# changelog

author: Lubomir Rintel <lkundrak@v3.sk> - 1.10.2-1
changelog:
  - Update to 1.10.2 release (rh #1543498)
  - Don't grab cdc_ether devices on Sierra QMI modems (rh #1712031)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.40.16-5
changelog:
  - support bond port prio property (rh #1920398)
  - team: don't try to connect to teamd in update_connection() (rh #2182029)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.0.32-2
changelog:
  - Resolve issues found by rpmdiff
    - add explicit Requires: on subpackages to avoid the need to test
      interoperability between the various combinations of old and new
      subpackages


author: Pavel Cahyna <pcahyna@redhat.com> - 2.0.32-3
changelog:
  - Add a patch to resolve one more issue found by rpmdiff/rpminspect:
    fix getaddrinfo detection to avoid using gethostbyname.


author: Kamil Dudka <kdudka@redhat.com> 2.2.52-14
changelog:
  - drop obsolete BuildRoot and Group tags
  - fix spurious acl_check() failure on setfacl --restore (#1451826)


author: Kamil Dudka <kdudka@redhat.com> 2.2.52-15
changelog:
  - setfacl.1: document the meaning of '-' in perms (#1337039)
  - avoid failure of %check when building as root (#1085389)
  - apply patches automatically to ease maintenance


author: Al Stone <ahs3@redhat.com> - 20190108-1
changelog:
  - Update to 20190108 source tree, including patch refeshes.
  - Replace use of strncpy() with memcpy() when moving ASCII bytes around;
    the tables use "strings" but they are seldom null terminated, causing
    GCC9 to complain.  Closes BZ#1674629.


author: Al Stone <ahs3@redhat.com> - 20190509-2
changelog:
  - Added an arm7hl specific fix acenv.h; GCC9 on arm7hl can now deal
    with misalignments so the unaligned patch could be relaxed a bit
  - the templates test was failing because of the backup left behind
    by the patch macro, so change the invocation of the macro.


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 20190509-5.0.1
changelog:
  - Fix upgrade and downgrade warning (xuchunmei)
    * remove %pre to avoid warning when upgrade from old version
    * exec "alternatives --install" to avoid missing of acpixtract and acpidump
      when downgrade to old version
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build (Liwei Gei)
  - ignore mismatched ACPI Warning message at misc tests


author: Sumit Bose <sbose@redhat.com> - 0.8.2-6
changelog:
  - [abrt] [faf] adcli: raise(): /usr/sbin/adcli killed by 6 [#1806260]
  - No longer able to delete computer from AD using adcli [#1846882]
  - adcli: presetting $computer in $domain domain failed: Cannot set computer
    password: Authentication error [#1846878]
  - Typo in adcli update --help option [#1791611]
  - Manpage and help does not explain the use of "-C" option [#1791545]


author: Sumit Bose <sbose@redhat.com> - 0.8.2-8
changelog:
  - Add --use-ldaps option to adcli update as well [#1883467]
  - Cannot join a pre-staged Computer Account on AD in Custom OU using Delegated
    user [#1734764]
  - missing documentation for required AD rights for adcli join and net
    join [#1852080]
  - [RFE] Add new mode to just create an AD account to be able to connect to
    LDAP [#1854112]


author: Sumit Bose <sbose@redhat.com> - 0.8.2-10
changelog:
  - [RFE] Adcli and Realm Error Code Optimization Request [#1889386]
  - [RFE] adcli should allow to modify DONT_EXPIRE_PASSWORD attribute [#1769644]


author: Sumit Bose <sbose@redhat.com> - 0.8.2-12
changelog:
  - [RFE] Allow adcli to create AD user with password as well as set or reset
    existing user password [#1952828]
  - [RFE] add option to populate "managed by" computer attribute [#1690920]


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.20-7
changelog:
  - the ownership of the spool directory should be root as at is configured
    with daemon username root
  - document the -n option


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3-1
changelog:
  - Update to new 3.10.3 stable version.
  - Remove ppc64/ppc64le related patches.
  - All packages now use -A option to specify the target CPU/Architecture instead of 
  sed substitutions and auto detection. The packages should now be less dependant on the 
  builder machine used.
  - Base package for each architecture should now be configured to be compatible with the 
  most basic machine of given type.
  - In addittion to base package, added some optimized packages for more advanced CPUs for
  most architectures.
  - Dropped sse2/sse3 subpackages for ix86


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3-6
changelog:
  * Pass all required compiler/linker flags
  - use annobin plugin
  - generate assembler build notes
  Related: #1624098


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3-8
changelog:
  * Update the s390 subpackages:
  - The base pakcage is now optimized to z13
  - New subpackage is introduced: z14
  - All remaining subpackages for s390 are being deprecated
  - Clean up of the spec file 
  - Some commented out subpackages were removed form the spec
  - These subpackages were not built/shipped -> no change from the users point of view
  Resolves: #1782560
  Resolves: #1780286
  Resolves: #1782561


author: Kamil Dudka <kdudka@redhat.com> 2.4.47-19
changelog:
  - fix test-suite failure with perl-5.26.0 (#1473853)
  - apply patches automatically to ease maintenance
  - update URL of the upstream source tarball


author: Steve Grubb <sgrubb@redhat.com> 3.0-0.15.20191104git1c2f876
changelog:
  resolves: rhbz#1757986 - Rebase audit package on 8.2 for updates
  resolves: rhbz#1767054 - move audit rules to shared data directory
  resolves: rhbz#1746018 - Breakup 30-ospp-v42.rules into more granular files
  resolves: rhbz#1740798 - auditctl(8) needs clarification for backlog_limit
  resolves: rhbz#1497279 - Add option to interpret fields in audit syslog plugin


author: Sergio Correia <scorreia@redhat.com> - 3.0.5-1
changelog:
  - Rebase audit package on 8.6
    Resolves: rhbz#1939406
    Resolves: rhbz#1906065
    Resolves: rhbz#1921447
    Resolves: rhbz#1927884
    Resolves: rhbz#1921658


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-2
changelog:
  - Adjust sample-rules dir permissions
    Resolves: rhbz#2054727 - /usr/share/audit/sample-rules is no longer readable by non-root users


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-3
changelog:
  - Fix path normalization in auparse
    Resolves: rhbz#2062612 - auparse missing information when used with --format-text


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-4
changelog:
  - Drop ProtectHome from auditd.service as it interferes with rules
    Resolves: rhbz#2071727 - Default systemd service config blocks audit watch rules in some directories


author: Richard W.M. Jones <rjones@redhat.com> - 1.13.0-2
changelog:
  - Parse auto_reset_crashkernel in kdump
    resolves: rhbz#2042772
  - Add new directives and options for chrony


author: Richard W.M. Jones <rjones@redhat.com> - 1.13.0-4
changelog:
  - Fix parsing of /usr/lib/tmpfiles.d/provision.conf
  - Fix parsing of /etc/kernel/cmdline
    resolves: rhbz#2155136, rhbz#2159282


author: Pavel Březina <pbrezina@redhat.com> - 1.1-1
changelog:
  - Rebase to authselect-1.1 (RHBZ #1685516)
  - Notify that oddjob-mkhomedir needs to be enabled manually (RHBZ #1694103)
  - Ask for smartcard insertion when smartcard authentication is required (RHBZ #1674397)
  - Update translations (RHBZ #1689973)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.1-1
changelog:
  - Rebase to authselect-1.2.1 (RHBZ #1810471)
  - CLI commands are now correctly translated (RHBZ #1816009)
  - Remove unsupported features from sssd profile description (RHBZ #1830251)
  - add `with-files-access-provider` to sssd profile (RHBZ #1734094)
  - switch to pam_usertype module (RHBZ #1773567)
  - fix typo in sssd profile description (RHBZ #1787638)
  - add minimal profile (RHBZ #1654018)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.2-2
changelog:
  - try_first_pass option no longer works on some PAM modules in RHEL8 (RHBZ #1949070)
  - Need to localize the description of --debug option in authselect show (RHBZ #1970408)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.5-1
changelog:
  - Rebase to 1.2.5 (RHBZ #2080238)
  - sssd profile with-smartcard no longer prevents local users from accessing cron (RHBZ #2070325)
  - backup-restore now works correctly (RHBZ #2066535)
  - add with-subid to sssd profile (RHBZ #2063750)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.6-1
changelog:
  - Rebase to 1.2.6 (RHBZ #2142805)
  - Update translations (RHBZ #2139696)
  - Change password hashing algorithm from yescrypt back to sha512 (RHBZ #2151140)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.6-2
changelog:
  - Fix Japanese translations (RHBZ #2216755)
  - Update translations (RHBZ #2189557)
  - Do not prompt for password twice when changing password of local user (RHBZ #2179607)


author: Ian Kent <ikent@redhat.com> - 5.1.4-93
changelog:
  - bz2165143 - Autofs reports can't connect to sssd, retry for 10 seconds when
    real problem is empty LDAP object
    - improve handling of ENOENT in sss setautomntent().
    - dont immediately call function when waiting.
  - Resolves: rhbz#2165143


author: Ian Kent <ikent@redhat.com> - 5.1.4-102
changelog:
  - bz2177998 - deadlock while reading amd maps
    - fix return status of mount_autofs().
    - don't close lookup at umount.
    - fix deadlock in lookups.
    - dont delay expire.
    - make amd mapent search function name clear.
    - rename statemachine() to signal_handler().
    - make signal handling consistent.
    - fix incorrect print format specifiers in get_pkt().
    - eliminate last remaining state_pipe usage.
    - add function master_find_mapent_by_devid().
    - use device id to locate autofs_point when setting log priotity.
    - add command pipe handling functions.
    - switch to application wide command pipe.
    - get rid of unused field submnt_count.
    - fix mount tree startup reconnect.
    - fix unterminated read in handle_cmd_pipe_fifo_message() (Coverity).
  - Resolves: rhbz#2177998


author: Ian Kent <ikent@redhat.com> - 5.1.4-103
changelog:
  - bz2177998 - deadlock while reading amd maps
    - rebuild to avoid possible NVR problems.
  - Related: rhbz#2177998


author: Ian Kent <ikent@redhat.com> - 5.1.4-104
changelog:
  - bz2208408 - autofs fails to start with combination of +auto.master and
    local direct map lookups after upgrading to 5.1.4-93.el8
    - fix memory leak in sasl_do_kinit() (Coverity).
    - fix fix mount tree startup reconnect.
  - Resolves: rhbz#2208408


author: Ian Kent <ikent@redhat.com> - 5.1.4-105
changelog:
  - bz2207801 - amd map format netgoup selector function not working
    - fix date for revision 104 changelog entry.
    - fix use_ignore_mount_option description.
    - include addtional log info for mounts.
    - fix amd selector function matching.
    - get rid entry thid field.
    - continue expire immediately after submount check.
    - add buffer length checks to autofs mount_mount().
    - eliminate realpath from mount of submount.
    - eliminate root param from autofs mount and umount.
    - remove redundant fstat from do_mount_direct().
    - get rid of strlen call in handle_packet_missing_direct().
    - remove redundant stat call in lookup_ghost().
    - set mapent dev and ino before adding to index.
    - change to use printf functions in amd parser.
    - dont call umount_subtree_mounts() on parent at umount.
    - dont take parent source lock at mount shutdown.
    - eliminate buffer usage from handle_mounts_cleanup().
    - fix possible use after free in handle_mounts_exit().
    - make submount cleanup the same as top level mounts.
    - eliminate some more alloca usage.
    - add soucre parameter to module functions.
    - add ioctlfd open helper.
    - make open files limit configurable.
  - Resolves: rhbz#2207801


author: Ian Kent <ikent@redhat.com> - 5.1.4-106
changelog:
  - bz2214444 - The sss lookup modules handles error return incorrectly
    in some cases
    - fix some sss error return cases.
  - Resolves: rhbz#2214444


author: Ian Kent <ikent@redhat.com> - 5.1.4-107
changelog:
  - bz2216877 - When looking up included maps, sometimes autofs does not
    consult all the included files in order
    - fix incorrect matching of cached wildcard key
  - Resolves: rhbz#2216877


author: Ian Kent <ikent@redhat.com> - 5.1.4-108
changelog:
  - bz2216877 - When looking up included maps, sometimes autofs does not
    consult all the included files in order
    - fix the "fix incorrect matching of cached wildcard key" patch.
  - Related: rhbz#2216877


author: Ian Kent <ikent@redhat.com> - 5.1.4-109
changelog:
  - bz2213267 - filesystems mount and expire immediately
    - fix expire retry looping.
  - Resolves: rhbz#2213267


author: Michal Sekletar <msekleta@redhat.com> - 0.7-21.1
changelog:
  - Fix CVE-2021-3468 (RHEL-18311)
  - Fix CVE-2023-38469 (RHEL-17783)
  - Fix CVE-2023-38470 (RHEL-17795)
  - Fix CVE-2023-38471 (RHEL-17789)
  - Fix CVE-2023-38472 (RHEL-17807)
  - Fix CVE-2023-38473 (RHEL-17801)


author: Kevin Fenzi <kevin@scrye.com> - 1.07.1-1https://bugs.archlinux.org/task/53546
changelog:
  - Update to 1.07.1
  - Fixes a bug that breaks kernel builds ( https://bugs.archlinux.org/task/53546 )


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-4
changelog:
  - Tighten cache protection against record from forwarders (CVE-2021-25220)
  - Include test of forwarders


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.36-5
changelog:
  - Fix memory leak in ECDSA verify processing (CVE-2022-38177)
  - Fix memory leak in EdDSA verify processing (CVE-2022-38178)


author: Yara Ahmad <yahmad@redhat.com> - 2.30-121
changelog:
  - Fix an illegal memory access when parsing an ELF file containing corrupt symbol version information.  (#2164700)


author: Xue haolin <xuehaolin@openanolis.org> - 2.30-123.0.1
changelog:
  - Rebrand to Anolis OS.
  - Add loongarch support. (lixing@loongson.cn)
  - Fixup LoongArch wrong debug line. (lixing@loongson.cn)
  - Add LoongArch missing opcode. (lixing@loongson.cn)
  - Fixup gas SIGSEGV for extremely long function name. (lixing@loongson.cn)
  - change loong64 to loongarch64. (lixing@loongson.cn)
  - Add ifunc support. (lixing@loongson.cn)
  - Delete R_LARCH_NONE for eh_frame. (lixing@loongson.cn)
  - Fixup pr21964 bug. (lixing@loongson.cn)
  - Add 3A6000 opcode. (lixing@loongson.cn)
  - Fix some testsuite error. (lixing@loongson.cn)


author: Iryna Shcherbina <ishcherb@redhat.com> - 1.2.0-2
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Tomas Orsava <torsava@redhat.com> - 1.2.0-9
changelog:
  - Switch hardcoded python3 shebangs into the %{__python3} macro
  - Add missing BuildRequires on python3-devel so that %{__python3} macro is
    defined


author: Gopal Tiwari <gtiwari@redhat.com> - 5.56-1
changelog:
  + bluez-5.56-1
  - Fixing (#1965057)
  - Removing bccmd, enabling hid2hci as upstream removed the support in bluez-5.56


author: Christian Kellner <ckellner@redhat.com> - 0.1-2
changelog:
  - Set database path to /var/lib/boltd, create it during
    installation, which is needed for the service file to work.


author: Christian Kellner <ckellner@redhat.com> - 0.8-1
changelog:
  - bolt 0.8 upstream release with pre-boot ACL and IOMMU support
    D-Bus Configuration moved from sysconfdir to datadir
    Resolves: #1629715


author: Christian Kellner <ckellner@redhat.com> - 0.8-2
changelog:
  - Rebuilt for fixed gating.yaml (remove missing tier1 gate)
  - Unset env NOTIFY_SOCKET for no socket case in test-unix


author: Marian Csontos <mcsontos@redhat.com> 1.3-1
changelog:
  - Check for duplicates consistently in the clone and edit commands.
  - Apply correct command line precedence to --add-opts and --del-opts.
  - Correctly merge multiple --add/del-opts when editing or cloning.
  - Correctly propagate --add/del-opts in boom edit commands.
  - Enhanced logging of --add/del-opts merge logic.
  - The default Python interpreter is now /usr/bin/python.
  - Fixed re-ordering of options modifications when read from disk.
  - Do not set BootParams attributes for anonymous option words.
  - Make lvm_root_lv validation checks more strict.
  - Improve BootParams.from_entry() parameter recovery debug logging.
  - Include sample OsProfile for Fedora 32.
  - Re-set sandbox state in test suite to ensure run-to-run consistency.
  - Improve compatibility with Red Hat BLS implementation.
  - Allow non-boom managed entries to be listed and displayed.
  - Handle quirks in Red Hat's use of the BLS machine_id key.
  - Allow grub2 bootloader variables to be expanded when cloning entries.
  - Simplify clone_entry logic and make consistent with edit_entry.
  - Ensure stable ordering of legacy boot entry configuration.


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.19.1.el8_8]
changelog:
  - crypto: jitter - correct health test during initialization (Vladis Dronov) [2215079 2214270]
  - rbd: get snapshot context after exclusive lock is ensured to be held (Ilya Dryomov) [2216769 2214973]
  - rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting (Ilya Dryomov) [2216769 2214973]
  - PCI: hv: Add a per-bus mutex state_lock (Vitaly Kuznetsov) [2216543 2184863]
  - Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally" (Vitaly Kuznetsov) [2216543 2184863]
  - PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (Vitaly Kuznetsov) [2216543 2184863]
  - PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (Vitaly Kuznetsov) [2216543 2184863]
  - PCI: hv: Fix a race condition bug in hv_pci_query_relations() (Vitaly Kuznetsov) [2216543 2184863]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.20.1.el8_8]
changelog:
  - block: make sure local irq is disabled when calling __blkcg_rstat_flush (Ming Lei) [2220810 2208904]
  - blk-cgroup: Flush stats before releasing blkcg_gq (Ming Lei) [2220810 2208904]
  - PCI: vmd: Add quirk to configure PCIe ASPM and LTR (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Create feature grouping for client products (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Use PCI_VDEVICE in device list (Myron Stowe) [2211198 2136922]
  - PCI/ASPM: Add pci_enable_link_state() (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Fix secondary bus reset for Intel bridges (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Disable MSI remapping after suspend (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Add DID 8086:7D0B and 8086:AD0B for Intel MTL SKUs (Myron Stowe) [2211198 2136922]
  - PCI: vmd: Use devm_kasprintf() instead of simple kasprintf() (Myron Stowe) [2211198 2136922]
  - powerpc/pseries: unregister VPA when hot unplugging a CPU (Mamatha Inamdar) [2193375 2143007]
  - net/sched: cls_tcindex: downgrade to imperfect hash (Davide Caratti) [2192307 2192308] {CVE-2023-1829}
  - powerpc/papr_scm: Update the NUMA distance table for the target node (Mamatha Inamdar) [2212451 2183474]
  - hvcs: Synchronize hotplug remove with port free (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Use vhangup in hotplug remove (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Get reference to tty in remove (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Use driver groups to manage driver attributes (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Use dev_groups to manage hvcs device attributes (Mamatha Inamdar) [2212373 2167962]
  - hvcs: Fix hvcs port reference counting (Mamatha Inamdar) [2212373 2167962]
  - tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup() (Mamatha Inamdar) [2212373 2167962]
  - scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity (Tomas Henzl) [2216498 2160149]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.21.1.el8_8]
changelog:
  - ipmi: msghandler: kABI implementation was wrong (Tony Camuso) [2213189 2182345]
  - ipmi: ipmb: Fix the MODULE_PARM_DESC associated to 'retry_time_ms' (Tony Camuso) [2211667 2174220]
  - ipmi:ssif: Add a timer between request retries (Tony Camuso) [2211667 2174220]
  - ipmi:ssif: Remove rtc_us_timer (Tony Camuso) [2211667 2174220]
  - ipmi_ssif: Rename idle state and check (Tony Camuso) [2211667 2174220]
  - ipmi:ssif: resend_msg() cannot fail (Tony Camuso) [2211667 2174220]
  - ipmi/watchdog: use strscpy() to instead of strncpy() (Tony Camuso) [2211667 2174220]
  - ipmi: ssif_bmc: Convert to i2c's .probe_new() (Tony Camuso) [2211667 2174220]
  - ipmi: fix use after free in _ipmi_destroy_user() (Tony Camuso) [2211667 2174220]
  - ipmi:ssif: Increase the message retry time (Tony Camuso) [2211667 2174220]
  - ipmi: Fix some kernel-doc warnings (Tony Camuso) [2211667 2174220]
  - ipmi: ssif_bmc: Use EPOLLIN instead of POLLIN (Tony Camuso) [2211667 2174220]
  - ipmi: fix msg stack when IPMI is disconnected (Tony Camuso) [2211667 2174220]
  - ipmi: fix memleak when unload ipmi driver (Tony Camuso) [2211667 2174220]
  - ipmi: fix long wait in unload when IPMI disconnect (Tony Camuso) [2211667 2174220]
  - ipmi: kcs: Poll OBF briefly to reduce OBE latency (Tony Camuso) [2211667 2174220]
  - ipmi: ssif_bmc: Add SSIF BMC driver (Tony Camuso) [2211667 2174220]
  - ipmi: Remove unused struct watcher_entry (Tony Camuso) [2211667 2174220]
  - ipmi: kcs: aspeed: Update port address comments (Tony Camuso) [2211667 2174220]
  - ipmi: Add __init/__exit annotations to module init/exit funcs (Tony Camuso) [2211667 2174220]
  - ipmi:ipmb: Don't call ipmi_unregister_smi() on a register failure (Tony Camuso) [2211667 2174220]
  - ipmi:ipmb: Fix a vague comment and a typo (Tony Camuso) [2211667 2174220]
  - ipmi: Fix comment typo (Tony Camuso) [2211667 2174220]
  - char: ipmi: modify NPCM KCS configuration (Tony Camuso) [2211667 2174220]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.22.1.el8_8]
changelog:
  - mm: avoid unnecessary page fault retires on shared memory types (Nico Pache) [2221100 2213877]
  - mm: remove redundant check about FAULT_FLAG_ALLOW_RETRY bit (Nico Pache) [2221100 2213877]
  - mm: Allow the [page|pfn]_mkwrite callbacks to drop the mmap_sem (Nico Pache) [2221100 2213877]
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ricardo Robaina) [2196352 2196353] {CVE-2023-2002}
  - mm/memcg: Fix mem_cgroup_id_get_online() underflow problem (Waiman Long) [2221010]
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Davide Caratti) [2216989 2214027] {CVE-2023-35788}
  - netfilter: conntrack: gre: don't set assured flag for clash entries (Florian Westphal) [2223542]
  - netfilter: conntrack: allow insertion clash of gre protocol (Florian Westphal) [2223542]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.23.1.el8_8]
changelog:
  - ice: avoid bonding causing auxiliary plug/unplug under RTNL lock (Petr Oros) [2224515 2153356]
  - ceph: fix use-after-free bug for inodes when flushing capsnaps (Xiubo Li) [2218271 2209299]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.24.1.el8_8]
changelog:
  - x86/cpu/amd: Add a Zenbleed fix (Waiman Long) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu/amd: Move the errata checking functionality up (Waiman Long) [2226831 2226832] {CVE-2023-20593}
  - x86/amd: Cache debug register values in percpu variables (Waiman Long) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Waiman Long) [2226831 2226832] {CVE-2023-20593}
  - x86/microcode/AMD: Track patch allocation size explicitly (David Arcari) [2226831 2226832] {CVE-2023-20593}
  - x86/microcode: Print previous version of microcode after reload (David Arcari) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu: Load microcode during restore_processor_state() (David Arcari) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu: Include the header of init_ia32_feat_ctl()'s prototype (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/pm: Fix false positive kmemleak report in msr_build_context() (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/speculation: Restore speculation related MSRs during S3 resume (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - kbuild: remove leftover comment for filechk utility (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/cpu: Reinitialize IA32_FEAT_CTL MSR on BSP during wakeup (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/rdrand: Sanity-check RDRAND output (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - x86/CPU/AMD: Clear RDRAND CPUID bit on AMD family 15h/16h (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - firmware: refactor firmware/Makefile (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - kbuild: remove redundant 'set -e' from filechk_offsets (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - kbuild: do not redirect the first prerequisite for filechk (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - kbuild: move bin2c back to scripts/ from scripts/basic/ (Chris von Recklinghausen) [2226831 2226832] {CVE-2023-20593}
  - libceph: harden msgr2.1 frame segment length checks (Ilya Dryomov) [2227073 2222256]
  - iavf: fix reset task race with iavf_remove() (Petr Oros) [2228161 2223604]
  - iavf: fix a deadlock caused by rtnl and driver's lock circular dependencies (Petr Oros) [2228161 2223604]
  - Revert "iavf: Do not restart Tx queues after reset task failure" (Petr Oros) [2228161 2223604]
  - Revert "iavf: Detach device during reset task" (Petr Oros) [2228161 2223604]
  - iavf: Wait for reset in callbacks which trigger it (Petr Oros) [2228161 2223604]
  - iavf: use internal state to free traffic IRQs (Petr Oros) [2228161 2223604]
  - iavf: Fix out-of-bounds when setting channels on remove (Petr Oros) [2228161 2223604]
  - iavf: Fix use-after-free in free_netdev (Petr Oros) [2228161 2223604]
  - iavf: make functions static where possible (Petr Oros) [2228161 2223604]
  - iavf: fix err handling for MAC replace (Petr Oros) [2228161 2223604]
  - iavf: remove some unused functions and pointless wrappers (Petr Oros) [2228161 2223604]
  - iavf: remove mask from iavf_irq_enable_queues() (Petr Oros) [2228161 2223604]
  - iavf: send VLAN offloading caps once after VFR (Petr Oros) [2228161 2223604]
  - i40e: Wait for pending VF reset in VF set callbacks (Ivan Vecera) [2228163 2203921]
  - i40e: Add helper for VF inited state check with timeout (Ivan Vecera) [2228163 2203921]
  - ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep() (Mark Langsdorf) [2218025 2215625]
  - locking/semaphore: Add might_sleep() to down_*() family (Mark Langsdorf) [2218025 2215625]
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (Davide Caratti) [2219660 2218676] {CVE-2023-3090}
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Phil Sutter) [2216165 2214963] {CVE-2023-3390}
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Phil Sutter) [2216165 2214963] {CVE-2023-3390}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (Phil Sutter) [2216165 2214963] {CVE-2023-3390}


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.25.1.el8_8]
changelog:
  - netfilter: nft_set_pipapo: fix improper element removal (Phil Sutter) [2227508 2225276] {CVE-2023-4004}
  - perf/x86/rapl: Add support for Intel Emerald Rapids (Michael Petlan) [2230162 2165766]
  - perf/x86/intel/cstate: Add Emerald Rapids (Michael Petlan) [2230152 2156802]
  - perf/x86/intel: Add Emerald Rapids (Michael Petlan) [2230152 2156802]
  - perf/x86/intel/uncore: Add Emerald Rapids (Michael Petlan) [2230152 2156802]
  - perf/x86/msr: Add Emerald Rapids (Michael Petlan) [2230152 2156802]
  - perf/x86/msr: Add Sapphire Rapids CPU support (Michael Petlan) [2230152 2156802]
  - netfilter: xt_owner: Add supplementary groups option (Phil Sutter) [2229715 2136194]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.26.1.el8_8]
changelog:
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Cathy Avery) [2230743 1986067]
  - kernfs: Improve kernfs_notify() poll notification latency (Ian Kent) [2208540]
  - crypto: rng - Fix lock imbalance in crypto_del_rng (Herbert Xu) [2232215]
  - net: stmmac: propagate feature flags to vlan (Corinna Vinschen) [2219907 2174701]
  - scsi: storvsc: Handle SRB status value 0x30 (Cathy Avery) [2231988 2218133]


author: Lucas Zampieri <lzampier@redhat.com> [4.18.0-477.27.1.el8_8]
changelog:
  - gfs2: Fix freeze consistency check in gfs2_trans_add_meta (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: gfs2_freeze_lock_shared cleanup (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Replace sd_freeze_state with SDF_FROZEN flag (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rework freeze / thaw logic (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rename SDF_{FS_FROZEN => FREEZE_INITIATOR} (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Reconfiguring frozen filesystem already rejected (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rename gfs2_freeze_lock{ => _shared } (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rename the {freeze,thaw}_super callbacks (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: Rename remaining "transaction" glock references (Andreas Gruenbacher) [2231825 2095340]
  - gfs2: init system threads before freeze lock (Bob Peterson) [2231825 2095340]
  - cifs: fix bogus cifs_mount error handling in RHEL8 (Jeffrey Layton) [2229128 2215018]
  - cifs: missing null pointer check in cifs_mount (Jay Shin) [2229128 2215018]
  - x86/cpu: Add CPU model numbers for Meteor Lake (Prarit Bhargava) [2230158 2156826]
  - redhat/configs: enable CONFIG_INTEL_UNCORE_FREQ_CONTROL for x86_64 (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Return error on write frequency (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: Add client processors (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: add Emerald Rapids support (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: Use sysfs_emit() to instead of scnprintf() (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: Prevent driver loading in guests (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-freq: fix uncore_freq_common_init() error codes (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Split common and enumeration part (David Arcari) [2230158 2156826]
  - platform/x86/intel/uncore-freq: Display uncore current frequency (David Arcari) [2230158 2156826]
  - platform/x86/intel/uncore-freq: Use sysfs API to create attributes (David Arcari) [2230158 2156826]
  - platform/x86/intel/uncore-freq: Move to uncore-frequency folder (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-frequency: use default_groups in kobj_type (David Arcari) [2230158 2156826]
  - platform/x86: intel-uncore-frequency: Move to intel sub-directory (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Add Sapphire Rapids server support (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: make uncore_root_kobj static (David Arcari) [2230158 2156826]
  - platform/x86: Convert to new CPU match macros (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Add release callback (David Arcari) [2230158 2156826]
  - platform/x86/intel-uncore-freq: Fix static checker issue and potential race condition (David Arcari) [2230158 2156826]
  - MAINTAINERS: Update for the intel uncore frequency control (David Arcari) [2230158 2156826]
  - platform/x86: Add support for Uncore frequency control (David Arcari) [2230158 2156826]
  - scsi: storvsc: Remove errant duplicate code (Cathy Avery) [2233227 2211725]
  - scsi: storvsc: Limit max_sectors for virtual Fibre Channel devices (Cathy Avery) [2233227 2211725]
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (Davide Caratti) [2225647 2225103] {CVE-2023-3776}
  - iavf: remove active_cvlans and active_svlans bitmaps (Stefan Assmann) [2232399 2153349]
  - iavf: refactor VLAN filter states (Stefan Assmann) [2232399 2153349]
  - iavf: do not track VLAN 0 filters (Stefan Assmann) [2232399 2153349]
  - iavf: fix non-tunneled IPv6 UDP packet type and hashing (Stefan Assmann) [2232399 2153349]
  - iavf: fix inverted Rx hash condition leading to disabled hash (Stefan Assmann) [2232399 2153349]
  - net/sched: move struct tc_mqprio_qopt_offload from pkt_cls.h to pkt_sched.h (Stefan Assmann) [2232399 2153349]
  - iavf/iavf_main: actually log ->src mask when talking about it (Stefan Assmann) [2232399 2153349]
  - iavf: Fix VF driver counting VLAN 0 filters (Stefan Assmann) [2232399 2153349]
  - iavf: Change information about device removal in dmesg (Stefan Assmann) [2232399 2153349]
  - iavf: Replace __FUNCTION__ with __func__ (Stefan Assmann) [2232399 2153349]
  - net: Remove the obsolte u64_stats_fetch_*_irq() users (drivers). (Stefan Assmann) [2232399 2153349]
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Florian Westphal) [2221725 2221046] {CVE-2023-35001}


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27_rc2.an8]
changelog:
  - anolis: kbuild: fix error remind bug for libelf check (Yuanhe Shu)
  - anolis: configs: enable RCU_TORTURE_TEST for arm64 (Erwei Deng)
  - erofs: use kill_anon_super() to kill super in fscache mode (Jia Zhu)
  - hardirq/nmi: Allow nested nmi_enter() (Peter Zijlstra)
  - cachefiles: make on-demand request distribution fairer (Xin Yin)
  - anolis: cachefiles: refactor cachefiles_ondemand_daemon_read() (Jingbo Xu)
  - cachefiles: fix error return code in cachefiles_ondemand_copen() (Sun Ke)
  - anolis: erofs: update page for .readpages() in fscache mode (Jingbo Xu)
  - anolis: cachefiles: fix volume key setup for cachefiles_open (Jingbo Xu)
  - anolis: cachefiles: replace BUG_ON() with WARN_ON() (Jingbo Xu)
  - xfs: Sanity check flags of Q_XQUOTARM call (Jan Kara)
  - anolis: configs: enable CONFIG_LOCK_TORTURE_TEST for arm64 (Erwei Deng)
  - vfio/pci: Handle concurrent vma faults (liuxinwei)
  - anolis: revert: pci: shorten waiting time in pci_reset_secondary_bus (Yang Su)
  - io_uring: don't convert to jiffies for waiting on timeouts (Jens Axboe)
  - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT (Josh Poimboeuf) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Warn about Spectre v2 LFENCE mitigation (Josh Poimboeuf) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf) {CVE-2022-0001,CVE-2022-0002}
  - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel)) {CVE-2022-0001,CVE-2022-0002}
  - x86,bugs: Unconditionally allow spectre_v2=retpoline,amd (Peter Zijlstra) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov) {CVE-2022-0001,CVE-2022-0002}
  - xen/blkfront: fix leaking data in shared pages (Ziyang Zhang) {CVE-2022-26365}
  - bnx2x: fix potential memory leak in bnx2x_tpa_stop() (Jianglei Nie) {CVE-2022-3542}
  - scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg() (Gu Mi)
  - scsi: qla2xxx: Set the qpair in SRB to NULL when SRB is released (Gu Mi)
  - scsi: qla2xxx: Move ABTS code behind qpair (Gu Mi)
  - scsi: qla2xxx: Fix out of order Termination and ABTS response (Gu Mi)
  - scsi: qla2xxx: Add logic to detect ABTS hang and response completion (Gu Mi)
  - dm verity: set DM_TARGET_IMMUTABLE feature flag (Sarthak Kukreti) {CVE-2022-2503}
  - bitops: protect variables in set_mask_bits() macro (Miklos Szeredi)
  - anolis: mm: kidled: improve efficiency of scanning valid PFNs (Rongwei Wang)
  - x86/speculation/mmio: Reuse SRBDS mitigation for SBDS (Pawan Gupta)
  - x86/speculation/mmio: Enable CPU Fill buffer clearing on idle (Pawan Gupta)
  - x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data (Pawan Gupta)
  - x86/speculation: Add a common function for MD_CLEAR mitigation update (Pawan Gupta)
  - x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug (Pawan Gupta)
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family (Tony Luck)
  - x86/cpu: Add Jasper Lake to Intel family (Zhang Rui)
  - x86/cpu: Add Elkhart Lake to Intel family (Gayatri Kammela)
  - perf: Fix sys_perf_event_open() race against self (Peter Zijlstra) {CVE-2022-1729}


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27_rc3.an8]
changelog:
  - anolis: sched/fair: fix sched_group_identity_enabled read error (Cruz Zhao)
  - mm: fix a race on nr_swap_pages (Zhaoyang Huang)
  - anolis: sched/fair: fix group identity fast path omits select_idle_core() (Cruz Zhao)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.an8]
changelog:
  - xfs: fix an ABBA deadlock in xfs_rename (Darrick J. Wong)
  - xfs: Fix deadlock between AGI and AGF when target_ip exists in xfs_rename() (kaixuxia)
  - iomap: Fix negative assignment to unsigned sis->pages in iomap_swapfile_activate (Ritesh Harjani)
  - ext4: prevent partial update of the extent blocks (Zhang Yi)
  - ext4: check for inconsistent extents between index and leaf block (Zhang Yi)
  - ext4: check for out-of-order index extents in ext4_valid_extent_entries() (Zhang Yi)
  - ext4: add check to prevent attempting to resize an fs with sparse_super2 (Josh Triplett)
  - ext4: add reserved GDT blocks check (Zhang Yi)
  - anolis: mm: avoid shmem_getpage_gfp sleep in atomic (Rongwei Wang)
  - anolis: mm: gup:remove FOLL_GET_PGSTABLE flag checking (Simon Guo)
  - anolis: psi: fix compile error when cgroup disabled (Joseph Qi)
  - anolis: io_uring: fix compile error when cgroup disabled (Joseph Qi)
  - anolis: erofs: make fscache and RAFS mode mutually exclusive (Jingbo Xu)
  - anolis: erofs: force bootstrap_path to be regular file (Jingbo Xu)
  - anolis: erofs: make bootstrap_path mandatory in RAFS mode (Jingbo Xu)
  - anolis: erofs: fix erofs_is_fscache_mode() (Jingbo Xu)
  - net: Fix gro aggregation for udp encaps with zero csum (Daniel Borkmann)
  - anolis: rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs (leoliu)
  - USB: HCD: Fix URB giveback issue in tasklet function (leoliu-oc)
  - anolis: iommu: SMMU will be passthrough on PHYTIUM FT2000 & FT2500 Socs due to hardware limitation (Gu Mi)
  - printk: Drop console_sem during panic (Stephen Brennan)
  - printk: Avoid livelock with heavy printk during panic (Stephen Brennan)
  - printk: disable optimistic spin during panic (Stephen Brennan)
  - printk: Add panic_in_progress helper (Stephen Brennan)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.1.an8]
changelog:
  - anolis: bpf: add reserve fields for bpf structures (Tianchen Ding)
  - xprtrdma: fix incorrect header size calculations (Colin Ian King) {CVE-2022-0812}
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Linus Torvalds) {CVE-2022-4378}
  - proc: avoid integer type confusion in get_proc_long (Linus Torvalds) {CVE-2022-4378}
  - KVM: x86: do not report a vCPU as preempted outside instruction boundaries (Paolo Bonzini) {CVE-2022-39189}
  - nvme: ensure subsystem reset is single threaded (Keith Busch) {CVE-2022-3169}
  - nvme: Wait for reset state when required (Keith Busch) {CVE-2022-3169}
  - nvme-pci: Allow PCI bus-level PM to be used if ASPM is disabled (Rafael J. Wysocki) {CVE-2022-3169}
  - PCI/ASPM: Add pcie_aspm_enabled() (Rafael J. Wysocki) {CVE-2022-3169}
  - nvme-pci: use host managed power state for suspend (Keith Busch) {CVE-2022-3169}
  - nvme: introduce nvme_sync_io_queues (Chao Leng) {CVE-2022-3169}
  - nvme: include admin_q sync with nvme_sync_queues (Edmund Nadolski) {CVE-2022-3169}
  - nvme-pci: Sync queues on reset (Keith Busch) {CVE-2022-3169}
  - nvme: export get and set features (Keith Busch) {CVE-2022-3169}
  - nvme: Prevent resets during paused controller state (Keith Busch) {CVE-2022-3169}
  - nvme: restrict management ioctls to admin (Keith Busch) {CVE-2022-3169}
  - sch_sfb: Don't assume the skb is still around after enqueueing to child (Toke Høiland-Jørgensen) {CVE-2022-3586}
  - arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
  - KVM: arm64: Check arm64_get_bp_hardening_data() didn't return NULL (James Morse)
  - arm64: Use the clearbhb instruction in mitigations (James Morse)
  - arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly)
  - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (James Morse)
  - arm64: Mitigate spectre style branch history side channels (James Morse)
  - KVM: arm64: Add templates for BHB mitigation sequences (James Morse)
  - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 (James Morse)
  - arm64: Add percpu vectors for EL1 (James Morse)
  - arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse)
  - arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse)
  - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse)
  - arm64: entry: Allow the trampoline text to occupy multiple pages (James Morse)
  - arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse)
  - arm64: entry: Move trampoline macros out of ifdef'd section (James Morse)
  - arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse)
  - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary (James Morse)
  - arm64: entry: Move the trampoline data page before the text page (James Morse)
  - arm64: entry: Free up another register on kpti's tramp_exit path (James Morse)
  - arm64: entry: Make the trampoline cleanup optional (James Morse)
  - arm64: entry.S: Add ventry overflow sanity checks (James Morse)
  - arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual)
  - arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose)
  - arm64: Add part number for Arm Cortex-A77 (Rob Herring)
  - ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle (Ard Biesheuvel)
  - ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 (Ard Biesheuvel)
  - ARM: 9196/1: spectre-bhb: enable for Cortex-A15 (Ard Biesheuvel)
  - ARM: fix Thumb2 regression with Spectre BHB (Russell King (Oracle))
  - ARM: Spectre-BHB: provide empty stub for non-config (Randy Dunlap)
  - ARM: fix build warning in proc-v7-bugs.c (Russell King (Oracle))
  - ARM: Do not use NOCROSSREFS directive with ld.lld (Nathan Chancellor)
  - ARM: fix co-processor register typo (Russell King (Oracle))
  - kbuild: add CONFIG_LD_IS_LLD (Sami Tolvanen)
  - ARM: fix build error when BPF_SYSCALL is disabled (Emmanuel Gil Peyrot)
  - ARM: include unprivileged BPF status in Spectre V2 reporting (Russell King (Oracle))
  - ARM: Spectre-BHB workaround (Russell King (Oracle))
  - ARM: use LOADADDR() to get load address of sections (Russell King (Oracle))
  - ARM: early traps initialisation (Russell King (Oracle))
  - ARM: report Spectre v2 status through sysfs (Russell King (Oracle))
  - arm/arm64: smccc/psci: add arm_smccc_1_1_get_conduit() (Mark Rutland)
  - arm/arm64: Provide a wrapper for SMCCC 1.1 calls (Steven Price)
  - xen/netfront: fix leaking data in shared pages (Roger Pau Monne) {CVE-2022-33740}
  - powerpc/32: Fix overread/overwrite of thread_struct via ptrace (Michael Ellerman) {CVE-2022-32981}
  - floppy: disable FDRAWCMD by default (Willy Tarreau) {CVE-2022-33981,CVE-2022-1836}
  - x86/speculation: Add LFENCE to RSB fill sequence (Pawan Gupta) {CVE-2022-26373}
  - x86/speculation: Add RSB VM Exit protections (Daniel Sneddon) {CVE-2022-26373}
  - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf) {CVE-2022-26373}
  - x86/entry: Add kernel IBRS implementation (Peter Zijlstra) {CVE-2022-26373}
  - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra) {CVE-2022-26373}
  - x86/cpufeatures: Move RETPOLINE flags to word 11 (Peter Zijlstra) {CVE-2022-26373}
  - xen/arm: Fix race in RB-tree based P2M accounting (Oleksandr Tyshchenko) {CVE-2022-33744}
  - tcp: drop the hash_32() part from the index calculation (Willy Tarreau) {CVE-2022-32296}
  - tcp: increase source port perturb table to 2^16 (Willy Tarreau) {CVE-2022-32296}
  - tcp: dynamically allocate the perturb table used by source ports (Willy Tarreau) {CVE-2022-32296}
  - tcp: add small random increments to the source port (Kangjie Xu) {CVE-2022-32296}
  - tcp: resalt the secret every 10 seconds (Eric Dumazet) {CVE-2022-32296}
  - tcp: use different parts of the port_offset for index and offset (Willy Tarreau) {CVE-2022-32296}
  - tcp: change source port randomizarion at connect() time (Willy Tarreau) {CVE-2022-32296}
  - kcm: avoid potential race in kcm_tx_work (Eric Dumazet) {CVE-2022-3521}
  - af_key: Do not call xfrm_probe_algs in parallel (Herbert Xu) {CVE-2022-3028}
  - mISDN: fix use-after-free bugs in l1oip timer handlers (Duoming Zhou) {CVE-2022-3565}
  - vsock: Fix memory leak in vsock_connect() (Peilin Ye) {CVE-2022-3629}
  - nfp: fix use-after-free in area_cache_get() (Jialiang Wang) {CVE-2022-3545}
  - netfilter: nf_conntrack_irc: Fix forged IP logic (David Leadbeater) {CVE-2022-2663}
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (Luiz Augusto von Dentz) {CVE-2022-42895}
  - igmp: Add ip_mc_list lock in ip_check_mc_rcu (Liu Jian) {CVE-2022-20141}
  - net/x25: Fix null-ptr-deref caused by x25_disconnect (Duoming Zhou) {CVE-2022-1516}
  - arm64: fix oops in concurrently setting insn_emulation sysctls (haibinzhang (张海斌))
  - efi: capsule-loader: Fix use-after-free in efi_capsule_write (Hyunwoo Kim) {CVE-2022-40307}
  - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() (Dokyung Song) {CVE-2022-3628}
  - usb: mon: make mmapped memory read only (Tadeusz Struk) {CVE-2022-43750}
  - r8152: Rate limit overflow messages (Andrew Gaul) {CVE-2022-3594}
  - atm: idt77252: fix use-after-free bugs caused by tst_timer (Duoming Zhou) {CVE-2022-3635}
  - video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write (Hyunwoo Kim) {CVE-2022-39842}
  - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls (Chen-Yu Tsai) {CVE-2022-20369}
  - sr9700: sanity check for packet length (Oliver Neukum) {CVE-2022-26966}
  - parisc: Declare pci_iounmap() parisc version only when CONFIG_PCI enabled (Helge Deller)
  - pci_iounmap'2: Electric Boogaloo: try to make sense of it all (Linus Torvalds)
  - asm-generic/io.h: Fix !CONFIG_GENERIC_IOMAP pci_iounmap() implementation (Lorenzo Pieralisi)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.2.an8]
changelog:
  - anolis: nfsd: remove nfsd_reply_cache_shutdown() in nfsd_exit_net (Yuanhe Shu)
  - RDMA/core: Don't infoleak GRH fields (Leon Romanovsky) {CVE-2021-3923}
  - vgacon: Fix for missing check in scrollback handling (Yunhai Zhang) {CVE-2020-14331}
  - btrfs: fix race between quota disable and quota assign ioctls (Filipe Manana) {CVE-2023-1611}
  - Fix double fget() in vhost_net_set_backend() (Al Viro)
  - seq_buf: Fix overflow in seq_buf_putmem_hex() (Yun Zhou) {CVE-2023-28772}
  - drm/nouveau/mmu: add more general vmm free/node handling functions (Ben Skeggs) {CVE-2023-0030}
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (ly929421) {CVE-2023-1118}
  - USB: core: Prevent nested device-reset calls (Alan Stern) {CVE-2022-4662}
  - Bluetooth: L2CAP: Fix u8 overflow (zzzzzzzzzy9) {CVE-2022-45934}
  - drm/amdkfd: Check for null pointer after calling kmemdup (Jiasheng Jiang) {CVE-2022-3108}
  - l2tp: Serialize access to sk_user_data with sk_callback_lock (Jakub Sitnicki) {CVE-2022-4129}
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Maxim Mikityanskiy) {CVE-2022-3564}
  - tcp/udp: Fix memory leak in ipv6_renew_options(). (Kuniyuki Iwashima) {CVE-2022-3524}
  - nfc: fix refcount leak in llcp_sock_connect() (Xiaoming Ni)
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (Luiz Augusto von Dentz) {CVE-2022-20566}
  - netfilter: nf_tables: fix null deref due to zeroed list head (张钰 10307750)
  - nfc: fix refcount leak in llcp_sock_bind() (Xiaoming Ni)
  - net: sched: fix race condition in qdisc_graft() (Eric Dumazet) {CVE-2023-0590}
  - nfc: fix memory leak in llcp_sock_connect() (Xiaoming Ni)
  - net/sched: tcindex: update imperfect hash filters respecting rcu (Pedro Tammela) {CVE-2023-1281}
  - net: sched: cbq: dont intepret cls results when asked to drop (Jamal Hadi Salim) {CVE-2023-23454}
  - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (Jann Horn) {CVE-2022-2964}
  - net: mpls: fix stale pointer if allocation fails during device rename (Jakub Kicinski) {CVE-2023-26545}
  - sctp: fail if no bound addresses can be used for a given scope (Marcelo Ricardo Leitner) {CVE-2023-1074}
  - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (Herbert Xu) {CVE-2023-0394}
  - net: sched: disallow noqueue for qdisc classes (Frederick Lawler) {CVE-2022-47929}
  - net: sched: atm: dont intepret cls results when asked to drop (Jamal Hadi Salim) {CVE-2023-23455}
  - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid (Szymon Heidrich) {CVE-2023-23559}
  - net: mvpp2: fix mvpp2 debugfs leak (Russell King (Oracle)) {CVE-2022-3535}
  - memcg: enable accounting of ipc resources (Vasily Averin) {CVE-2021-3759}
  - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (Jann Horn) {CVE-2022-42703}
  - hv_netvsc: Add check for kvmalloc_array (Jiasheng Jiang) {CVE-2022-3107}
  - NFC: netlink: fix sleep in atomic bug when firmware download timeout (feng.wei) {CVE-2022-1975}
  - anolis: x86/kasan: Map shadow for percpu pages on demand (Xuchun Shang)
  - anolis: x86/kasan: Add helpers to align shadow addresses up and down (Xuchun Shang)
  - net/ulp: prevent ULP without clone op from entering the LISTEN status (Paolo Abeni) {CVE-2023-0461}
  - x86/mm: Randomize per-cpu entry area (Peter Zijlstra) {CVE-2023-0597}
  - anolis: random32: put prandom_init in a earlier step (Xuchun Shang) {CVE-2023-0597}
  - x86/hw_breakpoint: Prevent data breakpoints on direct GDT (Lai Jiangshan) {CVE-2023-0597}
  - x86/hw_breakpoint: Add within_area() to check data breakpoints (Lai Jiangshan) {CVE-2023-0597}
  - x86/hw_breakpoint: Prevent data breakpoints on cpu_entry_area (Andy Lutomirski) {CVE-2023-0597}
  - x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise (Ingo Molnar) {CVE-2023-0597}
  - xen/netback: don't call kfree_skb() with interrupts disabled (Juergen Gross)
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (Luiz Augusto von Dentz) {CVE-2022-42896}
  - net: sched: sch_teql: fix null-pointer dereference (Pavel Tikhomirov)
  - tcp/dccp: fix possible race __inet_lookup_established() (Eric Dumazet)
  - power: supply: wm8350-power: Add missing free in free_charger_irq (Jiasheng Jiang) {CVE-2022-3111}
  - media: em28xx: initialize refcount before kref_get (Dongliang Mu) {CVE-2022-3239}
  - media: dvb-core: Fix UAF due to refcount races at releasing (Takashi Iwai) {CVE-2022-41218}
  - ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (Clement Lecigne) {CVE-2023-0266}
  - drivers: net: slip: fix NPD bug in sl_tx_timeout() (Duoming Zhou) {CVE-2022-41858}
  - xen/netfront: force data bouncing when backend is untrusted (Roger Pau Monne) {CVE-2022-33741}
  - tcp: Fix data races around icsk->icsk_af_ops. (Kuniyuki Iwashima) {CVE-2022-3566}
  - anolis: bond: broadcast ARP or ND messages to all slaves (Tony Lu)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.3.an8]
changelog:
  - nvme-pci: rerun irq setup on IO queue init errors (Keith Busch)
  - nvme-pci: refactor nvme_disable_io_queues (Christoph Hellwig)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.4.an8]
changelog:
  - iommu/vt-d: Fix agaw for a supported 48 bit guest address width (Gu Mi)
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Pablo Neira Ayuso) {CVE-2023-32233}


