# changelog

author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27_rc2.an8]
changelog:
  - anolis: kbuild: fix error remind bug for libelf check (Yuanhe Shu)
  - anolis: configs: enable RCU_TORTURE_TEST for arm64 (Erwei Deng)
  - erofs: use kill_anon_super() to kill super in fscache mode (Jia Zhu)
  - hardirq/nmi: Allow nested nmi_enter() (Peter Zijlstra)
  - cachefiles: make on-demand request distribution fairer (Xin Yin)
  - anolis: cachefiles: refactor cachefiles_ondemand_daemon_read() (Jingbo Xu)
  - cachefiles: fix error return code in cachefiles_ondemand_copen() (Sun Ke)
  - anolis: erofs: update page for .readpages() in fscache mode (Jingbo Xu)
  - anolis: cachefiles: fix volume key setup for cachefiles_open (Jingbo Xu)
  - anolis: cachefiles: replace BUG_ON() with WARN_ON() (Jingbo Xu)
  - xfs: Sanity check flags of Q_XQUOTARM call (Jan Kara)
  - anolis: configs: enable CONFIG_LOCK_TORTURE_TEST for arm64 (Erwei Deng)
  - vfio/pci: Handle concurrent vma faults (liuxinwei)
  - anolis: revert: pci: shorten waiting time in pci_reset_secondary_bus (Yang Su)
  - io_uring: don't convert to jiffies for waiting on timeouts (Jens Axboe)
  - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT (Josh Poimboeuf) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Warn about Spectre v2 LFENCE mitigation (Josh Poimboeuf) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Update link to AMD speculation whitepaper (Kim Phillips) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Use generic retpoline by default on AMD (Kim Phillips) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Josh Poimboeuf) {CVE-2022-0001,CVE-2022-0002}
  - Documentation/hw-vuln: Update spectre doc (Peter Zijlstra) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Add eIBRS + Retpoline options (Peter Zijlstra) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Peter Zijlstra (Intel)) {CVE-2022-0001,CVE-2022-0002}
  - x86,bugs: Unconditionally allow spectre_v2=retpoline,amd (Peter Zijlstra) {CVE-2022-0001,CVE-2022-0002}
  - x86/speculation: Merge one test in spectre_v2_user_select_mitigation() (Borislav Petkov) {CVE-2022-0001,CVE-2022-0002}
  - xen/blkfront: fix leaking data in shared pages (Ziyang Zhang) {CVE-2022-26365}
  - bnx2x: fix potential memory leak in bnx2x_tpa_stop() (Jianglei Nie) {CVE-2022-3542}
  - scsi: qla2xxx: Fix wrong return value in qlt_chk_unresolv_exchg() (Gu Mi)
  - scsi: qla2xxx: Set the qpair in SRB to NULL when SRB is released (Gu Mi)
  - scsi: qla2xxx: Move ABTS code behind qpair (Gu Mi)
  - scsi: qla2xxx: Fix out of order Termination and ABTS response (Gu Mi)
  - scsi: qla2xxx: Add logic to detect ABTS hang and response completion (Gu Mi)
  - dm verity: set DM_TARGET_IMMUTABLE feature flag (Sarthak Kukreti) {CVE-2022-2503}
  - bitops: protect variables in set_mask_bits() macro (Miklos Szeredi)
  - anolis: mm: kidled: improve efficiency of scanning valid PFNs (Rongwei Wang)
  - x86/speculation/mmio: Reuse SRBDS mitigation for SBDS (Pawan Gupta)
  - x86/speculation/mmio: Enable CPU Fill buffer clearing on idle (Pawan Gupta)
  - x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data (Pawan Gupta)
  - x86/speculation: Add a common function for MD_CLEAR mitigation update (Pawan Gupta)
  - x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug (Pawan Gupta)
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to the to Intel CPU family (Tony Luck)
  - x86/cpu: Add Jasper Lake to Intel family (Zhang Rui)
  - x86/cpu: Add Elkhart Lake to Intel family (Gayatri Kammela)
  - perf: Fix sys_perf_event_open() race against self (Peter Zijlstra) {CVE-2022-1729}


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27_rc3.an8]
changelog:
  - anolis: sched/fair: fix sched_group_identity_enabled read error (Cruz Zhao)
  - mm: fix a race on nr_swap_pages (Zhaoyang Huang)
  - anolis: sched/fair: fix group identity fast path omits select_idle_core() (Cruz Zhao)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.an8]
changelog:
  - xfs: fix an ABBA deadlock in xfs_rename (Darrick J. Wong)
  - xfs: Fix deadlock between AGI and AGF when target_ip exists in xfs_rename() (kaixuxia)
  - iomap: Fix negative assignment to unsigned sis->pages in iomap_swapfile_activate (Ritesh Harjani)
  - ext4: prevent partial update of the extent blocks (Zhang Yi)
  - ext4: check for inconsistent extents between index and leaf block (Zhang Yi)
