# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 1.4.0.20-5
changelog:
  - Bump version to 1.4.0.20-5
  - Resolves: Bug 1654566 - dsctl db2ldif: Failing with error AttributeError: DirSrv has no attribute '_instance'


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.0.20-6
changelog:
  - Bump version to 1.4.0.20-6
  - Resolves: Bug 1654101 - dscreate - suffix create root node option
  - Resolves: Bug 1671505 - ns-slapd crashes with k5_mutex_lock: Assertion `r == 0' failed


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.0.20-7
changelog:
  - Bump version to 1.4.0.20-7
  - Resolves: Bug 1671735 - dscreate interactive fails when the suffix contains spaces 
  - Resolves: Bug 1654101 - Fix cherry-pick error in setup.py


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.1.3-1
changelog:
  - Bump version to 1.4.1.3-1
  - Resolves: Bug 1633718 - 389-ds module: Switched Requires from "python3" to "platform-python"
  - Resolves: Bug 1654059 - 389-ds-base: dscreate and dsconf print DM's password in verbose mode
  - Resolves: Bug 1712467 - Rebase 389-ds-base on RHEL 8.1


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.1.3-2
changelog:
  - Bump version to 1.4.1.3-2
  - Resolves: Bug 1544973 - [RFE] IPA replica stuck at last update status: Error (18) Replication error acquiring replica: Incremental update transient error.


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.1.3-3
changelog:
  - Bump verison to 1.4.1.3-3
  - Resolves: Bug 1654056 - /usr/lib/systemd/system/dirsrv@.service:40: .include directives are deprecated
  - Resolves: Bug 1706224 - Protocol setting is inconsistent in FIPS mode
  - Resolves: Bug 1715675 - Fix potential ipv6 issues
  - Resolves: Bug 1717540 - Address covscan warnings


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.1.3-4
changelog:
  - Bump verison to 1.4.1.3-4
  - Resolves: Bug 1712467 - Fix schema OID issue that came over from rebase


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.1.3-5
changelog:
  - Bump verison to 1.4.1.3-5
  - Resolves: Bug 1720331 - Log the actual base DN when the search fails with "invalid attribute request"
  - Resolves: Bug 1725815 - consistency in the replication error codes while setting nsds5replicaid=65535
  - Resolves: Bug 1592228 - CVE-2018-10871 389-ds-base: replication and the Retro Changelog plugin store plaintext password by default
  - Resolves: Bug 1699043 - CVE-2019-3883 389-ds-base: DoS via hanging secured connections 
  - Resolves: Bug 1444876 - Add new keyword to access logging when buffer capacity is exceeded


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.1.3-7
changelog:
  - Bump version to 1.4.1.3-7
  - Resolves: Bug 1748201 - EMBARGOED CVE-2019-14824 389-ds:1.4/389-ds-base: 389-ds and IDM: allows authenticated unprivileged user to retrieve content of userPassword field for any user


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.2.4-3
changelog:
  - Bump version to 1.4.2.4-3
  - Issue 50712 - Version comparison doesn't work correctly on git builds (relates to #1748994)


author: Mark Reynolkds <mreynolds@redhat.com> - 1.4.2.4-5
changelog:
  - Bump version to 1.4.2.4-5
  - Resolves: Bug 1676699 - dsconf allows to set an empty password for Directory Manager
  - Resolves: Bug 1714688 - dscontainer executable should be placed under /usr/libexec/dirsrv/
  - Resolves: Bug 1773115 - bdb_start - Detected Disorderly Shutdown last time Directory Server was running
  - Resolves: Bug 1790975 - Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10
  - Resolves: Bug 1790979 - ns-slapd is crashing while restarting ipactl
  - Resolves: Bug 1790981 - Entry cache contention during base search
  - Resolves: Bug 1790984 - Crash on startup: Bus error in __env_faultmem.isra.1.part.2


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.2.4-6
changelog:
  - Resolves: Bug 1776227 - Error: 'PwPolicyManager' object has no attribute 'get_attr_list'
  - Resolves: Bug 1790975 - Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10(fix regression)
  - Resolves: Bug 1758473 - AddressSanitizer: heap-use-after-free in log_get_loglist
  - Resolves: Bug 1790259 - Change the default behavior of 'nsslapd-verify-filter-schema'
  - Resolves: Bug 1773114 - ns-slapd hangs during CleanAllRUV tests


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.2.4-7
changelog:
  - Bump version to 1.4.2.4-7
  - Resolves: Bug 1744662 - DB Deadlock on modrdn appears to corrupt database and entry cache
  - Resolves: Bug 1779216 - dsctl doesn't work with 'slapd-' in the instance name
  - Resolves: Bug 1790984 - Crash on startup: Bus error in __env_faultmem.isra.1.part.2
  - Resolves: Bug 1793060 - dsctl healthcheck issues error : type object 'datetime.date' has no attribute 'fromisoformat'
  - Resolves: Bug 1758494 - LeakSanitizer: detected memory leaks in do_add 
  - Resolves: Bug 1790975 - Several memory leaks reported by Valgrind for 389-ds 1.3.9.1-10.


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.2.4-8
changelog:
  - Bump version to 1.4.2.4-8
  - Resolves: Bug 1807971 - dsctl healthcheck fails at checking replica when conflict entries are present


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.2.4-9
changelog:
  - Bump version to 1.4.2.4-9
  - Resolves: Bug 1867097 - Memory leak in ACI using IP subject
  - Resolves: Bug 1862170 - python3-lib389 pulls unnecessary bash-completion package
  - Resolves: Bug 1867988 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.16-4
changelog:
  - Bump version to 1.4.3.16-4
  - Resolves: Bug 1843517 - Using ldifgen with --start-idx option fails with unsupported operand
  - Resolves: Bug 1801086 - [RFE] Generate dsrc file using dsconf
  - Resolves: Bug 1843838 - heap-use-after-free in slapi_be_getsuffix


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.16-5
changelog:
  - Bump version to 1.4.3.16-5
  - Resolves: Bug 1879386 - cli dsconf replication monitor fails to retrieve database RUV
  - Resolves: Bug 1887449 - Sync repl: missing update because operation are erroneously stated as nested
  - Resolves: Bug 1887415 - Sync repl - if a series of updates target the same entry then the cookie get wrong changenumber
  - Resolves: Bug 1851978 - SyncRepl plugin provides a wrong cookie


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.16-6
changelog:
  - Bump version to 1.4.3.16-6
  - Resolves: Bug 1879386 - cli dsconf replication monitor fails to retrieve database RUV - consumer (Unavailable) State (green) Reason (error (0)
  - Resolves: Bug 1904991 - Unexpected info returned to ldap request
  - Resolves: Bug 1843838 - heap-use-after-free in slapi_be_getsuffix
  - Resolves: Bug 1903133 - Server-Cert.crt created using dscreate has Subject:CN =localhost instead of hostname.


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.16-7
changelog:
  - Bump version to 1.4.3.16-7
  - Resolves: Bug 1890118 - SIGFPE crash in rhds disk monitoring routine
  - Resolves: Bug 1904991 - 389-ds:1.4/389-ds-base: information disclosure during the binding of a DN
  - Resolves: Bug 1627645 - ldif2db does not change exit code when there are skipped entries


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.16-8
changelog:
  - Bump version to 1.4.3.16-8
  - Resolves: Bug 1903539 - cn=monitor is throwing err=32 with scope: -s one
  - Resolves: Bug 1893870 - PR_WaitCondVar() issue causes replication delay when clock jumps backwards


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.16-9
changelog:
  - Bump version to 1.4.3.16-9
  - Resolves: Bug 1924130 - RHDS11: “write” permission of ACI changes ns-slapd’s behavior on search operation
  - Resolves: Bug 1916677 - A failed re-indexing leaves the database in broken state.
  - Resolves: Bug 1912822 - sync_repl: when completing an operation in the pending list, it can select the wrong operation


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.16-10
changelog:
  - Bump version to 1.4.3.16-10
  - Resolves: Bug 1924130 - RHDS11: “write” permission of ACI changes ns-slapd’s behavior on search operation(part 2)


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.16-11
changelog:
  - Bump version to 1.4.3.16-11
  - Resolves: Bug 1924130 - RHDS11: “write” permission of ACI changes ns-slapd’s behavior on search operation(remove patch as it breaks DogTag, will add this patch back after DogTag is fixed)


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.16-12
changelog:
  - Bump version to 1.4.3.16-12
  - Resolves: Bug 1929067 - PKI instance creation failed with new 389-ds-base build


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.16-13
changelog:
  - Bump version to 1.4.3.16-13
  - Resolves: Bug 1930188 - crash in sync_repl when a MODRDN create a cenotaph


author: Thierry Bordaz <tbordaz@redhat.com> - 1.4.3.16-14
changelog:
  - Bump version to 1.4.3.16-14
  - Resolves: Bug 1968588 - ACIs are being evaluated against the Replication Manager account in a replication context
  - Resolves: Bug 1960720 - sync_repl NULL pointer dereference in sync_create_state_control()


author: Thierry Bordaz <tbordaz@redhat.com> - 1.4.3.16-15
changelog:
  - Bump version to 1.4.3.16-15
  - Resolves: Bug 1970791 - A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind rule


author: Thierry Bordaz <tbordaz@redhat.com> - 1.4.3.16-16
changelog:
  - Bump version to 1.4.3.16-16
  - Resolves: Bug 1972738 - Changelog cache can upload updates from a wrong starting point (CSN)
  - Resolves: Bug 1972721 - Large updates can reset the CLcache to the beginning of the changelog


author: Thierry Bordaz <tbordaz@redhat.com> - 1.4.3.16-17
changelog:
  - Bump version to 1.4.3.16-17
  - Resolve: Bug 1983095 - Internal unindexed searches in syncrepl
  - Resolve: Bug 1980063 - IPA installation fails on s390x with 389-ds-base-1.4.3.8-4.module+el8.3.0+7193+dfd1e8ad.s390x


author: Thierry Bordaz <tbordaz@redhat.com> - 1.4.3.16-18
changelog:
  - Bump version to 1.4.3.16-18
  - Resolve: Bug 1983121 - CRYPT password hash with asterisk allows any bind attempt to succeed


author: Thierry Bordaz <tbordaz@redhat.com> - 1.4.3.16-19
changelog:
  - Bump version to 1.4.3.16-19
  - Resolve: Bug 1984091 - persistent search returns entries even when an error is returned by content-sync-plugin


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.4-1
changelog:
  - Bump version to 1.4.3.4
  - Issue 50954 - Port buildnum.pl to python(part 2)
  - Issue 50955 - Fix memory leaks in chaining plugin
  - Issue 50954 - Port buildnum.pl to python
  - Issue 50947 - change 00core.ldif objectClasses for openldap migration
  - Issue 50755 - setting nsslapd-db-home-directory is overriding db_directory
  - Issue 50937 - Update CLI for new backend split configuration
  - Issue 50860 - Port Password Policy test cases from TET to python3 pwp.sh
  - Issue 50945 - givenname alias of gn from openldap
  - Issue 50935 - systemd override in lib389 for dscontainer
  - Issue 50499 - Fix npm audit issues
  - Issue 49761 - Fix CI test suite issues
  - Issue 50618 - clean compiler warning and log level
  - Issue 50889 - fix compiler issues
  - Issue 50884 - Health check tool DSEldif check fails
  - Issue 50926 - Remove dual spinner and other UI fixes
  - Issue 50928 - Unable to create a suffix with countryName
  - Issue 50758 - Only Recommend bash-completion, not Require
  - Issue 50923 - Fix a test regression
  - Issue 50904 - Connect All React Components And Refactor the Main Navigation Tab Code
  - Issue 50920 - cl-dump exit code is 0 even if command fails with invalid arguments
  - Issue 50923 - Add test - dsctl fails to remove instances with dashes in the name
  - Issue 50919 - Backend delete fails using dsconf
  - Issue 50872 - dsconf can't create GSSAPI replication agreements
  - Issue 50912 - RFE - add password policy attribute pwdReset
  - Issue 50914 - No error returned when adding an entry matching filters for a non existing automember group
  - Issue 50889 - Extract pem files into a private namespace
  - Issue 50909 - nsDS5ReplicaId cant be set to the old value it had before
  - Issue 50686 - Port fractional replication test cases from TET to python3 final
  - Issue 49845 - Remove pkgconfig check for libasan
  - Issue:50860 - Port Password Policy test cases from TET to python3 bug624080
  - Issue:50860 - Port Password Policy test cases from TET to python3 series of bugs
  - Issue 50786 - connection table freelist
  - Issue 50618 - support cgroupv2
  - Issue 50900 - Fix cargo offline build
  - Issue 50898 - ldclt core dumped when run with -e genldif option


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.5-1
changelog:
  - Bump version to 1.4.3.5
  - Issue 50994 - Fix latest UI bugs found by QE
  - Issue 50933 - rfc2307compat.ldif
  - Issue 50337 - Replace exec() with setattr()
  - Issue 50984 - Memory leaks in disk monitoring
  - Issue 50984 - Memory leaks in disk monitoring
  - Issue 49731 - dscreate fails in silent mode because of db_home_dir
  - Issue 50975 - Revise UI branding with new minimized build
  - Issue 49437 - Fix memory leak with indirect COS
  - Issue 49731 - Do not add db_home_dir to template-dse.ldif
  - Issue 49731 - set and use db_home_directory by default
  - Issue 50971 - fix BSD_SOURCE
  - Issue 50744 - -n option of dbverify does not work
  - Issue 50952 - SSCA lacks basicConstraint:CA
  - Issue 50976 - Clean up Web UI source directory from unused files
  - Issue 50955 - Fix memory leaks in chaining plugin(part 2)
  - Issue 50966 - UI - Database indexes not using typeAhead correctly
  - Issue 50974 - UI - wrong title in "Delete Suffix" popup
  - Issue 50972 - Fix cockpit plugin build
  - Issue 49761 - Fix CI test suite issues
  - Issue 50971 - Support building on FreeBSD.
  - Issue 50960 - [RFE] Advance options in RHDS Disk Monitoring Framework
  - Issue 50800 - wildcards in rootdn-allow-ip attribute are not accepted
  - Issue 50963 - We should bundle *.min.js files of Console
  - Issue 50860 - Port Password Policy test cases from TET to python3 Password grace limit section.
  - Issue 50860 - Port Password Policy test cases from TET to python3 series of bugs Port final
  - Issue 50954 - buildnum.py - fix date formatting issue


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.6-1
changelog:
  - Bump version to 1.4.3.6
  - Issue 50933 - 10rfc2307compat.ldif is not ready to set used by default
  - Issue 50931 - RFE AD filter rewriter for ObjectCategory
  - Issue 51016 - Fix memory leaks in changelog5_init and perfctrs_init
  - Issue 50980 - RFE extend usability for slapi_compute_add_search_rewriter and slapi_compute_add_evaluator
  - Issue 51008 - dbhome in containers
  - Issue 50875 - Refactor passwordUserAttributes's and passwordBadWords's code
  - Issue 51014 - slapi_pal.c possible static buffer overflow
  - Issue 50545 - remove dbmon "incr" option from arg parser
  - Issue 50545 - Port dbmon.sh to dsconf
  - Issue 51005 - AttributeUniqueness plugin's DN parameter should not have a default value
  - Issue 49731 - Fix additional issues with setting db home directory by default
  - Issue 50337 - Replace exec() with setattr()
  - Issue 50905 - intermittent SSL hang with rhds
  - Issue 50952 - SSCA lacks basicConstraint:CA
  - Issue 50640 - Database links: get_monitor() takes 1 positional argument but 2 were given
  - Issue 50869 - Setting nsslapd-allowed-sasl-mechanisms truncates the value


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.7-1
changelog:
  - Bump version to 1.4.3.7
  - Issue 51024 - syncrepl_entry callback does not contain attributes added by postoperation plugins
  - Issue 51035 - Heavy StartTLS connection load can randomly fail with err=1
  - Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  - Issue 51031 - UI - transition between two instances needs improvement


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.8-0
changelog:
  - Bump version to 1.4.3.8-0
  - Issue 51078 - Add nsslapd-enable-upgrade-hash to the schema
  - Issue 51054 - Revise ACI target syntax checking
  - Issue 51068 - deadlock when updating the schema
  - Issue 51060 - unable to set sslVersionMin to TLS1.0
  - Issue 51064 - Unable to install server where IPv6 is disabled
  - Issue 51051 - CLI fix consistency issues with confirmations
  - Issue 49731 - undo db_home_dir under /dev/shm/dirsrv for now
  - Issue 51054 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  - Issue 51047 - React deprecating ComponentWillMount
  - Issue 50499 - fix npm audit issues
  - Issue 50545 - Port dbgen.pl to dsctl


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.8-1
changelog:
  - Bump version to 1.4.3.8-1
  - Resolves: Bug 1833350 - Rebase 389-ds-base for RHEL 8.3
  - Resolves: Bug 1728943 - [RFE] Advance options in RHDS Disk Monitoring Framework
  - Resolves: Bug 1775285 - [RFE] Implement the Password Policy attribute "pwdReset"
  - Resolves: Bug 1638875 - [RFE] extract key/certs pem file into a private namespace
  - Resolves: Bug 1758478 - AddressSanitizer: heap-buffer-overflow in ldap_utf8prev
  - Resolves: Bug 1795943 - Port dbmon.sh from legacy tools package
  - Resolves: Bug 1798394 - Port dbgen from legacy tools package
  - Resolves: Bug 1800529 - Memory leaks in disk monitoring
  - Resolves: Bug 1807419 - Unable to create a suffix with countryName either via dscreate or the admin console
  - Resolves: Bug 1816848 - Database links: get_monitor() takes 1 positional argument but 2 were given
  - Resolves: Bug 1816854 - Setting nsslapd-allowed-sasl-mechanisms truncates the value
  - Resolves: Bug 1816857 - Searches on cn=config takes values with spaces and makes multiple attributes out of them
  - Resolves: Bug 1816859 - lib389 - Replace exec() with setattr()
  - Resolves: Bug 1816862 - Memory leak in indirect COS
  - Resolves: Bug 1829071 - Installation of RHDS 11 fails on RHEL8 server with IPv6 disabled
  - Resolves: Bug 1833515 - set 'nsslapd-enable-upgrade-hash: off' as this raises warnings in IPA
  - Resolves: Bug 1790986 - cenotaph errors on modrdn operations
  - Resolves: Bug 1769734 - Heavy StartTLS connection load can randomly fail with err=1
  - Resolves: Bug 1758501 - LeakSanitizer: detected memory leaks in changelog5_init and perfctrs_init


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.8-2
changelog:
  - Bump version to 1.4.3.8-2
  - Resolves: Bug 1833350 - Remove cockpit dependancies that are breaking builds


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.8-3
changelog:
  - Bump version to 1.4.3.8-3
  - Resolves: Bug 1835619 - Healthcheck with --json option reports "Object of type 'bytes' is not JSON serializable" when mapping tree is deleted 
  - Resolves: Bug 1836428 - Directory Server ds-replcheck RFE to add a timeout command-line arg/value to wait longer when connecting to a replica server
  - Resolves: Bug 1843090 - abort when a empty valueset is freed
  - Resolves: Bug 1843156 - Prevent unnecessarily duplication of the target entry
  - Resolves: Bug 1843157 - Check for clock errors and time skew
  - Resolves: Bug 1843159 - RFE AD filter rewriter for ObjectCategory
  - Resolves: Bug 1843162 - Creating Replication Manager fails if uid=repman is used
  - Resolves: Bug 1816851 - Add option to healthcheck to list all the lint reports
  - Resolves: Bug 1748227 - Instance name length is not enforced
  - Resolves: Bug 1748244 - dscreate doesn't sanitize instance name


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.8-4
changelog:
  - Bump version to 1.4.3.8-4
  - Resolves: Bug 1806978 - ns-slapd crashes during db2ldif
  - Resolves: Bug 1450863 - Log warning when tuning of nsslapd-threadnumber above or below the optimal value
  - Resolves: Bug 1647017 - A distinguished value of a single valued attribute can be missing in an entry
  - Resolves: Bug 1806573 - Dsctl healthcheck doesn't work when using instance name with 'slapd-'
  - Resolves: Bug 1807773 - dsctl healthcheck : typo in DSREPLLE0002 Lint error suggested resolution commands
  - Resolves: Bug 1843567 - Healthcheck to find notes=F
  - Resolves: Bug 1845094 - User/Directory Manager can modify Password Policy attribute "pwdReset"
  - Resolves: Bug 1850275 - Add new access log keywords for time spent in work queue and actual operation time
  - Resolves: Bug 1442386 - Recreating an index while changing case will create an indexfile with the old name (different case) and after restart the indexfile is abandoned
  - Resolves: Bug 1672574 - nsIndexIDListScanLimit accepts any value
  - Resolves: Bug 1800529 - Memory leaks in disk monitoring


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.8-5
changelog:
  - Bump version to 1.4.3.8-5
  - Resolves: Bug 1841086 - SSL alert: The value of sslVersionMax "TLS1.3" is higher than the supported version
  - Resolves: Bug 1800529 - Memory leaks in disk monitoring
  - Resolves: Bug 1748227 - Instance name length is not enforced
  - Resolves: Bug 1849418 - python3-lib389 pulls unnecessary bash-completion package


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.8-6
changelog:
  - Bump version to 1.4.3.8-6
  - Resolves: Bug 1851973 - Duplicate entryUSN numbers for different LDAP entries in the same backend
  - Resolves: Bug 1888863 - group rdn with leading space char and add fails error 21 invalid syntax and delete fails error 32
  - Resolves: Bug 1859228 - do not add referrals for masters with different data generation
  - Resolves: Bug 1859227 - create keep alive entry after on line init
  - Resolves: Bug 1896850 - NULL dereference in revert_cache()
  - Resolves: Bug 1861504 - ds-replcheck crashes in offline mode
  - Resolves: Bug 1898850 - Entries conflict not resolved by replication


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.8-6
changelog:
  - Bump version to 1.4.3.8-6
  - Resolves: Bug 1904348 - Duplicate entryUSN numbers for different LDAP entries in the same backend
  - Resolves: Bug 1904349 - group rdn with leading space char and add fails error 21 invalid syntax and delete fails error 32
  - Resolves: Bug 1904350 - do not add referrals for masters with different data generation
  - Resolves: Bug 1904351 - create keep alive entry after on line init
  - Resolves: Bug 1904352 - NULL dereference in revert_cache()
  - Resolves: Bug 1904353 - ds-replcheck crashes in offline mode
  - Resolves: Bug 1904347 - Entries conflict not resolved by replication


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.8-7
changelog:
  - Bump version to 1.4.3.8-7
  - Resolves: Bug 1908705 - CVE-2020-35518 389-ds:1.4/389-ds-base: information disclosure during the binding of a DN
  - Resolves: Bug 1936461 - A failed re-indexing leaves the database in broken state.
  - Resolves: Bug 1912481 - Server-Cert.crt created using dscreate has Subject:CN =localhost instead of hostname.


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.1.3-8
changelog:
  - Add %_isa to -devel base package dependency.
  - Headers get installed by "make install", copying them from the HTML
    doc headers dir is not necessary.
  - Configure build with --disable-static.
  - Drop unneeded spec stuff (buildroot def, removal, clean, pkgconfig dep).
  - Using %defattr is not needed anymore.
  - Deduplicate documentation files in unversioned docdir (#1001276).


author: Michael Schwendt <mschwendt@fedoraproject.org> - 2.1.3-9
changelog:
  - Fix HTML documentation installation location.
  - Replace CUnit-2.1-3-src.tar.bz2 tarball, which really
    is 2.1-2 in disguise according to configure.in, with 2.1-3 as
    published on 2014-04-24.
  - BR libtool
  - Run autoreconf instead of autoconf.
  - Drop --enable-curses because without BuildRequires ncurses-devel it
    would disable itself automatically (and if it were enabled, test programs
    would need to link with ncurses explicitly).


author: Charalampos Stratakis <cstratak@redhat.com> - 0.28.1-6
changelog:
  - Replace GCC's attribute optimize("Os") by the better supported and similar (cold).
  - Resolves: rhbz#1658621


author: Ville Skyttä <ville.skytta@iki.fi> - 3.2.6-15
changelog:
  - Fix source URL and switch to xz tarball (the only one available)
  - Do not own %{_localstatedir}/lib/rpm-state (#907618)
  - Ship gsettings-schema-convert manpage only in -devel (#893767)
  - Install COPYING as %license where available
  - Fix bogus dates in %changelog


author: Paul Howarth <paul@city-fan.org> - 1.0.5-17
changelog:
  - ldconfig scriptlets replaced by RPM File Triggers from Fedora 28
  - Drop legacy BuildRoot: and Group: tags
  - Drop redundant explicit buildroot cleaning
  - Specify all explicitly-used build requirements
  - Use %license where possible
  - Drop %defattr, redundant since rpm 4.4


author: Debarshi Ray <rishi@fedoraproject.org> - 0.19.0-1
changelog:
  - 0.19.0
  - Fix License
  - Explicitly enable JPEG and OpenMP support to avoid surprises
  - Tighten %files, mostly so api/soname changes will no longer be a surpise
  - Use %make_build %ldconfig_scriptlets
  Resolves: #1633708


author: Lubomir Rintel <lkundrak@v3.sk> - 1.6.12-1
changelog:
  - Update to 1.6.12 release
  - Require libmbim and libqmi we were built with (rh #1534945)
  - Restore the scriptlets where they are needed


author: Lubomir Rintel <lkundrak@v3.sk> - 1.10.2-1
changelog:
  - Update to 1.10.2 release (rh #1543498)
  - Don't grab cdc_ether devices on Sierra QMI modems (rh #1712031)


author: Thomas Haller <thaller@redhat.com> - 1:1.14.0-6
changelog:
  - dhcp: fix out-of-bounds heap write for DHCPv6 with internal plugin (CVE-2018-15688)
  - dhcp: revert letting internal DHCP generate default client-id based on MAC address (rh #1640464)
  - dhcp: support "duid" setting for ipv4.dhcp-client-id
  - dhcp: support "${MAC}" identifier for connection.stable-id
  - dhcp: support dhcp-plugin device spec for matching devices in NetworkManager.conf
  - dhcp: install configuration snippet in config-server package for ipv4.dhcp-client-id=mac (rh #1640494)
  - dns: remove limitation for six DNS search entries (rh #1649704)
  - libnm: fix crash cancelling activation from within callback (rh #1643085)


author: Thomas Haller <thaller@redhat.com> - 1:1.14.0-9
changelog:
  - dhcp: fix default client-id for NetworkManager-config-server (rh #1658057)
  - connectivity: fix crash and portal detection (rh #1658217)
  - core: combine secret-key with machine-id for host identity (rh #1642023)
  - SR-IOV related fixes (rh #1651578, rh #1651576, rh #1651979)
  - core: fix updating agent-owned secrets (rh #1658771)
  - core: no longer set rp_filter sysctl (rh #1651097)
  - device: don't take device down when changing MAC address (rh #1659063)
  - doc: use pregenerated manual pages and gtk-doc from source tarball


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.14.0-10
changelog:
  - ifcfg-rh: fix reading SR-IOV settings
  - dhcp: support client-id and DUID for infiniband (rh #1658057)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.14.0-11
changelog:
  - device: ensure IP configuration is restored when link goes up (rh #1636715)
  - dhcp: fix client-id and DUID for infiniband (rh #1658057)
  - dhcp: change internal DHCP plugin's ipv4.dhcp-client-id setting to "mac" (rh #1661165)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.20.0-0.1
changelog:
  - Update to a 1.20 snapshot
  - core: fix a possible crash on device removal (rh #1659790)
  - core: fix automatic activation of software deviecs (rh #1667874)
  - team: use strict JSON parsing for configuration (rh #1691619)
  - team: don't kill teamd for external devices (rh #1693142)
  - logging: don't misuse SYSLOG_FACILITY field in journal (rh #1709741)


author: Lubomir Rintel <lrintel@redhat.com> - 1:1.20.0-0.2
changelog:
  - Update to a newer 1.20 snapshot
  - ovs: support dpdk interfaces (rh #1612503)
  - libnm-core: change unsupported modes for arp_ip_targets bond option (rh #1718173)
  - ipv6: add 'disabled' method (rh #1643841)
  - device: fix matching parent device by connection UUID (rh #1716438)
  - cli: fix default value for team.runner-min-ports (rh #1716987)
  - initrd: re-enable the generator (rh #1626348)


author: Thomas Haller <thaller@redhat.com> - 1:1.20.0-0.4
changelog:
  - Update to 1.20-rc1 snapshot
  - settings: support read-only directory for keyfile profiles (rh #1674545)
  - settings: add AddConnection2 D-Bus API to suppress autoconnect (rh #1677068)
  - settings: add no-reapply flat to Update2 D-Bus API (rh #1677070)
  - openvswitch: don't release slaves on quit (rh #1733709)
  - dhcp: expose private options for internal DHCP plugin (rh #1663253)
  - device: fix route table setting when re-activating device (rh #1719318)
  - man: clarify example in nm-openvswitch manual page (rh #1638038)
  - man: various improvements of manual pages (rh #1612554)


author: Thomas Haller <thaller@redhat.com> - 1:1.20.0-1
changelog:
  - Update to 1.20.0 release
  - fix license comments for RPM package (rh #1723395)
  - dhcp: disable experimental nettools DHCP plugin


author: Thomas Haller <thaller@redhat.com> - 1:1.20.0-3
changelog:
  - wifi: detect FT support per device to fix issues with driver support (rh #1743730)
  - doc: fix default values in pre-generated documentation (rh #1737945)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.20.0-5
changelog:
  - ipv6: disable kernel handling of RAs (accept_ra) (rh #1734470)
  - device: fix setting MTU lower than 1280 when IPv6 is disabled (rh #1753128)


author: Thomas Haller <thaller@redhat.com> - 1:1.22.0-0.2
changelog:
  - Update to 1.22-rc1 (1.21.90)
  - large internal rework of libnm's NMClient
  - dhcp: switch implementation of "internal" DHCP to nettools' n-dhcp4
  - add support for carrier state of devices on D-Bus/libnm (rh #1722024)
  - cloud-setup: add initial and experimental tool for configuring in cloud (rh #1642461)
  - dhcp: support configuring FQDN hostname flags (rh #1649368)


author: Thomas Haller <thaller@redhat.com> - 1:1.22.2-1
changelog:
  - Update to 1.22.2
  - core,libnm: expose capability for OVS support (rh #1785147)
  - dhcp: various bugfixes for nettools n-dhcp4 plugin