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.5.an8]
changelog:
  - iomap: Support inline data with block size < page size (Matthew Wilcox (Oracle))
  - iomap: support reading inline data from non-zero pos (Gao Xiang)
  - iomap: Don't create iomap_page objects for inline files (Andreas Gruenbacher)
  - selinux: fix race condition when computing ocontext SIDs (gcc_2023)
  - virtio_blk: fix the discard_granularity and discard_alignment queue limits (Christoph Hellwig)
  - virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero (Xie Yongji)
  - ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline (Ye Bin)
  - ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline (Eric Whitney)
  - ext4: fix corruption when online resizing a 1K bigalloc fs (Baokun Li)
  - ext4: avoid resizing to a partial cluster size (Kiselev, Oleg)
  - ext4: reduce computation of overhead during resize (Kiselev, Oleg)
  - ext4: fix extent status tree race in writeback error recovery path (Eric Whitney)
  - ext4: update s_overhead_clusters in the superblock during an on-line resize (Theodore Ts'o)
  - ext4: force overhead calculation if the s_overhead_cluster makes no sense (Theodore Ts'o)
  - ext4: fix avefreec in find_group_orlov (Pan Dong)
  - isolcpus: Affine unbound kernel threads to housekeeping cpus (Marcelo Tosatti)
  - kthread: Switch to cpu_possible_mask (Marcelo Tosatti)
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Thadeu Lima de Souza Cascardo) {CVE-2023-35001}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (D. Wythe) {CVE-2023-3117}
  - sched/rt: pick_next_rt_entity(): check list_entry (Pietro Borrello) {CVE-2023-1077}
  - relayfs: fix out-of-bounds access in relay_file_read (Zhang Zhengming) {CVE-2023-3268}
  - kernel/relay.c: fix read_pos error when multiple readers (Pengcheng Yang) {CVE-2023-3268}
  - drm/i915/gvt: fix double free bug in split_2MB_gtt_entry (Zheng Wang) {CVE-2022-3707}
  - usb: gadget: rndis: prevent integer overflow in rndis_set_response() (Dan Carpenter) {CVE-2022-20423}
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work (Zheng Wang) {CVE-2023-1989}
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition (Zheng Wang) {CVE-2023-30772}
  - phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function (Miaoqian Lin) {CVE-2023-23000}
  - HID: check empty report_list in hid_validate_values() (Pietro Borrello) {CVE-2023-1073}
  - staging: rtl8712: fix use after free bugs (Dan Carpenter) {CVE-2022-4095}
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition (Zheng Wang) {CVE-2023-1855}
  - HID: roccat: Fix use-after-free in roccat_read() (Hyunwoo Kim) {CVE-2022-41850}
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition (Zheng Wang) {CVE-2023-1990}
  - prlimit: do_prlimit needs to have a speculation check (Greg Kroah-Hartman) {CVE-2023-0458}
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach (Zheng Wang) {CVE-2023-1670}
  - media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors (shi.xue) {CVE-2020-0404}
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() (Baisong Zhong) {CVE-2023-28328}
  - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() (Wei Chen) {CVE-2023-2194}
  - drm/vmwgfx: Validate the box size for the snooped cursor (Zack Rusin) {CVE-2022-36280}
  - x86/bugs: Flush IBP in ib_prctl_set() (Rodrigo Branco) {CVE-2023-0045}
  - drm/msm/dpu: Add check for pstates (Jiasheng Jiang) {CVE-2023-3220}
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang) {CVE-2023-35825}
  - tap: tap_open(): correctly initialize socket uid (Pietro Borrello) {CVE-2023-1076}
  - tun: tun_chr_open(): correctly initialize socket uid (Pietro Borrello) {CVE-2023-1076}
  - net: add sock_init_data_uid() (Pietro Borrello) {CVE-2023-1076}
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Hangyu Hua) {CVE-2023-35788}
  - net/sched: Retire tcindex classifier (Jamal Hadi Salim) {CVE-2023-1829}
  - ntfs: fix out-of-bounds read in ntfs_attr_find() (Hawkins Jiawei) {CVE-2023-26607}
  - ntfs: fix use-after-free in ntfs_ucsncmp() (ChenXiaoSong)
  - fs: hfsplus: fix UAF issue in hfsplus_put_super (Dongliang Mu) {CVE-2023-2985}
  - rds: rds_rm_zerocopy_callback() use list_first_entry() (Pietro Borrello) {CVE-2023-1078}
  - arm64: PCI: Preserve firmware configuration when desired (Benjamin Herrenschmidt)
  - arm64: PCI: Allow resource reallocation if necessary (Benjamin Herrenschmidt)
  - xen/blkfront: force data bouncing when backend is untrusted (Roger Pau Monne) {CVE-2022-33742.}
  - virtio_net: suppress cpu stall when free_unused_bufs (Wenliang Wang)
  - virtio_net: split free_unused_bufs() (Xuan Zhuo)
  - ext4: correct the misjudgment in ext4_iget_extra_inode (Baokun Li) {CVE-2023-2513}
  - ext4: correct max_inline_xattr_value_size computing (Baokun Li) {CVE-2023-2513}
  - ext4: fix use-after-free in ext4_xattr_set_entry (Baokun Li) {CVE-2023-2513}
  - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (Baokun Li) {CVE-2023-2513}
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern (Mike Snitzer) {CVE-2023-2269}
  - ext4: avoid cycles in directory h-tree (Jan Kara) {CVE-2022-1184}
  - ext4: verify dir block before splitting it (Jan Kara) {CVE-2022-1184}
  - ovl: enable RCU'd ->get_acl() (Miklos Szeredi)
  - anolis: Revert "anolis: erofs,ovl: bypass [override|revert]_creds for overlayfs" (Jingbo Xu)
  - anolis: Revert "anolis: erofs,ovl: enable RCU'd ->get_acl()" (Jingbo Xu)
  - anolis: virtio-blk: skip BUG_ON() in virtio_queue_rq() for discard command (fupan)


