# changelog

author: Caolán McNamara <caolanm@redhat.com> - 1:7.1.8.1-8
changelog:
  - Resolves: rhbz#2134759 Untrusted Macros
  - Resolves: rhbz#2134757 Weak Master Keys
  - Resolves: rhbz#2134755 Static Initialization Vector
  - Resolves: rhbz#2134761 Macro URL arbitrary script execution


author: haomimi <haomimi@uniontech.com> - 1:7.1.8.1-8.0.1.03
changelog:
  - fix: fix menu display issue of arm architecture libreoffice related software (bugid:184789)
  - spec: modify aarch64 off serverconfig


author: Stephan Bergmann <sbergman@redhat.com> - 1:7.1.8.1-11.0.1
changelog:
  - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula
    Parsing
  - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded
    without prompt via IFrame
  - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write


author: Eduard Abdullin <eabdullin@almalinux.org> - 1:7.1.8.1-12.0.1
changelog:
  - escape url passed to gstreamer
  - add some protocols that don't make sense as floating frame
   targets
  - warn about exotic protocols as well
  - default to ignoring libreoffice special-purpose protocols
   in calc hyperlink
  - reuse AllowedLinkProtocolFromDocument in writer
  - reuse AllowedLinkProtocolFromDocument in impress/draw
  - CVE-2023-6185 CVE-2023-6186 backporting


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-14
changelog:
  - Speed up parsing of DNS messages with many different names (CVE-2023-4408)
  - Prevent increased CPU consumption in DNSSEC validator (CVE-2023-50387 CVE-2023-50868)
  - Do not use header_prev in expire_lru_headers


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-16.1
changelog:
  - Resolve CVE-2024-1975
  - Resolve CVE-2024-1737
  - Add ability to change runtime limits for max types and records per name


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-16.3
changelog:
  - Limit additional section records CPU processing (CVE-2024-11187)
  - Correct ANY queries to not have additional data appended


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-4
changelog:
  - Tighten cache protection against record from forwarders (CVE-2021-25220)
  - Include test of forwarders


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-5
changelog:
  - Fix memory leak in ECDSA verify processing (CVE-2022-38177)
  - Fix memory leak in EdDSA verify processing (CVE-2022-38178)


author: yangxianzhao <yangxianzhao@uniontech.com> - 32:9.11.36-5.3
changelog:
  - fix: Delete other distribution identities in version(bugid:166379)
  - fix: delete empty link(bugid:123783)


author: Nick Clifton <nickc@redhat.com> - 2.30-119.1
changelog:
  - Backport: Fix an illegal memory access when parsing an ELF file containing corrupt symbol version information.  (#2164700)


author: Nick Clifton <nickc@redhat.com> - 2.30-119.2
changelog:
  - Backport: Fix an illegal memory access when parsing an ELF file containing corrupt symbol version information.  (RHEL-12956)


author: Xue haolin <xuehaolin@openanolis.org> - 2.30-119.0.1.2
changelog:
  - Rebrand to Anolis OS.
  - Add loongarch support. (lixing@loongson.cn)
  - Fixup LoongArch wrong debug line. (lixing@loongson.cn)
  - Add LoongArch missing opcode. (lixing@loongson.cn)


author: Xing Li <lixing@loongson.cn> - 2.30-119.0.2.2
changelog:
  - Fixup gas SIGSEGV for extremely long function name. (lixing@loongson.cn)
  - change loong64 to loongarch64.
  - Add ifunc support.
  - Delete R_LARCH_NONE for eh_frame.
  - Fixup pr21964 bug.
  - Add 3A6000 opcode.
  - Fix some testsuite error.


author: mahailiang <mahailiang@uniontech.com> - 2.30-119.0.2.2.01
changelog:
  - rebrand: rebrand for uos
  - rebrand: modify bugurl
  - spec: no build loongarch64
  - cve: fix ld -E POC loophole
  - cve: fix memory crash when doing "objdump -D" UT-2023-0001


author: Gopal Tiwari <gtiwari@redhat.com> - 5.56-1
changelog:
  + bluez-5.56-1
  - Fixing (#1965057)
  - Removing bccmd, enabling hid2hci as upstream removed the support in bluez-5.56


author: David Marlin <dmarlin@redhat.com> - 5.63-2
changelog:
  + bluez-5.63-2
  - Change default of ClassicBondedOnly to true to align with HID specification.
  - Resolves: RHEL-18429
  - Fixing CVE-2021-41229


author: David Marlin <dmarlin@redhat.com> - 5.63-4
changelog:
  + bluez-5.63-4
  - Resolves: RHEL-35501
  - Fixing CVE-2023-50230
  - Resolves: RHEL-35504
  - Fixing CVE-2023-50229


author: David Marlin <dmarlin@redhat.com> - 5.63-5
changelog:
  + bluez-5.63-5
  - Resolves: RHEL-35371
  - Fixing CVE-2023-27349
  - Resolves: RHEL-35492
  - Fixing CVE-2023-51589


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.151
changelog:
  - Revert "x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise"
  - Revert "x86/hw_breakpoint: Prevent data breakpoints on cpu_entry_area"
  - Revert "x86/hw_breakpoint: Add within_area() to check data breakpoints"
  - Revert "x86/hw_breakpoint: Prevent data breakpoints on direct GDT"
  - Revert "x86/mm: Randomize per-cpu entry area"


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.2
changelog:
  * Wed Jun 14 2023 daifan <daifan@uniontech.com> - 4.19.0-91.152.1
  - (CVE-2023-2985)fs: hfsplus: fix UAF issue in hfsplus_put_super
  - (CVE-2023-34256)ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.3
changelog:
  - UOS: Modify the CONFIG_SND_ALOOP configuration to Y
  - (CVE-2023-3161)fbcon: Check font dimension limits
  - (CVE-2023-3220)drm/msm/dpu: Add check for pstates
  - (CVE-2023-3358)HID: intel_ish-hid: Add check for ishtp_dma_tx_map
  - (CVE-2023-3090)ipvlan:Fix out-of-bounds caused by unclear skb->cb
  - (CVE-2023-3338)Linux Kernel NULL Pointer Dereference in DECnet
  - (CVE-2023-3141)memstick: r592: Fix UAF bug in r592_remove due to race condition
  - (CVE-2023-3111)btrfs: unset reloc control if transaction commit fails in prepare_to_relocate()
  - (CVE-2023-3111-pre)btrfs: check return value of btrfs_commit_transaction in relocation
  - (CVE-2023-3268)relayfs: fix out-of-bounds access in relay_file_read
  - (CVE-2023-3268-pre)kernel/relay.c: fix read_pos error when multiple readers
  - (CVE-2023-35788)net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
  - (CVE-2023-35823)media: saa7134: fix use after free bug in saa7134_finidev due to race condition
  - (CVE-2023-35824)media: dm1105: Fix use after free bug in dm1105_remove due to race condition
  - (CVE-2023-35828)usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.4
changelog:
  - UOS:Zhaoxin:sata/xhci: disable 64bit dma support on some zhaoxin's sata/xhci controller
  - UOS: Compile st_gmac and IGB network card drivers to kernel modules
  - UOS: inspur: Fixing CS5280H legacy mode automatic reboot during shutdown
  - UOS: radeon:Refactoring submitted 1998e6355fa8 to add architectural distinction to the code introduced by Loongson
  - UOS: fix var compile error
  - UOS: Fix possible kernel panic on FT2000 when loading crct10dif-ce module
  - UOS: loongarch: Support for crash parsing kernel


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.5
changelog:
  - uos: Increased NR_CPUS to resolve hardware detection errors in loongarch [B211173]
  - uos: kabi: only run check_kabi.sh


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.6
changelog:
  - stable: {CVE-2023-20593} x86/cpu/amd: Add a Zenbleed fix
  - stable: x86/microcode/AMD: Add a @cpu parameter to the reloading functions
  - uos: kabi: update loongarch Module.kabi_loongarch64


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.7
changelog:
  - stable: {CVE-2023-34319} xen/netback: Fix buffer overrun triggered by unusual packet [T282039]
  - uos: qxl: adapt io map cache policy in arm64 for qxl
  - uos: qxl: Resolve qxl driver initialization failure issue


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.10
changelog:
  - uos: fix CVE-2022-40982 patch kabi problem [T282039]
  - anolis: virtio_blk: fix the discard_granularity and discard_alignment queue limits
  - anolis: virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero
  - anolis: ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline
  - anolis: ext4: reduce computation of overhead during resize
  - anolis: erofs: fix misbehavior of unsupported chunk format check
  - anolis: iomap: Support inline data with block size < page size
  - anolis: iomap: support reading inline data from non-zero pos
  - anolis: iomap: Don't create iomap_page objects for inline files
  - anolis: selinux: fix race condition when computing ocontext SIDs
  - anolis: isolcpus: Affine unbound kernel threads to housekeeping cpus
  - anolis: kthread: Switch to cpu_possible_mask
  - Merge changes from topic "merge-anolis-419-27-update" into 1060a-152-lts
  - Merge "anolis: Revert "anolis: erofs,ovl: enable RCU'd ->get_acl()"" into 1060a-152-lts
  - Merge "anolis: virtio-blk: skip BUG_ON() in virtio_queue_rq() for discard command" into 1060a-152-lts
  - Merge "stable: {CVE-2023-35001} netfilter: nf_tables: prevent OOB access in nft_byteorder_eval [T282039]" into 1060a-152-lts
  - Merge "euler: {CVE-2023-3117} netfilter: nf_tables: unbind non-anonymous set if rule construction fails [T282039]" into 1060a-152-lts
  - Merge "euler: {CVE-2023-3117} netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain [T282039]" into 1060a-152-lts
  - Merge "euler: {CVE-2023-3117} netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-3212} gfs2: Don't deref jdesc in evict [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-1206} tcp: Reduce chance of collisions in inet6_hashfn(). [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-3609} net/sched: cls_u32: Fix reference counter leak leading to overflow [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-3611} net/sched: sch_qfq: account for stab overhead in qfq_enqueue [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-3776} net/sched: cls_fw: Fix improper refcount update leads to use-after-free [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-4128} net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-4128} net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-4132} media: usb: siano: Fix warning due to null work_func_t function pointer [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-4132} media: usb: siano: Fix use after free bugs caused by do_submit_urb [T282039]" into 1060a-152-lts
  - Merge "stable: {CVE-2023-40283} Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb [T282039]" into 1060a-152-lts
  - stable: {CVE-2022-40982} Documentation/x86: Fix backwards on/off logic about YMM support [T282039]
  - stable: {CVE-2022-40982} x86/xen: Fix secondary processors' FPU initialization [T282039]
  - stable: {CVE-2022-40982} KVM: Add GDS_NO support to KVM [T282039]
  - stable: {CVE-2022-40982} x86/speculation: Add Kconfig option for GDS [T282039]
  - stable: {CVE-2022-40982} x86/speculation: Add force option to GDS mitigation [T282039]
  - stable: {CVE-2022-40982} x86/speculation: Add Gather Data Sampling mitigation [T282039]
  - stable: {CVE-2022-40982} x86/fpu: Move FPU initialization into arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} x86/fpu: Mark init functions __init [T282039]
  - stable: {CVE-2022-40982} x86/fpu: Remove cpuinfo argument from init functions [T282039]
  - stable: {CVE-2022-40982} init, x86: Move mem_encrypt_init() into arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} init: Invoke arch_cpu_finalize_init() earlier [T282039]
  - stable: {CVE-2022-40982} init: Remove check_bugs() leftovers [T282039]
  - stable: {CVE-2022-40982} um/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} sparc/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} sh/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} mips/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} m68k/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} ia64/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} ARM: cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} x86/cpu: Switch to arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2022-40982} init: Provide arch_cpu_finalize_init() [T282039]
  - stable: {CVE-2023-35001} netfilter: nf_tables: prevent OOB access in nft_byteorder_eval [T282039]
  - euler: {CVE-2023-3117} netfilter: nf_tables: unbind non-anonymous set if rule construction fails [T282039]
  - euler: {CVE-2023-3117} netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain [T282039]
  - euler: {CVE-2023-3117} netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE [T282039]
  - stable: {CVE-2023-3212} gfs2: Don't deref jdesc in evict [T282039]
  - stable: {CVE-2023-1206} tcp: Reduce chance of collisions in inet6_hashfn(). [T282039]
  - stable: {CVE-2023-3609} net/sched: cls_u32: Fix reference counter leak leading to overflow [T282039]
  - stable: {CVE-2023-3611} net/sched: sch_qfq: account for stab overhead in qfq_enqueue [T282039]
  - stable: {CVE-2023-3776} net/sched: cls_fw: Fix improper refcount update leads to use-after-free [T282039]
  - anolis: {CVE-2023-1077} sched/rt: pick_next_rt_entity(): check list_entry
  - anolis: virtio_net: suppress cpu stall when free_unused_bufs
  - anolis: virtio_net: split free_unused_bufs()
  - anolis: ovl: enable RCU'd ->get_acl()
  - stable: {CVE-2023-4128} net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free [T282039]
  - stable: {CVE-2023-4128} net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free [T282039]
  - anolis: Revert "anolis: erofs,ovl: enable RCU'd ->get_acl()"
  - anolis: Revert "anolis: erofs,ovl: bypass [override|revert]_creds for overlayfs"
  - anolis: virtio-blk: skip BUG_ON() in virtio_queue_rq() for discard command
  - stable: {CVE-2023-4132} media: usb: siano: Fix warning due to null work_func_t function pointer [T282039]
  - stable: {CVE-2023-4132} media: usb: siano: Fix use after free bugs caused by do_submit_urb [T282039]
  - stable: {CVE-2023-40283} Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb [T282039]
  - loongarch: pci: irq: Add early_param pci_irq_limit to limit pci irq numbers [B209739]


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.11
changelog:
  - uos: refresh loongarch kabi
  - stable: {CVE-2022-45886} media: dvb-core: Fix use-after-free due on race condition at dvb_net [T282039]
  - stable: {CVE-2022-45887} media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() [T282039]
  - stable: {CVE-2022-45919} media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 [T282039]
  - stable: {CVE-2023-3772} xfrm: add NULL check in xfrm_update_ae_params [T282039]
  - UOS: kabi: fix files_struct broken [T286681]
  - fix: UOS: disable short task method on loongson to improve performance [T286681]
  - fix: UOS: use find_idlest_group old path on loongson to improve 1c performance [T286681]
  - fix: UOS: solve loongson syscall __fget error [T286681]
  - LoongArch:fixed some error fo loongson_syscall [T286681]
  - LoongArch: Introduce optimize syscall for loongarch [T286681]


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.12
changelog:
  - uos: add uharden app net manager module uhdappnm
  - uos: net: Fixed the txgbe compilation warning issue [T290527]
  - uos: net: Fixed the ngbe compilation error issue [T290527]
  - mainline: dma-direct: Force unencrypted DMA under SME for certain DMA masks
  - mainline: ext4: Fix rec_len verify error
  - uos: livepatch: support new style symbol format
  - uos: net: Update txgbe driver to 1.3.4 [T290527]
  - uos: net: Update ngbevf driver to 1.2.1 [T290527]
  - uos: net: Update ngbe driver to 1.2.5 [T290527]
  - uos: refresh loongarch kabi


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.13
changelog:
  - uos: enable CONFIG_OCFS2_FS
  - stable: {CVE-2023-4921} net: sched: sch_qfq: Fix UAF in qfq_dequeue() [T287071]
  - stable: {CVE-2023-4623} net/sched: sch_hfsc: Ensure inner classes have fsc curve [T287071]
  - stable: {CVE-2023-42755} net/sched: Retire rsvp classifier [T287071]
  - stable: {CVE-2023-42752} igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU [T287071]
  - stable: {CVE-2023-4207} net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free [T287071]


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.143
changelog:
  - UOS: loongarch/config: enable CONFIG_PARAVIRT
  - fbdev: ls2k500 sfb add module device table to enable module auto load.
  - fbdev: ls2k500 sfb add set par to support resolution setup.
  - Adds parsing compatibility for screen info guid.
  - fbdev: ls2k500sfb gpio irq handler stop all cpus to wait pcie training done.
  - LoongArch:LSVZ: implement the paravirt qspinlock call
  - drm/loongson: do not load loongson drm driver if ls2k500 bmc been found.
  - pci/quirk.c: Add limit for mrrs of 7A2000
  - Revert "LoongArch: Not using GCC stackrealign feature"
  - net: mucse: Update Mucse's network card device driver
  - LoongArch: nokaslr added to builtin cmdline
  - Revert "LoongArch: use generic irq migration"
  - LoongArch: Enable KASLR
  - LoongArch: Add the same binary implementation of kdump
  - irqchip/loongarch: Improve extioi code for guest cpu
  - LoongArch: Fix cpuhotplug on master core
  - xhci: Fix usb device probability miss
  - loongarch/kvm: ls7a add iocsrw emulation
  - fbdev: ls2k500 sfb add gpio request fail process.
  - LoongArch: kdump: Reimplement crashkernel=YM
  - LoongArch: Backport upstream kexec/kdump feature
  - LoongArch: export symbol invalid_pud_table
  - LoongArch: fix pm callback function error
  - LoongArch: Fix enable_gpe_wakeup() function error
  - irqchip: irq-loongson-liointc: fix some registers not be saved during S3
  - LoongArch: Make spinlock_test not dependent on Debug_FS
  - Revert "LoongArch: Introduce optimize syscall for loongarch"
  - Revert "LoongArch:fixed some error fo loongson_syscall"
  - Revert "LoongArch:Fix the bug of ls_dup copying invalid file descriptors"
  - Revert "UOS: Fix the warning message of ls_get_file"
  - Revert "UOS: kabi: fix kabi break by 759f47d3506ci"
  - scsi: lpfc: Add the FLOGI cmd to the list of commands which are allowed to retry
  - Revert "KVM: arm64: Fix symbol dependency in __hyp_call_panic_nvhe"
  - Revert "compiler.h: Raise minimum version of GCC to 5.1 for arm64"


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.144
changelog:
  - (CVE-2023-1670)xirc2ps_cs: Fix use after free bug in xirc2ps_detach
  - (CVE-2022-4744)tun: avoid double free in tun_free_netdev
  - (CVE-2023-1855)hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition
  - (CVE-2023-1513)kvm: initialize all of the kvm_debugregs structure before sending it to userspace
  - UOS: blk: Adjust blk_done_softirq to align the high version
  - block: mark flush request as IDLE when it is really finished
  - blk-mq: mark flush request as IDLE in flush_end_io()


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.145
changelog:
  - Revert "UOS: kabi: fix broken by 5ca4f93f48db"
  - UOS: lock tuned 
  - UOS: config: enable SCHED_CLUSTER
  - UOS: zhaoxin: rename topology_cluster_id to topology_zx_cluster_id
  - UOS: sched: Add cluster scheduler level for x86
  - UOS: sched: Add cluster scheduler level in core and related Kconfig for ARM64
  - UOS: topology: Represent clusters of CPUs within a die
  - UOS: sched: short execution cycle process optimization
  - UOS: fix: the impact of UTS audit function on performance degradation when selinux is not enabled.
  - Merge "vfio/mdev: Add iommu related member in mdev_device" into linux-next
  - UOS: kabi: fix broken by -
  - vfio/mdev: Add iommu related member in mdev_device
  - Zhaoxin: update patch version banner v4.0.10
  - Zhaoxin: tcp: add a missing nf_reset_ct() in 3WHS handling
  - Zhaoxin: net: add skb_defer_max sysctl
  - Zhaoxin: net: use napi_consume_skb() in skb_defer_free_flush()
  - Zhaoxin: net: fix possible race in skb_attempt_defer_free()
  - Zhaoxin: net: call skb_defer_free_flush() before each napi_poll()
  - Zhaoxin: tcp: drop skb dst in tcp_rcv_established()
  - Zhaoxin: net: make sure net_rx_action() calls skb_defer_free_flush()
  - Zhaoxin: net: generalize skb freeing deferral to per-cpu lists
  - Zhaoxin: Fix streaming DMA writes disorder issue for Zhaoxin's KH-40000 platform v2
  - Zhoaxin: update Zhaoxin I2C Linux driver to v1.3.0
  - Zhaoxin: sched/topology: fix the issue groups don't span domain->span for NUMA diameter > 2
  - UOS: loonarch: enable CONFIG_ECRYPT_FS for encryptfs filesystem
  - Merge changes from topics "2304.4.0", "merge_euler-2304.3.0" into linux-next
  - KVM: nVMX: add missing consistency checks for CR0 and CR4
  - net/sched: Retire tcindex classifier
  - Documentation/hw-vuln: Fix rST warning
  - Documentation/hw-vuln: Add documentation for Cross-Thread Return Predictions
  - KVM: x86: Mitigate the cross-thread return address predictions bug
  - x86/speculation: Identify processors vulnerable to SMT RSB predictions
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
  - Merge "UOS: locking/osq_lock: Fix wrong input type" into linux-next
  - UOS: loongarch/config: enable CONFIG_CRASH_DUMP
  - LoongArch: Limite pci device irq number to 32
  - UOS: locking/osq_lock: Fix wrong input type
  - nbd: remove the call to set_blocksize
  - nbd: Fix use-after-free in pid_show
  - UOS:config: enable CONFIG_ECRYPT_FS for encryptfs filesystem
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition
  - bpf: add missing header file include
  - uaccess: Add speculation barrier to copy_from_user()
  - x86/mm: Fix use of uninitialized buffer in sme_enable()
  - ext4: fail ext4_iget if special inode unallocated
  - ext4: zero i_disksize when initializing the bootloader inode
  - irqdomain: Drop bogus fwspec-mapping error handling
  - irqdomain: Fix disassociation race
  - irqdomain: Fix association race
  - x86/kprobes: Fix arch_check_optimized_kprobe check within optimized_kprobe range
  - x86/kprobes: Fix __recover_optprobed_insn check optimizing logic
  - x86/bugs: Reset speculation control settings on init
  - timers: Prevent union confusion from unexpected restart_syscall()
  - crypto: rsa-pkcs1pad - Use akcipher_request_complete
  - crypto: seqiv - Handle EBUSY correctly
  - ACPI: battery: Fix missing NUL-termination with large strings
  - ACPICA: nsrepair: handle cases without a return value correctly
  - genirq: Fix the return type of kstat_cpu_irqs_sum()
  - ACPI: NFIT: fix a potential deadlock during NFIT teardown
  - alarmtimer: Prevent starvation by small intervals and SIG_IGN
  - ring-buffer: Fix race while reader and writer are on the same page
  - md: fix kabi broken in struct mddev
  - md: use interruptible apis in idle/frozen_sync_thread
  - md: wake up 'resync_wait' at last in md_reap_sync_thread()
  - md: refactor idle/frozen_sync_thread()
  - md: add a mutex to synchronize idle and frozen in action_store()
  - md: refactor action_store() for 'idle' and 'frozen'
  - md: fix soft lockup in status_resync
  - md: don't update recovery_cp when curr_resync is ACTIVE
  - md: Ensure resync is reported after it starts
  - md: Use enum for overloaded magic numbers used by mddev->curr_resync
  - loop: Add parm check in loop_control_ioctl
  - block/wbt: enable wbt after switching cfq to other schedulers
  - sched/fair: Sanitize vruntime of entity being migrated
  - sched/fair: sanitize vruntime of entity being placed
  - Revert "sched: Reinit task's vruntime if a task sleep over 200 days"
  - btrfs: fix race between quota disable and quota assign ioctls
  - ext4: Fix i_disksize exceeding i_size problem in paritally written case
  - ext4: ext4_put_super: Remove redundant checking for 'sbi->s_journal_bdev'
  - ext4: Fix reusing stale buffer heads from last failed mounting
  - ext4: fix race between writepages and remount
  - ftrace: Fix invalid address access in lookup_rec() when index is 0
  - scsi: scsi_dh_alua: fix memleak for 'qdata' in alua_activate()
  - cgroup: Add missing cpus_read_lock() to cgroup_attach_task_all()
  - cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock
  - cgroup/cpuset: Change cpuset_rwsem and hotplug lock order
  - net/sched: tcindex: search key must be 16 bits
  - net/sched: tcindex: update imperfect hash filters respecting rcu
  - ext4: make sure fs error flag setted before clear journal error
  - ext4: commit super block if fs record error when journal record without error
  - tty: fix out-of-bounds access in tty_driver_lookup_tty()
  - kernel: Initialize cpumask before parsing
  - softirq: Don't try waking ksoftirqd before it has been spawned
  - act_mirred: use the backlog for nested calls to mirred ingress
  - net/sched: act_mirred: refactor the handle of xmit
  - net: sched: don't expose action qstats to skb_tc_reinsert()
  - net: sched: protect against stack overflow in TC act_mirred
  - net: sched: refactor reinsert action
  - net: tls: fix possible race condition between do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
  - wifi: brcmfmac: slab-out-of-bounds read in brcmf_get_assoc_ies()
  - ext4: fix another off-by-one fsmap error on 1k block filesystems
  - mm: memcontrol: fix cannot alloc the maximum memcg ID
  - Merge "UOS:loongarch config add CONFIG_HINIC" into linux-next
  - Merge "staging: TCM: add GMJS(Nationz Tech) TCM driver." into linux-next
  - Merge "UOS:x86_64 add CONFIG_DRM_SMI and CONFIG_DRM_SMI_HDMI" into linux-next
  - UOS:loongarch config add CONFIG_HINIC
  - staging: TCM: add GMJS(Nationz Tech) TCM driver.
  - UOS:x86_64 add CONFIG_DRM_SMI and CONFIG_DRM_SMI_HDMI


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.146
changelog:
  - UOS: revert the debugfs modify  in  stmmac_main.c for  phytimu D2000 support
  - Merge "ext4: fix a possible ABBA deadlock due to busy PA" into linux-next
  - Merge "ext4: discard preallocations before releasing group lock" into linux-next
  - Merge "blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()" into linux-next
  - Merge "blk-wbt: call rq_qos_add() after wb_normal is initialized" into linux-next
  - ext4: fix a possible ABBA deadlock due to busy PA
  - ext4: discard preallocations before releasing group lock
  - blk-wbt: fix that 'rwb->wc' is always set to 1 in wbt_init()
  - UOS: fix 'struct task_struct' kabi changed
  - blk-wbt: call rq_qos_add() after wb_normal is initialized
  - UOS: optimization for stream
  - UOS: optimize short cycle process solution
  - UOS: modify pipe read/write
  - UOS: modify syscall for ARM64
  - UOS: fix ltp cpuhotplug stuck
  - Phytium: add dwmac-phytium support for d2000
  - UOS:net/phy: update Motorcomm Phy driver to 2.2.10068
  - Zhaoxin: update patch version banner v4.0.11
  - UOS: Zhaoxin: config:enable Zhaoxin i2c/sata/random/cputemp/sm3/sm4
  - Zhaoxin: Update coherent DMA writes disorder issue fix patch
  - UOS: kabi: fix broken by 5ca4f93f48db -- 2
  - UOS: kabi: fix broken by 6a5e5d2007e3
  - UOS: open CONFIG_SCHED_DEBUG config on loongarch


