# changelog

author: Lubomir Rintel <lrintel@redhat.com> - 1:1.20.0-0.1
changelog:
  - Update to a 1.20 snapshot
  - core: fix a possible crash on device removal (rh #1659790)
  - core: fix automatic activation of software deviecs (rh #1667874)
  - team: use strict JSON parsing for configuration (rh #1691619)
  - team: don't kill teamd for external devices (rh #1693142)
  - logging: don't misuse SYSLOG_FACILITY field in journal (rh #1709741)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.20.0-0.2
changelog:
  - Update to a newer 1.20 snapshot
  - ovs: support dpdk interfaces (rh #1612503)
  - libnm-core: change unsupported modes for arp_ip_targets bond option (rh #1718173)
  - ipv6: add 'disabled' method (rh #1643841)
  - device: fix matching parent device by connection UUID (rh #1716438)
  - cli: fix default value for team.runner-min-ports (rh #1716987)
  - initrd: re-enable the generator (rh #1626348)


author: Thomas Haller <thaller@redhat.com> - 1:1.20.0-0.4
changelog:
  - Update to 1.20-rc1 snapshot
  - settings: support read-only directory for keyfile profiles (rh #1674545)
  - settings: add AddConnection2 D-Bus API to suppress autoconnect (rh #1677068)
  - settings: add no-reapply flat to Update2 D-Bus API (rh #1677070)
  - openvswitch: don't release slaves on quit (rh #1733709)
  - dhcp: expose private options for internal DHCP plugin (rh #1663253)
  - device: fix route table setting when re-activating device (rh #1719318)
  - man: clarify example in nm-openvswitch manual page (rh #1638038)
  - man: various improvements of manual pages (rh #1612554)


author: Thomas Haller <thaller@redhat.com> - 1:1.20.0-1
changelog:
  - Update to 1.20.0 release
  - fix license comments for RPM package (rh #1723395)
  - dhcp: disable experimental nettools DHCP plugin


author: Thomas Haller <thaller@redhat.com> - 1:1.20.0-3
changelog:
  - wifi: detect FT support per device to fix issues with driver support (rh #1743730)
  - doc: fix default values in pre-generated documentation (rh #1737945)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.20.0-5
changelog:
  - ipv6: disable kernel handling of RAs (accept_ra) (rh #1734470)
  - device: fix setting MTU lower than 1280 when IPv6 is disabled (rh #1753128)


author: Pino Toscano <ptoscano@redhat.com> - 1.10.1-3
changelog:
  - Backport some upstream commits to fix few memory leaks, and potential
    memory issues (RHBZ#1602446)


author: Pino Toscano <ptoscano@redhat.com> - 1.10.1-4
changelog:
  - Grub: better handle invalid grub.conf files (RHBZ#1649262)
  - Sudoers: handle "always_query_group_plugin" option (RHBZ#1649299)


author: Pino Toscano <ptoscano@redhat.com> - 1.10.1-6
changelog:
  - Semanage: new lens (RHBZ#1652840)
  - Add "Provides: bundled(gnulib)" to augeas-libs, as it embeds gnulib
    (RHBZ#1653768)


author: Pino Toscano <ptoscano@redhat.com> - 1.12.0-2.el8_1.1
changelog:
  - Krb5: improve handling of [dbmodules]; allow include/includedir directives
    everywhere (RHBZ#1800552)


author: Nick Clifton <nickc@redhat.com> 2.30-58
changelog:
  - Stop the BFD library from complaining about sections with multiple sets of relocations.  (#1749084)


author: Nick Clifton <nickc@redhat.com> - 2.30-58.2
changelog:
  - Allow the BFD library to handle the copying of files containing secondary reloc sections.  (#1803825)


author: Kamil Dudka <kdudka@redhat.com> - 8.29-7
changelog:
  - add provides to coreutils-single to make it a drop-in replacement (#1572693)
  - reintroduce very old Provides (mktemp, sh-utils, textwrap, fileutils, stat)


author: Kamil Dudka <kdudka@redhat.com> - 8.29-8
changelog:
  - ls: increase the allowed abmon width from 5 to 12 (#1577872)
  - date, ls: pick strftime fixes from glibc to improve locale support (#1577872)


author: Kamil Dudka <kdudka@redhat.com> - 8.30-5
changelog:
  - sync: fix open() fallback bug (#1602463)
  - fix implicit declaration warning in coreutils-getgrouplist.patch (#1602463)


author: Lukas Nykryn <lnykryn@redhat.com> - 049-17.git20190725
changelog:
  - rngd: new module running early during boot to help generating entropy when system's default entropy sources are poor (e.g. use of SSD disks or UEFI RNG not available)


author: Lukas Nykryn <lnykryn@redhat.com> - 049-24.git20190802
changelog:
  - 95fcoe: load 'libfcoe' module as a fallback
  - 99base: enable the initqueue in both 'dracut --add-device' and 'dracut --mount' cases
  - dracut: let module handling function accept optional path option
  - squash: also squash systemctl if switch-root is not needed
  - squash: fix and simplify required_in_root
  - squash: squash systemd binary and udevadm


author: Radovan Sroka <rsroka@redhat.com> - 0.8.8-1
changelog:
  - New upstream release
  - Added new DNF plugin that can update the trust database when rpms are installed
  - Added support for FAN_OPEN_EXEC_PERM


author: Radovan Sroka <rsroka@redhat.com> - 0.8.10-2
changelog:
  - Convert hashes to lowercase like sha256sum outputs
  - Stop littering STDOUT output for dnf plugin in fapolicyd
  Resolves: rhbz#1721496


author: Radovan Sroka <rsroka@redhat.com> - 0.8.10-3.1
changelog:
  RHEL 8.1.Z
  - fixed: fapolicyd blocks dracut from generating initramfs
  - changed default fapolicyd.rules
  Resolves: rhbz#1791856


author: Eric Garver <egarver@redhat.com> - 0.6.3-4
changelog:
  - backport recent stable fixes
  - backport fix for lost NM interfaces during reload
  - backport rich rule priorities
  - backport fix for set entries not applied
  - update translations


author: Eric Garver <egarver@redhat.com> - 0.7.0-3
changelog:
  - backport patch to show service includes in service output
  - backport patches to fix dbus API break


author: Florian Weimer <fweimer@redhat.com> - 2.28-65
changelog:
  - glibc-all-langpacks: Do not delete locale archive during update (#1717347)
  - Do not mark /usr/lib/locale/locale-archive as a configuration file
    because it is always automatically overwritten by build-locale-archive.


author: Peter Jones <pjones@redhat.com> - 2.02-70
changelog:
  - Fix (once again) how CFLAGS and LDFLAGS propogate the settings for hardened
    builds, because rpmdiff doesn't like the current way failing.
    Related: rhbz#1653961


author: Peter Jones <pjones@redhat.com> - 2.02-71
changelog:
  - Fix (a fourth time, due to a typo) how LDFLAGS works on non-efi platforms.
    Related: rhbz#1653961


author: Mike FABIAN <mfabian@redhat.com> - 60.2-4
changelog:
  - Add negative-daylight-savings.patch from upstream.
    (see http://bugs.icu-project.org/trac/ticket/13566 and
    http://bugs.icu-project.org/trac/changeset/40954)


author: Parag Nemade <pnemade AT redhat DOT com> - 60.2-7
changelog:
  - Resolves:rh#1602551 - Fix specfile by adding compile options
  - also add BuildRequires for gcc and gcc-c++
  - Correct the upstream URL


author: Mike FABIAN <mfabian@redhat.com> - 60.3-1
changelog:
  - Update to 60.3 maintenance release including support for new Japanese era Reiwa (令和).
  - Resolves: rhbz#1677093


author: Mike FABIAN <mfabian@redhat.com> - 60.3-2
changelog:
  - Apply ICU-13634-Adding-integer-overflow-logic-to-ICU4C-num.patch
  - Apply ICU-20958-Prevent-SEGV_MAPERR-in-append.patch
  - Resolves: rhbz#1808238