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.22.4-1
changelog:
  - Update to 1.22.4
  - dhcp: fix behavior of internal DHCP client when the server sends a NAK (rh #1787219)


author: Antonio Cardace <acardace@redhat.com> - 1:1.22.6-1
changelog:
  - Update to 1.22.6
  - nm-device: add new pending action to keep the device busy when in between states (rh #1759956)
  - cloud-setup: avoid unsupported settings in systemd service unit (rh #1791758)
  - do not create virtual device if master is not present (rh #1795919)
  - allow IPv6 RA timeout to be set to a value higher than 120 seconds (rh #1795957)
  - fix behaviour when 'ipv4.dhcp-timeout' option is set to 'infinity' (rh #1791378)


author: Antonio Cardace <acardace@redhat.com> - 1:1.22.8-1
changelog:
  - Update to 1.22.8
  - Added configuration option to customize IPv6 RA timeout (rh #1801158)
  - Removed length limitation for OVS Bridge, Patches and Interfaces (only Patch types) names (rh #1788432)
  - Reworked asynchronous deactivation of OVS interfaces (rh #1787989, rh #1782701)
  - Fixed failure when creating team interfaces (rh #1798947)
  - ifcfg-rh: fix clearing ovs slave type from ifcfg-rh file (rh #1804167)
  - Fixed bug causing virtual devices to not be available after AddConnection()/Update() (rh #1804350)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.22.8-3
changelog:
  - dhcp: keep trying after a send failure (rh #1806516)
  - ovs: fail port enslavement when the bridge is not found (rh #1797696)


author: Thomas Haller <thaller@redhat.com> - 1:1.22.8-4
changelog:
  - core: fix leaking device state files in /run (rh #1810153)
  - dhcp: fix crash in nettools client when leaking GSource (rh #1810188)


author: Thomas Haller <thaller@redhat.com> - 1:1.22.8-5
changelog:
  - dhcp: fix handling IO error in nettools DHCPv4 client (rh #1843357)
  - ifcfg-rh: handle "802-1x.{,phase2-}ca-path" (rh #1843360, CVE-2020-10754)


author: Thomas Haller <thaller@redhat.com> - 1:1.26.0-3
changelog:
  - core: fix managing devices after resuming from sleep (rh #1855563)
  - dhcp: fix BPF filter for internal client on big endian arch (rh #1861488)
  - core: support warning log setting IPv6 MTU with IPv6 disabled (rh #1840989)
  - wifi: fix crash parsing incomplete BSS info (rh #1866395)


author: Antonio Cardace <acardace@redhat.com> - 1:1.26.0-4
changelog:
  - bond: fix Reapply does not update bond options (rh #1847814)
  - dhcp: support DHCPv6 fqdn_fqdn option for hostname (rh #1858344)


author: Antonio Cardace <acardace@redhat.com> - 1:1.26.0-7
changelog:
  - dhcp: add dhcp-vendor-class-identifier option (rh #1871042)
  - initrd: parse 'rd.net.dhcp.vendor-class' kernel cmdline arg (rh #1872299)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.26.0-8
changelog:
  - initrd: accept mac address as interface specifier (rh #1879795)
  - initrd: fix parsing IPv6 prefix length (rh #1879795)


author: Antonio Cardace <acardace@redhat.com> - 1:1.26.0-11
changelog:
  - initrd: disable ipv4 and ipv6 by default for vlan parent connection (rh #1903698)
  - initrd: fix parsing of ip= argument with dotted interface name (rh #1903695)
  - initrd: fix parsing with empty token (rh #1902791)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.26.0-0.2
changelog:
  - update to 1.26-rc2 (1.25.91)
  - initrd: set ipv6.method=auto when using IPv4 static configuration (rh #1848943)
  - cloud-setup: add support for Google Cloud load-balancing routes (rh #1821787)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.26.0-0.2.1
changelog:
  - device: restart DHCP only for devices that are active or activating (rh #1852612)
  - initrd: fix generating default BOOTIF= connection (rh #1853277)
  - ovs: fix race condition when setting MAC address for ovs interfaces (rh #1852106)


author: Thomas Haller <thaller@redhat.com> - 1:1.26.0-1
changelog:
  - update to 1.26.0
  - device: reset SR-IOV parameters on activation failure (rh #1819587)
  - initrd: enable ipv6.method=auto with ip=dhcp6 (rh #1854323)
  - core: add "nm-shared" zone for firewalld for shared mode (rh #1834907)
  - ppp: fix taking control of link (rh #1849386)


author: Antonio Cardace <acardace@redhat.com> - 1:1.26.0-2
changelog:
  - core: fix generation of local routes for VRF devices (rh #1857133)
  - team: fix crash on failure to connect to teamd (rh #1856723)
  - core: fix detecting failure of master active-connection (rh #1845018)
  - core: fix warning about setting active_slave of bond when activating master (rh #1858326)
  - import translations (rh #1820552)


author: Thomas Haller <thaller@redhat.com> - 1:1.30.0-3
changelog:
  - Increase LimitNOFILE to allow more than 1024 file descriptors (rh #1926599).
    This requires a suitable libndp version that can handle many file descriptors (rh #1933041).


author: Thomas Haller <thaller@redhat.com> - 1:1.30.0-6
changelog:
  - core: fix handling local routes generated by kernel (rh #1907661)
  - initrd: fix crash with rd.znet= argument (rh #1941106)
  - core: fix crash handling path match (rh #1942741)


author: Wen Liang <wenliang@redhat.com> - 1:1.30.0-8
changelog:
  - core: fix finding active connection for controller (rh #1965337)
  - bond: support 'tlb_dynamic_lb' in 'balance-alb' mode (rh #1965948)
  - manager: delete default connection when veth removed (rh #1965336)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.30.0-0.8
changelog:
  - Update to 1.29.10 (development)
  - bond: introduce new 'vlan+srcmac' xmit_hash_policy option (rh #1915457)
  - ovs: clean up interfaces from ovsdb at startup (rh #1861296)


author: Antonio Cardace <acardace@redhat.com> - 1:1.30.0-0.9
changelog:
  - Update to 1.29.11 (development)
  - bond: fix changing mode when the device is created externally (rh #1870691)
  - ovs: fix firewalld configuration for ovs-ports (rh #1921107)
  - ovs: avoid race condition when system interface is removed from ovsdb (rh #1923248)
  - doc: mention NETMASK as alternative to PREFIX for addresses in `man nm-settings-ifcfg-rh` (rh #1925123)


author: Thomas Haller <thaller@redhat.com> - 1:1.30.0-0.10
changelog:
  - Update to 1.30-rc1 (1.29.90-dev) (development)
  - cloud-setup: fix removing IPv4 address (rh #1920838)


author: Francesco Giudici <fgiudici@redhat.com> - 1.2.8-0.1
changelog:
  - Update to latest development snapshot of NetworkManager-libreswan 1.2.8
  - Introduced IKEv2 support (rh #1557035)
  - Introduced support to more Libreswan properties (rh #1557035)
  - Updated translations


author: Josef Ridky <jridky@redhat.com> - 2.0.25-1
changelog:
  - New upstream release 2.0.25 (#1568194)
  - Replace Python2 with Python3
  - Drop OpenIPMI-python2 and set it as Obsolete
  - Introduce new OpenIPMI-python3 package
  - use ldconfig macros
  - remove old systemd dependencies
  - use autosetup


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.12-6
changelog:
  - Python 2 binary package renamed to python2-pyyaml
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Iryna Shcherbina <ishcherb@redhat.com> - 3.12-9
changelog:
  - Fix ambiguous Python 2 dependency declarations
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Miro Hrončok <mhroncok@redhat.com> - 3.12-12
changelog:
  - Rename python3-PyYAML to python3-pyyaml
  - Modernize spec
  - Fix python2 invocation

  - Cherry-picked from: https://src.fedoraproject.org/rpms/PyYAML/pull-request/2


author: Wim Taymans <wtaymans@redhat.com> - 1.2.15-38
changelog:
  - fix CVEs
  - Resolves: rhbz#1716209, rhbz#1716210, rhbz#1716211, rhbz#1716212,
              rhbz#1716213, rhbz#1716214, rhbz#1716215, rhbz#1716216,
  	    rhbz#1716217, rhbz#1716218, rhbz#1716219


author: Wim Taymans <wtaymans@redhat.com> - 2.0.10-2
changelog:
  - Fix CVE-2019-13616 SDL: heap-based buffer overflow in SDL blit
    functions in video/SDL_blit*.c
  - Resolves: rhbz#1756279


author: Mukundan Ragavan <nonamedotc@fedoraproject.org> - 5.1.1-1
changelog:
  - Update to 5.1.1
  - Remove format security patch - not needed anymore
  - Edit patches to be version specific
  - Renamed patch4 to be consistent with others
  - Minor spec file housekeeping


author: Nicolas Chauvet <kwizart@gmail.com> - 0.7.4-24
changelog:
  - Multilibs support - rhbz#1433758
  - Simplify description
  - Convert AUTHORS to UTF-8
  - Drop Groups
  - Add Obsoletes/Provides for a52dec-devel


author: Martin Kutlak <mkutlak@redhat.com> - 2.10.9-9
changelog:
  - spec: turn on --enable-native-unwinder aarch64
  - spec: enable addon-vmcore on aarch64
  - daemon: Fix double closed fd race condition
  - dbus: Add configuration for Python3
  - Add autogen.sh
  - Resolves: #1646569, #1651676, #1650619, #1650622, #1652676


author: Martin Kutlak <mkutlak@redhat.com> - 2.10.9-10
changelog:
  - spec: Add-explicit-package-version-requirement-of-abrt-libs
  - cli: get list of possible workflows for problem_data_t
  - cli: mark the suggestion text for translation
  - cli list: show a hint about creating a case in RHTS
  Resolves: #1649753


author: Michal Židek <mzidek@redhat.com> - 2.10.9-13
changelog:
  - Resolves: rhbz#1658685
  - shellcheck: Use command instead of type
  - shellcheck: Check exit code directly with if mycmd
  - shellcheck: Suppress shellcheck warning SC1090
  - shellcheck: Use $(...) instead of legacy backticked
  - cli: Add a shebang


author: - Michal Židek <mzidek@redhat.com> - 2.10.9-18
changelog:
  - Resolves: rhbz#1835388
  - This is seccond commit to fix som mess with one missing patch and synchronize
    the internal gitlab patch numbers with this spec file


author: Ernestas Kulik <ekulik@redhat.com> - 1.1.0-16
changelog:
  - Add patch for #1721393
  - Add patch for https://github.com/abrt/abrt-java-connector/commit/ae2144f1674f163517f0aa18b5f1b4784c143572


author: Kamil Dudka <kdudka@redhat.com> 2.2.52-14
changelog:
  - drop obsolete BuildRoot and Group tags
  - fix spurious acl_check() failure on setfacl --restore (#1451826)


author: Kamil Dudka <kdudka@redhat.com> 2.2.52-15
changelog:
  - setfacl.1: document the meaning of '-' in perms (#1337039)
  - avoid failure of %check when building as root (#1085389)
  - apply patches automatically to ease maintenance


author: Al Stone <ahs3@redhat.com> - 20180209-1
changelog:
  - Update to 20180209 source tree, including patch refeshes. Closes BZ#1544048
  - CVE-2017-13693: operand cache leak in dsutils.c -- applied github patch to
    fix the leak.  Resolves BZ#1485346.
  - CVE-2017-13694: acpi parse and parseext cache leaks in psobjects.c -- applied
    github patch to fix the leaks.  Resolves BZ#1485348.
  - CVE-2017-13695: operand cache leak in nseval.c -- applied github patch to fix
    the leak.  Resolves BZ#1485349.
  - Security fixes for the CVEs above applied.  Closes BZ#1485355.  NOTE: these
    patches fix acpica-tools ONLY; the kernel needs to be patch separately.
  - Added gcc to BuildRequires
  - It turns out the %build section was incorrectly passing in OPT_CFLAGS; it
    made the wrong assumptions about what generate/unix/Makefile.config did with
    that value.  Added to the spec file what should happen so that a full and
    complete set of C flags get passed in, not just the small subset that was.
  - Clean up compiler warnings for truncated strings
  - Clean up compiler warnings for pointer casting on 32-bit architectures


author: Al Stone <ahs3@redhat.com> - 20180508-1
changelog:
  - Update to 20180508 source tree, including patch refeshes. Closes BZ#1544048
  - acpidump/acpixtract no longer have alternatives, so remove the scriptlets
    that maintain them and just install them directly; we do leave the pre-
    and post- scriptlets to remove the alternatives for now.  Closes BZ#1576970
  - Typo: OPT_LDFLAGS, not OPT_LDLAGS in the build section.  Closes BZ#1560542


author: Al Stone <ahs3@redhat.com> - 20180508-2
changelog:
  - %pre and %post scriptlets fail -- stupid thinko where I inadvertently
    tested for alternatives not existing, vs existing


author: Al Stone <ahs3@redhat.com> - 20180629-1
changelog:
  - Update to 20180629 source tree, including patch refeshes. Closes BZ#1584923
  - Includes upstream fix for #1592971 (iasl segfault).


author: Al Stone <ahs3@redhat.com> - 20180629-3
changelog:
  - Add in man page for acpiexamples.  So that the man page makes some sense,
    also copy the source code used for acpiexamples to the doc directory for
    this package.  Closes BZ#1611145.
  - Add in the converterSample.asl file from the misc tests.  Clean up the
    run-misc-tests.sh script, too, to make it more robust by simplifying
    the work done.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.0.28-6
changelog:
  - Switched kacpimon to dynamic connections (increased max connections
    from 20 to 1024)
    Resolves: rhbz#1450980
  - Consolidated new line delimiters


author: Sumit Bose <sbose@redhat.com> - 0.8.2-1
changelog:
  - Update to upstream release 0.8.2
  - various other fixes and improvements from the latest Fedora update


author: Sumit Bose <sbose@redhat.com> - 0.8.2-3
changelog:
  - use autosetup macro to simplify patch handling
  - fixed rpmlint warnings in the spec file
  - join failed if hostname is not FQDN [#1677194]
  - adcli join fails in FIPS enabled environment [#1717355]
  - forward port of RHEL-7.7 fixes and enhancements


author: Sumit Bose <sbose@redhat.com> - 0.8.2-4
changelog:
  - adcli update --add-samba-data does not work as expected [#1745931]
  - Issue is that with arcfour-hmac as first encryption type [#1745932]
  - [RFE] enhancement adcli to set description attribute and to show all AD
    attributes [#1737342]


author: Sumit Bose <sbose@redhat.com> - 0.8.2-6
changelog:
  - [abrt] [faf] adcli: raise(): /usr/sbin/adcli killed by 6 [#1806260]
  - No longer able to delete computer from AD using adcli [#1846882]
  - adcli: presetting $computer in $domain domain failed: Cannot set computer
    password: Authentication error [#1846878]
  - Typo in adcli update --help option [#1791611]
  - Manpage and help does not explain the use of "-C" option [#1791545]


author: Sumit Bose <sbose@redhat.com> - 0.8.2-8
changelog:
  - Add --use-ldaps option to adcli update as well [#1883467]
  - Cannot join a pre-staged Computer Account on AD in Custom OU using Delegated
    user [#1734764]
  - missing documentation for required AD rights for adcli join and net
    join [#1852080]
  - [RFE] Add new mode to just create an AD account to be able to connect to
    LDAP [#1854112]


author: Radovan Sroka <rsroka@redhat.com> - 0.16-6
changelog:
  - ported syslog format from rhel7
    resolves: rhbz#1584136
  - fixed crypto problem with libgcrypt
    resolves: rhbz#1584120


author: Radovan Sroka <rsroka@redhat.com> - 0.16-8
changelog:
  - fixed wrong line wrapping of messages in the syslog format
    resolves: rhbz#1628153
  - fixed coverity issues
    resolves: rhbz#1602441
  - fixed crash when processing .dynamic section
    resolves: rhbz#1597250


author: Radovan Sroka <rsroka@redhat.com> - 0.16-9
changelog:
  - Null pointer dereference fix spotted by coverity
    resolves: rhbz#1676487
  - aide.conf needs updates for RHEL 8
    resolves: rhbz#1708015


author: Attila Lakatos <alakatos@redhat.com> - 0.16-12
changelog:
  - RHEL 8.3
  - minor edit of aide.conf
    resolves: rhbz#1740754
  - do not generate false warnings when report_ignore_e2fsattrs is specified in aide.conf
    resolves: rhbz#1806323


author: Jaroslav Kysela <jkysela@redhat.com> - 1.1.6-3
changelog:
  - Sync with the RHEL 7
  - Add Dell WD15/WD19 Dock to USB-Audio.conf and create UCM configs
  - Resolves: rhbz#1664247


author: Radek Vykydal <rvykydal@redhat.com> - 29.19.1.6-1
changelog:
  - Require blivet with flags.protect_cdrom support (rvykydal)
    Related: rhbz#1671713
  - Be more strict when checking for mounted dvd source. (rvykydal)
    Resolves: rhbz#1671713
  - Protect cdroms during tree population for image installs. (rvykydal)
    Resolves: rhbz#1671713


author: Radek Vykydal <rvykydal@redhat.com> - 29.19.1.7-1
changelog:
  - Add support for disabling modules via module --disable (mkolman)
    Resolves: rhbz#1655523
    Related: rhbz#1719347


author: Radek Vykydal <rvykydal@redhat.com> - 29.19.1.8-1
changelog:
  - Respect changesok password policy for root password (mkolman)
    Resolves: rhbz#1584145
  - Fix default value for pwpolicy emptyok (mkolman)
    Resolves: rhbz#1664704


author: Radek Vykydal <rvykydal@redhat.com> - 29.19.1.9-1
changelog:
  - Adjust the exclude arguments for livepayloads (bcl)
    Related: rhbz#1684542
  - Recreate the BLS entries when using liveimg (bcl)
    Resolves: rhbz#1684542
  - Cache the liveimg tar kernel list (bcl)
    Related: rhbz#1684542
  - Add common function for creating rescue images (bcl)
    Related: rhbz#1684542
  - Re-generate BLS loader file snippets on live installs (awilliam)
    Related: rhbz#1684542


author: Radek Vykydal <rvykydal@redhat.com> - 29.19.1.10-1
changelog:
  - Do not try to mount cdrom source also if it has been mounted in dracut.
    (rvykydal)
    Resolves: rhbz#1733507


author: Radek Vykydal <rvykydal@redhat.com> - 29.19.1.11-1
changelog:
  - Fix noverifyssl when downloading .treeinfo file (jkonecny)
    Resolves: rhbz#1726156
    Resolves: rhbz#1723811


author: Radek Vykydal <rvykydal@redhat.com> - 29.19.1.12-1
changelog:
  - Add the install class for Red Hat Virtualization (vponcova)
    Resolves: rhbz#1753316
  - Extend support for custom storage checking (vponcova)
    Related: rhbz#1753316
  - Enable to define the autopart type in an install class (vponcova)
    Related: rhbz#1753316


author: Radek Vykydal <rvykydal@redhat.com> - 29.19.2.8-1
changelog:
  - Fix output kickstart generation for subscription commands (mkolman)
    Resolves: rhbz#1788579
    Resolves: rhbz#1788513
  - Fix GTK access from subscription thread (mkolman)
    Resolves: rhbz#1787615


author: Radek Vykydal <rvykydal@redhat.com> - 29.19.2.9-1
changelog:
  - Fix RHSM HTTP proxy configuration clearing (mkolman)
    Resolves: rhbz#1789814
  - Add scrolling for the registration tab (mkolman)
    Resolves: rhbz#1788422


author: Radek Vykydal <rvykydal@redhat.com> - 29.19.2.10-1
changelog:
  - Log exceptions raised in subscription data fetching method (mkolman)
    Related: rhbz#1788036
  - Fix subscription status not being displayed in some cases (mkolman)
    Resolves: rhbz#1788036
  - Make sure syspurpose is set before registration in GUI (mkolman)
    Resolves: rhbz#1788207
    Related: rhbz#1788036
  - Update pep8speaks checker configuration for the branch (rvykydal)
    Related: rhbz#1788036


author: Radek Vykydal <rvykydal@redhat.com> - 29.19.2.11-1
changelog:
  - Fix DBus error detection (mkolman)
    Related: rhbz#1794767
  - Make sure RHSM HTTP proxy port from kickstart is an integer (mkolman)
    Resolves: rhbz#1794025


author: Radek Vykydal <rvykydal@redhat.com> - 29.19.2.14-1
changelog:
  - Do not allow selecting ignored disk in GUI even if it is the only one
    (rvykydal)
    Resolves: rhbz#1786561


author: Radek Vykydal <rvykydal@redhat.com> - 29.19.2.15-1
changelog:
  - Fix installation source switching to/from CDN (mkolman)
    Resolves: rhbz#1788487
    Resolves: rhbz#1790383
    Resolves: rhbz#1791376


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.3.17-1
changelog:
  - Revert root password spoke to 8.2 behavior (vslavik)
    Resolves: rhbz#1851220
  - Remove the DBus method ConfigureNTPServiceEnablementWithTask (vponcova)
    Resolves: rhbz#1862492
  - Add the function is_service_installed (vponcova)
    Related: rhbz#1862492


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.3.18-1
changelog:
  - subscription: Only restart payload when needed (mkolman)
    Resolves: rhbz#1861351
  - Reset the state of the custom partitioning spoke (vponcova)
    Resolves: rhbz#1868330
  - network: fix parsing of hostname from ip= if mac is defined in dhcp
    (rvykydal)
    Resolves: rhbz#1852560


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.3.20-1
changelog:
  - network: do not try to activate connection that has not been found (rvykydal)
    Resolves: rhbz#1869323
  - network: add timeout for synchronous activation of a connection (rvykydal)
    Related: rhbz#1869323


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.3.21-1
changelog:
  - Fix traceback when removing additional repository (jkonecny)
    Resolves: rhbz#1871037
  - Do not mount as RW in Dracut (jkonecny)
    Resolves: rhbz#1871049
  - Clean up s390 partitioning check (vslavik)
    Resolves: rhbz#1855724


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.3.22-1
changelog:
  - network: fix inst.dhcpclass boot option (rvykydal)
    Resolves: rhbz#1870692
  - network: fix kickstart network --dhcpclass option (rvykydal)
    Resolves: rhbz#1869224


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.3.23-1
changelog:
  - subscription: Assure payload restart on DVD install after registration
    (mkolman)
    Resolves: rhbz#1873164
  - Document the restart_payload argument of subscription helper functions
    (mkolman)
    Related: rhbz#1873164


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.3.24-1
changelog:
  - network: do not add superfluous quotes to inst.dhcpclass identifier
    (rvykydal)
    Related: rhbz#1870692


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.3.25-1
changelog:
  - Root password is mandatory if there is *not* admin user. (rvykydal)
    Related: rhbz#1876727
  - Make locked root be completed only for kickstart (vslavik)
    Resolves: rhbz#1876727


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.3.26-2
changelog:
  - network: do not crash on infiniband devices activated in initramfs
    (rvykydal)
    Resolves: rhbz#1890261


author: Martin Kolman <mkolman@redhat.com> - 33.16.4.6-1
changelog:
  - Initialize librepo logger (pkratoch)
    Resolves: rhbz#1908286
  - Add RPM tests support for owners on rhel-8 (jkonecny)
    Related: rhbz#1885635
  - Use latests RHEL-8 buildroot in containers (jkonecny)
    Related: rhbz#1885635
  - Implement rpm-tests execution in the container (jkonecny)
    Related: rhbz#1885635


author: Martin Kolman <mkolman@redhat.com> - 33.16.4.7-1
changelog:
  - Allow to disable the Security module (vponcova)
    Resolves: rhbz#1913689
  - Allow to disable the Services module (vponcova)
    Resolves: rhbz#1913689
  - Support should_run for standalone GUI spokes (vponcova)
    Resolves: rhbz#1913689
  - Allow to disable the Localization module (vponcova)
    Resolves: rhbz#1913689
  - Allow to disable the Timezone module (vponcova)
    Resolves: rhbz#1913689
  - Allow to disable the network installation (vponcova)
    Resolves: rhbz#1913689
  - Allow to disable the Users module (vponcova)
    Resolves: rhbz#1913689
  - Always show pykickstart parse warnings (vslavik)
    Resolves: rhbz#1897663


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.4.9-1
changelog:
  - Change warning messages of missing prefix for RH products (jkonecny)
    Resolves: rhbz#1897657
  - Do not use cache for container build (jkonecny)
    Related: rhbz#1885635
  - Fix missing inst. prefixes for bootloader options in documentation (jkonecny)
    Related: rhbz#1897657
  - Fix show missing inst. prefix warning appropriately (jkonencny)
    Related: rhbz#1897657
  - Remove docs where we tell users that inst. prefix is not required (jkonecny)
    Related: rhbz#1897657
  - Print warning for boot options without inst. prefix (jkonecny)
    Related: rhbz#1897657
  - Add missing dracut commands as missing inst. prefix warning (jkonecny)
    Related: rhbz#1897657
  - Enable warning when inst. prefix is not used (jkonecny)
    Related: rhbz#1897657


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.4.10-1
changelog:
  - Mark the rhsm and syspurpose kickstart commands as useless (vponcova)
    Resolves: rhbz#1921787
  - Fix getting kernel version list for liveimg (rvykydal)
    Resolves: rhbz#1919463


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.4.11-1
changelog:
  - Take dnf substitutions from installer environment configuration (rvykydal)
    Resolves: rhbz#1920735
  - Fix exclude arguments of tar payload extracting. (rvykydal)
    Resolves: rhbz#1924118


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.4.14-1
changelog:
  - Fix crash in NTP servers GUI dialog on late network configuration (rvykydal)
    Resolves: rhbz#1938168


author: Radek Vykydal <rvykydal@redhat.com> - 33.16.4.15-1
changelog:
  - network: clone connections from intramfs to persistent config (rvykydal)
    Resolves: rhbz#1910438
  - network: match also connections named by MAC created by NM in initramfs
    (rvykydal)
    Related: rhbz#1910438
  - network: do not reset ipv6.addr-gen-mode in tui network configuration
    (rvykydal)
    Related: rhbz#1873021
  - network: set addr-gen-mode of Anaconda default connections to eui64
    (rvykydal)
    Related: rhbz#1873021
  - network: default to addr-gen-mode eui64 (rvykydal)
    Resolves: rhbz#1873021


author: Nick Clifton <nickc@redhat.com> - 8.76-2
changelog:
  - Release bump in order to allow rebuild against latest version of gcc in RHEL-8 buildroot.  (#1720179)


author: Nick Clifton <nickc@redhat.com> - 8.77-1
changelog:
  - Another attempt at fixing the detection and reporting of missing -D_FORTIFY_SOURCE options.  (#1703500)


author: Nick Clifton <nickc@redhat.com> - 8.89-1
changelog:
  - Update to version 8.89.  (#1766631)
  - Generate a WARN result for code compiled with instrumentation enabled.  (#1753918)
  - Replace address checks with dladdr1.
  - Use libabigail like checking to ensure variable address consistency.
  - Skip generation of global notes for hot/cold sections.
  - Generate FAIL results if -Wall or -Wformat-security are missing.
  - If notes cannot be found in the executable look for them in the debuginfo file, if available.
  - Generate a FAIL if notes are missing from the executable/debuginfo file.
  - Record and report the setting of the AArcht64 specific -mbranch-protection option.
  - Improve detection of GO binaries.
  - Add gcc version information to annobin notes.
  - Do not complain about missing FORTIFY_SOURCE and GLIBCXX_ASSERTIONS in LTO compilations.  (#1743635)


author: Nick Clifton <nickc@redhat.com> - 9.19-1
changelog:
  - Annobin: If option name mismatch occurs, seach for the real option.  (#1817452)
  - Annocheck: Fix a division by zero error when parsing GO binaries.  (#1818863)
  - Annobin: Fix access to the -flto and -fsanitize flags.
  - Annobin: Use offsets stored in gcc's cl_option structure to access the global_options array, thus removing the need to check for changes in the size of this structure.
  - Rename gcc plugin directory to gcc-plugin.
  - Stop annocheck from complaining about missing options when the binary has been built in a mixed environment.
  - Improve builtby tool.
  - Stop annocheck complaining about missing notes when the binary is not compiled by either gcc or clang.
  - Skip the check of the ENTRY instruction for binaries not compiled by gcc or clang.  (#1809656)
  - Fix infinite loop hangup in annocheck.
  - Disable debuginfod support by default.
  - Improve parsing of .comment section.
  - Fix clang plugin to use hidden symbols.
  - Add ability to build clang plugin (disabled by default).
  - Annocheck: Fix error printing out the version number.
  - Annobin: Add checks of the exact location of the examined switches.
  - Annobin: Note when stack clash notes are generated.  (#1803173, #1828797)
  - Annocheck: Handle multiple builder IDs in the .comment section.
  - Add configure option to suppress building annocheck.
  - Fix debuginfod test.
  - Correct the build requirement for building with debuginfod support.
  - Add debuginfod support.
  - Add clang plugin (experimental).
  - Have annocheck ignore notes with an end address of 0.
  - Improve checking of gcc versions.


author: Nick Clifton <nickc@redhat.com> - 9.21-1
changelog:
  - Annobin: Fall back on using the flags if the option cannot be found in cl_options.  (#1817659)
  - Annocheck: Detect Fortran compiled programs.  (#1824393)


author: Nick Clifton <nickc@redhat.com> - 9.29-1
changelog:
  - gcc plugin: Detect any attempt to access the global_options array.
  - gcc plugin: Do not complain about missing pre-processor options when examining a preprocessed input file.  (#1862718)
  - Use more robust checks for AArch64 options.
  - Detect CLANG compiled assembler that is missing IBT support.
  - Improved target pointer size discovery.
  - Add support for installing clang and llvm plugins.
  - Temporary suppression of aarch64 pointer size check.  (#1860549)


author: Nick Clifton <nickc@redhat.com> - 9.32-1
changelog:
  - annocheck: Add tests for the AArch64 BTI and PAC security features.  (#1862478)
  - gcc plugin: Use a 4 byte offset for PowerPC start symbols, so that they do not break disassemblies.
  - gcc plugin: Correct the detection of 32-bit x86 builds.  (#1876197)


author: Nick Clifton <nickc@redhat.com> - 9.35-2
changelog:
  - Correct the directory chosen for 32-bit LLVM and Clang plugins.  (#1884951)
  - Allow the use of the SHF_LINK_ORDER section flag to discard unused notes.  (Experimental).
  - gcc-plugin: Fix test for empty PowerPC sections.  (#1880634)


author: Nick Clifton <nickc@redhat.com> - 9.46-1
changelog:
  - Annocheck: Support enabling/disabling future fails.
  - GCC plugin: Always record global notes for the .text.startup,
    .text.exit, .text.hot and .text.cold sections.
  - Clang plugin: Add -lLLVM to the build command line.
  - Annocheck: Improve reporting of missing -D_FORTIFY_SOURCE option.  (#1898075)
  - Annocheck: Improve reporting of missing LTO option.
  - Add detecting of gimple compiled binaries.
  - Add --without-gcc-plugin option.
  - Annocheck: Fix bug parsing DW_AT_producer.
  - Add test of .note.gnu.property section for PowerPC.
  - Add test of objcopy's ability to merge notes.
  - Record the -flto setting and produce a soft warning if it is absent.
  - Suppress warnings about _D_GLIBCXX_ASSERTIONS if the source code is known to be something other than C++.


author: Nick Clifton <nickc@redhat.com> - 9.49-1
changelog:
  - annocheck: Fix notes analyzer to accept empty PPC64 notes.
  - gcc plugin: Tweak generation of end symbols for PPC64 when LTO is active.  (#1898075)(#1904479)
  - gcc plugin: Add support for GCC 11's cl_vars array.


