# changelog

author: jslaby@suse.cz
changelog:
  - x86/ioapic: Force affinity setup before startup (bsc#1193231).
  - blacklist.conf: remove it from there as the prerequisities were
    backported already
  - commit 67a8716


author: ohering@suse.de
changelog:
  - PCI: hv: Add a per-bus mutex state_lock (bsc#1207001).
  - Revert "PCI: hv: Fix a timing issue which causes kdump to fail
    occasionally" (bsc#1207001).
  - PCI: hv: Remove the useless hv_pcichild_state from struct
    hv_pci_dev (bsc#1207001).
  - PCI: hv: Fix a race condition in hv_irq_unmask() that can
    cause panic (bsc#1207001).
  - PCI: hv: fix a race condition bug in hv_pci_query_relations()
    (bsc#1207001).
  - commit e9cf69b


author: jslaby@suse.cz
changelog:
  - x86/apic: Deinline x2apic functions (bsc#1181001 jsc#ECO-3191).
  - x86/x2apic: Mark set_x2apic_phys_mode() as __init (bsc#1181001
    jsc#ECO-3191).
  - Refresh
    patches.kabi/kABI-Fix-kABI-for-extended-APIC-ID-support.patch.
  - Refresh
    patches.suse/x86-msi-Force-affinity-setup-before-startup.patch.
    Update to upstream patches.
    Two easy cleanups added for simpler backports.
  - commit 2c2baeb


author: ematsumiya@suse.de
changelog:
  - cifs: fix return of uninitialized rc in
    dfs_cache_update_tgthint() (bsc#1190317).
  - commit aef9873


author: ematsumiya@suse.de
changelog:
  - cifs: Get rid of unneeded conditional in the smb2_get_aead_req()
    (bsc#1190317).
  - commit 46dc317


author: schwab@suse.de
changelog:
  - rpm/check-for-config-changes: add TOOLCHAIN_NEEDS_* to IGNORED_CONFIGS_RE
    This new form was added in commit e89c2e815e76 ("riscv: Handle
    zicsr/zifencei issues between clang and binutils").
  - commit 234baea


author: neilb@suse.de
changelog:
  - NFSv4: Fix hangs when recovering open state after a server reboot (git-fixes).
    [iivanov] Fix Patch-mainline to v6.3-rc5
  - commit f23280a


author: tiwai@suse.de
changelog:
  - rpm/constraints.in: increase the disk size for armv6/7 to 24GB
    It grows and the build fails recently on SLE15-SP4/5.
  - commit 41ac816


author: oneukum@suse.com
changelog:
  - net: usb: smsc75xx: Move packet length check to prevent kernel
    panic in skb_pull (git-fixes).
  - commit 904473f


author: dwagner@suse.de
changelog:
  - scsi: qla2xxx: Synchronize the IOCB count to be in order
    (bsc#1209292 bsc#1209684 bsc#1209556).
  - commit 18dd273


author: roy.hopkins@suse.com
changelog:
  - netlink: limit recursion depth in policy validation
    (CVE-2020-36691 bsc#1209613).
  - commit 519d73a


author: jslaby@suse.cz
changelog:
  - x86/decoder: Add TEST opcode to Group3-2 (git-fixes).
  - x86/sysfb: Fix check for bad VRAM size (git-fixes).
  - x86/mm: Use the correct function type for native_set_fixmap()
    (git-fixes).
  - x86/ioapic: Prevent inconsistent state when moving an interrupt
    (git-fixes).
  - x86/mce: Lower throttling MCE messages' priority to warning
    (git-fixes).
  - x86/apic: Soft disable APIC before initializing it (git-fixes).
  - x86/reboot: Always use NMI fallback when shutdown via reboot
    vector IPI fails (git-fixes).
  - uprobes/x86: Fix detection of 32-bit user mode (git-fixes).
  - x86/apic: Fix arch_dynirq_lower_bound() bug for DT enabled
    machines (git-fixes).
  - x86/apic: Handle missing global clockevent gracefully (git-fixes
    bsc#1142926).
  - x86/lib/cpu: Address missing prototypes warning (git-fixes).
  - x86, boot: Remove multiple copy of static function
    sanitize_boot_params() (git-fixes).
  - commit 439b087


author: msuchanek@suse.de
changelog:
  - Define kernel-vanilla as source variant
    The vanilla_only macro is overloaded. It is used for determining if
    there should be two kernel sources built as well as for the purpose of
    determmioning if vanilla kernel should be used for kernel-obs-build.
    While the former can be determined at build time the latter needs to be
    baked into the spec file template. Separate the two while also making
    the latter more generic.
    $build_dtbs is enabled on every single rt and azure branch since 15.3
    when the setting was introduced, gate on the new $obs_build_variant
    setting as well.
  - commit 36ba909


author: fdmanana@suse.com
changelog:
  - btrfs: fix race between quota disable and quota assign ioctls
    (CVE-2023-1611 bsc#1209687).
  - commit 5262625


author: neilb@suse.de
changelog:
  - Update
    patches.suse/NFSD-Protect-against-send-buffer-overflow-in-NFSv2-R.patch
    (bsc#1205128 CVE-2022-43945 bsc#1210124).
  - Update
    patches.suse/NFSD-Protect-against-send-buffer-overflow-in-NFSv3-R.patch
    (bsc#1205128 CVE-2022-43945 bsc#1210124).
  - Update
    patches.suse/NFSD-Protect-against-send-buffer-overflow-in-NFSv3-Rdir.patch
    (bsc#1205128 CVE-2022-43945 bsc#1210124).
    Fix a performance bug introduced by the backports bsc#1210124
  - commit 98fde8e


author: petr.pavlu@suse.com
changelog:
  - ring-buffer: Fix race while reader and writer are on the same
    page (git-fixes).
  - commit 68f2c8a


author: dkirjanov@suse.com
changelog:
  - sctp: do not free asoc when it is already dead in sctp_sendmsg
    (git-fixes).
  - Refresh
    patches.suse/sctp-implement-memory-accounting-on-tx-path.patch.
  - commit 064e118


author: dkirjanov@suse.com
changelog:
  - sctp: use the right sk after waking up from wait_buf sleep
    (git-fixes).
  - Refresh
    patches.suse/sctp-implement-memory-accounting-on-tx-path.patch.
  - commit 09b20fd


author: dkirjanov@suse.com
changelog:
  - sctp: return error if the asoc has been peeled off in
    sctp_wait_for_sndbuf (git-fixes).
  - Refresh
    patches.suse/sctp-implement-memory-accounting-on-tx-path.patch.
  - commit ec9bf28


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add 6a2cbc58d6c9 seq_buf: Make trace_seq_putmem_hex() support data longer than 8
  - commit 3b72881


author: oneukum@suse.com
changelog:
  - Refresh
    patches.suse/net-usb-cdc_mbim-avoid-altsetting-toggling-for-Telit.patch.
    Added additional ID
  - commit ec0740e


author: oneukum@suse.com
changelog:
  - platform/x86: intel_pmc_ipc: Use devm_* calls in driver probe
    function (git-fixes).
  - commit 66a8daf


author: oneukum@suse.com
changelog:
  - Refresh
    patches.suse/platform-x86-intel_pmc_ipc-Use-spin_lock-to-protect-.patch.
    Added additional commit ID
  - commit 32b5de9


author: clin@suse.com
changelog:
  - nfc: st-nci: Fix use after free bug in ndlc_remove due to race
    condition (git-fixes bsc#1210337 CVE-2023-1990).
  - commit 6ec02e1


author: tiwai@suse.de
changelog:
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove
    due to unfinished work (CVE-2023-1989 bsc#1210336).
  - commit 636a7de


author: roy.hopkins@suse.com
changelog:
  - hwmon: (xgene) Fix use after free bug in xgene_hwmon_remove
    due to race condition (CVE-2023-1855 bsc#1210202).
  - commit 8e7b0ea


author: lhenriques@suse.de
changelog:
  - cachefiles: Drop superfluous readpages aops NULL check
    (bsc#1210430).
  - cachefiles: Handle readpage error correctly (bsc#1210430).
  - cachefiles: Fix race between read_waiter and read_copier
    involving  op->to_do (bsc#1210430).
  - fscache, cachefiles: remove redundant variable 'cache'
    (bsc#1210430).
  - cachefiles: Fix page leak in cachefiles_read_backing_file
    while  vmscan is active (bsc#1210430).
  - commit 08d094b


author: aabdallah@suse.de
changelog:
  - x86/vmware: Update platform detection code for VMCALL/VMMCALL
    hypercalls (bsc#1210327).
  - commit 99ca820


author: pmladek@suse.com
changelog:
  - workqueue: Fix spurious sanity check failures in
    destroy_workqueue() (bsc#1210460).
  - blacklist.conf: Remove the commit from the blacklist.
  - commit dcf3af1


author: pmladek@suse.com
changelog:
  - blacklist.conf: workqueue: Non-trivial reasoning why the change is correct.
    Fixing a corner case.
  - commit 5637e05


author: tiwai@suse.de
changelog:
  - power: supply: da9150: Fix use after free bug in
    da9150_charger_remove due to race condition (CVE-2023-30772
    bsc#1210329).
  - commit a67542a


author: dkirjanov@suse.com
changelog:
  - net: phy: realtek: Use the dummy stubs for MMD register access
    for rtl8211b (git-fixes).
  - commit 8197f03


author: pmladek@suse.com
changelog:
  - printk: Give error on attempt to set log buffer length to over
    2G (bsc#1210534).
  - commit 416f599


author: pmladek@suse.com
changelog:
  - blacklist.conf: not needed; added also the commit introducing the regression
    on the blacklist to stay on the safe side
  - commit 39430c3


author: jslaby@suse.cz
changelog:
  - x86/speculation: Allow enabling STIBP with legacy IBRS
    (bsc#1210506 CVE-2023-1998).
  - commit 82dbdfe


author: oneukum@suse.com
changelog:
  - usb: typec: Check for ops->exit instead of ops->enter in
    altmode_exit (git-fixes).
  - commit b4c0f7a


author: jslaby@suse.cz
changelog:
  - x86/boot/compressed: Disable relocation relaxation (git-fixes).
  - Refresh patches.suse/x86-Use-return-thunk-in-asm-code.patch.
  - kretprobe: Prevent triggering kretprobe from within
    kprobe_flush_task (git-fixes).
  - x86/speculation/mds: Mark mds_user_clear_cpu_buffers()
    __always_inline (git-fixes).
  - x86_64: Fix jiffies ODR violation (git-fixes).
  - x86/mm: Stop printing BRK addresses (git-fixes).
  - bpf, x86: Fix encoding for lower 8-bit registers in BPF_STX
    BPF_B (git-fixes).
  - x86: Don't let pgprot_modify() change the page encryption bit
    (git-fixes).
  - x86/pkeys: Add check for pkey "overflow" (git-fixes).
  - commit e67532f


author: dkirjanov@suse.com
changelog:
  - net: core: dst_cache_set_ip6: Rename 'addr' parameter to
    'saddr' for consistency (git-fixes).
  - commit d4c9c59


author: dkirjanov@suse.com
changelog:
  - l2tp: fix pseudo-wire type for sessions created by
    pppol2tp_connect() (git-fixes).
  - commit 3cea0f6


author: dkirjanov@suse.com
changelog:
  - l2tp: clean up stale tunnel or session in pppol2tp_connect's
    error path (git-fixes).
  - commit ac0c4ce


author: nmorey@suse.com
changelog:
  - RDMA/cma: Make the locking for automatic state transition more clear (bsc#1210629 CVE-2023-2176)
  - commit b3ddeab


author: nmorey@suse.com
changelog:
  - RDMA/cma: Do not change route.addr.src_addr outside state checks (bsc#1210629 CVE-2023-2176)
  - commit 8101e86


author: nmorey@suse.com
changelog:
  - RDMA/cma: Ensure rdma_addr_cancel() happens before issuing more requests (bsc#1210629 CVE-2023-2176)
  - commit e746751


author: lduncan@suse.com
changelog:
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost
    ipaddress (bsc#1210647 CVE-2023-2162).
  - commit eba27cd


author: msuchanek@suse.de
changelog:
  - powerpc/papr_scm: Update the NUMA distance table for the
    target node (bsc#1209999 ltc#202140 bsc#1142685 ltc#179509
    FATE#327775 git-fixes).
  - powerpc/pseries: Consolidate different NUMA distance update
    code paths (bsc#1209999 ltc#202140 bsc#1142685 ltc#179509
    FATE#327775 git-fixes).
  - powerpc/pseries: Rename TYPE1_AFFINITY to FORM1_AFFINITY
    (bsc#1209999 ltc#202140 bsc#1142685 ltc#179509 FATE#327775
    git-fixes).
  - powerpc/pseries: rename min_common_depth to primary_domain_index
    (bsc#1209999 ltc#202140 bsc#1142685 ltc#179509 FATE#327775
    git-fixes).
  - powerpc/numa: Consider the max NUMA node for migratable LPAR
    (bsc#1209999 ltc#202140 bsc#1190544 ltc#194520 bsc#1142685 ltc#179509 FATE#327775
    git-fixes).
  - powerpc/numa: Detect support for coregroup (bsc#1209999
    ltc#202140 bsc#1142685 ltc#179509 FATE#327775 git-fixes).
  - powerpc/numa: Restrict possible nodes based on platform
    (bsc#1209999 ltc#202140 bsc#1142685 ltc#179509 FATE#327775
    git-fixes).
  - powerpc/numa: Limit possible nodes to within num_possible_nodes
    (bsc#1209999 ltc#202140 bsc#1142685 ltc#179509 FATE#327775
    git-fixes).
  - commit 2690e67


author: mkoutny@suse.com
changelog:
  - cgroup/cpuset: Wake up cpuset_attach_wq tasks in
    cpuset_cancel_attach() (bsc#1210827).
  - commit c9ac567


author: dwagner@suse.de
changelog:
  - nvme-pci: fix doorbell buffer value endianness (git-fixes).
  - nvme: retain split access workaround for capability reads
    (git-fixes).
  - commit 664dfaa


author: jlee@suse.com
changelog:
  - xirc2ps_cs: Fix use after free bug in xirc2ps_detach
    (bsc#1209871 CVE-2023-1670).
  - commit cab17d2


author: dwagner@suse.de
changelog:
  - blacklist.conf: add nvme git-fixes
    The nvme fabric part is not really supported in sle12 and touching this
    code with proper a lot of testing has a high change of regressions.
    The nvme core bits are also very dangerous to update without introducing
    regression because sle12 is still using mixed single queue and
    multiqueue block layers infrastructures. All this fixes are addressing
    issues reported against multiqueue only setups
  - commit 039b5e1


author: dwagner@suse.de
changelog:
  - kabi/severities: ignore KABI for NVMe, except nvme-fc (bsc#1174777)
    Exported symbols under drivers/nvme/host/ are only used by the
    nvme subsystem itself, except for the nvme-fc symbols.
  - commit c973bd8


author: dwagner@suse.de
changelog:
  - scsi: qla2xxx: Fix memory leak in qla2x00_probe_one()
    (git-fixes).
  - scsi: qla2xxx: Perform lockless command completion in abort path
    (git-fixes).
  - commit 9283be1


author: dwagner@suse.de
changelog:
  - nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is
    not RESETTING (git-fixes).
  - commit 289f082


author: nik.borisov@suse.com
changelog:
  - x86/irq: Ensure PI wakeup handler is unregistered before module unload (git-fixes).
  - commit 1ba0504


author: oneukum@suse.com
changelog:
  - xhci: also avoid the XHCI_ZERO_64B_REGS quirk with a passthrough
    iommu (git-fixes).
  - commit 25aa1f6


author: dkirjanov@suse.com
changelog:
  - kcm: Only allow TCP sockets to be attached to a KCM mux
    (git-fixes).
  - Refresh patches.suse/kcm-lock-lower-socket-in-kcm_attach.patch.
  - commit 1c38f1b


author: ailiop@suse.com
changelog:
  - xfs: verify buffer contents when we skip log replay (bsc#1210498
    CVE-2023-2124).
  - commit d228bcf


author: jslaby@suse.cz
changelog:
  - wifi: ath5k: fix an off by one check in
    ath5k_eeprom_read_freq_list() (git-fixes).
  - commit e7e4a01


author: jslaby@suse.cz
changelog:
  - PCI: aardvark: Fix PCIe Max Payload Size setting (git-fixes).
  - PCI: Mark Atheros QCA6174 to avoid bus reset (git-fixes).
  - PCI: xilinx-nwl: Enable the clock through CCF (git-fixes).
  - PCI: aardvark: Fix masking and unmasking legacy INTx interrupts
    (git-fixes).
  - PCI: aardvark: Configure PCIe resources from 'ranges' DT
    property (git-fixes).
  - PCI: aardvark: Increase polling delay to 1.5s while waiting
    for PIO response (git-fixes).
  - PCI: aardvark: Fix checking for PIO status (git-fixes).
  - PCI: Add ACS quirks for Cavium multi-function devices
    (git-fixes).
  - PCI: Return ~0 data on pciconfig_read() CAP_SYS_ADMIN failure
    (git-fixes).
  - PCI: Restrict ASMedia ASM1062 SATA Max Payload Size Supported
    (git-fixes).
  - PCI: Call Max Payload Size-related fixup quirks early
    (git-fixes).
  - commit 4ba05a4


author: ematsumiya@suse.de
changelog:
  - cifs: return ENOENT for DFS lookup_cache_entry() (bsc#1190317).
  - Refresh
    patches.suse/cifs-handle-cache-lookup-errors-different-than-ENOENT.patch.
  - Refresh
    patches.suse/cifs-split-out-ses-and-tcon-retrieval-from-mount_get_conns-.patch.
  - commit f050536


author: denis.kirjanov@suse.com
changelog:
  - net: qcom/emac: Fix use after free bug in emac_remove due to
    race condition (bsc#1211037 CVE-2023-2483).
  - commit 6c7d167


author: jack@suse.cz
changelog:
  - ext4: fix use-after-free in ext4_xattr_set_entry (bsc#1206878
    bsc#1211105 CVE-2023-2513).
  - commit a52726d


author: msuchanek@suse.de
changelog:
  - kernel-spec-macros: Fix up obsolete_rebuilds_subpackage to generate
    obsoletes correctly (boo#1172073 bsc#1191731).
    rpm only supports full length release, no provides
  - commit c9b5bc4


author: msuchanek@suse.de
changelog:
  - Remove obsolete rpm spec constructs
    defattr does not need to be specified anymore
    buildroot does not need to be specified anymore
  - commit c963185


author: vkarasulli@suse.de
changelog:
  - wifi: brcmfmac: slab-out-of-bounds read in
    brcmf_get_assoc_ies() (bsc#1209287 CVE-2023-1380).
  - commit 07a41fa


author: oneukum@suse.com
changelog:
  - platform/x86: alienware-wmi: Adjust instance of
    wmi_evaluate_method calls to 0 (git-fixes).
  - commit 17d45d2


author: oneukum@suse.com
changelog:
  - platform/x86: alienware-wmi: fix kfree on potentially
    uninitialized pointer (git-fixes).
  - commit 52b26a2


author: oneukum@suse.com
changelog:
  - platform/x86: dell-smbios-wmi: Add missing kfree in error-exit
    from run_smbios_call (git-fixes).
  - commit bc58d39


author: msuchanek@suse.de
changelog:
  - Documentation: Document sysfs interfaces purr, spurr, idle_purr,
    idle_spurr (PED-3947 bsc#1210544 ltc#202303).
  - powerpc/sysfs: Show idle_purr and idle_spurr for every CPU
    (PED-3947 bsc#1210544 ltc#202303).
  - powerpc/pseries: Account for SPURR ticks on idle CPUs (PED-3947
    bsc#1210544 ltc#202303).
  - powerpc/idle: Store PURR snapshot in a per-cpu global variable
    (PED-3947 bsc#1210544 ltc#202303).
  - powerpc: Move idle_loop_prolog()/epilog() functions to header
    file (PED-3947 bsc#1210544 ltc#202303).
  - cpuidle/powernv: avoid double irq enable coming out of idle
    (PED-3947 bsc#1210544 ltc#202303).
  - cpuidle: powerpc: no memory barrier after break from idle
    (PED-3947 bsc#1210544 ltc#202303).
  - cpuidle: powerpc: read mostly for common globals (PED-3947
    bsc#1210544 ltc#202303).
  - Refresh patches.suse/cpuidle-powernv-Fix-promotion-from-snooze-if-next-st.patch
  - cpuidle: powerpc: cpuidle set polling before enabling irqs
    (PED-3947 bsc#1210544 ltc#202303).
  - Refresh patches.suse/cpuidle-powernv-Fix-promotion-from-snooze-if-next-st.patch
  - commit 964f26b


author: oneukum@suse.com
changelog:
  - wcn36xx: Add ability for wcn36xx_smd_dump_cmd_req to pass
    two's complement (git-fixes).
  - commit 39c25cd


author: oneukum@suse.com
changelog:
  - wcn36xx: Use kmemdup instead of duplicating it in
    wcn36xx_smd_process_ptt_msg_rsp (git-fixes).
  - commit aa805c7


author: oneukum@suse.com
changelog:
  - wcn36xx: Fix software-driven scan (git-fix).
  - Refresh
    patches.suse/wcn36xx-Channel-list-update-before-hardware-scan.patch.
  - Refresh
    patches.suse/wcn36xx-Move-hal_buf-allocation-to-devm_kmalloc-in-p.patch.
  - commit 15a8b93


author: oneukum@suse.com
changelog:
  - wcn36xx: ensure pairing of init_scan/finish_scan and
    start_scan/end_scan (git-fixes).
  - commit 087dd65


author: pmladek@suse.com
changelog:
  - workqueue: Print backtraces from CPUs with hung CPU bound
    workqueues (bsc#1211044).
  - commit 9009e7b


author: msuchanek@suse.de
changelog:
  - powerpc/rtas: use memmove for potentially overlapping buffer
    copy (bsc#1065729).
  - powerpc: Don't try to copy PPR for task with NULL pt_regs
    (bsc#1065729).
  - powerpc: Squash lines for simple wrapper functions
    (bsc#1065729).
  - commit 5b5254d


author: msuchanek@suse.de
changelog:
  - Refresh patches.suse/arm64-Discard-.note.GNU-stack-section.patch.
    Add note about required followups for the upstream version.
  - commit 22f581b


author: jgross@suse.com
changelog:
  - ACPI: processor: Fix evaluating _PDC method when running as
    Xen dom0 (git-fixes).
  - commit dc522b8


author: vkarasulli@suse.de
changelog:
  - net: tls: fix possible race condition between
    do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
    (bsc#1209366 CVE-2023-28466).
  - commit 6a60b30


author: vkarasulli@suse.de
changelog:
  - netrom: Fix use-after-free caused by accept on already
    connected socket (bsc#1211186 CVE-2023-32269).
  - commit 5091773


author: mfranc@suse.cz
changelog:
  - s390/kasan: fix early pgm check handler execution (git-fixes
    bsc#1211360).
  - s390: ctcm: fix ctcm_new_device error return code (git-fixes
    bsc#1211361).
  - s390/pci: fix sleeping in atomic during hotplug (git-fixes
    bsc#1211364).
  - s390/sysinfo: add missing #ifdef CONFIG_PROC_FS (git-fixes
    bsc#1211366).
  - s390/extmem: fix gcc 8 stringop-overflow warning (git-fixes
    bsc#1211363).
  - s390/scm_blk: correct numa_node in scm_blk_dev_setup (git-fixes
    bsc#1211365).
  - s390/dasd: correct numa_node in dasd_alloc_queue (git-fixes
    bsc#1211362).
  - commit eaf6fde


author: dkirjanov@suse.com
changelog:
  - net: mediatek: setup proper state for disabled GMAC on the
    default (git-fixes).
  - commit d4884c0


author: dkirjanov@suse.com
changelog:
  - net: ethernet: ti: cpsw-phy-sel: check bus_find_device()
    ret value (git-fixes).
  - commit faf163d


author: dkirjanov@suse.com
changelog:
  - net: davinci_emac: match the mdio device against its compatible if possible (git-fixes).
  - commit bd607b2


author: jlee@suse.com
changelog:
  - i2c: xgene-slimpro: Fix out-of-bounds bug in
    xgene_slimpro_i2c_xfer() (bsc#1210715 CVE-2023-2194).
  - commit 3e58c3b


author: denis.kirjanov@suse.com
changelog:
  - net: sched: sch_qfq: prevent slab-out-of-bounds in
    qfq_activate_agg (bsc#1210940 CVE-2023-31436).
  - commit a507e94


author: tiwai@suse.de
changelog:
  - media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
    (CVE-2022-45887 bsc#1205762).
  - media: dvb-core: Fix use-after-free due to race condition at
    dvb_ca_en50221 (CVE-2022-45919 bsc#1205803).
  - media: dvb-core: Fix use-after-free due to race at
    dvb_register_device() (CVE-2022-45884 bsc#1205756).
  - media: dvb-core: Fix use-after-free due on race condition at
    dvb_net (CVE-2022-45886 bsc#1205760).
  - media: dvb-core: Fix kernel WARNING for blocking operation in
    wait_event*() (CVE-2023-31084 bsc#1210783).
  - media: dvb-core: Fix use-after-free on race condition at
    dvb_frontend (CVE-2022-45885 bsc#1205758).
  - media: dvbdev: fix error logic at dvb_register_device()
    (CVE-2022-45884 bsc#1205756).
  - media: dvbdev: Fix memleak in dvb_register_device
    (CVE-2022-45884 bsc#1205756).
  - media: media/dvb: Use kmemdup rather than duplicating its
    implementation (CVE-2022-45884 bsc#1205756).
  - commit f7cc9c8


author: tiwai@suse.de
changelog:
  - media: dvb_net: kABI workaround (CVE-2022-45886 bsc#1205760).
  - media: dvb_frontend: kABI workaround (CVE-2022-45885
    bsc#1205758).
  - commit df5f28a


author: jgross@suse.com
changelog:
  - KVM: x86: Update the exit_qualification access bits while
    walking an address (git-fixes).
  - commit fb42639


author: jgross@suse.com
changelog:
  - KVM: nSVM: clear events pending from svm_complete_interrupts()
    when exiting to L1 (git-fixes).
  - commit dea3e13


author: petr.pavlu@suse.com
changelog:
  - ring-buffer: Ensure proper resetting of atomic variables in
    ring_buffer_reset_online_cpus (git-fixes).
  - commit 05b01b4


author: jgross@suse.com
changelog:
  - KVM: x86: avoid misreporting level-triggered irqs as
    edge-triggered in tracing (git-fixes).
  - commit 3a2f7bf


author: oneukum@suse.com
changelog:
  - HID: asus: use spinlock to protect concurrent accesses
    (bsc#1208604 CVE-2023-1079).
  - commit d755874


author: oneukum@suse.com
changelog:
  - HID: asus: use spinlock to safely schedule workers (bsc#1208604
    CVE-2023-1079).
  - commit 95bf045


author: ematsumiya@suse.de
changelog:
  - cifs: Fix uninitialized memory read for smb311 posix symlink
    create (bsc#1190317).
  - Refresh
    patches.suse/cifs-Fix-uninitialized-memory-reads-for-oparms-mode.patch.
  - commit 853e32c


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'video: fbdev: kyro: fix a DoS bug by restricting user input'
  - commit 4dfa6f9


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'video: fbdev: asiliantfb: Error out if 'pixclock' equals zero'
  - commit 4eef362


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'video: fbdev: nvidiafb: Use strscpy() to prevent buffer overflow'
  - commit e521feb


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'video: fbdev: cirrusfb: check pixclock to avoid divide by zero'
  - commit 9b4a739


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'video: fbdev: omapfb: acx565akm: replace snprintf with sysfs_emit'
  - commit 9966c33


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'video: fbdev: omapfb: panel-dsi-cm: Use sysfs_emit() instead of snprintf()'
  - commit 5a2e2fe


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'video: fbdev: omapfb: panel-tpo-td043mtea1: Use sysfs_emit() instead of snprintf()'
  - commit ac6af46


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove()'
  - commit 9dffdbd


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write'
  - commit ccb235b


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'video: fbdev: i740fb: Check the argument of i740_calc_vclk()'
  - commit c7b03dd


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init()'
  - commit 489652a


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'fbdev: vermilion: decrease reference count in error path'
  - commit bfe058e


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'fbdev: stifb: Provide valid pixelclock and add fb_check_var() checks'
  - commit 7424f1a


author: tzimmermann@suse.com
changelog:
  - fbcon: Check font dimension limits (bsc#1154048)
    Changes:
    * rename drivers/video/fbdev/core to drivers/video/console
  - commit 2e6300a


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'Revert "fbcon: don't lose the console font across generic->chip driver switch"'
  - commit 0b0664b


author: ematsumiya@suse.de
changelog:
  - CIFS: Spelling s/EACCESS/EACCES/ (bsc#1190317).
  - Refresh
    patches.suse/cifs-remove-various-function-description-warnings.patch.
  - commit 154e2e3


author: msuchanek@suse.de
changelog:
  - Remove usrmerge compatibility symlink in buildroot (boo#1211796)
    Besides Makefile depmod.sh needs to be patched to prefix /lib/modules.
    Requires corresponding patch to kmod.
  - commit b8e00c5


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add 659c0ce1cb9e kernel/sys.c: fix and improve control flow in __sys_setres[ug]id()
  - commit 28b437a


author: colyli@suse.de
changelog:
  - dm ioctl: fix nested locking in table_clear() to remove deadlock
    concern (bsc#1210806, CVE-2023-2269).
  - commit e962c83


author: jlee@suse.com
changelog:
  - Update References
    patches.suse/x86-speculation-restore-speculation-related-msrs-during-s3-resume.patch
    (bsc#1198400 bsc#1209779 CVE-2023-1637).
  - commit 8e47860


author: oneukum@suse.com
changelog:
  - mac80211: drop multicast fragments (git-fixes).
  - Refresh patches.kabi/cfg80211-kabi-workaround.patch.
  - Refresh
    patches.suse/mac80211-add-fragment-cache-to-sta_info.patch.
  - commit dcf3ad7


author: mfranc@suse.cz
changelog:
  - s390/uaccess: add missing earlyclobber annotations to __clear_user()
    (LTC#202116 bsc#1209857 git-fixes).
  - commit 466ebf1


author: dkirjanov@suse.com
changelog:
  - fix kcm_clone() (git-fixes).
  - Refresh
    patches.suse/kcm-Fix-use-after-free-caused-by-clonned-sockets.patch.
  - commit ff3266d


author: dkirjanov@suse.com
changelog:
  - sctp: fix the issue that a __u16 variable may overflow in
    sctp_ulpq_renege (git-fixes).
  - Refresh
    patches.suse/sctp-implement-memory-accounting-on-rx-path.patch.
  - commit dfdadd9


author: dkirjanov@suse.com
changelog:
  - xfrm: Fix stack-out-of-bounds with misconfigured transport
    mode policies (git-fixes).
  - commit a397dd8


author: dkirjanov@suse.com
changelog:
  - ip6_tunnel: allow ip6gre dev mtu to be set below 1280
    (git-fixes).
  - Refresh
    patches.suse/ip6_tunnel-remove-magic-mtu-value-0xFFF8.patch.
  - commit 9359f96


author: dkirjanov@suse.com
changelog:
  - kcm: Check if sk_user_data already set in kcm_attach
    (git-fixes).
  - Refresh patches.suse/kcm-lock-lower-socket-in-kcm_attach.patch.
  - commit 796ddfc


author: dwagner@suse.de
changelog:
  - scsi: qla2xxx: Replace all non-returning strlcpy() with
    strscpy() (bsc#1211960).
  - scsi: qla2xxx: Update version to 10.02.08.300-k (bsc#1211960).
  - scsi: qla2xxx: Wait for io return on terminate rport
    (bsc#1211960).
  - scsi: qla2xxx: Fix mem access after free (bsc#1211960).
  - scsi: qla2xxx: Fix hang in task management (bsc#1211960).
  - scsi: qla2xxx: Fix task management cmd fail due to unavailable
    resource (bsc#1211960).
  - scsi: qla2xxx: Fix task management cmd failure (bsc#1211960).
  - scsi: qla2xxx: Multi-que support for TMF (bsc#1211960).
  - scsi: qla2xxx: Replace all non-returning strlcpy() with
    strscpy() (bsc#1211960).
  - scsi: qla2xxx: Update version to 10.02.08.300-k (bsc#1211960).
  - scsi: qla2xxx: Wait for io return on terminate rport
    (bsc#1211960).
  - scsi: qla2xxx: Fix mem access after free (bsc#1211960).
  - scsi: qla2xxx: Fix hang in task management (bsc#1211960).
  - scsi: qla2xxx: Fix task management cmd fail due to unavailable
    resource (bsc#1211960).
  - scsi: qla2xxx: Fix task management cmd failure (bsc#1211960).
  - scsi: qla2xxx: Multi-que support for TMF (bsc#1211960).
  - scsi: qla2xxx: Declare SCSI host template const (bsc#1211960).
  - scsi: qla2xxx: Refer directly to the qla2xxx_driver_template
    (bsc#1211960).
  - scsi: qla2xxx: Remove default fabric ops callouts (bsc#1211960).
  - scsi: qla2xxx: Drop redundant pci_enable_pcie_error_reporting()
    (bsc#1211960).
  - commit 875f923


author: ohering@suse.de
changelog:
  - Drivers: hv: vmbus: Optimize vmbus_on_event (bsc#1211622).
  - scsi: storvsc: Parameterize number hardware queues
    (bsc#1211622).
  - commit f58838c


author: dwagner@suse.de
changelog:
  - nvme-pci: fix a NULL pointer dereference in
    nvme_alloc_admin_tags (git-fixes).
  - nvme-pci: avoid the deepest sleep state on Kingston A2000 SSDs
    (git-fixes).
  - nvme: free sq/cq dbbuf pointers when dbbuf set fails
    (git-fixes).
  - nvme: refine the Qemu Identify CNS quirk (git-fixes).
  - nvme: Fix u32 overflow in the number of namespace list
    calculation (git-fixes).
  - nvme: remove the ifdef around nvme_nvm_ioctl (git-fixes).
  - nvme-pci: unquiesce admin queue on shutdown (git-fixes).
  - nvme-pci: use the same attributes when freeing
    host_mem_desc_bufs (git-fixes).
  - commit f8a43a3


author: dwagner@suse.de
changelog:
  - blacklist: add nvme fabrics git-fixes
    The whole nvme fabrics part is missing fundamental changes which will
    not be backported. Don't bother to port git-fixes for this part.
  - commit f524f37


author: dkirjanov@suse.com
changelog:
  - l2tp: remove configurable payload offset (git-fixes).
  - Refresh
    patches.suse/l2tp-reject-creation-of-non-PPP-sessions-on-L2TPv2-t.patch.
  - commit e4e115d


author: dkirjanov@suse.com
changelog:
  - l2tp: remove l2specific_len dependency in l2tp_core (git-fixes).
  - Refresh
    patches.suse/l2tp-fix-reading-optional-fields-of-L2TPv3.patch.
  - commit 80db1e0


author: dkirjanov@suse.com
changelog:
  - netfilter: ipt_CLUSTERIP: put config struct if we can't
    increment ct refcount (git-fixes).
  - commit e675512


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add 4ef0c5c6b5ba kernel/sched: Fix sched_fork() access an invalid sched_task_group
  - commit 5d65c2b


author: dkirjanov@suse.com
changelog:
  - sfc: suppress duplicate nvmem partition types in
    efx_ef10_mtd_probe (git-fixes).
  - commit 17c6719


author: dkirjanov@suse.com
changelog:
  - net: altera_tse: fix msgdma_tx_completion on non-zero fill_level
    case (git-fixes).
  - commit 82bd47b


author: tbogendoerfer@suse.de
changelog:
  - gve: Remove the code of clearing PBA bit (bsc#1211519).
  - gve: Secure enough bytes in the first TX desc for all TCP pkts
    (bsc#1211519).
  - gve: Cache link_speed value from device (bsc#1211519).
  - gve: Handle alternate miss completions (bsc#1211519).
  - gve: Adding a new AdminQ command to verify driver (bsc#1211519).
  - gve: Fix error return code in gve_prefill_rx_pages()
    (bsc#1211519).
  - gve: Reduce alloc and copy costs in the GQ rx path
    (bsc#1211519).
  - gve: Fix GFP flags when allocing pages (bsc#1211519).
  - google/gve:fix repeated words in comments (bsc#1211519).
  - gve: Fix spelling mistake "droping" -> "dropping" (bsc#1211519).
  - gve: enhance no queue page list detection (bsc#1211519).
  - commit cda49a1


author: msuchanek@suse.de
changelog:
  - kernel-binary: Add back kernel-default-base guarded by option
    Add configsh option for splitting off kernel-default-base, and for
    not signing the kernel on non-efi
  - commit 8ad6a28


author: msuchanek@suse.de
changelog:
  - Trim obsolete KMP list.
    SLE11 is out of support, we do not need to handle upgrading from SLE11
    SP1.
  - commit 08819bb


author: msuchanek@suse.de
changelog:
  - Move obsolete KMP list into a separate file.
    The list of obsoleted KMPs varies per release, move it out of the spec
    file.
  - commit 016bc55


author: oneukum@suse.com
changelog:
  - xhci: Add grace period after xHC start to prevent premature
    runtime suspend (git-fixes).
  - commit 7c3b440


author: msuchanek@suse.de
changelog:
  - Move the kernel-binary conflicts out of the spec file.
    Thie list of conflicting packages varies per release.
    To reduce merge conflicts move the list out of the spec file.
  - commit 4d81125


author: dkirjanov@suse.com
changelog:
  - net: cxgb3_main: Fix a resource leak in a error path in
    'init_one()' (git-fixes).
  - commit e158810


author: jslaby@suse.cz
changelog:
  - PCI: aardvark: Replace custom macros by standard
    linux/pci_regs.h macros (git-fixes).
  - Refresh
    patches.suse/PCI-aardvark-Fix-PCIe-Max-Payload-Size-setting.patch.
  - blacklist.conf: remove it from there
    While it's a cleanup, it's a prerequisite for the following patches.
  - commit 4ef2916


author: jslaby@suse.cz
changelog:
  - PCI: pciehp: Clear cmd_busy bit in polling mode (git-fixes).
  - PCI: aardvark: Clear all MSIs at setup (git-fixes).
  - PCI: pciehp: Fix infinite loop in IRQ handler upon power fault
    (git-fixes).
  - PCI/MSI: Fix pci_irq_vector()/pci_irq_get_affinity()
    (git-fixes).
  - PCI/MSI: Clear PCI_MSIX_FLAGS_MASKALL on error (git-fixes).
  - PCI/MSI: Mask MSI-X vectors only on success (git-fixes).
  - PCI/MSI: Destroy sysfs before freeing entries (git-fixes).
  - PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
    (git-fixes).
  - PCI: aardvark: Fix return value of MSI domain .alloc() method
    (git-fixes).
  - PCI: aardvark: Do not unmask unused interrupts (git-fixes).
  - PCI: aardvark: Do not clear status bits of masked interrupts
    (git-fixes).
  - commit fd8f739


author: mhocko@suse.com
changelog:
  - Refresh
    patches.suse/0001-mm-mempolicy-make-mbind-return-EIO-when-MPOL_MF_STRI.patch.
    Fix the MPOL_MF_STRICT condition (noticed by Jiri Slaby)
  - commit b6b86f2


author: jslaby@suse.cz
changelog:
  - Refresh
    patches.suse/0001-memcg-kmem-further-deprecate-kmem.limit_in_bytes.patch.
    Drop memcg_update_kmem_limit() as it is unused now and the compiler
    complains:
    mm/memcontrol.c:2972:12: error: ?memcg_update_kmem_limit? defined but not used
    This is done in the upstream patch too.
  - commit 660e644


author: jslaby@suse.cz
changelog:
  - Refresh
    patches.suse/btrfs-remove-nr_async_submits-and-async_submit_draining.patch.
    Fix compiler warning:
    fs/btrfs/disk-io.c:815:6: error: unused variable ?limit?
    The upstream patch removes 'limit' too, so follow that up.
  - commit 45d33ba


author: jslaby@suse.cz
changelog:
  - wcn36xx: Fix max channels retrieval (gcc-warning-fixes).
    Fixes:
    drivers/net/wireless/ath/wcn36xx/smd.c: In function ?wcn36xx_smd_update_channel_list?:
    ./include/linux/kernel.h:785:12: error: large integer implicitly truncated to unsigned type
  - commit 6bbb096


author: jslaby@suse.cz
changelog:
  - Refresh
    patches.suse/ipmi-fix-initialization-when-workqueue-allocation-fa.patch.
    Delete also the out: label. Upstream still has users for that label.
    Unlike we.
    Fixes:
    drivers/char/ipmi/ipmi_msghandler.c:5366:1: error: label ?out? defined but not used
  - commit 05b72bb


author: mhocko@suse.com
changelog:
  - Refresh
    patches.suse/0001-mm-mempolicy-make-mbind-return-EIO-when-MPOL_MF_STRI.patch.
    fix the second instance of incorrect MPOL_MF_STRICT check.
  - commit 47debde


author: mfranc@suse.cz
changelog:
  - s390/dasd: fix hanging blockdevice after request requeue
    (git-fixes bsc#1212165).
  - commit 2203987


author: tiwai@suse.de
changelog:
  - firewire: fix potential uaf in outbound_phy_packet_callback()
    (CVE-2023-3159 bsc#1212128).
  - commit f62d406


author: tiwai@suse.de
changelog:
  - memstick: r592: Fix UAF bug in r592_remove due to race condition
    (CVE-2023-3141 bsc#1212129 bsc#1211449).
  - commit 77b88e9


author: ailiop@suse.com
changelog:
  - reiserfs: prevent NULL pointer dereference in
    reiserfs_insert_item() (git-fixes).
  - commit 922f823


author: ailiop@suse.com
changelog:
  - reiserfs: Add security prefix to xattr name in
    reiserfs_security_write() (git-fixes).
  - commit 381baa2


author: mfranc@suse.cz
changelog:
  - s390/kprobes: fix current_kprobe never cleared after kprobes
    reenter (git-fixes bsc#1212167).
  - commit 94cf46f


author: ailiop@suse.com
changelog:
  - hfsplus: fix bug causing custom uid and gid being unable to
    be assigned with mount (git-fixes).
  - commit 3226ad8


author: mfranc@suse.cz
changelog:
  - s390/kprobes: fix irq mask clobbering on kprobe reenter from
    post_handler (git-fixes bsc#1212170).
  - commit 21760dd


author: dkirjanov@suse.com
changelog:
  - xfrm: Refuse to insert 32 bit userspace socket policies on 64
    bit systems (git-fixes).
  - commit 413544a


author: mfranc@suse.cz
changelog:
  - scsi: zfcp: assert that the ERP lock is held when tracing a
    recovery trigger (git-fixes bsc#1212240).
  - commit eb171ad


author: lduncan@suse.com
changelog:
  - scsi: lpfc: Fix ioremap issues in lpfc_sli4_pci_mem_setup()
    (git-fixes).
  - scsi: megaraid: Fix mega_cmd_done() CMDID_INT_CMDS (git-fixes).
  - scsi: core: Improve scsi_vpd_inquiry() checks (git-fixes).
  - scsi: megaraid_sas: Fix crash after a double completion
    (git-fixes).
  - scsi: megaraid_sas: Fix fw_crash_buffer_show() (git-fixes).
  - scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate()
    (git-fixes).
  - scsi: core: Add BLIST_SKIP_VPD_PAGES for SKhynix H28U74301AMR
    (git-fixes).
  - scsi: mpt3sas: Fix NULL pointer access in
    mpt3sas_transport_port_add() (git-fixes).
  - scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
    (git-fixes).
  - scsi: ipr: Work around fortify-string warning (git-fixes).
  - scsi: ses: Don't attach if enclosure has no components
    (git-fixes).
  - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove()
    (git-fixes).
  - scsi: ses: Fix possible desc_ptr out-of-bounds accesses
    (git-fixes).
  - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses
    (git-fixes).
  - scsi: ses: Fix slab-out-of-bounds in
    ses_enclosure_data_process() (git-fixes).
  - scsi: aic94xx: Add missing check for dma_map_single()
    (git-fixes).
  - scsi: mpt3sas: Fix a memory leak (git-fixes).
  - scsi: libsas: Remove useless dev_list delete in
    sas_ex_discover_end_dev() (git-fixes).
  - commit 9bcdcf3


author: petr.pavlu@suse.com
changelog:
  - kprobes: Use synchronize_rcu_tasks() for optprobe with
    CONFIG_PREEMPT=y (git-fixes).
  - commit 32c4978


author: petr.pavlu@suse.com
changelog:
  - kprobes: Don't call BUG_ON() if there is a kprobe in use on
    free list (git-fixes).
  - commit e0562e5


author: petr.pavlu@suse.com
changelog:
  - kprobes: Remove pointless BUG_ON() from reuse_unused_kprobe()
    (git-fixes).
  - Refresh
    patches.suse/kprobes-Return-error-if-we-fail-to-reuse-kprobe-inst.patch.
  - commit 1fb5f11


author: oneukum@suse.com
changelog:
  - usb: xhci: add XHCI_SPURIOUS_SUCCESS to ASM1042 despite being
    a V0.96 controller.
  - commit b40a0f8


author: petr.pavlu@suse.com
changelog:
  - samples/kretprobes: Fix return value if register_kretprobe()
    failed (git-fixes).
  - commit 5b1b600


author: msuchanek@suse.de
changelog:
  - kernel-docs: Add buildrequires on python3-base when using python3
    The python3 binary is provided by python3-base.
  - commit c5df526


author: tiwai@suse.de
changelog:
  - Drop a buggy dvb-core fix patch (bsc#1205758)
    Also the kabi workaround is dropped, too
  - commit 34f0c8e


author: ailiop@suse.com
changelog:
  - hfs/hfsplus: avoid WARN_ON() for sanity check, use proper
    error handling (git-fixes).
  - commit e8ee0dd


author: ailiop@suse.com
changelog:
  - revert "squashfs: harden sanity check in
    squashfs_read_xattr_id_table" (git-fixes).
  - commit fc7c6f6


author: ailiop@suse.com
changelog:
  - uapi linux/coda_psdev.h: move upc_req definition from uapi to
    kernel side headers (git-fixes).
  - commit 074a075


author: petr.pavlu@suse.com
changelog:
  - kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation
    logic (git-fixes).
  - commit 36f829b


author: tbogendoerfer@suse.de
changelog:
  - e1000e: Disable TSO on i219-LM card to increase speed
    (git-fixes).
  - e1000e: Fix TX dispatch condition (git-fixes).
  - net/mlx4: Check retval of mlx4_bitmap_init (git-fixes).
  - net/mlx4_en: Fix wrong return value on ioctl EEPROM query
    failure (git-fixes).
  - e1000e: Fix possible overflow in LTR decoding (git-fixes).
  - e1000e: Correct NVM checksum verification flow (git-fixes).
  - net/mlx4_en: Fix an use-after-free bug in
    mlx4_en_try_alloc_resources() (git-fixes).
  - net/mlx4_en: Don't allow aRFS for encapsulated packets
    (git-fixes).
  - net/mlx4_en: Resolve bad operstate value (git-fixes).
  - mlx5: count all link events (git-fixes).
  - commit 084d4cc


author: petr.pavlu@suse.com
changelog:
  - x86/kprobes: Fix arch_check_optimized_kprobe check within
    optimized_kprobe range (git-fixes).
  - commit 261c02b


author: jlee@suse.com
changelog:
  - media: dm1105: Fix use after free bug in dm1105_remove due to
    race condition (bsc#1212501 CVE-2023-35824).
  - commit a511fea


author: jlee@suse.com
changelog:
  - bluetooth: Perform careful capability checks in hci_sock_ioctl()
    (bsc#1210533 CVE-2023-2002).
  - commit cb9bcb2


author: jlee@suse.com
changelog:
  - relayfs: fix out-of-bounds access in relay_file_read
    (bsc#1212502 CVE-2023-3268).
  - kernel/relay.c: fix read_pos error when multiple readers
    (bsc#1212502 CVE-2023-3268).
  - commit f9dadc6


author: mhocko@suse.com
changelog:
  - binfmt_elf: Take the mmap lock when walking the VMA list
    (bsc#1209039 CVE-2023-1249).
  - commit 6550df3


author: mfranc@suse.cz
changelog:
  - s390/dasd: Use correct lock while counting channel queue length
    (LTC#202775 bsc#1212443).
  - commit c2ba548


author: oneukum@suse.com
changelog:
  - USB: hub: Fix the broken detection of USB3 device in SMSC hub
    (git-fixes).
  - blacklist.conf: patch itself is useless, but needed as infrastructure
  - commit f4a7f78


author: dkirjanov@suse.com
changelog:
  - ipv4: fix uninit-value in ip_route_output_key_hash_rcu()
    (git-fixes).
  - Refresh
    patches.suse/ipv4-Return-ENETUNREACH-if-we-can-t-create-route-but.patch.
  - commit ea68726


author: dkirjanov@suse.com
changelog:
  - l2tp: hold reference on tunnels printed in l2tp/tunnels debugfs
    file (git-fixes).
  - commit b182fac


author: dkirjanov@suse.com
changelog:
  - net: thunderx: make CFG_DONE message to run through generic
    send-ack sequence (git-fixes).
  - commit dbc5a3f


author: msuchanek@suse.de
changelog:
  - blacklist.conf: Add 3f5f766d5f7f powerpc64/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06
  - commit 1a3b374


author: msuchanek@suse.de
changelog:
  - powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall
    (bsc#1212701).
  - commit 207c27c


author: tbogendoerfer@suse.de
changelog:
  - igb: fix nvm.ops.read() error handling (git-fixes).
  - bnxt_en: Query default VLAN before VNIC setup on a VF
    (git-fixes).
  - igb: fix bit_shift to be in [1..8] range (git-fixes).
  - ixgbe: Enable setting RSS table to default values (git-fixes).
  - ixgbe: Allow flow hash to be set via ethtool (git-fixes).
  - bnxt_en: Fix typo in PCI id to device description string mapping
    (git-fixes).
  - igbvf: Regard vf reset nack as success (git-fixes).
  - intel/igbvf: free irq on the error path in igbvf_request_msix()
    (git-fixes).
  - igb: Enable SR-IOV after reinit (git-fixes).
  - bnxt_en: Fix mqprio and XDP ring checking logic (git-fixes).
  - ixgbe: fix pci device refcount leak (git-fixes).
  - igb: Initialize mailbox message for VF reset (git-fixes).
  - igb: Allocate MSI-X vector when testing (git-fixes).
  - bnxt_en: Remove debugfs when pci_register_driver failed
    (git-fixes).
  - bnxt_en: fix potentially incorrect return value for
    ndo_rx_flow_steer (git-fixes).
  - ixgbe: stop resetting SYSTIME in ixgbe_ptp_start_cyclecounter
    (git-fixes).
  - bnxt_en: fix NQ resource accounting during vf creation on
    57500 chips (git-fixes).
  - igb: Add lock to avoid data race (git-fixes).
  - ixgbe: Add locking to prevent panic when setting sriov_numvfs
    to zero (git-fixes).
  - bnxt_en: reclaim max resources if sriov enable fails
    (git-fixes).
  - igb: Make DMA faster when CPU is active on the PCIe link
    (git-fixes).
  - ixgbe: fix unexpected VLAN Rx in promisc mode on VF (git-fixes).
  - ixgbe: fix bcast packets Rx on VF after promisc removal
    (git-fixes).
  - igb: skip phy status check where unavailable (git-fixes).
  - dim: initialize all struct fields (bsc#1174852).
  - ixgbe: ensure IPsec VF<->PF compatibility (git-fixes).
  - igc: Fix BUG: scheduling while atomic (git-fixes).
  - igc: Fix infinite loop in release_swfw_sync (git-fixes).
  - ixgbe: don't reserve excessive XDP_PACKET_HEADROOM on XSK Rx
    to skb (git-fixes).
  - igc: igc_write_phy_reg_gpy: drop premature return (git-fixes).
  - igc: igc_read_phy_reg_gpy: drop premature return (git-fixes).
  - ixgbe: set X550 MDIO speed before talking to PHY (git-fixes).
  - igbvf: fix double free in `igbvf_probe` (git-fixes).
  - igb: fix netpoll exit with traffic (git-fixes).
  - commit 34bf378


author: vkarasulli@suse.de
changelog:
  - HID: intel_ish-hid: Add check for ishtp_dma_tx_map (git-fixes
    bsc#1212606 CVE-2023-3358).
  - commit 448bfe3


author: petr.pavlu@suse.com
changelog:
  - kprobes: Fix to handle forcibly unoptimized kprobes on
    freeing_list (git-fixes).
  - commit 35c8c33


author: fdmanana@suse.com
changelog:
  - btrfs: unset reloc control if transaction commit fails in
    prepare_to_relocate() (bsc#1212051 CVE-2023-3111).
  - commit 6726801


author: vkarasulli@suse.de
changelog:
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (bsc#1212842
    CVE-2023-3090).
  - commit bd94484


author: msuchanek@suse.de
changelog:
  - usrmerge: Adjust module path in the kernel sources (bsc#1212835).
    With the module path adjustment applied as source patch only
    ALP/Tumbleweed kernel built on SLE/Leap needs the path changed back to
    non-usrmerged.
  - commit dd9a820


author: ailiop@suse.com
changelog:
  - ocfs2: take inode cluster lock before moving reflinked inode
    from orphan dir (git-fixes).
  - commit 7e1768a


author: ailiop@suse.com
changelog:
  - fs/ocfs2/dlm/dlmdebug.c: fix a sleep-in-atomic-context bug in
    dlm_print_one_mle() (git-fixes).
  - commit 01c2b72


author: ailiop@suse.com
changelog:
  - ocfs2: call journal flush to mark journal as empty after
    journal recovery when mount (git-fixes).
  - commit d5a28a3


author: ailiop@suse.com
changelog:
  - ocfs2: fix a NULL pointer dereference when call
    ocfs2_update_inode_fsync_trans() (git-fixes).
  - commit f3e26c1


author: ailiop@suse.com
changelog:
  - fs: ocfs2: fix a possible null-pointer dereference in
    ocfs2_info_scan_inode_alloc() (git-fixes).
  - commit 4a538d4


author: ailiop@suse.com
changelog:
  - fs: ocfs2: fix a possible null-pointer dereference in
    ocfs2_write_end_nolock() (git-fixes).
  - commit ea30d59


author: mkubecek@suse.cz
changelog:
  - rpm/check-for-config-changes: ignore also PAHOLE_HAS_*
    We now also have options like CONFIG_PAHOLE_HAS_LANG_EXCLUDE.
  - commit 86b52c1


author: wqu@suse.com
changelog:
  - patches.suse/btrfs-unset-reloc-control-if-transaction-commit-fail.patch:
    (bsc#1212051).
  - commit f5c0b6d