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-139.el8]
changelog:
  - [char] ipmi: move message error checking to avoid deadlock (Tony Camuso) [1731388 1718699]
  - [crypto] crypto: testmgr - mark crc32 checksum as FIPS allowed (Neil Horman) [1738887]
  - [include] dma-mapping: use dma_get_mask in dma_addressing_limited (Don Dutile) [1738631]
  - [kernel] dma-direct: correct the physical addr in dma_direct_sync_sg_for_cpu/device (Don Dutile) [1738631]
  - [kernel] dma-direct: only limit the mapping size if swiotlb could be used (Don Dutile) [1738631]
  - [include] dma-mapping: add a dma_addressing_limited helper (Don Dutile) [1738631]
  - [kernel] dma-direct: Force unencrypted DMA under SME for certain DMA masks (Don Dutile) [1738631]
  - [lib] lib/genalloc: introduce chunk owners (Don Dutile) [1738631]
  - [lib] lib/genalloc: add gen_pool_dma_zalloc() for zeroed DMA allocations (Don Dutile) [1738631]
  - [lib] lib/genalloc.c: fix allocation of aligned buffer from non-aligned chunk (Don Dutile) [1738631]
  - [include] dma-mapping: remove dma_max_pfn (Don Dutile) [1738631]
  - [mmc] mmc: core: let the dma map ops handle bouncing (Don Dutile) [1738631]
  - [mmc] mmc: core: align max segment size with logical block size (Don Dutile) [1738631]
  - [kernel] swiotlb: no need to check return value of debugfs_create functions (Don Dutile) [1738631]
  - [xen] swiotlb: fix phys_addr_t overflow warning (Don Dutile) [1738631]
  - [kernel] swiotlb: Return consistent SWIOTLB segments/nr_tbl (Don Dutile) [1738631]
  - [kernel] swiotlb: Group identical cleanup in swiotlb_cleanup() (Don Dutile) [1738631]
  - [kernel] swiotlb: save io_tlb_used to local variable before leaving critical section (Don Dutile) [1738631]
  - [kernel] swiotlb: dump used and total slots when swiotlb buffer is full (Don Dutile) [1738631]
  - [kernel] swiotlb: add checks for the return value of memblock_alloc*() (Don Dutile) [1738631]
  - [kernel] swiotlb: add debugfs to track swiotlb buffer usage (Don Dutile) [1738631]
  - [kernel] dma-direct: fix DMA_ATTR_NO_KERNEL_MAPPING (Don Dutile) [1738631]
  - [kernel] dma-direct: handle DMA_ATTR_NO_KERNEL_MAPPING in common code (Don Dutile) [1738631]
  - [kernel] dma-direct: fix DMA_ATTR_NO_KERNEL_MAPPING for remapped allocations (Don Dutile) [1738631]
  - [kernel] dma-mapping: remove a pointless memset in dma_atomic_pool_init (Don Dutile) [1738631]
  - [kernel] dma-mapping: fix lack of DMA address assignment in generic remap allocator (Don Dutile) [1738631]
  - [kernel] dma-remap: support DMA_ATTR_NO_KERNEL_MAPPING (Don Dutile) [1738631]
  - [kernel] dma-mapping: support highmem in the generic remap allocator (Don Dutile) [1738631]
  - [kernel] dma-direct: handle DMA_ATTR_NON_CONSISTENT in common code (Don Dutile) [1738631]
  - [kernel] dma-mapping: add a dma_alloc_need_uncached helper (Don Dutile) [1738631]
  - [kernel] dma-mapping: truncate dma masks to what dma_addr_t can hold (Don Dutile) [1738631]
  - [kernel] dma-remap: Avoid de-referencing NULL atomic_pool (Don Dutile) [1738631]
  - [include] dma-buf: add DMA_BUF_SET_NAME ioctls (Don Dutile) [1738631]
  - [include] dma-buf: give each buffer a full-fledged inode (Don Dutile) [1738631]
  - [fs] new wrapper: alloc_file_pseudo() (Don Dutile) [1738631]
  - [kernel] dma-direct: provide generic support for uncached kernel segments (Don Dutile) [1738631]
  - [include] dma-contiguous: fix !CONFIG_DMA_CMA version of dma_{alloc, free}_contiguous() (Don Dutile) [1738631]
  - [kernel] dma-contiguous: use fallback alloc_pages for single pages (Don Dutile) [1738631]
  - [kernel] dma-contiguous: add dma_{alloc,free}_contiguous() helpers (Don Dutile) [1738631]
  - [iommu] iommu/dma: Fix condition check in iommu_dma_unmap_sg (Don Dutile) [1738631]
  - [iommu] iommu/dma: move the arm64 wrappers to common code (Don Dutile) [1738631]
  - [iommu] iommu/dma-iommu.c: convert to use vm_map_pages() (Don Dutile) [1738631]
  - [mm] mm: introduce new vm_map_pages() and vm_map_pages_zero() API (Don Dutile) [1738631]
  - [mm] arm64/iommu: handle non-remapped addresses in ->mmap and ->get_sgtable (Don Dutile) [1738631]
  - [arm64] arm64/mm: wire up CONFIG_ARCH_HAS_SET_DIRECT_MAP (Don Dutile) [1738631]
  - [kernel] mm/hibernation: Make hibernation handle unmapped pages (Don Dutile) [1738631]
  - [mm] page_poison: play nicely with KASAN (Don Dutile) [1738631]
  - [mm] mm/vmalloc: Avoid rare case of flushing TLB with weird arguments (Don Dutile) [1738631]
  - [mm] mm/vmalloc: Fix calculation of direct map addr range (Don Dutile) [1738631]
  - [mm] mm/vmalloc: Add flag for freeing of special permsissions (Don Dutile) [1738631]
  - [x86] x86/mm/cpa: Add set_direct_map_*() functions (Don Dutile) [1738631]
  - [arm64] dma-mapping: add a kconfig symbol for arch_setup_dma_ops availability (Don Dutile) [1738631]
  - [iommu] iommu/dma: Remove the flush_page callback (Don Dutile) [1738631]
  - [include] iommu/dma: Cleanup dma-iommu.h (Don Dutile) [1738631]
  - [dma] dmaengine: Add matching device node validation in __dma_request_channel() (Don Dutile) [1738631]
  - [dma] dmaengine: dma_request_chan_by_mask() to handle deferred probing (Don Dutile) [1738631]
  - [include] dma-buf: start caching of sg_table objects v2 (Don Dutile) [1738631]
  - [kernel] dma-mapping: add a Kconfig symbol to indicate arch_dma_prep_coherent presence (Don Dutile) [1738631]
  - [iommu] iommu/dma-iommu: Remove iommu_dma_map_msi_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/ls-scfg-msi: Don't map the MSI page in ls_scfg_msi_compose_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/gic-v3-mbi: Don't map the MSI page in mbi_compose_m{b, s}i_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/gicv2m: Don't map the MSI page in gicv2m_compose_msi_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/gic-v3-its: Don't map the MSI page in its_irq_compose_msi_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size (Don Dutile) [1738631]
  - [iommu] iommu/dma-iommu: Split iommu_dma_map_msi_msg() in two parts (Don Dutile) [1738631]
  - [iommu] iommu/dma: Remove unused variable (Don Dutile) [1738631]
  - [iommu] iommu/dma: Use NUMA aware memory allocations in __iommu_dma_alloc_pages() (Don Dutile) [1738631]
  - [kernel] genirq/msi: Add a new field in msi_desc to store an IOMMU cookie (Don Dutile) [1738631]
  - [pci] PCI/MSI: Remove unused mask_msi_irq() and unmask_msi_irq() (Don Dutile) [1738631]
  - [include] PCI/MSI: Remove unused __write_msi_msg() and write_msi_msg() (Don Dutile) [1738631]
  - [include] genirq/msi: Clean up usage of __u8/__u16 types (Don Dutile) [1738631]
  - [base] platform-msi: Free descriptors in platform_msi_domain_free() (Don Dutile) [1738631]
  - [base] genirq/msi: Allow creation of a tree-based irqdomain for platform-msi (Don Dutile) [1738631]
  - [kernel] dma-debug: only skip one stackframe entry (Don Dutile) [1738631]
  - [dma] dmaengine: idma64: Move driver name to the header (Don Dutile) [1738631]
  - [kernel] dma-mapping: remove an unnecessary NULL check (Don Dutile) [1738631]
  - [include] dma-buf: Update [un]map documentation to match the other functions (Don Dutile) [1738631]
  - [include] dma-buf: Remove leftover [un]map_atomic comments (Don Dutile) [1738631]
  - [x86] x86/dma: Remove the x86_dma_fallback_dev hack (Don Dutile) [1738631]
  - [kernel] dma-mapping: remove leftover NULL device support (Don Dutile) [1738631]
  - [kernel] dma: select GENERIC_ALLOCATOR for DMA_REMAP (Don Dutile) [1738631]
  - [crypto] crypto: ccp - Ignore unconfigured CCP device on suspend/resume (Gary Hook) [1743999]
  - [md] dm snapshot: fix oversights in optional discard support (Mike Snitzer) [1744291]
  - [md] dm snapshot: add optional discard support features (Mike Snitzer) [1744291]
  - [md] dm snapshot: Use fine-grained locking scheme (Mike Snitzer) [1744291]
  - [md] dm snapshot: Make exception tables scalable (Mike Snitzer) [1744291]
  - [md] dm snapshot: Replace mutex with rw semaphore (Mike Snitzer) [1744291]
  - [md] dm snapshot: Don't sleep holding the snapshot lock (Mike Snitzer) [1744291]
  - [include] list_bl: Add hlist_bl_add_before/behind helpers (Mike Snitzer) [1744291]
  - [powerpc] powerpc/rtas: use device model APIs and serialization during LPM (Steve Best) [1741643]
  - [firmware] firmware/efi: Add NULL pointer checks in efivars API functions (Jarod Wilson) [1741949]
  - [fs] ovl: fix wrong flags check in FS_IOC_FS[SG]ETXATTR ioctls (Miklos Szeredi) [1724518]
  - [include] mm: page_cache_add_speculative(): refactor out some code duplication (Michael Petlan) [1738331]
  - [netdrv] ibmvnic: Unmap DMA address of TX descriptor buffers after use (Steve Best) [1743155]
  - [fs] NFSv4.1 don't free interrupted slot on open (Steve Dickson) [1708345]
  - [fs] NFSv4.1: Avoid false retries when RPC calls are interrupted (Steve Dickson) [1708345]
  - [net] ipv6: Fix return value of ipv6_mc_may_pull() for malformed packets (Stefano Brivio) [1743203]
  - [net] inet: frags: re-introduce skb coalescing for local delivery (Guillaume Nault) [1719418]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-140.el8]
changelog:
  - [x86] x86/kdump: Reserve extra memory when SME or SEV is active (Kairui Song) [1728519]
  - [scsi] scsi: qla2xxx: Fix hardlockup in abort command during driver remove (Himanshu Madhani) [1690041]
  - [scsi] qla2xxx: Update driver version to 10.01.00.15.08.1-k1 (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: cleanup trace buffer initialization (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: qla2x00_alloc_fw_dump: set ha->eft (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Use mutex protection during qla2x00_sysfs_read_fw_dump() (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: move IO flush to the front of NVME rport unregistration (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix NVME cmd and LS cmd timeout race condition (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Complain loudly about reference count underflow (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix race conditions in the code for aborting SCSI commands (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Use an on-stack completion in qla24xx_control_vp() (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Change abort wait_loop from msleep to wait_event_timeout (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Set the SCSI command result before calling the command done (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: on session delete, return nvme cmd (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix kernel crash after disconnecting NVMe devices (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Remove the fcport test from qla_nvme_abort_work() (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix driver unload when FC-NVMe LUNs are connected (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Set remote port devloss timeout to 0 (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix panic in qla_dfs_tgt_counters_show (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix fw dump corruption (Himanshu Madhani) [1690041]
  - [x86] kvm: disable nested virt on pre-haswell processors (Paolo Bonzini) [1739739]
  - [x86] kvm: taint kernel for tech-preview when using nested virtualization (Paolo Bonzini) [1739739]
  - [x86] kvm: x86: hyper-v: don't crash on KVM_GET_SUPPORTED_HV_CPUID when kvm_intel.nested is disabled (Vitaly Kuznetsov) [1746100]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-142.el8]
changelog:
  - [drm] drm/virtio: use virtio_max_dma_size (Gerd Hoffmann) [1739291]
  - [mm] hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined (Rafael Aquini) [1706088]
  - [powerpc] kvm: ppc: book3s: Enable XIVE native capability only if OPAL has required functions [BZ1744884] (David Gibson) [1744884]
  - [scsi] scsi: lpfc: Fix oops when fewer hdwqs than cpus (Dick Kennedy) [1745731]
  - [scsi] scsi: lpfc: Limit xri count for kdump environment (Dick Kennedy) [1745731]
  - [scsi] scsi: lpfc: Mitigate high memory pre-allocation by SCSI-MQ (Dick Kennedy) [1745731]
  - [scsi] scsi: qla2xxx: Fix hardirq-unsafe locking (Himanshu Madhani) [1719941]
  - [x86] Revert "[x86] x86/kexec/64: Prevent kexec from 5-level paging to a 4-level only kernel" (Baoquan He) [1669088]
  - [x86] Revert "[x86] x86/boot: Add xloadflags bits to check for 5-level paging support" (Baoquan He) [1669088]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-143.el8]
changelog:
  - [net] netfilter: nft_set: fix allocation size overflow in privsize callback. (Florian Westphal) [1746338]
  - [net] net: route dump netlink NLM_F_MULTI flag missing (Stefano Brivio) [1745971]
  - [net] sched: pfifo_fast: fix wrong dereference in pfifo_fast_enqueue (Davide Caratti) [1745390]
  - [net] sched: pfifo_fast: fix wrong dereference when qdisc is reset (Davide Caratti) [1745387]
  - [scsi] scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck() (David Milburn) [1746597]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-144.el8]
changelog:
  - [md] Revert "[md] dm: eliminate 'split_discard_bios' flag from DM target interface" (Mike Snitzer) [1749929]
  - [md] Revert "[md] dm: make sure to obey max_io_len_target_boundary" (Mike Snitzer) [1749929]
  - [pci] PCI: Restore Resizable BAR size bits correctly for 1MB BARs (Myron Stowe) [1717760]
  - [net] netfilter: nft_fib_netdev: Terminate rule eval if protocol=IPv6 and ipv6 module is disabled (Phil Sutter) [1743945]
  - [net] netfilter: bridge: Drops IPv6 packets if IPv6 module is not loaded (Phil Sutter) [1743945]
  - [drm] drm/qxl: get vga ioports (Gerd Hoffmann) [1728936]
  - [drm] drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe() (Lyude Paul) [1724363]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-145.el8]
changelog:
  - [iommu] iommu/amd: Add support for X2APIC IOMMU interrupts (Suravee Suthikulpanit) [1734842]
  - [vhost] vhost: make sure log_num < in_num (Eugenio Perez) [1750882] {CVE-2019-14835}


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-146.el8]
changelog:
  - [fs] gfs2: clear buf_in_tr when ending a transaction in sweep_bh_for_rgrps (Robert S Peterson) [1750939]
  - [s390] kvm: s390: kvm_s390_vm_start_migration: check dirty_bitmap before using it as target for memset() (Thomas Huth) [1753260]
  - [fs] cifs: fix credits leak for SMB1 oplock breaks (Leif Sahlberg) [1752243]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.el8]
changelog:
  - [x86] perf/x86/intel: Fix spurious NMI on fixed counter (Michael Petlan) [1755110]
  - [x86] perf/x86/intel: Fix race in intel_pmu_disable_event() (Michael Petlan) [1755110]
  - [netdrv] drivers: tap.c: fix wrong backport causing WARN_ON_ONCE(1) in skb_flow_dissect() (Davide Caratti) [1750711]
  - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746804] {CVE-2019-14821}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-147.0.2.el8_1]
changelog:
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1766056 1756805] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1766056 1756805] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [x86] x86/tsx: Add config options to set tsx=on|off|auto (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/tsx: Add "auto" option to the tsx= cmdline parameter (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [x86] x86/cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86/mmu: Reintroduce fast invalidate/zap for flushing memslot (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] Revert "KVM: x86/mmu: Zap only the relevant pages when removing a memslot" (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: x86, powerpc: do not allow clearing largepages debugfs entry (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [zstream] switch to zstream (Frantisek Hrbata)


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-147.0.3.el8_1]
changelog:
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-147.1.1.el8_1]
changelog:
  - [arm64] arm64/sve: Fix wrong free for task->thread.sve_state (Andrew Jones) [1767358 1756450]
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1766056 1756805] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1766056 1756805] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [x86] x86/tsx: Add config options to set tsx=on|off|auto (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/tsx: Add "auto" option to the tsx= cmdline parameter (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [x86] x86/cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86/mmu: Reintroduce fast invalidate/zap for flushing memslot (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] Revert "KVM: x86/mmu: Zap only the relevant pages when removing a memslot" (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: x86, powerpc: do not allow clearing largepages debugfs entry (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [zstream] switch to zstream (Frantisek Hrbata)