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.147
changelog:
  - (CVE-2023-2248)net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg
  - (CVE-2023-2194)i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer()
  - (CVE-2023-1989)Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work
  - (CVE-2023-30772)power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition
  - UOS: improve stream performance
  - Merge "UOS: fix ltp cpuset_hotlog bug" into linux-next
  - stmmac: debugfs entry name is not be changed when udev rename device name.
  - UOS: fix ltp cpuset_hotlog bug


author: lihongbin <lihongbin@uniontech.com> - 4.19.0-91.150
changelog:
  * Fri May 12 2023 lihongbin <lihongbin@uniontech.com> - 4.19.0-91.149
  - Merge "Revert "UOS: consider smt domain in short task solution"" into linux-next
  - Revert "UOS: consider smt domain in short task solution"
  - Merge "UOS: consider smt domain in short task solution" into linux-next
  - Merge "vfio/type1: Handle different mdev isolation type" into linux-next
  - Merge "vfio/type1: Add domain at(de)taching group helpers" into linux-next
  - Merge "iommu/vt-d: Return ID associated with an auxiliary domain" into linux-next
  - Merge "iommu/vt-d: Aux-domain specific domain attach/detach" into linux-next
  - Merge "iommu/vt-d: Move common code out of iommu_attch_device()" into linux-next
  - Merge "iommu/vt-d: Add per-device IOMMU feature ops entries" into linux-next
  - Merge "iommu/vt-d: Make intel_iommu_enable_pasid() more generic" into linux-next
  - Merge "iommu: Add APIs for multiple domains per device" into linux-next
  - Merge "iommu/vt-d: Remove misleading "domain 0" test from domain_exit()" into linux-next
  - Merge "iommu/vt-d: Remove unused dmar_remove_one_dev_info() argument" into linux-next
  - Merge "iommu/vt-d: Remove unnecessary local variable initializations" into linux-next
  - Merge "iommu/vt-d: Use dev_printk() when possible" into linux-next
  - Merge "iommu: Use dev_printk() when possible" into linux-next
  - Merge "iommu/vt-d: Remove deferred invalidation" into linux-next
  - Merge "iommu/vt-d: Shared virtual address in scalable mode" into linux-next
  - Merge "iommu/vt-d: Add first level page table interface" into linux-next
  - Merge "iommu/vt-d: Setup context and enable RID2PASID support" into linux-next
  - Merge "iommu/vt-d: Pass pasid table to context mapping" into linux-next
  - Merge "iommu/vt-d: Setup pasid entry for RID2PASID support" into linux-next
  - Merge "iommu/vt-d: Add second level page table interface" into linux-next
  - Merge "iommu/vt-d: Reserve a domain id for FL and PT modes" into linux-next
  - Merge "iommu/vt-d: Add 256-bit invalidation descriptor support" into linux-next
  - Merge "iommu/vt-d: Move page table helpers into header" into linux-next
  - Merge "iommu/vt-d: Manage scalalble mode PASID tables" into linux-next
  - Merge "iommu/vt-d: Enumerate the scalable mode capability" into linux-next
  - Merge "iommu/vtd: Cleanup dma_remapping.h header" into linux-next
  - Merge "iommu/vt-d: Add debugfs support to show context internals" into linux-next
  - Merge "iommu/vt-d: Add debugfs support for Interrupt remapping" into linux-next
  - Merge "iommu/vt-d: Add debugfs support to show register contents" into linux-next
  - Merge "iommu/vt-d: Enable base Intel IOMMU debugfs support" into linux-next
  - Merge "iommu/vt-d: Update register definitions to VT-d 3.0 specification" into linux-next
  - Merge "iommu/vt-d: Relocate struct/function declarations to its header files" into linux-next
  - UOS: consider smt domain in short task solution
  - xfs: fix an ABBA deadlock in xfs_rename
  - xfs: Fix deadlock between AGI and AGF when target_ip exists in xfs_rename()
  - xfs: don't account extra agfl blocks as available
  - xfs: preserve default grace interval during quotacheck
  - xfs: don't take a spinlock unconditionally in the DIO fastpath
  - xfs: show the proper user quota options
  - parisc: Declare pci_iounmap() parisc version only when CONFIG_PCI enabled
  - pci_iounmap'2: Electric Boogaloo: try to make sense of it all
  - anolis: nfsd: remove nfsd_reply_cache_shutdown() in nfsd_exit_net
  - drm/nouveau/mmu: add more general vmm free/node handling functions
  - l2tp: Serialize access to sk_user_data with sk_callback_lock
  - net: sched: fix race condition in qdisc_graft()
  - memcg: enable accounting of ipc resources
  - anolis: x86/kasan: Map shadow for percpu pages on demand
  - anolis: x86/kasan: Add helpers to align shadow addresses up and down
  - x86/mm: Randomize per-cpu entry area
  - x86/hw_breakpoint: Prevent data breakpoints on direct GDT
  - x86/hw_breakpoint: Add within_area() to check data breakpoints
  - x86/hw_breakpoint: Prevent data breakpoints on cpu_entry_area
  - x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise
  - KVM: x86: do not report a vCPU as preempted outside instruction boundaries
  - nvme: ensure subsystem reset is single threaded
  - nvme: Wait for reset state when required
  - nvme-pci: Allow PCI bus-level PM to be used if ASPM is disabled
  - PCI/ASPM: Add pcie_aspm_enabled()
  - nvme-pci: use host managed power state for suspend
  - nvme: introduce nvme_sync_io_queues
  - nvme: include admin_q sync with nvme_sync_queues
  - nvme-pci: Sync queues on reset
  - nvme: export get and set features
  - nvme: Prevent resets during paused controller state
  - arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually
  - anolis: kbuild: fix error remind bug for libelf check
  - vfio/type1: Handle different mdev isolation type
  - vfio/type1: Add domain at(de)taching group helpers
  - iommu/vt-d: Return ID associated with an auxiliary domain
  - iommu/vt-d: Aux-domain specific domain attach/detach
  - iommu/vt-d: Move common code out of iommu_attch_device()
  - iommu/vt-d: Add per-device IOMMU feature ops entries
  - iommu/vt-d: Make intel_iommu_enable_pasid() more generic
  - iommu: Add APIs for multiple domains per device
  - iommu/vt-d: Remove misleading "domain 0" test from domain_exit()
  - iommu/vt-d: Remove unused dmar_remove_one_dev_info() argument
  - iommu/vt-d: Remove unnecessary local variable initializations
  - iommu/vt-d: Use dev_printk() when possible
  - iommu: Use dev_printk() when possible
  - iommu/vt-d: Remove deferred invalidation
  - iommu/vt-d: Shared virtual address in scalable mode
  - iommu/vt-d: Add first level page table interface
  - iommu/vt-d: Setup context and enable RID2PASID support
  - iommu/vt-d: Pass pasid table to context mapping
  - iommu/vt-d: Setup pasid entry for RID2PASID support
  - iommu/vt-d: Add second level page table interface
  - iommu/vt-d: Reserve a domain id for FL and PT modes
  - iommu/vt-d: Add 256-bit invalidation descriptor support
  - iommu/vt-d: Move page table helpers into header
  - iommu/vt-d: Manage scalalble mode PASID tables
  - iommu/vt-d: Enumerate the scalable mode capability
  - iommu/vtd: Cleanup dma_remapping.h header
  - iommu/vt-d: Add debugfs support to show context internals
  - iommu/vt-d: Add debugfs support for Interrupt remapping
  - iommu/vt-d: Add debugfs support to show register contents
  - iommu/vt-d: Enable base Intel IOMMU debugfs support
  - iommu/vt-d: Update register definitions to VT-d 3.0 specification
  - iommu/vt-d: Relocate struct/function declarations to its header files
  - RDMA/core: Refactor rdma_bind_addr
  - Revert "RDMA/cma: Simplify rdma_resolve_addr() error flow"
  - ipv6: Fix an uninit variable access bug in __ip6_make_skb()
  - cgroup/cpuset: Wake up cpuset_attach_wq tasks in cpuset_cancel_attach()
  - verify_pefile: relax wrapper length check
  - udp6: fix potential access to stale information
  - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages()
  - ftrace: Mark get_lock_parent_ip() __always_inline
  - perf/core: Fix the same task check in perf_event_set_output
  - net: don't let netpoll invoke NAPI if in xmit context
  - icmp: guard against too small mtu
  - sched_getaffinity: don't assume 'cpumask_size()' is fully initialized
  - dm stats: check for and propagate alloc_percpu failure
  - dm thin: fix deadlock when swapping to thin device
  - genirq: introduce handle_fasteoi_edge_irq for phytium
  - genirq: introduce handle_fasteoi_edge_irq flow handler
  - scsi: dpt_i2o: Remove obsolete driver
  - md: extend disks_mutex coverage
  - md: use msleep() in md_notify_reboot()
  - md: fix double free of mddev->private in autorun_array()
  - bonding: Fix memory leak when changing bond type to Ethernet
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern
  - timers/nohz: Last resort update jiffies on nohz_full IRQ entry
  - bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails
  - bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change
  - net: qcom/emac: Fix use after free bug in emac_remove due to race condition
  - ext4: only update i_reserved_data_blocks on successful block allocation
  - writeback, cgroup: fix null-ptr-deref write in bdi_split_work_to_wbs
  - sctp: leave the err path free in sctp_stream_init to sctp_stream_free
  - audit: fix a memleak caused by auditing load module
  - tcp: restrict net.ipv4.tcp_app_win
  - x86/speculation: Allow enabling STIBP with legacy IBRS
  - iommu/arm-smmu-v3: Fix UAF when handle evt during iommu group removing
  - ipvlan: Modify the value of ipvlan modes
  - UOS: Add flags for Fisherman algo


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.14
changelog:
  - anolis: perf script python: Add Python3 support to tests/attr.py
  - anolis: nvme-pci: Fix controller freeze wait disabling
  - anolis: {CVE-2023-2124} xfs: verify buffer contents when we skip log replay
  - anolis: {CVE-2023-31084} media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
  - anolis: {CVE-2023-32233} netfilter: nf_tables: deactivate anonymous set from preparation phase
  - anolis: nvme-pci: rerun irq setup on IO queue init errors
  - anolis: nvme-pci: refactor nvme_disable_io_queues
  - uos: Revert "nvme-pci: rerun irq setup on IO queue init errors"


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.15
changelog:
  - uos: fix kabi changed with cpu_info
  - uos: Fix the zhaoxin compilation error by - and -
  - uos: fix compile error [T302429]
  - uos: loongarch restore to call check_bugs() [T302429]
  - Merge "uos: x86: Open tcm_fc configuration" into 1060a-152-lts
  - uos: x86: Open tcm_fc configuration
  - euler: block, bfq: consider also ioprio classes in symmetry detection [T300325]
  - uos: arm64: fix boot_cpu_data undeclared issue introduced by zhaoxin patch
  - uos: update inspur driver of drm
  - euler: DRM: Phytium display DRM document
  - euler: DRM: Phytium display DRM driver
  - euler: DRM: sound patch for Phytium dc driver
  - euler: DRM: Phytium vendor id
  - uos: zhaoxin: Log for Set ASYM_PACKING Flag on Zhaoxin KH-40000 platform
  - uos: zhaoxin: Set ASYM_PACKING Flag on Zhaoxin KH-40000 platform
  - uos: zhaoxin: Log for Add support for Zhaoxin USB4
  - uos: zhaoxin: Add support for Zhaoxin USB4
  - uos: zhaoxin: Log for KVM: x86: Introduce support for Zhaoxin ZXPAUSE instruction
  - uos: zhaoxin: KVM: x86: Introduce support for Zhaoxin ZXPAUSE instruction
  - uos: zhaoxin: Log for KVM: x86: Fix APIC page invalidation race
  - uos: zhaoxin: Log for x86/delay: add support for Zhaoxin ZXPAUSE instruction
  - uos: zhaoxin: x86/delay: add support for Zhaoxin ZXPAUSE instruction
  - uos: zhaoxin: Log for Add support Zhaoxin GPIO pinctrl
  - uos: zhaoxin: Add support Zhaoxin GPIO pinctrl
  - uos: zhaoxin: Log for Driver for Zhaoxin GMI SM2 Secure Hash algorithm
  - uos: zhaoxin: Add support for Zhaoxin GMI SM2 Secure Hash algorithm
  - uos: zhaoxin: Log for cpufreq: ACPI: add ITMT support when CPPC enabled
  - uos: zhaoxin: cpufreq: ACPI: add ITMT support when CPPC enabled
  - uos: zhaoxin: Update Zhaoxin core temperature monitoring driver
  - uos: zhaoxin: Log for Update HDAC support for Zhaoxin KX-7000
  - uos: zhaoxin: Update HDAC support for Zhaoxin KX-7000
  - uos: zhaoxin: Update PMU support for Zhaoxin KX-7000
  - uos: zhaoxin: Log for Fix Zhaoxin PMU uncore kdump fail bug
  - uos: zhaoxin: Fix Zhaoxin PMU uncore kdump fail bug
  - uos: zhaoxin: Update Zhaoxin GMI SM4 Block Cipher algorithm driver
  - uos: zhaoxin: Update Zhaoxin GMI SM3 Secure Hash algorithm driver
  - uos: zhaoxin: Log for xhci: guard accesses to ep_state in xhci_endpoint_reset()
  - uos: zhaoxin: Log for Driver for Zhaoxin SM3 and SM4 algorithm
  - uos: zhaoxin: Log for DMA RW sequence disorder issue fix
  - uos: zhaoxin: Log for sched/topology: fix the issue groups don't span domain->span for NUMA diameter > 2
  - uos: zhaoxin: Log for Net tcp optimization update
  - uos: zhaoxin: Log for Net tcp optimization
  - uos: zhaoxin: Zhaoxin: Log for x86/perf: Update performance events support for more Zhaoxin CPU
  - uos: zhaoxin: Log for EHCI:Clear wakeup signal locked in S0 state when device plug in
  - uos: zhaoxin: Log for XHCI:Fix some device identify fail when enable xHCI runtime suspend
  - uos: zhaoxin: Log for Add PMU support for Zhaoxin CPUs
  - uos: zhaoxin: x86/perf/zhaoxin: Add stepping check for ZXC
  - uos: zhaoxin: Log for Fix CRC32C instruction low performance issue
  - uos: zhaoxin: Log for iommu/vt-d:Add support for detecting ACPI device in RMRR
  - uos: zhaoxin: Log for USB:Fix kernel NULL pointer when unbind UHCI form vfio-pci
  - uos: zhaoxin: Log for x86/apic: Mask IOAPIC entries when disabling the local APIC
  - uos: zhaoxin: Log for Driver for Zhaoxin CPU core temperature monitoring
  - uos: zhaoxin: Log for Driver for Zhaoxin AES and SHA algorithm
  - uos: zhaoxin: Log for Driver for Zhaoxin HW Random Number Generator
  - uos: fix loongarch compiling error [T300323]
  - uos: fix kapi error for 00cd06c36fe [T300323]
  - uos: add config CONFIG_NVME_TARGET_TCP=m [T300323]
  - mainline: nvme-tcp: add NVMe over TCP host driver [T300323]
  - mainline: nvmet: allow configfs tcp trtype configuration [T300323]
  - mainline: nvmet-tcp: add NVMe over TCP target driver [T300323]
  - mainline: nvme-tcp: Add protocol header [T300323]
  - mainline: nvme-fabrics: allow user passing data digest [T300323]
  - mainline: nvme-fabrics: allow user passing header digest [T300323]
  - mainline: nvmet: Add install_queue callout [T300323]
  - mainline: datagram: introduce skb_copy_and_hash_datagram_iter helper [T300323]
  - mainline: iov_iter: introduce hash_and_copy_to_iter helper [T300323]
  - mainline: datagram: consolidate datagram copy to iter helpers [T300323]
  - mainline: iov_iter: pass void csum pointer to csum_and_copy_to_iter [T300323]
  - mainline: datagram: open-code copy_page_to_iter [T300323]
  - mainline: ath6kl: add ath6kl_ prefix to crypto_type [T300323]
  - mainline: node: Add access1 class to represent CPU to memory characteristics [T300323]
  - mainline: x86/numa: add 'nohmat' option [T300323]
  - mainline: ACPI: Remove side effect of partly creating a node in acpi_get_node() [T300323]
  - mainline: ACPI: Support Generic Initiator only domains [T300323]
  - mainline: x86/numa: cleanup configuration dependent command-line options [T300323]
  - mainline: ACPI: NUMA: Process hotpluggable memblocks when !CONFIG_MEMORY_HOTPLUG [T300323]
  - mainline: ACPI: HMAT: Fix handling of changes from ACPI 6.2 to ACPI 6.3 [T300323]
  - mainline: ACPI: NUMA: Remove the useless 'node >= MAX_NUMNODES' check [T300323]
  - mainline: ACPI: NUMA: Remove the useless sub table pointer check [T300323]
  - mainline: ACPI: NUMA: Up-level "map to online node" functionality [T300323]
  - mainline: ACPI: HMAT: use %u instead of %d to print u32 values [T300323]
  - mainline: ACPI: HMAT: don't mix pxm and nid when setting memory target processor_pxm [T300323]
  - mainline: ACPI: NUMA: HMAT: Register HMAT at device_initcall level [T300323]
  - mainline: ACPI: NUMA: Establish a new drivers/acpi/numa/ directory [T300323]
  - mainline: ACPICA: ACPI 6.3: SRAT: add Generic Affinity Structure subtable [T300323]
  - mainline: ACPI: HMAT: ACPI_HMAT_MEMORY_PD_VALID is deprecated since ACPI-6.3 [T300323]
  - mainline: HMAT: Skip publishing target info for nodes with no online memory [T300323]
  - mainline: HMAT: Register attributes for memory hot add [T300323]
  - mainline: HMAT: Register memory-side cache after parsing [T300323]
  - uos: fix a compile error by the previous commit
  - stable: PCI/AER: Remove pci_cleanup_aer_uncorrect_error_status() calls [T300323]
  - stable: PCI/EDR: Clear Device Status after EDR error recovery [T300323]
  - anolis: PCI/AER: Iterate over error counters instead of error strings [T300323]
  - anolis: PCI/RCEC: Fix RCiEP device to RCEC association [T300323]
  - anolis: PCI/AER: Add RCEC AER error injection support [T300323]
  - anolis: PCI/AER: Add pcie_walk_rcec() to RCEC AER handling [T300323]
  - anolis: PCI/ERR: Recover from RCiEP AER errors [T300323]
  - anolis: PCI/ERR: Add pcie_link_rcec() to associate RCiEPs [T300323]
  - anolis: PCI/ERR: Recover from RCEC AER errors [T300323]
  - anolis: PCI/AER: Write AER Capability only when we control it [T300323]
  - anolis: PCI/ERR: Clear AER status only when we control AER [T300323]
  - anolis: PCI/ERR: Add pci_walk_bridge() to pcie_do_recovery() [T300323]
  - anolis: PCI/ERR: Avoid negated conditional for clarity [T300323]
  - anolis: PCI/ERR: Use "bridge" for clarity in pcie_do_recovery() [T300323]
  - anolis: PCI/ERR: Simplify by computing pci_pcie_type() once [T300323]
  - anolis: PCI/ERR: Simplify by using pci_upstream_bridge() [T300323]
  - anolis: PCI/ERR: Cache RCEC EA Capability offset in pci_init_capabilities() [T300323]
  - anolis: PCI/ERR: Bind RCEC devices to the Root Port driver [T300323]
  - anolis: PCI/ERR: Clear PCIe Device Status errors only if OS owns AER [T300323]
  - anolis: PCI/ERR: Rename pci_aer_clear_device_status() to pcie_clear_device_status() [T300323]
  - anolis: PCI/AER: Log correctable errors as warning, not error [T300323]
  - anolis: PCI/AER: Simplify __aer_print_error() [T300323]
  - anolis: PCI: Convert PCIe capability PCIBIOS errors to errno [T300323]
  - anolis: PCI/AER: Use "aer" variable for capability offset [T300323]
  - anolis: PCI/AER: Remove redundant dev->aer_cap checks [T300323]
  - anolis: PCI/AER: Remove redundant pci_is_pcie() checks [T300323]
  - anolis: PCI/AER: Remove HEST/FIRMWARE_FIRST parsing for AER ownership [T300323]
  - anolis: PCI/AER: Use only _OSC to determine AER ownership [T300323]
  - mainline: PCI/AER: Rationalize error status register clearing [T300323]
  - euler: net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode [T300323]
  - uos: fix: space format errors
  - stable: {CVE-2023-34324} xen/events: replace evtchn_rwlock with RCU [T297505]
  - stable: {CVE-2023-31085} ubi: Refuse attaching if mtd's erasesize is 0 [T297505]
  - stable: {CVE-2023-45871} igb: set max size RX buffer when store bad packet is enabled [T297505]
  - stable: {CVE-2023-39193} netfilter: xt_sctp: validate the flag_info count [T297505]
  - stable: {CVE-2023-39192} netfilter: xt_u32: validate user space input [T297505]
  - stable: {CVE-2023-39189} netfilter: nfnetlink_osf: avoid OOB read [T297505]
  - stable: {CVE-2023-39194} net: xfrm: Fix xfrm_address_filter OOB read [T297505]
  - stable: {CVE-2023-45862} USB: ene_usb6250: Allocate enough memory for full object [T297505]
  - uos: Change the code according with mainline.
  - mainline: ACPI: APEI: do not add task_work to kernel thread to avoid memory leak [300485]
  - mainline: ACPI: APEI: fix synchronous external aborts in user-mode [300485]
  - mainline: ACPI / APEI: Don't store CPER records physical address in struct ghes [300485]
  - mainline: ACPI: APEI: EINJ: Use DEFINE_DEBUGFS_ATTRIBUTE for debugfs files [300485]
  - euler: ACPI / APEI: Notify all ras err to driver [300485]
  - mainline: ACPI / APEI: Add a notifier chain for unknown (vendor) CPER records [300485]
  - uos: feat: add module phytium ce drivers
  - stable: drm/ast: Fix ARM compatibility
  - uos: fix warning for 'ls_get_file' macro
  - uos: disable ls_dup
  - euler: PCI/PME: Fix kernel-doc of pcie_pme_resume() and pcie_pme_remove() [T300325]
  - euler: PCI: Add PCIE_LNKCAP2_SLS2SPEED() macro [T300325]
  - euler: PCI: Use pci_speed_string() for all PCI/PCI-X/PCIe strings [T300325]
  - euler: PCI: Add pci_speed_string() [T300325]
  - euler: PCI: Add 32 GT/s decoding in some macros [T300325]
  - euler: PCI: Decode PCIe 32 GT/s link speed [T300325]
  - uos: show Phytium_S5000C cpu model name
  - uos: default disable short task solution
  - uos: ls_dup: fallback to ksys_dup() if new_fd equals old_fd [B223191]
  - uos: Revert "fix: UOS: solve loongson syscall __fget error [T286681]" [B223191]
  - Merge "loongarch: spi: spi-ls: add spi-ls spi_transfer struct cs_change support" into 1060a-152-lts
  - loongarch: spi: spi-ls: add spi-ls spi_transfer struct cs_change support
  - anolis: hwmon/k10temp: Add support for Hygon family 18h model 5h [T298289]
  - anolis: hwmon/k10temp: Add support for Hygon family 18h model 4h [T298289]
  - anolis: hwmon: (k10temp) Rework the temperature offset calculation [T298289]
  - anolis: hwmon: (k10temp) Don't show Tdie for all Zen/Zen2/Zen3 CPU/APU [T298289]
  - anolis: hwmon: (k10temp) Remove support for displaying voltage and current on Zen CPUs [T298289]
  - anolis: hwmon: (k10temp) Add support for Zen3 CPUs [T298289]
  - anolis: hwmon: (k10temp) Define SVI telemetry and current factors for Zen2 CPUs [T298289]
  - anolis: hwmon: (k10temp) Create common functions and macros for Zen CPU families [T298289]
  - anolis: hwmon: (k10temp) make some symbols static [T298289]
  - anolis: hwmon: (k10temp) Reorganize and simplify temperature support detection [T298289]
  - anolis: hwmon: (k10temp) Swap Tdie and Tctl on Family 17h CPUs [T298289]
  - anolis: hwmon: (k10temp) Display up to eight sets of CCD temperatures [T298289]
  - anolis: hwmon: (k10temp) Don't show temperature limits on Ryzen (Zen) CPUs [T298289]
  - anolis: hwmon: (k10temp) Show core and SoC current and voltages on Ryzen CPUs [T298289]
  - anolis: hwmon: (k10temp) Report temperatures per CPU die [T298289]
  - anolis: hmon: (k10temp) Convert to use devm_hwmon_device_register_with_info [T298289]
  - anolis: hwmon: (k10temp) Use bitops [T298289]
  - anolis: hwmon: Add convience macro to define simple static sensors [T298289]
  - anolis: hwmon: (k10temp) Auto-convert to use SENSOR_DEVICE_ATTR_{RO, RW, WO} [T298289]
  - anolis: hwmon: Introduce SENSOR_DEVICE_ATTR_{RO, RW, WO} and variants [T298289]
  - anolis: EDAC/amd64: Add support for Hygon family 18h model 6h [T298289]
  - anolis: EDAC/amd64: Add support for Hygon family 18h model 5h [T298289]
  - anolis: EDAC/mce_amd: Use struct cpuinfo_x86.logical_die_id for Hygon NodeId [T298289]
  - anolis: EDAC/amd64: Adjust address translation for Hygon family 18h model 4h [T298289]
  - anolis: EDAC/amd64: Add support for Hygon family 18h model 4h [T298289]
  - anolis: EDAC/amd64: Get UMC channel from the 6th nibble for Hygon [T298289]
  - anolis: EDAC/amd64: Add new register offset support and related changes [T298289]
  - anolis: EDAC/amd64: Set memory type per DIMM [T298289]
  - anolis: EDAC/amd64: Add support for AMD Family 19h Models 10h-1Fh and A0h-AFh [T298289]
  - anolis: EDAC: Add RDDR5 and LRDDR5 memory types [T298289]
  - anolis: EDAC: Add DDR5 new memory type [T298289]
  - anolis: EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId [T298289]
  - anolis: EDAC/amd64: Set proper family type for Family 19h Models 20h-2Fh [T298289]
  - anolis: EDAC/amd64: Save max number of controllers to family type [T298289]
  - anolis: EDAC/amd64: Gather hardware information early [T298289]
  - anolis: EDAC/amd64: Make struct amd64_family_type global [T298289]
  - anolis: EDAC/amd64: Add PCI device IDs for family 17h, model 70h [T298289]
  - anolis: EDAC/amd64: Support asymmetric dual-rank DIMMs [T298289]
  - anolis: EDAC/amd64: Cache secondary Chip Select registers [T298289]
  - anolis: x86/amd_nb: Add support for Hygon family 18h model 6h [T298289]
  - anolis: x86/cpu: Get CPU topology for Hygon family 18h model 6h [T298289]
  - anolis: x86/amd_nb: Add support for Hygon family 18h model 5h [T298289]
  - anolis: x86/cpu: Get CPU topology and LLC ID for Hygon family 18h model 5h [T298289]
  - anolis: i2c-piix4: Remove the IMC detecting for Hygon SMBus [T298289]
  - anolis: iommu/hygon: Add support for Hygon family 18h model 4h IOAPIC [T298289]
  - anolis: x86/amd_nb: Add northbridge support for Hygon family 18h model 4h [T298289]
  - anolis: x86/amd_nb: Add Hygon family 18h model 4h PCI IDs [T298289]
  - anolis: x86/microcode/hygon: Add microcode loading support for Hygon processors [T298289]
  - anolis: x86/cpu/hygon: Modify the CPU topology deriving method for Hygon [T298289]
  - anolis: x86/MCE/AMD: Use an u64 for bank_map [T298289]
  - anolis: rtc: mc146818-lib: Fix the AltCentury for AMD platforms [T298289]
  - anolis: x86/topology: Make __max_die_per_package available unconditionally [T298289]
  - anolis: x86/topology: Set cpu_die_id only if DIE_TYPE found [T298289]
  - anolis: x86/CPU/AMD: Save AMD NodeId as cpu_die_id [T298289]
  - anolis: x86/mce: Increase maximum number of banks to 64 [T298289]
  - anolis: x86/umip: Make the UMIP activated message generic [T298289]
  - anolis: x86/umip: Print UMIP line only once [T298289]
  - anolis: x86/microcode/AMD: Clean up per-family patch size checks [T298289]