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add 6f363f5aa845 cgroup: Do not corrupt task iteration when rebinding subsystem
  - commit e6c7d2e


author: jack@suse.cz
changelog:
  - fs: prevent BUG_ON in submit_bh_wbc() (bsc#1212990).
    Refresh patches.suse/ext4-fix-error-code-in-ext4_commit_super.patch
  - commit daeb235


author: jack@suse.cz
changelog:
  - jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when
    journal aborted (bsc#1202716).
  - commit e85fc79


author: jack@suse.cz
changelog:
  - ext4: add inode table check in __ext4_get_inode_loc to aovid
    possible infinite loop (bsc#1207617).
  - commit 859359e


author: jack@suse.cz
changelog:
  - ext4: fix bug_on in __es_tree_search caused by bad boot loader
    inode (bsc#1207620).
  - commit cccc3e5


author: ailiop@suse.com
changelog:
  - dlm: Delete an unnecessary variable initialisation in
    dlm_ls_start() (git-fixes).
  - commit 8663a16


author: tbogendoerfer@suse.de
changelog:
  - igb: revert rtnl_lock() that causes deadlock (git-fixes).
  - Refresh patches.suse/igb-Enable-SR-IOV-after-reinit.patch.
  - commit e174406


author: jack@suse.cz
changelog:
  - ext4: initialize quota before expanding inode in setproject
    ioctl (bsc#1207633).
  - commit b8cc1a5


author: jack@suse.cz
changelog:
  - ext4: fix i_disksize exceeding i_size problem in paritally
    written case (bsc#1213015).
  - commit 7b579a0


author: jack@suse.cz
changelog:
  - ext4: only update i_reserved_data_blocks on successful block
    allocation (bsc#1213019).
  - commit 9a3a64e


author: jack@suse.cz
changelog:
  - ext4: fix to check return value of freeze_bdev() in
    ext4_shutdown() (bsc#1213021).
  - commit e4bb61c


author: jack@suse.cz
changelog:
  - blkcg, writeback: dead memcgs shouldn't contribute to writeback
    ownership arbitration (bsc#1213022).
  - commit deeb8e8


author: jack@suse.cz
changelog:
  - memcg: fix a crash in wb_workfn when a device disappears
    (bsc#1213023).
    Refresh patches.suse/writeback-Fix-sync-livelock-due-to-b_dirty_time-proc.patch
  - commit ab66f3a


author: jack@suse.cz
changelog:
  - udf: Do not bother looking for prealloc extents if i_lenExtents
    matches i_size (bsc#1213035).
  - commit 4ee0c8f


author: jack@suse.cz
changelog:
  - udf: Do not update file length for failed writes to inline files
    (bsc#1213041).
  - commit 18b4c06


author: jack@suse.cz
changelog:
  - include/trace/events/writeback.h: fix -Wstringop-truncation
    warnings (bsc#1213023).
  - blacklist.conf: Remove commit d1a445d3b8 from blacklist
  - patches.suse/writeback-Fix-sync-livelock-due-to-b_dirty_time-proc.patch:
    Refresh
  - commit 4c9bb20


author: mhocko@suse.com
changelog:
  - ubi: Fix failure attaching when vid_hdr offset equals to
    (sub)page size (bsc#1210584).
  - ubi: ensure that VID header offset + VID header size <= alloc,
    size (bsc#1210584).
  - commit 4331e8e


author: msuchanek@suse.de
changelog:
  - powerpc/mm/dax: Fix the condition when checking if altmap
    vmemap can cross-boundary (bsc#1150305 ltc#176097 git-fixes).
  - commit 49e2ec1


author: schwab@suse.de
changelog:
  - rpm/check-for-config-changes: ignore also RISCV_ISA_* and DYNAMIC_SIGFRAME
    They depend on CONFIG_TOOLCHAIN_HAS_*.
  - commit 1007103


author: fdmanana@suse.com
changelog:
  - btrfs: fix resolving backrefs for inline extent followed by
    prealloc (bsc#1213133).
  - commit 9143ce4


author: mfranc@suse.cz
changelog:
  - vfio-ccw: Do not call flush_workqueue while holding the spinlock
    (git-fixes bsc#1213218).
  - commit 99ea851


author: mfranc@suse.cz
changelog:
  - s390/perf: Change CPUM_CF return code in event init function
    (git-fixes bsc#1213344).
  - commit 8991783


author: nik.borisov@suse.com
changelog:
  - x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS  parts (git-fixes).
  - commit ba92ee5


author: nik.borisov@suse.com
changelog:
  - x86/bugs: Enable STIBP for JMP2RET (git-fixes).
  - Refresh patches.suse/x86-bugs-enable-stibp-for-ibpb-mitigated-retbleed.patch.
  - commit c8acef1


author: oneukum@suse.com
changelog:
  - usb: core: hub: Disable autosuspend for Cypress CY7C65632
    (git-fixes).
  - Refresh
    patches.suse/usb-core-hub-disable-autosuspend-for-TI-TUSB8041.patch.
  - commit 3ec99e4


author: oneukum@suse.com
changelog:
  - usb: hub: Add delay for SuperSpeed hub resume to let links
    transit to U0 (git-fixes).
  - commit ec30965


author: nik.borisov@suse.com
changelog:
  - Update patches.suse/08-x86-bugs-provide-boot-parameters-for-the-spec_store_bypass_disable-mitigation.patch
    (bsc#1087082 CVE-2018-3639 bsc#1207561).
  - commit 35a0609


author: nik.borisov@suse.com
changelog:
  - Update patches.suse/08-x86-bugs-provide-boot-parameters-for-the-spec_store_bypass_disable-mitigation.patch
    (bsc#1087082 CVE-2018-3639 bsc#1207561).
  - commit cdd6858


author: ematsumiya@suse.de
changelog:
  - Refresh
    patches.suse/cifs-split-out-ses-and-tcon-retrieval-from-mount_get_conns-.patch.
  - Refresh
    patches.suse/cifs-support-nested-dfs-links-over-reconnect.patch.
    Fix backport of
    patches.suse/cifs-support-nested-dfs-links-over-reconnect.patch
    (bsc#1212871)
  - commit 3f2dafd


author: petr.pavlu@suse.com
changelog:
  - Refresh
    patches.suse/keys-Fix-linking-a-duplicate-key-to-a-keyring-s-asso.patch.
  - commit ed0f049


author: msuchanek@suse.de
changelog:
  - powerpc/security: Fix Speculation_Store_Bypass reporting on
    Power10 (bsc#1188885 ltc#193722 git-fixes).
  - powerpc/64: Update Speculation_Store_Bypass in
    /proc/<pid>/status (bsc#1188885 ltc#193722 git-fixes).
  - commit c14b3fc


author: nik.borisov@suse.com
changelog:
  - x86/cpu/amd: Move the errata checking functionality up (bsc#1213286, CVE-2023-20593).
  - commit 06feaef


author: mkoutny@suse.com
changelog:
  - uaccess: Add speculation barrier to copy_from_user()
    (bsc#1211738 CVE-2023-0459).
  - commit 8370997


author: mkubecek@suse.cz
changelog:
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
    (CVE-2023-35001 bsc#1213059).
  - commit 846f417


author: nik.borisov@suse.com
changelog:
  - x86/speculation: Add Gather Data Sampling mitigation (bsc#1206418, CVE-2022-40982).
  - commit 89ac44a


author: neilb@suse.de
changelog:
  - svcrdma: Prevent page release when nothing was received
    (git-fixes).
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (git-fixes).
  - nfsd: fix double fget() bug in __write_ports_addfd()
    (git-fixes).
  - SUNRPC: remove the maximum number of retries in call_bind_status
    (git-fixes).
  - NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease
    (git-fixes).
  - commit 2c4e751


author: iivanov@suse.de
changelog:
  - x86/microcode/AMD: Make stub function static inline (bsc#1213286, CVE-2023-20593)
    Refresh patches.suse/x86-cpu-amd-add-a-zenbleed-fix.patch.
  - commit 78a62d1


author: jslaby@suse.cz
changelog:
  - vc_screen: don't clobber return value in vcs_read (bsc#1213167
    CVE-2023-3567).
  - vc_screen: modify vcs_size() handling in vcs_read() (bsc#1213167
    CVE-2023-3567).
  - vc_screen: move load of struct vc_data pointer in vcs_read()
    to avoid UAF (bsc#1213167 CVE-2023-3567).
  - commit d1352c9


author: mfranc@suse.cz
changelog:
  - s390/cio: introduce io_subchannel_type (bsc#1207526).
  - Refresh
    patches.suse/s390-cio-generate-delayed-uevent-for-vfio-ccw-subchannels.
  - commit c7d1471


author: msuchanek@suse.de
changelog:
  - kernel-binary.spec.in: Remove superfluous %% in Supplements
    Fixes: 02b7735e0caf ("rpm/kernel-binary.spec.in: Add Enhances and Supplements tags to in-tree KMPs")
  - commit 264db74


author: jgross@suse.com
changelog:
  - virtio-balloon: fix managed page counts when migrating pages
    between zones (git-fixes).
  - commit 5ada11d


author: dwagner@suse.de
changelog:
  - scsi: qla2xxx: Fix error code in qla2x00_start_sp()
    (bsc#1213747).
  - scsi: qla2xxx: Silence a static checker warning (bsc#1213747).
  - scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
    (bsc#1213747).
  - scsi: qla2xxx: Update version to 10.02.08.400-k (bsc#1213747).
  - scsi: qla2xxx: Correct the index of array (bsc#1213747).
  - scsi: qla2xxx: Pointer may be dereferenced (bsc#1213747).
  - scsi: qla2xxx: Fix buffer overrun (bsc#1213747).
  - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
    (bsc#1213747).
  - scsi: qla2xxx: Avoid fcport pointer dereference (bsc#1213747).
  - scsi: qla2xxx: Fix potential NULL pointer dereference
    (bsc#1213747).
  - scsi: qla2xxx: Array index may go out of bound (bsc#1213747).
  - scsi: qla2xxx: Drop useless LIST_HEAD (bsc#1213747).
  - scsi: qla2xxx: Fix end of loop test (bsc#1213747).
  - scsi: qla2xxx: Fix NULL pointer dereference in target mode
    (bsc#1213747).
  - commit f23fa07


author: dwagner@suse.de
changelog:
  - scsi: qla2xxx: Update version to 10.02.08.500-k (bsc#1213747).
  - scsi: qla2xxx: fix inconsistent TMF timeout (bsc#1213747).
  - scsi: qla2xxx: Fix TMF leak through (bsc#1213747).
  - scsi: qla2xxx: Turn off noisy message log (bsc#1213747).
  - scsi: qla2xxx: Fix session hang in gnl (bsc#1213747).
  - scsi: qla2xxx: Fix erroneous link up failure (bsc#1213747).
  - scsi: qla2xxx: Fix command flush during TMF (bsc#1213747).
  - scsi: qla2xxx: Limit TMF to 8 per function (bsc#1213747).
  - scsi: qla2xxx: Adjust IOCB resource on qpair create
    (bsc#1213747).
  - scsi: qla2xxx: Fix deletion race condition (bsc#1213747).
  - commit ccb6c62


author: nik.borisov@suse.com
changelog:
  - x86/srso: Add a Speculative RAS Overflow mitigation (bsc#1213287, CVE-2023-20569).
  - commit ef43cae


author: nik.borisov@suse.com
changelog:
  - x86/retbleed: Add __x86_return_thunk alignment checks (bsc#1213287, CVE-2023-20569).
  - commit 00b523c


author: jgross@suse.com
changelog:
  - virtio: Improve vq->broken access to avoid any compiler
    optimization (git-fixes).
  - commit e78eee9


author: vbabka@suse.cz
changelog:
  - Delete patches.suse/memcg-drop-kmem-limit_in_bytes.patch.
    Remove the patch due to causing bsc#1213705.
  - commit 3f5780d


author: jgross@suse.com
changelog:
  - virtio_ring: Fix querying of maximum DMA mapping size for
    virtio device (git-fixes).
  - commit 8dacd2d


author: mkubecek@suse.cz
changelog:
  - net/sched: sch_qfq: account for stab overhead in qfq_enqueue
    (CVE-2023-3611 bsc#1213585).
  - net/sched: sch_qfq: refactor parsing of netlink parameters
    (bsc#1213585).
  - blacklist follow-up commit 158810b261d0 ("net/sched: sch_qfq: reintroduce
    lmax bound check for MTU") as unlike the original upstream commit, our
    backport does not remove the check
  - commit 5488c28


author: mkubecek@suse.cz
changelog:
  - net/sched: cls_fw: Fix improper refcount update leads to
    use-after-free (CVE-2023-3776 bsc#1213588).
  - commit 0349f73


author: jgross@suse.com
changelog:
  - vhost/vsock: don't check owner in vhost_vsock_stop() while
    releasing (git-fixes).
  - commit 6e93d45


author: mkubecek@suse.cz
changelog:
  - net/sched: cls_u32: Fix reference counter leak leading to
    overflow (CVE-2023-3609 bsc#1213586).
  - commit a166dc2


author: jgross@suse.com
changelog:
  - virtio-mmio: fix missing put_device() when vm_cmdline_parent
    registration failed (git-fixes).
  - commit cc5a462


author: oneukum@suse.com
changelog:
  - blacklist.conf: irrelevant because you are not to do upstream
    development with a SLE12 kernel
  - commit 1dcedba


author: mfranc@suse.cz
changelog:
  - Update
    patches.suse/s390-dasd-fix-no-record-found-for-raw_track_access.patch
    (git-fixes bsc#1212266 bsc#1207528).
  - commit ae7fc88


author: mfranc@suse.cz
changelog:
  - Update
    patches.suse/scsi-zfcp-Fix-missing-auto-port-scan-and-thus-missing-target-ports
    (git-fixes bsc#1202670).
  - commit dacbbc4


author: mfranc@suse.cz
changelog:
  - vfio-ccw: Prevent quiesce function going into an infinite loop
    (git-fixes bsc#1213819).
  - commit 123e763


author: mfranc@suse.cz
changelog:
  - vfio-ccw: Release any channel program when releasing/removing
    vfio-ccw mdev (git-fixes bsc#1213823).
  - commit 60eb99d


author: mfranc@suse.cz
changelog:
  - s390/cpum_sf: Adjust sampling interval to avoid hitting sample
    limits (git-fixes bsc#1213827).
  - commit 8ee8817


author: mfranc@suse.cz
changelog:
  - s390/jump_label: print real address in a case of a jump label
    bug (git-fixes bsc#1213899).
  - commit c684264


author: mfranc@suse.cz
changelog:
  - s390/smp: __smp_rescan_cpus() - move cpumask away from stack
    (git-fixes bsc#1213906).
  - commit c4dc11f


author: mfranc@suse.cz
changelog:
  - s390/cpum_sf: Avoid SBD overflow condition in irq handler
    (git-fixes bsc#1213908).
  - commit a9dbd12


author: mfranc@suse.cz
changelog:
  - s390/time: ensure get_clock_monotonic() returns monotonic values
    (git-fixes bsc#1213911).
  - commit 5c3c506


author: mfranc@suse.cz
changelog:
  - s390/ftrace: fix endless recursion in function_graph tracer
    (git-fixes bsc#1213912).
  - commit dee4f50


author: nik.borisov@suse.com
changelog:
  - patches.kabi/cpufeatures-kabi-fix.patch: (bsc#1213287, CVE-2023-20569).
    x86 bug bits alias into cap bits. However with the introduction of the
    kABI fix for CPUID bits bug and cap ints need to be handled separately.
  - commit 335c50e


author: nik.borisov@suse.com
changelog:
  - Update config files. - Refresh patches.suse/x86-srso-add-srso_no-support.patch.
    Ensure SRSO is always built and also ensure that msr interception works
    correctly when writing to PRED_CMD msr with the SRSO_NO capability
    present.
  - commit c88c60d


author: ailiop@suse.com
changelog:
  - fs: hfsplus: remove WARN_ON() from
    hfsplus_cat_{read,write}_inode() (git-fixes).
  - commit 90060d8


author: mfranc@suse.cz
changelog:
  - net: tap_open(): set sk_uid from current_fsuid() (CVE-2023-4194
    bsc#1214019).
  - net: tun_chr_open(): set sk_uid from current_fsuid()
    (CVE-2023-4194 bsc#1214019).
  - commit 82ba5a9


author: iivanov@suse.de
changelog:
  - blacklist.conf: ("arm64: Avoid redundant type conversions in xchg() and cmpxchg()")
  - commit bd2ee86


author: nik.borisov@suse.com
changelog:
  - x86/srso: Tie SBPB bit setting to microcode patch detection (bsc#1213287, CVE-2023-20569).
  - commit 18888c5


author: jgross@suse.com
changelog:
  - xen/netback: Fix buffer overrun triggered by unusual packet
    (CVE-2023-34319, XSA-432, bsc#1213546).
  - commit 3798a75


author: tbogendoerfer@suse.de
changelog:
  - cxgb4: fix use after free bugs caused by circular dependency
    problem (bsc#1213970 CVE-2023-4133).
  - timers: Provide timer_shutdown[_sync]() (bsc#1213970).
  - timers: Add shutdown mechanism to the internal functions
    (bsc#1213970).
  - timers: Split [try_to_]del_timer[_sync]() to prepare for
    shutdown mode (bsc#1213970).
  - timers: Silently ignore timers with a NULL function
    (bsc#1213970).
  - timers: Rename del_timer() to timer_delete() (bsc#1213970).
  - timers: Rename del_timer_sync() to timer_delete_sync()
    (bsc#1213970).
  - timers: Use del_timer_sync() even on UP (bsc#1213970).
  - timers: Update kernel-doc for various functions (bsc#1213970).
  - timers: Replace BUG_ON()s (bsc#1213970).
  - clocksource/drivers/sp804: Do not use timer namespace for
    timer_shutdown() function (bsc#1213970).
  - clocksource/drivers/arm_arch_timer: Do not use timer namespace
    for timer_shutdown() function (bsc#1213970).
  - ARM: spear: Do not use timer namespace for timer_shutdown()
    function (bsc#1213970).
  - commit 7812c75


author: nik.borisov@suse.com
changelog:
  - Sort latest foray of security patches
  - Refresh patches.suse/kvm-add-gds_no-support-to-kvm.patch.
  - Refresh
    patches.suse/x86-speculation-add-gather-data-sampling-mitigation.patch.
  - Refresh
    patches.suse/x86-srso-add-a-speculative-ras-overflow-mitigation.patch.
  - Refresh patches.suse/x86-srso-add-srso_no-support.patch.
  - commit 6e04a2d


author: vkarasulli@suse.de
changelog:
  - net/sched: cls_route: No longer copy tcf_result on update  to
    avoid use-after-free (bsc#1214149 CVE-2023-4128).
  - net/sched: cls_fw: No longer copy tcf_result on update to
    avoid use-after-free (bsc#1214149 CVE-2023-4128).
  - net/sched: cls_u32: No longer copy tcf_result on update  to
    avoid use-after-free (bsc#1214149 CVE-2023-4128).
  - commit c462108


author: dkirjanov@suse.com
changelog:
  - netfilter: nf_conntrack: Fix possible possible crash on module
    loading (git-fixes).
  - commit 6f6cadf


author: oneukum@suse.com
changelog:
  - media: usb: siano: Fix use after free bugs caused by
    do_submit_urb (bsc#1213969 CVE-2023-4132).
  - commit 4613c3a


author: oneukum@suse.com
changelog:
  - media: usb: siano: Fix warning due to null work_func_t function
    pointer (bsc#1213969 CVE-2023-4132).
  - commit 75a6a97


author: dkirjanov@suse.com
changelog:
  - net: icmp: fix data-race in cmp_global_allow() (git-fixes).
  - Refresh
    patches.suse/icmp-randomize-the-global-rate-limiter.patch.
  - commit ac95ea3


author: dkirjanov@suse.com
changelog:
  - net/af_unix: fix a data-race in unix_dgram_sendmsg /
    unix_release_sock (git-fixes).
  - commit 210495b


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add 354d77930706 sched/autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[]
  - commit 9062495


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add a07db5c08657 sched/core: Fix CPU controller for !RT_GROUP_SCHED
  - commit dd8fafd


author: msuchanek@suse.de
changelog:
  - powerpc/pseries: Honour current SMT state when DLPAR onlining
    CPUs (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
  - powerpc: Add HOTPLUG_SMT support (bsc#1214285 bsc#1205462
    ltc#200161 ltc#200588).
    Update config files.
  - powerpc/pseries: Initialise CPU hotplug callbacks earlier
    (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
  - cpu/SMT: Allow enabling partial SMT states via sysfs
    (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
  - cpu/SMT: Create topology_smt_thread_allowed() (bsc#1214285
    bsc#1205462 ltc#200161 ltc#200588).
  - commit 6c86f9a


author: oneukum@suse.com
changelog:
  - usb: host: xhci: Fix potential memory leak in
    xhci_alloc_stream_info() (git-fixes).
  - commit c04f324


author: oneukum@suse.com
changelog:
  - xhci: Remove device endpoints from bandwidth list when freeing
    the device (git-fixes).
  - commit 841d8bb


author: msuchanek@suse.de
changelog:
  - kernel-binary: Drop code for kerntypes support
    Kerntypes was a SUSE-specific feature dropped before SLE 12.
  - commit 2c37773


author: msuchanek@suse.de
changelog:
  - kernel-binary: Common dependencies cleanup
    Common dependencies are copied to a subpackage, there is no need for
    copying defines or build dependencies there.
  - commit 254b03c


author: wqu@suse.com
changelog:
  - patches.suse/btrfs-allow-use-of-global-block-reserve-for-balance-.patch:
    (bsc#1214335).
  - commit 22c271f


author: tbogendoerfer@suse.de
changelog:
  - net: vmxnet3: fix possible use-after-free bugs in
    vmxnet3_rq_alloc_rx_buf() (bsc#1214350 CVE-2023-4387).
  - commit a117715


author: msuchanek@suse.de
changelog:
  - check-for-config-changes: ignore BUILTIN_RETURN_ADDRESS_STRIPS_PAC (bsc#1214380).
    gcc7 on SLE 15 does not support this while later gcc does.
  - commit 5b41c27


author: rgoldwyn@suse.com
changelog:
  - fs: jfs: fix possible NULL pointer dereference in dbFree() (bsc#1214348 CVE-2023-4385).
  - commit 47225b2


author: lduncan@suse.com
changelog:
  - Update config files. Drop the dpt_i2o kernel module.
    For: jsc#PED-4579, CVE-2023-2007
  - commit 55a7a29


author: nik.borisov@suse.com
changelog:
  - x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG (git-fixes).
  - commit 9b3cb5f


author: nik.borisov@suse.com
changelog:
  - x86/retpoline,kprobes: Skip optprobe check for indirect jumps with  retpolines and IBT (git-fixes).
  - commit 19c2705


author: oneukum@suse.com
changelog:
  - Refresh
    patches.suse/USB-serial-option-add-support-for-u-blox-LARA-R6-fam.patch.
  - commit 13f6793


author: tbogendoerfer@suse.de
changelog:
  - net: tun: fix bugs for oversize packet when napi frags enabled
    (bsc#1213543 CVE-2023-3812).
  - commit 6b178d4


author: dkirjanov@suse.com
changelog:
  - bonding: Fix a use-after-free problem when
    bond_sysfs_slave_add() failed (git-fixes).
  - commit 7b40920


author: tbogendoerfer@suse.de
changelog:
  - net: vmxnet3: fix possible NULL pointer dereference in
    vmxnet3_rq_cleanup() (bsc#1214451 CVE-2023-4459).
  - commit 070c8ea


author: aabdallah@suse.de
changelog:
  - x86/cpu/vmware: Use the full form of INL in VMWARE_HYPERCALL,
    for clang/llvm (bsc#1210327).
  - commit 1575f32


author: nik.borisov@suse.com
changelog:
  - Refresh patches.suse/x86-srso-add-ibpb.patch.
    CPU_IBPB_ENTRY is non-existant on our kernels and we effectively always
    have it enabled, adjust patch accordingly.
  - commit ef69893


author: jlee@suse.com
changelog:
  - nfc: Fix to check for kmemdup failure (bsc#1213601
    CVE-2023-3863).
    Refresh
    patches.suse/nfc-fix-refcount-leak-in-llcp_sock_connect.patch.
    patches.suse/nfc-fix-memory-leak-in-llcp_sock_connect.patch.
    patches.suse/net-nfc-fix-use-after-free-llcp_sock_bind-connect.patch.
  - commit 8e06144


author: jlee@suse.com
changelog:
  - net: nfc: Fix use-after-free caused by nfc_llcp_find_local
    (bsc#1213601 CVE-2023-3863).
  - nfc: llcp: simplify llcp_sock_connect() error paths (bsc#1213601
    CVE-2023-3863).
  - nfc: llcp: nullify llcp_sock->dev on connect() error paths
    (bsc#1213601 CVE-2023-3863).
  - commit d4622dc


author: msuchanek@suse.de
changelog:
  - old-flavors: Drop 2.6 kernels.
    2.6 based kernels are EOL, upgrading from them is no longer suported.
  - commit 7bb5087


author: nik.borisov@suse.com
changelog:
  - x86/CPU/AMD: Do not leak quotient data after a division by 0 (bsc#1213927, CVE-2023-20588).
  - commit c7be7bc


author: vkarasulli@suse.de
changelog:
  - Input: cyttsp4_core - change del_timer_sync() to
    timer_shutdown_sync() (bsc#1213971 CVE-2023-4134).
  - commit 3678dd9


author: dkirjanov@suse.com
changelog:
  - bridge: ebtables: don't crash when using dnat target in output
    chains (git-fixes).
  - commit 6755ab5


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add a46d14eca7b7 sched/fair: Use rq_lock/unlock in online_fair_sched_group
  - commit f2e125e


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add 541676078b52 membarrier: Disable preemption when calling smp_call_function_many()
  - commit abc325d


author: neilb@suse.de
changelog:
  - SUNRPC: always clear XPRT_SOCK_CONNECTING before
    xprt_clear_connecting on TCP xprt (bsc#1214453).
  - commit 262ee00


author: oneukum@suse.com
changelog:
  - Bluetooth: nokia: fix value check in
    nokia_bluetooth_serdev_probe() (git-fixes).
  - commit 65ce64f


author: jslaby@suse.cz
changelog:
  - rpm/mkspec-dtb: dtbs have moved to vendor sub-directories in 6.5
    By commit 724ba6751532 ("ARM: dts: Move .dts files to vendor
    sub-directories").
    So switch to them.
  - rpm/mkspec-dtb: support for nested subdirs
    Commit 724ba6751532 ("ARM: dts: Move .dts files to vendor
    sub-directories") moved the dts to nested subdirs, add a support for
    that. That is, generate a %dir entry in %files for them.
  - commit 7aee36a


author: neilb@suse.de
changelog:
  - NFS: Guard against READDIR loop when entry names exceed
    MAXNAMELEN (git-fixes).
  - nfs/blocklayout: Use the passed in gfp flags (git-fixes).
  - NFSD: da_addr_body field missing in some GETDEVICEINFO replies
    (git-fixes).
  - fs: lockd: avoid possible wrong NULL parameter (git-fixes).
  - NFSD: add encoding of op_recall flag for write delegation
    (git-fixes).
  - commit 9627d5e


author: nik.borisov@suse.com
changelog:
  - blacklist.conf: Ignore a bunch of useless patches
    They primarily relate to the GDS mitigations but have some implicit
    dependencies which aren't satisfied in SLE12-SP5 hence can't be
    backported without breaking the boot flow.
  - commit 8a7a083


author: nik.borisov@suse.com
changelog:
  - x86/crash: Disable virt in core NMI crash handler to avoid double  shootdown (git-fixes).
  - commit 3755873


author: dwagner@suse.de
changelog:
  - series: update metadata qla2xxx
  - Refresh
    patches.suse/scsi-qla2xxx-Adjust-IOCB-resource-on-qpair-create.patch.
  - Refresh patches.suse/scsi-qla2xxx-Fix-TMF-leak-through.patch.
  - Refresh
    patches.suse/scsi-qla2xxx-Fix-command-flush-during-TMF.patch.
  - Refresh
    patches.suse/scsi-qla2xxx-Fix-deletion-race-condition.patch.
  - Refresh
    patches.suse/scsi-qla2xxx-Fix-erroneous-link-up-failure.patch.
  - Refresh patches.suse/scsi-qla2xxx-Fix-session-hang-in-gnl.patch.
  - Refresh
    patches.suse/scsi-qla2xxx-Limit-TMF-to-8-per-function.patch.
  - Refresh
    patches.suse/scsi-qla2xxx-Turn-off-noisy-message-log.patch.
  - Refresh
    patches.suse/scsi-qla2xxx-Update-version-to-10.02.08.500-k.patch.
  - Refresh
    patches.suse/scsi-qla2xxx-fix-inconsistent-TMF-timeout.patch.
  - commit a78c0e0


author: dwagner@suse.de
changelog:
  - scsi: qla2xxx: Remove unused variables in
    qla24xx_build_scsi_type_6_iocbs() (bsc#1214928).
  - scsi: qla2xxx: Update version to 10.02.09.100-k (bsc#1214928).
  - Revert "scsi: qla2xxx: Fix buffer overrun" (bsc#1214928).
  - scsi: qla2xxx: Fix smatch warn for qla_init_iocb_limit()
    (bsc#1214928).
  - scsi: qla2xxx: Remove unsupported ql2xenabledif option
    (bsc#1214928).
  - scsi: qla2xxx: Error code did not return to upper layer
    (bsc#1214928).
  - scsi: qla2xxx: Add logs for SFP temperature monitoring
    (bsc#1214928).
  - scsi: qla2xxx: Fix firmware resource tracking (bsc#1214928).
  - scsi: qla2xxx: Flush mailbox commands on chip reset
    (bsc#1214928).
  - scsi: qla2xxx: Allow 32-byte CDBs (bsc#1214928).
  - scsi: qla2xxx: Move resource to allow code reuse (bsc#1214928).
  - scsi: qla2xxx: Remove unused declarations (bsc#1214928).
  - commit e3144fe


author: ohering@suse.de
changelog:
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
    (git-fixes).
  - scsi: storvsc: Always set no_report_opcodes (git-fixes).
  - commit 1d90748


author: mgorman@suse.de
changelog:
  - sched/fair: Fix CFS bandwidth hrtimer expiry type (git fixes).
  - sched/fair: Don't NUMA balance for kthreads (git fixes).
  - sched/core: Check quota and period overflow at usec to nsec
    conversion (git fixes).
  - sched/core: Handle overflow in cpu_shares_write_u64 (git fixes).
  - sched/cpufreq: Fix kobject memleak (git fixes).
  - sched/topology: Fix off by one bug (git fixes).
  - commit 1834f8f


author: tzimmermann@suse.com
changelog:
  - drm/vmwgfx: Test shader type against SVGA3d_SHADERTYPE_MIN (bsc#1203517 CVE-2022-36402)
  - commit 90f1895


author: jlee@suse.com
changelog:
  - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
    (bsc#1214233 CVE-2023-40283).
  - commit eabaa85


author: mfranc@suse.cz
changelog:
  - s390/pkey: add one more argument space for debug feature entry
    (git-fixes bsc#1215035).
  - commit 06b1fa0


author: mfranc@suse.cz
changelog:
  - s390/uaccess: avoid (false positive) compiler warnings
    (git-fixes bsc#1215041).
  - commit 59bf770


author: mfranc@suse.cz
changelog:
  - s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR
    (git-fixes bsc#1215046).
  - commit 44d01f3


author: mfranc@suse.cz
changelog:
  - s390/dasd/cio: Interpret ccw_device_get_mdc return value
    correctly (git-fixes bsc#1215049).
  - commit a97aee2


author: mfranc@suse.cz
changelog:
  - s390/cio: cio_ignore_proc_seq_next should increase position
    index (git-fixes bsc#1215057).
  - commit 128857d


author: wqu@suse.com
changelog:
  - patches.suse/btrfs-output-extra-debug-info-if-we-failed-to-find-a.patch:
    (bsc#1215136).
  - commit edf562a


author: mfranc@suse.cz
changelog:
  - scsi: zfcp: reduce flood of fcrscn1 trace records on
    multi-element RSCN (git-fixes bsc#1215149).
  - commit a1a3484


author: mfranc@suse.cz
changelog:
  - s390/zcrypt: don't leak memory if dev_set_name() fails
    (git-fixes bsc#1215152).
  - commit 6bbbd1c


author: jack@suse.cz
changelog:
  - jbd2: Fix wrongly judgement for buffer head removing while
    doing checkpoint (bsc#1214948).
  - commit 9167319


author: jack@suse.cz
changelog:
  - jbd2: check 'jh->b_transaction' before removing it from
    checkpoint (bsc#1214953).
  - commit d390fb5


author: jack@suse.cz
changelog:
  - udf: Fix file corruption when appending just after end of
    preallocated extent (bsc#1214965).
  - commit 9b4bb47


author: ohering@suse.de
changelog:
  - Drivers: hv: vmbus: Don't dereference ACPI root object handle (git-fixes).
  - x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails (git-fixes).
  - hv_utils: Fix passing zero to 'PTR_ERR' warning (git-fixes).
  - commit 1c1b9d9


author: msuchanek@suse.de
changelog:
  - blacklist.conf: Add eac030b22ea1 ("powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT")
  - commit 7c10484


author: msuchanek@suse.de
changelog:
  - powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
    (bsc#1065729).
  - powerpc/xics: Remove unnecessary endian conversion
    (bsc#1065729).
  - word-at-a-time: use the same return type for has_zero regardless
    of endianness (bsc#1065729).
  - powerpc/64s/exception: machine check use correct cfar for late
    handler (bsc#1065729).
  - commit 024bdb8


author: mfranc@suse.cz
changelog:
  - Update
    patches.suse/s390-dasd-fix-hanging-device-after-quiesce-resume.patch
    (git-fixes bsc#1214157 bsc#1215122).
  - commit 07aca49


author: petr.pavlu@suse.com
changelog:
  - rpm/kernel-binary.spec.in: Drop use of KBUILD_OVERRIDE=1
    Genksyms has functionality to specify an override for each type in
    a symtypes reference file. This override is then used instead of an
    actual type and allows to preserve modversions (CRCs) of symbols that
    reference the type. It is kind of an alternative to doing kABI fix-ups
    with '#ifndef __GENKSYMS__'. The functionality is hidden behind the
    genksyms --preserve option which primarily tells the tool to strictly
    verify modversions against a given reference file or fail.
    Downstream patch patches.suse/genksyms-add-override-flag.diff which is
    present in various kernel-source branches separates the override logic.
    It allows it to be enabled with a new --override flag and used without
    specifying the --preserve option. Setting KBUILD_OVERRIDE=1 in the spec
    file is then a way how the build is told that --override should be
    passed to all invocations of genksyms. This was needed for SUSE kernels
    because their build doesn't use --preserve but instead resulting CRCs
    are later checked by scripts/kabi.pl.
    However, this override functionality was not utilized much in practice
    and the only use currently to be found is in SLE11-SP1-LTSS. It means
    that no one should miss this option and KBUILD_OVERRIDE=1 together with
    patches.suse/genksyms-add-override-flag.diff can be removed.
    Notes for maintainers merging this commit to their branches:
    * Downstream patch patches.suse/genksyms-add-override-flag.diff can be
    dropped after merging this commit.
    * Branch SLE11-SP1-LTSS uses the mentioned override functionality and
    this commit should not be merged to it, or needs to be reverted
    afterwards.
  - commit 4aa02b8


author: msuchanek@suse.de
changelog:
  - Delete patches.suse/genksyms-add-override-flag.diff.
    The override flag is no longer used in kernel-binary.
  - commit 3815406


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Update information about DUD (jsc#PED-5021)
    Remove a dead link to description of Device Update Disks found
    previously on novell.com. Replace it with a short section summarizing
    what DUD is and reference the mkdud + mksusecd tools and their
    documentation for more information.
  - commit 7eeba4e


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Update title information (jsc#PED-5021)
    * Drop the mention of kernel versions from the readme title.
    * Remove information about the original authors of the document. Rely as
    in case of other readmes on Git metadata to get information about all
    contributions.
    * Strip the table of contents. The document is short and easy to
    navigate just by scrolling through it.
  - commit 06f5139


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Update the references list (jsc#PED-5021)
    * Remove the reference to Linux Documentation Project. It has been
    inactive for years and mostly contains old manuals that aren't
    relevant for contemporary systems and hardware.
    * Update the name and link to LWN.net. The original name "Linux Weekly
    News" has been deemphasized over time by its authors.
    * Update the link to Kernel newbies website.
    * Update the reference to The Linux Kernel Module Programming Guide. The
    document has not been updated for over a decade but it looks its
    content is still relevant for today.
    * Point Kernel Module Packages Manual to the current version.
    * Add a reference to SUSE SolidDriver Program.
  - commit 0edac75


author: oneukum@suse.com
changelog:
  - media: flexcop-usb: fix NULL-ptr deref in
    flexcop_usb_transfer_init() (git-fixes).
  - Refresh
    patches.suse/0001-media-flexcop-usb-fix-endpoint-sanity-check.patch.
  - commit bad0523


author: oneukum@suse.com
changelog:
  - media: mceusb: return without resubmitting URB in case of
    - EPROTO error (git-fixes).
  - commit c8383de


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Bring the overview section up to date
    (jsc#PED-5021)
    * Update information in the overview section that was no longer
    accurate.
    * Improve wording and fix some typos+grammar.
  - commit 798c075


author: oneukum@suse.com
changelog:
  - Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe
    (git-fixes).
  - Input: xpad - add constants for GIP interface numbers
    (git-fixes).
  - commit f16c0ae


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Bring information about compiling up to date
    (jsc#PED-5021)
    * When building the kernel, don't mention to initially change the
    current directory to /usr/src/linux because later description
    discourages it and specifies to use 'make -C /usr/src/linux'.
    * Avoid writing additional details in parentheses, incorporate them
    instead properly in the text.
    * Fix the obsolete name of /etc/modprobe.d/unsupported-modules ->
    /etc/modprobe.d/10-unsupported-modules.conf.
    * Drop a note that a newly built kernel should be added to the boot
    manager because that normally happens automatically when running
    'make install'.
    * Update a link to the Kernel Module Packages Manual.
    * When preparing a build for external modules, mention use of the
    upstream recommended 'make modules_prepare' instead of a pair of
    'make prepare' + 'make scripts'.
    * Fix some typos+grammar.
  - commit b9b7e79


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Update information about (un)supported modules
    (jsc#PED-5021)
    * Update the list of taint flags. Convert it to a table that matches the
    upstream documentation format and describe specifically flags that are
    related to module support status.
    * Fix some typos and wording.
  - commit e46f0df


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Update the patch selection section
    (jsc#PED-5021)
    * Make the steps how to obtain expanded kernel source more generic in
    regards to version numbers.
    * Use '#' instead of '$' as the command line indicator to signal that
    the steps need to be run as root.
    * Update the format of linux-$SRCVERSION.tar.bz2 to xz.
    * Improve some wording.
  - commit e14852c


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Update information about config files
    (jsc#PED-5021)
    * Use version variables to describe a name of the /boot/config-... file
    instead of using specific example versions which get outdated quickly.
    * Replace removed silentoldconfig with oldconfig.
    * Mention that oldconfig can automatically pick a base config from
    "/boot/config-$(uname -r)".
    * Avoid writing additional details in parentheses, incorporate them
    instead properly in the text.
  - commit cba5807


author: mkubecek@suse.cz
changelog:
  - netfilter: nftables: exthdr: fix 4-byte stack OOB write
    (CVE-2023-4881 bsc#1215221).
  - commit b9ba6b9


author: jgross@suse.com
changelog:
  - 9p/xen : Fix use after free bug in xen_9pfs_front_remove due
    to race condition (bsc#1215206, CVE-2023-1859).
  - commit 4fa7183


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'parisc/agp: Annotate parisc agp init functions with __init'
  - commit c9c8dac


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'fbdev: imsttfb: Release framebuffer and dealloc cmap on error path'
  - commit 7e72c90


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'fbdev: stifb: Fix info entry in sti_struct on error path'
  - commit 1d87a9e


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'backlight/gpio_backlight: Compare against struct fb_info.device'
  - commit 5ee6636


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'backlight/lv5207lp: Compare against struct fb_info.device'
  - commit deff103


author: tzimmermann@suse.com
changelog:
  - fbcon: Fix null-ptr-deref in soft_cursor (bsc#1154048)
    Backporting changes:
    * Move code from video/fbdev/core to video/consol
    * Refresh patch
  - commit a573af9


author: tzimmermann@suse.com
changelog:
  - fbdev: omapfb: lcd_mipid: Fix an error handling path in (bsc#1154048)
    Backporting changes:
    * Refresh patch
  - commit f0bd08e


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Update information about custom patches
    (jsc#PED-5021)
    * Replace mention of various patches.* directories with only
    patches.suse as the typical location for patches.
    * Replace i386 with x86_64 in the example how to define a config addon.
    * Fix some typos and wording.
  - commit 2997d22


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Update information about module paths
    (jsc#PED-5021)
    * Use version variables to describe names of the
    /lib/modules/$VERSION-$RELEASE-$FLAVOR/... directories
    instead of using specific example versions which get outdated quickly.
    * Note: Keep the /lib/modules/ prefix instead of using the new
    /usr/lib/modules/ location for now. The updated README is expected to
    be incorporated to various branches that are not yet usrmerged.
  - commit 7eba2f0


author: jack@suse.cz
changelog:
  - patches.suse/ext4-avoid-deadlock-in-fs-reclaim-with-page-writebac.patch:
    Fix compiler warning due to unused 'sbi' variable
  - commit f8d160b


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Minor content clean up (jsc#PED-5021)
    * Mark the user's build directory as a variable, not a command:
    'make -C $(your_build_dir)' -> 'make -C $YOUR_BUILD_DIR'.
    * Unify how to get the current directory: 'M=$(pwd)' -> 'M=$PWD'.
    * 'GIT' / 'git' -> 'Git'.
  - commit 1cb4ec8


author: tiwai@suse.de
changelog:
  - cec-api: prevent leaking memory through hole in structure
    (CVE-2020-36766 bsc#1215299).
  - commit 95fe4aa


author: mkubecek@suse.cz
changelog:
  - net/sched: sch_hfsc: Ensure inner classes have fsc curve
    (CVE-2023-4623 bsc#1215115).
  - commit 522fe97


author: mkubecek@suse.cz
changelog:
  - af_unix: Fix null-ptr-deref in unix_stream_sendpage()
    (CVE-2023-4622 bsc#1215117).
  - commit c96e367


author: oneukum@suse.com
changelog:
  - firmware: raspberrypi: Keep count of all consumers (git-fixes).
  - Refresh
    patches.suse/firmware-raspberrypi-Introduce-devm_rpi_firmware_get.patch.
  - commit 12c2932


author: oneukum@suse.com
changelog:
  - firmware: raspberrypi: fix possible memory leak in
    rpi_firmware_probe() (git-fixes).
  - commit c078a04


author: iivanov@suse.de
changelog:
  - blacklist.conf: ("arm64/fpsimd: Only provide the length to cpufeature for xCR registers")
  - commit fa8f4a7


author: msuchanek@suse.de
changelog:
  - kernel-binary: python3 is needed for build
    At least scripts/bpf_helpers_doc.py requires python3 since Linux 4.18
    Other simimlar scripts may exist.
  - commit c882efa


author: jgross@suse.com
changelog:
  - virtio_pci_modern: Fix the comment of
    virtio_pci_find_capability() (git-fixes).
  - commit cb1942b


author: jgross@suse.com
changelog:
  - vhost: introduce helpers to get the size of metadata area
    (git-fixes).
  - Refresh
    patches.kabi/kabi-mask-changes-to-vhost_dev_init-and-struct-vhost.patch.
  - Refresh
    patches.suse/vhost-Don-t-call-access_ok-when-using-IOTLB.patch.
  - commit dff33f7


author: jgross@suse.com
changelog:
  - net: check if protocol extracted by virtio_net_hdr_set_proto
    is correct (git-fixes).
  - commit 2e28a62


author: mkoutny@suse.com
changelog:
  - Update
    patches.suse/ipv6-raw-Deduct-extension-header-length-in-rawv6_pus.patch
    (bsc#1207168 CVE-2023-0394).
    (empty commit to synthesize changelog reference)
  - commit 5add4b1


author: dwagner@suse.de
changelog:
  - series: refresh meta data on qla2xxx patches
    Refresh:
    - patches.suse/Revert-scsi-qla2xxx-Fix-buffer-overrun.patch
    - patches.suse/scsi-qla2xxx-Add-logs-for-SFP-temperature-monitoring.patch
    - patches.suse/scsi-qla2xxx-Allow-32-byte-CDBs.patch
    - patches.suse/scsi-qla2xxx-Error-code-did-not-return-to-upper-laye.patch
    - patches.suse/scsi-qla2xxx-Fix-firmware-resource-tracking.patch
    - patches.suse/scsi-qla2xxx-Fix-smatch-warn-for-qla_init_iocb_limit.patch
    - patches.suse/scsi-qla2xxx-Flush-mailbox-commands-on-chip-reset-6d0b6556.patch
    - patches.suse/scsi-qla2xxx-Move-resource-to-allow-code-reuse.patch
    - patches.suse/scsi-qla2xxx-Remove-unsupported-ql2xenabledif-option.patch
    - patches.suse/scsi-qla2xxx-Remove-unused-variables-in-qla24xx_buil.patch
    - patches.suse/scsi-qla2xxx-Update-version-to-10.02.09.100-k.patch
  - commit 97d82a0


author: dwagner@suse.de
changelog:
  - scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir()
    (git-fixes).
  - scsi: qla2xxx: Use raw_smp_processor_id() instead of
    smp_processor_id() (git-fixes).
  - commit 42813d6


author: jgross@suse.com
changelog:
  - drm/virtio: fix NULL pointer dereference in
    virtio_gpu_conn_get_modes (git-fixes).
  - commit ab80da2


author: jgross@suse.com
changelog:
  - net: tap: NULL pointer derefence in dev_parse_header_protocol
    when skb->dev is null (git-fixes).
  - commit 58c21c4


author: nik.borisov@suse.com
changelog:
  - x86/srso: Set CPUID feature bits independently of bug or mitigation  status (git-fixes).
  - commit 353140c


author: msuchanek@suse.de
changelog:
  - kernel-binary: Move build-time definitions together
    Move source list and build architecture to buildrequires to aid in
    future reorganization of the spec template.
  - commit 30e2cef


author: petr.pavlu@suse.com
changelog:
  - doc/README.PATCH-POLICY.SUSE: Update the summary and background
    (jsc#PED-5021)
    * Drop information about patches being split into directories per
    a subsystem because that is no longer the case.
    * Remove the mention that the expanded tree is present since SLE11-SP2
    as that is now only a historical detail.
    * Incorporate URLs and additional information in parenthenses directly
    into the text.
    * Fix typos and improve some wording.
  - commit 640988f


author: petr.pavlu@suse.com
changelog:
  - doc/README.PATCH-POLICY.SUSE: Update information about the patch
    format (jsc#PED-5021)
    * Replace bugzilla.novell.com with bugzilla.suse.com and FATE with Jira.
    * Remove references to links to the patchtools and kernel source. They
    are incorporated in other parts of the text.
    * Use sentence-style capitalization for section headings, as recommended
    in the current SUSE Documentation Style Guide.
    * Fix typos and some wording, in particular avoid use of "there is/are".
  - commit ce98345


author: petr.pavlu@suse.com
changelog:
  - doc/README.PATCH-POLICY.SUSE: Update information about the tools
    (jsc#PED-5021)
    * Replace bugzilla.novell.com with bugzilla.suse.com and FATE with Jira.
    * Limit the range of commits in the exportpatch example to prevent it
    from running for too long.
    * Incorporate URLs directly into the text.
    * Fix typos and improve some wording, in particular avoid use of "there
    is/are" and prefer the present tense over the future one.
  - commit c0bea0c


author: neilb@suse.de
changelog:
  - NFS/pNFS: Report EINVAL errors from connect() to the server
    (git-fixes).
  - nfsd: fix change_info in NFSv4 RENAME replies (git-fixes).
  - NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
    (git-fixes).
  - commit fd7ddac


author: tzimmermann@suse.com
changelog:
  - drm/client: Send hotplug event after registering a client (bsc#1152446)
    Backporting changes:
    * send hotplug event from drm_client_add()
    * remove drm_dbg_kms()
  - commit 6137335


author: tzimmermann@suse.com
changelog:
  - drm/client: Fix memory leak in drm_client_target_cloned (bsc#1152446)
    Backporting changes:
    * move changes to drm_fb_helper.c
    * context changes
  - commit 2728def


author: vliaskovitis@suse.com
changelog:
  - blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason
    to kick (bsc#1214586).
  - commit c307c4a


author: petr.pavlu@suse.com
changelog:
  - tracing: Reverse the order of trace_types_lock and event_mutex
    (git-fixes bsc#1215634).
  - blacklist.conf: Remove the patch
  - commit f4d2e9c


author: nik.borisov@suse.com
changelog:
  - Refresh patches.kabi/cpufeatures-kabi-fix.patch.
    Implement support fo extended bug words alongside extended capability
    words.
  - commit 96606bc


author: nik.borisov@suse.com
changelog:
  - x86/resctrl: Fix to restore to original value when re-enabling hardware prefetch register (git-fixes).
  - commit 307ba1a


author: nik.borisov@suse.com
changelog:
  - x86/topology: Fix multiple packages shown on a single-package  system (git-fixes).
  - Refresh
    patches.suse/x86-topology-fix-duplicated-core-id-within-a-package.patch.
  - commit e04b6c0


author: pmladek@suse.com
changelog:
  - blacklist.conf: workqueue: compiler warning on 32-bit systems with
    Clang (bsc#1215877)
  - commit cdf35f4


author: mkubecek@suse.cz
changelog:
  - tcp: Reduce chance of collisions in inet6_hashfn()
    (CVE-2023-1206 bsc#1212703).
  - commit a16b5ec


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Adjust heading style (jsc#PED-5021)
    * Underscore all headings as a preparation for Markdown conversion.
    * Use title-style capitalization for the document name and
    sentence-style capitalization for section headings, as recommended in
    the current SUSE Documentation Style Guide.
  - commit 11e3267


author: petr.pavlu@suse.com
changelog:
  - doc/README.PATCH-POLICY.SUSE: Remove the list of links (jsc#PED-5021)
    All links have been incorporated into the text. Remove now unnecessary
    list at the end of the document.
  - commit 43d62b1


author: mfranc@suse.cz
changelog:
  - KVM: s390: vsie: Fix the initialization of the epoch extension
    (epdx) field (git-fixes bsc#1215897).
  - commit 8cf6ae4


author: mfranc@suse.cz
changelog:
  - scsi: zfcp: Defer fc_rport blocking until after ADISC response
    (LTC#203327 bsc#1213977 git-fixes).
  - commit 1163975


author: mfranc@suse.cz
changelog:
  - s390/zcrypt: fix reply buffer calculations for CCA replies
    (LTC#203322 bsc#1213950).
  - commit 877301e


author: mkoutny@suse.com
changelog:
  - Update
    patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch
    (bsc#1211592 CVE-2023-2860).
  - commit bb891c5


author: petr.pavlu@suse.com
changelog:
  - tracing: Fix cpu buffers unavailable due to 'record_disabled'
    missed (git-fixes).
  - commit 6f0b300


author: oneukum@suse.com
changelog:
  - net: usb: smsc75xx: Fix uninit-value access in
    __smsc75xx_read_reg (git-fixes).
  - commit aaff955