  - ext4: check for out-of-order index extents in ext4_valid_extent_entries() (Zhang Yi)
  - ext4: add check to prevent attempting to resize an fs with sparse_super2 (Josh Triplett)
  - ext4: add reserved GDT blocks check (Zhang Yi)
  - anolis: mm: avoid shmem_getpage_gfp sleep in atomic (Rongwei Wang)
  - anolis: mm: gup:remove FOLL_GET_PGSTABLE flag checking (Simon Guo)
  - anolis: psi: fix compile error when cgroup disabled (Joseph Qi)
  - anolis: io_uring: fix compile error when cgroup disabled (Joseph Qi)
  - anolis: erofs: make fscache and RAFS mode mutually exclusive (Jingbo Xu)
  - anolis: erofs: force bootstrap_path to be regular file (Jingbo Xu)
  - anolis: erofs: make bootstrap_path mandatory in RAFS mode (Jingbo Xu)
  - anolis: erofs: fix erofs_is_fscache_mode() (Jingbo Xu)
  - net: Fix gro aggregation for udp encaps with zero csum (Daniel Borkmann)
  - anolis: rtc: Fix set RTC time delay 500ms on some Zhaoxin SOCs (leoliu)
  - USB: HCD: Fix URB giveback issue in tasklet function (leoliu-oc)
  - anolis: iommu: SMMU will be passthrough on PHYTIUM FT2000 & FT2500 Socs due to hardware limitation (Gu Mi)
  - printk: Drop console_sem during panic (Stephen Brennan)
  - printk: Avoid livelock with heavy printk during panic (Stephen Brennan)
  - printk: disable optimistic spin during panic (Stephen Brennan)
  - printk: Add panic_in_progress helper (Stephen Brennan)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.1.an8]
changelog:
  - anolis: bpf: add reserve fields for bpf structures (Tianchen Ding)
  - xprtrdma: fix incorrect header size calculations (Colin Ian King) {CVE-2022-0812}
  - proc: proc_skip_spaces() shouldn't think it is working on C strings (Linus Torvalds) {CVE-2022-4378}
  - proc: avoid integer type confusion in get_proc_long (Linus Torvalds) {CVE-2022-4378}
  - KVM: x86: do not report a vCPU as preempted outside instruction boundaries (Paolo Bonzini) {CVE-2022-39189}
  - nvme: ensure subsystem reset is single threaded (Keith Busch) {CVE-2022-3169}
  - nvme: Wait for reset state when required (Keith Busch) {CVE-2022-3169}
  - nvme-pci: Allow PCI bus-level PM to be used if ASPM is disabled (Rafael J. Wysocki) {CVE-2022-3169}
  - PCI/ASPM: Add pcie_aspm_enabled() (Rafael J. Wysocki) {CVE-2022-3169}
  - nvme-pci: use host managed power state for suspend (Keith Busch) {CVE-2022-3169}
  - nvme: introduce nvme_sync_io_queues (Chao Leng) {CVE-2022-3169}
  - nvme: include admin_q sync with nvme_sync_queues (Edmund Nadolski) {CVE-2022-3169}
  - nvme-pci: Sync queues on reset (Keith Busch) {CVE-2022-3169}
  - nvme: export get and set features (Keith Busch) {CVE-2022-3169}
  - nvme: Prevent resets during paused controller state (Keith Busch) {CVE-2022-3169}
  - nvme: restrict management ioctls to admin (Keith Busch) {CVE-2022-3169}
  - sch_sfb: Don't assume the skb is still around after enqueueing to child (Toke Høiland-Jørgensen) {CVE-2022-3586}
  - arm64: spectre: increase parameters that can be used to turn off bhb mitigation individually (Liu Song)
  - KVM: arm64: Check arm64_get_bp_hardening_data() didn't return NULL (James Morse)
  - arm64: Use the clearbhb instruction in mitigations (James Morse)
  - arm64: add ID_AA64ISAR2_EL1 sys register (Joey Gouly)
  - KVM: arm64: Allow SMCCC_ARCH_WORKAROUND_3 to be discovered and migrated (James Morse)
  - arm64: Mitigate spectre style branch history side channels (James Morse)
  - KVM: arm64: Add templates for BHB mitigation sequences (James Morse)
  - arm64: proton-pack: Report Spectre-BHB vulnerabilities as part of Spectre-v2 (James Morse)
  - arm64: Add percpu vectors for EL1 (James Morse)
  - arm64: entry: Add macro for reading symbol addresses from the trampoline (James Morse)
  - arm64: entry: Add vectors that have the bhb mitigation sequences (James Morse)
  - arm64: entry: Add non-kpti __bp_harden_el1_vectors for mitigations (James Morse)
  - arm64: entry: Allow the trampoline text to occupy multiple pages (James Morse)
  - arm64: entry: Make the kpti trampoline's kpti sequence optional (James Morse)
  - arm64: entry: Move trampoline macros out of ifdef'd section (James Morse)
  - arm64: entry: Don't assume tramp_vectors is the start of the vectors (James Morse)
  - arm64: entry: Allow tramp_alias to access symbols after the 4K boundary (James Morse)
  - arm64: entry: Move the trampoline data page before the text page (James Morse)