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.2.1.el8_1]
changelog:
  - [sched] fair: Scale bandwidth quota and period without losing quota/period ratio precision (Phil Auld) [1773568 1706247]
  - [sched] fair: Fix -Wunused-but-set-variable warnings (Phil Auld) [1773568 1706247]
  - [sched] fair: Fix low cpu usage with high throttling by removing expiration of cpu-local slices (Phil Auld) [1773568 1706247]
  - [powerpc] powerpc/pseries: Track LMB nid instead of using device tree (Steve Best) [1772110 1758742]
  - [powerpc] powerpc/pseries/memory-hotplug: Only update DT once per memory DLPAR request (Steve Best) [1772110 1758742]
  - [powerpc] powerpc/rtas: allow rescheduling while changing cpu states (Steve Best) [1772109 1758651]
  - [powerpc] powerpc/pseries/mobility: use cond_resched when updating device tree (Steve Best) [1772109 1758651]
  - [netdrv] i40e: Do not check VF state in i40e_ndo_get_vf_config (Stefan Assmann) [1770177 1752498]
  - [fs] CIFS: Fix use after free of file info structures (Dave Wysochanski) [1767357 1757865]
  - [fs] cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic (Dave Wysochanski) [1767357 1757865]
  - [netdrv] net/ibmvnic: prevent more than one thread from running in reset (Steve Best) [1764830 1756943]
  - [netdrv] net/ibmvnic: unlock rtnl_lock in reset so linkwatch_event can run (Steve Best) [1764830 1756943]
  - [netdrv] ibmvnic: Warn unknown speed message only when carrier is present (Steve Best) [1764832 1749873]
  - [netdrv] net/ibmvnic: Fix missing { in __ibmvnic_reset (Steve Best) [1764832 1749873]
  - [netdrv] net/ibmvnic: free reset work of removed device from queue (Steve Best) [1764832 1749873]
  - [netdrv] ibmvnic: Do not process reset during or after device removal (Steve Best) [1764832 1749873]
  - [cpuidle] cpuidle: governor: Add new governors to cpuidle_governors again (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: do not set an owner to allow modunload (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: set haltpoll as preferred governor (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: allow governor switch on cpuidle_register_driver() (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: Add cpuidle.governor= command line parameter (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: vcpu hotplug support (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: disable host side polling when kvm virtualized (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: add haltpoll governor (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: header file stubs must be "static inline" (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] governors: unify last_state_idx (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: add poll_limit_ns to cpuidle_device structure (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: poll_state: Fix default time limit (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: poll_state: Disregard disable idle states (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: poll_state: Revise loop termination condition (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: menu: Fix wakeup statistics updates for polling state (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: return -ENODEV on modinit failure (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] add cpuidle-haltpoll driver (Marcelo Tosatti) [1764831 1759282]
  - [x86] kvm: x86: add host poll control msrs (Vitaly Kuznetsov) [1764831 1749495]
  - [s390] s390/setup: Fix kernel lock down for s390 (Philipp Rudo) [1764827 1748343]
  - [powerpc] powerpc: Allow flush_(inval_)dcache_range to work across ranges >4GB (Steve Best) [1764826 1744062]
  - [fs] mm/huge_memory: fix vmf_insert_pfn_{pmd, pud}() crash, handle unaligned addresses (Jeff Moyer) [1764825 1743159]
  - [mm] mm/huge_memory.c: fix modifying of page protection by insert_pfn_pmd() (Jeff Moyer) [1764825 1743159]
  - [pci] PCI: hv: Use bytes 4 and 5 from instance ID as the PCI domain numbers (Mohammed Gamal) [1764634 1671288]
  - [pci] PCI: hv: Detect and fix Hyper-V PCI domain number collision (Mohammed Gamal) [1764634 1671288]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.3.1.el8_1]
changelog:
  - [x86] kvm: svm: taint module and print taint message iff nested is enabled (Bandan Das) [1776114 1775410]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.4.1.el8_1]
changelog:
  - [block] blk-mq: apply normal plugging for HDD (Ming Lei) [1782181 1759380]
  - [block] blk-mq: honor IO scheduler for multiqueue devices (Ming Lei) [1782181 1759380]
  - [block] blk-mq: simplify blk_mq_make_request() (Ming Lei) [1782181 1759380]
  - [block] blk-mq: remove blk_mq_put_ctx() (Ming Lei) [1782181 1759380]
  - [x86] kvm: vmx: use MSR_IA32_TSX_CTRL to hard-disable TSX on guest that lack it (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm: vmx: implement MSR_IA32_TSX_CTRL disable RTM functionality (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm: x86: implement MSR_IA32_TSX_CTRL effect on CPUID (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm: x86: do not modify masked bits of shared MSRs (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm: x86: fix presentation of TSX feature in ARCH_CAPABILITIES (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm/x86: Export MDS_NO=0 to guests when TSX is enabled (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [fs] cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs (Leif Sahlberg) [1778693 1765979]
  - [fs] cifs: avoid using MID 0xFFFF (Leif Sahlberg) [1778693 1765979]
  - [fs] cifs: Fix retry mid list corruption on reconnects (Leif Sahlberg) [1778693 1765979]
  - [fs] smb3: fix unmount hang in open_shroot (Leif Sahlberg) [1781113 1757670]
  - [fs] CIFS: fix deadlock in cached root handling (Leif Sahlberg) [1781113 1757670]
  - [fs] Fix match_server check to allow for auto dialect negotiate (Leif Sahlberg) [1781113 1757670]
  - [fs] SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write (Leif Sahlberg) [1781113 1757670]
  - [fs] cifs: fix panic in smb2_reconnect (Leif Sahlberg) [1781113 1757670]
  - [fs] cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level() (Leif Sahlberg) [1781113 1757670]
  - [fs] smb3: fix signing verification of large reads (Dave Wysochanski) [1781110 1753114]
  - [scsi] scsi: lpfc: Fix port relogin failure due to GID_FT interaction (Dick Kennedy) [1781108 1733217]
  - [fs] xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT (Bill O'Donnell) [1778692 1739607]
  - [net] cfg80211: wext: avoid copying malformed SSIDs (Jarod Wilson) [1778633 1778634] {CVE-2019-17133}
  - [block] blkcg: perpcu_ref init/exit should be done from blkg_alloc/free() (Ming Lei) [1777766 1741392]
  - [fs] userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx (Alex Gladkov) [1777389 1749763] {CVE-2019-14898}
  - [netdrv] mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings (Jarod Wilson) [1776618 1775484] {CVE-2019-14814 CVE-2019-14815 CVE-2019-14816}
  - [netdrv] mwifiex: fix possible heap overflow in mwifiex_process_country_ie() (Jarod Wilson) [1776209 1776210] {CVE-2019-14895}
  - [netdrv] mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() (Jarod Wilson) [1776161 1776162] {CVE-2019-14901}
  - [netdrv] rtlwifi: Fix potential overflow on P2P code (Jarod Wilson) [1775222 1775223] {CVE-2019-17666}
  - [pci] hv: Avoid use of hv_pci_dev->pci_slot after freeing it (Mohammed Gamal) [1764635 1737569]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.5.1.el8_1]
changelog:
  - [powerpc] powerpc/shared: Use static key to detect shared processor (Phil Auld) [1781114 1767529]
  - [powerpc] powerpc/vcpu: Assume dedicated processors as non-preempt (Phil Auld) [1781114 1767529]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.6.1.el8_1]
changelog:
  - [crypto] crypto: chelsio - count incomplete block in IV (Jonathan Toppins) [1798527 1725813]
  - [crypto] crypto: chelsio - Fix softlockup with heavy I/O (Jonathan Toppins) [1798527 1725813]
  - [crypto] crypto: chelsio - Fix NULL pointer dereference (Jonathan Toppins) [1798527 1725813]
  - [nvme] nvme: Treat discovery subsystems as unique subsystems (Ewan Milne) [1798381 1757525]
  - [mm] mm/page-writeback.c: don't break integrity writeback on ->writepage() error (Christoph von Recklinghausen) [1797962 1782117]
  - [lib] crc-t10dif: crc_t10dif_mutex can be static (Vladis Dronov) [1797961 1769462]
  - [lib] crc-t10dif: Allow current transform to be inspected in sysfs (Vladis Dronov) [1797961 1769462]
  - [lib] crc-t10dif: Pick better transform if one becomes available (Vladis Dronov) [1797961 1769462]
  - [crypto] api - Introduce notifier for new crypto algorithms (Vladis Dronov) [1797961 1769462]
  - [block] blk-mq: make sure that line break can be printed (Ming Lei) [1797960 1741462]
  - [block] blk-mq: avoid sysfs buffer overflow with too many CPU cores (Ming Lei) [1797960 1741462]
  - [scsi] hpsa: update driver version (Joseph Szczypek) [1797519 1761968]
  - [scsi] scsi: hpsa: add missing hunks in reset-patch (Joseph Szczypek) [1797519 1761968]
  - [arm64] arm64: compat: Workaround Neoverse-N1 #1542419 for compat user-space (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Fake the IminLine size on systems affected by Neoverse-N1 #1542419 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: errata: Hide CTR_EL0.DIC on systems affected by Neoverse-N1 #1542419 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Handle erratum 1418040 as a superset of erratum 1188873 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: errata: Add workaround for Cortex-A76 erratum #1463225 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Kconfig: Tidy up errata workaround help text (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Apply ARM64_ERRATUM_1188873 to Neoverse-N1 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Add part number for Neoverse N1 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Make ARM64_ERRATUM_1188873 depend on COMPAT (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Restrict ARM64_ERRATUM_1188873 mitigation to AArch32 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: arch_timer: avoid unused function warning (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Add workaround for Cortex-A76 erratum 1286807 (Mark Salter) [1797518 1757828]
  - [md] dm snapshot: rework COW throttling to fix deadlock (Mike Snitzer) [1796490 1758605]
  - [md] dm snapshot: introduce account_start_copy() and account_end_copy() (Mike Snitzer) [1796490 1758605]
  - [block] fix memleak of bio integrity data (Ming Lei) [1795338 1779898]
  - [powerpc] xive: Prevent page fault issues in the machine crash handler (Diego Domingos) [1795337 1756116]
  - [scsi] scsi: megaraid_sas: IRQ poll to avoid CPU hard lockups (Tomas Henzl) [1795335 1726251]
  - [powerpc] powerpc/perf: Disable trace_imc pmu (Steve Best) [1794061 1785573]
  - [s390] s390/qeth: ensure linear access to packet headers (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: guard against runt packets (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: handle skb allocation error gracefully (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: drop unwanted packets earlier in RX path (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: support per-frame invalidation (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: gather more detailed RX dropped/error statistics (Philipp Rudo) [1794059 1781085]
  - [s390] s390/net: Mark expected switch fall-throughs (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: consolidate skb RX processing in L3 driver (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: remove RX seqno in skb->cb (Philipp Rudo) [1794059 1781085]
  - [powerpc] kvm: ppc: book3s hv: Flush link stack on guest exit to host kernel (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] book3s64: Fix link stack flush on context switch (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] 64s: support nospectre_v2 cmdline option (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] fsl: Update Spectre v2 reporting (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] fsl: Add nospectre_v2 command line argument (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] fsl: Fix spectre_v2 mitigations reporting (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] 64: Make meltdown reporting Book3S 64 specific (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] 64: Disable the speculation barrier from the command line (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [firmware] efi/memreserve: Register reservations as 'reserved' in /proc/iomem (Bhupesh Sharma) [1792200 1772730]
  - [firmware] efi/memreserve: deal with memreserve entries in unmapped memory (Bhupesh Sharma) [1792200 1772730]
  - [s390] s390/cpum_sf: save TOD clock base in SDBs for time conversion (Philipp Rudo) [1792198 1743504]
  - [s390] s390/sclp: Fix bit checked for has_sipl (Philipp Rudo) [1791408 1748347]
  - [scsi] qla2xxx: Fix incorrect SFUB length used for Secure Flash Update MB Cmd (Himanshu Madhani) [1790350 1782598]
  - [scsi] qla2xxx: Added support for MPI and PEP regions for ISP28XX (Himanshu Madhani) [1790350 1782598]
  - [scsi] qla2xxx: Correctly retrieve and interpret active flash region (Himanshu Madhani) [1790350 1782598]
  - [powerpc] powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction (Gustavo Duarte) [1788862 1750653] {CVE-2019-15030}
  - [powerpc] powerpc/tm: Fix restoring FP/VMX facility incorrectly on interrupts (Gustavo Duarte) [1791630 1750653] {CVE-2019-15031}
  - [scsi] scsi: qla2xxx: Fix different size DMA Alloc/Unmap (Himanshu Madhani) [1788206 1753031]
  - [scsi] qla2xxx: call dma_free_coherent with correct size in all cases in qla24xx_sp_unmap (Himanshu Madhani) [1788206 1753031]
  - [fs] devpts_pty_kill(): don't bother with d_delete() (Eric Sandeen) [1783959 1772718]
  - [fs] devpts: always delete dcache dentry-s in dput() (Eric Sandeen) [1783959 1772718]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.7.1.el8_1]
changelog:
  - [hid] hiddev: do cleanup in failure of opening a device (Benjamin Tissoires) [1803458 1803460] {CVE-2019-19527}
  - [hid] hiddev: avoid opening a disconnected device (Benjamin Tissoires) [1803458 1803460] {CVE-2019-19527}
  - [nvme] nvmet: fix discover log page when offsets are used (Gopal Tiwari) [1801216 1745836]
  - [netdrv] ibmvnic: Serialize device queries (Steve Best) [1794060 1778037]
  - [netdrv] ibmvnic: Bound waits for device queries (Steve Best) [1794060 1778037]
  - [netdrv] ibmvnic: Terminate waiting device threads after loss of service (Steve Best) [1794060 1778037]
  - [netdrv] ibmvnic: Fix completion structure initialization (Steve Best) [1794060 1778037]
  - [netdrv] ibmvnic: Ignore H_FUNCTION return from H_EOI to tolerate XIVE mode (Steve Best) [1794060 1778037]
  - [tools] selftests/powerpc: Fix compile error on tlbie_test due to newer gcc (Desnes Augusto Nunes do Rosario) [1794058 1755707]
  - [tools] selftests/powerpc: Add test case for tlbie vs mtpidr ordering issue (Desnes Augusto Nunes do Rosario) [1794058 1755707]
  - [powerpc] powerpc/mm: Fixup tlbie vs mtpidr/mtlpidr ordering issue on POWER9 (Desnes Augusto Nunes do Rosario) [1794058 1755707]
  - [powerpc] powerpc/book3s64/radix: Rename CPU_FTR_P9_TLBIE_BUG feature flag (Desnes Augusto Nunes do Rosario) [1794058 1755707]
  - [powerpc] powerpc/book3s64/mm: Don't do tlbie fixup for some hardware revisions (Desnes Augusto Nunes do Rosario) [1794058 1755707]