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add 82b90b6c5b38 cgroup:namespace: Remove unused cgroup_namespaces_init()
  - commit 154e29d


author: mkoutny@suse.com
changelog:
  - blk-cgroup: Fix NULL deref caused by blkg_policy_data being
    installed before init (bsc#1216062 bsc#1225203).
  - commit 0dd445b


author: mkoutny@suse.com
changelog:
  - memcg: drop kmem.limit_in_bytes (bsc#1208788)
    This brings a breaking commit for easier backport, it'll be fixed
    differently in a following commit.
  - commit f87e772


author: mkoutny@suse.com
changelog:
  - mm, memcg: reconsider kmem.limit_in_bytes deprecation
    (bsc#1208788 bsc#1213705).
  - commit 2d13fe0


author: oneukum@suse.com
changelog:
  - audit: fix potential double free on error path from
    fsnotify_add_inode_mark (git-fixes).
  - commit 4086838


author: jgross@suse.com
changelog:
  - xen/events: replace evtchn_rwlock with RCU (bsc#1215745,
    xsa-441, cve-2023-34324).
  - commit a9545c4


author: oneukum@suse.com
changelog:
  - net: usb: dm9601: fix uninitialized variable use in
    dm9601_mdio_read (git-fixes).
  - commit f96b2d4


author: oneukum@suse.com
changelog:
  - usb: typec: altmodes/displayport: Fix configure initial pin
    assignment (git-fixes).
  - commit 849955e


author: jgross@suse.com
changelog:
  - xen/x86: obtain upper 32 bits of video frame buffer address
    for Dom0 (bsc#1215743).
  - commit e0fb7ee


author: jgross@suse.com
changelog:
  - xen/x86: obtain full video frame buffer address for Dom0 also
    under EFI (bsc#1215743).
  - commit 04d5576


author: jgross@suse.com
changelog:
  - vsock/virtio: add transport parameter to the
    virtio_transport_reset_no_sock() (git-fixes).
  - Refresh
    patches.suse/vhost-vsock-accept-only-packets-with-the-right-dst_c.patch.
    patches.suse/net-virtio_vsock-Enhance-connection-semantics.patch
  - commit b2f8fd4


author: jgross@suse.com
changelog:
  - crypto: virtio: Fix use-after-free in
    virtio_crypto_skcipher_finalize_req() (git-fixes).
  - commit 1c1619c


author: jslaby@suse.cz
changelog:
  - kabi: iommu/amd: Fix IOMMU interrupt generation in X2APIC mode
    (bsc#1206010).
  - iommu/amd: Fix IOMMU interrupt generation in X2APIC mode
    (bsc#1206010).
  - commit 422a4d8


author: jslaby@suse.cz
changelog:
  - iommu/amd: Remove useless irq affinity notifier (bsc#1206010).
  - Delete patches.kabi/kABI-Fix-kABI-for-struct-amd_iommu.patch.
  - commit 2e08e52


author: jslaby@suse.cz
changelog:
  - iommu/amd: Set iommu->int_enabled consistently when interrupts
    are set up (bsc#1206010).
  - commit d889c94


author: mgorman@suse.de
changelog:
  - blacklist.conf: Guard against unlikely tuning value, fix only in the event of a customer bug
  - commit 166c336


author: mgorman@suse.de
changelog:
  - blacklist.conf: Complex dependencies missing, fix only in the event of a customer bug
  - commit 9b299fd


author: mgorman@suse.de
changelog:
  - blacklist.conf: Complex dependencies missing that applies to an extreme corner case, fix only in the event of a customer bug
  - commit d67ae17


author: mgorman@suse.de
changelog:
  - blacklist.conf: Fix to experimental feature, fix only in the event of a customer bug
  - commit 56273cd


author: mgorman@suse.de
changelog:
  - blacklist.conf: Potentially surprising change in behaviour, fix only in the event of a customer bug
  - commit 0f74b6a


author: mgorman@suse.de
changelog:
  - blacklist.conf: Potentially surprising change in behaviour, fix only in the event of a customer bug
  - commit c026b47


author: mgorman@suse.de
changelog:
  - blacklist.conf: Potentially surprising change in behaviour, fix only in the event of a customer bug
  - commit 1100fe5


author: mgorman@suse.de
changelog:
  - blacklist.conf: Complex dependencies missing, fix only in the event of a customer bug
  - commit ede2396


author: mgorman@suse.de
changelog:
  - blacklist.conf: Complex dependencies missing, fix only in the event of a customer bug
  - commit d6a80de


author: mgorman@suse.de
changelog:
  - blacklist.conf: Complex dependencies missing, fix only in the event of a customer bug
  - commit bb2fa98


author: mgorman@suse.de
changelog:
  - blacklist.conf: Complex dependencies missing, fix only in the event of a customer bug
  - commit 9afb234


author: mgorman@suse.de
changelog:
  - blacklist.conf: Complex dependencies missing, fix only in the event of a customer bug
  - commit b83449b


author: mgorman@suse.de
changelog:
  - sched/fair: Don't balance task to its current running CPU
    (git fixes (sched)).
  - sched/core: Mitigate race
    cpus_share_cache()/update_top_cache_domain() (git fixes
    (sched)).
  - sched: Reenable interrupts in do_sched_yield() (git fixes
    (sched)).
  - sched: correct SD_flags returned by tl->sd_flags() (git fixes
    (sched)).
  - sched: Avoid scale real weight down to zero (git fixes (sched)).
  - sched/core: Fix migration to invalid CPU in
    __set_cpus_allowed_ptr() (git fixes (sched)).
  - sched/rt: Restore rt_runtime after disabling RT_RUNTIME_SHARE
    (git fixes (sched)).
  - sched/rt: Minimize rq->lock contention in
    do_sched_rt_period_timer() (git fixes (sched)).
  - commit 913e5fc


author: oneukum@suse.com
changelog:
  - USB: ene_usb6250: Allocate enough memory for full object
    (bsc#1216051 CVE-2023-45862).
  - commit 6d3e018


author: jslaby@suse.cz
changelog:
  - rpm/check-for-config-changes: add AS_WRUSS to IGNORED_CONFIGS_RE
    Add AS_WRUSS as an IGNORED_CONFIGS_RE entry in check-for-config-changes
    to fix build on x86_32.
    There was a fix submitted to upstream but it was not accepted:
    https://lore.kernel.org/all/20231031140504.GCZUEJkMPXSrEDh3MA@fat_crate.local/
    So carry this in IGNORED_CONFIGS_RE instead.
  - commit 7acca37


author: jlee@suse.com
changelog:
  - Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in
    HCIUARTGETPROTO (bsc#1210780 CVE-2023-31083).
  - commit b07c667


author: tbogendoerfer@suse.de
changelog:
  - igb: set max size RX buffer when store bad packet is enabled
    (bsc#1216259 CVE-2023-45871).
  - commit d675d77


author: mfranc@suse.cz
changelog:
  - s390/cmma: fix initial kernel address space page table walk
    (LTC#203996 bsc#1217087).
  - commit 1ad76c2


author: mfranc@suse.cz
changelog:
  - s390/mm: add missing arch_set_page_dat() call to
    vmem_crst_alloc() (LTC#203996 bsc#1217087).
  - commit 0dd665d


author: mfranc@suse.cz
changelog:
  - s390/mm: add missing arch_set_page_dat() call to gmap
    allocations (LTC#203996 bsc#1217087).
  - commit 1b2cc83


author: mfranc@suse.cz
changelog:
  - s390/cmma: fix handling of swapper_pg_dir and invalid_pg_dir
    (LTC#203996 bsc#1217087).
  - commit 3a41a21


author: schwab@suse.de
changelog:
  - rpm/check-for-config-changes: add HAVE_SHADOW_CALL_STACK to IGNORED_CONFIGS_RE
    Not supported by our compiler.
  - commit eb32b5a


author: dwagner@suse.de
changelog:
  - scsi: qla2xxx: Use FIELD_GET() to extract PCIe capability fields
    (git-fixes).
  - scsi: qla2xxx: Fix double free of dsd_list during driver load
    (git-fixes).
  - commit 9172a73


author: tonyj@suse.de
changelog:
  - perf/core: Fix __perf_read_group_add() locking (bsc#1216584
    CVE-2023-5717).
  - perf/core: Fix locking for children siblings group read
    (bsc#1216584 CVE-2023-5717).
  - commit 8ccfe6e


author: tonyj@suse.de
changelog:
  - perf: Disallow mis-matched inherited group reads (bsc#1216584 CVE-2023-5717).
    Implement KABI fix for above
  - commit 5b65c0e


author: dkirjanov@suse.com
changelog:
  - l2tp: fix {pppol2tp, l2tp_dfs}_seq_stop() in case of seq_file
    overflow (git-fixes).
  - commit 28faea4


author: ailiop@suse.com
changelog:
  - xfs: make sure maxlen is still congruent with prod when rounding
    down (git-fixes).
  - commit 0154927


author: jlee@suse.com
changelog:
  - kobject: Fix slab-out-of-bounds in fill_kobj_path() (bsc#1216058
    CVE-2023-45863).
  - commit 9922921


author: fcrozat@suse.com
changelog:
  - Ensure ia32_emulation is always enabled for kernel-obs-build
    If ia32_emulation is disabled by default, ensure it is enabled
    back for OBS kernel to allow building 32bit binaries (jsc#PED-3184)
    [ms: Always pass the parameter, no need to grep through the config which
    may not be very reliable]
  - commit 56a2c2f


author: petr.pavlu@suse.com
changelog:
  - tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and
    docker together (bsc#1216031).
  - commit f260538


author: mfranc@suse.cz
changelog:
  - s390/dasd: protect device queue against concurrent access
    (git-fixes bsc#1217519).
  - commit dab3b0f


author: jgross@suse.com
changelog:
  - cpu/SMT: Move SMT prototypes into cpu_smt.h (bsc#1214408).
  - Refresh
    patches.kabi/cpu-hotplug-Fix-SMT-disabled-by-BIOS-detection-for-K.patch.
  - commit 76bedc5


author: jgross@suse.com
changelog:
  - cpu/SMT: Store the current/max number of threads (bsc#1214408).
  - Refresh
    patches.kabi/cpu-hotplug-Fix-SMT-disabled-by-BIOS-detection-for-K.patch.
  - commit bfa1761


author: mfranc@suse.cz
changelog:
  - s390/dasd: use correct number of retries for ERP requests
    (git-fixes bsc#1217604).
  - s390/ptrace: fix PTRACE_GET_LAST_BREAK error handling (git-fixes
    bsc#1217603).
  - commit d2fc41b


author: mfranc@suse.cz
changelog:
  - s390/cio: unregister device when the only path is gone
    (git-fixes bsc#1217607).
  - commit 750467a


author: msuchanek@suse.de
changelog:
  - cpu/hotplug: Create SMT sysfs interface for all arches
    (bsc#1214285 bsc#1205462 ltc#200161 ltc#200588).
  - Refresh patches.suse/cpu-SMT-Move-SMT-prototypes-into-cpu_smt.h.patch.
  - Refresh patches.suse/cpu-SMT-Store-the-current-max-number-of-threads.patch.
  - Refresh patches.suse/cpu-smt-create-and-export-cpu_smt_possible.patch.
  - Refresh patches.suse/x86-power-Fix-nosmt-vs-hibernation-triple-fault-duri.patch.
  - commit f37a0c7


author: bwiedemann@suse.de
changelog:
  - Do not store build host name in initrd
    Without this patch, kernel-obs-build stored the build host name
    in its .build.initrd.kvm
    This patch allows for reproducible builds of kernel-obs-build and thus
    avoids re-publishing the kernel-obs-build.rpm when nothing changed.
    Note that this has no influence on the /etc/hosts file
    that is used during other OBS builds.
    https://bugzilla.opensuse.org/show_bug.cgi?id=1084909
  - commit fd3a75e


author: jslaby@suse.cz
changelog:
  - README.SUSE: fix patches.addon use
    It's series, not series.conf in there.
    And make it more precise on when the patches are applied.
  - commit cb8969c


author: petr.pavlu@suse.com
changelog:
  - Revert "tracing: Fix warning in trace_buffered_event_disable()"
    (bsc#1217036)
    Temporarily revert the commit. It exposed a separate issue related to
    trace buffered event synchronization which needs to be fixed first.
  - commit 579dd1d


author: msuchanek@suse.de
changelog:
  - rpm: Use run_if_exists for all external scriptlets
    With that the scriptlets do not need to be installed for build.
  - commit 25edd65


author: msuchanek@suse.de
changelog:
  - kernel-binary: suse-module-tools is also required when installed
    Requires(pre) adds dependency for the specific sciptlet.
    However, suse-module-tools also ships modprobe.d files which may be
    needed at posttrans time or any time the kernel is on the system for
    generating ramdisk. Add plain Requires as well.
  - commit 8c12816


author: mkubecek@suse.cz
changelog:
  - netfilter: conntrack: dccp: copy entire header to stack buffer,
    not just basic one (CVE-2023-39197 bsc#1216976).
  - commit 91c26b6


author: neilb@suse.de
changelog:
  - Update patches.kabi/NFSv4-Fix-OPEN-CLOSE-race-FIX.patch
    (bsc#1176950, bsc#1217525).
  - Refresh
    patches.kabi/NFSv4-Wait-for-stateid-updates-after-CLOSE-OPEN_DOWN_kabi.patch.
  - commit 70e60bf


author: tbogendoerfer@suse.de
changelog:
  - net: mana: Configure hwc timeout from hardware (bsc#1214037).
  - net: mana: Fix MANA VF unload when hardware is unresponsive
    (bsc#1214764).
  - commit 66a91f5


author: oneukum@suse.com
changelog:
  - usb: typec: tcpm: Fix altmode re-registration causes sysfs
    create fail (git-fixes).
  - commit fc9ee7b


author: oneukum@suse.com
changelog:
  - USB: serial: option: add Quectel RM500U-CN modem (git-fixes).
  - Refresh
    patches.suse/USB-serial-option-add-Quectel-EC200A-module-support.patch.
  - commit b94685a


author: oneukum@suse.com
changelog:
  - usb-storage: fix deadlock when a scsi command timeouts more
    than once (git-fixes).
  - commit cf05cec


author: colyli@suse.de
changelog:
  - md: flush md_rdev_misc_wq for HOT_ADD_DISK case (git-fixes).
  - md: add new workqueue for delete rdev (git-fixes).
  - commit 17e8908


author: colyli@suse.de
changelog:
  - md: fix deadlock causing by sysfs_notify (git-fixes).
  - Refresh patches.kabi/md-backport-kabi.patch.
  - commit f6c5a12


author: colyli@suse.de
changelog:
  - md/raid10: prevent soft lockup while flush writes (git-fixes).
  - md/raid10: fix io loss while replacement replace rdev
    (git-fixes).
  - md/raid10: Do not add spare disk when recovery fails
    (git-fixes).
  - md/raid10: clean up md_add_new_disk() (git-fixes).
  - md/raid10: prioritize adding disk to 'removed' mirror
    (git-fixes).
  - md/raid10: improve code of mrdev in raid10_sync_request
    (git-fixes).
  - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
    (git-fixes).
  - md/bitmap: factor out a helper to set timeout (git-fixes).
  - md/bitmap: always wake up md_thread in timeout_store
    (git-fixes).
  - dm-raid: remove useless checking in raid_message() (git-fixes).
  - md/raid10: fix wrong setting of max_corr_read_errors
    (git-fixes).
  - md/raid10: fix overflow of md/safe_mode_delay (git-fixes).
  - md: fix data corruption for raid456 when reshape restart while
    grow up (git-fixes).
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter
    (git-fixes).
  - md/raid10: fix memleak of md thread (git-fixes).
  - md/raid10: fix memleak for 'conf->bio_split' (git-fixes).
  - md/raid10: fix leak of 'r10bio->remaining' for recovery
    (git-fixes).
  - md/raid10: fix null-ptr-deref in raid10_sync_request
    (git-fixes).
  - md: avoid signed overflow in slot_store() (git-fixes).
  - md: fix incorrect declaration about claim_rdev in
    md_import_device (git-fixes).
  - md: remove lock_bdev / unlock_bdev (git-fixes).
  - md: Flush workqueue md_rdev_misc_wq in md_alloc() (git-fixes).
  - md: do not return existing mddevs from mddev_find_or_alloc
    (git-fixes).
  - md: refactor mddev_find_or_alloc (git-fixes).
  - md: factor out a mddev_alloc_unit helper from mddev_find
    (git-fixes).
  - md: get sysfs entry after redundancy attr group create
    (git-fixes).
  - commit 293695f


author: oneukum@suse.com
changelog:
  - Revert "Bluetooth: btsdio: fix use after free bug in
    btsdio_remove due to unfinished work" (git-fixes).
  - commit a2b7495


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Remove how to build modules using kernel-source
    (jsc#PED-5021)
    Remove the first method how to build kernel modules from the readme. It
    describes a process consisting of the kernel-source installation,
    configuring this kernel and then performing an ad-hoc module build.
    This method is not ideal as no modversion data is involved in the
    process. It results in a module with no symbol CRCs which can be wrongly
    loaded on an incompatible kernel.
    Removing the method also simplifies the readme because only two main
    methods how to build the modules are then described, either doing an
    ad-hoc build using kernel-devel, or creating a proper Kernel Module
    Package.
  - commit 9285bb8


author: mkubecek@suse.cz
changelog:
  - net/ulp: use consistent error code when blocking ULP
    (CVE-2023-0461 bsc#1208787 bsc#1217079).
  - net/ulp: prevent ULP without clone op from entering the LISTEN
    status (CVE-2023-0461 bsc#1208787 bsc#1217079).
  - commit fb04b97


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Add how to update the config for module signing
    (jsc#PED-5021)
    Configuration files for SUSE kernels include settings to integrate with
    signing support provided by the Open Build Service. This creates
    problems if someone tries to use such a configuration file to build
    a "standalone" kernel as described in doc/README.SUSE:
    * Default configuration files available in the kernel-source repository
    unset CONFIG_MODULE_SIG_ALL to leave module signing to
    pesign-obs-integration. In case of a "standalone" build, this
    integration is not available and the modules don't get signed.
    * The kernel spec file overrides CONFIG_MODULE_SIG_KEY to
    ".kernel_signing_key.pem" which is a file populated by certificates
    provided by OBS but otherwise not available. The value ends up in
    /boot/config-$VERSION-$RELEASE-$FLAVOR and /proc/config.gz. If someone
    decides to use one of these files as their base configuration then the
    build fails with an error because the specified module signing key is
    missing.
    Add information on how to enable module signing and where to find the
    relevant upstream documentation.
  - commit a699dc3


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Simplify the list of references (jsc#PED-5021)
    Reduce indentation in the list of references, make the style consistent
    with README.md.
  - commit 70e3c33


author: petr.pavlu@suse.com
changelog:
  - kernel-source: Remove config-options.changes (jsc#PED-5021)
    The file doc/config-options.changes was used in the past to document
    kernel config changes. It was introduced in 2010 but haven't received
    any updates on any branch since 2015. The file is renamed by tar-up.sh
    to config-options.changes.txt and shipped in the kernel-source RPM
    package under /usr/share/doc. As its content now only contains outdated
    information, retaining it can lead to confusion for users encountering
    this file.
    Config changes are nowadays described in associated Git commit messages,
    which get automatically collected and are incorporated into changelogs
    of kernel RPM packages.
    Drop then this obsolete file, starting with its packaging logic.
    For branch maintainers: Upon merging this commit on your branch, please
    correspondingly delete the file doc/config-options.changes.
  - commit adedbd2


author: petr.pavlu@suse.com
changelog:
  - tracing: Fix warning in trace_buffered_event_disable()
    (git-fixes, bsc#1217036).
  - commit 693b5e0


author: dwagner@suse.de
changelog:
  - nvmet: nul-terminate the NQNs passed in the connect command
    (bsc#1217250 CVE-2023-6121).
  - commit 2021a67


author: oneukum@suse.com
changelog:
  - net: usb: smsc95xx: Fix uninit-value access in smsc95xx_read_reg
    (git-fixes).
  - net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
    (git-fixes).
  - commit 9c4175d


author: oneukum@suse.com
changelog:
  - net: usb: ax88179_178a: fix failed operations during
    ax88179_reset (git-fixes).
  - commit 9041dc6


author: tbogendoerfer@suse.de
changelog:
  - net/tg3: fix race condition in tg3_reset_task() (bsc#1217801).
  - net/tg3: resolve deadlock in tg3_reset_task() during EEH
    (bsc#1217801).
  - commit b55327d


author: jwiesner@suse.de
changelog:
  - xfrm: reuse uncached_list to track xdsts (git-fixes).
  - blacklist.conf: remove from the blacklist
  - Refresh
    patches.suse/ipv4-fix-race-condition-between-route-lookup-and-inv.patch.
  - Refresh
    patches.suse/ipv4-lock-mtu-in-fnhe-when-received-PMTU-net.ipv4.ro.patch.
  - commit 38edc03


author: petr.pavlu@suse.com
changelog:
  - tracing: relax trace_event_eval_update() execution with
    cond_resched() (git-fixes).
  - commit f1e2f19


author: dkirjanov@suse.com
changelog:
  - netfilter: compat: prepare xt_compat_init_offsets to return
    errors (git-fixes).
  - commit a1a8d4f


author: dkirjanov@suse.com
changelog:
  - netfilter: ebtables: don't attempt to allocate 0-sized compat
    array (git-fixes).
  - Refresh
    patches.kabi/netfilter-preserve-KABI-for-xt_compat_init_offsets.patch.
  - commit 39f9e26


author: dkirjanov@suse.com
changelog:
  - netfilter: ebtables: compat: un-break 32bit setsockopt when
    no rules are present (git-fixes).
  - Refresh
    patches.kabi/netfilter-preserve-KABI-for-xt_compat_init_offsets.patch.
  - commit 332123a


author: dkirjanov@suse.com
changelog:
  - netfilter: ebtables: also count base chain policies (git-fixes).
  - Refresh
    patches.kabi/netfilter-preserve-KABI-for-xt_compat_init_offsets.patch.
  - commit 051bd2a


author: dkirjanov@suse.com
changelog:
  - netfilter: nf_tables: fix use-after-free when deleting compat
    expressions (git-fixes).
  - commit b4fa1c0


author: dkirjanov@suse.com
changelog:
  - net: ethernet: ti: cpsw: unsync mcast entries while switch promisc mode (git-fixes).
  - commit 39aa8c8


author: tbogendoerfer@suse.de
changelog:
  - gve: Fixes for napi_poll when budget is 0 (bsc#1214479).
  - gve: Do not fully free QPL pages on prefill errors
    (bsc#1214479).
  - gve: fix frag_list chaining (bsc#1214479).
  - gve: RX path for DQO-QPL (bsc#1214479).
  - gve: Tx path for DQO-QPL (bsc#1214479).
  - gve: Control path for DQO-QPL (bsc#1214479).
  - gve: trivial spell fix Recive to Receive (bsc#1214479).
  - gve: unify driver name usage (bsc#1214479).
  - gve: Set default duplex configuration to full (bsc#1214479).
  - gve: Unify duplicate GQ min pkt desc size constants
    (bsc#1214479).
  - gve: Add XDP REDIRECT support for GQI-QPL format (bsc#1214479).
  - gve: Add XDP DROP and TX support for GQI-QPL format
    (bsc#1214479).
  - gve: Changes to add new TX queues (bsc#1214479).
  - gve: XDP support GQI-QPL: helper function changes (bsc#1214479).
  - gve: Fix gve interrupt names (bsc#1214479).
  - commit 9108d42


author: denis.kirjanov@suse.com
changelog:
  - ipv4: igmp: fix refcnt uaf issue when receiving igmp query
    packet (bsc#1218253 CVE-2023-6932).
  - commit ebe786a


author: oneukum@suse.com
changelog:
  - Input: powermate - fix use-after-free in
    powermate_config_complete (git-fixes).
  - commit 6690cf9


author: tonyj@suse.de
changelog:
  - x86/cpu: Add Ice Lake NNPI to Intel family (jsc#PED-5023
    bsc#1211439).
  - Refresh
    patches.suse/x86-intel-aggregate-big-core-mobile-naming.patch.
  - commit 34f99e6


author: tonyj@suse.de
changelog:
  - perf/x86: Add Intel Ice Lake NNPI uncore support (jsc#PED-5023
    bsc#1211439).
  - Refresh
    patches.suse/x86-intel-aggregate-big-core-client-naming.patch.
  - Refresh
    patches.suse/x86-intel-aggregate-big-core-mobile-naming.patch.
  - Refresh
    patches.suse/x86-perf-events-convert-to-new-cpu-match-macros.patch.
  - commit 55befa5


author: tonyj@suse.de
changelog:
  - perf/x86/intel/uncore: Add tabs to Uncore IMC PCI IDs
    (jsc#PED-5023 bsc#1211439).
  - commit 1e8abbc


author: tonyj@suse.de
changelog:
  - perf/x86/intel/uncore: Add new IMC PCI IDs for KabyLake,
    AmberLake and WhiskeyLake CPUs (jsc#PED-5023 bsc#1211439).
  - commit 4d459ae


author: tonyj@suse.de
changelog:
  - perf/x86/intel: Add Icelake desktop CPUID (jsc#PED-5023
    bsc#1211439).
  - Refresh
    patches.suse/intel_rapl-add-support-for-IceLake-desktop.patch.
  - Refresh
    patches.suse/powercap-intel-rapl-add-support-for-ICX.patch.
  - Refresh
    patches.suse/x86-intel-aggregate-big-core-client-naming.patch.
  - Refresh
    patches.suse/x86-intel-aggregate-big-core-mobile-naming.patch.
  - Refresh
    patches.suse/x86-perf-events-convert-to-new-cpu-match-macros.patch.
  - commit 7786ce1


author: tonyj@suse.de
changelog:
  - perf/x86/intel: Add more Icelake CPUIDs (jsc#PED-5023
    bsc#1211439).
  - Refresh
    patches.suse/x86-intel-aggregate-big-core-client-naming.patch.
  - Refresh
    patches.suse/x86-intel-aggregate-big-core-mobile-naming.patch.
  - commit ba0eb7e


author: tonyj@suse.de
changelog:
  - perf/x86/intel/uncore: Add uncore support for Snow Ridge server
    (jsc#PED-5023 bsc#1211439).
  - Refresh
    patches.suse/x86-intel-aggregate-big-core-client-naming.patch.
  - Refresh
    patches.suse/x86-intel-aggregate-big-core-mobile-naming.patch.
  - Refresh
    patches.suse/x86-intel-aggregate-microserver-naming.patch.
  - Refresh
    patches.suse/x86-perf-events-convert-to-new-cpu-match-macros.patch.
  - commit 6e7af12


author: tonyj@suse.de
changelog:
  - perf/x86/intel/uncore: Factor out box ref/unref functions
    (jsc#PED-5023 bsc#1211439).
  - commit 9298d3b


author: tonyj@suse.de
changelog:
  - perf/x86/intel/uncore: Support MMIO type uncore blocks
    (jsc#PED-5023 bsc#1211439).
  - Refresh
    patches.suse/x86-perf-events-convert-to-new-cpu-match-macros.patch.
  - commit 2ed2c09


author: tonyj@suse.de
changelog:
  - perf/x86/intel/uncore: Add IMC uncore support for Snow Ridge
    (jsc#PED-5023 bsc#1211439).
  - commit 1e6f0c4


author: tonyj@suse.de
changelog:
  - perf/x86/intel: Fix invalid Bit 13 for Icelake MSR_OFFCORE_RSP_x
    register (jsc#PED-5023 bsc#1211439).
  - commit b357e8f


author: tonyj@suse.de
changelog:
  - perf/x86/intel: Mark expected switch fall-throughs (jsc#PED-5023
    bsc#1211439).
  - Refresh
    patches.suse/x86-intel-aggregate-big-core-client-naming.patch.
  - Refresh
    patches.suse/x86-intel-aggregate-big-core-mobile-naming.patch.
  - commit ebba1f6


author: tonyj@suse.de
changelog:
  - x86/cpu: Add Tiger Lake to Intel family (jsc#PED-5023
    bsc#1211439).
  - blacklist.conf:
  - Refresh patches.suse/x86-CPU-Add-Icelake-model-number.patch.
  - Refresh patches.suse/x86-cpu-sanitize-fam6_atom-naming.patch.
  - commit 45e2da6


author: tonyj@suse.de
changelog:
  - x86/cpu: Add Comet Lake to the Intel CPU models header
    (jsc#PED-5023 bsc#1211439).
  - blacklist.conf:
  - commit bd3eac7


author: tonyj@suse.de
changelog:
  - perf/x86/msr: Add new CPU model numbers for Ice Lake
    (jsc#PED-5023 bsc#1211439).
  - Refresh
    patches.suse/x86-bugs-Report-AMD-retbleed-vulnerability.patch.
  - Refresh
    patches.suse/x86-bugs-Report-Intel-retbleed-vulnerability.patch.
  - Refresh
    patches.suse/x86-bugs-add-cannon-lake-to-retbleed-affected-cpu-list.patch.
  - Refresh
    patches.suse/x86-common-Stamp-out-the-stepping-madness.patch.
  - Refresh
    patches.suse/x86-intel-aggregate-microserver-naming.patch.
  - Refresh
    patches.suse/x86-speculation-Mark-all-Skylake-CPUs-as-vulnerable-to-GDS.patch.
  - Refresh
    patches.suse/x86-speculation-add-gather-data-sampling-mitigation.patch.
  - Refresh
    patches.suse/x86-speculation-mmio-Enumerate-Processor-MMIO-Stale-Data-bug.patch.
  - Refresh
    patches.suse/x86-speculation-mmio-Reuse-SRBDS-mitigation-for-SBDS.patch.
  - commit 68588a6


author: tonyj@suse.de
changelog:
  - perf/x86/cstate: Update C-state counters for Ice Lake
    (jsc#PED-5023 bsc#1211439).
  - Refresh
    patches.suse/x86-perf-events-convert-to-new-cpu-match-macros.patch.
  - commit fef0544


author: tonyj@suse.de
changelog:
  - perf/x86: Add Intel Tiger Lake uncore support (jsc#PED-5023
    bsc#1211439).
  - Refresh
    patches.suse/x86-intel-aggregate-big-core-mobile-naming.patch.
  - Refresh
    patches.suse/x86-intel-aggregate-microserver-naming.patch.
  - Refresh
    patches.suse/x86-perf-events-convert-to-new-cpu-match-macros.patch.
  - commit f5492f0


author: tonyj@suse.de
changelog:
  - perf/x86/intel/uncore: Factor out __snr_uncore_mmio_init_box
    (jsc#PED-5023 bsc#1211439).
  - commit c73e167


author: tonyj@suse.de
changelog:
  - perf/x86/intel/uncore: Add Ice Lake server uncore support
    (jsc#PED-5023 bsc#1211439).
  - commit 4150606


author: tonyj@suse.de
changelog:
  - perf/x86/intel/uncore: Add Comet Lake support (jsc#PED-5023
    bsc#1211439).
  - Refresh
    patches.suse/x86-perf-events-convert-to-new-cpu-match-macros.patch.
  - commit 2e1087f


author: tonyj@suse.de
changelog:
  - x86/cpu: Add Lakefield, Alder Lake and Rocket Lake models to
    the to Intel CPU family (jsc#PED-5023 bsc#1211439).
  - blacklist.conf:
  - commit 2561a0a


author: tonyj@suse.de
changelog:
  - perf/x86/intel/uncore: Split the Ice Lake and Tiger Lake MSR
    uncore support (jsc#PED-5023 bsc#1211439).
  - commit 9c5fb1a


author: tonyj@suse.de
changelog:
  - perf/x86/intel/uncore: Update Ice Lake uncore units
    (jsc#PED-5023 bsc#1211439).
  - commit 0e10240


author: tonyj@suse.de
changelog:
  - perf/x86/intel: Fix Ice Lake event constraint table
    (jsc#PED-5023 bsc#1211439).
  - commit cd283d5


author: tonyj@suse.de
changelog:
  - perf/x86/cstate: Add Tiger Lake CPU support (jsc#PED-5023
    bsc#1211439).
  - Refresh
    patches.suse/x86-perf-events-convert-to-new-cpu-match-macros.patch.
  - commit c544da1


author: tonyj@suse.de
changelog:
  - perf: Fix perf_event_validate_size() lockdep splat
    (CVE-2023-6931 bsc#1218258).
  - perf: Fix perf_event_validate_size() (CVE-2023-6931
    bsc#1218258).
  - commit 6cfe60a


author: tonyj@suse.de
changelog:
  - perf/x86/intel/uncore: Fix reference count leak in
    __uncore_imc_init_box() (jsc#PED-5023 bsc#1211439 (git-fixes)).
  - perf/x86/intel/uncore: Fix reference count leak in
    snr_uncore_mmio_map() (jsc#PED-5023 bsc#1211439 (git-fixes)).
  - perf/x86/intel/uncore: Fix broken read_counter() for SNB IMC
    PMU (jsc#PED-5023 bsc#1211439 (git-fixes)).
  - perf/x86/intel/uncore: Fix CAS_COUNT_WRITE issue for ICX
    (jsc#PED-5023 bsc#1211439 (git-fixes)).
  - perf/x86/intel/uncore: Fix IIO event constraints for Snowridge
    (jsc#PED-5023 bsc#1211439 (git-fixes)).
  - perf/x86/intel/uncore: Fix Intel ICX IIO event constraints
    (jsc#PED-5023 bsc#1211439 (git-fixes)).
  - perf/x86/intel/uncore: Support extra IMC channel on Ice Lake
    server (jsc#PED-5023 bsc#1211439 (git-fixes)).
  - perf/x86/intel/uncore: Fix integer overflow on 23 bit left
    shift of a u32 (jsc#PED-5023 bsc#1211439 (git-fixes)).
  - perf/x86/intel/uncore: Fix M2M event umask for Ice Lake server
    (jsc#PED-5023 bsc#1211439 (git-fixes)).
  - perf/x86/intel/uncore: Fix the scale of the IMC free-running
    events (jsc#PED-5023 bsc#1211439 (git-fixes)).
  - perf/x86/intel/uncore: Fix oops when counting IMC uncore events
    on some TGL (jsc#PED-5023 bsc#1211439 (git-fixes)).
  - perf/x86/intel/uncore: Fix missing marker for
    snr_uncore_imc_freerunning_events (jsc#PED-5023 bsc#1211439
    (git-fixes)).
  - commit 1cc4e6d


author: jlee@suse.com
changelog:
  - Bluetooth: Reject connection with the device which has same
    BD_ADDR (bsc#1215237 CVE-2020-26555).
  - commit fea8835


author: jlee@suse.com
changelog:
  - Bluetooth: avoid memcmp() out of bounds warning (bsc#1215237
    CVE-2020-26555).
  - Bluetooth: hci_event: Fix coding style (bsc#1215237
    CVE-2020-26555).
  - Bluetooth: hci_event: Fix using memcmp when comparing keys
    (bsc#1215237 CVE-2020-26555).
  - commit eb3189f


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add 1ca0b6051505 cgroup: Remove duplicates in cgroup v1 tasks file
  - commit a77e914


author: msuchanek@suse.de
changelog:
  - Build in the correct KOTD repository with multibuild
    (JSC-SLE#5501, boo#1211226, bsc#1218184)
    With multibuild setting repository flags is no longer supported for
    individual spec files - see
    https://github.com/openSUSE/open-build-service/issues/3574
    Add ExclusiveArch conditional that depends on a macro set up by
    bs-upload-kernel instead. With that each package should build only in
    one repository - either standard or QA.
    Note: bs-upload-kernel does not interpret rpm conditionals, and only
    uses the first ExclusiveArch line to determine the architectures to
    enable.
  - commit aa5424d


author: msuchanek@suse.de
changelog:
  - mkspec: Add multibuild support (JSC-SLE#5501, boo#1211226, bsc#1218184)
    When MULTIBUILD option in config.sh is enabled generate a _multibuild
    file listing all spec files.
  - commit f734347


author: tonyj@suse.de
changelog:
  - Previous perf cve-4.12->SLE12-SP5 manual merge was incorrect. Fix.
  - Refresh
    patches.suse/perf-Fix-perf_event_validate_size-lockdep-splat.patch.
  - Refresh patches.suse/perf-Fix-perf_event_validate_size.patch.
  - commit 3382aa6


author: colyli@suse.de
changelog:
  - dm-integrity: don't modify bio's immutable bio_vec in
    integrity_metadata() (git-fixes).
  - md: don't leave 'MD_RECOVERY_FROZEN' in error path of
    md_set_readonly() (git-fixes).
  - bcache: revert replacing IS_ERR_OR_NULL with IS_ERR (git-fixes).
  - dm-verity: align struct dm_verity_fec_io properly (git-fixes).
  - dm verity: don't perform FEC for failed readahead IO
    (git-fixes).
  - bcache: add code comments for bch_btree_node_get() and
    __bch_btree_node_alloc() (git-fixes).
  - bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in
    btree_gc_coalesce() (git-fixes).
  - bcache: prevent potential division by zero error (git-fixes).
  - bcache: check return value from btree_node_alloc_replacement()
    (git-fixes).
  - md/raid1: hold the barrier until handle_read_error() finishes
    (git-fixes).
  - md/raid1: free the r1bio before waiting for blocked rdev
    (git-fixes).
  - md: raid1: fix potential OOB in raid1_remove_disk() (git-fixes).
  - md: restore 'noio_flag' for the last mddev_resume() (git-fixes).
  - dm cache policy smq: ensure IO doesn't prevent cleaner policy
    progress (git-fixes).
  - dm raid: fix missing reconfig_mutex unlock in raid_ctr()
    error paths (git-fixes).
  - md/raid0: add discard support for the 'original' layout
    (git-fixes).
  - bcache: Fix __bch_btree_node_alloc to make the failure behavior
    consistent (git-fixes).
  - bcache: Remove unnecessary NULL point check in node allocations
    (git-fixes).
  - nbd: Add the maximum limit of allocated index in nbd_dev_add
    (git-fixes).
  - nbd: Fix debugfs_create_dir error checking (git-fixes).
  - dm flakey: fix a crash with invalid table line (git-fixes).
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init()
    error path (git-fixes).
  - dm verity: fix error handling for check_at_most_once on FEC
    (git-fixes).
  - dm stats: check for and propagate alloc_percpu failure
    (git-fixes).
  - dm crypt: add cond_resched() to dmcrypt_write() (git-fixes).
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create()
    fails (git-fixes).
  - dm cache: add cond_resched() to various workqueue loops
    (git-fixes).
  - dm thin: add cond_resched() to various workqueue loops
    (git-fixes).
  - dm: remove flush_scheduled_work() during local_exit()
    (git-fixes).
  - dm flakey: fix logic when corrupting a bio (git-fixes).
  - dm flakey: don't corrupt the zero page (git-fixes).
  - dm verity: skip redundant verity_handle_err() on I/O errors
    (git-fixes).
  - commit 640b528


author: tiwai@suse.de
changelog:
  - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
    (CVE-2023-51779 bsc#1218559).
  - commit f63e944


author: tonyj@suse.de
changelog:
  - Resolve build warnings from previous series due to missing commit for
    Ice Lake freerunning counters
    perf/x86/intel/uncore: Add box_offsets for free-running counters
    (jsc#PED-5023 bsc#1211439).
  - commit 8524ea3


author: denis.kirjanov@suse.com
changelog:
  - netfilter: nf_tables: pass ctx to nf_tables_expr_destroy() (bsc#1202095 CVE-2022-2586).
  - commit 61a0caa


author: denis.kirjanov@suse.com
changelog:
  - netfilter: nf_tables: do not allow SET_ID to refer to another table (bsc#1202095 CVE-2022-2586).
  - commit d107d27


author: denis.kirjanov@suse.com
changelog:
  - netfilter: nf_tables: do not allow RULE_ID to refer to another chain (bsc#1202095 CVE-2022-2586).
  - commit 32951b9


author: msuchanek@suse.de
changelog:
  - Limit kernel-source build to architectures for which the kernel binary
    is built (bsc#1108281).
  - commit 08a9e44


author: palcantara@suse.de
changelog:
  - smb: client: fix potential OOB in smb2_dump_detail()
    (bsc#1217946 CVE-2023-6610).
  - commit 74aafd7


author: palcantara@suse.de
changelog:
  - smb: client: fix potential OOB in smb2_dump_detail()
    (bsc#1217946 CVE-2023-6610).
  - commit 04b527b


author: ailiop@suse.com
changelog:
  - GFS2: Flush the GFS2 delete workqueue before stopping the
    kernel threads (git-fixes).
  - commit c0d61c2


author: ailiop@suse.com
changelog:
  - gfs2: clear buf_in_tr when ending a transaction in
    sweep_bh_for_rgrps (git-fixes).
  - commit 0638ce6


author: ailiop@suse.com
changelog:
  - gfs2: Free rd_bits later in gfs2_clear_rgrpd to fix
    use-after-free (git-fixes).
  - commit 5f11647


author: tiwai@suse.de
changelog:
  - Store the old kernel changelog entries in kernel-docs package (bsc#1218713)
    The old entries are found in kernel-docs/old_changelog.txt in docdir.
    rpm/old_changelog.txt can be an optional file that stores the similar
    info like rpm/kernel-sources.changes.old.  It can specify the commit
    range that have been truncated.  scripts/tar-up.sh expands from the
    git log accordingly.
  - commit c9a2566


author: msuchanek@suse.de
changelog:
  - powerpc/powernv: Add a null pointer check in
    opal_powercap_init() (bsc#1181674 ltc#189159 git-fixes).
  - powerpc/powernv: Add a null pointer check in opal_event_init()
    (bsc#1065729).
  - powerpc/pseries/memhp: Fix access beyond end of drmem array
    (bsc#1065729).
  - powerpc: Don't clobber f0/vs0 during fp|altivec register save
    (bsc#1065729).
  - commit d5de04b


author: denis.kirjanov@suse.com
changelog:
  - netfilter: nf_tables: Reject tables of unsupported family
    (CVE-2023-6040 bsc#1218752).
  - commit 9e6d9d4


author: colyli@suse.de
changelog:
  - libnvdimm: Out of bounds read in __nd_ioctl() (git-fixes).
  - acpi/nfit: improve bounds checking for 'func' (git-fixes).
  - libnvdimm/btt: fix variable 'rc' set but not used (git-fixes).
  - libnvdimm/pmem: Delete include of nd-core.h (git-fixes).
  - =?UTF-8?q?libnvdimm:=20Fix=20endian=20conversion=20issues?=
    =?UTF-8?q?=C2=A0?= (git-fixes).
  - libnvdimm: Fix compilation warnings with W=1 (git-fixes).
  - libnvdimm/pmem: fix a possible OOB access when read and write
    pmem (git-fixes).
  - libnvdimm/btt: Fix a kmemdup failure check (git-fixes).
  - libnvdimm/namespace: Fix a potential NULL pointer dereference
    (git-fixes).
  - libnvdimm/btt: Fix LBA masking during 'free list' population
    (git-fixes).
  - libnvdimm/btt: Remove unnecessary code in btt_freelist_init
    (git-fixes).
  - acpi/nfit: Require opt-in for read-only label configurations
    (git-fixes).
  - UAPI: ndctl: Fix g++-unsupported initialisation in headers
    (git-fixes).
  - commit e6b26fa


author: colyli@suse.de
changelog:
  - libnvdimm: cover up changes in struct nvdimm_bus_descriptor
    (git-fixes).
  - libnvdimm: Validate command family indices (git-fixes).
  - commit 27f581b


author: colyli@suse.de
changelog:
  - libnvdimm/of_pmem: Use devm_kstrdup instead of kstrdup and
    check its return value (git-fixes).
  - nvdimm: Fix badblocks clear off-by-one error (git-fixes).
  - nvdimm: Allow overwrite in the presence of disabled dimms
    (git-fixes).
  - nvdimm/btt: do not call del_gendisk() if not needed (git-fixes).
  - libnvdimm/region: Fix label activation vs errors (git-fixes).
  - commit dc5bee2


author: neilb@suse.de
changelog:
  - nfsd: drop st_mutex and rp_mutex before calling
    move_to_close_lru() (bsc#1217525).
  - commit d08e536


author: dkirjanov@suse.com
changelog:
  - mlxsw: spectrum: Properly cleanup LAG uppers when removing
    port from LAG (git-fixes).
  - commit 65b3a7e


author: dkirjanov@suse.com
changelog:
  - net: stmmac: Fallback to Platform Data clock in Watchdog
    conversion (git-fixes).
  - commit c0e8ae4


author: dkirjanov@suse.com
changelog:
  - net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe() (git-fixes).
  - commit 5db0cbe


author: mfranc@suse.cz
changelog:
  - KVM: s390: vsie: Fix STFLE interpretive execution identification
    (git-fixes bsc#1219022).
  - commit 16098a4


author: neilb@suse.de
changelog:
  - blacklist.conf:
  - Delete
    patches.suse/NFSD-Fix-possible-sleep-during-nfsd4_release_lockown.patch.
    This patch is harmful on all kernels, and irrelevant on kernels before
    v5.4
    bsc#1218968
  - commit 5365a0a


author: jslaby@suse.cz
changelog:
  - rpm/kernel-docs.spec.in: fix build with 6.8
    Since upstream commit f061c9f7d058 (Documentation: Document each netlink
    family), the build needs python yaml.
  - commit 6a7ece3


author: oneukum@suse.com
changelog:
  - Refresh
    patches.suse/ipmi-Cleanup-oops-on-initialization-failure.patch.
    Alt-commit added
  - commit 5093b56


author: tiwai@suse.de
changelog:
  - scripts/tar-up.sh: don't add spurious entry from kernel-sources.changes.old
    The previous change added the manual entry from kernel-sources.change.old
    to old_changelog.txt unnecessarily.  Let's fix it.
  - commit fb033e8


author: lhenriques@suse.de
changelog:
  - Update
    patches.suse/ext4-improve-error-recovery-code-paths-in-__ext4_rem.patch
    (bsc#1213017 bsc#1219053 CVE-2024-0775).
  - commit a5b396b


author: lhenriques@suse.de
changelog:
  - ext4: improve error recovery code paths in __ext4_remount()
    (bsc#1213017 bsc#1219053 CVE-2024-0775).
  - commit 3bb0d48


author: jack@suse.cz
changelog:
  - writeback: Export inode_io_list_del() (bsc#1216989).
    patches/patches.suse/writeback-Protect-inode-i_io_list-with-inode-i_lock.patch:
    Refresh
  - commit c969261


author: jack@suse.cz
changelog:
  - ext4: silence the warning when evicting inode with
    dioread_nolock (bsc#1206889).
  - commit 3433e7a


author: dwagner@suse.de
changelog:
  - scsi: qedf: fc_rport_priv reference counting fixes
    (bsc#1212152).
    Refresh:
    - patches.suse/scsi-qedf-correctly-handle-refcounting-of-rdata
    - patches.suse/scsi-qedf-print-message-during-bailout-conditions
    - patches.suse/scsi-qedf-print-scsi_cmd-backpointer-in-good-completion-path-if-the-command-is-still-being-used
  - commit e171158


author: nik.borisov@suse.com
changelog:
  - Refresh patches.suse/mce-fix-set_mce_nospec-to-always-unmap-the-whole-page.patch.
  - commit 97df026


author: jslaby@suse.cz
changelog:
  - rpm/kernel-source.rpmlintrc: add action-ebpf
    Upstream commit a79d8ba734bd (selftests: tc-testing: remove buildebpf
    plugin) added this precompiled binary blob. Adapt rpmlintrc for
    kernel-source.
  - commit b5ccb33


author: jslaby@suse.cz
changelog:
  - rpm/mkspec: use kernel-source: prefix for constraints on multibuild
    Otherwise the constraints are not applied with multibuild enabled.
  - commit 841012b


author: msuchanek@suse.de
changelog:
  - mkspec: Include constraints for both multibuild and plain package always
    There is no need to check for multibuild flag, the constraints can be
    always generated for both cases.
  - commit 308ea09


author: msuchanek@suse.de
changelog:
  - Revert "Limit kernel-source build to architectures for which the kernel binary"
    This reverts commit 08a9e44c00758b5f3f3b641830ab6affff041132.
    The fix for bsc#1108281 directly causes bsc#1218768, revert.
  - commit 2943b8a


author: nik.borisov@suse.com
changelog:
  - Refresh patches.kabi/cpufeatures-kabi-fix.patch.
    Adjust the cpuid check when applying alternatives. Fixes false BUG_ON
    in the presence of extra bugints/capints.
  - commit 48af78f


author: pjakobsson@suse.de
changelog:
  - drm/atomic: Fix potential use-after-free in nonblocking commits
    (bsc#1219120 CVE-2023-51043).
  - commit a69e3d8


author: jslaby@suse.cz
changelog:
  - rpm/constraints.in: add static multibuild packages
    Commit 841012b049a5 (rpm/mkspec: use kernel-source: prefix for
    constraints on multibuild) added "kernel-source:" prefix to the
    dynamically generated kernels. But there are also static ones like
    kernel-docs. Those fail to build as the constraints are still not
    applied.
    So add the prefix also to the static ones.
    Note kernel-docs-rt is given kernel-source-rt prefix. I am not sure it
    will ever be multibuilt...
  - commit c2e0681


author: msuchanek@suse.de
changelog:
  - mkspec: Use variant in constraints template
    Constraints are not applied consistently with kernel package variants.
    Add variant to the constraints template as appropriate, and expand it
    in mkspec.
  - commit cc68ab9


author: nik.borisov@suse.com
changelog:
  - blacklist.conf: Black  unapplicable patch
    This one requires 45b575c00d8e72d69d75dd8c112f044b7b01b069 which is
    blacklisted. So black list this one as well.
  - commit 8ad7e95


author: dkirjanov@suse.com
changelog:
  - net: dsa: mv88e6xxx: Work around mv886e6161 SERDES missing
    MII_PHYSID2 (git-fixes).
  - commit d97991c


author: jslaby@suse.cz
changelog:
  - rpm/constraints.in: set jobs for riscv to 8
    The same workers are used for x86 and riscv and the riscv builds take
    ages. So align the riscv jobs count to x86.
  - commit b2c82b9


author: tiwai@suse.de
changelog:
  - wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
    (CVE-2023-47233 bsc#1216702).
  - commit d2e0155


author: nik.borisov@suse.com
changelog:
  - blacklist.conf: Blacklist 447ae316670230d7d29430e2cbf1f5db4f49d14c
    It reworks header inclusion to no real benefit for out kernel and
    results in massive kABI breakage. Just blacklist it.
  - commit 879fd91


author: petr.pavlu@suse.com
changelog:
  - blacklist.conf: remove a merge relic
    Remove a merge relic introduced in 44aaf966aab ("Merge remote-tracking
    branch 'origin/SLE12-SP4' into SLE12-SP5-UPDATE").
  - commit 78c957f


author: lhenriques@suse.de
changelog:
  - ext4: fix kernel BUG in 'ext4_write_inline_data_end()'
    (CVE-2021-33631 bsc#1219412).
  - commit 019d3a9


author: oneukum@suse.com
changelog:
  - USB: serial: option: add entry for Sierra EM9191 with new
    firmware (git-fixes).
  - commit e18b083


author: lhenriques@suse.de
changelog:
  - libceph: use kernel_connect() (bsc#1219446).
  - ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
    (bsc#1219445).
  - commit 92ba85d