author: Qinyun Tan <qinyuntan@linux.alibaba.com> [4.19.91-27.6.an8]
changelog:
  - driver core: auxiliary bus: make remove function return void (Greg Kroah-Hartman)
  - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Peter Ujfalusi)
  - driver core: auxiliary bus: Fix calling stage for auxiliary bus init (Dave Jiang)
  - driver core: auxiliary bus: Fix auxiliary bus shutdown null auxdrv ptr (Dave Jiang)
  - anolis: config: Add AUXILIARY_BUS support in anolis defconfig (cuishw)
  - Add auxiliary bus support (Dave Ertman)
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (M A Ramdhan) {CVE-2023-3776}
  - net: tun: fix bugs for oversize packet when napi frags enabled (Ziyang Xuan) {CVE-2023-3812}
  - tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS (Yunjian Wang) {CVE-2023-3812}
  - anolis: configs: disable CONFIG_BPFILTER (Tianchen Ding)
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Pablo Neira Ayuso)
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Pablo Neira Ayuso)
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (Pablo Neira Ayuso)
  - anolis: Revert "netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE" (tangbin)
  - anolis: mm: unlock zdm_lock after delete zdm (Ning Zhang)
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Gwangun Jung) {CVE-2023-31436}
  - perf script python: Add Python3 support to tests/attr.py (Tony Jones)
  - nvme-pci: Fix controller freeze wait disabling (Keith Busch)
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng) {CVE-2023-3090}
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Pedro Tammela) {CVE-2023-3611}
  - net/sched: cls_u32: Fix reference counter leak leading to overflow (Lee Jones) {CVE-2023-3609}
  - gfs2: Don't deref jdesc in evict (Bob Peterson) {CVE-2023-3212,CVE-2023-3212}
  - btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (Zixuan Fu) {CVE-2023-3111}
  - btrfs: check return value of btrfs_commit_transaction in relocation (Josef Bacik) {CVE-2023-3111}
  - xfs: verify buffer contents when we skip log replay (Darrick J. Wong) {CVE-2023-2124}
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus) {CVE-2023-34256}
  - uaccess: Add speculation barrier to copy_from_user() (Dave Hansen) {CVE-2023-0459}
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Takashi Iwai) {CVE-2023-31084}
  - anolis: sched/isolation: fix a memory leak in procfs (Tianchen Ding)
  - KVM: nVMX: add missing consistency checks for CR0 and CR4 (Paolo Bonzini) {CVE-2023-30456}
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Mike Christie) {CVE-2023-2162}
  - bpf: fix buggy r0 retval refinement for tracing helpers (Daniel Borkmann)
  - erofs: fix misbehavior of unsupported chunk format check (Gao Xiang)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-15_rc3.an8]
changelog:
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang) {CVE-2023-35825}
  - relayfs: fix out-of-bounds access in relay_file_read (Zhang Zhengming) {CVE-2023-3268}
  - drm/msm/dpu: Add check for pstates (Jiasheng Jiang) {CVE-2023-3220}
  - driver core: auxiliary bus: make remove function return void (Greg Kroah-Hartman)
  - devlink: Extend devlink port documentation for subfunctions (Parav Pandit)
  - devlink: Add devlink port documentation (Parav Pandit)
  - devlink: Support get and set state of port function (Parav Pandit)
  - devlink: Support add and delete devlink port (Parav Pandit)
  - devlink: Introduce PCI SF port flavour and port attribute (Parav Pandit)
  - devlink: Prepare code to fill multiple port function attributes (Parav Pandit)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-15_rc3.1.an8]
changelog:
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Mike Christie) {CVE-2023-2162}
  - anolis: Revert "selftest: kvm: Add amx selftest" (Guanjun)
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Thadeu Lima de Souza Cascardo) {CVE-2023-35001}
  - netfilter: nf_tables: do not ignore genmask when looking up chain by id (D. Wythe) {CVE-2023-31248}
  - uaccess: Add speculation barrier to copy_from_user() (Dave Hansen) {CVE-2023-0459}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (D. Wythe) {CVE-2023-3117}
  - tipc: set con sock in tipc_conn_alloc (Xin Long) {CVE-2023-1382,CVE-2023-1382}
  - anolis: sched/isolation: fix a memory leak in procfs (Tianchen Ding)
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus)
  - anolis: Revert "anolis: io_uring: lift nice value of sqthread" (Ferry Meng)
  - anolis: mm/lru: align lruvec lock to a cache line (Rongwei Wang)
  - cgroup: always put cset in cgroup_css_set_put_fork (John Sperbeck)
  - anolis: Revert "anolis: xfs: account extra freespace btree splits for multiple allocations" (Gao Xiang)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-15.an8]
changelog:
  - xfs: verify buffer contents when we skip log replay (Darrick J. Wong) {CVE-2023-2124}
  - anolis: net/smc: fix hung state in inet sock (D. Wythe)
  - anolis: net/smc: avoid applications receiving clc msg (D. Wythe)
  - anolis: net/smc: Improve print and remove module params of reserve_mode (Wen Gu)
  - anolis: net/smc: validate rdma writable by rtoken_idx (Guangguan Wang)
  - anolis: net/smc: fix dup smc diag info (D. Wythe)
  - anolis: net/smc: Fix potential memory leaks and exceptions in inet (D. Wythe)
  - anolis: net/smc: fix ebpf panic (D. Wythe)
  - anolis: net/smc: fix bpf compile error (D. Wythe)
  - anolis: net/smc: fix potential reference count leak in smc (D. Wythe)
  - anolis: net/smc: protect connection state transitions in listen work (D. Wythe)
  - anolis: net/smc: optimize mutex_fback_rsn from mutex to spinlock (D. Wythe)
  - anolis: net/smc: refactor sock_flag/sock_set_flag (D. Wythe)
  - anolis: net/smc: add default name for smc negotiator (D. Wythe)
  - anolis: net/smc: do not check diff_cons when rmb_desc is null (Guangguan Wang)
  - anolis: net/smc: Expand the statistical range of ringbufs (Wen Gu)
  - anolis: net/smc: Expand the upper limit of SMCR/D ringbuf to 2MB (Wen Gu)
  - anolis: net/smc: Split wr_rx_buf into SMC_WR_BUF_CNT (Wen Gu)
  - anolis: net/smc: Adjust reserved-ports range and add warning print (Wen Gu)
  - anolis: net/smc: Fix fallback count overflow issue (Wen Gu)
  - anolis: net/smc: sock_hold in conns_lock protect area when smc_lgr_find_conn (Guangguan Wang)
  - anolis: net/smc: protect rdma_write processing from deleting rkey (Guangguan Wang)
  - anolis: net/smc: do not validate rkey by testing rkey value (Guangguan Wang)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-15.1.an8]
changelog:
  - anolis: configs: Enable CRYPTO_OFB for fips mode (Tianjia Zhang)
  - anolis: erofs: fix EROFS completely broken due to RAFS v6 support (Gao Xiang)
  - erofs: fix misbehavior of unsupported chunk format check (Gao Xiang)
  - anolis: RDMA/erdma: Add erdma to arm64 defconfig (Kai Shen)
  - perf build: Install libsymbol locally when building (Ian Rogers)
  - tool lib symbol: Add Makefile/Build (Ian Rogers)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-16_rc1.an8]
changelog:
  - anolis: net/smc: enlarge testlink llc wait time to 4 * HZ (Guangguan Wang)
  - ext4: don't allow journal inode to have encrypt flag (Eric Biggers)
  - fs: ext4: initialize fsdata in pagecache_write() (Alexander Potapenko)
  - ext4: use memcpy_to_page() in pagecache_write() (Chaitanya Kulkarni)
  - mm/highmem: Lift memcpy_[to|from]_page to core (Ira Weiny)
  - ext4: correct inconsistent error msg in nojournal mode (Baokun Li)
  - ext4: goto right label 'failed_mount3a' (Jason Yan)
  - ext4: allocate extended attribute value in vmalloc area (Ye Bin)
  - ext4: avoid unaccounted block allocation when expanding inode (Jan Kara)
  - ext4: initialize quota before expanding inode in setproject ioctl (Jan Kara)
  - ext4: fix error code return to user-space in ext4_get_branch() (Luís Henriques)
  - ext4: init quota for 'old.inode' in 'ext4_rename' (Ye Bin)
  - ext4: check and assert if marking an no_delete evicting inode dirty (Zhang Yi)
  - ext4: fix bug_on in __es_tree_search caused by bad quota inode (Baokun Li)
  - ext4: add helper to check quota inums (Baokun Li)
  - ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode (Baokun Li)
  - ext4: fix undefined behavior in bit shift for ext4_check_flag_values (Gaosheng Cui)
  - ext4: add inode table check in __ext4_get_inode_loc to aovid possible infinite loop (Baokun Li)
  - ext4: silence the warning when evicting inode with dioread_nolock (Zhang Yi)
  - ext4: fix use-after-free in ext4_ext_shift_extents (Baokun Li)
  - ext4,f2fs: fix readahead of verity data (Matthew Wilcox (Oracle))
  - ext4: fix BUG_ON() when directory entry has invalid rec_len (Luís Henriques)
  - ext4: fix warning in 'ext4_da_release_space' (Ye Bin)
  - anolis: net/smc: Fix missing mutex_unlock when finding SMCv2 device (Wen Gu)
  - fuse: nlookup missing decrement in fuse_direntplus_link (ruanmeisi)
  - anolis: net: txgbe: fix ethtool self test failed when sriov is enabled (DuanqiangWen)
  - anolis: net: txgbe: fix set tx-frames-irq failed (DuanqiangWen)
  - anolis: net: txgbe: add tx_multicast tx_broadcast statistics (DuanqiangWen)
  - anolis: net: txgbe: add 1000M autoneg on/off switch (DuanqiangWen)
  - anolis: net: txgbe: fix rxhash bug (DuanqiangWen)
  - anolis: net: txgbe: add rx fc count (DuanqiangWen)
  - anolis: net: txgbe: add protect for vr reset (DuanqiangWen)
  - anolis: net: txgbe: add lldp support (DuanqiangWen)
  - anolis: net: txgbe: add sriov support (DuanqiangWen)
  - anolis: net: txgbe: fix open/close notify sleep too long (DuanqiangWen)
  - anolis: spec: add some examples to make it more easily to use. (Qiao Ma)
  - anolis: spec: support for diy build mode (Qiao Ma)
  - anolis: spec: add extra check for official build mode (Qiao Ma)
  - anolis: spec: remove sign modules related codes (Qiao Ma)
  - x86/kprobes: Fix JNG/JNLE emulation (Nadav Amit)
  - x86/kprobes: Update kcb status flag after singlestepping (Masami Hiramatsu (Google))
  - x86/kprobes: Move 'inline' to the beginning of the kprobe_is_ss() declaration (Wei Yongjun)
  - x86/kprobes: Fix to identify indirect jmp and others using range case (Masami Hiramatsu)
  - x86/kprobes: Use int3 instead of debug trap for single-step (Masami Hiramatsu)
  - x86/kprobes: Identify far indirect JMP correctly (Masami Hiramatsu)
  - x86/kprobes: Retrieve correct opcode for group instruction (Masami Hiramatsu)
  - x86/kprobes: Do not decode opcode in resume_execution() (Masami Hiramatsu)
  - kprobes/x86: Fix fall-through warnings for Clang (Gustavo A. R. Silva)
  - anolis: arm64: Insert dsb instruction before and after writing cpuectlr register (Feng Su)
  - anolis: arm64: Remove some unsafe cpuectlr interfaces (Feng Su)
  - anolis: DRM: Phytium Add Phytium Display Engine support. (Li Shuo)
  - anolis: RDMA/erdma: Clear doorbell records when create_qp (kai.sk)
  - anolis: net/smc: fix hung under state SMC_APPFINCLOSEWAIT (D. Wythe)
  - anolis: net/smc: remove locks smc_client_lgr_pending and smc_server_lgr_pending (D. Wythe)
  - anolis: net/smc: refactoring lgr pending lock (D. Wythe)
  - anolis: net/smc: Use diff TCP EXPR MAGIC to avoid network middleware do simple echo (D. Wythe)
  - fuse: in fuse_flush only wait if someone wants the return code (ningmingxiao)
  - cgroup: rstat: retrieve current bstat to delta directly (Wei Yang)
  - cgroup: rstat: use same convention to assign cgroup_base_stat (Wei Yang)
  - arm64: support copy_mc_[user]_highpage() (Tong Tiangen)
  - arm64: add uaccess to machine check safe (Tong Tiangen)
  - arm64: add support for machine check error safe (Tong Tiangen)
  - uaccess: add generic fallback version of copy_mc_to_user() (Tong Tiangen)
  - arm64: mte: Clean up user tag accessors (Robin Murphy)
  - linkage: add SYM_FUNC_ALIAS{,_LOCAL,_WEAK}() (Mark Rutland)
  - arm64: extable: cleanup redundant extable type EX_TYPE_FIXUP (Tong Tiangen)
  - arm64: extable: move _cond_extable to _cond_uaccess_extable (Tong Tiangen)
  - arm64: extable: make uaaccess helper use extable type EX_TYPE_UACCESS_ERR_ZERO (Tong Tiangen)
  - arm64: asm-extable: add asm uacess helpers (Mark Rutland)
  - arm64: asm-extable: move data fields (Mark Rutland)
  - arm64: extable: add new extable type EX_TYPE_KACCESS_ERR_ZERO support (Tong Tiangen)
  - anolis: net/smc: Fix connection leak of SMC_PEERFINCLOSEWAIT (Wen Gu)
  - anolis: net/smc: Add interface implementation of loopback device (Wen Gu)
  - anolis: net/smc: Modify cursor update logic when using mappable DMB (Wen Gu)
  - anolis: net/smc: Avoid data copy from sndbuf to peer RMB in SMC-D (Wen Gu)
  - anolis: net/smc: Introudce interfaces for DMB attach and detach (Wen Gu)
  - anolis: net/smc: Introduce an interface for getting DMB attribute (Wen Gu)
  - anolis: net/smc: Introduce SMC-D loopback device (Wen Gu)
  - anolis: net/smc: Extract v2 check helper from SMC-D device registration (Wen Gu)
  - anolis: net/smc: Decouple ism_dev from SMC-D DMB registration (Wen Gu)
  - anolis: net/smc: Decouple ism_dev from SMC-D device dump (Wen Gu)
  - anolis: net/smc: fix for credit leak when get free slot but the connection is killed (Guangguan Wang)
  - anolis: sched/core: introduce ht-aware-quota (Cruz Zhao)
  - cgroup: rstat: support cgroup1 (Johannes Weiner)
  - anolis: sched: introduce per cgroup sibidle (Cruz Zhao)
  - anolis: sched: account sibidle for core scheduling (Cruz Zhao)
  - anolis: sched: introduce sysctl_sched_acpu_enabled (Cruz Zhao)
  - anolis: sched: introduce ACPU accounting (Tianchen Ding)
  - anolis: configs: enable page table bind related configuration (Kaihao Bai)
  - anolis: mm: support allocating page table pages binded with local numa node (Kaihao Bai)
  - sched: adjust sleeper credit for SCHED_IDLE entities (Josh Don)
  - sched: reduce sched slice for SCHED_IDLE entities (Josh Don)
  - sched: Account number of SCHED_IDLE entities on each cfs_rq (Josh Don)
  - mm: memcontrol: make the slab calculation consistent (Muchun Song)
  - mm: memcontrol: convert NR_FILE_PMDMAPPED account to pages (Muchun Song)
  - mm: memcontrol: convert NR_SHMEM_PMDMAPPED account to pages (Muchun Song)
  - mm: memcontrol: convert NR_SHMEM_THPS account to pages (Muchun Song)
  - mm: memcontrol: convert NR_FILE_THPS account to pages (Muchun Song)
  - mm: memcontrol: convert NR_ANON_THPS account to pages (Muchun Song)
  - mm: memcontrol: optimize per-lruvec stats counter memory usage (Muchun Song)
  - mm: memcontrol: account pagetables per node (Shakeel Butt)
  - mm: move lruvec stats update functions to vmstat.h (Shakeel Butt)
  - anolis: configs: enable CONFIG_EROFS_FS_ZIP_DEFLATE=y (Gao Xiang)
  - erofs: allow empty device tags in flatdev mode (Jingbo Xu)
  - erofs: fix memory leak of LZMA global compressed deduplication (Gao Xiang)
  - erofs: DEFLATE compression support (Gao Xiang)
  - anolis: hwmon: Phytium tachometer driver (wangzhimin)
  - anolis:irqchip:Phytium pd2008 PCIe legacy INTx interrupt controller (wangzhimin)
  - anolis: mailbox: mailbox driver support for Phytium desktop and embedded CPUs (Chen Ziqiang)
  - ext4: continue to expand file system when the target size doesn't reach (Jerry Lee 李修賢)
  - ext4: place buffer head allocation before handle start (Jinke Han)
  - ext4: ext4_read_bh_lock() should submit IO if the buffer isn't uptodate (Zhang Yi)
  - ext4: don't increase iversion counter for ea_inodes (Lukas Czerner)
  - ext4: make ext4_lazyinit_thread freezable (Lalith Rajendran)
  - ext4: fix null-ptr-deref in ext4_write_info (Baokun Li)
  - ext4: avoid crash when inline data creation follows DIO write (Jan Kara)
  - jbd2: add miss release buffer head in fc_do_one_pass() (Ye Bin)
  - jbd2: fix potential use-after-free in jbd2_fc_wait_bufs (Ye Bin)
  - jbd2: fix potential buffer head reference count leak (Ye Bin)
  - jbd2: wake up journal waiters in FIFO order, not LIFO (Andrew Perepechko)
  - anolis: mm: prezero: adapt to high-order pcp (Xu Yu)
  - ext4: make directory inode spreading reflect flexbg size (Jan Kara)
  - ext4: limit the number of retries after discarding preallocations blocks (Theodore Ts'o)
  - ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0 (Luís Henriques)
  - ext4: avoid remove directory when directory is corrupted (Ye Bin)
  - ext4: make sure ext4_append() always allocates new block (Lukas Czerner)
  - ext4: fix warning in ext4_iomap_begin as race between bmap and write (Ye Bin)
  - jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when journal aborted (Zhihao Cheng)
  - ext4: recover csum seed of tmp_inode after migrating to extents (Li Lingfeng)
  - jbd2: fix outstanding credits assert in jbd2_journal_commit_transaction() (Zhang Yi)
  - anolis: config: Enable inspur drm module (Guixin Liu)
  - anolis: inspur-drm: Add X86_64 dependency (Guixin Liu)
  - anolis: spi: add support for Phytium SPI (Malloy Liu)
  - anolis: can: can driver for phytium CPUs (Chen Siyu)
  - anolis: gpio: GPIO driver support for Phytium CPUs (Wei Tian)
  - anolis:usb:Phytium Pe220x usb2.0 OTG USB Controller (wangzhimin)
  - anolis: ep: Phytium pd2008 pcie endpoint driver (wangzhimin)
  - anolis: input: add phytium ps-2 controller support (Jiakun Shuai)
  - anolis: nand: add phytium 5.10 nand controller driver (Jiakun Shuai)
  - anolis:net:add dwmac phytium driver for d2000 (wangzhimin)
  - anolis: keypad: Driver for the Phytium keypad port. (Li Shuo)
  - io_uring: break iopolling on signal (Pavel Begunkov)
  - io_uring: break out of iowq iopoll on teardown (Pavel Begunkov)
  - io_uring: always lock in io_apoll_task_func (Pavel Begunkov)
  - io_uring: correct check for O_TMPFILE (Aleksa Sarai)
  - io_uring: gate iowait schedule on having pending requests (Jens Axboe)
  - io_uring: treat -EAGAIN for REQ_F_NOWAIT as final for io-wq (Jens Axboe)
  - io_uring: don't audit the capability check in io_uring_create() (Ondrej Mosnacek)
  - io_uring: add reschedule point to handle_tw_list() (Jens Axboe)
  - io_uring: Use io_schedule* in cqring wait (Andres Freund)
  - io_uring: wait interruptibly for request completions on exit (Jens Axboe)
  - io_uring: ensure IOPOLL locks around deferred work (Jens Axboe)
  - io_uring/net: disable partial retries for recvmsg with cmsg (Jens Axboe)
  - io_uring/net: clear msg_controllen on partial sendmsg retry (Jens Axboe)
  - io_uring/net: save msghdr->msg_control for retries (Jens Axboe)
  - io_uring: hold uring mutex around poll removal (Jens Axboe)
  - io_uring: avoid null-ptr-deref in io_arm_poll_handler (Fedor Pchelkin)
  - io_uring/poll: allow some retries for poll triggering spuriously (Jens Axboe)
  - io_uring: remove MSG_NOSIGNAL from recvmsg (David Lamparter)
  - io_uring/rsrc: disallow multi-source reg buffers (Pavel Begunkov)
  - io_uring: add a conditional reschedule to the IOPOLL cancelation loop (Jens Axboe)
  - io_uring: mark task TASK_RUNNING before handling resume/task work (Jens Axboe)
  - io_uring: handle TIF_NOTIFY_RESUME when checking for task_work (Jens Axboe)
  - io_uring: ensure that io_init_req() passes in the right issue_flags (Jens Axboe)
  - io_uring: add missing lock in io_get_file_fixed (Bing-Jhong Billy Jheng)
  - sched/core: introduce sched_core_idle_cpu() (Cruz Zhao)
  - anolis: sched/core: introduce sysctl_sched_core (Cruz Zhao)
  - anolis: sched/core: introduce PR_SCHED_CORE_CLEAR (Cruz Zhao)
  - anolis: Revert "anolis: sched: Add a switch to control core scheduling" (Cruz Zhao)
  - anolis: RDMA/erdma: Prevent RQE out of range from HW (Kai Shen)
  - anolis: newfeature: ccp: add hct module (yangdepei)
  - anolis: bugfix: crypto: fix coredump when the data address from userspace is invalid. (Xiangyu Xu)
  - anolis: bugfix: crypto: ccp: Fix a problem that vq thread may stuck when do multi process test. (Xiangyu Xu)
  - anolis: bugfix: crypto: ccp: Fix sm2 test failed when insmod modules of hygonccp (Xiangyu Xu)
  - anolis: bugfix: crypto: ccp: It prompt failed when encrypted size is 64KB. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Process multiple VQ commands once for SM4/SM4-CTR ccp. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Process multiple VQ commands once for SM3 ccp. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Modify value of COMMANDS_PER_QUEUE from 16 to 8192. (Yabin Li)
  - anolis: bugfix: crypto: ccp: Only handle interrupts by completion, eliminating by empty queue. (Yabin Li)
  - anolis: bugfix: crypto: ccp: It prompt ILLEGAL_MEM_ADDR when using PSPCCP. (Yabin Li)
  - anolis: bugfix: crypto: The output data length is not fixed for SM2 encrypt and decrypt algorithm. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Userspace can exchange context data including iv, etc with kernel space. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Support SM4 algorithm for hygon ccp. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Support SM3 algorithm for hygon ccp. (Yabin Li)
  - anolis: newfeature: crypto: ccp: Support SM2 algorithm for hygon ccp. (Yabin Li)
  - anolis: crypto: avoid invalid op in aead cipher mode (yangdepei)
  - opensource: crypto: AF_ALG -- add asymmetric cipher (Stephan Mueller)
  - opensource: crypto: AF_ALG -- add setpubkey setsockopt call (Stephan Mueller)
  - opensource: crypto: AF_ALG -- add sign/verify API (Stephan Mueller)
  - anolis: configs: enable CONFIG_KEXEC_BZIMAGE_VERIFY_SIG (YiLin.Li)
  - io_uring/rw: remove leftover debug statement (Jens Axboe)
  - io_uring/rw: ensure kiocb_end_write() is always called (Jens Axboe)
  - io_uring: fix double poll leak on repolling (Pavel Begunkov)
  - io_uring: Clean up a false-positive warning from GCC 9.3.0 (Alviro Iskandar Setiawan)
  - io_uring/net: fix fast_iov assignment in io_setup_async_msg() (Stefan Metzmacher)
  - io_uring: io_kiocb_update_pos() should not touch file for non -1 offset (Jens Axboe)
  - io_uring/rw: defer fsnotify calls to task context (Jens Axboe)
  - io_uring: do not recalculate ppos unnecessarily (Dylan Yudaken)
  - io_uring: update kiocb->ki_pos at execution time (Dylan Yudaken)
  - io_uring: remove duplicated calls to io_kiocb_ppos (Dylan Yudaken)
  - io_uring: ensure that cached task references are always put on exit (Jens Axboe)
  - io_uring: lock overflowing for IOPOLL (Pavel Begunkov)
  - io_uring: check for valid register opcode earlier (Jens Axboe)
  - io_uring: fix async accept on O_NONBLOCK sockets (Dylan Yudaken)
  - io_uring: allow re-poll if we made progress (Jens Axboe)
  - io_uring: support MSG_WAITALL for IORING_OP_SEND(MSG) (Jens Axboe)
  - io_uring: add flag for disabling provided buffer recycling (Jens Axboe)
  - io_uring: ensure recv and recvmsg handle MSG_WAITALL correctly (Jens Axboe)
  - io_uring: improve send/recv error handling (Pavel Begunkov)
  - io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL (Jens Axboe)
  - io_uring/io-wq: only free worker if it was allocated for creation (Jens Axboe)
  - io_uring/io-wq: free worker if task_work creation is canceled (Jens Axboe)
  - io_uring: Fix unsigned 'res' comparison with zero in io_fixup_rw_res() (Harshit Mogalapalli)
  - io_uring: pass in EPOLL_URING_WAKE for eventfd signaling and wakeups (Jens Axboe)
  - eventfd: provide a eventfd_signal_mask() helper (Jens Axboe)
  - eventpoll: add EPOLL_URING_WAKE poll wakeup flag (Jens Axboe)
  - anolis: drm/inspur/inspur-drm: Add inspur drm driver (wangkaiyuan)
  - anolis: config: Enable 3snic module (Guixin Liu)
  - Net: ethernet: Support 3snic 3s9xx network card (Steven Song)
  - anolis: scsi: lack of isci driver leads to boot failed (Gu Mi)
  - xfs: don't reuse busy extents on extent trim (Brian Foster)
  - xfs: shut down the filesystem if we screw up quota reservation (Darrick J. Wong)
  - xfs: remove xfs_setattr_time() declaration (Gaosheng Cui)
  - xfs: use setattr_copy to set vfs inode attributes (Darrick J. Wong)
  - xfs: set prealloc flag in xfs_alloc_file_space() (Dave Chinner)
  - xfs: fallocate() should call file_modified() (Dave Chinner)
  - xfs: remove XFS_PREALLOC_SYNC (Dave Chinner)
  - xfs: don't leak btree cursor when insrec fails after a split (Darrick J. Wong)
  - xfs: purge dquots after inode walk fails during quotacheck (Darrick J. Wong)
  - xfs: don't assert fail on perag references on teardown (Dave Chinner)
  - xfs: reorder iunlink remove operation in xfs_ifree (Dave Chinner)
  - anolis: io_uring: re-add sqthread percpu polling support. (Ferry Meng)
  - io_uring: import 5.15-stable io_uring (Jens Axboe)
  - anolis: mm: thp: fix compile error on MEMCG_DISABLE_SHMEM_THP (Rongwei Wang)
  - anolis: sched: fix compile error if CONFIG_SCHED_SLI not set (Yi Tao)
  - anolis: mm: avoid lru_gen_del_page if kidled is enabled (Kaihao Bai)
  - anolis: mm: coldpgs: delete check of memcg swappiness (Huang Haowei)
  - anolis: mm: pagecache_limit: inherit settings of parent memcg (Xu Yu)
  - anolis: config, modsign: enable CONFIG_SYSTEM_EXTRA_CERTIFICATE to support insert a certificate to the kernel image without recompiling the kernel (YiLin.Li)
  - anolis: kabi: Reserve some space for kABI stability (Guixin Liu)
  - sched/fair: Mark tg_is_idle() an inline in the !CONFIG_FAIR_GROUP_SCHED case (Ingo Molnar)
  - sched: Cgroup SCHED_IDLE support (Josh Don)
  - sched/fair: Reorder throttle_cfs_rq() path (Peng Wang)
  - anolis: sched: Support latency histograms in cpu controller (Yi Tao)
  - anolis: sched, cpuacct: Move scheduling latency data from cpuacct to task_group (Yi Tao)
  - anolis: sched/fair: Support sched_cfs_statistics in cgroup v2 (Yi Tao)
  - anolis: mm: thp: introduce memcg interface to control THP behavior (Xu Yu)
  - anolis: crypto: iax: fix unexpected softlockup while enabling iax_crypto (Kun(llfl))
  - iommu/vt-d: Fix RID2PASID setup/teardown failure (Lu Baolu)
  - xfs: fix soft lockup via spinning in filestream ag selection loop (Brian Foster)
  - xfs: fix overfilling of reserve pool (Darrick J. Wong)
  - xfs: always succeed at setting the reserve pool size (Darrick J. Wong)
  - xfs: remove infinite loop when reserving free block pool (Darrick J. Wong)
  - xfs: only bother with sync_filesystem during readonly remount (Darrick J. Wong)
  - xfs: reject crazy array sizes being fed to XFS_IOC_GETBMAP* (Darrick J. Wong)
  - xfs: prevent a WARN_ONCE() in xfs_ioc_attr_list() (Dan Carpenter)
  - xfs: fix I_DONTCACHE (Dave Chinner)
  - xfs: only set IOMAP_F_SHARED when providing a srcmap to a write (Darrick J. Wong)
  - mm: Add kvrealloc() (Dave Chinner)
  - task_work: add helper for more targeted task_work canceling (Jens Axboe)
  - kernel: don't call do_exit() for PF_IO_WORKER threads (Jens Axboe)
  - kernel: stop masking signals in create_io_thread() (Jens Axboe)
  - x86/process: setup io_threads more like normal user space threads (Stefan Metzmacher)
  - arch: ensure parisc/powerpc handle PF_IO_WORKER in copy_thread() (Jens Axboe)
  - arch: setup PF_IO_WORKER threads like PF_KTHREAD (Jens Axboe)
  - entry/kvm: Exit to user mode when TIF_NOTIFY_SIGNAL is set (Seth Forshee)
  - kernel: allow fork with TIF_NOTIFY_SIGNAL pending (Jens Axboe)
  - coredump: Limit what can interrupt coredumps (Eric W. Biederman)
  - kernel: remove checking for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - task_work: remove legacy TWA_SIGNAL path (Jens Axboe)
  - alpha: fix TIF_NOTIFY_SIGNAL handling (Al Viro)
  - ARC: unbork 5.11 bootup: fix snafu in _TIF_NOTIFY_SIGNAL handling (Vineet Gupta)
  - ia64: don't call handle_signal() unless there's actually a signal queued (Jens Axboe)
  - sparc: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - riscv: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - nds32: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - ia64: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - h8300: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - c6x: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - alpha: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - xtensa: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - arm: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - microblaze: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - hexagon: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - csky: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - openrisc: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - sh: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - um: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - s390: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - mips: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - powerpc: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - parisc: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - nios32: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - m68k: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - arm64: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - arc: add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - x86: Wire up TIF_NOTIFY_SIGNAL (Jens Axboe)
  - task_work: Use TIF_NOTIFY_SIGNAL if available (Jens Axboe)
  - entry: Add support for TIF_NOTIFY_SIGNAL (Jens Axboe)
  - fs: provide locked helper variant of close_fd_get_file() (Jens Axboe)
  - file: Rename __close_fd_get_file close_fd_get_file (Eric W. Biederman)
  - fs: make do_renameat2() take struct filename (Jens Axboe)
  - signal: Add task_sigpending() helper (Jens Axboe)
  - net: add accept helper not installing fd (Pavel Begunkov)
  - net: provide __sys_shutdown_sock() that takes a socket (Jens Axboe)
  - tools headers UAPI: Sync openat2.h with the kernel sources (Arnaldo Carvalho de Melo)
  - fs: expose LOOKUP_CACHED through openat2() RESOLVE_CACHED (Jens Axboe)
  - Make sure nd->path.mnt and nd->path.dentry are always valid pointers (Al Viro)
  - fix handling of nd->depth on LOOKUP_CACHED failures in try_to_unlazy* (Al Viro)
  - fs: add support for LOOKUP_CACHED (Jens Axboe)
  - saner calling conventions for unlazy_child() (Al Viro)
  - iov_iter: add helper to save iov_iter state (Jens Axboe)
  - kernel: provide create_io_thread() helper (Jens Axboe)
  - anolis: mm, memcg: increase memsli interface for cgroup v2 (Bo Liu)
  - x86/tdx: Add Quote generation support (Kuppuswamy Sathyanarayanan)
  - x86/coco: Add cc_decrypted_alloc/free() interfaces (Kuppuswamy Sathyanarayanan)
  - x86/tdx: Add TDX Guest event notify interrupt support (Kuppuswamy Sathyanarayanan)
  - xfs: Enforce attr3 buffer recovery order (Dave Chinner)
  - xfs: logging the on disk inode LSN can make it go backwards (Dave Chinner)
  - xfs: remove dead stale buf unpin handling code (Brian Foster)
  - xfs: hold buffer across unpin and potential shutdown processing (Brian Foster)
  - xfs: force the log offline when log intent item recovery fails (Darrick J. Wong)
  - xfs: prevent UAF in xfs_log_item_in_current_chkpt (Darrick J. Wong)
  - xfs: xfs_log_force_lsn isn't passed a LSN (Dave Chinner)
  - anolis: sw64: make rpm package for sw_64 (Gu Mi)
  - anolis: mm/kidled: remove unused variable 'idx' (Joseph Qi)
  - anolis: sw64: fix compile issue dut to lack of WITH Linux-syscall-note (Gu Mi)
  - anolis: sw64: rename perf_reg_name to __perf_reg_name (Gu Mi)
  - anolis:  mm: rename pud_page_vaddr to pud_pgtable and make it return pmd_t * (Gu Mi)
  - anolis: arm64: turning off mitigations for Spectre-BHB and Variant-4 in cmdline (Bitao Hu)
  - anolis: mm, kidled: set age value in the flags of head pages (Ning Zhang)
  - selftests/bpf: Limit unroll_count for pyperf600 test (Yonghong Song)
  - anolis: sched/fair: place id_commit_make_up() correctly (Tianchen Ding)
  - netfilter: nf_tables: don't skip expired elements during walk (Florian Westphal) {CVE-2023-4563}
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb (Sungwoo Kim) {CVE-2023-40283}
  - ext4: only update i_reserved_data_blocks on successful block allocation (Baokun Li)
  - ext4: correct inline offset when handling xattrs in inode body (Eric Whitney)
  - SCSI: SSSRAID: Introduce map_queue in sssraid module (Steven Song)
  - anolis: x86/hygon: x86_cap_flags should now be written as it is RO (Zelin Deng)
  - anolis: KVM: Fix the issue of Windows VMs crashing starting via QEMU (Guanjun)
  - LoongArch: Fix module relocation error with binutils 2.41 (Juxin Gao)
  - dm raid: protect md_stop() with 'reconfig_mutex' (Yu Kuai)
  - dm raid: clean up four equivalent goto tags in raid_ctr() (Yu Kuai)
  - dm raid: fix missing reconfig_mutex unlock in raid_ctr() error paths (Yu Kuai)
  - dm crypt: add cond_resched() to dmcrypt_write() (Mikulas Patocka)
  - dm stats: check for and propagate alloc_percpu failure (Jiasheng Jiang)
  - dm thin: fix deadlock when swapping to thin device (Coly Li)
  - dm: add cond_resched() to dm_wq_work() (Pingfan Liu)
  - dm cache: add cond_resched() to various workqueue loops (Mike Snitzer)
  - dm thin: add cond_resched() to various workqueue loops (Mike Snitzer)
  - dm cache: set needs_check flag after aborting metadata (Mike Snitzer)
  - dm thin: resume even if in FAIL mode (Luo Meng)
  - dm thin: Use last transaction's pmd->root when commit failed (Zhihao Cheng)
  - dm cache: Fix ABBA deadlock between shrink_slab and dm_cache_metadata_abort (Mike Snitzer)
  - dm thin: Fix ABBA deadlock between shrink_slab and dm_pool_abort_metadata (Zhihao Cheng)
  - dm ioctl: fix misbehavior if list_versions races with module loading (Mikulas Patocka)
  - dm raid: fix address sanitizer warning in raid_status (Mikulas Patocka)
  - dm raid: fix address sanitizer warning in raid_resume (Mikulas Patocka)
  - dm thin: fix use-after-free crash in dm_sm_register_threshold_callback (Luo Meng)
  - dm writecache: set a default MAX_WRITEBACK_JOBS (Mikulas Patocka)
  - dm: return early from dm_pr_call() if DM device is suspended (Mike Snitzer)
  - fuse: revalidate: don't invalidate if interrupted (Miklos Szeredi)
  - Loongarch: Fix build erorr when enable kprobe (Juxin Gao)
  - LoongArch: Add kretprobes support (Juxin Gao)
  - LoongArch: Add kprobes support (Juxin Gao)
  - LoongArch: Simulate branch and PC* instructions (Juxin Gao)
  - LoongArch: Fix the write_fcsr() macro (Qi Hu)
  - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (valis) {CVE-2023-4128}
  - net: rpl: fix rpl header size calculation (Alexander Aring) {CVE-2023-2156}
  - xfrm: add forgotten nla_policy for XFRMA_MTIMER_THRESH (Lin Ma) {CVE-2023-3773}
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (M A Ramdhan) {CVE-2023-3776}
  - net: tun: fix bugs for oversize packet when napi frags enabled (Ziyang Xuan) {CVE-2023-3812}
  - anolis: erofs: ensure that the post-EOF tails are all zeroed (Gao Xiang)
  - anolis: erofs: fix -EFAULT error due to KVEC iovec (Huang Jianan)
  - anolis: erofs: introduce erofs_is_rafsv6_mode() helper (Jingbo Xu)
  - anolis: erofs: disable flatdev in rafsv6 mode (Jingbo Xu)
  - anolis: erofs: initialize bootstrap prior to reading superblock (Jingbo Xu)
  - anolis: erofs: no bother sb_set_blocksize() in rafsv6 mode (Jingbo Xu)
  - anolis: erofs: move option exclusion check to .get_tree() (Jingbo Xu)
  - anolis: erofs: fix erofs_is_fscache_mode() (Jingbo Xu)
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Pablo Neira Ayuso)
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Pablo Neira Ayuso)
  - perf/x86/amd/core: Always clear status for idx (Breno Leitao)
  - anolis: alinux: tcm: add Hygon TCM2 driver (chench)
  - drm/amdkfd: Check for null pointer after calling kmemdup (Jiasheng Jiang) {CVE-2022-3108}
  - anolis: KVM: SVM: Force flush caches before reboot CSV guest (hanliyang)
  - anolis: KVM: SVM: Add support for rebooting CSV2 guest (hanliyang)
  - anolis: KVM: x86: Introduce control_{pre,post}_system_reset ioctl interfaces (hanliyang)
  - anolis: arm64: add cpuectlr sysfs interface (Feng Su)
  - anolis: Revert "anolis: drivers: arm64: add prefetch tuning sysctl interface by module mode" (Feng Su)
  - anolis: spec: fix a bash gramma problem (Qiao Ma)
  - anolis: spec: add dependency of kernel-modules-{extra, internal} for kernel.rpm (Qiao Ma)
  - anolis: spec: split comments into new lines (Qiao Ma)
  - anolis: spec: use * to adapt for gz and zstd compressions (Qiao Ma)
  - anolis: spec: do not use lto optimize (Qiao Ma)
  - anolis: spec: remove modules.builtin.alias.bin after built kernel (Qiao Ma)
  - anolis: spec: update rpm-config dependency for anolis 23 (Qiao Ma)
  - ext4: do not mark inode dirty every time in delalloc append write scenario (Liu Song)
  - anolis: PHYTIUM: ft2000: Add CONFIG_ARM_SMMU dependency for SMMU HW workaround (Shawn Wang)
  - anolis: add AER config dependency sanity check to fix build error (Shuai Xue)
  - anolis: mm: fix compile error if CONFIG_KIDLED disabled (Kaihao Bai)
  - ext4: don't set up encryption key during jbd2 transaction (Eric Biggers)
  - ext4: disable fast-commit of encrypted dir operations (Eric Biggers)
  - ext4: fix leaking uninitialized memory in fast-commit journal (Eric Biggers)
  - ext4: update 'state->fc_regions_size' after successful memory allocation (Ye Bin)
  - ext4: fix potential memory leak in ext4_fc_record_regions() (Ye Bin)
  - ext4: fix potential memory leak in ext4_fc_record_modified_inode() (Ye Bin)
  - ext4: fix miss release buffer head in ext4_fc_write_inode (Ye Bin)
  - nvdimm: Support sizeof(struct page) > MAX_STRUCT_PAGE_SIZE (Dan Williams)
  - libnvdimm/pfn_dev: increase MAX_STRUCT_PAGE_SIZE (Alexander Potapenko)
  - erofs: fix wrong primary bvec selection on deduplicated extents (Gao Xiang)
  - erofs: avoid infinite loop in z_erofs_do_read_page() when reading beyond EOF (Chunhai Guo)
  - erofs: avoid useless loops in z_erofs_pcluster_readmore() when reading beyond EOF (Chunhai Guo)
  - erofs: fix compact 4B support for 16k block size (Gao Xiang)
  - erofs: kill hooked chains to avoid loops on deduplicated compressed images (Gao Xiang)
  - erofs: initialize packed inode after root inode is assigned (Jingbo Xu)
  - erofs: stop parsing non-compact HEAD index if clusterofs is invalid (Gao Xiang)
  - erofs: get rid of a useless DBG_BUGON (Gao Xiang)
  - erofs: fix wrong kunmap when using LZMA on HIGHMEM platforms (Gao Xiang)
  - erofs: move zdata.h into zdata.c (Gao Xiang)
  - erofs: remove tagged pointer helpers (Gao Xiang)
  - erofs: avoid tagged pointers to mark sync decompression (Gao Xiang)
  - erofs: validate the extent length for uncompressed pclusters (Gao Xiang)
  - erofs: fix missing unmap if z_erofs_get_extent_compressedlen() fails (Gao Xiang)
  - erofs: Fix pcluster memleak when its block address is zero (Chen Zhongjin)
  - erofs: clean up cached I/O strategies (Gao Xiang)
  - erofs: fix general protection fault when reading fragment (Yue Hu)
  - erofs: fix up inplace decompression success rate (Gao Xiang)
  - erofs: shouldn't churn the mapping page for duplicated copies (Gao Xiang)
  - erofs: fix illegal unmapped accesses in z_erofs_fill_inode_lazy() (Yue Hu)
  - erofs: clean up unnecessary code and comments (Gao Xiang)
  - erofs: fold in z_erofs_reload_indexes() (Yue Hu)
  - erofs: introduce partial-referenced pclusters (Gao Xiang)
  - erofs: support on-disk compressed fragments data (Yue Hu)
  - erofs: support interlaced uncompressed data for compressed files (Yue Hu)
  - erofs: fix pcluster use-after-free on UP platforms (Gao Xiang)
  - erofs: introduce multi-reference pclusters (fully-referenced) (Gao Xiang)
  - erofs: record the longest decompressed size in this round (Gao Xiang)
  - erofs: introduce z_erofs_do_decompressed_bvec() (Gao Xiang)
  - erofs: try to leave (de)compressed_pages on stack if possible (Gao Xiang)
  - erofs: introduce struct z_erofs_decompress_backend (Gao Xiang)
  - erofs: get rid of `z_pagemap_global' (Gao Xiang)
  - erofs: clean up `enum z_erofs_collectmode' (Gao Xiang)
  - erofs: get rid of `enum z_erofs_page_type' (Gao Xiang)
  - erofs: rework online page handling (Gao Xiang)
  - erofs: switch compressed_pages[] to bufvec (Gao Xiang)
  - erofs: introduce `z_erofs_parse_in_bvecs' (Gao Xiang)
  - erofs: drop the old pagevec approach (Gao Xiang)
  - erofs: introduce bufvec to store decompressed buffers (Gao Xiang)
  - erofs: introduce `z_erofs_parse_out_bvecs()' (Gao Xiang)
  - erofs: clean up z_erofs_collector_begin() (Gao Xiang)
  - erofs: get rid of unneeded `inode', `map' and `sb' (Gao Xiang)
  - erofs: refine managed inode stuffs (Gao Xiang)
  - erofs: avoid consecutive detection for Highmem memory (Gao Xiang)
  - erofs: wake up all waiters after z_erofs_lzma_head ready (Yuwen Chen)
  - erofs: fix 'backmost' member of z_erofs_decompress_frontend (Weizhao Ouyang)
  - erofs: simplify z_erofs_pcluster_readmore() (Gao Xiang)
  - erofs: get rid of label `restart_now' (Gao Xiang)
  - erofs: get rid of `struct z_erofs_collection' (Gao Xiang)
  - erofs: fix buffer copy overflow of ztailpacking feature (Gao Xiang)
  - erofs: refine on-disk definition comments (Gao Xiang)
  - erofs: remove obsoleted comments (Gao Xiang)
  - erofs: do not prompt for risk any more when using big pcluster (Yue Hu)
  - erofs: fix use-after-free of on-stack io[] (Hongyu Jin)
  - erofs: rename ctime to mtime (David Anderson)
  - erofs: clean up z_erofs_extent_lookback (Gao Xiang)
  - erofs: silence warnings related to impossible m_plen (Gao Xiang)
  - erofs: clean up preload_compressed_pages() (Gao Xiang)
  - erofs: get rid of `struct z_erofs_collector' (Gao Xiang)
  - erofs: fix ztailpacking on > 4GiB filesystems (Gao Xiang)
  - erofs: fix small compressed files inlining (Gao Xiang)
  - erofs: add on-disk compressed tail-packing inline support (Yue Hu)
  - erofs: support inline data decompression (Yue Hu)
  - erofs: support unaligned data decompression (Gao Xiang)
  - erofs: introduce z_erofs_fixup_insize (Gao Xiang)
  - erofs: tidy up z_erofs_lz4_decompress (Gao Xiang)
  - erofs: Replace zero-length array with flexible-array member (Gao Xiang)
  - erofs: remove useless cache strategy of DELAYEDALLOC (Yue Hu)
  - erofs: get rid of ->lru usage (Gao Xiang)
  - anolis: meminfo: fix compile error with CONFIG_CGROUP_BPF not set (Yi Tao)
  - anolis: sysfs/cpu: fix compile error with CONFIG_CGROUP_BPF not set (Yi Tao)
  - anolis: arm64: cpuinfo: fix compile error with CONFIG_CGROUP_BPF not set (Yi Tao)
  - anolis: x86: cpuinfo: fix compile error with CONFIG_CGROUP_BPF not set (Yi Tao)
  - anolis: configs: support EROFS LZMA compression (Gao Xiang)
  - erofs: lzma compression support (Gao Xiang)
  - lib/xz: Add MicroLZMA decoder (Lasse Collin)
  - lib/xz: Move s->lzma.len = 0 initialization to lzma_reset() (Lasse Collin)
  - erofs: rename some generic methods in decompressor (Gao Xiang)
  - erofs: introduce readmore decompression strategy (Gao Xiang)
  - mm: Implement readahead_control pageset expansion (David Howells)
  - mm/readahead: Handle ractl nr_pages being modified (Matthew Wilcox (Oracle))
  - fs: Document file_ra_state (Matthew Wilcox (Oracle))
  - mm/filemap: Pass the file_ra_state in the ractl (Matthew Wilcox (Oracle))
  - erofs: introduce the secondary compression head (Gao Xiang)
  - erofs: get compression algorithms directly on mapping (Gao Xiang)
  - erofs: remove the fast path of per-CPU buffer decompression (Yue Hu)
  - erofs: clear compacted_2b if compacted_4b_initial > totalidx (Yue Hu)
  - erofs: add support for the full decompressed length (Gao Xiang)
  - erofs: remove the mapping parameter from erofs_try_to_free_cached_page() (Yue Hu)
  - erofs: directly use wrapper erofs_page_is_managed() when shrinking (Yue Hu)
  - anolis: configs: enable CONFIG_SCHED_CORE (Tianchen Ding)
  - anolis: sched: reserve field for core scheduling (Tianchen Ding)
  - anolis: sched: Add a switch to control core scheduling (Tianchen Ding)
  - sched/core: Avoid selecting the task that is throttled to run when core-sched enable (Hao Jia)
  - cgroup: fix display of forceidle time at root (Josh Don)
  - sched/core: Fix comparison in sched_group_cookie_match() (Lin Shengwang)
  - sched/core: Remove superfluous semicolon (Xin Gao)
  - sched/core: add forced idle accounting for cgroups (Josh Don)
  - sched/core: Fix the bug that task won't enqueue into core tree when update cookie (Cruz Zhao)
  - arch/arm64: Fix topology initialization for core scheduling (Phil Auld)
  - sched: Teach the forced-newidle balancer about CPU affinity limitation. (Sebastian Andrzej Siewior)
  - sched/core: Fix forceidle balancing (Peter Zijlstra)
  - sched/core: Accounting forceidle time for all tasks except idle task (Cruz Zhao)
  - sched/core: Forced idle accounting (Josh Don)
  - sched: Make cookie functions static (Shaokun Zhang)
  - tools headers UAPI: Sync linux/prctl.h with the kernel sources (Arnaldo Carvalho de Melo)
  - uapi/linux/prctl: provide macro definitions for the PR_SCHED_CORE type argument (Eugene Syromiatnikov)
  - sched/core: Simplify core-wide task selection (Peter Zijlstra)
  - sched: Fix Core-wide rq->lock for uninitialized CPUs (Peter Zijlstra)
  - admin-guide/hw-vuln: Rephrase a section of core-scheduling.rst (Fabio M. De Francesco)
  - Documentation: Add usecases, design and interface for core scheduling (Joel Fernandes (Google))
  - kselftest: Add test for core sched prctl interface (Chris Hyser)
  - sched: prctl() core-scheduling interface (Chris Hyser)
  - sched: Inherit task cookie on fork() (Peter Zijlstra)
  - sched: Trivial core scheduling cookie management (Peter Zijlstra)
  - sched: Migration changes for core scheduling (Aubrey Li)
  - sched: Trivial forced-newidle balancer (Peter Zijlstra)
  - sched/fair: Snapshot the min_vruntime of CPUs on force idle (Joel Fernandes (Google))
  - sched: Fix priority inversion of cookied task with sibling (Joel Fernandes (Google))
  - sched/fair: Fix forced idle sibling starvation corner case (Vineeth Pillai)
  - sched: Add core wide task selection and scheduling (Peter Zijlstra)
  - sched: Basic tracking of matching tasks (Peter Zijlstra)
  - sched: Introduce sched_class::pick_task() (Peter Zijlstra)
  - sched: Allow sched_core_put() from atomic context (Peter Zijlstra)
  - sched: Optimize rq_lockp() usage (Peter Zijlstra)
  - sched: Core-wide rq->lock (Peter Zijlstra)
  - sched: Prepare for Core-wide rq->lock (Peter Zijlstra)
  - sched: Wrap rq::lock access (Peter Zijlstra)
  - sched: Provide raw_spin_rq_*lock*() helpers (Peter Zijlstra)
  - sched/fair: Add a few assertions (Peter Zijlstra)
  - bpf, arm64: Fix BTI type used for freplace attached functions (Alexander Duyck)
  - bpf, arm64: Fixed a BTI error on returning to patched function (Xu Kuohai)
  - bpf, arm64: Fix bpf trampoline instruction endianness (Xu Kuohai)
  - bpf, arm64: Fix compile error in dummy_tramp() (Xu Kuohai)
  - bpf, arm64: Mark dummy_tramp as global (Nathan Chancellor)
  - bpf, arm64: Add bpf trampoline for arm64 (Xu Kuohai)
  - bpf, arm64: Implement bpf_arch_text_poke() for arm64 (Xu Kuohai)
  - arm64: Add LDR (literal) instruction (Xu Kuohai)
  - bpf: Remove is_valid_bpf_tramp_flags() (Xu Kuohai)
  - bpf, arm64: Adjust the offset of str/ldr(immediate) to positive number (Xu Kuohai)
  - bpf, arm64: Optimize BPF store/load using arm64 str/ldr(immediate offset) (Xu Kuohai)
  - arm64, insn: Add ldr/str with immediate offset (Xu Kuohai)
  - bpf, arm64: Replace STACK_ALIGN() with round_up() to align stack size (Tiezhu Yang)
  - anolis: configs: enable EROFS compression (Gao Xiang)
  - erofs: fix 1 lcluster-sized pcluster for big pcluster (Gao Xiang)
  - erofs: enable big pcluster feature (Gao Xiang)
  - erofs: support decompress big pcluster for lz4 backend (Gao Xiang)
  - erofs: support parsing big pcluster compact indexes (Gao Xiang)
  - erofs: support parsing big pcluster compress indexes (Gao Xiang)
  - erofs: adjust per-CPU buffers according to max_pclusterblks (Gao Xiang)
  - erofs: add big physical cluster definition (Gao Xiang)
  - erofs: fix up inplace I/O pointer for big pcluster (Gao Xiang)
  - erofs: introduce physical cluster slab pools (Gao Xiang)
  - erofs: introduce multipage per-CPU buffers (Gao Xiang)
  - erofs: reserve physical_clusterbits[] (Gao Xiang)
  - erofs: Clean up spelling mistakes found in fs/erofs (Ruiqi Gong)
  - erofs: add on-disk compression configurations (Gao Xiang)
  - erofs: introduce on-disk lz4 fs configurations (Gao Xiang)
  - erofs: support adjust lz4 history window size (Huang Jianan)
  - erofs: complete a missing case for inplace I/O (Gao Xiang)
  - erofs: avoid memory allocation failure during rolling decompression (Huang Jianan)
  - erofs: force inplace I/O under low memory scenario (Gao Xiang)
  - erofs: simplify try_to_claim_pcluster() (Gao Xiang)
  - erofs: insert to managed cache after adding to pcl (Gao Xiang)
  - erofs: get rid of magical Z_EROFS_MAPPING_STAGING (Gao Xiang)
  - erofs: remove a void EROFS_VERSION macro set in Makefile (Vladimir Zapolskiy)
  - anolis: sched: Add monitoring indicators for group identity (Yihao Wu)
  - nvme-tcp: fence TCP socket on receive error (Chris Leech)
  - nvme-tcp: fix a possible UAF when failing to allocate an io queue (Sagi Grimberg)
  - nvme-tcp: fix possible circular locking when deleting a controller under memory pressure (Sagi Grimberg)
  - nvme-tcp: fix possible hang caused during ctrl deletion (Sagi Grimberg)
  - nvme-tcp: handle number of queue changes (Daniel Wagner)
  - nvme-tcp: fix regression that causes sporadic requests to time out (Sagi Grimberg)
  - nvme-tcp: fix UAF when detecting digest errors (Sagi Grimberg)
  - nvme-tcp: check if the queue is allocated before stopping it (Maurizio Lombardi)
  - nvme-tcp: fix memory leak when freeing a queue (Maurizio Lombardi)
  - nvme-tcp: Do not reset transport on data digest errors (Daniel Wagner)
  - nvme-tcp: pair send_mutex init with destroy (Keith Busch)
  - nvme-tcp: fix error codes in nvme_tcp_setup_ctrl() (Dan Carpenter)
  - nvme-tcp: check sgl supported by target (Max Gurtovoy)
  - nvme-tcp: fix crash triggered with a dataless request submission (Sagi Grimberg)
  - nvme-tcp: fix wrong setting of request iov_iter (Sagi Grimberg)
  - anolis: spec: extends DIST_OFFICIAL_BUILD to DIST_BUILD_MODE (Qiao Ma)
  - anolis: KVM: SVM: Export MSR_AMD64_SEV_ES_GHCB to userspace for CSV2 guest (hanliyang)
  - anolis: KVM: x86: Restore control registers in __set_sregs() to support CSV2 guest live migration (hanliyang)
  - anolis: KVM: SVM: Keep track EFER even though the VM is CSV2 guest (hanliyang)
  - anolis: KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_VMSA command (hanliyang)
  - anolis: KVM: SVM: Add KVM_SEV_SEND_UPDATE_VMSA command (hanliyang)
  - anolis: x86/cpufeatures: Add CSV3 CPU feature (hanliyang)
  - anolis: x86/cpufeatures: Add CPUID_8C86_0000_EDX CPUID leaf (hanliyang)
  - anolis: x86/csv2: Keep in atomic context when holding ghcb page if the #VC comes from userspace (hanliyang)
  - anolis: crypto: ccp: Implement CSV_DOWNLOAD_FIRMWARE ioctl command (hanliyang)
  - anolis: crypto: ccp: Implement CSV_PLATFORM_SHUTDOWN ioctl command (hanliyang)
  - anolis: crypto: ccp: Implement CSV_PLATFORM_INIT ioctl command (hanliyang)
  - anolis: crypto: ccp: Support DOWNLOAD_FIRMWARE when detect CSV (hanliyang)
  - anolis: configs: adjust some crypto related configs (Qiao Ma)
  - anolis: configs: adjust block related configs (Qiao Ma)
  - anolis: configs: disable CONFIG_SLAB_MERGE_DEFAULT (Qiao Ma)
  - anolis: configs: disable CONFIG_CAN (Qiao Ma)
  - anolis: configs: align net/ieee802154 related config with x86 (Qiao Ma)
  - anolis: configs: enable CONFIG_6LOWPAN for arm64 (Qiao Ma)
  - anolis: configs: align net/mac80211 configs with x86 (Qiao Ma)
  - anolis: configs: align arm64 wireless related configs with x86 (Qiao Ma)
  - anolis: kconfig: only include loongarch platform drivers for LOONGARCH (Qiao Ma)
  - anolis: arm64: kfence: allow allocating kfence pool after system boot stage (Kaihao Bai)
  - Revert "anolis: arm64: always allocate kfence area to avoid splitting linear mapping" (Kaihao Bai)
  - anolis: arm64: fix judgement of pte valid (Kaihao Bai)
  - anolis: arm64: add switch of command line to control split mapping (Kaihao Bai)
  - anolis: arm64: avoid speculative access after memory failure (Kaihao Bai)
  - anolis: arm64: add the helper to set no-present page table (Kaihao Bai)
  - anolis: arm64: support splitting the dynamic allocation range of kfence (Kaihao Bai)
  - anolis: arm64: support splitting page table of rodata_full enabled (Kaihao Bai)
  - anolis: arm64: support splitting the block mapping kernel page table (Kaihao Bai)
  - anolis: arm64: add page table entry tlb flush helper (Kaihao Bai)
  - anolis: arm64: reposition function and flags and make them visible (Kaihao Bai)
  - anolis: mm: duptext: refresh duptext for unstable pages (Xu Yu)
  - anolis: mm: duptext: introduce duptext_nodes interface (Xu Yu)
  - anolis: mm: duptext: use hpage in __dup_page (Xu Yu)
  - anolis: selftests/bpf: add test for rich_container (Tianchen Ding)
  - anolis: libbpf: Add support for CGROUP_RICH_CONTAINER program type (Yi Tao)
  - anolis: bpf: Sync linux/bpf.h to tools (Yi Tao)
  - anolis: meminfo: Add meminfo support for bpf rich container (Yi Tao)
  - anolis: sysfs/cpu: Add online cpus support for bpf rich container (Yi Tao)
  - anolis: arm64: cpuinfo: Add cpuinfo support for bpf rich container (Yi Tao)
  - anolis: x86: cpuinfo: Add cpuinfo support for bpf rich container (Yi Tao)
  - anolis: bpf, cgroup: Introduce CGROUP_RICH_CONTAINER program type (Yi Tao)
  - xfs: use deferred frees for btree block freeing (Dave Chinner)
  - xfs: fix confusing xfs_extent_item variable names (Darrick J. Wong)
  - xfs: pass xfs_extent_free_item directly through the log intent code (Darrick J. Wong)
  - xfs: validate block number being freed before adding to xefi (Dave Chinner)
  - xfs: refactor data device extent validation (Darrick J. Wong)
  - xfs: remove unused parameter from refcount code (Darrick J. Wong)
  - xfs: reduce the size of struct xfs_extent_free_item (Darrick J. Wong)
  - xfs: fix agf/agfl verification on v4 filesystems (Dave Chinner)
  - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Darrick J. Wong)
  - xfs: create slab caches for frequently-used deferred items (Darrick J. Wong)
  - xfs: rename _zone variables to _cache (Darrick J. Wong)
  - xfs: remove kmem_zone typedef (Darrick J. Wong)
  - xfs: fix log intent recovery ENOSPC shutdowns when inactivating inodes (Darrick J. Wong)
  - anolis: Loongarch: synchronize vector extensions support upstream (Juxin Gao)
  - anolis: Loongarch: Fix modpost warning when build (Juxin Gao)
  - anolis: LoongArch: fix CONFIG_TRACE_IRQFLAGS_SUPPORT not defined (Yingkun Meng)
  - anolis: LoongArch: fix CONFIG_ZONE_DMA32 not defined (Hongchen Zhang)
  - anolis: LoongArch: fix percpu area not allocated as expected (Hongchen Zhang)
  - anolis: irqchip/loongson-pch-pic: 7a1000 int_clear reg must use 64bit write. (Chong Qiao)
  - anolis: ipmi_si: ls2k500 kcs driver add wait bmc reboot done and rebind support. (Chong Qiao)
  - PCI/portdrv: Prevent LS7A Bus Master clearing on shutdown (Huacai Chen)
  - anolis: Revert "PCI: Add quirk for LS7A to avoid reboot failure" (Juxin Gao)
  - anolis: LoongArch: defconfig: Enable a large number of configurations (Juxin Gao)
  - anolis: LoongArch: fix ls2k500 bmc not work when installing iso (Chong Qiao)
  - anolis: pci: irq: Add early_param pci_irq_limit to limit pci irq numbers (Juxin Gao)
  - anolis: LoongArch: kdump: Add high memory reservation (Youling Tang)
  - anolis: LoongArch: defconfig: enable CONFIG_FB_LS2K500=m. (Chong Qiao)
  - anolis: ipmi: add ls2k500 bmc ipmi support. (Chong Qiao)
  - anolis: fbdev: add ls2k500sfb driver for ls2k500 bmc. (Chong Qiao)
  - anolis: LoongArch: fix __ffs not defined compile error (Hongchen Zhang)
  - anolis: LoongArch: defconfig: Add PCI hotplug support (yangyinglu)
  - anolis: LoongArch: defconfig: Add memory hotplug support (yangyinglu)
  - anolis: LoongArch: LSVZ: Support PV IPI to reduce VM exit (Juxin Gao)
  - anolis: spec: add make help messages (Qiao Ma)
  - anolis: spec: add function to build rpm package (Qiao Ma)
  - anolis: spec: intree kernel build related files (Qiao Ma)
  - anolis: spec: add function to generate kernel.spec (Qiao Ma)
  - anolis: spec: add script to generate kernel changelogs (Qiao Ma)
  - anolis: spec: prepare for making kernel.spec intree (Qiao Ma)
  - selftests: add selftests for cachestat (Nhat Pham)
  - cachestat: wire up cachestat for other architectures (Nhat Pham)
  - cachestat: implement cachestat syscall (Nhat Pham)
  - workingset: refactor LRU refault to expose refault recency check (Nhat Pham)
  - workingset: fix confusion around eviction vs refault container (Johannes Weiner)
  - coresight: tmc: Explicit type conversions to prevent integer overflow (Ruidong Tian)
  - coresight: cti: Remove atomic type from enable_req_count (James Clark)
  - coresight: cti: Add PM runtime call in enable_store (Mao Jinlong)
  - coresight: cti: Prevent negative values of enable count (James Clark)
  - coresight: etm4x: Fix accesses to TRCSEQRSTEVR and TRCSEQSTR (Junhao He)
  - coresight: perf: Release Coresight path when alloc trace id failed (Ruidong Tian)
  - coresight: Fix signedness bug in tmc_etr_buf_insert_barrier_packet() (Dan Carpenter)
  - coresight: etm_pmu: Set the module field (Suzuki K Poulose)
  - coresight: etm4x: Do not access TRCIDR1 for identification (Suzuki K Poulose)
  - coresight-etm4: Fix for() loop drvdata->nr_addr_cmp range bug (Steve Clevenger)
  - coresight: tmc: Don't enable TMC when it's not ready. (Yabin Cui)
  - coresight: perf: Output trace id only once (Suzuki K Poulose)
  - coresight: Fix uninitialised variable use in coresight_disable (Suzuki K Poulose)
  - coresight: core: Use IDR for non-cpu bound sources' paths. (Mao Jinlong)
  - anolis: perf: ignore exited thread when synthesize thread map (Cruz Zhao)
  - coresight: trace-id: Add debug & test macros to Trace ID allocation (Mike Leach)
  - coresight: events: PERF_RECORD_AUX_OUTPUT_HW_ID used for Trace ID (Mike Leach)
  - coresight: trace id: Remove legacy get trace ID function. (Mike Leach)
  - coresight: etmX.X: stm: Remove trace_id() callback (Mike Leach)
  - coresight: etm3x: Update ETM3 driver to use Trace ID API (Mike Leach)
  - coresight: etm4x: Update ETM4 driver to use Trace ID API (Mike Leach)
  - coresight: stm: Update STM driver to use Trace ID API (Mike Leach)
  - coresight: perf: traceid: Add perf ID allocation and notifiers (Mike Leach)
  - coresight: Remove obsolete Trace ID unniqueness checks (Mike Leach)
  - coresight: trace-id: Add API to dynamically assign Trace ID values (Mike Leach)
  - anolis: mm: Readd DMA page copy support for page migration (Shawn Wang)
  - anolis: mm: Add a new dma_migrate_mode parameter for dma_migrate_pages_copy() (Shawn Wang)
  - mm,unmap: avoid flushing TLB in batch if PTE is inaccessible (Huang Ying)
  - migrate_pages: try migrate in batch asynchronously firstly (Huang Ying)
  - migrate_pages: move split folios processing out of migrate_pages_batch() (Huang Ying)
  - migrate_pages: fix deadlock in batched migration (Huang Ying)
  - migrate_pages: move THP/hugetlb migration support check to simplify code (Huang Ying)
  - migrate_pages: batch flushing TLB (Huang Ying)
  - migrate_pages: share more code between _unmap and _move (Huang Ying)
  - migrate_pages: move migrate_folio_unmap() (Huang Ying)
  - migrate_pages: batch _unmap and _move (Huang Ying)
  - migrate_pages: split unmap_and_move() to _unmap() and _move() (Huang Ying)
  - migrate_pages: restrict number of pages to migrate in batch (Huang Ying)
  - migrate_pages: separate hugetlb folios migration (Huang Ying)
  - migrate_pages: organize stats with struct migrate_pages_stats (Huang Ying)
  - mm: migrate: fix return value if all subpages of THPs are migrated successfully (Baolin Wang)
  - mm: migrate: do not retry 10 times for the subpages of fail-to-migrate THP (Baolin Wang)
  - migrate_pages(): fix failure counting for retry (Huang Ying)
  - migrate_pages(): fix failure counting for THP splitting (Huang Ying)
  - migrate_pages(): fix failure counting for THP on -ENOSYS (Huang Ying)
  - migrate_pages(): fix failure counting for THP subpages retrying (Huang Ying)
  - migrate_pages(): fix THP failure counting for -ENOMEM (Huang Ying)
  - migrate_pages(): remove unnecessary list_safe_reset_next() (Huang Ying)
  - migrate: fix syscall move_pages() return value for failure (Huang Ying)
  - mm/migration: remove some duplicated codes in migrate_pages (Miaohe Lin)
  - mm/migration: fix potential page refcounts leak in migrate_pages (Miaohe Lin)
  - mm: compaction: fix the migration stats in trace_mm_compaction_migratepages() (Baolin Wang)
  - mm: migrate: correct the hugetlb migration stats (Baolin Wang)
  - mm: migrate: fix the return value of migrate_pages() (Baolin Wang)
  - mm/migrate: enable returning precise migrate_pages() success count (Yang Shi)
  - anolis: Revert "mm: migrate: introduce batch page migration" (Shawn Wang)
  - anolis: Revert "mm: migrate: batch flushing TLB" (Shawn Wang)
  - anolis: Revert "mm: migrate: batch copying pages" (Shawn Wang)
  - anolis: Revert "anolis: mm: migrate: add interface to enable batch migration" (Shawn Wang)
  - anolis: mm: Remove DMA pages copy support for page migration (Shawn Wang)
  - anolis: Revert "mm: migrate: continue to migrate for non-hugetlb pages" (Shawn Wang)
  - anolis: Revert "mm: migrate: fix potential deadlock in migrate_page_unmap" (Shawn Wang)
  - anolis: Revert "mm: migrate: do not assume that newpage->lru is unchanged" (Shawn Wang)
  - anolis: configs: Enable sssraid module (Guixin Liu)
  - anolis: LoongArch: Fix kdump failure on v40 interface specification (Youling Tang)
  - anolis: LoongArch: configs: Enable kexec/kdump (Youling Tang)
  - LoongArch: kdump: Add crashkernel=YM handling (Youling Tang)
  - LoongArch: kdump: Add single kernel image implementation (Youling Tang)
  - LoongArch: Add support for kernel address space layout randomization (KASLR) (Youling Tang)
  - LoongArch: Add support for kernel relocation (Youling Tang)
  - LoongArch: Add la_abs macro implementation (Juxin Gao)
  - LoongArch: Add JUMP_VIRT_ADDR macro implementation to avoid using la.abs (Youling Tang)
  - LoongArch: Use la.pcrel instead of la.abs when it's trivially possible (Youling Tang)
  - anolis: LoongArch: efistub: Modify the address where efistub jumps to the main kernel (Youling Tang)
  - anolis: LoongArch: kdump: Add memory reservation for old kernel (Youling Tang)
  - anolis: LoongArch: Integrate initrd operation (Juxin Gao)
  - anolis: LoongArch: kexec: Add compatibility with old interfaces (Youling Tang)
  - LoongArch: Flush TLB earlier at initialization (Youling Tang)
  - LoongArch: Add kdump support (Youling Tang)
  - LoongArch: Add kexec support (Youling Tang)
  - anolis: LoongArch: defconfig: enable CONFIG_CACHEFILES (Hongchen Zhang)
  - anolis: i2c: loongson: fix irq not freed when remove module (Hongchen Zhang)
  - LoongArch: Set _PAGE_DIRTY only if _PAGE_MODIFIED is set in {pmd,pte}_mkwrite() (Huacai Chen)
  - LoongArch: Set _PAGE_DIRTY only if _PAGE_WRITE is set in {pmd,pte}_mkdirty() (Huacai Chen)
  - LoongArch: Clear FPU/SIMD thread info flags for kernel thread (Huacai Chen)
  - anolis: LoongArch: Remove generic irq migration (Jianmin Lv)
  - anolis: LoongArch: Fix secondary bridge routing errors (liuyun)
  - anolis: net: stmmac: fix potential double free of dma descriptor resources (Hongchen Zhang)
  - anolis: kabi: Reserve some space for kABI stability (Guixin Liu)
  - anolis: configs: enable CONFIG_LRU_GEN (Kaihao Bai)
  - anolis: mm: fix the symbol lookup error of coldpgs (Kaihao Bai)
  - anolis: mm: kidled: calculate pageflags usage with KIDLED_AGE_WIDTH (Xu Yu)
  - anolis: mm: limit use confliction between kidled/coldpgs and mglru (Kaihao Bai)
  - mm: Multi-gen LRU: remove wait_event_killable() (Kalesh Singh)
  - Multi-gen LRU: fix workingset accounting (Kalesh Singh)
  - mm: multi-gen LRU: fix crash during cgroup migration (Yu Zhao)
  - mm: multi-gen LRU: retry folios written back while isolated (Yu Zhao)
  - mm: multi-gen LRU: move lru_gen_add_mm() out of IRQ-off region (Sebastian Andrzej Siewior)
  - mm/mglru: don't sync disk for each aging cycle (Yu Zhao)
  - mm: multi-gen LRU: design doc (Yu Zhao)
  - mm: multi-gen LRU: admin guide (Yu Zhao)
  - mm: multi-gen LRU: debugfs interface (Yu Zhao)
  - mm: multi-gen LRU: thrashing prevention (Yu Zhao)
  - mm: multi-gen LRU: kill switch (Yu Zhao)
  - mm: multi-gen LRU: optimize multiple memcgs (Yu Zhao)
  - mm: multi-gen LRU: support page table walks (Yu Zhao)
  - mm: multi-gen LRU: exploit locality in rmap (Yu Zhao)
  - mm: multi-gen LRU: minimal implementation (Yu Zhao)
  - mm: multi-gen LRU: groundwork (Yu Zhao)
  - asm-generic/atomic: Add try_cmpxchg() fallbacks (Peter Zijlstra)
  - mm/vmscan.c: refactor shrink_node() (Yu Zhao)
  - mm: x86: add CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG (Yu Zhao)
  - mm: x86, arm64: add arch_has_hw_pte_young() (Yu Zhao)
  - mm: VM_BUG_ON lru page flags (Yu Zhao)
  - mm: add __clear_page_lru_flags() to replace page_off_lru() (Yu Zhao)
  - mm/swap.c: don't pass "enum lru_list" to del_page_from_lru_list() (Yu Zhao)
  - mm/swap.c: don't pass "enum lru_list" to trace_mm_lru_insertion() (Yu Zhao)
  - mm: don't pass "enum lru_list" to lru list addition functions (Yu Zhao)
  - include/linux/mm_inline.h: shuffle lru list addition and deletion functions (Yu Zhao)
  - mm/vmscan.c: use add_page_to_lru_list() (Yu Zhao)
  - anolis: x86: adjust the configuration of NR_CPUS (Kaihao Bai)
  - anolis: efi: cper: add ARM64 dependence for YITIAN_CPER_RAWDATA (Shuai Xue)
  - anolis: KVM: SVM: Fix the available ASID range for CSV2 guest (hanliyang)
  - KVM, SEV: Add KVM_EXIT_SHUTDOWN metadata for SEV-ES (Peter Gonda)
  - KVM: SVM: Exit to userspace on ENOMEM/EFAULT GHCB errors (Sean Christopherson)
  - KVM: SVM: Do not terminate SEV-ES guests on GHCB validation failure (Tom Lendacky)
  - KVM: SEV: Fall back to vmalloc for SEV-ES scratch area if necessary (Sean Christopherson)
  - KVM: SEV: Return appropriate error codes if SEV-ES scratch setup fails (Sean Christopherson)
  - anolis: kfence: recover kfence_node_map if flush list fail (Tianchen Ding)
  - anolis: kfence: do not re-enable kfence if no areas (Tianchen Ding)
  - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (Pablo Neira Ayuso) {CVE-2023-4147}
  - netfilter: nft_set_pipapo: fix improper element removal (Florian Westphal) {CVE-2023-4004}
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng) {CVE-2023-3090}
  - net/sched: cls_u32: Fix reference counter leak leading to overflow (Lee Jones) {CVE-2023-3609}
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Pedro Tammela) {CVE-2023-3611}
  - net/sched: sch_qfq: refactor parsing of netlink parameters (Pedro Tammela) {CVE-2023-3611}
  - btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (Zixuan Fu) {CVE-2023-3111}
  - btrfs: check return value of btrfs_commit_transaction in relocation (Josef Bacik) {CVE-2023-3111}
  - anolis: configs: Enable CRYPTO_OFB for fips mode (Tianjia Zhang)
  - gfs2: Don't deref jdesc in evict (Bob Peterson) {CVE-2023-3212}
  - dma-direct: always leak memory that can't be re-encrypted (Christoph Hellwig)
  - dma-direct: factor out dma_set_{de,en}crypted helpers (Christoph Hellwig)
  - usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup (Johan Hovold)
  - xen/pvcalls-back: fix double frees with pvcalls_new_active_socket() (Dan Carpenter)
  - drm/virtio: Correct drm_gem_shmem_get_sg_table() error handling (Dmitry Osipenko)
  - SCSI: SSSRAID: Support 3SNIC 3S5XX serial RAID/HBA controllers (Steven Song)
  - crypto: ccp - Add SEV_INIT rc error logging on init (Peter Gonda)
  - KVM: SVM: Zero out the VMCB array used to track SEV ASID association (Sean Christopherson)
  - KVM: SEV: Add cond_resched() to loop in sev_clflush_pages() (Peter Gonda)
  - KVM: SVM: Inject #UD on attempted emulation for SEV guest w/o insn buffer (Sean Christopherson)
  - KVM: SVM: WARN if KVM attempts emulation on #UD or #GP for SEV guests (Sean Christopherson)
  - KVM: x86: Pass emulation type to can_emulate_instruction() (Sean Christopherson)
  - KVM: SVM: Explicitly require DECODEASSISTS to enable SEV support (Sean Christopherson)
  - KVM: SVM: Don't intercept #GP for SEV guests (Sean Christopherson)
  - KVM: SVM: Skip SEV cache flush if no ASIDs have been used (Sean Christopherson)
  - KVM: SVM: Remove an unnecessary prototype declaration of sev_flush_asids() (Sean Christopherson)
  - KVM: SVM: Free sev_asid_bitmap during init if SEV setup fails (Sean Christopherson)
  - anolis: configs: adjust CONFIG_CMA_AREAS for arm64 (Qiao Ma)
  - anolis: configs: enable CONFIG_CMA for x86 (Qiao Ma)
  - anolis: configs: disable CONFIG_CRC4 for x86 (Qiao Ma)
  - anolis: configs: disable CONFIG_SECURITY_SMACK for x86 (Qiao Ma)
  - anolis: configs: disable CONFIG_IP_DCCP for x86 (Qiao Ma)
  - anolis: config: disable CONFIG_IP6_NF_TARGET_HL for x86 (Qiao Ma)
  - anolis: configs: disable CONFIG_IP_NF_TARGET_CLUSTERIP for x86 (Qiao Ma)
  - configs: enable CONFIG_ZONE_DEVICE for arm64 (Qiao Ma)
  - Loongarch: Fixed finding zero address exception vector table error (Juxin Gao)
  - KVM: x86: Don't WARN if userspace mucks with RCX during string I/O exit (Sean Christopherson)
  - KVM: SEV-ES: fix another issue with string I/O VMGEXITs (Paolo Bonzini)
  - KVM: SEV-ES: go over the sev_pio_data buffer in multiple passes if needed (Paolo Bonzini)
  - KVM: SEV-ES: keep INS functions together (Paolo Bonzini)
  - KVM: x86: remove unnecessary arguments from complete_emulator_pio_in (Paolo Bonzini)
  - KVM: x86: split the two parts of emulator_pio_in (Paolo Bonzini)
  - KVM: SEV-ES: clean up kvm_sev_es_ins/outs (Paolo Bonzini)
  - KVM: x86: leave vcpu->arch.pio.count alone in emulator_pio_in_out (Paolo Bonzini)
  - KVM: SEV-ES: rename guest_ins_data to sev_pio_data (Paolo Bonzini)
  - KVM: SEV-ES: reduce ghcb_sa_len to 32 bits (Paolo Bonzini)
  - KVM: SEV-ES: fix length of string I/O (Paolo Bonzini)
  - netfilter: nf_tables: fix chain binding transaction logic (Pablo Neira Ayuso) {CVE-2023-3610}
  - anolis: Loongarch: Fix a large of build error. (Juxin Gao)
  - LoongArch: Support dbar with different hints (Juxin Gao)
  - bpf: add missing header file include (Juxin Gao)
  - anolis: KVM: SVM: Print Hygon CSV support info if support is detected (hanliyang)
  - anolis: crypto: ccp: Print Hygon CSV API version when CSV support is detected (hanliyang)
  - anolis: x86/cpu: Detect memory encryption features on Hygon CPUs (hanliyang)
  - kallsyms: increase maximum kernel symbol length to 512 (Miguel Ojeda)
  - kallsyms: support "big" kernel symbols (Miguel Ojeda)
  - kallsyms: add static relationship between `KSYM_NAME_LEN{,_BUFFER}` (Miguel Ojeda)
  - kallsyms: avoid hardcoding buffer size (Boqun Feng)
  - kallsyms: use `ARRAY_SIZE` instead of hardcoded size (Boqun Feng)
  - anolis: erofs: fix EROFS completely broken due to RAFS v6 support (Gao Xiang)
  - erofs: fix misbehavior of unsupported chunk format check (Gao Xiang)
  - anolis: LoongArch: Fix compile warning about ACPI_VIDEO (Juxin Gao)
  - PCI/ACPI: Guard ARM64-specific mcfg_quirks (Juxin Gao)
  - anolis: LoongArch: Fix compile error because missing __init (Juxin Gao)
  - mm: rename pud_page_vaddr to pud_pgtable and make it return pmd_t * (Juxin Gao)
  - anolis: usb: xhci: add XHCI_NO_SOFT_RETRY quirk for EJ188 (Hongchen Zhang)
  - anolis: drm/loongson: fix compile warnning (Sui Jingfeng)
  - anolis: drm/loongson: using hdmi hot plug status register (Juxin Gao)
  - anolis: irqchip/loongson: Fix syscore ops registration (Jianmin Lv)
  - anolis: irqchip/loongarch: Fix some issues of irq controllers (Jianmin Lv)
  - anolis: LoongArch: Initialize screen_info variable (Juxin Gao)
  - anolis: LoongArch: Fixed EIOINTC structure members (yangqiming)
  - anolis: LoongArch: Fix virtual machine startup error (Juxin Gao)
  - anolis: loongarch/kvm: ls7a add iocsrw emulation (Juxin Gao)
  - anolis: LoongArch: defconfig: update network configurations (Juxin Gao)
  - anolis: LoongArch: fix signal handler name changed (Hongchen Zhang)
  - anolis: fix compile error introduced by LoongArch commit (Juxin Gao)
  - anolis: LoongArch: pci root bridige set acpi companion only when not acpi_disabled. (Tianli Xiong)
  - anolis: pci: fix X server auto probe fail when both ast and etnaviv drm present (suijingfeng)
  - anolis: LS7A2000: PCIE: Fixup GPU card error (Juxin Gao)
  - anolis: net: ngbe: fix vxlan is not working (DuanqiangWen)
  - KVM: SVM: Move GHCB unmapping to fix RCU warning (Tom Lendacky)
  - KVM: SVM: Make sure GHCB is mapped before updating (Tom Lendacky)
  - KVM: SEV-ES: Set guest_state_protected after VMSA update (Peter Gonda)
  - KVM: SEV: Acquire vcpu mutex when updating VMSA (Peter Gonda)
  - KVM: SVM: Use online_vcpus, not created_vcpus, to iterate over vCPUs (Sean Christopherson)
  - KVM: x86: Always set kvm_run->if_flag (Marc Orr)
  - KVM: x86: Assume a 64-bit hypercall for guests with protected state (Tom Lendacky)
  - KVM: X86: Fix failure to boost kernel lock holder candidate in SEV-ES guests (Wanpeng Li)
  - KVM: SVM: Flush when freeing encrypted pages even on SME_COHERENT CPUs (Mingwei Zhang)
  - KVM: SVM: Simplify and harden helper to flush SEV guest page(s) (Sean Christopherson)
  - KVM: SEV: WARN if SEV-ES is marked active but SEV is not (Sean Christopherson)
  - KVM: SVM: Do not set sev->es_active until KVM_SEV_ES_INIT completes (Sean Christopherson)
  - x86/debug: Fix stack recursion caused by wrongly ordered DR7 accesses (Joerg Roedel)
  - x86/sev: Remove duplicated assignment to variable info (Colin Ian King)
  - x86/sev: Mark the code returning to user space as syscall gap (Lai Jiangshan)
  - x86/sev-es: Replace open-coded hlt-loop with sev_es_terminate() (Peter Gonda)
  - x86/sev: Allow #VC exceptions on the VC2 stack (Joerg Roedel)
  - x86/sev: Carve out HV call's return value verification (Borislav Petkov)
  - x86/sev: Propagate #GP if getting linear instruction address failed (Joerg Roedel)
  - x86/insn: Extend error reporting from insn_fetch_from_user[_inatomic]() (Joerg Roedel)
  - x86/insn-eval: Make 0 a valid RIP for insn_get_effective_ip() (Joerg Roedel)
  - x86/sev: Fix error message in runtime #VC handler (Joerg Roedel)
  - x86/sev: Move GHCB MSR protocol and NAE definitions in a common header (Brijesh Singh)
  - x86/sev: Use "SEV: " prefix for messages from sev.c (Joerg Roedel)
  - x86/sev-es: Rename sev-es.{ch} to sev.{ch} (Brijesh Singh)
  - x86/sev: Drop redundant and potentially misleading 'sev_enabled' (Sean Christopherson)
  - x86/sev-es: Optimize __sev_es_ist_enter() for better readability (Joerg Roedel)
  - x86/sev-es: Replace open-coded hlt-loops with sev_es_terminate() (Joerg Roedel)
  - x86/boot/compressed/64: Cleanup exception handling before booting kernel (Joerg Roedel)
  - x86/sev-es: Split vc_decode_insn() (Borislav Petkov)
  - x86/sev-es: Remove subtraction of res variable (Borislav Petkov)
  - x86/efi: Restore Firmware IDT before calling ExitBootServices() (Joerg Roedel)
  - x86/boot/compressed/64: Add CPUID sanity check to 32-bit boot-path (Joerg Roedel)
  - x86/boot/compressed/64: Add 32-bit boot #VC handler (Joerg Roedel)
  - x86/boot/compressed/64: Setup IDT in startup_32 boot path (Joerg Roedel)
  - x86/boot/compressed/64: Reload CS in startup_32 (Joerg Roedel)
  - anolis: mm: coldpgs: batch free unref pages (Huang Haowei)
  - anolis: mm: coldpgs: relax in reclaim_coldpgs_read_stats (Huang Haowei)
  - anolis: arm_mpam: Fix schemata's display error of MB when CDP is enabled (Shawn Wang)
  - anolis: LoongArch: kvm: KVM support for 5.10 (Bibo Mao)
  - anolis: LoongArch: kvm: add initial kvm support (yangyinglu)
  - anolis: pci/quirks: ls7a2000: fix pm transition of devices under pcie port (yangyinglu)
  - anolis: LoongArch: Fixed some pcie card not scanning properly (yangyinglu)
  - anolis: pci: fix kabi error caused by pm_suspend_target_state (yangyinglu)
  - anolis: PCI: PM: Fix pcie mrrs restoring (yangyinglu)
  - anolis: PCI: Check if the pci controller can use both CFG0 and CFG1 mode to access configuration space (yangyinglu)
  - anolis: PCI: Check if entry->offset already exist for mem resource (yangyinglu)
  - LoongArch: Export symbol for function smp_send_reschedule() (yangyinglu)
  - anolis: LoongArch: fix compile error when using make allmodconfig (yangyinglu)
  - anolis: LoongArch: remove __ARCH_WANT_NEW_STAT (yangyinglu)
  - anolis: LoongArch: modify defconfig according to other architectures (yangyinglu)
  - anolis: LoongArch: Change definition of cpu_relax() (yangyinglu)
  - anolis: drm/loongson: add kernel modesetting driver support for ls7a1000/ls7a2000 (yangyinglu)
  - LoongArch: Use alternative to optimize libraries (yangyinglu)
  - LoongArch: Add alternative runtime patching mechanism (yangyinglu)
  - LoongArch: Remove the .fixup section usage (yangyinglu)
  - LoongArch: extable: Add a dedicated uaccess handler (yangyinglu)
  - LoongArch: extable: Add `type` and `data` (yangyinglu)
  - LoongArch: Switch to relative exception (yangyinglu)
  - LoongArch: Consolidate __ex_table construction (yangyinglu)
  - anolis: vfio:mdev:idxd: fix kernel warning after idxd mdev re-created (Fengqian Gao)
  - anolis: config: correct arm64 configs (Qiao Ma)
  - anolis: efi: do not enable CONFIG_EFI_ZBOOT for arm64 (Qiao Ma)
  - anolis: configs: refresh anolis configs for x86 (Qiao Ma)
  - anolis: mm: limit min_cache_kbytes (Xu Yu)
  - anolis: mm: make min_cache_kbytes behave explicitly (Xu Yu)
  - media: saa7134: fix use after free bug in saa7134_finidev due to race condition (Zheng Wang)
  - anolis: crypto: ccp: Fix definition of struct sev_data_send_update_vmsa (hanliyang)
  - anolis: LoongArch: fix SECCOMP test error (Hongchen Zhang)
  - anolis: LoongArch: fix vmlinux ld error (Hongchen Zhang)
  - anolis: LoongArch: enable hugetlbfs support (Hongchen Zhang)
  - anolis: LoongArch: save one instruction for arch_local_irq_{enable,disable} (Hongchen Zhang)
  - anolis: LoongArch: optimize for syscall return (Hongchen Zhang)
  - anolis: LoongArch: refresh usage of sync (Bibo Mao)
  - anolis: LoongArch: use 40 bits address space for user (Hongchen Zhang)
  - anolis: LoongArch: Support loader and kernel interface V40 (liweihao)
  - anolis: LoongArch: Enhance booting and resume compatibility (Jianmin Lv)
  - anolis: LoongArch: Remove redudant csr save/restore (Jun Yi)
  - anolis: LoongArch: Support Power Manager (liweihao)
  - anolis: irqchip/loongson-liointc: Set different isr for differnt core (Tianli Xiong)
  - anolis: platform: Support loongson laptop generic driver (liweihao)
  - anolis: LoongArch: Adapted SECTION_SIZE_BITS with page size (zhangtianyang)
  - anolis: ACPI: Support ACPI_MACHINE_WIDTH for 64 (liweihao)
  - anolis: spi: loongson: Add LS7A spi driver support (liweihao)
  - anolis: i2c: loongson: Add LS7A i2c driver support (liweihao)
  - anolis: LoongArch: Call irq_find_matching_fwnode get irq domain (liweihao)
  - anolis: irqchip/ACPI: Introduce ACPI_IRQ_MODEL_LPIC for LoongArch (Jianmin Lv)
  - anolis: gpio: loongson: Add 3A/3B/3C/7A gpio dirver support (liweihao)
  - rxrpc: Fix race between conn bundle lookup and bundle removal [ZDI-CAN-15975] (David Howells) {CVE-2023-2006}
  - kvm: x86: Add support for getting/setting expanded xstate buffer (Guang Zeng)
  - perf/x86/uncore: Don't WARN_ON_ONCE() for a broken discovery table (Kan Liang)
  - perf/x86/uncore: Add a quirk for UPI on SPR (Kan Liang)
  - perf/x86/uncore: Ignore broken units in discovery table (Kan Liang)
  - perf/x86/uncore: Fix potential NULL pointer in uncore_get_alias_name (Kan Liang)
  - perf/x86/uncore: Factor out uncore_device_to_die() (Kan Liang)
  - rtc: ls2x: Add support for the Loongson-2K/LS7A RTC (Ming Wang)
  - anolis: LoongArch: convert p v s cache to l1 l2 l3 format (Liu Peibao)
  - anolis: cpufreq: Add cpufreq driver for LoongArch (liuyun)
  - LoongArch: Fix section mismatch due to acpi_os_ioremap() (Huacai Chen)
  - LoongArch: Add vector extensions support (Ming Wang)
  - tools/perf: Add basic support for LoongArch (Ming Wang)
  - perf machine: Use path__join() to compose a path instead of snprintf(dir, '/', filename) (Ming Wang)
  - anolis: LoongArch: defconfig: Set CONFIG_TXGBE=m by default (Ming Wang)
  - anolis: LS7A2000 : Add quirk for OHCI device rev 0x02 (Ming Wang)
  - anolis: stmmac: pci: Add dwmac support for Loongson (Ming Wang)
  - anolis: LoongArch: hugepage table replace tlb (liuyun)
  - anolis: LoongArch: change global registers to local registers (Hongchen Zhang)
  - anolis: LoongArch: Old BPI compatibility (Juxin Gao)
  - anolis: LoongArch: add kernel setvirtmap for runtime (liuyun)
  - anolis: LoongArch: enable some netfilter related configs (Ming Wang)
  - anolis: LoongArch: defconfig: use make defconfig to save a clean defconfig (Ming Wang)
  - LoongArch: Support R_LARCH_GOT_PC_{LO12,HI20} in modules (Ming Wang)
  - LoongArch: Support PC-relative relocations in modules (Ming Wang)
  - LoongArch: Define ELF relocation types added in v2.00 ABI (Ming Wang)
  - LoongArch: Adjust symbol addressing for AS_HAS_EXPLICIT_RELOCS (Ming Wang)
  - LoongArch: Add Kconfig option AS_HAS_EXPLICIT_RELOCS (Ming Wang)
  - anolis: arm64: Add a cmdline parameter to adjust the cpufreq snapshot threshold (Shawn Wang)
  - anolis: KVM: SVM: Add RECEIVE_UPDATE_DATA command helper to support KVM_CSV_COMMAND_BATCH (fangbaoshun)
  - anolis: KVM: SVM: Add SEND_UPDATE_DATA command helper to support KVM_CSV_COMMAND_BATCH (fangbaoshun)
  - anolis: KVM: SVM: Prepare memory pool to allocate buffers for KVM_CSV_COMMAND_BATCH (fangbaoshun)
  - anolis: KVM: SVM: Add KVM_CSV_COMMAND_BATCH command for applying CSV RING_BUFFER mode (fangbaoshun)
  - anolis: crypto: ccp: Add support for issue commands in CSV RING_BUFFER mode (fangbaoshun)
  - anolis: crypto: ccp: Add support to switch to CSV RING_BUFFER mode (fangbaoshun)
  - anolis: crypto: ccp: Add support for dequeue status in CSV RING_BUFFER mode (fangbaoshun)
  - anolis: crypto: ccp: Add support for enqueue command pointers in CSV RING_BUFFER mode (fangbaoshun)
  - anolis: crypto: ccp: Introduce init and free helpers to manage CSV RING_BUFFER queues (fangbaoshun)
  - EDAC/i10nm: Add Intel Emerald Rapids server support (Qiuxu Zhuo)
  - anolis: driver core: Support forcing probe drivers synchronously (Bitao Hu)
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Takashi Iwai) {CVE-2023-31084}
  - usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition (Zheng Wang)
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Zheng Wang)
  - fbcon: Check font dimension limits (Samuel Thibault) {CVE-2023-3161}
  - media: rkvdec: fix use after free bug in rkvdec_remove (Zheng Wang)
  - sched/fair: Sanitize vruntime of entity being migrated (Vincent Guittot)
  - sched/fair: sanitize vruntime of entity being placed (Zhang Qiao)
  - perf build: Install libsymbol locally when building (Ian Rogers)
  - tool lib symbol: Add Makefile/Build (Ian Rogers)
  - anolis: configs: enable CONFIG_VFIO_MDEV_IDXD (Aubrey Li)
  - anolis: mm: hugetext: default enable (Rongwei Wang)
  - crypto: ccp - Fix whitespace in sev_cmd_buffer_len() (Peter Gonda)
  - KVM: SEV: Flush cache on non-coherent systems before RECEIVE_UPDATE_DATA (Masahiro Kozuka)
  - KVM: SVM: Fix potential overflow in SEV's send|receive_update_data() (Peter Gonda)
  - KVM: SEV: Pin guest memory for write for RECEIVE_UPDATE_DATA (Sean Christopherson)
  - KVM: SVM: Fix sev_pin_memory() error checks in SEV migration utilities (Sean Christopherson)
  - KVM: SVM: fix missing sev_decommission in sev_receive_start (Mingwei Zhang)
  - KVM: SVM: Return -EFAULT if copy_to_user() for SEV mig packet header fails (Sean Christopherson)
  - KVM: SVM: Fix SEV SEND_START session length & SEND_UPDATE_DATA query length after commit 238eca821cee (Ashish Kalra)
  - KVM: SVM: Add KVM_SEV_RECEIVE_FINISH command (Brijesh Singh)
  - KVM: SVM: Add KVM_SEV_RECEIVE_UPDATE_DATA command (Brijesh Singh)
  - KVM: SVM: Add support for KVM_SEV_RECEIVE_START command (Brijesh Singh)
  - KVM: SVM: Add support for KVM_SEV_SEND_CANCEL command (Steve Rutherford)
  - KVM: SVM: Add KVM_SEV_SEND_FINISH command (Brijesh Singh)
  - KVM: SVM: Add KVM_SEND_UPDATE_DATA command (Brijesh Singh)
  - KVM: SVM: Add KVM_SEV SEND_START command (Brijesh Singh)
  - xfs: verify buffer contents when we skip log replay (Darrick J. Wong) {CVE-2023-2124}
  - anolis: xhci: Show Zhaoxin XHCI root hub speed correctly (leoliu-oc)
  - anolis: x86/mm: Print CSV info into the kernel log (hanliyang)
  - perf cs-etm: Add fix for coresight trace for any range of CPUs (Ganapatrao Kulkarni)
  - perf cs-etm: Handle PERF_RECORD_AUX_OUTPUT_HW_ID packet (Mike Leach)
  - perf cs-etm: Update record event to use new Trace ID protocol (Mike Leach)
  - perf cs-etm: Move mapping of Trace ID and cpu into helper function (Mike Leach)
  - perf cs-etm: Improve missing sink warning message (James Clark)
  - anolis: net/smc: fix hung state in inet sock (D. Wythe)
  - anolis: net/smc: avoid applications receiving clc msg (D. Wythe)
  - anolis: net/smc: Improve print and remove module params of reserve_mode (Wen Gu)
  - anolis: net/smc: validate rdma writable by rtoken_idx (Guangguan Wang)
  - anolis: net/smc: fix dup smc diag info (D. Wythe)
  - anolis: net/smc: Fix potential memory leaks and exceptions in inet (D. Wythe)
  - anolis: net/smc: fix ebpf panic (D. Wythe)
  - anolis: net/smc: fix bpf compile error (D. Wythe)
  - anolis: net/smc: fix potential reference count leak in smc (D. Wythe)
  - anolis: net/smc: protect connection state transitions in listen work (D. Wythe)
  - anolis: net/smc: optimize mutex_fback_rsn from mutex to spinlock (D. Wythe)
  - anolis: net/smc: refactor sock_flag/sock_set_flag (D. Wythe)
  - anolis: net/smc: add default name for smc negotiator (D. Wythe)
  - anolis: net/smc: do not check diff_cons when rmb_desc is null (Guangguan Wang)
  - anolis: net/smc: Expand the statistical range of ringbufs (Wen Gu)
  - anolis: net/smc: Expand the upper limit of SMCR/D ringbuf to 2MB (Wen Gu)
  - anolis: net/smc: Split wr_rx_buf into SMC_WR_BUF_CNT (Wen Gu)
  - anolis: net/smc: Adjust reserved-ports range and add warning print (Wen Gu)
  - anolis: net/smc: Fix fallback count overflow issue (Wen Gu)
  - anolis: net/smc: sock_hold in conns_lock protect area when smc_lgr_find_conn (Guangguan Wang)
  - anolis: net/smc: protect rdma_write processing from deleting rkey (Guangguan Wang)
  - anolis: net/smc: do not validate rkey by testing rkey value (Guangguan Wang)
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Mike Christie) {CVE-2023-2162}
  - anolis: Revert "anolis: io_uring: lift nice value of sqthread" (Ferry Meng)
  - anolis: Revert "selftest: kvm: Add amx selftest" (Guanjun)
  - anolis: arm64: enable CONFIG_KFENCE to solve memory corruption (Kaihao Bai)
  - anolis: arm64: always allocate kfence area to avoid splitting linear mapping (Kaihao Bai)
  - mm,kfence: decouple kfence from page granularity mapping judgement (Zhenhua Huang)
  - anolis: mm/lru: align lruvec lock to a cache line (Rongwei Wang)
  - anolis: i2c: i2c controller driver for Phytium platforms (Jiakun Shuai)
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Thadeu Lima de Souza Cascardo) {CVE-2023-35001}
  - netfilter: nf_tables: do not ignore genmask when looking up chain by id (D. Wythe) {CVE-2023-31248}
  - cgroup: always put cset in cgroup_css_set_put_fork (John Sperbeck)
  - anolis: io_uring: remove redundant CONFIG_CGROUP_CPUACCT (Joseph Qi)
  - uaccess: Add speculation barrier to copy_from_user() (Dave Hansen) {CVE-2023-0459}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (D. Wythe) {CVE-2023-3117}
  - tipc: set con sock in tipc_conn_alloc (Xin Long) {CVE-2023-1382,CVE-2023-1382}
  - anolis: sched/isolation: fix a memory leak in procfs (Tianchen Ding)
  - irqchip/loongson-liointc: Fix an error handling path in liointc_init() (Christophe JAILLET)
  - irqchip/loongarch: Fix irq_domain_alloc_fwnode() abuse (Marc Zyngier)
  - irqchip/loongson-eiointc: Fix a build warning (Huacai Chen)
  - irqchip/loongson-eiointc: Fix irq affinity setting (Huacai Chen)
  - irqchip: Adjust Kconfig for Loongson (Huacai Chen)
  - anolis: PCI: Add quirk for LS7A to avoid reboot failure (Huacai Chen)
  - anolis: PCI: loongson: Improve the MRRS quirk for LS7A (Huacai Chen)
  - PCI: loongson: Work around LS7A incorrect Interrupt Pin registers (Jianmin Lv)
  - PCI: loongson: Don't access non-existent devices (Huacai Chen)
  - PCI: loongson: Add ACPI init support (Juxin Gao)
  - PCI: loongson: Use generic 8/16/32-bit config ops on LS2K/LS7A (Huacai Chen)
  - irqchip / ACPI: Introduce ACPI_IRQ_MODEL_LPIC for LoongArch (Jianmin Lv)
  - ACPI: irq: Allow acpi_gsi_to_irq() to have an arch-specific fallback (Marc Zyngier)
  - APCI: irq: Add support for multiple GSI domains (Juxin Gao)
  - anolis: drm/radeon: Workaround radeon driver bug for Loongson (Huacai Chen)
  - LoongArch: Add writecombine support for drm (Huacai Chen)
  - Input: i8042 - Add PNP checking hook for Loongson (Huacai Chen)
  - LoongArch: Add qspinlock support (Huacai Chen)
  - LoongArch: Add perf events support (Huacai Chen)
  - LoongArch: Add SysRq-x (TLB Dump) support (Huacai Chen)
  - LoongArch: Use TLB for ioremap() (Huacai Chen)
  - LoongArch: Enable ARCH_WANT_HUGETLB_PAGE_OPTIMIZE_VMEMMAP (Feiyang Chen)
  - LoongArch: Add sparse memory vmemmap support (Feiyang Chen)
  - MIPS&LoongArch&NIOS2: Adjust prototypes of p?d_init() (Feiyang Chen)
  - anolis: configs: enable CONFIG_BUG_ON_DATA_CORRUPTION for arm64 (Qiao Ma)
  - anolis: configs: enable some crypto related configs for arm64 (Qiao Ma)
  - anolis: configs: enable some net related configs for arm64 (Qiao Ma)
  - anolis: configs: support SMR zoned device on arm64 (Qiao Ma)
  - anolis: configs: enable IPV6_SUBTREES for arm64 (Qiao Ma)
  - anolis: configs: refresh configs for arm64 (Qiao Ma)
  - anolis: configs: set fq_codel as default qdisc type for x86 (Qiao Ma)
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus)
  - anolis: Revert "anolis: xfs: account extra freespace btree splits for multiple allocations" (Gao Xiang)
  - anolis:driver/virt/coco: Add HYGON CSV Guest dirver. (fangbaoshun)
  - irqchip/loongson-pch-lpc: Add suspend/resume support (Huacai Chen)
  - irqchip/loongson-pch-pic: Add suspend/resume support (Huacai Chen)
  - irqchip/loongson-eiointc: Add suspend/resume support (Huacai Chen)
  - irqchip/loongson-htvec: Add suspend/resume support (Huacai Chen)
  - irqchip/loongson-htvec: Add ACPI init support (Huacai Chen)
  - net/mlx5: SF: Fix memory leak of work item (Shay Drory)
  - net/mlx5: SF, Correct vhca context size (Parav Pandit)
  - net/mlx5: SF_DEV, remove SF device on invalid state (Parav Pandit)
  - net/mlx5: SF, Fix error return code in mlx5_sf_dev_probe() (Wei Yongjun)
  - vdpa/mlx5: Use the correct dma device when registering memory (Eli Cohen)
  - vdpa/mlx5: Retrieve BAR address suitable any function (Eli Cohen)
  - net/mlx5: Don't skip subfunction cleanup in case of error in module init (Leon Romanovsky)
  - net/mlx5: Fix SF health recovery flow (Moshe Shemesh)
  - net/mlx5: Fix access to sf_dev_table on allocation failure (Shay Drory)
  - net/mlx5: SF, Drain health before removing device (Shay Drory)
  - net/mlx5: SF: Fix error flow of SFs allocation flow (Shay Drory)
  - net/mlx5: SF, do not use ecpu bit for vhca state processing (Parav Pandit)
  - net/mlx5: SF, Fix show state inactive when its inactivated (Parav Pandit)
  - net/mlx5: Avoid false positive lockdep warning by adding lock_class_key (Moshe Shemesh)
  - net/mlx5: Add devlink subfunction port documentation (Parav Pandit)
  - net/mlx5: SF, Port function state change support (Parav Pandit)
  - net/mlx5: SF, Add port add delete functionality (Parav Pandit)
  - net/mlx5: E-switch, Add eswitch helpers for SF vport (Parav Pandit)
  - net/mlx5: E-switch, Prepare eswitch to handle SF vport (Vu Pham)
  - net/mlx5: SF, Add auxiliary device driver (Parav Pandit)
  - net/mlx5: SF, Add auxiliary device support (Parav Pandit)
  - net/mlx5: Introduce vhca state event notifier (Parav Pandit)
  - net/mlx5: Update the hardware interface definition for vhca state (Parav Pandit)
  - net/mlx5: Register mlx5 devices to auxiliary virtual bus (Leon Romanovsky)
  - net/mlx5_core: Clean driver version and name (Leon Romanovsky)
  - driver core: auxiliary bus: make remove function return void (Greg Kroah-Hartman)
  - devlink: Extend devlink port documentation for subfunctions (Parav Pandit)
  - devlink: Add devlink port documentation (Parav Pandit)
  - devlink: Support get and set state of port function (Parav Pandit)
  - devlink: Support add and delete devlink port (Parav Pandit)
  - devlink: Introduce PCI SF port flavour and port attribute (Parav Pandit)
  - devlink: Prepare code to fill multiple port function attributes (Parav Pandit)
  - ACPI / table: Print CORE_PIC information when MADT is parsed (Huacai Chen)
  - ACPICA: Events: Support fixed pcie wake event (Huacai Chen)
  - ACPICA: MADT: Add loongarch_arch-specific APICs support (Juxin Gao)
  - ACPI: Add LoongArch support for ACPI_PROCESSOR/ACPI_NUMA (Huacai Chen)
  - Revert "LoongArch: Provisionally add ACPICA data structures" (Huacai Chen)
  - loongarch: efi: enable generic EFI compressed boot (Ard Biesheuvel)
  - efi/libstub: implement generic EFI zboot (Juxin Gao)
  - efi/libstub: use EFI provided memcpy/memset routines (Juxin Gao)
  - efi/libstub: add some missing EFI prototypes (Ard Biesheuvel)
  - efi/loongarch: Add efistub booting support (Huacai Chen)
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang) {CVE-2023-35825}
  - relayfs: fix out-of-bounds access in relay_file_read (Zhang Zhengming) {CVE-2023-3268}
  - drm/msm/dpu: Add check for pstates (Jiasheng Jiang) {CVE-2023-3220}
  - anolis: ata: sata_zhaoxin: Add support for Zhaoxin Serial ATA (leoliu-oc)
  - anolis: xhci: Add Zhaoxin xHCI LPM U1/U2 feature support (leoliu-oc)
  - anolis: xhci: fix issue with resume from system Sx state (leoliu-oc)
  - s390/smp: perform cpu reset before delegating work to target cpu (Heiko Carstens)
  - af_unix: Get user_ns from in_skb in unix_diag_get_exact(). (Kuniyuki Iwashima) {CVE-2023-28327}
  - netrom: Fix use-after-free caused by accept on already connected socket (Hyunwoo Kim) {CVE-2023-32269}
  - net: qcom/emac: Fix use after free bug in emac_remove due to race condition (Zheng Wang) {CVE-2023-2483}
  - sctp: leave the err path free in sctp_stream_init to sctp_stream_free (Xin Long) {CVE-2023-2177}
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due to race condition (Zheng Wang) {CVE-2023-1859}
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ruihan Li) {CVE-2023-2002}
  - anolis: docs/kfence: update document for kfence.fault switch (Tianchen Ding)
  - anolis: kfence: add independent switch about panic (Tianchen Ding)
  - ovl: enable RCU'd ->get_acl() (Miklos Szeredi)
  - anolis: Revert "anolis: erofs,ovl: bypass [override|revert]_creds for overlayfs" (Jingbo Xu)
  - anolis: Revert "anolis: erofs,ovl: enable RCU'd ->get_acl()" (Jingbo Xu)
  - anolis: configs: enable CONFIG_IKCONFIG_PROC (Qiao Ma)
  - anolis: configs: refresh anolis configs (Qiao Ma)
  - anolis: virtio-blk: skip BUG_ON() in virtio_queue_rq() for discard command (Fupan Li)
  - anolis: configs: enable TDX guest support by default (GuoRui.Yu)
  - anolis: drivers: arm64: add prefetch tuning sysctl interface by module mode (Feng Su)
  - irqchip: Select downstream irqchip drivers for LoongArch CPU (Huacai Chen)
  - LoongArch: Add subword xchg/cmpxchg emulation (Huacai Chen)
  - LoongArch: Cleanup headers to avoid circular dependency (Huacai Chen)
  - LoongArch: Cleanup reset routines with new API (Huacai Chen)
  - LoongArch: Fix build warnings in VDSO (Huacai Chen)
  - LoongArch: Select PCI_QUIRKS to avoid build error (Huacai Chen)
  - LoongArch: Update Loongson-3 default config file (Huacai Chen)
  - LoongArch: Add USER_STACKTRACE support (Qing Zhang)
  - LoongArch: Add STACKTRACE support (Qing Zhang)
  - LoongArch: Add prologue unwinder support (Qing Zhang)
  - LoongArch: Add guess unwinder support (Qing Zhang)
  - LoongArch: Add vDSO syscall __vdso_getcpu() (Huacai Chen)
  - LoongArch: Add PCI controller support (Huacai Chen)
  - LoongArch: Parse MADT to get multi-processor information (Huacai Chen)
  - LoongArch: Jump to the link address before enable PG (Huacai Chen)
  - LoongArch: Requires __force attributes for any casts (Qing Zhang)
  - LoongArch: Fix unsigned comparison with less than zero (Yang Li)
  - LoongArch: Adjust arch/loongarch/Kconfig (Huacai Chen)
  - UM: cpuinfo: Fix a warning for CONFIG_CPUMASK_OFFSTACK (Huacai Chen)
  - mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region() (Jann Horn) {CVE-2022-39188}
  - mm: Force TLB flush for PFNMAP mappings before unlink_file_vma() (Jann Horn) {CVE-2022-39188}
  - anolis: mm, thp: fix panic tr_get_hugepage() for thp reclaim (Ning Zhang)
  - usb: dwc3: dwc3-qcom: Add missing platform_device_put() in dwc3_qcom_acpi_register_core (Miaoqian Lin) {CVE-2023-22995}
  - anolis: configs: split CONFIG_KVM into independent config file (Qiao Ma)
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Hangyu Hua) {CVE-2023-35788}
  - power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition (Zheng Wang) {CVE-2023-33288}
  - anolis: fuse: fix array-index-out-of-bounds in fuse_update_stats() (Jingbo Xu)
  - binder: Gracefully handle BINDER_TYPE_FDA objects with num_fds=0 (Alessandro Astone) {CVE-2023-20938}
  - x86/bugs: Flush IBP in ib_prctl_set() (Rodrigo Branco) {CVE-2023-0045}
  - drm/vmwgfx: Validate the box size for the snooped cursor (Zack Rusin) {CVE-2022-36280}
  - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() (Wei Chen) {CVE-2023-2194}
  - USB: gadgetfs: Fix race between mounting and unmounting (Alan Stern) {CVE-2022-4382}
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach (Zheng Wang) {CVE-2023-1670}
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work (Zheng Wang) {CVE-2023-1989}
  - android: binder: stop saving a pointer to the VMA (Liam R. Howlett) {CVE-2023-20928}
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition (Zheng Wang) {CVE-2023-1855}
  - HID: roccat: Fix use-after-free in roccat_read() (Hyunwoo Kim) {CVE-2022-41850}
  - mlxfw: fix null-ptr-deref in mlxfw_mfa2_tlv_next() (Nikita Zhandarovich)
  - clk: st: Fix memory leak in st_of_quadfs_setup() (Xiu Jianfeng)
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition (Zheng Wang) {CVE-2023-30772}
  - prlimit: do_prlimit needs to have a speculation check (Greg Kroah-Hartman) {CVE-2023-0458}
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition (Zheng Wang) {CVE-2023-1990}
  - net/sched: Retire tcindex classifier (Jamal Hadi Salim) {CVE-2023-1829}
  - irqchip/loongson-pch-pic: Move find_pch_pic() into CONFIG_ACPI (Huacai Chen)
  - LoongArch: Fix wrong "ROM Size" of boardinfo (Tiezhu Yang)
  - LoongArch: Fix missing fcsr in ptrace's fpr_set (Qi Hu)
  - LoongArch: Fix shared cache size calculation (Huacai Chen)
  - LoongArch: Disable executable stack by default (Huacai Chen)
  - LoongArch: Remove unused variables (Bibo Mao)
  - LoongArch: Remove clock setting during cpu hotplug stage (Bibo Mao)
  - LoongArch: Remove useless header compiler.h (Jun Yi)
  - LoongArch: Remove several syntactic sugar macros for branches (WANG Xuerui)
  - LoongArch: Re-tab the assembly files (WANG Xuerui)
  - LoongArch: Simplify "BGT foo, zero" with BGTZ (WANG Xuerui)
  - LoongArch: Simplify "BLT foo, zero" with BLTZ (WANG Xuerui)
  - LoongArch: Simplify "BEQ/BNE foo, zero" with BEQZ/BNEZ (WANG Xuerui)
  - LoongArch: Use the "move" pseudo-instruction where applicable (WANG Xuerui)
  - LoongArch: Use the "jr" pseudo-instruction where applicable (WANG Xuerui)
  - LoongArch: Use ABI names of registers where appropriate (WANG Xuerui)
  - irqchip: Add LoongArch CPU interrupt controller support (Huacai Chen)
  - irqchip: Add Loongson Extended I/O interrupt controller support (Huacai Chen)
  - irqchip/loongson-liointc: Add ACPI init support (Huacai Chen)
  - irqchip/loongson-pch-msi: Add ACPI init support (Huacai Chen)
  - irqchip/loongson-pch-pic: Add ACPI init support (Huacai Chen)
  - irqchip: Add Loongson PCH LPC controller support (Huacai Chen)
  - LoongArch: Prepare to support multiple pch-pic and pch-msi irqdomain (Jianmin Lv)
  - ahci: Add a generic 'controller2' RAID id (Dan Williams)
  - anolis: EDAC/amd64: Add support for Hygon family 18h model 6h (Pu Wen)
  - anolis: x86/amd_nb: Add support for Hygon family 18h model 6h (Pu Wen)
  - anolis: x86/cpu: Get CPU topology for Hygon family 18h model 6h (Pu Wen)
  - anolis: hwmon/k10temp: Add support for Hygon family 18h model 5h (Pu Wen)
  - anolis: EDAC/amd64: Add support for Hygon family 18h model 5h (Pu Wen)
  - anolis: x86/amd_nb: Add support for Hygon family 18h model 5h (Pu Wen)
  - anolis: x86/cpu: Get CPU topology and LLC ID for Hygon family 18h model 5h (Pu Wen)
  - anolis: i2c-piix4: Remove the IMC detecting for Hygon SMBus (Pu Wen)
  - anolis: hwmon/k10temp: Add support for Hygon family 18h model 4h (Pu Wen)
  - anolis: EDAC/mce_amd: Use struct cpuinfo_x86.logical_die_id for Hygon NodeId (Pu Wen)
  - anolis: EDAC/amd64: Adjust address translation for Hygon family 18h model 4h (Pu Wen)
  - anolis: EDAC/amd64: Add support for Hygon family 18h model 4h (Pu Wen)
  - anolis: EDAC/amd64: Get UMC channel from the 6th nibble for Hygon (Pu Wen)
  - anolis: iommu/hygon: Add support for Hygon family 18h model 4h IOAPIC (Pu Wen)
  - anolis: x86/amd_nb: Add northbridge support for Hygon family 18h model 4h (Pu Wen)
  - anolis: x86/amd_nb: Add Hygon family 18h model 4h PCI IDs (Pu Wen)
  - anolis: x86/microcode/hygon: Add microcode loading support for Hygon processors (Pu Wen)
  - anolis: x86/cpu/hygon: Modify the CPU topology deriving method for Hygon (Pu Wen)
  - x86/MCE/AMD: Use an u64 for bank_map (Muralidhara M K)
  - x86/cstate: Allow ACPI C1 FFH MWAIT use on Hygon systems (Pu Wen)
  - x86/topology: Set cpu_die_id only if DIE_TYPE found (Yazen Ghannam)
  - selftest: mptcp: exit from copyfd_io_poll() when receive SIGUSR1 (Menglong Dong)
  - selftests: mptcp: tune timeout and delay for simult_flows cases (Paolo Abeni)
  - NFSD: fix use-after-free in __nfs42_ssc_open() (Dai Ngo) {CVE-2022-4379}
  - spdxcheck.py: Fix a type error (zhujun2)
  - ntfs: fix out-of-bounds read in ntfs_attr_find() (Hawkins Jiawei) {CVE-2023-26607}
  - ntfs: fix use-after-free in ntfs_ucsncmp() (ChenXiaoSong)
  - fs: hfsplus: fix UAF issue in hfsplus_put_super (Dongliang Mu) {CVE-2023-2985}
  - ovl: skip stale entries in merge dir cache iteration (Amir Goldstein)
  - anolis: bpf/selftests: fix compile error on bpf_smc (D. Wythe)
  - perf flamegraph: fix a undefined variable error (zhujun2)
  - netfilter: nfnetlink_osf: fix possible bogus match in nf_osf_find() (Pablo Neira Ayuso) {CVE-2022-42432}
  - rds: rds_rm_zerocopy_callback() use list_first_entry() (Pietro Borrello) {CVE-2023-1078}
  - anolis: RDMA/erdma: Add erdma to arm64 defconfig (Kai Shen)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-16_rc2.an8]
changelog:
  - anolis: mm,compaction: Don't use ALLOC_CMA in long term gup path (yangge)
  - net: nfc: Fix use-after-free caused by nfc_llcp_find_local (Lin Ma) {CVE-2023-3863}
  - nfc: llcp: simplify llcp_sock_connect() error paths (Krzysztof Kozlowski) {CVE-2023-3863}
  - nfc: constify several pointers to u8, char and sk_buff (Krzysztof Kozlowski) {CVE-2023-3863}
  - mm: disable LRU pagevec during the migration temporarily (Minchan Kim)
  - clk: imx: Add check for kcalloc (Jiasheng Jiang) {CVE-2022-3114}
  - ubi: Refuse attaching if mtd's erasesize is 0 (Zhihao Cheng) {CVE-2023-31085}
  - media: usb: siano: Fix warning due to null work_func_t function pointer (Duoming Zhou) {CVE-2023-4132}
  - media: usb: siano: Fix use after free bugs caused by do_submit_urb (Duoming Zhou) {CVE-2023-4132}
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (Zheng Wang) {CVE-2022-3424}
  - media: mceusb: Use new usb_control_msg_*() routines (Alan Stern) {CVE-2022-3903}
  - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() (Hyunwoo Kim) {CVE-2022-45887}
  - mm: remove lru_add_drain_all in alloc_contig_range (Minchan Kim)
  - mm, page_alloc: move draining pcplists to page isolation users (Vlastimil Babka)
  - anolis: KVM: flush the CPU caches only when guest memory is reclaimed (Xin Jiang)
  - arm64: Add AMPERE1 to the Spectre-BHB affected list (D Scott Phillips) {CVE-2023-3006}
  - ipv4: fix null-deref in ipv4_link_failure (Kyle Zeng) {CVE-2023-42754}
  - bpf, sockmap: fix deadlocks in the sockhash and sockmap (Xin Liu) {CVE-2023-0160}
  - mm/page_alloc: don't corrupt pcppage_migratetype (Doug Berger)
  - ptp: Fix ptp_kvm_getcrosststamp issue for x86 ptp_kvm (Zelin Deng)
  - anolis: mm/hugetlb: misusing spinlock API in isolate_huge_page() (Xin Jiang)
  - anolis: KVM: SEV: Pin SEV guest memory out of CMA area (Xin Jiang)
  - anolis: mm/gup: Use vzalloc to allocate vmas (yangge)
  - anolis: iommu/vt-d: fix alert message of PASID PT SRE checking for EMR (Fengqian Gao)
  - anolis: crypto: ccp: Fix PSP interrupt register's write race (fangbaoshun)
  - anolis: fix invisible experiment_syn_smc (D. Wythe)
  - anolis: net/smc: Add a module parameter to enable/disable loopback support (Wen Gu)
  - anolis: net/smc: Set SMC-R default buffer type to SMCR_MIXED_BUFS (Wen Gu)
  - net/smc: fix smc clc failed issue when netdevice not in init_net (Dust Li)
  - net/smc: Fix pos miscalculation in statistics (Nils Hoppmann)
  - anolis: net/smc: Fix hung issue in smc_cdc_wait_pend_tx_wr (Wen Gu)
  - anolis: net/smc: add rmb between peer_rmbe_space and local_rx_ctrl.cons read (Guangguan Wang)
  - anolis: net/smc: fix for concurrently cursor add and cursor copy (Guangguan Wang)
  - anolis: net/smc: do not print to dmesg when smc_tx_rdma_write but rmb invalid (Guangguan Wang)
  - anolis: net/smc: fix free slot leak when free slot got but lgr terminate (Guangguan Wang)
  - anolis: net/smc: wait for all rwwi tx wr complete before free link (Guangguan Wang)
  - anolis: net/smc: protect link down work from execute after lgr freed (Guangguan Wang)
  - anolis: net/smc: fix timeout in smc_inet_csk_wait_for_connect (D. Wythe)
  - anolis: net/smc: fix race on inet_sock between tcp-fin and final CDC (D. Wythe)
  - anolis: net/smc: fix sk_wq assigned (D. Wythe)
  - anolis: net/smc: fix imcomplete sock dump info (D. Wythe)
  - ext4: Properly sync file size update after O_SYNC direct IO (Jan Kara)
  - iomap: update ki_pos a little later in iomap_dio_complete (Christoph Hellwig)
  - ovl: remove privs in ovl_copyfile() (Amir Goldstein)
  - anolis: set CONFIG_IO_STRICT_DEVMEM to n by default (chench)
  - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Jingbo Xu)
  - anolis: erofs: fix -EIO when zero-length iovec encountered in rafsv6 (Jingbo Xu)
  - anolis: sched/core: fix warning when occ is zero when account sibidle (Cruz Zhao)
  - anolis: sched/core: remove unused variable of clear_all_cookie() (Cruz Zhao)
  - anolis: watchdog: enlarge watchdog_thresh limit (Cruz Zhao)
  - anolis: sched: fix the wrong config judge for __account_sibidle_time() (Cruz Zhao)
  - anolis: mm: kfence: avoid error caused by multiple assignment (Kaihao Bai)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-16_rc2.1.an8]
changelog:
  - anolis: crypto - Revert "ccp: Fix sm2 test failed when insmod modules" (Tianjia Zhang)
  - perf/x86/uncore: Correct the number of CHAs on EMR (Kan Liang)
  - perf/x86/uncore: Correct the number of CHAs on SPR (Kan Liang)
  - perf/x86/intel: Fix pebs event constraints for SPR (Kan Liang)
  - anolis: perf/arm-cmn: Fix compatibility between Yitian CMN700 and CMN-ANY (Jing Zhang)
  - KVM: SEV: only access GHCB fields once (Paolo Bonzini) {CVE-2023-4155}
  - x86/cpu/amd: Add a Zenbleed fix (Borislav Petkov (AMD)) {CVE-2023-20593}
  - x86/bugs: Increase the x86 bugs vector size to two u32s (Borislav Petkov (AMD)) {CVE-2023-20569}
  - vc_screen: modify vcs_size() handling in vcs_read() (George Kennedy) {CVE-2023-3567}
  - vc_screen: don't clobber return value in vcs_read (Thomas Weißschuh) {CVE-2023-3567}
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (George Kennedy) {CVE-2023-3567}
  - HID: intel_ish-hid: Add check for ishtp_dma_tx_map (Jiasheng Jiang) {CVE-2023-3358}
  - media: vivid: dev->bitmap_cap wasn't freed in all cases (Hans Verkuil) {CVE-2023-0615}
  - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO (Lee, Chun-Yi) {CVE-2023-31083}
  - iommu/vt-d: Fix kdump kernels boot failure with scalable mode (Lu Baolu)
  - anolis: mm: release hugetlb pages to buddy allocator after migrate them (yangge)
  - netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR (Pablo Neira Ayuso) {CVE-2023-4015}
  - anolis: inspur-drm: Fix kernel panic (Bo Liu)
  - netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c (Kyle Zeng) {CVE-2023-42753}
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Budimir Markovic) {CVE-2023-4623}
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis) {CVE-2023-4921}
  - ipv6: sr: fix out-of-bounds read when setting HMAC data. (David Lebrun) {CVE-2023-2860}
  - tcp: Reduce chance of collisions in inet6_hashfn(). (Stewart Smith) {CVE-2023-1206}
  - xfrm: add NULL check in xfrm_update_ae_params (Lin Ma) {CVE-2023-3772}
  - net/sched: Retire rsvp classifier (Jamal Hadi Salim) {CVE-2023-42755}
  - swap: stop add to avail list if swap is full (Ma Wupeng)
  - anolis: Revert "anolis: net/smc: Add SMC-R link WR and WC statistic" (Wen Gu)
  - anolis: Revert "anolis: net/smc: Introduce smc_lgr_stats_list for trouble shooting" (Wen Gu)
  - anolis: Revert "anolis: net/smc: support SMC-R rwwi wr/wc statistic" (Wen Gu)
  - anolis: Revert "anolis: net/smc: Fix fallback count overflow issue" (Wen Gu)
  - anolis: Revert "anolis: net/smc: Expand the upper limit of SMCR/D ringbuf to 2MB" (Wen Gu)
  - anolis: Revert "anolis: net/smc: Expand the statistical range of ringbufs" (Wen Gu)
  - anolis: net/smc: print netns inum instead of address (Wen Gu)
  - anolis: Revert "anolis: net/smc: Add sysctl conrtol for handshake limiation" (D. Wythe)
  - anolis: Revert "anolis: net/smc: Use diff TCP EXPR MAGIC to avoid network middleware do simple echo" (D. Wythe)
  - anolis: Revert "anolis: fix invisible experiment_syn_smc" (D. Wythe)
  - anolis: Revert "anolis: net/smc: Introduce SMC-R-related proc files" (Wen Gu)
  - anolis: Revert "anolis: net/smc: Introduce dim proc file" (Guangguan Wang)
  - anolis: Revert "anolis: net/smc: Introduce link-related proc file" (Guangguan Wang)
  - anolis: Revert "anolis: net/smc: show rwwi flag in link proc file" (Guangguan Wang)
  - anolis: Revert "anolis: net/smc: show max links and max conns info in link proc" (Guangguan Wang)
  - anolis: net/smc: add experiment_vendor_options sysctl description to documentation (Guangguan Wang)
  - anolis: net/smc: change sysctl vendor_exp_option to experiment_vendor_options (Guangguan Wang)
  - anolis: net/smc: fix incorrect sk_buf_size via inet sock (D. Wythe)
  - anolis: net/smc: allow configure on inet mode via sysctl (D. Wythe)
  - anolis: net/smc: force SMC_CLOSED after smc_listen_out_err (D. Wythe)
  - anolis: sched: always update rq->sibidle_sum in update_acpu() (Cruz Zhao)
  - anolis: arm64: Cancel cpuectlr sysfs interfaces write permission on the physical machine (Feng Su)
  - anolis: fix the bug that turn off kernel.sched_core doesn't work (Cruz Zhao)
  - anolis: fuse: make fuse support configuring delete_stale feature (zyfjeff)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-16.an8]
changelog:
  - block: don't remove hctx debugfs dir from blk_mq_exit_queue (Ming Lei)
  - anolis: net/smc: allow smc_sock_negotiator_ops negotiate on addr (D. Wythe)
  - anolis: net/smc: fix sockopt for inet sock (D. Wythe)
  - anolis: net/smc: avoid data corruption caused by decline (D. Wythe)
  - anolis: sched: fix duplicate define of PR_SCHED_CORE_CLEAR (Cruz Zhao)
  - anolis: tracing/timerlat: Do not start timerlat kthread when it already started (Zelin Deng)
  - anolis: sched: enable CONFIG_SCHED_ACPU by default (Cruz Zhao)
  - anolis: sched: fix the wrong config judge in __account_sibidle_time() (Cruz Zhao)
  - anolis: sched: don't init se->ht_ratio when alloc fair group (Cruz Zhao)