author: Nick Clifton <nickc@redhat.com> - 8.73-2
changelog:
  - Release bump in order to allow rebuild against latest version of gcc in RHEL-8 buildroot.  (#1657912)


author: Nick Clifton <nickc@redhat.com> - 8.76-1
changelog:
  - Report a missing -D_FORTIFY_SOUCRE option if -D_GLIBCXX_ASSERTIONS was detected.  (#1703500)
  - Do not report problems with -fstack-protection if the binary was not built by gcc or clang.  (#1703788)    
  - Add tests of clang command line options recorded in the DW_AT_producer attribute.


author: Nick Clifton <nickc@redhat.com> - 8.89-1
changelog:
  - Update to version 8.89.  (#1766631)
  - Generate a WARN result for code compiled with instrumentation enabled.  (#1753918)
  - Replace address checks with dladdr1.
  - Use libabigail like checking to ensure variable address consistency.
  - Skip generation of global notes for hot/cold sections.
  - Generate FAIL results if -Wall or -Wformat-security are missing.
  - If notes cannot be found in the executable look for them in the debuginfo file, if available.
  - Generate a FAIL if notes are missing from the executable/debuginfo file.
  - Record and report the setting of the AArcht64 specific -mbranch-protection option.
  - Improve detection of GO binaries.
  - Add gcc version information to annobin notes.
  - Do not complain about missing FORTIFY_SOURCE and GLIBCXX_ASSERTIONS in LTO compilations.


author: Iryna Shcherbina <ishcherb@redhat.com> - 1.6.3-7
changelog:
  - Update Python 2 dependency declarations to new packaging standards
    (See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3)


author: Joe Orton <jorton@redhat.com> - 1.6.0-1
changelog:
  - update to 1.6.0 (#1460831)
  - move bdb support to loadable DSO in apr-util-dbd subpackage
  - drop NSS, freetds support


author: Tomáš Mráz <tmraz@redhat.com> - 3.1.20-7
changelog:
  - the ownership of the spool directory should be root as at is configured
    with daemon username root
  - document the -n option


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3-1
changelog:
  - Update to new 3.10.3 stable version.
  - Remove ppc64/ppc64le related patches.
  - All packages now use -A option to specify the target CPU/Architecture instead of 
  sed substitutions and auto detection. The packages should now be less dependant on the 
  builder machine used.
  - Base package for each architecture should now be configured to be compatible with the 
  most basic machine of given type.
  - In addittion to base package, added some optimized packages for more advanced CPUs for
  most architectures.
  - Dropped sse2/sse3 subpackages for ix86


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3-6
changelog:
  * Pass all required compiler/linker flags
  - use annobin plugin
  - generate assembler build notes
  Related: #1624098


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3-8
changelog:
  * Update the s390 subpackages:
  - The base pakcage is now optimized to z13
  - New subpackage is introduced: z14
  - All remaining subpackages for s390 are being deprecated
  - Clean up of the spec file 
  - Some commented out subpackages were removed form the spec
  - These subpackages were not built/shipped -> no change from the users point of view
  Resolves: #1782560
  Resolves: #1780286
  Resolves: #1782561


author: Kamil Dudka <kdudka@redhat.com> 2.4.47-19
changelog:
  - fix test-suite failure with perl-5.26.0 (#1473853)
  - apply patches automatically to ease maintenance
  - update URL of the upstream source tarball


author: Tom Stellard <tstellar@redhat.com> - 2.7.8-2
changelog:
  - Use go-toolset-7 instead of golang
  - Package now must be built with: rhpkg --release rhel-8.0-go-toolset


author: Steve Grubb <sgrubb@redhat.com> 3.0-0.8.20180831git0047a6c
changelog:
  resolves: rhbz#1639745 - build requires go-toolset-7 which is not available
  resolves: rhbz#1643567 - service auditd stop exits prematurely
  resolves: rhbz#1616428 - Update git snapshot of audit package
  - Remove static libs subpackage


author: Steve Grubb <sgrubb@redhat.com> 3.0-0.11.20190607gitf58ec40
changelog:
  resolves: rhbz#1643567 - service auditd stop exits prematurely
  resolves: rhbz#1693470 - libauparse memory leak
  resolves: rhbz#1694071 - ausearch doesn't record device/inode details checkpointing a single file
  resolves: rhbz#1695638 - Rebase audit package to pick up latest bugfixes
  resolves: rhbz#1705894 - aureport aborts when using a specific input
  resolves: rhbz#1706045 - RFE: Backport support for new audit record types
  resolves: rhbz#1715852 - RFE: provide a way to filter on network address family


author: Steve Grubb <sgrubb@redhat.com> 3.0-0.15.20191104git1c2f876
changelog:
  resolves: rhbz#1757986 - Rebase audit package on 8.2 for updates
  resolves: rhbz#1767054 - move audit rules to shared data directory
  resolves: rhbz#1746018 - Breakup 30-ospp-v42.rules into more granular files
  resolves: rhbz#1740798 - auditctl(8) needs clarification for backlog_limit
  resolves: rhbz#1497279 - Add option to interpret fields in audit syslog plugin


author: Pino Toscano <ptoscano@redhat.com> - 1.10.1-3
changelog:
  - Backport some upstream commits to fix few memory leaks, and potential
    memory issues (RHBZ#1602446)


author: Pino Toscano <ptoscano@redhat.com> - 1.10.1-4
changelog:
  - Grub: better handle invalid grub.conf files (RHBZ#1649262)
  - Sudoers: handle "always_query_group_plugin" option (RHBZ#1649299)


author: Pino Toscano <ptoscano@redhat.com> - 1.10.1-6
changelog:
  - Semanage: new lens (RHBZ#1652840)
  - Add "Provides: bundled(gnulib)" to augeas-libs, as it embeds gnulib
    (RHBZ#1653768)


author: Pino Toscano <ptoscano@redhat.com> - 1.12.0-2.el8_1.1
changelog:
  - Krb5: improve handling of [dbmodules]; allow include/includedir directives
    everywhere (RHBZ#1800552)


author: Pino Toscano <ptoscano@redhat.com> - 1.12.0-5
changelog:
  - Fix completion with special characters in augtool. (RHBZ#1232224)
  - Krb5: improve handling of [dbmodules]; allow include/includedir directives
    everywhere (RHBZ#1798486)
  - Systemd: improve parsing of quoted variables of Environment (RHBZ#1798922)


author: Pavel Březina <pbrezina@redhat.com> - 1.0-7
changelog:
  - pam_systemd shouldn't be optional in system-auth (RHBZ #1643928)
  - compat tool: support --enablerequiresmartcard (RHBZ #1649277)
  - compat tool: support --smartcardaction=0 (RHBZ #1649279)
  - remove ecryptfs from authselect since it is not present in rhel8 (RHBZ #1649282)
  - authselect enable-features should error on unknown features (RHBZ #1651637)


author: Pavel Březina <pbrezina@redhat.com> - 1.0-9
changelog:
  - fix sources for official rhel translations (RHBZ #1608286)
  - fix coverity warnings for authselect enable-features should error on unknown features (RHBZ #1651637)


author: Pavel Březina <pbrezina@redhat.com> - 1.0-12
changelog:
  - make authselect work with selinux disabled (RHBZ #1668025)
  - require smartcard authentication only for specific services (RHBZ #1665058)
  - update translations (RHBZ #1608286)


author: Jakub Hrozek <jhrozek@redhat.com> - 1.0-13
changelog:
  - Revert pam_systemd.so to be optional
  - Resolves: #rhbz1643928 - pam_systemd shouldn't be optional in system-auth


author: Pavel Březina <pbrezina@redhat.com> - 1.1-1
changelog:
  - Rebase to authselect-1.1 (RHBZ #1685516)
  - Notify that oddjob-mkhomedir needs to be enabled manually (RHBZ #1694103)
  - Ask for smartcard insertion when smartcard authentication is required (RHBZ #1674397)
  - Update translations (RHBZ #1689973)


author: Pavel Březina <pbrezina@redhat.com> - 1.2.1-1
changelog:
  - Rebase to authselect-1.2.1 (RHBZ #1810471)
  - CLI commands are now correctly translated (RHBZ #1816009)
  - Remove unsupported features from sssd profile description (RHBZ #1830251)
  - add `with-files-access-provider` to sssd profile (RHBZ #1734094)
  - switch to pam_usertype module (RHBZ #1773567)
  - fix typo in sssd profile description (RHBZ #1787638)
  - add minimal profile (RHBZ #1654018)


author: Ian Kent <ikent@redhat.com> - 1:5.1.4-19
changelog:
  - bz1602447 - Please review important issues found by covscan in
    "autofs-5.1.4-18.el8+7"
    - covarity fixes.
  -Resolves: rhbz#1602447


author: Ian Kent <ikent@redhat.com> - 1:5.1.4-20
changelog:
  - bz1612565 - Man page scan results for autofs
    - fix program usage message.
  - Resolves: rhbz#1612565


author: Ian Kent <ikent@redhat.com> - 1:5.1.4-21
changelog:
  - bz1611866 - autofs reload is unable to activate new map entries,
    it is autofs restart which shows new map entries.
    - fix update_negative_cache() map source usage.
  - bz1613621 - [autofs]Removed entries still can be accessed
    - mark removed cache entry negative.
  - Resolves: rhbz#1611866 rhbz#1613621


author: Ian Kent <ikent@redhat.com> - 5.1.4-22
changelog:
  - bz1613630 - On Red Hat 7.x systems if you try to access local
    filesystems using the automounter through /net then the shell
    and mount could lock up *if* the filesystem your accessing is
    double exported.
    - set bind mount as propagation slave.
    - add master map pseudo options for mount propagation.
  - Resolves: rhbz#1613630


author: Ian Kent <ikent@redhat.com> - 5.1.4-23
changelog:
  - bz1615782 - autofs master map age is incorrectly set
    - fix age setting at startup.
  - Resolves: rhbz#1615782


author: Ian Kent <ikent@redhat.com> - 5.1.4-24
changelog:
  - bz1621938 - autofs can no longer get maps from IPA server
    - fix use after free in parse_ldap_config().
  - Resolves: rhbz#1621938


author: Ian Kent <ikent@redhat.com> - 5.1.4-26
changelog:
  - bz1630190 - yum update hanging while restarting autofs
    - fix incorrect locking in sss lookup.
  - bz1630194 - after upgrading to autofs-5.0.7-83.el7.x86_64 on
    RHEL 7 clients, amd maps /defaults key mount options are no
    longer working
    - fix amd parser opts option handling.
  - Resolves: rhbz#1630190 rhbz#1630194


author: Ian Kent <ikent@redhat.com> - 5.1.4-27
changelog:
  - bz1638487 - Drop dependency on hesiod
    - better handle hesiod support not built in.
    - exclude hesiod support from configure options
    - remove hesiod depends.
  - Resolves: rhbz#1638487


author: Ian Kent <ikent@redhat.com> - 5.1.4-28
changelog:
  - bz1638487 - Drop dependency on hesiod
    - actually update the spec file with the hesiod removal.
  - Related: rhbz#1638487


author: Ian Kent <ikent@redhat.com> - 5.1.4-29
changelog:
  - bz1654541 - autofs crash when parsing master map
    - fix hesiod string check in master_parse().
  - Resolves: rhbz#1654541


author: Ian Kent <ikent@redhat.com> - 5.1.4-30
changelog:
  - bz1689469 - [autofs] The log no longer print PID of automount process
    - remove autofs4 module load code.
    - add NULL check in prepare_attempt_prefix().
    - update build info with systemd.
    - use flags for startup boolean options.
    - move close stdio descriptors to become_daemon().
    - add systemd service command line option.
  - Resolves: rhbz#1689469


author: Ian Kent <ikent@redhat.com> - 5.1.4-31
changelog:
  - bz1689467 - path_resolution on an autofs managed path resets the timer. Can
    this be made configurable?
    - support strictexpire mount option.
  - Resolves: rhbz#1689467


author: Ian Kent <ikent@redhat.com> - 5.1.4-32
changelog:
  - bz1703876 - [RFE] Enable additional logging information for autofs
    - add NULL check for get_addr_string() return.
    - use malloc(3) in spawn.c.
    - add mount_verbose configuration option.
    - optionally log mount requestor process info.
    - log mount call arguments if mount_verbose is set.
  - Resolves: rhbz#1703876


author: Ian Kent <ikent@redhat.com> - 5.1.4-33
changelog:
  - bz1689466 - Sanitize autofs logging
    - make expire remaining log level debug.
  - bz1685805 - autofs doesn't expand macros in amd map selectors
    - allow period following macro in selector value.
    - fix macro expansion in selector values.
  - Resolves: rhbz#1689466 rhbz#1685805


author: Ian Kent <ikent@redhat.com> - 5.1.4-34
changelog:
  - bz1681956 - autofs changes blocked until gating tests are added
    - add gating.yaml for manual gate testing.
  - Related: rhbz#1681956


author: Ian Kent <ikent@redhat.com> - 5.1.4-35
changelog:
  - bz1681956 - autofs changes blocked until gating tests are added
    - correct test name in gating.yaml.
  - Related: rhbz#1681956


author: Ian Kent <ikent@redhat.com> - 5.1.4-36
changelog:
  - bz1743442 - getmntent returns additional "-hosts" entries when
    automounter is used with "hosts" map (userspace part)
    - also use strictexpire for offsets (mounts).
    - change expire type naming to better reflect usage.
    - remove unused function has_fstab_option().
    - remove unused function reverse_mnt_list().
    - remove a couple of old debug messages.
    - fix amd entry memory leak.
    - fix unlink_mount_tree() not umounting mounts.
    - add ignore mount option.
    - use ignore option for offset mounts as well.
    - add config option for "ignore" mount option.
    - use bit flags for autofs mount types in mnt_list.
    - use mp instead of path in mnt_list entries.
    - always use PROC_MOUNTS to make mount lists.
    - add glibc getmntent_r().
    - use local getmntent_r in table_is_mounted().
    - refactor unlink_active_mounts() in direct.c.
    - don't use tree_is_mounted() for mounted checks.
    - use single unlink_umount_tree() for both direct and indirect mounts.
    - move unlink_mount_tree() to lib/mounts.c.
    - use local_getmntent_r() for unlink_mount_tree().
    - use local getmntent_r() in get_mnt_list().
    - use local getmntent_r() in tree_make_mnt_list().
    - fix missing initialization of autofs_point flags.
  - Resolves: rhbz#1743442


author: Ian Kent <ikent@redhat.com> - 5.1.4-37
changelog:
  - bz1660145 - autofs.schema doesn't work in RHEL8
    - update ldap READMEs and schema definitions.
  - Resolves: rhbz#1660145


author: Ian Kent <ikent@redhat.com> - 5.1.4-38
changelog:
  - bz1660145 - autofs.schema doesn't work in RHEL8
    - update spec file doc inclusions for schema definition update.
  - Related: rhbz#1660145


author: Ian Kent <ikent@redhat.com> - 5.1.4-39
changelog:
  - bz1802251 - Autofs will only mount share once if sss is first ini
    nsswitch.conf
    - fix a regression with map instance lookup.
  - Resolves: rhbz#1802251


author: Ian Kent <ikent@redhat.com> - 5.1.4-41
changelog:
  - bz1835547 - [RHEL8]autofs cannot mount samba/cifs shares that end with a
    dollar sign
    - fix trailing dollar sun entry expansion.
  - Resolves: rhbz#1835547


author: Ian Kent <ikent@redhat.com> - 5.1.4-42
changelog:
  - bz1841456 - automount program crashes with "malloc(): invalid next size
    (unsorted)
    - initialize struct addrinfo for getaddrinfo() calls.
    - fix quoted string length calc in expandsunent().
  -Resolves: rhbz#1841456


author: Ian Kent <ikent@redhat.com> - 5.1.4-43
changelog:
  - bz1841456 - automount program crashes with "malloc(): invalid next size
    (unsorted)
    - fix autofs mount options construction.
  -Related: rhbz#1841456


author: Ian Kent <ikent@redhat.com> - 5.1.4-44
changelog:
  - bz1858742 - autofs share doesn't mount when using nobind over RDMA where
    nfs-server and nfs-client are the same systems.
    - mount_nfs.c fix local rdma share not mounting.
  -Resolves: rhbz#1858742


author: Ian Kent <ikent@redhat.com> - 5.1.4-45
changelog:
  - bz1664561 - incorrect of start service command in autofs man page
    - fix incorrect systemctl command syntax in autofs(8).
  -Resolves: rhbz#1664561


author: Ian Kent <ikent@redhat.com> - 5.1.4-46
changelog:
  - bz1664561 - incorrect of start service command in autofs man page
    - actually apply fix patch.
  - fix dates and recent status messages in changelog.
  -Related: rhbz#1664561 rhbz#1858742


author: Ian Kent <ikent@redhat.com> - 5.1.4-47
changelog:
  - bz1887681 - automount force unlink option (-F) does not work as expected
    on autofs-5.0.7-109.el7
    - fix direct mount unlink_mount_tree() path.
    - fix unlink mounts umount order.
    - fix incorrect logical compare in unlink_mount_tree().
    - use bit flag for force unlink mounts.
    - improve force unlink mounts option description.
    - remove logpri fifo on autofs mount fail.
    - add force unlink mounts and exit option.
    - cleanup stale logpri fifo pipes on unlink and exit.
  - Resolves: rhbz#1887681


author: Ian Kent <ikent@redhat.com> - 5.1.4-48
changelog:
  - bz1892184 - autofs: return a connection failure until maps have been fetched
    - fix lookup_nss_read_master() nsswicth check return.
    - fix typo in open_sss_lib().
    - fix sss_master_map_wait timing.
    - add sss ECONREFUSED return handling.
    - use mapname in sss context for setautomntent().
    - add support for new sss autofs proto version call.
    - fix retries check in setautomntent_wait().
    - refactor sss setautomntent().
    - improve sss setautomntent() error handling.
    - refactor sss getautomntent().
    - improve sss getautomntent() error handling.
    - sss introduce calculate_retry_count() function.
    - move readall into struct master.
    - sss introduce a flag to indicate map being read.
    - update sss timeout documentation.
    - refactor sss getautomntbyname().
    - improve sss getautomntbyname() error handling.
    - use a valid timeout in lookup_prune_one_cache().
    - dont prune offset map entries.
    - simplify sss source stale check.
  - Resolves: rhbz#1892184


author: Ian Kent <ikent@redhat.com> - 5.1.4-48.el8_4.1
changelog:
  - bz1973888 - autofs: already mounted as other than autofs or failed to unlink
    entry in tree
    - fix empty mounts list return from unlink_mount_tree().
  - Resolves: rhbz#1973888


author: Miroslav Lichvar <mlichvar@redhat.com> - 5.18.12-7
changelog:
  - fix linking to use hardening flags (#1547522)
  - use macro for ldconfig scriptlets
  - add gcc to build requirements
  - remove comment with macro


author: Jaroslav Škarvada <jskarvad@redhat.com> - 0.31.1-43
changelog:
  - Enabled pstoedit backend
  - Fixed out of bounds write when using pstoedit backend
    Resolves: CVE-2016-7392
  - Fixed hardcoded version on source URL
  - Fixed bogus date in changelog (best effort)


author: Michal Sekletár <msekleta@redhat.com> - 0.7-19
changelog:
  - make sure we get compiled with -fstack-protector-strong (#1624099)
  - fix issues reported by coverity (#1602449)


author: Josef Ridky <jridky@redhat.com> - 9.0.4-2
changelog:
  - Add support for openssl (#1512577)
  - Change build requirement form mysql-devel to mariadb-connector-c-devel (#1545413)


author: Kevin Fenzi <kevin@scrye.com> - 1.07.1-1https://bugs.archlinux.org/task/53546
changelog:
  - Update to 1.07.1
  - Fixes a bug that breaks kernel builds ( https://bugs.archlinux.org/task/53546 )


author: Jerome Marchand <jmarchan@redhat.com> - 0.8.0-1
changelog:
  - Rebase on bcc-8.0.0
  - Replace the temporary s390x workaround by a proper fix
  - Remove the doc of excluded tool from the package
  - Fix print_log2_hist
  - Fix yet a few other python3 bytes vs strings issues


author: Jerome Marchand <jmarchan@redhat.com> - 0.10.0-1
changelog:
  - Rebase to bcc-0.10.0
  - Drop criticalstat
  - Fix regression on vfscount and runqslower
  - Rebuild on LLVM 9


author: Jerome Marchand <jmarchan@redhat.com> - 0.14.0-2
changelog:
  - Remove criticalstat manpage
  - Remove compactsnoop on non x86_64
  - Suggest to use --binary in deadlock
  - Remove non-existent argument from tcpconnect man page
  - Suggest to install the proper kernel-devel version
  - Fix dbstat and dbslower


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.12-2
changelog:
  - Add GeoLite2 support (#1564443)
  - Add GeoIP to bind-chroot (#1497646)
  - Fix wrong default GeoIP directory (#1768258)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.20-2
changelog:
  - Add manual page for dnssec-importkey-pkcs11 (#1666785)
  - Add versioned depends to all library subpackages


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.20-5
changelog:
  - Fix tsig-request verify (CVE-2020-8622)
  - Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623)
  - Correct update-policy type subdomain to match documentation (CVE-2020-8624)
  - Include available test


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.25-1
changelog:
  - Update to 9.11.25
  - Require libcap from devel package
  - Fix crash on NTA recheck failure (#1893761)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.26-2
changelog:
  - Add DNSTAP support (#1854148), new dnstap-read tool
  - Add JSON support in statistics-channel (#1899257)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-7.P1
changelog:
  - Fix chroot devices upgrade warning (#1592872)
  - Automatically replace obsoleted ISC DLV key with root key (#1595782)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.4-19.P2
changelog:
  - Add support for OpenSSL provided random data
  - Disable often failing unit test random_test
  - Add /dev/urandom to chroot


author: Thomas Woerner <twoerner@redhat.com> - 11.2-2
changelog:
  - Add support for serve-stale, detected on build time
    Patch by Petr Menšík <pemensik@redhat.com>
    Related: RHBZ#1762813


author: Nick Clifton <nickc@redhat.com> 2.30-58
changelog:
  - Stop the BFD library from complaining about sections with multiple sets of relocations.  (#1749084)


author: Nick Clifton <nickc@redhat.com> - 2.30-58.2
changelog:
  - Allow the BFD library to handle the copying of files containing secondary reloc sections.  (#1803825)


author: Nick Clifton <nickc@redhat.com> - 2.30-71
changelog:
  - Fix a potential seg-fault in the BFD library when parsing pathalogical debug_info sections.  (#1779245)
  - Fix a potential memory exhaustion in the BFD library when parsing corrupt DWARF debug information.


author: Nick Clifton <nickc@redhat.com> - 2.30-72
changelog:
  - Allow the BFD library to handle the copying of files containing secondary reloc sections.  (#1801879)


author: Nick Clifton <nickc@redhat.com> - 2.30-74
changelog:
  - Stop the BFD library from issueing warning messages about allocated sections being found outside of loadable segments.  (#1630115)
  - Fix linker testsuite failures for the aarch64 and s390x targets.  (#1632775, #1809101)
  - Fix building the binutils with address sanitization enabled.  (#1678323)
  - Add support for the PT_GNU_PROPERTY segment.  (#1721606)
  - Fix an internal error in the GOLD linker.  (#1722715)
  - Fix the generation of corrupt .note.gnu.property notes.  (#1723533)
  - Stop objcopy's --set-section-flags option from setting the 'shared' flag on non-COFF binaries.  (#1807308)
  - Fix a bug in the secondary reloc processing code.  (#1809186)


author: Michal Sekletár <msekleta@redhat.com> - 0.7.3-2
changelog:
  - make biosdevname optional even on Dell servers (#1623621)
  - prevent infinite recursion in smbios_setslot() (#1499458)
  - Netronome biosdevname support (#1649036)


author: Tomas Orsava <torsava@redhat.com> - 1.2.0-9
changelog:
  - Switch hardcoded python3 shebangs into the %{__python3} macro
  - Add missing BuildRequires on python3-devel so that %{__python3} macro is
    defined


author: Adrian Reber <adrian@lisas.de> - 1.2.4-7
changelog:
  - Added multiple upstream patches to fix various memory bugs
  - Fixes "[abrt] bogofilter: yyrealloc(): bogofilter killed by SIGABRT" (#1246282)
  - Fixes "why libdb4" (#1367329) by switching BR to libdb-devel (from db4-devel)


author: Christian Kellner <ckellner@redhat.com> - 0.1-2
changelog:
  - Set database path to /var/lib/boltd, create it during
    installation, which is needed for the service file to work.


author: Christian Kellner <ckellner@redhat.com> - 0.8-1
changelog:
  - bolt 0.8 upstream release with pre-boot ACL and IOMMU support
    D-Bus Configuration moved from sysconfdir to datadir
    Resolves: #1629715


author: Jan Pokorný <jpokorny+rpm-booth@fedoraproject.org> - 1.0-3.570876d.git
changelog:
  - update per the changesets recently accepted by the upstream
    (memory/resource leaks fixes, patches previously attached separately
    that make unit test pass, internal cleanups, etc.)


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-3.f2d38ce.git
changelog:
  - update for another, current snapshot beyond booth-1.0
    (commit f2d38ce), including:
    . support for solely manually managed tickets (9a365f9)
    . use asciidoctor instead of asciidoc for generating man pages (65e6a6b)
  - switch to using Python 3 for the tests instead of Python 2
    (behind unversioned "python" references; rhbz#1590856)


author: Jan Pokorný <jpokorny+rpm-booth@redhat.com> - 1.0-4.f2d38ce.git
changelog:
  - revert back to using asciidoc instead of asciidoctor for generating man pages
    (rhbz#1603119)
  - fix some issues in the shell scripts (rhbz#1602455)


author: Jan Friesse <jfriesse@redhat.com> - 1.0-6.ac1d34c.git.1
changelog:
  - Resolves: rhbz#1602455
  - Resolves: rhbz#1682122
  - Resolves: rhbz#1768369
  - Resolves: rhbz#1835831

  - Update to current snapshot (commit ac1d34c) to fix test suite,
    build warnings and build with gcc10
  - Fix hardcoded-library-path
  - Package /var/lib/booth where booth can chroot
  - Add '?dist' macro to release field
  - Pass full path of Python3 to configure
  - Add CI tests
  - Enable gating


author: Jan Friesse <jfriesse@redhat.com> - 1.0-6.ac1d34c.git.2
changelog:
  - Related: rhbz#1835831

  - Do not link with the pcmk libraries
  - Generate runtests.py and boothtestenv.py with -Es as make check does


author: Jan Friesse <jfriesse@redhat.com> - 1.0-199.1.ac1d34c.git
changelog:
  - Resolves: rhbz#1873948
  - Resolves: rhbz#1768172

  - Fix versioning scheme to handle updates better
  - Handle updated exit code of crm_ticket


author: Jan Pokorný <jpokorny+rpm-booth@fedoraproject.org> - 1.0-2.eb4256a.git
changelog:
  - update a subset of out-of-tree patches per
    https://github.com/ClusterLabs/booth/pull/22#issuecomment-216936987
  - pre-inclusion cleanups in the spec (apply systemd scriptlet operations
    with booth-arbitrator, avoid overloading file implicitly considered %doc
    as %license)
    Resolves: rhbz#1314865
    Related: rhbz#1333509


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-142.el8]
changelog:
  - [drm] drm/virtio: use virtio_max_dma_size (Gerd Hoffmann) [1739291]
  - [mm] hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined (Rafael Aquini) [1706088]
  - [powerpc] kvm: ppc: book3s: Enable XIVE native capability only if OPAL has required functions [BZ1744884] (David Gibson) [1744884]
  - [scsi] scsi: lpfc: Fix oops when fewer hdwqs than cpus (Dick Kennedy) [1745731]
  - [scsi] scsi: lpfc: Limit xri count for kdump environment (Dick Kennedy) [1745731]
  - [scsi] scsi: lpfc: Mitigate high memory pre-allocation by SCSI-MQ (Dick Kennedy) [1745731]
  - [scsi] scsi: qla2xxx: Fix hardirq-unsafe locking (Himanshu Madhani) [1719941]
  - [x86] Revert "[x86] x86/kexec/64: Prevent kexec from 5-level paging to a 4-level only kernel" (Baoquan He) [1669088]
  - [x86] Revert "[x86] x86/boot: Add xloadflags bits to check for 5-level paging support" (Baoquan He) [1669088]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-143.el8]
changelog:
  - [net] netfilter: nft_set: fix allocation size overflow in privsize callback. (Florian Westphal) [1746338]
  - [net] net: route dump netlink NLM_F_MULTI flag missing (Stefano Brivio) [1745971]
  - [net] sched: pfifo_fast: fix wrong dereference in pfifo_fast_enqueue (Davide Caratti) [1745390]
  - [net] sched: pfifo_fast: fix wrong dereference when qdisc is reset (Davide Caratti) [1745387]
  - [scsi] scsi: vmw_pscsi: Fix use-after-free in pvscsi_queue_lck() (David Milburn) [1746597]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-144.el8]
changelog:
  - [md] Revert "[md] dm: eliminate 'split_discard_bios' flag from DM target interface" (Mike Snitzer) [1749929]
  - [md] Revert "[md] dm: make sure to obey max_io_len_target_boundary" (Mike Snitzer) [1749929]
  - [pci] PCI: Restore Resizable BAR size bits correctly for 1MB BARs (Myron Stowe) [1717760]
  - [net] netfilter: nft_fib_netdev: Terminate rule eval if protocol=IPv6 and ipv6 module is disabled (Phil Sutter) [1743945]
  - [net] netfilter: bridge: Drops IPv6 packets if IPv6 module is not loaded (Phil Sutter) [1743945]
  - [drm] drm/qxl: get vga ioports (Gerd Hoffmann) [1728936]
  - [drm] drm/i915: Call dma_set_max_seg_size() in i915_driver_hw_probe() (Lyude Paul) [1724363]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-145.el8]
changelog:
  - [iommu] iommu/amd: Add support for X2APIC IOMMU interrupts (Suravee Suthikulpanit) [1734842]
  - [vhost] vhost: make sure log_num < in_num (Eugenio Perez) [1750882] {CVE-2019-14835}


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-146.el8]
changelog:
  - [fs] gfs2: clear buf_in_tr when ending a transaction in sweep_bh_for_rgrps (Robert S Peterson) [1750939]
  - [s390] kvm: s390: kvm_s390_vm_start_migration: check dirty_bitmap before using it as target for memset() (Thomas Huth) [1753260]
  - [fs] cifs: fix credits leak for SMB1 oplock breaks (Leif Sahlberg) [1752243]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.el8]
changelog:
  - [x86] perf/x86/intel: Fix spurious NMI on fixed counter (Michael Petlan) [1755110]
  - [x86] perf/x86/intel: Fix race in intel_pmu_disable_event() (Michael Petlan) [1755110]
  - [netdrv] drivers: tap.c: fix wrong backport causing WARN_ON_ONCE(1) in skb_flow_dissect() (Davide Caratti) [1750711]
  - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746804] {CVE-2019-14821}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-147.0.2.el8_1]
changelog:
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1766056 1756805] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1766056 1756805] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [x86] x86/tsx: Add config options to set tsx=on|off|auto (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/tsx: Add "auto" option to the tsx= cmdline parameter (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [x86] x86/cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86/mmu: Reintroduce fast invalidate/zap for flushing memslot (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] Revert "KVM: x86/mmu: Zap only the relevant pages when removing a memslot" (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: x86, powerpc: do not allow clearing largepages debugfs entry (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [zstream] switch to zstream (Frantisek Hrbata)