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add baa9be4ffb55 sched/fair: Fix throttle_list starvation with low CFS quota
  - commit f2444c0


author: jgross@suse.com
changelog:
  - xen-netback: don't produce zero-size SKB frags (CVE-2023-46838,
    XSA-448, bsc#1218836).
  - commit 6d25bad


author: jslaby@suse.cz
changelog:
  - rpm/mkspec: sort entries in _multibuild
    Otherwise it creates unnecessary diffs when tar-up-ing. It's of course
    due to readdir() using "random" order as served by the underlying
    filesystem.
    See for example:
    https://build.opensuse.org/request/show/1144457/changes
  - commit d1155de


author: pjakobsson@suse.de
changelog:
  - drm/amdgpu: Fix potential fence use-after-free v2 (bsc#1219128
    CVE-2023-51042).
  - commit 78c123f


author: ailiop@suse.com
changelog:
  - pstore: ram_core: fix possible overflow in
    persistent_ram_init_ecc() (git-fixes).
  - commit 3b8a874


author: ailiop@suse.com
changelog:
  - pstore/ram: Run without kernel crash dump region (git-fixes).
  - Refresh patches.suse/pstore-backend-autoaction.
  - commit 27a20a7


author: ailiop@suse.com
changelog:
  - configfs: stash the data we need into configfs_buffer at open
    time (git-fixes).
  - commit 57d5998


author: ailiop@suse.com
changelog:
  - locks: print a warning when mount fails due to lack of "mand"
    support (git-fixes).
  - commit 4a54942


author: ailiop@suse.com
changelog:
  - 9p: missing chunk of "fs/9p: Don't update file type when
    updating file attributes" (git-fixes).
  - commit d7f7957


author: ailiop@suse.com
changelog:
  - fs: orangefs: fix error return code of
    orangefs_revalidate_lookup() (git-fixes).
  - commit 05692b2


author: denis.kirjanov@suse.com
changelog:
  - netfilter: nf_tables: reject QUEUE/DROP verdict parameters
    (CVE-2024-1086 bsc#1219434).
  - commit 1f42903


author: dkirjanov@suse.com
changelog:
  - net: macb: Add null check for PCLK and HCLK (git-fixed).
  - Refresh
    patches.suse/0006-net-macb-fix-error-format-in-dev_err.patch.
  - commit 1fdfc75


author: jslaby@suse.cz
changelog:
  - rpm/kernel-binary.spec.in: install scripts/gdb when enabled in config
    (bsc#1219653)
    They are put into -devel subpackage. And a proper link to
    /usr/share/gdb/auto-load/ is created.
  - commit 1dccf2a


author: jgross@suse.com
changelog:
  - vhost: use kzalloc() instead of kmalloc() followed by memset()
    (CVE-2024-0340, bsc#1218689).
  - commit 265772f


author: dwagner@suse.de
changelog:
  - nvmet-tcp: Fix the H2C expected PDU len calculation
    (bsc#1217987 bsc#1217988 bsc#1217989 CVE-2023-6535 CVE-2023-6536
    CVE-2023-6356).
  - nvmet-tcp: remove boilerplate code (bsc#1217987 bsc#1217988
    bsc#1217989 CVE-2023-6535 CVE-2023-6536 CVE-2023-6356).
  - nvmet-tcp: Fix a kernel panic when host sends an invalid H2C
    PDU length (bsc#1217987 bsc#1217988 bsc#1217989 CVE-2023-6535
    CVE-2023-6536 CVE-2023-6356).
  - commit 3e8a84f


author: dwagner@suse.de
changelog:
  - Update
    patches.suse/nvmet-tcp-fix-a-crash-in-nvmet_req_complete.patch
    (bsc#1217987 bsc#1217988 bsc#1217989 CVE-2023-6535 CVE-2023-6536
    CVE-2023-6356).
  - commit 1a6bd68


author: colyli@suse.de
changelog:
  - dm: limit the number of targets and parameter size area
    (bsc#1219827, bsc#1219146, CVE-2023-52429).
  - commit 3ddaf98


author: colyli@suse.de
changelog:
  - Update to add CVE-2024-23851 tag,
    patches.suse/dm-limit-the-number-of-targets-and-parameter-size-ar.patch
    (bsc#1219827, bsc#1219146, CVE-2023-52429, CVE-2024-23851).
  - commit 7dd5c42


author: oneukum@suse.com
changelog:
  - PCI: Prevent xHCI driver from claiming AMD VanGogh USB3 DRD
    device (git-fixes).
  - commit 2012056


author: msuchanek@suse.de
changelog:
  - rpm templates: sort rpm tags
    The rpm tags in kernel spec files are sorted at random.
    Make the order of rpm tags somewhat more consistent across rpm spec
    templates.
  - commit 8875c35


author: dkirjanov@suse.com
changelog:
  - net: bonding: debug: avoid printing debug logs when bond is
    not notifying peers (git-fixes).
  - commit f58ad69


author: msuchanek@suse.de
changelog:
  - rpm templates: Aggregate subpackage descriptions
    While in some cases the package tags, description, scriptlets and
    filelist are located together in other cases they are all across the
    spec file. Aggregate the information related to a subpackage in one
    place.
  - commit 8eeb08c


author: msuchanek@suse.de
changelog:
  - kernel-binary: Move build script to the end
    All other spec templates have the build script at the end, only
    kernel-binary has it in the middle. Align with the other templates.
  - commit 98cbdd0


author: oneukum@suse.com
changelog:
  - USB: hub: check for alternate port before enabling
    A_ALT_HNP_SUPPORT (bsc#1218527).
  - commit aaefb30


author: jlee@suse.com
changelog:
  - net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
    (bsc#1219127 CVE-2024-23849).
  - commit e941df3


author: nik.borisov@suse.com
changelog:
  - KVM: VMX: Move VERW closer to VMentry for MDS mitigation (git-fixes).
  - KVM: VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (git-fixes).
  - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (git-fixes).
    Also add mds_user_clear to kABI severity as it's used purely for
    mitigation so it's low risk.
  - x86/entry_32: Add VERW just before userspace transition (git-fixes).
  - x86/entry_64: Add VERW just before userspace transition (git-fixes).
  - x86/bugs: Add asm helpers for executing VERW (bsc#1213456).
  - commit 7cd11ce


author: nik.borisov@suse.com
changelog:
  - KVM: x86: Move open-coded CPUID leaf 0x80000021 EAX bit propagation  code (git-fixes).
  - commit aebeb2d


author: msuchanek@suse.de
changelog:
  - compute-PATCHVERSION: Do not produce output when awk fails
    compute-PATCHVERSION uses awk to produce a shell script that is
    subsequently executed to update shell variables which are then printed
    as the patchversion.
    Some versions of awk, most notably bysybox-gawk do not understand the
    awk program and fail to run. This results in no script generated as
    output, and printing the initial values of the shell variables as
    the patchversion.
    When the awk program fails to run produce 'exit 1' as the shell script
    to run instead. That prevents printing the stale values, generates no
    output, and generates invalid rpm spec file down the line. Then the
    problem is flagged early and should be easier to diagnose.
  - commit 8ef8383


author: oneukum@suse.com
changelog:
  - usb: host: fotg210: fix the endpoint's transactional
    opportunities calculation (git-fixes).
  - commit f16fc26


author: oneukum@suse.com
changelog:
  - usb: musb: tusb6010: check return value after calling
    platform_get_resource() (git-fixes).
  - commit 3b8e34e


author: oneukum@suse.com
changelog:
  - media: dvb-usb: m920x: Fix a potential memory leak in
    m920x_i2c_xfer() (git-fixes).
  - commit 4716702


author: oneukum@suse.com
changelog:
  - media: dvb-usb: dw2102: fix uninit-value in
    su3000_read_mac_address (git-fixes).
  - commit abccca4


author: oneukum@suse.com
changelog:
  - media: coda: wake up capture queue on encoder stop after output
    streamoff (git-fixes).
  - Refresh
    patches.suse/media-coda-fix-last-buffer-handling-in-V4L2_ENC_CMD_.patch.
  - commit 4fba70d


author: oneukum@suse.com
changelog:
  - media: coda: reuse coda_s_fmt_vid_cap to propagate format in
    coda_s_fmt_vid_out (git-fixes).
  - commit 346be28


author: oneukum@suse.com
changelog:
  - media: rc: ir-rc6-decoder: enable toggle bit for Kathrein
    RCU-676 remote (git-fixes).
  - commit 40a7cdd


author: jslaby@suse.cz
changelog:
  - rpm/check-for-config-changes: add GCC_ASM_GOTO_OUTPUT_WORKAROUND to IGNORED_CONFIGS_RE
    Introduced by commit 68fb3ca0e408 ("update workarounds for gcc "asm
    goto" issue").
  - commit be1bdab


author: oneukum@suse.com
changelog:
  - media: dvb-usb: Add memory free on error path in dw2102_probe()
    (git-fixes).
  - Refresh
    patches.suse/media-dw2102-Fix-memleak-on-sequence-of-probes.patch.
  - commit 60bfc4d


author: oneukum@suse.com
changelog:
  - media: dw2102: make dvb_usb_device_description structures const
    (git-fixes).
  - Refresh
    patches.suse/media-dw2102-Fix-memleak-on-sequence-of-probes.patch.
  - commit cfe8bf2


author: oneukum@suse.com
changelog:
  - media: usb: dvd-usb: fix uninit-value bug in
    dibusb_read_eeprom_byte() (git-fixes).
  - commit 4772961


author: msuchanek@suse.de
changelog:
  - rpm templates: Move macro definitions below buildrequires
    Many of the rpm macros defined in the kernel packages depend directly or
    indirectly on script execution. OBS cannot execute scripts which means
    values of these macros cannot be used in tags that are required for OBS
    to see such as package name, buildrequires or buildarch.
    Accumulate macro definitions that are not directly expanded by mkspec
    below buildrequires and buildarch to make this distinction clear.
  - commit 89eaf4c


author: dkirjanov@suse.com
changelog:
  - net: hisilicon: make hip04_tx_reclaim non-reentrant (git-fixes).
  - Refresh
    patches.suse/net-hisilicon-Fix-ping-latency-when-deal-with-high-t.patch.
  - commit 1de9297


author: dkirjanov@suse.com
changelog:
  - net: tundra: tsi108: use spin_lock_irqsave instead of
    spin_lock_irq in IRQ context (git-fixes).
  - commit 3fddc2a


author: msuchanek@suse.de
changelog:
  - rpm templates: Always define usrmerged
    usrmerged is now defined in kernel-spec-macros and not the distribution.
    Only check if it's defined in kernel-spec-macros, not everywhere where
    it's used.
  - commit a6ad8af


author: iivanov@suse.de
changelog:
  - EDAC/thunderx: Fix possible out-of-bounds string access (bsc#1220330, CVE-2023-52464)
  - commit a228c17


author: denis.kirjanov@suse.com
changelog:
  - net: openvswitch: limit the number of recursions from action
    sets (bsc#1219835 CVE-2024-1151).
  - commit 9353f4f


author: dkirjanov@suse.com
changelog:
  - net/mlx5e: ethtool, Avoid setting speed to 56GBASE when autoneg
    off (git-fixes).
  - commit 38e0f13


author: dkirjanov@suse.com
changelog:
  - net: hisilicon: Fix usage of uninitialized variable in function
    mdio_sc_cfg_reg_write() (git-fixes).
  - commit 467a700


author: dkirjanov@suse.com
changelog:
  - igb: Fix constant media auto sense switching when no cable is
    connected (git-fixes).
  - commit ecbd46c


author: dkirjanov@suse.com
changelog:
  - net: hns3: add compatible handling for MAC VLAN switch parameter
    configuration (git-fixes).
  - commit 9cbe2e0


author: tbogendoerfer@suse.de
changelog:
  - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in
    error path (bsc#1220344 CVE-2024-26595).
  - commit 71c942e


author: denis.kirjanov@suse.com
changelog:
  - i40e: Fix use-after-free in i40e_client_subtask()
    (CVE-2021-46991 bsc#1220575).
  - commit 27d6f39


author: denis.kirjanov@suse.com
changelog:
  - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
    (CVE-2021-47013 bsc#1220641).
  - commit a848ac2


author: denis.kirjanov@suse.com
changelog:
  - netfilter: nftables: avoid overflows in nft_hash_buckets()
    (CVE-2021-46992 bsc#1220638).
  - commit c79b980


author: jlee@suse.com
changelog:
  - nfc: nci: fix possible NULL pointer dereference in
    send_acknowledge() (bsc#1219125 CVE-2023-46343).
  - commit 7ff1724


author: ddiss@suse.de
changelog:
  - apparmor: avoid crash when parsed profile name is empty
    (CVE-2023-52443 bsc#1220240).
  - commit 8387a56


author: tiwai@suse.de
changelog:
  - media: dvbdev: Fix memory leak in dvb_media_device_free()
    (CVE-2020-36777 bsc#1220526).
  - commit cd311ab


author: tiwai@suse.de
changelog:
  - media: pvrusb2: fix use after free on context disconnection
    (CVE-2023-52445 bsc#1220241).
  - commit f8f3542


author: denis.kirjanov@suse.com
changelog:
  - netfilter: nft_limit: avoid possible divide error in
    nft_limit_init (CVE-2021-46915 bsc#1220436).
  - commit 9130a3d


author: tiwai@suse.de
changelog:
  - NFC: st21nfca: Fix memory leak in device probe and remove
    (CVE-2021-46924 bsc#1220459).
  - commit 01b7814


author: jdelvare@suse.de
changelog:
  - i2c: cadence: fix reference leak when pm_runtime_get_sync fails
    (bsc#1220570 CVE-2020-36784).
  - commit 8727379


author: tiwai@suse.de
changelog:
  - Input: powermate - fix use-after-free in
    powermate_config_complete (CVE-2023-52475 bsc#1220649).
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
    (CVE-2023-52478 bsc#1220796).
  - commit 6daf909


author: ailiop@suse.com
changelog:
  - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
    (bsc#1220238 CVE-2023-52449).
  - commit a845e8b


author: jlee@suse.com
changelog:
  - ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe
    failure (bsc#1220599 CVE-2021-46953).
  - commit 69d8de2


author: osalvador@suse.de
changelog:
  - powerpc/pseries/memhp: Fix access beyond end of drmem array
    (bsc#1220250,CVE-2023-52451).
  - commit 22d7587


author: tiwai@suse.de
changelog:
  - Input: appletouch - initialize work before device registration
    (CVE-2021-46932 bsc#1220444).
  - commit 02010d5


author: oneukum@suse.com
changelog:
  - Bluetooth: hci_qca: don't call kfree_skb() under
    spin_lock_irqsave() (git-fixes).
  - commit 40c2728


author: oneukum@suse.com
changelog:
  - Bluetooth: hci_bcsp: don't call kfree_skb() under
    spin_lock_irqsave() (git-fixes).
  - commit 3114978


author: jwiesner@suse.de
changelog:
  - locking/barriers: Introduce smp_cond_load_relaxed() and
    atomic_cond_read_relaxed() (bsc#1220468 bsc#1050549).
  - commit 76b2073


author: jwiesner@suse.de
changelog:
  - locking/qrwlock: Fix ordering in queued_write_lock_slowpath()
    (CVE-2021-46921 bsc#1220468 bsc#1185041).
  - commit 9f2e845


author: oneukum@suse.com
changelog:
  - Bluetooth: hci_h5: don't call kfree_skb() under
    spin_lock_irqsave() (git-fixes).
  - commit e3ec875


author: oneukum@suse.com
changelog:
  - Bluetooth: hci_ll: don't call kfree_skb() under
    spin_lock_irqsave() (git-fixes).
  - commit 8e9750e


author: petr.pavlu@suse.com
changelog:
  - doc/README.SUSE: Update information about module support status
    (jsc#PED-5759)
    Following the code change in SLE15-SP6 to have externally supported
    modules no longer taint the kernel, update the respective documentation
    in README.SUSE:
    * Describe that support status can be obtained at runtime for each
    module from /sys/module/$MODULE/supported and for the entire system
    from /sys/kernel/supported. This provides a way how to now check that
    the kernel has any externally supported modules loaded.
    * Remove a mention that externally supported modules taint the kernel,
    but keep the information about bit 16 (X) and add a note that it is
    still tracked per module and can be read from
    /sys/module/$MODULE/taint. This per-module information also appears in
    Oopses.
  - commit 9ed8107


author: ailiop@suse.com
changelog:
  - tomoyo: fix UAF write bug in tomoyo_write_control() (bsc#1220825
    CVE-2024-26622).
  - commit e934259


author: denis.kirjanov@suse.com
changelog:
  - Update patches.suse/sctp-use-call_rcu-to-free-endpoint.patch
    (CVE-2022-20154 CVE-2021-46929 bsc#1200599 bsc#1220482).
  - commit 23c3231


author: mkubecek@suse.cz
changelog:
  - netfilter: nf_tables: fix 64-bit load issue in
    nft_byteorder_eval() (CVE-2024-0607 bsc#1218915).
  - netfilter: nf_tables: fix pointer math issue in
    nft_byteorder_eval() (CVE-2024-0607 bsc#1218915).
  - commit b635ad7


author: mkubecek@suse.cz
changelog:
  - kabi: restore return type of dst_ops::gc() callback
    (CVE-2023-52340 bsc#1219295).
  - ipv6: remove max_size check inline with ipv4 (CVE-2023-52340
    bsc#1219295).
  - commit dd00c24


author: mkubecek@suse.cz
changelog:
  - tls: fix race between tx work scheduling and socket close
    (CVE-2024-26585 bsc#1220187).
  - commit 2d824be


author: denis.kirjanov@suse.com
changelog:
  - net: nfc: fix races in nfc_llcp_sock_get() and
    nfc_llcp_sock_get_sn() (CVE-2023-52502 bsc#1220831).
  - commit d0dd97d


author: oneukum@suse.com
changelog:
  - usb: storage: set 1.50 as the lower bcdDevice for older "Super
    Top" compatibility (git-fixes).
  - commit 680e979


author: tiwai@suse.de
changelog:
  - wifi: mac80211: fix potential key use-after-free (CVE-2023-52530
    bsc#1220930).
  - wifi: iwlwifi: mvm: Fix a memory corruption issue
    (CVE-2023-52531 bsc#1220931).
  - commit 4749167


author: shung-hsi.yu@suse.com
changelog:
  - Update reference of bpf-Fix-masking-negation-logic-upon-negative-dst-reg.patch
    (bsc#1186484,CVE-2021-33200,bsc#1220700,CVE-2021-46974).
  - commit d334f65


author: tbogendoerfer@suse.de
changelog:
  - ravb: Fix use-after-free issue in ravb_tx_timeout_work()
    (bsc#1212514 CVE-2023-35827).
  - team: fix null-ptr-deref when team device type is changed
    (bsc#1220870 CVE-2023-52574).
  - commit 36ef587


author: msuchanek@suse.de
changelog:
  - Refresh patches.suse/0001-powerpc-pseries-memhp-Fix-access-beyond-end-of-drmem.patch.
    Refresh patch metadata and sort.
  - commit 15cb428


author: lduncan@suse.com
changelog:
  - scsi: qedf: Add pointer checks in qedf_update_link_speed()
    (bsc#1220861 CVE-2021-47077).
  - commit 499d19e


author: nik.borisov@suse.com
changelog:
  - x86/rfds: Mitigate Register File Data Sampling (RFDS) (bsc#1213456 CVE-2023-28746).
  - Update config files.
  - Refresh patches.kabi/cpufeatures-kabi-fix.patch.
  - commit 47b68f4


author: msuchanek@suse.de
changelog:
  - kernel-binary: vdso: fix filelist for non-usrmerged kernel
    Fixes: a6ad8af207e6 ("rpm templates: Always define usrmerged")
  - commit fb3f221


author: jslaby@suse.cz
changelog:
  - vt: fix memory overlapping when deleting chars in the buffer
    (bsc#1220845 CVE-2022-48627).
  - commit 6d7d615


author: jslaby@suse.cz
changelog:
  - x86/srso: Add SRSO mitigation for Hygon processors (bsc#1220735
    CVE-2023-52482).
  - commit c7d3dd8


author: msuchanek@suse.de
changelog:
  - kernel-binary: Fix i386 build
    Fixes: 89eaf4cdce05 ("rpm templates: Move macro definitions below buildrequires")
  - commit f7c6351


author: oneukum@suse.com
changelog:
  - net: hso: fix null-ptr-deref during tty device unregistration
    (bsc#1220416 CVE-2021-46904).
  - commit d61504e


author: oneukum@suse.com
changelog:
  - net: hso: fix NULL-deref on disconnect regression (bsc#1220416
    CVE-2021-46904).
  - commit fe1eee0


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add d4ccd54d28d3 exit: Put an upper limit on how often we can oops
    and its dependant.
  - commit 64ce341


author: nmorey@suse.com
changelog:
  - RDMA/rxe: Return CQE error if invalid lkey was supplied (bsc#1220860 CVE-2021-47076)
  - commit 3f60a4e


author: iivanov@suse.de
changelog:
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (bsc#1220340,CVE-2024-26600)
  - commit 20e2c08


author: oneukum@suse.com
changelog:
  - Update
    patches.suse/net-hso-fix-NULL-deref-on-disconnect-regression.patch
    (bsc#1220416 bsc#1220418 CVE-2021-46905 CVE-2021-46904).
    Added second CVE reference
  - commit f72c3a5


author: dkirjanov@suse.com
changelog:
  - blacklist.conf: update blacklist
    The entries added in the commit are temporary ones so once
    MU is done I'll revert the commit
  - commit 874c87d


author: msuchanek@suse.de
changelog:
  - group-source-files.pl: Quote filenames (boo#1221077).
    The kernel source now contains a file with a space in the name.
    Add quotes in group-source-files.pl to avoid splitting the filename.
    Also use -print0 / -0 when updating timestamps.
  - commit a005e42


author: pjakobsson@suse.de
changelog:
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (bsc#1220411 CVE-2023-52469).
  - commit 3357315


author: pjakobsson@suse.de
changelog:
  - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (bsc#1220413 CVE-2023-52470).
  - commit f1a2e90


author: oneukum@suse.com
changelog:
  - lan78xx: enable auto speed configuration for LAN7850 if no
    EEPROM is detected (git-fixes).
  - commit 3edfed0


author: oneukum@suse.com
changelog:
  - net: lan78xx: Merge memcpy + lexx_to_cpus to get_unaligned_lexx
    (git-fixes).
  - lan78xx: Do not access skb_queue_head list pointers directly
    (git-fixes).
  - commit f2cbfb9


author: oneukum@suse.com
changelog:
  - lan78xx: Add missing return code checks (git-fixes).
  - Refresh
    patches.suse/bsc1084332-0003-lan78xx-Enable-LEDs-and-auto-negotiation.patch.
  - Refresh
    patches.suse/lan78xx-Fix-exception-on-link-speed-change.patch.
  - commit 5704b69


author: nik.borisov@suse.com
changelog:
  - Refresh patches.kabi/cpufeatures-kabi-fix.patch. (bsc#1221287)
    X86_FEATURE_LFENCE_RDTSC became an extended bit and was set via
    cpu_set_cap as opposed to setup_force_cpu_cap. So extend the
    infrastructure to also cover cpu_set_cap.
  - commit 3fcb500


author: oneukum@suse.com
changelog:
  - usb: hub: Guard against accesses to uninitialized BOS
    descriptors (bsc#1220790 CVE-2023-52477).
  - commit bf5af19


author: lhenriques@suse.de
changelog:
  - ceph: fix deadlock or deadcode of misusing dget() (bsc#1221058
    CVE-2023-52583).
  - commit a413cb6


author: tbogendoerfer@suse.de
changelog:
  - Refresh patches.kabi/team-Hide-new-member-header-ops.patch.
    Fix for kABI workaround.
  - commit f1bcdf5


author: mbrugger@suse.com
changelog:
  - ARM: 9064/1: hw_breakpoint: Do not directly check the event's
    overflow_handler hook (bsc#1220751 CVE-2021-47006).
  - commit 605e3a7


author: vkarasulli@suse.de
changelog:
  - iommu/amd: Increase interrupt remapping table limit to 512
    entries (git-fixes).
  - commit c290a72


author: nik.borisov@suse.com
changelog:
  - Sort patches that are already upstream
  - Refresh
    patches.suse/Documentation-hw-vuln-Add-documentation-for-RFDS.patch.
  - Refresh
    patches.suse/KVM-x86-Export-RFDS_NO-and-RFDS_CLEAR-to-guests.patch.
  - Refresh
    patches.suse/x86-rfds-Mitigate-Register-File-Data-Sampling-RFDS.patch.
  - commit 031146a


author: nik.borisov@suse.com
changelog:
  - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (bsc#1213456 CVE-2023-28746).
  - commit c5b2dec


author: mkoutny@suse.com
changelog:
  - net/sched: Remove alias of sch_clsact (bsc#1210335 CVE-2023-1829).
  - net/sched: Load modules via their alias (bsc#1210335 CVE-2023-1829).
  - net/sched: Add module aliases for cls_,sch_,act_ modules
    (bsc#1210335 CVE-2023-1829).
  - net/sched: Add helper macros with module names (bsc#1210335 CVE-2023-1829).
  - commit 609fe5f


author: neilb@suse.de
changelog:
  - NFSD: Retransmit callbacks after client reconnects (git-fixes).
  - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (git-fixes).
  - SUNRPC: fix some memleaks in gssx_dec_option_array (git-fixes).
  - NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
    (git-fixes).
  - SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
    (git-fixes).
  - nfsd: lock_rename() needs both directories to live on the same
    fs (git-fixes).
  - pNFS/flexfiles: Check the layout validity in
    ff_layout_mirror_prepare_stats (git-fixes).
  - commit 311216b


author: jlee@suse.com
changelog:
  - Input: add bounds checking to input_set_capability()
    (bsc#1218220 CVE-2022-48619).
  - commit f42351b


author: oneukum@suse.com
changelog:
  - usb: dwc3: core: Do core softreset when switch mode (bsc#1220628
    CVE-2021-46941).
  - blacklist.conf: needed after all for a CVE
  - Refresh
    patches.suse/USB-dwc3-fix-runtime-pm-imbalance-on-probe-errors.patch.
  - Refresh
    patches.suse/usb-dwc3-Fix-race-between-dwc3_set_mode-and-__dwc3_s.patch.
  - commit 7ca4d31


author: jack@suse.cz
changelog:
  - fs: Establish locking order for unrelated directories
    (bsc#1221044 CVE-2023-52591).
  - commit c49cfde


author: jack@suse.cz
changelog:
  - fs: Restrict lock_two_nondirectories() to non-directory inodes
    (bsc#1221044 CVE-2023-52591).
  - commit 2042147


author: jack@suse.cz
changelog:
  - reiserfs: Avoid touching renamed directory if parent does not
    change (git-fixes bsc#1221044 CVE-2023-52591).
    Refresh patches.suse/reiserfs-add-check-to-detect-corrupted-directory-entry.patch
    Refresh patches.suse/reiserfs-don-t-panic-on-bad-directory-entries.patch
  - commit 304c6b9


author: jack@suse.cz
changelog:
  - ocfs2: Avoid touching renamed directory if parent does not
    change (bsc#1221044 CVE-2023-52591).
  - commit ef44829


author: jack@suse.cz
changelog:
  - udf_rename(): only access the child content on cross-directory
    rename (bsc#1221044 CVE-2023-52591).
  - commit 3e77e59


author: jack@suse.cz
changelog:
  - ext2: Avoid reading renamed directory if parent does not change
    (bsc#1221044 CVE-2023-52591).
  - commit 47af51c


author: jack@suse.cz
changelog:
  - ext4: don't access the source subdirectory content on
    same-directory rename (bsc#1221044 CVE-2023-52591).
  - commit e81c5d2


author: jack@suse.cz
changelog:
  - f2fs: Avoid reading renamed directory if parent does not change
    (bsc#1221044 CVE-2023-52591).
  - commit 95ecb76


author: jack@suse.cz
changelog:
  - rename(): avoid a deadlock in the case of parents having no
    common ancestor (bsc#1221044 CVE-2023-52591).
  - commit 16f9b33


author: jlee@suse.com
changelog:
  - aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
    (bsc#1218562 CVE-2023-6270).
  - commit 4e659c8


author: tzimmermann@suse.com
changelog:
  - drm: bridge/panel: Cleanup connector on bridge detach (bsc#1220777, CVE-2021-47063)
    Backporting changes:
  - add patch at the top of panel_bridge_detach()
  - commit 760a99d


author: dwagner@suse.de
changelog:
  - scsi: qla2xxx: Update version to 10.02.09.200-k (bsc1221816).
  - scsi: qla2xxx: Delay I/O Abort on PCI error (bsc1221816).
  - scsi: qla2xxx: Change debug message during driver unload
    (bsc1221816).
  - scsi: qla2xxx: Fix double free of fcport (bsc1221816).
  - scsi: qla2xxx: Fix double free of the ha->vp_map pointer
    (bsc1221816).
  - scsi: qla2xxx: Fix command flush on cable pull (bsc1221816).
  - scsi: qla2xxx: NVME|FCP prefer flag not being honored
    (bsc1221816).
  - scsi: qla2xxx: Update manufacturer detail (bsc1221816).
  - scsi: qla2xxx: Split FCE|EFT trace control (bsc1221816).
  - scsi: qla2xxx: Fix N2N stuck connection (bsc1221816).
  - scsi: qla2xxx: Prevent command send on chip reset (bsc1221816).
  - commit 61951e8


author: jlee@suse.com
changelog:
  - Bluetooth: rfcomm: Fix null-ptr-deref in rfcomm_check_security
    (bsc#1219170 CVE-2024-22099).
  - commit f6c10f5


author: neilb@suse.de
changelog:
  - NFS: Fix an off by one in root_nfs_cat() (git-fixes).
  - net: sunrpc: Fix an off by one in rpc_sockaddr2uaddr()
    (git-fixes).
  - SUNRPC: fix a memleak in gss_import_v2_context (git-fixes).
  - NFS: More O_DIRECT accounting fixes for error paths (git-fixes).
  - NFS: Fix error handling for O_DIRECT write scheduling
    (git-fixes).
  - nfs: only issue commit in DIO codepath if we have uncommitted
    data (git-fixes).
  - NFS: Fix a request reference leak in
    nfs_direct_write_clear_reqs() (git-fixes).
  - NFS: Fix O_DIRECT commit verifier handling (git-fixes).
  - NFS: commit errors should be fatal (git-fixes).
  - commit c3fe0ca


author: neilb@suse.de
changelog:
  - pNFS: Fix the pnfs block driver's calculation of layoutget size
    (git-fixes).
  - NFS: Fix O_DIRECT locking issues (git-fixes).
  - NFS: Fix direct WRITE throughput regression (git-fixes).
  - commit 53dafcd


author: neilb@suse.de
changelog:
  - kabi fix for pNFS: Fix the pnfs block driver's calculation of
    layoutget size (git-fixes).
  - commit 188e451


author: jlee@suse.com
changelog:
  - wifi: ath10k: fix NULL pointer dereference in
    ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() (bsc#1218336
    CVE-2023-7042).
  - commit 1463c4a


author: mfranc@suse.cz
changelog:
  - s390/ptrace: handle setting of fpc register correctly
    (CVE-2023-52598 bsc#1221060 git-fixes).
  - commit 0d179a3


author: nmorey@suse.com
changelog:
  - IB/hfi1: Fix bugs with non-PAGE_SIZE-end multi-iovec user SDMA requests (bsc#1220445 CVE-2023-52474)
  - commit 71ecb14


author: mkoutny@suse.com
changelog:
  - Update
    patches.suse/netlabel-fix-out-of-bounds-memory-accesses.patch
    (networking-stable-19_03_07 CVE-2019-25160 bsc#1220394).
  - commit cfd1daa


author: mkoutny@suse.com
changelog:
  - Update
    patches.suse/0019-dm-rq-fix-double-free-of-blk_mq_tag_set-in-dev-remov.patch
    (git fixes CVE-2021-46938 bsc#1220554).
  - Update
    patches.suse/ACPI-custom_method-fix-potential-use-after-free-issu.patch
    (git-fixes CVE-2021-46966 bsc#1220572).
  - Update
    patches.suse/ARM-footbridge-fix-PCI-interrupt-mapping.patch
    (git-fixes CVE-2021-46909 bsc#1220442).
  - Update
    patches.suse/IB-qib-Fix-memory-leak-in-qib_user_sdma_queue_pkts.patch
    (git-fixes CVE-2021-47104 bsc#1220960).
  - Update
    patches.suse/NFC-nci-fix-memory-leak-in-nci_allocate_device.patch
    (git-fixes CVE-2021-47180 bsc#1221999).
  - Update
    patches.suse/NFS-Don-t-corrupt-the-value-of-pg_bytes_written-in-n.patch
    (git-fixes CVE-2021-47166 bsc#1221998).
  - Update
    patches.suse/NFS-Fix-an-Oopsable-condition-in-__nfs_pageio_add_re.patch
    (git-fixes CVE-2021-47167 bsc#1221991).
  - Update
    patches.suse/NFS-fix-an-incorrect-limit-in-filelayout_decode_layo.patch
    (git-fixes CVE-2021-47168 bsc#1222002).
  - Update
    patches.suse/NFSv4-Fix-a-NULL-pointer-dereference-in-pnfs_mark_ma.patch
    (git-fixes CVE-2021-47179 bsc#1222001).
  - Update
    patches.suse/asix-fix-uninit-value-in-asix_mdio_read.patch
    (git-fixes CVE-2021-47101 bsc#1220987).
  - Update
    patches.suse/bnxt_en-Fix-RX-consumer-index-logic-in-the-error-pat.patch
    (git-fixes CVE-2021-47015 bsc#1220794).
  - Update
    patches.suse/btrfs-fix-race-between-transaction-aborts-and-fsyncs.patch
    (bsc#1186441 CVE-2021-46958 bsc#1220521).
  - Update
    patches.suse/cifs-Return-correct-error-code-from-smb2_get_enc_key.patch
    (git-fixes CVE-2021-46960 bsc#1220528).
  - Update
    patches.suse/crypto-qat-ADF_STATUS_PF_RUNNING-should-be-set-after.patch
    (git-fixes CVE-2021-47056 bsc#1220769).
  - Update
    patches.suse/cxgb4-avoid-accessing-registers-when-clearing-filter.patch
    (bsc#1136345 jsc#SLE-4681 CVE-2021-47138 bsc#1221934).
  - Update patches.suse/drm-amdgpu-Fix-a-use-after-free.patch
    (git-fixes CVE-2021-47142 bsc#1221952).
  - Update
    patches.suse/drm-meson-fix-shutdown-crash-when-component-not-prob.patch
    (git-fixes CVE-2021-47165 bsc#1221965).
  - Update
    patches.suse/ethernet-enic-Fix-a-use-after-free-bug-in-enic_hard_.patch
    (bsc#1113431 CVE-2021-46998 bsc#1220625).
  - Update
    patches.suse/ext4-fix-bug-on-in-ext4_es_cache_extent-as-ext4_spli.patch
    (bsc#1187408 CVE-2021-47117 bsc#1221575).
  - Update
    patches.suse/ext4-fix-memory-leak-in-ext4_fill_super.patch
    (bsc#1187409 CVE-2021-47119 bsc#1221608).
  - Update
    patches.suse/gve-Add-NULL-pointer-checks-when-freeing-irqs.patch
    (bsc#1176940 CVE-2021-47141 bsc#1221949).
  - Update
    patches.suse/i2c-i801-Don-t-generate-an-interrupt-on-bus-reset.patch
    (git-fixes CVE-2021-47153 bsc#1221969).
  - Update patches.suse/iommu-vt-d-fix-sysfs-leak-in-alloc_iommu
    (bsc#1189272 CVE-2021-47177 bsc#1221997).
  - Update
    patches.suse/ipmi-Fix-UAF-when-uninstall-ipmi_si-and-ipmi_msghand.patch
    (git-fixes CVE-2021-47100 bsc#1220985).
  - Update
    patches.suse/kvm-destroy-i-o-bus-devices-on-unregister-failure-after_-sync-ing-srcu
    (CVE-2020-36312 bsc#1184509 CVE-2021-47061 bsc#1220745).
  - Update
    patches.suse/kvm-stop-looking-for-coalesced-mmio-zones-if-the-bus-is-destroyed
    (CVE-2020-36312 bsc#1184509 CVE-2021-47060 bsc#1220742).
  - Update
    patches.suse/md-raid1-properly-indicate-failure-when-ending-a-fai.patch
    (bsc#1185680 CVE-2021-46950 bsc#1220662).
  - Update
    patches.suse/misc-uss720-fix-memory-leak-in-uss720_probe.patch
    (git-fixes CVE-2021-47173 bsc#1221993).
  - Update
    patches.suse/msft-hv-2305-Drivers-hv-vmbus-Use-after-free-in-__vmbus_open.patch
    (git-fixes CVE-2021-47049 bsc#1220692).
  - Update
    patches.suse/msft-hv-2316-uio_hv_generic-Fix-a-memory-leak-in-error-handling-p.patch
    (git-fixes CVE-2021-47071 bsc#1220846).
  - Update
    patches.suse/msft-hv-2317-uio_hv_generic-Fix-another-memory-leak-in-error-hand.patch
    (git-fixes CVE-2021-47070 bsc#1220829).
  - Update
    patches.suse/mtd-require-write-permissions-for-locking-and-badblo.patch
    (git-fixes CVE-2021-47055 bsc#1220768).
  - Update
    patches.suse/nbd-Fix-NULL-pointer-in-flush_workqueue-79eb.patch
    (git-fixes CVE-2021-46981 bsc#1220611).
  - Update
    patches.suse/net-fec-fix-the-potential-memory-leak-in-fec_enet_in.patch
    (git-fixes CVE-2021-47150 bsc#1221973).
  - Update
    patches.suse/net-nfc-fix-use-after-free-llcp_sock_bind-connect.patch
    (CVE-2021-23134 bsc#1186060 CVE-2021-47068 bsc#1220739).
  - Update
    patches.suse/net-smc-remove-device-from-smcd_dev_list-after-failed-device_add
    (git-fixes CVE-2021-47143 bsc#1221988).
  - Update
    patches.suse/net-usb-fix-memory-leak-in-smsc75xx_bind.patch
    (git-fixes CVE-2021-47171 bsc#1221994).
  - Update patches.suse/ocfs2-fix-data-corruption-by-fallocate.patch
    (bsc#1187412 CVE-2021-47114 bsc#1221548).
  - Update
    patches.suse/pid-take-a-reference-when-initializing-cad_pid.patch
    (bsc#1114648 CVE-2021-47118 bsc#1221605).
  - Update
    patches.suse/platform-x86-dell-smbios-wmi-Fix-oops-on-rmmod-dell_.patch
    (git-fixes CVE-2021-47073 bsc#1220850).
  - Update
    patches.suse/powerpc-64s-Fix-crashes-when-toggling-entry-flush-ba.patch
    (bsc#1177666 git-fixes bsc#1186460 ltc#192531 CVE-2021-46990
    bsc#1220743).
  - Update
    patches.suse/powerpc-64s-Fix-pte-update-for-kernel-memory-on-radi.patch
    (bsc#1055117 git-fixes CVE-2021-47034 bsc#1220687).
  - Update
    patches.suse/scsi-lpfc-Fix-null-pointer-dereference-in-lpfc_prep_.patch
    (bsc#1182574 CVE-2021-47045 bsc#1220640).
  - Update
    patches.suse/scsi-qla2xxx-Fix-crash-in-qla2xxx_mqueuecommand.patch
    (bsc#1185491 CVE-2021-46963 bsc#1220536).
  - Update patches.suse/scsi-qla2xxx-Reserve-extra-IRQ-vectors.patch
    (bsc#1185491 CVE-2021-46964 bsc#1220538).
  - Update
    patches.suse/serial-rp2-use-request_firmware-instead-of-request_f.patch
    (git-fixes CVE-2021-47169 bsc#1222000).
  - Update
    patches.suse/tracing-Restructure-trace_clock_global-to-never-block.patch
    (git-fixes CVE-2021-46939 bsc#1220580).
  - Update
    patches.suse/vsock-virtio-free-queued-packets-when-closing-socket.patch
    (git-fixes CVE-2021-47024 bsc#1220637).
  - Update
    patches.suse/x86-kvm-Disable-kvmclock-on-all-CPUs-on-shutdown.patch
    (bsc#1185308 CVE-2021-47110 bsc#1221532).
  - Update
    patches.suse/x86-kvm-Teardown-PV-features-on-boot-CPU-as-well.patch
    (bsc#1185308 CVE-2021-47112 bsc#1221541).
  - commit fa763cd


author: mkoutny@suse.com
changelog:
  - Update patches.suse/mmc-moxart_remove-Fix-UAF.patch (bsc#1194516
    CVE-2022-0487 CVE-2022-48626 bsc#1220366).
  - commit 10fc152


author: mkoutny@suse.com
changelog:
  - Update
    patches.suse/net-nfc-llcp-Add-lock-when-modifying-device-list.patch
    (git-fixes CVE-2023-52524 bsc#1220927).
  - Update
    patches.suse/net-usb-smsc75xx-Fix-uninit-value-access-in-__smsc75.patch
    (git-fixes CVE-2023-52528 bsc#1220843).
  - Update
    patches.suse/nvmet-tcp-Fix-a-kernel-panic-when-host-sends-an-inva.patch
    (bsc#1217987 bsc#1217988 bsc#1217989 CVE-2023-6535 CVE-2023-6536
    CVE-2023-6356 CVE-2023-52454 bsc#1220320).
  - Update
    patches.suse/ocfs2-Avoid-touching-renamed-directory-if-parent-doe.patch
    (bsc#1221044 CVE-2023-52591 CVE-2023-52590 bsc#1221088).
  - Update
    patches.suse/ravb-Fix-use-after-free-issue-in-ravb_tx_timeout_wor.patch
    (bsc#1212514 CVE-2023-35827 CVE-2023-52509 bsc#1220836).
  - Update
    patches.suse/x86-srso-fix-sbpb-enablement-for-spec_rstack_overflow-off.patch
    (git-fixes CVE-2023-52575 bsc#1220871).
  - commit 2258ead


author: msuchanek@suse.de
changelog:
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add
    (CVE-2023-52607 bsc#1221061).
  - commit af6f33a


author: vbabka@suse.cz
changelog:
  - userfaultfd: release page in error path to avoid BUG_ON
    (CVE-2021-46988 bsc#1220706).
  - commit bcafeec


author: tbogendoerfer@suse.de
changelog:
  - tcp: make sure init the accept_queue's spinlocks once
    (bsc#1221293 CVE-2024-26614).
  - commit 800aa0a


author: tbogendoerfer@suse.de
changelog:
  - ipv6: init the accept_queue's spinlocks in inet6_create
    (bsc#1221293 CVE-2024-26614).
  - commit 6bea6a5


author: oneukum@suse.com
changelog:
  - usb: dwc3: core: Do not perform GCTL_CORE_SOFTRESET during
    bootup (bsc#1220628 CVE-2021-46941).
  - commit ebce255


author: dkirjanov@suse.com
changelog:
  - ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram (git-fixes).
  - commit 6895e10


author: dkirjanov@suse.com
changelog:
  - net: allwinner: Fix some resources leak in the error handling path of the probe and in the remove function (git-fixes).
  - commit d464181


author: mkubecek@suse.cz
changelog:
  - netfilter: ctnetlink: fix possible refcount leak in
    ctnetlink_create_conntrack() (CVE-2023-7192 bsc#1218479).
  - commit 0774a95


author: mkubecek@suse.cz
changelog:
  - netfilter: nf_tables: disallow anonymous set with timeout flag
    (CVE-2024-26642 bsc#1221830).
  - commit b3d18fd


author: dkirjanov@suse.com
changelog:
  - net: macb: ensure the device is available before accessing
    GEMGXL control registers (git-fixes).
  - commit 1742349


author: shung-hsi.yu@suse.com
changelog:
  - bpf, sockmap: Prevent lock inversion deadlock in map delete elem
    (bsc#1209657 CVE-2023-0160).
  - commit 40497a8


author: vkarasulli@suse.de
changelog:
  - media: xc4000: Fix atomicity violation in xc4000_get_frequency
    (git-fixes bsc#1219623 CVE-2024-24861).
  - commit ad0b314


author: vkarasulli@suse.de
changelog:
  - scsi: lpfc: Fix a possible data race in
    lpfc_unregister_fcf_rescan() (bsc#1219618 CVE-2024-24855).
  - commit 6004b44


author: dkirjanov@suse.com
changelog:
  - Delete
    patches.suse/x86-bugs-Fix-the-SRSO-mitigation-on-Zen3-4.patch.
    the kernel fails to boot on x86:
    [    0.048461] MDS: Vulnerable: Clear CPU buffers attempted, no microcode
    [    0.048698] MMIO Stale Data: Unknown: No mitigations
    qemu-system-x86_64: terminating on signal 15 from pid 42034 (timeout)
  - commit 035c88f


author: jack@suse.cz
changelog:
  - Fixup NULL ptr dereference due to mistake in backporting in
    patches.suse/ext2-Avoid-reading-renamed-directory-if-parent-does-.patch.
  - commit 55001e0


author: nik.borisov@suse.com
changelog:
  - x86/bhi: Add support for clearing branch history at syscall entry (bsc#1217339 CVE-2024-2201).
  - Refresh patches.kabi/cpufeatures-kabi-fix.patch.
  - commit 955ab56


author: nik.borisov@suse.com
changelog:
  - x86/bhi: Enumerate Branch History Injection (BHI) bug (bsc#1217339 CVE-2024-2201).
  - commit 2432a6f


author: nik.borisov@suse.com
changelog:
  - x86/bhi: Add BHI mitigation knob (bsc#1217339 CVE-2024-2201).
  - Update config files.
  - commit 41d6371


author: mfranc@suse.cz
changelog:
  - Update
    patches.suse/KVM-s390-vsie-fix-race-during-shadow-creation.patch
    (git-fixes bsc#1220613 CVE-2023-52639 bsc#1222300).
  - Update
    patches.suse/netfilter-nftables-exthdr-fix-4-byte-stack-OOB-write.patch
    (CVE-2023-4881 bsc#1215221 CVE-2023-52628 bsc#1222117).
  - commit 5564fa1


author: nik.borisov@suse.com
changelog:
  - Refresh patches.kabi/cpufeatures-kabi-fix.patch.
    Fix aliasing problems if we have an extended capability which aliases a
    non-extended bug bit. The fix is to always ensure that bug bits related
    functionality doesn't use the "generic" cap functionality.
  - commit c674af2


author: tbogendoerfer@suse.de
changelog:
  - gtp: fix use-after-free and null-ptr-deref in gtp_newlink()
    (bsc#1222428 CVE-2024-26793).
  - gtp: fix use-after-free and null-ptr-deref in
    gtp_genl_dump_pdp() (bsc#1222428 CVE-2024-26793).
  - commit 9c6b7d6


author: dkirjanov@suse.com
changelog:
  - Refresh
    patches.suse/bpf-sockmap-Prevent-lock-inversion-deadlock-in-map-d.patch.
  - commit 6490813


author: jack@suse.cz
changelog:
  - ext4: fix double-free of blocks due to wrong extents moved_len
    (bsc#1222422 CVE-2024-26704).
  - commit da029ac


author: oneukum@suse.com
changelog:
  - Bluetooth: btqcomsmd: Fix command timeout after setting BD
    address (git-fixes).
  - commit de57587


author: oneukum@suse.com
changelog:
  - Refresh
    patches.suse/Bluetooth-btsdio-fix-use-after-free-bug-in-btsdio_re.patch.
    Add alternate ID for stable
  - commit 38c4e25


author: jslaby@suse.cz
changelog:
  - PCI: endpoint: Don't stop controller when unbinding endpoint
    function (git-fixes).
  - PCI: qcom: Fix unbalanced PHY init on probe errors (git-fixes).
  - PCI: Avoid pci_dev_lock() AB/BA deadlock with
    sriov_numvfs_store() (git-fixes).
  - PCI/PM: Power up all devices during runtime resume (git-fixes).
  - PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits (git-fixes).
  - PCI: aardvark: Fix setting MSI address (git-fixes).
  - PCI: aardvark: Fix support for MSI interrupts (git-fixes).
  - commit fd2813d


author: jslaby@suse.cz
changelog:
  - PCI/ASPM: Disable ASPM on MFD function removal to avoid
    use-after-free (git-fixes).
  - PCI: pciehp: Fix AB-BA deadlock between reset_lock and
    device_lock (git-fixes).
  - PCI: switchtec: Return -EFAULT for copy_to_user() errors
    (git-fixes).
  - PCI: Avoid FLR for AMD FCH AHCI adapters (git-fixes).
  - PCI/IOV: Enlarge virtfn sysfs name buffer (git-fixes).
  - PCI: hotplug: Allow marking devices as disconnected during
    bind/unbind (git-fixes).
  - PCI: dwc: Add unroll iATU space support to dw_pcie_disable_atu()
    (git-fixes).
  - PCI: Add ACS quirk for Broadcom BCM5750x NICs (git-fixes).
  - commit 60d94f2


author: mkubecek@suse.cz
changelog:
  - net/sched: act_mirred: don't override retval if we already
    lost the skb (CVE-2024-26733 bsc#1222585).
  - commit ec837ad


author: jslaby@suse.cz
changelog:
  - PCI: Mark 3ware-9650SE Root Port Extended Tags as broken
    (git-fixes).
  - PCI/DPC: Print all TLP Prefixes, not just the first (git-fixes).
  - PCI/MSI: Prevent MSI hardware interrupt number truncation
    (git-fixes).
  - PCI/sysfs: Protect driver's D3cold preference from user space
    (git-fixes).
  - PCI/ASPM: Use RMW accessors for changing LNKCTL (git-fixes).
  - PCI: pciehp: Use RMW accessors for changing LNKCTL (git-fixes).
  - PCI: Make link retraining use RMW accessors for changing LNKCTL
    (git-fixes).
  - PCI: Add locking to RMW PCI Express Capability Register
    accessors (git-fixes).
  - kABI: PCI: Add locking to RMW PCI Express Capability Register
    accessors (kabi).
  - PCI: qcom: Use DWC helpers for modifying the read-only DBI
    registers (git-fixes).
  - PCI: qcom: Disable write access to read only registers for IP
    v2.3.3 (git-fixes).
  - PCI: Add function 1 DMA alias quirk for Marvell 88SE9235
    (git-fixes).
  - PCI: pciehp: Cancel bringup sequence if card is not present
    (git-fixes).
  - PCI/ASPM: Avoid link retraining race (git-fixes).
  - commit 5d813c6


author: mhocko@suse.com
changelog:
  - Update
    patches.suse/usb-musb-tusb6010-check-return-value-after-calling-p.patch
    (git-fixes CVE-2021-47181 bsc#1222660).
  - commit a0f1eaa


author: mhocko@suse.com
changelog:
  - Update
    patches.suse/scsi-lpfc-Fix-link-down-processing-to-address-NULL-p.patch
    (bsc#1192145 CVE-2021-47183 bsc#1222664).
  - commit b599f2b


author: nik.borisov@suse.com
changelog:
  - Refresh patches.suse/x86-bhi-Add-BHI-mitigation-knob.patch.
    Check for bug presence with cpu_has_bug rather than cpu_has so that
    overlapping bug/feature bits are handled correctly
  - commit ec98c66


author: jslaby@suse.cz
changelog:
  - PCI/ASPM: Factor out pcie_wait_for_retrain() (git-fixes).
  - PCI/ASPM: Return 0 or -ETIMEDOUT from  pcie_retrain_link()
    (git-fixes).
  - PCI: Rework pcie_retrain_link() wait loop (git-fixes).
  - commit 4a0cd5a


author: jslaby@suse.cz
changelog:
  - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc
    (bsc#1222669 CVE-2021-47185).
  - commit 24cc88e


author: mhocko@suse.com
changelog:
  - Update
    patches.suse/btrfs-fix-memory-ordering-between-normal-and-ordered-work-functions.patch
    (git-fixes CVE-2021-47189 bsc#1222706).
  - commit d1ad6f0


author: mhocko@suse.com
changelog:
  - Update
    patches.suse/gtp-fix-use-after-free-and-null-ptr-deref-in-gtp_gen.patch
    (bsc#1222428 CVE-2024-26793 CVE-2024-26754 bsc#1222632).
  - commit b4d8fa6


author: dkirjanov@suse.com
changelog:
  - netlink: Fix kernel-infoleak-after-free in __skb_datagram_iter
    (bsc#1222630 CVE-2024-26805).
  - commit ad84c88


author: iivanov@suse.de
changelog:
  - dmaengine: ti: edma: Add some null pointer checks to the edma_probe (CVE-2024-26771 bsc#1222610)
  - commit 01a7e9c


author: mwilck@suse.com
changelog:
  - scsi: core: Fix scsi_mode_sense() buffer length handling
    (bsc#1222662 CVE-2021-47182).
  - commit 09c6ab5


author: colyli@suse.de
changelog:
  - dm-crypt: don't modify the data when using authenticated
    encryption (bsc#1222720, CVE-2024-26763).
  - commit 3e74213


author: neilb@suse.de
changelog:
  - Update
    patches.suse/NFS-add-atomic_open-for-NFSv3-to-handle-O_TRUNC-corr.patch
    (bsc#1219847 bsc#1221862).
    Fix a NULL-pointer-deref bug.  Make the patch closer to the patch I sent
    upstream.
  - commit 5f62723


author: nmorey@suse.com
changelog:
  - RDMA/srpt: Support specifying the srpt_service_guid parameter (bsc#1222449 CVE-2024-26744)
  - commit 00d0add


author: pjakobsson@suse.de
changelog:
  - drm: Don't unref the same fb many times by mistake due to deadlock handling (CVE-2023-52486 bsc#1221277).
  - commit 5843530


author: hare@suse.com
changelog:
  - md/raid5: fix atomicity violation in raid5_cache_count
    (bsc#1219169, CVE-2024-23307).
  - commit 391774d


author: iivanov@suse.de
changelog:
  - thermal: Fix NULL pointer dereferences in of_thermal_ functions (CVE-2021-47202 bsc#1222878)
  - commit 08cf92c


author: jack@suse.cz
changelog:
  - ext4: avoid allocating blocks from corrupted group in
    ext4_mb_try_best_found() (bsc#1222618 CVE-2024-26773).
  - commit 4110538


author: rgoldwyn@suse.com
changelog:
  - md/raid5: fix atomicity violation in raid5_cache_count (bsc#1219169, CVE-2024-23307).
  - commit c0dbc35


author: nik.borisov@suse.com
changelog:
  - Refresh patches.kabi/cpufeatures-kabi-fix.patch (bsc#1222952)
    Don't call set_cpu_caps when calling set_cpu_bug, this causes problems
    with overlapping feature/bug ints. Directly call set_bit witht he
    correct parameters.
  - commit 16e52e8


author: jslaby@suse.cz
changelog:
  - serial: sc16is7xx: convert from _raw_ to _noinc_ regmap
    functions for FIFO (bsc#1221162 CVE-2023-52488).
  - commit a689f3e


author: oneukum@suse.com
changelog:
  - usb: roles: fix NULL pointer issue when put module's reference
    (bsc#1222609 CVE-2024-26747).
  - commit 73af327


author: jslaby@suse.cz
changelog:
  - regmap: Add regmap_noinc_write API (bsc#1221162 CVE-2023-52488).
  - regmap: Add regmap_noinc_read API (bsc#1221162 CVE-2023-52488).
  - commit 60efad2


author: mkubecek@suse.cz
changelog:
  - Update patches.suse/arp-Prevent-overflow-in-arp_req_get.patch
  - fix build warning
  - commit f10c34a


author: tzimmermann@suse.com
changelog:
  - blacklist.conf: Append 'drm/amdgpu: Fix variable 'mca_funcs' dereferenced before NULL check in 'amdgpu_mca_smu_get_mca_entry()''
  - commit cde121c


author: tiwai@suse.de
changelog:
  - wifi: rt2x00: restart beacon queue when hardware reset
    (CVE-2023-52595 bsc#1221046).
  - commit 671852b


author: tiwai@suse.de
changelog:
  - wifi: mac80211: fix race condition on enabling fast-xmit
    (CVE-2024-26779 bsc#1222772).
  - commit 5e02fca


author: tiwai@suse.de
changelog:
  - ALSA: gus: fix null pointer dereference on pointer block
    (CVE-2021-47207 bsc#1222790).
  - commit 2c3256c


author: osalvador@suse.de
changelog:
  - Update
    patches.suse/scsi-lpfc-Fix-list_add-corruption-in-lpfc_drain_txq.patch
    (bsc#1190576 CVE-2021-47203 bsc#1222881).
  - commit 2cb2a3c


author: tiwai@suse.de
changelog:
  - ALSA: usb-audio: fix null pointer dereference on pointer cs_desc
    (CVE-2021-47211 bsc#1222869).
  - commit a86f817


author: tiwai@suse.de
changelog:
  - clk: sunxi-ng: Unregister clocks/resets when unbinding
    (CVE-2021-47205 bsc#1222888).
  - commit 67523b6


author: tiwai@suse.de
changelog:
  - wifi: b43: Stop/wake correct queue in DMA Tx path when QoS is
    disabled (CVE-2023-52644 bsc#1222961).
  - commit 411fc96


author: neilb@suse.de
changelog:
  - Refresh
    patches.suse/NFS-add-atomic_open-for-NFSv3-to-handle-O_TRUNC-corr.patch.
    Handle too-long file names.
  - commit d3b61d6


author: shung-hsi.yu@suse.com
changelog:
  - bpf: Fix stackmap overflow check on 32-bit arches (bsc#1223035
    CVE-2024-26883).
  - bpf: Fix hashtab overflow check on 32-bit arches (bsc#1223189
    CVE-2024-26884).
  - bpf: Check for integer overflow when using roundup_pow_of_two()
    (bsc#1223035 CVE-2024-26883).
  - commit 4249641


author: mkoutny@suse.com
changelog:
  - Update
    patches.suse/msft-hv-2480-x86-hyperv-Fix-NULL-deref-in-set_hv_tscchange_cb-if-.patch
    (git-fixes CVE-2021-47217 bsc#1222836).
  - Update
    patches.suse/net-dpaa2-eth-fix-use-after-free-in-dpaa2_eth_remove.patch
    (git-fixes CVE-2021-47204 bsc#1222787).
  - Update patches.suse/scsi-advansys-Fix-kernel-pointer-leak.patch
    (git-fixes CVE-2021-47216 bsc#1222876).
  - Update
    patches.suse/scsi-lpfc-Fix-use-after-free-in-lpfc_unreg_rpi-routi.patch
    (bsc#1192145 CVE-2021-47198 bsc#1222883).
  - commit 1aa3f8e


author: mkoutny@suse.com
changelog:
  - Update
    patches.suse/Bluetooth-rfcomm-Fix-null-ptr-deref-in-rfcomm_check_-2535b848.patch
    (bsc#1219170 CVE-2024-22099 CVE-2024-26903 bsc#1223187).
  - Update
    patches.suse/aoe-fix-the-potential-use-after-free-problem-in-aoec.patch
    (bsc#1218562 CVE-2023-6270 CVE-2024-26898 bsc#1223016).
  - Update
    patches.suse/net-sched-act_mirred-don-t-override-retval-if-we-alr.patch
    (CVE-2024-26733 bsc#1222585 CVE-2024-26739 bsc#1222559).
  - Update
    patches.suse/sr9800-Add-check-for-usbnet_get_endpoints.patch
    (git-fixes CVE-2024-26651 bsc#1221337).
  - commit f0c3935


author: tiwai@suse.de
changelog:
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop]
    (CVE-2023-52635 bsc#1222294).
  - commit faf3604