author: Qiao Ma <mqaio@linux.alibaba.com> [5.10.134-16.1_beta.an8]
changelog:
  - anolis: sched: update forceidle time during ttwu (Tianchen Ding)
  - anolis: sched: account cfs_rq runtime hierarchically for ht-aware-quota (Cruz Zhao)
  - anolis: sched/fair: fix the problem that cfs_rq->core is NULL (Cruz Zhao)
  - anolis: net/smc: add sysctl for max conns per lgr for SMC-R v2.1 (Guangguan Wang)
  - anolis: net/smc: add sysctl for max links per lgr for SMC-R v2.1 (Guangguan Wang)
  - anolis: net/smc: fix UAF due to SMC_PROCESSABORT (D. Wythe)
  - anolis: introduce sched feature SCHED_CORE_VRUNTIME (Cruz Zhao)
  - anolis: sched/fair: introduce fine-grained priority scheduler (Tianchen Ding)
  - anolis: configs: enable CONFIG_DRM_PHYTIUM (Qiao Ma)
  - anolis: configs: refresh configs by scripts/dummy-tools (Qiao Ma)
  - anolis: blk-throttle: add io latency indicators in cgroupV2 (Ferry Meng)
  - perf/core: Fix perf_cgroup_switch() (Chengming Zhou)
  - perf/core: Don't pass task around when ctx sched in (Chengming Zhou)
  - anolis: sched/core: fix cfs_prio_less (Cruz Zhao)
  - anolis: sched/fair: introduce core_vruntime and (Cruz Zhao)
  - anolis: sched/core: introduce core to struct cfs_rq (Cruz Zhao)
  - anolis: sched/core: introduce core_id to struct rq (Cruz Zhao)
  - anolis: sched: add forceidled time for task and cgroup (Tianchen Ding)
  - anolis: sched: fix percpu account for CPUTIME_*IDLE (Tianchen Ding)


author: Colin Walters <walters@verbum.org> - 0.1.7-1
changelog:
  - New upstream version;
    https://github.com/projectatomic/bubblewrap/releases/tag/v0.1.7
  - Resolves: #1411814


author: Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-6
changelog:
  - Resolves: rhbz#1989425 - CVE-2021-3672 c-ares: missing input validation of host names may lead to Domain Hijacking [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-7
changelog:
  - Resolves: rhbz#2170867 - c-ares: buffer overflow in config_sortlist() due to missing string length check [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 1.13.0-9
changelog:
  - Resolves: rhbz#2238293 - CVE-2020-22217 c-ares: read-heap-buffer-overflow in ares_parse_soa_reply [rhel-8] [rhel-8.9.0.z]


author: Bob Relyea <rrelyea@redhat.com> - 2020.2.41-81
changelog:
  - Update to CKBI 2.41 from NSS 3.53.0
  -    Removing:
  -     # Certificate "AddTrust Low-Value Services Root"
  -     # Certificate "AddTrust External Root"
  -     # Certificate "UTN USERFirst Email Root CA"
  -     # Certificate "Certplus Class 2 Primary CA"
  -     # Certificate "Deutsche Telekom Root CA 2"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "Certinomis - Root CA"
  -    Adding:
  -     # Certificate "Entrust Root Certification Authority - G4"


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-81
changelog:
  - Update to CKBI 2.48 from NSS 3.64
  -    Removing:
  -     # Certificate "Verisign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "Taiwan GRCA"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "Symantec Class 1 Public Primary Certification Authority - G4"
  -     # Certificate "Symantec Class 2 Public Primary Certification Authority - G4"
  -    Adding:
  -     # Certificate "Microsoft ECC Root Certificate Authority 2017"
  -     # Certificate "Microsoft RSA Root Certificate Authority 2017"
  -     # Certificate "e-Szigno Root CA 2017"
  -     # Certificate "certSIGN Root CA G2"
  -     # Certificate "Trustwave Global Certification Authority"
  -     # Certificate "Trustwave Global ECC P256 Certification Authority"
  -     # Certificate "Trustwave Global ECC P384 Certification Authority"
  -     # Certificate "NAVER Global Root Certification Authority"
  -     # Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
  -     # Certificate "GlobalSign Secure Mail Root R45"
  -     # Certificate "GlobalSign Secure Mail Root E45"
  -     # Certificate "GlobalSign Root R46"
  -     # Certificate "GlobalSign Root E46"