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.16
changelog:
  - uos: fix kabi by -
  - uos: enable CONFIG_DRM_PHYTIUM=m
  - stable: {CVE-2023-5717} perf: Disallow mis-matched inherited group reads [T297505]
  - uos: fix kabi changed with cpu_info
  - uos: Fix the zhaoxin compilation error by c43be4782938 and c87911c9ae0c
  - uos: fix compile error [T302429]


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.17
changelog:
  - uos: Revert "UOS: Compile st_gmac and IGB network card drivers to kernel modules"
  - uos: loongarch: Open tcm_fc configuration
  - uos: fix kabi by f5d961e43bbc


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.19
changelog:
  - uos: add feature1 [T302819]
  - uos: stream performance optimization
  - stable: {CVE-2023-45863} kobject: Fix slab-out-of-bounds in fill_kobj_path() [T297509]


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.22
changelog:
  * Thu Nov 30 2023 daifan <daifan@uniontech.com> - 4.19.0-91.152.21
  - uos: Fix the patch of coherent DMA writes disorder issue for Zhaoxin KH-40000
  - uos: dup: rename config and cmdline
  - uos: Modify the default configuration file to uos419_defconfig
  - uos: rename config's name to uos
  - uos: zhaoxin: Add support for Zhaoxin Processors
  - uos: feature1: fix params passed error in uld_copy_bitmap()
  - uos: feature1: fix full_fds init error
  - uos: feature1: fix fdt changed after get_unused_fd()
  - uos: feature1: fix __get_file NULL pointer dereference


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.23
changelog:
  - uos: fix kabi breakup by merging cve patch [T310775]
  - stable: {CVE-2023-51780} atm: Fix Use-After-Free in do_vcc_ioctl [T310775]
  - stable: {CVE-2023-51781} appletalk: Fix Use-After-Free in atalk_ioctl [T310775]
  - stable: {CVE-2023-51782} net/rose: Fix Use-After-Free in rose_ioctl [T310775]
  - stable: {CVE-2023-6931} perf: Fix perf_event_validate_size() [T310775]
  - stable: {CVE-2023-6931} perf/core: Add a new read format to get a number of lost samples [T310775]
  - stable: {CVE-2023-6932} ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet [T310775]
  - euler: netfilter: nf_queue: fix socket leak
  - uos: bugfix: fixup marvell sata controller init fail on some machine
  - Merge "stable: iommu/vt-d: Leave scalable mode default off [T285937]" into 1060a-152-lts
  - uos: lms feature optimized
  - stable: iommu/vt-d: Leave scalable mode default off [T285937]
  - uos: uos lms feature
  - uos: Revert "uos: stream performance optimization"


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.24
changelog:
  - uos: igb: add architecture flag for loongarch patch [B237615]
  - uos: Revert "uos: bugfix: fixup marvell sata controller init fail on some machine" [B240939]
  - stable: {CVE-2023-7192} netfilter: ctnetlink: fix possible refcount leak in ctnetlink_create_conntrack() [T310775]
  - stable: {CVE-2023-6606} smb: client: fix OOB in smbCalcSize() [T310775]


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.25
changelog:
  - uos: Fix the issue of crashing during reboot. Release reserved memory resources
  - uos: elfverify: fix slab memory leak [T325833]
  - stable: {CVE-2023-46838} xen-netback: don't produce zero-size SKB frags [T310775]
  - stable: {CVE-2023-6040} netfilter: nf_tables: Reject tables of unsupported family [T310775]
  - stable: {CVE-2023-46343} nfc: nci: fix possible NULL pointer dereference in send_acknowledge() [T310775]
  - stable: {CVE-2023-51042} drm/amdgpu: Fix potential fence use-after-free v2 [T310775]
  - stable: {CVE-2023-51043} drm/atomic: Fix potential use-after-free in nonblocking commits [T310775]
  - stable: {CVE-2024-0775} ext4: improve error recovery code paths in __ext4_remount() [T310775]
  - euler: {CVE-2021-33631} ext4: fix kernel BUG in 'ext4_write_inline_data_end()' [T310775]


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.26
changelog:
  - Merge "uos: bugfix: fixup marvell sata controller init fail on some machine" into 1060a-152-lts
  - uos: bugfix: fixup marvell sata controller init fail on some machine
  - stable: {CVE-2024-23849} net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv [T310775]
  - stable: {CVE-2024-1086} netfilter: nf_tables: reject QUEUE/DROP verdict parameters [T310775]
  - stable: {CVE-2024-0607} netfilter: nf_tables: fix pointer math issue in nft_byteorder_eval() [T310775]
  - stable: {CVE-2024-0340} vhost: use kzalloc() instead of kmalloc() followed by memset() [T310775]
  - stable: {CVE-2024-26597} net: qualcomm: rmnet: fix global oob in rmnet_policy [T310775]
  - stable: {CVE-2023-52464} EDAC/thunderx: Fix possible out-of-bounds string access [T310775]
  - stable: {CVE-2023-52451} powerpc/pseries/memhp: Fix access beyond end of drmem array [T310775]
  - stable: {CVE-2023-52451} powerpc/pseries/memhotplug: Quieten some DLPAR operations [T310775]
  - stable: {CVE-2023-52449} mtd: Fix gluebi NULL pointer dereference caused by ftl notifier [T310775]
  - stable: {CVE-2023-52445} media: pvrusb2: fix use after free on context disconnection [T310775]
  - stable: {CVE-2023-52444} f2fs: fix to avoid dirent corruption [T310775]
  - stable: {CVE-2023-52443} apparmor: avoid crash when parsed profile name is empty [T310775]
  - stable: {CVE-2023-52439} uio: Fix use-after-free in uio_open [T310775]
  - stable: {CVE-2023-52436} f2fs: explicitly null-terminate the xattr list [T310775]


author: caina <caina@uniontech.com> - 4.19.0-91.152.27
changelog:
  - stable: {CVE-2023-7042} wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() [T334689]
  - stable: {CVE-2024-22099} Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security [T334689]
  - stable: {CVE-2023-6270} aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts [T334689]
  - stable: kvm/arm64: fixed passthrough gpu into vm on arm64


author: daifan <daifan@uniontech.com> - 4.19.0-91.152.28
changelog:
  - euler: net: sctp: update stream->incnt after successful allocation of stream_in [B342737]
  - uos: export uld_fcheck_file symbol [B251417]
  - uos: fix kabi break [T334689]
  - stable: {CVE-2024-26793} gtp: fix use-after-free and null-ptr-deref in gtp_newlink() [T334689]
  - stable: {CVE-2024-26685} nilfs2: fix potential bug in end_buffer_async_write [T334689]
  - stable: {CVE-2024-26685} nilfs2: fix buffer corruption due to concurrent device reads [T334689]
  - stable: {CVE-2023-52340} ipv6: remove max_size check inline with ipv4 [T334689]
  - stable: {CVE-2023-52340} ipv6: make ip6_rt_gc_expire an atomic_t [T334689]
  - stable: {CVE-2023-52340} net/dst: use a smaller percpu_counter batch for dst entries accounting [T334689]
  - stable: {CVE-2023-52340} net: add a route cache full diagnostic message [T334689]
  - stable: {CVE-2024-26636} llc: make llc_ui_sendmsg() more robust against bonding changes [T334689]
  - stable: {CVE-2024-26645} tracing: Ensure visibility when inserting an element into tracing_map [T334689]
  - stable: {CVE-2024-26651} sr9800: Add check for usbnet_get_endpoints [T334689]
  - stable: {CVE-2024-26663} tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() [T334689]
  - stable: {CVE-2024-26664} hwmon: (coretemp) Fix out-of-bounds memory access [T334689]
  - stable: {CVE-2024-26671} blk-mq: fix IO hang from sbitmap wakeup race [T334689]
  - stable: {CVE-2024-26675} ppp_async: limit MRU to 64K [T334689]
  - stable: {CVE-2024-26679} inet: read sk->sk_family once in inet_recv_error() [T334689]
  - stable: {CVE-2024-26696} nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() [T334689]
  - stable: {CVE-2024-26697} nilfs2: fix data corruption in dsync block recovery for small block sizes [T334689]
  - stable: {CVE-2024-26704} ext4: fix double-free of blocks due to wrong extents moved_len [T334689]
  - stable: {CVE-2024-26720} mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again [T334689]
  - stable: {CVE-2024-26735} ipv6: sr: fix possible use-after-free and null-ptr-deref [T334689]
  - stable: {CVE-2024-26744} RDMA/srpt: Support specifying the srpt_service_guid parameter [T334689]
  - stable: {CVE-2024-26751} ARM: ep93xx: Add terminator to gpiod_lookup_table [T334689]
  - stable: {CVE-2024-26752} l2tp: pass correct message length to ip6_append_data [T334689]
  - stable: {CVE-2024-26754} gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() [T334689]
  - stable: {CVE-2024-26763} dm-crypt: don't modify the data when using authenticated encryption [T334689]
  - stable: {CVE-2024-26764} fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio [T334689]
  - stable: {CVE-2024-26766} IB/hfi1: Fix sdma.h tx->num_descs off-by-one error [T334689]
  - stable: {CVE-2024-26766} IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors [T334689]
  - stable: {CVE-2024-26772} ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() [T334689]
  - stable: {CVE-2024-26773} ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() [T334689]
  - stable: {CVE-2024-26777} fbdev: sis: Error out if pixclock equals zero [T334689]
  - stable: {CVE-2024-26778} fbdev: savage: Error out if pixclock equals zero [T334689]
  - stable: {CVE-2024-26779} wifi: mac80211: fix race condition on enabling fast-xmit [T334689]
  - stable: {CVE-2024-26791} btrfs: dev-replace: properly validate device names [T334689]
  - stable: {CVE-2024-26801} Bluetooth: Avoid potential use-after-free in hci_error_reset [T334689]
  - stable: {CVE-2024-26805} netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter [T334689]
  - stable: {CVE-2024-26600} phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP [T334689]
  - stable: {CVE-2024-26606} binder: signal epoll threads of self-work [T334689]
  - stable: {CVE-2024-26615} net/smc: fix illegal rmb_desc access in SMC-D connection dump [T334689]
  - stable: {CVE-2024-26625} llc: call sock_orphan() at release time [T334689]
  - stable: {CVE-2024-26633} ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() [T334689]
  - stable: {CVE-2024-26635} llc: Drop support for ETH_P_TR_802_2. [T334689]
  - stable: {CVE-2023-52583} ceph: fix deadlock or deadcode of misusing dget() [T334689]
  - stable: {CVE-2023-52603} UBSAN: array-index-out-of-bounds in dtSplitRoot [T334689]
  - stable: {CVE-2023-52604} FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree [T334689]
  - stable: {CVE-2023-52606} powerpc/lib: Validate size for vector operations [T334689]
  - stable: {CVE-2023-52607} powerpc/mm: Fix null-pointer dereference in pgtable_cache_add [T334689]
  - stable: {CVE-2023-52609} binder: fix race between mmput() and do_exit() [T334689]
  - stable: {CVE-2023-52612} crypto: scomp - fix req->dst buffer overflow [T334689]
  - stable: {CVE-2023-52612} crypto: scompress - Use per-CPU struct instead multiple variables [T334689]
  - stable: {CVE-2023-52612} crypto: scompress - return proper error code for allocation failure [T334689]
  - stable: {CVE-2023-52615} hwrng: core - Fix page fault dead lock on mmap-ed hwrng [T334689]
  - stable: {CVE-2023-52619} pstore/ram: Fix crash when setting number of cpus to an odd number [T334689]
  - stable: {CVE-2023-52622} ext4: avoid online resizing failures due to oversized flex bg [T334689]
  - stable: {CVE-2023-52622} ext4: unify the type of flexbg_size to unsigned int [T334689]
  - stable: {CVE-2023-52622} ext4: remove unnecessary check from alloc_flex_gd() [T334689]
  - stable: {CVE-2023-52623} SUNRPC: Fix a suspicious RCU usage warning [T334689]
  - stable: {CVE-2023-52469} drivers/amd/pm: fix a use-after-free in kv_parse_power_table [T334689]
  - stable: {CVE-2023-52475} Input: powermate - fix use-after-free in powermate_config_complete [T334689]
  - stable: {CVE-2023-52477} usb: hub: Guard against accesses to uninitialized BOS descriptors [T334689]
  - stable: {CVE-2023-52478} HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect [T334689]
  - stable: {CVE-2023-52486} drm: Don't unref the same fb many times by mistake due to deadlock handling [T334689]
  - stable: {CVE-2023-52502} net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() [T334689]
  - stable: {CVE-2023-52502} nfc: constify several pointers to u8, char and sk_buff [T334689]
  - stable: {CVE-2023-52504} x86/alternatives: Disable KASAN in apply_alternatives() [T334689]
  - stable: {CVE-2023-52507} nfc: nci: assert requested protocol is valid [T334689]
  - stable: {CVE-2023-52510} ieee802154: ca8210: Fix a potential UAF in ca8210_probe [T334689]
  - stable: {CVE-2023-52527} ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() [T334689]
  - stable: {CVE-2023-52528} net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg [T334689]
  - stable: {CVE-2023-52566} nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() [T334689]
  - stable: {CVE-2023-52574} team: fix null-ptr-deref when team device type is changed [T334689]
  - stable: {CVE-2023-52587} IB/ipoib: Fix mcast list locking [T334689]
  - stable: {CVE-2023-52587} RDMA/IPoIB: Fix error code return in ipoib_mcast_join [T334689]
  - stable: {CVE-2023-52594} wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() [T334689]
  - stable: {CVE-2023-52597} KVM: s390: fix setting of fpc register [T334689]
  - stable: {CVE-2023-52598} s390/ptrace: handle setting of fpc register correctly [T334689]
  - stable: {CVE-2023-52602} jfs: fix slab-out-of-bounds Read in dtSearch [T334689]
  - stable: {CVE-2023-52600} jfs: fix array-index-out-of-bounds in dbAdjTree [T334689]
  - stable: {CVE-2023-52601} FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree [T334689]
  - stable: {CVE-2023-52600} jfs: fix uaf in jfs_evict_inode [T334689]
  - stable: {CVE-2023-52599} jfs: fix array-index-out-of-bounds in diNewExt [T334689]
  - fix: wrong logic when allocating memory in elf module


author: Gou Hao <gouhao@uniontech.com> - 4.19.0-91.152.29
changelog:
  * Wed May 08 2024 daifan <daifan@uniontech.com> - 4.19.0-91.152.28
  - euler: net: sctp: update stream->incnt after successful allocation of stream_in [B342737]
  - uos: export uld_fcheck_file symbol [B251417]
  - uos: fix kabi break [T334689]
  - stable: {CVE-2024-26793} gtp: fix use-after-free and null-ptr-deref in gtp_newlink() [T334689]
  - stable: {CVE-2024-26685} nilfs2: fix potential bug in end_buffer_async_write [T334689]
  - stable: {CVE-2024-26685} nilfs2: fix buffer corruption due to concurrent device reads [T334689]
  - stable: {CVE-2023-52340} ipv6: remove max_size check inline with ipv4 [T334689]
  - stable: {CVE-2023-52340} ipv6: make ip6_rt_gc_expire an atomic_t [T334689]
  - stable: {CVE-2023-52340} net/dst: use a smaller percpu_counter batch for dst entries accounting [T334689]
  - stable: {CVE-2023-52340} net: add a route cache full diagnostic message [T334689]
  - stable: {CVE-2024-26636} llc: make llc_ui_sendmsg() more robust against bonding changes [T334689]
  - stable: {CVE-2024-26645} tracing: Ensure visibility when inserting an element into tracing_map [T334689]
  - stable: {CVE-2024-26651} sr9800: Add check for usbnet_get_endpoints [T334689]
  - stable: {CVE-2024-26663} tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() [T334689]
  - stable: {CVE-2024-26664} hwmon: (coretemp) Fix out-of-bounds memory access [T334689]
  - stable: {CVE-2024-26671} blk-mq: fix IO hang from sbitmap wakeup race [T334689]
  - stable: {CVE-2024-26675} ppp_async: limit MRU to 64K [T334689]
  - stable: {CVE-2024-26679} inet: read sk->sk_family once in inet_recv_error() [T334689]
  - stable: {CVE-2024-26696} nilfs2: fix hang in nilfs_lookup_dirty_data_buffers() [T334689]
  - stable: {CVE-2024-26697} nilfs2: fix data corruption in dsync block recovery for small block sizes [T334689]
  - stable: {CVE-2024-26704} ext4: fix double-free of blocks due to wrong extents moved_len [T334689]
  - stable: {CVE-2024-26720} mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again [T334689]
  - stable: {CVE-2024-26735} ipv6: sr: fix possible use-after-free and null-ptr-deref [T334689]
  - stable: {CVE-2024-26744} RDMA/srpt: Support specifying the srpt_service_guid parameter [T334689]
  - stable: {CVE-2024-26751} ARM: ep93xx: Add terminator to gpiod_lookup_table [T334689]
  - stable: {CVE-2024-26752} l2tp: pass correct message length to ip6_append_data [T334689]
  - stable: {CVE-2024-26754} gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() [T334689]
  - stable: {CVE-2024-26763} dm-crypt: don't modify the data when using authenticated encryption [T334689]
  - stable: {CVE-2024-26764} fs/aio: Restrict kiocb_set_cancel_fn() to I/O submitted via libaio [T334689]
  - stable: {CVE-2024-26766} IB/hfi1: Fix sdma.h tx->num_descs off-by-one error [T334689]
  - stable: {CVE-2024-26766} IB/hfi1: Fix sdma.h tx->num_descs off-by-one errors [T334689]
  - stable: {CVE-2024-26772} ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() [T334689]
  - stable: {CVE-2024-26773} ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() [T334689]
  - stable: {CVE-2024-26777} fbdev: sis: Error out if pixclock equals zero [T334689]
  - stable: {CVE-2024-26778} fbdev: savage: Error out if pixclock equals zero [T334689]
  - stable: {CVE-2024-26779} wifi: mac80211: fix race condition on enabling fast-xmit [T334689]
  - stable: {CVE-2024-26791} btrfs: dev-replace: properly validate device names [T334689]
  - stable: {CVE-2024-26801} Bluetooth: Avoid potential use-after-free in hci_error_reset [T334689]
  - stable: {CVE-2024-26805} netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter [T334689]
  - stable: {CVE-2024-26600} phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP [T334689]
  - stable: {CVE-2024-26606} binder: signal epoll threads of self-work [T334689]
  - stable: {CVE-2024-26615} net/smc: fix illegal rmb_desc access in SMC-D connection dump [T334689]
  - stable: {CVE-2024-26625} llc: call sock_orphan() at release time [T334689]
  - stable: {CVE-2024-26633} ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() [T334689]
  - stable: {CVE-2024-26635} llc: Drop support for ETH_P_TR_802_2. [T334689]
  - stable: {CVE-2023-52583} ceph: fix deadlock or deadcode of misusing dget() [T334689]
  - stable: {CVE-2023-52603} UBSAN: array-index-out-of-bounds in dtSplitRoot [T334689]
  - stable: {CVE-2023-52604} FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree [T334689]
  - stable: {CVE-2023-52606} powerpc/lib: Validate size for vector operations [T334689]
  - stable: {CVE-2023-52607} powerpc/mm: Fix null-pointer dereference in pgtable_cache_add [T334689]
  - stable: {CVE-2023-52609} binder: fix race between mmput() and do_exit() [T334689]
  - stable: {CVE-2023-52612} crypto: scomp - fix req->dst buffer overflow [T334689]
  - stable: {CVE-2023-52612} crypto: scompress - Use per-CPU struct instead multiple variables [T334689]
  - stable: {CVE-2023-52612} crypto: scompress - return proper error code for allocation failure [T334689]
  - stable: {CVE-2023-52615} hwrng: core - Fix page fault dead lock on mmap-ed hwrng [T334689]
  - stable: {CVE-2023-52619} pstore/ram: Fix crash when setting number of cpus to an odd number [T334689]
  - stable: {CVE-2023-52622} ext4: avoid online resizing failures due to oversized flex bg [T334689]
  - stable: {CVE-2023-52622} ext4: unify the type of flexbg_size to unsigned int [T334689]
  - stable: {CVE-2023-52622} ext4: remove unnecessary check from alloc_flex_gd() [T334689]
  - stable: {CVE-2023-52623} SUNRPC: Fix a suspicious RCU usage warning [T334689]
  - stable: {CVE-2023-52469} drivers/amd/pm: fix a use-after-free in kv_parse_power_table [T334689]
  - stable: {CVE-2023-52475} Input: powermate - fix use-after-free in powermate_config_complete [T334689]
  - stable: {CVE-2023-52477} usb: hub: Guard against accesses to uninitialized BOS descriptors [T334689]
  - stable: {CVE-2023-52478} HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect [T334689]
  - stable: {CVE-2023-52486} drm: Don't unref the same fb many times by mistake due to deadlock handling [T334689]
  - stable: {CVE-2023-52502} net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() [T334689]
  - stable: {CVE-2023-52502} nfc: constify several pointers to u8, char and sk_buff [T334689]
  - stable: {CVE-2023-52504} x86/alternatives: Disable KASAN in apply_alternatives() [T334689]
  - stable: {CVE-2023-52507} nfc: nci: assert requested protocol is valid [T334689]
  - stable: {CVE-2023-52510} ieee802154: ca8210: Fix a potential UAF in ca8210_probe [T334689]
  - stable: {CVE-2023-52527} ipv4, ipv6: Fix handling of transhdrlen in __ip{,6}_append_data() [T334689]
  - stable: {CVE-2023-52528} net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg [T334689]
  - stable: {CVE-2023-52566} nilfs2: fix potential use after free in nilfs_gccache_submit_read_data() [T334689]
  - stable: {CVE-2023-52574} team: fix null-ptr-deref when team device type is changed [T334689]
  - stable: {CVE-2023-52587} IB/ipoib: Fix mcast list locking [T334689]
  - stable: {CVE-2023-52587} RDMA/IPoIB: Fix error code return in ipoib_mcast_join [T334689]
  - stable: {CVE-2023-52594} wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() [T334689]
  - stable: {CVE-2023-52597} KVM: s390: fix setting of fpc register [T334689]
  - stable: {CVE-2023-52598} s390/ptrace: handle setting of fpc register correctly [T334689]
  - stable: {CVE-2023-52602} jfs: fix slab-out-of-bounds Read in dtSearch [T334689]
  - stable: {CVE-2023-52600} jfs: fix array-index-out-of-bounds in dbAdjTree [T334689]
  - stable: {CVE-2023-52601} FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree [T334689]
  - stable: {CVE-2023-52600} jfs: fix uaf in jfs_evict_inode [T334689]
  - stable: {CVE-2023-52599} jfs: fix array-index-out-of-bounds in diNewExt [T334689]
  - fix: wrong logic when allocating memory in elf module


author: Gou Hao <gouhao@uniontech.com> - 4.19.0-91.152.30
changelog:
  - uos: perf: Fix the logical in ebtables optimise. [G005616]
  - uos: fix kernel panic caused by memory out of bounds [B255527]
  - uos: perf: ebtables: fix cpu 100% during wrk testing. [G005616]
  - feat: modify the hook add timing for network control
  - anolis: LoongArch: Limit min pci msi-x/msi vector number [G005956]
  - uos: PCI/MSI: Fix the nvec value when maxvec is greater than 32 for loongarch [G005956]
  - uos: Revert "uos: diable irq limit of la64 by default [T358195]"
  - uos: srpm: add file of 4.19.0-91.152.29 [T00000]
  - uos: update srpm to 4.19.0-91.152.29 [T00000]