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add 246f80a0b17f8 ("sh: push-switch: Reorder cleanup operations to avoid use-after-free bug")
  - commit 8e38656


author: nik.borisov@suse.com
changelog:
  - x86/boot: Ignore relocations in .notes sections in walk_relocs() too (bsc#1222624 CVE-2024-26816).
  - commit b878a00


author: tbogendoerfer@suse.de
changelog:
  - i40e: Fix NULL ptr dereference on VSI filter sync (bsc#1222666
    CVE-2021-47184).
  - commit 1ad3e1d


author: tzimmermann@suse.com
changelog:
  - drm/amdgpu: validate the parameters of bo mapping operations more (CVE-2024-26922 bsc#1223315)
  - commit 1a7d0fd


author: oneukum@suse.com
changelog:
  - usb: dwc2: check return value after calling
    platform_get_resource() (git-fixes).
  - commit 831627d


author: jslaby@suse.cz
changelog:
  - regmap: prevent noinc writes from clobbering cache (bsc#1221162
    CVE-2023-52488).
  - regmap: fix page selection for noinc writes (bsc#1221162
    CVE-2023-52488).
  - regmap: fix page selection for noinc reads (bsc#1221162
    CVE-2023-52488).
  - commit dc5bde0


author: nmorey@suse.com
changelog:
  - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (bsc#1223203 CVE-2024-26907)
  - commit 1c532b6


author: tbogendoerfer@suse.de
changelog:
  - net: ice: Fix potential NULL pointer dereference in
    ice_bridge_setlink() (bsc#1223051 CVE-2024-26855).
  - geneve: make sure to pull inner header in geneve_rx()
    (bsc#1223058 CVE-2024-26857).
  - ppp_async: limit MRU to 64K (bsc#1222379 CVE-2024-26675).
  - ipvlan: Fix out-of-bound bugs caused by unset skb->mac_header
    (bsc#1223513 CVE-2022-48651).
  - commit bc8fe89


author: tiwai@suse.de
changelog:
  - PM / devfreq: Fix buffer overflow in trans_stat_show
    (CVE-2023-52614 bsc#1221617).
  - commit ad2729f


author: jack@suse.cz
changelog:
  - ext4: avoid allocating blocks from corrupted group in
    ext4_mb_find_by_goal() (bsc#1222613 CVE-2024-26772).
  - commit 3d3003a


author: jack@suse.cz
changelog:
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak
    (bsc#1223198 CVE-2024-26901).
  - commit 2f53016


author: mfranc@suse.cz
changelog:
  - Update
    patches.suse/s390-Once-the-discipline-is-associated-with-the-device-de.patch
    (bsc#1141539 git-fixes).
  - commit b8b94c0


author: davide.benini@suse.com
changelog:
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify()
    (CVE-2024-26852 bsc#1223057)
  - commit 598df4c


author: krisman@suse.de
changelog:
  - netfilter: nf_tables: disallow timeout for anonymous sets
    (CVE-2023-52620 bsc#1221825).
  - commit f690b72


author: krisman@suse.de
changelog:
  - net: dsa: fix a crash if ->get_sset_count() fails
    (CVE-2021-47146 bsc#1221979).
  - commit 599796c


author: krisman@suse.de
changelog:
  - tipc: skb_linearize the head skb when reassembling msgs
    (bsc#1221977 CVE-2021-47162).
  - commit ba440f6


author: vkarasulli@suse.de
changelog:
  - Update
    patches.suse/smb3-fix-temporary-data-corruption-in-collapse-range.patch
    (bsc#1190317 CVE-2022-48668 bsc#1223516).
  - commit 10d5c12


author: vkarasulli@suse.de
changelog:
  - Update
    patches.suse/smb3-fix-temporary-data-corruption-in-insert-range.patch
    (bsc#1190317 CVE-2022-48667 bsc#1223518).
  - commit 91d9162


author: tzimmermann@suse.com
changelog:
  - amdkfd: use calloc instead of kzalloc to avoid integer overflow (CVE-2024-26817 bsc#1222812)
  - commit e67f0f8


author: tiwai@suse.de
changelog:
  - spi: spi-fsl-dspi: Fix a resource leak in an error handling path
    (CVE-2021-47161 bsc#1221966).
  - commit 86c2723


author: tbogendoerfer@suse.de
changelog:
  - net/bnx2x: Prevent access to a freed page in page_pool
    (bsc#1223049 CVE-2024-26859).
  - commit d2c8d25


author: lhenriques@suse.de
changelog:
  - cachefiles: fix memory leak in cachefiles_add_cache()
    (bsc#1222976 CVE-2024-26840).
  - commit 7ab2bde


author: tiwai@suse.de
changelog:
  - media: cec: abort if the current transmit was canceled
    (CVE-2024-23848 bsc#1219104).
  - commit 331f0d4


author: tiwai@suse.de
changelog:
  - kABI workaround for cec_adapter (CVE-2024-23848 bsc#1219104).
  - media: cec: core: avoid recursive cec_claim_log_addrs
    (CVE-2024-23848 bsc#1219104).
  - media: cec: core: avoid confusing "transmit timed out" message
    (CVE-2024-23848 bsc#1219104).
  - media: cec: cec-api: add locking in cec_release()
    (CVE-2024-23848 bsc#1219104).
  - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh
    (CVE-2024-23848 bsc#1219104).
  - commit 6debb18


author: mwilck@suse.com
changelog:
  - scsi: ufs: core: Improve SCSI abort handling (bsc#11222671,
    CVE-2021-47188).
  - blacklist.conf: remove 3ff1f6b
  - commit 9ba0cd1


author: tiwai@suse.de
changelog:
  - NTB: fix possible name leak in ntb_register_device()
    (CVE-2023-52652 bsc#1223686).
  - commit ca5484d


author: mfranc@suse.cz
changelog:
  - s390/mm: Fix storage key clearing for guest huge pages
    (git-fixes bsc#1223885).
  - commit cd536ee


author: tiwai@suse.de
changelog:
  - media: go7007: fix a memleak in go7007_load_encoder
    (CVE-2024-27074 bsc#1223844).
  - commit 54185dc


author: tiwai@suse.de
changelog:
  - media: ttpci: fix two memleaks in budget_av_attach
    (CVE-2024-27073 bsc#1223843).
  - commit 13b28d2


author: tiwai@suse.de
changelog:
  - media: dvb-frontends: avoid stack overflow warnings with clang
    (CVE-2024-27075 bsc#1223842).
  - commit 134dc5e


author: tiwai@suse.de
changelog:
  - media: usbtv: Remove useless locks in usbtv_video_free()
    (CVE-2024-27072 bsc#1223837).
  - commit 784e536


author: tbogendoerfer@suse.de
changelog:
  - tun: limit printing rate when illegal packet received by tun
    dev (bsc#1223745 CVE-2024-27013).
  - net/mlx5e: Prevent deadlock while disabling aRFS (bsc#1223735
    CVE-2024-27014).
  - nfp: flower: handle acti_netdevs allocation failure (bsc#1223827
    CVE-2024-27046).
  - commit bb18705


author: tzimmermann@suse.com
changelog:
  - drm/amd/display: Add a dc_state NULL check in dc_state_release (CVE-2024-26948 bsc#1223664)
  - commit 04ae1fa


author: pmladek@suse.com
changelog:
  - printk: Disable passing console lock owner completely during
    panic() (bsc#1197894).
  - commit 7493ac1


author: dsterba@suse.com
changelog:
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (CVE-2024-26993 bsc#1223693)
  - commit d5b445d


author: pmladek@suse.com
changelog:
  - printk: Update @console_may_schedule in
    console_trylock_spinning() (bsc#1223969).
  - commit 2217d14


author: pmladek@suse.com
changelog:
  - livepatch: Fix missing newline character in
    klp_resolve_symbols() (bsc#1223539).
  - commit a04a835


author: tzimmermann@suse.com
changelog:
  - drm/tegra: dsi: Add missing check for of_find_device_by_node (CVE-2023-52650 bsc#1223770)
  - commit 52453b3


author: vkarasulli@suse.de
changelog:
  - Update
    patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup
    (git-fixes CVE-2022-48636 bsc#1223512).
  - Update
    patches.suse/scsi-qla2xxx-Fix-memory-leak-in-__qlt_24xx_handle_ab.patch
    (bsc#1203935 CVE-2022-48650 bsc#1223509).
  - commit b81c322


author: vkarasulli@suse.de
changelog:
  - Update
    patches.suse/SUNRPC-fix-a-memleak-in-gss_import_v2_context.patch
    (git-fixes CVE-2023-52653 bsc#1223712).
  - Update patches.suse/aio-fix-mremap-after-fork-null-deref.patch
    (git-fixes CVE-2023-52646 bsc#1223432).
  - commit 6164312


author: vkarasulli@suse.de
changelog:
  - Update
    patches.suse/SUNRPC-fix-some-memleaks-in-gssx_dec_option_array.patch
    (git-fixes CVE-2024-27388 bsc#1223744).
  - Update
    patches.suse/s390-Once-the-discipline-is-associated-with-the-device-de.patch
    (bsc#1141539 git-fixes CVE-2024-27054 bsc#1223819).
  - Update
    patches.suse/scsi-qla2xxx-Fix-command-flush-on-cable-pull.patch
    (bsc1221816 CVE-2024-26931 bsc#1223627).
  - Update patches.suse/scsi-qla2xxx-Fix-double-free-of-fcport.patch
    (bsc1221816 CVE-2024-26929 bsc#1223715).
  - Update
    patches.suse/scsi-qla2xxx-Fix-double-free-of-the-ha-vp_map-pointe.patch
    (bsc1221816 CVE-2024-26930 bsc#1223626).
  - commit d54495e


author: mkubecek@suse.cz
changelog:
  - sctp: fix potential deadlock on &net->sctp.addr_wq_lock
    (CVE-2024-0639 bsc#1218917).
  - commit de19ab3


author: mkubecek@suse.cz
changelog:
  - openvswitch: fix stack OOB read while fragmenting IPv4 packets
    (CVE-2021-46955 bsc#1220513).
  - commit 1116e19


author: krisman@suse.de
changelog:
  - Fix references of
    patches.suse/net-dsa-fix-a-crash-if-get_sset_count-fails.patch
    This fix actually refers to different CVE and bug report. Fix the error.
  - commit b797fc2


author: krisman@suse.de
changelog:
  - Update
    patches.suse/net-dsa-fix-a-crash-if-get_sset_count-fails.patch
    (CVE-2021-47146 bsc#1221979 CVE-2021-47159 bsc#1221967).
  - Update
    patches.suse/scsi-ufs-core-Improve-SCSI-abort-handling.patch
    (bsc#11222671 CVE-2021-47188 bsc#1222671).
  - commit 5a613f4


author: krisman@suse.de
changelog:
  - Update
    patches.suse/i40e-Fix-kernel-crash-during-module-removal.patch
    (git-fixes CVE-2022-48688 bsc#1223953).
  - Update
    patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch
    (bsc#1211592 CVE-2023-2860 CVE-2022-48687 bsc#1223952).
  - Update
    patches.suse/s390-dasd-fix-Oops-in-dasd_alias_get_start_dev-due-to-missing-pavgroup
    (git-fixes CVE-2022-48636 bsc#1223512).
  - Update
    patches.suse/scsi-mpt3sas-Fix-use-after-free-warning.patch
    (git-fixes CVE-2022-48695 bsc#1223941).
  - Update
    patches.suse/scsi-qla2xxx-Fix-memory-leak-in-__qlt_24xx_handle_ab.patch
    (bsc#1203935 CVE-2022-48650 bsc#1223509).
  - commit cc68904


author: krisman@suse.de
changelog:
  - Update
    patches.suse/SUNRPC-fix-a-memleak-in-gss_import_v2_context.patch
    (git-fixes CVE-2023-52653 bsc#1223712).
  - Update patches.suse/aio-fix-mremap-after-fork-null-deref.patch
    (git-fixes CVE-2023-52646 bsc#1223432).
  - commit 793a07e


author: krisman@suse.de
changelog:
  - Update
    patches.suse/SUNRPC-fix-some-memleaks-in-gssx_dec_option_array.patch
    (git-fixes CVE-2024-27388 bsc#1223744).
  - Update
    patches.suse/s390-Once-the-discipline-is-associated-with-the-device-de.patch
    (bsc#1141539 git-fixes CVE-2024-27054 bsc#1223819).
  - Update
    patches.suse/scsi-qla2xxx-Fix-command-flush-on-cable-pull.patch
    (bsc1221816 CVE-2024-26931 bsc#1223627).
  - Update patches.suse/scsi-qla2xxx-Fix-double-free-of-fcport.patch
    (bsc1221816 CVE-2024-26929 bsc#1223715).
  - Update
    patches.suse/scsi-qla2xxx-Fix-double-free-of-the-ha-vp_map-pointe.patch
    (bsc1221816 CVE-2024-26930 bsc#1223626).
  - commit daf9a87


author: mkubecek@suse.cz
changelog:
  - kabi: hide new member of struct tls_context (CVE-2021-47131
    bsc#1221545).
  - net/tls: Fix use-after-free after the TLS device goes down
    and up (CVE-2021-47131 bsc#1221545).
  - commit 8c186be


author: tiwai@suse.de
changelog:
  - ALSA: usb-audio: Fix an out-of-bounds bug in
    __snd_usb_parse_audio_interface() (CVE-2022-48701 bsc#1223921).
  - commit 6f798e9


author: mkubecek@suse.cz
changelog:
  - blacklist.conf: add 94ce3b64c62d
    Blacklist commit 94ce3b64c62d ("net/tls: Use RCU API to access
    tls_ctx->netdev"). This is a follow-up to c55dcdd435aa which addresses an
    issue which is rather theoretical and the backport would be quite
    intrusive.
  - commit 8ca558a


author: mkubecek@suse.cz
changelog:
  - Update
    patches.suse/net-sched-act_mirred-don-t-override-retval-if-we-alr.patch
    references (CVE-2024-26739 bsc#1222559, drop incorrect references).
  - commit ea93ecf


author: dsterba@suse.com
changelog:
  - btrfs: abort in rename_exchange if we fail to insert the second ref (CVE-2021-47113 bsc#1221543)
  - Refresh patches.suse/btrfs-prevent-rename2-from-exchanging-a-subvol-with-a-directory-from-different-parents.patch.
  - commit 6cc4490


author: vkarasulli@suse.de
changelog:
  - inet: read sk->sk_family once in inet_recv_error() (bsc#1222385
    CVE-2024-26679).
  - commit 5c9ee90


author: krisman@suse.de
changelog:
  - of: fdt: fix off-by-one error in unflatten_dt_nodes()
    (CVE-2022-48672 bsc#1223931).
  - commit 032891a


author: krisman@suse.de
changelog:
  - ALSA: emu10k1: Fix out of bounds access in
    snd_emu10k1_pcm_channel_alloc() (bsc#1223923 CVE-2022-48702).
  - commit af9ea5f


author: oneukum@suse.com
changelog:
  - usb: gadget: f_ncm: Fix UAF ncm object at re-bind after usb
    ep transport error (bsc#1223752 CVE-2024-26996).
  - commit f8904de


author: oneukum@suse.com
changelog:
  - Update
    patches.suse/USB-usb-storage-Prevent-divide-by-0-error-in-isd200_.patch
    (bsc#1223738 CVE-2024-27059).
    Added CVE and bugzilla ids
  - commit 6bf9f21


author: oneukum@suse.com
changelog:
  - usb: host: ohci-tmio: check return value after calling
    platform_get_resource() (bsc#1222894 CVE-2021-47206).
  - blacklist.conf: blacklist entry was a mistake caused by the driver
    being dropped upstream, but only after SLE12
  - commit 740a25a


author: tbogendoerfer@suse.de
changelog:
  - net: vmxnet3: Fix NULL pointer dereference in
    vmxnet3_rq_rx_complete() (bsc#1223360).
  - commit 829bff3


author: dsterba@suse.com
changelog:
  - btrfs: fix unaligned access in readdir (git-fixes)
  - Refresh patches.suse/btrfs-support-swap-files.patch.
    Diff context only.
  - commit 0df1b83


author: dsterba@suse.com
changelog:
  - btrfs: defrag: use btrfs_mod_outstanding_extents in cluster_pages_for_defrag (git-fixes)
  - commit 6b856de


author: dsterba@suse.com
changelog:
  - btrfs: tree-checker: Fix misleading group system information (git-fixes)
  - Refresh patches.suse/0014-btrfs-tree-checker-get-fs_info-from-eb-in-block_grou.patch.
  - commit 4c1912f


author: dsterba@suse.com
changelog:
  - btrfs: tree-checker: add missing returns after data_ref alignment checks (git-fixes)
  - commit 465da04


author: tzimmermann@suse.com
changelog:
  - drm/radeon: add a force flush to delay work when radeon (bsc#1223932 CVE-2022-48704)
  - commit 05d207f


author: mwilck@suse.com
changelog:
  - Update
    patches.suse/scsi-ufs-core-Improve-SCSI-abort-handling.patch
    (bsc#1222671, CVE-2021-47188).
  - commit df1a16c


author: tiwai@suse.de
changelog:
  - firewire: nosy: ensure user_length is taken into account when
    fetching packet contents (CVE-2024-27401 bsc#1224181).
  - commit f890e6b


author: dsterba@suse.com
changelog:
  - btrfs: fix lockdep splat and potential deadlock after failure running delayed items (git-fixes)
  - commit 20fccdb


author: dsterba@suse.com
changelog:
  - btrfs: fix race when deleting quota root from the dirty cow roots list (git-fixes)
  - commit 1e8a661


author: dsterba@suse.com
changelog:
  - btrfs: fix lost error handling when looking up extended ref on log replay (git-fixes)
  - commit 20591f1


author: dsterba@suse.com
changelog:
  - btrfs: sysfs: use NOFS for device creation (git-fixes)
    Adjustment: add #include
  - commit f20ad81


author: oneukum@suse.com
changelog:
  - usb: aqc111: check packet for fixup for true limit (bsc#1217169
    CVE-2023-52655).
  - commit 9dd6dfa


author: oneukum@suse.com
changelog:
  - Update
    patches.suse/net-usb-fix-possible-use-after-free-in-smsc75xx_bind.patch
    (bsc#1221994 CVE-2021-47171).
    Added bugzilla ID and CVE
    The initial fix was present, but it turned later out to be wrong
    and the correct fix lacked the references.
  - commit cf80be9


author: lduncan@suse.com
changelog:
  - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats()
    (git-fixes).
  - scsi: lpfc: Correct size for wqe for memset() (git-fixes).
  - scsi: libsas: Fix disk not being scanned in after being removed
    (git-fixes).
  - scsi: libsas: Add a helper sas_get_sas_addr_and_dev_type()
    (git-fixes).
  - scsi: bfa: Fix function pointer type mismatch for hcb_qe->cbfn
    (git-fixes).
  - scsi: csiostor: Avoid function pointer casts (git-fixes).
  - scsi: isci: Fix an error code problem in isci_io_request_build()
    (git-fixes).
  - scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() (git-fixes).
  - scsi: be2iscsi: Fix a memleak in beiscsi_init_wrb_handle()
    (git-fixes).
  - scsi: megaraid_sas: Increase register read retry rount from
    3 to 30 for selected registers (git-fixes).
  - scsi: libfc: Fix potential NULL pointer dereference in
    fc_lport_ptp_setup() (git-fixes).
  - scsi: mpt3sas: Fix in error path (git-fixes).
  - scsi: iscsi_tcp: restrict to TCP sockets (git-fixes).
  - scsi: lpfc: Fix the NULL vs IS_ERR() bug for
    debugfs_create_file() (git-fixes).
  - scsi: mpt3sas: Perform additional retries if doorbell read
    returns 0 (git-fixes).
  - scsi: qedf: Do not touch __user pointer in
    qedf_dbg_fp_int_cmd_read() directly (git-fixes).
  - scsi: qedf: Do not touch __user pointer in
    qedf_dbg_debug_cmd_read() directly (git-fixes).
  - scsi: qedf: Do not touch __user pointer in
    qedf_dbg_stop_io_on_error_cmd_read() directly (git-fixes).
  - scsi: qla4xxx: Add length check when parsing nlattrs
    (git-fixes).
  - scsi: be2iscsi: Add length check when parsing nlattrs
    (git-fixes).
  - scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
    (git-fixes).
  - scsi: iscsi: Add length check for nlattr payload (git-fixes).
  - scsi: qedf: Fix firmware halt over suspend and resume
    (git-fixes).
  - scsi: qedi: Fix firmware halt over suspend and resume
    (git-fixes).
  - scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
    (git-fixes).
  - scsi: snic: Fix possible memory leak if device_add() fails
    (git-fixes).
  - scsi: core: Fix possible memory leak if device_add() fails
    (git-fixes).
  - scsi: core: Fix legacy /proc parsing buffer overflow
    (git-fixes).
  - scsi: 53c700: Check that command slot is not NULL (git-fixes).
  - scsi: 3w-xxxx: Add error handling for initialization failure
    in tw_probe() (git-fixes).
  - scsi: lpfc: Fix double free in lpfc_cmpl_els_logo_acc() caused
    by lpfc_nlp_not_used() (git-fixes).
  - scsi: qedf: Fix NULL dereference in error handling (git-fixes).
  - scsi: stex: Fix gcc 13 warnings (git-fixes).
  - scsi: core: Decrease scsi_device's iorequest_cnt if dispatch
    failed (git-fixes).
  - commit 43436ef


author: oneukum@suse.com
changelog:
  - usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear
    (bsc#1220487 CVE-2021-46933).
  - commit 33d6865


author: jdelvare@suse.de
changelog:
  - Refresh
    patches.suse/media-flexcop-usb-fix-NULL-ptr-deref-in-flexcop_usb_.patch.
    Fix the Patch-mainline tag.
  - commit 3169adb


author: lduncan@suse.com
changelog:
  - Fix build warning about now-unused function
    Refresh:
    - patches.suse/scsi-libsas-Fix-disk-not-being-scanned-in-after-being-removed.patch
  - commit bbcdd67


author: lduncan@suse.com
changelog:
  - Fix use-before-set in hand-coded part of patch
    Refresh:
    - patches.suse/scsi-iscsi_tcp-restrict-to-TCP-sockets.patch.
  - commit 757fd5b


author: dkirjanov@suse.com
changelog:
  - Refresh
    patches.suse/x86-boot-Ignore-relocations-in-.notes-sections-in-walk_rel.patch.
  - commit 1389ef9


author: tzimmermann@suse.com
changelog:
  - nouveau: fix instmem race condition around ptr stores (bsc#1223633 CVE-2024-26984)
  - commit 9350c2a


author: dsterba@suse.com
changelog:
  - blacklist.conf: fscrypt: depends on no-key format update
    Fix depends on functionality added by edc440e3d27fb3 ("fscrypt: improve
    format of no-key names")
  - commit 871959c


author: dsterba@suse.com
changelog:
  - blacklist.conf: fs: fget/fput optimization
    Commit looks safe but is not a fix rather than an optimization.
  - commit 2263087


author: dsterba@suse.com
changelog:
  - fs/proc/proc_sysctl.c: fix the default values of i_uid/i_gid on /proc/sys inodes (git-fixes)
  - commit 73af5d9


author: dsterba@suse.com
changelog:
  - exportfs_decode_fh(): negative pinned may become positive without the parent locked (git-fixes)
  - commit 681e816


author: lduncan@suse.com
changelog:
  - scsi: mpt3sas: Fix loop logic (git-fixes).
  - scsi: snic: Fix double free in snic_tgt_create() (git-fixes).
  - commit d29fa2d


author: mfranc@suse.cz
changelog:
  - s390/cpum_cf: make crypto counters upward compatible across
    machine types (bsc#1224347).
  - commit 8af04c2


author: mkoutny@suse.com
changelog:
  - Update
    patches.suse/USB-core-Fix-deadlock-in-usb_deauthorize_interface.patch
    (git-fixes CVE-2024-26934 bsc#1223671).
  - commit cc5c596


author: dkirjanov@suse.com
changelog:
  - Refresh patches.suse/nfs-fix-UAF-in-direct-writes.patch.
    Fixup the build warning:
    Changed build warnings:
    * **** 1 warnings *****
    * passing argument 1 of 'nfs_commit_end' from incompatible pointer type [enabled by default] (nfs_commit_end) in ../fs/nfs/direct.c in nfs_direct_commit_complete
    ../fs/nfs/direct.c: In function 'nfs_direct_commit_complete':
    ../fs/nfs/direct.c:668:2: warning: passing argument 1 of 'nfs_commit_end' from incompatible pointer type [enabled by default]
  - commit 10952b2


author: dsterba@suse.com
changelog:
  - Btrfs: fix incorrect {node,sector}size endianness from BTRFS_IOC_FS_INFO (git-fixes)
  - commit b016cd3


author: dsterba@suse.com
changelog:
  - btrfs: avoid null pointer dereference on fs_info when calling btrfs_crit (git-fixes)
  - commit daf7dc2


author: dsterba@suse.com
changelog:
  - blacklist.conf: btrfs: metadata dump v2 definition only
    e2731e55884f2138a252b0a3d7b24d57e49c3c59
  - commit b680815


author: dsterba@suse.com
changelog:
  - btrfs: tree-checker: do not error out if extent ref hash doesn't match (git-fixes)
  - commit 874e705


author: mkoutny@suse.com
changelog:
  - af_unix: Fix garbage collector racing against connect()
    (CVE-2024-26923 bsc#1223384).
  - af_unix: Replace BUG_ON() with WARN_ON_ONCE() (bsc#1223384).
  - af_unix: Do not use atomic ops for unix_sk(sk)->inflight (bsc#1223384).
  - commit d9e2f79


author: jlee@suse.com
changelog:
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout
    (bsc#1224174 CVE-2024-27398).
  - commit 231873b


author: jslaby@suse.cz
changelog:
  - rpm/kernel-obs-build.spec.in: remove reiserfs from OBS initrd
    We disabled the FS in bug 1202309. And we actively blacklist it in:
    /usr/lib/modprobe.d/60-blacklist_fs-reiserfs.conf
    This, as a side-effect, fixes obs-build's warning:
    dracut-pre-udev[1463]: sh: line 1: /usr/lib/module-init-tools/unblacklist: No such file or directory
    Exactly due to the above 60-blacklist_fs-reiserfs.conf trying to call the
    above unblacklist.
    We should likely drop ext2+ext3 from the list too, as we don't build
    them at all. But that's a different story.
  - commit 9e1a078


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add a1fd0b9d751f sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level
  - commit 3567984


author: neilb@suse.de
changelog:
  - Fix backport of :  NFS: Fix error handling for O_DIRECT write
    scheduling (bsc#1224785).
  - commit e968faa


author: oneukum@suse.com
changelog:
  - blacklist.conf: we select the CONFIG whose absence triggers this in all
    configs
  - commit 2c2df2e


author: ailiop@suse.com
changelog:
  - Update
    patches.suse/gfs2-Fix-use-after-free-in-gfs2_glock_shrink_scan.patch
    (git-fixes CVE-2021-47254).
  - commit 38ebdb5


author: jlee@suse.com
changelog:
  - Update
    patches.suse/NFS-Fix-a-potential-NULL-dereference-in-nfs_get_clie.patch
    (git-fixes CVE-2021-47260 bsc#1224834).
  - Update
    patches.suse/PCI-aardvark-Fix-kernel-panic-during-PIO-transfer.patch
    (git-fixes CVE-2021-47229 bsc#1224854).
  - Update
    patches.suse/batman-adv-Avoid-WARN_ON-timing-related-checks.patch
    (git-fixes CVE-2021-47252 bsc#1224882).
  - Update
    patches.suse/can-mcba_usb-fix-memory-leak-in-mcba_usb.patch
    (git-fixes CVE-2021-47231 bsc#1224849).
  - Update
    patches.suse/gfs2-Fix-use-after-free-in-gfs2_glock_shrink_scan.patch
    (git-fixes CVE-2021-47254 bsc#1224888).
  - Update
    patches.suse/media-ngene-Fix-out-of-bounds-bug-in-ngene_command_c.patch
    (git-fixes CVE-2021-47288 bsc#1224889).
  - Update
    patches.suse/memory-fsl_ifc-fix-leak-of-IO-mapping-on-probe-failu.patch
    (git-fixes CVE-2021-47315 bsc#1224892).
  - Update
    patches.suse/memory-fsl_ifc-fix-leak-of-private-memory-on-probe-f.patch
    (git-fixes CVE-2021-47314 bsc#1224893).
  - Update patches.suse/net-cdc_eem-fix-tx-fixup-skb-leak.patch
    (git-fixes CVE-2021-47236 bsc#1224841).
  - Update
    patches.suse/net-ethernet-fix-potential-use-after-free-in-ec_bhf_.patch
    (git-fixes CVE-2021-47235 bsc#1224844).
  - Update
    patches.suse/net-hamradio-fix-memory-leak-in-mkiss_close.patch
    (git-fixes CVE-2021-47237 bsc#1224830).
  - Update
    patches.suse/net-usb-fix-possible-use-after-free-in-smsc75xx_bind.patch
    (bsc#1221994 CVE-2021-47171 CVE-2021-47239 bsc#1224846).
  - Update
    patches.suse/scsi-core-Fix-error-handling-of-scsi_host_alloc
    (git-fixes CVE-2021-47258 bsc#1224899).
  - Update
    patches.suse/udp-fix-race-between-close-and-udp_abort.patch
    (git-fixes CVE-2021-47248 bsc#1224867).
  - Update
    patches.suse/usb-dwc3-core-fix-kernel-panic-when-do-reboot.patch
    (git-fixes CVE-2021-47220 bsc#1224859).
  - commit 7295d7f


author: jlee@suse.com
changelog:
  - Update
    patches.suse/powerpc-powernv-Add-a-null-pointer-check-in-opal_eve.patch
    (bsc#1065729 CVE-2023-52686 bsc#1224682).
  - Update
    patches.suse/powerpc-powernv-Add-a-null-pointer-check-in-opal_pow.patch
    (bsc#1181674 ltc#189159 git-fixes CVE-2023-52696 bsc#1224601).
  - Update
    patches.suse/pstore-ram_core-fix-possible-overflow-in-persistent_ram_init_ecc.patch
    (git-fixes CVE-2023-52685 bsc#1224728).
  - commit 0720a5d


author: jlee@suse.com
changelog:
  - Refresh
    patches.suse/USB-core-Fix-deadlock-in-usb_deauthorize_interface.patch.
  - Update
    patches.suse/bpf-sockmap-Prevent-lock-inversion-deadlock-in-map-d.patch
    (bsc#1209657 CVE-2023-0160 CVE-2024-35895 bsc#1224511).
  - Update
    patches.suse/nfsd-Fix-error-cleanup-path-in-nfsd_rename.patch
    (bsc#1221044 CVE-2023-52591 CVE-2024-35914 bsc#1224482).
  - Update
    patches.suse/wifi-brcmfmac-Fix-use-after-free-bug-in-brcmf_cfg802.patch
    (CVE-2023-47233 bsc#1216702 CVE-2024-35811 bsc#1224592).
  - commit 9a84305


author: mfranc@suse.cz
changelog:
  - KVM: s390: Check kvm pointer when testing KVM_CAP_S390_HPAGE_1M
    (git-fixes bsc#1225059).
  - commit b5429fa


author: mfranc@suse.cz
changelog:
  - s390/zcrypt: fix reference counting on zcrypt card objects
    (git-fixes CVE-2024-26957 bsc#1223666).
  - commit 1a50d91


author: mfranc@suse.cz
changelog:
  - s390/pci: fix max size calculation in zpci_memcpy_toio()
    (git-fixes bsc#1225062).
  - commit 1d5a845


author: tiwai@suse.de
changelog:
  - regmap: Fix possible double-free in regcache_rbtree_exit()
    (CVE-2021-47483 bsc#1224907).
  - commit 1f96a36


author: davide.benini@suse.com
changelog:
  - ax25: fix use-after-free bugs caused by ax25_ds_del_timer
    (CVE-2024-35887 bzg#1224663)
  - commit 2bbaa4c


author: tiwai@suse.de
changelog:
  - clk: mediatek: clk-mt6797: Add check for mtk_alloc_clk_data
    (CVE-2023-52865 bsc#1225086).
  - commit c2dc4d3


author: tiwai@suse.de
changelog:
  - clk: mediatek: clk-mt2701: Add check for mtk_alloc_clk_data
    (CVE-2023-52875 bsc#1225096).
  - commit eff8019


author: tiwai@suse.de
changelog:
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN
    changes (CVE-2024-35789 bsc#1224749).
  - media: tc358743: register v4l2 async device only after
    successful setup (CVE-2024-35830 bsc#1224680).
  - misc/libmasm/module: Fix two use after free in ibmasm_init_one
    (CVE-2021-47334 bsc#1225112).
  - atm: iphase: fix possible use-after-free in ia_module_exit()
    (CVE-2021-47357 bsc#1225144).
  - commit 4495db1


author: petr.pavlu@suse.com
changelog:
  - tracing: Use strncpy instead of memcpy when copying comm in
    trace.c (git-fixes).
  - commit 77a5fe6


author: mkoutny@suse.com
changelog:
  - af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress (bsc#1223384).
  - commit 8ee0966


author: tiwai@suse.de
changelog:
  - ALSA: usb-audio: Stop parsing channels bits when all channels
    are found (CVE-2024-27436 bsc#1224803).
  - ALSA: seq: Fix race of snd_seq_timer_open() (CVE-2021-47281
    bsc#1224983).
  - commit 19aff08


author: fdmanana@suse.com
changelog:
  - btrfs: fix information leak in btrfs_ioctl_logical_to_ino()
    (CVE-2024-35849 bsc#1224733).
  - commit 4e18545


author: davide.benini@suse.com
changelog:
  - net: ipv4: fix memory leak in netlbl_cipsov4_add_std
    (CVE-2021-47250 bsc#1224827)
  - commit ffd876f


author: davide.benini@suse.com
changelog:
  - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb
    (CVE-2021-47397 bsc#1225082)
  - commit 2340710


author: nmorey@suse.com
changelog:
  - IB/hfi1: Restore allocated resources on failed copyout (CVE-2023-52747 bsc#1224931)
  - commit 4ba08d9


author: tiwai@suse.de
changelog:
  - of: module: prevent NULL pointer dereference in vsnprintf()
    (CVE-2024-35878 bsc#1224671).
  - commit dcde1a4


author: davide.benini@suse.com
changelog:
  - netfilter: synproxy: Fix out of bounds when parsing TCP options
    (CVE-2021-47245 bsc#1224838)
  - commit 3bf50df


author: tiwai@suse.de
changelog:
  - atm: nicstar: Fix possible use-after-free in nicstar_cleanup()
    (CVE-2021-47355 bsc#1225141).
  - commit 111c5b1


author: tiwai@suse.de
changelog:
  - mmc: sdio: fix possible resource leaks in some error paths
    (CVE-2023-52730 bsc#1224956).
  - commit 8629def


author: tiwai@suse.de
changelog:
  - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host()
    (CVE-2024-35944 bsc#1224648).
  - commit a03c425


author: jgross@suse.com
changelog:
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in
    svm_register_enc_region() (bsc#1224725, CVE-2024-35791).
  - commit 818a70e


author: jgross@suse.com
changelog:
  - kvm: avoid speculation-based attacks from out-of-range memslot
    accesses (bsc#1224960, CVE-2021-47277).
  - commit 7198007


author: tiwai@suse.de
changelog:
  - spi: Fix deadlock when adding SPI controllers on SPI buses
    (CVE-2021-47469 bsc#1225347).
  - commit 575a8d4


author: tiwai@suse.de
changelog:
  - blacklist.conf: Add SPI fix commit to be ignored (CVE-2021-47469 bsc#1225347)
    SLE12-SP5 has no devm spi controller allocation, hence it's superfluous
  - commit 939a6a5


author: davide.benini@suse.com
changelog:
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
    (CVE-2024-35969 bsc#1224580)
  - commit bcaf17a


author: davide.benini@suse.com
changelog:
  - batman-adv: Avoid infinite loop trying to resize local TT
    (CVE-2024-35982 bsc#1224566)
  - commit 4f15041


author: jslaby@suse.cz
changelog:
  - tty: Fix out-of-bound vmalloc access in imageblit
    (CVE-2021-47383 bsc#1225208).
  - commit a21c750


author: jslaby@suse.cz
changelog:
  - PCI/PM: Drain runtime-idle callbacks before driver removal
    (CVE-2024-35809 bsc#1224738).
  - commit 9f4d35b


author: pjakobsson@suse.de
changelog:
  - drm/vc4: don't check if plane->state->fb == state->fb (CVE-2024-35932 bsc#1224650).
  - commit 4fdcf5e


author: jlee@suse.com
changelog:
  - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells
    (bsc#1225355 CVE-2021-47497).
  - commit 30121bc


author: pjakobsson@suse.de
changelog:
  - drm/radeon: fix a possible null pointer dereference (CVE-2022-48710 bsc#1225230).
  - commit ee59a3e


author: ematsumiya@suse.de
changelog:
  - cifs: fix underflow in parse_server_interfaces() (bsc#1223084,
    CVE-2024-26828).
  - commit 7164147


author: dsterba@suse.com
changelog:
  - btrfs: send: handle path ref underflow in header iterate_inode_ref() (CVE-2024-35935 bsc#1224645)
  - commit 0b2d17e


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add c5b0a7eefc70 sched/fair: Remove sysctl_sched_migration_cost condition
  - commit dbc3425


author: davide.benini@suse.com
changelog:
  - calipso: fix memory leak in netlbl_calipso_add_pass()
    (CVE-2023-52698 bsc#1224621)
  - commit 008f52c


author: iivanov@suse.de
changelog:
  - mmc: sdhci-msm: pervent access to suspended controller (bsc#1225708 CVE-2024-36029)
  - commit 0915583


author: iivanov@suse.de
changelog:
  - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array (bsc#1225506 CVE-2021-47548)
  - commit e4002ca


author: dsterba@suse.com
changelog:
  - btrfs: handle chunk tree lookup error in btrfs_relocate_sys_chunks() (CVE-2024-35936 bsc#1224644)
  - commit 64d6920


author: dsterba@suse.com
changelog:
  - btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks() (CVE-2024-35936 bsc#1224644)
  - commit 7904756


author: lhenriques@suse.de
changelog:
  - ceph: blocklist the kclient when receiving corrupted snap trace
    (bsc#1225222 CVE-2023-52732).
  - commit afa0bf6


author: tbogendoerfer@suse.de
changelog:
  - net: atlantic: eliminate double free in error handling logic
    (CVE-2023-52664 bsc#1224747).
  - ipvlan: add ipvlan_route_v6_outbound() helper (CVE-2023-52796
    bsc#1224930).
  - net/mlx5e: Fix page reclaim for dead peer hairpin
    (CVE-2021-47246 bsc#1224831).
  - commit e8481e2


author: dkirjanov@suse.com
changelog:
  - rxrpc: The mutex lock returned by rxrpc_accept_call() needs
    releasing (git-fixes).
  - commit 56d0a26


author: dkirjanov@suse.com
changelog:
  - rxrpc: Provide a different lockdep key for call->user_mutex
    for kernel calls (git-fixes).
  - commit 256d44f


author: dkirjanov@suse.com
changelog:
  - ila: do not generate empty messages in
    ila_xlat_nl_cmd_get_mapping() (git-fixes).
  - commit bd4b08a


author: dkirjanov@suse.com
changelog:
  - netfilter: nft_compat: explicitly reject ERROR and standard
    target (git-fixes).
  - commit 46fdab6


author: msuchanek@suse.de
changelog:
  - powerpc/pseries/lparcfg: drop error message from guest name
    lookup (bsc#1187716 ltc#193451 git-fixes).
  - commit 62b0891


author: mfranc@suse.cz
changelog:
  - Update
    patches.suse/0004-dm-fix-mempool-NULL-pointer-race-when-completing-IO.patch
    (git-fixes bsc#1225247 CVE-2021-47435).
  - Update
    patches.suse/0022-dm-btree-remove-assign-new_root-only-when-removal-su.patch
    (git fixes bsc#1225155 CVE-2021-47343).
  - Update
    patches.suse/0066-virtio-blk-Fix-memory-leak-among-suspend-resume-procedure.patch
    (git-fixes bsc#1225054 CVE-2021-47319).
  - Update
    patches.suse/HID-betop-fix-slab-out-of-bounds-Write-in-betop_prob.patch
    (git-fixes bsc#1207186 bsc#1225303 CVE-2021-47404).
  - Update
    patches.suse/IB-hfi1-Fix-leak-of-rcvhdrtail_dummy_kvaddr.patch
    (git-fixes bsc#1225438 CVE-2021-47523).
  - Update
    patches.suse/IB-mlx5-Fix-initializing-CQ-fragments-buffer.patch
    (git-fixes bsc#1224954 CVE-2021-47261).
  - Update
    patches.suse/IB-qib-Protect-from-buffer-overflow-in-struct-qib_us.patch
    (git-fixes bsc#1224904 CVE-2021-47485).
  - Update
    patches.suse/RDMA-cma-Ensure-rdma_addr_cancel-happens-before-issu.patch
    (git-fixes bsc#1225318 CVE-2021-47391).
  - Update
    patches.suse/RDMA-cma-Fix-rdma_resolve_route-memory-leak.patch
    (git-fixes bsc#1225157 CVE-2021-47345).
  - Update
    patches.suse/SUNRPC-Fix-RPC-client-cleaned-up-the-freed-pipefs-de.patch
    (git-fixes bsc#1225008 CVE-2023-52803).
  - Update
    patches.suse/blktrace-Fix-uaf-in-blk_trace-access-after-removing-.patch
    (bsc#1191452 bsc#1225193 CVE-2021-47375).
  - Update patches.suse/can-peak_pci-peak_pci_remove-fix-UAF.patch
    (git-fixes bsc#1225256 CVE-2021-47456).
  - Update
    patches.suse/cifs-Fix-use-after-free-in-rdata-read_into_pages-.patch
    (bsc#1190317 bsc#1225479 CVE-2023-52741).
  - Update
    patches.suse/cifs-prevent-NULL-deref-in-cifs_compose_mount_options-.patch
    (bsc#1185902 bsc#1224961 CVE-2021-47307).
  - Update
    patches.suse/dma-buf-sync_file-Don-t-leak-fences-on-merge-failure.patch
    (git-fixes bsc#1224968 CVE-2021-47305).
  - Update
    patches.suse/drm-Fix-use-after-free-read-in-drm_getunique.patch
    (git-fixes bsc#1224982 CVE-2021-47280).
  - Update
    patches.suse/ftrace-Do-not-blindly-read-the-ip-address-in-ftrace_bug.patch
    (git-fixes bsc#1224966 CVE-2021-47276).
  - Update patches.suse/gfs2-ignore-negated-quota-changes.patch
    (git-fixes bsc#1225560 CVE-2023-52759).
  - Update
    patches.suse/i40e-Fix-freeing-of-uninitialized-misc-IRQ-vector.patch
    (bsc#1101816 FATE#325147 FATE#325149 bsc#1225367
    CVE-2021-47424).
  - Update
    patches.suse/igb-Fix-use-after-free-error-during-reset.patch
    (git-fixes bsc#1224916 CVE-2021-47301).
  - Update
    patches.suse/igc-Fix-use-after-free-error-during-reset.patch
    (git-fixes bsc#1224917 CVE-2021-47302).
  - Update
    patches.suse/ipv4-ipv6-Fix-handling-of-transhdrlen-in-__ip-6-_app.patch
    (git-fixes bsc#1220928 CVE-2023-52527).
  - Update
    patches.suse/isdn-mISDN-netjet-Fix-crash-in-nj_probe.patch
    (git-fixes bsc#1224987 CVE-2021-47284).
  - Update
    patches.suse/isofs-Fix-out-of-bound-access-for-corrupted-isofs-im.patch
    (bsc#1194591 bsc#1225198 CVE-2021-47478).
  - Update
    patches.suse/kprobes-Fix-possible-use-after-free-issue-on-kprobe-registration.patch
    (git-fixes bsc#1224676 CVE-2024-35955).
  - Update
    patches.suse/l2tp-pass-correct-message-length-to-ip6_append_data.patch
    (git-fixes bsc#1222667 CVE-2024-26752).
  - Update
    patches.suse/mISDN-fix-possible-use-after-free-in-HFC_cleanup.patch
    (git-fixes bsc#1225143 CVE-2021-47356).
  - Update
    patches.suse/media-zr364xx-fix-memory-leak-in-zr364xx_start_readp.patch
    (git-fixes bsc#1224922 CVE-2021-47344).
  - Update
    patches.suse/net-USB-Fix-wrong-direction-WARNING-in-plusb.c.patch
    (git-fixes bsc#1225482 CVE-2023-52742).
  - Update
    patches.suse/net-hns3-do-not-allow-call-hns3_nic_net_open-repeate.patch
    (git-fixes bsc#1225329 CVE-2021-47400).
  - Update
    patches.suse/net-mdiobus-Fix-memory-leak-in-__mdiobus_register.patch
    (git-fixes bsc#1225189 CVE-2021-47472).
  - Update
    patches.suse/net-mlx4_en-Fix-an-use-after-free-bug-in-mlx4_en_try.patch
    (git-fixes bsc#1225453 CVE-2021-47541).
  - Update
    patches.suse/net-nfc-rawsock.c-fix-a-permission-check-bug.patch
    (git-fixes bsc#1224981 CVE-2021-47285).
  - Update patches.suse/net-qcom-emac-fix-UAF-in-emac_remove.patch
    (git-fixes bsc#1225010 CVE-2021-47311).
  - Update patches.suse/net-ti-fix-UAF-in-tlan_remove_one.patch
    (git-fixes bsc#1224959 CVE-2021-47310).
  - Update
    patches.suse/net-usb-kalmia-Don-t-pass-act_len-in-usb_bulk_msg-er.patch
    (git-fixes bsc#1225549 CVE-2023-52703).
  - Update
    patches.suse/nfs-fix-acl-memory-leak-of-posix_acl_create.patch
    (git-fixes bsc#1225058 CVE-2021-47320).
  - Update
    patches.suse/nfsd-fix-use-after-free-due-to-delegation-race.patch
    (git-fixes bsc#1225404 CVE-2021-47506).
  - Update
    patches.suse/ocfs2-fix-data-corruption-after-conversion-from-inli.patch
    (bsc#1190795 bsc#1225251 CVE-2021-47460).
  - Update
    patches.suse/ocfs2-mount-fails-with-buffer-overflow-in-strlen.patch
    (bsc#1197760 bsc#1225252 CVE-2021-47458).
  - Update patches.suse/phy-mdio-fix-memory-leak.patch (git-fixes
    bsc#1225336 CVE-2021-47416).
  - Update
    patches.suse/ppdev-Add-an-error-check-in-register_device.patch
    (git-fixes bsc#1225640 CVE-2024-36015).
  - Update
    patches.suse/s390-dasd-protect-device-queue-against-concurrent-access.patch
    (git-fixes bsc#1217519 bsc#1225572 CVE-2023-52774).
  - Update
    patches.suse/s390-qeth-fix-NULL-deref-in-qeth_clear_working_pool_list
    (git-fixes bsc#1225164 CVE-2021-47369).
  - Update
    patches.suse/s390-qeth-fix-deadlock-during-failing-recovery
    (bsc#1206213 LTC#200742 bsc#1225207 CVE-2021-47382).
  - Update
    patches.suse/scsi-core-Fix-bad-pointer-dereference-when-ehandler-kthread-is-invalid
    (git-fixes bsc#1224926 CVE-2021-47337).
  - Update
    patches.suse/scsi-core-Put-LLD-module-refcnt-after-SCSI-device-is-released
    (git-fixes bsc#1225322 CVE-2021-47480).
  - Update
    patches.suse/scsi-libfc-Fix-array-index-out-of-bound-exception.patch
    (bsc#1188616 bsc#1224963 CVE-2021-47308).
  - Update
    patches.suse/scsi-mpt3sas-Fix-kernel-panic-during-drive-powercycle-test
    (git-fixes bsc#1225384 CVE-2021-47565).
  - Update
    patches.suse/scsi-qla2xxx-Fix-a-memory-leak-in-an-error-path-of-qla2x00_process_els
    (git-fixes bsc#1225192 CVE-2021-47473).
  - Update
    patches.suse/tipc-fix-a-possible-memleak-in-tipc_buf_append.patch
    (bsc#1221977 CVE-2021-47162 bsc#1225764 CVE-2024-36954).
  - Update
    patches.suse/tracing-Correct-the-length-check-which-causes-memory-corruption.patch
    (git-fixes bsc#1224990 CVE-2021-47274).
  - Update
    patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
    (git-fixes CVE-2024-26920).
  - Update
    patches.suse/tty-n_gsm-require-CAP_NET_ADMIN-to-attach-N_GSM0710-.patch
    (bsc#1222619 CVE-2023-52880).
  - Update
    patches.suse/tty-serial-8250-serial_cs-Fix-a-memory-leak-in-error.patch
    (git-fixes bsc#1225084 CVE-2021-47330).
  - Update
    patches.suse/udf-Fix-NULL-pointer-dereference-in-udf_symlink-func.patch
    (bsc#1206646 bsc#1225128 CVE-2021-47353).
  - Update
    patches.suse/usb-config-fix-iteration-issue-in-usb_get_bos_descri.patch
    (git-fixes bsc#1225092 CVE-2023-52781).
  - Update
    patches.suse/usb-dwc2-check-return-value-after-calling-platform_g.patch
    (git-fixes bsc#1225330 CVE-2021-47409).
  - Update
    patches.suse/usb-dwc3-ep0-fix-NULL-pointer-exception.patch
    (git-fixes bsc#1224996 CVE-2021-47269).
  - Update patches.suse/usb-musb-dsps-Fix-the-probe-error-path.patch
    (git-fixes bsc#1225244 CVE-2021-47436).
  - Update patches.suse/usbnet-sanity-check-for-maxpacket.patch
    (git-fixes bsc#1225351 CVE-2021-47495).
  - Update
    patches.suse/watchdog-Fix-possible-use-after-free-by-calling-del_.patch
    (git-fixes bsc#1225060 CVE-2021-47321).
  - Update
    patches.suse/watchdog-Fix-possible-use-after-free-in-wdt_startup.patch
    (git-fixes bsc#1225030 CVE-2021-47324).
  - Update
    patches.suse/watchdog-sc520_wdt-Fix-possible-use-after-free-in-wd.patch
    (git-fixes bsc#1225026 CVE-2021-47323).
  - Update
    patches.suse/wl1251-Fix-possible-buffer-overflow-in-wl1251_cmd_sc.patch
    (git-fixes bsc#1225177 CVE-2021-47347).
  - commit 8975a47


author: davide.benini@suse.com
changelog:
  - net/tls: Fix flipped sign in tls_err_abort() calls
    (CVE-2021-47496 bsc#1225354)
  - commit af28ae7


author: davide.benini@suse.com
changelog:
  - blacklist.conf: add d380ce70058a4ccddc3e5f5c2063165dc07672c6
    netrom: Fix data-races around sysctl_net_busy_read
    (CVE-2024-27419 bsc#1224759)
  - commit 9b21914


author: dwagner@suse.de
changelog:
  - nvme-fc: do not wait in vain when unloading module
    (CVE-2024-26846 bsc#1223023).
  - commit 365a6dd


author: dwagner@suse.de
changelog:
  - nvmet: fix a use-after-free (CVE-2022-48697 bsc#1223922).
    Update blacklist.conf: drop entry from it
  - commit 5e496a4


author: dwagner@suse.de
changelog:
  - nvme-rdma: destroy cm id before destroy qp to avoid use after
    free (CVE-2021-47378 bsc#1225201).
  - commit 599a36a


author: dwagner@suse.de
changelog:
  - nvme-loop: fix memory leak in nvme_loop_create_ctrl() (CVE-2021-47074 bsc#1220854).
    Update blacklist.conf: remove entry
  - commit 5f6a5df


author: dwagner@suse.de
changelog:
  - nvme-tcp: fix UAF when detecting digest errors (CVE-2022-48686 bsc#1223948).
    Update blacklist.conf: remove entry
  - commit f159215


author: ematsumiya@suse.de
changelog:
  - smb: client: fix potential UAF in smb2_is_valid_oplock_break()
    (bsc#1224668, CVE-2024-35865).
  - commit 77a46ab


author: ematsumiya@suse.de
changelog:
  - smb3: fix lock ordering potential deadlock in
    cifs_sync_mid_result (bsc#1224549, CVE-2024-35998).
  - commit fbe7cb6


author: ematsumiya@suse.de
changelog:
  - smb: client: fix potential UAF in smb2_is_network_name_deleted()
    (bsc#1224764, CVE-2024-35862).
  - commit 6bbd54b


author: ematsumiya@suse.de
changelog:
  - smb: client: fix potential UAF in smb2_is_valid_lease_break()
    (bsc#1224765, CVE-2024-35864).
  - commit 688ad5f


author: ematsumiya@suse.de
changelog:
  - smb: client: fix potential UAF in cifs_debug_files_proc_show()
    (bsc#1223532, CVE-2024-26928).
  - commit 92bb153


author: ematsumiya@suse.de
changelog:
  - smb: client: fix potential UAF in cifs_stats_proc_show()
    (bsc#1224664, CVE-2024-35867).
  - commit adb391f


author: ematsumiya@suse.de
changelog:
  - smb: client: fix potential UAF in cifs_stats_proc_write()
    (bsc#1224678, CVE-2024-35868).
  - commit 7c5946d


author: ematsumiya@suse.de
changelog:
  - smb: client: fix potential UAF in is_valid_oplock_break()
    (bsc#1224763, CVE-2024-35863).
  - commit be79366


author: ematsumiya@suse.de
changelog:
  - smb: client: fix potential deadlock when releasing mids
    (bsc#1225548, CVE-2023-52757).
  - commit 00dc86e


author: pjakobsson@suse.de
changelog:
  - drm/client: Fully protect modes with dev->mode_config.mutex (CVE-2024-35950 bsc#1224703).
  - commit f0cb811


author: shung-hsi.yu@suse.com
changelog:
  - bpf, skmsg: Fix NULL pointer dereference in
    sk_psock_skb_ingress_enqueue (bsc#1225761 CVE-2024-36938).
  - commit 24fab08


author: oneukum@suse.com
changelog:
  - usb: fix various gadgets null ptr deref on 10gbps cabling
    (CVE-2021-47270 bsc#1224997).
  - commit 00c58e2


author: shung-hsi.yu@suse.com
changelog:
  - xsk: validate user input for XDP_{UMEM|COMPLETION}_FILL_RING
    (bsc#1224575 CVE-2024-35976).
  - commit 641c7c4


author: oneukum@suse.com
changelog:
  - xhci: Fix command ring pointer corruption while aborting a
    command (CVE-2021-47434 bsc#1225232).
  - blacklist.conf: taken so that the correct fix applies
  - commit ea90837


author: oneukum@suse.com
changelog:
  - xhci: Fix commad ring abort, write all 64 bits to CRCR register
    (CVE-2021-47434 bsc#1225232).
  - commit d92fac3


author: dkirjanov@suse.com
changelog:
  - inet: inet_defrag: prevent sk release while still in use
    (CVE-2024-26921 bsc#1223138).
  - commit 7846939


author: oneukum@suse.com
changelog:
  - usb: dwc2: fix possible NULL pointer dereference caused by
    driver concurrency (CVE-2023-52855 bsc#1225583).
  - commit 304ea43


author: vbabka@suse.cz
changelog:
  - proc/vmcore: fix clearing user buffer by properly using
    clear_user() (CVE-2021-47566 bsc#1225514).
  - commit 4f35255


author: oneukum@suse.com
changelog:
  - usb: gadget: f_fs: Fix race between aio_cancel() and AIO
    request complete (CVE-2024-36894 bsc#1225749).
  - commit 66229f2


author: dsterba@suse.com
changelog:
  - blacklist.conf: CVE-2024-35956 bsc#1224674: not applicable bsc#1225945
    Quoting bsc#1225945#c11:
    "So the upstream 6.5 kernel commit (1b53e51a4a8f ("btrfs: don't commit
    transaction for every subvol create")
    ) was never backported to SLE, so that fix eb96e221937a ("btrfs: fix
    unwritten extent buffer after snapshotting a new subvolume") was never
    backported."
  - commit 13b6119


author: tonyj@suse.de
changelog:
  - powerpc/imc-pmu: Add a null pointer check in
    update_events_in_group() (bsc#1224504 CVE-2023-52675).
  - commit 5ed0541


author: tonyj@suse.de
changelog:
  - perf/core: Bail out early if the request AUX area is out of
    bound (bsc#1225602 CVE-2023-52835).
  - commit 0b197bf


author: ddiss@suse.de
changelog:
  - fix compat handling of FICLONERANGE, FIDEDUPERANGE and
    FS_IOC_FIEMAP (bsc#1225848).
  - blacklist.conf:
  - fs: make fiemap work from compat_ioctl (bsc#1225848).
  - commit e6c580c


author: davide.benini@suse.com
changelog:
  - wifi: nl80211: reject iftype change with mesh ID change
    (CVE-2024-27410 bsc#1224432).
  - commit 18882c6


author: vkarasulli@suse.de
changelog:
  - HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent
    lock-up (bsc#1224552 CVE-2024-35997).
  - commit 31522d3


