fix crash in nj_probe: (Ken Cox) [RHEL-38444] {CVE-2021-47284}
  - isdn: mISDN: Fix sleeping function called from invalid context (Ken Cox) [RHEL-38400] {CVE-2021-47468}
  - net/smc: avoid data corruption caused by decline (Tobias Huschle) [RHEL-38234] {CVE-2023-52775}
  - ubi: Check for too small LEB size in VTBL code (David Arcari) [RHEL-25092] {CVE-2024-25739}
  - i2c: core: Fix atomic xfer check for non-preempt config (Steve Best) [RHEL-38313] {CVE-2023-52791}
  - i2c: core: Run atomic i2c xfer when !preemptible (Steve Best) [RHEL-38313] {CVE-2023-52791}
  - firewire: ohci: mask bus reset interrupts between ISR and bottom half (Steve Best) [RHEL-39902] {CVE-2024-36950}
  - ipv6: init the accept_queue's spinlocks in inet6_create (Guillaume Nault) [RHEL-28899] {CVE-2024-26614}
  - tcp: make sure init the accept_queue's spinlocks once (Guillaume Nault) [RHEL-28899] {CVE-2024-26614}
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive() (Steve Best) [RHEL-39352] {CVE-2024-36016}
  - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage (Ivan Vecera) [RHEL-37484] {CVE-2024-36006}
  - pwm: Fix double shift bug (Steve Best) [RHEL-38278] {CVE-2023-52756}
  - mmc: sdio: fix possible resource leaks in some error paths (Steve Best) [RHEL-38149] {CVE-2023-52730}
  - of: unittest: Fix compile in the non-dynamic case (Steve Best) [RHEL-37070] {CVE-2023-52679}
  - of: unittest: Fix of_count_phandle_with_args() expected value message (Steve Best) [RHEL-37070] {CVE-2023-52679}
  - of: Fix double free in of_parse_phandle_with_args_map (Steve Best) [RHEL-37070] {CVE-2023-52679}
  - pinctrl: core: delete incorrect free in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940}
  - pinctrl: core: fix possible memory leak in pinctrl_enable() (Steve Best) [RHEL-39756] {CVE-2024-36940}
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker (Desnes Nunes) [RHEL-38331] {CVE-2023-52764}
  - tipc: fix a possible memleak in tipc_buf_append (Xin Long) [RHEL-39881] {CVE-2024-36954}
  - cifs: fix mid leak during reconnection after timeout threshold (Paulo Alcantara) [RHEL-36222]
  - cifs: Fix use-after-free in rdata->read_into_pages() (Paulo Alcantara) [RHEL-36222]
  - cifs: Fix pages leak when writedata alloc failed in cifs_write_from_iter() (Paulo Alcantara) [RHEL-36222]
  - cifs: Fix pages array leak when writedata alloc failed in cifs_writedata_alloc() (Paulo Alcantara) [RHEL-36222]
  - cifs: destage dirty pages before re-reading them for cache=none (Paulo Alcantara) [RHEL-36222]
  - cifs: destage any unwritten data to the server before calling copychunk_write (Paulo Alcantara) [RHEL-36222]
  - Adjust cifssb maximum read size (Paulo Alcantara) [RHEL-36222]
  - cifs: make locking consistent around the server session status (Paulo Alcantara) [RHEL-36222]
  - cifs: fix credit accounting for extra channel (Paulo Alcantara) [RHEL-36222]
  - smb3: prevent races updating CurrentMid (Paulo Alcantara) [RHEL-36222]
  - cifs: fix missing spinlock around update to ses->status (Paulo Alcantara) [RHEL-36222]
  - cifs: use echo_interval even when connection not ready. (Paulo Alcantara) [RHEL-36222]
  - cifs: detect dead connections only when echoes are enabled. (Paulo Alcantara) [RHEL-36222]
  - cifs: Fix preauth hash corruption (Paulo Alcantara) [RHEL-36222]
  - cifs: do not send close in compound create+close requests (Paulo Alcantara) [RHEL-36222]
  - cifs: ask for more credit on async read/write code paths (Paulo Alcantara) [RHEL-36222]
  - cifs: use discard iterator to discard unneeded network data more efficiently (Paulo Alcantara) [RHEL-36222]
  - cifs: Fix in error types returned for out-of-credit situations. (Paulo Alcantara) [RHEL-36222]
  - smb3: fix crediting for compounding when only one request in flight (Paulo Alcantara) [RHEL-36222]
  - cifs: New optype for session operations. (Paulo Alcantara) [RHEL-36222]
  - mm/gup: do not return 0 from pin_user_pages_fast() for bad args (Paulo Alcantara) [RHEL-36222]
  - wifi: brcmfmac: pcie: handle randbuf allocation failure (Jose Ignacio Tornos Martinez) [RHEL-44124] {CVE-2024-38575}
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). (Guillaume Nault) [RHEL-39835] {CVE-2024-36904}
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() (Jose Ignacio Tornos Martinez) [RHEL-38159] {CVE-2023-52832}
  - wifi: ath11k: fix gtk offload status event locking (Jose Ignacio Tornos Martinez) [RHEL-38155] {CVE-2023-52777}
  - net: ieee802154: fix null deref in parse dev addr (Steve Best) [RHEL-38012] {CVE-2021-47257}
  - mm/hugetlb: fix missing hugetlb_lock for resv uncharge (Rafael Aquini) [RHEL-37465] {CVE-2024-36000}
  - x86/xen: Add some null pointer checking to smp.c (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908}
  - x86/xen: Fix memory leak in xen_smp_intr_init{_pv}() (Vitaly Kuznetsov) [RHEL-33258] {CVE-2024-26908}
  - wifi: cfg80211: check A-MSDU format more carefully (Jose Ignacio Tornos Martinez) [RHEL-37343] {CVE-2024-35937}
  - wifi: rtw89: fix null pointer access when abort scan (Jose Ignacio Tornos Martinez) [RHEL-37355] {CVE-2024-35946}
  - atl1c: Work around the DMA RX overflow issue (Ken Cox) [RHEL-38287] {CVE-2023-52834}
  - wifi: ath11k: decrease MHI channel buffer length to 8KB (Jose Ignacio Tornos Martinez) [RHEL-37339] {CVE-2024-35938}
  - wifi: iwlwifi: mvm: rfi: fix potential response leaks (Jose Ignacio Tornos Martinez) [RHEL-37163] {CVE-2024-35912}
  - USB: core: Fix access violation during port device removal (Desnes Nunes) [RHEL-39853] {CVE-2024-36896}
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() (Ewan D. Milne) [RHEL-37123] {CVE-2024-35930}
  - netfilter: nf_tables: honor table dormant flag from netdev release event path (Phil Sutter) [RHEL-37450] {CVE-2024-36005}
  - wifi: iwlwifi: mvm: don't set the MFP flag for the GTK (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434}
  - wifi: iwlwifi: mvm: Fix key flags for IGTK on AP interface (Jose Ignacio Tornos Martinez) [RHEL-36898] {CVE-2024-27434}
  - misc: lis3lv02d_i2c: Fix regulators getting en-/dis-abled twice on suspend/resume (Steve Best) [RHEL-36932] {CVE-2024-35824}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.11.1.el8_10]
changelog:
  - x86/bugs: Reverse instruction order of CLEAR_CPU_BUFFERS (Waiman Long) [RHEL-42121]
  - Revert "x86/bugs: Use fixed addressing for VERW operand" (Waiman Long) [RHEL-42121]
  - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests (Waiman Long) [RHEL-42121]
  - x86/rfds: Mitigate Register File Data Sampling (RFDS) (Waiman Long) [RHEL-42121]
  - Documentation/hw-vuln: Add documentation for RFDS (Waiman Long) [RHEL-42121]
  - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (Waiman Long) [RHEL-42121]
  - x86/bugs: Use fixed addressing for VERW operand (Waiman Long) [RHEL-42121]
  - KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (Waiman Long) [RHEL-42121]
  - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (Waiman Long) [RHEL-42121]
  - x86/entry_32: Add VERW just before userspace transition (Waiman Long) [RHEL-42121]
  - x86/entry_64: Add VERW just before userspace transition (Waiman Long) [RHEL-42121]
  - x86/bugs: Add asm helpers for executing VERW (Waiman Long) [RHEL-42121]
  - x86/cpu: Fix Gracemont uarch (Waiman Long) [RHEL-42121]
  - Documentation/hw-vuln: Unify filename specification in index (Waiman Long) [RHEL-42121]
  - KVM: VMX: Access @flags as a 32-bit value in __vmx_vcpu_run() (Waiman Long) [RHEL-42121]
  - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (Waiman Long) [RHEL-42121]
  - x86/asm: Have the __ASM_FORM macros handle commas in arguments (Waiman Long) [RHEL-42121]
  - x86/asm: Allow to pass macros to __ASM_FORM() (Waiman Long) [RHEL-42121]
  - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-39801] {CVE-2024-36921}
  - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-39784]
  - ipv4: Fix uninit-value access in __ip_make_skb() (Antoine Tenart) [RHEL-39784] {CVE-2024-36927}
  - perf mmap: Lazily initialize zstd streams to save memory when not using it (Michael Petlan) [RHEL-34876]
  - perf tools: Fix spelling mistake "commpressor" -> "compressor" (Michael Petlan) [RHEL-34876]
  - perf record: Introduce data transferred and compressed stats (Michael Petlan) [RHEL-34876]
  - perf record: Introduce compressor at mmap buffer object (Michael Petlan) [RHEL-34876]
  - perf record: Introduce bytes written stats (Michael Petlan) [RHEL-34876]
  - perf record: Introduce data file at mmap buffer object (Michael Petlan) [RHEL-34876]
  - perf record: Start threads in the beginning of trace streaming (Alexey Bayduraev) [RHEL-34876]
  - perf record: Stop threads in the end of trace streaming (Michael Petlan) [RHEL-34876]
  - perf record: Introduce thread local variable (Michael Petlan) [RHEL-34876]
  - perf record: Introduce function to propagate control commands (Michael Petlan) [RHEL-34876]
  - perf record: Introduce thread specific data array (Michael Petlan) [RHEL-34876]
  - tools lib: Introduce fdarray duplicate function (Michael Petlan) [RHEL-34876]
  - perf record: Introduce thread affinity and mmap masks (Michael Petlan) [RHEL-34876]
  - gfs2: Be more careful with the quota sync generation (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Get rid of some unnecessary quota locking (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Add some missing quota locking (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Fold qd_fish into gfs2_quota_sync (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: quota need_sync cleanup (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Fix and clean up function do_qc (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Revert "Add quota_change type" (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Revert "ignore negated quota changes" (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: qd_check_sync cleanups (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Check quota consistency on mount (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Minor gfs2_quota_init error path cleanup (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: fix kernel BUG in gfs2_quota_cleanup (Edward Adam Davis) [RHEL-40901]
  - gfs2: Clean up quota.c:print_message (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Clean up gfs2_alloc_parms initializers (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Two quota=account mode fixes (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Remove useless assignment (Bob Peterson) [RHEL-40901]
  - gfs2: simplify slot_get (Bob Peterson) [RHEL-40901]
  - gfs2: Simplify qd2offset (Bob Peterson) [RHEL-40901]
  - gfs2: Remove quota allocation info from quota file (Bob Peterson) [RHEL-40901]
  - gfs2: use constant for array size (Bob Peterson) [RHEL-40901]
  - gfs2: Set qd_sync_gen in do_sync (Bob Peterson) [RHEL-40901]
  - gfs2: Remove useless err set (Bob Peterson) [RHEL-40901]
  - gfs2: Small gfs2_quota_lock cleanup (Bob Peterson) [RHEL-40901]
  - gfs2: move qdsb_put and reduce redundancy (Bob Peterson) [RHEL-40901]
  - gfs2: Don't try to sync non-changes (Bob Peterson) [RHEL-40901]
  - gfs2: Simplify function need_sync (Bob Peterson) [RHEL-40901]
  - gfs2: remove unneeded pg_oflow variable (Bob Peterson) [RHEL-40901]
  - gfs2: remove unneeded variable done (Bob Peterson) [RHEL-40901]
  - gfs2: pass sdp to gfs2_write_buf_to_page (Bob Peterson) [RHEL-40901]
  - gfs2: pass sdp in to gfs2_write_disk_quota (Bob Peterson) [RHEL-40901]
  - gfs2: Pass sdp to gfs2_adjust_quota (Bob Peterson) [RHEL-40901]
  - gfs2: remove dead code for quota writes (Bob Peterson) [RHEL-40901]
  - gfs2: Use qd_sbd more consequently (Bob Peterson) [RHEL-40901]
  - gfs2: replace 'found' with dedicated list iterator variable (Jakob Koschel) [RHEL-40901]
  - gfs2: Some whitespace cleanups (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold (Bob Peterson) [RHEL-40901]
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (Guillaume Nault) [RHEL-43961] {CVE-2024-38596}
  - af_unix: Fix data-races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596}
  - af_unix: Fix data races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596}
  - perf/core: Fix event sibling list locking (Daniel Vacek) [RHEL-31798]
  - media: bttv: fix use after free error due to btv->timeout timer (Kate Hsuan) [RHEL-38256] {CVE-2023-52847}
  - arp: Prevent overflow in arp_req_get(). (Antoine Tenart) [RHEL-31706] {CVE-2024-26733}
  - Bluetooth: btusb: Add a new PID/VID 0489/e0c8 for MT7921 (David Marlin) [RHEL-10263]
  - mm: swap: fix race between free_swap_and_cache() and swapoff() (Waiman Long) [RHEL-34971] {CVE-2024-26960}
  - swap: comments get_swap_device() with usage rule (Waiman Long) [RHEL-34971] {CVE-2024-26960}
  - mm/swapfile.c: __swap_entry_free() always free 1 entry (Waiman Long) [RHEL-34971] {CVE-2024-26960}
  - mm/swapfile.c: call free_swap_slot() in __swap_entry_free() (Waiman Long) [RHEL-34971] {CVE-2024-26960}
  - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() (Waiman Long) [RHEL-34971] {CVE-2024-26960}
  - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43788] {CVE-2022-48743}
  - ovl: fix warning in ovl_create_real() (cki-backport-bot) [RHEL-43652] {CVE-2021-47579}
  - net/sched: initialize noop_qdisc owner (Davide Caratti) [RHEL-35056]
  - net/sched: Fix mirred deadlock on device recursion (Davide Caratti) [RHEL-35056] {CVE-2024-27010}
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (Pavel Reichl) [RHEL-45029] {CVE-2024-39276}
  - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-38713] {CVE-2021-47548}
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44396] {CVE-2024-33621}
  - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26462] {CVE-2024-26586}
  - inet: inet_defrag: prevent sk release while still in use (Antoine Tenart) [RHEL-33398] {CVE-2024-26921}
  - skb_expand_head() adjust skb->truesize incorrectly (Antoine Tenart) [RHEL-33398]
  - nvmet: fix ns enable/disable possible hang (Ming Lei) [RHEL-43547]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.12.1.el8_10]
changelog:
  - net: bridge: xmit: make sure we have at least eth header len bytes (cki-backport-bot) [RHEL-44291] {CVE-2024-38538}
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Michel Dänzer) [RHEL-26893] {CVE-2023-52469}
  - SUNRPC: Fix a suspicious RCU usage warning (Scott Mayhew) [RHEL-30503] {CVE-2023-52623}
  - ice: Fix some null pointer dereference issues in ice_ptp.c (Petr Oros) [RHEL-26901] {CVE-2023-52471}
  - xfs: fix internal error from AGFL exhaustion (Pavel Reichl) [RHEL-45581]
  - sched/psi: Fix use-after-free in ep_remove_wait_queue() (Phil Auld) [RHEL-38117] {CVE-2023-52707}
  - wait: add wake_up_pollfree() (Phil Auld) [RHEL-38117]
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-33269] {CVE-2024-26852}
  - net: bridge: switchdev: Skip MDB replays of deferred events on offload (Ivan Vecera) [RHEL-33117] {CVE-2024-26837}
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Pavel Reichl) [RHEL-31700] {CVE-2024-26772}
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-31688] {CVE-2024-26773}
  - ext4: fix double-free of blocks due to wrong extents moved_len (Pavel Reichl) [RHEL-31612] {CVE-2024-26704}
  - vxlan: Pull inner IP header in vxlan_xmit_one(). (Guillaume Nault) [RHEL-31389]
  - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (Guillaume Nault) [RHEL-31389]
  - vxlan: Pull inner IP header in vxlan_rcv(). (Guillaume Nault) [RHEL-31389]
  - geneve: fix header validation in geneve[6]_xmit_skb (Guillaume Nault) [RHEL-31389]
  - geneve: make sure to pull inner header in geneve_rx() (Guillaume Nault) [RHEL-31389]
  - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (Guillaume Nault) [RHEL-31389]
  - net: geneve: check skb is large enough for IPv4/IPv6 header (Guillaume Nault) [RHEL-31389]
  - net/smc: fix neighbour and rtable leak in smc_ib_find_route() (Tobias Huschle) [RHEL-39744] {CVE-2024-36945}
  - igb: Fix string truncation warnings in igb_set_fw_version (Corinna Vinschen) [RHEL-38452] {CVE-2024-36010}
  - bonding: stop the device in bond_setup_by_slave() (Hangbin Liu) [RHEL-38327] {CVE-2023-52784}
  - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-39702] {CVE-2024-36020}
  - powerpc/64: Fix the definition of the fixmap area (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018}
  - powerpc/mm/hash64: Add a variable to track the end of IO mapping (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018}
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (Xin Long) [RHEL-39770] {CVE-2024-36933}
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Xin Long) [RHEL-39770]
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-39779] {CVE-2024-36929}
  - tcp: properly terminate timers for kernel sockets (Guillaume Nault) [RHEL-37171] {CVE-2024-35910}
  - net: relax socket state check at accept time. (Florian Westphal) [RHEL-39831]
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (Florian Westphal) [RHEL-39831] {CVE-2024-36905}
  - tcp: remove redundant check on tskb (Florian Westphal) [RHEL-39831]
  - drm/ast: Fix soft lockup (cki-backport-bot) [RHEL-37438] {CVE-2024-35952}
  - null_blk: Fix return value of nullb_device_power_store() (Ming Lei) [RHEL-39341]
  - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (Ming Lei) [RHEL-39341]
  - null_blk: fix return value from null_add_dev() (Ming Lei) [RHEL-39341]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.13.1.el8_10]
changelog:
  - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko)
  - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202]
  - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202]
  - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202]
  - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202]
  - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202]
  - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202]
  - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202]
  - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889}
  - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974}
  - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530}
  - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573}
  - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740}
  - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810}
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978}
  - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304}
  - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619}
  - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662}
  - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810}
  - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940}
  - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648}
  - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960}
  - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747}
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487}
  - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971}
  - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853}
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961}
  - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615}
  - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672]
  - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672]
  - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672]
  - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672]
  - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672]
  - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672]
  - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672]
  - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672]
  - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672]
  - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672]
  - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672]
  - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672]
  - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672]
  - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672]
  - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672]
  - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672]
  - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672]
  - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672]
  - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672]
  - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672]
  - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672]
  - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672]
  - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672]
  - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672]
  - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672]
  - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672]
  - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672]
  - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672]
  - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672]
  - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672]
  - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672]
  - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672]
  - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672]
  - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672]
  - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672]
  - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672]
  - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672]
  - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672]
  - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672]
  - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672]
  - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672]
  - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672]
  - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672]
  - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672]
  - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672]
  - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672]
  - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672]
  - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672]
  - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672]
  - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672]
  - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672]
  - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672]
  - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672]
  - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672]
  - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672]
  - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672]
  - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672]
  - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672]
  - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672]
  - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672]
  - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672]
  - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672]
  - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672]
  - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672]
  - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672]
  - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672]
  - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672]
  - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672]
  - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672]
  - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672]
  - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672]
  - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672]
  - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672]
  - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672]
  - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672]
  - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672]
  - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672]
  - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672]
  - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672]
  - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672]
  - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672]
  - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672]
  - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672]
  - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672]
  - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672]
  - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672]
  - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672]
  - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672]
  - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672]
  - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672]
  - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672]
  - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672]
  - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672]
  - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672]
  - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672]
  - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672]
  - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672]
  - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672]
  - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672]
  - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672]
  - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672]
  - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672]
  - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672]
  - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672]
  - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672]
  - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672]
  - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672]
  - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672]
  - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672]
  - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672]
  - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672]
  - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672]
  - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672]
  - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672]
  - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672]
  - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672]
  - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672]
  - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672]
  - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672]
  - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672]
  - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672]
  - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672]
  - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672]
  - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672]
  - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672]
  - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672]
  - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672]
  - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672]
  - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672]
  - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672]
  - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672]
  - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672]
  - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672]
  - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672]
  - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672]
  - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672]
  - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672]
  - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672]
  - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672]
  - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672]
  - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476}
  - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757}
  - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924}
  - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286]
  - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286]
  - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286]
  - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286]
  - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286]
  - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286]
  - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286]
  - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286]
  - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286]
  - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077]
  - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461}
  - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491}
  - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840}
  - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660}
  - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555}
  - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486}
  - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598}
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017}
  - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897}
  - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205]
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924}
  - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952}
  - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011}
  - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900}
  - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899}
  - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210]
  - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896}
  - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270}
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286}
  - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065}
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019}
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020}
  - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024]
  - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408}
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925}
  - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217]
  - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.14.1.el8_10]
changelog:
  - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754]
  - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798]
  - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823}
  - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754]
  - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984]
  - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984]
  - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984]
  - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984]
  - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984]
  - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984]
  - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984]
  - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790}
  - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627}
  - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755]
  - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489}
  - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472}
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686}
  - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686}
  - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686}
  - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686}
  - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811}
  - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929}
  - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930}
  - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.15.1.el8_10]
changelog:
  - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613]
  - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502}
  - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502}
  - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624}
  - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927}
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395}
  - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979}
  - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979}
  - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979}
  - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847}
  - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373}
  - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632}
  - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.16.1.el8_10]
changelog:
  - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.17.1.el8_10]
changelog:
  - kyber: fix out of bounds access when preempted (Ming Lei) [RHEL-27258] {CVE-2021-46984}
  - vfs: don't mod negative dentry count when on shrinker list (Brian Foster) [RHEL-35874]
  - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading (Brian Foster) [RHEL-35874]
  - fbmem: Do not delete the mode that is still in use (CKI Backport Bot) [RHEL-37796] {CVE-2021-47338}
  - netpoll: Fix race condition in netpoll_owner_active (CKI Backport Bot) [RHEL-49361] {CVE-2024-41005}
  - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Mark Salter) [RHEL-43702] {CVE-2021-47609}
  - ipv6: prevent possible NULL dereference in rt6_probe() (Guillaume Nault) [RHEL-48149] {CVE-2024-40960}
  - HID: i2c-hid-of: fix NULL-deref on failed power up (CKI Backport Bot) [RHEL-31598] {CVE-2024-26717}
  - cpufreq: amd-pstate: fix memory leak on CPU EPP exit (CKI Backport Bot) [RHEL-48489] {CVE-2024-40997}
  - x86/mm/pat: fix VM_PAT handling in COW mappings (Chris von Recklinghausen) [RHEL-37258] {CVE-2024-35877}
  - PCI/PM: Drain runtime-idle callbacks before driver removal (Myron Stowe) [RHEL-42937] {CVE-2024-35809}
  - PCI: Drop pci_device_remove() test of pci_dev->driver (Myron Stowe) [RHEL-42937] {CVE-2024-35809}
  - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Mika Penttilä) [RHEL-26909] {CVE-2023-52470}
  - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Desnes Nunes) [RHEL-43979] {CVE-2022-48760}
  - cifs: fix bad fids sent over wire (Paulo Alcantara) [RHEL-52517]
  - smb3: add additional null check in SMB311_posix_mkdir (Paulo Alcantara) [RHEL-52517]
  - smb3: add additional null check in SMB2_tcon (Paulo Alcantara) [RHEL-52517]
  - smb3: add additional null check in SMB2_open (Paulo Alcantara) [RHEL-52517]
  - smb3: add additional null check in SMB2_ioctl (Paulo Alcantara) [RHEL-52517]
  - selftests: forwarding: devlink_lib: Wait for udev events after reloading (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501}
  - drivers: core: synchronize really_probe() and dev_uevent() (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501}
  - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Xin Long) [RHEL-42997] {CVE-2024-35884}
  - filelock: Remove locks reliably when fcntl/close race is detected (Bill O'Donnell) [RHEL-50170] {CVE-2024-41012}
  - Input: add bounds checking to input_set_capability() (Benjamin Tissoires) [RHEL-21413] {CVE-2022-48619}
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CKI Backport Bot) [RHEL-48130] {CVE-2024-40959}
  - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (Ming Lei) [RHEL-33695]
  - blk-cgroup: fix list corruption from resetting io stat (Ming Lei) [RHEL-33695]
  - net: do not leave a dangling sk pointer, when socket creation fails (CKI Backport Bot) [RHEL-48060] {CVE-2024-40954}
  - perf/x86/lbr: Filter vsyscall addresses (Michael Petlan) [RHEL-28991] {CVE-2023-52476}
  - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CKI Backport Bot) [RHEL-47678] {CVE-2024-39499}
  - serial: core: fix transmit-buffer reset and memleak (Steve Best) [RHEL-38731] {CVE-2021-47527}
  - powerpc/pseries: Whitelist dtl slub object for copying to userspace (Mamatha Inamdar) [RHEL-51236] {CVE-2024-41065}
  - powerpc/eeh: avoid possible crash when edev->pdev changes (Mamatha Inamdar) [RHEL-51220] {CVE-2024-41064}
  - x86: stop playing stack games in profile_pc() (Steve Best) [RHEL-51643] {CVE-2024-42096}
  - mptcp: ensure snd_una is properly initialized on connect (Florian Westphal) [RHEL-47933 RHEL-47934] {CVE-2024-40931}
  - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CKI Backport Bot) [RHEL-47492] {CVE-2024-39506}
  - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50194] {CVE-2024-41091}
  - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50279] {CVE-2024-41090}
  - usb-storage: alauda: Check whether the media is initialized (Desnes Nunes) [RHEL-43708] {CVE-2024-38619}
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Desnes Nunes) [RHEL-43708] {CVE-2024-38619}
  - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37723] {CVE-2021-47384}
  - block: fix that util can be greater than 100% (Ming Lei) [RHEL-23074]
  - block: support to account io_ticks precisely (Ming Lei) [RHEL-23074]
  - watchdog: Fix possible use-after-free by calling del_timer_sync() (Steve Best) [RHEL-38795] {CVE-2021-47321}
  - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37719] {CVE-2021-47385}
  - mlxsw: spectrum: Protect driver from buggy firmware (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560}
  - mlxsw: Verify the accessed index doesn't exceed the array length (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560}
  - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] {CVE-2024-26880}
  - tty: Fix out-of-bound vmalloc access in imageblit (Steve Best) [RHEL-37727] {CVE-2021-47383}
  - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37715] {CVE-2021-47386}
  - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (Steve Best) [RHEL-37710] {CVE-2021-47393}
  - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Steve Best) [RHEL-38436] {CVE-2021-47497}
  - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Steve Best) [RHEL-37901] {CVE-2021-47287}
  - phylib: fix potential use-after-free (cki-backport-bot) [RHEL-43764] {CVE-2022-48754}
  - ptp: Fix possible memory leak in ptp_clock_register() (Hangbin Liu) [RHEL-38424] {CVE-2021-47455}
  - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-51315] {CVE-2024-41076}
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CKI Backport Bot) [RHEL-51618] {CVE-2024-42090}
  - ftruncate: pass a signed offset (CKI Backport Bot) [RHEL-51598] {CVE-2024-42084}
  - af_unix: Fix garbage collector racing against connect() (Felix Maurer) [RHEL-34225] {CVE-2024-26923}
  - virtio-net: Add validation for used length (Laurent Vivier) [RHEL-42080] {CVE-2021-47352}
  - net: fix possible store tearing in neigh_periodic_work() (Antoine Tenart) [RHEL-42359] {CVE-2023-52522}
  - tunnels: fix out of bounds access when building IPv6 PMTU error (Antoine Tenart) [RHEL-41823] {CVE-2024-26665}
  - vt_ioctl: fix array_index_nospec in vt_setactivate (John W. Linville) [RHEL-49141] {CVE-2022-48804}
  - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CKI Backport Bot) [RHEL-38302] {CVE-2023-52840}
  - netns: Make get_net_ns() handle zero refcount net (Antoine Tenart) [RHEL-48105] {CVE-2024-40958}
  - tracing: Ensure visibility when inserting an element into tracing_map (Michael Petlan) [RHEL-30457] {CVE-2024-26645}
  - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50072]
  - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files (CKI Backport Bot) [RHEL-51144] {CVE-2024-41056}
  - SUNRPC: Fix a race to wake a sync task (Benjamin Coddington) [RHEL-11843]
  - firmware: cs_dsp: Fix overflow checking of wmfw header (CKI Backport Bot) [RHEL-50999] {CVE-2024-41039}
  - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers (CKI Backport Bot) [RHEL-50987] {CVE-2024-41038}
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (Xin Long) [RHEL-48471] {CVE-2024-40995}
  - net: fix out-of-bounds access in ops_init (Xin Long) [RHEL-43185] {CVE-2024-36883}
  - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Steve Best) [RHEL-45310]
  - x86/mce/therm_throt: Do not access uninitialized therm_work (Steve Best) [RHEL-45310]
  - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Steve Best) [RHEL-45310]
  - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Steve Best) [RHEL-45310]
  - x86/mce/therm_throt: Optimize notifications of thermal throttle (Steve Best) [RHEL-45310]
  - jiffies: add utility function to calculate delta in ms (Steve Best) [RHEL-45310]
  - x86/mce: Lower throttling MCE messages' priority to warning (Steve Best) [RHEL-45310]
  - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (Eder Zulian) [RHEL-37361] {CVE-2024-35989}
  - xfs: don't walk off the end of a directory data block (CKI Backport Bot) [RHEL-50879] {CVE-2024-41013}
  - xfs: add bounds checking to xlog_recover_process_data (CKI Backport Bot) [RHEL-50856] {CVE-2024-41014}
  - dm-crypt: limit the size of encryption requests (Benjamin Marzinski) [RHEL-29330]
  - netfilter: flowtable: remove nf_ct_l4proto_find() call (Florian Westphal) [RHEL-49589]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.18.1.el8_10]
changelog:
  - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920}
  - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013}
  - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817}
  - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817}
  - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581}
  - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649}
  - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042}
  - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040}
  - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154}
  - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508]
  - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508]
  - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124}
  - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097}
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478}
  - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988}
  - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582}
  - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582}
  - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978}
  - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977}
  - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433]
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941}
  - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988]
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929}
  - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836}
  - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836}
  - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836}
  - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226}
  - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225}
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912}
  - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911}
  - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944}
  - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944}
  - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944}
  - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114}
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097}
  - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939}
  - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060}
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041}
  - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035}
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356}
  - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007}
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627]
  - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627]
  - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627]
  - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627]
  - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.19.1.el8_10]
changelog:
  - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939}
  - RHEL-48620 (Kenneth Yin) [RHEL-48620]
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855}
  - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936]
  - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936]
  - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936]
  - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936]
  - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646]
  - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922}
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919}
  - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638}
  - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412}
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152}
  - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901}
  - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044}
  - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830}
  - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579}
  - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559}
  - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240}
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901}
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902}
  - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167]
  - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167]
  - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167]
  - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167]
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953}
  - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953}
  - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094}
  - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400]
  - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027]
  - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027]
  - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027]
  - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027]
  - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238}
  - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237}
  - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466}
  - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466}
  - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800}
  - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798}
  - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432}
  - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432}
  - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236]
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809}
  - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570}
  - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570}
  - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570}
  - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846}
  - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866}
  - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797]
  - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797]
  - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797]
  - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720}
  - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131}
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720}
  - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.20.1.el8_10]
changelog:
  - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989}
  - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871}
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600}
  - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769}
  - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769}
  - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683}
  - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023}
  - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515]
  - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595}
  - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595}
  - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605}
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894}
  - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055}
  - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055}
  - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904]
  - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904]
  - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972}
  - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972}
  - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972}
  - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998}
  - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.21.1.el8_10]
changelog:
  - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874]
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265}
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558}
  - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441}
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904}
  - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322}
  - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246}
  - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008}
  - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471}
  - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471}
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.22.1.el8_10]
changelog:
  - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.23.1.el8_10]
changelog:
  - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002]
  - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924}
  - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017}
  - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017}
  - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017}
  - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042}
  - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070}
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898}
  - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503}
  - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503}
  - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503}
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851}
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301}
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976}
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540}
  - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284}
  - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857}
  - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924}
  - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983}
  - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854}
  - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936}
  - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093}
  - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961}
  - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880}
  - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066}
  - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066}
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244}
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.24.1.el8_10]
changelog:
  - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729]
  - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889}
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000]
  - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935}
  - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608}
  - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608}
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586}
  - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018}
  - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892}
  - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892}
  - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892}
  - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892}
  - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.25.1.el8_10]
changelog:
  - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052]
  - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052]
  - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052]
  - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052]
  - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052]
  - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052]
  - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052]
  - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052]
  - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052]
  - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052]
  - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052]
  - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052]
  - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052]
  - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052]
  - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052]
  - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052]
  - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052]
  - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092}
  - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224]
  - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292}
  - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079}
  - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.26.1.el8_10]
changelog:
  - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062}
  - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037]
  - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156]
  - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757]
  - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757]
  - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757]
  - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492}
  - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939}
  - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075]
  - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397]
  - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251]
  - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251]
  - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251]
  - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.27.1.el8_10]
changelog:
  - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668}
  - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989}
  - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990}
  - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009}
  - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773}
  - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257]
  - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257]
  - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826}
  - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100]
  - loopback: fix lockdep splat (Xin Long) [RHEL-58100]
  - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100]
  - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.28.1.el8_10]
changelog:
  - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702]
  - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400]
  - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400]
  - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400]
  - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991]
  - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann)
  - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709]
  - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004]
  - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999]
  - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.29.1.el8_10]
changelog:
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399}
  - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858}
  - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.30.1.el8_10]
changelog:
  - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043}
  - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200]
  - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684]
  - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684]
  - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684]
  - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363]
  - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363]
  - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363]
  - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363]
  - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168]
  - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168]
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.31.1.el8_10]
changelog:
  - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110}
  - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256}
  - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862]
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862]
  - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988]
  - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988]
  - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988]
  - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988]
  - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988]
  - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988]
  - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988]
  - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695}
  - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823]
  - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823]
  - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099}
  - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949}
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.32.1.el8_10]
changelog:
  - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192}
  - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192}
  - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082}
  - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869]
  - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869]
  - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080]
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264}
  - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.33.1.el8_10]
changelog:
  - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073]
  - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796]
  - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.34.1.el8_10]
changelog:
  - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122}
  - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647]
  - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924]
  - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974]
  - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362]
  - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860]
  - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088}
  - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.35.1.el8_10]
changelog:
  - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480]
  - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480]
  - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396]
  - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.36.1.el8_10]
changelog:
  - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649]
  - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790]
  - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790]
  - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790]
  - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.37.1.el8_10]