author: Gou Hao <gouhao@uniontech.com> - 4.19.0-91.152.31
changelog:
  - stable: {CVE-2024-26976} KVM: Always flush async #PF workqueue when vCPU is being destroyed [T371989]
  - stable: {CVE-2024-44999} gtp: pull network headers in gtp_dev_xmit() [T371989]
  - stable: {CVE-2023-52885} SUNRPC: Fix UAF in svc_tcp_listen_data_ready() [T371989]
  - stable: {CVE-2024-46800} sch/netem: fix use after free in netem_dequeue [T371989]
  - stable: {CVE-2024-26852} net/ipv6: avoid possible UAF in ip6_route_mpath_notify() [T371989]
  - stable: {CVE-2024-41046} net: ethernet: lantiq_etop: fix double free in detach [T371989]
  - stable: {CVE-2024-53061} media: s5p-jpeg: prevent buffer overflows [T371989]
  - stable: {CVE-2024-50230} nilfs2: fix kernel bug due to missing clearing of checked flag [T371989]
  - stable: {CVE-2024-40901} scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory [T371989]
  - stable: {CVE-2024-36940} pinctrl: core: delete incorrect free in pinctrl_enable() [T371989]
  - stable: {CVE-2024-53155} ocfs2: fix uninitialized value in ocfs2_file_read_iter() [T371989]
  - stable: {CVE-2024-26934} USB: core: Fix deadlock in usb_deauthorize_interface() [T371989]
  - stable: {CVE-2024-53156} wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() [T371989]
  - stable: {CVE-2024-56548} hfsplus: don't query the device logical block size multiple times [T371989]
  - stable: {CVE-2023-52840} Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() [T371989]
  - stable: {CVE-2024-46782} ila: call nf_unregister_net_hooks() sooner [T371989]
  - stable: {CVE-2024-44998} atm: idt77252: prevent use after free in dequeue_rx() [T371989]
  - stable: {CVE-2024-26884} bpf: Fix hashtab overflow check on 32-bit arches [T371989]
  - stable: {CVE-2024-53057} net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT [T371989]
  - stable: {CVE-2024-38552} drm/amd/display: Fix potential index out of bounds in color transformation function [T371989]
  - stable: {CVE-2024-46738} VMCI: Fix use-after-free when removing resource in vmci_resource_remove() [T371989]
  - stable: {CVE-2024-38560} scsi: bfa: Ensure the copied buf is NUL terminated [T371989]
  - stable: {CVE-2024-50262} bpf: Fix out-of-bounds write in trie_get_next_key() [T371989]
  - stable: {CVE-2024-53227} scsi: bfa: Fix use-after-free in bfad_im_module_exit() [T371989]
  - stable: {CVE-2024-50267} USB: serial: io_edgeport: fix use after free in debug printk [T371989]
  - stable: {CVE-2024-35847} irqchip/gic-v3-its: Prevent double free on error [T371989]
  - stable: {CVE-2024-50302} HID: core: zero-initialize the report buffer [T371989]
  - stable: {CVE-2024-41087} ata: libata-core: Fix double free on error [T371989]
  - stable: {CVE-2023-52847} media: bttv: fix use after free error due to btv->timeout timer [T371989]
  - stable: {CVE-2024-50279} dm cache: fix out-of-bounds access to the dirty bitset when resizing [T371989]
  - stable: {CVE-2024-53173} NFSv4.0: Fix a use-after-free problem in the asynchronous open() [T371989]
  - stable: {CVE-2024-35821} ubifs: Set page uptodate in the correct place [T371989]
  - stable: {CVE-2024-38627} stm class: Fix a double free in stm_register_device() [T371989]
  - stable: {CVE-2024-27024} net/rds: fix WARNING in rds_conn_connect_if_down [T371989]
  - stable: {CVE-2024-53104} media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format [T371989]
  - stable: {CVE-2024-36886} tipc: fix UAF in error path [T371989]
  - stable: {CVE-2024-50269} usb: musb: sunxi: Fix accessing an released usb phy [T371989]
  - stable: {CVE-2024-56704} 9p/xen: fix release of IRQ [T371989]
  - stable: {CVE-2024-44987} ipv6: prevent UAF in ip6_send_skb() [T371989]
  - stable: {CVE-2024-50301} security/keys: fix slab-out-of-bounds in key_task_permission [T371989]
  - stable: {CVE-2024-46674} usb: dwc3: st: fix probed platform device ref count on probe error path [T371989]
  - stable: {CVE-2024-50264} vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans [T371989]
  - stable: {CVE-2024-53165} sh: intc: Fix use-after-free bug in register_intc_controller() [T371989]
  - stable: {CVE-2023-52922} can: bcm: Fix UAF in bcm_proc_show() [T371989]
  - stable: {CVE-2024-53142} initramfs: avoid filename buffer overrun [T371989]
  - stable: {CVE-2024-53239} ALSA: 6fire: Release resources at card release [T371989]
  - stable: {CVE-2024-46673} scsi: aacraid: Fix double-free on probe failure [T371989]
  - stable: {CVE-2024-42148} bnx2x: Fix multiple UBSAN array-index-out-of-bounds [T371989]
  - stable: {CVE-2024-27043} media: edia: dvbdev: fix a use-after-free [T371989]
  - stable: {CVE-2023-52691} drm/amd/pm: fix a double-free in si_dpm_init [T371989]
  - stable: {CVE-2023-52679} of: Fix double free in of_parse_phandle_with_args_map [T371989]
  - stable: {CVE-2024-38583} nilfs2: fix use-after-free of timer for log writer thread [T371989]
  - stable: {CVE-2024-53141} netfilter: ipset: add missing range check in bitmap_ip_uadt [T371989]
  - uos: diable irq limit of la64 by default again [T358195] [G005956]
  - uos: net: update Motorcomm Phy driver to 2.2.26536 [G2025012200008]
  - uos: update srpm to 4.19.0-91.152.30 [T00000]


author: Gou Hao <gouhao@uniontech.com> - 4.19.0-91.152.32
changelog:
  - Merge changes from topic "cve-1060a-20250417" into lts-1060
  - Merge changes I638580c6,I7cf3ec8b,I9ebcccc2,Ib131ad0c,I414c898f into lts-1060
  - Merge "uos: update srpm to 4.19.0-91.152.31 [T00000]" into lts-1060
  - mainline: {CVE-2024-26974} crypto: qat - resolve race condition during AER recovery
  - mainline: crypto: qat - fix double free during reset
  - mainline: {CVE-2024-38612} ipv6: sr: fix invalid unregister error path
  - mainline: ipv6: sr: fix incorrect unregister order
  - mainline: ipv6: sr: add missing seg6_local_exit
  - mainline: {CVE-2024-50278} dm cache: fix potential out-of-bounds access on the first resume
  - mainline: dm cache: optimize dirty bit checking with find_next_bit when resizing
  - mainline: {CVE-2024-27405} usb: gadget: ncm: Avoid dropping datagrams of properly parsed NTBs
  - mainline: usb: gadget: f_ncm: Always set current gadget in ncm_bind()
  - mainline: usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
  - mainline: usb: gadget: f_ncm: Fix NTP-32 support
  - mainline: usb: gadget: f_ncm: Add OS descriptor support
  - mainline: {CVE-2024-27395} net: openvswitch: Fix Use-After-Free in ovs_ct_exit
  - mainline: net: openvswitch: ovs_ct_exit to be done under ovs_lock
  - mainline: {CVE-2024-35960} net/mlx5: Properly link new fs rules into the tree
  - mainline: hardirq/nmi: Allow nested nmi_enter() [G2025040200015]
  - euler: Revert "NFS: Don't interrupt file writeout due to fatal errors" [G006687]
  - euler: cpuidle: menu: Avoid computations when result will be discarded [G006912]
  - uos: update srpm to 4.19.0-91.152.31 [T00000]
  - anolis: ipvs: add sysctl_run_estimation to support disable estimation [G2025031100008]
  - uos: Revert "ipvs: move estimation from timer to kworker" [G2025031100008]
  - uos: Revert "net: ipvs: add sysctl_run_estimation to support disable estimation" [G2025031100008]


author: Gou Hao <gouhao@uniontech.com> - 4.19.0-91.152.33
changelog:
  - mainline: {CVE-2024-50051} spi: mpc52xx: Add cancel_work_sync before module remove [G2025060400020]
  - mainline: {CVE-2024-26659} xhci: handle isoc Babble and Buffer Overrun events properly [G2025060400020]
  - mainline: {CVE-2024-26659} xhci: process isoc TD properly when there was a transaction error mid TD. [G2025060400020]
  - mainline: {CVE-2024-26659} xhci: store TD status in the td struct instead of passing it along [G2025060400020]
  - mainline: {CVE-2024-26659} xhci: remove extra loop in interrupt context [G2025060400020]
  - mainline: {CVE-2024-26659} xhci: get isochronous ring directly from endpoint structure [G2025060400020]
  - uos: Revert "UOS: modify pipe read/write" [G2025061700021]
  - uos: fix "mainline: mptcp: add sk_stop_timer_sync helper"
  - mainline: {CVE-2024-57887} drm: adv7511: Fix use-after-free in adv7533_attach_dsi() [G2025060400020]
  - Merge changes from topic "cve-419a-lts1060-20250612-2" into lts-1060
  - mainline: {CVE-2024-56659} net: lapb: increase LAPB_HEADER_LEN [G2025060400020]
  - mainline: {CVE-2024-56650} netfilter: x_tables: fix LED ID check in led_tg_check() [G2025060400020]
  - mainline: net/mlx5: Fix eeprom support for SFP module [ztgd2025052300009]
  - mainline: net/mlx5e: ethtool, Add support for EEPROM high pages query [ztgd2025052300009]
  - mainline: ethtool: Add SFF-8436 and SFF-8636 max EEPROM length definitions [ztgd2025052300009]
  - uos: fix kabi broken for struct dst_ops and netns_xfrm
  - mainline: {CVE-2024-36971} net: fix __dst_negative_advice() race [G2025051600022]
  - mainline: mptcp: add sk_stop_timer_sync helper
  - mainline: net: annotate data-races around sk->sk_dst_pending_confirm
  - mainline: af_unix: Fix data race around sk->sk_err.
  - mainline: af_unix: Fix data-races around sk->sk_shutdown.
  - mainline: net: read sk->sk_family once in sk_mc_loop()
  - mainline: sock: Fix misuse of sk_under_memory_pressure()
  - mainline: net: add missing data-race annotation for sk_ll_usec
  - mainline: net: add missing data-race annotations around sk->sk_peek_off
  - mainline: netlink: Add __sock_i_ino() for __netlink_diag_dump().
  - mainline: xfrm: fix a data-race in xfrm_gen_index()
  - Merge changes Ied6aad01,Ied6aad01 into lts-1060
  - mainline: waitid: Add support for waiting for the current process group [G2025051000002]
  - mainline: pidfd: add P_PIDFD to waitid() [G2025051000002]
  - stable: nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties [T343551]
  - uos: update srpm to 4.19.0-91.152.32 [T00000]


author: xinghe <xinghe2@h-partners.com> - 1.16.1-7
changelog:
  - Type:cves
  - CVE:CVE-2023-31130 CVE-2023-31124 CVE-2023-31147
  - SUG:NA
  - DESC:fix CVE-2023-31130 CVE-2023-31124 CVE-2023-31147


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-81
changelog:
  - Update to CKBI 2.48 from NSS 3.64
  -    Removing:
  -     # Certificate "Verisign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "Taiwan GRCA"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "Symantec Class 1 Public Primary Certification Authority - G4"
  -     # Certificate "Symantec Class 2 Public Primary Certification Authority - G4"
  -    Adding:
  -     # Certificate "Microsoft ECC Root Certificate Authority 2017"
  -     # Certificate "Microsoft RSA Root Certificate Authority 2017"
  -     # Certificate "e-Szigno Root CA 2017"
  -     # Certificate "certSIGN Root CA G2"
  -     # Certificate "Trustwave Global Certification Authority"
  -     # Certificate "Trustwave Global ECC P256 Certification Authority"
  -     # Certificate "Trustwave Global ECC P384 Certification Authority"
  -     # Certificate "NAVER Global Root Certification Authority"
  -     # Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
  -     # Certificate "GlobalSign Secure Mail Root R45"
  -     # Certificate "GlobalSign Secure Mail Root E45"
  -     # Certificate "GlobalSign Root R46"
  -     # Certificate "GlobalSign Root E46"


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-82
changelog:
  - Update to CKBI 2.48 from NSS 3.66
  -    Removing:
  -     # Certificate "QuoVadis Root CA"
  -     # Certificate "Sonera Class 2 Root CA"
  -     # Certificate "Trustis FPS Root CA"
  -    Adding:
  -     # Certificate "GLOBALTRUST 2020"
  -     # Certificate "ANF Secure Server Root CA"
  -     # Certificate "Certum EC-384 CA"
  -     # Certificate "Certum Trusted Root CA"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-81
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "GlobalSign Root CA - R2"
  -     # Certificate "DST Root CA X3"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2"
  -    Adding:
  -     # Certificate "TunTrust Root CA"
  -     # Certificate "HARICA TLS RSA Root CA 2021"
  -     # Certificate "HARICA TLS ECC Root CA 2021"
  -     # Certificate "HARICA Client RSA Root CA 2021"
  -     # Certificate "HARICA Client ECC Root CA 2021"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "vTrus ECC Root CA"
  -     # Certificate "vTrus Root CA"
  -     # Certificate "ISRG Root X2"
  -     # Certificate "HiPKI Root CA - G1"
  -     # Certificate "Telia Root CA v2"
  -     # Certificate "D-TRUST BR Root CA 1 2020"
  -     # Certificate "D-TRUST EV Root CA 1 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-80.0
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Adding:
  -     # Certificate "CAEDICOM Root"
  -     # Certificate "I.CA Root CA/RSA"
  -     # Certificate "MULTICERT Root Certification Authority 01"
  -     # Certificate "Certification Authority of WoSign G2"
  -     # Certificate "CA WoSign ECC Root"
  -     # Certificate "CCA India 2015 SPL"
  -     # Certificate "Swedish Government Root Authority v3"
  -     # Certificate "Swedish Government Root Authority v2"
  -     # Certificate "Tunisian Root Certificate Authority - TunRootCA2"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "OpenTrust Root CA G2"
  -     # Certificate "OpenTrust Root CA G3"
  -     # Certificate "Certplus Root CA G1"
  -     # Certificate "Certplus Root CA G2"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Thailand National Root Certification Authority - G1"
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Certification Authority of WoSign"
  -     # Certificate "CA 沃通根证书"
  -     # Certificate "SSC GDL CA Root B"
  -     # Certificate "SAPO Class 2 Root CA"
  -     # Certificate "SAPO Class 3 Root CA"
  -     # Certificate "SAPO Class 4 Root CA"
  -     # Certificate "CA Disig Root R1"
  -     # Certificate "Autoridad Certificadora Raíz Nacional de Uruguay"
  -     # Certificate "ApplicationCA2 Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G6"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "Halcom Root CA"
  -     # Certificate "Swisscom Root EV CA 2"
  -     # Certificate "CFCA GT CA"
  -     # Certificate "Digidentity L3 Root CA - G2"
  -     # Certificate "SITHS Root CA v1"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority (G02)"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "IGC/A AC racine Etat francais"
  -     # Certificate "PersonalID Trustworthy RootCA 2011"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "Swiss Government Root CA II"
  -     # Certificate "Swiss Government Root CA I"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "LuxTrust Global Root"
  -     # Certificate "AC1 RAIZ MTIN"
  -     # Certificate "Microsoft Root Certificate Authority 2011"
  -     # Certificate "CCA India 2011"
  -     # Certificate "ANCERT Certificados Notariales V2"
  -     # Certificate "ANCERT Certificados CGN V2"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "China Internet Network Information Center EV Certificates Root"
  -     # Certificate "Verizon Global Root CA"
  -     # Certificate "SwissSign Silver Root CA - G3"
  -     # Certificate "SwissSign Platinum Root CA - G3"
  -     # Certificate "SwissSign Gold Root CA - G3"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "SITHS CA v3"
  -     # Certificate "Certinomis - Autorité Racine"
  -     # Certificate "ANF Server CA"
  -     # Certificate "Thawte Premium Server CA"
  -     # Certificate "Thawte Server CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "KEYNECTIS ROOT CA"
  -     # Certificate "I.CA - Standard Certification Authority, 09/2009"
  -     # Certificate "I.CA - Qualified Certification Authority, 09/2009"
  -     # Certificate "VI Registru Centras RCSC (RootCA)"
  -     # Certificate "CCA India 2007"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v1"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Actalis Authentication CA G1"
  -     # Certificate "A-Trust-Qual-03"
  -     # Certificate "AddTrust External CA Root"
  -     # Certificate "ECRaizEstado"
  -     # Certificate "Configuration"
  -     # Certificate "FNMT-RCM"
  -     # Certificate "StartCom Certification Authority"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "E-ME SSI (RCA)"
  -     # Certificate "ACEDICOM Root"
  -     # Certificate "Autoridad Certificadora Raiz de la Secretaria de Economia"
  -     # Certificate "Correo Uruguayo - Root CA"
  -     # Certificate "CNNIC ROOT"
  -     # Certificate "Common Policy"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "NetLock Platina (Class Platinum) Főtanúsítvány"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "Cisco Root CA 2048"
  -     # Certificate "CA Disig"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "UCA Global Root"
  -     # Certificate "UCA Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Starfield Services Root Certificate Authority"
  -     # Certificate "I.CA - Qualified root certificate"
  -     # Certificate "I.CA - Standard root certificate"
  -     # Certificate "e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi"
  -     # Certificate "Japanese Government"
  -     # Certificate "AdminCA-CD-T01"
  -     # Certificate "Admin-Root-CA"
  -     # Certificate "Izenpe.com"
  -     # Certificate "TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3"
  -     # Certificate "Halcom CA FO"
  -     # Certificate "Halcom CA PO 2"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "ACNLB"
  -     # Certificate "state-institutions"
  -     # Certificate "state-institutions"
  -     # Certificate "SECOM Trust Systems CO.,LTD."
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "D-TRUST Root Class 2 CA 2007"
  -     # Certificate "D-TRUST Root Class 3 CA 2007"
  -     # Certificate "SSC Root CA A"
  -     # Certificate "SSC Root CA B"
  -     # Certificate "SSC Root CA C"
  -     # Certificate "Autoridad de Certificacion de la Abogacia"
  -     # Certificate "Root CA Generalitat Valenciana"
  -     # Certificate "VAS Latvijas Pasts SSI(RCA)"
  -     # Certificate "ANCERT Certificados CGN"
  -     # Certificate "ANCERT Certificados Notariales"
  -     # Certificate "ANCERT Corporaciones de Derecho Publico"
  -     # Certificate "GLOBALTRUST"
  -     # Certificate "Certipost E-Trust TOP Root CA"
  -     # Certificate "Certipost E-Trust Primary Qualified CA"
  -     # Certificate "Certipost E-Trust Primary Normalised CA"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "IGC/A"
  -     # Certificate "S-TRUST Authentication and Encryption Root CA 2005:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "Swisscom Root CA 1"
  -     # Certificate "Microsec e-Szigno Root CA"
  -     # Certificate "LGPKI"
  -     # Certificate "AC RAIZ DNIE"
  -     # Certificate "Common Policy"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 1"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Staat der Nederlanden Root CA"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Global CA 2"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "QuoVadis Root Certification Authority"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Microsoft Root Authority"
  -     # Certificate "Microsoft Root Certificate Authority"
  -     # Certificate "Microsoft Root Certificate Authority 2010"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "UTN-USERFirst-Object"
  -     # Certificate "BYTE Root Certification Authority 001"
  -     # Certificate "CISRCA1"
  -     # Certificate "ePKI Root Certification Authority - G2"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "SSL.com EV Root Certification Authority RSA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "ACA ROOT"
  -     # Certificate "Security Communication ECC RootCA1"
  -     # Certificate "Security Communication RootCA3"
  -     # Certificate "CHAMBERS OF COMMERCE ROOT - 2016"
  -     # Certificate "Network Solutions RSA Certificate Authority"
  -     # Certificate "Network Solutions ECC Certificate Authority"
  -     # Certificate "Australian Defence Public Root CA"
  -     # Certificate "SI-TRUST Root"
  -     # Certificate "Halcom Root Certificate Authority"
  -     # Certificate "Application CA G3 Root"
  -     # Certificate "GLOBALTRUST 2015"
  -     # Certificate "Microsoft ECC Product Root Certificate Authority 2018"
  -     # Certificate "emSign Root CA - G2"
  -     # Certificate "emSign Root CA - C2"
  -     # Certificate "Microsoft ECC TS Root Certificate Authority 2018"
  -     # Certificate "DigiCert CS ECC P384 Root G5"
  -     # Certificate "DigiCert CS RSA4096 Root G5"
  -     # Certificate "DigiCert RSA4096 Root G5"
  -     # Certificate "DigiCert ECC P384 Root G5"
  -     # Certificate "HARICA Code Signing RSA Root CA 2021"
  -     # Certificate "HARICA Code Signing ECC Root CA 2021"
  -     # Certificate "Microsoft Identity Verification Root Certificate Authority 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-80.2
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "Izenpe.com"
  -     # Certificate "state-institutions"
  -     # Certificate "GlobalSign"
  -     # Certificate "Common Policy"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "AC Raíz Certicámara S.A."


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-80.0
changelog:
  - Update to CKBI 2.60_v7.0.306 from NSS 3.91
  -    Removing:
  -     # Certificate "Camerfirma Global Chambersign Root"
  -     # Certificate "Staat der Nederlanden EV Root CA"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "CCA India 2007"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -    Adding:
  -     # Certificate "DigiCert TLS ECC P384 Root G5"
  -     # Certificate "DigiCert TLS RSA4096 Root G5"
  -     # Certificate "DigiCert SMIME ECC P384 Root G5"
  -     # Certificate "DigiCert SMIME RSA4096 Root G5"
  -     # Certificate "Certainly Root R1"
  -     # Certificate "Certainly Root E1"
  -     # Certificate "E-Tugra Global Root CA RSA v3"
  -     # Certificate "E-Tugra Global Root CA ECC v3"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT RSA CA"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT ECDSA CA"
  -     # Certificate "BJCA Global Root CA1"
  -     # Certificate "BJCA Global Root CA2"
  -     # Certificate "Symantec Enterprise Mobile Root for Microsoft"
  -     # Certificate "A-Trust-Root-05"
  -     # Certificate "ADOCA02"
  -     # Certificate "StartCom Certification Authority G2"
  -     # Certificate "ATHEX Root CA"
  -     # Certificate "EBG Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "America Online Root Certification Authority 1"
  -     # Certificate "Juur-SK"
  -     # Certificate "ComSign CA"
  -     # Certificate "ComSign Secured CA"
  -     # Certificate "ComSign Advanced Security CA"
  -     # Certificate "Global Chambersign Root"
  -     # Certificate "Sonera Class2 CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "VeriSign, Inc."
  -     # Certificate "GTE CyberTrust Global Root"
  -     # Certificate "Equifax Secure Global eBusiness CA-1"
  -     # Certificate "Equifax"
  -     # Certificate "Class 1 Primary CA"
  -     # Certificate "Swiss Government Root CA III"
  -     # Certificate "Application CA G4 Root"
  -     # Certificate "SSC GDL CA Root A"
  -     # Certificate "GlobalSign Code Signing Root E45"
  -     # Certificate "GlobalSign Code Signing Root R45"
  -     # Certificate "Entrust Code Signing Root Certification Authority - CSBR1"


author: Frantisek Krenzelok <fkrenzel@redhat.com> - 2024.2.69_v8.0.303-80.0
changelog:
  - Update to CKBI 2.69_v8.0.303 from NSS 3.101.1
  -    Removing:
  -     # Certificate "Verisign Class 1 Public Primary Certification Authority - G3"
  -     # Certificate "Verisign Class 2 Public Primary Certification Authority - G3"
  -     # Certificate "Security Communication Root CA"
  -     # Certificate "Camerfirma Chambers of Commerce Root"
  -     # Certificate "Hongkong Post Root CA 1"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Symantec Class 1 Public Primary Certification Authority - G6"
  -     # Certificate "Symantec Class 2 Public Primary Certification Authority - G6"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "FNMT-RCM"
  -    Adding:
  -     # Certificate "LAWtrust Root CA2 (4096)"
  -     # Certificate "Sectigo Public Email Protection Root E46"
  -     # Certificate "Sectigo Public Email Protection Root R46"
  -     # Certificate "Sectigo Public Server Authentication Root E46"
  -     # Certificate "Sectigo Public Server Authentication Root R46"
  -     # Certificate "SSL.com TLS RSA Root CA 2022"
  -     # Certificate "SSL.com TLS ECC Root CA 2022"
  -     # Certificate "SSL.com Client ECC Root CA 2022"
  -     # Certificate "SSL.com Client RSA Root CA 2022"
  -     # Certificate "Atos TrustedRoot Root CA ECC G2 2020"
  -     # Certificate "Atos TrustedRoot Root CA RSA G2 2020"
  -     # Certificate "Atos TrustedRoot Root CA ECC TLS 2021"
  -     # Certificate "Atos TrustedRoot Root CA RSA TLS 2021"
  -     # Certificate "TrustAsia Global Root CA G3"
  -     # Certificate "TrustAsia Global Root CA G4"
  -     # Certificate "CommScope Public Trust ECC Root-01"
  -     # Certificate "CommScope Public Trust ECC Root-02"
  -     # Certificate "CommScope Public Trust RSA Root-01"
  -     # Certificate "CommScope Public Trust RSA Root-02"
  -     # Certificate "D-Trust SBR Root CA 1 2022"
  -     # Certificate "D-Trust SBR Root CA 2 2022"
  -     # Certificate "Telekom Security SMIME ECC Root 2021"
  -     # Certificate "Telekom Security TLS ECC Root 2020"
  -     # Certificate "Telekom Security SMIME RSA Root 2023"
  -     # Certificate "Telekom Security TLS RSA Root 2023"
  -     # Certificate "FIRMAPROFESIONAL CA ROOT-A WEB"
  -     # Certificate "SECOM Trust.net"
  -     # Certificate "Chambers of Commerce Root"
  -     # Certificate "VeriSign Class 2 Public Primary Certification Authority - G3"
  -     # Certificate "SSL.com Code Signing RSA Root CA 2022"
  -     # Certificate "SSL.com Code Signing ECC Root CA 2022"


author: haowenchao <haowenchao@huawei.com> - 6.10-3
changelog:
  - DESC: delete -Sgit from 
  %setup       -q




  /usr/bin/cat /builddir/build/SOURCES/0001-Use-explicit-usr-bin-python3.patch | 
  /usr/bin/patch  -s --fuzz=0 --no-backup-if-mismatch

  , and delete BuildRequires git


author: zhangxianting <zhangxianting@uniontech.com> - 310.4-1.01
changelog:
  - spec: no BR gdb on loongarch64 
  - spec: add patch1 for gcc-7.3.0 based compilation
  - spec: Change the subscription-manager-cockpit dependency level
  - fix: delete arch/* empty link(bugid:123783)
  - fix: fix no display /usr/share/cockpit/motd/inactive.motd (bugid:192093)
  - fix: remove rhel and centos(bugid:198321)
  - fix: closed others brands(bugid:243459)


author: Rongwei Wang <rongwei.wang@linux.alibaba.com> - 2.28-225.0.4.6
changelog:
  - elf: Properly align PT_LOAD segments
  - Sync loongarch64 code to lnd.35. (lixing@loongson.cn)
  - Add patch for gb18030-2022 from upstream bug#30243 (fundawang@yeah.net)


author: Patsy Griffin <patsy@redhat.com> - 2.28-251.19
changelog:
  - libio: Fix a deadlock after fork in popen
  - libio: Correctly link tst-popen-fork against libpthread (RHEL-86018)


author: Rongwei Wang <rongwei.wang@linux.alibaba.com> - 2.28-251.0.1.22
changelog:
  - elf: Properly align PT_LOAD segments
  - Sync loongarch64 code to lnd.35. (lixing@loongson.cn)
  - Add patch for gb18030-2022 from upstream bug#30243 (fundawang@yeah.net)
  - aarch64: Increase small and medium cases for __memcpy_generic (bug#7060) (Kaiqiang Wang)
  - Add Hygon Support (Jing Li)
  - Sync loongarch64 code to lnd.36. (fanpeng@loongson.cn)
  - SPECS: define glibc_ldso for LoongArch. (fanpeng@loongson.cn)


author: zengwei <zengwei1@uniontech.com> - 2.28-251.0.1.22.1
changelog:
  - feat: sync optmize from upstream
  - arch: loongarch64 shadow stack
  - optmize: from upstream bug#214497


author: Lianbo Jiang <lijiang@redhat.com> - 7.3.1-3
changelog:
  - Fix segmentation fault caused by crash extension modules
  - Support the overflow stack exception handling on aarch64


author: Lianbo Jiang <lijiang@redhat.com> - 7.3.1-4
changelog:
  - Fix segfault on aarch64 for "bt -a|-c" command
  - Fix HZ calculation on Linux 5.14 and later
  - Fix for "timer -r" option to display all the per-CPU clocks


author: Andreas Schneider <asn@redhat.com> - 4.17.2-1
changelog:
  - resolves: rhbz#2132051 - Update to version 4.17.2
  - resolves: rhbz#2126174 - Fix CVE-2022-1615
  - resolves: rhbz#2108487 - ctdb: Add dependency to samba-winbind-clients