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add 1971d13ffa84a "af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc()."
  - commit 9ab8e4f


author: davide.benini@suse.com
changelog:
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING
    (CVE-2023-52845 bsc#1225585).
  - commit 28beea5


author: tzimmermann@suse.com
changelog:
  - fbmon: prevent division by zero in fb_videomode_from_videomode() (bsc#1224660 CVE-2024-35922)
  - commit 9990cdc


author: jlee@suse.com
changelog:
  - Bluetooth: Normalize HCI_OP_READ_ENC_KEY_SIZE cmdcmplt
    (bsc#1218148 CVE-2023-24023).
  - commit be61b35


author: davide.benini@suse.com
changelog:
  - netfilter: validate user input for expected length
    (CVE-2024-35896 bsc#1224662).
  - commit d09d89a


author: davide.benini@suse.com
changelog:
  - netfilter: complete validation of user input
    (git-fixes CVE-2024-35896 bsc#1224662).
  - commit bd2bc6c


author: davide.benini@suse.com
changelog:
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation
    (CVE-2024-36017 bsc#1225681).
  - commit eee2828


author: fvogt@suse.de
changelog:
  - rpm/kernel-obs-build.spec.in: Add networking modules for docker
    (bsc#1226211)
    docker needs more networking modules, even legacy iptable_nat and _filter.
  - commit 415e132


author: davide.benini@suse.com
changelog:
  - nfc: llcp: fix nfc_llcp_setsockopt() unsafe copies
    (CVE-2024-36915 bsc#1225758).
  - commit d2aa3fc


author: fvogt@suse.de
changelog:
  - rpm/kernel-obs-build.spec.in: Add iso9660 (bsc#1226212)
    Some builds don't just create an iso9660 image, but also mount it during
    build.
  - commit aaee141


author: tzimmermann@suse.com
changelog:
  - drm/msm: Fix null pointer dereference on pointer edp (bsc#1225261 CVE-2021-47445)
  - commit 7365fdb


author: oneukum@suse.com
changelog:
  - Bluetooth: qca: add missing firmware sanity checks
    (CVE-2024-36880 bsc#1225722).
  - commit 1f313de


author: tiwai@suse.de
changelog:
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker
    (CVE-2023-52764 bsc#1225571).
  - wifi: mac80211: don't return unset power in
    ieee80211_get_tx_power() (CVE-2023-52832 bsc#1225577).
  - commit 74cf739


author: tiwai@suse.de
changelog:
  - staging: rtl8192e: Fix use after free in
    _rtl92e_pci_disconnect() (CVE-2021-47571 bsc#1225518).
  - commit 9243acc


author: tiwai@suse.de
changelog:
  - pinctrl: core: delete incorrect free in pinctrl_enable()
    (CVE-2024-36940 bsc#1225840).
  - commit 6103cd4


author: tiwai@suse.de
changelog:
  - firewire: ohci: mask bus reset interrupts between ISR and
    bottom half (CVE-2024-36950 bsc#1225895).
  - commit 342de59


author: tiwai@suse.de
changelog:
  - media: imon: fix access to invalid resource for the second
    interface (CVE-2023-52754 bsc#1225490).
  - commit 0f818a4


author: jack@suse.cz
changelog:
  - fs/9p: only translate RWX permissions for plain 9P2000
    (bsc#1225866 CVE-2024-36964).
  - commit 7cf061b


author: colyli@suse.de
changelog:
  - raid1: fix use-after-free for original bio in raid1_write_request()
    (bsc#1221097, bsc#1224572, CVE-2024-35979).
  - commit daf8372


author: jack@suse.cz
changelog:
  - ext4: correct offset of gdb backup in non meta_bg group to
    update_backups (bsc#1224735 CVE-2024-35807).
  - commit 57ba8ce


author: fdmanana@suse.com
changelog:
  - btrfs: lock the inode in shared mode before starting fiemap
    (bsc#1225484 CVE-2023-52737).
  - commit e4a79d3


author: mkoutny@suse.com
changelog:
  - blk-cgroup: fix UAF by grabbing blkcg lock before destroying
    blkg pd (CVE-2021-47379 bsc#1225203).
  - commit 26f8206


author: mkoutny@suse.com
changelog:
  - blkcg: Fix multiple bugs in blkcg_activate_policy()
    (CVE-2021-47379 bsc#1225203).
  - blkcg: blkcg_activate_policy() should initialize ancestors first
    (CVE-2021-47379 bsc#1225203).
  - commit 5e6941f


author: ematsumiya@suse.de
changelog:
  - smb: client: fix use-after-free bug in
    cifs_debug_data_proc_show() (bsc#1225487, CVE-2023-52752).
  - commit b2bff17


author: heming.zhao@suse.com
changelog:
  - ocfs2: fix sparse warnings (bsc#1219224).
  - ocfs2: speed up chain-list searching (bsc#1219224).
  - ocfs2: adjust enabling place for la window (bsc#1219224).
  - ocfs2: improve write IO performance when fragmentation is high
    (bsc#1219224).
  - commit d862a97


author: oneukum@suse.com
changelog:
  - net: usb: smsc95xx: fix changing LED_SEL bit value updated
    from EEPROM (git-fixes).
  - commit d6ed297


author: dsterba@suse.com
changelog:
  - btrfs: fix false EIO for missing device (git-fixes)
  - Refresh
    patches.suse/btrfs-ensure-that-a-dup-or-raid1-block-group-has-exactly-two-stripes.patch
  - commit 01544ea


author: dsterba@suse.com
changelog:
  - Btrfs: send, fix issuing write op when processing hole in no data mode (git-fixes)
  - Refresh
    patches.suse/btrfs-send-fix-incorrect-file-layout-after-hole-punching-beyond-eof.patch.
  - commit f710800


author: dsterba@suse.com
changelog:
  - btrfs: fix crash when trying to resume balance without the resume flag (git-fixes)
  - commit f0fa7bc


author: jslaby@suse.cz
changelog:
  - tty: n_gsm: fix possible out-of-bounds in gsm0_receive()
    (CVE-2024-36016 bsc#1225642).
  - commit f5c4f31


author: davide.benini@suse.com
changelog:
  - netrom: Decrease sock refcount when sock timers expire
    (CVE-2021-47294 bsc#1224977).
  - commit 44bce11


author: davide.benini@suse.com
changelog:
  - net: validate lwtstate->data before returning from skb_tunnel_info()
    (CVE-2021-47309 bsc#1224967).
  - commit 2b76537


author: davide.benini@suse.com
changelog:
  - nfc: fix potential NULL pointer deref in nfc_genl_dump_ses_done
    (CVE-2021-47518 bsc#1225372).
  - commit d0fabf7


author: davide.benini@suse.com
changelog:
  - net/smc: Fix NULL pointer dereferencing in smc_vlan_by_tcpsk()
    (CVE-2021-47559 bsc#1225396).
  - commit ca251c9


author: jack@suse.cz
changelog:
  - ext4: avoid online resizing failures due to oversized flex bg
    (bsc#1222080 CVE-2023-52622).
  - commit a81bee5


author: jack@suse.cz
changelog:
  - fat: fix uninitialized field in nostale filehandles (git-fixes
    CVE-2024-26973 bsc#1223641).
  - commit 8b4f3fd


author: jack@suse.cz
changelog:
  - block: prevent division by zero in blk_rq_stat_sum()
    (bsc#1224661 CVE-2024-35925).
  - commit 7fd346a


author: neilb@suse.de
changelog:
  - NFSv4: Always clear the pNFS layout when handling ESTALE
    (bsc#1221791).
  - NFSv4: nfs_set_open_stateid must not trigger state recovery
    for closed state (bsc#1221791).
  - PNFS for stateid errors retry against MDS first (bsc#1221791).
  - commit fcd364d


author: tzimmermann@suse.com
changelog:
  - drm/vmwgfx: Fix invalid reads in fence signaled events (bsc#1225872 CVE-2024-36960)
  - commit fe8da4d


author: tzimmermann@suse.com
changelog:
  - amd/amdkfd: sync all devices to wait all processes being evicted (bsc#1225872 CVE-2024-36949)
  - commit aa91737


author: lduncan@suse.com
changelog:
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc()
    (bsc#1224651 CVE-2024-35930).
  - scsi: target: core: Add TMF to tmr_list handling (bsc#1223018
    CVE-26845).
  - scsi: scsi_debug: Fix out-of-bound read in resp_readcap16()
    (bsc#122286 CVE-2021-47191).
  - commit 3100b52


author: lduncan@suse.com
changelog:
  - blacklist.conf: bsc#1225559 CVE-2023-5281
    Does not apply cleanly at all, and addresses
    a corner case that it knows is rare.
  - commit 66930cf


author: dkirjanov@suse.com
changelog:
  - bonding: stop the device in bond_setup_by_slave() (bsc#1224946
    CVE-2023-52784).
  - commit da74b6f


author: iivanov@suse.de
changelog:
  - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (bsc#1226562 CVE-2021-47609)
  - commit 4642449


author: dkirjanov@suse.com
changelog:
  - net/mlx5e: fix a double-free in arfs_create_groups (bsc#1224605
    CVE-2024-35835).
  - commit 2cc5781


author: dkirjanov@suse.com
changelog:
  - net/mlx5: Properly link new fs rules into the tree (bsc#1224588
    CVE-2024-35960).
  - commit 14f14ea


author: tzimmermann@suse.com
changelog:
  - bsc#1225894: Fix build warning
    Fix the following build warning.
    * unused-variable (i) in ../drivers/gpu/drm/amd/amdkfd/kfd_device.c in kgd2kfd_resume
    ../drivers/gpu/drm/amd/amdkfd/kfd_device.c: In function 'kgd2kfd_resume':
    ../drivers/gpu/drm/amd/amdkfd/kfd_device.c:621:11: warning: unused variable 'i' [-Wunused-variable]
  - commit e16e5ba


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add 7af443ee16976 sched/core: Require cpu_active() in select_task_rq(), for user tasks
  - commit 35a10db


author: tiwai@suse.de
changelog:
  - mac80211: track only QoS data frames for admission control
    (CVE-2021-47602 bsc#1226554).
  - commit 6d84852


author: tiwai@suse.de
changelog:
  - wifi: ar5523: enable proper endpoint verification
    (CVE-2024-38565 bsc#1226747).
  - commit 7f113b6


author: tiwai@suse.de
changelog:
  - wifi: carl9170: add a proper sanity check for endpoints
    (CVE-2024-38567 bsc#1226769).
  - rpmsg: char: Fix race between the release of rpmsg_ctrldev
    and cdev (CVE-2022-48759 bsc#1226711).
  - commit 1d933f6


author: oneukum@suse.com
changelog:
  - net: usb: rtl8150 fix unintiatilzed variables in
    rtl8150_get_link_ksettings (git-fixes).
  - commit 996e5c4


author: tzimmermann@suse.com
changelog:
  - drm/msm/dsi: invalid parameter check in msm_dsi_phy_enable (bsc#1226698 CVE-2022-48756)
  - commit bd95a05


author: tzimmermann@suse.com
changelog:
  - drm/amd/display: Fix potential index out of bounds in color (bsc#1226767 CVE-2024-38552)
  - commit fdaaa54


author: tiwai@suse.de
changelog:
  - stm class: Fix a double free in stm_register_device()
    (CVE-2024-38627 bsc#1226857).
  - commit b4ea481


author: tiwai@suse.de
changelog:
  - dma-buf/sw-sync: don't enable IRQ from sync_print_obj()
    (CVE-2024-38780 bsc#1226886).
  - commit 0a1e3b6


author: tiwai@suse.de
changelog:
  - media: stk1160: fix bounds checking in stk1160_copy_video()
    (CVE-2024-38621 bsc#1226895).
  - commit 617f122


author: jlee@suse.com
changelog:
  - Update references tag
    patches.suse/Bluetooth-Disconnect-if-E0-is-used-for-Level-4.patch
    (bsc#1171988 CVE-2020-10135 bsc#1218148 CVE-2023-24023).
  - commit b41c397


author: tzimmermann@suse.com
changelog:
  - drm/nouveau: fix off by one in BIOS boundary checking (bsc#1226716 CVE-2022-48732)
  - commit bed5212


author: mfranc@suse.cz
changelog:
  - s390/ap: Fix crash in AP internal function modify_bitmap()
    (CVE-2024-38661 bsc#1226996 git-fixes).
  - commit 642fe77


author: colyli@suse.de
changelog:
  - Update to fix a compiling error,
    patches.suse/raid1-fix-use-after-free-for-original-bio-in-raid1_-fcf3.patch.
  - commit 4738bf0


author: fdmanana@suse.com
changelog:
  - btrfs: fix use-after-free after failure to create a snapshot
    (bsc#1226718 CVE-2022-48733).
  - commit bc8f6e2


author: dfaggioli@suse.com
changelog:
  - virtio-blk: fix implicit overflow on virtio_max_dma_size
    (bsc#1225573 CVE-2023-52762).
  - commit 630807b


author: oneukum@suse.com
changelog:
  - usb: xhci-plat: fix crash when suspend if remote wake enable
    (CVE-2022-48761 bsc#1226701).
  - commit 6918857


author: tbogendoerfer@suse.de
changelog:
  - enic: Validate length of nl attributes in enic_set_vf_port
    (CVE-2024-38659 bsc#1226883).
  - net: fec: remove .ndo_poll_controller to avoid deadlocks
    (CVE-2024-38553 bsc#1226744).
  - net/mlx5e: Fix netif state handling (CVE-2024-38608
    bsc#1226746).
  - eth: sungem: remove .ndo_poll_controller to avoid deadlocks
    (CVE-2024-38597 bsc#1226749).
  - net: amd-xgbe: Fix skb data length underflow (CVE-2022-48743
    bsc#1226705).
  - net: systemport: Add global locking for descriptor lifecycle
    (CVE-2021-47587 bsc#1226567).
  - commit 6fa5a1e


author: tiwai@suse.de
changelog:
  - fpga: bridge: add owner module and take its refcount
    (CVE-2024-36479 bsc#1226949).
  - commit 410068f


author: tiwai@suse.de
changelog:
  - fpga: region: add owner module and take its refcount
    (CVE-2024-35247 bsc#1226948).
  - commit 75fbd8f


author: tiwai@suse.de
changelog:
  - fpga: manager: add owner module and take its refcount
    (CVE-2024-37021 bsc#1226950).
  - commit 580ed12


author: tiwai@suse.de
changelog:
  - media: lgdt3306a: Add a check against null-pointer-def
    (CVE-2022-48772 bsc#1226976).
  - commit 79e986b


author: jgross@suse.com
changelog:
  - KVM: x86: Handle SRCU initialization failure during page track
    init (CVE-2021-47407, bsc#1225306).
  - commit 61b3e37


author: jwiesner@suse.de
changelog:
  - x86/tsc: Trust initial offset in architectural TSC-adjust MSRs
    (bsc#1222015 bsc#1226962).
  - commit c9f769c


author: mhocko@suse.com
changelog:
  - Update
    patches.suse/0006-dm-btree-remove-fix-use-after-free-in-rebalance_chil.patch
    (git-fixes CVE-2021-47600 bsc#1226575).
  - Update
    patches.suse/PCI-pciehp-Fix-infinite-loop-in-IRQ-handler-upon-pow.patch
    (git-fixes CVE-2021-47617 bsc#1226614).
  - Update
    patches.suse/USB-core-Fix-hang-in-usb_kill_urb-by-adding-memory-b.patch
    (git-fixes CVE-2022-48760 bsc#1226712).
  - Update
    patches.suse/audit-improve-robustness-of-the-audit-queue-handling.patch
    (bsc#1204514 CVE-2021-47603 bsc#1226577).
  - Update
    patches.suse/drm-vmwgfx-Fix-stale-file-descriptors-on-failed-user.patch
    (CVE-2022-22942 bsc#1195065 CVE-2022-48771 bsc#1226732).
  - Update patches.suse/igbvf-fix-double-free-in-igbvf_probe.patch
    (git-fixes CVE-2021-47589 bsc#1226557).
  - Update
    patches.suse/isdn-cpai-check-ctr-cnr-to-avoid-array-index-out-of-bound.patch
    (bsc#1191958 CVE-2021-43389 CVE-2021-4439 bsc#1226670).
  - Update
    patches.suse/net-ieee802154-ca8210-Stop-leaking-skb-s.patch
    (git-fixes CVE-2022-48722 bsc#1226619).
  - Update
    patches.suse/netfilter-complete-validation-of-user-input.patch
    (git-fixes CVE-2024-35896 bsc#1224662 CVE-2024-35962
    bsc#1224583).
  - Update patches.suse/phylib-fix-potential-use-after-free.patch
    (bsc#1119113 FATE#326472 CVE-2022-48754 bsc#1226692).
  - Update
    patches.suse/ring-buffer-Fix-a-race-between-readers-and-resize-checks.patch
    (bsc#1222893 CVE-2024-38601 bsc#1226876).
  - Update
    patches.suse/scsi-bnx2fc-Flush-destroy_work-queue-before-calling-bnx2fc_interface_put
    (git-fixes CVE-2022-48758 bsc#1226708).
  - Update patches.suse/scsi-bnx2fc-Make-bnx2fc_recv_frame-mp-safe
    (git-fixes CVE-2022-48715 bsc#1226621).
  - Update
    patches.suse/scsi-libfc-Fix-potential-NULL-pointer-dereference-in-fc_lport_ptp_setup.patch
    (git-fixes CVE-2023-52809 bsc#1225556).
  - Update
    patches.suse/scsi-qla2xxx-Fix-off-by-one-in-qla_edif_app_getstats.patch
    (git-fixes CVE-2024-36025 bsc#1225704).
  - Update
    patches.suse/scsi-scsi_debug-Sanity-check-block-descriptor-length-in-resp_mode_select
    (git-fixes CVE-2021-47576 bsc#1226537).
  - Update
    patches.suse/scsi-target-core-Add-TMF-to-tmr_list-handling.patch
    (bsc#1223018 CVE-26845 CVE-2024-26845).
  - Update
    patches.suse/tipc-improve-size-validations-for-received-domain-re.patch
    (bsc#1195254 CVE-2022-0435 CVE-2022-48711 bsc#1226672).
  - commit c2edf0b


author: fdmanana@suse.com
changelog:
  - btrfs: fix crash on racing fsync and size-extending write into
    prealloc (bsc#1227101 CVE-2024-37354).
  - btrfs: add helper to truncate inode items when logging inode
    (bsc#1227101 CVE-2024-37354).
  - btrfs: don't set the full sync flag when truncation does not
    touch extents (bsc#1227101 CVE-2024-37354).
  - btrfs: fix misleading and incomplete comment of btrfs_truncate()
    (bsc#1227101 CVE-2024-37354).
  - btrfs: make btrfs_truncate_inode_items take btrfs_inode
    (bsc#1227101 CVE-2024-37354).
  - commit 25e24a4


author: krisman@suse.de
changelog:
  - fs/9p: fix uninitialized values during inode evict (bsc#1225815
    CVE-2024-36923).
  - commit fccda1c


author: krisman@suse.de
changelog:
  - selinux: fix double free of cond_list on error paths
    (bsc#1226699 CVE-2022-48740).
  - commit c27761a


author: lduncan@suse.com
changelog:
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources
    after upload (bsc#1224767 CVE-2024-36919).
  - scsi: lpfc: Move NPIV's transport unregistration to after
    resource clean up (bsc#1225898 CVE-2024-36592).
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources
    after upload (bsc#1224767 CVE-2024-36919).
  - scsi: lpfc: Move NPIV's transport unregistration to after
    resource clean up (bsc#1225898 CVE-2024-36592).
  - commit 011e140


author: jlee@suse.com
changelog:
  - ACPI: processor_idle: Fix memory leak in
    acpi_processor_power_exit() (bsc#1223043 CVE-2024-26894).
  - commit 69014d4


author: jlee@suse.com
changelog:
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout
    (bsc#1224177 CVE-2024-27399).
  - commit f1f5272


author: jdelvare@suse.de
changelog:
  - watchdog: cpu5wdt.c: Fix use-after-free bug caused by
    cpu5wdt_trigger (bsc#1226908 CVE-2024-38630).
  - commit 4e6b95e


author: pjakobsson@suse.de
changelog:
  - blacklist.conf: ecedd99a9369 drm/amd/display: Skip on writeback when it's not applicable
  - commit 7f9ee16


author: mkubecek@suse.cz
changelog:
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in
    ip6_tnl_parse_tlv_enc_lim() (CVE-2024-26633 bsc#1221647).
  - commit 6bed746


author: lhenriques@suse.de
changelog:
  - hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021
    CVE-2024-26863).
  - net: hsr: fix placement of logical operator in a multi-line
    statement (bsc#1223021).
  - hsr: Fix uninit-value access in hsr_get_node() (bsc#1223021
    CVE-2024-26863).
  - net: hsr: fix placement of logical operator in a multi-line
    statement (bsc#1223021).
  - commit bea7af4


author: mkubecek@suse.cz
changelog:
  - ip6_tunnel: make sure to pull inner header in __ip6_tnl_rcv()
    (CVE-2024-26641 bsc#1221654).
  - commit 785d6bf


author: pjakobsson@suse.de
changelog:
  - blacklist.conf: 9cb46b31f3d0 drm/xe/xe_migrate: Cast to output precision before multiplying operands
  - commit 6d5246f


author: tbogendoerfer@suse.de
changelog:
  - iavf: free q_vectors before queues in iavf_disable_vf
    (CVE-2021-47201 bsc#1222792).
  - commit 5fa75c2


author: oneukum@suse.com
changelog:
  - usb-storage: alauda: Check whether the media is initialized
    (CVE-2024-38619 bsc#1226861).
  - commit 8f69e1a


author: nmorey@suse.com
changelog:
  - net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path (bsc#1225229 CVE-2021-47438)
  - commit eebb92a


author: nmorey@suse.com
changelog:
  - net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() (bsc#1225229 CVE-2021-47438)
  - commit dd90392


author: colyli@suse.de
changelog:
  - dm snapshot: fix lockup in dm_exception_table_exit (bsc#1224743,
    CVE-2024-35805).
  - dm: call the resume method on internal suspend (bsc#1223188,
    CVE-2024-26880).
  - dm rq: don't queue request to blk-mq during DM suspend
    (bsc#1225357, CVE-2021-47498).
  - bcache: avoid oversized read request in cache missing code path
    (bsc#1224965, CVE-2021-47275).
  - bcache: remove bcache device self-defined readahead
    (bsc#1224965, CVE-2021-47275).
  - commit 0df91b9


author: colyli@suse.de
changelog:
  - md: fix resync softlockup when bitmap size is less than array
    size (CVE-2024-38598, bsc#1226757).
  - commit e578184


author: jlee@suse.com
changelog:
  - wifi: libertas: fix some memleaks in lbs_allocate_cmd_buffer()
    (bsc#1224622 CVE-2024-35828).
  - commit 9f39e76


author: mkubecek@suse.cz
changelog:
  - llc: make llc_ui_sendmsg() more robust against bonding changes
    (CVE-2024-26636 bsc#1221659).
  - commit 727fec1


author: pjakobsson@suse.de
changelog:
  - drm/arm/malidp: fix a possible null pointer dereference (CVE-2024-36014 bsc#1225593).
  - commit 3f35223


author: pjakobsson@suse.de
changelog:
  - blacklist.conf: 31729e8c21ec drm/amd/pm: fixes a random hang in S4 for SMU v13.0.4/11
  - commit 785f136


author: pjakobsson@suse.de
changelog:
  - drm/amd/display: Avoid NULL dereference of timing generator (CVE-2023-52753 bsc#1225478).
  - commit f316fd9


author: pjakobsson@suse.de
changelog:
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 (CVE-2023-52818 bsc#1225530).
  - commit d67dcd9


author: pjakobsson@suse.de
changelog:
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga (CVE-2023-52819 bsc#1225532).
  - commit d196cd8


author: pjakobsson@suse.de
changelog:
  - blacklist.conf: 406e8845356d drm/amd: check num of link levels when update pcie param
  - commit f93c72c


author: pjakobsson@suse.de
changelog:
  - blacklist.conf: cd90511557fd drm/amdgpu/vkms: fix a possible null pointer dereference
  - commit d0def0c


author: pjakobsson@suse.de
changelog:
  - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (CVE-2023-52817 bsc#1225569).
  - commit d2e5a64


author: lhenriques@suse.de
changelog:
  - net: tulip: de4x5: fix the problem that the array 'lp->phy'
    may be  out of bound (bsc#1225505 CVE-2021-47547).
  - commit 605a3ba


author: mkoutny@suse.com
changelog:
  - blacklist.conf: Add c7fcb99877f9 sched/rt: Fix sysctl_sched_rr_timeslice intial value
  - commit 71427f6


author: pjakobsson@suse.de
changelog:
  - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (git-fixes).
  - commit a2420fb


author: jlee@suse.com
changelog:
  - soc: fsl: qbman: Always disable interrupts when taking cgr_lock
    (bsc#1224683 CVE-2024-35819).
  - commit 99e6ba5


author: jlee@suse.com
changelog:
  - soc: fsl: qbman: Add helper for sanity checking cgr ops
    (bsc#1224683 CVE-2024-35819).
  - commit b33b9fc


author: neilb@suse.de
changelog:
  - SUNRPC: Fix loop termination condition in
    gss_free_in_token_pages() (git-fixes).
  - sunrpc: fix NFSACL RPC retry on soft mount (git-fixes).
  - SUNRPC: Fix gss_free_in_token_pages() (git-fixes).
  - nfs: Handle error of rpc_proc_register() in nfs_net_init()
    (git-fixes).
  - commit 823e515


author: msuchanek@suse.de
changelog:
  - powerpc/rtas: Prevent Spectre v1 gadget construction in
    sys_rtas() (bsc#1227487).
  - commit 564651d


author: lhenriques@suse.de
changelog:
  - can: pch_can: pch_can_rx_normal: fix use after free (bsc#1225431
    CVE-2021-47520).
  - commit 0efd10b


author: nik.borisov@suse.com
changelog:
  - PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820  integrity check (git-fixes).
  - commit 63895f5


author: nik.borisov@suse.com
changelog:
  - x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys (git-fixes).
  - commit f7c83aa


author: nik.borisov@suse.com
changelog:
  - x86/ioremap: Fix page aligned size calculation in __ioremap_caller() (git-fixes).
  - commit 51d4d78


author: nik.borisov@suse.com
changelog:
  - kgdb: Move the extern declaration kgdb_has_hit_break() to generic  kgdb.h (git-fixes).
  - commit 4c96601


author: tzimmermann@suse.com
changelog:
  - fbdev: savage: Handle err return when savagefb_check_var failed (bsc#1227435 CVE-2024-39475)
  - commit 3cf493f


author: nik.borisov@suse.com
changelog:
  - x86/kprobes: Fix kprobes instruction boudary check with CONFIG_RETHUNK (git-fixes).
  - commit 29d18ef


author: dkirjanov@suse.com
changelog:
  - Fix the warning:
    * return makes pointer from integer without a cast [enabled by default] in ../drivers/infiniband/hw/mlx5/srq.c in mlx5_ib_create_srq
    ../drivers/infiniband/hw/mlx5/srq.c: In function 'mlx5_ib_create_srq':
    ../drivers/infiniband/hw/mlx5/srq.c:259:3: warning: return makes pointer from integer without a cast [enabled by default]
  - commit d292fa8


author: dkirjanov@suse.com
changelog:
  - netfilter: Implement reference counting for nft_sets
    (bsc#1215420 CVE-2023-4244).
  - commit b5c850d


author: dkirjanov@suse.com
changelog:
  - netfilter: take a reference when looking up nft_sets
    (bsc#1215420 CVE-2023-4244).
  - commit 3f2e165


author: jlee@suse.com
changelog:
  - ACPI: video: check for error while searching for backlight
    device parent (bsc#1224686 CVE-2023-52693).
  - commit aafdad5


author: tiwai@suse.de
changelog:
  - Fix spurious WARNING caused by a qxl driver patch (bsc#1227213,bsc#1227191)
    Refresh patches.suse/drm-qxl-fix-UAF-on-handle-creation.patch
  - commit 55a7bf6


author: mkoutny@suse.com
changelog:
  - blacklist.conf: convert entry to Alt-commit:
    Refresh   patches.suse/net_sched-fix-a-race-condition-in-tcindex_destroy.patch.
  - commit 4a1ea17


author: mkoutny@suse.com
changelog:
  - net: sched: fix memory leak in tcindex_partial_destroy_work (CVE-2021-47295 bsc#1224975)
  - commit 280e278


author: mkoutny@suse.com
changelog:
  - net_sched: fix a memory leak in cls_tcindex (bsc#1224975).
  - Refresh
    patches.suse/net_sched-fix-an-OOB-access-in-cls_tcindex.patch.
  - Refresh
    patches.suse/net_sched-keep-alloc_hash-updated-after-hash-allocat.patch.
  - commit 98c1fbb


author: mkoutny@suse.com
changelog:
  - net_sched: add a temporary refcnt for struct tcindex_data
    (bsc#1224975).
  - Refresh
    patches.suse/net-sched-tcindex-update-imperfect-hash-filters-resp.patch.
  - commit b3f881b


author: oneukum@suse.com
changelog:
  - xhci: handle isoc Babble and Buffer Overrun events properly
    (CVE-2024-26659 bsc#1222317).
  - commit 98fde6e


author: lduncan@suse.com
changelog:
  - Update
    patches.suse/scsi-bnx2fc-Remove-spin_lock_bh-while-releasing-resources-after-upload.patch
    (bsc#1225767 CVE-2024-36919).
    fix incorrect bug number
  - commit d503d18


author: jlee@suse.com
changelog:
  - ACPI: CPPC: Drop redundant local variable from cpc_read()
    (bsc#1224557 CVE-2024-35995).
  - commit 73812cd


author: jlee@suse.com
changelog:
  - ACPI: CPPC: Use access_width over bit_width for system memory
    accesses (bsc#1224557 CVE-2024-35995).
  - commit ef057c5


author: jlee@suse.com
changelog:
  - ACPI: CPPC: Fix bit_offset shift in MASK_VAL() macro
    (bsc#1224557 CVE-2024-35995).
  - commit ae6202b


author: jlee@suse.com
changelog:
  - ACPI: CPPC: Fix access width used for PCC registers (bsc#1224557
    CVE-2024-35995).
  - commit 33ff733


author: nstange@suse.de
changelog:
  - blacklist.conf: 55e78c933d74 mm: zswap: increase reject_compress_poor but not reject_compress_fail if compression returns ENOSPC
    bsc#1221616, CVE-2023-52612 required backport of
    commit 744e1885922a ("crypto: scomp - fix req->dst buffer overflow"),
    for which there is the subsequent commit 55e78c933d74 ("mm: zswap:
    increase reject_compress_poor but not reject_compress_fail if
    compression returns ENOSPC") referencing it from the Fixes tag.
    That latter commit fixes a debugfs counter stat (reject_compress_fail),
    which got introduced only with commit cb61dad80fdc ("zswap: export
    compression failure stats"). Thus, it's not needed, blacklist it.
  - commit 6bbc535


author: nstange@suse.de
changelog:
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng
    (CVE-2023-52615 bsc#1221614).
  - commit c3d2ac9


author: nstange@suse.de
changelog:
  - crypto: s390/aes - Fix buffer overread in CTR mode
    (CVE-2023-52669 bsc#1224637).
  - commit bc65b53


author: oneukum@suse.com
changelog:
  - xhci: get isochronous ring directly from endpoint structure
    (CVE-2024-26659 bsc#1222317).
  - commit 1c8c540


author: jlee@suse.com
changelog:
  - Bluetooth: Fix memory leak in hci_req_sync_complete()
    (bsc#1224571 CVE-2024-35978).
  - commit 0071ef8


author: oneukum@suse.com
changelog:
  - usb: xhci: Remove ep_trb from xhci_cleanup_halted_endpoint()
    (CVE-2024-26659 bsc#1222317).
  - Refresh
    patches.suse/xhci-remove-extra-loop-in-interrupt-context.patch.
  - commit 93f2e51


author: oneukum@suse.com
changelog:
  - xhci: Add a separate debug message for split transaction errors
    (CVE-2024-26659 bsc#1222317).
  - commit 93897b0


author: oneukum@suse.com
changelog:
  - xhci: store TD status in the td struct instead of passing it
    along (CVE-2024-26659 bsc#1222317).
  - commit dba92cd


author: oneukum@suse.com
changelog:
  - xhci: process isoc TD properly when there was a transaction
    error mid TD (CVE-2024-26659 bsc#1222317).
  - commit 1966e44


author: oneukum@suse.com
changelog:
  - xhci: Fix incorrect tracking of free space on transfer rings
    (CVE-2024-26659 bsc#1222317).
  - commit 985549c


author: nik.borisov@suse.com
changelog:
  - Fix build warning
    Refresh
    patches.suse/PM-hibernate-x86-Use-crc32-instead-of-md5-for-hibernation-.patch.
  - commit 33d6e41


author: rgoldwyn@suse.com
changelog:
  - pstore/ram: Fix crash when setting number of cpus to an odd number (bsc#1221618, CVE-2023-52619).
  - commit 03ca866


author: mkoutny@suse.com
changelog:
  - Update
    patches.suse/SUNRPC-Fix-loop-termination-condition-in-gss_free_in.patch
    (git-fixes CVE-2024-36288 bsc#1226834).
  - Update
    patches.suse/arm64-asm-bug-Add-.align-2-to-the-end-of-__BUG_ENTRY.patch
    (git-fixes CVE-2024-39488 bsc#1227618).
  - Update
    patches.suse/ax25-fix-use-after-free-bugs-caused-by-ax25_ds_del_t.patch
    (CVE-2024-35887 bzg#1224663 bsc#1224663).
  - Update
    patches.suse/net-mlx5e-nullify-cq-dbg-pointer-in-mlx5_debug_cq_re.patch
    (bsc#1225229 CVE-2021-47438 CVE-2021-47197 bsc#1222776).
  - Update
    patches.suse/nfs-Handle-error-of-rpc_proc_register-in-nfs_net_ini.patch
    (git-fixes CVE-2024-36939 bsc#1225838).
  - Update
    patches.suse/scsi-lpfc-Move-NPIV-s-transport-unregistration-to-after-resource-clean-up.patch
    (bsc#1225898 CVE-2024-36592 CVE-2024-36952).
  - Update
    patches.suse/scsi-scsi_debug-Fix-out-of-bound-read-in-resp_readcap16.patch
    (bsc#122286 CVE-2021-47191 bsc#1222866).
  - Update
    patches.suse/soc-fsl-qbman-Always-disable-interrupts-when-taking-.patch
    (bsc#1224683 CVE-2024-35819 CVE-2024-35806 bsc#1224699).
  - commit 81c691f


author: jlee@suse.com
changelog:
  - Bluetooth: SCO: Fix not validating setsockopt user input
    (bsc#1224576 CVE-2024-35966).
  - commit d80abbf


author: vkarasulli@suse.de
changelog:
  - ipv6: sr: fix missing sk_buff release in seg6_input_core
    (bsc#1227626 CVE-2024-39490).
  - net: openvswitch: fix overwriting ct original tuple for  ICMPv6
    (bsc#1226783 CVE-2024-38558).
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump
    (bsc#1220942 CVE-2024-26615).
  - commit ee46311


author: mhocko@suse.com
changelog:
  - tipc: Check the bearer type before calling
    tipc_udp_nl_bearer_add() (CVE-2024-26663 bsc#1222326).
  - commit 91299f0


author: dsterba@suse.com
changelog:
  - btrfs: use latest_dev in btrfs_show_devname (CVE-2021-47599 bsc#1226571)
    Simplified backport, keep mutex protection and only remove WARN_ON.
  - commit 2ee6fb6


author: dsterba@suse.com
changelog:
  - net: qlogic: qlcnic: Fix a NULL pointer dereference in qlcnic_83xx_add_rings() (CVE-2021-47542 bsc#1225455)
  - commit ce2e7bb


author: tiwai@suse.de
changelog:
  - drivers: core: synchronize really_probe() and dev_uevent()
    (CVE-2024-39501 bsc#1227754).
  - commit 1b7df5b


author: tbogendoerfer@suse.de
changelog:
  - i40e: Do not allow untrusted VF to remove administratively
    set MAC (CVE-2024-26830 bsc#1223012).
  - nfp: Fix memory leak in nfp_cpp_area_cache_add() (CVE-2021-47516
    bsc#1225427).
  - i40e: Fix NULL pointer dereference in i40e_dbg_dump_desc
    (CVE-2021-47501 bsc#1225361).
  - commit e2ee4f5


author: lduncan@suse.com
changelog:
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated
    memory (bsc#1227762 CVE-2024-40901).
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up()
    (bsc#1225820 CVE-2024-26924).
  - scsi: scsi_debug: Fix type in min_t to avoid stack OOB
    (bsc#1226560 CVE-2021-47580).
  - commit 4de5c4e


author: oneukum@suse.com
changelog:
  - signal: Replace memset(info,...) with clear_siginfo for clarity
    (CVE-2021-47582 bsc#1226559).
  - commit 10e5b53


author: oneukum@suse.com
changelog:
  - usb: usbfs: use irqsave() in USB's complete callback
    (CVE-2021-47582 bsc#1226559).
  - commit 89f4a73


author: oneukum@suse.com
changelog:
  - usb: core: Replace hardcoded check with inline function from
    usb.h (CVE-2021-47582 bsc#1226559).
  - commit a0c8b54


author: oneukum@suse.com
changelog:
  - usb: usbfs: only account once for mmap()'ed usb memory usage
    (CVE-2021-47582 bsc#1226559).
  - commit a282a95


author: oneukum@suse.com
changelog:
  - usb: core: devio.c: Fix assignment of 0/1 to bool variables
    (CVE-2021-47582 bsc#1226559).
  - commit 202a764


author: oneukum@suse.com
changelog:
  - usb: usbfs: correct kernel->user page attribute mismatch
    (CVE-2021-47582 bsc#1226559).
  - commit d089a07


author: mhocko@suse.com
changelog:
  - net: netlink: af_netlink: Prevent empty skb by adding a check
    on len (CVE-2021-47606 bsc#1226555).
  - commit 314dfef


author: oneukum@suse.com
changelog:
  - USB: core: Make do_proc_control() and do_proc_bulk() killable
    (CVE-2021-47582 bsc#1226559).
  - commit 6d322e2


author: mhocko@suse.com
changelog:
  - ipv6: fib6_rules: avoid possible NULL dereference in
    fib6_rule_action() (CVE-2024-36902 bsc#1225719).
  - commit 4cdf9a2


author: tiwai@suse.de
changelog:
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids
    (CVE-2024-40929 bsc#1227774).
  - wifi: mac80211: Fix deadlock in
    ieee80211_sta_ps_deliver_wakeup() (CVE-2024-40912 bsc#1227790).
  - wifi: mac80211: mesh: Fix leak of mesh_preq_queue objects
    (CVE-2024-40942 bsc#1227770).
  - NFC: port100: fix use-after-free in port100_send_complete
    (CVE-2022-48857 bsc#1228005).
  - commit 1f497da


author: dsterba@suse.com
changelog:
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (CVE-2024-27019 bsc#1223813)
  - commit 2fcd5af


author: ohering@suse.de
changelog:
  - net: mana: Fix the extra HZ in mana_hwc_send_request (git-fixes).
  - net: mana: select PAGE_POOL (git-fixes).
  - hv_netvsc: rndis_filter needs to select NLS (git-fixes).
  - Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj (git-fixes, bsc#1227924, CVE-2022-48775).
  - Tools: hv: kvp: eliminate 'may be used uninitialized' warning (git-fixes).
  - tools: hv: fix KVP and VSS daemons exit code (git-fixes).
  - commit 51c2361


author: dsterba@suse.com
changelog:
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (CVE-2024-27020 bsc#1223815)
  - commit cfe8cf0


author: dsterba@suse.com
changelog:
  - cfg80211: call cfg80211_stop_ap when switch from P2P_GO type (CVE-2021-47194 bsc#1222829)
  - commit 6cc8bdc


author: dsterba@suse.com
changelog:
  - mlxsw: thermal: Fix out-of-bounds memory accesses (CVE-2021-47441 bsc#1225224)
    Simplified backport. Upstream patch removes code that does not exist in
    SLE12-SP5, the only relevant fix is the bounds checking.
  - commit 0b8797d


author: davide.benini@suse.com
changelog:
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr()
    (CVE-2024-40959 bsc#1227884).
  - commit 38ba090


author: jdelvare@suse.de
changelog:
  - Update
    patches.suse/scsi-scsi_debug-Fix-out-of-bound-read-in-resp_readcap16.patch.
    Fix a build warning about using min() vs min_t().
  - commit a4b6164


author: dsterba@suse.com
changelog:
  - blacklist.conf: CVE-2024-35934 bsc#1224641: not applicable
    Patch fixing code that does not exist in SLE12-SP5 and there's no
    equivalent either. Added by e888a2e8337c96 ("net/smc: introduce list of
    pnetids for Ethernet devices").
  - commit 4b9f331


author: dsterba@suse.com
changelog:
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CVE-2024-39487 bsc#1227573)
  - commit b775587


author: dsterba@suse.com
changelog:
  - HID: core: remove unnecessary WARN_ON() in implement() (CVE-2024-39509 bsc#1227733)
  - commit fe2364e


author: dsterba@suse.com
changelog:
  - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CVE-2024-39499 bsc#1227725)
  - commit d42ba53


author: jgross@suse.com
changelog:
  - KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()
    (CVE-2024-40953, bsc#1227806).
  - commit b18a093


author: jlee@suse.com
changelog:
  - Bluetooth: RFCOMM: Fix not validating setsockopt user input
    (bsc#1224576 CVE-2024-35966).
  - commit 68cb9dc


author: mhocko@suse.com
changelog:
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation
    (git-fixes CVE-2024-40941 bsc#1227771).
  - commit e4b5384


author: mhocko@suse.com
changelog:
  - vmxnet3: disable rx data ring on dma allocation failure
    (CVE-2024-40923 bsc#1227786).
  - commit 4f3a9e9


author: tbogendoerfer@suse.de
changelog:
  - Refresh
    patches.suse/ipv6-sr-fix-missing-sk_buff-release-in-seg6_input_co.patch.
    Fix broken patch, which only applys with rapidquilt but not with normal
    patch.
  - commit 9ba3403


author: tbogendoerfer@suse.de
changelog:
  - gve: Clear napi->skb before dev_kfree_skb_any() (CVE-2024-40937
    bsc#1227836).
  - net: hns3: fix kernel crash problem in concurrent scenario
    (CVE-2024-39507 bsc#1227730).
  - ibmvnic: don't release napi in __ibmvnic_open() (CVE-2022-48811
    bsc#1227928).
  - commit 753a87a


author: jlee@suse.com
changelog:
  - Update References
    patches.suse/Bluetooth-SMP-Fail-if-remote-and-local-public-keys-a.patch
    (bsc#1186463, CVE-2021-0129, CVE-2020-26558, bsc#1179610,
    CVE-2020-26558).
  - commit ef3041a


author: lduncan@suse.com
changelog:
  - scsi: bfa: Ensure the copied buf is NUL terminated (bsc#1226786
    CVE-2024-38560).
  - commit 2623515


author: lduncan@suse.com
changelog:
  - Update
    patches.suse/scsi-scsi_debug-Fix-type-in-min_t-to-avoid-stack-OOB.patch
    (bsc#1226550 CVE-2021-47580).
    Fix incorrect bug#
  - commit a8e747b


author: dkirjanov@suse.com
changelog:
  - ipv6: sr: fix possible use-after-free and null-ptr-deref
    (bsc#1222372 CVE-2024-26735).
  - commit 5258c5a


author: lduncan@suse.com
changelog:
  - scsi: scsi_debug: Fix out-of-bound read in resp_report_tgtpgs()
    (bsc#1226550 CVE-2021-47580).
  - commit 72ff240


author: mhocko@suse.com
changelog:
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in
    ath9k_htc_txstatus() (CVE-2023-52594 bsc#1221045).
  - commit d04a718


author: mhocko@suse.com
changelog:
  - ipmr,ip6mr: acquire RTNL before calling ip[6]mr_free_table()
    on failure path (CVE-2022-48810 bsc#1227936).
  - commit 7af1a4f


author: jslaby@suse.cz
changelog:
  - tools lib: Fix builds when glibc contains strlcpy() (git-fixes).
  - blacklist.conf: unblaclist it
    This commit allows for local builds with newer glibc.
  - commit 480e775


author: jlee@suse.com
changelog:
  - mac80211: limit injected vht mcs/nss in
    ieee80211_parse_tx_radiotap (bsc#1225326 CVE-2021-47395).
  - commit 2fdeaab


author: jlee@suse.com
changelog:
  - isdn: mISDN: Fix sleeping function called from invalid context
    (bsc#1225346 CVE-2021-47468).
  - commit 34167c4


author: tiwai@suse.de
changelog:
  - ssb: Fix potential NULL pointer dereference in
    ssb_device_uevent() (CVE-2024-40982 bsc#1227865).
  - commit 9fbb468


author: oneukum@suse.com
changelog:
  - usb: core: Don't hold the device lock while sleeping in
    do_proc_control() (CVE-2021-47582 bsc#1226559).
  - commit ff00ceb


author: jdelvare@suse.de
changelog:
  - Update patches.suse/ovl-fix-failure-to-fsync-lower-dir.patch
    (bsc#1088701).
    Fix bug reference (missing digit).
  - commit 718aec5


author: jdelvare@suse.de
changelog:
  - Update
    patches.suse/nvme-rdma-remove-redundant-reference-between-ib_devi.patch
    (bsc#1149446).
    Fix bug reference (missing digit).
  - commit 4f5320f


author: lduncan@suse.com
changelog:
  - Update
    patches.suse/scsi-lpfc-Release-hbalock-before-calling-lpfc_worker_wake_up.patch
    (bsc#1225820 CVE-2024-36924).
    Fix incorrect CVE number.
  - commit cb94423


author: lduncan@suse.com
changelog:
  - Update
    patches.suse/scsi-scsi_debug-Fix-out-of-bound-read-in-resp_report_tgtpgs.patch
    (bsc#1222824 CVE-2021-47219).
    Fix incorrect Bug number and incorrect CVE number.
  - commit b4dbf5c


author: dsterba@suse.com
changelog:
  - net-sysfs: add check for netdevice being present to speed_show (CVE-2022-48850 bsc#1228071)
  - commit 9fdf37b


author: jslaby@suse.cz
changelog:
  - kABI: tty: add the option to have a tty reject a new ldisc
    (kabi CVE-2024-40966 bsc#1227886).
  - tty: add the option to have a tty reject a new ldisc
    (CVE-2024-40966 bsc#1227886).
  - commit 16b4088


author: jslaby@suse.cz
changelog:
  - serial: imx: Introduce timeout when waiting on transmitter empty
    (CVE-2024-40967 bsc#1227891).
  - commit 9b7db88


author: jslaby@suse.cz
changelog:
  - vt_ioctl: fix array_index_nospec in vt_setactivate
    (CVE-2022-48804 bsc#1227968).
  - commit ee44df4


author: dkirjanov@suse.com
changelog:
  - Refresh
    patches.suse/powerpc-rtas-Prevent-Spectre-v1-gadget-construction-.patch.
  - commit af33133


author: davide.benini@suse.com
changelog:
  - sit: do not call ipip6_dev_free() from sit_init_net()
    (CVE-2021-47588 bsc#1226568).
  - commit 9afcbd9


author: jdelvare@suse.de
changelog:
  - Update
    patches.suse/xhci-Fix-incorrect-tracking-of-free-space-on-transfe.patch.
    Fix a backporting mistake which was causing the following warning:
    drivers/usb/host/xhci-ring.c: In function 'xhci_queue_intr_tx':
    drivers/usb/host/xhci-ring.c:3255:6: warning: unused variable 'trbs_freed' [-Wunused-variable]
  - commit 787d888


author: tbogendoerfer@suse.de
changelog:
  - tun: add missing verification for short frame (CVE-2024-41091
    bsc#1228327).
  - tap: add missing verification for short frame (CVE-2024-41090
    bsc#1228328).
  - net: ena: Add validation for completion descriptors consistency
    (CVE-2024-40999 bsc#1227913).
  - net: mvpp2: clear BM pool before initialization (CVE-2024-35837
    bsc#1224500).
  - commit 69b68ee


author: ailiop@suse.com
changelog:
  - xfs: add bounds checking to xlog_recover_process_data
    (bsc#1228408 CVE-2024-41014).
  - commit b3db770


author: ailiop@suse.com
changelog:
  - xfs: refactor xfs_verifier_error and xfs_buf_ioerror
    (git-fixes).
  - Refresh
    patches.suse/xfs-don-t-ever-return-a-stale-pointer-from-__xfs_dir.patch.
  - commit ac4dc1f


author: jlee@suse.com
changelog:
  - HID: usbhid: free raw_report buffers in usbhid_stop (bsc#1225238
    CVE-2021-47405).
  - commit 67ff2bd


author: msuchanek@suse.de
changelog:
  - KVM: PPC: Book3S HV: Prevent UAF in
    kvm_spapr_tce_attach_iommu_group() (bsc#1228581 CVE-2024-41070).
  - commit 1cd5894


author: dsterba@suse.com
changelog:
  - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (CVE-2024-42070 bsc#1228470)
  - commit d9e81e6


author: dsterba@suse.com
changelog:
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev() (CVE-2024-41063 bsc#1228580)
  - commit 95070bc


author: dsterba@suse.com
changelog:
  - Fix reference in patches.suse/ixgbe-Fix-NULL-pointer-dereference-in-ixgbe_xdp_setu.patch (CVE-2021-47399 bsc#1225328)
  - commit 7933225


author: jslaby@suse.cz
changelog:
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ (bsc#1222625
    CVE-2024-27437).
  - commit 9829ce8


author: heming.zhao@suse.com
changelog:
  - ocfs2: add bounds checking to ocfs2_check_dir_entry()
    (bsc#1228409 CVE-2024-41015).
  - ocfs2: strict bound check before memcmp in
    ocfs2_xattr_find_entry() (bsc#1228410).
  - ocfs2: add bounds checking to ocfs2_xattr_find_entry()
    (bsc#1228410 CVE-2024-41016).
  - ocfs2: remove redundant assignment to variable free_space
    (bsc#1228409).
  - commit 2a658bc


author: oneukum@suse.com
changelog:
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log
    messages (git-fixes).
  - commit 7c21caa


author: jack@suse.cz
changelog:
  - ext4: fix uninitialized ratelimit_state->lock access in
    __ext4_fill_super() (bsc#1227866 CVE-2024-40998).
  - commit 5fe487a


author: dsterba@suse.com
changelog:
  - blacklist.conf: CVE-2024-41076 bsc#1228649: not applicable
    Different code using a local variable, switch to dynamic allocation done
    in 1b00ad657997c8 ("NFS: Remove the nfs4_label from the nfs_setattrres")
    in 5.16.
  - commit ff35317


author: lduncan@suse.com
changelog:
  - scsi: qedi: Fix crash while reading debugfs attribute
    (bsc#1227929 CVE-2024-40978).
  - scsi: pm8001: Fix use-after-free for aborted SSP/STP sas_task
    (bsc#1228013 CVE-2022-48792).
  - scsi: qedf: Fix refcount issue when LOGO is received during TMF
    (bsc#1228045 CVE-2022-48823).
  - commit 2a5c419


author: dsterba@suse.com
changelog:
  - btrfs: make sure that WRITTEN is set on all metadata blocks (CVE-2024-35949 bsc#1224700)
    Changes: adjust returned error codes to -EUCLEAN and drop definition of
    the enum error.
  - commit 6dc890d


author: msuchanek@suse.de
changelog:
  - powerpc/eeh: avoid possible crash when edev->pdev changes
    (CVE-2024-41064 bsc#1228599).
  - commit 145d8ea


author: tiwai@suse.de
changelog:
  - wifi: mac80211: Avoid address calculations via out of bounds
    array indexing (CVE-2024-41071 bsc#1228625).
  - commit be2129f


author: fdmanana@suse.com
changelog:
  - btrfs: qgroup: fix quota root leak after quota disable failure
    (bsc#1228655 CVE-2024-41078).
  - commit 263e74a


author: neilb@suse.de
changelog:
  - NFSD: Fix NFSv3 SETATTR/CREATE's handling of large file sizes
    (CVE-2022-48829 bsc#1228055).
  - NFSD: Fix ia_size underflow (CVE-2022-48828 bsc#1228054).
  - NFSD: Fix the behavior of READ near OFFSET_MAX (CVE-2022-48827
    bsc#1228037).
  - commit 1c127f3


author: tzimmermann@suse.com
changelog:
  - drm/radeon: check bo_va->bo is non-NULL before using it (bsc#1228567 CVE-2024-41060)
  - commit 7a28cea


author: tzimmermann@suse.com
changelog:
  - drm/nouveau/dispnv04: fix null pointer dereference in (bsc#1228658 CVE-2024-41089)
  - commit aec5d0e


author: tbogendoerfer@suse.de
changelog:
  - net/dpaa2: Avoid explicit cpumask var allocation on stack
    (CVE-2024-42093 bsc#1228680).
  - dpaa2-eth: Refactor xps code (CVE-2024-42093 bsc#1228680).
  - commit caf72f9


author: tbogendoerfer@suse.de
changelog:
  - ppp: reject claimed-as-LCP but actually malformed packets
    (CVE-2024-41044 bsc#1228530).
  - ibmvnic: Add tx check to prevent skb leak (CVE-2024-41066
    bsc#1228640).
  - commit 0bdb098


author: davide.benini@suse.com
changelog:
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc()
    (CVE-2024-40995 bsc#1227830).
  - commit ee1ce8a


author: dsterba@suse.com
changelog:
  - skmsg: Skip zero length skb in sk_msg_recvmsg (CVE-2024-41048 bsc#1228565)
    Based on c9c89dcd872e ("bpf, sockmap: Fix partial copy_page_to_iter so
    progress can still be made"), previous commit.
    Upstream commit 2bc793e3272a13 ("skmsg: Extract __tcp_bpf_recvmsg() and
    tcp_bpf_wait_data()") moved the code from net/ipv4/tcp_bpf.c to
    net/core/skmsg.c.
  - commit 80be5ae


author: dsterba@suse.com
changelog:
  - bpf, sockmap: Fix partial copy_page_to_iter so progress can still be made (CVE-2024-41048 bsc#1228565)
  - commit 79dff63


author: dsterba@suse.com
changelog:
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check (CVE-2024-41072 bsc#1228626)
  - commit c131ba5


author: dsterba@suse.com
changelog:
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes (CVE-2024-41095 bsc#1228662)
  - commit bb0cd8f


author: dsterba@suse.com
changelog:
  - drm/amd/display: Check pipe offset before setting vblank (CVE-2024-42120 bsc#1228588)
  - commit d85398e


author: dsterba@suse.com
changelog:
  - drm/amd/display: Skip finding free audio for unknown engine_id (CVE-2024-42119 bsc#1228584)
  - commit f0a5549


author: dsterba@suse.com
changelog:
  - media: dvb-frontends: tda10048: Fix integer overflow (CVE-2024-42223 bsc#1228726)
  - commit 4d685fd


author: krisman@suse.de
changelog:
  - Update
    patches.suse/Input-aiptek-properly-check-endpoint-type.patch
    (git-fixes CVE-2022-48836 bsc#1227989).
  - Update
    patches.suse/net-ieee802154-at86rf230-Stop-leaking-skb-s.patch
    (git-fixes CVE-2022-48794 bsc#1228025).
  - Update
    patches.suse/net-packet-fix-slab-out-of-bounds-access-in-packet_r.patch
    (CVE-2022-20368 bsc#1202346 CVE-2022-48839 bsc#1227985).
  - Update
    patches.suse/net-usb-ax88179_178a-Fix-out-of-bounds-accesses-in-R.patch
    (bsc#1196018 CVE-2022-28748 CVE-2022-2964 CVE-2022-48805
    bsc#1227969).
  - commit 55fdbd1