author: Clark Williams <williams@redhat.com> [4.18.0-139.rt24.85.el8]
changelog:
  - [rt] kernel-rt-4.18.0-139.rt24.84.el8 (Clark Williams) [1678887]
  - [char] ipmi: move message error checking to avoid deadlock (Tony Camuso) [1731388 1718699]
  - [crypto] crypto: testmgr - mark crc32 checksum as FIPS allowed (Neil Horman) [1738887]
  - [include] dma-mapping: use dma_get_mask in dma_addressing_limited (Don Dutile) [1738631]
  - [kernel] dma-direct: correct the physical addr in dma_direct_sync_sg_for_cpu/device (Don Dutile) [1738631]
  - [kernel] dma-direct: only limit the mapping size if swiotlb could be used (Don Dutile) [1738631]
  - [include] dma-mapping: add a dma_addressing_limited helper (Don Dutile) [1738631]
  - [kernel] dma-direct: Force unencrypted DMA under SME for certain DMA masks (Don Dutile) [1738631]
  - [lib] lib/genalloc: introduce chunk owners (Don Dutile) [1738631]
  - [lib] lib/genalloc: add gen_pool_dma_zalloc() for zeroed DMA allocations (Don Dutile) [1738631]
  - [lib] lib/genalloc.c: fix allocation of aligned buffer from non-aligned chunk (Don Dutile) [1738631]
  - [include] dma-mapping: remove dma_max_pfn (Don Dutile) [1738631]
  - [mmc] mmc: core: let the dma map ops handle bouncing (Don Dutile) [1738631]
  - [mmc] mmc: core: align max segment size with logical block size (Don Dutile) [1738631]
  - [kernel] swiotlb: no need to check return value of debugfs_create functions (Don Dutile) [1738631]
  - [xen] swiotlb: fix phys_addr_t overflow warning (Don Dutile) [1738631]
  - [kernel] swiotlb: Return consistent SWIOTLB segments/nr_tbl (Don Dutile) [1738631]
  - [kernel] swiotlb: Group identical cleanup in swiotlb_cleanup() (Don Dutile) [1738631]
  - [kernel] swiotlb: save io_tlb_used to local variable before leaving critical section (Don Dutile) [1738631]
  - [kernel] swiotlb: dump used and total slots when swiotlb buffer is full (Don Dutile) [1738631]
  - [kernel] swiotlb: add checks for the return value of memblock_alloc*() (Don Dutile) [1738631]
  - [kernel] swiotlb: add debugfs to track swiotlb buffer usage (Don Dutile) [1738631]
  - [kernel] dma-direct: fix DMA_ATTR_NO_KERNEL_MAPPING (Don Dutile) [1738631]
  - [kernel] dma-direct: handle DMA_ATTR_NO_KERNEL_MAPPING in common code (Don Dutile) [1738631]
  - [kernel] dma-direct: fix DMA_ATTR_NO_KERNEL_MAPPING for remapped allocations (Don Dutile) [1738631]
  - [kernel] dma-mapping: remove a pointless memset in dma_atomic_pool_init (Don Dutile) [1738631]
  - [kernel] dma-mapping: fix lack of DMA address assignment in generic remap allocator (Don Dutile) [1738631]
  - [kernel] dma-remap: support DMA_ATTR_NO_KERNEL_MAPPING (Don Dutile) [1738631]
  - [kernel] dma-mapping: support highmem in the generic remap allocator (Don Dutile) [1738631]
  - [kernel] dma-direct: handle DMA_ATTR_NON_CONSISTENT in common code (Don Dutile) [1738631]
  - [kernel] dma-mapping: add a dma_alloc_need_uncached helper (Don Dutile) [1738631]
  - [kernel] dma-mapping: truncate dma masks to what dma_addr_t can hold (Don Dutile) [1738631]
  - [kernel] dma-remap: Avoid de-referencing NULL atomic_pool (Don Dutile) [1738631]
  - [include] dma-buf: add DMA_BUF_SET_NAME ioctls (Don Dutile) [1738631]
  - [include] dma-buf: give each buffer a full-fledged inode (Don Dutile) [1738631]
  - [fs] new wrapper: alloc_file_pseudo() (Don Dutile) [1738631]
  - [kernel] dma-direct: provide generic support for uncached kernel segments (Don Dutile) [1738631]
  - [include] dma-contiguous: fix !CONFIG_DMA_CMA version of dma_{alloc, free}_contiguous() (Don Dutile) [1738631]
  - [kernel] dma-contiguous: use fallback alloc_pages for single pages (Don Dutile) [1738631]
  - [kernel] dma-contiguous: add dma_{alloc,free}_contiguous() helpers (Don Dutile) [1738631]
  - [iommu] iommu/dma: Fix condition check in iommu_dma_unmap_sg (Don Dutile) [1738631]
  - [iommu] iommu/dma: move the arm64 wrappers to common code (Don Dutile) [1738631]
  - [iommu] iommu/dma-iommu.c: convert to use vm_map_pages() (Don Dutile) [1738631]
  - [mm] mm: introduce new vm_map_pages() and vm_map_pages_zero() API (Don Dutile) [1738631]
  - [mm] arm64/iommu: handle non-remapped addresses in ->mmap and ->get_sgtable (Don Dutile) [1738631]
  - [arm64] arm64/mm: wire up CONFIG_ARCH_HAS_SET_DIRECT_MAP (Don Dutile) [1738631]
  - [kernel] mm/hibernation: Make hibernation handle unmapped pages (Don Dutile) [1738631]
  - [mm] page_poison: play nicely with KASAN (Don Dutile) [1738631]
  - [mm] mm/vmalloc: Avoid rare case of flushing TLB with weird arguments (Don Dutile) [1738631]
  - [mm] mm/vmalloc: Fix calculation of direct map addr range (Don Dutile) [1738631]
  - [mm] mm/vmalloc: Add flag for freeing of special permsissions (Don Dutile) [1738631]
  - [x86] x86/mm/cpa: Add set_direct_map_*() functions (Don Dutile) [1738631]
  - [arm64] dma-mapping: add a kconfig symbol for arch_setup_dma_ops availability (Don Dutile) [1738631]
  - [iommu] iommu/dma: Remove the flush_page callback (Don Dutile) [1738631]
  - [include] iommu/dma: Cleanup dma-iommu.h (Don Dutile) [1738631]
  - [dma] dmaengine: Add matching device node validation in __dma_request_channel() (Don Dutile) [1738631]
  - [dma] dmaengine: dma_request_chan_by_mask() to handle deferred probing (Don Dutile) [1738631]
  - [include] dma-buf: start caching of sg_table objects v2 (Don Dutile) [1738631]
  - [kernel] dma-mapping: add a Kconfig symbol to indicate arch_dma_prep_coherent presence (Don Dutile) [1738631]
  - [iommu] iommu/dma-iommu: Remove iommu_dma_map_msi_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/ls-scfg-msi: Don't map the MSI page in ls_scfg_msi_compose_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/gic-v3-mbi: Don't map the MSI page in mbi_compose_m{b, s}i_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/gicv2m: Don't map the MSI page in gicv2m_compose_msi_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/gic-v3-its: Don't map the MSI page in its_irq_compose_msi_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size (Don Dutile) [1738631]
  - [iommu] iommu/dma-iommu: Split iommu_dma_map_msi_msg() in two parts (Don Dutile) [1738631]
  - [iommu] iommu/dma: Remove unused variable (Don Dutile) [1738631]
  - [iommu] iommu/dma: Use NUMA aware memory allocations in __iommu_dma_alloc_pages() (Don Dutile) [1738631]
  - [kernel] genirq/msi: Add a new field in msi_desc to store an IOMMU cookie (Don Dutile) [1738631]
  - [pci] PCI/MSI: Remove unused mask_msi_irq() and unmask_msi_irq() (Don Dutile) [1738631]
  - [include] PCI/MSI: Remove unused __write_msi_msg() and write_msi_msg() (Don Dutile) [1738631]
  - [include] genirq/msi: Clean up usage of __u8/__u16 types (Don Dutile) [1738631]
  - [base] platform-msi: Free descriptors in platform_msi_domain_free() (Don Dutile) [1738631]
  - [base] genirq/msi: Allow creation of a tree-based irqdomain for platform-msi (Don Dutile) [1738631]
  - [kernel] dma-debug: only skip one stackframe entry (Don Dutile) [1738631]
  - [dma] dmaengine: idma64: Move driver name to the header (Don Dutile) [1738631]
  - [kernel] dma-mapping: remove an unnecessary NULL check (Don Dutile) [1738631]
  - [include] dma-buf: Update [un]map documentation to match the other functions (Don Dutile) [1738631]
  - [include] dma-buf: Remove leftover [un]map_atomic comments (Don Dutile) [1738631]
  - [x86] x86/dma: Remove the x86_dma_fallback_dev hack (Don Dutile) [1738631]
  - [kernel] dma-mapping: remove leftover NULL device support (Don Dutile) [1738631]
  - [kernel] dma: select GENERIC_ALLOCATOR for DMA_REMAP (Don Dutile) [1738631]
  - [crypto] crypto: ccp - Ignore unconfigured CCP device on suspend/resume (Gary Hook) [1743999]
  - [md] dm snapshot: fix oversights in optional discard support (Mike Snitzer) [1744291]
  - [md] dm snapshot: add optional discard support features (Mike Snitzer) [1744291]
  - [md] dm snapshot: Use fine-grained locking scheme (Mike Snitzer) [1744291]
  - [md] dm snapshot: Make exception tables scalable (Mike Snitzer) [1744291]
  - [md] dm snapshot: Replace mutex with rw semaphore (Mike Snitzer) [1744291]
  - [md] dm snapshot: Don't sleep holding the snapshot lock (Mike Snitzer) [1744291]
  - [include] list_bl: Add hlist_bl_add_before/behind helpers (Mike Snitzer) [1744291]
  - [powerpc] powerpc/rtas: use device model APIs and serialization during LPM (Steve Best) [1741643]
  - [firmware] firmware/efi: Add NULL pointer checks in efivars API functions (Jarod Wilson) [1741949]
  - [fs] ovl: fix wrong flags check in FS_IOC_FS[SG]ETXATTR ioctls (Miklos Szeredi) [1724518]
  - [include] mm: page_cache_add_speculative(): refactor out some code duplication (Michael Petlan) [1738331]
  - [netdrv] ibmvnic: Unmap DMA address of TX descriptor buffers after use (Steve Best) [1743155]
  - [fs] NFSv4.1 don't free interrupted slot on open (Steve Dickson) [1708345]
  - [fs] NFSv4.1: Avoid false retries when RPC calls are interrupted (Steve Dickson) [1708345]
  - [net] ipv6: Fix return value of ipv6_mc_may_pull() for malformed packets (Stefano Brivio) [1743203]
  - [net] inet: frags: re-introduce skb coalescing for local delivery (Guillaume Nault) [1719418]


author: Clark Williams <williams@redhat.com> [4.18.0-140.rt24.86.el8]
changelog:
  - [rt] kernel-rt-4.18.0-140.rt24.85.el8 (Clark Williams) [1678887]
  - [x86] x86/kdump: Reserve extra memory when SME or SEV is active (Kairui Song) [1728519]
  - [scsi] scsi: qla2xxx: Fix hardlockup in abort command during driver remove (Himanshu Madhani) [1690041]
  - [scsi] qla2xxx: Update driver version to 10.01.00.15.08.1-k1 (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: cleanup trace buffer initialization (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: qla2x00_alloc_fw_dump: set ha->eft (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Use mutex protection during qla2x00_sysfs_read_fw_dump() (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: move IO flush to the front of NVME rport unregistration (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix NVME cmd and LS cmd timeout race condition (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Complain loudly about reference count underflow (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix race conditions in the code for aborting SCSI commands (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Use an on-stack completion in qla24xx_control_vp() (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Change abort wait_loop from msleep to wait_event_timeout (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Set the SCSI command result before calling the command done (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: on session delete, return nvme cmd (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix kernel crash after disconnecting NVMe devices (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Remove the fcport test from qla_nvme_abort_work() (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix driver unload when FC-NVMe LUNs are connected (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Set remote port devloss timeout to 0 (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix panic in qla_dfs_tgt_counters_show (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix fw dump corruption (Himanshu Madhani) [1690041]
  - [x86] kvm: disable nested virt on pre-haswell processors (Paolo Bonzini) [1739739]
  - [x86] kvm: taint kernel for tech-preview when using nested virtualization (Paolo Bonzini) [1739739]
  - [x86] kvm: x86: hyper-v: don't crash on KVM_GET_SUPPORTED_HV_CPUID when kvm_intel.nested is disabled (Vitaly Kuznetsov) [1746100]


author: Clark Williams <williams@redhat.com> [4.18.0-141.rt24.87.el8]
changelog:
  - [rt] kernel-rt-4.18.0-141.rt24.86.el8 (Clark Williams) [1678887]
  - [wireless] mwifiex: fix 802.11n/WPA detection (Jarod Wilson) [1714476] {CVE-2019-3846}


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-142.rt24.88.el8]
changelog:
  - [rt] kernel-rt-4.18.0-142.rt24.87.el8 (Juri Lelli) [1678887]
  - [drm] drm/virtio: use virtio_max_dma_size (Gerd Hoffmann) [1739291]
  - [mm] hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined (Rafael Aquini) [1706088]
  - [powerpc] kvm: ppc: book3s: Enable XIVE native capability only if OPAL has required functions [BZ1744884] (David Gibson) [1744884]
  - [scsi] scsi: lpfc: Fix oops when fewer hdwqs than cpus (Dick Kennedy) [1745731]
  - [scsi] scsi: lpfc: Limit xri count for kdump environment (Dick Kennedy) [1745731]
  - [scsi] scsi: lpfc: Mitigate high memory pre-allocation by SCSI-MQ (Dick Kennedy) [1745731]
  - [scsi] scsi: qla2xxx: Fix hardirq-unsafe locking (Himanshu Madhani) [1719941]
  - [x86] Revert "[x86] x86/kexec/64: Prevent kexec from 5-level paging to a 4-level only kernel" (Baoquan He) [1669088]
  - [x86] Revert "[x86] x86/boot: Add xloadflags bits to check for 5-level paging support" (Baoquan He) [1669088]