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.2-2
changelog:
  - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
  - related: rhbz#2132051


author: Pavel Filipenský <pfilipenn@redhat.com> - 4.17.4-0
changelog:
  - related: rhbz#2132051 - Update to version 4.17.4
  - resolves: rhbz#2154370 - Fix CVE-2022-38023
  - resolves: rhbz#2142331 - Fix %U include directive for share listing (netshareenum)
  - resolves: rhbz#2148943 - Fix Winbind to retrieve user groups from Active Directory


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.5-2
changelog:
  - resolves: rhbz#2169339 - Fix winbind memory leak
  - resolves: rhbz#2152899 - Fix Samba shares not accessible issue


author: lichao <lichaod@uniontech.com> - 4.17.5-2.0.1.02
changelog:
  - cve: CVE-2022-2127 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968 CVE-2023-42669 CVE-2023-4091 CVE-2023-3961


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-46
changelog:
  - 2074684 - lp to a remote server takes a long time
  - 2074736 - CUPS is too chatty about "Removing document files." in debug mode


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.20.0-33
changelog:
  - RHEL-19433 Incorrect PS header handling in gstopdf
  - RHEL-16034 pdftopdf results with (N > 1)^2 copies if a file is sent to IPP printer with collate
  - RHEL-13211 redhat-lsb unnecessary pulls in cups and avahi dependencies


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 1.20.0-34.0.1
changelog:
  - use extern in header files when declaring global variables for compatible gcc10 build
  - Add doc sub package(Weisson)


author: xingwei <xingwei14@h-partners.com> - 7.71.1-23.up3
changelog:
  - Type:cves
  - CVE:CVE-2023-27533 CVE-2023-27534 CVE-2023-27535 CVE-2023-27536 CVE-2023-27538
  - SUG:NA
  - DESC:fix CVE-2023-27533 CVE-2023-27534 CVE-2023-27535 CVE-2023-27536 CVE-2023-27538


author: yuxiaojun <yuxiaojun@uniontech.com> - 5.5.90-1.03
changelog:
  - fix: When root is disabled after creating an administrator account, the problem of being unable to enter the system through the graphical interface(bugid:203337)


author: lichao <lichaod@uniontech.com> - 1.0.47-1.01
changelog:
  - update: update to 1.0.47
  - spec: limit opencv BuildRequires
  - fix: fix incorrect pkg replacing relation(bugid:219967)
  - spec: sw BuildRequires: opencv


author: qinzhiben <qinzhiben@uniontech.com> - 12:4.3.6-50.0.2
changelog:
  - feat: update 12:4.3.6-50.0.1
  - feat: dhcp-server sw_64 provides dhcp
  - rebrand: modify bug url for uos


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-6
changelog:
  - fix mail storage block count parsing (#1894418)
  - MIME parser crashed when boundaries were wrong (#1888111)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-1
changelog:
  - dovecot updated to 2.3.16, pigeonhole to 0.5.16
  - fix CVE-2021-33515 plaintext commands injection (#1980014)


author: Timothy Redaelli <tredaelli@redhat.com> - 19.11.1-1
changelog:
  - Rebase DPDK to 19.11.1 (#1824905)
  - Remove dpdk-pmdinfo.py (#1801361)
  - Add Requires: rdma-core-devel libmnl-devel on x86_64 for dpdk-devel (#1813252)


author: Pavel Valena <pvalena@redhat.com> - 049-218.git20221019
changelog:
  - Dracut: only login to one target at a time
  - iscsi: don't continue waiting if the root device is present
  - network: stop waiting for interfaces if root device is
  - iscsiroot: parse_iscsi_root overwrites command line args
  - iscsiroot: there's never more than one target per call
  - iscsiroot: try targets only once
  - iscsiroot: remove bashisms
  - fixup "Dracut: only login to one target at a time"
  - 35network-legacy: only skip waiting for interfaces if netroot


author: Pavel Valena <pvalena@redhat.com> - 049-221.git20221214
changelog:
  - fix(80lvmthinpool-monitor): use systemsctl instead of
  - fix(squash): build ld cache for squash loader
  - fix(network-manager): write DHCP filename option to dhcpopts


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-6
changelog:
  - edk2-UefiCpuPkg-MpInitLib-fix-apic-mode-for-cpu-hotplug.patch [bz#2150267]
  - Resolves: bz#2150267
    (ovmf must consider max cpu count not boot cpu count for apic mode [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-7
changelog:
  - edk2-add-8.6-machine-type-to-edk2-ovmf-cc.json.patch [RHEL-12626]
  - Resolves: RHEL-12626
    (Missing firmware descriptor with secureboot disabled in RHEL 8)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-8
changelog:
  - edk2-Bumped-openssl-submodule-version-to-cf317b2bb227.patch [RHEL-7560]
  - Resolves: RHEL-7560
    (CVE-2023-3446 edk2: openssl: Excessive time spent checking DH keys and parameters [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-9
changelog:
  - edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariableG.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variables.patch [RHEL-17587]
  - Resolves: RHEL-17587
    ([rhel8] guest fails to boot due to ASSERT error)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-10
changelog:
  - edk2-OvmfPkg-VirtNorFlashDxe-clone-ArmPlatformPkg-s-NOR-f.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-remove-CheckBlockLocked-feat.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-remove-disk-I-O-protocol-imp.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-drop-block-I-O-protocol-impl.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-avoid-array-mode-switch-afte.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-avoid-switching-between-mode.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-use-EFI_MEMORY_WC-and-drop-A.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-map-flash-memory-as-uncachea.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-stop-accepting-gEfiVariable2.patch [RHEL-17587]
  -  edk2-OvmfPkg-VirtNorFlashDxe-sanity-check-variable2.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-add-casts-to-UINTN-and-UINT3.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-clarify-block-write-logic-fi.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-add-a-loop-for-NorFlashWrite.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-allow-larger-writes-without-.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-ValidateFvHeader-unwritten-s.patch [RHEL-17587]
  - edk2-OvmfPkg-VirtNorFlashDxe-move-DoErase-code-block-into.patch [RHEL-17587]
  - edk2-ArmVirtPkg-ArmVirtQemu-migrate-to-OVMF-s-VirtNorFlas.patch [RHEL-17587]
  - edk2-OvmfPkg-clone-NorFlashPlatformLib-into-VirtNorFlashP.patch [RHEL-17587]
  - Resolves: RHEL-17587
    ([rhel8] guest fails to boot due to ASSERT error)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-11
changelog:
  - edk2-SecurityPkg-Change-use-of-EFI_D_-to-DEBUG_.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-Change-OPTIONAL-keyword-usage-style.patch [RHEL-21154 RHEL-21156]
  - edk2-MdePkg-Introduce-CcMeasurementProtocol-for-CC-Guest-.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpm2.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-Support-CcMeasurementProtocol-in-DxeTpmM.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-411.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4117.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-Adding-CVE-2022-36763-to-SecurityFixes.y.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SECURITY-PATCH-418.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-DxeTpmMeasureBootLib-SECURITY-PATCH-4118.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-DxeTpm2MeasureBootLib-SEC-PATCH-4118-2.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-DxeTpmMeasureBootLib-SEC-PATCH-4117-2.patch [RHEL-21154 RHEL-21156]
  - edk2-SecurityPkg-Updating-SecurityFixes.yaml-after-symbol.patch [RHEL-21154 RHEL-21156]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Pa.patch [RHEL-21840 RHEL-21842]
  - edk2-NetworkPkg-Add-Unit-tests-to-CI-and-create-Host-Test.patch [RHEL-21840 RHEL-21842]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45230-Un.patch [RHEL-21840 RHEL-21842]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Pa.patch [RHEL-21840 RHEL-21842]
  - Resolves: RHEL-21154
    (CVE-2022-36763 edk2: heap buffer overflow in Tcg2MeasureGptTable() [rhel-8])
  - Resolves: RHEL-21156
    (CVE-2022-36764 edk2: heap buffer overflow in Tcg2MeasurePeImage() [rhel-8])
  - Resolves: RHEL-21840
    (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8])
  - Resolves: RHEL-21842
    (CVE-2023-45230 edk2: Buffer overflow in the DHCPv6 client via a long Server ID option [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-12
changelog:
  - edk2-Apply-uncrustify-changes-to-.c-.h-files-in-the-Netwo.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Patc.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45231-Unit.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Patc.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Ip6Dxe-SECURITY-PATCH-CVE-2023-45232-Unit.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Apply-uncrustify-changes.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p2.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p3.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-UefiPxeBcDxe-SECURITY-PATCH-CVE-2023-4523p4.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Adds-a-SecurityFix.yaml-file.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Apply-uncrustify-changes-p2.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Dhcp6Dxe-SECURITY-PATCH-CVE-2023-45229-Re.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Dhcp6Dxe-Removes-duplicate-check-and-repl.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - edk2-NetworkPkg-Dhcp6Dxe-Packet-Length-is-not-updated-bef.patch [RHEL-21840 RHEL-21844 RHEL-21846 RHEL-21848 RHEL-21850 RHEL-21852]
  - Resolves: RHEL-21840
    (CVE-2023-45229 edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message [rhel-8])
  - Resolves: RHEL-21844
    (CVE-2023-45231 edk2: Out of Bounds read when handling a ND Redirect message with truncated options [rhel-8])
  - Resolves: RHEL-21846
    (CVE-2023-45232 edk2: Infinite loop when parsing unknown options in the Destination Options header [rhel-8])
  - Resolves: RHEL-21848
    (CVE-2023-45233 edk2: Infinite loop when parsing a PadN option in the Destination Options header [rhel-8])
  - Resolves: RHEL-21850
    (CVE-2023-45234 edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message [rhel-8])
  - Resolves: RHEL-21852
    (CVE-2023-45235 edk2: Buffer overflow when handling Server ID option from a DHCPv6 proxy Advertise message [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-13
changelog:
  - edk2-EmbeddedPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-21158]
  - edk2-StandaloneMmPkg-Hob-Integer-Overflow-in-CreateHob.patch [RHEL-21158]
  - Resolves: RHEL-21158
    (CVE-2022-36765 edk2: integer overflow in CreateHob() could lead to HOB OOB R/W [rhel-8])


author: Jiang Xin <jiangxin@hygon.cn> - 20220126gitbb1bba3d77-13.0.1
changelog:
  - Support hygon CSV3 feature
  - Support SEV live migration
  - 0047-anolis-OvmfPkg-BaseMemEncryptLib-Save-memory-encrypt.patch
  - Fix the isue that interrupt is enabled in MMIO VC handler
  - 0048-OvmfPkg-AmdSev-SecretDxe-Allocate-secret-location-as.patch (fangbaoshun@hygon.cn)
  - Resolves: bz#8033


author: maqi <maqi@uniontech.com> - 20220126gitbb1bba3d77-13.0.1.01
changelog:
  - fix: add soft link to make UEFI fireware be detectable(bugid:240197)
  - fix: create symbolic link OVMF_CODE.fd(bugid:253393)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-13.el8_10.2
changelog:
  * Wed Jul 03 2024 Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-13.el8_10.1
  - edk2-MdeModulePkg-Change-use-of-EFI_D_-to-DEBUG_.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdeModulePkg-Potential-UINT32-overflow-in-S3-ResumeC.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-Apply-uncrustify-changes.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-NetworkPkg-Apply-uncrustify-changes.p2.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Rename-RdRandGenerateEntropy-to-g.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Remove-ArchGetSupportedRngAlgorit.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Documentation-include-parameter-c.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Check-before-advertising-Cpu-Rng-.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Add-AArch64-RawAlgorithm-support-.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Add-debug-warning-for-NULL-PcdCpu.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Rename-AArch64-RngDxe.c.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Add-Arm-support-of-RngDxe.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Correctly-update-mAvailableAlgoAr.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Conditionally-install-EFI_RNG_PRO.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdeModulePkg-Duplicate-BaseRngLibTimerLib-to-MdeModu.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-Add-deprecated-warning-to-BaseRngLibTimer.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-SecurityPkg.dec-Move-PcdCpuRngSupportedA.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-DxeRngLib-Request-raw-algorithm-instead-of-de.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-Rng-Add-GUID-to-describe-Arm-Rndr-Rng-algorit.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdeModulePkg-Rng-Add-GUID-to-describe-unsafe-Rng-alg.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-Rng-Add-GetRngGuid-to-RngLib.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Use-GetRngGuid-when-probing-RngLi.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-Simplify-Rng-algorithm-selection-.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-NetworkPkg-SECURITY-PATCH-CVE-2023-45237.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-BaseRngLib-Add-a-smoketest-for-RDRAND-and-che.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-SecurityPkg-RngDxe-add-rng-test.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-OvmfPkg-wire-up-RngDxe.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-CryptoPkg-Test-call-ProcessLibraryConstructorList.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-MdePkg-X86UnitTestHost-set-rdrand-cpuid-bit.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-NetworkPkg-TcpDxe-SECURITY-PATCH-CVE-2023-45236.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - edk2-NetworkPkg-TcpDxe-Fixed-system-stuck-on-PXE-boot-flo.patch [RHEL-21854 RHEL-21856 RHEL-40099]
  - Resolves: RHEL-21854
    (CVE-2023-45236 edk2: Predictable TCP Initial Sequence Numbers [rhel-8])
  - Resolves: RHEL-21856
    (CVE-2023-45237 edk2: Use of a Weak PseudoRandom Number Generator [rhel-8])
  - Resolves: RHEL-40099
    (CVE-2024-1298 edk2: Temporary DoS vulnerability [rhel-8.10.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20200602gitca407c7246bf-5.el8
changelog:
  - edk2-MdeModulePkg-LzmaCustomDecompressLib-catch-4GB-uncom.patch [bz#1892318]
  - edk2-redhat-add-OVMF-binary-that-will-support-SEV-ES.patch [bz#1956837]
  - Resolves: bz#1892318
    (edk2: possible heap corruption with LzmaUefiDecompressGetInfo [rhel-8])
  - Resolves: bz#1956837
    (Additional build of edk2 without SMM (dual build / sub-package) for SEV-ES)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-1
changelog:
  - Rebase to edk2-stable202105 [bz#1938238]
  - Resolves: bz#1938238
    ((edk2-rebase-rhel-8.5) - rebase edk2 to edk2-stable202105 for RHEL-8.5)


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-2
changelog:
  - edk2-NetworkPkg-IScsiDxe-wrap-IScsiCHAP-source-files-to-8.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-simplify-ISCSI_CHAP_AUTH_DATA.In.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-clean-up-ISCSI_CHAP_AUTH_DATA.Ou.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-clean-up-library-class-dependenc.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-potential-integer-overflow-i.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-assert-that-IScsiBinToHex-always.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-reformat-IScsiHexToBin-leading-c.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-IScsiHexToBin-hex-parsing.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-fix-IScsiHexToBin-buffer-overflo.patch [bz#1956408]
  - edk2-NetworkPkg-IScsiDxe-check-IScsiHexToBin-return-value.patch [bz#1956408]
  - Resolves: bz#1956408
    (edk2: remote buffer overflow in IScsiHexToBin function in NetworkPkg/IScsiDxe [rhel-8.5.0])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20210527gite1999b264f1f-3
changelog:
  - edk2-MdeModulePkg-PartitionDxe-Ignore-PMBR-BootIndicator-.patch [bz#1988762]
  - Resolves: bz#1988762
    (edk2 does not ignore PMBR protective record BootIndicator as required by UEFI spec)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-1.el8
changelog:
  - Rebase to latest upstream release [bz#2018386]
  - Resolves: bz#2018386
    ([rebase] update edk2 to nov '21 release (edk2-stable202111xx))


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-2
changelog:
  - edk2-OvmfPkg-AmdSev-SecretPei-Mark-SEV-launch-secret-area.patch [bz#2112307]
  - Resolves: bz#2112307
    (Mark SEV launch secret area as reserved)


author: Camilla Conte <cconte@redhat.com> - 20220126gitbb1bba3d77-3
changelog:
  - Bumping OpenSSL version [bz# 2074834]
  - Resolves: bz# 2074834
    (edk2: sync openssl sources with rhel openssl rpm)


author: Jon Maloy <jmaloy@redhat.com> - 20220126gitbb1bba3d77-4
changelog:
  - edk2-openssl-update.patch [bz#2164531 bz#2164543 bz#2164558 bz#2164581]
  - edk2-rh-openssl-add-crypto-bn-rsa_sup_mul.c-to-file-list.patch [bz#2164531 bz#2164543 bz#2164558 bz#2164581]
  - Resolves: bz#2164531
    (CVE-2023-0286 edk2: openssl: X.400 address type confusion in X.509 GeneralName [rhel-8])
  - Resolves: bz#2164543
    (CVE-2022-4304 edk2: openssl: timing attack in RSA Decryption implementation [rhel-8])
  - Resolves: bz#2164558
    (CVE-2023-0215 edk2: openssl: use-after-free following BIO_new_NDEF [rhel-8])
  - Resolves: bz#2164581
    (CVE-2022-4450 edk2: openssl: double free after calling PEM_read_bio_ex [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 20220126gitbb1bba3d77-5
changelog:
  - edk2-SecurityPkg-DxeImageVerificationLib-Check-result-of-.patch [bz#1861743]
  - Resolves: bz#1861743
    (CVE-2019-14560 edk2: Function GetEfiGlobalVariable2() return value not checked in DxeImageVerificationHandler() [rhel-8])


author: Jacek Migacz <jmigacz@redhat.com> - 1:26.1-10
changelog:
  - Fix etags local command injection vulnerability (#2175189)
  - Fix htmlfontify.el command injection vulnerability (#2175178)
  - Fix ob-latex.el command injection vulnerability (#2180587)


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-9
changelog:
  - Fix etags local command injection vulnerability (#2175190)
  - Fix htmlfontify.el command injection vulnerability (#2175179)
  - Fix ruby-mode.el local command injection vulnerability (#2175142)
  - Fix ob-latex.el command injection vulnerability (#2180590)


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-10
changelog:
  - Disable xwidgets (RHEL-14551)
  - org-file-contents: Consider all remote files unsafe (CVE-2024-30205)
  - Make Gnus treats inline MIME contents as untrusted (CVE-2024-30203)
  - Add protection for LaTeX preview (CVE-2024-30204)
  - org-link-expand-abbrev: Do not evaluate arbitrary unsafe Elisp code (CVE-2024-39331)


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-11.el9_5.1
changelog:
  - Fix man.el shell injection vulnerability (RHEL-79021)
  - Eliminate use of obsolete patch syntax (RHEL-80450)


author: Xiaoping Liu <liuxiaoping@alibaba-inc.com> - 1:27.2-11.0.1.1
changelog:
  - Add doc sub package
  - update config.sub and config.guess for loongarch64 (Jingyun Hua)
  - cherry-pick `add sw patch #349896d0a48b80b530cfa5cc2bd1fc4ceff68e42`. (nijie@wxiat.com)


author: wangjie <wangjie375@huawei.com> - 2.2.9-4
changelog:
  - Type:CVE
  - ID:CVE-2021-45960 CVE-2021-46143 CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 CVE-2022-22827
  - SUG:NA
  - DESC:fix CVE-2021-45960 CVE-2021-46143
         CVE-2022-22822 CVE-2022-22823 CVE-2022-22824 CVE-2022-22825 CVE-2022-22826 CVE-2022-22827


author: yangzhuangzhuang <yangzhuangzhuang1@h-partners.com> - 2.2.9-6
changelog:
  - Type:CVE
  - ID:CVE-2022-25235 CVE-2022-25236 CVE-2022-25313 CVE-2022-25314 CVE-2022-25315
  - SUG:NA
  - DESC:Fix CVE-2022-25235 CVE-2022-25236 CVE-2022-25313 CVE-2022-25314 CVE-2022-25315


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-125
changelog:
  - all agents: update metadata in non-I/O agents to Power or Network
    fencing
    Resolves: RHEL-14031


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-127
changelog:
  - fence_scsi: fix registration handling if ISID conflicts
    Resolves: RHEL-5397
  - fence_zvmip: document required user permissions in metadata/manpage
    Resolves: RHEL-14343


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-129
changelog:
  - bundled urllib3: fix CVE-2023-45803
    Resolves: RHEL-18132
  - bundled pycryptodome: fix CVE-2023-52323
    Resolves: RHEL-20915
  - bundled jinja2: fix CVE-2024-22195
    Resolves: RHEL-22174


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-129.02
changelog:
  - bundled setuptools: fix CVE-2024-6345
    Resolves: RHEL-50223
  - bundled urllib3: fix CVE-2024-37891
    Resolves: RHEL-43568

  - fence_eps: add fence_epsr2 for ePowerSwitch R2 and newer
    Resolves: RHEL-7734
  - bundled jinja2: fix CVE-2024-34064
    Resolves: RHEL-35655


author: maqi <maqi@uniontech.com> - 102.12.0-1.02
changelog:
  - spec: define rhel_minor_version 3 for uelc20 dist.
  - spec: requires uos-indexhtml.
  - spec: fix bookmark icon in English env:comment cp command.
  - arch: exclude loongarch.
  - rebrand: modify distribution.ini.
  - rebrand: rename centos js file to uos.
  - rebrand: Welcome page 'https://www.chinauos.com/home' in js file.


author: Jan Grulich <jgrulich@redhat.com - 128.4.0-2
changelog:
  - Enable PipeWire camera support for RHEL 10
    + backport upstream fixes for PipeWire camera support
    Fixes: RHEL-64749


author: Jan Horak <jhorak@redhat.com> - 128.3.1-1.02
changelog:
  - cve: modify redhat to uos
  -      add 13-gcc-c++  change nss version from 3.101 to 3.90
  -  chnage nss: 3.101 | rust: 1.76 | llvm : 7.0


author: Kalev Lember <klember@redhat.com> - 1.12.9-2
changelog:
  - Backport upstream patches for CVE-2024-42472
  - Require bubblewrap version that has new --bind-fd option backported for
    addressing CVE-2024-42472


author: José Expósito <jexposit@redhat.com> - 3.0.0-9
changelog:
  - Fix CVE-2024-24258 and CVE-2024-24259
    Resolves: https://issues.redhat.com/browse/RHEL-25175
    Resolves: https://issues.redhat.com/browse/RHEL-25177


author: Michal Ruprich <mruprich@redhat.com> - 8.3.1-2
changelog:
  - Resolves: #2128738 - out-of-bounds read in the BGP daemon may lead to information disclosure or denial of service


author: Michal Ruprich <mruprich@redhat.com> - 8.3.1-6
changelog:
  - Resolves: #2184870 - Reachable assertion in peek_for_as4_capability function
  - Resolves: #2196795 - denial of service by crafting a BGP OPEN message with an option of type 0xff
  - Resolves: #2196796 - denial of service by crafting a BGP OPEN message with an option of type 0xff
  - Resolves: #2196794 - out-of-bounds read exists in the BGP daemon of FRRouting


author: Zoltan Fridrich <zfridric@redhat.com> - 3.6.16-6
changelog:
  - Fix x86_64 CPU feature detection when AVX is not available (#2131152)
  - Fix timing side-channel in TLS RSA key exchange (#2162598)


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.11-2
changelog:
  - resolve CVE-2021-44716 golang: net/http: limit growth of header canonicalization cache
  - resolve CVE-2021-43813 grafana: directory traversal vulnerability for *.md files


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-1
changelog:
  - update to 7.5.15 tagged upstream community sources, see CHANGELOG
  - resolve CVE-2022-21673 grafana: Forward OAuth Identity Token can allow users to access some data sources
  - resolve CVE-2022-21702 grafana: XSS vulnerability in data source handling
  - resolve CVE-2022-21703 grafana: CSRF vulnerability can lead to privilege escalation
  - resolve CVE-2022-21713 grafana: IDOR vulnerability can lead to information disclosure
  - resolve CVE-2021-23648 sanitize-url: XSS
  - resolve CVE-2022-21698 prometheus/client_golang: Denial of service using InstrumentHandlerCounter
  - declare Node.js dependencies of subpackages
  - make vendor and webpack tarballs reproducible


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-3
changelog:
  - resolve CVE-2022-1962 golang: go/parser: stack exhaustion in all Parse* functions
  - resolve CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
  - resolve CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
  - resolve CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
  - resolve CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
  - resolve CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
  - resolve CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode
  - resolve CVE-2022-28131 golang: encoding/xml: stack exhaustion in Decoder.Skip
  - resolve CVE-2022-30633 golang: encoding/xml: stack exhaustion in Unmarshal