author: krisman@suse.de
changelog:
  - Update
    patches.suse/SUNRPC-Fix-UAF-in-svc_tcp_listen_data_ready.patch
    (git-fixes CVE-2023-52885 bsc#1227750).
  - commit 4594a5d


author: krisman@suse.de
changelog:
  - Update
    patches.suse/Bluetooth-SCO-Fix-not-validating-setsockopt-user-inp.patch
    (bsc#1224576 CVE-2024-35966 CVE-2024-35967 bsc#1224587).
  - Update
    patches.suse/RDMA-mlx5-Add-check-for-srq-max_sge-attribute.patch
    (git-fixes CVE-2024-40990 bsc#1227824).
  - Update
    patches.suse/USB-class-cdc-wdm-Fix-CPU-lockup-caused-by-excessive.patch
    (git-fixes CVE-2024-40904 bsc#1227772).
  - Update
    patches.suse/ocfs2-fix-races-between-hole-punching-and-AIO-DIO.patch
    (bsc#1227849 CVE-2024-40943).
  - Update
    patches.suse/tracing-trigger-Fix-to-return-error-if-failed-to-alloc-snapshot.patch
    (git-fixes CVE-2024-26920 bsc#1228237).
  - commit 71c68bc


author: dwagner@suse.de
changelog:
  - scsi: qla2xxx: Convert comma to semicolon (bsc#1228850).
  - scsi: qla2xxx: Update version to 10.02.09.300-k (bsc#1228850).
  - scsi: qla2xxx: Use QP lock to search for bsg (bsc#1228850).
  - scsi: qla2xxx: Reduce fabric scan duplicate code (bsc#1228850).
  - scsi: qla2xxx: Fix optrom version displayed in FDMI
    (bsc#1228850).
  - scsi: qla2xxx: During vport delete send async logout explicitly
    (bsc#1228850).
  - scsi: qla2xxx: Complete command early within lock (bsc#1228850).
  - scsi: qla2xxx: Fix flash read failure (bsc#1228850).
  - scsi: qla2xxx: Return ENOBUFS if sg_cnt is more than one for
    ELS cmds (bsc#1228850).
  - scsi: qla2xxx: Fix for possible memory corruption (bsc#1228850).
  - scsi: qla2xxx: validate nvme_local_port correctly (bsc#1228850).
  - scsi: qla2xxx: Unable to act on RSCN for port online
    (bsc#1228850).
  - scsi: qla2xxx: Remove unused struct 'scsi_dif_tuple'
    (bsc#1228850).
  - scsi: qla2xxx: Fix debugfs output for fw_resource_count
    (bsc#1228850).
  - scsi: qla2xxx: Drop driver owner assignment (bsc#1228850).
  - scsi: qla2xxx: Avoid possible run-time warning with long
    model_num (bsc#1228850).
  - string.h: Introduce memtostr() and memtostr_pad() (bsc#1228850).
  - commit 2402124


author: fdmanana@suse.com
changelog:
  - btrfs: send: remove unused found_type parameter to
    lookup_dir_item_inode() (bsc#1228030).
  - commit bc238fe


author: tbogendoerfer@suse.de
changelog:
  - liquidio: Adjust a NULL pointer handling path in
    lio_vf_rep_copy_packet (CVE-2024-39506 bsc#1227729).
  - i40e: Fix queues reservation for XDP (CVE-2021-47619
    bsc#1226645).
  - commit 37ce537


author: fdmanana@suse.com
changelog:
  - btrfs: remove unused members dir_path from recorded_ref
    (bsc#1228030).
  - Refresh
    patches.suse/btrfs-incremental-send-fix-invalid-path-for-unlink-commands.patch.
  - Refresh
    patches.suse/btrfs-send-fix-sending-link-commands-for-existing-fi.patch.
  - commit 980e08a


author: fdmanana@suse.com
changelog:
  - Btrfs: incremental send, fix emission of invalid clone
    operations (bsc#1228030).
  - commit 88a98fe


author: fdmanana@suse.com
changelog:
  - btrfs: send: remove stale code when checking for shared extents
    (bsc#1228030).
  - btrfs: silence maybe-uninitialized warning in clone_range
    (bsc#1228030).
  - commit 095e644


author: msuchanek@suse.de
changelog:
  - KVM: PPC: Book3S HV: remove extraneous asterisk from
    rm_host_ipi_action() comment (bsc#1065729).
  - KVM: PPC: Book3S HV: Don't take kvm->lock around
    kvm_for_each_vcpu (bsc#1065729).
  - KVM: PPC: Book3S: Use new mutex to synchronize access to rtas
    token list (bsc#1065729).
  - Refresh patches.suse/KVM-PPC-Book3S-Fix-H_RTAS-rets-buffer-overflow.patch
  - KVM: PPC: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv
    machines (bsc#1065729).
  - KVM: PPC: Move and undef TRACE_INCLUDE_PATH/FILE (bsc#1065729).
  - KVM: PPC: Inform the userspace about TCE update failures
    (bsc#1065729).
  - KVM: PPC: Book3S PR: Exiting split hack mode needs to fixup
    both PC and LR (bsc#1065729).
  - commit ad6fee4


author: nik.borisov@suse.com
changelog:
  - Sort BHI mitigation patches
  - Refresh patches.suse/x86-bhi-Add-BHI-mitigation-knob.patch.
  - Refresh
    patches.suse/x86-bhi-Add-support-for-clearing-branch-history-at-syscall.patch.
  - Refresh patches.suse/x86-bhi-Define-SPEC_CTRL_BHI_DIS_S.patch.
  - Refresh
    patches.suse/x86-bhi-Enumerate-Branch-History-Injection-BHI-bug.patch.
  - Refresh patches.suse/x86-bhi-Mitigate-KVM-by-default.patch.
  - Refresh
    patches.suse/x86-cpufeature-Add-missing-leaf-enumeration.patch.
  - commit f2f0729


author: nik.borisov@suse.com
changelog:
  - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (git-fixes).
    This commit was missing for SLE12-SP5 which made the performance profile
    of SLE12-SP5 and SLE15-SP[56] differ. Our decision was to follow
    upstream w.r.t how BHI is going to be mitigated and the decision was to
    do away with 'auto' mode.
  - Update config files.
  - commit 02bfc90


author: nik.borisov@suse.com
changelog:
  - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (git-fixes).
  - Update config files.
  - commit 4549b89


author: nmorey@suse.com
changelog:
  - Refresh patches.suse/IB-hfi1-Fix-bugs-with-non-PAGE_SIZE-end-multi-iovec-.patch
    Alt-commit added
    Blacklist the follow-up fix of the Alt-commit
  - commit c3542b0


author: fdmanana@suse.com
changelog:
  - btrfs: fix 64bit compat send ioctl arguments not initializing
    version member (bsc#1228030).
  - btrfs: fix send ioctl on 32bit with 64bit kernel (bsc#1228030).
  - btrfs: send: add new command FILEATTR for file attributes
    (bsc#1228030).
  - btrfs: send: add stream v2 definitions (bsc#1228030).
  - btrfs: send: avoid copying file data (bsc#1228030).
  - btrfs: send: explicitly number commands and attributes
    (bsc#1228030).
  - btrfs: send: get rid of i_size logic in send_write()
    (bsc#1228030).
  - btrfs: send: prepare for v2 protocol (bsc#1228030).
  - btrfs: send: remove unused send_ctx::{total,cmd}_send_size
    (bsc#1228030).
  - Refresh
    patches.suse/Btrfs-fix-race-between-send-and-deduplication-that-l.patch.
  - Refresh
    patches.suse/btrfs-send-ensure-send_fd-is-writable.patch.
  - Refresh
    patches.suse/btrfs-send-fix-sending-link-commands-for-existing-fi.patch.
  - commit 956ca27


author: fdmanana@suse.com
changelog:
  - btrfs: send: always use the rbtree based inode ref management
    infrastructure (bsc#1228030).
  - commit 252130e


author: fdmanana@suse.com
changelog:
  - btrfs: send: fix send failure of a subcase of orphan inodes
    (bsc#1228030).
  - btrfs: send: fix failures when processing inodes with no links
    (bsc#1228030).
  - commit 9fd4ec5


author: gjhe@novell.com
changelog:
  - update to version 0.9.8k
  - patches merged upstream:
    openssl-CVE-2008-5077.patch
    openssl-CVE-2009-0590.patch
    openssl-CVE-2009-0591.patch
    openssl-CVE-2009-0789.patch
    openssl-CVE-2009-1377.patch
    openssl-CVE-2009-1378.patch
    openssl-CVE-2009-1379.patch
    openssl-CVE-2009-1386.patch
    openssl-CVE-2009-1387.patch


author: gjhe@novell.com
changelog:
  - update to version 0.9.8m
    Merge the following patches from 0.9.8k:
    bswap.diff
    non-exec-stack.diff
    openssl-0.9.6g-alpha.diff
    openssl-0.9.7f-ppc64.diff
    openssl-0.9.8-flags-priority.dif
    openssl-0.9.8-sparc.dif
    openssl-allow-arch.diff
    openssl-hppa-config.diff


author: meissner@suse.de
changelog:
  - fixed "exectuable stack" for libcrypto.so issue on i586 by
    adjusting the assembler output during MMX builds.


author: gjhe@novell.com
changelog:
  - update to 1.0.0
    Merge the following patches from 0.9.8k:
    openssl-0.9.6g-alpha.diff
    openssl-0.9.7f-ppc64.diff
    openssl-0.9.8-flags-priority.dif
    openssl-0.9.8-sparc.dif
    openssl-allow-arch.diff
    openssl-hppa-config.diff


author: meissner@suse.de
changelog:
  - Disable our own build targets, instead use the openSSL provided ones
    as they are now good (or should be good at least).
  - add -Wa,--noexecstack to the Configure call, this is the upstream
    approved way to avoid exec-stack marking


author: lnussel@suse.de
changelog:
  - also create old certificate hash in /etc/ssl/certs for
    compatibility with applications that still link against 0.9.8


author: gjhe@novell.com
changelog:
  - build libopenssl to /%{_lib} dir,and keep only one
    libopenssl-devel for new developping programs.


author: aj@suse.de
changelog:
  - Do not compile in build time but use mtime of changes file instead.
    This allows build-compare to identify that no changes have happened.


author: gjhe@novell.com
changelog:
  - fix bnc #610223,change Configure to tell openssl to load engines
    from /%{_lib} instead of %{_libdir}


author: gjhe@novell.com
changelog:
  - update to stable version 1.0.0c.
    patch included:
    CVE-2010-1633_and_CVE-2010-0742.patch
    patchset-19727.diff
    CVE-2010-2939.patch
    CVE-2010-3864.patch


author: cristian.rodriguez@opensuse.org
changelog:
  - Add patch from upstream in order to support AES-NI instruction
    set present on current Intel and AMD processors


author: gjhe@novell.com
changelog:
  - fix bug[bnc#693027].
    Add protection against ECDSA timing attacks as mentioned in the paper
    by Billy Bob Brumley and Nicola Tuveri, see:
    http://eprint.iacr.org/2011/232.pdf
    [Billy Bob Brumley and Nicola Tuveri]


author: gjhe@novell.com
changelog:
  - update to latest stable version 1.0.0d.
    patch removed(already in the new package):
    CVE-2011-0014
    patch added:
    ECDSA_signatures_timing_attack.patch


author: crrodriguez@opensuse.org
changelog:
  - Add upstream patch that calls ENGINE_register_all_complete()
    in ENGINE_load_builtin_engines() saving us from adding dozens
    of calls to such function to calling applications.


author: crrodriguez@opensuse.org
changelog:
  - Update to openssl 1.0.0e fixes CVE-2011-3207 and CVE-2011-3210
    see http://openssl.org/news/secadv_20110906.txt for details.


author: crrodriguez@opensuse.org
changelog:
  - Build with -DSSL_FORBID_ENULL so servers are not
    able to use the NULL encryption ciphers (Those offering no
    encryption whatsoever).


author: crrodriguez@opensuse.org
changelog:
  - AES-NI: Check the return value of Engine_add()
    if the ENGINE_add() call fails: it ends up adding a reference
    to a freed up ENGINE which is likely to subsequently contain garbage
    This will happen if an ENGINE with the same name is added multiple
    times,for example different libraries. [bnc#720601]


author: gjhe@suse.com
changelog:
  - Update to version 1.0.0f fix the following:
    DTLS Plaintext Recovery Attack (CVE-2011-4108)
    Uninitialized SSL 3.0 Padding (CVE-2011-4576)
    Malformed RFC 3779 Data Can Cause Assertion Failures (CVE-2011-4577)
    SGC Restart DoS Attack (CVE-2011-4619)
    Invalid GOST parameters DoS Attack (CVE-2012-0027)


author: gjhe@suse.com
changelog:
  - fix bug[bnc#749213]-Free headers after use in error message
    and bug[bnc#749210]-Symmetric crypto errors in PKCS7_decrypt


author: gjhe@suse.com
changelog:
  - fix bug[bnc#749735] - Memory leak when creating public keys.
    fix bug[bnc#751977] - CMS and S/MIME Bleichenbacher attack
    CVE-2012-0884


author: gjhe@suse.com
changelog:
  - update to latest stable verison 1.0.0i
    including the following patches:
    CVE-2012-2110.path
    Bug748738_Tolerate_bad_MIME_headers.patch
    bug749213-Free-headers-after-use.patch
    bug749210-Symmetric-crypto-errors-in-PKCS7_decrypt.patch
    CVE-2012-1165.patch
    CVE-2012-0884.patch
    bug749735.patch


author: crrodriguez@opensuse.org
changelog:
  - Update to version 1.0.1c for the complete list of changes see
    NEWS, this only list packaging changes.
  - Drop aes-ni patch, no longer needed as it is builtin in openssl
    now.
  - Define GNU_SOURCE and use -std=gnu99 to build the package.
  - Use LFS_CFLAGS in platforms where it matters.


author: crrodriguez@opensuse.org
changelog:
  - Open Internal file descriptors with O_CLOEXEC, leaving
    those open across fork()..execve() makes a perfect
    vector for a side-channel attack...


author: meissner@suse.com
changelog:
  - update to version 1.0.1d, fixing security issues
    o Fix renegotiation in TLS 1.1, 1.2 by using the correct TLS version.
    o Include the fips configuration module.
    o Fix OCSP bad key DoS attack CVE-2013-0166
    o Fix for SSL/TLS/DTLS CBC plaintext recovery attack CVE-2013-0169
      bnc#802184
    o Fix for TLS AESNI record handling flaw CVE-2012-2686


author: hrvoje.senjan@gmail.com
changelog:
  - Update to 1.0.1e
    o Bugfix release (bnc#803004)
  - Drop openssl-1.0.1d-s3-packet.patch, included upstream


author: crrodriguez@opensuse.org
changelog:
  - Build enable-ec_nistp_64_gcc_128, ecdh is many times faster
    but only works in x86_64.
    According to the openSSL team
    "it is superior to the default in multiple regards (speed, and also
    security as the new implementations are secure against timing
    attacks)"
    It is not enabled by default due to the build system being unable
    to detect if the compiler supports __uint128_t.


author: lnussel@suse.de
changelog:
  - Don't use the legacy /etc/ssl/certs directory anymore but rather
    the p11-kit generated /var/lib/ca-certificates/openssl one
    (fate#314991, openssl-1.0.1e-truststore.diff)


author: meissner@suse.com
changelog:
  - compression_methods_switch.patch: Disable compression by default to
    avoid the CRIME attack (CVE-2012-4929 bnc#793420)
    Can be override by setting environment variable
      OPENSSL_NO_DEFAULT_ZLIB=no


author: crrodriguez@opensuse.org
changelog:
  - 0005-libssl-Hide-library-private-symbols.patch: hide
    private symbols, this *only* applies to libssl where
    it is straightforward to do so as applications should
    not be using any of the symbols declared/defined in headers
    that the library does not install.
    A separate patch MAY be provided in the future for libcrypto
    where things are much more complicated and threfore requires
    careful testing.


author: dmueller@suse.com
changelog:
  - add openssl-1.0.1c-default-paths.patch:
    Fix from Fedora for openssl s_client not setting
    CApath by default


author: crrodriguez@opensuse.org
changelog:
  - openssl-pkgconfig.patch: Here we go.. For applications
    to benefit fully of features provided by openSSL engines
    (rdrand, aes-ni..etc) either builtin or in DSO form applications
    have to call ENGINE_load_builtin_engines() or OPENSSL_config()
    unfortunately from a total of 68 apps/libraries linked to libcrypto
    in a desktop system, only 4 do so, and there is a sea of buggy
    code that I dont feel like fixing.
    Instead we can pass -DOPENSSL_LOAD_CONF in the pkgconfig files
    so the needed operation becomes implicit the next time such apps
    are recompiled, see OPENSSL_config(3)
    Unfortunately this does not fix everything, because there are apps
    not using pkgconfig or using it incorrectly, but it is a good start.


author: crrodriguez@opensuse.org
changelog:
  - Cleanup engines that are of no use in a modern linux distro
  - The following engines stay:
    * libcapi.so --> usable in case you have third party /dev/crypto
    * libgmp.so --> may help to doing some maths using GMP
    * libgost.so --> implements the GOST block cipher
    * libpadlock.so --> VIA padlock support
  - Al other are removed because they require third party propietary
    shared libraries nowhere to be found or that we can test.


author: shchang@suse.com
changelog:
  - Fix bug[ bnc#832833] openssl ssl_set_cert_masks() is broken
    modify patch file: SSL_get_certificate-broken.patch


author: guillaume@opensuse.org
changelog:
  - Fix armv6l arch (armv7 was previously used to build armv6 which
    lead to illegal instruction when used)


author: dmacvicar@suse.de
changelog:
  - VPN openconnect problem (DTLS handshake failed)
    (git 9fe4603b8, bnc#822642, openssl ticket#2984)


author: meissner@suse.com
changelog:
  - openssl-1.0.1c-ipv6-apps.patch:
    Support ipv6 in the openssl s_client / s_server commandline app.


author: crrodriguez@opensuse.org
changelog:
  - 0001-libcrypto-Hide-library-private-symbols.patch
    This patch implements the libcrpto part complimentary to
    0005-libssl-Hide-library-private-symbols.patch.
    This patch is however not 100% complete, as some private library
    symbols are declared in public headers that shall not be touched
    or are defined/declared in "perlasm". (tested in 13.1, 12.3, factory)
  - openSSL defaults to -O3 optimization level but we override
    it with RPM_OPT_FLAGS, ensure we use -O3 like upstream.


author: shchang@suse.com
changelog:
  - Patches for OpenSSL FIPS-140-2/3 certification
    Add patch files: openssl-1.0.1e-fips.patch, openssl-1.0.1e-fips-ec.patch,
    openssl-1.0.1e-fips-ctor.patch


author: crrodriguez@opensuse.org
changelog:
  - Restrict the (broken beyond build) FIPS certification code
    to SLE releases only, it has no value in openSUSE at all.


author: meissner@suse.com
changelog:
  - Actually enable it (in a building way) for openSUSE and SLES,
    as we intended.
  - Add README-FIPS.txt from SLE 11.


author: meissner@suse.com
changelog:
  - compression_methods_switch.patch: setenv might not be successful
    if a surrounding library or application filters it, like e.g. sudo.
    As setenv() does not seem to be useful anyway, remove it.
    bnc#849377


author: shchang@suse.com
changelog:
  - Fixed bnc#857203, openssl: crash in DTLS renegotiation after packet loss
    Add file: CVE-2013-6450.patch


author: andreas.stieger@gmx.de
changelog:
  - 1.0.1f:
    * Fix for TLS record tampering bug CVE-2013-4353
  - already included:
    * Fix for TLS version checking bug CVE-2013-6449
    * Fix for DTLS retransmission bug CVE-2013-6450
  - removed patches:
    * CVE-2013-6449.patch, committed upstream
    * CVE-2013-6450.patch, committed upstream
    * SSL_get_certificate-broken.patch, committed upstream
    * openssl-1.0.1e-bnc822642.patch, committed upstream
  - modified patches:
    * openssl-1.0.1e-fips.patch, adjust for upstream changes
    * openssl-fix-pod-syntax.diff, adjust for upstream changes


author: shchang@suse.com
changelog:
  - Adjust the installation path( libopenssl/hmac into /lib or /lib64)
    Modify files: README-FIPS.txt openssl.spec


author: shchang@suse.com
changelog:
  - additional changes required for FIPS validation( from Fedora repo)
    Add patch file: openssl-1.0.1e-new-fips-reqs.patch


author: vpereira@novell.com
changelog:
  - Added DEFAULT_SUSE cipher suite
  - Improved the DEFAULT cipher suite, removing EXPORT algorithms, RC2 and DES
  - Added test case for the new DEFAULT_SUSE cipher suite
    Add file: openssl-1.0.1e-add-test-suse-default-cipher-suite.patch


author: vpereira@novell.com
changelog:
  - fate#316363: Remove broken or outdated Ciphers
    Add files: openssl-1.0.1e-add-suse-default-cipher-header.patch, openssl-1.0.1e-add-suse-default-cipher.patch


author: shchang@suse.com
changelog:
  - Fix bug[ bnc#869945] CVE-2014-0076: openssl: Recovering OpenSSL ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack
    Add file: CVE-2014-0076.patch


author: shchang@suse.com
changelog:
  - Upgrade to OpenSSL 1.0.1g:
    * Fix bug[ bnc#872299] TLS heartbeat read overrun (CVE-2014-0160)
    Add files: openssl-1.0.1g.tar.gz, openssl-1.0.1g.tar.gz.asc
    Delete files: openssl-1.0.1f.tar.gz, openssl-1.0.1f.tar.gz.asc, CVE-2014-0076.patch


author: shchang@suse.com
changelog:
  - Fixed bug[ bnc#873351] CVE-2010-5298: openssl: Use-after-free race condition,in OpenSSL's read buffer
    Add file: CVE-2010-5298.patch


author: shchang@suse.com
changelog:
  - Fixed bug[ bnc#876748] FIPS: openssl hmac verification fails open on empty hmac file
    * Initialize rv to -1 by default
    Modify file: openssl-1.0.1e-fips-ctor.patch


author: shchang@suse.com
changelog:
  - Fixed bug[ bnc#876282], CVE-2014-0198 openssl: OpenSSL NULL pointer dereference in do_ssl3_write
    Add file: CVE-2014-0198.patch
    Fixed bug[ bnc#876712], FIPS: ssh remote login does not work anymore
    Add file: openssl-no-egd.patch


author: shchang@suse.com
changelog:
  - Fixed bug[ bnc#876710], openssl genrsa still uses 1024 bit by default
    Add file: openssl-app-genrsa-fips.patch
    Properly detect encryption failure in BIO
    * use 2048 bit RSA key in FIPS selftests
    Modify file: openssl-1.0.1e-new-fips-reqs.patch


author: meissner@suse.com
changelog:
  - updated to 1.0.1h (bnc#880891)
    - CVE-2014-0224: Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
      handshake can force the use of weak keying material in OpenSSL
      SSL/TLS clients and servers.
    - CVE-2014-0221: Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an
      OpenSSL DTLS client the code can be made to recurse eventually crashing
      in a DoS attack.
    - CVE-2014-0195: Fix DTLS invalid fragment vulnerability. A buffer
      overrun attack can be triggered by sending invalid DTLS fragments to
      an OpenSSL DTLS client or server. This is potentially exploitable to
      run arbitrary code on a vulnerable client or server.
    - CVE-2014-3470: Fix bug in TLS code where clients enable anonymous
      ECDH ciphersuites are subject to a denial of service attack.
  - CVE-2014-0198.patch: removed, upstream
  - CVE-2010-5298.patch: removed, upstream
  - openssl-1.0.1e-fips-ctor.patch: return success from checking of FIPS signatures.


author: meissner@suse.com
changelog:
  - fixed the FIPS pairwise check in DSA and EC key generation.
    openssl-1.0.1e-fips-ec.patch
    openssl-1.0.1e-fips.patch


author: meissner@suse.com
changelog:
  - openssl-1.0.1h-fips-engine.patch:
    For the engine using algorithms, check if the meth returned
    by the engine has the FIPS flag set in FIPS mode, otherwise
    use the builtin method. (EVP digest and RSA implemented)


author: vcizek@suse.com
changelog:
  - update to 1.0.1i
    * Fix SRP buffer overrun vulnerability. Invalid parameters passed to the
      SRP code can be overrun an internal buffer. Add sanity check that
      g, A, B < N to SRP code.
      (CVE-2014-3512)
    * A flaw in the OpenSSL SSL/TLS server code causes the server to negotiate
      TLS 1.0 instead of higher protocol versions when the ClientHello message
      is badly fragmented. This allows a man-in-the-middle attacker to force a
      downgrade to TLS 1.0 even if both the server and the client support a
      higher protocol version, by modifying the client's TLS records.
      (CVE-2014-3511)
    * OpenSSL DTLS clients enabling anonymous (EC)DH ciphersuites are subject
      to a denial of service attack. A malicious server can crash the client
      with a null pointer dereference (read) by specifying an anonymous (EC)DH
      ciphersuite and sending carefully crafted handshake messages.
      (CVE-2014-3510)
    * By sending carefully crafted DTLS packets an attacker could cause openssl
      to leak memory. This can be exploited through a Denial of Service attack.
      (CVE-2014-3507)
    * An attacker can force openssl to consume large amounts of memory whilst
      processing DTLS handshake messages. This can be exploited through a
      Denial of Service attack.
      (CVE-2014-3506)
    * An attacker can force an error condition which causes openssl to crash
      whilst processing DTLS packets due to memory being freed twice. This
      can be exploited through a Denial of Service attack.
      (CVE-2014-3505)
    * If a multithreaded client connects to a malicious server using a resumed
      session and the server sends an ec point format extension it could write
      up to 255 bytes to freed memory.
      (CVE-2014-3509)
    * A malicious server can crash an OpenSSL client with a null pointer
      dereference (read) by specifying an SRP ciphersuite even though it was not
      properly negotiated with the client. This can be exploited through a
      Denial of Service attack.
      (CVE-2014-5139)
    * A flaw in OBJ_obj2txt may cause pretty printing functions such as
      X509_name_oneline, X509_name_print_ex et al. to leak some information
      from the stack. Applications may be affected if they echo pretty printing
      output to the attacker.
      (CVE-2014-3508)
    * Fix ec_GFp_simple_points_make_affine (thus, EC_POINTs_mul etc.)
      for corner cases. (Certain input points at infinity could lead to
      bogus results, with non-infinity inputs mapped to infinity too.)
  - refreshed patches:
    * openssl-1.0.1e-new-fips-reqs.patch
    * 0005-libssl-Hide-library-private-symbols.patch
      (thanks to Marcus Meissner)


author: meissner@suse.com
changelog:
  - openssl-1.0.1e-new-fips-reqs.patch refreshed to openssl-1.0.1i-new-fips-reqs.patch:
    refreshed / renamed patch to match 1.0.1i changes.
    - randomness locking is upstream
    - RSA selftest with X9.31 padding is not needed anymore
    - fixed FIPS selftest failures bnc#892477
  - openssl-1.0.1i-ppc-asm-update.patch: update for ppc64le


author: vcizek@suse.com
changelog:
  - security fixes for bnc#901277 and bnc#901223
  - NOTE: this update alone DOESN'T FIX the POODLE SSL protocol vulnerability.
    OpenSSL only adds downgrade detection support for client applications.
    See https://www.suse.com/support/kb/doc.php?id=7015773 for mitigations.
  - details of the addressed vulnerabilities:
    * ) SRTP Memory Leak.
      A flaw in the DTLS SRTP extension parsing code allows an attacker, who
      sends a carefully crafted handshake message, to cause OpenSSL to fail
      to free up to 64k of memory causing a memory leak. This could be
      exploited in a Denial Of Service attack. This issue affects OpenSSL
      1.0.1 server implementations for both SSL/TLS and DTLS regardless of
      whether SRTP is used or configured. Implementations of OpenSSL that
      have been compiled with OPENSSL_NO_SRTP defined are not affected.
      (CVE-2014-3513)
    * ) Session Ticket Memory Leak.
      When an OpenSSL SSL/TLS/DTLS server receives a session ticket the
      integrity of that ticket is first verified. In the event of a session
      ticket integrity check failing, OpenSSL will fail to free memory
      causing a memory leak. By sending a large number of invalid session
      tickets an attacker could exploit this issue in a Denial Of Service
      attack.
      (CVE-2014-3567)
    * ) Build option no-ssl3 is incomplete.
      When OpenSSL is configured with "no-ssl3" as a build option, servers
      could accept and complete a SSL 3.0 handshake, and clients could be
      configured to send them.
      (CVE-2014-3568)
    * ) Add support for TLS_FALLBACK_SCSV.
      Client applications doing fallback retries should call
      SSL_set_mode(s, SSL_MODE_SEND_FALLBACK_SCSV).
      (CVE-2014-3566)
  - added patches:
    * openssl-CVE-2014-3513.patch
    * openssl-CVE-2014-3566.patch
    * openssl-CVE-2014-3567.patch
    * openssl-CVE-2014-3568.patch


author: vcizek@suse.com
changelog:
  - don't advertise curves we don't support (bnc#906878)
    * added openssl-Added-OPENSSL_NO_EC2M-guards-around-the-preferred-EC.patch


author: meissner@suse.com
changelog:
  - openssl-urandom-reseeding.patch: constant reseeding from /dev/urandom;
    for every byte pulled, seed with 1 byte from /dev/urandom, also
    change RAND_poll to pull the full state size of the SSLEAY DRBG.
    bsc#908372


author: meissner@suse.com
changelog:
  - openssl-rsakeygen-minimum-distance.patch: in non-FIPS rsa key
    generation, mirror the maximum and minimum limiters from
    FIPS rsa generation to meet Common Criteria requirements
    on minimum and maximum distances between p and q. bsc#908362


author: vcizek@suse.com
changelog:
  - X9.31 rand method is not allowed in FIPS mode
    * added openssl-fips_disallow_x931_rand_method.patch
  - don't allow dynamic ENGINEs loading in FIPS mode
    * added openssl-fips_disallow_ENGINE_loading.patch
  - for both see bnc#855676, comment 16
  - added a locking hack which prevents hangs in FIPS mode (bnc#895129)
    * added openssl-1.0.1i-fipslocking.patch


author: vcizek@suse.com
changelog:
  - make RSA2 key generation FIPS 186-4 compliant (bnc#901902)
    * added openssl-fips_RSA_compute_d_with_lcm.patch


author: vcizek@suse.com
changelog:
  - fix for several security vulnerabilites:
    * CVE-2014-3570 (bnc#912296)
    - Bignum squaring (BN_sqr) may produce incorrect results on some
      platforms, including x86_64.
    - added openssl-CVE-2014-3570.patch
    * CVE-2014-3571 (bnc#912294)
    - Fix crash in dtls1_get_record whilst in the listen state where
      you get two separate reads performed - one for the header and
      one for the body of the handshake record.
    - added openssl-CVE-2014-3571.patch
    * CVE-2014-3572 (bnc#912015)
    - don't accept a handshake using an ephemeral ECDH ciphersuites
      with the server key exchange message omitted.
    - added openssl-CVE-2014-3572.patch
    * CVE-2014-8275 (bnc#912018)
    - fix various certificate fingerprint issues
    - added openssl-CVE-2014-8275.patch
    * CVE-2015-0204 (bnc#912014)
    - Only allow ephemeral RSA keys in export ciphersuites
    - added openssl-CVE-2015-0204.patch
    * CVE-2015-0205 (bnc#912293)
    - Fix to prevent use of DH client certificates without sending
      certificate verify message.
    - added openssl-CVE-2015-0205.patch
    * CVE-2015-0206 (bnc#912292)
    - memory leak can occur in dtls1_buffer_record
    - added openssl-CVE-2015-0206.patch


author: vcizek@suse.com
changelog:
  - enforce a limit on minimal length of RSA decryption exponent d
    * added openssl-fips-rsagen-d-bits.patch by Marcus Meissner


author: vcizek@suse.com
changelog:
  - security update:
    * CVE-2015-0209 (bnc#919648)
    - Fix a failure to NULL a pointer freed on error
    * CVE-2015-0286 (bnc#922496)
    - Segmentation fault in ASN1_TYPE_cmp
    * CVE-2015-0287 (bnc#922499)
    - ASN.1 structure reuse memory corruption
    * CVE-2015-0288 x509: (bnc#920236)
    - added missing public key is not NULL check
    * CVE-2015-0289 (bnc#922500)
    - PKCS7 NULL pointer dereferences
    * CVE-2015-0293 (bnc#922488)
    - Fix reachable assert in SSLv2 servers
    * added patches:
    openssl-CVE-2015-0209.patch
    openssl-CVE-2015-0286.patch
    openssl-CVE-2015-0287.patch
    openssl-CVE-2015-0288.patch
    openssl-CVE-2015-0289.patch
    openssl-CVE-2015-0293.patch


author: vcizek@suse.com
changelog:
  - the selftests must pass even in non-FIPS mode if the module is
    complete (bnc#926597)
    * added openssl-fips-selftests_in_nonfips_mode.patch


author: vcizek@suse.com
changelog:
  - CVE-2015-4000 (boo#931698)
    * The Logjam Attack / weakdh.org
    * reject connections with DH parameters shorter than 1024 bits
    * generates 2048-bit DH parameters by default
  - CVE-2015-1788 (boo#934487)
    * Malformed ECParameters causes infinite loop
  - CVE-2015-1789 (boo#934489)
    * Exploitable out-of-bounds read in X509_cmp_time
  - CVE-2015-1790 (boo#934491)
    * PKCS7 crash with missing EnvelopedContent
  - CVE-2015-1792 (boo#934493)
    * CMS verify infinite loop with unknown hash function
  - CVE-2015-1791 (boo#933911)
    * race condition in NewSessionTicket
  - CVE-2015-3216 (boo#933898)
    * Crash in ssleay_rand_bytes due to locking regression
    * modified openssl-1.0.1i-fipslocking.patch
  - fix timing side channel in RSA decryption (bnc#929678)
  - newly added patches:
    * 0001-s_server-Use-2048-bit-DH-parameters-by-default.patch
    * 0002-dhparam-set-the-default-to-2048-bits.patch
    * 0003-dhparam-fix-documentation.patch
    * 0004-Update-documentation-with-Diffie-Hellman-best-practi.patch
    * 0005-client-reject-handshakes-with-DH-parameters-1024-bits.patch
    * openssl-CVE-2015-1788.patch
    * openssl-CVE-2015-1789.patch
    * openssl-CVE-2015-1790.patch
    * openssl-CVE-2015-1791.patch
    * openssl-CVE-2015-1792.patch
    * openssl-RSA_premaster_secret_in_constant_time.patch


author: vcizek@suse.com
changelog:
  - fix an RSA key generation problem with odd bit sizes (bsc#937212)
    * added openssl-fips-fix-odd-rsakeybits.patch


author: vcizek@suse.com
changelog:
  - Add POWER8 VMX crypto acceleration (fate#318717, bsc#937634)
  - added patches from IBM:
    * 0001-Taking-only-the-struct-change-of-ks-to-ks-ks.patch
    * 0002-Taking-only-the-general-HWAES_-function-declarations.patch
    * 0003-Taking-only-the-change-to-the-preprocessor-condition.patch
    * 0004-evp-e_aes.c-populate-HWAES_-to-remaning-modes.patch
  - fix corrupted keyring


author: vcizek@suse.com
changelog:
  - add support for "ciphers" providing no encryption (bsc#937085)
    * don't build with -DSSL_FORBID_ENULL


author: vcizek@suse.com
changelog:
  - don't build ppc64le as linux-generic32 (bsc#943421)
  - modified openssl-1.0.1i-ppc-asm-update.patch
  - adding patches:
    0001-Config-for-ppc64-le.patch
    0001-sha-asm-fips.patch
    0002-Delete-OPENSSL-CLEANSE-buplicated.patch
    0003-Missing-function-declarations.patch
    0001-Adding-OPENSSL_cpuid_setup.patch


author: vcizek@suse.com
changelog:
  - clear openssl error when fips selftests fail in non-fips mode
    (bsc#947104)
    * added openssl-fips-clearerror.patch


author: meissner@suse.com
changelog:
  - avoid running OPENSSL_config twice. This avoids breaking
    engine loading. (bsc#952871)
  - openssl.keyring: replaced with correct release engineer key


author: vcizek@suse.com
changelog:
  - improve s390 performance (bsc#954256)
    * added 0001-bn-asm-s390x.S-improve-performance-on-z196-and-z13-b.patch


author: vcizek@suse.com
changelog:
  - security fixes:
    * Certificate verify crash with missing PSS parameter
      (CVE-2015-3194) (bsc#957815)
    * X509_ATTRIBUTE memory leak (CVE-2015-3195) (bsc#957812)
    * Race condition handling PSK identify hint (CVE-2015-3196)
      (bsc#957813)
    * added patches:
      openssl-CVE-2015-3194.patch
      openssl-CVE-2015-3195.patch
      openssl-CVE-2015-3196.patch


author: vcizek@suse.com
changelog:
  - fix CVE-2015-3197 (bsc#963415)
    * SSLv2 doesn't block disabled ciphers
    * add openssl-CVE-2015-3197.patch


author: psimons@suse.com
changelog:
  - Fix CVE-2016-0702 (bnc#968050, "Cache Bleed"). The patch
    "openssl-CVE-2016-0702-openssl101.patch" prevents side channel
    attacks on modular exponentiation that attempted to recover RSA
    secret keys by analyzing cache-bank conflicts on the Intel
    Sandy-Bridge microarchitecture. The ability to exploit this issue
    was limited, however, as it required the attacker to have control
    of code running in a thread on the same hyper-threaded core as the
    victim thread which was performing decryptions.
  - Fix CVE-2016-0705 (bnc#968047) via "openssl-CVE-2016-0705.patch".
    This issue allowed attackers with the ability to load malformed
    DSA private keys into applications based on OpenSSL to trigger a
    double free() bug in OpenSSL's parser code. That scenario could be
    abused to facilitate a denial-of-service attack.
  - Fix CVE-2016-0797 (bnc#968048) via "openssl-CVE-2016-0797.patch".
    The BN_hex2bn() and BN_dec2bn() functions had a bug that could
    result in an attempt to de-reference a NULL pointer. This could
    have security consequences if these functions were ever called by
    user applications with large untrusted hex/decimal data. Also,
    internal usage of these functions in OpenSSL uses data from config
    files or application command line arguments. If user developed
    applications generated config file data based on untrusted data,
    then this could have had security consequences as well.
  - Fix CVE-2016-0800 (bnc#968046, "Drown"). OpenSSL used to be
    vulnerable to a cross-protocol attack that could lead to
    decryption of TLS sessions by using a server supporting SSLv2 and
    EXPORT cipher suites as a Bleichenbacher RSA padding oracle. The
    patch "openssl-CVE-2016-0800-DROWN-disable-ssl2.patch" remedies
    this issue by disabling the SSLv2 protocol (unless the environment
    variable $OPENSSL_ALLOW_SSL2 is defined) and all weak EXPORT
    ciphers (unless $OPENSSL_ALLOW_EXPORT is defined).
  - The PGP signature "openssl-1.0.1i.tar.gz.asc" of the OpenSSL
    release tarball was removed because the key that issued it uses
    insecure signature algorithms and can no longer be considered
    safe, i.e. having the signature around does not improve security.
  - Add patch "openssl-fips-dont-fall-back-to-default-digest.patch" to
    ensure that OpenSSL doesn't fall back to the default digest
    algorithm (SHA1) in case a non-FIPS algorithm was negotiated while
    running in FIPS mode. Instead, OpenSSL will refuse the session.
    (bnc#958501)
  - Fix CVE-2016-0798 via "openssl-CVE-2016-0798-101.patch". The SRP
    user database lookup method SRP_VBASE_get_by_user() had a memory
    leak that attackers could abuse to facility DoS attacks. To
    mitigate the issue, the seed handling in SRP_VBASE_get_by_user()
    was disabled even if the user has configured a seed. Applications
    are advised to migrate to SRP_VBASE_get1_by_user(). (bnc#968265)
  - Fix CVE-2016-0799 (bnc#968374) via "openssl-CVE-2016-0799.patch".
    On many 64 bit systems, the internal fmtstr() and doapr_outch()
    functions could miscalculate the length of a string and attempt to
    access out-of-bounds memory locations. These problems could have
    enabled attacks where large amounts of untrusted data is passed to
    the BIO_*printf functions. If applications use these functions in
    this way then they could have been vulnerable. OpenSSL itself uses
    these functions when printing out human-readable dumps of ASN.1
    data. Therefore applications that print this data could have been
    vulnerable if the data is from untrusted sources. OpenSSL command
    line applications could also have been vulnerable when they print
    out ASN.1 data, or if untrusted data is passed as command line
    arguments. Libssl is not considered directly vulnerable.


author: vcizek@suse.com
changelog:
  - update to 1.0.2g (fate#317043)
    Major changes since 1.0.1:
      EXPORT and LOW strength ciphers aren't provided
      Suite B support for TLS 1.2 and DTLS 1.2
      Support for DTLS 1.2
      TLS automatic EC curve selection.
      API to set TLS supported signature algorithms and curves
      SSL_CONF configuration API.
      TLS Brainpool support.
      ALPN support.
      CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.
    * dropped many patches as they are included upstream
      (all security fixes, s390x performance improvements, ppc64le
      build, POWER8 VMX crypto acceleration)
    * build with enable-ssl2 to provide SSLv2_method but only allow
      SSL2 when OPENSSL_ALLOW_SSL2 environment variable is set


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [3rd May 2016]
  - update to 1.0.2h (boo#977584, boo#977663)
    * Prevent padding oracle in AES-NI CBC MAC check
      A MITM attacker can use a padding oracle attack to decrypt traffic
      when the connection uses an AES CBC cipher and the server support
      AES-NI.
      (CVE-2016-2107, boo#977616)
    * Fix EVP_EncodeUpdate overflow
      An overflow can occur in the EVP_EncodeUpdate() function which is used for
      Base64 encoding of binary data. If an attacker is able to supply very large
      amounts of input data then a length check can overflow resulting in a heap
      corruption.
      (CVE-2016-2105, boo#977614)
    * Fix EVP_EncryptUpdate overflow
      An overflow can occur in the EVP_EncryptUpdate() function. If an attacker
      is able to supply very large amounts of input data after a previous call to
      EVP_EncryptUpdate() with a partial block then a length check can overflow
      resulting in a heap corruption.
      (CVE-2016-2106, boo#977615)
    * Prevent ASN.1 BIO excessive memory allocation
      When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio()
      a short invalid encoding can casuse allocation of large amounts of memory
      potentially consuming excessive resources or exhausting memory.
      (CVE-2016-2109, boo#976942)
    * EBCDIC overread
      ASN1 Strings that are over 1024 bytes can cause an overread in applications
      using the X509_NAME_oneline() function on EBCDIC systems. This could result
      in arbitrary stack data being returned in the buffer.
      (CVE-2016-2176, boo#978224)
    * Modify behavior of ALPN to invoke callback after SNI/servername
      callback, such that updates to the SSL_CTX affect ALPN.
    * Remove LOW from the DEFAULT cipher list.  This removes singles DES from the
      default.
    * Only remove the SSLv2 methods with the no-ssl2-method option. When the
      methods are enabled and ssl2 is disabled the methods return NULL.
  - dropping enable-ssl2 build flag, SSLv2 methods are now exposed without it


author: vcizek@suse.com
changelog:
  - don't check for /etc/system-fips (bsc#982268)
    * add openssl-fips-dont_run_FIPS_module_installed.patch
  - list the correct hmac key in spec comment (bsc#985054)


author: vcizek@suse.com
changelog:
  - fix problems with locking in FIPS mode (bsc#992120)
    * duplicates: bsc#991877, bsc#991193, bsc#990392, bsc#990428
      and bsc#990207
    * bring back openssl-fipslocking.patch


author: vcizek@suse.com
changelog:
  - security update
    * CVE-2016-2177: Avoid some undefined pointer arithmetic (bsc#982575)
    * CVE-2016-2178: Fix DSA, preserve BN_FLG_CONSTTIME (bsc#983249)
    * CVE-2016-2179: remote denial of service via DTLS Finished Message (bsc#994844)
    * CVE-2016-2180: OOB read in TS_OBJ_print_bio() (bsc#990419)
    * CVE-2016-2181: Fix DTLS replay protection (bsc#994749)
    * CVE-2016-2182: Check for errors in BN_bn2dec() (bsc#993819)
    * CVE-2016-2183: Birthday attacks on 64-bit block ciphers aka triple-des
      (SWEET32) (bsc#995359)
    * CVE-2016-6302: Sanity check ticket length. (bsc#995324)
    * CVE-2016-6303: Avoid overflow in MDC2_Update (bsc#995377)
  - added patches:
    * openssl-CVE-2016-2177.patch
    * openssl-CVE-2016-2178-2.patch
    * openssl-CVE-2016-2178.patch
    * openssl-CVE-2016-2179-2.patch
    * openssl-CVE-2016-2179.patch
    * openssl-CVE-2016-2180.patch
    * openssl-CVE-2016-2181-2.patch
    * openssl-CVE-2016-2181-3.patch
    * openssl-CVE-2016-2181.patch
    * openssl-CVE-2016-2182-2.patch
    * openssl-CVE-2016-2182.patch
    * openssl-CVE-2016-2183-SWEET32.patch
    * openssl-CVE-2016-6302.patch
    * openssl-CVE-2016-6303.patch


author: vcizek@suse.com
changelog:
  - Fix a regression caused by openssl-CVE-2016-2182-2.patch (bsc#995959)
    * add openssl-CVE-2016-2182-3.patch


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [22 Sep 2016] (bsc#999665)
    Severity: High
    * OCSP Status Request extension unbounded memory growth
      (CVE-2016-6304) (bsc#999666)
    Severity: Low
    * Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575)
    * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249)
    * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844)
    * OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419)
    * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749)
    * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819)
    * Birthday attack against 64-bit block ciphers (SWEET32)
      (CVE-2016-2183) (bsc#995359)
    * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324)
    * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377)
    * Certificate message OOB reads (CVE-2016-6306) (bsc#999668)
  - update to openssl-1.0.2i
    * drop patches:
      openssl-1.0.2a-new-fips-reqs.patch
      openssl-1.0.2e-fips.patch
      openssl-CVE-2016-2177.patch
      openssl-CVE-2016-2178-2.patch
      openssl-CVE-2016-2178.patch
      openssl-CVE-2016-2179-2.patch
      openssl-CVE-2016-2179.patch
      openssl-CVE-2016-2180.patch
      openssl-CVE-2016-2181-2.patch
      openssl-CVE-2016-2181-3.patch
      openssl-CVE-2016-2181.patch
      openssl-CVE-2016-2182-2.patch
      openssl-CVE-2016-2182.patch
      openssl-CVE-2016-2183-SWEET32.patch
      openssl-CVE-2016-6302.patch
      openssl-CVE-2016-6303.patch
    * add patches:
      openssl-1.0.2i-fips.patch
      openssl-1.0.2i-new-fips-reqs.patch
    * refresh patches:
      0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
      0001-libcrypto-Hide-library-private-symbols.patch


author: vcizek@suse.com
changelog:
  - update to 1.0.2j
  - OpenSSL Security Advisory [26 Sep 2016]
    Severity: Moderate
    * Missing CRL sanity check (CVE-2016-7052) (bsc#1001148)
    * A bug fix which included a CRL sanity check was added to OpenSSL 1.1.0
      but was omitted from OpenSSL 1.0.2i. As a result any attempt to use
      CRLs in OpenSSL 1.0.2i will crash with a null pointer exception.


author: vcizek@suse.com
changelog:
  - resume reading from /dev/urandom when interrupted by a signal
    (bsc#995075)
    * add openssl-randfile_fread_interrupt.patch
  - fix crash in print_notice (bsc#998190)
    * add openssl-print_notice-NULL_crash.patch


author: vcizek@suse.com
changelog:
  - temporarily revert upstream commit fd7ca7465b67336b8950a505b6d2adee867a78f7
    because it breaks libcamgm (bsc#1002585)
    * 0001-Make-openssl-req-x509-more-equivalent-to-openssl-req.patch


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [26 Jan 2017] (bsc#1021641)
    * Truncated packet could crash via OOB read (CVE-2017-3731) (bsc#1022085)
    * BN_mod_exp may produce incorrect results on x86_64 (CVE-2017-3732)
      (bsc#1022086)
    * Montgomery multiplication may produce incorrect results (CVE-2016-7055)
      (bsc#1009528)
  - degrade 3DES to MEDIUM in SSL2 (bsc#1001912)
  - fix crash in openssl speed (bsc#1000677)
  - added patches:
    * openssl-CVE-2016-7055.patch
    * openssl-CVE-2017-3731.patch
    * openssl-CVE-2017-3732.patch
    * openssl-fix_crash_in_openssl_speed.patch
    * openssl-degrade_3DES_to_MEDIUM_in_SSL2.patch
  - fix X509_CERT_FILE path (bsc#1022271)
    * updated openssl-1.0.1e-truststore.diff
  - AES XTS key parts must not be identical in FIPS mode (bsc#1019637)
    * add openssl-fips-xts_nonidentical_key_parts.patch


author: vcizek@suse.com
changelog:
  - s_client sent empty client certificate (bsc#1028281)
    Add back certificate initialization set_cert_key_stuff()
    which was removed by openssl-1.0.2a-default-paths.patch
    * modified openssl-1.0.2a-default-paths.patch


author: vcizek@suse.com
changelog:
  - Allow runtime switching of s390x capabilities via OPENSSL_s390xcap
    environmental variable (bsc#1028723)
    * add openssl-fips-OPENSSL_s390xcap.patch


author: vcizek@suse.com
changelog:
  - Fix x86 extended feature detection (bsc#1029523)
    * add openssl-x86_extended_feature_detection.patch


author: vcizek@suse.com
changelog:
  - FIPS CAVS: allow fips_* tools to run in FIPS mode (bnc#902364)
    * added openssl-fips_cavs_helpers_run_in_fips_mode.patch


author: vcizek@suse.com
changelog:
  - Fix CAVS testing padding issue with RSA d values (bsc#1044107)
    * add openssl-fips_cavs_pad_with_zeroes.patch from Pedro Monreal


author: vcizek@suse.com
changelog:
  - Use getrandom syscall instead of reading from /dev/urandom to get
    at least 128 bits of entropy to comply with FIPS 140.2 IG 7.14
    * merge openssl-urandom-reseeding.patch into new
      openssl-fips_entropy_reseeding.patch (bsc#1027079)


author: vcizek@suse.com
changelog:
  - FIPS CAVS: Add AES keywrap (KWVS) test tool (bsc#1044095)
    * add openssl-fips_cavs_aes_keywrap.patch


author: vcizek@suse.com
changelog:
  - remove DES-CBC3-SHA based ciphers from DEFAULT_SUSE (bsc#1027908)
    * update patches:
      openssl-1.0.1e-add-suse-default-cipher.patch
      openssl-1.0.1e-add-test-suse-default-cipher-suite.patch


author: vcizek@suse.com
changelog:
  - Don't run FIPS power-up self-tests when the checksum files aren't
    installed (bsc#1042392)
    * add openssl-fips-run_selftests_only_when_module_is_complete.patch


author: vcizek@suse.com
changelog:
  - use blocking getrandom syscall only from fips_drbg_bytes() to avoid
    stalls on low entropy (bsc#1044175)
  - refresh patches:
    * openssl-fips_entropy_reseeding.patch
    * openssl-fipslocking.patch


author: vcizek@suse.com
changelog:
  - Add ECDSA ciphers to DEFAULT_SUSE cipher list (bsc#1055825)
    * modified openssl-1.0.1e-add-suse-default-cipher.patch
    * modified openssl-1.0.1e-add-test-suse-default-cipher-suite.patch


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [02 Nov 2017]
    * CVE-2017-3736 (bsc#1066242)
    - bn_sqrx8x_internal carry bug on x86_64
    * add openssl-CVE-2017-3736.patch
  - OpenSSL Security Advisory [28 Aug 2017]
    * CVE-2017-3735 (bsc#1056058)
    - Malformed X.509 IPAdressFamily could cause OOB read()
    * add openssl-CVE-2017-3735.patch
  - fix crash in DES (bsc#1065363)
    * add openssl-fix_crash_in_DES.patch


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [07 Dec 2017]
    * Read/write after SSL object in error state
      (CVE-2017-3737, bsc#1071905)
    * rsaz_1024_mul_avx2 overflow bug on x86_64
      (CVE-2017-3738, bsc#1071906)
  - added patches:
    * openssl-CVE-2017-3737.patch
    * openssl-CVE-2017-3738.patch


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [27 Mar 2018]
    * Constructed ASN.1 types with a recursive definition could exceed
      the stack (CVE-2018-0739) (bsc#1087102)
  - add openssl-CVE-2018-0739.patch


author: vcizek@suse.com
changelog:
  - Suggest libopenssl1_0_0-hmac from libopenssl1_0_0 package to avoid
    dependency issues during updates (bsc#1090765)


author: sflees@suse.de
changelog:
  - Reject excessively large primes in DH key generation (bsc#1097158,
    CVE-2018-0732)
    * openssl-CVE-2018-0732.patch
  - blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)
    * openssl-add-blinding-to-ecdsa.patch
    * openssl-add-blinding-to-dsa.patch


author: vcizek@suse.com
changelog:
  - Namespace library to ease co-existing with openssl 1.1
    (fate#325336)
    * add openssl-1.0.0-version.patch
  - The openssl package is now a meta-package that pulls either
    openssl 1.0.2 (default) or openssl 1.1


author: vcizek@suse.com
changelog:
  - Don't Require openssl-1_0_0 from the devel package, just Recommend it
  - Add openssl(cli) Provide so the packages that require the openssl
    binary can require this instead of the new openssl meta package
    (bsc#1101470)


author: vcizek@suse.com
changelog:
  - Update to 1.0.2o (fate#325336)
    - rebase to Factory openssl 1.0.2
    - SSLv2 and SSLv3 is now disabled at compile time
  - added patches:
    * 0001-Set-FIPS-thread-id-callback.patch
    * openssl-pkgconfig-enginesdir.patch
    * openssl-truststore.patch
  - deleted patches
    * 0001-Make-openssl-req-x509-more-equivalent-to-openssl-req.patch
    * 0001-libcrypto-Hide-library-private-symbols.patch
    * 0005-libssl-Hide-library-private-symbols.patch
    * bsc936563_hack.patch
    * openssl-1.0.1e-truststore.diff
    * openssl-CVE-2016-0800-DROWN-disable-ssl2.patch
    * openssl-CVE-2016-7055.patch
    * openssl-CVE-2017-3731.patch
    * openssl-CVE-2017-3732.patch
    * openssl-CVE-2017-3735.patch
    * openssl-CVE-2017-3736.patch
    * openssl-CVE-2017-3737.patch
    * openssl-CVE-2017-3738.patch
    * openssl-CVE-2018-0732.patch
    * openssl-CVE-2018-0739.patch
    * openssl-add-blinding-to-dsa.patch
    * openssl-add-blinding-to-ecdsa.patch
    * openssl-degrade_3DES_to_MEDIUM_in_SSL2.patch
    * openssl-fix_crash_in_DES.patch
    * openssl-fix_crash_in_openssl_speed.patch
    * openssl-ocloexec.patch
    * openssl-print_notice-NULL_crash.patch
    * openssl-x86_extended_feature_detection.patch
    * openssl.test
  - move showciphers.c to a separate file


author: vcizek@suse.com
changelog:
  - Fix path to the engines which is in /lib64 on SLE-12
    (bsc#1101246, bsc#997043)
    * add openssl-pkgconfig-enginesdir.patch
    * add back bug610223.patch


author: vcizek@suse.com
changelog:
  - Update to 1.0.2p
    OpenSSL Security Advisory [12 June 2018]
    * Reject excessively large primes in DH key generation
      (bsc#1097158, CVE-2018-0732)
    OpenSSL Security Advisory [16 Apr 2018]
    * Cache timing vulnerability in RSA Key Generation
      (CVE-2018-0737, bsc#1089039)
    * Make EVP_PKEY_asn1_new() a bit stricter about its input
    * Revert blinding in ECDSA sign and instead make problematic addition
      length-invariant. Switch even to fixed-length Montgomery multiplication.
    * Change generating and checking of primes so that the error rate of not
      being prime depends on the intended use based on the size of the input.
    * Increase the number of Miller-Rabin rounds for DSA key generating to 64.
    * Add blinding to ECDSA and DSA signatures to protect against side channel
      attacks
    * When unlocking a pass phrase protected PEM file or PKCS#8 container, we
      now allow empty (zero character) pass phrases.
    * Certificate time validation (X509_cmp_time) enforces stricter
      compliance with RFC 5280. Fractional seconds and timezone offsets
      are no longer allowed.
  - add openssl-CVE-2018-0737-fips.patch
  - refreshed patches:
    * openssl-1.0.2a-fips-ec.patch
    * openssl-1.0.2a-ipv6-apps.patch
    * openssl-1.0.2i-fips.patch
    * openssl-1.0.2i-new-fips-reqs.patch