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-82
changelog:
  - Update to CKBI 2.48 from NSS 3.66
  -    Removing:
  -     # Certificate "QuoVadis Root CA"
  -     # Certificate "Sonera Class 2 Root CA"
  -     # Certificate "Trustis FPS Root CA"
  -    Adding:
  -     # Certificate "GLOBALTRUST 2020"
  -     # Certificate "ANF Secure Server Root CA"
  -     # Certificate "Certum EC-384 CA"
  -     # Certificate "Certum Trusted Root CA"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-81
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "GlobalSign Root CA - R2"
  -     # Certificate "DST Root CA X3"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "Explicitly Distrusted DigiNotar PKIoverheid G2"
  -    Adding:
  -     # Certificate "TunTrust Root CA"
  -     # Certificate "HARICA TLS RSA Root CA 2021"
  -     # Certificate "HARICA TLS ECC Root CA 2021"
  -     # Certificate "HARICA Client RSA Root CA 2021"
  -     # Certificate "HARICA Client ECC Root CA 2021"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "vTrus ECC Root CA"
  -     # Certificate "vTrus Root CA"
  -     # Certificate "ISRG Root X2"
  -     # Certificate "HiPKI Root CA - G1"
  -     # Certificate "Telia Root CA v2"
  -     # Certificate "D-TRUST BR Root CA 1 2020"
  -     # Certificate "D-TRUST EV Root CA 1 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-80.0
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Adding:
  -     # Certificate "CAEDICOM Root"
  -     # Certificate "I.CA Root CA/RSA"
  -     # Certificate "MULTICERT Root Certification Authority 01"
  -     # Certificate "Certification Authority of WoSign G2"
  -     # Certificate "CA WoSign ECC Root"
  -     # Certificate "CCA India 2015 SPL"
  -     # Certificate "Swedish Government Root Authority v3"
  -     # Certificate "Swedish Government Root Authority v2"
  -     # Certificate "Tunisian Root Certificate Authority - TunRootCA2"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "OpenTrust Root CA G2"
  -     # Certificate "OpenTrust Root CA G3"
  -     # Certificate "Certplus Root CA G1"
  -     # Certificate "Certplus Root CA G2"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Thailand National Root Certification Authority - G1"
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Certification Authority of WoSign"
  -     # Certificate "CA 沃通根证书"
  -     # Certificate "SSC GDL CA Root B"
  -     # Certificate "SAPO Class 2 Root CA"
  -     # Certificate "SAPO Class 3 Root CA"
  -     # Certificate "SAPO Class 4 Root CA"
  -     # Certificate "CA Disig Root R1"
  -     # Certificate "Autoridad Certificadora Raíz Nacional de Uruguay"
  -     # Certificate "ApplicationCA2 Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G6"
  -     # Certificate "Symantec Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "Halcom Root CA"
  -     # Certificate "Swisscom Root EV CA 2"
  -     # Certificate "CFCA GT CA"
  -     # Certificate "Digidentity L3 Root CA - G2"
  -     # Certificate "SITHS Root CA v1"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority (G02)"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "IGC/A AC racine Etat francais"
  -     # Certificate "PersonalID Trustworthy RootCA 2011"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "Swiss Government Root CA II"
  -     # Certificate "Swiss Government Root CA I"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "LuxTrust Global Root"
  -     # Certificate "AC1 RAIZ MTIN"
  -     # Certificate "Microsoft Root Certificate Authority 2011"
  -     # Certificate "CCA India 2011"
  -     # Certificate "ANCERT Certificados Notariales V2"
  -     # Certificate "ANCERT Certificados CGN V2"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "China Internet Network Information Center EV Certificates Root"
  -     # Certificate "Verizon Global Root CA"
  -     # Certificate "SwissSign Silver Root CA - G3"
  -     # Certificate "SwissSign Platinum Root CA - G3"
  -     # Certificate "SwissSign Gold Root CA - G3"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "SITHS CA v3"
  -     # Certificate "Certinomis - Autorité Racine"
  -     # Certificate "ANF Server CA"
  -     # Certificate "Thawte Premium Server CA"
  -     # Certificate "Thawte Server CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "KEYNECTIS ROOT CA"
  -     # Certificate "I.CA - Standard Certification Authority, 09/2009"
  -     # Certificate "I.CA - Qualified Certification Authority, 09/2009"
  -     # Certificate "VI Registru Centras RCSC (RootCA)"
  -     # Certificate "CCA India 2007"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira v1"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Actalis Authentication CA G1"
  -     # Certificate "A-Trust-Qual-03"
  -     # Certificate "AddTrust External CA Root"
  -     # Certificate "ECRaizEstado"
  -     # Certificate "Configuration"
  -     # Certificate "FNMT-RCM"
  -     # Certificate "StartCom Certification Authority"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "E-ME SSI (RCA)"
  -     # Certificate "ACEDICOM Root"
  -     # Certificate "Autoridad Certificadora Raiz de la Secretaria de Economia"
  -     # Certificate "Correo Uruguayo - Root CA"
  -     # Certificate "CNNIC ROOT"
  -     # Certificate "Common Policy"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "NetLock Platina (Class Platinum) Főtanúsítvány"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "Cisco Root CA 2048"
  -     # Certificate "CA Disig"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "UCA Global Root"
  -     # Certificate "UCA Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Starfield Services Root Certificate Authority"
  -     # Certificate "I.CA - Qualified root certificate"
  -     # Certificate "I.CA - Standard root certificate"
  -     # Certificate "e-Guven Kok Elektronik Sertifika Hizmet Saglayicisi"
  -     # Certificate "Japanese Government"
  -     # Certificate "AdminCA-CD-T01"
  -     # Certificate "Admin-Root-CA"
  -     # Certificate "Izenpe.com"
  -     # Certificate "TÜBİTAK UEKAE Kök Sertifika Hizmet Sağlayıcısı - Sürüm 3"
  -     # Certificate "Halcom CA FO"
  -     # Certificate "Halcom CA PO 2"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "ACNLB"
  -     # Certificate "state-institutions"
  -     # Certificate "state-institutions"
  -     # Certificate "SECOM Trust Systems CO.,LTD."
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "D-TRUST Root Class 2 CA 2007"
  -     # Certificate "D-TRUST Root Class 3 CA 2007"
  -     # Certificate "SSC Root CA A"
  -     # Certificate "SSC Root CA B"
  -     # Certificate "SSC Root CA C"
  -     # Certificate "Autoridad de Certificacion de la Abogacia"
  -     # Certificate "Root CA Generalitat Valenciana"
  -     # Certificate "VAS Latvijas Pasts SSI(RCA)"
  -     # Certificate "ANCERT Certificados CGN"
  -     # Certificate "ANCERT Certificados Notariales"
  -     # Certificate "ANCERT Corporaciones de Derecho Publico"
  -     # Certificate "GLOBALTRUST"
  -     # Certificate "Certipost E-Trust TOP Root CA"
  -     # Certificate "Certipost E-Trust Primary Qualified CA"
  -     # Certificate "Certipost E-Trust Primary Normalised CA"
  -     # Certificate "Cybertrust Global Root"
  -     # Certificate "GlobalSign"
  -     # Certificate "IGC/A"
  -     # Certificate "S-TRUST Authentication and Encryption Root CA 2005:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "Swisscom Root CA 1"
  -     # Certificate "Microsec e-Szigno Root CA"
  -     # Certificate "LGPKI"
  -     # Certificate "AC RAIZ DNIE"
  -     # Certificate "Common Policy"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 1"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "NetLock Minositett Kozjegyzoi (Class QA) Tanusitvanykiado"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Staat der Nederlanden Root CA"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Global CA 2"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "QuoVadis Root Certification Authority"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Microsoft Root Authority"
  -     # Certificate "Microsoft Root Certificate Authority"
  -     # Certificate "Microsoft Root Certificate Authority 2010"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "UTN-USERFirst-Object"
  -     # Certificate "BYTE Root Certification Authority 001"
  -     # Certificate "CISRCA1"
  -     # Certificate "ePKI Root Certification Authority - G2"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -     # Certificate "AC Raíz Certicámara S.A."
  -     # Certificate "SSL.com EV Root Certification Authority RSA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "ACA ROOT"
  -     # Certificate "Security Communication ECC RootCA1"
  -     # Certificate "Security Communication RootCA3"
  -     # Certificate "CHAMBERS OF COMMERCE ROOT - 2016"
  -     # Certificate "Network Solutions RSA Certificate Authority"
  -     # Certificate "Network Solutions ECC Certificate Authority"
  -     # Certificate "Australian Defence Public Root CA"
  -     # Certificate "SI-TRUST Root"
  -     # Certificate "Halcom Root Certificate Authority"
  -     # Certificate "Application CA G3 Root"
  -     # Certificate "GLOBALTRUST 2015"
  -     # Certificate "Microsoft ECC Product Root Certificate Authority 2018"
  -     # Certificate "emSign Root CA - G2"
  -     # Certificate "emSign Root CA - C2"
  -     # Certificate "Microsoft ECC TS Root Certificate Authority 2018"
  -     # Certificate "DigiCert CS ECC P384 Root G5"
  -     # Certificate "DigiCert CS RSA4096 Root G5"
  -     # Certificate "DigiCert RSA4096 Root G5"
  -     # Certificate "DigiCert ECC P384 Root G5"
  -     # Certificate "HARICA Code Signing RSA Root CA 2021"
  -     # Certificate "HARICA Code Signing ECC Root CA 2021"
  -     # Certificate "Microsoft Identity Verification Root Certificate Authority 2020"


author: Bob Relyea <rrelyea@redhat.com> - 2022.2.54-80.2
changelog:
  - Update to CKBI 2.54 from NSS 3.79
  -    Removing:
  -     # Certificate "TrustCor ECA-1"
  -     # Certificate "TrustCor RootCert CA-2"
  -     # Certificate "TrustCor RootCert CA-1"
  -     # Certificate "Network Solutions Certificate Authority"
  -     # Certificate "COMODO Certification Authority"
  -     # Certificate "Autoridad de Certificacion Raiz del Estado Venezolano"
  -     # Certificate "Microsec e-Szigno Root CA 2009"
  -     # Certificate "TWCA Root Certification Authority"
  -     # Certificate "Izenpe.com"
  -     # Certificate "state-institutions"
  -     # Certificate "GlobalSign"
  -     # Certificate "Common Policy"
  -     # Certificate "A-Trust-nQual-03"
  -     # Certificate "A-Trust-Qual-02"
  -     # Certificate "Autoridad de Certificacion Firmaprofesional CIF A62634068"
  -     # Certificate "Government Root Certification Authority"
  -     # Certificate "AC Raíz Certicámara S.A."


author: Robert Relyea <rrelyea@redhat.com> - 2023.2.60_v7.0.306-80.0
changelog:
  - Update to CKBI 2.60_v7.0.306 from NSS 3.91
  -    Removing:
  -     # Certificate "Camerfirma Global Chambersign Root"
  -     # Certificate "Staat der Nederlanden EV Root CA"
  -     # Certificate "OpenTrust Root CA G1"
  -     # Certificate "Swedish Government Root Authority v1"
  -     # Certificate "DigiNotar Root CA G2"
  -     # Certificate "Federal Common Policy CA"
  -     # Certificate "TC TrustCenter Universal CA III"
  -     # Certificate "CCA India 2007"
  -     # Certificate "ipsCA Global CA Root"
  -     # Certificate "ipsCA Main CA Root"
  -     # Certificate "Macao Post eSignTrust Root Certification Authority"
  -     # Certificate "InfoNotary CSP Root"
  -     # Certificate "DigiNotar Root CA"
  -     # Certificate "Root CA"
  -     # Certificate "GPKIRootCA"
  -     # Certificate "D-TRUST Qualified Root CA 1 2007:PN"
  -     # Certificate "TC TrustCenter Universal CA I"
  -     # Certificate "TC TrustCenter Universal CA II"
  -     # Certificate "TC TrustCenter Class 2 CA II"
  -     # Certificate "TC TrustCenter Class 4 CA II"
  -     # Certificate "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "CertRSA01"
  -     # Certificate "KISA RootCA 3"
  -     # Certificate "A-CERT ADVANCED"
  -     # Certificate "A-Trust-Qual-01"
  -     # Certificate "A-Trust-nQual-01"
  -     # Certificate "Serasa Certificate Authority II"
  -     # Certificate "TDC Internet"
  -     # Certificate "America Online Root Certification Authority 2"
  -     # Certificate "RSA Security Inc"
  -     # Certificate "Public Notary Root"
  -     # Certificate "Autoridade Certificadora Raiz Brasileira"
  -     # Certificate "Post.Trust Root CA"
  -     # Certificate "Entrust.net Secure Server Certification Authority"
  -     # Certificate "ePKI EV SSL Certification Authority - G1"
  -    Adding:
  -     # Certificate "DigiCert TLS ECC P384 Root G5"
  -     # Certificate "DigiCert TLS RSA4096 Root G5"
  -     # Certificate "DigiCert SMIME ECC P384 Root G5"
  -     # Certificate "DigiCert SMIME RSA4096 Root G5"
  -     # Certificate "Certainly Root R1"
  -     # Certificate "Certainly Root E1"
  -     # Certificate "E-Tugra Global Root CA RSA v3"
  -     # Certificate "E-Tugra Global Root CA ECC v3"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT RSA CA"
  -     # Certificate "DIGITALSIGN GLOBAL ROOT ECDSA CA"
  -     # Certificate "BJCA Global Root CA1"
  -     # Certificate "BJCA Global Root CA2"
  -     # Certificate "Symantec Enterprise Mobile Root for Microsoft"
  -     # Certificate "A-Trust-Root-05"
  -     # Certificate "ADOCA02"
  -     # Certificate "StartCom Certification Authority G2"
  -     # Certificate "ATHEX Root CA"
  -     # Certificate "EBG Elektronik Sertifika Hizmet Sağlayıcısı"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "America Online Root Certification Authority 1"
  -     # Certificate "Juur-SK"
  -     # Certificate "ComSign CA"
  -     # Certificate "ComSign Secured CA"
  -     # Certificate "ComSign Advanced Security CA"
  -     # Certificate "Global Chambersign Root"
  -     # Certificate "Sonera Class2 CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "VeriSign, Inc."
  -     # Certificate "GTE CyberTrust Global Root"
  -     # Certificate "Equifax Secure Global eBusiness CA-1"
  -     # Certificate "Equifax"
  -     # Certificate "Class 1 Primary CA"
  -     # Certificate "Swiss Government Root CA III"
  -     # Certificate "Application CA G4 Root"
  -     # Certificate "SSC GDL CA Root A"
  -     # Certificate "GlobalSign Code Signing Root E45"
  -     # Certificate "GlobalSign Code Signing Root R45"
  -     # Certificate "Entrust Code Signing Root Certification Authority - CSBR1"


author: David Howells <dhowells@redhat.com> 0.10.6-1
changelog:
  - Note the correct licence.
  - Handle malformed kernel status correctly.
  - Permit culling to be disabled on the command line with the -N flag.
  - Suspend culling when cache space is short and cache objects are pinned.


author: David Howells <dhowells@redhat.com> 0.10.8-1
changelog:
  - Use systemd interaction macros in specfile installation sections [RH BZ 850053].
  - Fix the service file to use /usr/sbin/ rather than /sbin/.
  - Turn on RELRO and PIE build hardening in RPM builds.


author: Jan Macku <jamacku@redhat.com> - 1.15-1
changelog:
  - spec: sync specfile with Fedora
  - makefile: Use rpmdev-bumpspec's legacy date option
  - Add feature to generate specfile entry, commit and archive


author: Jan Macku <jamacku@redhat.com> - 1.16-1
changelog:
  - alternatives: add --keep-foreign (#57)
  - Translations update from Weblate
  - ci: Onboard chkconfig to Packit
  - zanata: remove zanata related stuff
  - Use make macros
  - alternatives: use one function for path cleaning
  - CI: specify more closely when to run CI
  - Add basic CI and README
  - spec: sync specfile with Fedora


author: Jan Macku <jamacku@redhat.com> - 1.19.2-1
changelog:
  - alternatives: --keep-foreign incorrectly handles non-existent files
  - alternatives: isLink should return 0 in case of lstat error
  - spec: Replace not working awk command with sed (#63)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.3-2
changelog:
  - move pidfile to /var/run/chrony to allow chronyd to remove it on exit
    (#1584585)
  - avoid blocking in getrandom system call (#1592425)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.3-3
changelog:
  - fix PIDFile in local chronyd.service on upgrades from chrony < 3.3-2
    (#1614800)
  - add workaround for late reload of unit file (#1614751)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.5-1
changelog:
  - update to 3.5 (#1685469 #1677218)
  - fix shellcheck warnings in helper scripts (#1711948)
  - update ntp2chrony script


author: Miroslav Lichvar <mlichvar@redhat.com> 4.1-1
changelog:
  - update to 4.1 (#1895003 #1847853 #1929157)
  - add NetworkManager dispatcher script to add servers from DHCP even without
    dhclient (#1933139)
  - restrict permissions of /var/lib/chrony and /var/log/chrony (#1939295)
  - reset chrony-helper state after stopping chronyd (#1971697)
  - add gcc-c++ and make to build requirements
  - move default paths in /var/run to /run


author: Miroslav Lichvar <mlichvar@redhat.com> 4.2-1
changelog:
  - update to 4.2 (#2062356)
  - fix chrony-helper to delete sources by their original name (#2061660)
  - update ntp2chrony script (#2018045 #2063766)


author: David King <amigadave@amigadave.com> - 0.16-1
changelog:
  - Update to 0.16 (#1144863)
  - Remove clean section and BuildRoot tag
  - Update URL and Sourc0
  - Use license macro for COPYING
  - Use parallel make flags
  - Preserve timestamps during install


author: Jeff Layton <jlayton@redhat.com> - 6.7-5
changelog:
  - more updates, switch to rst for manpages
  - update mount.cifs manpage to describe defaults better (BZ#1474539)


author: Sachin Prabhu <sprabhu@redhat.com> - 6.8-3
changelog:
  - Add manual gating tests
  - docs: cleanup rst formating
  - mount.cifs.rst: document new (no)handlecache mount option
  - manpage: update mount.cifs manpage with info about rdma option
  - checkopts: add python script to cross check mount options
  - mount.cifs.rst: document missing options, correct wrong ones
  - checkopts: report duplicated options in man page
  - mount.cifs.rst: more cleanups
  - mount.cifs.rst: document vers=3 mount option
  - mount.cifs.rst: document vers=3.02 mount option
  - cifs: Allow DNS resolver key to expire
  - mount.cifs: be more verbose and helpful regarding mount errors
  - Update mount.cifs with vers=default mount option and SMBv3.0.2
  - mount.cifs.rst: update vers=3.1.1 option description
  - getcifsacl: Do not go to parse_sec_desc if getxattr fails.
  - getcifsacl: Improve help usage and add -h option.
  - setcifsacl: fix adding ACE when owner sid in unexpected location
  - cifs.upcall: fix a compiler warning
  - mount.cifs Add various missing parms from the help text
  - mount.cifs: add more options to help message
  - mount.cifs: detect GMT format of snapshot version
  - Update man page for mount.cifs to add new options
  - mount.cifs.rst: mention kernel version for snapshots
  - Fix authors and maintainers


author: Packit <hello@packit.dev> - 297-1
changelog:
  - users: allow administrators to change the user shell
  - Enable Python bridge on Fedora 38 and CentOS/RHEL 9


author: Packit <hello@packit.dev> - 299-1
changelog:
  - Kdump: Show location of kdump to verify the successful configuration test
  - Storage: Support for no-overprovisioning with Stratis
  - Storage: Cockpit can now add caches to encrypted Stratis pools


author: Packit <hello@packit.dev> - 300-1
changelog:
  - Celebrating the Nürnberg life release!
  - Storage: Support for growing block devices of a Stratis pool


author: Kamil Dudka <kdudka@redhat.com> - 8.30-8
changelog:
  - df --local: recognize afs, auristorfs, and smb3 as remote fs (#1798030)
  - fix formatting of sha512sum(1) man page (#1688744)


author: Kamil Dudka <kdudka@redhat.com> - 8.30-9
changelog:
  - split: fix --number=K/N to output correct part of file (#1921246)
  - rm: do not skip files upon failure to remove an empty dir (#1905481)
  - use statx instead of stat when available (#1760300)


author: Kamil Dudka <kdudka@redhat.com> - 8.30-13
changelog:
  - ls, stat: avoid triggering automounts (#2044981)
  - make `df --direct` work again (#2058686)
  - doc: improve description of the --kibibytes option of ls (#1527391)


author: Stanislaw Gruszka <sgruszka@redhat.com> - 3.18_2018.05.31-2
changelog:
  - Update wireless-regdb to 2018.05.31
  - Remove python2 dependency
  - Use sforshee signed reulatory.bin (required by modern kernels)


author: Ondřej Pohořelský <opohorel@redhat.com> - 1.11-17.20190603git
changelog:
  - update to the latest release
  - add sed require
  - remove %clean section
  - remove obsolete Group tag
  - fix upstream URL
  - Resolves: rhbz#1696449, rhbz#1703982


author: Tomáš Mráz <tmraz@redhat.com> - 20200527-2.git63fc906
changelog:
  - explicitly enable DHE-DSS in gnutls config if enabled in policy
  - use grubby with --update-kernel=ALL to avoid breaking kernelopts
  - OSPP subpolicy: Allow GCM for SSH protocol
  - openssh: Support newly standardized ECDHE-GSS and DHE-GSS key exchanges
  - if the policy in FIPS mode is not a FIPS policy print a message
  - openssl: Add SignatureAlgorithms support
  - custom crypto policies: enable completely overriding contents of the list
    value
  - added ECDHE-ONLY.pmod policy module example
  - openssh: make LEGACY policy to prefer strong public key algorithms
  - various python code cleanups
  - update-crypto-policies: dump the current policy to
    /etc/crypto-policies/state/CURRENT.pol
  - split scripts into their own subpackage


author: Tomáš Mráz <tmraz@redhat.com> - 20200610-1.git0ac8b1f
changelog:
  - fallback to FIPS policy instead of the default-config in FIPS mode
  - java: Document properly how to override the crypto policy
  - krb5: No support for 3des anymore
  - reorder the signature algorithms to follow the order in default openssl list


author: Alexander Sosedkin <asosedkin@redhat.com> - 20210617-1.gitc776d3e
changelog:
  - implement scoped policies, e.g., cipher@SSH = ... (#1960266)
  - implement algorithm globbing, e.g., cipher@SSH = -*-CBC
  - deprecate derived properties:
    tls_cipher, ssh_cipher, ssh_group, ike_protocol
  - deprecate sha1_in_dnssec property
  - deprecate unscoped form of protocol property
  - update documentation
  - expand upstream test coverage
  - openssl: set MinProtocol / MaxProtocol separately for TLS and DTLS (#1946522)
  - support AES-192 ciphers in custom policies for non-TLS scenarios (#1876846)
  - stop claiming Camellia is disabled (#1925104)
  - disable CBC ciphers in FUTURE for everything but Kerberos (#1933016)
  - drop SHA224 from signature algorithms in FIPS:OSPP (#1934755)
  - condition ecdh-sha2-nistp384 on SECP384R1


author: Alexander Sosedkin <asosedkin@redhat.com> - 20211116-1.gitae470d6
changelog:
  - OSPP: relax -ECDSA-SHA2-512, -FFDHE-*
  - fips-mode-setup, fips-finish-install: call zipl more often (s390x-specific)
  - libssh: enable diffie-hellman-group14-sha256 support
  - openssl: fix disabling ChaCha20


author: Alexander Sosedkin <asosedkin@redhat.com> - 20221215-1.gitece0092
changelog:
  - bind: expand the list of disableable algorithms
  - tests/java: fix java.security.disableSystemPropertiesFile=true
  - stop accidentally creating /etc/crypto-policies/back-ends/.config symlink


author: Ondrej Kozina <okozina@redhat.com> - 2.3.3-4
changelog:
  - patch: Fix reencryption for custom devices with data segments
    set to use cipher_null.
  - Resolves: #1927409


author: Ondrej Kozina <okozina@redhat.com> - 2.3.7-1
changelog:
  - update to cryptsetup 2.3.7
  - fixes CVE-2021-4122
  - patch: Fix suboptimal optimization in bundled argon2.
  - patch: Fix bogus memory allocation/device read with
           invalid LUKS2 headers
  - patch: Fix typo in luksRepair prompt.
  - Resolves: #2021815 #2022301 #2031859


author: Daniel Zatovic <dzatovic@redhat.com> - 2.3.7-4
changelog:
  - patch: Remove LUKS2 encryption data size restriction.
  - patch: Abort encryption when header and data devices are same.
  - Resolves: #2150254


author: Daniel Zatovic <dzatovic@redhat.com> - 2.3.7-6
changelog:
  - patch: Delegate FIPS mode detection to configured crypto backend
  - patch: Disallow use of internal kenrel crypto driver names in "capi"
  - patch: Also disallow active devices with internal kernel names
  - patch: Fix init_by_name to allow unknown cipher format in dm-crypt
  - patch: Fix reencryption to fail properly for unknown cipher
  - patch: Fix activation of LUKS2 with capi format cipher and kernel
  - Resolves: #2212772 #2193342


author: Andreas Schneider <asn@redhat.com> - 4.17.2-1
changelog:
  - resolves: rhbz#2132051 - Update to version 4.17.2
  - resolves: rhbz#2126174 - Fix CVE-2022-1615
  - resolves: rhbz#2108487 - ctdb: Add dependency to samba-winbind-clients


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.2-2
changelog:
  - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
  - related: rhbz#2132051


author: Pavel Filipenský <pfilipenn@redhat.com> - 4.17.4-0
changelog:
  - related: rhbz#2132051 - Update to version 4.17.4
  - resolves: rhbz#2154370 - Fix CVE-2022-38023
  - resolves: rhbz#2142331 - Fix %U include directive for share listing (netshareenum)
  - resolves: rhbz#2148943 - Fix Winbind to retrieve user groups from Active Directory


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.5-2
changelog:
  - resolves: rhbz#2169339 - Fix winbind memory leak
  - resolves: rhbz#2152899 - Fix Samba shares not accessible issue


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-46
changelog:
  - 2074684 - lp to a remote server takes a long time
  - 2074736 - CUPS is too chatty about "Removing document files." in debug mode


author: Bo Liu <liub03@inspur.com> - 7.61.1-31.0.3.2
changelog:
  - url: only reuse connections with same GSS delegation (CVE-2023-27536)
  - fix host name wildcard checking (CVE-2023-28321)


author: Simo Sorce <simo@redhat.com> - 2.1.27-0.4rc7
changelog:
  - Add patch form Upstream PR559 to use RC4 implementation from OpenSSL
  - Resolves bz#1618744
  - Fix multilib issue bz#1663120


author: Jeff Moyer <jmoyer@redhat.com> - 67-1.el8
changelog:
  - Rebase to v67.  This brings in the following features:
    - support for the 'security frozen' sysfs attribute
    - support for using pmem as system ram
    - various cleanup and bug fixes
  - Fix load-keys failure in initramfs (Jeff Moyer)
  - Resolves: bz#1724531 bz#1730673 bz#1741164 bz#1741165 bz#1749888 bz#1749889


author: Jeff Moyer <jmoyer@redhat.com> - 71.1-4.el8
changelog:
  - Pull in fixes from upstream v72 and v73 (Jeff Moyer)
    - Fix enable-namespace all reporting errors incorrectly
    - Add support for inject-smart on papr scm
  - Related: bz#2090190 bz#1986185 bz#2040074


author: Ray Strode <rstrode@redhat.com> - 1:1.12.8-22
changelog:
  - Use hangup signal instead of termination signal to
    kill sesssion monitoring script to appeach tcsh.
    Related: #2089362


author: Ray Strode <rstrode@redhat.com> - 1:1.12.8-23
changelog:
  - Address race for very short running sessions in SSH
    session monitoring script.
    Related: #2089362


author: Ray Strode <rstrode@redhat.com> - 1.12.8-25
changelog:
  - Ensure only one dbus-daemon is spawned for all shells sharing
    a single connection.
    Resolves: #2189201


author: Zhao Hang <wb-zh951434@alibaba-inc.com> - 1.12.8-26.0.1
changelog:
  - Add doc sub package, requires and provides
  - Fix build failure(Chang Gao)
  - Fix CVE-2023-34969 (Bo Liu)


author: Till Maas <opensource@till.name> - 0.104-2
changelog:
  - Rebuilt for Fedora 23 Change
    https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Peter Jones <pjones@redhat.com> - 8-1
changelog:
  - Update to dbxtool 8
  - Make a "make coverity" rule to scan the source
    Results at: https://scan.coverity.com/projects/rhboot-dbxtool
  - Don't try to apply anything if PK and KEK aren't enrolled
  - Add --force and --quiet for the PK/KEK checker, and use them in the
    systemd service.
    Resolves: rhbz#1489942
  - Add a .syntastic_c_config for vim's Syntastic modules
  - Use tsearch()/tfind()/tdestroy() from libc instead of ccan htables
  - Don't open the dbx file with O_RDWR|O_CREAT, use O_RDONLY.
  - Lots of minor bug fixes gcc -Wextra and friends found.


author: Peter Jones <pjones@redhat.com> - 8-2
changelog:
  - Don't use -f in dbxtool.service; that'll make it do the thing we're
    trying to avoid.
    Resolves: rhbz#1489942


author: Marian Csontos <mcsontos@redhat.com> - 2.03.14-7
changelog:
  - Fix lvm crash when recreating PV with UUID of a missing PV.
  - Fix lvconvert --type vdo-pool with --test should not write signature.
  - Use correect profile in lvmdbusd preventing messages in JSON output.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.14-8
changelog:
  - Fix [vdo_]use_compression options.
  - Fix vgimportdevices operating on incomplete VGs fails when nothing to import.
  - Fix message processing on thin-pool extension leaving devices behind.


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-30
changelog:
  - Add 0111-multipathd-factor-out-the-code-to-flush-a-map-with-n.patch
  - Add 0112-libmultipath-return-success-if-we-raced-to-remove-a-.patch
  - Add 0113-multipathd-Handle-losing-all-path-in-update_map.patch
  - Resolves: bz #2110485


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-31
changelog:
  - Add 0114-multipathd-ignore-duplicated-multipathd-command-keys.patch
    * Fixes bz #2133996
  - Add 0115-multipath-tools-use-run-instead-of-dev-shm.patch
    * Fixes bz #2133990
  - Resolves: bz #2133990, #2133996


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-32
changelog:
  - Add 0116-kpartx-hold-device-open-until-partitions-have-been-c.patch
    * Fixes bz #2128885
  - Add 0117-libmultipath-cleanup-remove_feature.patch
  - Add 0118-libmultipath-cleanup-add_feature.patch
  - Add 0119-multipath-tests-tests-for-adding-and-removing-featur.patch
  - Add 0120-libmultipath-fix-queue_mode-feature-handling.patch
  - Add 0121-multipath-tests-tests-for-reconcile_features_with_qu.patch
  - Add 0122-libmultipath-prepare-proto_id-for-use-by-non-scsi-de.patch
  - Add 0123-libmultipath-get-nvme-path-transport-protocol.patch
  - Add 0124-libmultipath-enforce-queue_mode-bio-for-nmve-tcp-pat.patch
    * Fixes bz #2022359
  - Resolves: bz #2022359, #2128885


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-33
changelog:
  - Add 0125-multipath-add-historical-service-time-to-the-man-pag.patch
    * Fixes bz #2141996
  - Modify tests/multipath_conf_syntax/main.sh
    * fix unrelated test error
  - Resolves: bz #2141996


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-34
changelog:
  - Add 0126-libmultipath-copy-mpp-hwe-from-pp-hwe.patch
    * Fixes bz #2126714
  - Cleanup multiple CI tests
  - Resolves: bz #2126714


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-35
changelog:
  - Add 0127-libmultipath-don-t-leak-memory-on-invalid-strings.patch
  - Add 0128-libmutipath-validate-the-argument-count-of-config-st.patch
  - Resolves: bz #2155560


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-36
changelog:
  - Add 0129-libmultipath-select-resize-action-even-if-reload-is-.patch
  - Add 0130-libmultipath-cleanup-ACT_CREATE-code-in-select_actio.patch
  - Add 0131-libmultipath-keep-renames-from-stopping-other-multip.patch
  - Resolves: bz #2166468


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-37
changelog:
  - Fix bugzilla linked to the changes (was previously linked to
    the wrong bug, 2162537)
  - Resolves: bz #2166468


author: Marian Csontos <mcsontos@redhat.com> - 0.8.5-3
changelog:
  - Remove obsolete pool-inactive option from thin_trim man page.
  - Check input file exists eralier, and prevent writing incorrect metadata.


author: Marian Csontos <mcsontos@redhat.com> - 0.9.0-1
changelog:
  - Update to upstream version 0.9.0.
  - Fix important issues found by static analysis.
  - Update crc32c to version 0.5 supporting non x86 architectures.
  - New tools thin_metadata_pack and thin_metadata_unpack.


author: Lukas Hrazky <lhrazky@redhat.com> - 4.7.0-11
changelog:
  - [doc] Describe how gpg keys are stored for `repo_ggpcheck`
  - Add only relevant pkgs to upgrade transaction (RhBug:2097757)


author: Lukas Hrazky <lhrazky@redhat.com> - 4.7.0-12
changelog:
  - Allow passing plugin parameters with dashes in names (RhBug:1980712)
  - Fix upgrade from file to noarch pkg (RhBug:2006018)
  - Add support for group upgrade rollback (RhBug:2016070)
  - Expose plugin unload method to API (RhBug:2047251)
  - Add doc related to --destdir and --downloadonly options (RhBug:2100811)
  - Set default value for variable to prevent crash (RhBug:2091636)
  - Don't include resolved advisories for obsoletes with sec. filters (RhBug:2101421)


author: Nicola Sella <nsella@redhat.com> - 4.7.0-13
changelog:
  - Add support for rollback of group upgrade rollback (RhBug:2016070)
  - Move system-upgrade plugin to core (RhBug:2054235)
  - Fix plugins unit tests + unload plugins upon their deletion (RhBug:2134309)


author: Nicola Sella <nsella@redhat.com> - 4.7.0-15
changelog:
  - Ignore processing variable files with unsupported encoding (RhBug:2141215)
  - Better explain traceback of rpm.error with dnf


author: Jaroslav Rohel <jrohel@redhat.com> - 4.7.0-17
changelog:
  - Omit src RPMs from check-update (RhBug:2151910,2203069)
  - automatic: Fix online detection with proxy (RhBug:2022440,2189851)


author: Lukas Hrazky <lhrazky@redhat.com> - 4.0.21-12
changelog:
  - [repomanage] Use modules only from repo they are handling
  - [repomanage] Add new option --oldonly
  - Skip all non rpm tsi for transaction_action plugins
  - Update translations


author: Lukas Hrazky <lhrazky@redhat.com> - 4.0.21-13
changelog:
  - [copr] Fix 'dnf copr enable' on Fedora 35
  - [copr] Disable dnf playground command
  - [copr] Fix baseurl for centos stream chroot
  - [copr] Silence a deprecation warning in plugins/copr.py
  - [copr] Shorter verification that the project exists
  - [copr] Better error message for dnf copr enable
  - [copr] allow specifying protocol as part of --hub


author: Nicola Sella <nsella@redhat.com> - 4.0.21-17
changelog:
  - offline-upgrade: add support for security filters (RhBug:1939975,2139324)
  - Move system-upgrade plugin to core (RhBug:2054235)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 4.0-1
changelog:
  - New version
    Resolves: rhbz#1333781
  - Switched to autotools
  - Various spec file cosmetic fixes (e.g. used optflags)


author: Pavel Valena <pvalena@redhat.com> - 049-209.git20220815
changelog:
  - fix(95iscsi): Fix network setup
  - fix(dracut-systemd): correct service dependencies
  - feat(lvm): add new module lvmthinpool-monitor
  - fix(dracut-shutdown): add cleanup handler on failure


author: Pavel Valena <pvalena@redhat.com> - 049-218.git20221019
changelog:
  - Dracut: only login to one target at a time
  - iscsi: don't continue waiting if the root device is present
  - network: stop waiting for interfaces if root device is
  - iscsiroot: parse_iscsi_root overwrites command line args
  - iscsiroot: there's never more than one target per call
  - iscsiroot: try targets only once
  - iscsiroot: remove bashisms
  - fixup "Dracut: only login to one target at a time"
  - 35network-legacy: only skip waiting for interfaces if netroot


author: Pavel Valena <pvalena@redhat.com> - 049-221.git20221214
changelog:
  - fix(80lvmthinpool-monitor): use systemsctl instead of
  - fix(squash): build ld cache for squash loader
  - fix(network-manager): write DHCP filename option to dhcpopts


author: Lukas Czerner <lczerner@redhat.com> 1.45.4-1
changelog:
  - Rebase to the release 1.45.4 (#1783777)
  - provide rhel6/7 compatible fs_type in mke2fs.conf (#1780279)
  - fix crafted ext4 partition leads to out-of-bounds write (#1768709)
  - include note about supported rhel8 features and options (#1788573)


author: Peter Jones <pjones@redhat.com> - 3-2
changelog:
  - Always provide macros for efi_arch and efi_alt_arch (and their _upper
    variants), and make efi_has_arch and efi_has_alt_arch 0 when they will be
    wrong.  This ensures everything can always expand when we're on a non-efi
    architecture.


author: Peter Jones <pjones@redhat.com> - 15-1
changelog:
  - Update to efibootmgr 15
  - Make efibootmgr use EFIDIR / efibootmgr.efidir like fwupdate does
  - make --loader default build-time configurable
  - sanitize set_mirror()/get_mirror()
  - Add support for parsing loader options as UCS2
  - GCC 7 fixes
  - Don't use -fshort-wchar since we don't run on EFI machines.
  - Also rebuild for efivar-31-1.fc26 to get symbol versioning right.
    Resolves: rhbz#1468841


author: Peter Jones <pjones@redhat.com> - 35-1
changelog:
  - Update to efivar 35
  - fixes for older compilers
  - efi_get_variable_exists()
  - Lots of stuff to make CI work.
  - use usleep() to avoid hitting the kernel rate limiter on efivarfs
  - better EFI_GUID macro
  - add efi_guid_fwupdate (0abba7dc-e516-4167-bbf5-4d9d1c739416)


author: Peter Jones <pjones@redhat.com> - 36-1
changelog:
  - Update to efivar 36 (and some change)
    Resolves: rhbz#1635019
  - Add NVDIMM support
  - Re-written linux interface parser to handle how devices are
    partitioned better, and for cleaner code, with one file per device
    type.
  - lots of verbosity updates
  - better CI
  - analysis with clang's analyzer as well as coverity
  - Better handling of immutable bits in sysfs
  - LIBEFIVAR_OPS=help
  - lots of code cleanups.
  - Add emmc device support
  - Add SAS port expander support
  - Support for ACPI root nodes that are less common
    (i.e. ACPI Generic Container and Embedded Controller PNP nodes)
  - Make abbreviated device paths if we can't parse a device's info
  - Don't require NVME to have an EUI


author: Mark Wielaard <mjw@redhat.com> - 0.182-1
changelog:
  - Upgrade to upstream 0.182
    - backends: Support for tilegx has been removed.
    - config: New /etc/profile.d files to provide default $DEBUGINFOD_URLS.
    - debuginfod: More efficient package traversal, tolerate various
      errors during scanning, grooming progress is more visible and
      interruptible, more prometheus metrics.
    - debuginfod-client: Now supports compressed (kernel) ELF images.
    - libdwfl: Add ZSTD compression support.


author: Mark Wielaard <mjw@redhat.com> - 0.186-1
changelog:
  - Upgrade to upstream 0.186
    - debuginfod-client: Default $DEBUGINFOD_URLS is computed from
      drop-in files /etc/debuginfod/*.urls rather than
      hardcoded into the /etc/profile.d/debuginfod*
      scripts.
      Add $DEBUGINFOD_MAXSIZE and $DEBUGINFOD_MAXTIME settings
      for skipping large/slow transfers.
      Add $DEBUGINFOD_RETRY for retrying aborted lookups.
    - debuginfod: Supply extra HTTP response headers, describing
      archive/file names that satisfy the requested buildid content.
      Support -d :memory: option for in-memory databases.
      Protect against loops in federated server configurations.
      Add -r option to use -I/-X regexes for grooming stale files.
      Protect against wasted CPU from duplicate concurrent requests.
      Limit the duration of groom ops roughly to rescan (-t) times.
      Add --passive mode for serving from read-only database.
      Several other performance improvements & prometheus metrics.
    - libdw: Support for the NVIDIA Cuda line map extensions.
      DW_LNE_NVIDIA_inlined_call and DW_LNE_NVIDIA_set_function_name
      are defined in dwarf.h. New functions dwarf_linecontext and
      dwarf_linefunctionname.
    - translations: Update Japanese translation.


author: Mark Wielaard <mjw@redhat.com> - 0.187-4
changelog:
  - Upgrade to elfutils 0.187
    - debuginfod: Support -C option for connection thread pooling.
    - debuginfod-client: Negative cache file are now zero sized instead
      of no-permission files.
    - addr2line: The -A, --absolute option, which shows file names
      includingthe full compilation directory is now the
      default.  To get theold behavior use the new option --relative.
    - readelf, elflint: Recognize FDO Packaging Metadata ELF notes
    - libdw, debuginfo-client: Load libcurl lazily only when files need
      to be fetched remotely. libcurl is now never loaded when
      DEBUGINFOD_URLS is unset. And whenDEBUGINFOD_URLS is set,
      libcurl is only loaded when the debuginfod_begin function is
      called.
  - Add elfutils-0.187-csh-profile.patch
  - Add elfutils-0.187-debuginfod-client-fd-leak.patch
  - Add elfutils-0.187-mhd_no_dual_stack.patch
  - Add elfutils-0.187-mhd_epoll.patch
  - Add an explicit versioned requires from elfutils-debuginfod-client
    on elfutils-libs and elfutils-libelf.
  - Remove brew testsuite workarounds


author: Jacek Migacz <jmigacz@redhat.com> - 1:27.2-8.1
changelog:
  - Fix etags local command injection vulnerability (#2184369)
  - Fix htmlfontify.el command injection vulnerability (#2184368)
  - Fix ruby-mode.el local command injection vulnerability (#2184367)
  - Fix ob-latex.el command injection vulnerability (#2184377)


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-5
changelog:
  - Fix multiple CVEs
  - CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
  - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
  - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
  - CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
  - CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
  - CVE-2022-22825 Integer overflow in lookup in xmlparse.c
  - CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
  - CVE-2022-22823 Integer overflow in build_model in xmlparse.c
  - CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
  - Resolves: CVE-2022-23852
  - Resolves: CVE-2021-45960
  - Resolves: CVE-2021-46143
  - Resolves: CVE-2022-22827
  - Resolves: CVE-2022-22826
  - Resolves: CVE-2022-22825
  - Resolves: CVE-2022-22824
  - Resolves: CVE-2022-22823
  - Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-6
changelog:
  - Fix multiple CVEs
  - CVE-2022-25236 expat: namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
  - CVE-2022-25235 expat: malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
  - CVE-2022-25315 expat: integer overflow in storeRawNames()
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-11
changelog:
  - CVE-2022-43680 expat: use-after free caused by overeager destruction of a shared DTD in XML_ExternalEntityParserCreate
  - Resolves: CVE-2022-43680


author: Chris Leech <cleech@redhat.com> - 1.0.32-6
changelog:
  - remove fcoe from SUPPORTED_DRIVERS in /etc/sysconfig/fcoe
  - add qedf to SUPPORTED_DRIVERS in /etc/sysconf/fcoe
  - added upstream fix for large fcoe ctrl numbers


author: Ondrej Vasik <ovasik@redhat.com> - 3.6-1
changelog:
  - own /usr/share/bash-completion{,/completions,/helpers} (#1504616)
  - create and own /usr/lib/debug/.dwz dir to prevent
    dangling symlink (#1508610)


author: Ondrej Vasik <ovasik@redhat.com> - 3.7-1
changelog:
  - own /usr/share/locale and /usr/lib/modules
  - own /usr/lib/sysimage
  - improve filesystem content file to include symlinks and rootdir


author: Tomas Mraz <tmraz@redhat.com> - 1.2.0-1
changelog:
  - add lib subpackage to avoid multilib on the base package
  - add ability to compute hmacs on multiple files at once
  - improved debugging with FIPSCHECK_DEBUG


author: Eric Garver <egarver@redhat.com> - 0.9.3-12
changelog:
  - feat(config): add CleanupModulesOnExit configuration option
  - change default CleanupModulesOnExit=yes


author: Akira TAGOH <tagoh@redhat.com> - 2.13.0-6
changelog:
  - Add Suggests: dejavu-sans-fonts to address pulling the unpredicted
    font package as dependency. (#1321551)


author: Akira TAGOH <tagoh@redhat.com> - 2.13.1-3
changelog:
  - Stop cleaning up .uuid file even when a directory is empty.
    resolves: rhbz#1653171
  - Use Rachana instead of Meera for serif subsitution.
    resolves: rhbz#1650491


author: Marek Kasik <mkasik@redhat.com> - 2.10.4-1
changelog:
  - Update to 2.10.4
  - Test bitmap size earlier for PNGs
  - Fix memory leak in pngshim.c
  - Enable man pages for demos
  - Resolves: #1887084, #1890211


author: Akira TAGOH <tagoh@redhat.com> - 2.10.4-3
changelog:
  - Enable HarfBuzz support
  - Add bootstrap without HarfBuzz
  - Resolves: #1853937
  - Resolves: #1906714


author: Pavel Reichl <preichl@redhat.com> - 2.9.7-16
changelog:
  - Back-port max_pages support,
  - caching symlinks in kernel page cache,
  - and in-kernel readdir caching
  - Fixed rhbz#2080000


author: Richard Hughes <richard@hughsie.com> 1.5.4-1
changelog:
  - Rebase package to include support for latest OEM hardware and to
    support deploying UEFI SecureBoot dbx updates.
  - Resolves: #1870811


author: Richard Hughes <richard@hughsie.com> 1.5.5-2
changelog:
  - Do not invalidate all remote timestamps during package install to fix rpm -V.
  - Backport some important high priority fixes from upstream.
  - Resolves: #1926382


author: Richard Hughes <richard@hughsie.com> 1.5.9-3
changelog:
  - Rebase to include the SBAT metadata section to allow fixing BootHole
  - Resolves: rhbz#1933012
  - Resolves: rhbz#1932953
  - Resolves: rhbz#1932909
  - Resolves: rhbz#1932882
  - Resolves: rhbz#1932579
  - Resolves: rhbz#1932553
  - Resolves: rhbz#1932423


author: Richard Hughes <richard@hughsie.com> 1.7.1-1
changelog:
  - New upstream release
  - Backport upstream changes
  - Include support for Dell TBT4 Docking stations
  - Resolves: rhbz#1969472
  - Resolves: rhbz#1976408


author: Richard Hughes <richard@hughsie.com> 1.7.1-2
changelog:
  - Disable the Logitech bulkcontroller plugin to avoid adding a dep to protobuf-c
    which lives in AppStream, not BaseOS.
  - Resolves: rhbz#2029333


author: Richard Hughes <richard@hughsie.com> 1.7.4-1
changelog:
  - Include support for Lenovo TBT4 Docking stations
  - Do not cause systemd-modules-load failures
  - Resolves: rhbz#2038258
  - Resolves: rhbz#2037294


author: Peter Jones <pjones@redhat.com> - 10-4
changelog:
  - Roll in some bugfixes that'll be in fwupdate-11 upstream.
    This helps fix a couple of vendors machines.


author: Weitao Zhou <zhouwt@linux.alibaba.com> 11-3.0.1
changelog:
  - Disable -Wno-address-of-packed-member to fix build failed with gcc9.2
  - Support loongarch64 platform(Liwei Ge)


author: Charles R. Anderson <cra@wpi.edu> - 2008_10_13-10
changelog:
  - Patch to apply CFLAGS/LDFLAGS to final link so RPM_OPT_FLAGS are picked up (rhbz#1548426)
  - Use CC=gcc explicitly
  - Regenerate fxload-noa3load.patch


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.1.4-7
changelog:
  - Revert previous change of adding 'awk*' symlinks for info pages (bug #1486924)
  - Added patch to correctly fix the info pages issue (bug #1486924)
  - specfile content refactored for better readability
  - Package now provides its ABI version via gawk(abi)
  - Added test for usage of correct gawk(abi) into %check section


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.2.0-1
changelog:
  - Update to latest stable release from upstream [new API version - 2.0]
  - Added latest relevant patches from upstream's gawk-4.2-stable branch


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 4.2.0-2
changelog:
  - 'noarch' removed from *-devel subpackage
  - added arch requirement for *-devel subpackage
  - updated the build process to use %make_build macro


author: <fjanus@redhat.com> - 1.18-2
changelog:
  - Add backward compatibility patch
  - Resolves: #2097704
  - Backport from upstream commit: 00ba17479ff31c6825f0e6f28b965f11525e83f6