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-143.rt24.89.el8]
changelog:
  - [rt] kernel-rt-4.18.0-143.rt24.88.el8 (Juri Lelli) [1678887]
  - [net] netfilter: nft_set: fix allocation size overflow in privsize callback. (Florian Westphal) [1746338]
  - [net] net: route dump netlink NLM_F_MULTI flag missing (Stefano Brivio) [1745971]
  - [net] sched: pfifo_fast: fix wrong dereference in pfifo_fast_enqueue (Davide Caratti) [1745390]
  - [net] sched: pfifo_fast: fix wrong dereference when qdisc is reset (Davide Caratti) [1745387]
  - [scsi] scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck() (David Milburn) [1746597]


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-144.rt24.90.el8]
changelog:
  - [rt] kernel-rt-4.18.0-144.rt24.89.el8 (Juri Lelli) [1678887]
  - [md] Revert "[md] dm: eliminate 'split_discard_bios' flag from DM target interface" (Mike Snitzer) [1749929]
  - [md] Revert "[md] dm: make sure to obey max_io_len_target_boundary" (Mike Snitzer) [1749929]
  - [pci] PCI: Restore Resizable BAR size bits correctly for 1MB BARs (Myron Stowe) [1717760]
  - [net] netfilter: nft_fib_netdev: Terminate rule eval if protocol=IPv6 and ipv6 module is disabled (Phil Sutter) [1743945]
  - [net] netfilter: bridge: Drops IPv6 packets if IPv6 module is not loaded (Phil Sutter) [1743945]
  - [drm] drm/qxl: get vga ioports (Gerd Hoffmann) [1728936]
  - [drm] drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe() (Lyude Paul) [1724363]


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-145.rt24.91.el8]
changelog:
  - [rt] kernel-rt-4.18.0-145.rt24.90.el8 (Juri Lelli) [1678887]
  - [iommu] iommu/amd: Add support for X2APIC IOMMU interrupts (Suravee Suthikulpanit) [1734842]
  - [vhost] vhost: make sure log_num < in_num (Eugenio Perez) [1750882] {CVE-2019-14835}


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-146.rt24.92.el8]
changelog:
  - [rt] kernel-rt-4.18.0-146.rt24.91.el8 (Juri Lelli) [1678887]
  - [fs] gfs2: clear buf_in_tr when ending a transaction in sweep_bh_for_rgrps (Robert S Peterson) [1750939]
  - [s390] kvm: s390: kvm_s390_vm_start_migration: check dirty_bitmap before using it as target for memset() (Thomas Huth) [1753260]
  - [fs] cifs: fix credits leak for SMB1 oplock breaks (Leif Sahlberg) [1752243]


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-147.rt24.93.el8]
changelog:
  - [rt] kernel-rt-4.18.0-147.rt24.92.el8 (Juri Lelli) [1678887]
  - [x86] perf/x86/intel: Fix spurious NMI on fixed counter (Michael Petlan) [1755110]
  - [x86] perf/x86/intel: Fix race in intel_pmu_disable_event() (Michael Petlan) [1755110]
  - [netdrv] drivers: tap.c: fix wrong backport causing WARN_ON_ONCE(1) in skb_flow_dissect() (Davide Caratti) [1750711]
  - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746804] {CVE-2019-14821}


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-147.0.2.rt24.94.el8_1]
changelog:
  - [rt] kernel-rt-4.18.0-147.0.2.rt24.93.el8_1 (Juri Lelli)
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1766056 1756805] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1766056 1756805] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [x86] x86/tsx: Add config options to set tsx=on|off|auto (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/tsx: Add "auto" option to the tsx= cmdline parameter (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [x86] x86/cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86/mmu: Reintroduce fast invalidate/zap for flushing memslot (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] Revert "KVM: x86/mmu: Zap only the relevant pages when removing a memslot" (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: x86, powerpc: do not allow clearing largepages debugfs entry (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [zstream] switch to zstream (Frantisek Hrbata)


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-147.0.3.rt24.95.el8_1]
changelog:
  - [rt] kernel-rt-4.18.0-147.0.3.rt24.94.el8_1 (Juri Lelli)
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-147.1.1.rt24.94.el8_1]
changelog:
  - [rt] kernel-rt-4.18.0-147.1.1.rt24.93.el8_1 (Juri Lelli)
  - [arm64] arm64/sve: Fix wrong free for task->thread.sve_state (Andrew Jones) [1767358 1756450]
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1766056 1756805] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1766056 1756805] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [x86] x86/tsx: Add config options to set tsx=on|off|auto (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/tsx: Add "auto" option to the tsx= cmdline parameter (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [x86] x86/cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86/mmu: Reintroduce fast invalidate/zap for flushing memslot (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] Revert "KVM: x86/mmu: Zap only the relevant pages when removing a memslot" (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: x86, powerpc: do not allow clearing largepages debugfs entry (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [zstream] switch to zstream (Frantisek Hrbata)


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-147.2.1.rt24.95.el8_1]
changelog:
  - [rt] kernel-rt-4.18.0-147.2.1.rt24.94.el8_1 (Juri Lelli)
  - [sched] fair: Scale bandwidth quota and period without losing quota/period ratio precision (Phil Auld) [1773568 1706247]
  - [sched] fair: Fix -Wunused-but-set-variable warnings (Phil Auld) [1773568 1706247]
  - [sched] fair: Fix low cpu usage with high throttling by removing expiration of cpu-local slices (Phil Auld) [1773568 1706247]
  - [powerpc] powerpc/pseries: Track LMB nid instead of using device tree (Steve Best) [1772110 1758742]
  - [powerpc] powerpc/pseries/memory-hotplug: Only update DT once per memory DLPAR request (Steve Best) [1772110 1758742]
  - [powerpc] powerpc/rtas: allow rescheduling while changing cpu states (Steve Best) [1772109 1758651]
  - [powerpc] powerpc/pseries/mobility: use cond_resched when updating device tree (Steve Best) [1772109 1758651]
  - [netdrv] i40e: Do not check VF state in i40e_ndo_get_vf_config (Stefan Assmann) [1770177 1752498]
  - [fs] CIFS: Fix use after free of file info structures (Dave Wysochanski) [1767357 1757865]
  - [fs] cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic (Dave Wysochanski) [1767357 1757865]
  - [netdrv] net/ibmvnic: prevent more than one thread from running in reset (Steve Best) [1764830 1756943]
  - [netdrv] net/ibmvnic: unlock rtnl_lock in reset so linkwatch_event can run (Steve Best) [1764830 1756943]
  - [netdrv] ibmvnic: Warn unknown speed message only when carrier is present (Steve Best) [1764832 1749873]
  - [netdrv] net/ibmvnic: Fix missing { in __ibmvnic_reset (Steve Best) [1764832 1749873]
  - [netdrv] net/ibmvnic: free reset work of removed device from queue (Steve Best) [1764832 1749873]
  - [netdrv] ibmvnic: Do not process reset during or after device removal (Steve Best) [1764832 1749873]
  - [cpuidle] cpuidle: governor: Add new governors to cpuidle_governors again (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: do not set an owner to allow modunload (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: set haltpoll as preferred governor (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: allow governor switch on cpuidle_register_driver() (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: Add cpuidle.governor= command line parameter (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: vcpu hotplug support (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: disable host side polling when kvm virtualized (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: add haltpoll governor (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: header file stubs must be "static inline" (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] governors: unify last_state_idx (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: add poll_limit_ns to cpuidle_device structure (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: poll_state: Fix default time limit (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: poll_state: Disregard disable idle states (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: poll_state: Revise loop termination condition (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: menu: Fix wakeup statistics updates for polling state (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: return -ENODEV on modinit failure (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] add cpuidle-haltpoll driver (Marcelo Tosatti) [1764831 1759282]
  - [x86] kvm: x86: add host poll control msrs (Vitaly Kuznetsov) [1764831 1749495]
  - [s390] s390/setup: Fix kernel lock down for s390 (Philipp Rudo) [1764827 1748343]
  - [powerpc] powerpc: Allow flush_(inval_)dcache_range to work across ranges >4GB (Steve Best) [1764826 1744062]
  - [fs] mm/huge_memory: fix vmf_insert_pfn_{pmd, pud}() crash, handle unaligned addresses (Jeff Moyer) [1764825 1743159]
  - [mm] mm/huge_memory.c: fix modifying of page protection by insert_pfn_pmd() (Jeff Moyer) [1764825 1743159]
  - [pci] PCI: hv: Use bytes 4 and 5 from instance ID as the PCI domain numbers (Mohammed Gamal) [1764634 1671288]
  - [pci] PCI: hv: Detect and fix Hyper-V PCI domain number collision (Mohammed Gamal) [1764634 1671288]


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-147.3.1.rt24.96.el8_1]
changelog:
  - [rt] kernel-rt-4.18.0-147.3.1.rt24.95.el8_1 (Juri Lelli)
  - [x86] kvm: svm: taint module and print taint message iff nested is enabled (Bandan Das) [1776114 1775410]


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-147.4.1.rt24.97.el8_1]
changelog:
  - [rt] kernel-rt-4.18.0-147.4.1.rt24.96.el8_1 (Juri Lelli)
  - [block] blk-mq: apply normal plugging for HDD (Ming Lei) [1782181 1759380]
  - [block] blk-mq: honor IO scheduler for multiqueue devices (Ming Lei) [1782181 1759380]
  - [block] blk-mq: simplify blk_mq_make_request() (Ming Lei) [1782181 1759380]
  - [block] blk-mq: remove blk_mq_put_ctx() (Ming Lei) [1782181 1759380]
  - [x86] kvm: vmx: use MSR_IA32_TSX_CTRL to hard-disable TSX on guest that lack it (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm: vmx: implement MSR_IA32_TSX_CTRL disable RTM functionality (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm: x86: implement MSR_IA32_TSX_CTRL effect on CPUID (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm: x86: do not modify masked bits of shared MSRs (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm: x86: fix presentation of TSX feature in ARCH_CAPABILITIES (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm/x86: Export MDS_NO=0 to guests when TSX is enabled (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [fs] cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs (Leif Sahlberg) [1778693 1765979]
  - [fs] cifs: avoid using MID 0xFFFF (Leif Sahlberg) [1778693 1765979]
  - [fs] cifs: Fix retry mid list corruption on reconnects (Leif Sahlberg) [1778693 1765979]
  - [fs] smb3: fix unmount hang in open_shroot (Leif Sahlberg) [1781113 1757670]
  - [fs] CIFS: fix deadlock in cached root handling (Leif Sahlberg) [1781113 1757670]
  - [fs] Fix match_server check to allow for auto dialect negotiate (Leif Sahlberg) [1781113 1757670]
  - [fs] SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write (Leif Sahlberg) [1781113 1757670]
  - [fs] cifs: fix panic in smb2_reconnect (Leif Sahlberg) [1781113 1757670]
  - [fs] cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level() (Leif Sahlberg) [1781113 1757670]
  - [fs] smb3: fix signing verification of large reads (Dave Wysochanski) [1781110 1753114]
  - [scsi] scsi: lpfc: Fix port relogin failure due to GID_FT interaction (Dick Kennedy) [1781108 1733217]
  - [fs] xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT (Bill O'Donnell) [1778692 1739607]
  - [net] cfg80211: wext: avoid copying malformed SSIDs (Jarod Wilson) [1778633 1778634] {CVE-2019-17133}
  - [block] blkcg: perpcu_ref init/exit should be done from blkg_alloc/free() (Ming Lei) [1777766 1741392]
  - [fs] userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx (Alex Gladkov) [1777389 1749763] {CVE-2019-14898}
  - [netdrv] mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings (Jarod Wilson) [1776618 1775484] {CVE-2019-14814 CVE-2019-14815 CVE-2019-14816}
  - [netdrv] mwifiex: fix possible heap overflow in mwifiex_process_country_ie() (Jarod Wilson) [1776209 1776210] {CVE-2019-14895}
  - [netdrv] mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() (Jarod Wilson) [1776161 1776162] {CVE-2019-14901}
  - [netdrv] rtlwifi: Fix potential overflow on P2P code (Jarod Wilson) [1775222 1775223] {CVE-2019-17666}
  - [pci] hv: Avoid use of hv_pci_dev->pci_slot after freeing it (Mohammed Gamal) [1764635 1737569]


author: Luis Claudio R. Goncalves <lgoncalv@redhat.com> [4.18.0-147.5.1.rt24.98.el8_1]
changelog:
  - [rt] kernel-rt-4.18.0-147.5.1.rt24.97.el8_1 ("Luis Claudio R. Goncalves")
  - [powerpc] powerpc/shared: Use static key to detect shared processor (Phil Auld) [1781114 1767529]
  - [powerpc] powerpc/vcpu: Assume dedicated processors as non-preempt (Phil Auld) [1781114 1767529]