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [30 October 2018]
    * Timing vulnerability in DSA signature generation
      (bsc#1113652, CVE-2018-0734)
    * And more timing fixes (bsc#1113742)
  - Add patches:
    * openssl-CVE-2018-0734.patch
    * 0001-Merge-to-1.0.2-DSA-mod-inverse-fix.patch
    * 0001-Add-a-constant-time-flag-to-one-of-the-bignums-to-av.patch


author: vcizek@suse.com
changelog:
  - Elliptic curve scalar multiplication timing attack defenses
    * fixes "PortSmash" (bsc#1113534, CVE-2018-5407)
  - Add openssl-CVE-2018-5407-PortSmash.patch


author: vcizek@suse.com
changelog:
  - Set TLS version to 0 in msg_callback for record messages to avoid
    confusing applications (bsc#1100078)
    * add openssl-record_msg_callback.patch
  - Fix infinite loop in DSA generation with incorrect parameters
    (bsc#1112209)
    * add 0001-DSA-Check-for-sanity-of-input-parameters.patch


author: vcizek@suse.com
changelog:
  - The 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS
    Implementations (bsc#1117951)
    * https://github.com/openssl/openssl/issues/7739
  - add patches
    * 0001-crypto-bn-add-more-fixed-top-routines.patch
    * 0002-rsa-rsa_eay.c-implement-variant-of-Smooth-CRT-RSA.patch
    * 0003-bn-bn_blind.c-use-Montgomery-multiplication-when-pos.patch
    * 0004-bn-bn_lib.c-conceal-even-memmory-access-pattern-in-b.patch
    * 0005-err-err.c-add-err_clear_last_constant_time.patch
    * 0006-rsa-rsa_eay.c-make-RSAerr-call-in-rsa_ossl_private_d.patch
    * 0007-rsa-rsa_pk1.c-remove-memcpy-calls-from-RSA_padding_c.patch
    * 0008-rsa-rsa_oaep.c-remove-memcpy-calls-from-RSA_padding_.patch
    * 0009-rsa-rsa_ssl.c-make-RSA_padding_check_SSLv23-constant.patch


author: vcizek@suse.com
changelog:
  - Fix 0-byte record padding oracle via SSL_shutdown
    (bsc#1127080, CVE-2019-1559)
    * add openssl-CVE-2019-1559.patch


author: pmonrealgonzalez@suse.com
changelog:
  - OpenSSL Security Advisory [10 September 2019]
    * EC_GROUP_set_generator side channel attack avoidance. [bsc#1150003, CVE-2019-1547]
    * Bleichenbacher attack against cms/pkcs7 encryption transported key [bsc#1150250, CVE-2019-1563]
  - Added patches:
    * openssl-CVE-2019-1547.patch
    * openssl-CVE-2019-1563.patch


author: vcizek@suse.com
changelog:
  - Prevent invalid curve attacks by validating that an EC point lies
    on the curve (bsc#1131291)
    * add 0001-RT-4242-reject-invalid-EC-point-coordinates.patch


author: pmonrealgonzalez@suse.com
changelog:
  - Security fix: [bsc#1158809, CVE-2019-1551]
    * Overflow bug in the x64_64 Montgomery squaring procedure used
      in exponentiation with 512-bit moduli
  - Add openssl-1_1-CVE-2019-1551.patch


author: vcizek@suse.com
changelog:
  - Use SHA-2 in the RSA pairwise consistency check (bsc#1155346)
    * add openssl-fips_SHA2_in_RSA_pairwise_test.patch


author: jsikes@suse.com
changelog:
  - Preparation for fips certification (jsc#SLE-10541)
    * Added openssl-fips-drbg_derfunc.patch
    * Added openssl-fips_fix_selftests_return_value.patch


author: pmonreal@suse.com
changelog:
  - Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1176029]
  - Add patches:
    * openssl-DH.patch
    * openssl-kdf-tls-selftest.patch


author: vcizek@suse.com
changelog:
  - Add shared secret KAT to FIPS DH selftest [bsc#1176029]
    * add openssl-fips-DH_selftest_shared_secret_KAT.patch


author: vcizek@suse.com
changelog:
  - Drop obsolete CAVS subpackage and related patches:
    - openssl-fips_add_cavs_tests.patch
    - openssl-fips_cavs_aes_keywrap.patch
    - openssl-fips_cavs_helpers_run_in_fips_mode.patch
    - openssl-fips_cavs_pad_with_zeroes.patch
  - Use %autosetup instead of applying hundred patches by name
    * reverse 0001-Set-FIPS-thread-id-callback.patch


author: vcizek@suse.com
changelog:
  - Rename BN_get_rfc3526_prime_* functions back to get_rfc3526_prime_*
    (bsc#1177575)
  - update openssl-DH.patch


author: pmonreal@suse.com
changelog:
  - Initialize dh->nid to NID_undef in DH_new_method() [bsc#1177673]
  - Fix openQA test failure in apache_ssl in fips mode [bsc#1177793]
  - update openssl-DH.patch


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [08 December 2020]
    * Fix EDIPARTYNAME NULL pointer dereference
      (CVE-2020-1971, bsc#1179491)
    * add openssl-CVE-2020-1971.patch


author: jsikes@suse.com
changelog:
  - Add declaration of BN_secure_new() needed by other packages
    * add openssl-1.0.2p-declare-BN_secure_new.patch
    * [bsc#1180777]
  - Add FIPS key check necessary for certification.
    * modified openssl-DH.patch
    * [bsc#1180959]


author: pmonreal@suse.com
changelog:
  - Security fixes:
    * Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
      protection [bsc#1182333, CVE-2021-23840]
    * Null pointer deref in X509_issuer_and_serial_hash()
      [bsc#1182331, CVE-2021-23841]
  - Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch


author: jsikes@suse.com
changelog:
  - Add safe primes to DH parameter generation
    * RFC7919 and RFC3526
    * bsc#1180995
    * Added openssl-add_rfc3526_rfc7919.patch
    * Genpkey: "-pkeyopt dh_param:" can now choose modp_* (rfc3526) and
      ffdhe* (rfc7919) groups. Example:
      $ openssl genpkey -genparam -algorithm DH -pkeyopt dh_param:modp_4096


author: jsikes@suse.com
changelog:
  - The function X509_CERT_AUX_print() has a bug which may cause a read buffer overrun
    when printing certificate details. A malicious actor could construct a
    certificate to deliberately hit this bug, which may result in a crash of the
    application (causing a Denial of Service attack).
    * CVE-2021-3712
    * bsc#1189521
    * Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_CERT_AUX_print.patch


author: jsikes@suse.com
changelog:
  - Other OpenSSL functions that print ASN.1 data have been found to assume that
    the ASN1_STRING byte array will be NUL terminated, even though this is not
    guaranteed for strings that have been directly constructed. Where an application
    requests an ASN.1 structure to be printed, and where that ASN.1 structure
    contains ASN1_STRINGs that have been directly constructed by the application
    without NUL terminating the "data" field, then a read buffer overrun can occur.
    * CVE-2021-3712 continued
    * bsc#1189521
    * Add CVE-2021-3712-other-ASN1_STRING-issues.patch
    * Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
      2021-08-24 00:47 PDT by Marcus Meissner


author: jsikes@suse.com
changelog:
  - bsc#1190885
    * OpenSSL: parameters by name ffdheXXXX and modp_XXXX sometimes result in "not found"
    * modified openssl-DH.patch


author: pmonreal@suse.com
changelog:
  - Security Fix: [bsc#1196877, CVE-2022-0778]
    * Infinite loop in BN_mod_sqrt() reachable when parsing certificates
    * Add openssl-CVE-2022-0778.patch


author: pmonreal@suse.com
changelog:
  - Security Fix: [bsc#1196249]
    * Allow CRYPTO_THREADID_set_callback to be called with NULL parameter
    * Add openssl-CRYPTO_THREADID_set_callback.patch


author: jsikes@suse.com
changelog:
  - Security fix: [bsc#1199166, CVE-2022-1292]
    * Added: openssl-CVE-2022-1292.patch
    * properly sanitise shell metacharacters in c_rehash script.


author: jsikes@suse.com
changelog:
  - Added	openssl-1_0_0-Fix-file-operations-in-c_rehash.patch
    * bsc#1200550
    * CVE-2022-2068
    * Fixed more shell code injection issues in c_rehash


author: jsikes@suse.com
changelog:
  - Added openssl-1_0_0-paramgen-default_to_rfc7919.patch
    * bsc#1180995
    * Default to RFC7919 groups when generating ECDH parameters
      using 'genpkey' or 'dhparam' in FIPS mode.


author: otto.hollmann@suse.com
changelog:
  - Update further expiring certificates that affect tests [bsc#1201627]
    * Add openssl-Update-further-expiring-certificates.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [bsc#1207533, CVE-2023-0286]
    * Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
      for x400Address
    * Add openssl-CVE-2023-0286.patch
  - Security Fix: [bsc#1207536, CVE-2023-0215]
    * Use-after-free following BIO_new_NDEF()
    * Add patches:
    - openssl-CVE-2023-0215-1of4.patch
    - openssl-CVE-2023-0215-2of4.patch
    - openssl-CVE-2023-0215-3of4.patch
    - openssl-CVE-2023-0215-4of4.patch
    - openssl-Groundwork-for-a-perl-based-testing-framework.patch
    - openssl-Add-recipes-for-the-larger-protocols.patch
  - Security Fix: [bsc#1207534, CVE-2022-4304]
    * Timing Oracle in RSA Decryption
    * Add openssl-CVE-2022-4304.patch


author: otto.hollmann@suse.com
changelog:
  - Fix DH key generation in FIPS mode, add support for constant BN for
    DH parameters [bsc#1202062]
    * Add patch: openssl-fips_fix_DH_key_generation.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [CVE-2023-0464, bsc#1209624]
    * Excessive Resource Usage Verifying X.509 Policy Constraints
    * Add openssl-CVE-2023-0464.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [CVE-2023-0465, bsc#1209878]
    * Invalid certificate policies in leaf certificates are silently ignored
    * Add openssl-CVE-2023-0465.patch
  - Security Fix: [CVE-2023-0466, bsc#1209873]
    * Certificate policy check not enabled
    * Add openssl-CVE-2023-0466.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [CVE-2023-2650, bsc#1211430]
    * Possible DoS translating ASN.1 object identifiers
    * Add openssl-CVE-2023-2650.patch


author: otto.hollmann@suse.com
changelog:
  - Security Fix: [bsc#1207534, CVE-2022-4304]
    * Reworked the Fix for the Timing Oracle in RSA Decryption
      The previous fix for this timing side channel turned out to cause
      a severe 2-3x performance regression in the typical use case
      compared to 1.1.1s.
    * Reworked openssl-CVE-2022-4304.patch
    * Refreshed openssl-CVE-2023-0286.patch


author: pmonreal@suse.com
changelog:
  - Security fix: [bsc#1213487, CVE-2023-3446]
    * Fix DH_check() excessive time with over sized modulus.
    * The function DH_check() performs various checks on DH parameters.
      One of those checks confirms that the modulus ("p" parameter) is
      not too large. Trying to use a very large modulus is slow and
      OpenSSL will not normally use a modulus which is over 10,000 bits
      in length.
      However the DH_check() function checks numerous aspects of the
      key or parameters that have been supplied. Some of those checks
      use the supplied modulus value even if it has already been found
      to be too large.
      A new limit has been added to DH_check of 32,768 bits. Supplying
      a key/parameters with a modulus over this size will simply cause
      DH_check() to fail.
    * Add openssl-CVE-2023-3446.patch


author: otto.hollmann@suse.com
changelog:
  - Security fix: (bsc#1213853, CVE-2023-3817)
    * Fix excessive time spent checking DH q parameter value
      (bsc#1213853, CVE-2023-3817). The function DH_check() performs
      various checks on DH parameters. After fixing CVE-2023-3446 it
      was discovered that a large q parameter value can also trigger
      an overly long computation during some of these checks. A
      correct q value, if present, cannot be larger than the modulus
      p parameter, thus it is unnecessary to perform these checks if
      q is larger than p. If DH_check() is called with such q parameter
      value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
      computationally intensive checks are skipped.
    * Add openssl-1_0-CVE-2023-3817.patch


author: otto.hollmann@suse.com
changelog:
  - Security fix: [bsc#1216922, CVE-2023-5678]
    * Fix excessive time spent in DH check / generation with large Q
      parameter value.
    * Applications that use the functions DH_generate_key() to generate
      an X9.42 DH key may experience long delays. Likewise,
      applications that use DH_check_pub_key(), DH_check_pub_key_ex
      () or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42
      DH parameters may experience long delays. Where the key or
      parameters that are being checked have been obtained from an
      untrusted source this may lead to a Denial of Service.
    * Add openssl-CVE-2023-5678.patch


author: otto.hollmann@suse.com
changelog:
  - Security fix: [bsc#1219243, CVE-2024-0727]
    * Add NULL checks where ContentInfo data can be NULL
    * Add openssl-CVE-2024-0727.patch


author: dmueller@suse.com
changelog:
  - update to 1.0.1g:
    * fix for critical TLS heartbeat read overrun (CVE-2014-0160) (bnc#872299)
    * Fix for Recovering OpenSSL ECDSA Nonces (CVE-2014-0076) (bnc#869945)
    * Workaround for the "TLS hang bug" (see FAQ and PR#2771)
  - remove CVE-2014-0076.patch
  - openssl.keyring: upstream changed to:
    pub  4096R/FA40E9E2 2005-03-19 Dr Stephen N Henson <steve@openssl.org>
    uid                            Dr Stephen Henson <shenson@drh-consultancy.co.uk>
    uid                            Dr Stephen Henson <shenson@opensslfoundation.com>


author: crrodriguez@opensuse.org
changelog:
  - openssl-gcc-attributes.patch
    * annotate memory allocation wrappers with attribute(alloc_size)
      so the compiler can tell us if it knows they are being misused
    * OPENSSL_showfatal is annotated with attribute printf to detect
      format string problems.
  - It is time to try to disable SSLv2 again, it was tried a while
    ago but broke too many things, nowadays Debian, Ubuntu, the BSDs
    all have disabled it, most components are already fixed.
    I will fix the remaining fallout if any. (email me)


author: crrodriguez@opensuse.org
changelog:
  - openssl-gcc-attributes.patch: fix thinko, CRYPTO_realloc_clean does
    not return memory of "num * old_num" but only "num" size
    fortunately this function is currently unused.


author: crrodriguez@opensuse.org
changelog:
  - openssl-libssl-noweakciphers.patch do not offer "export"
    or "low" quality ciphers by default. using such ciphers
    is not forbidden but requires an explicit request


author: crrodriguez@opensuse.org
changelog:
  - openssl-buffreelistbug-aka-CVE-2010-5298.patch fix
    CVE-2010-5298 and disable the internal BUF_FREELISTS
    functionality. it hides bugs like heartbleed and is
    there only for systems on which malloc() free() are slow.
  - ensure we export MALLOC_CHECK and PERTURB during the test
    suite, now that the freelist functionality is disabled it
    will help to catch bugs before they hit users.


author: crrodriguez@opensuse.org
changelog:
  - Use enable-rfc3779 to allow projects such as rpki.net
    to work in openSUSE and match the functionality
    available in Debian/Fedora/etc


author: crrodriguez@opensuse.org
changelog:
  - Remove the "gmp" and "capi" shared engines, nobody noticed
    but they are just dummies that do nothing.


author: crrodriguez@opensuse.org
changelog:
  - Build everything with full RELRO (-Wl,-z,relro,-z,now)
  - Remove -fstack-protector from the hardcoded build options
    it is already in RPM_OPT_FLAGS and is replaced by
    - fstack-protector-strong with gcc 4.9


author: citypw@gmail.com
changelog:
  - Fixed bug[ bnc#876282], CVE-2014-0198 openssl: OpenSSL NULL pointer dereference in do_ssl3_write
    Add file: CVE-2014-0198.patch


author: crrodriguez@opensuse.org
changelog:
  -  0005-libssl-Hide-library-private-symbols.patch
    Update to hide more symbols that are not part of
    the public API
  - openssl-gcc-attributes.patch BUF_memdup also
    needs attribute alloc_size as it returns memory
    of size of the second parameter.
  - openssl-ocloexec.patch Update, accept()
    also needs O_CLOEXEC.
  - 0009-Fix-double-frees.patch, 0017-Double-free-in-i2o_ECPublicKey.patch
    fix various double frees (from upstream)
  - 012-Fix-eckey_priv_encode.patch eckey_priv_encode should
    return an error inmediately on failure of i2d_ECPrivateKey (from upstream)
  - 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
    From libressl, modified to work on linux systems that do not have
    funopen() but fopencookie() instead.
    Once upon a time, OS didn't have snprintf, which caused openssl to
    bundle a *printf implementation. We know better nowadays, the glibc
    implementation has buffer overflow checking, has sane failure modes
    deal properly with threads, signals..etc..
  - build with -fno-common as well.


author: crrodriguez@opensuse.org
changelog:
  - Add upstream patches fixing coverity scan issues:
    * 0018-fix-coverity-issues-966593-966596.patch
    * 0020-Initialize-num-properly.patch
    * 0022-bignum-allow-concurrent-BN_MONT_CTX_set_locked.patch
    * 0023-evp-prevent-underflow-in-base64-decoding.patch
    * 0024-Fixed-NULL-pointer-dereference-in-PKCS7_dataDecode-r.patch
    * 0025-fix-coverity-issue-966597-error-line-is-not-always-i.patch
  - Update 0001-libcrypto-Hide-library-private-symbols.patch
    to cover more private symbols, now 98% complete and probably
    not much more can be done to fix the rest of the ill-defined API.
  - openssl-fips-hidden.patch new, hides private symbols added by the
    FIPS patches.
  - openssl-no-egd.patch disable the EGD (entropy gathering daemon)
    interface, we have no EGD in the distro and obtaining entropy from
    a place other than /dev/*random, the hardware rng or the openSSL
    internal PRNG is an extremely bad & dangerous idea.
  - use secure_getenv instead of getenv everywhere.


author: vpereira@novell.com
changelog:
  - Added new SUSE default cipher suite
    openssl-1.0.1e-add-suse-default-cipher.patch
    openssl-1.0.1e-add-suse-default-cipher-header.patch
    openssl-1.0.1e-add-test-suse-default-cipher-suite.patch


author: meissner@suse.com
changelog:
  - updated openssl to 1.0.1h (bnc#880891):
    - CVE-2014-0224: Fix for SSL/TLS MITM flaw. An attacker using a carefully crafted
      handshake can force the use of weak keying material in OpenSSL
      SSL/TLS clients and servers.
    - CVE-2014-0221: Fix DTLS recursion flaw. By sending an invalid DTLS handshake to an
      OpenSSL DTLS client the code can be made to recurse eventually crashing
      in a DoS attack.
    - CVE-2014-0195: Fix DTLS invalid fragment vulnerability. A buffer
      overrun attack can be triggered by sending invalid DTLS fragments to
      an OpenSSL DTLS client or server. This is potentially exploitable to
      run arbitrary code on a vulnerable client or server.
    - CVE-2014-3470: Fix bug in TLS code where clients enable anonymous
      ECDH ciphersuites are subject to a denial of service attack.
  - openssl-buffreelistbug-aka-CVE-2010-5298.patch: removed, upstream
  - CVE-2014-0198.patch: removed, upstream
  - 0009-Fix-double-frees.patch: removed, upstream
  - 0012-Fix-eckey_priv_encode.patch: removed, upstream
  - 0017-Double-free-in-i2o_ECPublicKey.patch: removed, upstream
  - 0018-fix-coverity-issues-966593-966596.patch: removed, upstream
  - 0020-Initialize-num-properly.patch: removed, upstream
  - 0022-bignum-allow-concurrent-BN_MONT_CTX_set_locked.patch: removed, upstream
  - 0023-evp-prevent-underflow-in-base64-decoding.patch: removed, upstream
  - 0024-Fixed-NULL-pointer-dereference-in-PKCS7_dataDecode-r.patch: removed, upstream
  - 0025-fix-coverity-issue-966597-error-line-is-not-always-i.patch: removed, upstream
  - 0001-libcrypto-Hide-library-private-symbols.patch: disabled heartbeat testcase
  - openssl-1.0.1c-ipv6-apps.patch: refreshed
  - openssl-fix-pod-syntax.diff: some stuff merged upstream, refreshed


author: jengelh@inai.de
changelog:
  - Move manpages around: *.1ssl should be in openssl
    (e.g. ciphers(1ssl) is also referenced by openssl(1)),
    and *.3ssl should be in openssl-doc.


author: crrodriguez@opensuse.org
changelog:
  - openSSL 1.0.1j
    * Fix SRTP Memory Leak (CVE-2014-3513)
    * Session Ticket Memory Leak (CVE-2014-3567)
    * Add SSL 3.0 Fallback protection (TLS_FALLBACK_SCSV)
    * Build option no-ssl3 is incomplete (CVE-2014-3568)


author: meissner@suse.com
changelog:
  - openssl-1.0.1i-noec2m-fix.patch: only report the Elliptic Curves
    we actually support (not the binary ones) (bnc#905037)


author: meissner@suse.com
changelog:
  - openssl 1.0.1k release
    bsc#912294 CVE-2014-3571: Fix DTLS segmentation fault in dtls1_get_record.
    bsc#912292 CVE-2015-0206: Fix DTLS memory leak in dtls1_buffer_record.
    bsc#911399 CVE-2014-3569: Fix issue where no-ssl3 configuration sets method to NULL.
    bsc#912015 CVE-2014-3572: Abort handshake if server key exchange
      message is omitted for ephemeral ECDH ciphersuites.
    bsc#912014 CVE-2015-0204: Remove non-export ephemeral RSA code on client and server.
    bsc#912293 CVE-2015-0205: Fixed issue where DH client certificates are accepted without verification.
    bsc#912018 CVE-2014-8275: Fix various certificate fingerprint issues.
    bsc#912296 CVE-2014-3570: Correct Bignum squaring.
    and other bugfixes.
  - openssl.keyring: use Matt Caswells current key.
    pub  2048R/0E604491 2013-04-30
    uid                            Matt Caswell <frodo@baggins.org>
    uid                            Matt Caswell <matt@openssl.org>
    sub  2048R/E3C21B70 2013-04-30
  - openssl-1.0.1e-fips.patch: rediffed
  - openssl-1.0.1i-noec2m-fix.patch: removed (upstream)
  - openssl-ocloexec.patch: rediffed


author: vcizek@suse.com
changelog:
  - update to 1.0.2a
    * Major changes since 1.0.1:
    - Suite B support for TLS 1.2 and DTLS 1.2
    - Support for DTLS 1.2
    - TLS automatic EC curve selection.
    - API to set TLS supported signature algorithms and curves
    - SSL_CONF configuration API.
    - TLS Brainpool support.
    - ALPN support.
    - CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.
  - packaging changes:
    * merged patches modifying CIPHER_LIST into one, dropping:
    - openssl-1.0.1e-add-suse-default-cipher-header.patch
    - openssl-libssl-noweakciphers.patch
    * fix a manpage with invalid name
    - added openssl-fix_invalid_manpage_name.patch
    * remove a missing fips function
    - openssl-missing_FIPS_ec_group_new_by_curve_name.patch
    * reimported patches from Fedora
      dropped patches:
    - openssl-1.0.1c-default-paths.patch
    - openssl-1.0.1c-ipv6-apps.patch
    - openssl-1.0.1e-fips-ctor.patch
    - openssl-1.0.1e-fips-ec.patch
    - openssl-1.0.1e-fips.patch
    - openssl-1.0.1e-new-fips-reqs.patch
    - VIA_padlock_support_on_64systems.patch
      added patches:
    - openssl-1.0.2a-default-paths.patch
    - openssl-1.0.2a-fips-ctor.patch
    - openssl-1.0.2a-fips-ec.patch
    - openssl-1.0.2a-fips.patch
    - openssl-1.0.2a-ipv6-apps.patch
    - openssl-1.0.2a-new-fips-reqs.patch
    - openssl-1.0.2a-padlock64.patch
    * dropped security fixes (upstream)
    - openssl-CVE-2015-0209.patch
    - openssl-CVE-2015-0286.patch
    - openssl-CVE-2015-0287.patch
    - openssl-CVE-2015-0288.patch
    - openssl-CVE-2015-0289.patch
    - openssl-CVE-2015-0293.patch
    * upstream reformatted the sources, so all the patches have to
      be refreshed


author: vcizek@suse.com
changelog:
  - update to 1.0.2b
    * Malformed ECParameters causes infinite loop (CVE-2015-1788)
    * Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
    * PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
    * CMS verify infinite loop with unknown hash function (CVE-2015-1792)
    * Race condition handling NewSessionTicket (CVE-2015-1791)
  - refreshed patches:
    * 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
    * 0001-libcrypto-Hide-library-private-symbols.patch
    * openssl-1.0.2a-default-paths.patch
    * openssl-1.0.2a-fips.patch
    * compression_methods_switch.patch
    * openssl-1.0.1e-add-test-suse-default-cipher-suite.patch


author: crrodriguez@opensuse.org
changelog:
  - Build with no-ssl3, for details on why this is needed read
    rfc7568. Contrary to the "no-ssl2" option, this does not
    require us to patch dependant packages as the relevant
    functions are still available (SSLv3_(client|server)_method)
    but will fail to negotiate. if removing SSL3 methods is desired
    at a later time, option "no-ssl3-method" needs to be used.


author: normand@linux.vnet.ibm.com
changelog:
  - update merge_from_0.9.8k.patch replacing __LP64__ by __LP64
    this is a change versus previous request 309611
    required to avoid build error for ppc64


author: vcizek@suse.com
changelog:
  - update to 1.0.2d
    * fixes CVE-2015-1793 (bsc#936746)
    Alternate chains certificate forgery
      During certificate verfification, OpenSSL will attempt to find an
      alternative certificate chain if the first attempt to build such a chain
      fails. An error in the implementation of this logic can mean that an
      attacker could cause certain checks on untrusted certificates to be
      bypassed, such as the CA flag, enabling them to use a valid leaf
      certificate to act as a CA and "issue" an invalid certificate.
  - drop openssl-fix_invalid_manpage_name.patch (upstream)


author: vcizek@suse.com
changelog:
  - update to 1.0.2e
    * fixes five security vulnerabilities
    * Anon DH ServerKeyExchange with 0 p parameter
      (CVE-2015-1794) (bsc#957984)
    * BN_mod_exp may produce incorrect results on x86_64
      (CVE-2015-3193) (bsc#957814)
    * Certificate verify crash with missing PSS parameter
      (CVE-2015-3194) (bsc#957815)
    * X509_ATTRIBUTE memory leak
      (CVE-2015-3195) (bsc#957812)
    * Race condition handling PSK identify hint
      (CVE-2015-3196) (bsc#957813)
  - pulled a refreshed fips patch from Fedora
    * openssl-1.0.2a-fips.patch was replaced by
      openssl-1.0.2e-fips.patch
  - refresh openssl-ocloexec.patch


author: vcizek@suse.com
changelog:
  - update to 1.0.2f (boo#963410)
    * ) DH small subgroups (boo#963413)
      Historically OpenSSL only ever generated DH parameters based on "safe"
      primes. More recently (in version 1.0.2) support was provided for
      generating X9.42 style parameter files such as those required for RFC 5114
      support. The primes used in such files may not be "safe". Where an
      application is using DH configured with parameters based on primes that are
      not "safe" then an attacker could use this fact to find a peer's private
      DH exponent. This attack requires that the attacker complete multiple
      handshakes in which the peer uses the same private DH exponent. For example
      this could be used to discover a TLS server's private DH exponent if it's
      reusing the private DH exponent or it's using a static DH ciphersuite.
      (CVE-2016-0701)
    * ) SSLv2 doesn't block disabled ciphers (boo#963415)
      A malicious client can negotiate SSLv2 ciphers that have been disabled on
      the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
      been disabled, provided that the SSLv2 protocol was not also disabled via
      SSL_OP_NO_SSLv2.
      (CVE-2015-3197)
    * ) Reject DH handshakes with parameters shorter than 1024 bits.


author: vcizek@suse.com
changelog:
  - update to 1.0.2g (bsc#968044)
    * Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
      Builds that are not configured with "enable-weak-ssl-ciphers" will not
      provide any "EXPORT" or "LOW" strength ciphers.
    * Disable SSLv2 default build, default negotiation and weak ciphers.  SSLv2
      is by default disabled at build-time.  Builds that are not configured with
      "enable-ssl2" will not support SSLv2.  Even if "enable-ssl2" is used,
      users who want to negotiate SSLv2 via the version-flexible SSLv23_method()
      will need to explicitly call either of:
      SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);
      or
      SSL_clear_options(ssl, SSL_OP_NO_SSLv2);
      (CVE-2016-0800)
    * Fix a double-free in DSA code
      (CVE-2016-0705)
    * Disable SRP fake user seed to address a server memory leak.
      Add a new method SRP_VBASE_get1_by_user that handles the seed properly.
      (CVE-2016-0798)
    * Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
      (CVE-2016-0797)
    * ) Side channel attack on modular exponentiation
      http://cachebleed.info.
      (CVE-2016-0702)
    * ) Change the req app to generate a 2048-bit RSA/DSA key by default,
      if no keysize is specified with default_bits. This fixes an
      omission in an earlier change that changed all RSA/DSA key generation
      apps to use 2048 bits by default.


author: vcizek@suse.com
changelog:
  - import fips patches from SLE-12
    * openssl-fips-clearerror.patch
    * openssl-fips-dont-fall-back-to-default-digest.patch
    * openssl-fips-fix-odd-rsakeybits.patch
    * openssl-fips-rsagen-d-bits.patch
    * openssl-fips-selftests_in_nonfips_mode.patch
    * openssl-fips_RSA_compute_d_with_lcm.patch
    * openssl-fips_disallow_ENGINE_loading.patch
    * openssl-fips_disallow_x931_rand_method.patch
    * openssl-rsakeygen-minimum-distance.patch
    * openssl-urandom-reseeding.patch


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [3rd May 2016]
  - update to 1.0.2h (boo#977584, boo#977663)
    * Prevent padding oracle in AES-NI CBC MAC check
      A MITM attacker can use a padding oracle attack to decrypt traffic
      when the connection uses an AES CBC cipher and the server support
      AES-NI.
      (CVE-2016-2107, boo#977616)
    * Fix EVP_EncodeUpdate overflow
      An overflow can occur in the EVP_EncodeUpdate() function which is used for
      Base64 encoding of binary data. If an attacker is able to supply very large
      amounts of input data then a length check can overflow resulting in a heap
      corruption.
      (CVE-2016-2105, boo#977614)
    * Fix EVP_EncryptUpdate overflow
      An overflow can occur in the EVP_EncryptUpdate() function. If an attacker
      is able to supply very large amounts of input data after a previous call to
      EVP_EncryptUpdate() with a partial block then a length check can overflow
      resulting in a heap corruption.
      (CVE-2016-2106, boo#977615)
    * Prevent ASN.1 BIO excessive memory allocation
      When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio()
      a short invalid encoding can casuse allocation of large amounts of memory
      potentially consuming excessive resources or exhausting memory.
      (CVE-2016-2109, boo#976942)
    * EBCDIC overread
      ASN1 Strings that are over 1024 bytes can cause an overread in applications
      using the X509_NAME_oneline() function on EBCDIC systems. This could result
      in arbitrary stack data being returned in the buffer.
      (CVE-2016-2176, boo#978224)
    * Modify behavior of ALPN to invoke callback after SNI/servername
      callback, such that updates to the SSL_CTX affect ALPN.
    * Remove LOW from the DEFAULT cipher list.  This removes singles DES from the
      default.
    * Only remove the SSLv2 methods with the no-ssl2-method option. When the
      methods are enabled and ssl2 is disabled the methods return NULL.


author: vcizek@suse.com
changelog:
  - OpenSSL Security Advisory [22 Sep 2016] (bsc#999665)
    Severity: High
    * OCSP Status Request extension unbounded memory growth
      (CVE-2016-6304) (bsc#999666)
    Severity: Low
    * Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575)
    * Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249)
    * DTLS buffered message DoS (CVE-2016-2179) (bsc#994844)
    * OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419)
    * DTLS replay protection DoS (CVE-2016-2181) (bsc#994749)
    * OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819)
    * Birthday attack against 64-bit block ciphers (SWEET32)
      (CVE-2016-2183) (bsc#995359)
    * Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324)
    * OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377)
    * Certificate message OOB reads (CVE-2016-6306) (bsc#999668)
  - update to openssl-1.0.2i
    * remove patches:
      openssl-1.0.2a-new-fips-reqs.patch
      openssl-1.0.2e-fips.patch
    * add patches:
      openssl-1.0.2i-fips.patch
      openssl-1.0.2i-new-fips-reqs.patch


author: vcizek@suse.com
changelog:
  - add FIPS changes from SP2:
  - fix problems with locking in FIPS mode (bsc#992120)
    * duplicates: bsc#991877, bsc#991193, bsc#990392, bsc#990428
      and bsc#990207
    * bring back openssl-fipslocking.patch
  - drop openssl-fips_RSA_compute_d_with_lcm.patch (upstream)
    (bsc#984323)
  - don't check for /etc/system-fips (bsc#982268)
    * add openssl-fips-dont_run_FIPS_module_installed.patch
  - refresh openssl-fips-rsagen-d-bits.patch


author: vcizek@suse.com
changelog:
  - resume reading from /dev/urandom when interrupted by a signal
    (bsc#995075)
    * add openssl-randfile_fread_interrupt.patch


author: meissner@suse.com
changelog:
  - Updated to openssl 1.0.2k
    - bsc#1009528 / CVE-2016-7055: openssl: Montgomery multiplication may produce incorrect results
    - bsc#1019334 / CVE-2016-7056: openssl: ECSDA P-256 timing attack key recovery
    - bsc#1022085 / CVE-2017-3731: openssl: Truncated packet could crash via OOB read
    - bsc#1022086 / CVE-2017-3732: openssl: BN_mod_exp may produce incorrect results on x86_64


author: vcizek@suse.com
changelog:
  - fix X509_CERT_FILE path (bsc#1022271) and rename
    updated openssl-1.0.1e-truststore.diff to openssl-truststore.patch


author: tchvatal@suse.com
changelog:
  - Remove O3 from optflags, no need to not rely on distro wide settings
  - Remove conditions for sle10 and sle11, we care only about sle12+
  - USE SUSE instead of SuSE in readme
  - Pass over with spec-cleaner


author: tchvatal@suse.com
changelog:
  - Prepare to split to various subpackages converting main one to
    dummy package
  - Reduce to only provide main pkg and devel and depend on proper
    soversioned package
  - Version in this package needs to be synced with the one provided
    by the split package
  - Remove all the patches, now in the proper versioned namespace:
    * merge_from_0.9.8k.patch
    * openssl-1.0.0-c_rehash-compat.diff
    * bug610223.patch
    * openssl-ocloexec.patch
    * openssl-1.0.2a-padlock64.patch
    * openssl-fix-pod-syntax.diff
    * openssl-truststore.patch
    * compression_methods_switch.patch
    * 0005-libssl-Hide-library-private-symbols.patch
    * openssl-1.0.2a-default-paths.patch
    * openssl-pkgconfig.patch
    * openssl-1.0.2a-ipv6-apps.patch
    * 0001-libcrypto-Hide-library-private-symbols.patch
    * openssl-1.0.2i-fips.patch
    * openssl-1.0.2a-fips-ec.patch
    * openssl-1.0.2a-fips-ctor.patch
    * openssl-1.0.2i-new-fips-reqs.patch
    * openssl-gcc-attributes.patch
    * 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
    * openssl-no-egd.patch
    * openssl-fips-hidden.patch
    * openssl-1.0.1e-add-suse-default-cipher.patch
    * openssl-1.0.1e-add-test-suse-default-cipher-suite.patch
    * openssl-missing_FIPS_ec_group_new_by_curve_name.patch
    * openssl-fips-dont_run_FIPS_module_installed.patch
    * openssl-fips_disallow_x931_rand_method.patch
    * openssl-fips_disallow_ENGINE_loading.patch
    * openssl-rsakeygen-minimum-distance.patch
    * openssl-urandom-reseeding.patch
    * openssl-fips-rsagen-d-bits.patch
    * openssl-fips-selftests_in_nonfips_mode.patch
    * openssl-fips-fix-odd-rsakeybits.patch
    * openssl-fips-clearerror.patch
    * openssl-fips-dont-fall-back-to-default-digest.patch
    * openssl-fipslocking.patch
    * openssl-print_notice-NULL_crash.patch
    * openssl-randfile_fread_interrupt.patch


author: tchvatal@suse.com
changelog:
  - Fix typo in openssl requires
  - Add dependency on the branched devel package
  - Provide all pkgconfig symbols to hide them in versioned subpkgs
  - This allows us to propagate only the preffered version of openssl
    while allowing us to add extra openssl only as additional dependency


author: tchvatal@suse.com
changelog:
  - Provide basic baselibs.conf for 32bit subpackages
  - Specify this package as noarch (as we just provide README files)


author: vcizek@suse.com
changelog:
  - Obsolete openssl-debuginfo
    * the package doesn't exist any more, has been replaced by
      openssl-{so_version}-debuginfo (bsc#1040172)


author: vcizek@suse.com
changelog:
  - Revert version back to 1.0.2m to get security fixes quickly to
    Tumbleweed
    * OpenSSL Security Advisory [02 Nov 2017] (bsc#1066242,bsc#1056058)


author: vcizek@suse.com
changelog:
  - change the sonum to 1.1, as all the minor versions keep ABI
    compatibility (bsc#1081335)
  - update baselibs.conf


author: vcizek@suse.com
changelog:
  - Packaged for SLE-12-SP4 (fate#325336)
    * point to 1.0.2h
    * adjust baselibs to 1_0_0
    - recommend openssl from libopenssl-devel


author: jreidinger@suse.cz
changelog:
  - Code cleanup
  - abstract udev settings from library
  - abstract architecture from library
  - doesn't parse # after text for grub bootloader (bnc#481416)
  - move MBR handling code from yast2-bootlaoder to pbl
  - 0.5.0


author: jreidinger@suse.cz
changelog:
  - add SplitPath to library interface
  - fix filling partitions
  - set thinkpad detection to last know detection
  - fix building on ppc
  - 0.5.1


author: jreidinger@suse.cz
changelog:
  - suppress warning about testing extended partition (bnc#504083)
  - don't warn if multipath module is not loaded and just log it
    (bnc#506742)
  - remove last occurences of metadata as now yast2-bootloader
    doesn't use it
  - 0.5.2


author: jreidinger@suse.cz
changelog:
  - Allow parameters without root in zipl (bnc#511398)
  - implement failover boot for md arrays (FATE #305008)
  - fix perl warnings if target device cannot be read
  - 0.5.4


author: jreidinger@suse.cz
changelog:
  - don't use blkid for UUID and label, as it is deprecated and
    causes problems if have in cache non-existed devices
    (bnc#531636)


author: jreidinger@suse.cz
changelog:
  - Adapt to new kernel flavor desktop and create fallback section
    for this section (bnc#537208)
  - 0.5.5


author: jreidinger@suse.cz
changelog:
  -  add tests for md raid
  -  add more verbose logging for md raid
  -  add fix for labeled md raid partitions bnc#535065
  -  fix root paramtere for S390 (bnc#539824)
  -  0.5.6


author: jreidinger@novell.com
changelog:
  - don't translate during kernel-update mdraid over whole disc
    (FATE#305883)
  - fix problems with MD Raid (bnc#533866,bnc#547580)
  - pass vga mode to xen kernel (FATE#305310); fix mdraid test to
    check proper directory
  - 0.5.7


author: jreidinger@novell.com
changelog:
  - fix md raid duplication of boot sector (bnc#555574)
  - adapt failsafe to disable KMS (bnc#560426)
  - fix printing warning (bnc#559151)
  - 0.5.8


author: jreidinger@novell.com
changelog:
  - don't print outside if mdadm missing (bnc#578003)
  - fix splitting of values which now doesn't use that structure
    (bnc#566020)
  - adapt to new version of getting product description (bnc#583034)
  - 0.5.9


author: jreidinger@novell.com
changelog:
  - use same root as it is in etc/fstab (bnc#575362)
  - use new zypper method to get boot label (prevent hang during
    installation)
  - 0.5.10


author: jreidinger@novell.com
changelog:
  - adapt to new kernel which use only ext_range (bnc#597774)
  - explicitelly mention that output come from pbl (bnc#597810)
  - port changes from SP1 - avoid warning if path is not used
    and create failsafe also on s390
  - 0.5.11


author: jreidinger@novell.com
changelog:
  - port changes from SLE11SP1
  - user properly names for raid disc in partition map (bnc#607852)
  - add missing keyword to hashed password (bnc#598025)
  - 0.5.12


author: jreidinger@novell.com
changelog:
  - DM_NAME could contain also partition number in some case
    (bnc#590637)
  - fix detect of md raid (bnc#626132)
  - 0.5.13


author: lnussel@suse.de
changelog:
  - own /var/log/YaST2 as perl-Bootloader can be installed without
    yast but spams stderr with debug output if the log dir is not
    present.


author: jreidinger@novell.com
changelog:
  - in tools return reference for easy to implement advanced command line scripts
  - force order of serial and terminal configuration (bnc#650150)
  - fix detecting extended partition on virtual discs (bnc#659905)
  - 0.5.16


author: jreidinger@novell.com
changelog:
  - prepare for use perl-Bootloader for other boot management tools
    (bnc#672471#c8)
  - change behavior during kernel update to first try use parameters
    from fitting section and have sysconfig only as failsafe
    (FATE#310946)
  - 0.5.18


author: snwint@suse.de
changelog:
  - support more devices in fallback heuristics
  - add basic grub2 support to update-bootloader
  - 0.5.22


author: mchang@suse.com
changelog:
  - grub2-kernel-commandline.patch: add kerenl parameters (detected
    necessary and user specfied one during installation) to grub2's
    config file.(bnc#752939)
  - 0.6.1


author: mchang@suse.de
changelog:
  - add read/write grub2-efi's settings for global options from yast2's
    bootloader option widgets, including timeout, hiddenmenu, vgamode, append
    and default
  - add read/write grub2's settings for serial console from yast2's bootloader
    option widgets
  - add read/write grub2's settings for global options from yast2's bootloader
    option widgets, including timeout, hiddenmenu, vgamode, append and default
  - fix bootloader_entry util to correctly handle grub2's case (bnc#755183)


author: mchang@suse.de
changelog:
  - fix after grub2 package update, the system become unbootable. (bnc#758570)
    also fix running update-bootloader --refresh returns error when extended
    partition is to be installed.
  - 0.6.3


author: snwint@suse.de
changelog:
  - mchang: fix error caused by grub.cfg missing (bnc#769350)
  - make dependency on Pod::Usage optional (bnc#760464)
  - 0.6.5


author: mchang@suse.com
changelog:
  - use 'auto' for default gfxmode
  - replace background with theme
  - support editing GRUB_DISTRIBUTOR
  - re-enable to create device.map from BootStorage
  - 0.6.6


author: mchang@suse.com
changelog:
  - add management to GRUB_BACKGROUND
  - export section and write as global option
  - manage GRUB_DISABLE_OS_PROBER settings
  - use grub device name in /etc/default/grub_installdevice


author: snwint@suse.de
changelog:
  - if called from yast: log directly to y2log, not via limal
  - don't use udev for device mapping; instead read symlinks in dev tree
  - add package-local make target
  - clean up spec file
  - log root device & chroot
  - use additional log file /var/log/pbl.log for now to work around broken yast logging
  - 0.702


author: snwint@suse.de
changelog:
  - don't report an error if bootloader type is unset (bnc#757942)
  - don't run external grep to read sysconfig variables
  - don't use Sys::Hostname (bnc#792634)
  - 0.705


author: snwint@suse.de
changelog:
  - arvidjaar: use explicit target arch for GRUB2 and remove grub2-efi calls
  - mchang: handle add and remove in update-bootloader for grub2
  - 0.706


author: snwint@suse.de
changelog:
  - support uefi secureboot
  - fix timeout 0 not work
  - default to entry 0 if no saved_entry is present in grub2 env
  - mention grub2 in /boot/boot.readme
  - 0.708


author: snwint@suse.de
changelog:
  - update-bootloader refresh cleanup and introduce reinit
  - better way to know kerenl device of physical drive
  - fix grub2-set-default error during installation
  - remove floppy in device map
  - clean up unused functions and variables
  - use grub2-probe to get device map
  - unify indention
  - require coreutils for %post
  - 0.709


author: snwint@suse.de
changelog:
  - add pbl-yaml: a command line interface to perl-Bootloader using YAML files
    for input and output
  - 0.800


author: snwint@suse.de
changelog:
  - fix confusion between Tools::GetDeviceMapping() and Core::GetDeviceMapping()
    (bnc#858268)
  - 0.801


author: mchang@suse.com
changelog:
  - enable SUSE_BTRFS_SNAPSHOT_BOOTING on x86 as other architectures
    are working in progress.
  - 0.808


author: snwint@suse.de
changelog:
  - drop old log /var/log/YaST2/perl-BL-standalone-log
  - remove /var/log/YaST2/y2log_bootloader
  - add MaxDepth parameter to logging function
  - clean up logging in some functions
  - use logrotate file (bnc#822774)
  - 0.811


author: mchang@suse.com
changelog:
  - enable btrfs snapshot booting on ppc
  - remove suse_btrfs_grub2_install.sh as it's no longer used
  - 0.812


author: snwint@suse.com
changelog:
  - started pbl-yaml testsuite
  - added test cases for various utf8/non-utf8/really broken config files
  - rewrite file-io to do some utf8 processing that keeps non-utf8 files intact as much as possible
  - use only WriteFileRaw() to actually write files
  - use ReadFileRaw() to read grub2 config (bnc#899921)
  - rewrite ReadFile() to handle utf8 properly (bnc#899921)
  - export more pbl functions via yaml interface to allow easier testing
  - 0.832


author: snwint@suse.com
changelog:
  - allow empty distributor, which for new grub2 means use os-release (bsc#942519)
  - more fixes in grub2-efi
  - fix empty distributor handling for grub2-efi (bsc#942519)
  - 0.842


author: snwint@suse.com
changelog:
  - make grub_installdevice parsing more robust
  - continue after wrong entries in grub_install_device
  - move bootloader scripts into separate subdirectories
  - updated doc
  - introduce separate per-bootloader scripts
  - add documentation
  - some minor corrections
  - support --reinit option to force grub2 install
  - adjust Makefile
  - add new wrapper script to get rid of old perl-Bootloader code for grub2
  - 0.900


author: snwint@suse.com
changelog:
  - grub2-efi: Allow fallback to removable booting
  - grub2-efi: Make 32bit arm be a wildcard match
  - 0.907


author: snwint@suse.com
changelog:
  - also clear LC_ALL when setting locale
  - run grub in RC_LANG locale taken from sysconfig (bsc#985946)
  - 0.915


author: mchang@suse.com
changelog:
  - merge gh#openSUSE/perl-bootloader#112
  - implemented trusted boot/TPM support in UEFI mode (bsc#1036735,
    fate#315831)
  - 0.918


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#116
  - add --get-option to pbl (bsc#1033776, bsc#1050349)
  - 0.921


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#117
  - work without /etc/default/grub_installdevice (bsc#1079321,
    bsc#994322)
  - removed unused function


author: jreidinger@suse.cz
changelog:
  - merge gh#openSUSE/perl-bootloader#121
  - Fix secureboot on aarch64 (boo#1136601)
  - [RFC] Fix secureboot on aarch64 (boo#1136601)
  - 0.924


author: jreidinger@suse.cz
changelog:
  - merge gh#openSUSE/perl-bootloader#122
  - Replace --suse-signed-grub by --suse-force-signed to follow
    update from boo#1136601
  - 0.925


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#126
  - always install EFI fallback boot for aarch64 (bsc#1167015)
  - 0.927


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#129
  - Check tpm.mod in the new grub2 directory (bsc#1174320)
  - 0.931


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#131
  - grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader
    (bsc#1157550 jsc#SLE-11500).
  - 0.932


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#133
  - use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020)
  - 0.933


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#134
  - install with --removable if efivars are not writable
    (bsc#1182749, bsc#1174111, bsc#1184160)
  - fix whitespace
  - 0.934


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#136
  - report error if config file could not be updated (bsc#1188768)
  - 0.936


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#137
  - grub2 install: Support secure boot on powerpc (bsc#1192764
    jsc#SLE-18271).
  - 0.937


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#138
  - grub2/install: reset error code when passing through recover code
    (bsc#1198197)
  - 0.938


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#142
  - use fw_platform_size to distinguish between 32 bit and 64 bit
    UEFI platforms (bsc#1208003)
  - 0.942


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#147
  - UEFI: update also default location, if it is controlled by SUSE
    (bsc#1210799, bsc#1201399)
  - 0.943


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#152
  - use signed grub EFI binary when updating grub in default EFI
    location (bsc#1210799)
  - check whether grub2-install supports --suse-force-signed option
  - 0.944


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#157
  - bootloader_entry script can have an optional 'force-default'
    argument (bsc#1215064)
  - skip warning about unsupported options when in compat mode
  - 0.945


author: wfeldt@opensuse.org
changelog:
  - merge gh#openSUSE/perl-bootloader#161
  - support old grub versions (<= 2.02) that used /usr/lib
    (bsc#1218842)
  - create EFI boot fallback directory if necessary
  - 0.946


author: jengelh@inai.de
changelog:
  - New package. Split SUSE-specific scripts from module-init-tools,
    so that we can actually get a system with kmod-compat running.


author: crrodriguez@opensuse.org
changelog:
  - The "allow_unsupported_modules" feature, does not belong too
    openSUSE, kmod (and hence udev and systemd) do not understand
    it in anyway. limit to SLE only.


author: mmarek@suse.cz
changelog:
  - The package cannot be noarch, because it installs different
    configs for different architectures.
  - Install 10-unsupported-modules.conf unconditionally, kmod has
    been patched.


author: mmarek@suse.cz
changelog:
  - weak-modules2: Use lsinitrd to list the modules in an initrd, so
    that initrds with early microcode work (bnc#873209, bnc#873113).


author: mmarek@suse.cz
changelog:
  - Only handle KMPs that are built using the %kernel_module_package
    macro (preparatory work for fate#319339).


author: trenn@suse.de
changelog:
  - Use /run instead of deprecated /var/run
    This can have sever consequences if this package uses /var/run. It may
    be installed before filesystem package generating the /run tmpfs and
    predict it to generate the link /var/run -> /run. Later dracut convertfs
    kicks in to generate it, but it has issues. bsc#922676


author: mmarek@suse.cz
changelog:
  - Revert change for fate#319339, as some 3rd party KMPs are built
    with a modified template (bsc#949862).


author: jlee@suse.com
changelog:
  - Add modhash tool to calculate hash of signed module.
    It strips X.509 or PKCS#7 signature before hash kernel module.
    (fate#319460)


author: mwilck@suse.com
changelog:
  - Update to version 12.5:
    * spec file: add conflicts for dracut < 44.2 (bsc#1127891)
    * modprobe.conf.common: add csiostor->cxgb4 dependency
      (bsc#1100989, bsc#1131635)
  - Fix driver-check.sh (boo#1123697, boo#1123704)
  - modsign-verify: support for parsing PKCS#7 signatures
    (bsc#1111300, bsc#1105495)


author: mwilck@suse.com
changelog:
  - Update to version 12.6:
    * weak-modules2: emit "inconsistent" warning only if replacement fails
    (bsc#1127155)


author: mwilck@suse.com
changelog:
  - Update to version 12.7:
    * remove modhash (moved to mokutil package in SLE12-SP5)
    (jsc#SLE-6094)
    * modprobe.tar.bz2: remove bogus backup (*~) file


author: mwilck@suse.com
changelog:
  - Update to version 12.8:
    * modprobe.conf: add dependency of papr_scm on libnvdimm
    (bsc#1142152, ltc#176292, FATE#327775)
    * Load fbcon together with virtio_gpu on s390 (bsc#1132798)


author: mwilck@suse.com
changelog:
  - Update to version 12.11: Import kernel scriptlets from kernel-source
    * rpm-script: fix bad exit status in OpenQA (bsc#1191922)
    * cert-script: Deal with existing $cert.delete file (bsc#1191804).
    * cert-script: Ignore kernel keyring for kernel certificates (bsc#1191480).
    * cert-script: Only print mokutil output in verbose mode.
    * inkmp-script(postun): don't pass  existing files to weak-modules2
      (boo#1191200)
    * kernel-scriptlets: skip cert scriptlet on non-UEFI systems
      (boo#1191260)
    * rpm-script: link config also into /boot (boo#1189879)
    * Import kernel scriptlets from kernel-source.
      (bsc#1189841, bsc#1190598)
    * Provide "suse-kernel-rpm-scriptlets"


author: mwilck@suse.com
changelog:
  - Update to version 12.13: added blacklist entries in modprobe.conf
    * blacklist RNDIS modules (bsc#1205767, jsc#PED-5731, CVE-2023-23559)
    * blacklist cls_tcindex module (bsc#1210335, CVE-2023-1829)
    * blacklist isst_if_mbox_msr (bsc#1187196)