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 1:1.18-2.0.1
changelog:
  - remove char *parseopt_program_doc and *parseopt_program_args in parseopt.c for compatible gcc10 build


author: Tomas Popela <tpopela@redhat.com> - 2.42.6-3
changelog:
  - Backport fixes for CVE-2021-46829 and CVE-2021-44648
  - Resolves: rhbz#2115213
  - Resolves: rhbz#2044346


author: Andrew Price <anprice@redhat.com> - 3.2.0-9
changelog:
  - gfs2_jadd: Handle out-of-space issues
  - gfs2_jadd: error handling overhaul
    Resolves: rhbz#1833141
  - gfs2.5: Update some mentions of gfs2_tool
    Resolves: rhbz#1818983


author: Andrew Price <anprice@redhat.com> - 3.2.0-11
changelog:
  - gfs2_jadd: Use fallocate to preallocate journals
  - gfs2_jadd: Don't fsync after each block written
    Resolves: rhbz#1942434


author: Rongwei Wang <rongwei.wang@linux.alibaba.com> - 2.28-225.0.4.6
changelog:
  - elf: Properly align PT_LOAD segments
  - Sync loongarch64 code to lnd.35. (lixing@loongson.cn)
  - Add patch for gb18030-2022 from upstream bug#30243 (fundawang@yeah.net)


author: Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-57
changelog:
  - fixes bugs bz#1600379 bz#1689375 bz#1782428 bz#1798897 bz#1815462 
    bz#1889966 bz#1891403 bz#1901468 bz#1903911 bz#1908635 bz#1917488 bz#1918018 
    bz#1919132 bz#1925425 bz#1927411 bz#1927640 bz#1928676 bz#1942816 bz#1943467 
    bz#1945143 bz#1946171 bz#1957191 bz#1957641


author: Gluster Jenkins <dkhandel+glusterjenkins@redhat.com> - 6.0-60
changelog:
  - fixes bugs bz#1668303 bz#1853631 bz#1901468 bz#1904137 bz#1911665 
    bz#1962972 bz#1973566 bz#1994593 bz#1995029 bz#1997447 bz#2006205


author: Jakub Martisko <jamartis@redhat.com> - 1:6.2.0-9
changelog:
  - Move the .hmac files to the fipscheck subfolder
  - Make symlinks from their original location (Fedora contains the .hmac files there) pointing to their new location
  Resolves: rhbz#1980758


author: Jakub Martisko <jamartis@redhat.com> - 1:6.2.0-13
changelog:
  - Fix: previous commit removed one function from the library and thus broke the ABI
  - function gmpn_preinv_divrem_1 should now not be removed
  Related: rhbz#2044216


author: Daiki Ueno <dueno@redhat.com> - 3.6.16-1
changelog:
  - Update to upstream 3.6.16 release (#1956783)
  - Fix potential use-after-free in key_share handling (#1927597)
  - Fix potential use-after-free in pre_shared_key handling (#1927593)
  - Stop gnutls-serv relying on AI_ADDRCONFIG to decide listening address (#1908334)
  - Fix cert expiration issue in tests (#1908110)


author: Zoltan Fridrich <zfridric@redhat.com> - 3.6.16-6
changelog:
  - Fix x86_64 CPU feature detection when AVX is not available (#2131152)
  - Fix timing side-channel in TLS RSA key exchange (#2162598)


author: David King <amigadave@amigadave.com> - 1.68.0-6
changelog:
  - Add Requires on python-markdown for g-ir-doc-tool (#1979144)
  - Add license texts and documentation files (#1979144)


author: Robbie Harwood <rharwood@redhat.com> - 2.02-143
changelog:
  - x86-efi: Fix an incorrect array size in kernel allocation
  - Also merge with 8.7
  - Resolves: #2031288


author: Bo Ren <rb01097748@alibaba-inc.com> - 2.02-148.0.1.1
changelog:
  - Build pc-modules package on x86_64 (geliwei@openanolis.org)
  - Add loongarch64 base support (zhangwenlong@loongson.cn)(chenguoqi@loongson.cn)
  - Fix a bug in bls_make_list, blscfg. (zhonglingh@linux.alibaba.com)
  - Delete LoongArch64 support old version due to compile error(yangqiming@loongson.cn)
  - Add LoongArch64 support(yangqiming@loongson.cn)
  - LoongArch64 support fdt and phy-addr BIOS(yangqiming@loongson.cn)
  - Remove dtb dir with correct argument (Liwei Ge)


author: Tomas Popela <tpopela@redhat.com> - 40.0-6
changelog:
  - Require the Source Code Pro font instead of only recommending it to not break
    systems updated from 9.0.0.
    Resolves: rhbz#2093975


author: Jakub Martisko <jamartis@redhat.com> - 1.9-5
changelog:
  - Fix wrong skip size in gzexe
  - Add new test dealing with the ^^ (needs autoreconf)
  - Enable make check (needs less)
    Resolves: 1705413

   * Tue Aug 07 2018 Jakub Martisko <jamartis@redhat.com> - 1.9-4
   - Fix FTBFS bug (gnulib problems)
   - more details: https://lists.gnu.org/r/bug-gnulib/2018-03/msg00000.html
     Resolves 1611722


author: Francisco Javier Tsao Santín <tsao@gpul.org> - 1:1.3-1
changelog:
  - Patch by Todd Lewis that adds option -x to exclude files with pcre lib 
  - This patch solves RH Bugzilla ID's 955246 1322198


author: Tomasz Kłoczko <kloczek@fedoraproject.org> - 1:1.3-4
changelog:
  - remove manually added pcre2 requires (this is autogenerated)
  - removed BuildRoot, %defattr() and Group (new Fedora Packaging Guildline)
  - do not use straight gcc and add use %{__global_ldflags}
  - use %_licensedir is no longer needed
  - minor cleanups:
  -- reformat %description to 80 col
  -- added full URLs in Source fields
  -- more macros
  -- a bit simpler %prep


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-6
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
    harfbuzz: integer overflow in the component hb-ot-shape-fallback.c


author: Parag Nemade <pnemade AT redhat DOT com> - 2.7.4-7
changelog:
  - Resolves:rh#2103849 CVE-2022-33068
  - Fix Covscan compiler warning for inclusion of parenthesis
  - Update tests.yaml


author: Michal Grzedzicki <mge@fb.com> - 9.54-4
changelog:
  - backport fix for --dco-identify real max sectors calculation from upstream version 9.62 (#1959918)


author: Honggang Li <honli@redhat.com> - 32.0-4
changelog:
  - Update to upstream stable release v32.1
  - Fix mlx5 pyverbs CQ test
  - Resolves: bz1915745, bz1907377


author: Honggang Li <honli@redhat.com> - 37.1-1
changelog:
  - Update to upstream v37.1 release for features and fixes
  - Resolves: bz1982200, bz1990120, bz1982131


author: Kamal Heib <kheib@redhat.com> - 46.0-1
changelog:
  - Rebase to upstream release v46.0
  - Resolves: rhbz#2170066, rhbz#2209685, rhbz#2159635, rhbz#2167517


author: Mike FABIAN <mfabian@redhat.com> - 60.2-4
changelog:
  - Add negative-daylight-savings.patch from upstream.
    (see http://bugs.icu-project.org/trac/ticket/13566 and
    http://bugs.icu-project.org/trac/changeset/40954)


author: Parag Nemade <pnemade AT redhat DOT com> - 60.2-7
changelog:
  - Resolves:rh#1602551 - Fix specfile by adding compile options
  - also add BuildRequires for gcc and gcc-c++
  - Correct the upstream URL


author: Mike FABIAN <mfabian@redhat.com> - 60.3-1
changelog:
  - Update to 60.3 maintenance release including support for new Japanese era Reiwa (令和).
  - Resolves: rhbz#1677093


author: Mike FABIAN <mfabian@redhat.com> - 60.3-2
changelog:
  - Apply ICU-13634-Adding-integer-overflow-logic-to-ICU4C-num.patch
  - Apply ICU-20958-Prevent-SEGV_MAPERR-in-append.patch
  - Resolves: rhbz#1808238


author: Jan Macku <jamacku@redhat.com> - 10.00.10-1
changelog:
  - Allow updating rfkill switch status while in readonly root mode
  - service: Prevent variables from globbing
  - Allow updating mlocate.db while in readonly root mode


author: Jan Macku <jamacku@redhat.com> - 10.00.16-1
changelog:
  - rename_device: also support dracut-style kernel cmdline configuration
  - ifup-routes: Log when using `ip $type replace`
  - ifup-routes: Use `ip route repace` to avoid race


author: Jan Macku <jamacku@redhat.com> - 10.00.17-1
changelog:
  - ifup-routes: Revert quotes
  - ifup-routes: Use `ip replace` only on type `route`
  - ci: introduce GA ci from master to rhel8-branch
  - ci: Setup packit for RHEL8 branch
  - ci: Get rid of old ci files (travis and zanata)


author: Charalampos Stratakis <cstratak@redhat.com> - 0.6-10
changelog:
  - SPEC file cleanup
  - Added licence tag
  - Removal of old and unneeded macros
  - Use of newest python macros
  - Removed Python 2 dependency
  - Added patch for Python 3 build


author: Andrea Claudi <aclaudi@redhat.com> - 5.15.0-2.el8
changelog:
  - vdpa: Enable user to set mtu of the vdpa device (Andrea Claudi) [2036880]
  - vdpa: Enable user to set mac address of vdpa device (Andrea Claudi) [2036880]
  - vdpa: Enable user to query vdpa device config layout (Andrea Claudi) [2036880]
  - vdpa: align uapi headers (Andrea Claudi) [2036880]


author: Andrea Claudi <aclaudi@redhat.com> - 5.15.0-3.el8
changelog:
  - tc: u32: add json support in `print_raw`, `print_ipv4`, `print_ipv6` (Andrea Claudi) [1989591]
  - tc: u32: add support for json output (Andrea Claudi) [1989591]


author: Andrea Claudi <aclaudi@redhat.com> - 5.15.0-4.el8
changelog:
  - vdpa: Update man page with added support to configure max vq pair (Andrea Claudi) [2056827]
  - vdpa: Support reading device features (Andrea Claudi) [2056827]
  - vdpa: Support for configuring max VQ pairs for a device (Andrea Claudi) [2056827]
  - vdpa: Allow for printing negotiated features of a device (Andrea Claudi) [2056827]
  - vdpa: Remove unsupported command line option (Andrea Claudi) [2056827]
  - uapi: update vdpa.h (Andrea Claudi) [2056827]
  - Update kernel headers and import virtio_net (Andrea Claudi) [2056827]


author: Andrea Claudi <aclaudi@redhat.com> - 6.2.0-2.el8
changelog:
  - macvlan: Add bclim parameter (Andrea Claudi) [2188134]
  - Update kernel headers (Andrea Claudi) [2188134]


author: Andrea Claudi <aclaudi@redhat.com> - 6.2.0-4.el8
changelog:
  - ip vrf: make ipvrf_exec SELinux-aware (Andrea Claudi) [1780023]
  - lib: add SELinux include and stub functions (Andrea Claudi) [1780023]
  - ss: make SELinux stub functions conformant to API definitions (Andrea Claudi) [1780023]
  - ss: make is_selinux_enabled stub work like in SELinux (Andrea Claudi) [1780023]


author: Liwei Ge <geliwei@openanolis.org> - 6.2.0-5.0.1
changelog:
  - delete the rt_dsfield file due to three Aones (hengqi@linux.alibaba.com)
  - [kernelself-tests]net.fib_rule_tests.sh: TEST rule4 del by pref, rule6 del by pref FAIL


author: Stefano Brivio <sbrivio@redhat.com> - 6.38-3
changelog:
  - Fix loading of sets with dependencies on other sets (RHBZ#1647096), and
    hardcode 6.38-1.el7 for ipset-service upgrade and downgrade triggers, so that
    we don't run into issues with z-stream updates


author: Stefano Brivio <sbrivio@redhat.com> - 7.1-1
changelog:
  - Rebase to 7.1 (RHBZ#1649090):
    - Add compatibility support for strscpy()
    - Correct the manpage about the sort option
    - Add missing functions to libipset.map
    - configure.ac: Fix build regression on RHEL/CentOS/SL (Serhey Popovych)
    - Implement sorting for hash types in the ipset tool
    - Fix to list/save into file specified by option (reported by Isaac Good)
    - Introduction of new commands and protocol version 7, updated kernel include files
    - Add compatibility support for async in pernet_operations
    - Use more robust awk patterns to check for backward compatibility
    - Prepare the ipset tool to handle multiple protocol version
    - Fix warning message handlin
    - Correct to test null valued entry in hash:net6,port,net6 test
    - Library reworked to support embedding ipset completely
    - Add compatibility to support kvcalloc()
    - Validate string type attributes in attr2data() (Stefano Brivio)
    - manpage: Add comment about matching on destination MAC address (Stefano Brivio)
      (RHBZ#1649079)
    - Add compatibility to support is_zero_ether_addr()
    - Fix use-after-free in ipset_parse_name_compat() (Stefano Brivio) (RHBZ#1649085)
    - Fix leak in build_argv() on line parsing error (Stefano Brivio) (RHBZ#1649085)
    - Simplify return statement in ipset_mnl_query() (Stefano Brivio) (RHBZ#1649085)
    - tests/check_klog.sh: Try dmesg too, don't let shell terminate script (Stefano Brivio) 
  - Fixes:
    - Fix all shellcheck warnings in init script (RHBZ#1649085)
    - Make error reporting consistent, introduce different severities (RHBZ#1683711)
    - While restoring, on invalid entries, remove them and retry (RHBZ#1683713)
    - Fix covscan SC2166 warning in init script (RHBZ#1649085)


author: Phil Sutter <psutter@redhat.com> - 1.8.4-16
changelog:
  - tests/shell: Add test for bitwise avoidance fixes
  - ebtables: Optimize masked MAC address matches
  - nft: Optimize class-based IP prefix matches
  - nft: Fix for broken address mask match detection
  - nft: cache: Make nft_rebuild_cache() respect fake cache
  - tests: shell: Improve concurrent noflush restore test a bit
  - nft: Fix for concurrent noflush restore calls
  - nft: Fix error reporting for refreshed transactions
  - nft: Make batch_add_chain() return the added batch object


author: Phil Sutter <psutter@redhat.com> - 1.8.4-17
changelog:
  - extensions: dccp: Fix for DCCP type 'INVALID'
  - tests: shell: Merge and extend return codes test
  - nft: Fix command name in ip6tables error message
  - extensions: libxt_CT: add translation for NOTRACK
  - extensions: libipt_icmp: Fix translation of type 'any'
  - tests/shell: Test for fixed extension registration
  - libxtables: Register multiple extensions in ascending order
  - libxtables: Simplify pending extension registration
  - libxtables: Make sure extensions register in revision order


author: Phil Sutter <psutter@redhat.com> - 1.8.4-18
changelog:
  - xtables-translate: Fix translation of odd netmasks
  - nft: Fix bitwise expression avoidance detection
  - xtables-monitor: 'LL=0x304' is not very convenient, print LOOPBACK instead.
  - xtables-monitor: print packet first
  - xtables-monitor: fix packet family protocol
  - xtables-monitor: fix rule printing
  - xtables-monitor: Fix ip6tables rule printing


author: Phil Sutter <psutter@redhat.com> - 1.8.4-20
changelog:
  - extensions: SECMARK: Use a better context in test case
  - extensions: sctp: Translate --chunk-types option
  - extensions: sctp: Fix nftables translation
  - extensions: SECMARK: Implement revision 1
  - nft: cache: Retry if kernel returns EINTR


author: Phil Sutter <psutter@redhat.com> - 1.8.4-21
changelog:
  - extensions: hashlimit: Fix tests with HZ=100
  - ebtables: Dump atomic waste
  - doc: ebtables-nft.8: Adjust for missing atomic-options


author: Phil Sutter <psutter@redhat.com> - 1.8.4-23
changelog:
  - libxtables: Fix unsupported extension warning corner case
  - tests: shell: Check overhead in iptables-save and -restore
  - nft: Fix EPERM handling for extensions without rev 0
  - Improve error messages for unsupported extensions
  - xshared: Fix response to unprivileged users
  - libxtables: Register only the highest revision extension
  - Use proto_to_name() from xshared in more places
  - libxtables: Boost rule target checks by announcing chain names
  - libxtables: Implement notargets hash table
  - nft: Reject standard targets as chain names when restoring
  - xshared: Merge and share parse_chain()
  - xshared: Prefer xtables_chain_protos lookup over getprotoent
  - nft: Speed up immediate parsing
  - nft: Simplify immediate parsing


author: Phil Cameron <pcameron@redhat.com> - 1.1.4-16
changelog:
  - Moved upstream from https://fedorahosted.org/iptraf-ng/ to 
    https://github.com/iptraf-ng/iptraf-ng/ with release v1.1.4
    Fixes error in patch Patch03 - this fixes 1283773


author: Thomas Woerner <twoerner@redhat.com> 2.2.6-1
changelog:
  - New upstream version 2.2.6
    - Located at github
    - Fixes (RHBZ#1294913 and RHBZ#1375395)
  - Additional upstream patch (no_debug) to drop some debugging remains
  - Additional proposed patch to fix segmentation fault with -1 -C (RHBZ#599181)


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 20180629-11.0.1
changelog:
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - Fix ping: process interrupts in ping*_receive_error_msg (forrest_ly)


author: Kairui Song <kasong@redhat.com> 2:1.4.0-3
changelog:
  - Update document and remove dead options to fix manpage scan warning (bz1612706)
  - Fix gating test error (bz1680619)


author: Chris Leech - 6.2.0.878-5.gitd791ce0
changelog:
  - 1849931, 1869438 go back to MD5 CHAP only by default
    new CHAP modes can cause issue with some targets,
    so SHA1/SHA256/SHA3-256 modes must be configured to enable now


author: Chris Leech <cleech@redhat.com> - 0.94-1
changelog:
  - new upstream location, update to 0.94
  - new devel package, upstream open-iscsi is dropping it's internal copy


author: Jarod Wilson <jarod@redhat.com> - 20220713-109.gitdfa29317
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Include even newer qed firmware update (rhbz 2040269)


author: Jarod Wilson <jarod@redhat.com> - 20220726-110.git150864a4
changelog:
  - Omit unused password-protected vxge firmware files from package (rhbz 2108051)
  - Pick up latest AMD GPU firmwares


author: Lucas Zampieri <lzampier@redhat.com> - 20221102-111.git8bb75626
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - amdgpu firmware update to fix certain "multiple monitor scenarios" (rhbz 2130707)


author: Lucas Zampieri <lzampier@redhat.com> - 20230111-112.gita1ad1d5b
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Navi33 dGPU firmware (rhbz 2047480)
  - Navi31 dGPU firmware (rhbz 2047483)


author: Lucas Zampieri <lzampier@redhat.com> - 20230217-113.git83f1d778
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Qualcomm Wi-Fi - Disconnecting power cable during suspend wakes up the laptop (rhbz 2169012)


author: Patrick Talbert <ptalbert@redhat.com> - 20230404-114.git2e92a49f
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Intel QAT Update - firmware for QAT (rhbz 2030316)


author: Xin Long <lxin@redhat.com> - 2.11-3
changelog:
  - Deal with warnings under gcc 8
  - Call va_end after va_copy in json_vsprintf
  - Fix bogus date in jansson.spec


author: Anna Khaitovich <akhaitov@redhat.com> - 0.13.1-0.3
changelog:
  - Don't package empty /usr/share/doc/json-c
  - Resolves: rhbz#1741076
  - Do not use --enable-rdrand
  - Resolves: rhbz#1806532


author: Pingfan Liu <piliu@redhat.com> - 2.0.24-6
changelog:
  - kdump-lib: Add the CoreOS kernel dir to the boot_dirlist
  - kdump-lib: attempt to fix BOOT_IMAGE detection
  - kdump-lib: change how ostree based systems are detected
  - kdump-lib: clear up references to Atomic/CoreOS


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-2
changelog:
  - mkdumprd: Improve error messages on non-existing NFS target directories
  - fadump: avoid non-debug kernel use for fadump case


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-3
changelog:
  - kdump.conf: use a simple generator script to maintain
  - Reduce kdump memory consumption by not letting NetworkManager manage unneeded network interfaces


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-4
changelog:
  - Don't check fs modified when dump target is lvm2 thinp
  - Add dependency of dracut lvmthinpool-monitor module
  - lvm.conf should be check modified if lvm2 thinp enabled
  - Add lvm2 thin provision dump target checker
  - Fix the sync issue for dump_fs


author: Pingfan Liu <piliu@redhat.com> - 2.0.25-5
changelog:
  dracut-module-setup: Fix invalid rd.znet command line entry
   dracut-module-setup: Fix persistent nic name on s390


author: Youling Tang <tangyouling@loongson.cn> - 2.0.25-5.0.1
changelog:
  - Add LoongArch support
  - Add doc sub package (wb-zh951434@alibaba-inc.com)
  - Fix kexec error for kexec -s (xiangzao@linux.alibaba.com)
  - Reimplement loongarch64 support


author: David Howells <dhowells@redhat.com> - 1.5.10-1
changelog:
  - Include sys/types.h in keyutils.h.
  - The dns resolver needs limits.h.
  - Overhaul of all manual pages.
  - Some manual pages moved to Linux man-pages project.
  - Add Diffie-Helman keyctl function.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-16
changelog:
  - weak-modules: update_modules_for_krel: always finish sandbox
  - weak-modules: groupping: use dependencies of extra/ provider
    Resolves: rhbz#1778889


author: Guixin Liu <kanie@linux.alibaba.com> - 1.13.1
changelog:
  - change spec weak-module (Guixin Liu)
  - add Conflicts: kernel < 5.10.134-16.an8 to avoid install unexpected kernel (DengXiewei)
  - remove pkgversion in spec (DengXiewei)
  - update spec & chmod -x (DengXiewei)
  - ast: support ast driver (Guixin Liu)


author: - Andy Walsh <awalsh@redhat.com> - 6.2.7.17-86
changelog:
  - Fixed bug which could result in empty flushes being issued to the storage
    below vdo while suspended.
  - Resolves: rhbz#2013056
  - Fixed syntax mismatch which prevented lvm from being able to configure a
    512MB UDS index.
  - Resolves: rhbz#2073203
  - Fixed a race handling timeouts of dedupe index queries.
  - Resolves: rhbz#2092075


author: - Andy Walsh <awalsh@redhat.com> - 6.2.8.1-87
changelog:
  - Fixed a bug which could produce a deadlock after multiple saves and resumes
    of a vdo.
  - Resolves: rhbz#2109047


author: - Susan LeGendre-McGhee <slegendr@redhat.com> - 6.2.8.7-88
changelog:
  - Fixed bug in read-only rebuild when the logical size of the volume is an
    exact multiple of 821 4K blocks.
  - Resolves: rhbz#2166131


author: Julien Thierry <jthierry@redhat.com> 0.9.2-2
changelog:
  - Fix unload issue under stress (rhbz#1883238)
  - Fix dnf-kpatch man file permissions (rhbz#1899341)
  - Do not replace dnf kpatch configuration file when reinstalling (rhbz#1898191)


author: Julien Rische <jrische@redhat.com> - 1.18.2-21
changelog:
  - Backport fix of memory use after free during libkrad cleanup
  - Backport support for larger RADIUS attributes in libkrad
  - Resolves: rhbz#2103125


author: Cestmir Kalina <ckalina@redhat.com> - 1.3-1
changelog:
  - Resolves: #1642134 Error restrict bugs to groups without permission while
    trying to submit RHEL8 symbols
  - New ksc reports will no longer be submitted under redhat bugzilla group.
  - At least one bugzilla group must be specified by a ksc user, otherwise ksc
    will terminate with an error.
  - Version bump to 1.3


author: Cestmir Kalina <ckalina@redhat.com> - 1.4-1
changelog:
  - Resolves: #1643187 ksc manpage lies -k can only be specified once
  - Resolves: #1645335 FILE is shown in ksc man page but no explain or effect
  - Support for multiple -k arguments added
  - Man page reworded to match ksc behaviour


author: Čestmír Kalina <ckalina@redhat.com> - 1.5-1
changelog:
  - Resolves: #1647528 ksc add feature to copy justifications between ksc...
  - Resolves: #1648026 ksc add a non-processed .ko file
  - Resolves: #1647974 piped input causes ksc to fail when asking for user input
  - Add support for justification carry over.
  - Add support for symbol filtering using -K.
  - Fix input problems when piping through to ksc.
  - Extend manpage with EXAMPLES section.
  - Version bump fo 1.5.


author: Čestmír Kalina <ckalina@redhat.com> - 1.6-1
changelog:
  - Resolves: #1729039 Extend ksc output to include environment metadata
  - Add modinfo vermagic field to the output.
  - Add kmod (provides modinfo) to requires.


author: Čestmír Kalina <ckalina@redhat.com> - 1.6-2
changelog:
  - Resolves: #1729039 Extend ksc output to include environment metadata
  - (OSCI) Add kmod to Makefile-generated Requires


author: Čestmír Kalina <ckalina@redhat.com> - 1.7-1
changelog:
  - Resolves: #1886901 Avoid divisive language
  - Resolves: #1912506 File bugs with Tracking keyword by default


author: Čestmír Kalina <ckalina@redhat.com> - 1.9-1
changelog:
  - Resolves: #2043450 ksc: Support Authorization header in bugzilla API
  - Rebase to latest ksc release


author: Čestmír Kalina <ckalina@redhat.com> - 1.9-2
changelog:
  - Resolves: #2043450 ksc: Support Authorization header in bugzilla API
  - Use platform-python in place of python3


author: Jan Macku <jamacku@redhat.com> - 0.97-1
changelog:
  - update to 0.97 (#2159588)
  - drop downstream patch - ipmi: avoid error messages on non-dell platforms


author: Jeff Moyer <jmoyer@redhat.com> - 0.3.110-12.el8
changelog:
  - Pass in the distro-provided CFLAGS and LFLAGS. (Jeff Moyer)
  - Get rid of -nostartfiles -nostdlib (Jeff Moyer)
  - Resolves: rhbz#1630578


author: Richard Hughes <richard@hughsie.com> 0.7.16-1
changelog:
  - Update to 0.7.15
  - Add UPL short name to SPDX conversion
  - Allow parsing desktop files using as_app_parse_data()
  - Do not preserve restrictive permissions when installing AppStream files
  - Modernize the validation requirements
  - Remove relative path from icon names
  - Support loading YAML from as_store_from_bytes()
  - Update list of allowed metadata licences
  - Update the SPDX license list to v3.5


author: Richard Hughes <richard@hughsie.com> 0.7.17-1
changelog:
  - New upstream release
  - Add "icon-theme" as recognised component type
  - Fix CI by moving 'future' back a bit
  - Make default content rating values match OARS semantics
  - Properly initialize unique_id_mutex


author: Richard Hughes <richard@hughsie.com> 0.7.18-1
changelog:
  - New upstream release
  - Add content rating system APIs from gnome-software
  - Add "validate-version" command
  - Allow timestamp in the future in validate-relax
  - Don't ignore localized strings that are the same as original
  - Fix crash with invalid children of <ul/>
  - Properly initialize mutexes
  - Test launchable tags in validation


author: Marek Polacek <polacek@redhat.com> 8.5.0-13
changelog:
  - require docbook-style-xsl instead of docbook5-style-xsl (#2073888)
  - backport Default widths with -fdec-format-defaults patch (#2074614)


author: Marek Polacek <polacek@redhat.com> 8.5.0-17
changelog:
  - fix deserialization for std::normal_distribution (#2130392,
    PR libstdc++/105502)
  - initialize std::normal_distribution::_M_saved (PR libstdc++/99536)
  - reject std::make_shared<T[]> (PR libstdc++/99006)


author: Xue haolin <xuehaolin@openanolis.org> 8.5.0-18.0.1
changelog:
  - Rebrand for Anolis OS. (xuehaolin@openanolis.org)
  - Add loongarch support. (lixing@loongson.cn)
  - Fixup LoongArch configure file error. (lixing@loongson.cn)
  - rename mt file for LoongArch. (lixing@loongson.cn)
  - Fixup LoongArch atomic_exchange error. (lixing@loongson.cn)
  - Remove loongarch64 arch (wb-zh951434@alibaba-inc.com)


author: Karel Zak <kzak@redhat.com> 2.32.1-36
changelog:
  - fix #2060030 - Please backport patches for atari partition detection to RHEL 8
  - fix #2069187 - Internal testsuite for lscpu failed on aarch64
  - fix #2093166 - lslogins reports incorrect "Password is locked" status
  - fix #2059241 - rpm -V / --verify reports bad user/group/mtime for /run/uuidd
  - fix #2044592 - Move /var/log/lastlog ownership to systemd


author: Karel Zak <kzak@redhat.com> 2.32.1-40
changelog:
  - fix #2121699 - fstrim -av fails to trim root filesystem on Red Hat Coreos 
  - fix #2142496 - update upstream tests
  - fix #2149394 - umount outputs inaccurate error message when umount() fails with EACCES
  - fix #2159544 - lslogins "Password is locked" status changed in util-linux-2.32.1-38
  - fix #2160321 - [last] ut->ut_user is not null terminated


author: Karel Zak <kzak@redhat.com> 2.32.1-43
changelog:
  - fix #2117355 - Add additional documentation for fstab
  - fix #2184728 - libuuid - downport cache related patch
  - fix #2188894 - The swapon man page of -p(priority) option shows incorrect.
  - fix #2227097 - wall(1) fail when trying to use seat0


author: liuzhilin <liuzhilin@uniontech.com> 2.32.1-43.0.1
changelog:
  - [Patch] hwclock: better compatibility for both glibc2.28 and glibc2.31
  - [Patch] lscpu: add Neoverse-N2 to ARM identifiers tables (flin@linux.alibaba.com)
  - [Patch] lscpu: fix lscpu to get cpu frequency from cpuinfo on arm64 (flin@linux.alibaba.com)


author: Zoltan Fridrich <zfridric@redhat.com> - 2.26-5
changelog:
  - added CAP_PERFMON, CAP_BPF and CAP_CHECKPOINT_RESTORE capabilities
    resolves: rhbz#1946982 rhbz#1921576


author: Zoltan Fridrich <zfridric@redhat.com> - 2.48-2
changelog:
  - rebase to 2.48
    resolves: rhbz#2032813
  - fix ambient capabilities for non-root users
    resolves: rhbz#1950187


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.7.8-6
changelog:
  - Python 2 binary package renamed to python2-libcap-ng
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Nikola Forró <nforro@redhat.com> - 0.41-17
changelog:
  - backport several upstream fixes
  - set Delegate property for cgconfig service to make sure complete
    cgroup hierarchy is always created by systemd


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.1.16-1
changelog:
  - Update to 0.1.16
  - Make inline function __comps_objmrtree_all also static (RhBug:1793424)
  - Fix memory leaks and resource leaks
  - Fix: Check result "comps_parse_parsed_init()"


author: Filip Januš <fjanus@redhat.com> 5.3.28-42
changelog:
  - Apply the previous change only on aarch64 to limit the risk of unwanted impact
  - Resolves: #1992402


author: Lukas Hrazky <lhrazky@redhat.com> - 0.63.0-8
changelog:
  - Substitute all repository config options (fixes substitution of baseurl)
  - Use solvfile userdata to store and check checksums and solv versions
  - Fix handling transaction id in resolveTransactionItemReason
  - Set short action for Reason Change


author: Lukas Hrazky <lhrazky@redhat.com> - 0.63.0-10
changelog:
  - Do not print errors on failovermethod repo option
  - the dnf_context_remove() function accepts `<package-spec>`, doc updates
  - advisory upgrade: filter out advPkgs with different arch


author: Liu Xiaoping <lxp01404969@alibaba-inc.com> - 0.63.0-17.0.1
changelog:
  - Disable rhsm support in Anolis (geliwei@openanolis.org)
  - rebrand: fix platform compatibility (geliwei@openanolis.org)
  - Add loongarch64 to arch_map (liwei.glw@alibaba-inc.com)


author: Jerry James <loganjerry@gmail.com> - 3.1-23.20170329cvs
changelog:
  - Add gcc BR
  - Build verbosely
  - Drop obsolete --enable-widec configure option
  - Fix "unused direct shared library dependency" warning from rpmlint again
  - Fix man page error due to BSD nroff macro that is not available on Linux
  - Drop explicit R on pkgconfig from the -devel package, autogenerated


author: Vishal Vijayraghavan <vvijayra AT redhat DOT com> - 1:2.1.3-1
changelog:
  - New release of liberation-fonts 2.1.3
  - Resolves:rh#1464310 : Tilded G not works with Liberation Sans and Serif


author: Honggang Li <honli@redhat.com> - 1.11.1-1
changelog:
  - Rebase to upstream release v1.11.1
  - EFA Support requires libfabric
  - Resolves: bz1831145, bz1852636


author: Michal Schmidt <mschmidt@redhat.com> - 1.15.1-1
changelog:
  - Update to upstream release 1.15.1
  - Disable LTO on x86_64 due to memory issues (copied from Fedora)
  - Resolves: rhbz#2040450


author: DJ Delorie <dj@redhat.com> - 3.1-24
changelog:
  - Use /etc/sysconfig/libffi-force-shared-memory-check-first to
    override selinux permissions check for shared memory access (#2014228)


author: Tomáš Mráz <tmraz@redhat.com> 1.8.3-2
changelog:
  - make only_urandom a default in non-presence of configuration file
  - run the full FIPS selftests only when the library is called from
    application


author: Tomáš Mráz <tmraz@redhat.com> 1.8.3-3
changelog:
  - add CMAC selftest for FIPS POST
  - add continuous FIPS entropy test
  - disable non-approved FIPS hashes in the enforced FIPS mode


author: Tomáš Mráz <tmraz@redhat.com> 1.8.5-3
changelog:
  - new upstream version 1.8.5
  - AES performance improvements backported from master branch
  - FIPS module is implicit with kernel FIPS flag
  - always run the FIPS selftests if FIPS module is installed


author: Jakub Jelen <jjelen@redhat.com> - 1.8.5-6
changelog:
  - Fix for CVE-2021-40528 (#1971421)
  - Enable HW optimizations in FIPS (#1976137)
  - Performance enchancements for ChaCha20 and Poly1305 (#1855231)


author: Richard Hughes <richard@hughsie.com> 0.2.10-1
changelog:
  - New upstream version
  - Correctly detect removed devices when rescanning
  - Fix a memory leak when using control tranfers
  - Fix symbol version table up to version 0.2.9


author: Rafael Aquini <aquini@redhat.com> - 2.21-4
changelog:
  - Fix: task-size-overrun hung over 8 hours on ppc64le (1737370)
  - Introduce libhugetlbfs-tests subpkg for CI tests (1688930)


author: Rafael Aquini <aquini@redhat.com> - 2.21-12
changelog:
  - Fix: Introduce libhugetlbfs-tests subpkg for CI tests (1688930)
  - trim repetitive changelogs for interim debug builds


author: Rafael Aquini <aquini@redhat.com> - 2.21-13
changelog:
  - Fix: huge_page_setup_helper.py: SyntaxError: Missing parentheses in call to 'print' (1821938)
  - libhugetlbfs-tests: harden the testcases to satisfy EXECSHIELD RPMDiff checks (1785296)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-5
changelog:
  - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
    Rebuild against Samba rebase.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
  - Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
  - Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-3
changelog:
  - Resolves: rhbz#2219351 - [sssd] SSSD enters failed state after heavy load in the system [rhel-8.8.0.z]
  - Resolves: rhbz#2196838 - [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed' [rhel-8.8.0.z]


author: Ondrej Mosnáček <omosnace@redhat.com> - 1.1.1-16_1
changelog:
  - [RHEL] Apply 'Add missing dependencies to the tests package'
  - [RHEL] Apply 'Update patch from upstream'


author: Sahana Prasad <sahana@redhat.com> - 1.1.5-3
changelog:
  - Enables building on old kernels [sync fix in Fedora from omosnance].
  - This is required for covscans as they run on RHEL7 machines.


author: Phil Sutter <psutter@redhat.com> - 0.3-2
changelog:
  - Add missing build requirement: gcc.
  - Add source code patches to facilitate following changes.
  - Patches managed in git, so add git as another build requirement.
  - Respect build system compiler flags.
  - Use %make_build instead of plain make in %build.
  - Add %check target which performs unattended runtime test.
  - Use -D install flag instead of manual mkdir.


author: Phil Sutter <psutter@redhat.com> - 0.3-3
changelog:
  - Use %autosetup flag '-p1' instead of '-S git' to get rid of git dependency.
  - Use %license macro in %files section.
  - Added comment about included patches' upstream status.


author: Ana Cabral <acabral@redhat.com> - 1.26.0-2
changelog:
  - Add Conflicts tag because the bash-completion scripts moved
    from the main package to the utils sub package causing a file
    conflict on multilib systems between the old 32 bit main
    package and the new 64 bit utils sub package.


author: Martin Gansser <martinkg@fedoraproject.org> - 1:0.9.57-1
changelog:
  - Update to 0.9.57
  - Dropped dependency on libgcrypt
  - Dropped dependency on openssl
  - Update tarball link to "https:"
  - Add examples from doc/examples


author: Stephen Gallagher <sgallagh@redhat.com> - 2.5.0-2
changelog:
  - Fix memory corruption error using Module.search_rpms() from python
  - Speed up valgrind tests
  - Resolves: rhbz#1714766


author: Hangbin Liu <haliu@redhat.com> - 1.7-1
changelog:
  - Update to 1.7
  - libndp: apply filter to raw socket to only accept ND messages
  - libndp: move ndp_sock_{open,close}() after msg parsing functions
  - ndptool: Fix compilation on musl libc


author: Hangbin Liu <haliu@redhat.com> - 1.7-2
changelog:
  - ndptool: add -T target support (rhbz 1666194)
  - ndptool: fix target parameter typo (rhbz 1666194)
  - libndp: close sockfd after using to avoid handle leak (rhbz 1666194)
  - libndp: fix nd_msg typo when setting target address (rhbz 1666194)


author: Hangbin Liu <haliu@redhat.com> - 1.7-3
changelog:
  - ndptool: add -D dest support (rhbz 1697595)
  - ndptool: fix potential memory leak caused by strdup (rhbz 1697595)


author: Steve Dickson <steved@redhat.com> 2.3.3-59
changelog:
  - Covscan Scan: Wrong Check of Return Value (bz 2151966)
  - Covscan Scan: Clang (experimental) (bz 2151971)


author: Weitao Zhou <zhouwt@linux.alibaba.com> 2.3.3-59.0.1
changelog:
  - use extern in header files when declaring global variables for compatible gcc10 build
  - allow compilation to succeed with -fno-common
  - Add libuuid-devel buildrequires (wb-zh951434@alibaba-inc.com)
  - Disable v4client on loongarch platform (liwei.glw@alibaba-inc.com)


author: Phil Sutter <psutter@redhat.com> [1.1.4-2.el8]
changelog:
  - obj/ct_timeout: Fix NFTA_CT_TIMEOUT_DATA parser (Phil Sutter) [1758673]
  - set_elem: Validate nftnl_set_elem_set() parameters (Phil Sutter) [1758673]
  - obj/ct_timeout: Avoid array overrun in timeout_parse_attr_data() (Phil Sutter) [1758673]
  - set: Don't bypass checks in nftnl_set_set_u{32,64}() (Phil Sutter) [1758673]
  - obj/tunnel: Fix for undefined behaviour (Phil Sutter) [1758673]
  - set_elem: Fix return code of nftnl_set_elem_set() (Phil Sutter) [1758673]
  - obj: ct_timeout: Check return code of mnl_attr_parse_nested() (Phil Sutter) [1758673]


author: Phil Sutter <psutter@redhat.com> [1.1.5-2.el8]
changelog:
  - chain: Correctly check realloc() call (Phil Sutter) [1778952]
  - flowtable: Correctly check realloc() call (Phil Sutter) [1778952]
  - chain: Fix memleak in error path of nftnl_chain_parse_devs() (Phil Sutter) [1778952]
  - flowtable: Fix memleak in error path of nftnl_flowtable_parse_devs() (Phil Sutter) [1778952]


author: Phil Sutter <psutter@redhat.com> [1.1.5-3.el8]
changelog:
  - set_elem: Introduce support for NFTNL_SET_ELEM_KEY_END (Phil Sutter) [1795223]
  - set: Add support for NFTA_SET_DESC_CONCAT attributes (Phil Sutter) [1795223]
  - include: resync nf_tables.h cache copy (Phil Sutter) [1795223]


author: Phil Sutter <psutter@redhat.com> [1.1.5-5.el8]
changelog:
  - set: expose nftnl_set_elem_nlmsg_build() (Phil Sutter) [2040754]
  - expr: dynset: release stateful expression from .free path (Phil Sutter) [2040478]
  - set_elem: missing set and build for NFTNL_SET_ELEM_EXPR (Phil Sutter) [2040478]


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.3.0-4
changelog:
  - Python 2 binary package renamed to python2-libnl3
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Michal Ruprich <michalruprich@gmail.com> - 14:1.9.1-1
changelog:
  - Resolves: #1806422 - rebase libpcap to version 1.9.1
  - Resolves: #1743650 - [RFE] enable inbox support for sniffing offloaded (RDMA) traffic with tcpdump
  - Resolves: #1785330 - Invalid IPv4 addresses are accepted without reporting even a warning
  - Resolves: #1792208 - Resource exhaustion while PHB header length validation


author: Bastien Nocera <bnocera@redhat.com> - 1.22.0-6
changelog:
  + libpeas-1.22.0-6
  - Remove python2 loader, all GNOME apps using libpeas were ported to Python3
    when ported to GTK+ 3.x, and obsolete libpeas-loader-python
  - Resolves: #1559090


author: Dan Winship <danw@redhat.com> - 0.4.15-5.1
changelog:
  - Drop python2 subpackage (#1559092)
  - Drop PAC runner based on the "pacrunner" package (#1569023)
  - Replace pacrunner-crash-fix patch with version from RHEL7
  - Drop kde subpackage (#1538147)


author: Tomáš Mráz <tmraz@redhat.com> 1.4.4-1
changelog:
  - Translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer
  - pam_pwquality: Abort the retry loop if user requests it
  - Allow setting retry, enforce_for_root, and local_users_only options
    in the pwquality.conf config file


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1919026 libpwquaily rpm requires cracklib to function but RPM missing requirement [updated]


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.3-11
changelog:
  Correctly set socket directory permissions when
    qb_ipcs_connection_auth_set() is called
    Resolves: rhbz#1836146


author: Remi Collet <remi@remirepo.net> - 0.11.0-1
changelog:
  - update to 0.11.0
  - add patch to not install the static library, from
    https://github.com/alanxz/rabbitmq-c/pull/665


author: Nicola Sella <nsella@redhat.com> - 1.12.0-1
changelog:
  - Update to 1.12.0
  - Decode package URL when using for local filename (RhBug:1817130)
  - Fix memory leak in lr_download_metadata() and lr_yum_download_remote()
  - Download sources work when at least one of specified is working (RhBug:1775184)
  - Enable building on OSX


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.0-1
changelog:
  - Update to 1.14.0
  - Fix the key string parsing in url_substitution
  - When zchunk enabled and not using HTTP/S protocol, download the whole file (RhBug:1886706)
  - Add an option LRO_SSLVERIFYSTATUS to check TLS certificate revocation status (using OCSP stapling) (RhBug:1814383)
  - Fix: lr_perform() - Avoid 100% CPU usage
  - Add support for working with certificates used with proxy
  - Reposync does not re-download unchanged packages (RhBug:1931904)
  - Fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.2-1
changelog:
  - Update to 1.14.2
  - Reduce time to load metadata
  - Fix resource leaks and memory leaks
  - Remove build dependency on python3-flask


author: Lukas Hrazky <lhrazky@redhat.com> - 1.14.2-4
changelog:
  - Fix termination of va_list in lr_metadatatarget_append_error()
  - Detailed error message when using non-existing TMPDIR


author: Martin Kutlak <mkutlak@redhat.com> - 2.9.5-10
changelog:
  - reportclient: Search for required packages recursively
  - reportclient: Find and download required debuginfo packages
  - report-client: Find debuginfos in own method
  - Resolves: rhbz#1783897


author: Michal Židek <mzidek@redhat.com> - 2.9.5-12
changelog:
  - Resolves: rhbz#1835388 - abrt-addon-ccpp causes failures during openscap scans on CCE-27119-7
  - This is just libreport side (abrt also needs to be patched)


author: zhangbinchen <zhangbinchen@openanolis.org> - 2.9.5-15.0.1
changelog:
  - Disable centos sub package
  - Don't requires subscription for Anolis OS
  - Remove unused sub packages
  - cherry-pick [1acfc44 00b6684 2f29df5]


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-2.1
changelog:
  - Use Python distutils to install SELinux python bindings (#1719771)
  - Move  sefcontext_compile to -utils package (#1612518)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-6
changelog:
  - Describe fcontext regular expressions (#1904059)
  - Strip spaces before values in config (#2012145)


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-5
changelog:
  - Revert "genhomedircon: check usepasswd" (rhbz#1871786)
  - semanage.conf - improve usepasswd=False explanation (rhbz#1871786)
  - semanage.conf - expand list of ignoredirs (rhbz#1871786)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-7
changelog:
  - Trivial style fixes
  - Free contents of modkey in semanage_direct_remove
  - Fix USE_AFTER_FREE (CWE-672) in semanage_direct_write_langext()
  - add missing include to boolean_record.c
  - move module hashing into libsemanage
  - move compressed file handling into a separate object
  - clean up semanage_direct_commit() a bit
  - optionally rebuild policy when modules are changed externally
  - add command-line option to detect module changes (#2049186)


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-5
changelog:
  - cil: Create new keep field for type attribute sets
  - build: follow standard semantics for DESTDIR and PREFIX
  - cil: show an error when cil_expr_to_string() fails


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-6
changelog:
  - Prevent freeing unitialized value in ibendport handling
  - Add support for the SCTP portcon keyword
  - Export sepol_polcap_getnum/name functions


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-3
changelog:
  - cil: Fix out-of-bound read of file context pattern ending with "\"
  - cil: Destroy classperms list when resetting classpermission (#1983517)
  - cil: Destroy classperm list when resetting map perms (#1983521)
  - cil: cil_reset_classperms_set() should not reset classpermission (#1983525)
  - cil: Set class field to NULL when resetting struct cil_classperms
  - cil: More strict verification of constraint leaf expressions
  - cil: Exit with an error if declaration name is a reserved word
  - cil: Allow permission expressions when using map classes
  - cil: Reorder checks for invalid rules when building AST
  - cil: Cleanup build AST helper functions
  - cil: Create new first child helper function for building AST
  - cil: Remove unused field from struct cil_args_resolve
  - cil: Destroy disabled optional blocks after pass is complete
  - cil: Check if name is a macro parameter first
  - cil: fix NULL pointer dereference in __cil_insert_name
  - cil: Report disabling an optional block only at high verbose levels
  - cil: Use AST to track blocks and optionals when resolving
  - cil: Reorder checks for invalid rules when resolving AST
  - cil: Sync checks for invalid rules in booleanifs
  - cil: Check for statements not allowed in optional blocks (#1983530)


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.17-1
changelog:
  - Update to 0.7.17
  - selected bug fixes:
    * repo_write: fix handling of nested flexarray
    * improve choicerule generation a bit more to cover more cases
    * harden testcase parser against repos being added too late
    * support python-3.10
    * check /var/lib/rpm macro in rpmdb code
  - new features:
    * handle default/visible/langonly attributes in comps parser
    * support multiple collections in updateinfo parser
    * add '-D' option in rpmdb2solv to set the dbpath


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.19-1
changelog:
  - Update to 0.7.19
  - repo_add_conda: add flag to skip v2 packages
  - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt
  - fix error handling in solv_xfopen_fd()
  - fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Jaroslav Rohel <jrohel@redhat.com> - 0.7.20-5
changelog:
  - Backport Treat condition both as positive and negative literal in pool_add_pos_literals_complex_dep
    (RhBug:2185061,2190136)


author: Milan Crha <mcrha@redhat.com> - 2.62.2-1
changelog:
  - Update to 2.62.2
  - Backport upstream patch for CVE-2018-12910 - Crash in soup_cookie_jar.c:get_cookies() on empty hostnames


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-1
changelog:
  - Fix CVE-2021-3634: Fix possible heap-buffer overflow when
    rekeying with different key exchange mechanism
  - Rebase to version 0.9.6
  - Rename SSHD_EXECUTABLE to SSH_EXECUTABLE in tests/torture.c
  - Resolves: rhbz#1896651, rhbz#1994600


author: Norbert Pocs <npocs@redhat.com> - 0.9.6-6
changelog:
  - Enable client and server testing build time
  - Fix failing rekey test on arch s390x
  - Resolves: rhbz#2126342


author: Liwei Ge <liwei.glw@alibaba-inc.com> - 0.9.6-7
changelog:
  - NULL pointer dereference during rekeying with algorithm guessing (CVE-2023-1667)
  - authorization bypass in pki_verify_data_signature (CVE-2023-2283)


author: Tony Asleson <tasleson@redhat.com> - 1.9.1-7
changelog:
  - Remove valgrind dependency as not being used and causing
    build to fail as it pulls in python3.11


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.18.2
changelog:
  - Obsolete the python2 packages on upgrade
  - Resolves: rhbz#1567138 - libtdb: Drop Python 2 subpackage from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 1.4.2-2
changelog:
  - Resolves: rhbz#1754420 - Rebase libtdb 1.4.2 for samba
  - Related: rhbz#1754420 - Fix sssd tests (tdb)


author: Xin Long <lxin@redhat.com> - 1.29-1
changelog:
  - man teamd.conf: update some parameter default values [1732587]
  - 1.29 release
  - teamd: add port_master_ifindex_changed for link_watch_port_watch_ops
  - initscripts: fix if/fi align
  - teamd: fix a json object memleak in get_port_obj() [1767685]
  - libteam: set netlink event socket as non-blocking [1684389]
  - libteam: double NETLINK_RCVBUF to fix -ENOMEM error
  - teamd: add a default value 1000 for link_watch.interval


author: Xin Long <lxin@redhat.com> - 1.29-2
changelog:
  - teamd/lacp: fix segfault due to NULL pointer dereference [1758073]
  - teamd: fix build error in expansion of macro teamd_log_dbgx [1758073]
  - teamd: update ctx->hwaddr after setting team dev to new hwaddr
  - libteam: wapper teamd_log_dbg with teamd_log_dbgx [1758073]


author: Xin Long <lxin@redhat.com> - 1.31-1
changelog:
  - 1.31 release
  - utils/bond2team: remove TYPE in ifcfg file [1858518]
  - utils/bond2team: keep delivering config to file if stdout not supplied [1858518]
  - teamd/lacp: silence ignore none LACP frames
  - Send LACP PDU right after the Actor state has been changed
  - Skip setting the same hwaddr to a lag port if not needed
  - Make all netlink socket RCVBUF sizes configurable
  - Don't return an error when timerfd socket return 0
  - Fix ifinfo_link_with_port race condition with newlink
  - teamd: fix possible race in master ifname callback
  - 1.30 release
  - teamd: Disregard current state when considering port enablement [1851460]


author: Xin Long <lxin@redhat.com> - 1.31-4
changelog:
  - teamd: do no remove the ports on shutdown with -N [2148856]
  - teamd: stop iterating callbacks when a loop restart is requested [2148855]


author: Jakub Hrozek <jhrozek@redhat.com> - 0.9.39-1
changelog:
  - Resolves: #1684580 - Rebase libtevent to version 0.9.36 for Samba
  - Resolves: #1597318 - libtevent uses Python 2 to build
  - Resolves: #1567139 - libtevent: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com>
changelog:
  - Remove the python2 subpackages on upgrade
  - Resolves: #1567139 - libtevent: Drop Python 2 subpackage from RHEL 8


author: Isaac Boukris <iboukris@redhat.com> - 0.10.0-2
changelog:
  - Resolves: #1754421 - Upgrade tevent to 0.10.0 version for samba
  - Related: #1754421 - Fix sssd tests (tevent)


author: Tom Stellard <tstellar@redhat.com> - 1.2.6-2
changelog:
  - Add BuildRequires: gcc
  - https://docs.fedoraproject.org/en-US/packaging-guidelines/C_and_C++/#_packaging


author: Pavel Raiskup <praiskup@redhat.com> - 2.4.6-23
changelog:
  - bake in versioned requirement on automake (rhbz#1193591)
  - fix testsuite FTBFS against automake 1.16.1
  - bypass -specs=* to gcc (rhbz#985592)


author: Jeff Moyer <jmoyer@redhat.com> - 1.0.7-2.el8
changelog:
  - Fix versioning.  The installed library is 1.0.7, make the rpm match.
  - bump release number for build, which includes -fPIC fix
  - Related: rhbz#1862551


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-16
changelog:
  - Use 2048bit keys in tests
  - Resolves: rhbz#1611729 - [RHEL8-S-BUILD] libuser Fails Scratch Build on rhel-8.0


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-17
changelog:
  - Resolves: rhbz#1558151 - libuser needs audit events around the account
                             lifecycle


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-19
changelog:
  - Resolves: rhbz#1602600 -  Please review important issues found by covscan
                              in "libuser-0.62-14.el8+7" package


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-20
changelog:
  - Resolves: rhbz#1637398 - libuser-python3 should be renamed to comply
                             with Packaging Guidelines


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-23
changelog:
  - Actually apply the patch from the previous build
  - Resolves: rhbz#1670997 - Amend the user lifecycle auditing


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.1.6-14
changelog:
  - build with hardening LDFLAGS (#1548717)
  - remove obsolete macro and comments
  - add gcc to build requirements


author: Harald Hoyer <harald@redhat.com> - 16-1
changelog:
  - libvarlink 16
  - fixed coverity issues
  - Resolves: #1638294 - Interface name validation rule update


author: Michel Alexandre Salim <salimma@centosproject.org> - 1.5.1-1
changelog:
  - Rebase to the latest upstream version
  - Enable optional gz, xz/lzma, and lz4 support in the zstd tool
  - Disable amd64 assembly on non-x86_64 architectures (rhbz#2035802)
    this should avoid the issue where an executable stack is created
  - Re-enable CET protections (rhbz#2039353)
    Resolves: rhbz#2039488


author: Xin Long <lxin@redhat.com> - 1.0.18-3
changelog:
  - Added a patch to fix netinet/sctp.h not to be installed.
  - Added some fixes for kernel feature detection.


author: Aaron Conole <aconole@redhat.com> - 1.0.1-14.git036e314
changelog:
  - Update to branch-1.1 compatibility
  - Fixes to avoid assert in the agent state machine
  - Remove the memory constraint on the event socket buffer (#1554110)


author: Artem Egorenkov <aegorenk@redhat.com> - 3.6.0-7
changelog:
  - New flag for no sensors added. This flag is used in VM environment
    to make sensors binaries not fail if no sensors was detected.