  - arm64: entry: Free up another register on kpti's tramp_exit path (James Morse)
  - arm64: entry: Make the trampoline cleanup optional (James Morse)
  - arm64: entry.S: Add ventry overflow sanity checks (James Morse)
  - arm64: Add Cortex-X2 CPU part definition (Anshuman Khandual)
  - arm64: Add Neoverse-N2, Cortex-A710 CPU part definition (Suzuki K Poulose)
  - arm64: Add part number for Arm Cortex-A77 (Rob Herring)
  - ARM: 9209/1: Spectre-BHB: avoid pr_info() every time a CPU comes out of idle (Ard Biesheuvel)
  - ARM: 9197/1: spectre-bhb: fix loop8 sequence for Thumb2 (Ard Biesheuvel)
  - ARM: 9196/1: spectre-bhb: enable for Cortex-A15 (Ard Biesheuvel)
  - ARM: fix Thumb2 regression with Spectre BHB (Russell King (Oracle))
  - ARM: Spectre-BHB: provide empty stub for non-config (Randy Dunlap)
  - ARM: fix build warning in proc-v7-bugs.c (Russell King (Oracle))
  - ARM: Do not use NOCROSSREFS directive with ld.lld (Nathan Chancellor)
  - ARM: fix co-processor register typo (Russell King (Oracle))
  - kbuild: add CONFIG_LD_IS_LLD (Sami Tolvanen)
  - ARM: fix build error when BPF_SYSCALL is disabled (Emmanuel Gil Peyrot)
  - ARM: include unprivileged BPF status in Spectre V2 reporting (Russell King (Oracle))
  - ARM: Spectre-BHB workaround (Russell King (Oracle))
  - ARM: use LOADADDR() to get load address of sections (Russell King (Oracle))
  - ARM: early traps initialisation (Russell King (Oracle))
  - ARM: report Spectre v2 status through sysfs (Russell King (Oracle))
  - arm/arm64: smccc/psci: add arm_smccc_1_1_get_conduit() (Mark Rutland)
  - arm/arm64: Provide a wrapper for SMCCC 1.1 calls (Steven Price)
  - xen/netfront: fix leaking data in shared pages (Roger Pau Monne) {CVE-2022-33740}
  - powerpc/32: Fix overread/overwrite of thread_struct via ptrace (Michael Ellerman) {CVE-2022-32981}
  - floppy: disable FDRAWCMD by default (Willy Tarreau) {CVE-2022-33981,CVE-2022-1836}
  - x86/speculation: Add LFENCE to RSB fill sequence (Pawan Gupta) {CVE-2022-26373}
  - x86/speculation: Add RSB VM Exit protections (Daniel Sneddon) {CVE-2022-26373}
  - x86/speculation: Fill RSB on vmexit for IBRS (Josh Poimboeuf) {CVE-2022-26373}
  - x86/entry: Add kernel IBRS implementation (Peter Zijlstra) {CVE-2022-26373}
  - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value (Peter Zijlstra) {CVE-2022-26373}
  - x86/cpufeatures: Move RETPOLINE flags to word 11 (Peter Zijlstra) {CVE-2022-26373}
  - xen/arm: Fix race in RB-tree based P2M accounting (Oleksandr Tyshchenko) {CVE-2022-33744}
  - tcp: drop the hash_32() part from the index calculation (Willy Tarreau) {CVE-2022-32296}
  - tcp: increase source port perturb table to 2^16 (Willy Tarreau) {CVE-2022-32296}
  - tcp: dynamically allocate the perturb table used by source ports (Willy Tarreau) {CVE-2022-32296}
  - tcp: add small random increments to the source port (Kangjie Xu) {CVE-2022-32296}
  - tcp: resalt the secret every 10 seconds (Eric Dumazet) {CVE-2022-32296}
  - tcp: use different parts of the port_offset for index and offset (Willy Tarreau) {CVE-2022-32296}
  - tcp: change source port randomizarion at connect() time (Willy Tarreau) {CVE-2022-32296}
  - kcm: avoid potential race in kcm_tx_work (Eric Dumazet) {CVE-2022-3521}
  - af_key: Do not call xfrm_probe_algs in parallel (Herbert Xu) {CVE-2022-3028}
  - mISDN: fix use-after-free bugs in l1oip timer handlers (Duoming Zhou) {CVE-2022-3565}
  - vsock: Fix memory leak in vsock_connect() (Peilin Ye) {CVE-2022-3629}
  - nfp: fix use-after-free in area_cache_get() (Jialiang Wang) {CVE-2022-3545}
  - netfilter: nf_conntrack_irc: Fix forged IP logic (David Leadbeater) {CVE-2022-2663}
  - Bluetooth: L2CAP: Fix attempting to access uninitialized memory (Luiz Augusto von Dentz) {CVE-2022-42895}
  - igmp: Add ip_mc_list lock in ip_check_mc_rcu (Liu Jian) {CVE-2022-20141}
  - net/x25: Fix null-ptr-deref caused by x25_disconnect (Duoming Zhou) {CVE-2022-1516}
  - arm64: fix oops in concurrently setting insn_emulation sysctls (haibinzhang (张海斌))
  - efi: capsule-loader: Fix use-after-free in efi_capsule_write (Hyunwoo Kim) {CVE-2022-40307}
  - wifi: brcmfmac: Fix potential buffer overflow in brcmf_fweh_event_worker() (Dokyung Song) {CVE-2022-3628}
  - usb: mon: make mmapped memory read only (Tadeusz Struk) {CVE-2022-43750}
  - r8152: Rate limit overflow messages (Andrew Gaul) {CVE-2022-3594}