changelog:
  - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275}
  - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275]
  - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275]
  - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275]
  - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.38.1.el8_10]
changelog:
  - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891]
  - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385]
  - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385]
  - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451]
  - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451]
  - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451]
  - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451]
  - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387]
  - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.40.1.el8_10]
changelog:
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.41.1.el8_10]
changelog:
  - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886]
  - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.42.1.el8_10]
changelog:
  - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261]
  - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458]
  - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950]
  - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415]
  - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161]
  - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.43.1.el8_10]
changelog:
  - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999]
  - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999]
  - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894]
  - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971]
  - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229]
  - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229]
  - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229]
  - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229]
  - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229]
  - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229]
  - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807}
  - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756]
  - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.44.1.el8_10]
changelog:
  - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302}
  - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786]
  - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786]
  - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197}
  - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.45.1.el8_10]
changelog:
  - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269]
  - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269]
  - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269]
  - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269]
  - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269]
  - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937}
  - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269]
  - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922}
  - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694]
  - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694]
  - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810]
  - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.46.1.el8_10]
changelog:
  - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934]
  - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934]
  - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934]
  - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832]
  - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785}
  - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.47.1.el8_10]
changelog:
  - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136]
  - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156]
  - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-549.el8]
changelog:
  - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678]
  - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678]
  - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934]
  - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934]
  - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934]
  - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934]
  - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934]
  - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934]
  - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934]
  - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934]
  - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934]
  - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934]
  - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934]
  - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-550.el8]
changelog:
  - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489}
  - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-551.el8]
changelog:
  - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742}
  - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992]
  - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-552.el8]
changelog:
  - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248]
  - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-552.1.1.el8_10]
changelog:
  - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko)
  - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185}
  - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579]
  - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744}
  - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743}
  - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664}
  - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776]
  - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578}
  - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578}
  - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578}
  - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610}
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528}
  - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130]
  - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130]
  - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444]
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607}
  - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606}
  - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477}
  - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565}
  - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445}
  - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593}
  - overlay: disable EVM (Coiby Xu) [RHEL-19863]
  - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863]
  - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863]
  - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286]
  - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777}
  - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784]
  - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162}
  - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934}
  - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520}
  - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340}
  - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513}
  - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627}
  - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603}
  - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782}
  - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240}
  - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240}
  - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240}
  - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136]
  - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456]
  - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456]
  - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456]
  - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-552.2.1.el8_10]
changelog:
  - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598}
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615}
  - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779}
  - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401]
  - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401]
  - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055}
  - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055}
  - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118}
  - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153}
  - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872}
  - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723]
  - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870]
  - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870]
  - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973}
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901}
  - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652]
  - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652]
  - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652]
  - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652]
  - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652]
  - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652]
  - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652]
  - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652]
  - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652]
  - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652]
  - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652]
  - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652]
  - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652]
  - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652]
  - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652]
  - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652]
  - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652]
  - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652]
  - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652]
  - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652]
  - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652]
  - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652]
  - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652]
  - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652]
  - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652]
  - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652]
  - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652]
  - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652]
  - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652]
  - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652]
  - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652]
  - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652]
  - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652]
  - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652]
  - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652]
  - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652]
  - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652]
  - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652]
  - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652]
  - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652]
  - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652]
  - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652]
  - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652]
  - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652]
  - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652]
  - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652]
  - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652]
  - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-552.3.1.el8_10]
changelog:
  - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643}
  - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642}
  - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576]
  - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307}
  - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919}
  - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669}
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059}
  - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912]
  - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934}
  - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964}
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993}
  - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659}
  - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659}
  - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933}
  - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933}
  - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521]
  - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521]
  - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521]
  - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521]
  - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516]
  - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.4.1.el8_10]
changelog:
  - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117]
  - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014}
  - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676]
  - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676]
  - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171}
  - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.5.1.el8_10]
changelog:
  - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238]
  - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238]
  - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439}
  - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013}
  - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772]
  - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772]
  - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772]
  - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772]
  - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048}
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052}
  - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056}
  - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892}
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897}
  - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693}
  - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694}
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594}
  - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595}
  - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.48.1.el8_10]
changelog:
  - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves)
  - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208]
  - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208]
  - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208]
  - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.49.1.el8_10]
changelog:
  - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244]
  - redhat: drop Y issues from changelog (Jan Stancek)
  - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673]
  - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673]
  - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673]
  - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673]
  - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673]
  - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499]
  - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241}
  - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.50.1.el8_10]
changelog:
  - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119]
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150}
  - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052]
  - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852]
  - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852]
  - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.51.1.el8_10]
changelog:
  - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072]
  - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.52.1.el8_10.gfd1b]
changelog:
  - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141}
  - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285]
  - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266]
  - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266]
  - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266]
  - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266]
  - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342]
  - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875]
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.53.1.el8_10]
changelog:
  - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906}
  - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712]
  - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970}
  - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717}
  - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819]
  - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714]
  - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793]
  - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756}
  - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756}
  - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.54.1.el8_10]
changelog:
  - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834]
  - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842}
  - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963]


author: Craig Guiller <craig.guiller@oracle.com> [4.18.0-553.54.1.0.1.el8_10.OL8]
changelog:
  - scsi: core: Restrict legal sdev_state transitions via sysfs (Uday Shankar) [Orabug: 37778230]
  - Update Oracle Linux certificates (Kevin Lyons)
  - Disable signing for aarch64 (Ilya Okomin)
  - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
  - Update x509.genkey [Orabug: 24817676]
  - Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
  - Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.56.1.el8_10]
changelog:
  - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963]
  - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395}


author: Craig Guiller <craig.guiller@oracle.com> [4.18.0-553.56.1.0.1.el8_10.OL8]
changelog:
  - scsi: core: Restrict legal sdev_state transitions via sysfs (Uday Shankar) [Orabug: 37778230]
  - Update Oracle Linux certificates (Kevin Lyons)
  - Disable signing for aarch64 (Ilya Okomin)
  - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
  - Update x509.genkey [Orabug: 24817676]
  - Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
  - Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
  - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]


author: Craig Guiller <craig.guiller@oracle.com> [4.18.0-553.56.1.el8_10.OL8]
changelog:
  - Update Oracle Linux certificates (Kevin Lyons)
  - Disable signing for aarch64 (Ilya Okomin)
  - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
  - Update x509.genkey [Orabug: 24817676]
  - Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.3
  - Remove upstream reference during boot (Kevin Lyons) [Orabug: 34750652]
  - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985772]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.57.1.el8_10]
changelog:
  - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825]
  - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919}
  - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.58.1.el8_10]
changelog:
  - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764}
  - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765}
  - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765}
  - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535]
  - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116}
  - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182]
  - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182]
  - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182]
  - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182]
  - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182]
  - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182]
  - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182]
  - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065}
  - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890}
  - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182]
  - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182]
  - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057}
  - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182]
  - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182]
  - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182]
  - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182]
  - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182]
  - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849]
  - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064}
  - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274}
  - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182]
  - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932}
  - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182]
  - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964}
  - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182]
  - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182]
  - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182]
  - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182]
  - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182]
  - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182]
  - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182]
  - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182]
  - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182]
  - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182]
  - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182]
  - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783]
  - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783]
  - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783]
  - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783]
  - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783]
  - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783]
  - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783]
  - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783]
  - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783]
  - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.59.1.el8_10]
changelog:
  - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291]
  - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291]
  - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291]
  - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132]
  - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111}
  - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136}
  - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709]
  - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932]
  - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.60.1.el8_10]
changelog:
  - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037]
  - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037]
  - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192]
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.6.1.el8_10]
changelog:
  - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058] {CVE-2023-52686}
  - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-35361]
  - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-35361]
  - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-35361]
  - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-35361]
  - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804}
  - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-36048]
  - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162] {CVE-2024-26907}
  - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972}
  - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
  - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
  - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
  - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
  - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759}
  - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759}
  - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759}
  - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294] {CVE-2023-52560}
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-29783]
  - block: null_blk: Fix handling of fake timeout request (Ming Lei) [RHEL-8130]
  - null_blk: fix poll request timeout handling (Ming Lei) [RHEL-8130]
  - block: null_blk: end timed out poll request (Ming Lei) [RHEL-8130]
  - block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0 (Ming Lei) [RHEL-8130]
  - null_blk: allow zero poll queues (Ming Lei) [RHEL-8130]
  - null_blk: Fix handling of submit_queues and poll_queues attributes (Ming Lei) [RHEL-8130]
  - null_blk: poll queue support (Ming Lei) [RHEL-8130]
  - null_blk: fix command timeout completion handling (Ming Lei) [RHEL-8130]
  - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790] {CVE-2021-47073}
  - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675}
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078] {CVE-2023-52675}
  - tcp: do not accept ACK of bytes we never sent (Xin Long) [RHEL-21952]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.7.1.el8_10]
changelog:
  - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311}
  - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835}
  - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813}
  - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656}
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854}
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855}
  - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853}
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852}
  - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007}
  - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456}
  - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495}
  - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495}
  - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835}
  - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878}
  - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236}
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703}
  - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877}
  - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781}
  - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890}
  - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700}
  - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888}
  - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366]
  - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366]
  - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397}
  - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061]
  - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669}
  - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893]
  - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893]
  - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893]
  - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893]
  - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893]
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845}
  - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838}
  - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410}
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789}
  - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801}
  - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26584 CVE-2024-26583 CVE-2024-26585}
  - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982}
  - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626}
  - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486]
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-545.el8]
changelog:
  - tracing/timerlat: Move hrtimer_init to timerlat_fd open() (John Kacur) [RHEL-26667]
  - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-19537]
  - ipvlan: Add handling of NETDEV_UP events (Hangbin Liu) [RHEL-19098]
  - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-21760]
  - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-21760]
  - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-21760]
  - nfs: fix redundant readdir request after get eof (Benjamin Coddington) [RHEL-7780]
  - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994]
  - NFSv4.1: fix pnfs MDS=DS session trunking (Scott Mayhew) [RHEL-7994]
  - NFSv4.1: fix zero value filehandle in post open getattr (Scott Mayhew) [RHEL-7994]
  - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-546.el8]
changelog:
  - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430] {CVE-2024-26602}
  - NFS: Set the stable writes flag when initialising the super block (Benjamin Coddington) [RHEL-25266]
  - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21685] {CVE-2024-0565}
  - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command (Ming Lei) [RHEL-23942]
  - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler (Ming Lei) [RHEL-23942]
  - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26501] {CVE-2023-52448}
  - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434}
  - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434}