author: Luis Claudio R. Goncalves <lgoncalv@redhat.com> [4.18.0-147.6.1.rt24.99.el8_1]
changelog:
  - [rt] kernel-rt-4.18.0-147.6.1.rt24.98.el8_1 [1794136]
  - [rt] lockdep: Increase MAX_LOCK_[ENTRIES|CHAIN_BITS] [1794199]
  - [crypto] crypto: chelsio - count incomplete block in IV (Jonathan Toppins) [1798527 1725813]
  - [crypto] crypto: chelsio - Fix softlockup with heavy I/O (Jonathan Toppins) [1798527 1725813]
  - [crypto] crypto: chelsio - Fix NULL pointer dereference (Jonathan Toppins) [1798527 1725813]
  - [nvme] nvme: Treat discovery subsystems as unique subsystems (Ewan Milne) [1798381 1757525]
  - [mm] mm/page-writeback.c: don't break integrity writeback on ->writepage() error (Christoph von Recklinghausen) [1797962 1782117]
  - [lib] crc-t10dif: crc_t10dif_mutex can be static (Vladis Dronov) [1797961 1769462]
  - [lib] crc-t10dif: Allow current transform to be inspected in sysfs (Vladis Dronov) [1797961 1769462]
  - [lib] crc-t10dif: Pick better transform if one becomes available (Vladis Dronov) [1797961 1769462]
  - [crypto] api - Introduce notifier for new crypto algorithms (Vladis Dronov) [1797961 1769462]
  - [block] blk-mq: make sure that line break can be printed (Ming Lei) [1797960 1741462]
  - [block] blk-mq: avoid sysfs buffer overflow with too many CPU cores (Ming Lei) [1797960 1741462]
  - [scsi] hpsa: update driver version (Joseph Szczypek) [1797519 1761968]
  - [scsi] scsi: hpsa: add missing hunks in reset-patch (Joseph Szczypek) [1797519 1761968]
  - [arm64] arm64: compat: Workaround Neoverse-N1 #1542419 for compat user-space (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Fake the IminLine size on systems affected by Neoverse-N1 #1542419 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: errata: Hide CTR_EL0.DIC on systems affected by Neoverse-N1 #1542419 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Handle erratum 1418040 as a superset of erratum 1188873 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: errata: Add workaround for Cortex-A76 erratum #1463225 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Kconfig: Tidy up errata workaround help text (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Apply ARM64_ERRATUM_1188873 to Neoverse-N1 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Add part number for Neoverse N1 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Make ARM64_ERRATUM_1188873 depend on COMPAT (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Restrict ARM64_ERRATUM_1188873 mitigation to AArch32 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: arch_timer: avoid unused function warning (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Add workaround for Cortex-A76 erratum 1286807 (Mark Salter) [1797518 1757828]
  - [md] dm snapshot: rework COW throttling to fix deadlock (Mike Snitzer) [1796490 1758605]
  - [md] dm snapshot: introduce account_start_copy() and account_end_copy() (Mike Snitzer) [1796490 1758605]
  - [block] fix memleak of bio integrity data (Ming Lei) [1795338 1779898]
  - [powerpc] xive: Prevent page fault issues in the machine crash handler (Diego Domingos) [1795337 1756116]
  - [scsi] scsi: megaraid_sas: IRQ poll to avoid CPU hard lockups (Tomas Henzl) [1795335 1726251]
  - [powerpc] powerpc/perf: Disable trace_imc pmu (Steve Best) [1794061 1785573]
  - [s390] s390/qeth: ensure linear access to packet headers (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: guard against runt packets (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: handle skb allocation error gracefully (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: drop unwanted packets earlier in RX path (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: support per-frame invalidation (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: gather more detailed RX dropped/error statistics (Philipp Rudo) [1794059 1781085]
  - [s390] s390/net: Mark expected switch fall-throughs (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: consolidate skb RX processing in L3 driver (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: remove RX seqno in skb->cb (Philipp Rudo) [1794059 1781085]
  - [powerpc] kvm: ppc: book3s hv: Flush link stack on guest exit to host kernel (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] book3s64: Fix link stack flush on context switch (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] 64s: support nospectre_v2 cmdline option (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] fsl: Update Spectre v2 reporting (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] fsl: Add nospectre_v2 command line argument (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] fsl: Fix spectre_v2 mitigations reporting (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] 64: Make meltdown reporting Book3S 64 specific (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] 64: Disable the speculation barrier from the command line (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [firmware] efi/memreserve: Register reservations as 'reserved' in /proc/iomem (Bhupesh Sharma) [1792200 1772730]
  - [firmware] efi/memreserve: deal with memreserve entries in unmapped memory (Bhupesh Sharma) [1792200 1772730]
  - [s390] s390/cpum_sf: save TOD clock base in SDBs for time conversion (Philipp Rudo) [1792198 1743504]
  - [s390] s390/sclp: Fix bit checked for has_sipl (Philipp Rudo) [1791408 1748347]
  - [scsi] qla2xxx: Fix incorrect SFUB length used for Secure Flash Update MB Cmd (Himanshu Madhani) [1790350 1782598]
  - [scsi] qla2xxx: Added support for MPI and PEP regions for ISP28XX (Himanshu Madhani) [1790350 1782598]
  - [scsi] qla2xxx: Correctly retrieve and interpret active flash region (Himanshu Madhani) [1790350 1782598]
  - [powerpc] powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction (Gustavo Duarte) [1788862 1750653] {CVE-2019-15030}
  - [powerpc] powerpc/tm: Fix restoring FP/VMX facility incorrectly on interrupts (Gustavo Duarte) [1791630 1750653] {CVE-2019-15031}
  - [scsi] scsi: qla2xxx: Fix different size DMA Alloc/Unmap (Himanshu Madhani) [1788206 1753031]
  - [scsi] qla2xxx: call dma_free_coherent with correct size in all cases in qla24xx_sp_unmap (Himanshu Madhani) [1788206 1753031]
  - [fs] devpts_pty_kill(): don't bother with d_delete() (Eric Sandeen) [1783959 1772718]
  - [fs] devpts: always delete dcache dentry-s in dput() (Eric Sandeen) [1783959 1772718]


author: Luis Claudio R. Goncalves <lgoncalv@redhat.com> [4.18.0-147.7.1.rt24.100.el8_1]
changelog:
  - [rt] kernel-rt-4.18.0-147.7.1.rt24.99.el8_1 ("Luis Claudio R. Goncalves")
  - [hid] hiddev: do cleanup in failure of opening a device (Benjamin Tissoires) [1803458 1803460] {CVE-2019-19527}
  - [hid] hiddev: avoid opening a disconnected device (Benjamin Tissoires) [1803458 1803460] {CVE-2019-19527}
  - [nvme] nvmet: fix discover log page when offsets are used (Gopal Tiwari) [1801216 1745836]
  - [netdrv] ibmvnic: Serialize device queries (Steve Best) [1794060 1778037]
  - [netdrv] ibmvnic: Bound waits for device queries (Steve Best) [1794060 1778037]
  - [netdrv] ibmvnic: Terminate waiting device threads after loss of service (Steve Best) [1794060 1778037]
  - [netdrv] ibmvnic: Fix completion structure initialization (Steve Best) [1794060 1778037]
  - [netdrv] ibmvnic: Ignore H_FUNCTION return from H_EOI to tolerate XIVE mode (Steve Best) [1794060 1778037]
  - [tools] selftests/powerpc: Fix compile error on tlbie_test due to newer gcc (Desnes Augusto Nunes do Rosario) [1794058 1755707]
  - [tools] selftests/powerpc: Add test case for tlbie vs mtpidr ordering issue (Desnes Augusto Nunes do Rosario) [1794058 1755707]
  - [powerpc] powerpc/mm: Fixup tlbie vs mtpidr/mtlpidr ordering issue on POWER9 (Desnes Augusto Nunes do Rosario) [1794058 1755707]
  - [powerpc] powerpc/book3s64/radix: Rename CPU_FTR_P9_TLBIE_BUG feature flag (Desnes Augusto Nunes do Rosario) [1794058 1755707]
  - [powerpc] powerpc/book3s64/mm: Don't do tlbie fixup for some hardware revisions (Desnes Augusto Nunes do Rosario) [1794058 1755707]


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-4
changelog:
  - kexec-kdump-howto.txt: Add document about encrypted targets
  - kexec-kdump-howto.txt: Add document about initramfs rebiuld
  - kexec-kdump-howto: Add note on setting correct value of kptr_restrict
  - doc: fix dead links in the file kexec-kdump-howto.txt
  - earlykdump: provide a prompt message after the rebuilding of kdump initramfs.
  - Get rid of duplicated strip_comments when reading config
  - mkdumprd: Improve the config reading logic
  - kdumpctl: don't always rebuild when extra_modules is set
  - kdumpctl: follow symlink when checking for modified files
  - fadump: leverage kernel support to re-regisgter FADump


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-5
changelog:
  - kdumpctl: check for ssh path availability when rebuild
  - kdumpctl: Check kdump.conf for error when rebuild is called
  - makedumpfile: x86_64: Add support for AMD Secure Memory Encryption
  - aarch64/kdump.sysconfig: Make config options similar to x86_64


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-9
changelog:
  - kexec/arm64: Add support for handling zlib compressed (Image.gz) image
  - kexec/kexec-zlib.h: Add 'is_zlib_file()' helper function
  - kexec-uImage-arm64.c: Fix return value of uImage_arm64_probe()
  - kexec/kexec.c: Add the missing close() for fd used for kexec_file_load()


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-12.1
changelog:
  - Don't execute final_action if failure_action terminates the system
  - dracut-module-setup.sh: Don't use squash module for fadump
  - Don't mount the dump target unless needed


author: Pingfan Liu <piliu@redhat.com> - 2.0.19-12.2
changelog:
  - arm64: kdump: deal with a lot of resource entries in /proc/iomem
  - arm64: kexec: allocate memory space avoiding reserved regions
  - kexec: add variant helper functions for handling memory regions


author: - Andy Walsh <awalsh@redhat.com> - 6.2.1.102-53
changelog:
  - Continued converting the VDO device to conform to the DM convention of
    not issuing I/O while suspended.
    - Resolves: rhbz#1659303
  - Added more rate limiting of error logging in both the kvdo and uds
    modules in order to avoid soft-lockups on newer kernels.
    - Resolves: rhbz#1703243
  - Eliminated the passing of addresses of unaligned fields in packed
    - Resolves: rhbz#1718058


author: - Andy Walsh <awalsh@redhat.com> - 6.2.1.134-56
changelog:
  - Finished converting the VDO device to conform to the DM convention of not
    issuing I/O while suspended.
  - Resolves: rhbz#1659303
  - Fixed a bug where crash recovery could use the wrong threads for certain
    operations potentially resulting in memory corruption.
  - Resolves: rhbz#1703621
  - Fixed a bug which could cause segfaults when running the vdostatus
    command.
  - Resolves: rhbz#1669960
  - Eliminated a backtrace from the error logged when creating a VDO device
    with an erroneous physical size in the table line.
  - Resolves: rhbz#1717435
  - Fixed a possible use-after-free of the UDSConfiguration.
  - Resolves: rhbz#1653802
  - Made VDO a singleton device because multi-segment devices containing a
    VDO have a number of issues.
  - Resolves: rhbz#1725077
  - Converted the VDO device to conform to the DM convention of not issuing
    writes from the constructor.
  - Resolves: rhbz#1669086


author: - Andy Walsh <awalsh@redhat.com> - 6.2.1.138-56
changelog:
  - Fixed a crash on allocation failure and a use-after-free race introduced by
    the changes to avoid issuing I/O while suspended.
  - Resolves: rhbz#1659303


author: Pavel Raiskup <praiskup@redhat.com> - 3.3.2-4
changelog:
  - fix out-of-bounds read within lha_read_data_none() (CVE-2017-14503)
  - fix crash on crafted 7zip archives (CVE-2019-1000019)
  - fix infinite loop in ISO9660 (CVE-2019-1000020)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.3.2-7
changelog:
  - fix use-after-free in delayed newc link processing (#1602575)
  - fix a few obvious resource leaks and strcpy() misuses (#1602575)