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-147.0.3.el8_1]
changelog:
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-147.1.1.el8_1]
changelog:
  - [arm64] arm64/sve: Fix wrong free for task->thread.sve_state (Andrew Jones) [1767358 1756450]
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1766056 1756805] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1766056 1756805] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Use explicit goto for error paths (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756871 1756873] {CVE-2019-0155}
  - [x86] x86/tsx: Add config options to set tsx=on|off|auto (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/tsx: Add "auto" option to the tsx= cmdline parameter (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Josh Poimboeuf) [1766550 1766551] {CVE-2019-11135}
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: x86: mmu: Recovery of shattered NX large pages (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [virt] kvm: Add helper function for creating VM worker threads (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: mmu: ITLB_MULTIHIT mitigation (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kernel] cpu/speculation: Uninline and export CPU mitigations helpers (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [x86] x86/cpu: Add Tremont to the cpu vulnerability whitelist (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: vmx, svm: always run with EFER.NXE=1 when shadow paging is active (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: add tracepoints around __direct_map and FNAME(fetch) (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: remove now unneeded hugepage gfn adjustment (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86: make FNAME(fetch) and __direct_map more similar (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: mmu: Do not release the page inside mmu_set_spte() (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: Convert kvm_lock to a mutex (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] KVM: x86/mmu: Reintroduce fast invalidate/zap for flushing memslot (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] Revert "KVM: x86/mmu: Zap only the relevant pages when removing a memslot" (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [kvm] kvm: x86, powerpc: do not allow clearing largepages debugfs entry (Paolo Bonzini) [1698416 1690344] {CVE-2018-12207}
  - [zstream] switch to zstream (Frantisek Hrbata)


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.2.1.el8_1]
changelog:
  - [sched] fair: Scale bandwidth quota and period without losing quota/period ratio precision (Phil Auld) [1773568 1706247]
  - [sched] fair: Fix -Wunused-but-set-variable warnings (Phil Auld) [1773568 1706247]
  - [sched] fair: Fix low cpu usage with high throttling by removing expiration of cpu-local slices (Phil Auld) [1773568 1706247]
  - [powerpc] powerpc/pseries: Track LMB nid instead of using device tree (Steve Best) [1772110 1758742]
  - [powerpc] powerpc/pseries/memory-hotplug: Only update DT once per memory DLPAR request (Steve Best) [1772110 1758742]
  - [powerpc] powerpc/rtas: allow rescheduling while changing cpu states (Steve Best) [1772109 1758651]
  - [powerpc] powerpc/pseries/mobility: use cond_resched when updating device tree (Steve Best) [1772109 1758651]
  - [netdrv] i40e: Do not check VF state in i40e_ndo_get_vf_config (Stefan Assmann) [1770177 1752498]
  - [fs] CIFS: Fix use after free of file info structures (Dave Wysochanski) [1767357 1757865]
  - [fs] cifs: use cifsInodeInfo->open_file_lock while iterating to avoid a panic (Dave Wysochanski) [1767357 1757865]
  - [netdrv] net/ibmvnic: prevent more than one thread from running in reset (Steve Best) [1764830 1756943]
  - [netdrv] net/ibmvnic: unlock rtnl_lock in reset so linkwatch_event can run (Steve Best) [1764830 1756943]
  - [netdrv] ibmvnic: Warn unknown speed message only when carrier is present (Steve Best) [1764832 1749873]
  - [netdrv] net/ibmvnic: Fix missing { in __ibmvnic_reset (Steve Best) [1764832 1749873]
  - [netdrv] net/ibmvnic: free reset work of removed device from queue (Steve Best) [1764832 1749873]
  - [netdrv] ibmvnic: Do not process reset during or after device removal (Steve Best) [1764832 1749873]
  - [cpuidle] cpuidle: governor: Add new governors to cpuidle_governors again (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: do not set an owner to allow modunload (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: set haltpoll as preferred governor (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: allow governor switch on cpuidle_register_driver() (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: Add cpuidle.governor= command line parameter (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: vcpu hotplug support (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: disable host side polling when kvm virtualized (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: add haltpoll governor (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: header file stubs must be "static inline" (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] governors: unify last_state_idx (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: add poll_limit_ns to cpuidle_device structure (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: poll_state: Fix default time limit (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: poll_state: Disregard disable idle states (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: poll_state: Revise loop termination condition (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle: menu: Fix wakeup statistics updates for polling state (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] cpuidle-haltpoll: return -ENODEV on modinit failure (Marcelo Tosatti) [1764831 1759282]
  - [cpuidle] add cpuidle-haltpoll driver (Marcelo Tosatti) [1764831 1759282]
  - [x86] kvm: x86: add host poll control msrs (Vitaly Kuznetsov) [1764831 1749495]
  - [s390] s390/setup: Fix kernel lock down for s390 (Philipp Rudo) [1764827 1748343]
  - [powerpc] powerpc: Allow flush_(inval_)dcache_range to work across ranges >4GB (Steve Best) [1764826 1744062]
  - [fs] mm/huge_memory: fix vmf_insert_pfn_{pmd, pud}() crash, handle unaligned addresses (Jeff Moyer) [1764825 1743159]
  - [mm] mm/huge_memory.c: fix modifying of page protection by insert_pfn_pmd() (Jeff Moyer) [1764825 1743159]
  - [pci] PCI: hv: Use bytes 4 and 5 from instance ID as the PCI domain numbers (Mohammed Gamal) [1764634 1671288]
  - [pci] PCI: hv: Detect and fix Hyper-V PCI domain number collision (Mohammed Gamal) [1764634 1671288]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.3.1.el8_1]
changelog:
  - [x86] kvm: svm: taint module and print taint message iff nested is enabled (Bandan Das) [1776114 1775410]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.4.1.el8_1]
changelog:
  - [block] blk-mq: apply normal plugging for HDD (Ming Lei) [1782181 1759380]
  - [block] blk-mq: honor IO scheduler for multiqueue devices (Ming Lei) [1782181 1759380]
  - [block] blk-mq: simplify blk_mq_make_request() (Ming Lei) [1782181 1759380]
  - [block] blk-mq: remove blk_mq_put_ctx() (Ming Lei) [1782181 1759380]
  - [x86] kvm: vmx: use MSR_IA32_TSX_CTRL to hard-disable TSX on guest that lack it (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm: vmx: implement MSR_IA32_TSX_CTRL disable RTM functionality (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm: x86: implement MSR_IA32_TSX_CTRL effect on CPUID (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm: x86: do not modify masked bits of shared MSRs (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm: x86: fix presentation of TSX feature in ARCH_CAPABILITIES (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [x86] kvm/x86: Export MDS_NO=0 to guests when TSX is enabled (Paolo Bonzini) [1781660 1779553] {CVE-2019-19338}
  - [fs] cifs: Fix cifsInodeInfo lock_sem deadlock when reconnect occurs (Leif Sahlberg) [1778693 1765979]
  - [fs] cifs: avoid using MID 0xFFFF (Leif Sahlberg) [1778693 1765979]
  - [fs] cifs: Fix retry mid list corruption on reconnects (Leif Sahlberg) [1778693 1765979]
  - [fs] smb3: fix unmount hang in open_shroot (Leif Sahlberg) [1781113 1757670]
  - [fs] CIFS: fix deadlock in cached root handling (Leif Sahlberg) [1781113 1757670]
  - [fs] Fix match_server check to allow for auto dialect negotiate (Leif Sahlberg) [1781113 1757670]
  - [fs] SMB3: retry on STATUS_INSUFFICIENT_RESOURCES instead of failing write (Leif Sahlberg) [1781113 1757670]
  - [fs] cifs: fix panic in smb2_reconnect (Leif Sahlberg) [1781113 1757670]
  - [fs] cifs: fix strcat buffer overflow and reduce raciness in smb21_set_oplock_level() (Leif Sahlberg) [1781113 1757670]
  - [fs] smb3: fix signing verification of large reads (Dave Wysochanski) [1781110 1753114]
  - [scsi] scsi: lpfc: Fix port relogin failure due to GID_FT interaction (Dick Kennedy) [1781108 1733217]
  - [fs] xfs: fix missing ILOCK unlock when xfs_setattr_nonsize fails due to EDQUOT (Bill O'Donnell) [1778692 1739607]
  - [net] cfg80211: wext: avoid copying malformed SSIDs (Jarod Wilson) [1778633 1778634] {CVE-2019-17133}
  - [block] blkcg: perpcu_ref init/exit should be done from blkg_alloc/free() (Ming Lei) [1777766 1741392]
  - [fs] userfaultfd_release: always remove uffd flags and clear vm_userfaultfd_ctx (Alex Gladkov) [1777389 1749763] {CVE-2019-14898}
  - [netdrv] mwifiex: Fix three heap overflow at parsing element in cfg80211_ap_settings (Jarod Wilson) [1776618 1775484] {CVE-2019-14814 CVE-2019-14815 CVE-2019-14816}
  - [netdrv] mwifiex: fix possible heap overflow in mwifiex_process_country_ie() (Jarod Wilson) [1776209 1776210] {CVE-2019-14895}
  - [netdrv] mwifiex: Fix heap overflow in mmwifiex_process_tdls_action_frame() (Jarod Wilson) [1776161 1776162] {CVE-2019-14901}
  - [netdrv] rtlwifi: Fix potential overflow on P2P code (Jarod Wilson) [1775222 1775223] {CVE-2019-17666}
  - [pci] hv: Avoid use of hv_pci_dev->pci_slot after freeing it (Mohammed Gamal) [1764635 1737569]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.5.1.el8_1]
changelog:
  - [powerpc] powerpc/shared: Use static key to detect shared processor (Phil Auld) [1781114 1767529]
  - [powerpc] powerpc/vcpu: Assume dedicated processors as non-preempt (Phil Auld) [1781114 1767529]


author: Akemi Yagi <toracat@centos.org> [4.18.0-147.5.1.el8.centos.plus]
changelog:
  - Apply debranding changes
  - Modify config file for x86_64 with extra features turned on including some network adapters,
    some SCSI adapters, ReiserFS, TOMOYO
  - Apply patches from CentOS-7 plus kernel
  - Apply driver patches imported from ELRepo
  - Add device IDs that have been removed from RHEL 8 kernels (megaraid_sas and mpt3sas)
  - Apply patches for e1000 from kernel.org [bug#16284]
  - Apply patch to fix xfrm memleak [RHBZ#1780470]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.6.1.el8_1]
changelog:
  - [crypto] crypto: chelsio - count incomplete block in IV (Jonathan Toppins) [1798527 1725813]
  - [crypto] crypto: chelsio - Fix softlockup with heavy I/O (Jonathan Toppins) [1798527 1725813]
  - [crypto] crypto: chelsio - Fix NULL pointer dereference (Jonathan Toppins) [1798527 1725813]
  - [nvme] nvme: Treat discovery subsystems as unique subsystems (Ewan Milne) [1798381 1757525]
  - [mm] mm/page-writeback.c: don't break integrity writeback on ->writepage() error (Christoph von Recklinghausen) [1797962 1782117]
  - [lib] crc-t10dif: crc_t10dif_mutex can be static (Vladis Dronov) [1797961 1769462]
  - [lib] crc-t10dif: Allow current transform to be inspected in sysfs (Vladis Dronov) [1797961 1769462]
  - [lib] crc-t10dif: Pick better transform if one becomes available (Vladis Dronov) [1797961 1769462]
  - [crypto] api - Introduce notifier for new crypto algorithms (Vladis Dronov) [1797961 1769462]
  - [block] blk-mq: make sure that line break can be printed (Ming Lei) [1797960 1741462]
  - [block] blk-mq: avoid sysfs buffer overflow with too many CPU cores (Ming Lei) [1797960 1741462]
  - [scsi] hpsa: update driver version (Joseph Szczypek) [1797519 1761968]
  - [scsi] scsi: hpsa: add missing hunks in reset-patch (Joseph Szczypek) [1797519 1761968]
  - [arm64] arm64: compat: Workaround Neoverse-N1 #1542419 for compat user-space (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Fake the IminLine size on systems affected by Neoverse-N1 #1542419 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: errata: Hide CTR_EL0.DIC on systems affected by Neoverse-N1 #1542419 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Handle erratum 1418040 as a superset of erratum 1188873 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: errata: Add workaround for Cortex-A76 erratum #1463225 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Kconfig: Tidy up errata workaround help text (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Apply ARM64_ERRATUM_1188873 to Neoverse-N1 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Add part number for Neoverse N1 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Make ARM64_ERRATUM_1188873 depend on COMPAT (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Restrict ARM64_ERRATUM_1188873 mitigation to AArch32 (Mark Salter) [1797518 1757828]
  - [arm64] arm64: arch_timer: avoid unused function warning (Mark Salter) [1797518 1757828]
  - [arm64] arm64: Add workaround for Cortex-A76 erratum 1286807 (Mark Salter) [1797518 1757828]
  - [md] dm snapshot: rework COW throttling to fix deadlock (Mike Snitzer) [1796490 1758605]
  - [md] dm snapshot: introduce account_start_copy() and account_end_copy() (Mike Snitzer) [1796490 1758605]
  - [block] fix memleak of bio integrity data (Ming Lei) [1795338 1779898]
  - [powerpc] xive: Prevent page fault issues in the machine crash handler (Diego Domingos) [1795337 1756116]
  - [scsi] scsi: megaraid_sas: IRQ poll to avoid CPU hard lockups (Tomas Henzl) [1795335 1726251]
  - [powerpc] powerpc/perf: Disable trace_imc pmu (Steve Best) [1794061 1785573]
  - [s390] s390/qeth: ensure linear access to packet headers (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: guard against runt packets (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: handle skb allocation error gracefully (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: drop unwanted packets earlier in RX path (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: support per-frame invalidation (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: gather more detailed RX dropped/error statistics (Philipp Rudo) [1794059 1781085]
  - [s390] s390/net: Mark expected switch fall-throughs (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: consolidate skb RX processing in L3 driver (Philipp Rudo) [1794059 1781085]
  - [s390] s390/qeth: remove RX seqno in skb->cb (Philipp Rudo) [1794059 1781085]
  - [powerpc] kvm: ppc: book3s hv: Flush link stack on guest exit to host kernel (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] book3s64: Fix link stack flush on context switch (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] 64s: support nospectre_v2 cmdline option (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] fsl: Update Spectre v2 reporting (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] fsl: Add nospectre_v2 command line argument (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] fsl: Fix spectre_v2 mitigations reporting (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] 64: Make meltdown reporting Book3S 64 specific (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [powerpc] 64: Disable the speculation barrier from the command line (Gustavo Duarte) [1794056 1777686] {CVE-2019-18660}
  - [firmware] efi/memreserve: Register reservations as 'reserved' in /proc/iomem (Bhupesh Sharma) [1792200 1772730]
  - [firmware] efi/memreserve: deal with memreserve entries in unmapped memory (Bhupesh Sharma) [1792200 1772730]
  - [s390] s390/cpum_sf: save TOD clock base in SDBs for time conversion (Philipp Rudo) [1792198 1743504]
  - [s390] s390/sclp: Fix bit checked for has_sipl (Philipp Rudo) [1791408 1748347]
  - [scsi] qla2xxx: Fix incorrect SFUB length used for Secure Flash Update MB Cmd (Himanshu Madhani) [1790350 1782598]
  - [scsi] qla2xxx: Added support for MPI and PEP regions for ISP28XX (Himanshu Madhani) [1790350 1782598]
  - [scsi] qla2xxx: Correctly retrieve and interpret active flash region (Himanshu Madhani) [1790350 1782598]
  - [powerpc] powerpc/tm: Fix FP/VMX unavailable exceptions inside a transaction (Gustavo Duarte) [1788862 1750653] {CVE-2019-15030}
  - [powerpc] powerpc/tm: Fix restoring FP/VMX facility incorrectly on interrupts (Gustavo Duarte) [1791630 1750653] {CVE-2019-15031}
  - [scsi] scsi: qla2xxx: Fix different size DMA Alloc/Unmap (Himanshu Madhani) [1788206 1753031]
  - [scsi] qla2xxx: call dma_free_coherent with correct size in all cases in qla24xx_sp_unmap (Himanshu Madhani) [1788206 1753031]
  - [fs] devpts_pty_kill(): don't bother with d_delete() (Eric Sandeen) [1783959 1772718]
  - [fs] devpts: always delete dcache dentry-s in dput() (Eric Sandeen) [1783959 1772718]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-147.7.1.el8_1]
changelog:
  - [hid] hiddev: do cleanup in failure of opening a device (Benjamin Tissoires) [1803458 1803460] {CVE-2019-19527}
  - [hid] hiddev: avoid opening a disconnected device (Benjamin Tissoires) [1803458 1803460] {CVE-2019-19527}
  - [nvme] nvmet: fix discover log page when offsets are used (Gopal Tiwari) [1801216 1745836]
  - [netdrv] ibmvnic: Serialize device queries (Steve Best) [1794060 1778037]
  - [netdrv] ibmvnic: Bound waits for device queries (Steve Best) [1794060 1778037]
  - [netdrv] ibmvnic: Terminate waiting device threads after loss of service (Steve Best) [1794060 1778037]
  - [netdrv] ibmvnic: Fix completion structure initialization (Steve Best) [1794060 1778037]
  - [netdrv] ibmvnic: Ignore H_FUNCTION return from H_EOI to tolerate XIVE mode (Steve Best) [1794060 1778037]
  - [tools] selftests/powerpc: Fix compile error on tlbie_test due to newer gcc (Desnes Augusto Nunes do Rosario) [1794058 1755707]
  - [tools] selftests/powerpc: Add test case for tlbie vs mtpidr ordering issue (Desnes Augusto Nunes do Rosario) [1794058 1755707]
  - [powerpc] powerpc/mm: Fixup tlbie vs mtpidr/mtlpidr ordering issue on POWER9 (Desnes Augusto Nunes do Rosario) [1794058 1755707]
  - [powerpc] powerpc/book3s64/radix: Rename CPU_FTR_P9_TLBIE_BUG feature flag (Desnes Augusto Nunes do Rosario) [1794058 1755707]
  - [powerpc] powerpc/book3s64/mm: Don't do tlbie fixup for some hardware revisions (Desnes Augusto Nunes do Rosario) [1794058 1755707]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-139.el8]
changelog:
  - [char] ipmi: move message error checking to avoid deadlock (Tony Camuso) [1731388 1718699]
  - [crypto] crypto: testmgr - mark crc32 checksum as FIPS allowed (Neil Horman) [1738887]
  - [include] dma-mapping: use dma_get_mask in dma_addressing_limited (Don Dutile) [1738631]
  - [kernel] dma-direct: correct the physical addr in dma_direct_sync_sg_for_cpu/device (Don Dutile) [1738631]
  - [kernel] dma-direct: only limit the mapping size if swiotlb could be used (Don Dutile) [1738631]
  - [include] dma-mapping: add a dma_addressing_limited helper (Don Dutile) [1738631]
  - [kernel] dma-direct: Force unencrypted DMA under SME for certain DMA masks (Don Dutile) [1738631]
  - [lib] lib/genalloc: introduce chunk owners (Don Dutile) [1738631]
  - [lib] lib/genalloc: add gen_pool_dma_zalloc() for zeroed DMA allocations (Don Dutile) [1738631]
  - [lib] lib/genalloc.c: fix allocation of aligned buffer from non-aligned chunk (Don Dutile) [1738631]
  - [include] dma-mapping: remove dma_max_pfn (Don Dutile) [1738631]
  - [mmc] mmc: core: let the dma map ops handle bouncing (Don Dutile) [1738631]
  - [mmc] mmc: core: align max segment size with logical block size (Don Dutile) [1738631]
  - [kernel] swiotlb: no need to check return value of debugfs_create functions (Don Dutile) [1738631]
  - [xen] swiotlb: fix phys_addr_t overflow warning (Don Dutile) [1738631]
  - [kernel] swiotlb: Return consistent SWIOTLB segments/nr_tbl (Don Dutile) [1738631]
  - [kernel] swiotlb: Group identical cleanup in swiotlb_cleanup() (Don Dutile) [1738631]
  - [kernel] swiotlb: save io_tlb_used to local variable before leaving critical section (Don Dutile) [1738631]
  - [kernel] swiotlb: dump used and total slots when swiotlb buffer is full (Don Dutile) [1738631]
  - [kernel] swiotlb: add checks for the return value of memblock_alloc*() (Don Dutile) [1738631]
  - [kernel] swiotlb: add debugfs to track swiotlb buffer usage (Don Dutile) [1738631]
  - [kernel] dma-direct: fix DMA_ATTR_NO_KERNEL_MAPPING (Don Dutile) [1738631]
  - [kernel] dma-direct: handle DMA_ATTR_NO_KERNEL_MAPPING in common code (Don Dutile) [1738631]
  - [kernel] dma-direct: fix DMA_ATTR_NO_KERNEL_MAPPING for remapped allocations (Don Dutile) [1738631]
  - [kernel] dma-mapping: remove a pointless memset in dma_atomic_pool_init (Don Dutile) [1738631]
  - [kernel] dma-mapping: fix lack of DMA address assignment in generic remap allocator (Don Dutile) [1738631]
  - [kernel] dma-remap: support DMA_ATTR_NO_KERNEL_MAPPING (Don Dutile) [1738631]
  - [kernel] dma-mapping: support highmem in the generic remap allocator (Don Dutile) [1738631]
  - [kernel] dma-direct: handle DMA_ATTR_NON_CONSISTENT in common code (Don Dutile) [1738631]
  - [kernel] dma-mapping: add a dma_alloc_need_uncached helper (Don Dutile) [1738631]
  - [kernel] dma-mapping: truncate dma masks to what dma_addr_t can hold (Don Dutile) [1738631]
  - [kernel] dma-remap: Avoid de-referencing NULL atomic_pool (Don Dutile) [1738631]
  - [include] dma-buf: add DMA_BUF_SET_NAME ioctls (Don Dutile) [1738631]
  - [include] dma-buf: give each buffer a full-fledged inode (Don Dutile) [1738631]
  - [fs] new wrapper: alloc_file_pseudo() (Don Dutile) [1738631]
  - [kernel] dma-direct: provide generic support for uncached kernel segments (Don Dutile) [1738631]
  - [include] dma-contiguous: fix !CONFIG_DMA_CMA version of dma_{alloc, free}_contiguous() (Don Dutile) [1738631]
  - [kernel] dma-contiguous: use fallback alloc_pages for single pages (Don Dutile) [1738631]
  - [kernel] dma-contiguous: add dma_{alloc,free}_contiguous() helpers (Don Dutile) [1738631]
  - [iommu] iommu/dma: Fix condition check in iommu_dma_unmap_sg (Don Dutile) [1738631]
  - [iommu] iommu/dma: move the arm64 wrappers to common code (Don Dutile) [1738631]
  - [iommu] iommu/dma-iommu.c: convert to use vm_map_pages() (Don Dutile) [1738631]
  - [mm] mm: introduce new vm_map_pages() and vm_map_pages_zero() API (Don Dutile) [1738631]
  - [mm] arm64/iommu: handle non-remapped addresses in ->mmap and ->get_sgtable (Don Dutile) [1738631]
  - [arm64] arm64/mm: wire up CONFIG_ARCH_HAS_SET_DIRECT_MAP (Don Dutile) [1738631]
  - [kernel] mm/hibernation: Make hibernation handle unmapped pages (Don Dutile) [1738631]
  - [mm] page_poison: play nicely with KASAN (Don Dutile) [1738631]
  - [mm] mm/vmalloc: Avoid rare case of flushing TLB with weird arguments (Don Dutile) [1738631]
  - [mm] mm/vmalloc: Fix calculation of direct map addr range (Don Dutile) [1738631]
  - [mm] mm/vmalloc: Add flag for freeing of special permsissions (Don Dutile) [1738631]
  - [x86] x86/mm/cpa: Add set_direct_map_*() functions (Don Dutile) [1738631]
  - [arm64] dma-mapping: add a kconfig symbol for arch_setup_dma_ops availability (Don Dutile) [1738631]
  - [iommu] iommu/dma: Remove the flush_page callback (Don Dutile) [1738631]
  - [include] iommu/dma: Cleanup dma-iommu.h (Don Dutile) [1738631]
  - [dma] dmaengine: Add matching device node validation in __dma_request_channel() (Don Dutile) [1738631]
  - [dma] dmaengine: dma_request_chan_by_mask() to handle deferred probing (Don Dutile) [1738631]
  - [include] dma-buf: start caching of sg_table objects v2 (Don Dutile) [1738631]
  - [kernel] dma-mapping: add a Kconfig symbol to indicate arch_dma_prep_coherent presence (Don Dutile) [1738631]
  - [iommu] iommu/dma-iommu: Remove iommu_dma_map_msi_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/ls-scfg-msi: Don't map the MSI page in ls_scfg_msi_compose_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/gic-v3-mbi: Don't map the MSI page in mbi_compose_m{b, s}i_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/gicv2m: Don't map the MSI page in gicv2m_compose_msi_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/gic-v3-its: Don't map the MSI page in its_irq_compose_msi_msg() (Don Dutile) [1738631]
  - [irqchip] irqchip/gic-v3-its: Align PCI Multi-MSI allocation on their size (Don Dutile) [1738631]
  - [iommu] iommu/dma-iommu: Split iommu_dma_map_msi_msg() in two parts (Don Dutile) [1738631]
  - [iommu] iommu/dma: Remove unused variable (Don Dutile) [1738631]
  - [iommu] iommu/dma: Use NUMA aware memory allocations in __iommu_dma_alloc_pages() (Don Dutile) [1738631]
  - [kernel] genirq/msi: Add a new field in msi_desc to store an IOMMU cookie (Don Dutile) [1738631]
  - [pci] PCI/MSI: Remove unused mask_msi_irq() and unmask_msi_irq() (Don Dutile) [1738631]
  - [include] PCI/MSI: Remove unused __write_msi_msg() and write_msi_msg() (Don Dutile) [1738631]
  - [include] genirq/msi: Clean up usage of __u8/__u16 types (Don Dutile) [1738631]
  - [base] platform-msi: Free descriptors in platform_msi_domain_free() (Don Dutile) [1738631]
  - [base] genirq/msi: Allow creation of a tree-based irqdomain for platform-msi (Don Dutile) [1738631]
  - [kernel] dma-debug: only skip one stackframe entry (Don Dutile) [1738631]
  - [dma] dmaengine: idma64: Move driver name to the header (Don Dutile) [1738631]
  - [kernel] dma-mapping: remove an unnecessary NULL check (Don Dutile) [1738631]
  - [include] dma-buf: Update [un]map documentation to match the other functions (Don Dutile) [1738631]
  - [include] dma-buf: Remove leftover [un]map_atomic comments (Don Dutile) [1738631]
  - [x86] x86/dma: Remove the x86_dma_fallback_dev hack (Don Dutile) [1738631]
  - [kernel] dma-mapping: remove leftover NULL device support (Don Dutile) [1738631]
  - [kernel] dma: select GENERIC_ALLOCATOR for DMA_REMAP (Don Dutile) [1738631]
  - [crypto] crypto: ccp - Ignore unconfigured CCP device on suspend/resume (Gary Hook) [1743999]
  - [md] dm snapshot: fix oversights in optional discard support (Mike Snitzer) [1744291]
  - [md] dm snapshot: add optional discard support features (Mike Snitzer) [1744291]
  - [md] dm snapshot: Use fine-grained locking scheme (Mike Snitzer) [1744291]
  - [md] dm snapshot: Make exception tables scalable (Mike Snitzer) [1744291]
  - [md] dm snapshot: Replace mutex with rw semaphore (Mike Snitzer) [1744291]
  - [md] dm snapshot: Don't sleep holding the snapshot lock (Mike Snitzer) [1744291]
  - [include] list_bl: Add hlist_bl_add_before/behind helpers (Mike Snitzer) [1744291]
  - [powerpc] powerpc/rtas: use device model APIs and serialization during LPM (Steve Best) [1741643]
  - [firmware] firmware/efi: Add NULL pointer checks in efivars API functions (Jarod Wilson) [1741949]
  - [fs] ovl: fix wrong flags check in FS_IOC_FS[SG]ETXATTR ioctls (Miklos Szeredi) [1724518]
  - [include] mm: page_cache_add_speculative(): refactor out some code duplication (Michael Petlan) [1738331]
  - [netdrv] ibmvnic: Unmap DMA address of TX descriptor buffers after use (Steve Best) [1743155]
  - [fs] NFSv4.1 don't free interrupted slot on open (Steve Dickson) [1708345]
  - [fs] NFSv4.1: Avoid false retries when RPC calls are interrupted (Steve Dickson) [1708345]
  - [net] ipv6: Fix return value of ipv6_mc_may_pull() for malformed packets (Stefano Brivio) [1743203]
  - [net] inet: frags: re-introduce skb coalescing for local delivery (Guillaume Nault) [1719418]