  - atm: idt77252: fix use-after-free bugs caused by tst_timer (Duoming Zhou) {CVE-2022-3635}
  - video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write (Hyunwoo Kim) {CVE-2022-39842}
  - media: v4l2-mem2mem: Apply DST_QUEUE_OFF_BASE on MMAP buffers across ioctls (Chen-Yu Tsai) {CVE-2022-20369}
  - sr9700: sanity check for packet length (Oliver Neukum) {CVE-2022-26966}
  - parisc: Declare pci_iounmap() parisc version only when CONFIG_PCI enabled (Helge Deller)
  - pci_iounmap'2: Electric Boogaloo: try to make sense of it all (Linus Torvalds)
  - asm-generic/io.h: Fix !CONFIG_GENERIC_IOMAP pci_iounmap() implementation (Lorenzo Pieralisi)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.2.an8]
changelog:
  - anolis: nfsd: remove nfsd_reply_cache_shutdown() in nfsd_exit_net (Yuanhe Shu)
  - RDMA/core: Don't infoleak GRH fields (Leon Romanovsky) {CVE-2021-3923}
  - vgacon: Fix for missing check in scrollback handling (Yunhai Zhang) {CVE-2020-14331}
  - btrfs: fix race between quota disable and quota assign ioctls (Filipe Manana) {CVE-2023-1611}
  - Fix double fget() in vhost_net_set_backend() (Al Viro)
  - seq_buf: Fix overflow in seq_buf_putmem_hex() (Yun Zhou) {CVE-2023-28772}
  - drm/nouveau/mmu: add more general vmm free/node handling functions (Ben Skeggs) {CVE-2023-0030}
  - media: rc: Fix use-after-free bugs caused by ene_tx_irqsim() (ly929421) {CVE-2023-1118}
  - USB: core: Prevent nested device-reset calls (Alan Stern) {CVE-2022-4662}
  - Bluetooth: L2CAP: Fix u8 overflow (zzzzzzzzzy9) {CVE-2022-45934}
  - drm/amdkfd: Check for null pointer after calling kmemdup (Jiasheng Jiang) {CVE-2022-3108}
  - l2tp: Serialize access to sk_user_data with sk_callback_lock (Jakub Sitnicki) {CVE-2022-4129}
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu (Maxim Mikityanskiy) {CVE-2022-3564}
  - tcp/udp: Fix memory leak in ipv6_renew_options(). (Kuniyuki Iwashima) {CVE-2022-3524}
  - nfc: fix refcount leak in llcp_sock_connect() (Xiaoming Ni)
  - Bluetooth: L2CAP: Fix use-after-free caused by l2cap_chan_put (Luiz Augusto von Dentz) {CVE-2022-20566}
  - netfilter: nf_tables: fix null deref due to zeroed list head (张钰 10307750)
  - nfc: fix refcount leak in llcp_sock_bind() (Xiaoming Ni)
  - net: sched: fix race condition in qdisc_graft() (Eric Dumazet) {CVE-2023-0590}
  - nfc: fix memory leak in llcp_sock_connect() (Xiaoming Ni)
  - net/sched: tcindex: update imperfect hash filters respecting rcu (Pedro Tammela) {CVE-2023-1281}
  - net: sched: cbq: dont intepret cls results when asked to drop (Jamal Hadi Salim) {CVE-2023-23454}
  - net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup (Jann Horn) {CVE-2022-2964}
  - net: mpls: fix stale pointer if allocation fails during device rename (Jakub Kicinski) {CVE-2023-26545}
  - sctp: fail if no bound addresses can be used for a given scope (Marcelo Ricardo Leitner) {CVE-2023-1074}
  - ipv6: raw: Deduct extension header length in rawv6_push_pending_frames (Herbert Xu) {CVE-2023-0394}
  - net: sched: disallow noqueue for qdisc classes (Frederick Lawler) {CVE-2022-47929}
  - net: sched: atm: dont intepret cls results when asked to drop (Jamal Hadi Salim) {CVE-2023-23455}
  - wifi: rndis_wlan: Prevent buffer overflow in rndis_query_oid (Szymon Heidrich) {CVE-2023-23559}
  - net: mvpp2: fix mvpp2 debugfs leak (Russell King (Oracle)) {CVE-2022-3535}
  - memcg: enable accounting of ipc resources (Vasily Averin) {CVE-2021-3759}
  - mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse (Jann Horn) {CVE-2022-42703}
  - hv_netvsc: Add check for kvmalloc_array (Jiasheng Jiang) {CVE-2022-3107}
  - NFC: netlink: fix sleep in atomic bug when firmware download timeout (feng.wei) {CVE-2022-1975}
  - anolis: x86/kasan: Map shadow for percpu pages on demand (Xuchun Shang)
  - anolis: x86/kasan: Add helpers to align shadow addresses up and down (Xuchun Shang)
  - net/ulp: prevent ULP without clone op from entering the LISTEN status (Paolo Abeni) {CVE-2023-0461}
  - x86/mm: Randomize per-cpu entry area (Peter Zijlstra) {CVE-2023-0597}
  - anolis: random32: put prandom_init in a earlier step (Xuchun Shang) {CVE-2023-0597}
  - x86/hw_breakpoint: Prevent data breakpoints on direct GDT (Lai Jiangshan) {CVE-2023-0597}
  - x86/hw_breakpoint: Add within_area() to check data breakpoints (Lai Jiangshan) {CVE-2023-0597}
  - x86/hw_breakpoint: Prevent data breakpoints on cpu_entry_area (Andy Lutomirski) {CVE-2023-0597}