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.15-4
changelog:
  - resolve CVE-2022-39229 grafana: using email as a username can block other users from signing in
  - resolve CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
  - resolve CVE-2022-41715 golang: regexp/syntax: limit memory used by parsing regexps
  - resolve CVE-2022-2880 golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters
  - run integration tests in check phase
  - update FIPS patch with latest changes in Go packaging


author: zhangxianting <zhangxianting@uniontech.com> 7.5.15-4.01
changelog:
  - cve: CVE-2022-2880 CVE-2022-27664 CVE-2022-39229 CVE-2022-41715
  - arch: support loongarch64
  - spec: Use cn proxy for go build


author: Sam Feifer <sfeifer@redhat.com> 7.5.15-5
changelog:
  - resolve RHEL-13284
  - resolve CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work
  - testing is turned off due to test failures caused by testing date mismatch


author: Sam Feifer <sfeifer@redhat.com> 9.2.10-12
changelog:
  - Resolves RHEL-7503
  - Adds a selinux policy for grafana
  - Resolves RHEL-12650
  - fix CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work


author: Sam Feifer <sfeifer@redhat.com> 9.2.10-14
changelog:
  - Resolves RHEL-19596
  - Fixes coredump issue introduced by selinux
  - Patches out call to panic when trying to walk "/" directory
  - Fixes postgresql AVC denial


author: Sam Feifer <sfeifer@redhat.com> 9.2.10-15
changelog:
  - Resolves RHEL-23466
  - Resolves RHEL-21027
  - Allows for gid to be 0
  - Allows for postgreSQL datasource in selinux policy


author: Sam Feifer <sfeifer@redhat.com> 9.2.10-7
changelog:
  - resolve RHEL-12649
  - resolve CVE-2023-39325 CVE-2023-44487 rapid stream resets can cause excessive work
  - testing is turned off due to test failures caused by testing date mismatch


author: Andreas Gerstmayr <agerstmayr@redhat.com> 3.0.0-1
changelog:
  - update to 3.0.0 tagged upstream community sources, see CHANGELOG
  - bundle golang dependencies and (optionally) node.js dependencies


author: Andreas Gerstmayr <agerstmayr@redhat.com> 3.1.0-1
changelog:
  - update to 3.1.0 tagged upstream community sources, see CHANGELOG
  - remove unused cryptographic implementations


author: Andreas Gerstmayr <agerstmayr@redhat.com> 3.2.0-2
changelog:
  - resolve CVE-2022-1705 golang: net/http: improper sanitization of Transfer-Encoding header
  - resolve CVE-2022-32148 golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working
  - resolve CVE-2022-30631 golang: compress/gzip: stack exhaustion in Reader.Read
  - resolve CVE-2022-30630 golang: io/fs: stack exhaustion in Glob
  - resolve CVE-2022-30632 golang: path/filepath: stack exhaustion in Glob
  - resolve CVE-2022-30635 golang: encoding/gob: stack exhaustion in Decoder.Decode


author: zhangqiumiao <zhangqiumiao1@huawei.com> - 1:2.04-36
changelog:
  - Type:CVE
  - CVE:CVE-2023-4692 CVE-2023-4693
  - SUG:NA
  - DESC:fs/ntfs: Make code more readable
         fs/ntfs: Fix an OOB read when parsing a volume label
         fs/ntfs: Fix an OOB read when parsing bitmaps for index attributes
         fs/ntfs: Fix an OOB read when parsing directory entries from resident and non-resident index attributes
         fs/ntfs: Fix an OOB read when reading data from the resident $DATA attribute
         fs/ntfs: Fix an OOB write when parsing the $ATTRIBUTE_LIST attribute for the $MFT file


author: zhangxianting <zhangxianting@uniontech.com> - 1:2.04-36.up7.12
changelog:
  - fix: fix bug when repeat execute grub-switch-to-blscfg.in to create /boot/loader/entries/(bugid:186045)


author: zhangxianting <zhangxianting@uniontech.com> - 1:2.04-36.up7.14
changelog:
  - fix: patch to fix bug when repeat execute grub-switch-to-blscfg.in to create /boot/loader/entries/(bugid:186045)


author: Wim Taymans <wtaymans@redhat.com> - 1.22.1-2
changelog:
  - Patch CVE-2023-44429: AV1 codec parser heap-based buffer overflow
  - Patch CVE-2023-44446: MXF demuxer use-after-free
  - Resolves: RHEL-17030, RHEL-17039


author: Wim Taymans <wtaymans@redhat.com> - 1.18.4-5
changelog:
  - Handle both compressed and uncompressed man pages
  - Fix build with small patch
  - Resolves: rhbz#2005247


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-6
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
    harfbuzz: integer overflow in the component hb-ot-shape-fallback.c


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-7
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
  - Fix Covscan compiler warning for inclusion of parenthesis
  - Update tests.yaml


author: Jarod Wilson <jarod@redhat.com> - 20220713-109.gitdfa29317
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Include even newer qed firmware update (rhbz 2040269)


author: Jarod Wilson <jarod@redhat.com> - 20220726-110.git150864a4
changelog:
  - Omit unused password-protected vxge firmware files from package (rhbz 2108051)
  - Pick up latest AMD GPU firmwares


author: Lucas Zampieri <lzampier@redhat.com> - 20221102-111.git8bb75626
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - amdgpu firmware update to fix certain "multiple monitor scenarios" (rhbz 2130707)


author: Lucas Zampieri <lzampier@redhat.com> - 20230111-112.gita1ad1d5b
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Navi33 dGPU firmware (rhbz 2047480)
  - Navi31 dGPU firmware (rhbz 2047483)


author: Lucas Zampieri <lzampier@redhat.com> - 20230217-113.git83f1d778
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Qualcomm Wi-Fi - Disconnecting power cable during suspend wakes up the laptop (rhbz 2169012)


author: Patrick Talbert <ptalbert@redhat.com> - 20230404-114.git2e92a49f
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Intel QAT Update - firmware for QAT (rhbz 2030316)


author: Denys Vlasenko <dvlasenk@redhat.com> - 20230515-115.gitd1962891
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - [RHEL8] Add latest NVIDIA signed firmware for Turing GPUs and later
  Resolves: rhbz#2183606


author: Denys Vlasenko <dvlasenk@redhat.com> - 20230711-116.gitd3f66064
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - AMD GPU firmware update: fix PSR-SU issues with kernel 6.2 or later
  Resolves: rhbz#2218670


author: Denys Vlasenko <dvlasenk@redhat.com> - 20230808-117.git0ab353f8
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Navi32 dGPU firmware
  - Update to fix multi monitor behind TBT3 dock & random flickers
  - AMD Zen2 firmware update for cross-process information leak
  Resolves: rhbz#2047482, rhbz#2227846, rhbz#2227153


author: Denys Vlasenko <dvlasenk@redhat.com> - 20230824-118.git0e048b06
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - AMD Zen3 and Zen4 firmware update for return address predictor velunerability
  Resolves: rhbz#2230415


author: Denys Vlasenko <dvlasenk@redhat.com> - 20231121-119.git9552083a
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Update AMD cpu microcode
  - hw: intel: Fix protection mechanism failure for some Intel(R) PROSet/Wireless WiFi
  Resolves: RHEL-16721, RHEL-14260


author: Denys Vlasenko <dvlasenk@redhat.com> - 20231121-120.git9552083a
changelog:
  - Work around absense of rdfind during build
  - Add file directives for new iwlwifi files
  Resolves: RHEL-16721, RHEL-14260


author: Denys Vlasenko <dvlasenk@redhat.com> - 20240111-121.gitb3132c18
changelog:
  - Pass --ignore-duplicates to copy-firmware.sh
  - AMD Zen3 and Zen4: fix for INVD instruction causing loss of SEV-ES guest machine memory integrity
  Resolves: RHEL-13982


author: Denys Vlasenko <dvlasenk@redhat.com> - 20240610-122.git90df68d2
changelog:
  - [Intel 8.10 FEAT] [SPR][EMR] QAT firmware update available (RHEL-15607)
  - CVE-2023-31346 AMD SEV: Reserved fields in guest message responses may not be zero initialized [rhel-8.10.0] (RHEL-35596)
  - amd-ucode early loading broken [rhel-8] (RHEL-16799)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - linux-firmware: Add firmware for Lenovo Thinkbooks
  - amdgpu: update yellow carp firmware
  - amdgpu: update VCN 4.0.4 firmware
  - amdgpu: update SDMA 6.0.2 firmware
  - amdgpu: update PSP 13.0.7 firmware
  - amdgpu: update GC 11.0.2 firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update raven2 firmware
  - amdgpu: update raven firmware
  - amdgpu: update SMU 13.0.10 firmware
  - amdgpu: update SDMA 6.0.3 firmware
  - amdgpu: update PSP 13.0.10 firmware
  - amdgpu: update GC 11.0.3 firmware
  - amdgpu: update VCN 3.1.2 firmware
  - amdgpu: update PSP 13.0.5 firmware
  - amdgpu: update psp 13.0.8 firmware
  - amdgpu: update vega20 firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: update smu 13.0.0 firmware
  - amdgpu: update SDMA 6.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - amdgpu: update picasso firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update PSP 13.0.11 firmware
  - amdgpu: update GC 11.0.4 firmware
  - amdgpu: update VCN 4.0.2 firmware
  - amdgpu: update SDMA 6.0.1 firmware
  - amdgpu: update PSP 13.0.4 firmware
  - amdgpu: update GC 11.0.1 firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update VCN 4.0.5 firmware
  - amdgpu: update PSP 14.0.0 firmware
  - amdgpu: update GC 11.5.0 firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update SMU 13.0.6 firmware
  - amdgpu: update PSP 13.0.6 firmware
  - amdgpu: update GC 9.4.3 firmware
  - amdgpu: update renoir firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update aldebaran firmware
  - amdgpu: add support for PSP 14.0.1
  - amdgpu: add support for VPE 6.1.1
  - amdgpu: add support for VCN 4.0.6
  - amdgpu: add support for SDMA 6.1.1
  - amdgpu: add support for GC 11.5.1
  - amdgpu: Add support for DCN 3.5.1
  - cnm: update chips&media wave521c firmware.
  - linux-firmware: Add ordinary firmware for RTL8821AU device
  - amdgpu: add new ISP 4.1.1 firmware
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - linux-firmware: Amphion: Update vpu firmware
  - linux-firmware: Update firmware file for Intel BlazarU core
  - linux-firmware: Update firmware file for Intel Bluetooth Magnetor core
  - linux-firmware: Update firmware file for Intel Bluetooth Solar core
  - linux-firmware: Update firmware file for Intel Bluetooth Solar core
  - i915: Add BMG DMC v2.06
  - linux-firmware: Add CS35L41 HDA Firmware for Asus HN7306
  - linux-firmware: Update firmware tuning for HP Consumer Laptop
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - rtl_bt: Update RTL8822C BT UART firmware to 0x0FD6_407B
  - rtl_bt: Update RTL8822C BT USB firmware to 0x0ED6_407B
  - cirrus: cs35l56: Add firmware for Cirrus CS35L56 for various ASUS laptops
  - linux-firmware: Add firmware and tuning for Lenovo Y770S
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - linux-firmware: Add firmware for Cirrus CS35L56 for various HP laptops
  - i915: Update Xe2LPD DMC to v2.20
  - linux-firmware: Remove Calibration Firmware and Tuning for CS35L41
  - linux-firmware: Add firmware for Lenovo Thinkbook 13X
  - ASoC: tas2781: Add dsp firmware for Thinkpad ICE-1 laptop
  - amdgpu: add DMCUB 3.5 firmware
  - amdgpu: add VPE 6.1.0 firmware
  - amdgpu: add VCN 4.0.5 firmware
  - amdgpu: add UMSCH 4.0.0 firmware
  - amdgpu: add SDMA 6.1.0 firmware
  - amdgpu: add PSP 14.0.0  firmware
  - amdgpu: add GC 11.5.0 firmware
  - amdgpu: update license date
  - Montage: update firmware for Mont-TSSE
  - linux-firmware: Add tuning parameter configs for CS35L41 Firmware
  - linux-firmware: Fix firmware names for Laptop SSID 104316a3
  - linux-firmware: Add CS35L41 HDA Firmware for Lenovo Legion Slim 7 16ARHA7
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
  - linux-firmware: update firmware for MT7922 WiFi device
  - iwlwifi: add gl FW for core87-44 release
  - iwlwifi: add ty/So/Ma firmwares for core87-44 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core87-44 release
  - nvidia: Update Tegra210 XUSB firmware to v50.29
  - amdgpu: update beige goby firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update psp 13.0.11 firmware
  - amdgpu: update gc 11.0.4 firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update renoir firmware
  - amdgpu: update vcn 4.0.2 firmware
  - amdgpu: update sdma 6.0.1 firmware
  - amdgpu: update psp 13.0.4 firmware
  - amdgpu: update gc 11.0.1 firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update vega20 firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update raven2 firmware
  - amdgpu: update vcn 4.0.4 firmware
  - amdgpu: update smu 13.0.7 firmware
  - amdgpu: update sdma 6.0.2 firmware
  - amdgpu: update ipsp 13.0.7 firmware
  - amdgpu: update gc 11.0.2 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update raven firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update smu 13.0.10 firmware
  - amdgpu: update sdma 6.0.3 firmware
  - amdgpu: update psp 13.0.10 firmware
  - amdgpu: update gc 11.0.3 firmware
  - amdgpu: update vcn 3.1.2 firmware
  - amdgpu: update psp 13.0.5 firmware
  - amdgpu: update gc 10.3.6 firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update arcturus firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update vcn 4.0.3 firmware
  - amdgpu: update smu 13.0.6 firmware
  - amdgpu: update psp 13.0.6 firmware
  - amdgpu: update gc 9.4.3 firmware
  - amdgpu: update vcn 4.0.0 firmware
  - amdgpu: update smu 13.0.0 firmware
  - amdgpu: update sdma 6.0.0 firmware
  - amdgpu: update psp 13.0.0 firmware
  - amdgpu: update gc 11.0.0 firmware
  - amdgpu: update  firmware
  - amdgpu: update aldebaran firmware
  - amdgpu: update psp 13.0.8 firmware
  - amdgpu: update gc 10.3.7 firmware
  - linux-firmware: mediatek: Update MT8173 VPU firmware to v1.1.9
  - Merge https://github.com/pkshih/linux-firmware into rtw
  - ath10k: WCN3990: hw1.0: add qcm2290 firmware API file
  - ath10k: WCN3990: hw1.0: move firmware back from qcom/ location
  - i915: Add DG2 HuC 7.10.15
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - linux-firmware: update firmware for en8811h 2.5G ethernet phy
  - mekdiatek: Update mt8186 SOF firmware to v2.0.1
  - rtw89: 8852c: update fw to v0.27.56.14
  - rtw89: 8922a: add firmware v0.35.18.0
  - rtw88: Add RTL8703B firmware v11.0.0
  - linux-firmware: Add firmware for Cirrus CS35L56 for Dell laptops
  - Montage: update firmware for Mont-TSSE
  - WHENCE: Link the Raspberry Pi CM4 and 5B to the 4B
  - Intel Bluetooth: Update firmware file for Intel Bluetooth BE200
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX210
  - Intel Bluetooth: Update firmware file for Intel Bluetooth AX200
  - Intel Bluetooth: Update firmware file for Intel Bluetooth AX201
  - Intel Bluetooth: Update firmware file for Intel Bluetooth 9560
  - Intel Bluetooth: Update firmware file for Intel Bluetooth 9260
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - linux-firmware: mediatek: Update MT8173 VPU firmware to v1.1.8
  - imx: sdma: update firmware to v3.6/v4.6
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7921)
  - iwlwifi: update 9000-family firmwares to core85-89
  - rtl_bt: Update RTL8852A BT USB firmware to 0xD9D6_17DA
  - linux-firmware: update firmware for MT7921 WiFi device
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
  - linux-firmware: update firmware for MT7922 WiFi device
  - linux-firmware: Add CS35L41 HDA Firmware for Lenovo Thinkbook 16P Laptops
  - amdgpu: Update VCN firmware binaries
  - Intel IPU2: Add firmware files
  - brcm: Add nvram for the Acer Iconia One 7 B1-750 tablet
  - i915: Add Xe2LPD DMC v2.18
  - i915: Update MTL DMC v2.21
  - linux-firmware: update firmware for en8811h 2.5G ethernet phy
  - linux-firmware: add firmware for MT7996
  - xe: First GuC release for LNL and Xe
  - i915: Add GuC v70.20.0 for ADL-P, DG1, DG2, MTL and TGL
  - linux-firmware: Add CS35L41 firmware for Lenovo Legion 7i gen7 laptop (16IAX7)
  - brcm: Add nvram for the Asus Memo Pad 7 ME176C tablet
  - ice: update ice DDP package to 1.3.36.0
  - Intel IPU3 ImgU: Move firmware file under intel/ipu
  - Intel IPU6: Move firmware binaries under ipu/
  - check_whence: Add a check for duplicate link entries
  - WHENCE: Clean up section separators
  - linux-firmware: Add CS35L41 firmware for additional ASUS Zenbook 2023 models
  - panthor: Add initial firmware for Gen10 Arm Mali GPUs
  - amdgpu: DMCUB Updates for DCN321: 7.0.38.0
  - amdgpu: DMCUB updates for Yellow Carp: 4.0.68.0
  - qcom: update venus firmware file for v5.4
  - Montage: add firmware for Mont-TSSE
  - amdgpu: update DMCUB to v0.0.203.0 for DCN314 and DCN32
  - linux-firmware: Remove 2 HP laptops using CS35L41 Audio Firmware
  - linux-firmware: Fix filenames for some CS35L41 firmwares for HP
  - linux-firmware: wilc1000: update WILC1000 firmware to v16.1.2
  - rtl_nic: add firmware for RTL8126A
  - linux-firmware: intel: Add IPU6 firmware binaries
  - ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.37
  - qcom: Add Audio firmware for SM8550 HDK
  - Merge tag 'amd-2024-01-30.2' into mlimonci/amd-2024-01-30.2
  - Revert "amdgpu: DMCUB updates for various AMDGPU ASICs"
  - amdgpu: update SMU 13.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - brcm: Add brcmfmac43430-sdio.xxx.txt nvram for the Chuwi Hi8 (CWI509) tablet
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - qcom: Add Audio firmware for SM8650 MTP
  - linux-firmware: Add firmware for Cirrus CS35L41 on HP Consumer Laptops
  - Intel Bluetooth: Make spacing consistent with rest of WHENCE
  - amdgpu: update raven2 firmware
  - amdgpu: update raven firmware
  - amdgpu: update SDMA 5.2.7 firmware
  - amdgpu: update PSP 13.0.8 firmware
  - amdgpu: update VCN 3.1.2 firmware
  - amdgpu: update SDMA 5.2.6 firmware
  - amdgpu: update PSP 13.0.5 firmware
  - amdgpu: update GC 10.3.6 firmware
  - amdgpu: add GC 11.0.1 rlc_1 firmware
  - amdgpu: update vega20 firmware
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: update SMU 13.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update picasso firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update PSP 13.0.11 firmware
  - amdgpu: update GC 11.0.4 firmware
  - amdgpu: update VCN 4.0.2 firmware
  - amdgpu: update PSP 13.0.4 firmware
  - amdgpu: update GC 11.0.1 firmware
  - amdgpu: update arcturus firmware
  - amdgpu: update navi14 firmware
  - amdgpu: add VCN 4.0.3 firmware
  - amdgpu: add SDMA 4.4.2 firmware
  - amdgpu: add SMU 13.0.6 firmware
  - amdgpu: add PSP 13.0.6 firmware
  - amdgpu: Add GC 9.4.3 firmware
  - amdgpu: update renoir firmware
  - amdgpu: update VCN 4.0.4 firmware
  - amdgpu: update SMU 13.0.7 firmware
  - amdgpu: update PSP 13.0.7 firmware
  - amdgpu: update GC 11.0.2 firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update SMU 13.0.10 firmware
  - amdgpu: update SDMA 6.0.3 firmware
  - amdgpu: update PSP 13.0.10 firmware
  - amdgpu: update GC 11.0.3 firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update aldebaran firmware
  - linux-firmware: Update AMD cpu microcode
  - RTL8192E: Remove old realtek WiFi firmware
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX101
  - Intel Bluetooth: Update firmware file for Magnetor Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX203
  - Intel Bluetooth: Update firmware file for SolarF Intel Bluetooth AX211
  - Intel Bluetooth: Update firmware file for Solar Intel Bluetooth AX211
  - amdgpu: DMCUB updates for DCN314
  - qcom: Update the firmware for Adreno a630 family of GPUs
  - cirrus: Add CS35L41 firmware for Legion Slim 7 Gen 8 laptops
  - linux-firmware: Add firmware for Cirrus CS35L41 for various Dell laptops
  - linux-firmware: update firmware for qat_4xxx devices
  Resolves: RHEL-35596, RHEL-16799, RHEL-15607


author: Denys Vlasenko <dvlasenk@redhat.com> - 20240715-123.git4c8fb21e
changelog:
  - [Intel 8.10 FEAT] [SRF] QAT_402XX firmware update (RHEL-47353)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - qcom: move signed x1e80100 signed firmware to the SoC subdir
  - qcom: add video firmware file for vpu-3.0
  - amdgpu: update DMCUB to v0.0.225.0 for Various AMDGPU Asics
  - qcom: add gpu firmwares for x1e80100 chipset
  - linux-firmware: add firmware for qat_402xx devices
  - amdgpu: update raven firmware
  - amdgpu: update SMU 13.0.10 firmware
  - amdgpu: update SDMA 6.0.3 firmware
  - amdgpu: update PSP 13.0.10 firmware
  - amdgpu: update GC 11.0.3 firmware
  - amdgpu: update vega20 firmware
  - amdgpu: update PSP 13.0.5 firmware
  - amdgpu: update PSP 13.0.8 firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: update SDMA 6.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - amdgpu: update picasso firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update PSP 13.0.11 firmware
  - amdgpu: update GC 11.0.4 firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update VCN 4.0.2 firmware
  - amdgpu: update SDMA 6.0.1 firmware
  - amdgpu: update PSP 13.0.4 firmware
  - amdgpu: update GC 11.0.1 firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update VPE 6.1.1 firmware
  - amdgpu: update VCN 4.0.6 firmware
  - amdgpu: update SDMA 6.1.1 firmware
  - amdgpu: update PSP 14.0.1 firmware
  - amdgpu: update GC 11.5.1 firmware
  - amdgpu: update VCN 4.0.5 firmware
  - amdgpu: update SDMA 6.1.0 firmware
  - amdgpu: update PSP 14.0.0 firmware
  - amdgpu: update GC 11.5.0 firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update renoir firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update PSP 13.0.6 firmware
  - amdgpu: update GC 9.4.3 firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update VCN 4.0.4 firmware
  - amdgpu: update SMU 13.0.7 firmware
  - amdgpu: update SDMA 6.0.2 firmware
  - amdgpu: update PSP 13.0.7 firmware
  - amdgpu: update GC 11.0.2 firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update raven2 firmware
  - amdgpu: update aldebaran firmware
  - linux-firmware: Update AMD cpu microcode
  - intel: avs: Add topology file for I2S Analog Devices 4567
  - intel: avs: Add topology file for I2S Nuvoton 8825
  - intel: avs: Add topology file for I2S Maxim 98927
  - intel: avs: Add topology file for I2S Maxim 98373
  - intel: avs: Add topology file for I2S Maxim 98357a
  - intel: avs: Add topology file for I2S Dialog 7219
  - intel: avs: Add topology file for I2S Realtek 5663
  - intel: avs: Add topology file for I2S Realtek 5640
  - intel: avs: Add topology file for I2S Realtek 5514
  - intel: avs: Add topology file for I2S Realtek 298
  - intel: avs: Add topology file for I2S Realtek 286
  - intel: avs: Add topology file for I2S Realtek 274
  - intel: avs: Add topology file for Digital Microphone Array
  - intel: avs: Add topology file for HDMI codecs
  - intel: avs: Add topology file for HDAudio codecs
  - Add a copy of Apache-2.0
  - intel: avs: Update AudioDSP base firmware for APL-based platforms
  - linux-firmware: Add ISH firmware file for Intel Lunar Lake platform
  - amdgpu: update DMCUB to v0.0.224.0 for Various AMDGPU Asics
  - cirrus: cs35l41: Update various firmware for ASUS laptops using CS35L41
  - amdgpu: Update ISP FW for isp v4.1.1
  - linux-firmware: mediatek: Update MT8173 VPU firmware to v1.2.0
  - qcom: Add AIC100 firmware files
  - amlogic: Update bluetooth firmware binary
  - linux-firmware: Update firmware file for Intel BlazarU core
  - linux-firmware: Update firmware file for Intel Bluetooth Magnetor core
  - linux-firmware: Update firmware file for Intel Bluetooth Solar core
  - linux-firmware: Update firmware file for Intel Bluetooth Pulsar core
  - rtl_bt: Update RTL8822C BT UART firmware to 0xB5D6_6DCB
  - rtl_bt: Update RTL8822C BT USB firmware to 0xAED6_6DCB
  - amdgpu: update DMCUB to v0.0.222.0 for DCN314
  - iwlwifi: add ty/So/Ma firmwares for core88-87 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core88-87 release
  - linux-firmware: add new cc33xx firmware for cc33xx chips
  - cirrus: cs35l56: Update firmware for Cirrus CS35L56 for ASUS UM5606 laptop
  - cirrus: cs35l56: Update firmware for Cirrus CS35L56 for various ASUS laptops
  - Merge https://github.com/zijun-hu/qca_btfw into qca
  Resolves: RHEL-47353


author: Denys Vlasenko <dvlasenk@redhat.com> - 20240827-141.git3cff7109
changelog:
  - AMD SEV: IOMMU improperly handles certain special address leading to a loss of guest integrity (RHEL-54256)
  - AMD SEV: Incomplete system memory cleanup in SEV firmware corrupt guest private memory (RHEL-54237)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - amdgpu: DMCUB updates forvarious AMDGPU ASICs
  - rtw89: 8922a: add fw format-1 v0.35.41.0
  - linux-firmware: update firmware for MT7925 WiFi device
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7925)
  - rtl_bt: Add firmware and config files for RTL8922A
  - rtl_bt: Add firmware file for the the RTL8723CS Bluetooth part
  - rtl_bt: de-dupe identical config.bin files
  - rename rtl8723bs_config-OBDA8723.bin -> rtl_bt/rtl8723bs_config.bin
  - linux-firmware: Update AMD SEV firmware
  - linux-firmware: update firmware for MT7996
  - Revert "i915: Update MTL DMC v2.22"
  - Merge tag 'amd-2024-08-12' of https://gitlab.freedesktop.org/drm/firmware into amd-2024-08-12
  - ath12k: WCN7850 hw2.0: update board-2.bin
  - ath11k: WCN6855 hw2.0: update to WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.41
  - ath11k: WCN6855 hw2.0: update board-2.bin
  - ath11k: QCA2066 hw2.1: add to WLAN.HSP.1.1-03926.13-QCAHSPSWPL_V2_SILICONZ_CE-2.52297.3
  - ath11k: QCA2066 hw2.1: add board-2.bin
  - ath11k: IPQ5018 hw1.0: update to WLAN.HK.2.6.0.1-01291-QCAHKSWPL_SILICONZ-1
  - qcom: vpu: add video firmware for sa8775p
  - amdgpu: DMCUB updates for various AMDGPU ASICs
  - qcom: update path for video firmware for vpu-1/2/3.0
  - Merge https://github.com/zijun-hu/qca_btfw into qca_btfw
  - Merge tag 'rtw-fw-2024-08-08' of https://github.com/pkshih/linux-firmware into rtw89
  - QCA: Update Bluetooth WCN685x 2.1 firmware to 2.1.0-00642
  - rtw89: 8852c: add fw format-1 v0.27.97.0
  - rtw89: 8852bt: add firmware 0.29.91.0
  - amdgpu: Update ISP FW for isp v4.1.1
  - Merge tag 'intel-2024-08-02' of https://gitlab.freedesktop.org/drm/firmware into intel-20240805
  - Merge https://github.com/zijun-hu/qca_btfw into list-20240802
  - mediatek: Update mt8195 SOF firmware
  - Merge tag 'amd-2024-08-02' of https://gitlab.freedesktop.org/drm/firmware into amd-20240802
  - amdgpu: DMCUB updates for DCN314
  - xe: First GuC release v70.29.2 for BMG
  - xe: Add GuC v70.29.2 for LNL
  - i915: Add GuC v70.29.2 for ADL-P, DG1, DG2, MTL, and TGL
  - i915: Update MTL DMC v2.22
  - i915: update MTL GSC to v102.0.10.1878
  - xe: Add BMG HuC 8.2.10
  - xe: Add GSC 104.0.0.1161 for LNL
  - xe: Add LNL HuC 9.4.13
  - i915: update DG2 HuC to v7.10.16
  - amdgpu: Update ISP FW for isp v4.1.1
  - amdgpu: Update ISP FW for isp v4.1.1
  - amdgpu: add new ISP 4.1.1 firmware
  - QCA: Update Bluetooth QCA2066 firmware to 2.1.0-00641
  - amdgpu: update DMCUB to v0.0.227.0 for DCN35 and DCN351
  - Merge tag 'iwlwifi-fw-2024-07-25' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/iwlwifi/linux-firmware into iwlfifi-fw-2024-07
  - Revert "iwlwifi: update ty/So/Ma firmwares for core89-58 release"
  - linux-firmware: update firmware for MT7922 WiFi device
  - linux-firmware: update firmware for MT7921 WiFi device
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7922)
  - linux-firmware: update firmware for mediatek bluetooth chip (MT7921)
  - iwlwifi: add gl FW for core89-58 release
  - iwlwifi: update ty/So/Ma firmwares for core89-58 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core89-58 release
  - mediatek: Update mt8195 SOF firmware and sof-tplg
  - ASoC: tas2781: fix the license issue for tas781 firmware
  - rtl_bt: Update RTL8852B BT USB FW to 0x048F_4008
  - .gitignore: Ignore intermediate files
  - i915: Update Xe2LPD DMC to v2.21
  Resolves: RHEL-54256, RHEL-54237