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20190618-1.20190918.1
changelog:
  - Intel CPU microcode update to 20190918 (#1758538).
  - Add new disclaimer, generated based on relevant caveats.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20190618-1.20191112-1
changelog:
  - Intel CPU microcode update to 20191112, addresses CVE-2017-5715,
    CVE-2019-0117, CVE-2019-11135, CVE-2019-11139 (#1764059, #1764072, #1764951,
      - Addition of 06-a6-00/0x80 (CML-U 6+2 A0) microcode at revision 0xc6;
    - Addition of 06-66-03/0x80 (CNL-U D0) microcode at revision 0x2a;
    - Addition of 06-55-03/0x97 (SKL-SP B1) microcode at revision 0x1000150;
    - Addition of 06-7e-05/0x80 (ICL-U/Y D1) microcode at revision 0x46;
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) microcode from revision 0xcc to 0xd4;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 R0/N0) microcode from revision 0xcc
      to 0xd4
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0) microcode from revision 0xb4
      to 0xc6;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-8e-0c/0x94 (AML-Y V0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-8e-0c/0x94 (CML-U 4+2 V0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-8e-0c/0x94 (WHL-U V0) microcode from revision 0xb8 to 0xc6;
    - Update of 06-9e-09/0x2a (KBL-G/X H0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-9e-09/0x2a (KBL-H/S/Xeon E3 B0) microcode from revision 0xb4
      to 0xc6;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode from revision 0xb4
      to 0xc6;
    - Update of 06-9e-0b/0x02 (CFL-S B0) microcode from revision 0xb4 to 0xc6;
    - Update of 06-9e-0d/0x22 (CFL-H R0) microcode from revision 0xb8 to 0xc6.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20190618-1.20191112.2
changelog:
  - Package the publicy available microcode-20191112 release (#1758539):
    - Addition of 06-4d-08/0x1 (AVN B0/C0) microcode at revision 0x12d;
    - Addition of 06-55-06/0xbf (CSL-SP B0) microcode at revision 0x400002c;
    - Addition of 06-7a-08/0x1 (GLK R0) microcode at revision 0x16;
    - Update of 06-55-03/0x97 (SKL-SP B1) microcode from revision 0x1000150
      up to 0x1000151;
    - Update of 06-55-04/0xb7 (SKL-SP H0/M0/U0, SKL-D M1) microcode from revision
      0x2000064 up to 0x2000065;
    - Update of 06-55-07/0xbf (CSL-SP B1) microcode from revision 0x500002b
      up to 0x500002c;
    - Update of 06-7a-01/0x1 (GLK B0) microcode from revision 0x2e up to 0x32;
  - Include 06-9e-0c (CFL-H/S P0) microcode from the microcode-20190918 release.
  - Correct the releasenote file (0001-releasenote-changes-summary-fixes.patch).
  - Update README.caveats with the link to the new Knowledge Base article.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20190618-1.20191113.1
changelog:
  - Update Intel CPU microcode to microcode-20191113 release:
    - Update of 06-9e-0c (CFL-H/S P0) microcode from revision 0xae up to 0xc6.
  - Drop 0001-releasenote-changes-summary-fixes.patch.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20190618-1.20191115.1
changelog:
  - Update Intel CPU microcode to microcode-20191115 release:
    - Update of 06-4e-03/0xc0 (SKL-U/Y D0) from revision 0xd4 up to 0xd6;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 R0/N0) from revision 0xd4
      up to 0xd6;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-09/0xc0 (KBL-U/Y H0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) from revision 0xc6 up to 0xca;
    - Update of 06-8e-0c/0x94 (AML-Y V0, CML-U 4+2 V0, WHL-U V0) from revision
      0xc6 up to 0xca;
    - Update of 06-9e-09/0x2a (KBL-G/X H0, KBL-H/S/Xeon E3 B0) from revision 0xc6
      up to 0xca;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0b/0x02 (CFL-S B0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0c/0x22 (CFL-S/Xeon E P0) from revision 0xc6 up to 0xca;
    - Update of 06-9e-0d/0x22 (CFL-H/S R0) from revision 0xc6 up to 0xca;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) from revision 0xc6 up to 0xca.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20190618-1.20191115.3
changelog:
  - Update stale posttrans dependency, add triggers for proper handling
    of the debug kernel flavour along with kernel-rt (#1780009).


author: Josef Ridky <jridky@redhat.com> - 1:5.8-12.1
changelog:
  - fix double free or corruption error caused by freeing security context (#1802055)
  - remove deprecated CFLAG


author: Phil Sutter <psutter@redhat.com> - 1:0.9.0-9
changelog:
  - Allow variables in jump statement
  - Make example configs readable only by root
  - Document nft list parameters
  - Document vmap statement
  - Install netdev-ingress.nft sample config in the right spot
  - Backport upstream fixes since last release


author: Than Ngo <than@redhat.com> - 3.10.0-3
changelog:
  - Resolves: #1657683, can't establish libica token in FIPS mode
  - Resolves: #1652856, EP11 token fails when using Strict-Session mode or VHSM-Mode


author: Than Ngo <than@redhat.com> - 3.11.0-3
changelog:
  - Resolves: #1667941, 3des tests failures due to FIPS incompatible test scenarios
  - Resolves: #1651731, ep11 token: enhanced IBM z14 functions
  - Resolves: #1651732, ep11 token: support m_*Single functions from ep11 lib
  - Resolves: #1525407, use CPACF hashes in ep11 token
  - Resolves: #1651238, rebase to 3.11.0
  - Resolves: #1682530, gating


author: Jitka Plesnikova <jplesnik@redhat.com> - 2.4.46-2
changelog:
  - Perl 5.28 rebuild
  - MozNSS Compat. Layer: Fix typos, and spelling in the README file header (#1564161)


author: Matus Honek <mhonek@redhat.com> - 2.4.46-3
changelog:
  - MozNSS Compat. Layer: Make log messages more clear (#1598103)
  - MozNSS Compat. Layer: Fix memleaks reported by valgrind (#1595203)


author: Matus Honek <mhonek@redhat.com> - 2.4.46-6
changelog:
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1594928)
  - Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967)


author: Jakub Jelen <jjelen@redhat.com> - 7.7p1-6 + 0.10.3-4
changelog:
  - Fix listing of kex algoritms in FIPS mode
  - Allow aes-gcm cipher modes in FIPS mode
  - Coverity fixes


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-2 + 0.10.3-5
changelog:
  - New upstream release fixing CVE 2018-15473
  - Remove unused patches
  - Remove reference to unused enviornment variable SSH_USE_STRONG_RNG
  - Address coverity issues
  - Unbreak scp between two IPv6 hosts (#1620333)
  - Unbreak GSSAPI key exchange (#1624323)
  - Unbreak rekeying with GSSAPI key exchange (#1624344)


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-3 + 0.10.3-5
changelog:
  - Disable OpenSSH hardening flags and use the ones provided by system (#1630615)
  - Ignore unknown parts of PKCS#11 URI (#1631478)
  - Do not fail with GSSAPI enabled in match blocks (#1580017)
  - Fix the segfaulting cavs test (#1629692)


author: Jakub Jelen <jjelen@redhat.com> - 7.8p1-4 + 0.10.3-5
changelog:
  - Unbreak PKCS#11 URI tests (#1648262)
  - Allow to disable RSA signatures with SHA1 (#1648898)
  - Dump missing GSS options from client configuration (#1649505)
  - Minor fixes from Fedora related to GSSAPI and keberos
  - Follow the system-wide PATH settings


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-1 + 0.10.3-7
changelog:
  - New upstream release (#1691045)
  - Remove support for unused VendorPatchLevel configuration option
  - Fix kerberos cleanup procedures (#1683295)
  - Do not negotiate arbitrary primes with DH GEX in FIPS (#1685096)
  - Several GSSAPI key exchange improvements and sync with Debian
  - Allow to use labels in PKCS#11 URIs even if they do not match on private key (#1671262)
  - Do not fall back to sshd_net_t SELinux context (#1678695)
  - Use FIPS compliant high-level signature OpenSSL API and KDF
  - Mention crypto-policies in manual pages
  - Do not fail if non-FIPS approved algorithm is enabled in FIPS
  - Generate the PEM files in new PKCS#8 format without the need of MD5 (#1712436)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-2 + 0.10.3-7
changelog:
  - Allow specifying a pin-value in PKCS #11 URI in ssh-add (#1639698)
  - Whitelist another syscall variant for s390x cryptographic module (ibmca engine) (#1714915)


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-3 + 0.10.3-7
changelog:
  - Fix typos in manual pages (#1668325)
  - Use the upstream support for PKCS#8 PEM files alongside with the legacy PEM files (#1712436)
  - Unbreak ssh-keygen -A in FIPS mode (#1732424)
  - Add missing RSA certificate types to offered hostkey types in FIPS mode (#1732449)


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1b-1
changelog:
  - update to the 1.1.1b release
  - EVP_KDF API backport from master
  - SSH KDF implementation for EVP_KDF API backport from master
  - add S390x chacha20-poly1305 assembler support from master branch


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-2
changelog:
  - do not try to use EC groups disallowed in FIPS mode
    in TLS
  - fix Valgrind regression with constant-time code


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1c-2.1
changelog:
  - add selftest of the RAND_DRBG implementation
  - fix incorrect error return value from FIPS_selftest_dsa


author: Petr Lautrbach <plautrba@redhat.com> - 2.8-15
changelog:
  - chcat: use check_call instead of getstatusoutput
  - semanage: Use standard argparse.error() method
  - semanage: Fix handling of -a/-e/-d/-r options


author: Petr Lautrbach <plautrba@redhat.com> - 2.8-16.1
changelog:
  - semanage: move valid_types initialisations to class constructors
  - semanage: import sepolicy only when it's needed
  - sepolicy: Add sepolicy.load_store_policy(store)
  - semanage: Start exporting "ibendport" and "ibpkey" entries


author: Florian Festi <ffesti@redhat.com> - 4.14.2-23
changelog:
  - Use --dpbath only with full path (#1696408)
  - Fix memory leaks (#1714657)
  - Remove capabilities instead of setting empty caps via. --setcaps (#1700920)
  - Fix bash warning from solution for #1689810


author: Ondrej Vasik <ovasik@redhat.com> - 2.12.0-1
changelog:
  - move /etc/networks from initscripts to setup
  - move /etc/profile.d/lang.{sh,csh} from initscripts to setup


author: Ondrej Vasik <ovasik@redhat.com> - 2.12.2-2
changelog:
  - do not ship /etc/hosts.allow and /etc/hosts.deny (no need for them
    as we don't allow tcp_wrappers in RHEL8, #1663556)


author: Petr Kubat <pkubat@redhat.com> - 3.26.0-1
changelog:
  - Updated to version 3.26.0 (https://sqlite.org/releaselog/3_26_0.html)
    Fixes fts3/4 corrupt database exploit (#1659684)


author: Michal Židek <mzidek@redhat.com> - 2.2.0-11
changelog:
  - Resolves: rhbz#1733372 - permission denied on logs when running sssd as
                             non-root user


author: Michal Židek <mzidek@redhat.com> - 2.2.0-13
changelog:
  - Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
              systemd-user service in the account phase in RHEL-8


author: Michal Židek <mzidek@redhat.com> - 2.2.0-14
changelog:
  - Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
                             should not cause files domain entries to be
                             qualified, this can break sudo access


author: Michal Židek <mzidek@redhat.com> - 2.2.0-15
changelog:
  - Resolves: rhbz#1736265 - Smart Card auth of local user: endless
                             loop if wrong PIN was provided


author: Michal Židek <mzidek@redhat.com> - 2.2.0-16
changelog:
  - Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
                             the IP address of the machine updated in IPA upon
                             sssd.service startup


author: Michal Židek <mzidek@redhat.com> - 2.2.0-17
changelog:
  - Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
                             keyring
  - Also apply a patch to fix gating tests issue


author: Michal Židek <mzidek@redhat.com> - 2.2.0-18
changelog:
  - Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
  - Also sync. kcm multihost tests with master


author: Michal Židek <mzidek@redhat.com> - 2.2.0-19
changelog:
  - Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
                             new ones (kcm)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.0-19.1
changelog:
  - Resolves: rhbz#1816591 - p11_child should have an option to skip
                             C_WaitForSlotEvent if the PKCS#11 module does not
                             implement it properly [rhel-8.1.0.z]


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-1
changelog:
  - rebase to the new upstream version 1.8.25p1
  - sync patches with rhel-7.6
  - sync sudoers with rhel-7.6
    resolves: rhbz#1633144


author: Daniel Kopecek <dkopecek@redhat.com> - 1.8.25-2
changelog:
  - Depend explicitly on /usr/sbin/sendmail instead of sendmail (rhel-7 sync)
  - Simplified pam configuration file by removing duplicate pam stack entries
  Resolves: rhbz#1633144


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-5
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed problem with sudo-1.8.23 and 'who am i'
  Resolves: rhbz#1673886
  - Backporting sudo bug with expired passwords
  Resolves: rhbz#1676819