  - smb3: Replace smb2pdu 1-element arrays with flex-arrays (Jay Shin) [RHEL-22143]
  - cifs: Replace remaining 1-element arrays (Jay Shin) [RHEL-22143]
  - cifs: Convert struct fealist away from 1-element array (Jay Shin) [RHEL-22143]
  - cifs: remove unneeded 2bytes of padding from smb2 tree connect (Jay Shin) [RHEL-22143]
  - cifs: Replace zero-length arrays with flexible-array members (Jay Shin) [RHEL-22143]
  - cifs: Replace a couple of one-element arrays with flexible-array members (Jay Shin) [RHEL-22143]
  - cifs: fix FILE_BOTH_DIRECTORY_INFO definition (Jay Shin) [RHEL-22143]
  - nfsd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441]
  - nfs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441]
  - lockd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441]
  - cifs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441]
  - ceph: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441]
  - filelock: add a new locks_inode_context accessor function (Jeffrey Layton) [RHEL-27441]
  - dm-integrity, dm-verity: reduce stack usage for recheck (Benjamin Marzinski) [RHEL-27849]
  - dm-crypt: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849]
  - dm-crypt: don't modify the data when using authenticated encryption (Benjamin Marzinski) [RHEL-27849]
  - dm-verity: recheck the hash after a failure (Benjamin Marzinski) [RHEL-27849]
  - dm-integrity: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-547.el8]
changelog:
  - x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Give up if memory attribute protocol returns an error (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Increase section and file alignment to 4k/512 (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Split off PE/COFF .data section (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Drop PE/COFF .reloc section (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Construct PE/COFF .text section from assembler (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Derive file size from _edata symbol (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed: Remove, discard, or assert for unwanted sections (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Check that there are no run-time relocations (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Discard .discard.unreachable for arch/x86/boot/compressed/vmlinux (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Define setup size in linker script (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Set EFI handover offset directly in header asm (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Drop references to startup_64 (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Drop redundant code setting the root device (Lenny Szubowicz) [RHEL-2505]
  - x86/build: Declutter the build output (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Omit compression buffer from PE/COFF image memory footprint (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Mark global variables as static (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Remove extra headroom for setup block (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Remove the 'bugger off' message (Lenny Szubowicz) [RHEL-2505]
  - x86/efi: Drop alignment flags from PE section headers (Lenny Szubowicz) [RHEL-2505]
  - efi: Put Linux specific magic number in the DOS header (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Fix the missing KASLR_FLAG bit in boot_params->hdr.loadflags (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Avoid physical KASLR on older Dell systems (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: efistub: Assign global boot_params variable (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Avoid legacy decompressor when doing EFI boot (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Perform SNP feature test while running in the firmware (Lenny Szubowicz) [RHEL-2505]
  - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Lenny Szubowicz) [RHEL-2505]
  - efi/libstub: Add limit argument to efi_random_alloc() (Lenny Szubowicz) [RHEL-2505]
  - arm64: efi: Limit allocations to 48-bit addressable physical region (Lenny Szubowicz) [RHEL-2505]
  - efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory (Lenny Szubowicz) [RHEL-2505]
  - arm64: efi: kaslr: Fix occasional random alloc (and boot) failure (Lenny Szubowicz) [RHEL-2505]
  - efi/libstub/random: Increase random alloc granularity (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Factor out kernel decompression and relocation (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Move global symbol references to C code (Lenny Szubowicz) [RHEL-2505]
  - decompress: Use 8 byte alignment (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Prefer EFI memory attributes protocol over DXE services (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Perform 4/5 level paging switch from the stub (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Merge trampoline cleanup with switching code (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Pass pgtable address to trampoline directly (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Only call the trampoline when changing paging levels (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Call trampoline directly from C code (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Avoid the need for a stack in the 32-bit trampoline (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Use standard calling convention for trampoline (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Call trampoline as a normal function (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed/64: Remove .bss/.pgtable from bzImage (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Remove run-time relocations from .head.text code (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Assign paging related global variables earlier (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Clear BSS in EFI handover protocol entrypoint (Lenny Szubowicz) [RHEL-2505]
  - x86/head_64: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved (Lenny Szubowicz) [RHEL-2505]
  - x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (Lenny Szubowicz) [RHEL-2505]
  - efi/libstub: Add memory attribute protocol definitions (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: libstub: remove unused variable (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Robustify calling startup_{32,64}() from the decompressor code (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Simplify and clean up handover entry code (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Branch straight to kernel entry point from C code (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Avoid using code32_start (Lenny Szubowicz) [RHEL-2505]
  - efi/libstub/x86: Use Exit() boot service to exit the stub on errors (Lenny Szubowicz) [RHEL-2505]
  - efi: x86: Wipe setup_data on pure EFI boot (Lenny Szubowicz) [RHEL-2505]
  - efi: x86: Fix config name for setting the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505]
  - efi: x86: Set the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Add kernel preferred address to PE header (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Use symbolic constants in PE header instead of bare numbers (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Drop redundant .bss section (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: add headroom to decompressor BSS to account for setup block (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Remove run-time relocations from head_{32,64}.S (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed: Fix debug_puthex() parameter type (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed/64: Use 32-bit (zero-extended) MOV for z_output_len (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Use unsigned comparison for addresses (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Micro-optimize GDT loading instructions (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: GDT limit value should be size - 1 (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Remove GDT setup from efi_main (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Clear direction and interrupt flags in startup_64 (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Don't depend on firmware GDT layout (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Remove KEEP_SEGMENTS support (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Handle malformed SRAT tables during early ACPI parsing (Lenny Szubowicz) [RHEL-2505]
  - efi/libstub/x86: Use mandatory 16-byte stack alignment in mixed mode (Lenny Szubowicz) [RHEL-2505]
  - efi/libstub/x86: Avoid globals to store context during mixed mode calls (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Disable paging at mixed mode entry (Lenny Szubowicz) [RHEL-2505]
  - x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table (Lenny Szubowicz) [RHEL-2505]
  - x86/asm: Make some functions local (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Annotate data appropriately (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Annotate local functions (Lenny Szubowicz) [RHEL-2505]
  - x86/asm: Make more symbols local (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed/64: Fix boot on machines with broken E820 table (Lenny Szubowicz) [RHEL-2505]
  - x86, boot: Remove multiple copy of static function sanitize_boot_params() (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed/64: Remove unused variable (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed/64: Explain paging_prepare()'s return value (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Save several bytes in decompressor (Lenny Szubowicz) [RHEL-2505]
  - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614] {CVE-2024-0841}
  - net/gve: update check for little-endianness in gve kconfig (Joshua Washington) [RHEL-29030]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-548.el8]
changelog:
  - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann)
  - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005]
  - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214]
  - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-74.el8]
changelog:
  - [x86] revert "cpu/hotplug: Add SMT policy options" (Josh Poimboeuf) [1683690]
  - [crypto] net: crypto set sk to NULL when af_alg_release (Neil Horman) [1679450] {CVE-2019-8912}
  - [drm] drm/i915/gvt: update force-to-nonpriv register whitelist (Paul Lai) [1643972]
  - [kernel] MODSIGN: Also check platform keyring in mod_verify_sig() (Lenny Szubowicz) [1568532]
  - [kernel] Fix for module sig verification (Lenny Szubowicz) [1568532]
  - [security] efi: Lock down the kernel if booted in secure boot mode (Lenny Szubowicz) [1568532]
  - [firmware] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode (Lenny Szubowicz) [1568532]
  - [x86] Copy secure_boot flag in boot params across kexec reboot (Lenny Szubowicz) [1568532]
  - [fs] debugfs: Restrict debugfs when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [mm] x86/mmiotrace: Lock down the testmmiotrace module (Lenny Szubowicz) [1568532]
  - [kernel] Lock down module params that specify hardware parameters (eg. ioport) (Lenny Szubowicz) [1568532]
  - [tty] Lock down TIOCSSERIAL (Lenny Szubowicz) [1568532]
  - [pcmcia] Prohibit PCMCIA CIS storage when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [acpi] acpi: Disable ACPI table override if the kernel is locked down (Lenny Szubowicz) [1568532]
  - [acpi] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down (Lenny Szubowicz) [1568532]
  - [acpi] ACPI: Limit access to custom_method when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [x86] x86/msr: Restrict MSR access when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [x86] x86: Lock down IO port access when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [pci] PCI: Lock down BAR access when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] uswsusp: Disable when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] hibernate: Disable when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] kexec_load: Disable at runtime if the kernel is locked down (Lenny Szubowicz) [1568532]
  - [char] Restrict /dev/{mem, kmem, port} when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] MODSIGN: Enforce module signatures if the kernel is locked down (Lenny Szubowicz) [1568532]
  - [security] Add a SysRq option to lift kernel lockdown (Lenny Szubowicz) [1568532]
  - [security] Add the ability to lock down access to the running kernel image (Lenny Szubowicz) [1568532]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-75.el8]
changelog:
  - [netdrv] net: hns3: add 8 BD limit for tx flow (Xiaojun Tan) [1676771]
  - [netdrv] net: hns3: fix a SSU buffer checking bug (Xiaojun Tan) [1676771]
  - [netdrv] net: hns3: aligning buffer size in SSU to 256 bytes (Xiaojun Tan) [1676771]
  - [netdrv] net: hns3: getting tx and dv buffer size through firmware (Xiaojun Tan) [1676771]
  - [net] netfilter: nf_nat_snmp_basic: add missing length checks in ASN.1 cbs (Florian Westphal) [1676602]
  - [char] ipmi: fix use-after-free of user->release_barrier.rda (Xiaojun Tan) [1677550]
  - [char] ipmi: Prevent use-after-free in deliver_response (Xiaojun Tan) [1677550]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-76.el8]
changelog:
  - [security] revert "Add a SysRq option to lift kernel lockdown" (Lenny Szubowicz) [1684348]
  - [s390] s390/setup: fix boot crash for machine without EDAT-1 (Philipp Rudo) [1677357]
  - [s390] s390/setup: fix early warning messages (Philipp Rudo) [1677357]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-77.el8]
changelog:
  - [firmware] efi: Reduce the amount of memblock reservations for persistent allocations (Bhupesh Sharma) [1682988]
  - [firmware] efi: Permit multiple entries in persistent memreserve data structure (Bhupesh Sharma) [1682988]
  - [kernel] cpu/hotplug: Create SMT sysfs interface for all arches (Josh Poimboeuf) [1686068]
  - [net] netfilter: nft_set_hash: bogus element self comparison from deactivation path (Florian Westphal) [1678574]
  - [net] netfilter: nft_set_hash: fix lookups with fixed size hash on big endian (Florian Westphal) [1678574]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-79.el8]
changelog:
  - [firmware] drivers/firmware: psci_checker: stash and use topology_core_cpumask for hotplug tests (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: re-introduce numa mask check for scheduler MC selection (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: rename llc_siblings to align with other struct members (Josh Poimboeuf) [1687101]
  - [arm64] arm64: smp: remove cpu and numa topology information when hotplugging out CPU (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: restrict updating siblings_masks to online cpus only (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: add support to remove cpu topology sibling masks (Josh Poimboeuf) [1687101]
  - [arm64] arm64: numa: separate out updates to percpu nodeid and NUMA node cpumap (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: refactor reset_cpu_topology to add support for removing topology (Josh Poimboeuf) [1687101]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.el8]
changelog:
  - [arm64] revert "arm64: tlb: Avoid synchronous TLBIs when freeing page tables" (Christoph von Recklinghausen) [1685697]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.1.2.el8_0]
changelog:
  - [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [s390] s390/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [powerpc] powerpc/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add 'mitigations=' support for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [kernel] cpu/speculation: Add 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Fix comment (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add SMT warning message (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [documentation] Documentation: Add MDS vulnerability documentation (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [documentation] Documentation: Move L1TF to separate directory (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Consolidate CPU whitelists (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/msr-index: Cleanup bit defines (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Cast ~SPEC_CTRL_STIBP atomic value to int (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [include] locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [tools] tools include: Adopt linux/bits.h (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.3.1.el8_0]
changelog:
  - [mm] mm: enforce min addr even if capable() in expand_downwards() (Rafael Aquini) [1708829 1687667] {CVE-2019-9213}
  - [powerpc] powerpc/radix: Fix kernel crash with mremap() (Steve Best) [1708617 1674186]
  - [powerpc] powerpc/security: Fix spectre_v2 reporting (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/powernv: Query firmware for count cache flush settings (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/pseries: Query hypervisor for count cache flush settings (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64s: Add support for software count cache flush (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64s: Add new security feature flags for count cache flush (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/asm: Add a patch_site macro & helpers for patching instructions (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64: Call setup_barrier_nospec() from setup_arch() (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (Gustavo Duarte) [1708112 1694456]
  - [of] of: __of_detach_node() - remove node from phandle cache (Steve Best) [1708102 1669198]
  - [of] of: of_node_get()/of_node_put() nodes held in phandle cache (Steve Best) [1708102 1669198]
  - [fs] debugfs: Fix EPERM regression from kernel lockdown check (Lenny Szubowicz) [1708100 1686755]
  - [block] nvme: lock NS list changes while handling command effects (David Milburn) [1701140 1672759]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.4.1.el8_0]
changelog:
  - [netdrv] ice: Do autoneg based on VSI state (Jonathan Toppins) [1709433 1687903]
  - [arm64] arm64: apply workaround on A64FX v1r0 (Mark Langsdorf) [1700901 1692306]
  - [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [s390] s390/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [powerpc] powerpc/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add 'mitigations=' support for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kernel] cpu/speculation: Add 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Fix comment (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add SMT warning message (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [documentation] Documentation: Add MDS vulnerability documentation (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [documentation] Documentation: Move L1TF to separate directory (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Consolidate CPU whitelists (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/msr-index: Cleanup bit defines (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Cast ~SPEC_CTRL_STIBP atomic value to int (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [include] locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [tools] tools include: Adopt linux/bits.h (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.5.1.el8_0]
changelog:
  - [kernel] sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup (Joel Savitz) [1715345 1695651]
  - [kernel] sched/fair: Fix O(nr_cgroups) in the load balancing path (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Fix insertion in rq->leaf_cfs_rq_list (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Add tmp_alone_branch assertion (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b9c (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [rpmspec] apply linux-kernel-test.patch when building ("Herton R. Krzesinski") [1715340 1690534]
  - [rpmspec] Fix cross builds (Jiri Olsa) [1715339 1694956]
  - [kernel] sched/fair: Do not re-read ->h_load_next during hierarchical load calculation (Phil Auld) [1715337 1701762]
  - [kvm] KVM: PPC: Book3S HV: Save/restore vrsave register in kvmhv_p9_guest_entry() (Suraj Jitindar Singh) [1714753 1700272]
  - [powerpc] KVM: PPC: Book3S HV: Perserve PSSCR FAKE_SUSPEND bit on guest exit (Suraj Jitindar Singh) [1714751 1689768]
  - [powerpc] powerpc/powernv/ioda: Fix locked_vm counting for memory used by IOMMU tables (David Gibson) [1714746 1674410]
  - [char] ipmi_si: fix use-after-free of resource->name (Tony Camuso) [1714409 1714410] {CVE-2019-11811}
  - [x86] Update stepping values for coffee lake desktop (David Arcari) [1711048 1704800]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.6.1.el8_0]
changelog:
  - [mm] mm: defer ZONE_DEVICE page initialization to the point where we init pgmap (Waiman Long) [1719635 1666538]
  - [mm] mm: create non-atomic version of SetPageReserved for init use (Waiman Long) [1719635 1666538]
  - [mm] mm: provide kernel parameter to allow disabling page init poisoning (Waiman Long) [1719635 1666538]
  - [mm] mm, slub: restore the original intention of prefetch_freepointer() (Rafael Aquini) [1718237 1714671]
  - [security] selinux: do not report error on connect(AF_UNSPEC) (Ondrej Mosnacek) [1717870 1707828]
  - [security] selinux: Check address length before reading address family (Ondrej Mosnacek) [1717870 1707828]
  - [powerpc] powerpc/tm: Fix stack pointer corruption (Desnes Augusto Nunes do Rosario) [1717869 1707635]
  - [md] dm cache metadata: Fix loading discard bitset (Mike Snitzer) [1717868 1701618]
  - [md] dm mpath: fix missing call of path selector type->end_io (Mike Snitzer) [1717804 1686227]
  - [mm] mm/memory.c: do_fault: avoid usage of stale vm_area_struct ("Herton R. Krzesinski") [1717801 1684734]
  - [net] sunrpc: fix 4 more call sites that were using stack memory with a scatterlist (Scott Mayhew) [1717800 1679183]
  - [net] sunrpc: Don't use stack buffer with scatterlist (Scott Mayhew) [1717800 1679183]
  - [scsi] scsi: mpt3sas: Fix kernel panic during expander reset (Tomas Henzl) [1717791 1677693]
  - [security] selinux: always allow mounting submounts (Ondrej Mosnacek) [1717777 1647723]
  - [drm] drm/bufs: Fix Spectre v1 vulnerability (Rob Clark) [1717382 1663467]
  - [drm] drm/ioctl: Fix Spectre v1 vulnerabilities (Rob Clark) [1717382 1663467]
  - [tools] perf annotate: Fix getting source line failure (Michael Petlan) [1716887 1614435]
  - [iommu] iommu/amd: Set exclusion range correctly (Jerry Snitselaar) [1715336 1702766]
  - [iommu] iommu/amd: Reserve exclusion range in iova-domain (Jerry Snitselaar) [1717344 1694835]
  - [kvm] KVM: PPC: Book3S: Add count cache flush parameters to kvmppc_get_cpu_char() (Vitaly Kuznetsov) [1715018 1694456]
  - [s390] kvm: s390: Fix potential spectre warnings (Thomas Huth) [1714754 1702344]
  - [drm] drm/i915/gvt: Fix mmap range check (Alex Williamson) [1713572 1713573] {CVE-2019-11085}
  - [scsi] scsi: megaraid_sas: return error when create DMA pool failed (Tomas Henzl) [1712862 1712863] {CVE-2019-11810}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.7.1.el8_0]
changelog:
  - [x86] Update stepping values for Whiskey Lake U/Y (David Arcari) [1722372 1704801]
  - [x86] x86/perf/amd: Resolve NMI latency issues for active PMCs (David Arcari) [1722367 1640238]
  - [x86] x86/perf/amd: Resolve race condition when disabling PMC (David Arcari) [1722367 1640238]
  - [edac] EDAC/amd64: Set maximum channel layer size depending on family (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Adjust printed chip select sizes when interleaved (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Recognize x16 symbol size (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Support more than two Unified Memory Controllers (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Use a macro for iterating over Unified Memory Controllers (Gary Hook) [1722365 1690984]
  - [edac] EDAC, amd64: Add Family 17h, models 10h-2fh support (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Add Family 17h Model 30h PCI IDs (Aristeu Rozanski) [1722365 1696603]
  - [x86] mark AMD Rome processors supported (David Arcari) [1721972 1520002]
  - [x86] x86/mce: Handle varying MCA bank counts (David Arcari) [1721233 1668779]
  - [iommu] iommu/vt-d: Disable ATS support on untrusted devices (Jerry Snitselaar) [1700376 1692246]
  - [documentation] thunderbolt: Export IOMMU based DMA protection support to userspace (Jerry Snitselaar) [1700376 1692246]
  - [iommu] iommu/vt-d: Do not enable ATS for untrusted devices (Jerry Snitselaar) [1700376 1692246]
  - [iommu] iommu/vt-d: Force IOMMU on for platform opt in hint (Jerry Snitselaar) [1700376 1692246]
  - [pci] PCI / ACPI: Identify untrusted PCI devices (Myron Stowe) [1700376 1704979]
  - [acpi] ACPI / property: Allow multiple property compatible _DSD entries (Myron Stowe) [1700376 1537397]
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719857 1719858] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719602 1719603] {CVE-2019-11477}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.8.1.el8_0]
changelog:
  - [documentation] Documentation: Add ARM64 to kernel-parameters.rst (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: ssbs: Don't treat CPUs with SSBS as unaffected by SSB (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: enable generic CPU vulnerabilites support (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: add sysfs vulnerability show for speculative store bypass (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Always enable ssb vulnerability detection (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: add sysfs vulnerability show for spectre-v2 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Always enable spectre-v2 vulnerability detection (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Use firmware to detect CPUs that are not affected by Spectre-v2 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Advertise mitigation of Spectre-v2, or lack thereof (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: add sysfs vulnerability show for meltdown (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Add sysfs vulnerability show for spectre-v1 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Provide a command line to disable spectre_v2 mitigation (Jeremy Linton) [1726353 1640855]
  - [documentation] powerpc/fsl: Add FSL_PPC_BOOK3E as supported arch for nospectre_v2 boot arg (Jeremy Linton) [1726353 1640855]
  - [documentation] Documentation: Document arm64 kpti control (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Whitelist HiSilicon Taishan v110 CPUs (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Add MIDR encoding for HiSilicon Taishan CPUs (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Whitelist Cortex-A CPUs that don't implement the CSV3 field (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Update arm64_kernel_use_ng_mappings() when forced on (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Avoid rewriting early page tables when KASLR is enabled (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: capabilities: Merge duplicate Cavium erratum entries (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: capabilities: Merge entries for ARM64_WORKAROUND_CLEAN_CACHE (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Use a raw spinlock in __install_bp_hardening_cb() (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: KVM: Guests can skip __install_bp_hardening_cb()s HYP work (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: fix SSBS sanitization (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: don't zero DIT on signal return (Jeremy Linton) [1726353 1640855]
  - [kvm] KVM: arm64: Set SCTLR_EL2.DSSBS if SSBD is forcefully disabled and !vhe (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: ssbd: Add support for PSTATE.SSBS rather than trapping to EL3 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: ssbd: Drop #ifdefs for PR_SPEC_STORE_BYPASS (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: cpufeature: Detect SSBS and advertise to userspace (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: move SCTLR_EL{1,2} assertions to <asm/sysreg.h> (Jeremy Linton) [1726353 1640855]
  - Revert: [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1726353 1640855] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kernel] ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME (Aristeu Rozanski) [1730958 1730959] {CVE-2019-13272}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.9.1.el8_0]
changelog:
  - [netdrv] thunderx: eliminate extra calls to put_page() for pages held for recycling (Dean Nelson) [1726354 1644011]
  - [netdrv] thunderx: enable page recycling for non-XDP case (Dean Nelson) [1726354 1644011]
  - [arm64] arm64: kaslr: ensure randomized quantities are clean also when kaslr is off (Mark Salter) [1726357 1673068]
  - [arm64] arm64: kaslr: ensure randomized quantities are clean to the PoC (Mark Salter) [1726357 1673068]
  - [mm] powerpc/mm/64s/hash: Reallocate context ids on fork (Gustavo Duarte) [1734689 1723808] {CVE-2019-12817}
  - [powerpc] powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration (Steve Best) [1733282 1720929]