author: Herton R. Krzesinski <herton@redhat.com> [4.18.0-140.el8]
changelog:
  - [x86] x86/kdump: Reserve extra memory when SME or SEV is active (Kairui Song) [1728519]
  - [scsi] scsi: qla2xxx: Fix hardlockup in abort command during driver remove (Himanshu Madhani) [1690041]
  - [scsi] qla2xxx: Update driver version to 10.01.00.15.08.1-k1 (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix panic from use after free in qla2x00_async_tm_cmd (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: cleanup trace buffer initialization (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: qla2x00_alloc_fw_dump: set ha->eft (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Use mutex protection during qla2x00_sysfs_read_fw_dump() (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: move IO flush to the front of NVME rport unregistration (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix NVME cmd and LS cmd timeout race condition (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Complain loudly about reference count underflow (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix race conditions in the code for aborting SCSI commands (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Use an on-stack completion in qla24xx_control_vp() (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Change abort wait_loop from msleep to wait_event_timeout (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Set the SCSI command result before calling the command done (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: on session delete, return nvme cmd (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix kernel crash after disconnecting NVMe devices (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Remove the fcport test from qla_nvme_abort_work() (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix driver unload when FC-NVMe LUNs are connected (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Set remote port devloss timeout to 0 (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix panic in qla_dfs_tgt_counters_show (Himanshu Madhani) [1690041]
  - [scsi] scsi: qla2xxx: Fix fw dump corruption (Himanshu Madhani) [1690041]
  - [x86] kvm: disable nested virt on pre-haswell processors (Paolo Bonzini) [1739739]
  - [x86] kvm: taint kernel for tech-preview when using nested virtualization (Paolo Bonzini) [1739739]
  - [x86] kvm: x86: hyper-v: don't crash on KVM_GET_SUPPORTED_HV_CPUID when kvm_intel.nested is disabled (Vitaly Kuznetsov) [1746100]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-187.el8]
changelog:
  - [kernel] blktrace: Protect q->blk_trace with RCU (Ming Lei) [1798329]
  - [drm] drm/i915: Force DPCD backlight mode for some Dell CML 2020 panels (Lyude Paul) [1782671 1773796 1748892]
  - [drm] drm/i915: Force DPCD backlight mode on X1 Extreme 2nd Gen 4K AMOLED panel (Lyude Paul) [1782671 1773796 1748892]
  - [drm] drm/dp: Introduce EDID-based quirks (Lyude Paul) [1782671 1773796 1748892]
  - [drm] drm/i915: Auto detect DPCD backlight support by default (Lyude Paul) [1782671 1773796 1748892]
  - [drm] drm/i915: Fix DPCD register order in intel_dp_aux_enable_backlight() (Lyude Paul) [1782671 1773796 1748892]
  - [drm] drm/i915: Assume 100 brightness when not in DPCD control mode (Lyude Paul) [1782671 1773796 1748892]
  - [drm] drm/i915: Fix eDP DPCD aux max backlight calculations (Lyude Paul) [1782671 1773796 1748892]
  - [drm] drm/i915: Check backlight type while doing eDP backlight initializaiton (Lyude Paul) [1782671 1773796 1748892]
  - [tools] selftests: nft_concat_range: Add test for reported add/flush/add issue (Stefano Brivio) [1807892]
  - [net] nft_set_pipapo: Actually fetch key data in nft_pipapo_remove() (Stefano Brivio) [1807892]
  - [net] sched: don't take rtnl lock during flow_action setup (Marcelo Leitner) [1804385]
  - [include] net: sched: refactor ct action helpers to require tcf_lock (Marcelo Leitner) [1804385]
  - [include] net: sched: refactor police action helpers to require tcf_lock (Marcelo Leitner) [1804385]
  - [net] sched: lock action when translating it to flow_action infra (Marcelo Leitner) [1804385]
  - [powerpc] powerpc/smp: Fix NMI IPI xmon timeout (Diego Domingos) [1747320]
  - [powerpc] powerpc/smp: Fix NMI IPI timeout (Diego Domingos) [1747320]
  - [powerpc] powerpc: NMI IPI make NMI IPIs fully sychronous (Diego Domingos) [1747320]
  - [arm64] arm64: select CPUMASK_OFFSTACK if NUMA (Andrea Arcangeli) [1712856]
  - [arm64] arm64: tlb: skip tlbi broadcast (Andrea Arcangeli) [1712856]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-188.el8]
changelog:
  - [block] blk-mq: Keep set->nr_hw_queues and set->map.nr_queues in sync (Ming Lei) [1810523]
  - [block] block: clear REQ_HIPRI if polling is not supported (Ming Lei) [1809506]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-189.el8]
changelog:
  - [netdrv] net/mlx5e: Show/set Rx network flow classification rules on ul rep (Alaa Hleihel) [1795156 1794280]
  - [netdrv] net/mlx5e: Init ethtool steering for representors (Alaa Hleihel) [1795156 1794280]
  - [netdrv] net/mlx5e: Show/set Rx flow indir table and RSS hash key on ul rep (Alaa Hleihel) [1795156 1794280]
  - [netdrv] net/mlx5e: Introduce root ft concept for representors netdevs (Alaa Hleihel) [1795156 1794280]
  - [netdrv] net/mlx5: E-Switch, Use vport metadata matching only when mandatory (Alaa Hleihel) [1795156]
  - [nvme] nvme: log additional message for controller status (David Milburn) [1752952]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-190.el8]
changelog:
  - [powerpc] powerpc/pseries: Avoid NULL pointer dereference when drmem is unavailable (David Hildenbrand) [1812874]
  - [x86] kvm/svm: PKU not currently supported (Wei Huang) [1789159]
  - [x86] Remove the unsupported check for Cooper Lake (David Arcari) [1813921]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-191.el8]
changelog:
  - [netdrv] net/mlx5e: Don't clear the whole vf config when switching modes (mohamad meib) [1814350]
  - [fs] fuse: fix stack use after return (Miklos Szeredi) [1814666]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-192.el8]
changelog:
  - [drm] drm/bochs: downgrade pci_request_region failure from error to warning (Dave Airlie) [1804735]
  - [drm] drm/bochs: deinit bugfix (Dave Airlie) [1804735]
  - [fs] gfs2: fix O_EXCL|O_CREAT handling on cold dcache (Andrew Price) [1811787]
  - [net] esp: remove the skb from the chain when it's enqueued in cryptd_wq (Xin Long) [1807909]
  - [powerpc] powerpc/nvdimm: set target_node properly (Diego Domingos) [1815038]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.el8]
changelog:
  - [kvm] KVM: PPC: Book3S HV: Use __gfn_to_pfn_memslot in HPT page fault handler (Sam Bobroff) [1815491]
  - [net] tcp: also NULL skb->dev when copy was needed (Florian Westphal) [1775961]
  - [net] tcp: ensure skb->dev is NULL before leaving TCP stack (Florian Westphal) [1775961]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.1.1.el8_2]
changelog:
  - [x86] kvm: x86: clear stale x86_emulate_ctxt->intercept value (Jon Maloy) [1824398 1806817] {CVE-2020-2732}
  - [x86] kvm: vmx: check descriptor table exits on instruction emulation (Jon Maloy) [1824398 1806817] {CVE-2020-2732}
  - [x86] kvm: nvmx: Check IO instruction VM-exit conditions (Jon Maloy) [1824398 1806817] {CVE-2020-2732}
  - [x86] kvm: nvmx: Refactor IO bitmap checks into helper function (Jon Maloy) [1824398 1806817] {CVE-2020-2732}
  - [x86] kvm: nvmx: Don't emulate instructions in guest mode (Jon Maloy) [1824398 1806817] {CVE-2020-2732}
  - [sound] ALSA: usb-audio: set the interface format after resume on Dell WD19 (Perry Yuan) [1821376 1807965]
  - [kernel] sched: Avoid scale real weight down to zero (Phil Auld) [1819909 1808562]
  - [netdrv] hv_netvsc: Fix unwanted rx_table reset (Mohammed Gamal) [1817945 1805950]
  - [netdrv] hv_netvsc: Fix tx_table init in rndis_set_subchannel() (Mohammed Gamal) [1817945 1805950]
  - [netdrv] hv_netvsc: Fix send_table offset in case of a host bug (Mohammed Gamal) [1817945 1805950]
  - [netdrv] hv_netvsc: Fix offset usage in netvsc_send_table() (Mohammed Gamal) [1817945 1805950]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.1.2.el8_2]
changelog:
  - [net] netlabel: cope with NULL catmap (Paolo Abeni) [1827249 1827251] {CVE-2020-10711}
  - [mm] s390/mm: fix page table upgrade vs 2ndary address mode accesses (Vladis Dronov) [1828153 1828154] {CVE-2020-11884}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.7.1.el8_2]
changelog:
  - [sound] ALSA: timer: Fix incorrectly assigned timer instance (Jaroslav Kysela) [1821714 1798468] {CVE-2019-19807}
  - [netdrv] ibmvnic: Do not process device remove during device reset (Steve Best) [1836229 1813223]
  - [net] ipv4: really enforce backoff for redirects (Paolo Abeni) [1836302 1834184]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.8.1.el8_2]
changelog:
  - [vfio] vfio-pci: Invalidate mmaps and block MMIO access on disabled memory (Alex Williamson) [1837309 1837310] {CVE-2020-12888}
  - [vfio] vfio-pci: Fault mmaps to enable vma tracking (Alex Williamson) [1837309 1837310] {CVE-2020-12888}
  - [vfio] vfio/type1: Support faulting PFNMAP vmas (Alex Williamson) [1837309 1837310] {CVE-2020-12888}
  - [vfio] vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn() (Alex Williamson) [1837309 1837310] {CVE-2020-12888}
  - [vfio] vfio/pci: call irq_bypass_unregister_producer() before freeing irq (Alex Williamson) [1837309 1837310] {CVE-2020-12888}
  - [vfio] vfio_pci: Enable memory accesses before calling pci_map_rom (Alex Williamson) [1837309 1837310] {CVE-2020-12888}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.9.1.el8_2]
changelog:
  - [wireless] mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status() (Jarod Wilson) [1844073 1844031] {CVE-2020-12654}
  - [wireless] mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv() (Jarod Wilson) [1844049 1844039] {CVE-2020-12653}
  - [netdrv] net/mlx5: FPGA, support network cards with standalone FPGA (Alaa Hleihel) [1843544 1789380]
  - [mm] hugetlbfs: don't retry when pool page allocations start to fail (Rafael Aquini) [1835789 1727288]
  - [mm] mm, compaction: raise compaction priority after it withdrawns (Rafael Aquini) [1835789 1727288]
  - [mm] mm, reclaim: cleanup should_continue_reclaim() (Rafael Aquini) [1835789 1727288]
  - [mm] mm, reclaim: make should_continue_reclaim perform dryrun detection (Rafael Aquini) [1835789 1727288]
  - [kernel] exit: panic before exit_mm() on global init exit (Oleg Nesterov) [1821378 1808944]
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Josh Poimboeuf) [1827191 1827192] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Josh Poimboeuf) [1827191 1827192] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Josh Poimboeuf) [1827191 1827192] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Josh Poimboeuf) [1827191 1827192] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Josh Poimboeuf) [1827191 1827192] {CVE-2020-0543}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.10.1.el8_2]
changelog:
  - [misc] dma-mapping: zero memory returned from dma_alloc_* (Philipp Rudo) [1847453 1788928]
  - [nvme] nvme-multipath: fix crash in nvme_mpath_clear_ctrl_paths (Gopal Tiwari) [1846405 1781927]
  - [net] netfilter: nf_tables: fix infinite loop when expr is not available (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: autoload modules from the abort path (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: remove WARN and add NLA_STRING upper limits (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: store transaction list locally while requesting module (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: use-after-free in failing rule with bound set (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nft_meta: skip EAGAIN if nft_meta_bridge is not a module (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: force module load in case select_ops() returns -EAGAIN (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: add nft_expr_type_request_module() (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: bogus EBUSY in helper removal from transaction (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: fix set double-free in abort path (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nft_compat: don't use refcount_inc on newly allocated entry (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: unbind set in rule from commit path (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nft_compat: destroy function must not have side effects (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nft_compat: make lists per netns (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nft_compat: use refcnt_t type for nft_xt reference count (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: fix suspicious RCU usage in nft_chain_stats_replace() (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: asynchronous release (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: split set destruction in deactivate and destroy phase (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: flow event notifier must use transaction mutex (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: use dedicated mutex to guard transactions (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: avoid global info storage (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: take module reference when starting a batch (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: make valid_genid callback mandatory (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: add and use helper for module autoload (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nat: never update the UDP checksum when it's 0 (Guillaume Nault) [1847128 1794714]
  - [x86] x86/speculation: PR_SPEC_FORCE_DISABLE enforcement for indirect branches (Waiman Long) [1847395 1847396] {CVE-2020-10768}
  - [x86] x86/speculation: Prevent rogue cross-process SSBD shutdown (Waiman Long) [1847357 1847358] {CVE-2020-10766}
  - [x86] x86/speculation: Avoid force-disabling IBPB based on STIBP and enhanced IBRS (Waiman Long) [1847378 1847379] {CVE-2020-10767}
  - [x86] x86/speculation: Add support for STIBP always-on preferred mode (Waiman Long) [1847378 1847379] {CVE-2020-10767}
  - [x86] x86/speculation: Change misspelled STIPB to STIBP (Waiman Long) [1847378 1847379] {CVE-2020-10767}
  - [powerpc] powerpc/pseries/ddw: Extend upper limit for huge DMA window for persistent memory (Steve Best) [1842406 1817596]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.11.1.el8_2]
changelog:
  - [net] netfilter: conntrack: fix infinite loop on rmmod (Florian Westphal) [1851005 1832381]
  - [net] netfilter: conntrack: allow insertion of clashing entries (Florian Westphal) [1851003 1821404]
  - [net] netfilter: conntrack: split resolve_clash function (Florian Westphal) [1851003 1821404]
  - [net] netfilter: conntrack: place confirm-bit setting in a helper (Florian Westphal) [1851003 1821404]
  - [net] netfilter: never get/set skb->tstamp (Florian Westphal) [1851003 1821404]
  - [net] netfilter: conntrack: remove two args from resolve_clash (Florian Westphal) [1851003 1821404]
  - [net] netfilter: conntrack: tell compiler to not inline nf_ct_resolve_clash (Florian Westphal) [1851003 1821404]
  - [x86] mm: Fix mremap not considering huge pmd devmap (Rafael Aquini) [1843440 1843441] {CVE-2020-10757}
  - [x86] x86/vector: Remove warning on managed interrupt migration (Peter Xu) [1848545 1812331]
  - [s390] s390/cio: fix virtio-ccw DMA without PV (Philipp Rudo) [1842620 1814787]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.12.1.el8_2]
changelog:
  - [net] openvswitch: simplify the ovs_dp_cmd_new (Eelco Chaudron) [1851235 1819202]
  - [net] openvswitch: fix possible memleak on destroy flow-table (Eelco Chaudron) [1851235 1819202]
  - [net] openvswitch: add likely in flow_lookup (Eelco Chaudron) [1851235 1819202]
  - [net] openvswitch: simplify the flow_hash (Eelco Chaudron) [1851235 1819202]
  - [net] openvswitch: optimize flow-mask looking up (Eelco Chaudron) [1851235 1819202]
  - [net] openvswitch: optimize flow mask cache hash collision (Eelco Chaudron) [1851235 1819202]
  - [net] openvswitch: shrink the mask array if necessary (Eelco Chaudron) [1851235 1819202]
  - [net] openvswitch: convert mask list in mask array (Eelco Chaudron) [1851235 1819202]
  - [net] openvswitch: add flow-mask cache for performance (Eelco Chaudron) [1851235 1819202]
  - [net] netfilter: nf_tables: use-after-free in dynamic operations (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nf_tables: add missing ->release_ops() in error path of newrule() (Phil Sutter) [1845164 1757933]
  - [net] netfilter: nft_compat: use .release_ops and remove list of extension (Phil Sutter) [1845164 1757933]
  - [vfio] vfio/pci: Fix SR-IOV VF handling with MMIO blocking (Alex Williamson) [1837309 1837310] {CVE-2020-12888}
  - [pci] PCI: pciehp: Fix MSI interrupt race (Myron Stowe) [1852045 1779610]
  - [kernel] smp: Allow smp_call_function_single_async() to insert locked csd (Peter Xu) [1851406 1830014]
  - [x86] kvm: Clean up host's steal time structure (Jon Maloy) [1795128 1813987] {CVE-2019-3016}
  - [x86] kvm: Make sure KVM_VCPU_FLUSH_TLB flag is not missed (Jon Maloy) [1795128 1813987] {CVE-2019-3016}
  - [virt] x86/kvm: Cache gfn to pfn translation (Jon Maloy) [1795128 1813987] {CVE-2019-3016}
  - [virt] x86/kvm: Introduce kvm_(un)map_gfn() (Jon Maloy) [1795128 1813987] {CVE-2019-3016}
  - [x86] kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit (Jon Maloy) [1795128 1813987] {CVE-2019-3016}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.13.1.el8_2]
changelog:
  - [x86] x86/efi: Allocate e820 buffer before calling efi_exit_boot_service (Lenny Szubowicz) [1846180 1824005]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.14.1.el8_2]
changelog:
  - [md] dm mpath: add DM device name to Failing/Reinstating path log messages (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: enhance queue_if_no_path debugging (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: restrict queue_if_no_path state machine (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: simplify __must_push_back (Mike Snitzer) [1852050 1822975]
  - [md] dm: use DMDEBUG macros now that they use pr_debug variants (Mike Snitzer) [1852050 1822975]
  - [include] dm: use dynamic debug instead of compile-time config option (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: switch paths in dm_blk_ioctl() code path (Mike Snitzer) [1852050 1822975]
  - [md] dm multipath: use updated MPATHF_QUEUE_IO on mapping for bio-based mpath (Mike Snitzer) [1852050 1822975]
  - [md] dm: bump version of core and various targets (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: Add timeout mechanism for queue_if_no_path (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: use true_false for bool variable (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: remove harmful bio-based optimization (Mike Snitzer) [1852050 1822975]
  - [scsi] scsi: libiscsi: fall back to sendmsg for slab pages (Maurizio Lombardi) [1852048 1825775]
  - [s390] s390/mm: fix panic in gup_fast on large pud (Philipp Rudo) [1853336 1816980]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.14.2.el8_2]
changelog:
  - [kernel] Move to dual-signing to split signing keys up better (pjones) [1837433 1837434] {CVE-2020-10713}
  - [crypto] pefile: Tolerate other pefile signatures after first (Lenny Szubowicz) [1837433 1837434] {CVE-2020-10713}
  - [acpi] ACPI: configfs: Disallow loading ACPI tables when locked down (Lenny Szubowicz) [1852968 1852969] {CVE-2020-15780}
  - [firmware] efi: Restrict efivar_ssdt_load when the kernel is locked down (Lenny Szubowicz) [1852948 1852949] {CVE-2019-20908}


author: Akemi Yagi <toracat@centos.org> [4.18.0-193.14.2.el8_2.centos.plus]
changelog:
  - Apply debranding changes
  - Modify config file for x86_64 with extra features turned on including some network adapters,
    some SCSI adapters, ReiserFS, TOMOYO
  - Apply patches from CentOS-7 plus kernel
  - Apply driver patches imported from ELRepo
  - Add device IDs that have been removed from RHEL 8 kernels (megaraid_sas and mpt3sas)
  - Apply patches for e1000 from kernel.org [bug#16284]
  - Added a triggerin scriptlet to rebuild the initramfs image
    when the system microcode package is updated [bug#17562]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.15.1.el8_2]
changelog:
  - [wireless] iwlwifi: pcie: handle QuZ configs with killer NICs as well (Jarod Wilson) [1857773 1844129]
  - [wireless] iwlwifi: pcie: move power gating workaround earlier in the flow (Jarod Wilson) [1857773 1844129]
  - [nvme] nvme: fix possible deadlock when nvme_update_formats fails (Gopal Tiwari) [1857115 1781927]
  - [iommu] iommu: move flags field before ids in iommu_fwspec (Jerry Snitselaar) [1856966 1833512]
  - [x86] kvm: x86: only do L1TF workaround on affected processors (Vitaly Kuznetsov) [1857796 1800673]
  - [x86] kvm: x86: create mmu/ subdirectory (Vitaly Kuznetsov) [1857796 1800673]
  - [kvm] KVM: SVM: Override default MMIO mask if memory encryption is enabled (Wei Huang) [1857796 1800673]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.16.1.el8_2]
changelog:
  - [infiniband] IB/rdmavt: Free kernel completion queue when done (Gopal Tiwari) [1857757 1805036]
  - [kernel] Move to dual-signing to split signing keys up better (pjones) [1837433 1837434] {CVE-2020-10713}
  - [crypto] pefile: Tolerate other pefile signatures after first (Lenny Szubowicz) [1837433 1837434] {CVE-2020-10713}
  - [acpi] ACPI: configfs: Disallow loading ACPI tables when locked down (Lenny Szubowicz) [1852968 1852969] {CVE-2020-15780}
  - [firmware] efi: Restrict efivar_ssdt_load when the kernel is locked down (Lenny Szubowicz) [1852948 1852949] {CVE-2019-20908}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.17.1.el8_2]
changelog:
  - [net] netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag (Phil Sutter) [1854531 1847553]
  - [net] netfilter: nf_tables: report EOPNOTSUPP on unsupported flags/object type (Phil Sutter) [1854531 1847553]
  - [s390] s390: prevent leaking kernel address in BEAR (Claudio Imbrenda) [1854986 1850907]
  - [s390] scsi: zfcp: Fix panic on ERP timeout for previously dismissed ERP action (Philipp Rudo) [1861355 1857312]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.18.1.el8_2]
changelog:
  - [security] selinux: allow reading labels before policy is loaded (Ondrej Mosnacek) [1861721 1839819]
  - [security] selinux: allow labeling before policy is loaded (Ondrej Mosnacek) [1861722 1777525]
  - [mm] mm/memory_hotplug.c: only respect mem= parameter during boot stage (Baoquan He) [1854207 1838809]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.19.1.el8_2]
changelog:
  - [net] tcp: add sanity tests in tcp_add_backlog() (Guillaume Nault) [1861378 1790843]
  - [net] tcp: implement coalescing on backlog queue (Guillaume Nault) [1861378 1790843]
  - [include] tcp: make tcp_space() aware of socket backlog (Guillaume Nault) [1861378 1790843]
  - [net] tcp: take care of compressed acks in tcp_add_reno_sack() (Guillaume Nault) [1861378 1790843]
  - [include] tcp: hint compiler about sack flows (Guillaume Nault) [1861378 1790843]
  - [net] tcp: drop dst in tcp_add_backlog() (Guillaume Nault) [1861378 1790843]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.20.1.el8_2]
changelog:
  - [infiniband] IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE (Kamal Heib) [1872771 1850314]
  - [block] blk-mq: Rerun dispatching in the case of budget contention (Ming Lei) [1869779 1824037]
  - [block] blk-mq: Add blk_mq_delay_run_hw_queues() API call (Ming Lei) [1869779 1824037]
  - [block] blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason to kick (Ming Lei) [1869779 1824037]
  - [block] blk-mq: Put driver tag in blk_mq_dispatch_rq_list() when no budget (Ming Lei) [1869779 1824037]
  - [md] dm mpath: use double checked locking in fast path (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: rename current_pgpath to pgpath in multipath_prepare_ioctl (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: rework __map_bio() (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: factor out multipath_queue_bio (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: push locking down to must_push_back_rq() (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: take m->lock spinlock when testing QUEUE_IF_NO_PATH (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: changes from initial m->flags locking audit (Mike Snitzer) [1869386 1848651]
  - [md] dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue() (Mike Snitzer) [1869386 1848651]
  - [md] dm: do not use waitqueue for request-based DM (Mike Snitzer) [1869386 1848651]
  - [block] blk-mq: consider non-idle request as "inflight" in blk_mq_rq_inflight() (Mike Snitzer) [1869386 1848651]
  - [kernel] sched/deadline: Initialize ->dl_boosted (Phil Auld) [1867612 1854179]
  - [kernel] sched/core: Fix PI boosting between RT and DEADLINE tasks (Phil Auld) [1867612 1854179]
  - [net] net/smc: tolerate future SMCD versions (Philipp Rudo) [1866390 1854992]
  - [net] openvswitch: fixes potential deadlock in dp cleanup code (Eelco Chaudron) [1859216 1845662]
  - [net] openvswitch: reorder masks array based on usage (Eelco Chaudron) [1859216 1845662]
  - [net] openvswitch: take into account de-fragmentation/gso_size in execute_check_pkt_len (Lorenzo Bianconi) [1860169 1851888]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.21.1.el8_2]
changelog:
  - [scsi] scsi: ibmvfc: Fix NULL return compiler warning (Steve Best) [1866371 1810653]
  - [scsi] scsi: ibmvfc: Avoid loss of all paths during SVC node reboot (Steve Best) [1866371 1810653]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.22.1.el8_2]
changelog:
  - [crypto] pefile: Support multiple signatures in verify_pefile_signature (Lenny Szubowicz) [1877530 1862072]
  - [crypto] Revert "pefile: Tolerate other pefile signatures after first" (Bruno Meneguele)
  - [infiniband] IB/hfi1: Fix another case where pq is left on waitlist (Kamal Heib) [1872766 1859209]
  - [infiniband] IB/hfi1: Ensure pq is not left on waitlist (Kamal Heib) [1872766 1859209]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.23.1.el8_2]
changelog:
  - [net] packet: fix overflow in tpacket_rcv (Hangbin Liu) [1876223 1876224] {CVE-2020-14386}
  - [net] packet: make tp_drops atomic (Hangbin Liu) [1876223 1876224] {CVE-2020-14386}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.24.1.el8_2]
changelog:
  - [kernel] timers: Remove must_forward_clk (Phil Auld) [1877417 1833096]
  - [kernel] timers: Spare timer softirq until next expiry (Phil Auld) [1877417 1833096]
  - [kernel] timers: Expand clk forward logic beyond nohz (Phil Auld) [1877417 1833096]
  - [kernel] timers: Reuse next expiry cache after nohz exit (Phil Auld) [1877417 1833096]
  - [kernel] timers: Always keep track of next expiry (Phil Auld) [1877417 1833096]
  - [kernel] timers: Optimize _next_timer_interrupt() level iteration (Phil Auld) [1877417 1833096]
  - [kernel] timers: Add comments about calc_index() ceiling work (Phil Auld) [1877417 1833096]
  - [kernel] timers: Move trigger_dyntick_cpu() to enqueue_timer() (Phil Auld) [1877417 1833096]
  - [kernel] timers: Use only bucket expiry for base->next_expiry value (Phil Auld) [1877417 1833096]
  - [kernel] timers: Preserve higher bits of expiration on index calculation (Phil Auld) [1877417 1833096]
  - [kernel] timer: Fix wheel index calculation on last level (Phil Auld) [1877417 1833096]
  - [kernel] timer: Prevent base->clk from moving backward (Phil Auld) [1877417 1833096]
  - [kernel] timer: Read jiffies once when forwarding base clk (Phil Auld) [1877417 1833096]
  - [infiniband] RDMA/umem: Fix ib_umem_find_best_pgsz() (Kamal Heib) [1872424 1856158]
  - [net] net: accept an empty mask in /sys/class/net/*/queues/rx-*/rps_cpus (Nitesh Narayan Lal) [1870181 1868433]
  - [net] net: Restrict receive packets queuing to housekeeping CPUs (Nitesh Narayan Lal) [1867174 1844520]
  - [pci] PCI: Restrict probe functions to housekeeping CPUs (Nitesh Narayan Lal) [1867174 1844520]
  - [lib] lib: Restrict cpumask_local_spread to houskeeping CPUs (Nitesh Narayan Lal) [1867174 1844520]
  - [s390] s390/pci: Fix unexpected write combine on resource (Philipp Rudo) [1869276 1827311]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.25.1.el8_2]
changelog:
  - [net] netfilter: conntrack: proc: rename stat column (Florian Westphal) [1882095 1875681]
  - [net] netfilter: conntrack: add clash resolution stat counter (Florian Westphal) [1882095 1875681]
  - [net] netfilter: conntrack: remove ignore stats (Florian Westphal) [1882095 1875681]
  - [net] netfilter: conntrack: do not increment two error counters at same time (Florian Westphal) [1882095 1875681]
  - [net] netfilter: conntrack: do not auto-delete clash entries on reply (Florian Westphal) [1882095 1875681]
  - [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen) [1881085 1875316] {CVE-2020-14385}
  - [kernel] time/tick-broadcast: Fix tick_broadcast_offline() lockdep complaint (Alexey Klimov) [1880081 1877380]
  - [net] atomics/treewide: Rename __atomic_add_unless() => atomic_fetch_add_unless() (Yauheni Kaliuta) [1880081 1813370]
  - [kernel] timers: Lower base clock forwarding threshold (Phil Auld) [1877417 1833096]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.26.1.el8_2]
changelog:
  - [firmware] efi: don't reserve MOK config table memory region (Kairui Song) [1879988 1878584]
  - [security] integrity: Load certs from the EFI MOK config table (Lenny Szubowicz) [1877528 1868306]
  - [security] integrity: Move import of MokListRT certs to a separate routine (Lenny Szubowicz) [1877528 1868306]
  - [firmware] efi: Support for MOK variable config table (Lenny Szubowicz) [1877528 1868306]
  - [security] efi: Only print errors about failing to get certs if EFI vars are found (Lenny Szubowicz) [1877528 1804969]
  - [fs] ceph: fix inode number handling on arches with 32-bit ino_t (Jeff Layton) [1875787 1866018]
  - [fs] ceph: handle zero-length feature mask in session messages (Jeff Layton) [1875787 1866018]
  - [fs] ceph: fix endianness bug when handling MDS session feature bits (Jeff Layton) [1875787 1866018]
  - [netdrv] net/mlx5e: Fix missing cleanup of ethtool steering during rep rx cleanup (Alaa Hleihel) [1857777 1856660]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.27.1.el8_2]
changelog:
  - [powerpc] powerpc/pseries: Do not initiate shutdown when system is running on UPS (Diego Domingos) [1882243 1870477]
  - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859471 1859472] {CVE-2020-14331}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.28.1.el8_2]
changelog:
  - [net] Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888256 1888258] {CVE-2020-12351}
  - [net] Bluetooth: A2MP: Fix not initializing all members (Gopal Tiwari) [1888906 1888807] {CVE-2020-12352}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.2.1.el8_2]
changelog:
  - [net] vti[6]: fix packet tx through bpf_redirect() in XinY cases (Sabrina Dubroca) [1821375 1795145]
  - [net] xfrm interface: fix packet tx through bpf_redirect() (Sabrina Dubroca) [1821375 1795145]
  - [net] vti[6]: fix packet tx through bpf_redirect() (Sabrina Dubroca) [1821375 1795145]
  - [scripts] redhat: fix modpost.c prerequisites (Frantisek Hrbata) [1828229 1818499]
  - [infiniband] IB/core: Avoid deadlock during netlink message handling (Kamal Heib) [1821381 1818986]
  - [infiniband] RDMA/core: Support netlink commands in non init_net net namespaces (Kamal Heib) [1821381 1818986]
  - [misc] mei: me: add comet point (lake) H device ids (Ken Cox) [1825262 1815355]
  - [misc] mei: me: add comet point (lake) LP device ids (Ken Cox) [1825262 1815355]
  - [misc] mei: define dma ring buffer sizes for PCH12 HW and newer (Ken Cox) [1825262 1815355]
  - [misc] mei: hbm: define dma ring setup protocol (Ken Cox) [1825262 1815355]
  - [net] SUNRPC: fix krb5p mount to provide large enough buffer in rq_rcvsize (Steve Dickson) [1826219 1825388]
  - [mm] mm, numa: fix bad pmd by atomically check for pmd_trans_huge when marking page tables prot_numa (Rafael Aquini) [1827619 1763878]
  - [mm] mm: thp: fix flags for pmd migration when split (Rafael Aquini) [1827619 1763878]
  - [mm] mm: thp: relocate flush_cache_range() in migrate_misplaced_transhuge_page() (Rafael Aquini) [1827619 1763878]
  - [mm] mm: thp: fix mmu_notifier in migrate_misplaced_transhuge_page() (Rafael Aquini) [1827619 1763878]
  - [mm] mm: thp: fix MADV_DONTNEED vs migrate_misplaced_transhuge_page race condition (Rafael Aquini) [1827619 1763878]
  - [md] Revert "dm: always call blk_queue_split() in dm_process_bio()" (Mike Snitzer) [1821382 1820705]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.3.1.el8_2]
changelog:
  - [kernel] sched/isolation: Allow "isolcpus=" to skip unknown sub-parameters (Peter Xu) [1832367 1799014]
  - [firmware] efi: fix a mistype in comments mentioning efivar_entry_iter_begin() (Vladis Dronov) [1829527 1804417]
  - [firmware] efi: add a sanity check to efivar_store_raw() (Vladis Dronov) [1829527 1804417]
  - [firmware] efi: fix a race and a buffer overflow while reading efivars via sysfs (Vladis Dronov) [1829527 1804417]
  - [net] net/smc: keep vlan_id for SMC-R in smc_listen_work() (Philipp Rudo) [1827631 1796890]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.4.1.el8_2]
changelog:
  - [bluetooth] Revert "Bluetooth: btusb: driver to enable the usb-wakeup feature" (Gopal Tiwari) [1827620 1811534]
  - [net] netlabel: cope with NULL catmap (Paolo Abeni) [1827249 1827251] {CVE-2020-10711}
  - [mm] s390/mm: fix page table upgrade vs 2ndary address mode accesses (Vladis Dronov) [1828153 1828154] {CVE-2020-11884}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.6.1.el8_2]
changelog:
  - [char] tpm: ibmvtpm: retry on H_CLOSED in tpm_ibmvtpm_send() (Steve Best) [1827632 1808048]
  - [netdrv] bonding: fix active-backup transition after link failure (Jarod Wilson) [1838477 1819408]
  - [netdrv] bonding: fix state transition issue in link monitoring (Jarod Wilson) [1838477 1819408]
  - [kernel] sched/fair: Allow a per-CPU kthread waking a task to stack on the same CPU, to fix XFS performance regression (Phil Auld) [1834517 1745111]
  - [block] block, bfq: fix use-after-free in bfq_idle_slice_timer_body (Ming Lei) [1835531 1835532] {CVE-2020-12657}
  - [kvm] KVM: x86: use raw clock values consistently (Marcelo Tosatti) [1822498 1768622]
  - [kvm] KVM: x86: reorganize pvclock_gtod_data members (Marcelo Tosatti) [1822498 1768622]
  - [kvm] KVM: x86: switch KVMCLOCK base to monotonic raw clock (Marcelo Tosatti) [1822498 1768622]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.6.2.el8_2]
changelog:
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Josh Poimboeuf) [1827191 1827192] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Josh Poimboeuf) [1827191 1827192] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Josh Poimboeuf) [1827191 1827192] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Josh Poimboeuf) [1827191 1827192] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Josh Poimboeuf) [1827191 1827192] {CVE-2020-0543}