  - x86/pti/32: Calculate the various PTI cpu_entry_area sizes correctly, make the CPU_ENTRY_AREA_PAGES assert precise (Ingo Molnar) {CVE-2023-0597}
  - xen/netback: don't call kfree_skb() with interrupts disabled (Juergen Gross)
  - Bluetooth: L2CAP: Fix accepting connection request for invalid SPSM (Luiz Augusto von Dentz) {CVE-2022-42896}
  - net: sched: sch_teql: fix null-pointer dereference (Pavel Tikhomirov)
  - tcp/dccp: fix possible race __inet_lookup_established() (Eric Dumazet)
  - power: supply: wm8350-power: Add missing free in free_charger_irq (Jiasheng Jiang) {CVE-2022-3111}
  - media: em28xx: initialize refcount before kref_get (Dongliang Mu) {CVE-2022-3239}
  - media: dvb-core: Fix UAF due to refcount races at releasing (Takashi Iwai) {CVE-2022-41218}
  - ALSA: pcm: Move rwsem lock inside snd_ctl_elem_read to prevent UAF (Clement Lecigne) {CVE-2023-0266}
  - drivers: net: slip: fix NPD bug in sl_tx_timeout() (Duoming Zhou) {CVE-2022-41858}
  - xen/netfront: force data bouncing when backend is untrusted (Roger Pau Monne) {CVE-2022-33741}
  - tcp: Fix data races around icsk->icsk_af_ops. (Kuniyuki Iwashima) {CVE-2022-3566}
  - anolis: bond: broadcast ARP or ND messages to all slaves (Tony Lu)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.3.an8]
changelog:
  - nvme-pci: rerun irq setup on IO queue init errors (Keith Busch)
  - nvme-pci: refactor nvme_disable_io_queues (Christoph Hellwig)


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.4.an8]
changelog:
  - iommu/vt-d: Fix agaw for a supported 48 bit guest address width (Gu Mi)
  - netfilter: nf_tables: deactivate anonymous set from preparation phase (Pablo Neira Ayuso) {CVE-2023-32233}


author: Qiao Ma <mqaio@linux.alibaba.com> [4.19.91-27.5.an8]
changelog:
  - iomap: Support inline data with block size < page size (Matthew Wilcox (Oracle))
  - iomap: support reading inline data from non-zero pos (Gao Xiang)
  - iomap: Don't create iomap_page objects for inline files (Andreas Gruenbacher)
  - selinux: fix race condition when computing ocontext SIDs (gcc_2023)
  - virtio_blk: fix the discard_granularity and discard_alignment queue limits (Christoph Hellwig)
  - virtio-blk: Don't use MAX_DISCARD_SEGMENTS if max_discard_seg is zero (Xie Yongji)
  - ext4: fix use-after-free read in ext4_find_extent for bigalloc + inline (Ye Bin)
  - ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline (Eric Whitney)
  - ext4: fix corruption when online resizing a 1K bigalloc fs (Baokun Li)
  - ext4: avoid resizing to a partial cluster size (Kiselev, Oleg)
  - ext4: reduce computation of overhead during resize (Kiselev, Oleg)
  - ext4: fix extent status tree race in writeback error recovery path (Eric Whitney)
  - ext4: update s_overhead_clusters in the superblock during an on-line resize (Theodore Ts'o)
  - ext4: force overhead calculation if the s_overhead_cluster makes no sense (Theodore Ts'o)
  - ext4: fix avefreec in find_group_orlov (Pan Dong)
  - isolcpus: Affine unbound kernel threads to housekeeping cpus (Marcelo Tosatti)
  - kthread: Switch to cpu_possible_mask (Marcelo Tosatti)
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Thadeu Lima de Souza Cascardo) {CVE-2023-35001}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (D. Wythe) {CVE-2023-3117}
  - sched/rt: pick_next_rt_entity(): check list_entry (Pietro Borrello) {CVE-2023-1077}
  - relayfs: fix out-of-bounds access in relay_file_read (Zhang Zhengming) {CVE-2023-3268}
  - kernel/relay.c: fix read_pos error when multiple readers (Pengcheng Yang) {CVE-2023-3268}
  - drm/i915/gvt: fix double free bug in split_2MB_gtt_entry (Zheng Wang) {CVE-2022-3707}
  - usb: gadget: rndis: prevent integer overflow in rndis_set_response() (Dan Carpenter) {CVE-2022-20423}
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work (Zheng Wang) {CVE-2023-1989}
  - power: supply: da9150: Fix use after free bug in da9150_charger_remove due to race condition (Zheng Wang) {CVE-2023-30772}
  - phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function (Miaoqian Lin) {CVE-2023-23000}
  - HID: check empty report_list in hid_validate_values() (Pietro Borrello) {CVE-2023-1073}
  - staging: rtl8712: fix use after free bugs (Dan Carpenter) {CVE-2022-4095}
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove due to race condition (Zheng Wang) {CVE-2023-1855}
  - HID: roccat: Fix use-after-free in roccat_read() (Hyunwoo Kim) {CVE-2022-41850}