author: Benshuai5D <benshuai5d@163.com> - 1:1.8.0.402-b06.4
changelog:
  - add 8322725-tz-Update-Timezone-Data-to-2023d.patch
  - add 8325150-tz-Update-Timezone-Data-to-2024a.patch
  - add 8220175-serviceability-dcmd-framework-VMVersionTest..patch
  - add 8149343-assert-rp-num_q-no_of_gc_workers-failed-sani.patch
  - add 8139595-MethodHandles-remove_dependent_nmethod-is-no.patch
  - add 8143408-Crash-during-InstanceKlass-unloading-when-cl.patch
  - add GCC-12-reports-some-compiler-warnings.patch


author: Autistic_boyya <wangzhongyi7@huawei.com> -1:1.8.0.412-b08.0
changelog:
  - del 8322725-tz-Update-Timezone-Data-to-2023d.patch
  - del 8325150-tz-Update-Timezone-Data-to-2024a.patch
  - del fix-the-length-value-of-ciBlock-in-ciMethodBlocks.cp.patch
  - modified 8014628-Support-AES-Encryption-with-HMAC-SHA2-for-Ke.patch
  - modified 8057743-process-Synchronize-exiting-of-threads-and-p.patch
  - modified add-missing-test-case.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified kae-phase2.patch
  - modified support-numactl-for-hadoop-yarn.patch
  - modified update-cacerts-and-VerifyCACerts.java-test.patch


author: kuenking111 <wangkun49@huawei.com> -1:1.8.0.412-b08.3
changelog:
  - add DependencyContext-mark_dependent_nmethods-crash-in-Dynamic-cds-mode.patch
  - add 8138922-StubCodeDesc-constructor-publishes-partially-constructed.patch


author: songliyang <songliyang@kylinos.cn> -1:1.8.0.412-b08.4
changelog:
  - fix LoongArch64-support.patch error that apply patch on loongarch64 in prep stage
  - fix loongson vendor error


author: zhangxianting <zhangxianting@uniontech.com> - 1:1.8.0.412-b08.5.up2.01
changelog:
  - update: sync openeuler pr526 pr556
  - cve: CVE-2024-21085 CVE-2024-21094 CVE-2024-21011 CVE-2024-21005 CVE-2024-21068 CVE-2024-20922 CVE-2024-20918 CVE-2024-20945 CVE-2024-20952 CVE-2024-20926 CVE-2024-20925 CVE-2024-20919 CVE-2024-20921 CVE-2024-20923


author: Autistic_boyya <wangzhongyi7@huawei.com> -1:1.8.0.422-b05.rolling
changelog:
  - modified 8014628-Support-AES-Encryption-with-HMAC-SHA2-for-Ke.patch
  - modified 8136577_Make_AbortVMOnException_available_in_product_builds.patch
  - modified Dynamic-CDS-Archive.patch
  - modified add-safe-compilation-flags.patch
  - modified fix-log-bug-enhance-aes-hmac-performance.patch
  - modified fix_X509TrustManagerImpl_symantec_distrust.patch
  - modified openjdk-1.8.0.spec
  - modified update-cacerts-and-VerifyCACerts.java-test.patch
  - Add Backport-6956385-URLConnection.getLastModified-leaks-file-han.patch
  - Add Backport-7036144-GZIPInputStream-readTrailer-uses-faulty-avai.patch
  - Add Backport-8068864-C2-failed-modified-node-is-not-on-IGVN._work.patch
  - Add Backport-8151845-Comment-in-globals.hpp-for-MetaspaceSize-is-.patch
  - Add Backport-8209362-sun-security-ssl-SSLSocketImpl-ReuseAddr.jav.patch
  - Add Backport-8210706-G1-may-deadlock-when-starting-a-concurrent-c.patch
  - Add Backport-8318889-Backport-Important-Fixed-Issues-in-Later-Ver.patch
  - Add Huawei-Add-Aggressive-CDS.patch
  - Add Huawei-Keep-objects-when-remove-unshareable-info.patch
  - Add Huawei-improve-GCTR-performance.patch


author: zengwei <zengwei1@uniontech.com> - 1:1.8.0.422-b05.up2.01
changelog:
  - update: sync openeuler pr584
  - cve: CVE-2024-21131 CVE-2024-21138 CVE-2024-21140 CVE-2024-21144 CVE-2024-21145 CVE-2024-21147


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-10
changelog:
  - weak-modules: group modules on add-kernel
  - weak-modules: do not make groups if there are no extra modules
    Resolves: rhbz#1649211


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-16
changelog:
  - weak-modules: update_modules_for_krel: always finish sandbox
  - weak-modules: groupping: use dependencies of extra/ provider
    Resolves: rhbz#1778889


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.72-79
changelog:
  - Fixed a bug which could result in the UDS index issuing I/O while
    suspended.
  - Resolves: rhbz#1990180


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.3-83
changelog:
  - Adjusted kernel dependencies to grab the right packages.
  - Resolves: rhbz#2011426
  - Rebuilt for latest kernel.
  - Relates: rhbz#2000909


author: Bin Hu<hubin73@huawei.com> -1:0.9.1-21.04
changelog:
  - Type:bugfix
  - ID:NA
  - SUG:NA
  - DESC:kpatch-build: fix gcc version check when using OOT_MODULE
         already fixed in 9000


author: Julien Rische <jrische@redhat.com> - 1.18.2-21
changelog:
  - Backport fix of memory use after free during libkrad cleanup
  - Backport support for larger RADIUS attributes in libkrad
  - Resolves: rhbz#2103125


author: Julien Rische <jrische@redhat.com> - 1.18.2-27
changelog:
  - Fix memory leak in GSSAPI interface
    Resolves: RHEL-27250
  - Fix memory leak in PMAP RPC interface
    Resolves: RHEL-27244
  - Make TCP waiting time configurable
    Resolves: RHEL-17131


author: Julien Rische <jrische@redhat.com> - 1.18.2-29.01
changelog:
  - CVE-2024-37370 CVE-2024-37371
    Fix vulnerabilities in GSS message token handling
    Resolves: RHEL-45398 RHEL-45386
  - Fix leak of default credentials in gss_inquire_cred()
    Resolves: RHEL-32258


author: José Expósito <jexposit@redhat.com> - 1.7.0-9
changelog:
  - Fix CVE-2023-43785: out-of-bounds memory access in _XkbReadKeySyms()
  - Fix CVE-2023-43786: stack exhaustion from infinite recursion in
    PutSubImage()
  - Fix CVE-2023-43787: integer overflow in XCreateImage() leading to
    a heap overflow


author: Zoltan Fridrich <zfridric@redhat.com> - 2.26-5
changelog:
  - added CAP_PERFMON, CAP_BPF and CAP_CHECKPOINT_RESTORE capabilities
    resolves: rhbz#1946982 rhbz#1921576


author: Zoltan Fridrich <zfridric@redhat.com> - 2.48-2
changelog:
  - rebase to 2.48
    resolves: rhbz#2032813
  - fix ambient capabilities for non-root users
    resolves: rhbz#1950187


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-4
changelog:
  - Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
    Rebuild against rebased Samba libs


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.1-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
  - Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
  - Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
  - Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
  - Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
  - Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
  - Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
  - Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
  - Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.2-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
  - Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.3-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
  - Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
  - Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
  - Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
  - Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
  - Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
  - Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
  - Resolves: RHEL-10721 - very bad performance when requesting service tickets
  - Resolves: RHEL-19011 - Invalid handling groups from child domain
  - Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-2
changelog:
  - Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
  - Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
  - Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-3
changelog:
  - Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently


author: lichao <lichaod@uniontech.com> - 2.9.4-3.01
changelog:
  - fix: adjust sssd service to speed up system-booting (bugid:240631)
  - fix: sssd service failed (bugid:240325)
  - fix: add default conf file at /etc/sssd/ (bugid:197047)


author: Michal Ruprich <michalruprich@gmail.com> - 14:1.9.1-1
changelog:
  - Resolves: #1806422 - rebase libpcap to version 1.9.1
  - Resolves: #1743650 - [RFE] enable inbox support for sniffing offloaded (RDMA) traffic with tcpdump
  - Resolves: #1785330 - Invalid IPv4 addresses are accepted without reporting even a warning
  - Resolves: #1792208 - Resource exhaustion while PHB header length validation


author: Dan Winship <danw@redhat.com> - 0.4.15-5.1
changelog:
  - Drop python2 subpackage (#1559092)
  - Drop PAC runner based on the "pacrunner" package (#1569023)
  - Replace pacrunner-crash-fix patch with version from RHEL7
  - Drop kde subpackage (#1538147)


author: Paul Wouters <pwouters@redhat.com> - 4.3-3
changelog:
  - Resolves: rhbz#1933064 - IKEv2 support for Labeled IPsec
  - Resolves: rhbz#1935150 RFE: Support IKE and ESP over TCP: RFC 8229
  - Resolves: rhbz#1935339 virtual_private setting is missing in the default config


author: Daiki Ueno <dueno@redhat.com> - 4.4-1
changelog:
  - Resolves: rhbz#1958968 Rebase libreswan to 4.4
  - Resolves: rhbz#1954423 Libreswan: TS_UNACCEPTABLE on multiple connections between the same peers


author: Daiki Ueno <dueno@redhat.com> - 4.5-1
changelog:
  - Resolves: rhbz#2017352 Rebase libreswan to 4.5
  - Resolves: rhbz#2036903 ikev1: disable diagnostics logging on receiving malformed packets


author: Daiki Ueno <dueno@redhat.com> - 4.9-1
changelog:
  - Resolves: rhbz#2128672 Rebase libreswan to 4.9
  - Remove libreswan-4.4-ikev1-disable-diagnostics.patch no longer necessary


author: Daiki Ueno <dueno@redhat.com> - 4.9-2
changelog:
  - Fix CVE-2023-23009: remote DoS via crafted TS payload with an
    incorrect selector length (rhbz#2186127)


author: Sahana Prasad <sahana@redhat.com> - 4.9-3
changelog:
  - Fix CVE-2023-30570: Malicious IKEv1 Aggressive Mode packets can crash
    libreswan
  - Resolves: rhbz#2187179


author: maqi <maqi@uniontech.com> - 4.9-3.01
changelog:
  - rebrand: add rebrand-to-uos.patch
  - spec: Set value for DEFAULT_DNSSEC_ROOTKEY_FILE to solve build error


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-10
changelog:
  - fix CVE-2018-19661 and CVE-2018-19662 - buffer over-read in the function
    i2alaw_array in alaw (#1673085)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-11
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985028)


author: Milan Crha <mcrha@redhat.com> - 2.62.2-1
changelog:
  - Update to 2.62.2
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c:get_cookies() on empty hostnames


author: Tomas Popela <tpopela@redhat.com> - 2.62.3-6
changelog:
  - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends of header names
  - Backport upstream patch for CVE-2024-52530 - infinite loop while reading websocket data
  - Resolves: RHEL-67076
  - Resolves: RHEL-67067


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.62.3-7
changelog:
  - Backport upstream patch for CVE-2024-52531 - buffer overflow via UTF-8 conversion in soup_header_parse_param_list_strict
    Resolves: RHEL-76376


author: Tomas Popela <tpopela@redhat.com> - 2.62.3-6
changelog:
  - Backport upstream patch for CVE-2024-52530 - HTTP request smuggling via stripping null bytes from the ends of header names
  - Backport upstream patch for CVE-2024-52532 - infinite loop while reading websocket data
  - Resolves: RHEL-67076
  - Resolves: RHEL-67067


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.62.3-8
changelog:
  - Backport patches for various CVEs, plus test improvements
    Resolves: RHEL-85887
    Resolves: RHEL-85900
    Resolves: RHEL-85901
    Resolves: RHEL-87039
    Resolves: RHEL-87094
    Resolves: RHEL-87114
    Resolves: RHEL-88348
    Resolves: RHEL-88351


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.62.3-9
changelog:
  - Add patches to improve test reliability
  - Backport patches for various CVEs
    Resolves: RHEL-85879
    Resolves: RHEL-92280
    Resolves: RHEL-93031
    Resolves: RHEL-93032


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-6
changelog:
  - Enable client and server testing build time
  - Fix failing rekey test on arch s390x
  - Resolves: rhbz#2126342


author: Liwei Ge <liwei.glw@alibaba-inc.com> - 0.9.6-7
changelog:
  - NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)
  - authorization bypass in pki_verify_data_signature (CVE-2023-2283)


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-6
changelog:
  - Fix CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570 CVE-2022-3598
    CVE-2022-3627
  - Resolves: CVE-2022-3597 CVE-2022-3626 CVE-2022-3599 CVE-2022-3570
    CVE-2022-3598 CVE-2022-3627


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-8
changelog:
  - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
    CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798 CVE-2023-0799
    CVE-2022-48281
  - Resolves: CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803
    CVE-2023-0804 CVE-2023-0795 CVE-2023-0796 CVE-2023-0797 CVE-2023-0798
    CVE-2023-0799 CVE-2022-48281


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-10
changelog:
  - Fix CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576
  - Resolves: CVE-2023-26965 CVE-2023-3316 CVE-2023-26966 CVE-2023-3576


author: Matej Mužila <mmuzila@redhat.com> - 4.4.0-11
changelog:
  - Fix CVE-2023-40090 CVE-2023-3618 CVE-2023-40745 CVE-2023-41175
  - Resolves: RHEL-5458 RHEL-5455 RHEL-5405 RHEL-5450


author: Matej Mužila <mmuzila@redhat.com> 4.4.0-2
changelog:
  - Update to version 4.4.0
  - Resolves: CVE-2022-0561 CVE-2022-0562 CVE-2022-22844 CVE-2022-0865
    CVE-2022-0891 CVE-2022-0924 CVE-2022-0909 CVE-2022-0908 CVE-2022-1354
    CVE-2022-1355


author: mahailiang <mahailiang@uniontech.com> - 2.9.0-9.01
changelog:
  - build: add udisks-mount-patch-changes.patch
  - spec: Modify redhat-rpm-config to uos-rpm-config and /media instead of /run/media


author: Wim Taymans <wtaymans@redhat.com> - 1.7.0-7
changelog:
  - Fix for CVE-2019-9232, CVE-2019-9433, CVE-2019-9371, CVE-2019-2126
  - Resolves: rhbz#1796086, rhbz#1796100, rhbz#1796448, rhbz#1796454
  - Remove php-cli BR


author: zengwei <zengwei1@uniontech.com> - 1.7.0-11.0.1.01
changelog:
  - Add patch to fix integer overflows.
  - Fix compilation by including limits.h
  - Resolves: RHEL-40650
  - fix: fix CVE-2024-5197 CVE-2023-6349


author: Funda Wang <fundawang@yeah.net> - 2.9.10-43
changelog:
  - Type:CVE
  - CVE:CVE-2024-56171
  - CVE:CVE-2025-24928
  - CVE:CVE-2025-27113
  - SUG:NA
  - DESC: fix CVE-2024-56171, CVE-2025-24928, CVE-2025-27113


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 0:1.5.22-2.0.1
changelog:
  - Fix glibc2.32 build issue for better compatible with both glibc2.28 and glibc2.32
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 and gcc8 build


author: Lubos Uhliarik <luhliari@redhat.com> - 2.9.2-9
changelog:
  - Resolves: #1824859 - RFE: Add a feature that can set a mod_security/libcurl
    timeout for retrieving the rules


author: Bob Relyea <rrelyea@redhat.com> - 3.90.0-4
changelog:
  - FIPS review changes
  -   add PORT_SafeZero to avoid compiler optimizing a way zeroing memory.
  -   update the indicators for this release
  -   allow hashing of longer than int32 values in a single PKCS #11 call.


author: Bob Relyea <rrelyea@redhat.com> - 3.90.0-5
changelog:
  - Pick up validated constant time implementations of p256, p384, and p521
    from upsream
  - More Fips indicator changes


author: Bob Relyea <rrelyea@redhat.com> - 3.101.0-2
changelog:
  - Fix MD-5 decode issue in pkcs #12
  - turn off policy processing for pkcs12 and smime
  - update the restore defaults for pkcs12


author: Bob Relyea <rrelyea@redhat.com> - 3.101.0-6
changelog:
  - fix param encoding in pkcs12 pbamac encoding
  - add support for certificate compression in selfserv and tstclient


author: Zhao Hang <wb-zh951434@alibaba-inc.com> - 3.101.0-7.01
changelog:
  - disable unit test
  - cherry-pick `add sw patch #ce8dbcf775a1bf3d6bd0d5de53d3688e7caa00db`. (nijie@wxiat.com)


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-5
changelog:
  - FIPS 140-3 changes
  -  Reject Small RSA keys, 1024 bit keys are marked as FIP OK when verifying, reject
     signature keys by policy
  -  Allow applications to retrigger selftests on demand.


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-8
changelog:
  - Update fips default for pk12util to AES rather than TDES
  - Fix bug in pkcs12 files with null passwords


author: Bob Relyea <rrelyea@redhat.com> - 3.79.0-10
changelog:
  - Fix QA found failures:
  -  remove extra '+' from sslpolicy.txt file causing test error values
  -  only use GRND_RANDOM if the kernel is in FIPS mode.


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 6.8.2-2.4
changelog:
  - Fix CVE-2019-13224
    Resolves: RHEL-20648
  - Fix CVE-2019-16163
    Resolves: RHEL-20642
  - Fix CVE-2019-19012
    Resolves: RHEL-20636
  - Fix CVE-2019-19203
    Resolves: RHEL-20630
  - Fix CVE-2019-19204
    Resolves: RHEL-20624


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.2.5-2.el8
changelog:
  - ovt-Fix-a-memory-leak-reported-by-a-partner-from-their-C.patch [bz#1935807]
  - Resolves: bz#1935807
    ([ESXi][RHEL-8.5][open-vm-tools] Coverity detected an important defect in open-vm-tools-11.2.5 rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 11.3.0-1.el8
changelog:
  - Rebase to open-vm-tools 11.3.0 [bz#1974468]
  - Resolves: bz#1974468
    ([ESXi][RHEL8]Open-vm-tools release 11.3.0 has been released - please rebase)


author: Miroslav Rezanian <mrezanin@redhat.com> - 11.3.5-1
changelog:
  - Rebase to open-vm-tools 11.3.5 [bz#2008244]
  - Resolves: bz#2008244
    ([ESXi][RHEL8]Open-vm-tools release 11.3.5 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.0.0-1
changelog:
  - Rebase to open-vm-tools 12.0.0 [bz#2061189]
  - Resolves: bz#2061189
    ([ESXi][RHEL8]Open-vm-tools release 12.0.0 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.0.5-1
changelog:
  - Rebase to open-vm-tools 12.0.5 [bz#2090273]
  - Resolves: bz#2090273
    ([ESXi][RHEL8]Open-vm-tools release 12.0.5 has been released - please rebase)


author: Jon Maloy <jmaloy@redhat.com> - 12.0.5-2
changelog:
  - ovt-Properly-check-authorization-on-incoming-guestOps-re.patch [bz#2119284]
  - Resolves: bz#2119284
    (CVE-2022-31676 open-vm-tools: local root privilege escalation in the virtual machine [rhel-8.7.0])


author: Miroslav Rezanina <mrezanin@redhat.com> 12.1.0-1
changelog:
  - Rebase to open-vm-tools 12.1.0
  - Resolves: bz#2121196
    ([ESXi][RHEL8]Open-vm-tools release 12.1.0 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> 12.1.5-1
changelog:
  - Rebase to open-vm-tools 12.1.5 [bz#2150188]
  - Resolves: bz#2150188
    (ESXi][RHEL8]Open-vm-tools release 12.1.5 has been released - please rebase)


author: Jon Maloy <jmaloy@redhat.com> - 12.1.5-2
changelog:
  - ovt-Remove-some-dead-code.patch [bz#2217083]
  - Resolves: bz#2217083
    ([CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module [rhel-8.8.0.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.1.5-3
changelog:
  - ovt-VGAuth-Allow-only-X509-certs-to-verify-the-SAML-toke.patch [RHEL-3073]
  - Resolves: RHEL-3073
    (CVE-2023-20900 open-vm-tools: SAML token signature bypass [rhel-8.8.0.z])


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.0-1
changelog:
  - Rebase to open-vm-tools 12.2.0 [bz#2177068]
  - Resolves: bz#2177068
    ([ESXi][RHEL8]open-vm-tools version 12.2.0 has been released - please rebase)


author: Jon Maloy <jmaloy@redhat.com> - 12.2.0-3
changelog:
  - ovt-Remove-some-dead-code.patch [bz#2215563]
  - Resolves: bz#2215563
    ([CISA Major Incident] CVE-2023-20867 open-vm-tools: authentication bypass vulnerability in the vgauth module [rhel-8])


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.5-1
changelog:
  - Rebase to open-vm-tools 12.2.5 [bz#2214861]
  - Resolves: bz#2214861
    ([ESXi][RHEL8]open-vm-tools version 12.2.5 has been released - please rebase)
  - Resolves: bz#2216415
    ([ESXi][RHEL8] URL in service unit files are started from http instead of https)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.5-2.el8_9
changelog:
  - ovt-VGAuth-Allow-only-X509-certs-to-verify-the-SAML-toke.patch [bz#2236543]
  - Resolves: bz#2236543
    (CVE-2023-20900 open-vm-tools: SAML token signature bypass [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 12.2.5-3.el8_9
changelog:
  - ovt-Provide-alternate-method-to-allow-expected-pre-froze.patch [RHEL-2447]
  - Resolves: RHEL-2447
    ([RHEL8.9][ESXi]Latest version of open-vm-tools breaks VM backups)


author: Miroslav Rezanina <mrezanin@redhat.com> - 12.2.5-3.1
changelog:
  - ovt-Don-t-accept-tokens-with-unrelated-certs.patch [RHEL-14648]
  - ovt-File-descriptor-vulnerability-in-the-open-vm-tools-v.patch [RHEL-14682]
  - Resolves: RHEL-14648
    (CVE-2023-34058 open-vm-tools: SAML token signature bypass [rhel-8.9.0])
  - Resolves: RHEL-14682
    (CVE-2023-34059 open-vm-tools: file descriptor hijack vulnerability in the vmware-user-suid-wrapper [rhel-8.9.0])


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-4
changelog:
  - Unbreak the Dual CAC cards in PIV driver (#1651748)
  - Fix few more corner cases for handling different types of padding (#1595626)
  - Unbreak signature verification in pkcs11-tool (#1651748)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-6
changelog:
  - Add support for Gemalto IDPrime smart cards (#1657970)
  - Fix 2k RSA key operations with Coolkey (#1766712)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-3
changelog:
  - Support PIN change for HID Alt tokens (#1830901)
  - Fix CVE-2020-26570, CVE-2020-26571 and CVE-2020-26572
  - Fix right padding of token labels of some cards (#1877973)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-5
changelog:
  - Avoid potential crash because of missing list terminator (#2196234)
  - Fix CVE-2023-2977: potential buffer overrun in pkcs15 cardos_have_verifyrc_package (#2211093)
  - Backport upstream changes regarding to reader removal (#2097048)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-7
changelog:
  - Fix file caching with different offsets (RHEL-4077)
  - Fix CVE-2023-40660: Potential PIN bypass
  - Fix CVE-2023-40661: Dynamic analyzers reports in pkcs15init
  - Fix CVE-2023-5992: Marvin: Side-channel leaks while stripping encryption PKCS#1.5 padding


author: Nathan Scott <nathans@redhat.com> - 5.3.7-17
changelog:
  - Harden pmdaopenmetrics metric name validator (BZ 2139325)
  - Fix issues in pmdanfsclient srcport handling (BZ 2150889)


author: Nathan Scott <nathans@redhat.com> - 5.3.7-18
changelog:
  - Improve pmproxy handling large HTTP requests (BZ 2159207)
  - Fix hacluster metrics with current Pacemaker (BZ 2219731)
  - Ensure pmcd.conf not needlessly over written (BZ 2211263)


author: Nathan Scott <nathans@redhat.com> - 5.3.7-19
changelog:
  - Fix OpenMetrics PMDA mishandling systemd metrics (RHEL-7507)
  - Additional pmlogger_farm service SELinux policy (RHEL-7501)


author: Nathan Scott <nathans@redhat.com> - 5.3.7-21
changelog:
  - Fix python API day-of-year out of range bug (RHEL-29708)
  - Added spec deps on ps and diffutils for diff (RHEL-17081)


author: Nathan Scott <nathans@redhat.com> - 5.3.7-22
changelog:
  - Fix buffer sizing checks in pmstore PDU handling (RHEL-57796)
  - Guard against symlink attacks in pmpost program (RHEL-57799)
  - Fix libpcp_web webgroup slow request refcounting (RHEL-58002)
  - Update pmdahacluster for newer crm_mon versions (RHEL-57788)


author: Nathan Scott <nathans@redhat.com> - 5.3.5-8
changelog:
  - Fix pcp-zeroconf logger interval override regression (BZ 1991763)
  - Remove warnings from spec setup of PCP systemd units (BZ 2048024)


author: Nathan Scott <nathans@redhat.com> - 5.3.7-1
changelog:
  - Fix several issues in the pcp-ss(1) utility (BZ 1981886)
  - Document pmproxy archive discovery further (BZ 2026726)
  - Improve SQL Server PMDA secure settings (BZ 2057615)
  - Rebase to latest stable version of PCP (BZ 2059461)


author: Nathan Scott <nathans@redhat.com> - 5.3.7-3
changelog:
  - Fix remaining issues in the pcp-ss(1) utility (BZ 1981886)
  - Remove benign warning message from pmie systemd unit file.