author: Akemi Yagi <toracat@centos.org> [4.18.0-193.6.3.el8_2.centos.plus]
changelog:
  - Apply debranding changes
  - Modify config file for x86_64 with extra features turned on including some network adapters,
    some SCSI adapters, ReiserFS, TOMOYO
  - Apply patches from CentOS-7 plus kernel
  - Apply driver patches imported from ELRepo
  - Add device IDs that have been removed from RHEL 8 kernels (megaraid_sas and mpt3sas)
  - Apply patches for e1000 from kernel.org [bug#16284]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-185.el8]
changelog:
  - [fs] NFS: Add deferred cache invalidation for close-to-open consistency violations (Benjamin Coddington) [1803162]
  - [block] nbd: fix stack corruption in nbd_check_sock_type() (Ming Lei) [1803664]
  - [mm] mm/vmscan.c: don't round up scan size for online memory cgroup (Aristeu Rozanski) [1775691]
  - [tools] selftests/bpf: fix clearing buffered output between tests/subtests (Yauheni Kaliuta) [1786006]
  - [tools] libbpf: avoid usage of __builtin_preserve_field_info (Yauheni Kaliuta) [1786006]
  - [tools] selftests/bpf: samples/bpf: fix Split off legacy stuff from bpf_helpers.h (Yauheni Kaliuta) [1786006]
  - [tools] libbpf: fix Make DECLARE_LIBBPF_OPTS macro strictly a variable declaration (Yauheni Kaliuta) [1786006]
  - [tools] selftests: fix too long argument (Yauheni Kaliuta) [1786006]
  - [tools] libbpf: Add BPF-side definitions of supported field relocation kinds (Yauheni Kaliuta) [1786006]
  - [tools] selftests/bpf: add sub-tests support for test_progs (Yauheni Kaliuta) [1786006]
  - [tools] selftests/bpf: abstract away test log output (Yauheni Kaliuta) [1786006]
  - [tools] selftest/bpf: centralize libbpf logging management for test_progs (Yauheni Kaliuta) [1786006]
  - [tools] selftests/bpf: prevent headers to be compiled as C code (Yauheni Kaliuta) [1786006]
  - [tools] selftests/bpf: add test selectors by number and name to test_progs (Yauheni Kaliuta) [1786006]
  - [tools] selftests/bpf: revamp test_progs to allow more control (Yauheni Kaliuta) [1786006]
  - [net] core: Don't skip generic XDP program execution for cloned SKBs (Jiri Benc) [1802507]
  - [tools] selftests/bpf: De-flake test_tcpbpf (Jiri Benc) [1802507]
  - [net] bpf, sockmap: Check update requirements after locking (Jiri Benc) [1802507]
  - [net] bpf, sockhash: Synchronize_rcu before free'ing map (Jiri Benc) [1802507]
  - [net] bpf, sockmap: Don't sleep while holding RCU lock on tear-down (Jiri Benc) [1802507]
  - [net] net: bpf: Don't leak time wait and request sockets (Jiri Benc) [1802507]
  - [net] bpf/sockmap: Read psock ingress_msg before sk_receive_queue (Jiri Benc) [1802507]
  - [net] bpf: Clear skb->tstamp in bpf_redirect when necessary (Jiri Benc) [1802507]
  - [net] xdp: obtain the mem_id mutex before trying to remove an entry (Jiri Benc) [1802507]
  - [net] page_pool: do not release pool until inflight == 0 (Jiri Benc) [1802507]
  - [net] xsk: Fix registration of Rx-only sockets (Jiri Benc) [1802507]
  - [net] xsk: avoid store-tearing when assigning umem (Jiri Benc) [1802507]
  - [net] xsk: avoid store-tearing when assigning queues (Jiri Benc) [1802507]
  - [tools] bpftool: Don't crash on missing xlated program instructions (Jiri Benc) [1802507]
  - [tools] bpftool: Fix printing incorrect pointer in btf_dump_ptr (Jiri Benc) [1802507]
  - [tools] bpftool: Don't crash on missing jited insns or ksyms (Jiri Benc) [1802507]
  - [tools] bpftool: Match several programs with same tag (Jiri Benc) [1802507]
  - [tools] libbpf: Fix realloc usage in bpf_core_find_cands (Jiri Benc) [1802507]
  - [tools] libbpf: Add missing newline in opts validation macro (Jiri Benc) [1802507]
  - [tools] libbpf: Don't attach perf_buffer to offline/missing CPUs (Jiri Benc) [1802507]
  - [tools] libbpf: Extract and generalize CPU mask parsing logic (Jiri Benc) [1802507]
  - [tools] libbpf: Fix printf compilation warnings on ppc64le arch (Jiri Benc) [1802507]
  - [tools] libbpf: Fix sym->st_value print on 32-bit arches (Jiri Benc) [1802507]
  - [tools] libbpf: Make btf__resolve_size logic always check size error condition (Jiri Benc) [1802507]
  - [tools] libbpf: Fix another potential overflow issue in bpf_prog_linfo (Jiri Benc) [1802507]
  - [tools] libbpf: Fix potential overflow issue (Jiri Benc) [1802507]
  - [tools] libbpf: Fix memory leak/double free issue (Jiri Benc) [1802507]
  - [tools] libbpf: Fix off-by-one error in ELF sanity check (Jiri Benc) [1802507]
  - [tools] selftests/bpf: Fix test_attach_probe (Jiri Benc) [1802507]
  - [kernel] bpf: Fix bpf_event_output re-entry issue (Jiri Benc) [1802507]
  - [net] bpf: Fix incorrect verifier simulation of ARSH under ALU32 (Jiri Benc) [1802507]
  - [net] bpf: Fix passing modified ctx to ld/abs/ind instruction (Jiri Benc) [1802507]
  - [net] bpf: cgroup: prevent out-of-order release of cgroup bpf (Jiri Benc) [1802507]
  - [net] bpf: Fix precision tracking for unbounded scalars (Jiri Benc) [1802507]
  - [net] bpf: Fix cgroup local storage prog tracking (Jiri Benc) [1802507]
  - [net] bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack() (Jiri Benc) [1802507]
  - [net] bpf, offload: Unlock on error in bpf_offload_dev_create() (Jiri Benc) [1802507]
  - [powerpc] powerpc/bpf: Fix tail call implementation (Jiri Benc) [1802507]
  - [net] bpf: Fix use after free in bpf_get_prog_name (Jiri Benc) [1802507]
  - [net] bpf: Fix use after free in subprog's jited symbol removal (Jiri Benc) [1802507]
  - [uapi] bpf: fix BTF limits (Jiri Benc) [1802507]
  - [net] bpf: fix BTF verification of enums (Jiri Benc) [1802507]
  - [netdrv] ice: Don't tell the OS that link is going down (Jonathan Toppins) [1792670]
  - [powerpc] powerpc/powernv: implement opal_put_chars_atomic (Steve Best) [1806254]
  - [tty] powerpc/powernv: move opal console flushing to udbg (Steve Best) [1806254]
  - [powerpc] powerpc/powernv: Remove OPALv1 support from opal console driver (Steve Best) [1806254]
  - [powerpc] powerpc/powernv: Implement and use opal_flush_console (Steve Best) [1806254]
  - [powerpc] powerpc/powernv: opal-kmsg use flush fallback from console code (Steve Best) [1806254]
  - [powerpc] powerpc/powernv: opal-kmsg standardise OPAL_BUSY handling (Steve Best) [1806254]
  - [powerpc] powerpc/powernv: Fix OPAL console driver OPAL_BUSY loops (Steve Best) [1806254]
  - [powerpc] powerpc/powernv: opal_put_chars partial write fix (Steve Best) [1806254]
  - [x86] Mark Comet Lake-S as supported (David Arcari) [1805754]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-186.el8]
changelog:
  - [netdrv] Revert "r8169: don't use MSI before RTL8168d" (Josef Oskera) [1792839]
  - [drm] drm/nouveau/kms/gv100-: Re-set LUT after clearing for modesets (Ben Skeggs) [1789026]
  - [drm] drm/nouveau/disp/gv100-: not all channel types support reporting error codes (Ben Skeggs) [1789481]
  - [drm] drm/nouveau/disp/nv50-: prevent oops when no channel method map provided (Ben Skeggs) [1789481]
  - [fs] cifs: don't leak -EAGAIN for stat() during reconnect (Dave Wysochanski) [1769599]
  - [block] blk-mq: insert passthrough request into hctx->dispatch directly (Ming Lei) [1788728]
  - [scsi] scsi: megaraid_sas: fixup MSIx interrupt setup during resume (Tomas Henzl) [1805353]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-232.el8]
changelog:
  - [fs] nfs: nfs_file_write() should check for writeback errors (Scott Mayhew) [1852788]
  - [s390] s390/cpum_cf, perf: change DFLT_CCERROR counter name (Philipp Rudo) [1865794]
  - [net] net/smc: unique reason code for exceeded max dmb count (Philipp Rudo) [1865792]
  - [s390] s390/ism: indicate correct error reason in ism_alloc_dmb() (Philipp Rudo) [1865792]
  - [net] net/smc: fix dmb buffer shortage (Philipp Rudo) [1865792]
  - [net] net/smc: put slot when connection is killed (Philipp Rudo) [1865792]
  - [net] net/smc: fix restoring of fallback changes (Philipp Rudo) [1865792]
  - [net] net/smc: remove freed buffer from list (Philipp Rudo) [1865792]
  - [net] net/smc: do not call dma sync for unmapped memory (Philipp Rudo) [1865792]
  - [net] net/smc: fix handling of delete link requests (Philipp Rudo) [1865792]
  - [net] net/smc: move add link processing for new device into llc layer (Philipp Rudo) [1865792]
  - [net] net/smc: drop out-of-flow llc response messages (Philipp Rudo) [1865792]
  - [net] net/smc: protect smc ib device initialization (Philipp Rudo) [1865792]
  - [net] net/smc: fix link lookup for new rdma connections (Philipp Rudo) [1865792]
  - [net] net/smc: clear link during SMC client link down processing (Philipp Rudo) [1865792]
  - [net] net/smc: handle unexpected response types for confirm link (Philipp Rudo) [1865792]
  - [net] net/smc: switch smcd_dev_list spinlock to mutex (Philipp Rudo) [1865792]
  - [net] net/smc: fix sleep bug in smc_pnet_find_roce_resource() (Philipp Rudo) [1865792]
  - [net] net/smc: fix work request handling (Philipp Rudo) [1865792]
  - [net] net/smc: separate LLC wait queues for flow and messages (Philipp Rudo) [1865792]
  - [net] net/smc: pre-fetch send buffer outside of send_lock (Philipp Rudo) [1865792]
  - [nvme] nvme-fc: set max_segments to lldd max value (Ewan Milne) [1853181]
  - [powerpc] ppc64/kexec_file: enable early kernel's OPAL calls (Diego Domingos) [1829715]
  - [powerpc] ppc64/kexec_file: fix kexec load failure with lack of memory hole (Diego Domingos) [1829715]
  - [powerpc] ppc64/kexec_file: add appropriate regions for memory reserve map (Diego Domingos) [1829715]
  - [powerpc] ppc64/kexec_file: prepare elfcore header for crashing kernel (Diego Domingos) [1829715]
  - [powerpc] ppc64/kexec_file: setup backup region for kdump kernel (Diego Domingos) [1829715]
  - [powerpc] ppc64/kexec_file: restrict memory usage of kdump kernel (Diego Domingos) [1829715]
  - [mm] powerpc/drmem: make lmb walk a bit more flexible (Diego Domingos) [1829715]
  - [powerpc] ppc64/kexec_file: avoid stomping memory used by special regions (Diego Domingos) [1829715]
  - [powerpc] powerpc/kexec_file: add helper functions for getting memory ranges (Diego Domingos) [1829715]
  - [powerpc] powerpc/kexec_file: mark PPC64 specific code (Diego Domingos) [1829715]
  - [kernel] kexec_file: allow archs to handle special regions while locating memory hole (Diego Domingos) [1829715]
  - [netdrv] net/mlx5e: CT: Support restore ipv6 tunnel (Alaa Hleihel) [1862975]
  - [netdrv] ionic: unlock queue mutex in error path (Jonathan Toppins) [1854270]
  - [netdrv] ionic: use mutex to protect queue operations (Jonathan Toppins) [1854270]
  - [net] xfrm: esp6: fix the location of the transport header with encapsulation (Sabrina Dubroca) [1857653]
  - [net] ipv4: fill fl4_icmp_{type, code} in ping_v4_sendmsg (Sabrina Dubroca) [1861324]
  - [netdrv] geneve: fix an uninitialized value in geneve_changelink() (Sabrina Dubroca) [1860945]
  - [net] ip_tunnel: fix use-after-free in ip_tunnel_lookup() (Sabrina Dubroca) [1860945]
  - [netdrv] vxlan: Avoid infinite loop when suppressing NS messages with invalid options (Sabrina Dubroca) [1860945]
  - [tools] selftests: mptcp: capture pcap on both sides (Hangbin Liu) [1859880]
  - [tools] selftests/net: report etf errors correctly (Hangbin Liu) [1859880]
  - [tools] selftests: net: ip_defrag: ignore EPERM (Hangbin Liu) [1859880]
  - [tools] selftests: forwarding: pedit_dsfield: Check counter value (Hangbin Liu) [1859880]
  - [tools] selftests: net: tcp_mmap: fix SO_RCVLOWAT setting (Hangbin Liu) [1859880]
  - [tools] selftests: net: tcp_mmap: clear whole tcp_zerocopy_receive struct (Hangbin Liu) [1859880]
  - [tools] selftests: A few improvements to fib_nexthops.sh (Hangbin Liu) [1859880]
  - [tools] selftests: Add tests for vrf and xfrms (Hangbin Liu) [1859880]
  - [tools] selftests: pmtu: implement IPIP, SIT and ip6tnl PMTU discovery tests (Hangbin Liu) [1859880]
  - [tools] selftests/net/forwarding: define libs as TEST_PROGS_EXTENDED (Hangbin Liu) [1859880]
  - [tools] selftests/net/forwarding: add Makefile to install tests (Hangbin Liu) [1859880]
  - [tools] selftests: nft_concat_range: Move option for 'list ruleset' before command (Hangbin Liu) [1859880]
  - [tools] selftests: netfilter: use randomized netns names (Hangbin Liu) [1859880]
  - [tools] kselftests: netfilter: fix leftover net/net-next merge conflict (Hangbin Liu) [1859880]
  - [tools] selftests: netfilter: missing error check when setting up veth interface (Hangbin Liu) [1859880]
  - [net] sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket (Xin Long) [1860673]
  - [net] sctp: check assoc before SCTP_ADDR_{MADE_PRIM, ADDED} event (Xin Long) [1860673]
  - [net] sctp: fix typo sctp_ulpevent_nofity_peer_addr_change (Xin Long) [1860673]
  - [net] sctp: Fix spelling in Kconfig help (Xin Long) [1860673]
  - [net] sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed (Xin Long) [1860673]
  - [net] sctp: Don't add the shutdown timer if its already been added (Xin Long) [1860673]
  - [net] sctp: Fix SHUTDOWN CTSN Ack in the peer restart case (Xin Long) [1860673]
  - [net] sctp: Fix bundling of SHUTDOWN with COOKIE-ACK (Xin Long) [1860673]
  - [net] ip6_vti: use IS_REACHABLE to avoid some compile errors (Xin Long) [1840976 1835075]
  - [net] xfrm: interface: use IS_REACHABLE to avoid some compile errors (Xin Long) [1840976 1835075]
  - [net] xfrm: interface: not xfrmi_ipv6/ipip_handler twice (Xin Long) [1840976 1835075]
  - [net] ip6_vti: not register vti_ipv6_handler twice (Xin Long) [1840976 1835075]
  - [net] ip_vti: not register vti_ipip_handler twice (Xin Long) [1840976 1835075]
  - [net] xfrm: interface: support IPIP and IPIP6 tunnels processing with .cb_handler (Xin Long) [1840976 1835075]
  - [net] xfrm: interface: support IP6IP6 and IP6IP tunnels processing with .cb_handler (Xin Long) [1840976 1835075]
  - [net] ipcomp: assign if_id to child tunnel from parent tunnel (Xin Long) [1840976 1835075]
  - [net] ip6_vti: support IP6IP tunnel processing (Xin Long) [1840976 1835075]
  - [net] ip6_vti: support IP6IP6 tunnel processing with .cb_handler (Xin Long) [1840976 1835075]
  - [net] ip_vti: support IPIP6 tunnel processing (Xin Long) [1840976 1835075]
  - [net] ip_vti: support IPIP tunnel processing with .cb_handler (Xin Long) [1840976 1835075]
  - [net] tunnel6: add tunnel6_input_afinfo for ipip and ipv6 tunnels (Xin Long) [1840976 1835075]
  - [net] tunnel4: add cb_handler to struct xfrm_tunnel (Xin Long) [1840976 1835075]
  - [net] xfrm: add is_ipip to struct xfrm_input_afinfo (Xin Long) [1840976 1835075]
  - [net] tunnel6: support for IPPROTO_MPLS (Xin Long) [1840976 1835075]
  - [net] virtio_vsock: Enhance connection semantics (Stefano Garzarella) [1861735]
  - [net] virtio_vsock: Fix race condition in virtio_transport_recv_pkt (Stefano Garzarella) [1858135]
  - [net] vsock/virtio: annotate 'the_virtio_vsock' RCU pointer (Stefano Garzarella) [1861762]
  - [vhost] vsock/virtio: fix multiple packet delivery to monitoring devices (Stefano Garzarella) [1861762]
  - [vhost] vsock: fix packet delivery order to monitoring devices (Stefano Garzarella) [1861762]
  - [vhost] vsock: accept only packets with the right dst_cid (Stefano Garzarella) [1861762]
  - [vhost] vsock: refuse CID assigned to the guest->host transport (Stefano Garzarella) [1861762]
  - [vhost] vsock: switch to a mutex for vhost_vsock_hash (Stefano Garzarella) [1861762]
  - [net] vsock: fix timeout in vsock_accept() (Stefano Garzarella) [1861762]
  - [net] vsock: Simplify '__vsock_release()' (Stefano Garzarella) [1861762]
  - [netdrv] net/mlx5e: Fix kernel crash when setting vf VLANID on a VF dev (Alaa Hleihel) [1859477]
  - [netdrv] net/mlx5e: Modify uplink state on interface up/down (Alaa Hleihel) [1861720 1859477]
  - [netdrv] net/mlx5e: Fix missing cleanup of ethtool steering during rep rx cleanup (Alaa Hleihel) [1859477 1856660]
  - [netdrv] ixgbe: Add ethtool support to enable 2.5 and 5.0 Gbps support (Ken Cox) [1835962]
  - [x86] x86/purgatory: Add -fno-stack-protector (Lianbo Jiang) [1857528]
  - [x86] x86/purgatory: Fail the build if purgatory.ro has missing symbols (Lianbo Jiang) [1857528]
  - [x86] x86/purgatory: Do not use __builtin_memcpy and __builtin_memset (Lianbo Jiang) [1857528]
  - [x86] x86/boot: Provide KASAN compatible aliases for string routines (Lianbo Jiang) [1857528]
  - [x86] x86/purgatory: Disable various profiling and sanitizing options (Lianbo Jiang) [1857528]
  - [x86] x86/boot: Restrict header scope to make Clang happy (Lianbo Jiang) [1857528]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-233.el8]
changelog:
  - [fs] nfs: ensure correct writeback errors are returned on close() (Scott Mayhew) [1849424]
  - [netdrv] net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task() (Dean Nelson) [1824858]
  - [crypto] crypto: ecc - SP800-56A rev 3 local public key validation (Herbert Xu) [1855817]
  - [crypto] crypto: dh - SP800-56A rev 3 local public key validation (Herbert Xu) [1855817]
  - [crypto] crypto: dh - check validity of Z before export (Herbert Xu) [1855817]
  - [lib] lib/mpi: Add mpi_sub_ui() (Herbert Xu) [1855817]
  - [crypto] crypto: ecdh - check validity of Z before export (Herbert Xu) [1855817]
  - [netdrv] net: thunderx: initialize VF's mailbox mutex before first usage (Dean Nelson) [1866827]
  - [kernel] timers: Lower base clock forwarding threshold (Phil Auld) [1833096]
  - [kernel] timers: Remove must_forward_clk (Phil Auld) [1833096]
  - [kernel] timers: Spare timer softirq until next expiry (Phil Auld) [1833096]
  - [kernel] timers: Expand clk forward logic beyond nohz (Phil Auld) [1833096]
  - [kernel] timers: Reuse next expiry cache after nohz exit (Phil Auld) [1833096]
  - [kernel] timers: Always keep track of next expiry (Phil Auld) [1833096]
  - [kernel] timers: Optimize _next_timer_interrupt() level iteration (Phil Auld) [1833096]
  - [kernel] timers: Add comments about calc_index() ceiling work (Phil Auld) [1833096]
  - [kernel] timers: Move trigger_dyntick_cpu() to enqueue_timer() (Phil Auld) [1833096]
  - [kernel] timers: Use only bucket expiry for base->next_expiry value (Phil Auld) [1833096]
  - [kernel] timers: Preserve higher bits of expiration on index calculation (Phil Auld) [1833096]
  - [kernel] timer: Fix wheel index calculation on last level (Phil Auld) [1833096]
  - [kernel] timer: Prevent base->clk from moving backward (Phil Auld) [1833096]
  - [kernel] timer: Read jiffies once when forwarding base clk (Phil Auld) [1833096]
  - [powerpc] powerpc/64: Update Speculation_Store_Bypass in /proc/<pid>/status (Gustavo Duarte) [1773868]
  - [scsi] scsi: virtio-scsi: Correctly handle the case where all LUNs are unplugged (Maxim Levitsky) [1756093]
  - [kvm] kvm: x86: replace kvm_spec_ctrl_test_value with runtime test on the host (Maxim Levitsky) [1853447]
  - [kvm] x86/kvm: Move context tracking where it belongs (Nitesh Narayan Lal) [1854011]
  - [scsi] scsi: megaraid_sas: Clear affinity hint (Tomas Henzl) [1828351]
  - [netdrv] revert "vxlan: fix tos value before xmit" (Andrea Claudi) [1862166]
  - [net] udp: Copy has_conns in reuseport_grow(). (Marcelo Leitner) [1867160]
  - [net] dev: Defer free of skbs in flush_backlog (Marcelo Leitner) [1867160]
  - [include] net: core: reduce recursion limit value (Marcelo Leitner) [1867160]
  - [netdrv] pppoe: only process PADT targeted at local interfaces (Andrea Claudi) [1866850]
  - [net] espintcp: count packets dropped in espintcp_rcv (Sabrina Dubroca) [1866393]
  - [net] espintcp: handle short messages instead of breaking the encap socket (Sabrina Dubroca) [1866393]
  - [net] espintcp: recv() should return 0 when the peer socket is closed (Sabrina Dubroca) [1866393]
  - [net] espintcp: support non-blocking sends (Sabrina Dubroca) [1866393]
  - [net] mptcp: be careful on subflow creation (Davide Caratti) [1862200]
  - [net] mptcp: fix bogus sendmsg() return code under pressure (Davide Caratti) [1862200]
  - [net] mptcp: fix joined subflows with unblocking sk (Davide Caratti) [1862200]
  - [net] subflow: explicitly check for plain tcp rsk (Davide Caratti) [1862200]
  - [net] mptcp: silence warning in subflow_data_ready() (Davide Caratti) [1862200]
  - [net] mptcp: fix race in subflow_data_ready() (Davide Caratti) [1862200]
  - [net] mptcp: fix memory leak in mptcp_subflow_create_socket() (Davide Caratti) [1862200]
  - [net] mptcp: don't leak msk in token container (Davide Caratti) [1862200]
  - [net] ipv4: Silence suspicious RCU usage warning (Guillaume Nault) [1866430]
  - [net] devinet: fix memleak in inetdev_init() (Guillaume Nault) [1866430]
  - [net] ipip: fix wrong address family in init error path (Guillaume Nault) [1866430]
  - [net] inet_csk: Fix so_reuseport bind-address cache in tb->fast* (Guillaume Nault) [1866430]
  - [net] ipmr: Add lockdep expression to ipmr_for_each_table macro (Guillaume Nault) [1866430]
  - [net] ipmr: Fix RCU list debugging warning (Guillaume Nault) [1866430]
  - [net] tcp: make sure listeners don't initialize congestion-control state (Paolo Abeni) [1865904]
  - [net] sched: The error lable position is corrected in ct_init_module (Davide Caratti) [1865890]
  - [net] sched: cls_api: fix nooffloaddevcnt warning dmesg log (Davide Caratti) [1865890]
  - [net] tls: fix race condition causing kernel panic (Sabrina Dubroca) [1861756]
  - [net] tls: free record only on encryption error (Sabrina Dubroca) [1861756]
  - [net] tls: fix encryption error checking (Sabrina Dubroca) [1861756]
  - [net] l2tp: add sk_family checks to l2tp_validate_socket (Guillaume Nault) [1861453]
  - [net] l2tp: do not use inet_hash()/inet_unhash() (Guillaume Nault) [1861453]
  - [net] tipc: allow to build NACK message in link timeout function (Xin Long) [1860877]
  - [net] tipc: fix retransmission on unicast links (Xin Long) [1860877]
  - [net] tipc: fix NULL pointer dereference in tipc_disc_rcv() (Xin Long) [1860877]
  - [net] tipc: remove set but not used variable 'prev' (Xin Long) [1860877]
  - [net] tipc: call tsk_set_importance from tipc_topsrv_create_listener (Xin Long) [1860877]
  - [net] tipc: add support for broadcast rcv stats dumping (Xin Long) [1860877]
  - [net] tipc: enable broadcast retrans via unicast (Xin Long) [1860877]
  - [net] tipc: add back link trace events (Xin Long) [1860877]
  - [net] tipc: introduce Gap ACK blocks for broadcast link (Xin Long) [1860877]
  - [net] tipc: block BH before using dst_cache (Xin Long) [1860877]
  - [net] tipc: fix partial topology connection closure (Xin Long) [1860877]
  - [net] xfrm: policy: match with both mark and mask on user interfaces (Xin Long) [1854116]
  - [scsi] scsi: dh: Add Fujitsu device to devinfo and dh lists (Ewan Milne) [1861418]
  - [x86] kvm: Set KVM_SOFT_MAX_VCPUS to 1024 (Eduardo Habkost) [1856996]
  - [md] dm integrity: fix integrity recalculation that is improperly skipped (Mike Snitzer) [1860160]
  - [netdrv] ibmvnic: Fix IRQ mapping disposal in error path (Steve Best) [1867498]
  - [infiniband] IB/hfi1: Do not destroy link_wq when the device is shut down (Kamal Heib) [1858392]
  - [infiniband] IB/hfi1: Do not destroy hfi1_wq when the device is shut down (Kamal Heib) [1858392]
  - [netdrv] Revert "net/broadcom: Clean broadcom code from driver versions" (Jonathan Toppins) [1867146]
  - [net] devmap: Use bpf_map_area_alloc() for allocating hash buckets (Jiri Benc) [1842380]
  - [kernel] kexec_file: Correctly output debugging information for the PT_LOAD ELF header (Lianbo Jiang) [1861186]
  - [kernel] kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges (Lianbo Jiang) [1861186]
  - [x86] x86/crash: Correct the address boundary of function parameters (Lianbo Jiang) [1861186]
  - [fs] ceph: handle zero-length feature mask in session messages (Jeff Layton) [1866018]
  - [s390] s390/bpf: Tolerate not converging code shrinking (Yauheni Kaliuta) [1857120]
  - [s390] s390/bpf: Use brcl for jumping to exit_ip if necessary (Yauheni Kaliuta) [1857120]
  - [s390] s390/bpf: Fix sign extension in branch_ku (Yauheni Kaliuta) [1857120]
  - [tools] selftests: bpf: test_kmod.sh: Fix running out of srctree (Yauheni Kaliuta) [1857120]
  - [lib] bpf: revert "test_bpf: Flag tests that cannot be jited on s390" (Yauheni Kaliuta) [1857120]
  - [kernel] uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned (Oleg Nesterov) [1848596]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-234.el8]
changelog:
  - [netdrv] vrf: Fix IPv6 with qdisc and xfrm (Sabrina Dubroca) [1868565]
  - [netdrv] vrf: make sure skb->data contains ip header to make routing (Sabrina Dubroca) [1868565]
  - [netdrv] vrf: Check skb for XFRM_TRANSFORMED flag (Sabrina Dubroca) [1868565]
  - [net] Do not clear the sock TX queue in sk_set_socket() (Andrea Claudi) [1850421]
  - [net] Use RCU_INIT_POINTER() to set sk_wq (Andrea Claudi) [1850421]
  - [net] netfilter: ip6tables: Add a .pre_exit hook in all ip6table_foo.c. (Florian Westphal) [1862384]
  - [net] netfilter: iptables: Add a .pre_exit hook in all iptable_foo.c. (Florian Westphal) [1862384]
  - [net] netfilter: ipset: Fix an error code in ip_set_sockfn_get() (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: Don't account for expired elements on insertion (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: Drop spurious condition for overlap detection on insertion (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: Detect partial overlaps on insertion (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() (Florian Westphal) [1862384]
  - [net] netfilter: nf_tables: fix nat hook table deletion (Florian Westphal) [1862384]
  - [net] netfilter: ipset: call ip_set_free() instead of kfree() (Florian Westphal) [1862384]
  - [net] netfilter: ip6tables: Split ip6t_unregister_table() into pre_exit and exit helpers. (Florian Westphal) [1862384]
  - [net] netfilter: iptables: Split ipt_unregister_table() into pre_exit and exit helpers. (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_pipapo: Disable preemption before getting per-CPU pointer (Florian Westphal) [1862384]
  - [net] netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported (Florian Westphal) [1862384]
  - [net] netfilter: conntrack: comparison of unsigned in cthelper confirmation (Florian Westphal) [1862384]
  - [net] netfilter: conntrack: refetch conntrack after nf_conntrack_update() (Florian Westphal) [1862384]
  - [net] netfilter: conntrack: Pass value of ctinfo to __nf_conntrack_update (Florian Westphal) [1862384]
  - [net] netfilter: conntrack: make conntrack userspace helpers work again (Florian Westphal) [1862384]
  - [net] netfilter: nfnetlink_cthelper: unbreak userspace helper support (Florian Westphal) [1862384]
  - [net] netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build (Florian Westphal) [1862384]
  - [net] netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_bitmap: initialize set element extension in lookups (Florian Westphal) [1862384]
  - [net] netfilter: nft_fwd_netdev: validate family and chain type (Florian Westphal) [1862384]
  - [net] netfilter: nft_payload: add missing attribute validation for payload csum flags (Florian Westphal) [1862384]
  - [net] netfilter: cthelper: add missing attribute validation for cthelper (Florian Westphal) [1862384]
  - [net] netfilter: ipset: Fix forceadd evaluation path (Florian Westphal) [1862384]
  - [net] netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets (Florian Westphal) [1862384]
  - [net] netfilter: ctnetlink: netns exit must wait for callbacks (Florian Westphal) [1862384]
  - [arm64] kvm: arm64: Don't inherit exec permission across page-table levels (Andrew Jones) [1869297]
  - [arm64] kvm: arm64: Flush the instruction cache if not unmapping the VM on reboot (Andrew Jones) [1869297]
  - [s390] s390, dcssblk: kaddr and pfn can be NULL to ->direct_access() (Claudio Imbrenda) [1868927]
  - [fs] chardev: Avoid potential use-after-free in 'chrdev_open()' (Vladis Dronov) [1866324] {CVE-2020-0305}
  - [net] net: accept an empty mask in /sys/class/net/*/queues/rx-*/rps_cpus (Nitesh Narayan Lal) [1868433]
  - [x86] Revert "x86/intel: Disable HPET on Intel Ice Lake platforms" (David Arcari) [1868405]
  - [kernel] sched: Fix race against ptrace_freeze_trace() (Oleg Nesterov) [1862560]
  - [kernel] sched: Fix loadavg accounting race (Oleg Nesterov) [1862560]
  - [kernel] kernel/sched/: remove caller signal_pending branch predictions (Oleg Nesterov) [1862560]
  - [kernel] locking/spinlock, sched/core: Clarify requirements for smp_mb__after_spinlock() (Oleg Nesterov) [1862560]
  - [nvme] nvme: multipath: round-robin: eliminate "fallback" variable (Gopal Tiwari) [1868443]
  - [nvme] nvme: multipath: round-robin: fix single non-optimized path case (Gopal Tiwari) [1868443]
  - [nvme] nvme-multipath: do not fall back to __nvme_find_path() for non-optimized paths (Gopal Tiwari) [1868443]
  - [nvme] nvme-multipath: fix logic for non-optimized paths (Gopal Tiwari) [1868443]
  - [tools] selftests/bpf: Fix segmentation fault in test_progs (Yauheni Kaliuta) [1868494]
  - [pci] hv: Fix a timing issue which causes kdump to fail occasionally (Mohammed Gamal) [1861960]
  - [hv] hv: vmbus: Only notify Hyper-V for die events that are oops (Vitaly Kuznetsov) [1868131]
  - [x86] kvm: nsvm: Correctly set the shadow NPT root level in its MMU role (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: x86: drop superfluous mmu_check_root() from fast_pgd_switch() (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: use nested_svm_load_cr3() on guest->host switch (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: implement nested_svm_load_cr3() and use it for host->guest switch (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: move kvm_set_cr3() after nested_svm_uninit_mmu_context() (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: introduce nested_svm_load_cr3()/nested_npt_enabled() (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: prepare to handle errors from enter_svm_guest_mode() (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: reset nested_run_pending upon nested_svm_vmrun_msrpm() failure (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: mmu: stop dereferencing vcpu->arch.mmu to get the context for MMU init (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: split kvm_init_shadow_npt_mmu() from kvm_init_shadow_mmu() (Vitaly Kuznetsov) [1845507]
  - [security] selinux: compute genfs symlink context in case of CephFS (Ondrej Mosnacek) [1865800]
  - [fs] ceph: set sec_context xattr on symlink creation (Ondrej Mosnacek) [1861509]
  - [tools] selftests: bpf: define SO_RCVTIMEO and SO_SNDTIMEO properly for ppc64le (Jiri Benc) [1860386]
  - [tools] bpf: Sync RHEL version of asm-generic/socket.h to tools/ (Jiri Benc) [1860386]
  - [tools] selftests: bpf: skip tests not working on RHEL (Jiri Benc) [1866908]
  - [tools] Revert "selftests: bpf: disable test_lwt_seg6local" (Jiri Benc) [1866908]
  - [tools] Revert "bpf: selftests: remove test_bpftool_build.sh from TEST_PROGS" (Jiri Benc) [1866908]
  - [tools] selftests: add option to skip specific tests in RHEL (Jiri Benc) [1866908]
  - [tools] selftests: bpf: switch off timeout (Jiri Benc) [1866908]
  - [tools] selftest/firmware: Add selftest timeout in settings (Jiri Benc) [1866908]
  - [tools] selftests/harness: Limit step counter reporting (Jiri Benc) [1866908]
  - [tools] selftests/harness: Clean up kern-doc for fixtures (Jiri Benc) [1866908]
  - [tools] selftests: fix condition in run_tests (Jiri Benc) [1866908]
  - [tools] selftests: do not use .ONESHELL (Jiri Benc) [1866908]
  - [tools] selftests/harness: Report skip reason (Jiri Benc) [1866908]
  - [tools] selftests/harness: Display signed values correctly (Jiri Benc) [1866908]
  - [tools] selftests/harness: Refactor XFAIL into SKIP (Jiri Benc) [1866908]
  - [tools] selftests/harness: Switch to TAP output (Jiri Benc) [1866908]
  - [tools] selftests: Add header documentation and helpers (Jiri Benc) [1866908]
  - [tools] kselftest: fix TAP output for skipped tests (Jiri Benc) [1866908]
  - [tools] kselftest: ksft_test_num return type should be unsigned (Jiri Benc) [1866908]
  - [tools] selftests: introduce gen_tar Makefile target (Jiri Benc) [1866908]
  - [tools] kselftest: add fixture variants (Jiri Benc) [1866908]
  - [tools] kselftest: run tests by fixture (Jiri Benc) [1866908]
  - [tools] kselftest: create fixture objects (Jiri Benc) [1866908]
  - [tools] kselftest: factor out list manipulation to a helper (Jiri Benc) [1866908]
  - [tools] selftests: add build/cross-build dependency check script (Jiri Benc) [1866908]
  - [tools] kselftest/runner: allow to properly deliver signals to tests (Jiri Benc) [1866908]
  - [tools] selftests/harness: fix spelling mistake "SIGARLM" -> "SIGALRM" (Jiri Benc) [1866908]
  - [tools] selftests: enforce local header dependency in lib.mk (Jiri Benc) [1866908]
  - [tools] selftests/harness: Handle timeouts cleanly (Jiri Benc) [1866908]
  - [tools] selftests/harness: Move test child waiting logic (Jiri Benc) [1866908]
  - [tools] selftests: Fix kselftest O=objdir build from cluttering top level objdir (Jiri Benc) [1866908]
  - [tools] selftests: allow detection of build failures (Jiri Benc) [1866908]
  - [tools] selftests: fix build behaviour on targets' failures (Jiri Benc) [1866908]
  - [tools] kselftest: Support old perl versions (Jiri Benc) [1866908]
  - [tools] kselftest/runner: Print new line in print of timeout log (Jiri Benc) [1866908]
  - [tools] selftests: Fix dangling documentation references to kselftest_module.sh (Jiri Benc) [1866908]
  - [tools] kselftest: Fix NULL INSTALL_PATH for TARGETS runlist (Jiri Benc) [1866908]
  - [tools] selftests: Move kselftest_module.sh into kselftest/ (Jiri Benc) [1866908]
  - [tools] selftests: gen_kselftest_tar.sh: Do not clobber kselftest/ (Jiri Benc) [1866908]
  - [tools] selftests/kselftest/runner.sh: Add 45 second timeout per test (Jiri Benc) [1866908]
  - [tools] kselftest: exclude failed TARGETS from runlist (Jiri Benc) [1866908]
  - [tools] kselftest: add capability to skip chosen TARGETS (Jiri Benc) [1866908]
  - [tools] selftests: Add kselftest-all and kselftest-install targets (Jiri Benc) [1866908]
  - [tools] selftests: use "$(MAKE)" instead of "make" (Jiri Benc) [1866908]
  - [tools] kselftest: save-and-restore errno to allow for m formatting (Jiri Benc) [1866908]
  - [tools] treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 481 (Jiri Benc) [1866908]
  - [tools] selftests/harness: Allow test to configure timeout (Jiri Benc) [1866908]
  - [tools] selftests: avoid KBUILD_OUTPUT dir cluttering with selftest objects (Jiri Benc) [1866908]
  - [tools] selftests: fix bpf build/test workflow regression when KBUILD_OUTPUT is set (Jiri Benc) [1866908]
  - [tools] selftests: fix install target to use default install path (Jiri Benc) [1866908]
  - [tools] selftests: build and run gpio when output directory is the src dir (Jiri Benc) [1866908]
  - [documentation] doc: kselftest: Fix KBUILD_OUTPUT usage instructions (Jiri Benc) [1866908]
  - [tools] selftests: fix headers_install circular dependency (Jiri Benc) [1866908]
  - [tools] selftests/harness: Add 30 second timeout per test (Jiri Benc) [1866908]
  - [tools] kselftest: Add test module framework header (Jiri Benc) [1866908]
  - [tools] kselftest: Add test runner creation script (Jiri Benc) [1866908]
  - [tools] selftests/harness: Update named initializer syntax (Jiri Benc) [1866908]
  - [tools] selftest: include stdio.h in kselftest.h (Jiri Benc) [1866908]
  - [tools] selftests: do not macro-expand failed assertion expressions (Jiri Benc) [1866908]
  - [documentation] Documentation/dev-tools: clean up kselftest.rst (Jiri Benc) [1866908]
  - [documentation] doc: dev-tools: kselftest.rst: update config file location (Jiri Benc) [1866908]
  - [documentation] doc: dev-tools: kselftest.rst: update contributing new tests (Jiri Benc) [1866908]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-235.el8]
changelog:
  - [s390] scsi: zfcp: Move allocation of the shost object to after xconf- and xport-data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Fence early sysfs interfaces for accesses of shost objects (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Fence adapter status propagation for common statuses (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Move p-t-p port allocation to after xport data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Fence fc_host updates during link-down handling (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Move fc_host updates during xport data handling into fenced function (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Move shost updates during xconfig data handling into fenced function (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Move shost modification after QDIO (re-)open into fenced function (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: fix fc_host attributes that should be unknown on local link down (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: wire previously driver-specific sysfs attributes also to fc_host (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: expose fabric name as common fc_host sysfs attribute (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: add diagnostics buffer for exchange config data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: diagnostics buffer caching and use for exchange port data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: signal incomplete or error for sync exchange config/port data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Fix use-after-free in request timeout handlers (Claudio Imbrenda) [1872796]
  - [tools] selftests/powerpc: Update the stack expansion test (Gustavo Duarte) [1869755]
  - [mm] powerpc: Allow 4224 bytes of stack expansion for the signal frame (Gustavo Duarte) [1869755]
  - [tools] selftests/powerpc: Add test of stack expansion logic (Gustavo Duarte) [1869755]
  - [mm] mm: check that mm is still valid in madvise() (Jeff Moyer) [1874560]
  - [block] block: virtio_blk: fix handling single range discard request (Ming Lei) [1842035]
  - [block] block: respect queue limit of max discard segment (Ming Lei) [1842035]
  - [fs] io_uring: Fix NULL pointer dereference in loop_rw_iter() (Jeff Moyer) [1854649]
  - [fs] io_uring: return locked and pinned page accounting (Jeff Moyer) [1854649]
  - [fs] io_uring: always allow drain/link/hardlink/async sqe flags (Jeff Moyer) [1854649]
  - [fs] io_uring: ensure double poll additions work with both request types (Jeff Moyer) [1854649]
  - [fs] io_uring: fix recvmsg memory leak with buffer selection (Jeff Moyer) [1854649]
  - [fs] io_uring: fix missing msg_name assignment (Jeff Moyer) [1854649]
  - [fs] io_uring: fix memleak in io_sqe_files_register() (Jeff Moyer) [1854649]
  - [fs] io_uring: account user memory freed when exit has been queued (Jeff Moyer) [1854649]
  - [fs] io_uring: fix memleak in __io_sqe_files_update() (Jeff Moyer) [1854649]
  - [fs] io_uring: fix regression with always ignoring signals in io_cqring_wait() (Jeff Moyer) [1854649]
  - [fs] io_uring: use signal based task_work running (Jeff Moyer) [1854649]
  - [kernel] task_work: teach task_work_add() to do signal_wake_up() (Jeff Moyer) [1854649]
  - [fs] io_uring: fix missing ->mm on exit (Jeff Moyer) [1854649]
  - [fs] io_uring: fix potential use after free on fallback request free (Jeff Moyer) [1854649]
  - [fs] io_uring: fix req->work corruption (Jeff Moyer) [1854649]
  - [fs] io_uring: fix NULL-mm for linked reqs (Jeff Moyer) [1854649]
  - [fs] io_uring: fix current->mm NULL dereference on exit (Jeff Moyer) [1854649]
  - [fs] io_uring: fix hanging iopoll in case of -EAGAIN (Jeff Moyer) [1854649]
  - [fs] io_uring: fix io_sq_thread no schedule when busy (Jeff Moyer) [1854649]
  - [fs] io_uring: fix possible race condition against REQ_F_NEED_CLEANUP (Jeff Moyer) [1854649]
  - [fs] io_uring: reap poll completions while waiting for refs to drop on exit (Jeff Moyer) [1854649]
  - [fs] io_uring: acquire 'mm' for task_work for SQPOLL (Jeff Moyer) [1854649]
  - [fs] io_uring: add memory barrier to synchronize io_kiocb's result and iopoll_completed (Jeff Moyer) [1854649]
  - [fs] io_uring: don't fail links for EAGAIN error in IOPOLL mode (Jeff Moyer) [1854649]
  - [fs] io_uring: fix io_kiocb.flags modification race in IOPOLL mode (Jeff Moyer) [1854649]
  - [fs] io_uring: allow O_NONBLOCK async retry (Jeff Moyer) [1854649]
  - [fs] io_uring: use kvfree() in io_sqe_buffer_register() (Jeff Moyer) [1854649]
  - [fs] io_uring: validate the full range of provided buffers for access (Jeff Moyer) [1854649]
  - [fs] io_uring: re-set iov base/len for buffer select retry (Jeff Moyer) [1854649]
  - [fs] io_uring: fix {SQ, IO}POLL with unsupported opcodes (Jeff Moyer) [1854649]
  - [fs] io_uring: disallow close of ring itself (Jeff Moyer) [1854649]
  - [fs] io_uring: fix overflowed reqs cancellation (Jeff Moyer) [1854649]
  - [fs] io_uring: fix flush req->refs underflow (Jeff Moyer) [1854649]
  - [fs] io_uring: async task poll trigger cleanup (Jeff Moyer) [1854649]
  - [fs] io_uring: allow POLL_ADD with double poll_wait() users (Jeff Moyer) [1854649]
  - [fs] io_uring: remove 'fd is io_uring' from close path (Jeff Moyer) [1854649]
  - [nvme] nvme: allow retry for requests with REQ_FAILFAST_TRANSPORT set (Mike Snitzer) [1843515]
  - [nvme] nvme: decouple basic ANA log page re-read support from native multipathing (Mike Snitzer) [1843515]
  - [nvme] nvme: update failover handling to work with REQ_FAILFAST_TRANSPORT (Mike Snitzer) [1843515]
  - [nvme] nvme: Return BLK_STS_TARGET if the DNR bit is set (Mike Snitzer) [1843515]
  - [nvme] nvme: redirect commands on dying queue (Mike Snitzer) [1843515]
  - [nvme] nvme: just check the status code type in nvme_is_path_error (Mike Snitzer) [1843515]
  - [nvme] nvme: refactor command completion (Mike Snitzer) [1843515]
  - [nvme] nvme-multipath: do not reset on unknown status (Mike Snitzer) [1843515]
  - [nvme] Revert "nvme: allow ANA support to be independent of native multipathing" (Mike Snitzer) [1843515]
  - [nvme] Revert "nvme-multipath: do not reset on unknown status" (Mike Snitzer) [1843515]
  - [mm] mm, THP, swap: fix allocating cluster for swapfile by mistake (Gao Xiang) [1855474]
  - [net] sched: act_ct: Fix skb double-free in tcf_ct_handle_fragments() error flow (Marcelo Leitner) [1866391]
  - [net] netfilter: conntrack: allow sctp hearbeat after connection re-use (Florian Westphal) [1865798]
  - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859472] {CVE-2020-14331}
  - [scsi] Revert "scsi: qla2xxx: Disable T10-DIF feature with FC-NVMe during probe" (Nilesh Javali) [1866744]
  - [scsi] Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Fix null pointer access during disconnect from subsystem (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Check if FW supports MQ before enabling (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Fix WARN_ON in qla_nvme_register_hba (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Allow ql2xextended_error_logging special value 1 to be set anytime (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Reduce noisy debug message (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Fix login timeout (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Flush I/O on zone disable (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Flush all sessions on zone disable (Nilesh Javali) [1866744]
  - [tools] bpf: selftests: global_funcs: Check err_str before strstr (Yauheni Kaliuta) [1873163]
  - [netdrv] net/mlx5e: E-Switch, Specify flow_source for rule with no in_port (Alaa Hleihel) [1869602]
  - [netdrv] net/mlx5e: E-Switch, Add misc bit when misc fields changed for mirroring (Alaa Hleihel) [1869602]
  - [tools] selftests/bpf: test for map update access from within EXT programs (=?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?=) [1871071]
  - [tools] selftests/bpf: test for checking return code for the extended prog (=?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?=) [1871071]
  - [tools] selftests/bpf: Add test for freplace program with write access (=?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?=) [1871071]
  - [net] bpf: verifier: use target program's type for access verifications (=?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?=) [1871071]
  - [scsi] scsi: lpfc: Fix NVMe rport deregister and registration during ADISC (Dick Kennedy) [1871223]
  - [scsi] scsi: lpfc: Fix LUN loss after cable pull (Dick Kennedy) [1871223]
  - [infiniband] RDMA/bnxt_re: Do not add user qps to flushlist (Selvin Xavier) [1858674]
  - [fs] NFSv4.0 allow nconnect for v4.0 (Benjamin Coddington) [1842746]
  - [mm] mm/vunmap: add cond_resched() in vunmap_pmd_range (Rafael Aquini) [1871710]
  - [s390] s390/bpf: Maintain 8-byte stack alignment (Jiri Olsa) [1871040]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-236.el8]
changelog:
  - [crypto] pefile: Support multiple signatures in verify_pefile_signature (Lenny Szubowicz) [1862072]
  - [security] integrity: Load certs from the EFI MOK config table (Lenny Szubowicz) [1868306]
  - [security] integrity: Move import of MokListRT certs to a separate routine (Lenny Szubowicz) [1868306]
  - [firmware] efi: Support for MOK variable config table (Lenny Szubowicz) [1868306]
  - [kernel] Move to dual-signing to split signing keys up better (Frantisek Hrbata) [1837434] {CVE-2020-10713}
  - [powerpc] pseries/hotplug-cpu: wait indefinitely for vCPU death (Michael Roth) [1856588]
  - [powerpc] kvm: ppc: book3s hv: Rework secure mem slot dropping (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Move kvmppc_svm_page_out up (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Migrate hot plugged memory (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: In H_SVM_INIT_DONE, migrate remaining normal-GFNs to secure-GFNs (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Track the state GFNs associated with secure VMs (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Disable page merging in H_SVM_INIT_START (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Fix function definition in book3s_hv_uvmem.c (Michael Roth) [1851259]
  - [kernel] mmap locking api: initial implementation as rwsem wrappers (Michael Roth) [1851259]
  - [mm] handle multiple owners of device private pages in migrate_vma (Michael Roth) [1851259]
  - [mm] migrate.c: clean up useless code in migrate_vma_collect_pmd() (Michael Roth) [1851259]
  - [mm] remove the unused MIGRATE_PFN_DEVICE flag (Michael Roth) [1851259]
  - [powerpc] rhel: powerpc: kvm: Increase HDEC threshold to enter guest (David Gibson) [1733467]
  - [netdrv] r8152: Add macpassthru support for ThinkPad Thunderbolt 3 Dock Gen 2 (Michal Schmidt) [1851966]
  - [fs] ceph: fix inode number handling on arches with 32-bit ino_t (Jeff Layton) [1869679]
  - [fs] ceph: don't allow setlease on cephfs (Jeff Layton) [1872382]
  - [block] blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART (Ming Lei) [1859628]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-237.el8]
changelog:
  - [fs] nfsd: avoid a NULL dereference in __cld_pipe_upcall() (Scott Mayhew) [1847225]
  - [net] packet: fix overflow in tpacket_rcv (Hangbin Liu) [1876224] {CVE-2020-14386}
  - [net] packet: make tp_drops atomic (Hangbin Liu) [1876224] {CVE-2020-14386}
  - [net] espintcp: restore IP CB before handing the packet to xfrm (Sabrina Dubroca) [1868201]
  - [fs] Revert "NFSv4: Handle NFS4ERR_OLD_STATEID in CLOSE/OPEN_DOWNGRADE" (Benjamin Coddington) [1865978]
  - [fs] Revert "NFSv4.x recover from pre-mature loss of openstateid" (Benjamin Coddington) [1865978]
  - [infiniband] RDMA/mlx4: Read pkey table length instead of hardcoded value (Alaa Hleihel) [1853564]
  - [net] net/smc: set rx_off for SMCR explicitly (Philipp Rudo) [1875833]
  - [drm] drm/i915: Auto detect DPCD backlight support by default (Lyude Paul) [1872381]
  - [drm] drm/i915: Fix DPCD register order in intel_dp_aux_enable_backlight() (Lyude Paul) [1872381]
  - [drm] drm/i915: Assume 100 brightness when not in DPCD control mode (Lyude Paul) [1872381]
  - [drm] drm/i915: Fix eDP DPCD aux max backlight calculations (Lyude Paul) [1872381]
  - [kernel] tracing: Define MCOUNT_INSN_SIZE when not defined without direct calls (Jiri Olsa) [1857599]
  - [kernel] ftrace: Fix function_graph tracer interaction with BPF trampoline (Jiri Olsa) [1857599]
  - [x86] x86/function_graph: Simplify with function_graph_enter() (Jiri Olsa) [1857599]
  - [kernel] function_graph: Create function_graph_enter() to consolidate architecture code (Jiri Olsa) [1857599]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-238.el8]
changelog:
  - [firmware] efi: don't reserve MOK config table memory region (Kairui Song) [1878584]
  - [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen) [1875316] {CVE-2020-14385}
  - [powerpc] powerpc/pseries: Do not initiate shutdown when system is running on UPS (Diego Domingos) [1870477]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-239.el8]
changelog:
  - [init] init/Kconfig: disable io_uring (Jeff Moyer) [1879754]
  - [block] blk-mq: always allow reserved allocation in hctx_may_queue (Ming Lei) [1740874]
  - [nvme] nvme-rdma: Avoid double freeing of async event data (Gopal Tiwari) [1878140]
  - [kernel] printk: queue wake_up_klogd irq_work only if per-CPU areas are ready (Igor Mammedov) [1867022]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.el8]
changelog:
  - [include] block: allow for_each_bvec to support zero len bvec (Ming Lei) [1872032]
  - [nvme] nvme-pci: disable the write zeros command for Intel 600P/P3100 (David Milburn) [1875391]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.1.1.el8_3]
changelog:
  - [net] Bluetooth: fix kernel oops in store_pending_adv_report (Gopal Tiwari) [1888454 1888455] {CVE-2020-24490}
  - [net] Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888257 1888258] {CVE-2020-12351}
  - [net] Bluetooth: A2MP: Fix not initializing all members (Gopal Tiwari) [1888806 1888807] {CVE-2020-12352}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.2.1.el8_3]
changelog:
  - [tools] selftests: rtnetlink: Test bridge enslavement with different parent IDs (Jonathan Toppins) [1886017 1860479]
  - [tools] selftests: rtnetlink: correct the final return value for the test (Jonathan Toppins) [1886017 1860479]
  - [net] Fix bridge enslavement failure (Jonathan Toppins) [1886017 1860479]
  - [net] netfilter: conntrack: proc: rename stat column (Florian Westphal) [1882094 1875681]
  - [net] netfilter: conntrack: add clash resolution stat counter (Florian Westphal) [1882094 1875681]
  - [net] netfilter: conntrack: remove ignore stats (Florian Westphal) [1882094 1875681]
  - [net] netfilter: conntrack: do not increment two error counters at same time (Florian Westphal) [1882094 1875681]
  - [net] netfilter: conntrack: do not auto-delete clash entries on reply (Florian Westphal) [1882094 1875681]
  - [kernel] time/tick-broadcast: Fix tick_broadcast_offline() lockdep complaint (Alexey Klimov) [1880080 1877380]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.3.1.el8_3]
changelog:
  - [iommu] iommu/amd: Fix the overwritten field in IVMD header (Baoquan He) [1888113 1869148]
  - [fs] xfs: trim IO to found COW extent limit (Eric Sandeen) [1886895 1882549]
  - [char] random32: update the net random state on interrupt and activity (Donghai Qiao) [1888233 1867569] {CVE-2020-16166}
  - [net] openvswitch: fixes crash if nf_conncount_init() fails (Eelco Chaudron) [1879935 1876445]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.4.1.el8_3]
changelog:
  - [kernel] sched/features: Fix !CONFIG_JUMP_LABEL case (Daniel Bristot de Oliveira) [1894073 1885850]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.6.1.el8_3]
changelog:
  - [arm64] paravirt: Initialize steal time when cpu is online (Andrew Jones) [1898758 1879137]
  - [kvm] Revert "x86/kvm: Move context tracking where it belongs" (Nitesh Narayan Lal) [1897716 1890284]
  - [pci] hv: Fix hibernation in case interrupts are not re-created (Mohammed Gamal) [1896435 1846838]
  - [hv] hv: vmbus: hibernation: do not hang forever in vmbus_bus_resume() (Mohammed Gamal) [1896434 1876519]
  - [netdrv] hv_netvsc: Cache the current data path to avoid duplicate call and message (Mohammed Gamal) [1896433 1876527]
  - [netdrv] hv_netvsc: Switch the data path at the right time during hibernation (Mohammed Gamal) [1896433 1876527]
  - [netdrv] hv_netvsc: Fix hibernation for mlx5 VF driver (Mohammed Gamal) [1896433 1876527]
  - [tools] selftests/powerpc: Make alignment handler test P9N DD2.1 vector CI load workaround (Gustavo Duarte) [1897278 1887442]
  - [powerpc] powerpc: Fix undetected data corruption with P9N DD2.1 VSX CI load emulation (Gustavo Duarte) [1897278 1887442]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.7.1.el8_3]
changelog:
  - [fs] writeback: Drop I_DIRTY_TIME_EXPIRE (Waiman Long) [1901547 1860031]
  - [fs] writeback: Fix sync livelock due to b_dirty_time processing (Waiman Long) [1901547 1860031]
  - [fs] writeback: Avoid skipping inode writeback (Waiman Long) [1901547 1860031]
  - [fs] writeback: Protect inode->i_io_list with inode->i_lock (Waiman Long) [1901547 1860031]
  - [fs] fs: Introduce DCACHE_DONTCACHE (Waiman Long) [1901547 1860031]
  - [fs] fs: Lift XFS_IDONTCACHE to the VFS layer (Waiman Long) [1901547 1860031]
  - [fs] dcache: sort the freeing-without-RCU-delay mess for good (Waiman Long) [1901547 1860031]
  - [net] ip_tunnel_core: Fix build for archs without _HAVE_ARCH_IPV6_CSUM (Aaron Conole) [1885766 1849736]
  - [tools] selftests: pmtu.sh: Add tests for UDP tunnels handled by Open vSwitch (Aaron Conole) [1885766 1849736]
  - [tools] selftests: pmtu.sh: Add tests for bridged UDP tunnels (Aaron Conole) [1885766 1849736]
  - [net] geneve: Support for PMTU discovery on directly bridged links (Aaron Conole) [1885766 1849736]
  - [net] vxlan: Support for PMTU discovery on directly bridged links (Aaron Conole) [1885766 1849736]
  - [net] tunnels: PMTU discovery support for directly bridged IP packets (Aaron Conole) [1885766 1849736]
  - [net] ipv4: route: Ignore output interface in FIB lookup for PMTU route (Aaron Conole) [1885766 1849736]
  - [netdrv] geneve: add transport ports in route lookup for geneve (Mark Gray) [1891818 1884481] {CVE-2020-25645}
  - [kernel] PM: hibernate: Batch hibernate and resume IO requests (Lenny Szubowicz) [1894629 1868096]
  - [md] dm: fix comment in __dm_suspend() (Mike Snitzer) [1890233 1881531]
  - [md] dm: fold dm_process_bio() into dm_make_request() (Mike Snitzer) [1890233 1881531]
  - [md] dm: fix missing imposition of queue_limits from dm_wq_work() thread (Mike Snitzer) [1890233 1881531]
  - [md] dm: optimize max_io_len() by inlining max_io_len_target_boundary() (Mike Snitzer) [1890233 1881531]
  - [md] dm: push md->immutable_target optimization down to __process_bio() (Mike Snitzer) [1890233 1881531]
  - [md] dm: change max_io_len() to use blk_max_size_offset() (Mike Snitzer) [1890233 1881531]
  - [md] dm table: stack 'chunk_sectors' limit to account for target-specific splitting (Mike Snitzer) [1890233 1881531]
  - [block] block: allow 'chunk_sectors' to be non-power-of-2 (Mike Snitzer) [1890233 1881531]
  - [block] block: use lcm_not_zero() when stacking chunk_sectors (Mike Snitzer) [1890233 1881531]
  - [md] dm: fix bio splitting and its bio completion order for regular IO (Mike Snitzer) [1890233 1881531]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.8.1.el8_3]
changelog:
  - [s390] s390/dasd: Fix zero write for FBA devices (Ming Lei) [1896787 1881760]
  - [s390] mm/gup: fix gup_fast with dynamic page table folding (Philipp Rudo) [1896351 1883266]
  - [netdrv] ibmveth: Identify ingress large send packets (Gustavo Duarte) [1896299 1887038]
  - [netdrv] ibmveth: Switch order of ibmveth_helper calls (Gustavo Duarte) [1896299 1887038]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.9.1.el8_3]
changelog:
  - [net] tunnels: Fix off-by-one in lower MTU bounds for ICMP/ICMPv6 replies (Antoine Tenart) [1902082 1895765]
  - [net] net-sysfs: add backlog len and CPU id to softnet data (Paolo Abeni) [1883314 1866909]
  - [net] try to avoid unneeded backlog flush (Paolo Abeni) [1883314 1866909]
  - [net] skbuff: fix a data race in skb_queue_len() (Paolo Abeni) [1883314 1866909]
  - [powerpc] mm/mmu_gather: invalidate TLB correctly on batch allocation failure and flush (Diego Domingos) [1899208 1805031]
  - [powerpc] powerpc/mmu_gather: enable RCU_TABLE_FREE even for !SMP case (Diego Domingos) [1899208 1805031]
  - [net] netfilter: ctnetlink: add a range check for l3/l4 protonum (Florian Westphal) [1892665 1892666] {CVE-2020-25211}
  - [char] random: decouple random and urandom extrng fops (Vladis Dronov) [1899584 1890711]
  - [char] random: Add a poll handler to extrng_fops (Vladis Dronov) [1886192 1884857]