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race condition (Zheng Wang) {CVE-2023-1990}
  - prlimit: do_prlimit needs to have a speculation check (Greg Kroah-Hartman) {CVE-2023-0458}
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach (Zheng Wang) {CVE-2023-1670}
  - media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors (shi.xue) {CVE-2020-0404}
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() (Baisong Zhong) {CVE-2023-28328}
  - i2c: xgene-slimpro: Fix out-of-bounds bug in xgene_slimpro_i2c_xfer() (Wei Chen) {CVE-2023-2194}
  - drm/vmwgfx: Validate the box size for the snooped cursor (Zack Rusin) {CVE-2022-36280}
  - x86/bugs: Flush IBP in ib_prctl_set() (Rodrigo Branco) {CVE-2023-0045}
  - drm/msm/dpu: Add check for pstates (Jiasheng Jiang) {CVE-2023-3220}
  - memstick: r592: Fix UAF bug in r592_remove due to race condition (Zheng Wang) {CVE-2023-35825}
  - tap: tap_open(): correctly initialize socket uid (Pietro Borrello) {CVE-2023-1076}
  - tun: tun_chr_open(): correctly initialize socket uid (Pietro Borrello) {CVE-2023-1076}
  - net: add sock_init_data_uid() (Pietro Borrello) {CVE-2023-1076}
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Hangyu Hua) {CVE-2023-35788}
  - net/sched: Retire tcindex classifier (Jamal Hadi Salim) {CVE-2023-1829}
  - ntfs: fix out-of-bounds read in ntfs_attr_find() (Hawkins Jiawei) {CVE-2023-26607}
  - ntfs: fix use-after-free in ntfs_ucsncmp() (ChenXiaoSong)
  - fs: hfsplus: fix UAF issue in hfsplus_put_super (Dongliang Mu) {CVE-2023-2985}
  - rds: rds_rm_zerocopy_callback() use list_first_entry() (Pietro Borrello) {CVE-2023-1078}
  - arm64: PCI: Preserve firmware configuration when desired (Benjamin Herrenschmidt)
  - arm64: PCI: Allow resource reallocation if necessary (Benjamin Herrenschmidt)
  - xen/blkfront: force data bouncing when backend is untrusted (Roger Pau Monne) {CVE-2022-33742.}
  - virtio_net: suppress cpu stall when free_unused_bufs (Wenliang Wang)
  - virtio_net: split free_unused_bufs() (Xuan Zhuo)
  - ext4: correct the misjudgment in ext4_iget_extra_inode (Baokun Li) {CVE-2023-2513}
  - ext4: correct max_inline_xattr_value_size computing (Baokun Li) {CVE-2023-2513}
  - ext4: fix use-after-free in ext4_xattr_set_entry (Baokun Li) {CVE-2023-2513}
  - ext4: add EXT4_INODE_HAS_XATTR_SPACE macro in xattr.h (Baokun Li) {CVE-2023-2513}
  - dm ioctl: fix nested locking in table_clear() to remove deadlock concern (Mike Snitzer) {CVE-2023-2269}
  - ext4: avoid cycles in directory h-tree (Jan Kara) {CVE-2022-1184}
  - ext4: verify dir block before splitting it (Jan Kara) {CVE-2022-1184}
  - ovl: enable RCU'd ->get_acl() (Miklos Szeredi)
  - anolis: Revert "anolis: erofs,ovl: bypass [override|revert]_creds for overlayfs" (Jingbo Xu)
  - anolis: Revert "anolis: erofs,ovl: enable RCU'd ->get_acl()" (Jingbo Xu)
  - anolis: virtio-blk: skip BUG_ON() in virtio_queue_rq() for discard command (fupan)


author: Qinyun Tan <qinyuntan@linux.alibaba.com> [4.19.91-27.6.an8]
changelog:
  - driver core: auxiliary bus: make remove function return void (Greg Kroah-Hartman)
  - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Peter Ujfalusi)
  - driver core: auxiliary bus: Fix calling stage for auxiliary bus init (Dave Jiang)
  - driver core: auxiliary bus: Fix auxiliary bus shutdown null auxdrv ptr (Dave Jiang)
  - anolis: config: Add AUXILIARY_BUS support in anolis defconfig (cuishw)
  - Add auxiliary bus support (Dave Ertman)
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (M A Ramdhan) {CVE-2023-3776}
  - net: tun: fix bugs for oversize packet when napi frags enabled (Ziyang Xuan) {CVE-2023-3812}
  - tun: fix return value when the number of iovs exceeds MAX_SKB_FRAGS (Yunjian Wang) {CVE-2023-3812}
  - anolis: configs: disable CONFIG_BPFILTER (Tianchen Ding)
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Pablo Neira Ayuso)
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Pablo Neira Ayuso)
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (Pablo Neira Ayuso)
  - anolis: Revert "netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE" (tangbin)
  - anolis: mm: unlock zdm_lock after delete zdm (Ning Zhang)
  - net: sched: sch_qfq: prevent slab-out-of-bounds in qfq_activate_agg (Gwangun Jung) {CVE-2023-31436}
  - perf script python: Add Python3 support to tests/attr.py (Tony Jones)