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.0.4-0.27.20111007git
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
  - Explicitly include <sys/sysmacros.h> due to glibc-headers changes.
  Definition of major and minor macros is no longer transitively included
  through <sys/types.h>, hence make it explicit.
  Ref:
  https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=NEWS;hb=HEAD


author: Kamil Dudka <kdudka@redhat.com> - 3.14.0-3
changelog:
  - fix programming mistakes detected by Coverity Analysis
  - document the --version option in the logrotate(8) man page (#1611498)


author: Kamil Dudka <kdudka@redhat.com> - 3.14.0-4
changelog:
  - logrotate.8: encourage admins to use the `su` directive (#1759770)
  - do not abort globbing on broken symlink (#1723265)


author: Frank Crawford <frank@crawford.emu.id.au> - 7.5.4-2
changelog:
  - Add requires for perl-diagnostics (#1893671) and perl-lib (#1893503)
  - Add other requires as nothing is now automatically supplied


author: Lianbo Jiang <lijiang@redhat.com> - B.02.18-22
changelog:
  - Display proper logical name of network device
  - Resolves: rhbz#1724087
  - Add DIMM running speed and Print dimm rank information
  - Resolves: rhbz#1725199


author: Jan Rybar <jrybar@redhat.com> - 4.93.2-1
changelog:
  - Rebase to lsof-4.93.2
  - Upstream moved to GitHub (original unreachable) and tarball structure changed
  - Manpage patch needed to reflect the tarball changes
  - Resolves: rhbz#1778228


author: Tomas Bzatek <tbzatek@redhat.com> - 0.32-1
changelog:
  - Upgrade to 0.32 upstream snapshot (#1855766)
  - Fix NVMe device parsing (#1687841, #1845977)
  - Fix WWN string reporting (#1846559)
  - Implement SCSI identifier sort priority (#1846566)


author: Gao Xiang <hsiangkao@linux.alibaba.com> - 1.9.4-1
changelog:
  - Update to 1.9.4 in sync with Anolis 23
  - Switch back from Meson since its version is too low on Anolis 8.


author: Robert Scheck <robert@fedoraproject.org> - 1.03-13
changelog:
  - Added patch by Khem Raj to use static inlines as the external
    inline definition has changed with GCC 5 (to fix ppc64 builds)


author: Patsy Griffin Franklin <pfrankli@redhat.com> 1:4.2.1-7
changelog:
  - Fix build failure caused by automake versioning differences related
    to the glob changes. (#1589769)
  - Fix testing failure due to Perl changes related to expanding paths.


author: Nikola Forró <nforro@redhat.com> - 2.7.6.1-18
changelog:
  - schedule interrupted cache update for the next boot, instead of blocking
    system reboot/shutdown
    resolves #1874010


author: Nikola Forró <nforro@redhat.com> - 4.15-7
changelog:
  - remove rpc.3 and xdr.3 man pages documenting deprecated glibc RPC implementation
    resolves: #1980919


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-2
changelog:
  - Revert "mcstransd select correct colour range." (#1731451)
  - Fix mcstrans secolor examples (#1731451)


author: Xiao Ni <xni@redhat.com> - 4.2-6
changelog:
  - Keep udev rule close to upstream and update to latest upstream
  - Resolves rhbz#1991596, rhbz#2129088, rhbz#2107150


author: Xiao Ni <xni@redhat.com> - 4.2-7
changelog:
  - Update to latest to upstream to fix some bugs
  - Resolves rhbz#2149307, rhbz#2149473, rhbz#2151208, rhbz#2127096


author: Xiao Ni <xni@redhat.com> - 4.2-9
changelog:
  - Update to latest upstream and fix mdcheck service bug
  - Resolves rhbz#2116418, rhbz#2150862, rhbz#2159584


author: Ales Matej <amatej@redhat.com> - 3.4.0-1
changelog:
  - Update to 3.4.0
  - Fix: do not download metadata in remove command
  - Add reinstall command
  - Add "--setopt=tsflags=test" support
  - Add "--setopt=reposdir=<path>" and "--setopt=varsdir=<path1>,<path2>,..." support
  - Add "--config=<path_to_config_file>" support
  - Add "--disableplugin", "--enableplugin" support (RhBug:1781126)
  - Add "--noplugins" support
  - Add "--setopt=cachedir=<path_to_cache_directory>" support
  - Add "--installroot=<path_to_installroot_directory>" support
  - Add "--refresh" support
  - Support "install_weak_deps" conf option and "--setopt=install_weak_deps=0/1"
  - Respect reposdir from conf file
  - Respect "metadata_expire" conf file opton (RhBug:1771147)
  - [repolist] Print padding spaces only if output is terminal


author: Nicola Sella <nsella@redhat.com> - 3.4.0-3
changelog:
  - Patch: Add support for setting a platform module ID
  - Rename "update" command to "upgrade", "update" remain as compatibility alias


author: Pavla Kratochvilova <pkratoch@redhat.com> - 3.8.0-1
changelog:
  - Update to 3.8.0
  - Don't set default value of "assumeyes" to TRUE
  - Support for user confirmation and assumeyes, assumeno, defaultyes
  - Add commands: distro-sync, makecache
  - Add subcommands support
  - Add support for command aliases
  - Added alias "update" to "upgrade" command
  - Relicense to GPLv2+
  - Add support for setting allow_vendor_change
  - [download] Support for "--resolve", "--alldeps" and "--archlist=" arguments
  - [download] several optimizations
  - Support "--setopt=keepcache=0/1"
  - Extend "--setopt" to support repository options


author: Michal Hlavinka <mhlavink@redhat.com> 56-1
changelog:
  - Upgrade to 56 (#1479800)
  - fixes wait exit codes of co-processes when run in interactive mode (#1479320)


author: Michal Sekletar <msekleta@redhat.com> - 0.26-14
changelog:
  - start timer after the installation (#1278587)
  - make mlocate-updatedb.service of the type simple, systemd will then not wait for its completion (#1282232)


author: Javier Martinez Canillas <javierm@redhat.com> - 0.3.0-10
changelog:
  - Add mokutil code to consume data from /sys/firmware/efi/mok-variables/
    as well as attempting to consume numbered mok variables from efivarfs
    when mok-variables aren't present (pjones)
    Resolves: rhbz#1907418


author: Liu Xiaoping <lxp01404969@alibaba-inc.com> - 0.3.0-12.0.1
changelog:
  - Modify the WARNINGFLAGS for loongarch64 (zhangwenlong@loongson.cn)
  - Add loongarch64 in ExclusiveArch (gongwen@nfschina.com)
  - Fix build error by koji (jacob.wang@openanolis.org)


author: James Paul Turner <jamesturner246@fedoraproject.org> - 3.1.6-1
changelog:
  - Update to MPFR version 3.1.6
  - Use autosetup specfile macro for applying patches (patches 1 and 2 applied)
  - Removed iconv calls, as they were breaking .info files, which are now unicode
    resolves #1299649
  - Other minor cleanups
  - BuildRequire gcc per https://fedoraproject.org/wiki/Packaging:C_and_C%2B%2B#BuildRequires_and_Requires


author: Pavel Cahyna <pcahyna@redhat.com> - 4.0.18-15
changelog:
  - Add dependency on glibc-gconv-extra
    mtools need codepage 850, which was split from glibc into a subpackage.
    (Fedora bug #2021637, RHEL bug #2073842)


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-5.20180224
changelog:
  - fix crash in parsing of terminfo use capability (CVE-2018-10754)
  - add gcc-c++ to build requirements


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-8.20180224
changelog:
  - fix buffer overflow in terminfo entry hashtable (CVE-2019-17594)
  - handle missing character after backslash in terminfo entry (CVE-2019-17595)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-19
changelog:
  - revert permission of config files to 600 (#1601060)
  - fix error message when the address specified by clientaddr option
    is wrong or cannot be bound (#1877375)
  - log error with /proc/net/if_inet6 only when IPv6 is enabled (#1824367)
  - fix issue with quoting empty passphrase (#1817225)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-21
changelog:
  - prevent parsing IP address twice (#1768908)
  - add support for digests detected from ECC certs (#1919714)
  - fix broken ErrorMsg at ucd-snmp (#1933150)
  - add support for intermediate certs (#1914656)
  - fix crash of certs with longer extension (#1908718)


author: Josef Ridky <jridky@redhat.com> - 1:5.8-27
changelog:
  - fix memory leak due of proc file creating (#2105957)
  - fix CVE-2022-44792 and CVE-2022-44793 (#2141901) and (#2141905)
  - fix memory leak when ipv6 disable set to 1 (#2151537)
  - fix proxy timeout issue (#2160723)


author: Michal Ruprich <mruprich@redhat.com> - 2.0-0.50.20160912git
changelog:
  - Resolves: 1557470 - netstat -i cut's interface names
  - Resolves: 1566084 - netstat -agn only shows 10 character interface name for IPv4 addressing


author: Michal Ruprich <michalruprich@gmail.com> - 2.0-0.52.20160912git
changelog:
  - Resolves: #1711119 - netstat says "packetes" instead of "packets"
  - Resolves: #1670355 - Exit code on wrong parameter is zero for many net-tools binaries
  - Resolves: #1807989 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: Tomáš Mráz <tmraz@redhat.com> - 3.4-4
changelog:
  - Cover the gaps in annotation coverage for assembler sources
  - Add .hmac checksums for FIPS mode integrity checking


author: Daiki Ueno <dueno@redhat.com> - 3.4.1-5
changelog:
  - Backport powerpc64 optimization patches from upstream (#1855228)
    Patch from Christopher M. Riedl.


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.52.20-4
changelog:
  - Python 2 binary package renamed to python2-newt
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-8
changelog:
  - rename newt-python3 subpackage to python3-newt
  - build python3 subpackage unconditionally
  - don't use unversioned python_sitearch macro
  - drop static subpackage
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - fix description of python2-newt


author: Miroslav Lichvar <mlichvar@redhat.com> - 0.52.20-10
changelog:
  - move snack provides to python3-newt subpackage (#1640153)
  - fix radio button selection check in snack (#1714517)


author: Steve Dickson <steved@redhat.com> 0.3.5-2
changelog:
  - nfs4_getfacl: Add new option -c/--omit-header (bz 1698281)
  - nfs4_setfacl: Skip comment field while reading ACE(s) (bz 1687299)


author: Phil Sutter <psutter@redhat.com> [0.9.3-17.el8]
changelog:
  - json: don't leave dangling pointers on hlist (Phil Sutter) [1900565]
  - json: Fix seqnum_to_json() functionality (Phil Sutter) [1900565]
  - json: echo: Speedup seqnum_to_json() (Phil Sutter) [1900565]
  - proto: Fix ARP header field ordering (Phil Sutter) [1896334]
  - proto: add sctp crc32 checksum fixup (Phil Sutter) [1895804]
  - mergesort: unbreak listing with binops (Phil Sutter) [1891790]
  - evaluate: missing datatype definition in implicit_set_declaration() (Phil Sutter) [1877022]
  - evaluate: Perform set evaluation on implicitly declared (anonymous) sets (Phil Sutter) [1877022]
  - src: store expr, not dtype to track data in sets (Phil Sutter) [1877022]


author: Phil Sutter <psutter@redhat.com> [0.9.3-19.el8]
changelog:
  - evaluate: Reject quoted strings containing only wildcard (Phil Sutter) [1818117]
  - tests: monitor: use correct $nft value in EXIT trap (Phil Sutter) [1919203]
  - monitor: Fix for use after free when printing map elements (Phil Sutter) [1919203]
  - tests: Disable tests known to fail on RHEL8 (Phil Sutter) [1919203]


author: Phil Sutter <psutter@redhat.com> [0.9.3-20.el8]
changelog:
  - src: Optimize prefix matches on byte-boundaries (Phil Sutter) [1934926]
  - src: Support odd-sized payload matches (Phil Sutter) [1934926]
  - spec: Add an rpminspect.yaml file to steer rpminspect (Phil Sutter) [1962184]
  - spec: Explicitly state dist string in Release tag (Phil Sutter) [1962184]


author: Phil Sutter <psutter@redhat.com> [0.9.3-21.el8]
changelog:
  - tests: shell: Fix bogus testsuite failure with 100Hz (Phil Sutter) [1919203]
  - doc: nft.8: Extend monitor description by trace (Phil Sutter) [1820365]
  - include: missing sctp_chunk.h in Makefile.am (Phil Sutter) [1979334]
  - exthdr: Implement SCTP Chunk matching (Phil Sutter) [1979334]
  - scanner: sctp: Move to own scope (Phil Sutter) [1979334]
  - scanner: introduce start condition stack (Phil Sutter) [1979334]
  - json: Simplify non-tcpopt exthdr printing a bit (Phil Sutter) [1979334]
  - json: tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcpopt: allow to check for presence of any tcp option (Phil Sutter) [1979334]
  - tcpopt: split tcpopt_hdr_fields into per-option enum (Phil Sutter) [1979334]
  - tcpopt: rename noop to nop (Phil Sutter) [1979334]
  - tcpopts: clean up parser -> tcpopt.c plumbing (Phil Sutter) [1979334]
  - parser: merge sack-perm/sack-permitted and maxseg/mss (Phil Sutter) [1979334]
  - tests/py: Move tcpopt.t to any/ directory (Phil Sutter) [1979334]


author: Phil Sutter <psutter@redhat.com> [0.9.3-22.el8]
changelog:
  - json: Drop pointless assignment in exthdr_expr_json() (Phil Sutter) [1999059]
  - parser_json: Fix for memleak in tcp option error path (Phil Sutter) [1999059]
  - parser_bison: Fix for implicit declaration of isalnum (Phil Sutter) [1999059]
  - parser_json: Fix error reporting for invalid syntax (Phil Sutter) [1994141]


author: Phil Sutter <psutter@redhat.com> [0.9.3-23.el8]
changelog:
  - tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set") (Phil Sutter) [1908127]
  - segtree: Fix segfault when restoring a huge interval set (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-24.el8]
changelog:
  - tests: shell: better parameters for the interval stack overflow test (Phil Sutter) [1908127]
  - tests: shell: $NFT needs to be invoked unquoted (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-25.el8]
changelog:
  - mnl: do not build nftnl_set element list (Phil Sutter) [2047821]
  - tests: py: add dnat to port without defining destination address (Phil Sutter) [2030773]
  - evaluate: fix inet nat with no layer 3 info (Phil Sutter) [2030773]
  - evaluate: attempt to set_eval flag if dynamic updates requested (Phil Sutter) [2039594]
  - src: support for restoring element counters (Phil Sutter) [2039594]
  - netlink: remove unused parameter from netlink_gen_stmt_stateful() (Phil Sutter) [2039594]


author: Phil Sutter <psutter@redhat.com> [0.9.3-26.el8]
changelog:
  - libnftables: call nft_cmd_expand() only with CMD_ADD (Phil Sutter) [2073287]
  - src: add CMD_OBJ_SETELEMS (Phil Sutter) [2073287]
  - src: rename CMD_OBJ_SETELEM to CMD_OBJ_ELEMENTS (Phil Sutter) [2073287]
  - rule: fix element cache update in __do_add_setelems() (Phil Sutter) [2073287]
  - rule: memleak in __do_add_setelems() (Phil Sutter) [2073287]
  - tests: shell: auto-removal of chain hook on netns removal (Phil Sutter) [2070924]
  - mnl: do not use expr->identifier to fetch device name (Phil Sutter) [2070924]


author: Filip Januš <fjanus@redhat.com> - 3.1-4
changelog:
  - addiing: recommending to install 32 bit-version if 32 bit glibc is installed
  - resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1803161


author: Filip Januš <fjanus@redhat.com> - 3.1-7
changelog:
  - improve recommandation of 32 bit-version
  - resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1803161


author: Than Ngo <than@redhat.com> - 3.18.0-1
changelog:
  - Resolves: #2043845, rebase to 3.18.0
  - Resolves: #2043854, add crypto counters
  - Resolves: #2043855, support crypto profiles


author: Than Ngo <than@redhat.com> - 3.18.0-3
changelog:
  - Related: #2043854, do not touch opencryptoki.conf if it is in place already and even if it is unchanged
  - Resolves: #2112785, EP11: Fix C_GetMechanismList returning CKR_BUFFER_TOO_SMALL


author: Than Ngo <than@redhat.com> - 3.19.0-1
changelog:
  - Resolves: #2126612, opencryptoki fails after generating > 500 RSA keys
  - Resolves: #2110315, rebase to 3.19.0
  - Resolves: #2110990, openCryptoki key generation with expected MKVP only on CCA and EP11 tokens
  - Resolves: #2110477, openCryptoki ep11 token: master key consistency
  - Resolves: #1984871, openCryptoki ep11 token: vendor specific key derivation


author: Michael Petlan <mpetlan@redhat.com> - 1.0.0-5
changelog:
  - Added some linker hardening flags to pass annocheck
    Related: rhbz#2031802

    * Tue Dec 14 2021 Michael Petlan <mpetlan@redhat.com> - 1.0.0-5
  - Added gating
    Related: rhbz#2031794


author: Michael Petlan <mpetlan@redhat.com> - 1.2.0-2
changelog:
  - Update to upstream 1.2.0 -- fix opencsd_tag
    Related: rhbz#2041578

    * Fri Jan 21 2022 Michael Petlan <mpetlan@redhat.com> - 1.2.0-1
  - Update to upstream 1.2.0
    Related: rhbz#2041578


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-3
changelog:
  - Unbreak the RSA-PSS mechanisms (#1595626)
  - Unbreak the signing using hashed mechanisms in CardOS and others (#1644338)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-4
changelog:
  - Unbreak the Dual CAC cards in PIV driver (#1651748)
  - Fix few more corner cases for handling different types of padding (#1595626)
  - Unbreak signature verification in pkcs11-tool (#1651748)


author: Jakub Jelen <jjelen@redhat.com> - 0.19.0-6
changelog:
  - Add support for Gemalto IDPrime smart cards (#1657970)
  - Fix 2k RSA key operations with Coolkey (#1766712)


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-3
changelog:
  - Support PIN change for HID Alt tokens (#1830901)
  - Fix CVE-2020-26570, CVE-2020-26571 and CVE-2020-26572
  - Fix right padding of token labels of some cards (#1877973)


author: Zoltan Fridrich <zfridric@redhat.com> - 8.0p1-14
changelog:
  - Upstream: add a local implementation of BSD realpath() for sftp-server (#2064249)
  - Change product name from Fedora to RHEL in openssh-7.8p1-UsePAM-warning.patch (#1953807)
  - Include caveat for crypto-policy in sshd manpage (#2044354)
  - Change log level of FIPS specific log message to verbose (#2050511)
  - Clarify force_file_perms (-m) documentation in sftp-server manpage (#1862504)
  - Minimize the use of SHA1 as a proof of possession for RSA key (#2093897)


author: Dmitry Belyavskiy - 8.0p1-17
changelog:
  - Fix parsing of IPv6 IPs in sftp client (#2151334)
  - Avoid ssh banner one-byte overflow (#2138344)
  - Avoid crash of sshd when Include folder does not exist (#2133087)


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 8.0p1-17.0.1
changelog:
  - seccomp: Allow check_nanosleep to better compatibility for both glibc2.28 and glibc2.32
  - Support loongarch64 seccomp_filter sandbox (xuezhixin@uniontech.com)
  - another case where a utimes() failure could make scp send (jiang.yong5@zte.com.cn)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-5
changelog:
  - Fixes CVE-2021-3712 openssl: Read buffer overruns processing ASN.1 strings
  - Resolves: rhbz#2005402


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067146


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-7
changelog:
  - Fix CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
    Resolves: CVE-2022-2097
  - Update expired certificates used in the testsuite
    Resolves: rhbz#2092462
  - Fix CVE-2022-1292: openssl: c_rehash script allows command injection
    Resolves: rhbz#2090372
  - Fix CVE-2022-2068: the c_rehash script allows command injection
    Resolves: rhbz#2098279


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-9
changelog:
  - Fixed Timing Oracle in RSA Decryption
    Resolves: CVE-2022-4304
  - Fixed Double free after calling PEM_read_bio_ex
    Resolves: CVE-2022-4450
  - Fixed Use-after-free following BIO_new_NDEF
    Resolves: CVE-2023-0215
  - Fixed X.400 address type confusion in X.509 GeneralName
    Resolves: CVE-2023-0286


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.8-1
changelog:
  - Update to 0.4.8-1
  - RSA key generation on the token
  - RSA-OAEP and RSA-PKCS encryption support
  - RSA-PSS signature support
  - Support for OpenSSL 1.1.1 beta
  - Removed support for OpenSSL 0.9.8
  - Various bug fixes and enhancements


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.8-2
changelog:
  - Require OpenSSL >= 1.0.2
  - Fixed missing declaration of ERR_get_CKR_code()
  - Add support to use EC keys and tests (#1625338)
  - Exposed check_fork() API
  - Fixed memory leak of RSA objects in pkcs11_store_key()
  - Updated OpenSSL license in eng_front.c
  - Fixed build for old C dialects
  - Allow engine to use private key without PIN
  - Require DEBUG to be defined to print debug messages
  - Changed package description


author: Anderson Sasaki <ansasaki@redhat.com> - 0.4.10-1
changelog:
  - Update to 0.4.10 (#1745082)
  - Add BuildRequires for OpenSSL >= 1.0.2, required for testing
  - Print tests logs if failed during build
  - Small bug fixes such as removal of unused variable
  - Search objects in all matching tokens (#1705505)


author: Neal Gompa <ngompa13@gmail.com> - 1.74-1
changelog:
  - Update to upstream version 1.74
  - Drop merged patches
  - Rediff remaining patches
  - Move newns to /usr/libexec/os-prober (debuginfo generation works)
  - Mark copyright file as license file


author: Peter Jones <pjones@redhat.com> - 1.74-7
changelog:
  - Make gcc use -Wl,-z,now -Wl,-z,relro -pie.  Dunno why the default didn't
    pick this up.
    Resolves: rhbz#1624158


author: Daiki Ueno <dueno@redhat.com> - 0.23.21-4
changelog:
  - Fix realloc usage on proxy cleanup (#1894979)
  - Make 'trust anchor --store' preserve all attributes from .p11-kit files


author: Daiki Ueno <dueno@redhat.com> - 0.23.22-1
changelog:
  - Rebase to 0.23.22 to fix memory safety issues (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363)
  - Preserve DT_NEEDED information from the previous version, flagged by rpmdiff
  - Add xsltproc to BR


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-17
changelog:
  - pam_keyinit: thread-safe implementation. Resolves: #1997969
  - pam_motd: support multiple motd paths specified, with filename overrides. Resolves: #2014458


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-19
changelog:
  - Add the motd.d directories (empty) to silence warnings and to
    provide proper ownership for them. Resolves: #2014458


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.3.1-25
changelog:
  - pam_motd: avoid unnecessary logging. Resolves: #2091062
  - pam_lastlog: check localtime_r() return value. Resolves: #2012871
  - pam_faillock: clarify missing user faillock files after reboot. Resolves: #2062512
  - pam_faillock: avoid logging an erroneous consecutive login failure message. Resolves: #2082442


author: Brian C. Lane <bcl@redhat.com> - 3.2-33
changelog:
  - Switch gpt-header-move and msdos-overlap to python3 (bcl)
    Resolves: rhbz#1595810
  - Modify gpt-header-move and msdos-overlap to work with py2 or py3 (bcl)
    Related: rhbz#1595810


author: Brian C. Lane <bcl@redhat.com> - 3.2-34
changelog:
  - Fix the length of several strncpy calls (bcl)
    Related: rhbz#1602652
  - parted.c: Always free peek_word (bcl)
    Related: rhbz#1602652
  - parted.c: Make sure dev_name is freed (bcl)
    Related: rhbz#1602652
  - t6100-mdraid-partitions: Use v0.90 metadata for the test (bcl)
  - Fix msdos-overlap to work correctly with py2 or py3 (bcl)
    Related: rhbz#1595810


author: Brian C. Lane <bcl@redhat.com> - 3.2-35
changelog:
  - Use python3-devel in buildroot
    Resolves: rhbz#1615576
  - linux.c: Use sys/sysmacros.h for major/minor
    Resolves: rhbz#1615592


author: Brian C. Lane <bcl@redhat.com> - 3.2-37
changelog:
  - Add CI tests
    Resolves: rhbz#1653912
  - t6000-dm: Stop using private lvm root
    Related: rhbz#1653912


author: Brian C. Lane <bcl@redhat.com> - 3.2-39
changelog:
  - tests: Add a test for resizepart on a busy partition (bcl)
    Related: rhbz#1861804
  - parted: Preserve resizepart End when prompted for busy partition (bcl)
    Resolves: rhbz#1861804
  - Fix end_input usage in do_resizepart (bcl)
    Related: rhbz#1861804
  - tests: Test incomplete resizepart command (bcl)
    Related: rhbz#1861804
  - Fix resizepart iec unit end sector (psusi)
    Related: rhbz#1861804
  - libparted: Fix endian bug in bsd.c (AWilcox)
    Resolves: rhbz#1980105


author: Than Ngo <than@redhat.com> - 2.7.6-10
changelog:
  - CVE-2019-13636 , Don't follow symlinks unless --follow-symlinks is given
  - Resolves: #1665928, patch has a huge error output and segfaults when the file to be patched does not exist


author: Michal Hlavinka <mhlavink@redhat.com> - 3.7.0-1
changelog:
  - pciutils updated to 3.7.0, add support for basic DVSEC and CXL DVSEC (#1856436)
  - add support for RCEC Associated Endpoint (#1856440)


author: Petr Pisar <ppisar@redhat.com> - 8.41-6
changelog:
  - Fix returning unset groups in POSIX interface if REG_STARTEND has a non-zero
    starting offset (upstream bug #2244)


author: Petr Pisar <ppisar@redhat.com> - 8.42-2
changelog:
  - Fix handling UTF and start-of-pattern options in C++ wrapper
    (upstream bug #2283)
  - Fix an error message and locale handling in pcregrep tool


author: Petr Pisar <ppisar@redhat.com> - 8.42-3
changelog:
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256
    (bug #1619228)


author: Petr Pisar <ppisar@redhat.com> - 8.42-5
changelog:
  - Fix CVE-2019-20838 (a subject buffer overread in JIT when UTF is disabled
    and \X or \R has a greater than 1 fixed quantifier) (bug #1852252)
  - Fix CVE-2020-14155 (an integer overflow when parsing numbers after "(?C"))
    (bug #1851552)


author: Petr Pisar <ppisar@redhat.com> - 10.31-6
changelog:
  - Fix global search/replace in pcre2test and pcre2_substitute() when the pattern
    matches an empty string, but never at the starting offset


author: Petr Pisar <ppisar@redhat.com> - 10.31-7
changelog:
  - Fix checking that a lookbehind assertion has a fixed length if the
    lookbehind assertion is used inside a lookahead assertion
  - Fix parsing VERSION conditions


author: Petr Pisar <ppisar@redhat.com> - 10.31-8
changelog:
  - Fix backtracking atomic groups when they are not separated by something with
    a backtracking point


author: Petr Pisar <ppisar@redhat.com> - 10.31-9
changelog:
  - Recognize all Unicode space characters with /x option in a pattern
    (bug #1617960)
  - Fix changing dynamic options (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 255,
    (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256,
    (bug #1617960)


author: Petr Pisar <ppisar@redhat.com> - 10.32-1
changelog:
  - 10.32 bump (bug #1628200)
  - Fix a subject buffer overread in JIT when UTF is disabled and \X or \R has
    a greater than 1 fixed quantifier (bug #1628200)
  - Fix matching a zero-repeated subroutine call at a start of a pattern
    (bug #1628200)
  - Fix heap limit checking overflow in pcre2_dfa_match() (bug #1628200)


author: Jakub Jelen <jjelen@redhat.com> - 1.9.5-1
changelog:
  - Rebase to 1.9.5 version to address race conditions (#2014641)
  - Drop dowstream polkit policy to avoid repeated authentication requests in remote sessions (#1928154)


author: Paul Howarth <paul@city-fan.org> - 1.1903-1
changelog:
  - Update to 1.1903
    - Fix documentation typos (CPAN RT#84981)
    - Add -w and -i switches to diffnew.pl (CPAN RT#69945)
    - Remove Algorithm::DiffOld from the index; the module is still distributed
      with Algorithm::Diff, but is not indexed on CPAN because this is an
      ***UNAUTHORIZED*** release of Algorithm::DiffOld
  - Add patch to generate provide for perl(Algorithm::DiffOld)
  - Drop %defattr, redundant since rpm 4.4
  - General spec tidy-up


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.54-6
changelog:
  - Adjust to sqlite-3.22.0 (bug #1543286)
  - Add new index constraint ops introduced in SQLite 3.21.0 to PerlData


author: Jan Pazdziora <jpazdziora@redhat.com> - 6.56-1
changelog:
  - 1372494 - Rebase to upstream version 6.56.
  - 1372494 - Rebase to upstream version 6.55, build failed due to
    https://rt.cpan.org/Public/Bug/Display.html?id=117404.


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-416
changelog:
  - 5.26.3 bump (bug #1655526)
  - Fix CVE-2018-18311 (integer overflow leading to buffer overflow) (bug #1654920)
  - Fix CVE-2018-18312 (heap buffer overflow in regcomp.c) (bug #1654922)
  - Fix CVE-2018-18313 (heap buffer overflow read in regcomp.c) (bug #1654924)
  - Fix CVE-2018-18314 (heap based buffer overflow) (bug #1654925)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-417
changelog:
  - Fix Time-Local tests to pass after year 2019 (bug #1807120)
  - Run-require perl(Encode) by perl-libs (bug #1903503)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-419
changelog:
  - Fix CVE-2020-10543 (bug #1839273)
  - Fix CVE-2020-10878 (bug #1839276)
  - Fix a file mode of a perl-example.stp example (bug #1913693)


author: Petr Pisar <ppisar@redhat.com> - 2.12-367
changelog:
  - Fix CVE-2017-6512 (setting arbitrary mode on an arbitrary file in rmtree()
    and remove_tree()) (bug #1457834)


author: Petr Pisar <ppisar@redhat.com> - 3.28-2
changelog:
  - Introduce a build-condition on groff
  - Rename a _without_tk build-condition to
    _without_perl_Pod_Perldoc_enables_tk_test


author: Paul Howarth <paul@city-fan.org> - 1.71-5
changelog:
  - Soften Business::ISBN dependency from Requires: to Suggests: to avoid
    pulling in gd and X libraries (#1380152)


author: Petr Pisar <ppisar@redhat.com> - 3.10-2
changelog:
  - Net::libnetFAQ document replaced with a hyper link because of the Artistic
    license (CPAN RT#117888)


author: Paul Howarth <paul@city-fan.org> - 1:0.236-1
changelog:
  - Update to 0.236
    - Add Travis test configuration
    - Make test for PMC availability more reliable
    - Disable benchmark test rt62341.t as it runs out of memory on many smoker
      systems (CPAN RT#118310)
  - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 1:0.237-1
changelog:
  - Update to 0.237
    - Don't load vars.pm (CPAN RT#132077)
  - Drop legacy Group: tag
  - Drop buildroot cleaning in %install section


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-44
changelog:
  - Use the monotonic clock for theading.Condition
  - Use the monotonic clock for the global interpreter lock
  Resolves: rhbz#2003758


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-45
changelog:
  - Security fix for CVE-2021-4189: ftplib should not use the host from the PASV response
  Resolves: rhbz#2036020


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-46
changelog:
  - Security fix for CVE-2022-0391: urlparse does not sanitize URLs containing ASCII newline and tabs
  - Fix the test suite support for Expat >= 2.4.5
  Resolves: rhbz#2047376, rhbz#2060435


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-50
changelog:
  - Security fix for CVE-2022-45061
  - Strip the LTO bytecode from python.o
  Resolves: rhbz#2144072, rhbz#2137707


author: zhangbinchen <zhangbinchen@openanolis.org> - 3.6.8-51.0.1.1
changelog:
  - Add Anolis platform cherry-pick [9a96461]
  - Support Loongarch for python3
  - Fix testcase fails on loongarch64


author: Miro Hrončok <mhroncok@redhat.com> - 9.0.3-13
changelog:
  - Use the system level root certificate instead of the one bundled in certifi
  - Resolves: rhbz#1655255


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-16
changelog:
  - Add four new patches for CVEs in bundled urllib3 and requests
  CVE-2018-20060, CVE-2019-11236, CVE-2019-11324, CVE-2018-18074
  Resolves: rhbz#1649153
  Resolves: rhbz#1700824
  Resolves: rhbz#1702473
  Resolves: rhbz#1643829


author: Tomas Orsava <torsava@redhat.com> - 9.0.3-18
changelog:
  - Patch for pip install <url> allow directory traversal, leading to arbitrary file write
  Resolves: rhbz#1868016


author: Lumír Balhar <lbalhar@redhat.com> - 9.0.3-20
changelog:
  - Fix for CVE-2021-3572 - pip incorrectly handled unicode separators in git references
  Resolves: rhbz#1962856


author: Lumír Balhar <lbalhar@redhat.com> - 39.2.0-4
changelog:
  - New subpackage platform-python-setuptools without files from /usr/bin/*
  - python3-setuptools contains only files from /usr/bin/* and depends
    on platform-python-setuptools
  - Resolves: rhbz#1641973


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-19
changelog:
  - semodule: move module hashing into libsemanage (requires libsemanage-2.9-7)
  - semodule: add command-line option to detect module changes (#2049189)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-20
changelog:
  - python: Split "semanage import" into two transactions (#2063353)
  - semodule: rename --rebuild-if-modules-changed to --refresh (#2089802)
  - selinux-autorelabel: Do not force reboot (#2093133)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-21.1
changelog:
  - python: Harden tools against "rogue" modules (#2128976)
  - Update "pathfix" arguments to match ^^^ (#2128976)
  - python: Do not query the local database if the fcontext is non-local (#2124825)


author: Jan Rybar <jrybar@redhat.com> - 0.115-7
changelog:
  - pkttyagent: polkit-agent-helper-1 timeout leaves tty echo disabled
  - Mitigation of regression caused by fix of CVE-2018-19788
  - Resolves: rhbz#1693781
  - Resolves: rhbz#1693814


author: Panu Matilainen <pmatilai@redhat.com> - 1.18-1
changelog:
  - Rebase to popt 1.18 (https://github.com/rpm-software-management/popt/releases/tag/popt-1.18-release)
  - Update URLs to rebooted upstream
  - Clean up ancient cruft from spec, use modern build macros


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.3.1-10
changelog:
  - Release bump and rebuild for relengs to be able to ship postfix-pcre,
    postfix-cdb, postfix-sqlite
    Resolves: rhbz#1745321


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.5.8-2
changelog:
  - Fixed cleanup crash when processing messages with whitespace only fullname
    Resolves: rhbz#1977732


author: Tomas Korbar <tkorbar@redhat.com> - 2:3.5.8-5
changelog:
  - Backport dns SRV record resolution feature (RFC6186)
    Resolves: rhbz#1787010
  - Fix building in ZUUL CI
    Resolves: rhbz#2196577


author: Michal Sekletár <msekleta@redhat.com> - 0.1.0-5
changelog:
  - if interface has name in expected format print it to stdout (#1643515)
  - don't assign names to virtual devices (#1644294)


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-3
changelog:
  - pgrep: uid/gid conversion overflow
  - vmstat: align manpage with procfs wording
  - watch: manpage presumes NTP on system
  - Resolves: rhbz#1827731
  - Resolves: rhbz#1829920
  - Resolves: rhbz#1583669


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-4
changelog:
  - pidof: new option to show kernel worker threads
  - pidof: empty input causes to show kernel worker threads
  - Resolves: rhbz#1860486
  - Resolves: rhbz#1894526
  - Related: rhbz#1803640
  -


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-5
changelog:
  - version bump due to unspotted malformed backport patch
  - Resolves: rhbz#1860486
  - Resolves: rhbz#1894526
  - Related: rhbz#1803640


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-8
changelog:
  - vmstat: added -y option to omit first report
  - Resolves: rhbz#2027350
  - sysctl: backport config directory order, align with systemd
  - Resolves: rhbz#2111915


author: Jan Rybar <jrybar@redhat.com> - 6.6.3-2
changelog:
  - lastcomm: added new --pid option to show process PID and PPID
  - changelog update: 6.6.3-1 author change
  - spec file update: added correct access mode to created /var/account/pacct


author: Jan Rybar <jrybar@redhat.com> - 23.1
changelog:
  - Rebase to the newest upstream official release
  - Source0 updated to latest functional SourceForge URL format
  - peekfd manpage now not present if peekfd binary missing on given architecture
  - URL of the project updated
  - new tool pslog added with rebase
  - Resolves: #1460695


author: liuzhilin <liuzhilin@uniontech.com> - 1.11.5-6.0.1
changelog:
  - Remove releated unversioned python macro that not supported now
    (See https://docs.fedoraproject.org/en-US/packaging-guidelines/Python/#_macros)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.0.4-3
changelog:
  - Python 2 binary package renamed to python2-chardet
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1:1.1.fb23-4
changelog:
  - Python 2 binary package renamed to python2-configshell
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Christian Heimes <cheimes@redhat.com> - 2.2.1-2
changelog:
  - Drop Python 2 subpackages from RHEL 8, fixes RHBZ#1589754
  - Remove unnecessary copy and shebang mangling


author: Christian Heimes <cheimes@redhat.com> - 2.3-1
changelog:
  - New upstream release 2.3
  - Fix AEAD tag truncation bug, CVE-2018-10903, RHBZ#1602755, RHBZ#1602932


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-1
changelog:
  - Rebase to upstream release 3.2.1
  - Resolves: rhbz#1873581
  - Resolves: rhbz#1778939
  - Removed dependencies on python-asn1crypto, python-idna


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-4
changelog:
  - CVE-2020-36242: Fixed a bug where certain sequences of update() calls
    when symmetrically encrypting very large payloads (>2GB) could result
    in an integer overflow, leading to buffer overflows.
  - Resolves: rhbz#1926528


author: Iryna Shcherbina <ishcherb@redhat.com> - 1:2.6.1-2
changelog:
  - Fix ambiguous Python 2 dependency declarations
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.2.4-9
changelog:
  - Python 2 binary package renamed to python2-dbus
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.2.4-10
changelog:
  - Also add Provides for the old name without %_isa
  - Use %python_provide for the python3 subpackage and drop manual Provide which
    conflicts with %python_provide in the python2 subpackage.


author: Miro Hrončok <mhroncok@redhat.com> - 0.13-1
changelog:
  - Updated to 0.13
  - Added python3 and python2 subpackages
  - Add --with tests
  - Modernize spec
  - Remove merged patch
  - Update upstream URL


author: Lumír Balhar <lbalhar@redhat.com> - 0.14-3
changelog:
  - Backport patch from upstream/rhel7 which allows pifconfig to show
    multiple IPv4 addresses for each interface
  - Move patches to dist-git
  - Resolves: rhbz#1652174


author: Tomas Popela <tpopela@redhat.com> - 3.40.1-6
changelog:
  - Fix the multilib problems by backporting fixes done by mhroncok from Fedora:
  - Move pure Python modules to a noarch subpackage
  - Ensure Python bytecode installed in multilib packages is bit-to-bit identical
    Resolves: rhbz#1915764


author: Carl George <carl@george.computer> - 1.6.1-1
changelog:
  - Latest upstream
  - Add patch0 to remove pytest-{cov,runner} deps
  - Share doc and license dir between subpackages
  - Enable EPEL PY3 build


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.9-16
changelog:
  - Python 2 binary package renamed to python2-kmod
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: John Kacur <jkacur@redhat.com> - 0.6.2-1
changelog:
  - Add bitmasklist_test
  - Clean-ups including using a more modern python spacing, tabbing, etc
  - Fix to parse number of cpus correctly on s390(x)
  Resolves: rhbz#1849215


author: John Kacur <jkacur@redhat.com> - 0.6.3-4
changelog:
  - various clean-ups including using 'with' context managers in try-except
  - Fix to ignore UnicodeDecodeError when it occurs
  Resolves: rhbz#2016204


author: John Dennis <jdennis@redhat.com> - 2.0.1-1
changelog:
  - Upgrade to upstream 2.0.1
  - port from jwt to jwcrypto (conditional build)
  - bring into alignment with rhel spec file


author: mulhern <amulhern@redhat.com> - 0.19.0
changelog:
  - Never raise a DeviceNotFoundError when iterating over a device enumeration
  - Device.subsystem() now returns None if device has no subsystem
  - Add DeprecationWarnings to deprecated Device methods
  - Replace "/" with "!" in Device.from_name() sys_name parameter
  - Add some unstable classes for parsing some kinds of values
  - Make version info more like Python's including micro numbers and levels
  - Refactor some internal modules into subdirectories
  - Work on tests and reproducers


author: mulhern <amulhern@redhat.com> - 0.20.0
changelog:
  - Remove parsing code added in previous release
  - No longer do CI for Python 2.6
  - Eliminate all wildcard imports and __all__ statements
  - No longer use deprecated Device.from_sys_path() method
  - Minor pylint induced changes
  - Documentation fixes


author: mulhern <amulhern@redhat.com> - 0.21.1
changelog:
  - Deprecate use of Device object as mapping from udev property names to values
  - Add a Properties class and a Device.properties() method for udev properties
  - Fix places where Device object was incorrectly used in a boolean context
  - Return an empty string, not None, if the property value is an empty string
  - Exceptions re-raised from libudev calls now have a message string
  - Insert a warning about using a Device in a boolean context in docs
  - Infrastructure for vagrant tests is removed
  - Various internal refactorings
  - Extensive test improvements
  - Numerous documentation fixes