author: Akemi Yagi <toracat@centos.org> [4.18.0-240.10.1.el8_3.centos.plus]
changelog:
  - Apply debranding changes
  - Modify config file for x86_64 with extra features turned on including some network adapters,
    some SCSI adapters, ReiserFS, TOMOYO
  - Apply patches from CentOS-7 plus kernel
  - Apply driver patches imported from ELRepo
  - Add device IDs that have been removed from RHEL 8 kernels (megaraid_sas and mpt3sas)
  - Apply patches for e1000 from kernel.org [bug#16284]
  - Added a triggerin scriptlet to rebuild the initramfs image
    when the system microcode package is updated [bug#17562]
  - wireguard added [bug#17652]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.11.1.el8_3]
changelog:
  - [scsi] scsi: core: Return BLK_STS_AGAIN for ALUA transitioning (Ewan Milne) [1900112 1867264]
  - [scsi] scsi: scsi_dh_alua: Set 'transitioning' state on Unit Attention (Ewan Milne) [1900112 1867264]
  - [scsi] scsi: scsi_dh_alua: Return BLK_STS_AGAIN for ALUA transitioning state (Ewan Milne) [1900112 1867264]
  - [block] scsi: block: Return status code in blk_mq_end_request() (Ewan Milne) [1900112 1867264]
  - [include] compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use (Ivan Vecera) [1900112 1867168]
  - [net] net: sctp: Rename fallthrough label to unhandled (Ivan Vecera) [1900112 1867168]
  - [idle] intel_idle: Customize IceLake server support (David Arcari) [1897183 1881620]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.12.1.el8_3]
changelog:
  - [net] SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() (Steve Dickson) [1912478 1884361]
  - [net] SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()") (Steve Dickson) [1912478 1884361]
  - [mm] x86/ioremap: Map EFI runtime services data as encrypted for SEV (Lenny Szubowicz) [1909243 1883134]
  - [kernel] sched/deadline: Unthrottle PI boosted threads while enqueuing (Daniel Bristot de Oliveira) [1913964 1869760]
  - [kernel] sched/deadline: Fix stale throttling on de-/boosted tasks (Daniel Bristot de Oliveira) [1913964 1869760]
  - [fs] NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation recall (Scott Mayhew) [1908313 1881550]
  - [fs] NFS: Fix interrupted slots by sending a solo SEQUENCE operation (Scott Mayhew) [1908312 1887577]
  - [net] netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal (Antoine Tenart) [1907576 1901026]
  - [powerpc] powerpc/powernv/opal-dump : Use IRQ_HANDLED instead of numbers in interrupt handler (Diego Domingos) [1907301 1891822]
  - [powerpc] powerpc/powernv/dump: Handle multiple writes to ack attribute (Diego Domingos) [1907301 1891822]
  - [powerpc] powerpc/powernv/dump: Fix race while processing OPAL dump (Diego Domingos) [1907301 1891822]
  - [powerpc] powerpc/opal_elog: Handle multiple writes to ack attribute (Diego Domingos) [1907301 1891822]
  - [powerpc] powerpc/powernv/elog: Fix race while processing OPAL error log event (Diego Domingos) [1907301 1891822]
  - [block] block: fix incorrect branching in blk_max_size_offset() (Mike Snitzer) [1905136 1903722]
  - [md] dm: fix IO splitting (Mike Snitzer) [1905136 1903722]
  - [block] block: fix get_max_io_size() (Mike Snitzer) [1905136 1903722]
  - [block] block: Improve physical block alignment of split bios (Mike Snitzer) [1905136 1903722]
  - [block] block: use gcd() to fix chunk_sectors limit stacking (Mike Snitzer) [1905136 1903722]
  - [netdrv] net/mlx5e: Add LAG warning if bond slave is not lag master (Alaa Hleihel) [1892344 1851709]
  - [netdrv] net/mlx5e: Add LAG warning for unsupported tx type (Alaa Hleihel) [1892344 1851709]
  - [netdrv] net/mlx5e: Return a valid errno if can't get lag device index (Alaa Hleihel) [1892344 1851709]
  - [net] openvswitch: handle DNAT tuple collision (Dumitru Ceara) [1892744 1877128]
  - [mm] mm/page_idle.c: skip offline pages (Chris von Recklinghausen) [1903019 1867490]
  - [include] mm/hotplug: invalid PFNs from pfn_to_online_page() (Waiman Long) [1903019 1878006]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.13.1.el8_3]
changelog:
  - [arm64] arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() (Andrew Jones) [1909577 1908439]
  - [arm64] arm64: pgtable: Fix pte_accessible() (Andrew Jones) [1909577 1908439]
  - [net] icmp: randomize the global rate limiter (Guillaume Nault) [1906371 1896516] {CVE-2020-25705}
  - [tools] kvm: x86: do not attempt TSC synchronization on guest writes (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: x86: fix MSR_IA32_TSC read for nested migration (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: delay MSR permission processing to first nested VM run (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: x86: rename KVM_REQ_GET_VMCS12_PAGES (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: use __GFP_ZERO instead of clear_page (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: refactor msr permission bitmap allocation (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: rename a variable in the svm_create_vcpu (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: Avoid freeing uninitialized pointers in svm_set_nested_state() (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: nested: Don't allocate VMCB structures on stack (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: more strict SMM checks when returning to nested guest (Paolo Bonzini) [1905084 1898018]
  - [x86] svm: nsvm: setup nested msr permission bitmap on nested state load (Paolo Bonzini) [1905084 1898018]
  - [x86] svm: nsvm: correctly restore GIF on vmexit from nesting after migration (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: avoid emulation with stale next_rip (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: remove nonsensical EXITINFO1 adjustment on nested NPF (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: Rename svm_nested_virtualize_tpr() to nested_svm_virtualize_tpr() (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: Add svm_ prefix to set/clr/is_intercept() (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: Add vmcb_ prefix to mark_*() functions (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: Rename struct nested_state to svm_nested_state (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: Check that DR6[63:32] and DR7[64:32] are not set on vmrun of nested guests (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: x86: Move the check for upper 32 reserved bits of DR6 to separate function (Paolo Bonzini) [1905084 1898018]
  - [netdrv] net/mlx5e: Add IPv6 traffic class (DSCP) header rewrite support (Alaa Hleihel) [1897688 1889981]
  - [netdrv] net/mlx5e: Fix endianness when calculating pedit mask first bit (Alaa Hleihel) [1897688 1889981]
  - [net] openvswitch: fix to make sure flow_lookup() is not preempted (Eelco Chaudron) [1893281 1888237]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.14.1.el8_3]
changelog:
  - [netdrv] net: usb: lan78xx: Disable interrupts before calling generic_handle_irq() (Waiman Long) [1915814 1904213]
  - [mm] x86/mm/cpa: Prevent large page split when ftrace flips RW on kernel text (Waiman Long) [1915814 1904213]
  - [mm] x86/mm/cpa: Fix cpa_flush_array() TLB invalidation (Waiman Long) [1915814 1904213]
  - [hv] hv: vmbus: Add timeout to vmbus_wait_for_unload (Mohammed Gamal) [1913528 1888980]
  - [kernel] perf/core: Fix race in the perf_mmap_close() function (Michael Petlan) [1897016 1869925] {CVE-2020-14351}
  - [kernel] perf: Make struct ring_buffer less ambiguous (Michael Petlan) [1897016 1869925] {CVE-2020-14351}
  - [tty] tty: Fix ->pgrp locking in tiocspgrp() (Waiman Long) [1908196 1908197] {CVE-2020-29661}
  - [x86] x86/tboot: Don't disable swiotlb when iommu is forced on (Tony Camuso) [1911555 1883395]
  - [iommu] iommu/vt-d: Avoid panic if iommu init fails in tboot system (Tony Camuso) [1911555 1883395]
  - [kernel] sched/deadline: Fix priority inheritance with multiple scheduling classes (Phil Auld) [1908731 1780490]
  - [kernel] locking/rwsem: Remove reader optimistic spinning (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Enable reader optimistic lock stealing (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Prevent potential lock starvation (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Pass the current atomic count to rwsem_down_read_slowpath() (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Fold __down_{read,write}*() (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Introduce rwsem_write_trylock() (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Better collate rwsem_read_trylock() (Waiman Long) [1908519 1895046]
  - [kernel] rwsem: Implement down_read_interruptible (Waiman Long) [1908519 1895046]
  - [kernel] rwsem: Implement down_read_killable_nested (Waiman Long) [1908519 1895046]
  - [firmware] efi/esrt: Only call efi_mem_reserve() for boot services memory (Kairui Song) [1907775 1878024]
  - [firmware] efi: Drop type and attribute checks in efi_mem_desc_lookup() (Kairui Song) [1907775 1878024]
  - [scsi] scsi: core: Don't start concurrent async scan on same host (Ming Lei) [1905214 1874501]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.15.1.el8_3]
changelog:
  - [x86] kvm: svm: Initialize prev_ga_tag before use (Vitaly Kuznetsov) [1919885 1909254]
  - [net] tls: move mark_tech_preview to tls_init (Sabrina Dubroca) [1918743 1907477]
  - [video] hyperv_fb: Fix the cache type when mapping the VRAM (Mohammed Gamal) [1917711 1908893]
  - [video] hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver (Mohammed Gamal) [1917711 1908893]
  - [net] esp: select CRYPTO_SEQIV (Vladis Dronov) [1912872 1905088]
  - [crypto] treewide: Use fallthrough pseudo-keyword (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - always try to free Jitter RNG instance (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - should select CTR (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: ctr - no longer needs CRYPTO_SEQIV (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - always seeded with SP800-90B compliant noise source (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: jitter - SP800-90B compliance (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: jitter - add header to fix buildwarnings (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: jitter - fix comments (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: jitter - update implementation to 2.1.2 (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - in-place cipher operation for CTR (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - eliminate constant reinitialization of SGL (Vladis Dronov) [1912872 1905088]
  - [netdrv] ionic: start queues before announcing link up (Jonathan Toppins) [1918372 1906250]
  - [drm] drm/i915: Enable Tigerlake support by default (Lyude Paul) [1882620 1877005]
  - [drm] drm/i915: Simplify intel_set_cdclk_{pre, post}_plane_update() calling convention (Lyude Paul) [1882620 1877005]
  - [drm] drm/i915/psr: Program default IO buffer Wake and Fast Wake (Lyude Paul) [1882620 1877005]
  - [kernel] rcu: Force on tick when invoking lots of callbacks (Waiman Long) [1915638 1862812]
  - [kernel] nohz: Add TICK_DEP_BIT_RCU (Waiman Long) [1915638 1862812]
  - [pci] PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken (Myron Stowe) [1906516 1888310]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.16.1.el8_3]
changelog:
  - [netdrv] net/mlx5e: Fix using wrong stats_grps in mlx5e_update_ndo_stats() (Alaa Hleihel) [1921060 1870593]
  - [net] tcp: Fix potential use-after-free due to double kfree() (Florian Westphal) [1915529 1915164]
  - [net] tcp: fix race condition when creating child sockets from syncookies (Florian Westphal) [1915529 1915164]
  - [x86] kvm: ioapic: break infinite recursion on lazy EOI (Vitaly Kuznetsov) [1906438 1882793]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.17.1.el8_3]
changelog:
  - [mm] mm/slub: fix panic in slab_alloc_node() (Oleksandr Natalenko) [1925511 1921056]
  - [s390] s390/early: improve machine detection (Claudio Imbrenda) [1925508 1896307]
  - [infiniband] RDMA/umem: Prevent small pages from being returned by ib_umem_find_best_pgsz() (Kamal Heib) [1924691 1903992]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.18.1.el8_3]
changelog:
  - [scsi] scsi: fnic: Do not call 'scsi_done()' for unhandled commands (Govindarajulu Varadarajan) [1925186 1870397]
  - [target] scsi: target: iscsi: Fix cmd abort fabric stop race (Maurizio Lombardi) [1918354 1908215]
  - [target] scsi: target: Modify core_tmr_abort_task() (Maurizio Lombardi) [1918363 1880395]
  - [s390] s390/crypto: add arch_get_random_long() support (Vladis Dronov) [1915816 1904274]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.19.1.el8_3]
changelog:
  - audit: trigger accompanying records when no rules present (Richard Guy Briggs) [1907520 1896480]
  - revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules present") (Richard Guy Briggs) [1907520 1896480]
  - audit: issue CWD record to accompany LSM_AUDIT_DATA_* records (Richard Guy Briggs) [1907520 1896480]
  - audit: remove unused !CONFIG_AUDITSYSCALL __audit_inode* stubs (Richard Guy Briggs) [1907520 1896480]
  - redhat: use tags from git notes for zstream to generate changelog (Frantisek Hrbata)