  - nvme-pci: Fix controller freeze wait disabling (Keith Busch)
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (t.feng) {CVE-2023-3090}
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Pedro Tammela) {CVE-2023-3611}
  - net/sched: cls_u32: Fix reference counter leak leading to overflow (Lee Jones) {CVE-2023-3609}
  - gfs2: Don't deref jdesc in evict (Bob Peterson) {CVE-2023-3212,CVE-2023-3212}
  - btrfs: unset reloc control if transaction commit fails in prepare_to_relocate() (Zixuan Fu) {CVE-2023-3111}
  - btrfs: check return value of btrfs_commit_transaction in relocation (Josef Bacik) {CVE-2023-3111}
  - xfs: verify buffer contents when we skip log replay (Darrick J. Wong) {CVE-2023-2124}
  - ext4: avoid a potential slab-out-of-bounds in ext4_group_desc_csum (Tudor Ambarus) {CVE-2023-34256}
  - uaccess: Add speculation barrier to copy_from_user() (Dave Hansen) {CVE-2023-0459}
  - media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() (Takashi Iwai) {CVE-2023-31084}
  - anolis: sched/isolation: fix a memory leak in procfs (Tianchen Ding)
  - KVM: nVMX: add missing consistency checks for CR0 and CR4 (Paolo Bonzini) {CVE-2023-30456}
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress (Mike Christie) {CVE-2023-2162}
  - bpf: fix buggy r0 retval refinement for tracing helpers (Daniel Borkmann)
  - erofs: fix misbehavior of unsupported chunk format check (Gao Xiang)


author: Qinyun Tan <qinyuntan@linux.alibaba.com> [4.19.91-27.8.an8]
changelog:
  - CIFS: Fix retry mid list corruption on reconnects (Pavel Shilovsky)
  - cifs:smbd When reconnecting to server, call smbd_destroy() after all MIDs have been called (Long Li)
  - cifs: Call MID callback before destroying transport (Long Li)
  - smbd: Make upper layer decide when to destroy the transport (Long Li)
  - cifs: smb2 commands can not be negative, remove confusing check (Steve French)
  - ipmi_si: Phytium S2500 workaround for MMIO-based IPMI (Gu Mi)
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet (Zhengchao Shao) {CVE-2023-6932}
  - anolis: inspur-drm: Support build on arm64 (wangkaiyuan)
  - perf/core: Fix potential NULL deref (Peter Zijlstra) {CVE-2023-5717}
  - perf: Disallow mis-matched inherited group reads (Peter Zijlstra) {CVE-2023-5717}
  - perf: Fix perf_event_validate_size() lockdep splat (Mark Rutland) {CVE-2023-6931}
  - perf: Fix perf_event_validate_size() (Peter Zijlstra) {CVE-2023-6931}
  - bluetooth: Perform careful capability checks in hci_sock_ioctl() (Ruihan Li) {CVE-2023-2002}
  - netfilter: xt_u32: validate user space input (Wander Lairson Costa) {CVE-2023-39192}
  - tipc: fix NULL deref in tipc_link_xmit() (Hoang Le) {CVE-2023-1390}
  - media: mceusb: Use new usb_control_msg_*() routines (Alan Stern) {CVE-2022-3903}
  - USB: correct API of usb_control_msg_send/recv (Oliver Neukum) {CVE-2022-3903}
  - USB: add usb_control_msg_send() and usb_control_msg_recv() (Greg Kroah-Hartman) {CVE-2022-3903}
  - USB: move snd_usb_pipe_sanity_check into the USB core (Greg Kroah-Hartman) {CVE-2022-3903}
  - anolis: configs: enable CONFIG_NVME_TCP (Qinyun Tan)
  - anolis: configs: refresh anolis configs (Qinyun Tan)
  - firewire: fix potential uaf in outbound_phy_packet_callback() (Chengfeng Ye) {CVE-2023-3159}
  - kobject: Fix slab-out-of-bounds in fill_kobj_path() (Wang Hai) {CVE-2023-45863}
  - media: vivid: dev->bitmap_cap wasn't freed in all cases (Hans Verkuil) {CVE-2023-0615}
  - media: saa7134: fix use after free bug in saa7134_finidev due to race condition (Zheng Wang) {CVE-2023-35823}
  - HID: intel_ish-hid: Add check for ishtp_dma_tx_map (Jiasheng Jiang) {CVE-2023-3358}
  - vc_screen: modify vcs_size() handling in vcs_read() (George Kennedy) {CVE-2023-3567}
  - vc_screen: don't clobber return value in vcs_read (Thomas Weißschuh) {CVE-2023-3567}
  - vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF (George Kennedy) {CVE-2023-3567}
  - HID: asus: use spinlock to safely schedule workers (Pietro Borrello) {CVE-2023-1079}
  - HID: asus: use spinlock to protect concurrent accesses (Pietro Borrello) {CVE-2023-1079}
  - HID: asus: Remove check for same LED brightness on set (Luke D. Jones) {CVE-2023-1079}
  - igb: set max size RX buffer when store bad packet is enabled (Radoslaw Tyl) {CVE-2023-45871}
  - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO (Lee, Chun-Yi) {CVE-2023-31083}
  - mm/page-writeback: Fix performance when BDI's share of ratio is 0. (Chi Wu)