  - [powerpc] powerpc/pseries/mobility: prevent cpu hotplug during DT update (Steve Best) [1733282 1720929]
  - [powerpc] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild (Steve Best) [1733282 1720929]
  - [powerpc] powerpc/watchpoint: Restore NV GPRs while returning from exception (Steve Best) [1733281 1728557]
  - [hid] HID: i2c-hid: Don't reset device upon system resume (Perry Yuan) [1727098 1715385]
  - [netdrv] net/mlx5e: RX, Verify MPWQE stride size is in range (Alaa Hleihel) [1726372 1683589]
  - [sound] ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c (Jaroslav Kysela) [1726371 1658924] {CVE-2018-19824}
  - [sound] ALSA: hda - Enable runtime PM only for discrete GPU (Jaroslav Kysela) [1726361 1714817]
  - [cpufreq] cpufreq: intel_pstate: Ignore turbo active ratio in HWP (David Arcari) [1726360 1711970]
  - [infiniband] usnic_verbs: fix deadlock (Govindarajulu Varadarajan) [1726358 1688505]
  - [infiniband] IB/usnic: Fix locking when unregistering (Govindarajulu Varadarajan) [1726358 1688505]
  - [infiniband] IB/usnic: Fix potential deadlock (Govindarajulu Varadarajan) [1726358 1688505]
  - [netdrv] igb: shorten maximum PHC timecounter update interval (Corinna Vinschen) [1726352 1637098]
  - [netdrv] igb: shorten maximum PHC timecounter update interval (Corinna Vinschen) [1726352 1637098]
  - [x86] x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls (Frank Ramsay) [1724534 1677695]
  - [security] selinux: overhaul sidtab to fix bug and improve performance (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: use separate table for initial SID lookup (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: refactor sidtab conversion (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: Cleanup printk logging in sidtab (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: Cleanup printk logging in services (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: Cleanup printk logging in policydb (Ondrej Mosnacek) [1717780 1656787]
  - [crypto] crypto: authenc - fix parsing key with misaligned rta_len (Herbert Xu) [1715335 1707546]
  - [mm] mm, page_alloc: fix has_unmovable_pages for HugePages (David Gibson) [1714758 1688114]
  - [wireless] mwifiex: Abort at too short BSS descriptor element (Jarod Wilson) [1714475 1714476] {CVE-2019-3846}
  - [wireless] mwifiex: Fix possible buffer overflows at parsing bss descriptor (Jarod Wilson) [1714475 1714476] {CVE-2019-3846}
  - [nvme] nvme-pci: add missing unlock for reset error (Gopal Tiwari) [1712261 1703201]
  - [nvme] nvme-pci: fix rapid add remove sequence (Gopal Tiwari) [1712261 1703201]
  - [wireless] brcmfmac: add subtype check for event handling in data path (Stanislaw Gruszka) [1733895 1704684] {CVE-2019-9503}
  - [wireless] brcmfmac: assure SSID length from firmware is limited (Stanislaw Gruszka) [1705385 1705386] {CVE-2019-9500}
  - [include] fs: fix kABI for struct pipe_buf_operations (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [fs] fs: prevent page refcount overflow in pipe_buf_get (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [mm] mm: prevent get_user_pages() from overflowing page refcount (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [include] mm: add 'try_get_page()' helper function (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [include] mm: make page ref count overflow check tighter and more explicit (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [fs] fuse: call pipe_buf_release() under pipe lock (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [kvm] KVM: x86: nVMX: fix x2APIC VTPR read intercept (Vitaly Kuznetsov) [1697198 1697199]
  - [kvm] KVM: x86: nVMX: close leak of L0's x2APIC MSRs (CVE-2019-3887) (Vitaly Kuznetsov) [1697198 1697199]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.10.1.el8_0]
changelog:
  - [x86] x86/entry/64: Use JMP instead of JMPQ (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Carve out CQM features retrieval (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.11.1.el8_0]
changelog:
  - [wireless] mwifiex: Don't abort on small, spec-compliant vendor IEs (Jarod Wilson) [1714475 1728992]
  - [wireless] mwifiex: fix 802.11n/WPA detection (Jarod Wilson) [1714475 1714476] {CVE-2019-3846}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.2.1.el8_0]
changelog:
  - [netdrv] qed: Fix qed_mcp_halt|resume() (Manish Chopra) [1704184 1697310]
  - [cpufreq] cpufreq: intel_pstate: Also use CPPC nominal_perf for base_frequency (Prarit Bhargava) [1706739 1696131]
  - [acpi] ACPI / CPPC: Fix guaranteed performance handling (Prarit Bhargava) [1706739 1696131]
  - [arm64] arm64: Add workaround for Fujitsu A64FX erratum 010001 (Mark Langsdorf) [1700902 1666951]
  - [s390] vfio_ap: link the vfio_ap devices to the vfio_ap bus subsystem (Cornelia Huck) [1700290 1686044]
  - [netdrv] net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [netdrv] net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [pci] PCI: pciehp: Fix re-enabling the slot marked for safe removal (Myron Stowe) [1700288 1695922]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.4.2.el8_0]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719857 1719858] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719602 1719603] {CVE-2019-11477}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.7.2.el8_0]
changelog:
  - [x86] x86/entry/64: Use JMP instead of JMPQ (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Carve out CQM features retrieval (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [kernel] ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME (Aristeu Rozanski) [1730958 1730959] {CVE-2019-13272}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-73.el8]
changelog:
  - [net] tun: forbid iface creation with rtnl ops (Sabrina Dubroca) [1680969]
  - [net] revert "bridge: do not add port to router list when receives query with source 0.0.0.0" (Hangbin Liu) [1679896]
  - [net] sctp: walk the list of asoc safely (Marcelo Leitner) [1679920] {CVE-2019-8956}
  - [net] netfilter: nf_nat: skip nat clash resolution for same-origin entries (Florian Westphal) [1677647]
  - [net] netfilter: nf_conntrack: resolve clash for matching conntracks (Florian Westphal) [1677647]
  - [net] netfilter: nf_tables: fix flush after rule deletion in the same batch (Phil Sutter) [1677672]
  - [net] gro_cell: add napi_disable in gro_cells_destroy (Stefano Brivio) [1674408]
  - [net] sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment (Xin Long) [1669386]
  - [net] ipvs: fix dependency on nf_defrag_ipv6 (Andrea Claudi) [1660808]
  - [net] sctp: check and update stream->out_curr when allocating stream_out (Xin Long) [1651877]


author: Ilya Okomin <ilya.okomin@oracle.com> - [4.18.0-80.el8.OL8]
changelog:
  - Fix Oracle Linux RHCK Module Signing Key addition to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
  - Oracle Linux certificates (Alexey Petrenko)
  - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)
  - Update x509.genkey [Orabug: 24817676]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-105.121.2.el8uek]
changelog:
  - LTS version: v5.15.121 (Jack Vogel)   
  - drm/atomic: Fix potential use-after-free in nonblocking commits (Daniel Vetter)   
  - net/sched: sch_qfq: reintroduce lmax bound check for MTU (Pedro Tammela)   
  - MIPS: kvm: Fix build error with KVM_MIPS_DEBUG_COP0_COUNTERS enabled (Thomas Bogendoerfer)   
  - scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue (Manish Rangankar)   
  - scsi: qla2xxx: Pointer may be dereferenced (Shreyas Deodhar)   
  - scsi: qla2xxx: Correct the index of array (Bikash Hazarika)   
  - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() (Nilesh Javali)   
  - scsi: qla2xxx: Fix potential NULL pointer dereference (Bikash Hazarika)   
  - scsi: qla2xxx: Fix buffer overrun (Quinn Tran)   
  - scsi: qla2xxx: Avoid fcport pointer dereference (Nilesh Javali)   
  - scsi: qla2xxx: Array index may go out of bound (Nilesh Javali)   
  - scsi: qla2xxx: Wait for io return on terminate rport (Quinn Tran)   
  - tracing/probes: Fix to update dynamic data counter if fetcharg uses it (Masami Hiramatsu (Google))   
  - tracing/probes: Fix not to count error code to total length (Masami Hiramatsu (Google))   
  - selftests: mptcp: depend on SYN_COOKIES (Matthieu Baerts)   
  - selftests: mptcp: sockopt: return error if wrong mark (Matthieu Baerts)   
  - tracing: Fix null pointer dereference in tracing_err_log_open() (Mateusz Stachyra)   
  - xtensa: ISS: fix call to split_if_spec (Max Filippov)   
  - ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() (Zheng Yejian)   
  - ring-buffer: Fix deadloop issue on reading trace_pipe (Zheng Yejian)   
  - net: ena: fix shift-out-of-bounds in exponential backoff (Krister Johansen)   
  - samples: ftrace: Save required argument registers in sample trampolines (Florent Revest)   
  - tracing: Fix memory leak of iter->temp when reading trace_pipe (Zheng Yejian)   
  - tracing/histograms: Add histograms to hist_vars if they have referenced variables (Mohamed Khalfella)   
  - s390/decompressor: fix misaligned symbol build error (Heiko Carstens)   
  - bus: ixp4xx: fix IXP4XX_EXP_T1_MASK (Jonas Gorski)   
  - Revert "8250: add support for ASIX devices with a FIFO bug" (Jiaqing Zhao)   
  - soundwire: qcom: fix storing port config out-of-bounds (Krzysztof Kozlowski)   
  - opp: Fix use-after-free in lazy_opp_tables after probe deferral (Stephan Gerhold)   
  - meson saradc: fix clock divider mask length (George Stark)   
  - xhci: Show ZHAOXIN xHCI root hub speed correctly (Weitao Wang)   
  - xhci: Fix TRB prefetch issue of ZHAOXIN hosts (Weitao Wang)   
  - xhci: Fix resume issue of some ZHAOXIN hosts (Weitao Wang)   
  - ceph: don't let check_caps skip sending responses for revoke msgs (Xiubo Li)   
  - libceph: harden msgr2.1 frame segment length checks (Ilya Dryomov)   
  - firmware: stratix10-svc: Fix a potential resource leak in svc_create_memory_pool() (Christophe JAILLET)   
  - tty: serial: imx: fix rs485 rx after tx (Martin Fuzzey)   
  - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() when iterating clk (Christophe JAILLET)   
  - tty: serial: samsung_tty: Fix a memory leak in s3c24xx_serial_getclk() in case of error (Christophe JAILLET)   
  - serial: atmel: don't enable IRQs prematurely (Dan Carpenter)   
  - drm/ttm: Don't leak a resource on swapout move error (Thomas Hellström)   
  - drm/amdgpu: avoid restore process run into dead loop. (gaba)   
  - drm/amd/display: Correct `DMUB_FW_VERSION` macro (Mario Limonciello)   
  - drm/amdgpu: fix clearing mappings for BOs that are always valid in VM (Samuel Pitoiset)   
  - drm/rockchip: vop: Leave vblank enabled in self-refresh (Brian Norris)   
  - drm/atomic: Allow vblank-enabled + self-refresh "disable" (Brian Norris)   
  - fs: dlm: return positive pid value for F_GETLK (Alexander Aring)   
  - dm init: add dm-mod.waitfor to wait for asynchronously probed block devices (Peter Korsgaard)   
  - md/raid0: add discard support for the 'original' layout (Jason Baron)   
  - mfd: pm8008: Fix module autoloading (Johan Hovold)   
  - misc: pci_endpoint_test: Re-init completion for every test (Damien Le Moal)   
  - misc: pci_endpoint_test: Free IRQs before removing the device (Damien Le Moal)   
  - PCI: rockchip: Set address alignment for endpoint mode (Damien Le Moal)   
  - PCI: rockchip: Use u32 variable to access 32-bit registers (Rick Wertenbroek)   
  - PCI: rockchip: Fix legacy IRQ generation for RK3399 PCIe endpoint core (Rick Wertenbroek)   
  - PCI: rockchip: Add poll and timeout to wait for PHY PLLs to be locked (Rick Wertenbroek)   
  - PCI: rockchip: Write PCI Device ID to correct register (Rick Wertenbroek)   
  - PCI: rockchip: Assert PCI Configuration Enable bit after probe (Rick Wertenbroek)   
  - PCI: qcom: Disable write access to read only registers for IP v2.3.3 (Manivannan Sadhasivam)   
  - PCI: Add function 1 DMA alias quirk for Marvell 88SE9235 (Robin Murphy)   
  - PCI/PM: Avoid putting EloPOS E2/S2/H2 PCIe Ports in D3cold (Ondrej Zary)   
  - dm integrity: reduce vmalloc space footprint on 32-bit architectures (Mikulas Patocka)   
  - hwrng: imx-rngc - fix the timeout for init and self check (Martin Kaiser)   
  - jfs: jfs_dmap: Validate db_l2nbperpage while mounting (Siddh Raman Pant)   
  - ext4: only update i_reserved_data_blocks on successful block allocation (Baokun Li)   
  - ext4: turn quotas off if mount failed after enabling quotas (Baokun Li)   
  - ext4: fix to check return value of freeze_bdev() in ext4_shutdown() (Chao Yu)   
  - ext4: fix wrong unit use in ext4_mb_new_blocks (Kemeng Shi)   
  - ext4: get block from bh in ext4_free_blocks for fast commit replay (Kemeng Shi)   
  - ext4: fix wrong unit use in ext4_mb_clear_bb (Kemeng Shi)   
  - ext4: Fix reusing stale buffer heads from last failed mounting (Zhihao Cheng)   
  - MIPS: KVM: Fix NULL pointer dereference (Huacai Chen)   
  - MIPS: Loongson: Fix cpu_probe_loongson() again (Huacai Chen)   
  - erofs: fix compact 4B support for 16k block size (Gao Xiang)   
  - powerpc/security: Fix Speculation_Store_Bypass reporting on Power10 (Michael Ellerman)   
  - misc: fastrpc: Create fastrpc scalar with correct buffer count (Ekansh Gupta)   
  - powerpc: Fail build if using recordmcount with binutils v2.37 (Naveen N Rao)   
  - mm/damon/ops-common: atomically test and clear young on ptes and pmds (Ryan Roberts)   
  - net: bcmgenet: Ensure MDIO unregistration has clocks enabled (Florian Fainelli)   
  - mtd: rawnand: meson: fix unaligned DMA buffers handling (Arseniy Krasnov)   
  - tpm: tpm_vtpm_proxy: fix a race condition in /dev/vtpmx creation (Jarkko Sakkinen)   
  - pinctrl: amd: Only use special debounce behavior for GPIO 0 (Mario Limonciello)   
  - pinctrl: amd: Detect and mask spurious interrupts (Kornel Dulęba)   
  - pinctrl: amd: Detect internal GPIO0 debounce handling (Mario Limonciello)   
  - pinctrl: amd: Fix mistake in handling clearing pins at startup (Mario Limonciello)   
  - f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io() (Chao Yu)   
  - fs/ntfs3: Check fields while reading (Konstantin Komarov)   
  - nvme-pci: fix DMA direction of unmapping integrity data (Ming Lei)   
  - nvme-pci: remove nvme_queue from nvme_iod (Keith Busch)   
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Pedro Tammela)   
  - net/sched: sch_qfq: refactor parsing of netlink parameters (Pedro Tammela)   
  - net/sched: make psched_mtu() RTNL-less safe (Pedro Tammela)   
  - netdevsim: fix uninitialized data in nsim_dev_trap_fa_cookie_write() (Dan Carpenter)   
  - riscv: mm: fix truncation warning on RV32 (Jisheng Zhang)   
  - net/sched: flower: Ensure both minimum and maximum ports are specified (Ido Schimmel)   
  - bpf: cpumap: Fix memory leak in cpu_map_update_elem (Pu Lehui)   
  - wifi: airo: avoid uninitialized warning in airo_get_rate() (Randy Dunlap)   
  - erofs: fix fsdax unavailability for chunk-based regular files (Xin Yin)   
  - erofs: decouple basic mount options from fs_context (Gao Xiang)   
  - erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF (Chunhai Guo)   
  - octeontx2-pf: Add additional check for MCAM rules (Suman Ghosh)   
  - drm/i915: Fix one wrong caching mode enum usage (Tvrtko Ursulin)   
  - riscv, bpf: Fix inconsistent JIT image generation (Björn Töpel)   
  - bpf, riscv: Support riscv jit to provide bpf_line_info (Pu Lehui)   
  - igc: Fix inserting of empty frame for launchtime (Florian Kauer)   
  - igc: Fix launchtime before start of cycle (Florian Kauer)   
  - kernel/trace: Fix cleanup logic of enable_trace_eprobe (Tzvetomir Stoyanov (VMware))   
  - platform/x86: wmi: Break possible infinite loop when parsing GUID (Andy Shevchenko)   
  - platform/x86: wmi: move variables (Barnabás Pőcze)   
  - platform/x86: wmi: use guid_t and guid_equal() (Barnabás Pőcze)   
  - platform/x86: wmi: remove unnecessary argument (Barnabás Pőcze)   
  - ipv6/addrconf: fix a potential refcount underflow for idev (Ziyang Xuan)   
  - NTB: ntb_tool: Add check for devm_kcalloc (Jiasheng Jiang)   
  - NTB: ntb_transport: fix possible memory leak while device_register() fails (Yang Yingliang)   
  - ntb: intel: Fix error handling in intel_ntb_pci_driver_init() (Yuan Can)   
  - NTB: amd: Fix error handling in amd_ntb_pci_driver_init() (Yuan Can)   
  - ntb: idt: Fix error handling in idt_pci_driver_init() (Yuan Can)   
  - udp6: fix udp6_ehashfn() typo (Eric Dumazet)   
  - icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). (Kuniyuki Iwashima)   
  - net: prevent skb corruption on frag list segmentation (Paolo Abeni)   
  - net: bgmac: postpone turning IRQs off to avoid SoC hangs (Rafał Miłecki)   
  - ionic: remove WARN_ON to prevent panic_on_warn (Nitya Sunkad)   
  - gve: Set default duplex configuration to full (Junfeng Guo)   
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (M A Ramdhan)   
  - net: mvneta: fix txq_map in case of txq_number==1 (Klaus Kudielka)   
  - bpf: Fix max stack depth check for async callbacks (Kumar Kartikeya Dwivedi)   
  - scsi: qla2xxx: Fix error code in qla2x00_start_sp() (Dan Carpenter)   
  - igc: Handle PPS start time programming for past time values (Aravindhan Gunasekaran)   
  - igc: set TP bit in 'supported' and 'advertising' fields of ethtool_link_ksettings (Prasad Koya)   
  - net/mlx5e: Check for NOT_READY flag state after locking (Vlad Buslov)   
  - net/mlx5e: fix memory leak in mlx5e_ptp_open (Zhengchao Shao)   
  - net/mlx5e: fix double free in mlx5e_destroy_flow_table (Zhengchao Shao)   
  - igc: Remove delay during TX ring configuration (Muhammad Husaini Zulkifli)   
  - drm/panel: simple: Add Powertip PH800480T013 drm_display_mode flags (Marek Vasut)   
  - drm/bridge: ti-sn65dsi86: Fix auxiliary bus lifetime (Douglas Anderson)   
  - drm/panel: simple: Add connector_type for innolux_at043tn24 (Fabio Estevam)   
  - ksmbd: validate session id and tree id in the compound request (Namjae Jeon)   
  - ksmbd: fix out-of-bound read in smb2_write (Namjae Jeon)   
  - ksmbd: validate command payload size (Namjae Jeon)   
  - ksmbd: use ksmbd_req_buf_next() in ksmbd_smb2_check_message() (Ralph Boehme)   
  - workqueue: clean up WORK_* constant types, clarify masking (Linus Torvalds)   
  - net: lan743x: Don't sleep in atomic context (Moritz Fischer)   
  - io_uring: add reschedule point to handle_tw_list() (Jens Axboe)   
  - io_uring: Use io_schedule* in cqring wait (Andres Freund)   
  - block/partition: fix signedness issue for Amiga partitions (Michael Schmitz)   
  - tty: serial: fsl_lpuart: add earlycon for imx8ulp platform (Sherry Sun)   
  - wireguard: netlink: send staged packets when setting initial private key (Jason A. Donenfeld)   
  - wireguard: queueing: use saner cpu selection wrapping (Jason A. Donenfeld)   
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Thadeu Lima de Souza Cascardo)   
  - netfilter: nf_tables: do not ignore genmask when looking up chain by id (Thadeu Lima de Souza Cascardo)   
  - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free (Florent Revest)   
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Pablo Neira Ayuso)   
  - fanotify: disallow mount/sb marks on kernel internal pseudo fs (Amir Goldstein)   
  - ovl: fix null pointer dereference in ovl_get_acl_rcu() (Zhihao Cheng)   
  - fs: no need to check source (Jan Kara)   
  - leds: trigger: netdev: Recheck NETDEV_LED_MODE_LINKUP on dev rename (Christian Marangi)   
  - ARM: orion5x: fix d2net gpio initialization (Arnd Bergmann)   
  - ARM: dts: qcom: ipq4019: fix broken NAND controller properties override (Krzysztof Kozlowski)   
  - ASoC: mediatek: mt8173: Fix snd_soc_component_initialize error path (Ricardo Ribalda Delgado)   
  - ASoC: mediatek: mt8173: Fix irq error path (Ricardo Ribalda Delgado)   
  - btrfs: do not BUG_ON() on tree mod log failure at __btrfs_cow_block() (Filipe Manana)   
  - btrfs: fix extent buffer leak after tree mod log failure at split_node() (Filipe Manana)   
  - btrfs: fix race when deleting quota root from the dirty cow roots list (Filipe Manana)   
  - btrfs: reinsert BGs failed to reclaim (Naohiro Aota)   
  - btrfs: bail out reclaim process if filesystem is read-only (Naohiro Aota)   
  - btrfs: delete unused BGs while reclaiming BGs (Naohiro Aota)   
  - btrfs: add handling for RAID1C23/DUP to btrfs_reduce_alloc_profile (Matt Corallo)   
  - fs: avoid empty option when generating legacy mount string (Thomas Weißschuh)   
  - jffs2: reduce stack usage in jffs2_build_xattr_subsystem() (Fabian Frederick)   
  - ipvs: increase ip_vs_conn_tab_bits range for 64BIT (Abhijeet Rastogi)   
  - fs: Lock moved directories (Jan Kara)   
  - fs: Establish locking order for unrelated directories (Jan Kara)   
  - Revert "f2fs: fix potential corruption when moving a directory" (Jan Kara)   
  - ext4: Remove ext4 locking of moved directory (Jan Kara)   
  - shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs (Roberto Sassu)   
  - autofs: use flexible array in ioctl structure (Arnd Bergmann)   
  - integrity: Fix possible multiple allocation in integrity_inode_get() (Tianjia Zhang)   
  - um: Use HOST_DIR for mrproper (Kees Cook)   
  - bcache: Fix __bch_btree_node_alloc to make the failure behavior consistent (Zheng Wang)   
  - bcache: Remove unnecessary NULL point check in node allocations (Zheng Wang)   
  - bcache: fixup btree_cache_wait list damage (Mingzhe Zou)   
  - mmc: sdhci: fix DMA configure compatibility issue when 64bit DMA mode is used. (Chevron Li)   
  - mmc: mmci: Set PROBE_PREFER_ASYNCHRONOUS (Ulf Hansson)   
  - mmc: core: disable TRIM on Micron MTFC4GACAJCN-1M (Robert Marko)   
  - mmc: core: disable TRIM on Kingston EMMC04G-M627 (Robert Marko)   
  - io_uring: wait interruptibly for request completions on exit (Jens Axboe)   
  - NFSD: add encoding of op_recall flag for write delegation (Dai Ngo)   
  - i2c: qup: Add missing unwind goto in qup_i2c_probe() (Shuai Jiang)   
  - btrfs: do not BUG_ON() on tree mod log failure at balance_level() (Filipe Manana)   
  - extcon: usbc-tusb320: Convert to i2c's .probe_new() (Uwe Kleine-König)   
  - i2c: xiic: Don't try to handle more interrupt events after error (Robert Hancock)   
  - i2c: xiic: Defer xiic_wakeup() and __xiic_start_xfer() in xiic_process() (Marek Vasut)   
  - apparmor: fix missing error check for rhashtable_insert_fast (Danila Chernetsov)   
  - sh: dma: Fix DMA channel offset calculation (Artur Rojek)   
  - s390/qeth: Fix vipa deletion (Thorsten Winkler)   
  - octeontx-af: fix hardware timestamp configuration (Hariprasad Kelam)   
  - net: dsa: tag_sja1105: fix MAC DA patching from meta frames (Vladimir Oltean)   
  - pptp: Fix fib lookup calls. (Guillaume Nault)   
  - riscv: move memblock_allow_resize() after linear mapping is ready (Woody Zhang)   
  - net/sched: act_pedit: Add size check for TCA_PEDIT_PARMS_EX (Lin Ma)   
  - xsk: Honor SO_BINDTODEVICE on bind (Ilya Maximets)   
  - tcp: annotate data races in __tcp_oow_rate_limited() (Eric Dumazet)   
  - net: bridge: keep ports without IFF_UNICAST_FLT in BR_PROMISC mode (Vladimir Oltean)   
  - powerpc: allow PPC_EARLY_DEBUG_CPM only when SERIAL_CPM=y (Randy Dunlap)   
  - ntfs: Fix panic about slab-out-of-bounds caused by ntfs_listxattr() (Zeng Heng)   
  - octeontx2-af: Add validation before accessing cgx and lmac (Hariprasad Kelam)   
  - octeontx2-af: Fix mapping for NIX block from CGX connection (Hariprasad Kelam)   
  - f2fs: fix error path handling in truncate_dnode() (Chao Yu)   
  - mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0 (Nishanth Menon)   
  - spi: bcm-qspi: return error if neither hif_mspi nor mspi is available (Jonas Gorski)   
  - net: dsa: vsc73xx: fix MTU configuration (Pawel Dembicki)   
  - ibmvnic: Do not reset dql stats on NON_FATAL err (Nick Child)   
  - Add MODULE_FIRMWARE() for FIRMWARE_TG357766. (Tobias Heider)   
  - net/sched: act_ipt: add sanity checks on table name and hook locations (Florian Westphal)   
  - sctp: fix potential deadlock on &net->sctp.addr_wq_lock (Chengfeng Ye)   
  - media: cec: i2c: ch7322: also select REGMAP (Randy Dunlap)   
  - drm/i915/psr: Use hw.adjusted mode when calculating io/fast wake times (Jouni Högander)   
  - rtc: st-lpc: Release some resources in st_rtc_probe() in case of error (Christophe JAILLET)   
  - md/raid10: fix the condition to call bio_end_io_acct() (Li Nan)   
  - pwm: mtk_disp: Fix the disable flow of disp_pwm (Shuijing Li)   
  - pwm: ab8500: Fix error code in probe() (Dan Carpenter)   
  - pwm: sysfs: Do not apply state to already disabled PWMs (Marek Vasut)   
  - pwm: imx-tpm: force 'real_period' to be zero in suspend (Fancy Fang)   
  - phy: tegra: xusb: check return value of devm_kzalloc() (Claudiu Beznea)   
  - mfd: stmpe: Only disable the regulators if they are enabled (Christophe JAILLET)   
  - KVM: s390/diag: fix racy access of physical cpu number in diag 9c handler (Christian Borntraeger)   
  - KVM: s390: vsie: fix the length of APCB bitmap (Pierre Morel)   
  - mfd: stmfx: Nullify stmfx->vdd in case of error (Amelie Delaunay)   
  - mfd: stmfx: Fix error path in stmfx_chip_init (Amelie Delaunay)   
  - nvmem: rmem: Use NVMEM_DEVID_AUTO (Phil Elwell)   
  - test_firmware: return ENOMEM instead of ENOSPC on failed memory allocation (Mirsad Goran Todorovac)   
  - serial: 8250_omap: Use force_suspend and resume for system suspend (Tony Lindgren)   
  - Revert "usb: common: usb-conn-gpio: Set last role to unknown before initial detection" (Greg Kroah-Hartman)   
  - mfd: intel-lpss: Add missing check for platform_get_resource (Jiasheng Jiang)   
  - usb: dwc3-meson-g12a: Fix an error handling path in dwc3_meson_g12a_probe() (Christophe JAILLET)   
  - usb: common: usb-conn-gpio: Set last role to unknown before initial detection (Prashanth K)   
  - usb: dwc3: qcom: Fix an error handling path in dwc3_qcom_probe() (Christophe JAILLET)   
  - usb: dwc3: qcom: Release the correct resources in dwc3_qcom_remove() (Christophe JAILLET)   
  - KVM: s390: fix KVM_S390_GET_CMMA_BITS for GFNs in memslot holes (Nico Boehr)   
  - media: atomisp: gmin_platform: fix out_len in gmin_get_config_dsm_var() (Dan Carpenter)   
  - media: venus: helpers: Fix ALIGN() of non power of two (Rikard Falkeborn)   
  - mfd: rt5033: Drop rt5033-battery sub-device (Stephan Gerhold)   
  - coresight: Fix loss of connection info when a module is unloaded (James Clark)   
  - kernfs: fix missing kernfs_idr_lock to remove an ID from the IDR (Muchun Song)   
  - serial: 8250: lock port for UART_IER access in omap8250_irq() (John Ogness)   
  - serial: 8250: lock port for stop_rx() in omap8250_irq() (John Ogness)   
  - usb: hide unused usbfs_notify_suspend/resume functions (Arnd Bergmann)   
  - usb: phy: phy-tahvo: fix memory leak in tahvo_usb_probe() (Li Yang)   
  - extcon: Fix kernel doc of property capability fields to avoid warnings (Andy Shevchenko)   
  - extcon: Fix kernel doc of property fields to avoid warnings (Andy Shevchenko)   
  - usb: gadget: u_serial: Add null pointer check in gserial_suspend (Prashanth K)   
  - usb: dwc3: qcom: Fix potential memory leak (Vladislav Efanov)   
  - clk: qcom: ipq6018: fix networking resets (Robert Marko)   
  - clk: qcom: reset: support resetting multiple bits (Robert Marko)   
  - clk: qcom: reset: Allow specifying custom reset delay (Stephan Gerhold)   
  - media: i2c: Correct format propagation for st-mipid02 (Daniel Scally)   
  - media: usb: siano: Fix warning due to null work_func_t function pointer (Duoming Zhou)   
  - media: videodev2.h: Fix struct v4l2_input tuner index comment (Marek Vasut)   
  - media: usb: Check az6007_read() return value (Daniil Dulov)   
  - clk: qcom: gcc-ipq6018: Use floor ops for sdcc clocks (Mantas Pucka)   
  - clk: qcom: camcc-sc7180: Add parent dependency to all camera GDSCs (Taniya Das)   
  - serial: 8250: omap: Fix freeing of resources on failed register (Tony Lindgren)   
  - usb: dwc2: Fix some error handling paths (Christophe JAILLET)   
  - usb: dwc2: platform: Improve error reporting for problems during .remove() (Uwe Kleine-König)   
  - sh: j2: Use ioremap() to translate device tree address into kernel memory (John Paul Adrian Glaubitz)   
  - w1: fix loop in w1_fini() (Dan Carpenter)   
  - w1: w1_therm: fix locking behavior in convert_t (Stefan Wahren)   
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (Ding Hui)   
  - block: increment diskseq on all media change events (Demi Marie Obenour)   
  - block: change all __u32 annotations to __be32 in affs_hardblocks.h (Michael Schmitz)   
  - block: add overflow checks for Amiga partition support (Michael Schmitz)   
  - block: fix signed int overflow in Amiga partition support (Michael Schmitz)   
  - ALSA: jack: Fix mutex call in snd_jack_report() (Takashi Iwai)   
  - ALSA: hda/realtek: Add quirk for Clevo NPx0SNx (Werner Sembach)   
  - iio: accel: fxls8962af: fixup buffer scan element type (Sean Nyekjaer)   
  - iio: accel: fxls8962af: errata bug only applicable for FXLS8962AF (Sean Nyekjaer)   
  - iio: adc: ad7192: Fix internal/external clock selection (Fabrizio Lamarque)   
  - iio: adc: ad7192: Fix null ad7192_state pointer access (Fabrizio Lamarque)   
  - phy: tegra: xusb: Clear the driver reference in usb-phy dev (EJ Hsu)   