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.10.0-3
changelog:
  - Python 2 binary package renamed to python2-pywbem
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Tony Asleson <tasleson@redhat.com> - 0.11.0-8
changelog:
  - Fix the conflict with sblim-wbemcli: RHBZ #1757855
  - Corrected warning about multiple file inclusion


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.12-6
changelog:
  - Python 2 binary package renamed to python2-pyyaml
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Miro Hrončok <mhroncok@redhat.com> - 3.12-12
changelog:
  - Rename python3-PyYAML to python3-pyyaml
  - Modernize spec
  - Fix python2 invocation

  - Cherry-picked from: https://src.fedoraproject.org/rpms/PyYAML/pull-request/2


author: Tomas Orsava <torsava@redhat.com> - 2.18.4-6
changelog:
  - Skip all tests needing httpbin: httpbin has too many dependencies to be
    shipped in RHEL just for build-time package tests


author: Lumír Balhar <lbalhar@redhat.com> - 2.20.0-4
changelog:
  - Bump release to fix upgrade path
    from 2.20.0-2.1.el8_1 via 2.20.0-3.el8_8 to 2.20.0-4.el8
  Related: rhbz#2209469


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-20
changelog:
  - Add --path query option (#1940895)
  - Macroize find-debuginfo script location (#2019540)
  - Validate and require subkey binding sigs on PGP pubkeys (#1958480)
  - Fixes CVE-2021-3521


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-22
changelog:
  - Fix spurious %transfiletriggerpostun execution (#2023693)
  - Skip recorded symlinks in --setperms (#1900662)


author: Liwei Ge <geliwei@openanolis.org> - 4.14.4-26.0.1
changelog:
  - Rebrand for Anolis OS
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - Support loongarch for rpm
  - Add loongarch64 support for debugedit(doupengda@loongson.cn)
  - Modify the spec to add debugedit for loongarch64(zhangwenlong@loongson.cn)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.5-5
changelog:
  - Python 2 binary package renamed to python2-schedutils
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Vit Mojzis <vmojzis@redhat.com> - 4.2.1-3
changelog:
  - Use 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -fasynchronous-unwind-tables -fstack-clash-protection}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -fasynchronous-unwind-tables -fstack-clash-protection}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -fasynchronous-unwind-tables -fstack-clash-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS instead of -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -fasynchronous-unwind-tables -fstack-clash-protection


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-1
changelog:
  - SETools 4.3.0 release (#1820079)
  - Revised sediff method for TE rules. This drastically reduced memory and run time.
  - Added infiniband context support to seinfo, sediff, and apol.
  - Added apol configuration for location of Qt assistant.
  - Fixed sediff issue where properties header would display when not requested.
  - Fixed sediff issue with type_transition file name comparison.
  - Fixed permission map socket sendto information flow direction.
  - Added methods to TypeAttribute class to make it a complete Python collection.
  - Genfscon now will look up classes rather than using fixed values which
    were dropped from libsepol.
  - setools requires -console, -console-analyses and -gui packages (#1820078)


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-4
changelog:
  - Disable/remove neverallow options in frontends (#2184141)
  - AVRuleXperm: Fix permission set creation for AVTAB_XPERMS_IOCTLDRIVER (#2174376)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.4-8
changelog:
  - Python 2 binary package renamed to python2-slip
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 0.6.4-10
changelog:
  - Also rename python-slip-dbus and python-slip-gtk to python2-*
  - Add missing %python_provide macros
  - Use new python2- names in dependencies


author: Charalampos Stratakis <cstratak@redhat.com> - 0.6.4-12
changelog:
  - Make firewalld to not log errors when running commands as root
    in the absence of polkitd.
  Resolves: rhbz#2076606


author: Tomas Orsava <torsava@redhat.com> - 1.24.2-1
changelog:
  - Rebased to 1.24.2 to fix CVE-2019-11324
  - Added patches for CVE-2019-11236 (AKA CVE-2019-9740)
  - Resolves: rhbz#1703361 rhbz#1706026


author: Lumír Balhar <lbalhar@redhat.com> - 1.24.2-3
changelog:
  - Enable TLS 1.3 post-handshake authentication
  - Adjust RECENT_DATE variable according to rules
  Resolves: rhbz#1726743


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.3.0-11
changelog:
  - Python 2 binary package renamed to python2-urwid
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: David Cantrell <dcantrell@redhat.com> - 1.3.1-2
changelog:
  - Apply upstream fix for EINTR handling in test_vterm test case
  - Apply upstream fix for test_remove_watch_file flakiness
  - Apply upstream fix for test_vterm handling of NUL characters


author: Petr Pisar <ppisar@redhat.com> - 1:4.05-17
changelog:
  - Support grace period expirations past 2038 year for XFS
  - Add a synopsis for a project quota option in the quota tool
  - Add a --filesystem option to the quota tool
  - Complain that ext4 external quota files are deprecated


author: Petr Pisar <ppisar@redhat.com> - 1:4.06-2
changelog:
  - Remove a dead code from process_file() (upstream bug #54)
  - Fix a compilation warning in quotaops.c
  - Warn when kernel XFS large time stamp does fit into (32-bit) user-space
    time_t
  - Do not use a pointless compiler-internal __P() macro


author: Aristeu Rozanski <aris@redhat.com> 0.6.7-1
changelog:
  - Bumped to 0.6.7
  - Backported patches that sit on top of 0.6.7 without being released
    Related: rhbz#2052190


author: Sumit Bose <sbose@redhat.com> - 0.16.3-19
changelog:
  - Realm join fails with error 'Failed to join domain: failed to lookup
    DC info ...'
    Resolves: rhbz#1859503
  - realm command to use option like dnshostname=fqdn
    Resolves: rhbz#1867912


author: Sumit Bose <sbose@redhat.com> - 0.16.3-20
changelog:
  - realmd should handle default_realm in krb5.conf
    Resolves: rhbz#1791016
  - [RFE] Enable LDAPS functionality in realmd join
    Resolves: rhbz#1826964


author: Sumit Bose <sbose@redhat.com> - 0.16.3-24
changelog:
  - Avoid duplicated log messages and use Samba's new CLI options
    Resolves: rhbz#2024248
    Resolves: rhbz#2028528


author: Vladis Dronov <vdronov@redhat.com> - 6.8-4
changelog:
  - There is no need to hardcode _sbindir anymore, also the old value is
    incorrect
  - Update the rngd.service file
  - Fix a busyloop bug (bz 1956248)
  - Fix /dev/hwrng permission issue (bz 1955522)


author: Vladis Dronov <vdronov@redhat.com> - 6.8-6
changelog:
  - Adjust rngd-wake-threshold.service and post section so udevadm is not
    run in a container (bz 1975554)


author: Vladis Dronov <vdronov@redhat.com> - 6.13-1.git.d207e0b6
changelog:
  - Update to the upstream v6.13 + tip of origin/master + onecpu
    branch + revert of 2ce93190
  - Rebuild rng-tools against the latest jitterentropy library
    3.0.2-2.git.409828cf with fixes for an important issue
  - Fix a number of issues (bz 1974103, bz 1980421, bz 1859154)


author: Vladis Dronov <vdronov@redhat.com> - 6.14-4.git.b2b7934e
changelog:
  - Update rng-tools to v6.14 @ b2b7934e (bz 2015570)
  - Update jitterentropy library to v3.3.1 @ 887c9871
  - Add a config file for storing rngd options
  - Fix a security issue found by a covscan in jitterentropy library


author: Vladis Dronov <vdronov@redhat.com> - 6.15-1
changelog:
  - Update rng-tools to v6.15 @ 172bf0e3 (bz 2075974)
  - Update jitterentropy library to v3.4.0 @ 887c9871
  - Allow rngd process to drop privileges with "-D user:group"
  - Fix an error building with jitterentropy-3.4.0
  - Add a requirement for selinux-policy of a certain version
  - Fix a build failure on ppc64
  - Small edits in test scripts


author: Vladis Dronov <vdronov@redhat.com> - 6.15-2
changelog:
  - Update rng-tools to v6.15 @ 6dcc9ec2 (bz 2124602)
  - Update jitterentropy library to v3.4.1 @ 4544e113
  - Do not require selinux-policy if it is not present


author: Vladis Dronov <vdronov@redhat.com> - 6.15-3
changelog:
  - Update rng-tools to v6.15 @ cb8cc624 (bz 2141379)
  - Update jitterentropy library to v3.4.1 @ 7bf9f85d
  - Fix a stack corruption on s390x
  - Fix a number of issues found by covscan code scanner
  - Add a jitter init timeout for tests
  - Add a start condition for the FIPS mode (bz 2154804)


author: Vladis Dronov <vdronov@redhat.com> - 6.16-1
changelog:
  - Update rng-tools to v6.16 @ 0e560296 (bz 2174908)
  - Get rid of text relocations in -fPIE build
  - Add a hint for opensc package (bz 1845854)


author: Ondrej Vasik <ovasik@redhat.com> 0.1-13
changelog:
  - copy content of /etc/skel directory for root as posstrans,
    don't overwrite  existing files (#999114)


author: Michal Ruprich <mruprich@redhat.com> - 3.1.3-19
changelog:
  - Resolves: #2116668 - zlib: a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field


author: Jakub Martisko <jamartis@redhat.com> - 4.4-4
changelog:
  - When editing file inplace, the SELinux context should
    be based on the link instead of the target file itself.
    --follow-symlinks option remains unchanged
  - Resolves: #1401442


author: Jakub Martisko <jamartis@redhat.com> - 4.5-2
changelog:
  - fix "in-place edits on FUSE filesystems create files with all-zero mode bits"
  - Resolves: #1835761


author: Jakub Martisko <jamartis@redhat.com> - 4.5-5
changelog:
  - Minor cleanup - remove unused patch from the spec file too (related to 4.5-3)
  - Resolves: rhbz#1869253


author: Mahailiang <mahailiang@openanolis.org> - 4.5-5.0.1
changelog:
  - fix testsuite/inplace-selinux.sh check error
  - Sync from https://debbugs.gnu.org/cgi/bugreport.cgi?bug=35997


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-120
changelog:
  - Allow unconfined service inherit signal state from init
  Resolves: rhbz#2177254
  - Allow systemd-pstore delete kernel persistent storage files
  Resolves: rhbz#2181558
  - Add fs_delete_pstore_files() interface
  Resolves: rhbz#2181558
  - Allow certmonger manage cluster library files
  Resolves: rhbz#2177836
  - Allow samba-rpcd work with passwords
  Resolves: rhbz#2107106
  - Allow snmpd read raw disk data
  Resolves: rhbz#2160000
  - Allow cluster_t dbus chat with various services
  Resolves: rhbz#2196524


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-121
changelog:
  - Update pkcsslotd policy for sandboxing 2/2
  Resolves: rhbz#2208162
  - Update pkcsslotd policy for sandboxing 1/2
  Resolves: rhbz#2208162
  - Allow abrt_t read kernel persistent storage files
  Resolves: rhbz#2207914
  - Add allow rules for lttng-sessiond domain
  Resolves: rhbz#2203509
  - Allow rpcd_lsad setcap and use generic ptys
  Resolves: rhbz#2107106
  - Allow samba-dcerpcd connect to systemd_machined over a unix socket
  Resolves: rhbz#2107106
  - Dontaudit targetd search httpd config dirs
  Resolves: rhbz#2203720


author: Nikola Knazekova <nknazeko@redhat.com> - 3.14.3-122
changelog:
  - Update cyrus_stream_connect() to use sockets in /run
  Resolves: rhbz#2165752
  - Allow insights-client map generic log files
  Resolves: rhbz#2214572
  - Allow insights-client work with pipe and socket tmp files
  Resolves: rhbz#2207819
  - Allow insights-client getsession process permission
  Resolves: rhbz#2207819
  - Allow keepalived to manage its tmp files
  Resolves: rhbz#2179335


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-123
changelog:
  - Label only /usr/sbin/ripd and ripngd with zebra_exec_t
  Resolves: rhbz#2213606
  - Allow httpd tcp connect to redis port conditionally
  Resolves: rhbz#2213965
  - Exclude container-selinux manpage from selinux-policy-doc
  Resolves: rhbz#2218362


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-124
changelog:
  - Add the files_getattr_non_auth_dirs() interface
  Resolves: rhbz#2076937
  - Update policy for the sblim-sfcb service
  Resolves: rhbz#2076937
  - Dontaudit sfcbd sys_ptrace cap_userns
  Resolves: rhbz#2076937
  - Label /usr/sbin/sos with sosreport_exec_t
  Resolves: rhbz#2167731
  - Allow sa-update manage spamc home files
  Resolves: rhbz#2222200
  - Allow sa-update connect to systemlog services
  Resolves: rhbz#2222200
  - Label /usr/lib/systemd/system/mimedefang.service with antivirus_unit_file_t
  Resolves: rhbz#2222200


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-125
changelog:
  - Allow user_u and staff_u get attributes of non-security dirs
  Resolves: rhbz#2216151
  - Allow unconfined user filetrans chrome_sandbox_home_t 1/2
  Resolves: rhbz#2221573
  - Allow unconfined user filetrans chrome_sandbox_home_t 2/2
  Resolves: rhbz#2221573
  - Allow insights-client execmem
  Resolves: rhbz#2225233
  - Allow svnserve execute postdrop with a transition
  Resolves: rhbz#2004843
  - Do not make postfix_postdrop_t type an MTA executable file
  Resolves: rhbz#2004843
  - Allow samba-dcerpc service manage samba tmp files
  Resolves: rhbz#2210771
  - Update samba-dcerpc policy for printing
  Resolves: rhbz#2210771


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-126
changelog:
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t 1/2
  Resolves: rhbz#2229726
  - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t
  Resolves: rhbz#2177704
  - Allow cloud_init create dhclient var files and init_t manage net_conf_t 2/2
  Resolves: rhbz#2229726
  - Make insights_client_t an unconfined domain
  Resolves: rhbz#2225527
  - Allow insights-client create all rpm logs with a correct label
  Resolves: rhbz#2229559
  - Allow insights-client manage generic logs
  Resolves: rhbz#2229559


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-128
changelog:
  - Allow ssh_agent_type manage generic cache home files
  Resolves: rhbz#2177704
  - Add chromium_sandbox_t setcap capability
  Resolves: rhbz#2221573


author: Ondrej Vasik <ovasik@redhat.com> - 2.12.2-2
changelog:
  - do not ship /etc/hosts.allow and /etc/hosts.deny (no need for them
    as we don't allow tcp_wrappers in RHEL8, #1663556)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-3
changelog:
  - add pcp user to /etc/aliases (#1744089)
  - set PATH if it is empty in csh.login (#1744104)
  - lang.csh: prevent grep from failing so scripts do not end
    prematurely when tcsh -e option in use (#1678706)
  - use full path for non-builtins (#1688302)
  - add nrpe tcp port 5666 to /etc/services (#1730396)


author: Martin Osvald <mosvald@redhat.com> - 2.12.2-7
changelog:
  - Move /var/log/lastlog ownership to systemd (#2044589)
  - tcsh sets variable p to /usr/sbin from /etc/csh.login (#1945400)
  - bashrc: Don't set up VTE-specific PROMPT_COMMAND (#1917934)


author: Tomas Bzatek <tbzatek@redhat.com> - 1.44-3
changelog:
  - Fix sg_turs help invocation in an old mode (#1683343)
  - Fix sg_raw printing error about device not specified on version request (#1627657)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-12
changelog:
  - lib/sssd: redirect warning message to file (#1749001)
  - useradd: clarify valid usernames/groupnames (#1869432)
  - login.defs: link login specific information to its own package (#1804766)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-15
changelog:
  - Creation of subid and subid-devel subpackages (#2013009)
  - libsubid: creation and nsswitch support
  - libsubid: don't print error messages on stderr by default
  - libsubid: libsubid_init return false if out of memory
  - libsubid: don't return owner in list_owner_ranges API call
  - libsubid: libsubid_init don't print messages on error
  - libsubid: fix newusers when nss provides subids
  - libsubid: make shadow_logfd not extern
  - useradd: fix SUB_UID_COUNT=0
  - man: mention NSS in new[ug]idmap manpages
  - man: clarify subid delegation


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-16
changelog:
  - getsubids: provide system binary and man page. Resolves: #2013016
  - groupdel: fix SIGSEGV when passwd does not exist. Resolves: #1986782


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-17
changelog:
  - subordinateio: also compare the owner ID. Resolves: #2093311
  - Fix release sources
  - Add subid requirement for subid-devel


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-18
changelog:
  - Update patch to close label to reset libselinux state. Resolves: #1984740
  - useradd: check if subid range exists for user. Resolves: #2012929
  - find_new_[gu]id: Skip over IDs that are reserved for legacy reasons. Resolves: #1994269


author: Javier Martinez Canillas <javierm@redhat.com> - 15-12
changelog:
  - Fix firmware update bug in aarch64 caused by shim ignoring arguments
    Resolves: rhbz#1830871
  - Fix a shim crash when attempting to netboot
    Resolves: rhbz#1795654


author: Peter Jones <pjones@redhat.com> - 15-13
changelog:
  - New signing keys
    Related: CVE-2020-10713
    Related: CVE-2020-14308
    Related: CVE-2020-14309
    Related: CVE-2020-14310
    Related: CVE-2020-14311


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-1
changelog:
  - Resolves: #1869292 Statistics Support - smc-tools part
  - Resolves: #1919225 Add SMC-D Setup Check (smc-tools)
  - Resolves: #1919240 Upgrade smc-tools to latest version


author: Čestmír Kalina <ckalina@redhat.com> - 1.6.0-3
changelog:
  - Patch stats.c to fix overruns
  - Patch stats.c to fix leaks
  - Patch stats.c to fix fallback counter values
  - Resolves: #1993469


author: Čestmír Kalina <ckalina@redhat.com> - 1.8.1-1
changelog:
  - Upgrade smc-tools to latest version
  - Add User-defined EID (Enterprise ID) Support
  - Resolves: #1919228
  - Resolves: #2043841


author: Bhupesh Sharma <bhsharma@redhat.com> - 1.1.8-1
changelog:
  - Rebase to latest github version Snappy-1.1.8
  - Also change the URL to reflect to the updated github location.


author: Jan Jansky <jjansky@redhat.com> = 4.6.0-1
changelog:
  - [ultrapath] Add new plugin for Huawei UltraPath
    Resolves: bz2187407
  - [cleaner] Use data filter for extraction
    Resolves: bz2217906
  - [discovery] Enable the plugin by containers
    Resolves: bz2222134


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-10
changelog:
  - Fixed CVE-2020-13632 (#1845572)
  - Fixed CVE-2020-13631 (#1845474)
  - Fixed CVE-2020-13630 (#1845153)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-14
changelog:
  - Fixed CVE-2019-5827 (#1710184)
  - Fixed CVE-2019-13750 (#1786510)
  - Fixed CVE-2019-13751 (#1786522)
  - Fixed CVE-2019-19603 (#1792013)
  - Fixed CVE-2020-13435 (#1841233)


author: Abhi Das <adas@redhat.com> - 4.3-19
changelog:
  - rhbz#1602698 - Fix coverity issues
    rhbz#1624173 - Fix annocheck failures
    rhbz#1716278 - limit max cpus in mksquashfs
    Resolves: rhbz#1602698, rhbz#1624173, rhbz#1716278


author: Abhi Das <adas@redhat.com> - 4.3-20
changelog:
  - rhbz#1895017 - unsquashfs does not preserve file capabilities
    rhbz#1754815 - Kdump: Building kdump initramfs img may fail with 'dracut: Failed making squash image' occasionally
    Resolves: rhbz#1895017, rhbz#1754815


author: Eugene Syromiatnikov <esyr@redhat.com> - 5.13-1
changelog:
  - Rebase to v5.13; drop upstream patches on top of 5.7 (#2015917).
  - Address some issues reported by covscan.


author: Sahana Prasad <sahana@redhat.com> - 5.56-5
changelog:
  - Fix CVE-2021-20230 stunnel: client certificate not
    correctly verified when redirect and verifyChain options are used.


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-6
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed The LDAP backend which is not properly parsing sudoOptions,
    resulting in selinux roles not being applied
  Resolves: rhbz#1738326


author: Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
changelog:
  - RHEL 8.2 ERRATUM
  - rebase to 1.8.28p1
  Resolves: rhbz#1733961
  - fixed man page for always_set_home
  Resolves: rhbz#1576880
  - sudo does not work with notbefore/after
  Resolves: rhbz#1679508
  - NOTBEFORE showing value of sudoNotAfter Ldap attribute
  Resolves: rhbz#1715516
  - CVE-2019-14287 sudo
  - Privilege escalation via 'Runas' specification with 'ALL' keyword
  Resolves: rhbz#1760697


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-7
changelog:
  - RHEL 8.4 ERRATUM
  - CVE-2021-3156
  Resolves: rhbz#1917734
  - CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
  Resolves: rhzb#1916434
  - CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
  Resolves: rhbz#1917038
  - updated upstream url
  Resolves: rhbz#1923825


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-8
changelog:
  RHEL 8.6.0 ERRATUM
  - sudoedit does not work with selinux args
  Resolves: rhbz#2029551
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#1999751
  - [RFE] pass KRB5CCNAME to pam_authenticate environment if available
  Resolves: rhbz#1917379
  - utmp resource leak in sudo
  Resolves: rhbz#1986572


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-8.1
changelog:
  RHEL 8.7.0.Z ERRATUM
  - CVE-2023-22809 sudo: arbitrary file write with privileges of the RunAs user
  Resolves: rhbz#2161220


author: Kalev Lember <klember@redhat.com> - 3.39.92-2
changelog:
  - Split sysprof-capture library and header files out to sysprof-capture-devel
  - Update minimum required glib2 version


author: Jan Tulak <jtulak@redhat.com> - 1.2-1
changelog:
  - Upstream release 1.2 which fixes:
  - use pwquality to test password strength for cryptsetup (#1141871)
  - add multipath detection support (#1309729)
  - add migrate command (#1014708)


author: Jan Tulak <jtulak@redhat.com> - 1.2-3:
changelog:
  - Gating tests implementation, which meant adding few more changes
    to the existing patches (#1681969)
  - sphinx patch was merged to python3 change
  - add seq numbers to patch files


author: Jan Tulak <jtulak@redhat.com> - 1.4-1:
changelog:
  - Bring changes from upstream 1.4 (mostly bugfixes)
  - Remove multipath from the list of default backends (rhbz#1685019)
  - Fix locale issue (rhbz#1679587)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-69
changelog:
  - logind: optionally watch utmp for login data (#2122288)
  - logind: add hashtable for finding session by leader PID (#2122288)
  - core/load-fragment: move config_parse_sec_fix_0 to src/shared (#2122288)
  - sd-event: add relative timer calls (#2122288)
  - logind: add option to stop idle sessions after specified timeout (#2122288)
  - logind: schedule idle check full interval from now if we couldn't figure out atime timestamp (#2122288)
  - ci(lint): add shell linter - Differential ShellCheck (#2122499)
  - meson: do not compare objects of different types (#2122499)
  - journal-remote: use MHD_HTTP_CONTENT_TOO_LARGE as MHD_HTTP_PAYLOAD_TOO_LARGE is deprecated since 0.9.74 (#2122499)
  - Fix build with µhttpd 0.9.71 (#2122499)
  - ci: replace LGTM with CodeQL (#2122499)
  - ci(mergify): Update policy - Drop LGTM checks (#2122499)
  - time-util: fix buffer-over-run (#2139391)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-70
changelog:
  - basic: recognize pdfs filesystem as a network filesystem (#2094661)
  - core: move reset_arguments() to the end of main's finish (#2127131)
  - manager: move inc. of n_reloading into a function (#2136869)
  - core: Add new DBUS properties UnitsReloadStartTimestamp and UnitsLoadTimestampMontonic (#2136869)
  - core: Indicate the time when the manager started loading units the last time (#2136869)
  - core: do not touch /run/systemd/systemd-units-load from user session instances (#2136869)
  - sysctl: downgrade message when we have no permission (#2158160)
  - core: respect SELinuxContext= for socket creation (#2136738)
  - manager: use target process context to set socket context (#2136738)
  - virt: detect Amazon EC2 Nitro instance (#2117948)
  - machine-id-setup: generate machine-id from DMI product ID on Amazon EC2 (#2117948)
  - virt: use string table to detect VM or container (#2117948)
  - fileio: introduce read_full_virtual_file() for reading virtual files in sysfs, procfs (#2117948)
  - Use BIOS characteristics to distinguish EC2 bare-metal from VMs (#2117948)
  - device: drop refuse_after (#2043524)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-71
changelog:
  - manager: limit access to private dbus socket (#2119405)
  - journalctl: do not treat EINTR as an error when waiting for events (#2161683)
  - core: bring manager_startup() and manager_reload() more inline (#2059633)
  - pam: add a call to pam_namespace (#1861836)
  - virt: Support detection for ARM64 Hyper-V guests (#2158307)
  - virt: Fix the detection for Hyper-V VMs (#2158307)
  - basic: add STRERROR() wrapper for strerror_r() (#2155520)
  - coredump: put context array into a struct (#2155520)
  - coredump: do not allow user to access coredumps with changed uid/gid/capabilities (#2155520)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-72
changelog:
  - test: import logind test from debian/ubuntu test suite (#1866955)
  - test: introduce inst_recursive() helper function (#1866955)
  - tests: verify that Lock D-Bus signal is sent when IdleAction=lock (#1866955)
  - systemctl: simplify halt_main() (#2053273)
  - systemctl: shutdown don't fallback on auth fail (#2053273)
  - systemctl: reintroduce the original halt_main() (#2053273)
  - systemctl: preserve old behavior unless requested (#2053273)
  - pam_systemd: suppress LOG_DEBUG log messages if debugging is off (#2170084)
  - udev/net_id: introduce naming scheme for RHEL-8.8 (#2170499)
  - pam: add a call to pam_namespace (#1861836)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-73
changelog:
  - journald: add API to move logging from /var to /run again (#1873540)
  - journalctl: add new --relinquish and --smart-relinquish options (#1873540)
  - units: automatically revert to /run logging on shutdown if necessary (#1873540)
  - pstore: Tool to archive contents of pstore (#2158832)
  - meson: drop redundant line (#2158832)
  - pstore: drop unnecessary initializations (#2158832)
  - pstopre: fix return value of list_files() (#2158832)
  - pstore: remove temporary file on failure (#2158832)
  - pstore: do not add FILE= journal entry if content_size == 0 (#2158832)
  - pstore: run only when /sys/fs/pstore is not empty (#2158832)
  - pstore: fix use after free (#2158832)
  - pstore: refuse to run if arguments are specified (#2158832)
  - pstore: allow specifying src and dst dirs are arguments (#2158832)
  - pstore: rework memory handling for dmesg (#2158832)
  - pstore: fixes for dmesg.txt reconstruction (#2158832)
  - pstore: Don't start systemd-pstore.service in containers (#2158832)
  - units: pull in systemd-pstore.service from sysinit.target (#2158832)
  - units: drop dependency on systemd-remount-fs.service from systemd-pstore.service (#2158832)
  - units: make sure systemd-pstore stops at shutdown (#2158832)
  - pstore: Run after modules are loaded (#2158832)
  - pstore: do not try to load all known pstore modules (#2158832)
  - logind-session: make stopping of idle session visible to admins (#2156780)
  - journald: Increase stdout buffer size sooner, when almost full (#2029426)
  - journald: rework end of line marker handling to use a field table (#2029426)
  - journald: use the fact that client_context_release() returns NULL (#2029426)
  - journald: rework pid change handling (#2029426)
  - test: Add a test case for #15654 (#2029426)
  - test: Stricter test case for #15654 (Add more checks) (#2029426)
  - man: document the new _LINE_BREAK= type (#2029426)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74
changelog:
  - journald-server: always create state file in signal handler (#2174645)
  - journald-server: move relinquish code into function (#2174645)
  - journald-server: always touch state file in signal handler (#2174645)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74.1
changelog:
  - pager: set $LESSSECURE whenver we invoke a pager (#2175623)
  - test-login: always test sd_pid_get_owner_uid(), modernize (#2175623)
  - pager: make pager secure when under euid is changed or explicitly requested (#2175623)
  - test: ignore ENOMEDIUM error from sd_pid_get_cgroup() (#2175623)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74.2
changelog:
  - pstore: fix crash and forward dummy arguments instead of NULL (#2190153)
  - ci: workflow for gathering metadata for source-git automation (#2190153)
  - ci: first part of the source-git automation - commit linter (#2190153)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-74.3
changelog:
  - login: add a missing error check for session_set_leader() (#2223602)
  - logind: reset session leader if we know for a fact that it is gone (#2223602)


author: Yuanhong Peng <yummypeng@linux.alibaba.com> - 239-74.0.2.3
changelog:
  - core: fix a null reference case in load_from_path()
  - sysctl: Don't pass null directive argument to '%s'
  - exit-status: introduce EXIT_EXCEPTION mapping to 255
  - main: don't freeze PID 1 in containers, exit with non-zero instead
  - Do not go into freeze when systemd crashd
  - mount-setup: change the system mount propagation to shared by default only at bootup
  - cgroup-util: make definition of CGROUP_CONTROLLER_TO_MASK() unsigned
  - cgroup: update only siblings that got realized once
  - core: add a config item to support setting the value of cpuset.clone_children when systemd is starting
  - support loongarch for systemd
  - test-catalog: Fix coredump when compiled under GCC10
  - add Iluvatar CoreX pci id (Liwei Ge)
  - seccomp: add loongarch64 support (Liwei Ge)
  - seccomp: remove loongarch64 switch(Liwei Ge)
  - umount: check LO_FLAGS_AUTOCLEAR after LOOP_CLR_FD claimed success(yuanhui)
  - fileio: when reading a full file into memory, refuse inner NUL bytes (Guorui Yu)
  - util: introduce explicit_bzero_safe for explicit memset (Guorui Yu)
  - util: introduce erase_and_free() helper (Guorui Yu)
  - util: introduce READ_FULL_FILE_SECURE flag for reading secure data (Guorui Yu)
  - fileio: introduce warn_file_is_world_accessible() (Guorui Yu)
  - fileio: read_full_file_full() also warns when file is world readable and secure flag is set (Guorui Yu)
  - basic/fileio: Fix memory leak if READ_FULL_FILE_SECURE flag is used (Guorui Yu)
  - fileio: add explicit flag for generating world executable warning when reading file (Guorui Yu)
  - fileio: add 'dir_fd' parameter to read_full_file_full() (Guorui Yu)
  - fileio: add support for read_full_file() on AF_UNIX stream sockets (Guorui Yu)
  - fileio: beef up READ_FULL_FILE_CONNECT_SOCKET to allow setting sender socket name (Guorui Yu)
  - fileio: teach read_full_file_full() to read from offset/with maximum size (Guorui Yu)
  - cryptsetup: port cryptsetup's main key file logic over to read_full_file_full() (Guorui Yu)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.30-6
changelog:
  - added "padding with zeros" info message (#1913566)
  - do not report disk error as file shrank (#1913569)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.6-2
changelog:
  - Splitted documentation to the doc subpackage
    Resolves: rhbz#1380291
  - Fixed whitespace
  - Dropped obsoleted defattr


author: Jaroslav Škarvada <jskarvad@redhat.com> - 1:8.6.8-2
changelog:
  - Reverted _module_build macro check which fixes systemtap probes on RHEL-8
    Resolves: rhbz#1579386


author: Petr Pisar <ppisar@redhat.com> - 1.8-1
changelog:
  - 1.8 bump
  - License changed from GPLv2+ to (GPLv3+ and GFDL)
  - Disable printing command failure in POSIX mode


author: Filipe Rosset <rosset.filipe@gmail.com> - 2.5-4
changelog:
  - Fixes rhbz #1476851 tmux bell-action other not working
  - Fixes rhbz #1476892 tmux update in F26 broke tmuxinator


author: Michal Schmidt <mschmidt@redhat.com> - 1.3.9-1
changelog:
  - Upstream release 1.3.9.
  - Add fixes for build errors with OpenSSL 1.1.
  - Add fixes for NULL cipher context use in seal/unseal.
  - spec file modernization.


author: Javier Martinez Canillas <javierm@redhat.com> - 2.0.0-1
changelog:
  - Download the distributed tarball instead of the source code tarball
  - Update URLs to point to the new project location
  - Update to 2.0.0 release


author: Jerry Snitselaar <jsnitsel@redhat.com> - 4.1.1-2
changelog:
  - Fix ESYS_TR hierarchy transition.
  - Refactor fix_esys_hierarchies to return actual TSS2_RC return code.
  - tpm2_alg_util.c: fix a bug where the string rsa3072 wasn't being parsed.
  - tpm2_create.c: Fix an issue where userwithauth attr cleared if policy specified.
  - tpm2_hierarchycontrol: Fix bug where hierarchycontrol operation failed silently.
  - tpm2_nvdefine.c: Fix error reporting message.
  - tpm2_policyor: Fix silent failure for invalid/unspecified policy digest alg.
  resolves: rhbz#1854774


author: Jerry Snitselaar <jsnitsel@redhat.com> - 4.1.1-3
changelog:
  - Fix resource leak.
  - Fix to restrict policy digest size.
  - Fix incompatible pointer cast.
  - Fix error message in files_load_##name
  - Fix issue where execution couldn't reach function return.
  resolves: rhbz#1920821


author: chench <chench@hygon.cn> -4.1.1-5.0.2
changelog:
  - Add gm support for all commands.
  - Add the gm API for tools library.
  - Add commands line arguments to support gm in some commands


author: chench <chench@hygon.cn> -4.1.1-5.0.3
changelog:
  - Add gm test case for all commands.
  - This patch tests all commands for gm support. Every script test a class of commands


author: Yunying Sun <yunying.sun@intel.com> - 2.0.0-1
changelog:
  - Update to 2.0.0 release (RHBZ#1508870)
  - Remove patch file 60-tpm-udev.rules, use upstream tpm-udev.rules instead
  - Disable ESAPI to fix build errors caused by dependency to libgcrypt 1.6.0
  - Add scriptlet to fix Rpath errors
  - Update file installation paths and names accordingly


author: Yunying Sun <yunying.sun@intel.com> - 2.0.0-2
changelog:
  - Re-enable ESAPI since gcrypt dependency is not an issue for Fedora
  - Bump release version to 2.0.0-2


author: Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-3
changelog:
  - Add tss user if doesn't exist.
  - Update exported symbols map for libtss2-mu
  - esys: Check object handle node before calling compute_session_value
  - esys: fix resource name calculation
  - esys: fix Esys_StartAuthSession called with optional params
  - esys: fix keysize of ECC curve TPM2_ECC_NISTP224
  - esys: fixup compute_encrypted_salt error handling
  - esys: use memcmp in byte array comparison
  - esys: zero out ctx->salt after startAuthSession_finish
  - mu: Remove use of VLAs for Marshalling TPML types
  - return proper error code on memory allocation failure
  - sys: match counter variable type for cmdAuthsArray->count
  - tcti-device: getPollHandles should allow num_handles query
  - tctildr: fix segmentation fault if name_conf is too big
  resolves: rhbz#1879071 rhbz#1855180


author: Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-4
changelog:
  - Fix hmac calculation for tpm2_clear command.
  - Remove private implementation of strndup.
  resolves: rhbz#1920825 rhbz#1940861


author: John Kacur <jkacur@redhat.com> - 2.7-8
changelog:
  - Install kernelshark manpage with kernelshark subpackage, not with trace-cmd
  Resolves: rhbz#1678252


author: Kamil Dudka <kdudka@redhat.com> - 1.7.0-11
changelog:
  - do not escape UTF-8 chars in file names by default in UTF-8 locale (#1480778)
  - modernize spec file (Group, BuildRoot, autosetup, clean, defattr)


author: Jerry Snitselaar <jsnitsel@redhat.com> - 0.3.15-1
changelog:
  - Rebase to 0.3.15
  - Fix CVE-2020-24330 CVE-2020-24331 CVE-2020-24332
  resolves: rhbz#1725782 rhbz#1877517 rhbz#1882402 rhbz#1882414


author: Leah Leshchinsky <lleshchi@redhat.com> - 0.17-2
changelog:
  - Fix typo for variable parm
  - Handle get_policy_and_rtprio exceptions
  - Remove finally block in get_policy_and_rtprio
  Resolves: rhbz#2049746


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.19.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2057602
    - fixed parsing of inline comments
      resolves: rhbz#2060138
    - added support for quotes in isolated_cores specification
      resolves: rhbz#1891036
    - recommend: preset balanced profile for notebook, laptop or portable if
      syspurpose is not defined
      resolves: rhbz#1896717


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.20.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2133814
    - systemd: relax polkit requirement
      resolves: rhbz#2065591
    - sysvinit: fixed path
    - plugin_cpu: added support for pm_qos_resume_latency_us
    - do not exit on duplicate config lines
      resolves: rhbz#2071418
    - profiles: new cpu-partitioning-powersave profile
    - profiles: new profile for AWS EC2
    - API: add support for moving devices between instances
    - D-Bus: send tracebacks through D-Bus only in debug mode
    - Makefile: added fix for python-3.12
    - throughput-performance: set net.core.somaxconn to at least 2048
      resolves: rhbz#1998310
    - plugin_scheduler: do not leak FDs from the perf
      resolves: rhbz#2080227
    - plugin_cpu: added support for intel_pstate scaling driver
    - added support for the API access through the Unix Domain Socket


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.21.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#2182119
    - sap-hana: new profile sap-hana-kvm-guest
      resolves: rhbz#2173740
    - serialized SIGHUP handler to prevent possible bootcmdline corruption
      resolves: rhbz#2215298


author: Patsy Griffin <patsy@redhat.com> - 2022b-1
changelog:
  - Rebase to tzdata-2022b
    - Chile transitions to DST on 2022-09-11, not 2022-09-04
    - 'make install' now defaults LOCALTIME to Factory rather than GMT
    - More zones that are the same since 1970 have been moved to backzone.
    - Include patch for awk workaround.


author: Patsy Griffin <patsy@redhat.com> - 2022c-1
changelog:
  - Rebase to tzdata-2022c - supersedes tzdata-2022b
    - Add a work-around for an awk bug in FreeBSD, macOS, etc.
    - Improve tzselect with respect to intercontinental Zones.


author: Patsy Griffin <patsy@redhat.com> - 2022f-1
changelog:
  - Rebase to tzdata-2022f
    - Mexico will stop observing DST except near the US border.
    - Chihuahua moved to -06 year round starting on 2022-10-30.
    - Fiji no longer observes DST.


author: Patsy Griffin <patsy@redhat.com> - 2022g-1
changelog:
  - Rebase to tzdata-2022g
    - The northern edge of the Mexican state of Chihuahua will
      change time zone to agree with nearby US locations on
      2022-11-30.
    - Added a new Zone America/Ciudad_Juarez that splits from
      America/Ojinaga.


author: Patsy Griffin <patsy@redhat.com> - 2023a-1
changelog:
  - Rebase to tzdata-2023a
    - Egypt reintroduced DST, from April through October.
    - Morocco springs forward April 23, not April 30.
    - Palestine delayed the start of DST this year.


author: Kamil Dudka <kdudka@redhat.com> - 2.17-5
changelog:
  - do not update currency.units from network during build
  - units_cur: validate rate data from server (#1598913)


author: Jakub Martisko <jamartis@redhat.com> - 6.0-38
changelog:
  - Fix CVE-2018-1000035 - heap based buffer overflow when opening
    password protected files.
    Resolves: 1537043


author: Jakub Martisko <jamartis@redhat.com> - 6.0-40
changelog:
  - fix several possibly unterminated strings
    When copying to OEM_CP and ISO_CP strings, the string could end unterminated
    (stncpy does not append '\0').
  - Related: #1602721


author: Miloslav Trmač <mitr@redhat.com> - 1.111-10
changelog:
  - Fix a FBFS with  -Werror=format-security
    Resolves #1444750
  - Fix inconsistent dates in %changelog


author: Jiri Kucera <jkucera@redhat.com> - 1.112-2
changelog:
  - Dropped need to run autotools
  - <sys/sysmacros.h> must be now included manually
    Resolves #1611752
  - Fixed bad FSF address


author: Jiri Kucera <jkucera@redhat.com> - 1.113-2
changelog:
  - Fix typo in pam-panel-icon manpage
    Do not use deprecated selinux API
    Do not use fexecve
    Resolves: #1775931


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.10.1-3
changelog:
  - Replace arch-dependent /usr/include/urcu/config.h with arch-independent
    stub when needed. (bz #1853168)
  - Added CI gating tests (bz #1682555)
  - Resolves: bz #1682555, #1853168


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.41-14
changelog:
  - Integrated the vdo to lvm conversion tool into the vdo management script
    and modified the tool itself to correctly convert the UDS index so that
    dedupe information is not lost by conversion.
  - Resolves: rhbz#1928284


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.62-14
changelog:
  - Removed extraneous fields from the super block of a converted index.
  - Resolves: rhbz#1965546
  - Added a parameter to the lvm conversion tool to specify the amount of
    space to free up.
  - Resolves: rhbz#1966827
  - Fixed calculation of the number of expiring chapters in a converted
    index.
  - Resolves: rhbz#1975546


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.74-14
changelog:
  - Renamed vdo2LVM to vdopreparelvm and moved its installation location to
    /usr/libexec so that it is not in common default paths as this utility is
    intended to be called from LVM, not directly by users.
  - Related: rhbz#1986930


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.3-14
changelog:
  - Added a check to vdopreparelvm to determine whether it has already been
    converted.
  - Resolves: rhbz#2017843


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.7-14
changelog:
  - Fixed bugs in the vdopreparelvm check to determine whether a device has
    already been converted.
  - Resolves: rhbz#2017843
  - Fixed an issue in the vdo-by-dev tool which could result in a failure to
    start vdo devices when some devices in the vdo config file do not exist.
  - Resolves: rhbz#2022154


author: - Andy Walsh <awalsh@redhat.com> - 6.2.6.14-14
changelog:
  - Added a tool to make LVMVDO pools read/write so that support and
    debugging tools may access them.
  - Resolves: rhbz#1999640


author: - Andy Walsh <awalsh@redhat.com> - 6.2.7.17-14
changelog:
  - Fixed excessive vdo2lvm "Retrying" messages.
  - Resolves: rhbz#1986595
  - Fixed a pylint 2+ complaint in the vdo scripts.
  - Resolves: rhbz#2072131
  - Updated vdo script documentation and help text for the uuid option.
  - Resolves: rhbz#2089957


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2021-4193 vim: vulnerable to Out-of-bounds Read
  - CVE-2021-4192 vim: vulnerable to Use After Free


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0261 vim: Heap-based Buffer Overflow in block_insert() in src/ops.c
  - CVE-2022-0318 vim: heap-based buffer overflow in utf_head_off() in mbyte.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - fix test suite after fix for CVE-2022-0318
  - CVE-2022-0359 vim: heap-based buffer overflow in init_ccline() in ex_getln.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-18
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - CVE-2022-0413 vim: use after free in src/ex_cmds.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-19.3
changelog:
  - CVE-2022-1785 vim: Out-of-bounds Write
  - CVE-2022-1897 vim: out-of-bounds write in vim_regsub_both() in regexp.c
  - CVE-2022-1927 vim: buffer over-read in utf_ptr2char() in mbyte.c


author: Richard W.M. Jones <rjones@redhat.com> - 0.5-17
changelog:
  - Remove ldconfig
    https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/SU3LJVDZ7LUSJGZR5MS72BMRAFP3PQQL/


author: Than Ngo <than@redhat.com> - 2.21-17
changelog:
  - Resolves: #2025709, check shell correctly 
  - Resolves: #2009547, which treats function contents as aliases when parsing ksh


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-2
changelog:
  - Fix AP mode PMF disconnection protection bypass (CVE-2019-16275)
  - Fix NULL dereference in d-bus handler when P2P control interface is removed (rh #1752780)
  - enable WIFI_DISPLAY (rh #1755941)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-3
changelog:
  - fix p2p_listen unexpectedly stopped after 5 seconds (rh #1693684)
  - allow changing 'bridge' via D-Bus (rh #1888050)
  - expose OWE configurability via D-Bus (rh #1888718)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-5
changelog:
  - P2P: Fix a corner case in peer addition based on PD Request (CVE-2021-27803)
  - Fix buffer overflow when processing P2P group information (CVE-2021-0326)


author: Pavel Reichl <preichl@redhat.com> - 3.1.8-5
changelog:
  - Batch fixing several issues
  - xfsdump: restoring inventory prevents non-directory files being restored
  -      from tape, Related: rhbz#2245677
  - xfsrestore: Files from the backup go to orphanage dir because of xfsdump
  -      issue, Related: rhbz#2245344
  - xfsdump/xfsrestore: suggest recovery for false roots may be possible using -x,
  -      Related: RHEL-14493


author: Bill O'Donnell <billodo@redhat.com> 5.0.0-6
changelog:
  - xfs_repair: improve AG btree ptr validation (libxfs_verify_agbno) (#1887288)
  - mkfs.xfs: fix ASSERT on too-small device with stripe geometry (#1887401)
  - xfs_repair: fix rebuilding btree block less than minrecs (#1759452)


author: Bill O'Donnell <billodo@redhat.com> 5.0.0-7
changelog:
  - xfs_quota: document how the default quota is stored (#1850188)
  - xfs_db: skip type change if type_f unchanged (#1867474)


author: Weitao Zhou <zhouwt@linux.alibaba.com> - 5.0.0-11.0.1
changelog:
  - Fix gcc10 -fno-common compile issue for compatible with gcc10 build
  - Add atomic write support (joseph.qi@linux.aliabba.com)
  - mkfs: don't trample the gid set in the protofile (hongnan.li@linux.alibaba.com)
  - Add doc sub package (fanhangbo.fhb@alibaba-inc.com)
  - Add fsck log replay support (joseph.qi@linux.aliabba.com)
  - mkfs.xfs: terminate getsubopt arrays properly (mengferry@linux.alibaba.com)
  - mkfs.xfs: fix internal logs' size (mengferry@linux.alibaba.com)
  - xfs_repair: ignore empty xattr leaf blocks (mengferry@linux.alibaba.com)


author: Rob Crittenden <rcritten@redhat.com> - 1.51.0-7
changelog:
  - lib: Prevent more integer overflows (CVE-2022-22822 to CVE-2022-22827)
    (#2058567, #2058576, #2058582, #2058589, #2058595, #2058602)
  - Prevent integer overflow on m_groupSize in doProlog
    (CVE-2021-46143) (#2058560)


author: Pavel Raiskup <praiskup@redhat.com> - 5.2.4-1
changelog:
  - rebase to 5.2.4 (rhbz#1574039), per release notes:
    https://www.mail-archive.com/xz-devel@tukaani.org/msg00295.html


author: Pavel Raiskup <praiskup@redhat.com> - 5.2.4-2
changelog:
  - drop ppc64p7 hack, per fedora devel list discussion:
    https://lists.fedoraproject.org/archives/list/
    devel@lists.fedoraproject.org/thread/2OWD2QRDFBEC6HTPVQ7FMJENH32BWT54/
  - don't explicitly set _FILE_OFFSET_BITS, package uses AC_SYS_LARGEFILE


author: Jakub Martisko <jamartis@redhat.com> - 3.0-22
changelog:
  - Add missing linker flags
  - Port the configure patch from unzip that allows linker flags configuration
    from the spec file
  - Related: #1624188


author: Jakub Martisko <jamartis@redhat.com> - 3.0-23
changelog:
  - Set the ziperr function as noreturn
  - Fix email in the previous chnagelog entry
  - Related: #1602741


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-11
changelog:
  - IBM Z hardware-accelerated deflate for s390x architectures
  - IBM CRC32 optimalization for POWER 8+ architectures
  - fixed firefox crash due to zlib (#1741266)
  - added test for crc32


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-13
changelog:
  - Added -DDFLTCC parameter to configure to enable 
  - Z hardware-accelerated deflate for s390x architectures (#1659433)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-16
changelog:
  - Permit a deflateParams() parameter change
  - Another fix for Z hardware-accelerated deflate for s390x architectures
  - according to previous change by upstream


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-17
changelog:
  - Fixed DFLTCC compression level switching issues (#1875492)
  - Enabled HW compression for compression levels 1 through 6 (#1847438)
  - Fixed inflateSyncPoint() bad return value on z15 (#1888930)


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11.19
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