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-6
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed The LDAP backend which is not properly parsing sudoOptions,
    resulting in selinux roles not being applied
  Resolves: rhbz#1738326


author: Lukas Nykryn <lnykryn@redhat.com> - 239-9
changelog:
  - dissect-image: use right comparison function (#1602706)
  - login: avoid leak of name returned by uid_to_name() (#1602706)
  - firewall-util: add an assert that we're not overwriting a buffer (#1602706)
  - journal-file: avoid calling ftruncate with invalid fd (#1602706)
  - dhcp6: make sure we have enough space for the DHCP6 option header (#1643363)
  - core: rename queued_message → pending_reload_message (#1647359)
  - core: when we can't send the pending reload message, say we ignore it in the warning we log (#1647359)
  - core: make sure we don't throttle change signal generator when a reload is pending (#1647359)
  - proc-cmdline: introduce PROC_CMDLINE_RD_STRICT (#1643429)
  - debug-generator: introduce rd.* version of all options (#1643429)
  - chown-recursive: let's rework the recursive logic to use O_PATH (#1643368)
  - chown-recursive: also drop ACLs when recursively chown()ing (#1643368)
  - chown-recursive: TAKE_FD() is your friend (#1643368)
  - test: add test case for recursive chown()ing (#1643368)
  - Revert "sysctl.d: request ECN on both in and outgoing connections" (#1619790)
  - detect-virt: do not try to read all of /proc/cpuinfo (#1631532)
  - sd-bus: unify three code-paths which free struct bus_container (#1635435)
  - sd-bus: properly initialize containers (#1635435)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-10
changelog:
  - cryptsetup-generator: introduce basic keydev support (#1656869)
  - cryptsetup: don't use %m if there's no error to show (#1656869)
  - cryptsetup-generator: don't return error if target directory already exists (#1656869)
  - cryptsetup-generator: allow whitespace characters in keydev specification (#1656869)
  - rules: watch metadata changes on DASD devices (#1638676)
  - sysctl.d: switch net.ipv4.conf.all.rp_filter from 1 to 2 (#1653824)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-12
changelog:
  - core: when deserializing state always use read_line(…, LONG_LINE_MAX, …) (CVE-2018-15686)
  - coredump: remove duplicate MESSAGE= prefix from message (#1664976)
  - journald: remove unnecessary {} (#1664976)
  - journald: do not store the iovec entry for process commandline on stack (#1664976)
  - basic/process-util: limit command line lengths to _SC_ARG_MAX (#1664976)
  - coredump: fix message when we fail to save a journald coredump (#1664976)
  - procfs-util: expose functionality to query total memory (#1664976)
  - basic/prioq: add prioq_peek_item() (#1664976)
  - journal: limit the number of entries in the cache based on available memory (#1664976)
  - journald: periodically drop cache for all dead PIDs (#1664976)
  - process-util: don't use overly large buffer to store process command line (#1664976)
  - Revert "sysctl.d: switch net.ipv4.conf.all.rp_filter from 1 to 2" (#1653824)
  - journal: fix syslog_parse_identifier() (#1664978)
  - journald: set a limit on the number of fields (1k) (#1664977)
  - journald: when processing a native message, bail more quickly on overbig messages (#1664977)
  - journald: lower the maximum entry size limit to ½ for non-sealed fds (#1664977)
  - µhttpd: use a cleanup function to call MHD_destroy_response (#1664977)
  - journal-remote: verify entry length from header (#1664977)
  - journal-remote: set a limit on the number of fields in a message (#1664977)
  - journald: correctly attribute log messages also with cgroupsv1 (#1658115)
  - rules: add elevator= kernel command line parameter (#1670126)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-14
changelog:
  - rules: implement new memory hotplug policy (#1670728)
  - rules: add the rule that adds elevator= kernel command line parameter (#1670126)
  - bus-socket: Fix line_begins() to accept word matching full string (#1692991)
  - Refuse dbus message paths longer than BUS_PATH_SIZE_MAX limit. (#1678641)
  - Allocate temporary strings to hold dbus paths on the heap (#1678641)
  - sd-bus: if we receive an invalid dbus message, ignore and proceeed (#1678641)
  - Revert "core: one step back again, for nspawn we actually can't wait for cgroups running empty since systemd will get exactly zero notifications about it" (#1703485)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-15
changelog:
  - tree-wide: shorten error logging a bit (#1697893)
  - nspawn: simplify machine terminate bus call (#1697893)
  - nspawn: merge two variable declaration lines (#1697893)
  - nspawn: rework how we allocate/kill scopes (#1697893)
  - unit: enqueue cgroup empty check event if the last ref on a unit is dropped (#1697893)
  - Revert "journal: remove journal audit socket" (#1699287)
  - journal: don't enable systemd-journald-audit.socket by default (#1699287)
  - logs-show: use grey color for de-emphasizing journal log output (#1695601)
  - units: add [Install] section to tmp.mount (#1667065)
  - nss: do not modify errno when NSS_STATUS_NOTFOUND or NSS_STATUS_SUCCESS (#1691691)
  - util.h: add new UNPROTECT_ERRNO macro (#1691691)
  - nss: unportect errno before writing to NSS' *errnop (#1691691)
  - seccomp: reduce logging about failure to add syscall to seccomp (#1658691)
  - format-table: when duplicating a cell, also copy the color (#1689832)
  - format-table: optionally make specific cells clickable links (#1689832)
  - format-table: before outputting a color, check if colors are available (#1689832)
  - format-table: add option to store/format percent and uint64_t values in cells (#1689832)
  - format-table: optionally allow reversing the sort order for a column (#1689832)
  - format-table: add table_update() to update existing entries (#1689832)
  - format-table: add an API for getting the cell at a specific row/column (#1689832)
  - format-table: always underline header line (#1689832)
  - format-table: add calls to query the data in a specific cell (#1689832)
  - format-table: make sure we never call memcmp() with NULL parameters (#1689832)
  - format-table: use right field for display (#1689832)
  - format-table: add option to uppercase cells on display (#1689832)
  - format-table: never try to reuse cells that have color/url/uppercase set (#1689832)
  - locale-util: add logic to output smiley emojis at various happiness levels (#1689832)
  - analyze: add new security verb (#1689832)
  - tests: add a rudimentary fuzzer for server_process_syslog_message (#9979) (#1696224)
  - journald: make it clear that dev_kmsg_record modifies the string passed to it (#1696224)
  - journald: free the allocated memory before returning from dev_kmsg_record (#1696224)
  - tests: rework the code fuzzing journald (#1696224)
  - journald: make server_process_native_message compatible with fuzz_journald_processing_function (#1696224)
  - tests: add a fuzzer for server_process_native_message (#1696224)
  - tests: add a fuzzer for sd-ndisc (#1696224)
  - ndisc: fix two infinite loops (#1696224)
  - tests: add reproducers for several issues uncovered with fuzz-journald-syslog (#1696224)
  - tests: add a reproducer for an infinite loop in ndisc_handle_datagram (#1696224)
  - tests: add a reproducer for another infinite loop in ndisc_handle_datagram (#1696224)
  - fuzz: rename "fuzz-corpus" directory to just "fuzz" (#1696224)
  - test: add testcase for issue 10007 by oss-fuzz (#1696224)
  - fuzz: unify the "fuzz-regressions" directory with the main corpus (#1696224)
  - test-bus-marshal: use cescaping instead of hexmem (#1696224)
  - meson: add -Dlog-trace to set LOG_TRACE (#1696224)
  - meson: allow building resolved and machined without nss modules (#1696224)
  - meson: drop duplicated condition (#1696224)
  - meson: use .source_root() in more places (#1696224)
  - meson: treat all fuzz cases as unit tests (#1696224)
  - fuzz-bus-message: add fuzzer for message parsing (#1696224)
  - bus-message: use structured initialization to avoid use of unitialized memory (#1696224)
  - bus-message: avoid an infinite loop on empty structures (#1696224)
  - bus-message: let's always use -EBADMSG when the message is bad (#1696224)
  - bus-message: rename function for clarity (#1696224)
  - bus-message: use define (#1696224)
  - bus: do not print (null) if the message has unknown type (#1696224)
  - bus-message: fix calculation of offsets table (#1696224)
  - bus-message: remove duplicate assignment (#1696224)
  - bus-message: fix calculation of offsets table for arrays (#1696224)
  - bus-message: drop asserts in functions which are wrappers for varargs version (#1696224)
  - bus-message: output debug information about offset troubles (#1696224)
  - bus-message: fix skipping of array fields in !gvariant messages (#1696224)
  - bus-message: also properly copy struct signature when skipping (#1696224)
  - fuzz-bus-message: add two test cases that pass now (#1696224)
  - bus-message: return -EBADMSG not -EINVAL on invalid !gvariant messages (#1696224)
  - bus-message: avoid wrap-around when using length read from message (#1696224)
  - util: do not use stack frame for parsing arbitrary inputs (#1696224)
  - travis: enable ASan and UBSan on RHEL8 (#1683319)
  - tests: keep SYS_PTRACE when running under ASan (#1683319)
  - tree-wide: various ubsan zero size memory fixes (#1683319)
  - util: introduce memcmp_safe() (#1683319)
  - test-socket-util: avoid "memleak" reported by valgrind (#1683319)
  - sd-journal: escape binary data in match_make_string() (#1683319)
  - capability: introduce CAP_TO_MASK_CORRECTED() macro replacing CAP_TO_MASK() (#1683319)
  - sd-bus: use size_t when dealing with memory offsets (#1683319)
  - sd-bus: call cap_last_cap() only once in has_cap() (#1683319)
  - mount-point: honour AT_SYMLINK_FOLLOW correctly (#1683319)
  - travis: switch from trusty to xenial (#1683319)
  - test-socket-util: Add tests for receive_fd_iov() and friends. (#1683319)
  - socket-util: Introduce send_one_fd_iov() and receive_one_fd_iov() (#1683319)
  - core: swap order of "n_storage_fds" and "n_socket_fds" parameters (#1683334)
  - execute: use our usual syntax for defining bit masks (#1683334)
  - core: introduce new Type=exec service type (#1683334)
  - man: document the new Type=exec type (#1683334)
  - sd-bus: allow connecting to the pseudo-container ".host" (#1683334)
  - sd-login: let's also make sd-login understand ".host" (#1683334)
  - test: add test for Type=exec (#1683334)
  - journal-gateway: explicitly declare local variables (#1705971)
  - tools: drop unused variable (#1705971)
  - journal-gateway: use localStorage["cursor"] only when it has valid value (#1705971)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-16
changelog:
  - sd-bus: deal with cookie overruns (#1694999)
  - journal-remote: do not request Content-Length if Transfer-Encoding is chunked (#1708849)
  - journal: do not remove multiple spaces after identifier in syslog message (#1691817)
  - cryptsetup: Do not fallback to PLAIN mapping if LUKS data device set fails. (#1719153)
  - cryptsetup: call crypt_load() for LUKS only once (#1719153)
  - cryptsetup: Add LUKS2 token support. (#1719153)
  - udev/scsi_id: fix incorrect page length when get device identification VPD page (#1713227)
  - Change job mode of manager triggered restarts to JOB_REPLACE (#11456
  - bash-completion: analyze: support 'security' (#1733395)
  - man: note that journal does not validate syslog fields (#1707175)
  - rules: skip memory hotplug on ppc64 (#1713159)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-17
changelog:
  - mount: simplify /proc/self/mountinfo handler (#1696178)
  - mount: rescan /proc/self/mountinfo before processing waitid() results (#1696178)
  - swap: scan /proc/swaps before processing waitid() results (#1696178)
  - analyze-security: fix potential division by zero (#1734400)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-18
changelog:
  - shared/but-util: drop trusted annotation from bus_open_system_watch_bind_with_description() (#1746857)
  - sd-bus: adjust indentation of comments (#1746857)
  - resolved: do not run loop twice (#1746857)
  - resolved: allow access to Set*Link and Revert methods through polkit (#1746857)
  - resolved: query polkit only after parsing the data (#1746857)


author: Lukas Nykryn <lnykryn@redhat.com> - 239-18.1
changelog:
  - journal: rely on _cleanup_free_ to free a temporary string used in client_context_read_cgroup (#1767716)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-18.3
changelog:
  - core, job: fix breakage of ordering dependencies by systemctl reload command (#1781712)
  - syslog: fix segfault in syslog_parse_priority() (#1781712)
  - journald: fixed assertion failure when system journal rotation fails (#9893) (#1781712)
  - test: use PBKDF2 instead of Argon2 in cryptsetup... (#1781712)
  - test: mask several unnecessary services (#1781712)
  - test: bump the second partition's size to 50M (#1781712)
  - sd-bus: make rqueue/wqueue sizes of type size_t (#20201712)
  - sd-bus: reorder bus ref and bus message ref handling (#20201712)
  - sd-bus: make sure dispatch_rqueue() initializes return parameter on all types of success (#20201712)
  - sd-bus: drop two inappropriate empty lines (#20201712)
  - sd-bus: initialize mutex after we allocated the wqueue (#20201712)
  - sd-bus: always go through sd_bus_unref() to free messages (#20201712)
  - bus-message: introduce two kinds of references to bus messages (#20201712)
  - sd-bus: introduce API for re-enqueuing incoming messages (#20201712)
  - sd-event: add sd_event_source_disable_unref() helper (#20201712)
  - polkit: when authorizing via PK let's re-resolve callback/userdata instead of caching it (#20201712)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-18.4
changelog:
  - sd-bus: use "queue" message references for managing r/w message queues in connection objects (CVE-2020-1712)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-18.5
changelog:
  - journal: do not trigger assertion when journal_file_close() get NULL (#1807350)
  - journal: use cleanup attribute at one more place (#1807350)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.12.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1685585
    - sap-netweaver: changed values of kernel.shmall and kernel.shmmax to RHEL-8 defaults
      resolves: rhbz#1708418
    - sap-netweaver: changed value of kernel.sem to RHEL-8 default
      resolves: rhbz#1701394
    - sap-hana-vmware: dropped profile
      resolves: rhbz#1715541
    - s2kb function: fixed to be compatible with python3
      resolves: rhbz#1684122
    - do fallback to the powersave governor (balanced and powersave profiles)
      resolves: rhbz#1679205
    - added support for negation of CPU list
      resolves: rhbz#1676588
    - switched from sysctl tool to own implementation
      resolves: rhbz#1666678
    - realtime-virtual-host: added tsc-deadline=on to qemu cmdline
      resolves: rhbz#1554458
    - fixed handling of devices that have been removed and re-attached
      resolves: rhbz#1677730


author: Kamil Dudka <kdudka@redhat.com> - 5.4.2-7
changelog:
  - avoid crash when copying empty hash table (CVE-2018-7549)
  - avoid NULL dereference when using ${(PA)...} on an empty array (CVE-2018-7548)


author: Kamil Dudka <kdudka@redhat.com> - 5.5-1
changelog:
  - update to latest upstream release, which fixes the following vulnerabilities:
      CVE-2018-1100 - stack-based buffer overflow in utils.c:checkmailpath()
      CVE-2018-1083 - stack-based buffer overflow in compctl.c:gen_matches_files()
      CVE-2018-1071 - stack-based buffer overflow in exec.c:hashcmd()