  - usb: dwc3: gadget: Propagate core init errors to UDC during pullup (Krishna Kurapati)   
  - USB: serial: option: add LARA-R6 01B PIDs (Davide Tronchin)   
  - io_uring: ensure IOPOLL locks around deferred work (Jens Axboe)   
  - bootmem: remove the vmemmap pages from kmemleak in free_bootmem_page (Liu Shixin)   
  - ACPI: utils: Fix acpi_evaluate_dsm_typed() redefinition error (Kiran K)   
  - ksmbd: avoid field overflow warning (Arnd Bergmann)   
  - efi/libstub: Disable PCI DMA before grabbing the EFI memory map (Ard Biesheuvel)   
  - kbuild: Disable GCOV for *.mod.o (Sami Tolvanen)   
  - hwrng: st - keep clock enabled while hwrng is registered (Martin Kaiser)   
  - dax/kmem: Pass valid argument to memory_group_register_static (Tarun Sahu)   
  - dax: Introduce alloc_dev_dax_id() (Dan Williams)   
  - dax: Fix dax_mapping_release() use after free (Dan Williams)   
  - SMB3: Do not send lease break acknowledgment if all file handles have been closed (Bharath SM)   
  - NFSv4.1: freeze the session table upon receiving NFS4ERR_BADSESSION (Olga Kornievskaia)   
  - crypto: qat - unmap buffers before free for RSA (Hareshx Sankar Raj)   
  - crypto: qat - unmap buffer before free for DH (Hareshx Sankar Raj)   
  - crypto: qat - Use helper to set reqsize (Herbert Xu)   
  - crypto: kpp - Add helper to set reqsize (Herbert Xu)   
  - crypto: qat - use reference to structure in dma_map_single() (Damian Muszynski)   
  - crypto: qat - replace get_current_node() with numa_node_id() (Andre Przywara)   
  - ARC: define ASM_NL and __ALIGN(_STR) outside #ifdef __ASSEMBLY__ guard (Masahiro Yamada)   
  - modpost: fix off by one in is_executable_section() (Dan Carpenter)   
  - crypto: marvell/cesa - Fix type mismatch warning (Arnd Bergmann)   
  - modpost: fix section mismatch message for R_ARM_{PC24,CALL,JUMP24} (Masahiro Yamada)   
  - modpost: fix section mismatch message for R_ARM_ABS32 (Masahiro Yamada)   
  - crypto: nx - fix build warnings when DEBUG_FS is not enabled (Randy Dunlap)   
  - modpost: remove broken calculation of exception_table_entry size (Masahiro Yamada)   
  - hwrng: virtio - Fix race on data_avail and actual data (Herbert Xu)   
  - hwrng: virtio - always add a pending request (Laurent Vivier)   
  - hwrng: virtio - don't waste entropy (Laurent Vivier)   
  - hwrng: virtio - don't wait on cleanup (Laurent Vivier)   
  - hwrng: virtio - add an internal buffer (Laurent Vivier)   
  - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Aneesh Kumar K.V)   
  - powerpc/book3s64/mm: Fix DirectMap stats in /proc/meminfo (Aneesh Kumar K.V)   
  - riscv: uprobes: Restore thread.bad_cause (Tiezhu Yang)   
  - powerpc: update ppc_save_regs to save current r1 in pt_regs (Aditya Gupta)   
  - powerpc: simplify ppc_save_regs (Nicholas Piggin)   
  - powerpc/powernv/sriov: perform null check on iov before dereferencing iov (Colin Ian King)   
  - pinctrl: at91-pio4: check return value of devm_kasprintf() (Claudiu Beznea)   
  - pinctrl: microchip-sgpio: check return value of devm_kasprintf() (Claudiu Beznea)   
  - powerpc/64s: Fix VAS mm use after free (Nicholas Piggin)   
  - perf dwarf-aux: Fix off-by-one in die_get_varname() (Namhyung Kim)   
  - perf script: Fix allocation of evsel->priv related to per-event dump files (Arnaldo Carvalho de Melo)   
  - powerpc/signal32: Force inlining of __unsafe_save_user_regs() and save_tm_user_regs_unsafe() (Christophe Leroy)   
  - powerpc/interrupt: Don't read MSR from interrupt_exit_kernel_prepare() (Christophe Leroy)   
  - kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures (Christophe Leroy)   
  - pinctrl: cherryview: Return correct value if pin in push-pull mode (Andy Shevchenko)   
  - perf bench: Add missing setlocale() call to allow usage of %'d style formatting (Arnaldo Carvalho de Melo)   
  - perf bench: Use unbuffered output when pipe/tee'ing to a file (Sohaib Mohamed)   
  - PCI: Add pci_clear_master() stub for non-CONFIG_PCI (Sui Jingfeng)   
  - PCI: ftpci100: Release the clock resources (Junyan Ye)   
  - PCI: pciehp: Cancel bringup sequence if card is not present (Rongguang Wei)   
  - scsi: 3w-xxxx: Add error handling for initialization failure in tw_probe() (Yuchen Yang)   
  - PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free (Ding Hui)   
  - pinctrl: bcm2835: Handle gpiochip_add_pin_range() errors (Christophe JAILLET)   
  - scsi: qedf: Fix NULL dereference in error handling (Jinhong Zhu)   
  - PCI: vmd: Reset VMD config register between soft reboots (Nirmal Patel)   
  - PCI: cadence: Fix Gen2 Link Retraining process (Siddharth Vadapalli)   
  - clk: Fix memory leak in devm_clk_notifier_register() (Fei Shao)   
  - ASoC: imx-audmix: check return value of devm_kasprintf() (Claudiu Beznea)   
  - ovl: update of dentry revalidate flags after copy up (Amir Goldstein)   
  - drivers: meson: secure-pwrc: always enable DMA domain (Alexey Romanov)   
  - clk: ti: clkctrl: check return value of kasprintf() (Claudiu Beznea)   
  - clk: keystone: sci-clk: check return value of kasprintf() (Claudiu Beznea)   
  - clk: si5341: free unused memory on probe failure (Claudiu Beznea)   
  - clk: si5341: check return value of {devm_}kasprintf() (Claudiu Beznea)   
  - clk: si5341: return error if one synth clock registration fails (Claudiu Beznea)   
  - clk: cdce925: check return value of kasprintf() (Claudiu Beznea)   
  - clk: vc5: check memory returned by kasprintf() (Claudiu Beznea)   
  - drm/msm/dpu: correct MERGE_3D length (Dmitry Baryshkov)   
  - arm64: dts: mediatek: mt8192: Fix CPUs capacity-dmips-mhz (Nícolas F. R. A. Prado)   
  - arm64: dts: mediatek: Add cpufreq nodes for MT8192 (Allen-KH Cheng)   
  - drm/msm/dp: Free resources after unregistering them (Bjorn Andersson)   
  - drm/msm/dpu: do not enable color-management if DSPPs are not available (Dmitry Baryshkov)   
  - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer (Su Hui)   
  - clk: tegra: tegra124-emc: Fix potential memory leak (Yuan Can)   
  - clk: clocking-wizard: Fix Oops in clk_wzrd_register_divider() (Dan Carpenter)   
  - arm64: dts: qcom: sm8250-edo: Panel framebuffer is 2.5k instead of 4k (Marijn Suijten)   
  - clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() (Yuxing Liu)   
  - clk: imx: clk-imx8mn: fix memory leak in imx8mn_clocks_probe (Hao Luo)   
  - RDMA/bnxt_re: Avoid calling wake_up threads from spin_lock context (Kashyap Desai)   
  - RDMA/bnxt_re: wraparound mbox producer index (Kashyap Desai)   
  - drm/msm/a5xx: really check for A510 in a5xx_gpu_init (Dmitry Baryshkov)   
  - amdgpu: validate offset_in_bo of drm_amdgpu_gem_va (Chia-I Wu)   
  - drm/radeon: fix possible division-by-zero errors (Nikita Zhandarovich)   
  - drm/amd/display: Fix artifacting on eDP panels when engaging freesync video mode (Aurabindo Pillai)   
  - drm/amdkfd: Fix potential deallocation of previously deallocated memory. (Daniil Dulov)   
  - ARM: dts: BCM5301X: fix duplex-full => full-duplex (Christian Lamparter)   
  - hwmon: (pmbus/adm1275) Fix problems with temperature monitoring on ADM1272 (Guenter Roeck)   
  - hwmon: (adm1275) Allow setting sample averaging (Potin Lai)   
  - hwmon: (gsc-hwmon) fix fan pwm temperature scaling (Tim Harvey)   
  - ARM: dts: stm32: fix i2s endpoint format property for stm32mp15xx-dkx (Olivier Moysan)   
  - ARM: dts: stm32: Fix audio routing on STM32MP15xx DHCOM PDK2 (Marek Vasut)   
  - arm64: dts: ti: k3-j7200: Fix physical address of pin (Keerthy)   
  - fbdev: omapfb: lcd_mipid: Fix an error handling path in mipid_spi_probe() (Christophe JAILLET)   
  - arm64: dts: renesas: ulcb-kf: Remove flow control for SCIF1 (Wolfram Sang)   
  - ARM: dts: iwg20d-q7-common: Fix backlight pwm specifier (Geert Uytterhoeven)   
  - RDMA/hns: Fix hns_roce_table_get return value (Chengchang Tang)   
  - IB/hfi1: Fix wrong mmu_node used for user SDMA packet after invalidate (Brendan Cunningham)   
  - IB/hfi1: Use bitmap_zalloc() when applicable (Christophe JAILLET)   
  - RDMA/irdma: avoid fortify-string warning in irdma_clr_wqes (Arnd Bergmann)   
  - soc/fsl/qe: fix usb.c build errors (Randy Dunlap)   
  - ARM: dts: meson8: correct uart_B and uart_C clock references (Martin Blumenstingl)   
  - ASoC: es8316: Do not set rate constraints for unsupported MCLKs (Cristian Ciocaltea)   
  - ASoC: es8316: Increment max value for ALC Capture Target Volume control (Cristian Ciocaltea)   
  - memory: brcmstb_dpfe: fix testing array offset after use (Krzysztof Kozlowski)   
  - ARM: dts: stm32: Shorten the AV96 HDMI sound card name (Marek Vasut)   
  - arm64: dts: mediatek: mt8183: Add mediatek,broken-save-restore-fw to kukui (Douglas Anderson)   
  - arm64: dts: qcom: apq8096: fix fixed regulator name property (Krzysztof Kozlowski)   
  - ARM: omap2: fix missing tick_broadcast() prototype (Arnd Bergmann)   
  - ARM: ep93xx: fix missing-prototype warnings (Arnd Bergmann)   
  - drm/panel: simple: fix active size for Ampire AM-480272H3TMQW-T01H (Dario Binacchi)   
  - arm64: dts: qcom: apq8016-sbc: Fix 1.8V power rail on LS expansion (Stephan Gerhold)   
  - arm64: dts: qcom: apq8016-sbc: Fix regulator constraints (Stephan Gerhold)   
  - arm64: dts: qcom: Drop unneeded extra device-specific includes (Stephan Gerhold)   
  - arm64: dts: qcom: apq8016-sbc: fix mpps state names (Dmitry Baryshkov)   
  - arm64: dts: qcom: apq8016-sbc: Clarify firmware-names (Stephan Gerhold)   
  - arm64: dts: qcom: apq8016-sbc: Update modem and WiFi firmware path (Bjorn Andersson)   
  - arm64: dts: qcom: db820c: Move blsp1_uart2 pin states to msm8996.dtsi (Yassine Oudjana)   
  - arm64: dts: qcom: sdm845: correct camss unit address (Krzysztof Kozlowski)   
  - arm64: dts: qcom: sdm630: correct camss unit address (Krzysztof Kozlowski)   
  - arm64: dts: qcom: msm8996: correct camss unit address (Krzysztof Kozlowski)   
  - arm64: dts: qcom: msm8994: correct SPMI unit address (Krzysztof Kozlowski)   
  - arm64: dts: qcom: msm8916: correct camss unit address (Krzysztof Kozlowski)   
  - ARM: dts: gta04: Move model property out of pinctrl node (Tony Lindgren)   
  - drm/msm/dpu: Set DPU_DATA_HCTL_EN for in INTF_SC7180_MASK (Konrad Dybcio)   
  - drm/msm/disp/dpu: get timing engine status from intf status register (Vinod Polimera)   
  - drm/msm/dsi: don't allow enabling 14nm VCO with unprogrammed rate (Dmitry Baryshkov)   
  - RDMA/bnxt_re: Fix to remove an unnecessary log (Kalesh AP)   
  - RDMA/bnxt_re: Remove a redundant check inside bnxt_re_update_gid (Kalesh AP)   
  - RDMA/bnxt_re: Use unique names while registering interrupts (Kalesh AP)   
  - RDMA/bnxt_re: Fix to remove unnecessary return labels (Kalesh AP)   
  - RDMA/bnxt_re: Disable/kill tasklet only if it is enabled (Selvin Xavier)   
  - clk: imx: scu: use _safe list iterator to avoid a use after free (Dan Carpenter)   
  - arm64: dts: microchip: sparx5: do not use PSCI on reference boards (Robert Marko)   
  - bus: ti-sysc: Fix dispc quirk masking bool variables (Tony Lindgren)   
  - ARM: dts: stm32: Move ethernet MAC EEPROM from SoM to carrier boards (Marek Vasut)   
  - drm/panel: sharp-ls043t1le01: adjust mode settings (Dmitry Baryshkov)   
  - drm: sun4i_tcon: use devm_clk_get_enabled in `sun4i_tcon_init_clocks` (XuDong Liu)   
  - Input: adxl34x - do not hardcode interrupt trigger type (Marek Vasut)   
  - ARM: dts: meson8b: correct uart_B and uart_C clock references (hfdevel@gmx.net)   
  - ARM: dts: BCM5301X: Drop "clock-names" from the SPI node (Rafał Miłecki)   
  - drm/vram-helper: fix function names in vram helper doc (Luc Ma)   
  - drm/bridge: tc358768: fix THS_TRAILCNT computation (Francesco Dolcini)   
  - drm/bridge: tc358768: fix TXTAGOCNT computation (Francesco Dolcini)   
  - drm/bridge: tc358768: fix THS_ZEROCNT computation (Francesco Dolcini)   
  - drm/bridge: tc358768: fix TCLK_TRAILCNT computation (Francesco Dolcini)   
  - drm/bridge: tc358768: Add atomic_get_input_bus_fmts() implementation (Francesco Dolcini)   
  - drm/bridge: tc358768: fix TCLK_ZEROCNT computation (Francesco Dolcini)   
  - drm/bridge: tc358768: fix PLL target frequency (Francesco Dolcini)   
  - drm/bridge: tc358768: fix PLL parameters computation (Francesco Dolcini)   
  - drm/bridge: tc358768: always enable HS video mode (Francesco Dolcini)   
  - Input: drv260x - sleep between polling GO bit (Luca Weiss)   
  - drm/amd/display: Explicitly specify update type per plane info change (Nicholas Kazlauskas)   
  - radeon: avoid double free in ci_dpm_init() (Nikita Zhandarovich)   
  - drm/amd/display: Add logging for display MALL refresh setting (Wesley Chalmers)   
  - netlink: Add __sock_i_ino() for __netlink_diag_dump(). (Kuniyuki Iwashima)   
  - ipvlan: Fix return value of ipvlan_queue_xmit() (Cambda Zhu)   
  - netfilter: nf_conntrack_sip: fix the ct_sip_parse_numerical_param() return value. (Ilia.Gavrilov)   
  - netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one (Florian Westphal)   
  - lib/ts_bm: reset initial match offset for every block of text (Jeremy Sowden)   
  - net: nfc: Fix use-after-free caused by nfc_llcp_find_local (Lin Ma)   
  - nfc: llcp: simplify llcp_sock_connect() error paths (Krzysztof Kozlowski)   
  - sfc: fix crash when reading stats while NIC is resetting (Edward Cree)   
  - net: axienet: Move reset before 64-bit DMA detection (Maxim Kochetkov)   
  - gtp: Fix use-after-free in __gtp_encap_destroy(). (Kuniyuki Iwashima)   
  - selftests: rtnetlink: remove netdevsim device after ipsec offload test (Sabrina Dubroca)   
  - bonding: do not assume skb mac_header is set (Eric Dumazet)   
  - netlink: do not hard code device address lenth in fdb dumps (Eric Dumazet)   
  - netlink: fix potential deadlock in netlink_set_err() (Eric Dumazet)   
  - net: stmmac: fix double serdes powerdown (Bartosz Golaszewski)   
  - igc: Fix race condition in PTP tx code (Vinicius Costa Gomes)   
  - can: length: fix bitstuffing count (Vincent Mailhol)   
  - bpf: Fix bpf socket lookup from tc/xdp to respect socket VRF bindings (Gilad Sever)   
  - bpf: Call __bpf_sk_lookup()/__bpf_skc_lookup() directly via TC hookpoint (Gilad Sever)   
  - bpf: Factor out socket lookup functions for the TC hookpoint. (Gilad Sever)   
  - bpf: Omit superfluous address family check in __bpf_skc_lookup (Tobias Klauser)   
  - wifi: ath9k: convert msecs to jiffies where needed (Dmitry Antipov)   
  - wifi: iwlwifi: mvm: indicate HW decrypt for beacon protection (Johannes Berg)   
  - wifi: cfg80211: rewrite merging of inherited elements (Benjamin Berg)   
  - wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler() (Anjaneyulu)   
  - iwlwifi: don't dump_stack() when we get an unexpected interrupt (Emmanuel Grumbach)   
  - wifi: iwlwifi: pull from TXQs with softirqs disabled (Johannes Berg)   
  - rtnetlink: extend RTEXT_FILTER_SKIP_STATS to IFLA_VF_INFO (Edwin Peer)   
  - wifi: ath9k: Fix possible stall on ath9k_txq_list_has_key() (Remi Pommarel)   
  - memstick r592: make memstick_debug_get_tpc_name() static (Arnd Bergmann)   
  - kexec: fix a memory leak in crash_shrink_memory() (Zhen Lei)   
  - watchdog/perf: more properly prevent false positives with turbo modes (Douglas Anderson)   
  - watchdog/perf: define dummy watchdog_update_hrtimer_threshold() on correct config (Douglas Anderson)   
  - wifi: rsi: Do not set MMC_PM_KEEP_POWER in shutdown (Marek Vasut)   
  - wifi: rsi: Do not configure WoWlan in shutdown hook if not enabled (Marek Vasut)   
  - selftests/bpf: Fix check_mtu using wrong variable type (Jesper Dangaard Brouer)   
  - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes (Fedor Pchelkin)   
  - wifi: ray_cs: Fix an error handling path in ray_probe() (Christophe JAILLET)   
  - wifi: ray_cs: Drop useless status variable in parse_addr() (Andy Shevchenko)   
  - wifi: ray_cs: Utilize strnlen() in parse_addr() (Andy Shevchenko)   
  - wifi: wl3501_cs: Fix an error handling path in wl3501_probe() (Christophe JAILLET)   
  - wl3501_cs: use eth_hw_addr_set() (Jakub Kicinski)   
  - wifi: atmel: Fix an error handling path in atmel_probe() (Christophe JAILLET)   
  - wifi: orinoco: Fix an error handling path in orinoco_cs_probe() (Christophe JAILLET)   
  - wifi: orinoco: Fix an error handling path in spectrum_cs_probe() (Christophe JAILLET)   
  - regulator: core: Streamline debugfs operations (Geert Uytterhoeven)   
  - regulator: core: Fix more error checking for debugfs_create_dir() (Geert Uytterhoeven)   
  - bpftool: JIT limited misreported as negative value on aarch64 (Alan Maguire)   
  - nfc: llcp: fix possible use of uninitialized variable in nfc_llcp_send_connect() (Krzysztof Kozlowski)   
  - spi: dw: Round of n_bytes to power of 2 (Joy Chakraborty)   
  - bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen (Stanislav Fomichev)   
  - libbpf: fix offsetof() and container_of() to work with CO-RE (Andrii Nakryiko)   
  - sctp: add bpf_bypass_getsockopt proto callback (Alexander Mikhalitsyn)   
  - wifi: mwifiex: Fix the size of a memory allocation in mwifiex_ret_802_11_scan() (Christophe JAILLET)   
  - wifi: wilc1000: fix for absent RSN capabilities WFA testcase (Amisha Patel)   
  - spi: spi-geni-qcom: Correct CS_TOGGLE bit in SPI_TRANS_CFG (Vijaya Krishna Nivarthi)   
  - samples/bpf: Fix buffer overflow in tcp_basertt (Pengcheng Yang)   
  - libbpf: btf_dump_type_data_check_overflow needs to consider BTF_MEMBER_BITFIELD_SIZE (Martin KaFai Lau)   
  - wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx (Fedor Pchelkin)   
  - wifi: ath9k: fix AR9003 mac hardware hang check register offset calculation (Peter Seiderer)   
  - igc: Enable and fix RX hash usage by netstack (Jesper Dangaard Brouer)   
  - pstore/ram: Add check for kstrdup (Jiasheng Jiang)   
  - ima: Fix build warnings (Roberto Sassu)   
  - evm: Fix build warnings (Roberto Sassu)   
  - evm: Complete description of evm_inode_setattr() (Roberto Sassu)   
  - locking/atomic: arm: fix sync ops (Mark Rutland)   
  - x86/mm: Fix __swp_entry_to_pte() for Xen PV guests (Juergen Gross)   
  - perf/ibs: Fix interface via core pmu events (Ravi Bangoria)   
  - kselftest: vDSO: Fix accumulation of uninitialized ret when CLOCK_REALTIME is undefined (Colin Ian King)   
  - rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale (Qiuxu Zhuo)   
  - rcu/rcuscale: Move rcu_scale_*() after kfree_scale_cleanup() (Qiuxu Zhuo)   
  - rcuscale: Move shutdown from wait_event() to wait_event_idle() (Paul E. McKenney)   
  - rcuscale: Always log error message (Li Zhijian)   
  - rcutorture: Correct name of use_softirq module parameter (Paul E. McKenney)   
  - thermal/drivers/sun8i: Fix some error handling paths in sun8i_ths_probe() (Christophe JAILLET)   
  - cpufreq: intel_pstate: Fix energy_performance_preference for passive (Tero Kristo)   
  - ARM: 9303/1: kprobes: avoid missing-declaration warnings (Arnd Bergmann)   
  - powercap: RAPL: Fix CONFIG_IOSF_MBI dependency (Zhang Rui)   
  - perf/arm-cmn: Fix DTC reset (Robin Murphy)   
  - PM: domains: fix integer overflow issues in genpd_parse_state() (Nikita Zhandarovich)   
  - clocksource/drivers/cadence-ttc: Fix memory leak in ttc_timer_probe (Feng Mingxi)   
  - tracing/timer: Add missing hrtimer modes to decode_hrtimer_mode(). (Sebastian Andrzej Siewior)   
  - posix-timers: Prevent RT livelock in itimer_delete() (Thomas Gleixner)   
  - svcrdma: Prevent page release when nothing was received (Chuck Lever)   
  - irqchip/jcore-aic: Fix missing allocation of IRQ descriptors (John Paul Adrian Glaubitz)   
  - md/raid10: fix io loss while replacement replace rdev (Li Nan)   
  - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request (Li Nan)   
  - md/raid10: fix wrong setting of max_corr_read_errors (Li Nan)   
  - md/raid10: fix overflow of md/safe_mode_delay (Li Nan)   
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter (Li Nan)   
  - blk-iocost: use spin_lock_irqsave in adjust_inuse_and_calc_cost (Li Nan)   
  - x86/resctrl: Only show tasks' pid in current pid namespace (Shawn Wang)   
  - fs: pipe: reveal missing function protoypes (Arnd Bergmann)   
  - netfilter: nf_tables: drop map element references from preparation phase (Pablo Neira Ayuso)   
  - LTS version: v5.15.120 (Jack Vogel)   
  - nubus: Partially revert proc_create_single_data() conversion (Finn Thain)   
  - parisc: Delete redundant register definitions in <asm/assembly.h> (Ben Hutchings)   
  - drm/amdgpu: Validate VM ioctl flags. (Bas Nieuwenhuizen)   
  - scripts/tags.sh: Resolve gtags empty index generation (Ahmed S. Darwish)   
  - perf symbols: Symbol lookup with kcore can fail if multiple segments match stext (Krister Johansen)   
  - Revert "thermal/drivers/mediatek: Use devm_of_iomap to avoid resource leak in mtk_thermal_probe" (Ricardo Cañuelo)   
  - HID: logitech-hidpp: add HIDPP_QUIRK_DELAYED_INIT for the T651. (Mike Hommey)   
  - HID: wacom: Use ktime_t rather than int when dealing with timestamps (Jason Gerecke)   
  - bpf: ensure main program has an extable (Krister Johansen)   
  - can: isotp: isotp_sendmsg(): fix return error fix on TX path (Oliver Hartkopp)   
  - x86/smp: Use dedicated cache-line for mwait_play_dead() (Thomas Gleixner)   
  - mm, hwpoison: when copy-on-write hits poison, take page offline (Jane Chu)   
  - mm, hwpoison: try to recover from copy-on write faults (Tony Luck)   
  - mptcp: consolidate fallback and non fallback state machine (Paolo Abeni)   
  - mptcp: fix possible divide by zero in recvmsg() (Paolo Abeni)   
  - net/rds: Allow MSG_NOSIGNAL in sendmsg (Gerd Rausch)  [Orabug: 35640815]  
  - uek-rpm: Prevent cls_tcindex module to be loaded on demand (Sherry Yang)  [Orabug: 35590149]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-105.123.3.el8uek]
changelog:
  - ovl: Always reevaluate the file signature for IMA (Eric Snowberg)  [Orabug: 35646438]  
  - ocfs2: always read both high and low parts of dinode link count (Alexey Asemov)  [Orabug: 35643002]  
  - uek-rpm: aarch64: Enable direct booting with nvdimm (Liam Merwick)  [Orabug: 35630385]  
  - LTS version: v5.15.123 (Jack Vogel)   
  - Revert "drm/amd/display: edp do not add non-edid timings" (Hersen Wu)   
  - nixge: fix mac address error handling again (Arnd Bergmann)   
  - tracing/histograms: Return an error if we fail to add histogram to hist_vars list (Mohamed Khalfella)   
  - jbd2: recheck chechpointing non-dirty buffer (Zhang Yi)   
  - net: phy: prevent stale pointer dereference in phy_init() (Vladimir Oltean)   
  - tcp: annotate data-races around fastopenq.max_qlen (Eric Dumazet)   
  - tcp: annotate data-races around icsk->icsk_user_timeout (Eric Dumazet)   
  - tcp: annotate data-races around tp->notsent_lowat (Eric Dumazet)   
  - tcp: annotate data-races around rskq_defer_accept (Eric Dumazet)   
  - tcp: annotate data-races around tp->linger2 (Eric Dumazet)   
  - tcp: annotate data-races around icsk->icsk_syn_retries (Eric Dumazet)   
  - tcp: annotate data-races around tp->keepalive_probes (Eric Dumazet)   
  - tcp: annotate data-races around tp->keepalive_intvl (Eric Dumazet)   
  - tcp: annotate data-races around tp->keepalive_time (Eric Dumazet)   
  - tcp: annotate data-races around tp->tcp_tx_delay (Eric Dumazet)   
  - netfilter: nf_tables: skip bound chain on rule flush (Pablo Neira Ayuso)   
  - netfilter: nf_tables: skip bound chain in netns release path (Pablo Neira Ayuso)   
  - netfilter: nft_set_pipapo: fix improper element removal (Florian Westphal)   
  - netfilter: nf_tables: fix spurious set element insertion failure (Florian Westphal)   
  - llc: Don't drop packet from non-root netns. (Kuniyuki Iwashima)   
  - fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe (Zhang Shurong)   
  - Revert "tcp: avoid the lookup process failing to get sk in ehash table" (Kuniyuki Iwashima)   
  - net:ipv6: check return value of pskb_trim() (Yuanjun Gong)   
  - net: ipv4: Use kfree_sensitive instead of kfree (Wang Ming)   
  - tcp: annotate data-races around tcp_rsk(req)->ts_recent (Eric Dumazet)   
  - igc: Prevent garbled TX queue with XDP ZEROCOPY (Florian Kauer)   
  - bpf: Fix subprog idx logic in check_max_stack_depth (Kumar Kartikeya Dwivedi)   
  - octeontx2-pf: Dont allocate BPIDs for LBK interfaces (Geetha sowjanya)   
  - security: keys: Modify mismatched function name (Jiapeng Chong)   
  - iavf: Fix out-of-bounds when setting channels on remove (Ding Hui)   
  - iavf: Fix use-after-free in free_netdev (Ding Hui)   
  - net: sched: cls_bpf: Undo tcf_bind_filter in case of an error (Victor Nogueira)   
  - net: ethernet: mtk_eth_soc: handle probe deferral (Daniel Golle)   
  - ethernet: use of_get_ethdev_address() (Jakub Kicinski)   
  - of: net: add a helper for loading netdev->dev_addr (Jakub Kicinski)   
  - bridge: Add extack warning when enabling STP in netns. (Kuniyuki Iwashima)   
  - net: ethernet: ti: cpsw_ale: Fix cpsw_ale_get_field()/cpsw_ale_set_field() (Tanmay Patil)   
  - pinctrl: amd: Use amd_pinconf_set() for all config options (Mario Limonciello)   
  - perf build: Fix library not found error when using CSLIBS (James Clark)   
  - fbdev: imxfb: warn about invalid left/right margin (Martin Kaiser)   
  - spi: bcm63xx: fix max prepend length (Jonas Gorski)   
  - FS: JFS: Check for read-only mounted filesystem in txBegin (Immad Mir)   
  - FS: JFS: Fix null-ptr-deref Read in txBegin (Immad Mir)   
  - MIPS: dec: prom: Address -Warray-bounds warning (Gustavo A. R. Silva)   
  - fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev (Yogesh)   
  - udf: Fix uninitialized array access for some pathnames (Jan Kara)   
  - quota: fix warning in dqgrab() (Ye Bin)   
  - quota: Properly disable quotas when add_dquot_ref() fails (Jan Kara)   
  - ALSA: emu10k1: roll up loops in DSP setup code for Audigy (Oswald Buddenhagen)   
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init (hackyzh002)   
  - ext4: correct inline offset when handling xattrs in inode body (Eric Whitney)   
  - ASoC: codecs: wcd938x: fix soundwire initialisation race (Johan Hovold)   
  - ASoC: codecs: wcd938x: fix codec initialisation race (Johan Hovold)   
  - ASoC: codecs: wcd934x: fix resource leaks on component remove (Johan Hovold)   
  - ASoC: codecs: wcd938x: fix missing mbhc init error handling (Johan Hovold)   
  - ASoC: codecs: wcd938x: fix resource leaks on component remove (Johan Hovold)   
  - ASoC: codecs: wcd-mbhc-v2: fix resource leaks on component remove (Johan Hovold)   
  - ASoC: codecs: wcd938x: fix missing clsh ctrl error handling (Johan Hovold)   
  - ASoC: fsl_sai: Disable bit clock with transmitter (Matus Gajdos)   
  - drm/amd/display: Keep PHY active for DP displays on DCN31 (Nicholas Kazlauskas)   
  - drm/amd/display: Disable MPC split by default on special asic (Zhikai Zhai)   
  - drm/client: Fix memory leak in drm_client_modeset_probe (Jocelyn Falempe)   
  - drm/client: Fix memory leak in drm_client_target_cloned (Jocelyn Falempe)   
  - selftests: tc: add ConnTrack procfs kconfig (Matthieu Baerts)   
  - can: bcm: Fix UAF in bcm_proc_show() (YueHaibing)   
  - regmap: Account for register length in SMBus I/O limits (Mark Brown)   
  - regmap: Drop initial version of maximum transfer length fixes (Mark Brown)   
  - selftests: tc: add 'ct' action kconfig dep (Matthieu Baerts)   
  - selftests: tc: set timeout to 15 minutes (Matthieu Baerts)   
  - fuse: ioctl: translate ENOSYS in outarg (Miklos Szeredi)   
  - btrfs: zoned: fix memory leak after finding block group with super blocks (Filipe Manana)   
  - fuse: revalidate: don't invalidate if interrupted (Miklos Szeredi)   
  - btrfs: fix warning when putting transaction with qgroups enabled after abort (Filipe Manana)   
  - perf probe: Add test for regression introduced by switch to die_get_decl_file() (Georg Müller)   
  - keys: Fix linking a duplicate key to a keyring's assoc_array (Petr Pavlu)   
  - ALSA: hda/realtek: Enable Mute LED on HP Laptop 15s-eq2xxx (Luka Guzenko)   
  - ALSA: hda/realtek: Add quirk for Clevo NS70AU (Christoffer Sandberg)   
  - ALSA: hda/realtek - remove 3k pull low procedure (Kailang Yang)   
  - LTS version: v5.15.122 (Jack Vogel)   
  - x86/cpu/amd: Add a Zenbleed fix (Borislav Petkov (AMD))  [Orabug: 35641577]  
  - x86/cpu/amd: Move the errata checking functionality up (Borislav Petkov (AMD))  [Orabug: 35641577]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-105.125.4.el8uek]
changelog:
  - LTS version: v5.15.125 (Jack Vogel)   
  - Documentation/x86: Fix backwards on/off logic about YMM support (Dave Hansen)   
  - x86/mm: Initialize text poking earlier (Peter Zijlstra)   
  - mm: Move mm_cachep initialization to mm_init() (Peter Zijlstra)   
  - x86/mm: Use mm_alloc() in poking_init() (Peter Zijlstra)   
  - x86/mm: fix poking_init() for Xen PV guests (Juergen Gross)   
  - x86/xen: Fix secondary processors' FPU initialization (Juergen Gross)   
  - KVM: Add GDS_NO support to KVM (Daniel Sneddon)   
  - x86/speculation: Add Kconfig option for GDS (Daniel Sneddon)   
  - x86/speculation: Add force option to GDS mitigation (Daniel Sneddon)   
  - x86/speculation: Add Gather Data Sampling mitigation (Daniel Sneddon)   
  - x86/fpu: Move FPU initialization into arch_cpu_finalize_init() (Thomas Gleixner)   
  - x86/fpu: Mark init functions __init (Thomas Gleixner)   
  - x86/fpu: Remove cpuinfo argument from init functions (Thomas Gleixner)   
  - x86/init: Initialize signal frame size late (Thomas Gleixner)   