  - x86/cpu/amd: Add a Zenbleed fix (Borislav Petkov (AMD)) {CVE-2023-20593}
  - x86/bugs: Increase the x86 bugs vector size to two u32s (Borislav Petkov (AMD)) {CVE-2023-20569}
  - net: sched: sch_qfq: Fix UAF in qfq_dequeue() (valis) {CVE-2023-4921}
  - tcp: Reduce chance of collisions in inet6_hashfn(). (Stewart Smith) {CVE-2023-1206}
  - net: vmxnet3: fix possible use-after-free bugs in vmxnet3_rq_alloc_rx_buf() (Zixuan Fu) {CVE-2023-4387}
  - ipv6: sr: fix out-of-bounds read when setting HMAC data. (David Lebrun) {CVE-2023-2860}
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve (Budimir Markovic) {CVE-2023-4623}
  - net/sched: Retire rsvp classifier (Jamal Hadi Salim) {CVE-2023-42755}
  - xen/netback: Ensure protocol headers don't fall in the non-linear area (Ross Lagerwall) {CVE-2022-3643}
  - fbdev: smscufx: Fix use-after-free in ufx_ops_open() (Hyunwoo Kim) {CVE-2022-41849}
  - phy: tegra: xusb: Fix return value of tegra_xusb_find_port_node function (Miaoqian Lin) {CVE-2023-23000}
  - media: dm1105: Fix use after free bug in dm1105_remove due to race condition (Zheng Wang) {CVE-2023-35824}
  - usb: gadget: udc: renesas_usb3: Fix use after free bug in renesas_usb3_remove due to race condition (Zheng Wang) {CVE-2023-35828}
  - ubi: Refuse attaching if mtd's erasesize is 0 (Zhihao Cheng) {CVE-2023-31085}
  - media: usb: siano: Fix warning due to null work_func_t function pointer (Duoming Zhou) {CVE-2023-4132}
  - media: usb: siano: Fix use after free bugs caused by do_submit_urb (Duoming Zhou) {CVE-2023-4132}
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (Zheng Wang) {CVE-2022-3424}
  - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() (Hyunwoo Kim) {CVE-2022-45887}
  - arm64: Add AMPERE1 to the Spectre-BHB affected list (D Scott Phillips) {CVE-2023-3006}
  - fs: jfs: fix possible NULL pointer dereference in dbFree() (Zixuan Fu) {CVE-2023-4385}
  - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Jingbo Xu)
  - anolis: watchdog: enlarge watchdog_thresh limit (Cruz Zhao)
  - anolis: ext4: fix O_DIRECT+O_SYNC semantics (Joseph Qi)
  - anolis: crypto: ccp: Fix PSP interrupt register's write race (fangbaoshun)
  - anolis: configs: Disable inspur-drm on arm64 (Guixin Liu)
  - anolis: inspur-drm: Add X86_64 dependency (Guixin Liu)
  - anolis: config: Enable inspur drm module (Guixin Liu)
  - anolis: drm/inspur/inspur-drm: Add inspur drm driver (wangkaiyuan)
  - anolis: config, modsign: enable CONFIG_SYSTEM_EXTRA_CERTIFICATE to support insert a certificate to the kernel image without recompiling the kernel (YiLin.Li)
  - kvm: initialize all of the kvm_debugregs structure before sending it to userspace (Greg Kroah-Hartman) {CVE-2023-1513}
  - fbcon: Check font dimension limits (Samuel Thibault) {CVE-2023-3161}
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage(). (Kuniyuki Iwashima)
  - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (valis) {CVE-2023-4128}
  - ext4: only update i_reserved_data_blocks on successful block allocation (Baokun Li)
  - ext4: correct inline offset when handling xattrs in inode body (Eric Whitney)


author: Qinyun Tan <qinyuntan@linux.alibaba.com> [4.19.91-27.8.an8]
changelog:
  * Tue Feb 20 2024 Qinyun Tan <qinyuntan@linux.alibaba.com> [4.19.91-27.8_rc2.an8]
  - ext4: find old entry again if failed to rename whiteout (zhangyi (F))
  - ext4: fix bug for rename with RENAME_WHITEOUT (yangerkun)
  - anolis: blk-iocost: fix ABBA deadlock when writing blkio.cost.qos (Jingbo Xu)
  - ext4: fix check to prevent false positive report of incorrect used inodes (Zhang Yi)


author: [4.19.91-28.5.an8]
changelog:
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu)
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu)
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu)
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu)
  - crypto: authenc - use memcpy_sglist() instead of null skcipher (Eric Biggers)
  - crypto: algif_aead - snapshot IV for async AEAD requests (Douya Le)
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu)
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher (Eric Biggers)
  - crypto: scatterwalk - Backport memcpy_sglist() (Eric Biggers)


author: Tao Xu <tao.xt@alibaba-inc.com> - 2.3.3-2
changelog:
  - Enable async SSL mode build for CPU acceleration
  - Fixes for resolv.conf detection and specification