author: Nathan Scott <nathans@redhat.com> - 5.3.7-5
changelog:
  - Harden pmdapostfix(1) against missing Postfix (BZ 2059463)
  - Fix cgroups failure on non-x86_64 platforms (BZ 2081262)


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-45
changelog:
  - Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response
  Resolves: rhbz#2036020


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-46
changelog:
  - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2047376, rhbz#2060435


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-50
changelog:
  - Security fix for CVE-2022-45061
  - Strip the LTO bytecode from python.o
  Resolves: rhbz#2144072, rhbz#2137707


author: zhangbinchen <zhangbinchen@openanolis.org> - 3.6.8-51.0.1.1
changelog:
  - Add Anolis platform cherry-pick [9a96461]
  - Support Loongarch for python3
  - Fix testcase fails on loongarch64


author: lichao <lichaod@uniontech.com> - 3.6.8-51.0.1.2
changelog:
  - spec: change redhat-rpm-config to uos-rpm-config
  - rebrand: add uos platform
  - feat: add sm3 support


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-58
changelog:
  - Security fix for CVE-2022-48564
  Resolves: RHEL-16674
  - Skip tests failing on s390x
  Resolves: RHEL-19252


author: zhangbinchen <zhangbinchen@openanolis.org> - 3.6.8-62.0.1
changelog:
  - Add Anolis platform
  - Support Loongarch for python3 (songmingliang@uniontech.com)
  - Fix testcase fails on loongarch64 (geliwei@openanolis.org)
  - repair security fix for CVE-2007-4559 (sunxinpeng@inspur.com)
  - Fix CVE-2023-40217: Check for & avoid the ssl (hezhongkun@inspur.com)
  - Security fix for CVE-2022-48560 (wangkaiqiang@inspur.com)
  - Security fix for CVE-2022-48564 (wangkaiqiang@inspur.com)
  - Security fix for CVE-2023-27043 (liubo03@inspur.com)
  - cherry-pick `add sw patch #1182efa2f05c5804a55d35d45a9d72f97b64a9b2`. (Weisson@linux.alibaba.com)
    cherry-pick `sw use python of wordsize 64 #862dabb407d3f98c64f3a9d2675fcd3a6300a21f`.


author: pangqing <pangqing@uniontech.com> - 3.6.8-62.0.1.01
changelog:
  - spec: change redhat-rpm-config to uos-rpm-config
  - rebrand: add uos platform
  - feat: add sm3 support
  - feat: add sw_64 support


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-16
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  - CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  - Resolves: rhbz#1649153
  - Resolves: rhbz#1700824
  - Resolves: rhbz#1702473
  - Resolves: rhbz#1643829


author: Tomas Orsava <torsava@redhat.com> - 9.0.3-18
changelog:
  - Patch for pip install <url> allow directory traversal, leading to arbitrary file write
  - Resolves: rhbz#1868016


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-20
changelog:
  - Fix for CVE-2021-3572 - pip incorrectly handled unicode separators in git references
  - Resolves: rhbz#1962856


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-4
changelog:
  - New subpackage platform-python-setuptools without files from /usr/bin/*
  - python3-setuptools contains only files from /usr/bin/* and depends
    on platform-python-setuptools
  - Resolves: rhbz#1641973


author: Philip Kovacs <pkdevel@yahoo.com> - 2.1.0-1
changelog:
  - Update to 2.1.0
  - Added enviromnent module for pmi/pmix
  - Added pkgconfig files for pmix/pmi/pmi2
  - Ensure lexer sources are rebuilt
  - Removed obsolete sasl support
  - Use new ldconfig_scriplets macro


author: Jarod Wilson <jarod@redhat.com> - 2.1.1-2
changelog:
  - Add the --with-tests-examples flag to be able to better verify functionality
  - Related: rhbz#1682374


author: Marek Kasik <mkasik@redhat.com> - 0.66.0-25
changelog:
  - Check whether input is RGB in PSOutputDev::checkPageSlice()
  - also when using "-optimizecolorspace" flag
  - Resolves: #1697576


author: Pavel Raiskup <praiskup@redhat.com> - 42.2.0-1
changelog:
  - rebase to the latest upstream release
  - nicer github source urls
  - sync with upstream spec
  - use new postgresql testing macros (rawhide only)
  - depend on postgresql-test-rpm-macros


author: zhangkea <zhangkea@uniontech.com> - 3.4.0-10.02
changelog:
  - fix cve CVE-2019-19450 
  - Do not evaluate unichar element
  - Replace an invalid char with a correct one (rpminspect)
  - Resolves: RHEL-7008


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-1
changelog:
  - Rebase to upstream release 3.2.1
  - Resolves: rhbz#1873581
  - Resolves: rhbz#1778939
  - Removed dependencies on python-asn1crypto, python-idna


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-4
changelog:
  - CVE-2020-36242: Fixed a bug where certain sequences of update() calls
    when symmetrically encrypting very large payloads (>2GB) could result
    in an integer overflow, leading to buffer overflows.
  - Resolves: rhbz#1926528


author: Miro Hrončok <mhroncok@redhat.com> - 1.25.7-2
changelog:
  - Subpackage python2-urllib3 has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-14
changelog:
  - Fixes for CVE-2021-25290, CVE-2021-25292, CVE-2021-25293, CVE-2021-27921
  CVE-2021-27922, and CVE-2021-27923
  Resolves: rhbz#1934685 rhbz#1934699 rhbz#1934705 rhbz#1935384 rhbz#1935396 rhbz#1935401


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-15
changelog:
  - Fixes for CVE-2021-25288, CVE-2021-25287, CVE-2021-28675, CVE-2021-28676,
  CVE-2021-28677 and CVE-2021-28678
  Resolves: rhbz#1958231, rhbz#1958226, rhbz#1958240, rhbz#1958252, rhbz#1958257, rhbz#1958263


author: Charalampos Stratakis <cstratak@redhat.com> - 5.1.1-18
changelog:
  - Fixup for CVE-2022-22817
  - Security fixes for CVE-2022-22815, CVE-2022-22816
  Resolves: rhbz#2042511, rhbz#2042522


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-47
changelog:
  - Filesystem: improve stop-action and allow setting term/kill signals
    and signal_delay for large filesystems

    Resolves: rhbz#2189243


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-51
changelog:
  - aws-vpc-move-ip/aws-vpc-route53/awseip/awsvip: add auth_type parameter
    and AWS Policy based authentication type

    Resolves: RHEL-16248


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-53
changelog:
  - bundled urllib3: fix CVE-2023-45803
  - bundled pycryptodome: fix CVE-2023-52323

    Resolves: RHEL-22431, RHEL-20916


author: lichao <lichaod@uniontech.com> - 4.9.0-54.01
changelog:
  - build: use /usr/bin/ps instead of /bin/ps for 105xe
  - build: disable python bytecompilation for 105xe
  - build: fix httplib2 not found error for 105xe
  - feat: New Resource Agent for TongWeb
  - feat: Resource Agent for solution Two-node cluster brain split
  - fix: iSCSILogicalUnit: fix issue where resource was in stopped state when using allowed_initiators parameter
  - fix: podman: add podman parameter error judgment
  - build: add BuildRequires gettext


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.9.0-54.02
changelog:
  - bundled setuptools: fix CVE-2024-6345
    Resolves: RHEL-50360

  - gcp-pd-move: fix TLS_VERSION_1 issue
    Resolves: RHEL-50041

  - bundled urllib3: fix CVE-2024-37891
    Resolves: RHEL-44923

  - AWS agents: retry failed metadata requests to avoid instantly
    failing when there is a hiccup in the network or metadata service
  - db2: fix OCF_SUCESS typo
    Resolves: RHEL-34137, RHEL-32828


author: Michal Ruprich <mruprich@redhat.com> - 3.1.3-19
changelog:
  - Resolves: #2116668 - zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field


author: Peter Jones <pjones@redhat.com> - 15.5-1
changelog:
  - Update to shim-15.5
    Resolves: rhbz#1970632
    Resolves: rhbz#1982071
    Resolves: rhbz#2000946
    Resolves: rhbz#2002265


author: Peter Jones <pjones@redhat.com> - 15.5-2.el8
changelog:
  - Include the actual signed shim binaries.
    Resolves: rhbz#1970632
    Resolves: rhbz#1982071
    Resolves: rhbz#2000946
    Resolves: rhbz#2002265


author: pangqing <pangqing@uniontech.com> - 15.8-4.01
changelog:
  - cve: CVE-2023-40548 CVE-2023-40547
  - Update boot entry name to UOS Server 20
  - exclude loongarch64
  - change BR dbxtool to fwupd(bugid:168383)
  - Update boot entry name and modify dist in SOURCES/shim.rpmmacros to uelc20
  - Add UOS Secure Boot,change shimx64.efi


author: Abhi Das <adas@redhat.com> - 4.3-19
changelog:
  - rhbz#1602698 - Fix coverity issues
    rhbz#1624173 - Fix annocheck failures
    rhbz#1716278 - limit max cpus in mksquashfs
    Resolves: rhbz#1602698, rhbz#1624173, rhbz#1716278


author: Abhi Das <adas@redhat.com> - 4.3-20
changelog:
  - rhbz#1895017 - unsquashfs does not preserve file capabilities
    rhbz#1754815 - Kdump: Building kdump initramfs img may fail with 'dracut: Failed making squash image' occasionally
    Resolves: rhbz#1895017, rhbz#1754815


author: Abhi Das <adas@redhat.com> - 4.3-21
changelog:
  - CVE-2021-41072 squashfs-tools: additional write outside destination directory exploit fix
    CVE-2021-40153 squashfs-tools: unvalidated filepaths allow writing outside of destination
    Resolves: rhbz#2007303 rhbz#2000637


author: Michal Sekletár <msekleta@redhat.com> - 11.7.3-2
changelog:
  - sysstat's buildsystem doesn't really use LDFLAGS, we have to merge CFLAGS and LDFLAGS to get binaries with full RELRO (#1624177)


author: <msekleta@redhat.com> - 11.7.3-7
changelog:
  - Don't trigger autofs mounts when running sadc (#2000910)
  - sar: Add missing %gnice CPU value for tickless CPU (#2000916)
  - sadf: Fix seg fault on empty data files (#1910841)
  - sar: Fix typo in manual page (#1877836)


author: psimovec <psimovec@redhat.com> - 11.7.3-11
changelog:
  - fix the arithmetic overflow in allocate_structures() that is still possible on some 32 bit systems (CVE-2023-33204)


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-4
changelog:
  - Removing build-time dependency on sharutils(rhbz#1587877)
  - Changing git dependency to smaller git-core


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-6
changelog:
  - Resolves: #1715423 - tcpdump pre creates user and groups unconditionally
  - Resolves: #1655622 - CVE-2018-19519 Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.3-2
changelog:
  - Resolves: #1860216 - tcpdump can not parse mptcp options
  - Resolves: #1901635 - ppp decapsulator can be convinced to allocate a large amount of memory
  - Adding tedude test to gating


author: Than Ngo <than@redhat.com> - 9:20200327-19
changelog:
  - Related: #1960650, add create-clean-texlive.sh to generate clean tarball from released build tarballs, update URLs


author: maqi <maqi@unintech.com> - 9:20200406-26.01
changelog:
  - spec: Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - spec: anolis texlive add loongarch64(Yaxuan Liu)


author: maqi <maqi@uniontech.com> - 102.12.0-1.02
changelog:
  - debrand: debrand from centos
  - arch:no build loongarch64
  - arch: add support mips64el
  - add Patch10010:0001-ChengJieOS-add-cflags.patch for build error.
  - add Patch10011:0001-add-mips64el-for-libffi.patch
  - add Patch10012:0001-add-n32.S-for-MIPS.patch
  - rebrand: rename js file and update vendor
  - rebrand: add zh_CN name on thunderbird.desktop
  - spec: define rhel_minor_version 3 for uelc20 dist
  - spec: modify RPM_BUILD_ROOT for uos build.


author: Angie.J <doucaixia@uniontech.com> - 115.14.0-1.02
changelog:
  - cve: CVE-2024-7518 CVE-2024-7519 CVE-2024-7520 CVE-2024-7521 CVE-2024-7522
         CVE-2024-7525 CVE-2024-7526 CVE-2024-7527 CVE-2024-7528 CVE-2024-7529


author: doucaixia <doucaixia@uniontech.com> - 128.3.1-1.01
changelog:
  - spec: no build loongarch64
  - spec: define rhel_minor_version 3 for uelc20 dist
  - spec: modify js filename from *redhat* to *uos*
  - rebrand: rename js file(uos) and update vendor
  - rebrand: add zh_CN name on thunderbird.desktop
  - spec: add some mips arch info , mips patch is not used


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-5
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18410
  - Fix CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18422


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-7
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20388
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20382
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20530
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21214


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-9
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-30755
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30767
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30761


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-10
changelog:
  - Drop patches that are already part of xorg-x11-server
    Resolves: RHEL-30755
    Resolves: RHEL-30767
    Resolves: RHEL-30761


author: Jan Grulich <jgrulich@redhat.com>
changelog:
  - Fix CVE-2024-9632: xorg-x11-server: heap-based buffer overflow privilege escalation vulnerability
    Resolves: RHEL-61999


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-15
changelog:
  - Fix CVE-2025-26594 xorg-x11-server Use-after-free of the root cursor
    Resolves: RHEL-79397
  - Fix CVE-2025-26595 xorg-x11-server Buffer overflow in XkbVModMaskText()
    Resolves: RHEL-79401
  - Fix CVE-2025-26596 xorg-x11-server Heap overflow in XkbWriteKeySyms()
    Resolves: RHEL-79386
  - Fix CVE-2025-26597 xorg-x11-server Buffer overflow in XkbChangeTypesOfKey()
    Resolves: RHEL-79380
  - Fix CVE-2025-26598 xorg-x11-server Out-of-bounds write in CreatePointerBarrierClient()
    Resolves: RHEL-79369
  - Fix CVE-2025-26599 xorg-x11-server Use of uninitialized pointer in compRedirectWindow()
    Resolves: RHEL-79364
  - Fix CVE-2025-26600 xorg-x11-server Use-after-free in PlayReleasedEvents()
    Resolves: RHEL-79360
  - Fix CVE-2025-26601 xorg-x11-server Use-after-free in SyncInitTrigger()
    Resolves: RHEL-79348


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2.1
changelog:
  - Fix CVE-2023-5380 tigervnc: xorg-x11-server: Use-after-free bug in DestroyWindow
  - Fix CVE-2023-5367 tigervnc: xorg-x11-server: Out-of-bounds write in XIChangeDeviceProperty/RRChangeOutputProperty
    Resolves: RHEL-15229


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2.2
changelog:
  - Fix CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18409
  - Fix CVE-2023-6478 tigervnc: xorg-x11-server: out-of-bounds memory read in RRChangeOutputProperty and RRChangeProviderProperty
    Resolves: RHEL-18421


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2.4
changelog:
  - Updated fix for CVE-2023-6377 tigervnc: xorg-x11-server: out-of-bounds memory reads/writes in XKB button actions
    Resolves: RHEL-18409


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-3.5
changelog:
  - Fix CVE-2024-21886 tigervnc: xorg-x11-server: heap buffer overflow in DisableDevice
    Resolves: RHEL-20432
  - Fix CVE-2024-21885 tigervnc: xorg-x11-server: heap buffer overflow in XISendDeviceHierarchyEvent
    Resolves: RHEL-20420
  - Fix CVE-2024-0229 tigervnc: xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access
    Resolves: RHEL-20583
  - Fix CVE-2023-6816 tigervnc: xorg-x11-server: Heap buffer overflow in DeviceFocusEvent and ProcXIQueryPointer
    Resolves: RHEL-21252


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-3.6
changelog:
  - Don't try to get pointer position when the pointer becomes a floating device
    Resolves: RHEL-20432


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-3.7
changelog:
  - Fix use after free related to CVE-2024-21886
    Resolves: RHEL-20432
  - Fix copy/paste error in the DeviceStateNotify
    Resolves: RHEL-20583


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2.8
changelog:
  - Fix CVE-2024-31080 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIGetSelectedEvents
    Resolves: RHEL-31011
  - Fix CVE-2024-31083 tigervnc: xorg-x11-server: User-after-free in ProcRenderAddGlyphs
    Resolves: RHEL-30981
  - Fix CVE-2024-31081 tigervnc: xorg-x11-server: Heap buffer overread/data leakage in ProcXIPassiveGrabDevice
    Resolves: RHEL-30998


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-1
changelog:
  - 1.13.1
    Resolves: bz#2175748
  - Restore "--fallbacktofreeport" option in the vncserver script
    Resolves: bz#2174398


author: Jan Grulich <jgrulich@redhat.com> - 1.13.1-2
changelog:
  - xorg-x11-server: X.Org Server Overlay Window Use-After-Free Local Privilege
    Escalation Vulnerability
    Resolves: bz#2180306


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-16
changelog:
  - Resolves: RHEL-12543 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
  - Remove JDK subpackges which are unused


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-27.2
changelog:
  - Resolves: RHEL-13907
  - Resolves: RHEL-13904
  - Resolves: RHEL-12951
  - Resolves: RHEL-2386
  - Revert change for obsoleting pki-servlet-engine


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-7
changelog:
  - Related: #2173874 Tomcat installs older java even though newer java is installed
  - Bump release number


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-10
changelog:
  - Resolves: #2210630 CVE-2023-28709 tomcat
  - Resolves: #2181448 CVE-2023-28708 tomcat: not including the secure attribute causes information disclosure


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-5.1
changelog:
  - Resolves: RHEL-12542 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
  - Update source to include the CVE fixes
  - Update patch command


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-16
changelog:
  - Resolves: RHEL-12543
    tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  - Remove JDK subpackges which are unused


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-27
changelog:
  - Related: RHEL-12543
    tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  - Bump release number


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-28
changelog:
  - Resolves: RHEL-13907
    tomcat: incorrectly parsed http trailer headers can cause request smuggling (CVE-2023-45648)
  - Resolves: RHEL-13904
    tomcat: improper cleaning of recycled objects could lead to information leak (CVE-2023-42795)
  - Resolves: RHEL-12951
    tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (CVE-2023-42794)
  - Resolves: RHEL-12544
    tomcat: HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
  - Resolves: RHEL-2386
    tomcat: Open Redirect vulnerability in FORM authentication (CVE-2023-41080)


author: Hui Wang <huwang@redhat.com> - 1:9.0.62-29
changelog:
  - Resolves: RHEL-17602
    tomcat: HTTP request smuggling via malformed trailer headers (CVE-2023-46589)
  - tomcat: Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)


author: Sokratis Zappis <szappis@redhat.com> - 1:9.0.87-1.el8_10.1
changelog:
  - Resolves: RHEL-38548 - Amend tomcat package's changelog so that fixed CVEs are mentioned explicitly
  - Resolves: RHEL-35813 - Rebase tomcat to version 9.0.87
  - Resolves: RHEL-29255
    tomcat: Apache Tomcat: WebSocket DoS with incomplete closing handshake (CVE-2024-23672)
  - Resolves: RHEL-29250
    tomcat: Apache Tomcat: HTTP/2 header handling DoS (CVE-2024-24549)


author: Adam Krajcik <akrajcik@redhat.com> - 1:9.0.87-1.el8_10.3
changelog:
  - Resolves: RHEL-82934
    tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)
  - Resolves: RHEL-71708
    tomcat: RCE due to TOCTOU issue in JSP compilation (CVE-2024-50379)


author: Liu Chao <liuchao173@huawei.com> - 2.24.1-1
changelog:
  - Upgrade to 2.24.1:
    - fixed privileged execution of arbitrary scripts by active local user. (CVE-2024-52336)
    - added sanity checks for API methods parameters. (CVE-2024-52337)


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.41-14
changelog:
  - Integrated the vdo to lvm conversion tool into the vdo management script
    and modified the tool itself to correctly convert the UDS index so that
    dedupe information is not lost by conversion.
  - Resolves: rhbz#1928284


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.62-14
changelog:
  - Removed extraneous fields from the super block of a converted index.
  - Resolves: rhbz#1965546
  - Added a parameter to the lvm conversion tool to specify the amount of
    space to free up.
  - Resolves: rhbz#1966827
  - Fixed calculation of the number of expiring chapters in a converted
    index.
  - Resolves: rhbz#1975546


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.74-14
changelog:
  - Renamed vdo2LVM to vdopreparelvm and moved its installation location to
    /usr/libexec so that it is not in common default paths as this utility is
    intended to be called from LVM, not directly by users.
  - Related: rhbz#1986930


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.3-14
changelog:
  - Added a check to vdopreparelvm to determine whether it has already been
    converted.
  - Resolves: rhbz#2017843


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.7-14
changelog:
  - Fixed bugs in the vdopreparelvm check to determine whether a device has
    already been converted.
  - Resolves: rhbz#2017843
  - Fixed an issue in the vdo-by-dev tool which could result in a failure to
    start vdo devices when some devices in the vdo config file do not exist.
  - Resolves: rhbz#2022154


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.14-14
changelog:
  - Added a tool to make LVMVDO pools read/write so that support and
    debugging tools may access them.
  - Resolves: rhbz#1999640


author: gouhao <gouhao@uniontech.com> - 6.2.6.14-14.0.1.02
changelog:
  - uos: add CACHE_LINE_BYTES macro for mips
  - uos: fix casting error
  - uos: add smp_rmb macro for mips


author: maqi <maqi@uniontech.com> - 2.38.5-1.0.1.4
changelog:
  - Add patch: 0001-Resolved-EGL_WAYLAND_BUFFER_WL-undefined.patch
  - fix: delete empty link(bugid:123783)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.38.5-1.0.1.7
changelog:
  - Add patch for CVE-2023-28204
    Resolves: #2209744
  - Add patch for CVE-2023-32373
    Resolves: #2209727


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.40.5-1
changelog:
  - Upgrade to 2.40.5. Also, disable JIT
    Resolves: #2176269
    Resolves: #2185742
    Resolves: #2209728
    Resolves: #2209745
    Resolves: #2218649
    Resolves: #2218651
    Resolves: #2224611


author: Bo Ren <rb01097748@alibaba-inc.com> 2.42.5-1.0.1
changelog:
  - Exclude loongarch64
  - cherry-pick `add sw arch #ef8be098b07c4d8a9f809d32a607700f4a420676`. (nijie@wxiat.com)


author: maqi <maqi@uniontech.com> - 1:2.6.2-14.3
changelog:
  - cve: CVE-2019-10894 CVE-2019-10896 CVE-2019-10899 
  - cve: CVE-2019-10901 CVE-2019-10903 CVE-2020-7045
  - cve: CVE-2019-12295 CVE-2019-13619 CVE-2019-9209 
  - cve: CVE-2020-26575 CVE-2020-9431  CVE-2020-11647
  - cve: CVE-2020-25862 CVE-2020-25863 CVE-2020-9428
  - rebuild: rebuild for c8.5


author: Michal Ruprich <mruprich@redhat.com> - 1:2.6.2-15
changelog:
  - Resolves: #2119126 - Wireshark source rpm fails to build due to looking for incorrect libssh header files


author: Rob Crittenden <rcritten@redhat.com> - 1.51.0-7
changelog:
  - lib: Prevent more integer overflows (CVE-2022-22822 to CVE-2022-22827)
    (#2058567, #2058576, #2058582, #2058589, #2058595, #2058602)
  - Prevent integer overflow on m_groupSize in doProlog
    (CVE-2021-46143) (#2058560)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-9
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2108156, rhbz#2108161


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.20.11-11
changelog:
  - CVE fix for: CVE-2022-4283 (#2151799), CVE-2022-46340 (#2151774),
    CVE-2022-46341 (#2151779), CVE-2022-46342 (#2151784),
    CVE-2022-46343 (#2151789), CVE-2022-46344 (#2151794)


author: zhangshaoning <zhangshaoning@uniontech.com> - 1.20.11-17.01
changelog:
  - update: xorg-x11-server-1.20.11-17.el8.src.rpm and sync patch
  - fix: workaround to resolve crash while changing resolution ratio(bugid:163293)(zhaoshuang)
  - feat: transplant deepin patch(liweigang)


author: José Expósito <jexposit@redhat.com> - 1.20.11-20
changelog:
  - CVE fix for: CVE-2023-6377, CVE-2023-6478
    Resolves: https://issues.redhat.com/browse/RHEL-18321
    Resolves: https://issues.redhat.com/browse/RHEL-18327


author: José Expósito <jexposit@redhat.com> - 1.20.11-21
changelog:
  - CVE fix for: CVE-2023-6816, CVE-2024-0229, CVE-2024-21885, CVE-2024-21886,
    CVE-2024-0408 and CVE-2024-0409
    Resolves: https://issues.redhat.com/browse/RHEL-21207
    Resolves: https://issues.redhat.com/browse/RHEL-20528
    Resolves: https://issues.redhat.com/browse/RHEL-20378
    Resolves: https://issues.redhat.com/browse/RHEL-20384
    Resolves: https://issues.redhat.com/browse/RHEL-21191
    Resolves: https://issues.redhat.com/browse/RHEL-21198


author: José Expósito <jexposit@redhat.com> - 1.20.14-23
changelog:
  - CVE fix for: CVE-2024-31080, CVE-2024-31081, CVE-2024-31082 and
    CVE-2024-31083
  - Add util-linux as a dependency of Xvfb
  - Fix compilation error on i686


author: zhangshaoning <zhangshaoning@uniontech.com> - 1.20.11-23.01
changelog:
  - update: xorg-x11-server-1.20.11-23.el8.src.rpm and sync patch
  - fix: workaround to resolve crash while changing resolution ratio(bugid:163293)(zhaoshuang)
  - feat: transplant deepin patch(liweigang)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-2
changelog:
  - CVE fix for: CVE-2021-4008 (#2038066), CVE-2021-4009 (#2038068),
    CVE-2021-4010 (#2038071), CVE-2021-4011 (#2038073)


author: Olivier Fourdan <ofourdan@redhat.com> - 21.1.3-6
changelog:
  - CVE fix for: CVE-2022-2319/ZDI-CAN-16062, CVE-2022-2320/ZDI-CAN-16070
    Resolves: rhbz#2110442, rhbz#2110437


author: Peter Hutterer <peter.hutterer@redhat.com> - 21.1.3-8
changelog:
  - CVE fix for: CVE-2022-4283 (#2151802), CVE-2022-46340 (#2151777),
    CVE-2022-46341 (#2151782), CVE-2022-46342 (#2151785),
    CVE-2022-46343 (#2151792), CVE-2022-46344 (#2151795)