  - init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() (Thomas Gleixner)   
  - init: Invoke arch_cpu_finalize_init() earlier (Thomas Gleixner)   
  - init: Remove check_bugs() leftovers (Thomas Gleixner)   
  - um/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)   
  - sparc/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)   
  - sh/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)   
  - mips/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)   
  - m68k/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)   
  - ia64/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)   
  - ARM: cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)   
  - x86/cpu: Switch to arch_cpu_finalize_init() (Thomas Gleixner)   
  - init: Provide arch_cpu_finalize_init() (Thomas Gleixner)   
  - LTS version: v5.15.124 (Jack Vogel)   
  - selftests: mptcp: join: only check for ip6tables if needed (Matthieu Baerts)   
  - ASoC: cs42l51: fix driver to properly autoload with automatic module loading (Thomas Petazzoni)   
  - io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq (Jens Axboe)   
  - selftests: mptcp: sockopt: use 'iptables-legacy' if available (Matthieu Baerts)   
  - cpufreq: intel_pstate: Drop ACPI _PSS states table patching (Rafael J. Wysocki)   
  - ACPI: processor: perflib: Avoid updating frequency QoS unnecessarily (Rafael J. Wysocki)   
  - ACPI: processor: perflib: Use the "no limit" frequency QoS (Rafael J. Wysocki)   
  - tracing: Fix trace_event_raw_event_synth() if else statement (Steven Rostedt (Google))   
  - rbd: retrieve and check lock owner twice before blocklisting (Ilya Dryomov)   
  - rbd: harden get_lock_owner_info() a bit (Ilya Dryomov)   
  - rbd: make get_lock_owner_info() return a single locker or NULL (Ilya Dryomov)   
  - dm cache policy smq: ensure IO doesn't prevent cleaner policy progress (Joe Thornber)   
  - ceph: never send metrics if disable_send_metrics is set (Xiubo Li)   
  - ASoC: wm8904: Fill the cache for WM8904_ADC_TEST_0 register (Mark Brown)   
  - s390/dasd: fix hanging device after quiesce/resume (Stefan Haberland)   
  - virtio-net: fix race between set queues and probe (Jason Wang)   
  - KVM: x86: Disallow KVM_SET_SREGS{2} if incoming CR0 is invalid (Sean Christopherson)   
  - locking/rtmutex: Fix task->pi_waiters integrity (Peter Zijlstra)   
  - irqchip/gic-v4.1: Properly lock VPEs when doing a directLPI invalidation (Marc Zyngier)   
  - irq-bcm6345-l1: Do not assume a fixed block to cpu mapping (Jonas Gorski)   
  - tpm_tis: Explicitly check for error code (Alexander Steffen)   
  - nfsd: Remove incorrect check in nfsd4_validate_stateid (Trond Myklebust)   
  - file: always lock position for FMODE_ATOMIC_POS (Christian Brauner)   
  - btrfs: check for commit error at btrfs_attach_transaction_barrier() (Filipe Manana)   
  - btrfs: check if the transaction was aborted at btrfs_wait_for_commit() (Filipe Manana)   
  - hwmon: (nct7802) Fix for temp6 (PECI1) processed even if PECI1 disabled (Gilles Buloz)   
  - hwmon: (k10temp) Enable AMD3255 Proc to show negative temperature (Baskaran Kannan)   
  - ALSA: hda/relatek: Enable Mute LED on HP 250 G8 (Luka Guzenko)   
  - Revert "xhci: add quirk for host controllers that don't update endpoint DCS" (Oliver Neukum)   
  - tty: n_gsm: fix UAF in gsm_cleanup_mux (Chaoyuan Peng)   
  - staging: ks7010: potential buffer overflow in ks_wlan_set_encode_ext() (Zhang Shurong)   
  - staging: r8712: Fix memory leak in _r8712_init_xmit_priv() (Larry Finger)   
  - Documentation: security-bugs.rst: clarify CVE handling (Greg Kroah-Hartman)   
  - Documentation: security-bugs.rst: update preferences when dealing with the linux-distros group (Greg Kroah-Hartman)   
  - Revert "usb: xhci: tegra: Fix error check" (Dan Carpenter)   
  - usb: xhci-mtk: set the dma max_seg_size (Ricardo Ribalda)   
  - usb: cdns3: fix incorrect calculation of ep_buf_size when more than one config (Frank Li)   
  - USB: quirks: add quirk for Focusrite Scarlett (Łukasz Bartosik)   
  - usb: ohci-at91: Fix the unhandle interrupt when resume (Guiting Shen)   
  - usb: dwc3: don't reset device side if dwc3 was configured as host-only (Jisheng Zhang)   
  - usb: dwc3: pci: skip BYT GPIO lookup table for hardwired phy (Gratian Crisan)   
  - Revert "usb: dwc3: core: Enable AutoRetry feature in the controller" (Jakub Vanek)   
  - can: gs_usb: gs_can_close(): add missing set of CAN state to CAN_STATE_STOPPED (Marc Kleine-Budde)   
  - USB: serial: simple: sort driver entries (Johan Hovold)   
  - USB: serial: simple: add Kaufmann RKS+CAN VCP (Oliver Neukum)   
  - USB: serial: option: add Quectel EC200A module support (Mohsen Tahmasebi)   
  - USB: serial: option: support Quectel EM060K_128 (Jerry Meng)   
  - serial: sifive: Fix sifive_serial_console_setup() section (Samuel Holland)   
  - serial: 8250_dw: Preserve original value of DLF register (Ruihong Luo)   
  - serial: qcom-geni: drop bogus runtime pm state update (Johan Hovold)   
  - KVM: VMX: Don't fudge CR0 and CR4 for restricted L2 guest (Sean Christopherson)   
  - KVM: Grab a reference to KVM for VM and vCPU stats file descriptors (Sean Christopherson)   
  - USB: gadget: Fix the memory leak in raw_gadget driver (Zqiang)   
  - usb: gadget: call usb_gadget_check_config() to verify UDC capability (Frank Li)   
  - Revert "usb: gadget: tegra-xudc: Fix error check in tegra_xudc_powerdomain_init()" (Dan Carpenter)   
  - tracing: Fix warning in trace_buffered_event_disable() (Zheng Yejian)   
  - ring-buffer: Fix wrong stat of cpu_buffer->read (Zheng Yejian)   
  - ata: pata_ns87415: mark ns87560_tf_read static (Arnd Bergmann)   
  - RDMA/irdma: Report correct WC error (Sindhu Devale)   
  - drm/amd: Fix an error handling mistake in psp_sw_init() (Mario Limonciello)   
  - dm raid: protect md_stop() with 'reconfig_mutex' (Yu Kuai)   
  - dm raid: clean up four equivalent goto tags in raid_ctr() (Yu Kuai)   
  - dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (Yu Kuai)   
  - block: Fix a source code comment in include/uapi/linux/blkzoned.h (Bart Van Assche)   
  - ASoC: fsl_spdif: Silence output on stop (Matus Gajdos)   
  - drm/msm: Fix IS_ERR_OR_NULL() vs NULL check in a5xx_submit_in_rb() (Gaosheng Cui)   
  - RDMA/bnxt_re: Prevent handling any completions after qp destroy (Kashyap Desai)   
  - RDMA/mthca: Fix crash when polling CQ for shared QPs (Thomas Bogendoerfer)   
  - RDMA/irdma: Fix data race on CQP request done (Shiraz Saleem)   
  - RDMA/irdma: Fix data race on CQP completion stats (Shiraz Saleem)   
  - RDMA/irdma: Add missing read barriers (Shiraz Saleem)   
  - drm/msm/adreno: Fix snapshot BINDLESS_DATA size (Rob Clark)   
  - drm/msm/dpu: drop enum dpu_core_perf_data_bus_id (Dmitry Baryshkov)   
  - RDMA/mlx4: Make check for invalid flags stricter (Dan Carpenter)   
  - tipc: stop tipc crypto on failure in tipc_node_create (Fedor Pchelkin)   
  - tipc: check return value of pskb_trim() (Yuanjun Gong)   
  - benet: fix return value check in be_lancer_xmit_workarounds() (Yuanjun Gong)   
  - net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 (Lin Ma)   
  - net/sched: mqprio: add extack to mqprio_parse_nlattr() (Vladimir Oltean)   
  - net/sched: mqprio: refactor nlattr parsing to a separate function (Vladimir Oltean)   
  - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (Pablo Neira Ayuso)   
  - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR (Pablo Neira Ayuso)   
  - netfilter: nft_set_rbtree: fix overlap expiration walk (Florian Westphal)   
  - igc: Fix Kernel Panic during ndo_tx_timeout callback (Muhammad Husaini Zulkifli)   
  - platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 (Maxim Mikityanskiy)   
  - net: stmmac: Apply redundant write work around on 4.xx too (Vincent Whitchurch)   
  - team: reset team's flags when down link is P2P device (Hangbin Liu)   
  - bonding: reset bond's flags when down link is P2P device (Hangbin Liu)   
  - ice: Fix memory management in ice_ethtool_fdir.c (Jedrzej Jagielski)   
  - tcp: Reduce chance of collisions in inet6_hashfn(). (Stewart Smith)   
  - ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new temporary address (Maciej Żenczykowski)   
  - ethernet: atheros: fix return value check in atl1e_tso_csum() (Yuanjun Gong)   
  - phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe() (Harshit Mogalapalli)   
  - vxlan: calculate correct header length for GPE (Jiri Benc)   
  - vxlan: move to its own directory (Roopa Prabhu)   
  - net: hns3: fix wrong bw weight of disabled tc issue (Jijie Shao)   
  - net: hns3: fix wrong tc bandwidth weight data issue (Jijie Shao)   
  - net: phy: marvell10g: fix 88x3310 power up (Jiawen Wu)   
  - iavf: check for removal state before IAVF_FLAG_PF_COMMS_FAILED (Jacob Keller)   
  - iavf: fix potential deadlock on allocation failure (Jacob Keller)   
  - i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() (Wang Ming)   
  - media: staging: atomisp: select V4L2_FWNODE (Sakari Ailus)   
  - soundwire: qcom: update status correctly with mask (Srinivas Kandagatla)   
  - phy: qcom-snps-femto-v2: properly enable ref clock (Adrien Thierry)   
  - phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime suspend (Adrien Thierry)   
  - phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc (Krzysztof Kozlowski)   
  - phy: qcom-snps: Use dev_err_probe() to simplify code (Yuan Can)   
  - drm/amdgpu/vkms: relax timer deactivation by hrtimer_try_to_cancel (Guchun Chen)   
  - drm/amdgpu: fix vkms crtc settings (Flora Cui)   
  - scsi: qla2xxx: Fix hang in task management (Quinn Tran)   
  - scsi: qla2xxx: Fix task management cmd fail due to unavailable resource (Quinn Tran)   
  - scsi: qla2xxx: Fix task management cmd failure (Quinn Tran)   
  - scsi: qla2xxx: Multi-que support for TMF (Quinn Tran)   
  - tracing/probes: Fix to record 0-length data_loc in fetch_store_string*() if fails (Masami Hiramatsu (Google))   
  - Revert "tracing: Add "(fault)" name injection to kernel probes" (Masami Hiramatsu (Google))   
  - tracing: Allow synthetic events to pass around stacktraces (Steven Rostedt (Google))   
  - tracing/probes: Fix to avoid double count of the string length on the array (Masami Hiramatsu (Google))   
  - tracing/probes: Add symstr type for dynamic events (Masami Hiramatsu (Google))   
  - pwm: meson: fix handling of period/duty if greater than UINT_MAX (Heiner Kallweit)   
  - pwm: meson: Simplify duplicated per-channel tracking (Uwe Kleine-König)   
  - cifs: if deferred close is disabled then close files immediately (Bharath SM)   
  - ksmbd: remove internal.h include (Namjae Jeon)   
  - cifs: use fs_context for automounts (Paulo Alcantara)   
  - cifs: missing directory in MAINTAINERS file (Steve French)   
  - drm/ttm: never consider pinned BOs for eviction&swap (Christian König)   
  - tty: fix hang on tty device with no_room set (Hui Li)   
  - n_tty: Rename tail to old_tail in n_tty_read() (Ilpo Järvinen)   
  - drm/ttm: Don't leak a resource on eviction error (Thomas Hellström)   
  - drm/ttm: Don't print error message if eviction was interrupted (Thomas Hellström)   
  - fs: dlm: interrupt posix locks only when process is killed (Alexander Aring)   
  - dlm: rearrange async condition return (Alexander Aring)   
  - dlm: cleanup plock_op vs plock_xop (Alexander Aring)   
  - PCI: rockchip: Don't advertise MSI-X in PCIe capabilities (Rick Wertenbroek)   
  - PCI: rockchip: Fix window mapping and address translation for endpoint (Rick Wertenbroek)   
  - PCI: rockchip: Remove writes to unused registers (Rick Wertenbroek)   
  - PCI/ASPM: Avoid link retraining race (Ilpo Järvinen)   
  - PCI/ASPM: Factor out pcie_wait_for_retrain() (Ilpo Järvinen)   
  - PCI/ASPM: Return 0 or -ETIMEDOUT from pcie_retrain_link() (Bjorn Helgaas)   
  - i2c: nomadik: Remove a useless call in the remove function (Christophe JAILLET)   
  - i2c: nomadik: Use devm_clk_get_enabled() (Andi Shyti)   
  - i2c: nomadik: Remove unnecessary goto label (Andi Shyti)   
  - i2c: Improve size determinations (Markus Elfring)   
  - i2c: Delete error messages for failed memory allocations (Markus Elfring)   
  - btrfs: fix race between quota disable and relocation (Filipe Manana)   
  - gpio: mvebu: fix irq domain leak (Bartosz Golaszewski)   
  - gpio: mvebu: Make use of devm_pwmchip_add (Uwe Kleine-König)   
  - pwm: Add a stub for devm_pwmchip_add() (Andy Shevchenko)   
  - gpio: tps68470: Make tps68470_gpio_output() always set the initial value (Hans de Goede)   
  - io_uring: don't audit the capability check in io_uring_create() (Ondrej Mosnacek)   
  - KVM: s390: pv: fix index value of replaced ASCE (Claudio Imbrenda)   
  - jbd2: Fix wrongly judgement for buffer head removing while doing checkpoint (Zhihao Cheng)   
  - uek-rpm: move sch_fq_codel module to be built-in (Samasth Norway Ananda)  [Orabug: 35659936]  
  - uek-rpm: Update kernel's linux-firmware dependency. (Somasundaram Krishnasamy)  [Orabug: 35678651]  
  - uek-rpm: Disable cls_tcindex in file tcindex-disable.conf (Sherry Yang)  [Orabug: 35678686]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-105.125.5.el8uek]
changelog:
  - sysctl: fix proc_dobool() usability (Ondrej Mosnacek)  [Orabug: 35146200]  
  - x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() (Chang S. Bae)  [Orabug: 35490456]  
  - x86/fpu: Emulate XRSTOR's behavior if the xfeatures PKRU bit is not set (Kyle Huey)  [Orabug: 35490456]  
  - x86/fpu: Allow PKRU to be (once again) written by ptrace. (Kyle Huey)  [Orabug: 35490456]  
  - x86/fpu/xstate: Fix XSTATE_WARN_ON() to emit relevant diagnostics (Andrew Cooper)  [Orabug: 35490456]  
  - x86/fpu: Fix copy_xstate_to_uabi() to copy init states correctly (Chang S. Bae)  [Orabug: 35490456]  
  - x86/fpu: Exclude dynamic states from init_fpstate (Chang S. Bae)  [Orabug: 35490456]  
  - x86/fpu: Fix the init_fpstate size check with the actual size (Chang S. Bae)  [Orabug: 35490456]  
  - x86/fpu: Configure init_fpstate attributes orderly (Chang S. Bae)  [Orabug: 35490456]  
  - x86/prctl: Remove pointless task argument (Thomas Gleixner)  [Orabug: 35490456]  
  - x86/fpu: Cleanup variable shadowing (Thomas Gleixner)  [Orabug: 35490456]  
  - x86/fpu/xsave: Support XSAVEC in the kernel (Thomas Gleixner)  [Orabug: 35490456]  
  - x86/fpu/xstate: Consolidate size calculations (Thomas Gleixner)  [Orabug: 35490456]  
  - x86/fpu/xstate: Handle supervisor states in XSTATE permissions (Thomas Gleixner)  [Orabug: 35490456]  
  - x86/fpu/xsave: Handle compacted offsets correctly with supervisor states (Thomas Gleixner)  [Orabug: 35490456]  
  - x86/fpu: Cache xfeature flags from CPUID (Thomas Gleixner)  [Orabug: 35490456]  
  - x86/fpu/xsave: Initialize offset/size cache early (Thomas Gleixner)  [Orabug: 35490456]  
  - x86/fpu: Remove unused supervisor only offsets (Thomas Gleixner)  [Orabug: 35490456]  
  - nvme: handle effects after freeing the request (Alan Adamson)  [Orabug: 35673772]  
  - nbd: make sure request completion won't concurrent (Yu Kuai)  [Orabug: 35709416]  
  - nbd: don't handle response without a corresponding request message (Yu Kuai)  [Orabug: 35709416]  
  - uek-rpm: Enforce linux firmware version 26 (Jack Vogel)  [Orabug: 35722340]  
  - LTS update - v5.15.125 Inception support added (Jack Vogel)   
  - x86: fix backwards merge of GDS/SRSO bit (Greg Kroah-Hartman)   
  - xen/netback: Fix buffer overrun triggered by unusual packet (Ross Lagerwall)   
  - x86/srso: Tie SBPB bit setting to microcode patch detection (Borislav Petkov (AMD))   
  - x86/srso: Fix return thunks in generated code (Josh Poimboeuf)   
  - x86/srso: Add IBPB on VMEXIT (Borislav Petkov (AMD))   
  - x86/srso: Add IBPB (Borislav Petkov (AMD))   
  - x86/srso: Add SRSO_NO support (Borislav Petkov (AMD))   
  - x86/srso: Add IBPB_BRTYPE support (Borislav Petkov (AMD))   
  - x86/srso: Add a Speculative RAS Overflow mitigation (Borislav Petkov (AMD))   
  - x86/cpu, kvm: Add support for CPUID_80000021_EAX (Kim Phillips)


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-105.125.6.el8uek]
changelog:
  - uek-rpm: Enable Hyper-V for OL8 and OL9 ARM (Harshvardhan Jha)  [Orabug: 35069663]  
  - PCI: hv: Avoid the retarget interrupt hypercall in irq_unmask() on ARM64 (Boqun Feng)  [Orabug: 35069663]  
  - PCI: hv: Add arm64 Hyper-V vPCI support (Sunil Muthuswamy)  [Orabug: 35069663]  
  - PCI: hv: Make the code arch neutral by adding arch specific interfaces (Sunil Muthuswamy)  [Orabug: 35069663]  
  - crypto: tcrypt - disable ffdhe tests for key sizes (Saeed Mirzamohammadi)  [Orabug: 35734478]  
  - io_uring: add support for registering ring file descriptors (Jens Axboe)  [Orabug: 35742743]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-106.125.1.el8uek]
changelog:
  - smp: Reduce NMI traffic from CSD waiters to CSD destination (Imran Khan)  [Orabug: 35752500]  
  - smp: Reduce logging due to dump_stack of CSD waiters (Imran Khan)  [Orabug: 35752500]  
  - block: Sysfs option to change ioticks granularity (Gulam Mohamed)  [Orabug: 34977356]  
  - uek: kabi: update x86_64 kABI files for new symbols (Saeed Mirzamohammadi)  [Orabug: 35501675]  
  - uek: kabi: update aarch64 kABI files for new symbols (Saeed Mirzamohammadi)  [Orabug: 35553840]  
  - rpmbuild: fixed missing _kernel_cc macros to allow alternate compilers (Mark Nicholson)  [Orabug: 35729326]  
  - scsi: megaraid_sas: Driver version update to 07.725.01.00-rc1 (Chandrakanth Patil)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Add crash dump mode capability bit in MFI capabilities (Chandrakanth Patil)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Add flexible array member for SGLs (Kees Cook)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Fix some spelling mistakes in comment (Yu Zhe)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Move megasas_dbg_lvl init to megasas_init() (Guixin Liu)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Remove unnecessary memset() (Guixin Liu)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Simplify megasas_update_device_list (Guixin Liu)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Correct an error message (Guixin Liu)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Correct value passed to scsi_device_lookup() (Guixin Liu)  [Orabug: 35729651]  
  - scsi: megaraid: Convert sysfs snprintf() to sysfs_emit() (Xuezhi Zhang)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Use struct_size() in code related to struct MR_PD_CFG_SEQ_NUM_SYNC (Gustavo A. R. Silva)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Use struct_size() in code related to struct MR_FW_RAID_MAP (Gustavo A. R. Silva)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Replace one-element array with flexible-array member in MR_PD_CFG_SEQ_NUM_SYNC (Gustavo A. R. Silva)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Replace one-element array with flexible-array member in MR_DRV_RAID_MAP (Gustavo A. R. Silva)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Replace one-element array with flexible-array member in MR_FW_RAID_MAP_DYNAMIC (Gustavo A. R. Silva)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Replace one-element array with flexible-array member in MR_FW_RAID_MAP (Gustavo A. R. Silva)  [Orabug: 35729651]  
  - scsi: megaraid: Remove redundant assignment to variable mfiStatus (Colin Ian King)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Remove unnecessary kfree() (Guixin Liu)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Remove redundant variable cmd_type (Colin Ian King)  [Orabug: 35729651]  
  - scsi: megaraid: Remove the static variable initialisation (Jason Wang)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Clean up some inconsistent indenting (Jiapeng Chong)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Remove redundant memset() statement (Harshit Mogalapalli)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Remove unnecessary memset (Wan Jiabing)  [Orabug: 35729651]  
  - scsi: megasas: Clean up some inconsistent indenting (Yang Li)  [Orabug: 35729651]  
  - scsi: megasas: Stop using the SCSI pointer (Bart Van Assche)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Use irq_set_affinity_and_hint() (Nitesh Narayan Lal)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Driver version update to 07.719.03.00-rc1 (Sumit Saxena)  [Orabug: 35729651]  
  - scsi: megaraid_sas: Add helper functions for irq_context (Sumit Saxena)  [Orabug: 35729651]  
  - scsi: mpt3sas: Fix an issue when driver is being removed (Tomas Henzl)  [Orabug: 35729658]  
  - scsi: mpt3sas: Remove HBA BIOS version in the kernel log (Ranjan Kumar)  [Orabug: 35729658]  
  - scsi: mpt3sas: Drop redundant pci_enable_pcie_error_reporting() (Bjorn Helgaas)  [Orabug: 35729658]  
  - scsi: mpt3sas: Demote log level for trace buffer allocation to info (Paul Menzel)  [Orabug: 35729658]  
  - scsi: mpt3sas: Update driver version to 43.100.00.00 (Sreekanth Reddy)  [Orabug: 35729658]  
  - scsi: mpt3sas: Increase cmd_per_lun to 128 (Sreekanth Reddy)  [Orabug: 35729658]  
  - scsi: mpt3sas: Fix trace buffer registration failed (Sreekanth Reddy)  [Orabug: 35729658]  
  - scsi: mpt3sas: Disable MPI2_FUNCTION_FW_DOWNLOAD for ATTO devices (Bradley Grove)  [Orabug: 35729658]  
  - scsi: mpt3sas: Add support for ATTO ExpressSAS H12xx GT devices (Bradley Grove)  [Orabug: 35729658]  
  - scsi: mpt3sas: Remove flush_scheduled_work() call (Tetsuo Handa)  [Orabug: 35729658]  
  - scsi: mpt3sas: Fix whitespace and spelling mistake (Zhang Jiaming)  [Orabug: 35729658]  
  - scsi: mpt3sas: Fix typo in comment (Ren Yu)  [Orabug: 35729658]  
  - scsi: mpt3sas: Fix junk chars displayed while printing ChipName (Sreekanth Reddy)  [Orabug: 35729658]  
  - scsi: mpt3sas: Use cached ATA Information VPD page (Martin K. Petersen)  [Orabug: 35729658]  
  - scsi: mpt3sas: Fix adapter replyPostRegisterIndex declaration (Damien Le Moal)  [Orabug: 35729658]  
  - scsi: mpt3sas: Fix event callback log_code value handling (Damien Le Moal)  [Orabug: 35729658]  
  - scsi: mpt3sas: Fix _ctl_set_task_mid() TaskMID check (Damien Le Moal)  [Orabug: 35729658]  
  - scsi: mpt3sas: Fix mpt3sas_check_same_4gb_region() kdoc comment (Damien Le Moal)  [Orabug: 35729658]  
  - scsi: mpt3sas: Convert to flexible arrays (Kees Cook)  [Orabug: 35729658]  
  - scsi: mpt3sas: Update persistent trigger pages from sysfs interface (Suganath Prabu S)  [Orabug: 35729658]  
  - KVM: selftests: vmx_pmu_msrs_test: Drop tests mangling guest visible CPUIDs (Vitaly Kuznetsov)  [Orabug: 35730650]  
  - rds: Remove gratuitous include of time.h from rds.h (Mark Haywood)  [Orabug: 35742760]  
  - uek-rpm: Removing pre scriptlet to not allow firmware downgrade (Samasth Norway Ananda)  [Orabug: 35756462]


author: Jack Vogel <jack.vogel@oracle.com> [5.15.0-106.130.2.el8uek]
changelog:
  - LTS version: v5.15.130 (Jack Vogel)   
  - rcu-tasks: Add trc_inspect_reader() checks for exiting critical section (Paul E. McKenney)   
  - rcu-tasks: Wait for trc_read_check_handler() IPIs (Paul E. McKenney)   
  - rcu-tasks: Fix IPI failure handling in trc_wait_for_one_reader (Neeraj Upadhyay)   
  - rcu: Prevent expedited GP from enabling tick on offline CPU (Paul E. McKenney)   
  - ARM: module: Use module_init_layout_section() to spot init sections (James Morse)   
  - arm64: module: Use module_init_layout_section() to spot init sections (James Morse)   
  - arm64: module-plts: inline linux/moduleloader.h (Arnd Bergmann)   
  - module: Expose module_init_layout_section() (James Morse)   
  - ACPI: thermal: Drop nocrt parameter (Mario Limonciello)   
  - LTS version: v5.15.129 (Jack Vogel)   
  - mm,ima,kexec,of: use memblock_free_late from ima_free_kexec_buffer (Rik van Riel)   
  - mm: memory-failure: fix unexpected return value in soft_offline_page() (Miaohe Lin)   
  - mm: memory-failure: kill soft_offline_free_page() (Kefeng Wang)   
  - dma-buf/sw_sync: Avoid recursive lock during fence signal (Rob Clark)   
  - pinctrl: renesas: rza2: Add lock around pinctrl_generic{{add,remove}_group,{add,remove}_function} (Biju Das)   
  - clk: Fix undefined reference to `clk_rate_exclusive_{get,put}' (Biju Das)   
  - scsi: core: raid_class: Remove raid_component_add() (Zhu Wang)   
  - scsi: snic: Fix double free in snic_tgt_create() (Zhu Wang)   
  - can: raw: add missing refcount for memory leak fix (Oliver Hartkopp)   
  - drm/i915: Fix premature release of request's reusable memory (Janusz Krzysztofik)   
  - cgroup/cpuset: Free DL BW in case can_attach() fails (Dietmar Eggemann)   
  - sched/deadline: Create DL BW alloc, free & check overflow interface (Dietmar Eggemann)   
  - cgroup/cpuset: Iterate only if DEADLINE tasks are present (Juri Lelli)   
  - sched/cpuset: Keep track of SCHED_DEADLINE task in cpusets (Juri Lelli)   
  - sched/cpuset: Bring back cpuset_mutex (Juri Lelli)   
  - cgroup/cpuset: Rename functions dealing with DEADLINE accounting (Juri Lelli)   
  - torture: Fix hang during kthread shutdown phase (Joel Fernandes (Google))   
  - nfsd: use vfs setgid helper (Christian Brauner)   
  - nfs: use vfs setgid helper (Christian Brauner)   
  - x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 (Feng Tang)   
  - x86/fpu: Invalidate FPU state correctly on exec() (Rick Edgecombe)   
  - drm/display/dp: Fix the DP DSC Receiver cap size (Ankit Nautiyal)   
  - drm/vmwgfx: Fix shader stage validation (Zack Rusin)   
  - PCI: acpiphp: Use pci_assign_unassigned_bridge_resources() only for non-root bus (Igor Mammedov)   
  - media: vcodec: Fix potential array out-of-bounds in encoder queue_setup (Wei Chen)   
  - of: dynamic: Refactor action prints to not use "%pOF" inside devtree_lock (Rob Herring)   
  - of: unittest: Fix EXPECT for parse_phandle_with_args_map() test (Rob Herring)   
  - radix tree: remove unused variable (Arnd Bergmann)   
  - lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels (Helge Deller)   
  - batman-adv: Hold rtnl lock during MTU update via netlink (Sven Eckelmann)   
  - batman-adv: Fix batadv_v_ogm_aggr_send memory leak (Remi Pommarel)   
  - batman-adv: Fix TT global entry leak when client roamed back (Remi Pommarel)   
  - batman-adv: Do not get eth header before batadv_check_management_packet (Remi Pommarel)   
  - batman-adv: Don't increase MTU when set by user (Sven Eckelmann)   
  - batman-adv: Trigger events for auto adjusted MTU (Sven Eckelmann)   
  - selinux: set next pointer before attaching to list (Christian Göttsche)   
  - nfsd: Fix race to FREE_STATEID and cl_revoked (Benjamin Coddington)   
  - NFS: Fix a use after free in nfs_direct_join_group() (Trond Myklebust)   
  - mm: add a call to flush_cache_vmap() in vmap_pfn() (Alexandre Ghiti)   
  - ALSA: ymfpci: Fix the missing snd_card_free() call at probe error (Takashi Iwai)   
  - clk: Fix slab-out-of-bounds error in devm_clk_release() (Andrey Skvortsov)   
  - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington)   
  - ibmveth: Use dcbf rather than dcbfl (Michael Ellerman)   
  - Revert "KVM: x86: enable TDP MMU by default" (Sean Christopherson)   
  - net/ncsi: change from ndo_set_mac_address to dev_set_mac_address (Ivan Mikhaylov)   
  - net/ncsi: make one oem_gma function for all mfr id (Ivan Mikhaylov)   
  - bonding: fix macvlan over alb bond support (Hangbin Liu)   
  - net: remove bond_slave_has_mac_rcu() (Jakub Kicinski)   
  - rtnetlink: Reject negative ifindexes in RTM_NEWLINK (Ido Schimmel)   
  - rtnetlink: return ENODEV when ifname does not exist and group is given (Florent Fourcot)   
  - netfilter: nf_tables: fix out of memory error handling (Florian Westphal)   
  - netfilter: nf_tables: flush pending destroy work before netlink notifier (Pablo Neira Ayuso)   
  - net/sched: fix a qdisc modification with ambiguous command request (Jamal Hadi Salim)   
  - igc: Fix the typo in the PTM Control macro (Sasha Neftin)   
  - igb: Avoid starting unnecessary workqueues (Alessio Igor Bogani)   
  - ice: fix receive buffer size miscalculation (Jesse Brandeburg)   
  - net: validate veth and vxcan peer ifindexes (Jakub Kicinski)   
  - net: bcmgenet: Fix return value check for fixed_phy_register() (Ruan Jinjie)   
  - net: bgmac: Fix return value check for fixed_phy_register() (Ruan Jinjie)   
  - ipvlan: Fix a reference count leak warning in ipvlan_ns_exit() (Lu Wei)   
  - dccp: annotate data-races in dccp_poll() (Eric Dumazet)   
  - sock: annotate data-races around prot->memory_pressure (Eric Dumazet)   
  - octeontx2-af: SDP: fix receive link config (Hariprasad Kelam)   
  - tracing: Fix memleak due to race between current_tracer and trace (Zheng Yejian)   
  - tracing: Fix cpu buffers unavailable due to 'record_disabled' missed (Zheng Yejian)   
  - can: raw: fix lockdep issue in raw_release() (Eric Dumazet)   
  - drm/amd/display: check TG is non-null before checking if enabled (Taimur Hassan)   
  - drm/amd/display: do not wait for mpc idle if tg is disabled (Josip Pavic)   
  - can: raw: fix receiver memory leak (Ziyang Xuan)   
  - jbd2: fix a race when checking checkpoint buffer busy (Zhang Yi)   
  - jbd2: remove journal_clean_one_cp_list() (Zhang Yi)   
  - jbd2: remove t_checkpoint_io_list (Zhang Yi)   
  - ALSA: pcm: Fix potential data race at PCM memory allocation helpers (Takashi Iwai)   
  - fbdev: fix potential OOB read in fast_imageblit() (Zhang Shurong)   
  - fbdev: Fix sys_imageblit() for arbitrary image widths (Thomas Zimmermann)   
  - fbdev: Improve performance of sys_imageblit() (Thomas Zimmermann)   
  - MIPS: cpu-features: Use boot_cpu_type for CPU type based features (Jiaxun Yang)   
  - MIPS: cpu-features: Enable octeon_cache by cpu_type (Jiaxun Yang)   
  - fs: dlm: fix mismatch of plock results from userspace (Alexander Aring)   
  - fs: dlm: use dlm_plock_info for do_unlock_close (Alexander Aring)   
  - fs: dlm: change plock interrupted message to debug again (Alexander Aring)   
  - fs: dlm: add pid to debug log (Alexander Aring)   
  - dlm: replace usage of found with dedicated list iterator variable (Jakob Koschel)   
  - dlm: improve plock logging if interrupted (Alexander Aring)   
  - PCI: acpiphp: Reassign resources on bridge if necessary (Igor Mammedov)   
  - xprtrdma: Remap Receive buffers after a reconnect (Chuck Lever)   
  - NFSv4: fix out path in __nfs4_get_acl_uncached (Fedor Pchelkin)   
  - NFSv4.2: fix error handling in nfs42_proc_getxattr (Fedor Pchelkin)   
  - objtool/x86: Fix SRSO mess (Peter Zijlstra)   
  - LTS version: v5.15.128 (Jack Vogel)   
  - x86/srso: Correct the mitigation status when SMT is disabled (Borislav Petkov (AMD))   
  - objtool/x86: Fixup frame-pointer vs rethunk (Peter Zijlstra)   
  - x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG (Petr Pavlu)   
  - x86/srso: Disable the mitigation on unaffected configurations (Borislav Petkov (AMD))   
  - x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() (Sean Christopherson)   
  - x86/static_call: Fix __static_call_fixup() (Peter Zijlstra)   
  - x86/srso: Explain the untraining sequences a bit more (Borislav Petkov (AMD))   
  - x86/cpu: Cleanup the untrain mess (Peter Zijlstra)   
  - x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 (Peter Zijlstra)   
  - x86/cpu: Rename original retbleed methods (Peter Zijlstra)   
  - x86/cpu: Clean up SRSO return thunk mess (Peter Zijlstra)   
  - x86/ibt: Add ANNOTATE_NOENDBR (Peter Zijlstra)   
  - objtool: Add frame-pointer-specific function ignore (Josh Poimboeuf)   
  - x86/alternative: Make custom return thunk unconditional (Peter Zijlstra)   
  - x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() (Peter Zijlstra)   
  - x86/cpu: Fix __x86_return_thunk symbol type (Peter Zijlstra)   
  - mmc: f-sdh30: fix order of function calls in sdhci_f_sdh30_remove (Yangtao Li)   
  - net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled (Jason Xing)   
  - virtio-net: set queues after driver_ok (Jason Wang)   
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima)   
  - arm64: dts: rockchip: Disable HS400 for eMMC on ROCK Pi 4 (Christopher Obbard)   
  - exfat: check if filename entries exceeds max filename length (Namjae Jeon)   
  - netfilter: set default timeout to 3 secs for sctp shutdown send and recv state (Xin Long)   
  - drm/amd: flush any delayed gfxoff on suspend entry (Mario Limonciello)   
  - drm/qxl: fix UAF on handle creation (Wander Lairson Costa)   
  - mmc: block: Fix in_flight[issue_type] value error (Yibin Ding)   
  - mmc: wbsd: fix double mmc_free_host() in wbsd_init() (Yang Yingliang)   
  - cifs: Release folio lock on fscache read hit. (Russell Harmon via samba-technical)   
  - ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces. (dengxiang)   
  - serial: 8250: Fix oops for port->pm on uart_change_pm() (Tony Lindgren)   
  - riscv: uaccess: Return the number of bytes effectively not copied (Alexandre Ghiti)   
  - ALSA: hda/realtek - Remodified 3k pull low procedure (Kailang Yang)   
  - soc: aspeed: socinfo: Add kfree for kstrdup (Jiasheng Jiang)   
  - ASoC: meson: axg-tdm-formatter: fix channel slot allocation (Jerome Brunet)   
  - ASoC: rt5665: add missed regulator_bulk_disable (Zhang Shurong)   
  - ARM: dts: imx: Set default tuning step for imx6sx usdhc (Xiaolei Wang)   
  - arm64: dts: qcom: qrb5165-rb5: fix thermal zone conflict (Dmitry Baryshkov)   
  - bus: ti-sysc: Flush posted write on enable before reset (Tony Lindgren)   
  - net: do not allow gso_size to be set to GSO_BY_FRAGS (Eric Dumazet)   
  - sock: Fix misuse of sk_under_memory_pressure() (Abel Wu)   
  - net: dsa: mv88e6xxx: Wait for EEPROM done before HW reset (Alfred Lee)   
  - i40e: fix misleading debug logs (Andrii Staikov)   
  - iavf: fix FDIR rule fields masks validation (Piotr Gardocki)   
  - team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - net: phy: broadcom: stub c45 read/write for 54810 (Justin Chen)   
  - netfilter: nft_dynset: disallow object maps (Pablo Neira Ayuso)   
  - ipvs: fix racy memcpy in proc_do_sync_threshold (Sishuai Gong)   
  - netfilter: nf_tables: deactivate catchall elements in next generation (Florian Westphal)   
  - netfilter: nf_tables: fix false-positive lockdep splat (Florian Westphal)   
  - drm/panel: simple: Fix AUO G121EAN01 panel timings according to the docs (Luca Ceresoli)   
  - selftests: mirror_gre_changes: Tighten up the TTL test match (Petr Machata)   
  - net: phy: fix IRQ-based wake-on-lan over hibernate / power off (Russell King (Oracle))   
  - xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH (Lin Ma)   
  - xfrm: add NULL check in xfrm_update_ae_params (Lin Ma)   
  - ip_vti: fix potential slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - ip6_vti: fix slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - xfrm: fix slab-use-after-free in decode_session6 (Zhengchao Shao)   
  - net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure (Lin Ma)   
  - net: af_key: fix sadb_x_filter validation (Lin Ma)   
  - net: xfrm: Fix xfrm_address_filter OOB read (Lin Ma)   
  - i2c: designware: Handle invalid SMBus block data response length value (Tam Nguyen)   
  - i2c: designware: Correct length byte validation logic (Quan Nguyen)   
  - btrfs: fix BUG_ON condition in btrfs_cancel_balance (xiaoshoukui)   
  - tty: serial: fsl_lpuart: Clear the error flags by writing 1 for lpuart32 platforms (Sherry Sun)   
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux (Yi Yang)   
  - powerpc/rtas_flash: allow user copy to flash block cache objects (Nathan Lynch)   
  - fbdev: mmp: fix value check in mmphw_probe() (Yuanjun Gong)   
  - i2c: hisi: Only handle the interrupt of the driver's transfer (Yicong Yang)   
  - i2c: bcm-iproc: Fix bcm_iproc_i2c_isr deadlock issue (Chengfeng Ye)   
  - cifs: fix potential oops in cifs_oplock_break (Steve French)   
  - vduse: Use proper spinlock for IRQ injection (Maxime Coquelin)   
  - virtio-mmio: don't break lifecycle of vm_dev (Wolfram Sang)   
  - btrfs: move out now unused BG from the reclaim list (Naohiro Aota)   
  - ARM: dts: nxp/imx6sll: fix wrong property name in usbphy node (Xu Yang)   
  - ARM: dts: imx6sll: fixup of operating points (Andreas Kemnade)   
  - mmc: sunxi: fix deferred probing (Sergey Shtylyov)   
  - mmc: bcm2835: fix deferred probing (Sergey Shtylyov)   
  - USB: dwc3: fix use-after-free on core driver unbind (Johan Hovold)   
  - USB: dwc3: qcom: fix NULL-deref on suspend (Johan Hovold)   
  - tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A (Robert Hodaszi)   
  - tty: serial: fsl_lpuart: make rx_watermark configurable for different platforms (Sherry Sun)   
  - tty: serial: fsl_lpuart: Add i.MXRT1050 support (Jesse Taube)   
  - usb: dwc3: gadget: Improve dwc3_gadget_suspend() and dwc3_gadget_resume() (Roger Quadros)   
  - USB: dwc3: gadget: drop dead hibernation code (Johan Hovold)   
  - usb: dwc3: Fix typos in gadget.c (Kushagra Verma)   
  - usb: dwc3: Remove DWC3 locking during gadget suspend/resume (Wesley Cheng)   
  - usb: dwc3: gadget: Synchronize IRQ between soft connect/disconnect (Wesley Cheng)   
  - drm/amd/display: fix access hdcp_workqueue assert (Hersen Wu)   
  - drm/amd/display: phase3 mst hdcp for multiple displays (hersen wu)   
  - drm/amd/display: save restore hdcp state when display is unplugged from mst hub (hersen wu)   
  - ARM: dts: aspeed: asrock: Correct firmware flash SPI clocks (Zev Weiss)   
  - igc: read before write to SRRCTL register (Song Yoong Siang)   
  - iio: addac: stx104: Fix race condition when converting analog-to-digital (William Breathitt Gray)   
  - iio: addac: stx104: Fix race condition for stx104_write_raw() (William Breathitt Gray)   
  - iio: stx104: Move to addac subdirectory (William Breathitt Gray)   
  - iio: adc: stx104: Implement and utilize register structures (William Breathitt Gray)   
  - iio: adc: stx104: Utilize iomap interface (William Breathitt Gray)   
  - iio: add addac subdirectory (Cosmin Tanislav)   
  - ring-buffer: Do not swap cpu_buffer during resize process (Chen Lin)   
  - powerpc/kasan: Disable KCOV in KASAN code (Benjamin Gray)   
  - ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() (Tuo Li)   
  - ALSA: hda/realtek: Add quirks for Unis H3C Desktop B760 & Q760 (dengxiang)   
  - fs/ntfs3: Mark ntfs dirty when on-disk struct is corrupted (Konstantin Komarov)   
  - fs: ntfs3: Fix possible null-pointer dereferences in mi_read() (Jia-Ju Bai)   
  - fs/ntfs3: Enhance sanity check while generating attr_list (Edward Lo)   
  - drm/amdgpu: Fix potential fence use-after-free v2 (shanzhulig)   
  - Bluetooth: btusb: Add MT7922 bluetooth ID for the Asus Ally (Matthew Anderson)   
  - Bluetooth: L2CAP: Fix use-after-free (Zhengping Jiang)   
  - watchdog: sp5100_tco: support Hygon FCH/SCH (Server Controller Hub) (Yuechao Zhao)   
  - firewire: net: fix use after free in fwnet_finish_incoming_packet() (Zhang Shurong)   
  - pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() (Armin Wolf)   
  - gfs2: Fix possible data races in gfs2_show_options() (Tuo Li)   
  - usb: chipidea: imx: add missing USB PHY DPDM wakeup setting (Xu Yang)   
  - usb: chipidea: imx: don't request QoS for imx8ulp (Xu Yang)   
  - thunderbolt: Read retimer NVM authentication status prior tb_retimer_set_inbound_sbtx() (Mika Westerberg)   
  - media: platform: mediatek: vpu: fix NULL ptr dereference (Hans Verkuil)   
  - usb: gadget: u_serial: Avoid spinlock recursion in __gs_console_push (Prashanth K)   
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy (Yunfei Dong)   
  - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara)   
  - ovl: check type and offset of struct vfsmount in ovl_entry (Christian Brauner)   
  - RDMA/mlx5: Return the firmware result upon destroying QP/RQ (Patrisious Haddad)   
  - HID: add quirk for 03f0:464a HP Elite Presenter Mouse (Marco Morandini)   
  - drm/amdgpu: install stub fence into potential unused fence pointers (Lang Yu)   
  - HID: logitech-hidpp: Add USB and Bluetooth IDs for the Logitech G915 TKL Keyboard (stuarthayhurst)   
  - dma-remap: use kvmalloc_array/kvfree for larger dma memory remap (gaoxu)   
  - ASoC: SOF: Intel: fix SoundWire/HDaudio mutual exclusion (Pierre-Louis Bossart)   
  - iopoll: Call cpu_relax() in busy loops (Geert Uytterhoeven)   
  - ARM: dts: imx6dl: prtrvt, prtvt7, prti6q, prtwd2: fix USB related warnings (Oleksij Rempel)   
  - PCI: tegra194: Fix possible array out of bounds access (Sumit Gupta)   
  - net: tls: avoid discarding data on record close (Jakub Kicinski)   
  - net/tls: Multi-threaded calls to TX tls_dev_del (Tariq Toukan)   
  - net/tls: Perform immediate device ctx cleanup when possible (Tariq Toukan)   
  - macsec: use DEV_STATS_INC() (Eric Dumazet)   
  - macsec: Fix traffic counters/statistics (Clayton Yager)   
  - selftests: forwarding: tc_actions: Use ncat instead of nc (Ido Schimmel)   
  - selftests: forwarding: tc_actions: cleanup temporary files when test is aborted (Davide Caratti)   
  - mmc: sdhci-f-sdh30: Replace with sdhci_pltfm (Kunihiko Hayashi)   
  - LTS version: v5.15.127 (Jack Vogel)   
  - timers/nohz: Last resort update jiffies on nohz_full IRQ entry (Frederic Weisbecker)   
  - timers/nohz: Switch to ONESHOT_STOPPED in the low-res handler when the tick is stopped (Nicholas Piggin)   
  - tick: Detect and fix jiffies update stall (Frederic Weisbecker)   
  - sch_netem: fix issues in netem_change() vs get_dist_table() (Eric Dumazet)   
  - alpha: remove __init annotation from exported page_is_ram() (Masahiro Yamada)   
  - scsi: qedf: Fix firmware halt over suspend and resume (Nilesh Javali)   
  - scsi: qedi: Fix firmware halt over suspend and resume (Nilesh Javali)   
  - scsi: fnic: Replace return codes in fnic_clean_pending_aborts() (Karan Tilak Kumar)   
  - scsi: core: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: snic: Fix possible memory leak if device_add() fails (Zhu Wang)   
  - scsi: 53c700: Check that command slot is not NULL (Alexandra Diupina)   
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Michael Kelley)   
  - scsi: core: Fix legacy /proc parsing buffer overflow (Tony Battersby)   
  - netfilter: nf_tables: report use refcount overflow (Pablo Neira Ayuso)   
  - nvme-rdma: fix potential unbalanced freeze & unfreeze (Ming Lei)   
  - nvme-tcp: fix potential unbalanced freeze & unfreeze (Ming Lei)   
  - btrfs: set cache_block_group_error if we find an error (Josef Bacik)   
  - btrfs: reject invalid reloc tree root keys with stack dump (Qu Wenruo)   
  - btrfs: exit gracefully if reloc roots don't match (Qu Wenruo)   
  - btrfs: don't stop integrity writeback too early (Christoph Hellwig)   
  - ibmvnic: Handle DMA unmapping of login buffs in release functions (Nick Child)   
  - ibmvnic: Unmap DMA login rsp buffer on send login fail (Nick Child)   
  - ibmvnic: Enforce stronger sanity checks on login response (Nick Child)   
  - net/mlx5: Skip clock update work when device is in error state (Moshe Shemesh)   
  - net/mlx5: Allow 0 for total host VFs (Daniel Jurgens)   
  - dmaengine: mcf-edma: Fix a potential un-allocated memory access (Christophe JAILLET)   
  - nexthop: Fix infinite nexthop bucket dump when using maximum nexthop ID (Ido Schimmel)   
  - nexthop: Make nexthop bucket dump more efficient (Ido Schimmel)   
  - nexthop: Fix infinite nexthop dump when using maximum nexthop ID (Ido Schimmel)   
  - net: hns3: add wait until mac link down (Jie Wang)   
  - net: hns3: refactor hclge_mac_link_status_wait for interface reuse (Jie Wang)   
  - net: phy: at803x: remove set/get wol callbacks for AR8032 (Li Yang)   
  - RDMA/umem: Set iova in ODP flow (Michael Guralnik)   
  - wifi: cfg80211: fix sband iftype data lookup for AP_VLAN (Felix Fietkau)   
  - drm/rockchip: Don't spam logs in atomic check (Daniel Stone)   
  - IB/hfi1: Fix possible panic during hotplug remove (Douglas Miller)   
  - iavf: fix potential races for FDIR filters (Piotr Gardocki)   
  - drivers: net: prevent tun_build_skb() to exceed the packet size limit (Andrew Kanner)   
  - dccp: fix data-race around dp->dccps_mss_cache (Eric Dumazet)   
  - bonding: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves (Ziyang Xuan)   
  - xsk: fix refcount underflow in error path (Magnus Karlsson)   
  - tunnels: fix kasan splat when generating ipv4 pmtu error (Florian Westphal)   
  - net/packet: annotate data-races around tp->status (Eric Dumazet)   
  - mISDN: Update parameter type of dsp_cmx_send() (Nathan Chancellor)   
  - bpf, sockmap: Fix bug that strp_done cannot be called (Xu Kuohai)   
  - bpf, sockmap: Fix map type error in sock_map_del_link (Xu Kuohai)   
  - net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() (Andrew Kanner)   
  - selftests: forwarding: tc_flower: Relax success criterion (Ido Schimmel)   
  - selftests: forwarding: Switch off timeout (Ido Schimmel)   
  - selftests: forwarding: Skip test when no interfaces are specified (Ido Schimmel)   
  - selftests: forwarding: ethtool_extended_state: Skip when using veth pairs (Ido Schimmel)   
  - selftests: forwarding: ethtool: Skip when using veth pairs (Ido Schimmel)   
  - selftests: forwarding: Add a helper to skip test when using veth pairs (Ido Schimmel)   
  - selftests/rseq: Fix build with undefined __weak (Mark Brown)   
  - drm/nouveau/disp: Revert a NULL check inside nouveau_connector_get_modes (Karol Herbst)   
  - x86: Move gds_ucode_mitigated() declaration to header (Arnd Bergmann)   
  - x86/speculation: Add cpu_show_gds() prototype (Arnd Bergmann)   
  - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Kirill A. Shutemov)   
  - x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 (Cristian Ciocaltea)   
  - x86/srso: Fix build breakage with the LLVM linker (Nick Desaulniers)   
  - usb: typec: tcpm: Fix response to vsafe0V event (Badhri Jagan Sridharan)   
  - usb: common: usb-conn-gpio: Prevent bailing out if initial role is none (Prashanth K)   
  - usb: dwc3: Properly handle processing of pending events (Elson Roy Serrao)   
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Alan Stern)   
  - misc: rtsx: judge ASPM Mode to set PETXCFG Reg (Ricky WU)   
  - binder: fix memory leak in binder_init() (Qi Zheng)   
  - iio: adc: ina2xx: avoid NULL pointer dereference on OF device match (Alvin Šipraga)   
  - iio: cros_ec: Fix the allocation size for cros_ec_command (Yiyuan Guo)   
  - io_uring: correct check for O_TMPFILE (Aleksa Sarai)   
  - selftests/bpf: Fix sk_assign on s390x (Ilya Leoshkevich)   
  - selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code (Yonghong Song)   
  - selftests/bpf: make test_align selftest more robust (Andrii Nakryiko)   
  - bpf: aggressively forget precise markings during state checkpointing (Andrii Nakryiko)   
  - bpf: stop setting precise in current state (Andrii Nakryiko)   
  - bpf: allow precision tracking for programs with subprogs (Andrii Nakryiko)   
  - nilfs2: fix use-after-free of nilfs_root in dirtying inodes via iput (Ryusuke Konishi)   
  - radix tree test suite: fix incorrect allocation size for pthreads (Colin Ian King)   
  - hwmon: (pmbus/bel-pfe) Enable PMBUS_SKIP_STATUS_CHECK for pfe1100 (Tao Ren)   
  - drm/amd/display: check attr flag before set cursor degamma on DCN3+ (Melissa Wen)   
  - drm/shmem-helper: Reset vma->vm_ops before calling dma_buf_mmap() (Boris Brezillon)   
  - drm/nouveau/gr: enable memory loads on helper invocation on all channels (Karol Herbst)   
  - riscv,mmio: Fix readX()-to-delay() ordering (Andrea Parri)   
  - dmaengine: pl330: Return DMA_PAUSED when transaction is paused (Ilpo Järvinen)   
  - ipv6: adjust ndisc_is_useropt() to also return true for PIO (Maciej Żenczykowski)   
  - mmc: moxart: read scr register without changing byte order (Sergei Antonov)   
  - wireguard: allowedips: expand maximum node depth (Jason A. Donenfeld)   
  - ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea() (Namjae Jeon)   
  - ksmbd: validate command request size (Long Li)   
  - LTS version v5.15.126 (Jack Vogel)   
  - PM: sleep: wakeirq: fix wake irq arming (Johan Hovold)   
  - PM / wakeirq: support enabling wake-up irq after runtime_suspend called (Chunfeng Yun)   
  - soundwire: fix enumeration completion (Johan Hovold)   
  - soundwire: bus: pm_runtime_request_resume on peripheral attachment (Pierre-Louis Bossart)   
  - selftests/rseq: Play nice with binaries statically linked against glibc 2.35+ (Sean Christopherson)   
  - selftests/rseq: check if libc rseq support is registered (Michael Jeanson)   
  - drm/imx/ipuv3: Fix front porch adjustment upon hactive aligning (Alexander Stein)   
  - powerpc/mm/altmap: Fix altmap boundary check (Aneesh Kumar K.V)   
  - mtd: rawnand: fsl_upm: Fix an off-by one test in fun_exec_op() (Christophe JAILLET)   
  - mtd: rawnand: rockchip: Align hwecc vs. raw page helper layouts (Johan Jonker)   
  - mtd: rawnand: rockchip: fix oobfree offset and description (Johan Jonker)   
  - mtd: rawnand: omap_elm: Fix incorrect type in assignment (Roger Quadros)   
  - ext2: Drop fragment support (Jan Kara)   
  - fs: Protect reconfiguration of sb read-write from racing writes (Jan Kara)   
  - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb (Alan Stern)   
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Sungwoo Kim)   
  - fs/sysv: Null check to prevent null-ptr-deref bug (Prince Kumar Maurya)   
  - fs/ntfs3: Use __GFP_NOWARN allocation at ntfs_load_attr_list() (Tetsuo Handa)   
  - file: reinstate f_pos locking optimization for regular files (Linus Torvalds)   
  - bpf, cpumap: Make sure kthread is running before map update returns (Hou Tao)   
  - drm/ttm: check null pointer before accessing when swapping (Guchun Chen)   
  - open: make RESOLVE_CACHED correctly test for O_TMPFILE (Aleksa Sarai)   
  - bpf: Disable preemption in bpf_event_output (Jiri Olsa)   
  - rbd: prevent busy loop when requesting exclusive lock (Ilya Dryomov)   
  - wifi: mt76: mt7615: do not advertise 5 GHz on first phy of MT7615D (DBDC) (Paul Fertser)   
  - net: tap_open(): set sk_uid from current_fsuid() (Laszlo Ersek)   
  - net: tun_chr_open(): set sk_uid from current_fsuid() (Laszlo Ersek)   
  - arm64: dts: stratix10: fix incorrect I2C property for SCL signal (Dinh Nguyen)   
  - mtd: rawnand: meson: fix OOB available bytes for ECC (Arseniy Krasnov)   
  - mtd: spinand: toshiba: Fix ecc_get_status (Olivier Maignial)   
  - exfat: release s_lock before calling dir_emit() (Sungjong Seo)   
  - exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree (gaoming)   
  - firmware: arm_scmi: Drop OF node reference in the transport channel setup (Krzysztof Kozlowski)   
  - ceph: defer stopping mdsc delayed_work (Xiubo Li)   
  - USB: zaurus: Add ID for A-300/B-500/C-700 (Ross Maynard)   
  - libceph: fix potential hang in ceph_osdc_notify() (Ilya Dryomov)   
  - scsi: storvsc: Limit max_sectors for virtual Fibre Channel devices (Michael Kelley)   
  - scsi: zfcp: Defer fc_rport blocking until after ADISC response (Steffen Maier)   
  - tcp_metrics: fix data-race in tcpm_suck_dst() vs fastopen (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_net (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_vals[] (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_lock (Eric Dumazet)   
  - tcp_metrics: annotate data-races around tm->tcpm_stamp (Eric Dumazet)   
  - tcp_metrics: fix addr_same() helper (Eric Dumazet)   
  - prestera: fix fallback to previous version on same major version (Jonas Gorski)   
  - net/mlx5: fs_core: Skip the FTs in the same FS_TYPE_PRIO_CHAINS fs_prio (Jianbo Liu)   
  - net/mlx5: fs_core: Make find_closest_ft more generic (Jianbo Liu)   
  - vxlan: Fix nexthop hash size (Benjamin Poirier)   
  - ip6mr: Fix skb_under_panic in ip6mr_cache_report() (Yue Haibing)   
  - s390/qeth: Don't call dev_close/dev_open (DOWN/UP) (Alexandra Winter)   
  - net: dcb: choose correct policy to parse DCB_ATTR_BCN (Lin Ma)   
  - net: netsec: Ignore 'phy-mode' on SynQuacer in DT mode (Mark Brown)   
  - net: korina: handle clk prepare error in korina_probe() (Yuanjun Gong)   
  - net: ll_temac: fix error checking of irq_of_parse_and_map() (Dan Carpenter)   
  - net: ll_temac: Switch to use dev_err_probe() helper (Yang Yingliang)   
  - bpf: sockmap: Remove preempt_disable in sock_map_sk_acquire (Tomas Glozar)   
  - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (valis)   
  - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (valis)   
  - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (valis)   
  - bpf, cpumap: Handle skb as well when clean up ptr_ring (Hou Tao)   
  - net/sched: taprio: Limit TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME to INT_MAX. (Kuniyuki Iwashima)   
  - net: add missing data-race annotation for sk_ll_usec (Eric Dumazet)   
  - net: add missing data-race annotations around sk->sk_peek_off (Eric Dumazet)   
  - net: add missing READ_ONCE(sk->sk_rcvbuf) annotation (Eric Dumazet)   
  - net: add missing READ_ONCE(sk->sk_sndbuf) annotation (Eric Dumazet)   
  - net: add missing READ_ONCE(sk->sk_rcvlowat) annotation (Eric Dumazet)   
  - net: annotate data-races around sk->sk_max_pacing_rate (Eric Dumazet)   
  - qed: Fix scheduling in a tasklet while getting stats (Konstantin Khorenko)   
  - mISDN: hfcpci: Fix potential deadlock on &hc->lock (Chengfeng Ye)   
  - net: sched: cls_u32: Fix match key mis-addressing (Jamal Hadi Salim)   
  - perf test uprobe_from_different_cu: Skip if there is no gcc (Georg Müller)   
  - net: dsa: fix value check in bcm_sf2_sw_probe() (Yuanjun Gong)   
  - rtnetlink: let rtnl_bridge_setlink checks IFLA_BRIDGE_MODE length (Lin Ma)   
  - bpf: Add length check for SK_DIAG_BPF_STORAGE_REQ_MAP_FD parsing (Lin Ma)   
  - net/mlx5e: fix return value check in mlx5e_ipsec_remove_trailer() (Yuanjun Gong)   
  - net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx (Zhengchao Shao)   
  - wifi: cfg80211: Fix return value in scan logic (Ilan Peer)   
  - KVM: s390: fix sthyi error handling (Heiko Carstens)   
  - word-at-a-time: use the same return type for has_zero regardless of endianness (ndesaulniers@google.com)   
  - arm64: dts: imx8mn-var-som: add missing pull-up for onboard PHY reset pinmux (Hugo Villeneuve)   
  - iommu/arm-smmu-v3: Document nesting-related errata (Robin Murphy)   
  - iommu/arm-smmu-v3: Add explicit feature for nesting (Robin Murphy)   
  - iommu/arm-smmu-v3: Document MMU-700 erratum 2812531 (Robin Murphy)   
  - iommu/arm-smmu-v3: Work around MMU-600 erratum 1076982 (Robin Murphy)   
  - net/mlx5: Free irqs only on shutdown callback (Shay Drory)   
  - perf: Fix function pointer case (Peter Zijlstra)   
  - io_uring: gate iowait schedule on having pending requests (Jens Axboe)   
  - net: mana: Use the correct WQE count for ringing RQ doorbell (Long Li)  [Orabug: 35555552]  
  - net: mana: Batch ringing RX queue doorbell on receiving packets (Long Li)  [Orabug: 35555552]  
  - devlink: report devlink_port_type_warn source device (Petr Oros)  [Orabug: 35727899]  
  - scsi: mpi3mr: Update driver version to 8.5.0.0.0 (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Enhance handling of devices removed after controller reset (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: WRITE SAME implementation (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Add support for more than 1MB I/O (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Update MPI Headers to version 3.00.28 (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Invoke soft reset upon TSU or event ack time out (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Propagate sense data for admin queue SCSI I/O (Sathya Prakash)  [Orabug: 35729632]  
  - scsi: mpi3mr: Fix the type used for pointers to bitmap (Christophe JAILLET)  [Orabug: 35729632]  
  - scsi: mpi3mr: Use -ENOMEM instead of -1 in mpi3mr_expander_add() (Harshit Mogalapalli)  [Orabug: 35729632]  
  - scsi: mpi3mr: Use IRQ save variants of spinlock to protect chain frame allocation (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Handle soft reset in progress fault code (0xF002) (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Update copyright year (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Fix W=1 compilation warnings (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Update MPI Headers to revision 27 (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Modify MUR timeout value to 120 seconds (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Fix admin queue memory leak upon soft reset (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Successive VD delete and add causes FW fault (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Fix expander node leak in mpi3mr_remove() (Tomas Henzl)  [Orabug: 35729632]  
  - scsi: mpi3mr: Fix memory leaks in mpi3mr_init_ioc() (Tomas Henzl)  [Orabug: 35729632]  
  - scsi: mpi3mr: Fix sas_hba.phy memory leak in mpi3mr_remove() (Tomas Henzl)  [Orabug: 35729632]  
  - scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() (Tomas Henzl)  [Orabug: 35729632]  
  - scsi: mpi3mr: Fix config page DMA memory leak (Tomas Henzl)  [Orabug: 35729632]  
  - scsi: mpi3mr: Fix throttle_groups memory leak (Tomas Henzl)  [Orabug: 35729632]  
  - scsi: mpi3mr: Bad drive in topology results kernel crash (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: NVMe command size greater than 8K fails (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Return proper values for failures in firmware init path (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Wait for diagnostic save during controller init (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: ioctl timeout when disabling/enabling interrupt (Ranjan Kumar)  [Orabug: 35729632]  
  - scsi: mpi3mr: Remove unneeded version.h include (Jesper Juhl)  [Orabug: 35729632]  
  - scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization (Shin'ichiro Kawasaki)  [Orabug: 35729632]  
  - scsi: mpi3mr: Use number of bits to manage bitmap sizes (Shin'ichiro Kawasaki)  [Orabug: 35729632]  
  - scsi: mpi3mr: Remove unnecessary memcpy() to alltgt_info->dmi (Shin'ichiro Kawasaki)  [Orabug: 35729632]  
  - scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() (Shin'ichiro Kawasaki)  [Orabug: 35729632]  
  - scsi: mpi3mr: Fix an issue found by KASAN (Tomas Henzl)  [Orabug: 35729632]  
  - scsi: mpi3mr: Remove usage of dma_get_required_mask() API (Sreekanth Reddy)  [Orabug: 35729632]  
  - scsi: mpi3mr: Suppress command reply debug prints (Shin'ichiro Kawasaki)  [Orabug: 35729632]  
  - scsi: mpi3mr: Select CONFIG_SCSI_SAS_ATTRS (Michal Kubecek)  [Orabug: 35729632]  
  - vhost-scsi: Fix alignment handling with windows (Mike Christie)  [Orabug: 35769316]  
  - selftests/bpf: fix static assert compilation issue for test_cls_*.c (Alan Maguire)  [Orabug: 35773339]