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.20.1.el8_3]
changelog:
  - fix regression in "epoll: Keep a reference on files added to the check list" (Carlos Maiolino) [1920775 1920776] {CVE-2020-0466}
  - do_epoll_ctl(): clean the failure exits up a bit (Carlos Maiolino) [1920775 1920776] {CVE-2020-0466}
  - epoll: Keep a reference on files added to the check list (Carlos Maiolino) [1920775 1920776] {CVE-2020-0466}
  - [kernel] sched/features: Distinguish between NORMAL and DEADLINE hrtick (Juri Lelli) [1930735 1912118]
  - [kernel] sched/features: Fix hrtick reprogramming (Juri Lelli) [1930735 1912118]
  - iommu/vt-d: Don't dereference iommu_device if IOMMU_API is not built (Vitaly Kuznetsov) [1932199 1887216]
  - iommu/vt-d: Gracefully handle DMAR units with no supported address widths (Vitaly Kuznetsov) [1932199 1887216]
  - iommu/vt-d: Skip TE disabling on quirky gfx dedicated iommu (Vitaly Kuznetsov) [1932199 1887216]
  - net/vmw_vsock: fix NULL pointer dereference (Jon Maloy) [1925599 1925600] {CVE-2021-26708}
  - net/vmw_vsock: improve locking in vsock_connect_timeout() (Jon Maloy) [1925599 1925600] {CVE-2021-26708}
  - vsock: fix locking in vsock_shutdown() (Jon Maloy) [1925599 1925600] {CVE-2021-26708}
  - vsock: fix the race conditions in multi-transport support (Jon Maloy) [1925599 1925600] {CVE-2021-26708}
  - [base] mm: don't panic when links can't be created in sysfs (Baoquan He) [1930168 1890171]
  - mm: don't rely on system state to detect hot-plug operations (Baoquan He) [1930168 1890171]
  - mm: replace memmap_context by meminit_context (Baoquan He) [1930168 1890171]
  - [tools] kvm: nvmx: check for invalid hdr.vmx.flags (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nvmx: check for required but missing VMCS12 in KVM_SET_NESTED_STATE (Paolo Bonzini) [1923281 1904128]
  - [tools] selftests: kvm: do not set guest mode flag (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: fix CPUID entries returned by KVM_GET_CPUID2 ioctl (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: svm: Fix offset computation bug in __sev_dbg_decrypt() (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nvmx: Sync unsync'd vmcs02 state to vmcs12 on migration (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: get smi pending status correctly (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86/pmu: Fix UBSAN shift-out-of-bounds warning in intel_pmu_refresh() (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: Add more protection against undefined behavior in rsvd_bits() (Paolo Bonzini) [1923281 1904128]
  - [documentation] kvm: Forbid the use of tagged userspace addresses for memslots (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: allow KVM_REQ_GET_NESTED_STATE_PAGES outside guest mode for VMX (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nsvm: cancel KVM_REQ_GET_NESTED_STATE_PAGES on nested vmexit (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nsvm: mark vmcb as dirty when forcingly leaving the guest mode (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nsvm: correctly restore nested_run_pending on migration (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: fix shift out of bounds reported by UBSAN (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits (Paolo Bonzini) [1923281 1904128]
  - [target] scsi: target: Fix XCOPY NAA identifier lookup (Maurizio Lombardi) [1900462 1900463] {CVE-2020-28374}
  - scsi: qla2xxx: Fix mailbox Ch erroneous error (Nilesh Javali) [1924222 1894578]
  - [net] fix iteration for sctp transport seq_files (Xin Long) [1927521 1916824]
  - [scsi] scsi: lpfc: Fix initial FLOGI failure due to BBSCN not supported (Dick Kennedy) [1927921 1887549]
  - [mm] mm, oom: remove oom_lock from oom_reaper (Waiman Long) [1929738 1873759]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.21.1.el8_3]
changelog:
  - KVM: x86: Allow guests to see MSR_IA32_TSX_CTRL even if tsx=off (Paolo Bonzini) [1939013 1912448]
  - gfs2: Fix deadlock between gfs2_{create_inode, inode_lookup} and delete_work_func (Andreas Gruenbacher) [1937109 1903190]
  - gfs2: Don't call cancel_delayed_work_sync from within delete work function (Andreas Gruenbacher) [1937109 1903190]
  - gfs2: Only access gl_delete for iopen glocks (Andreas Gruenbacher) [1937109 1903190]
  - gfs2: Don't sleep during glock hash walk (Andreas Gruenbacher) [1937109 1903190]
  - [netdrv] net/mlx5e: Add missing set of destination vport flags in termtbl create (Alaa Hleihel) [1924689 1851700]
  - [tools] tools arch x86: Sync asm/cpufeatures.h with the kernel sources (David Arcari) [1929740 1916478]
  - [x86] x86/cpu/amd: Call init_amd_zn() om Family 19h processors too (David Arcari) [1929740 1916478]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.22.1.el8_3]
changelog:
  - futex: Handle faults correctly for PI futexes (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Simplify fixup_pi_state_owner() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Use pi_state_update_owner() in put_pi_state() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Provide and use pi_state_update_owner() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Replace pointless printk in fixup_owner() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Ensure the correct return value from futex_lock_pi() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Don't enable IRQs unconditionally in put_pi_state() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Fix incorrect should_fail_futex() handling (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Consistently use fshared as boolean (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Remove needless goto's (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Remove put_futex_key() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930832 1930833] {CVE-2021-27364}
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930855 1930856] {CVE-2021-27365}
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1940423 1930809] {CVE-2021-27363}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-231.el8]
changelog:
  - [x86] x86/entry/64: Update comments and sanity tests for create_gap (Jiri Olsa) [1850831]
  - [x86] x86/alternatives: add missing insn.h include (Jiri Olsa) [1850831]
  - [x86] x86/alternatives: Teach text_poke_bp() to emulate instructions (Jiri Olsa) [1850831]
  - [x86] x86/paravirt: Standardize 'insn_buff' variable names (Jiri Olsa) [1850831]
  - [x86] x86_64: Allow breakpoints to emulate call instructions (Jiri Olsa) [1850831]
  - [x86] x86_64: Add gap to int3 to allow for call emulation (Jiri Olsa) [1850831]
  - [x86] x86/alternatives: Sync bp_patching update for avoiding NULL pointer exception (Jiri Olsa) [1850831]
  - [nvme] nvme: add a Identify Namespace Identification Descriptor list quirk (Gopal Tiwari) [1862136]
  - [nvme] nvme: fix identify error status silent ignore (Gopal Tiwari) [1862136]
  - [nvme] nvme: fix possible hang when ns scanning fails during error recovery (Gopal Tiwari) [1862136]
  - [nvme] nvme: refactor nvme_identify_ns_descs error handling (Gopal Tiwari) [1862136]
  - [infiniband] IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE (Kamal Heib) [1850314]
  - [powerpc] powerpc/pseries: PCIE PHB reset (Steve Best) [1747345]
  - [drm] drm/nouveau/kms: Handle -EINPROGRESS in nouveau_display_acpi_ntfy() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms: Fix runtime PM leak in nouveau_display_acpi_ntfy() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms: Invert conditionals in nouveau_display_acpi_ntfy() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms: Use pm_runtime_put_autosuspend() in hpd_work (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms/fbcon: Use pm_runtime_put_autosuspend() in suspend work (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms/fbcon: Fix pm_runtime calls in nouveau_fbcon_output_poll_changed() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms/fbcon: Correct pm_runtime calls in nouveau_fbcon_release() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms: Fix rpm leak in nouveau_connector_hotplug() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms: Handle -EINPROGRESS in nouveau_connector_hotplug() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms/tu102: wait for core update to complete when assigning windows (Lyude Paul) [1827812]
  - [drm] drm/nouveau/disp/gm200-: fix regression from HDA SOR selection changes (Lyude Paul) [1827812]
  - [drm] drm/amd/powerplay: fix a crash when overclocking Vega M (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: Fix NULL dereference in dpm sysfs handlers (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: fix preemption unit test (Lyude Paul) [1827812]
  - [drm] drm/amdgpu/gfx10: fix race condition for kiq (Lyude Paul) [1827812]
  - [drm] drm/amd/display: add dmcub check on RENOIR (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Check DMCU Exists Before Loading (Lyude Paul) [1827812]
  - [drm] drm/nouveau/nouveau: fix page fault on device private memory (Lyude Paul) [1827812]
  - [drm] drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout (Lyude Paul) [1827812]
  - [drm] drm/i915/perf: Use GTT when saving/restoring engine GPR (Lyude Paul) [1827812]
  - [drm] drm/i915/gvt: Fix two CFL MMIO handling caused by regression (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Only swap to a random sibling once upon creation (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Ignore irq enabling on the virtual engines (Lyude Paul) [1827812]
  - [drm] drm/i915: Move cec_notifier to intel_hdmi_connector_unregister, v2 (Lyude Paul) [1827812]
  - [drm] drm/amdgpu/display: create fake mst encoders ahead of time (v4) (Lyude Paul) [1827812]
  - [drm] drm/amd/display: handle failed allocation during stream construction (Lyude Paul) [1827812]
  - [drm] drm/amdgpu/sdma5: fix wptr overwritten in ->get_wptr() (Lyude Paul) [1827812]
  - [drm] drm/amdgpu/powerplay: Modify SMC message name for setting power profile mode (Lyude Paul) [1827812]
  - [drm] drm/i915: Also drop vm.ref along error paths for vma construction (Lyude Paul) [1827812]
  - [drm] drm/i915: Drop vm.ref for duplicate vma on construction (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: asd function needs to be unloaded in suspend phase (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: add TMR destory function for psp (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: don't do soft recovery if gpu_recovery=0 (Lyude Paul) [1827812]
  - [drm] drm/i915: Skip stale object handle for debugfs per-file-stats (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Pin the rings before marking active (Lyude Paul) [1827812]
  - [drm] drm/radeon: fix double free (Lyude Paul) [1827812]
  - [drm] drm: panel-orientation-quirks: Use generic orientation-data for Acer S1003 (Lyude Paul) [1827812]
  - [drm] drm: panel-orientation-quirks: Add quirk for Asus T101HA panel (Lyude Paul) [1827812]
  - [iommu] iommu/vt-d: Don't apply gfx quirks to untrusted devices (Lyude Paul) [1827812]
  - [drm] drm/tegra: hub: Do not enable orphaned window group (Lyude Paul) [1827812]
  - [drm] drm/ttm: Fix dma_fence refcnt leak when adding move fence (Lyude Paul) [1827812]
  - [drm] drm/ttm: Fix dma_fence refcnt leak in ttm_bo_vm_fault_reserved (Lyude Paul) [1827812]
  - [drm] drm/amdgpu/atomfirmware: fix vram_info fetching for renoir (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: use u rather than d for sclk/mclk (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Only revalidate bandwidth on medium and fast updates (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Mark timeline->cacheline as destroyed after rcu grace period (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Fix ineffective setting of max bpc property (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Fix incorrectly pruned modes with deep color (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: add fw release for sdma v5_0 (Lyude Paul) [1827812]
  - [drm] drm/radeon: fix fb_div check in ni_init_smc_spll_table() (Lyude Paul) [1827812]
  - [drm] drm/amd: fix potential memleak in err branch (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Enable output_bpc property on all outputs (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Use kfree() to free rgb_user in calculate_user_regamma_ramp() (Lyude Paul) [1827812]
  - [drm] Revert "drm/amd/display: disable dcn20 abm feature for bring up" (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Move gen4 GT workarounds from init_clock_gating to workarounds (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Move vlv GT workarounds from init_clock_gating to workarounds (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Move ilk GT workarounds from init_clock_gating to workarounds (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Move snb GT workarounds from init_clock_gating to workarounds (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Move ivb GT workarounds from init_clock_gating to workarounds (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Move hsw GT workarounds from init_clock_gating to workarounds (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Incrementally check for rewinding (Lyude Paul) [1827812]
  - [drm] drm/i915/tc: fix the reset of ln0 (Lyude Paul) [1827812]
  - [drm] drm/i915/icl+: Fix hotplug interrupt disabling after storm detection (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Use kvfree() to free coeff in build_regamma() (Lyude Paul) [1827812]
  - [drm] drm/amdkfd: Use correct major in devcgroup check (Lyude Paul) [1827812]
  - [drm] drm/connector: notify userspace on hotplug after register complete (Lyude Paul) [1827812]
  - [drm] drm/i915: Whitelist context-local timestamp in the gen9 cmdparser (Lyude Paul) [1827812]
  - [drm] drm/i915/gem: Avoid iterating an empty list (Lyude Paul) [1827812]
  - [drm] drm/i915: Fix AUX power domain toggling across TypeC mode resets (Lyude Paul) [1827812]
  - [drm] drm/dp_mst: Increase ACT retry timeout to 3s (Lyude Paul) [1827812]
  - [drm] drm/ast: Don't check new mode if CRTC is being disabled (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: Replace invalid device ID with a valid device ID (Lyude Paul) [1827812]
  - [drm] drm/amdgpu/display: use blanked rather than plane state for sync groups (Lyude Paul) [1827812]
  - [drm] drm/qxl: Use correct notify port address when creating cursor ring (Lyude Paul) [1827812]
  - [drm] drm/dp_mst: Reformat drm_dp_check_act_status() a bit (Lyude Paul) [1827812]
  - [drm] drm/ast: fix missing break in switch statement for format->cppcase 4 (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Revalidate bandwidth before commiting DC updates (Lyude Paul) [1827812]
  - [drm] drm/nouveau: gr/gk20a: Use firmware version 0 (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: Sync with VM root BO when switching VM to CPU update mode (Lyude Paul) [1827812]
  - [drm] drm/amd/powerpay: Disable gfxoff when setting manual mode on picasso and raven (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Do not disable pipe split if mode is not supported (Lyude Paul) [1827812]
  - [drm] drm/amd/display: dmcu wait loop calculation is incorrect in RV (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Correct updating logic of dcn21's pipe VM flags (Lyude Paul) [1827812]
  - [drm] drm/ast: Allocate initial CRTC state of the correct size (Lyude Paul) [1827812]
  - [drm] drm/hisilicon: Enforce 128-byte stride alignment to fix the hardware limitation (Lyude Paul) [1827812]
  - [drm] drm/dp: Lenovo X13 Yoga OLED panel brightness fix (Lyude Paul) [1827812]
  - [drm] drm/i915/dpcd_bl: Unbreak enable_dpcd_backlight modparam (Lyude Paul) [1827812]
  - [drm] drm/i915: Force DPCD backlight mode for some Dell CML 2020 panels (Lyude Paul) [1827812]
  - [drm] drm/i915: Force DPCD backlight mode on X1 Extreme 2nd Gen 4K AMOLED panel (Lyude Paul) [1827812]
  - [drm] drm/dp: Introduce EDID-based quirks (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: Init data to avoid oops while reading pp_num_states (Lyude Paul) [1827812]
  - [drm] drm/amd/display: fix virtual signal dsc setup (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Force watermark value propagation (Lyude Paul) [1827812]
  - [drm] drm: bridge: adv7511: Extend list of audio sample rates (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: fix and cleanup amdgpu_gem_object_close v4 (Lyude Paul) [1827812]
  - [drm] drm/vkms: Hold gem object while still in-use (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Not doing optimize bandwidth if flip pending (Lyude Paul) [1827812]
  - [drm] drm/amd/display: remove invalid dc_is_hw_initialized function (Lyude Paul) [1827812]
  - [drm] drm/amd/display: DP training to set properly SCRAMBLING_DISABLE (Lyude Paul) [1827812]
  - [drm] drm/edid: Add Oculus Rift S to non-desktop list (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Fix potential integer wraparound resulting in a hang (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Added locking for atomic update stream and update planes (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Indicate dsc updates explicitly (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Split program front end part that occur outside lock (Lyude Paul) [1827812]
  - [drm] drm/amd/display: drop cursor position check in atomic test (Lyude Paul) [1827812]
  - [drm] drm/amd/amdgpu: Update update_config() logic (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: Use GEM obj reference for KFD BOs (Lyude Paul) [1827812]
  - [drm] drm/amd/powerplay: perform PG ungate prior to CG ungate (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: drop unnecessary cancel_delayed_work_sync on PG ungate (Lyude Paul) [1827812]
  - [drm] drm/i915: Propagate error from completed fences (Lyude Paul) [1827812]
  - [drm] drm/i915/gvt: Init DPLL/DDI vreg for virtual display instead of inheritance (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Prevent dpcd reads with passive dongles (Lyude Paul) [1827812]
  - [drm] drm/amd/display: fix counter in wait_for_no_pipes_pending (Lyude Paul) [1827812]
  - [gpu] vgaarb: Keep adding VGA device in queue (Lyude Paul) [1827812]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.3.1.el8_4]
changelog:
  - Revert "uio: use request_threaded_irq instead" (Vitaly Kuznetsov) [1952952 1946644]
  - drm/ast: Set format registers in primary plane's update (Lyude Paul) [1952900 1923857]
  - net/sched: act_ct: clear post_ct if doing ct_clear (Marcelo Ricardo Leitner) [1956458 1941889]
  - md/raid1: properly indicate failure when ending a failed write request (Nigel Croxon) [1955188 1954588]
  - nitro_enclaves: Fix stale file descriptors on failed usercopy (Vitaly Kuznetsov) [1956379 1953717]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.5.1.el8_4]
changelog:
  - gfs2: report "already frozen/thawed" errors (Bob Peterson) [1961849 1932236]
  - gfs2: move freeze glock outside the make_fs_rw and _ro functions (Bob Peterson) [1961849 1932236]
  - gfs2: Add common helper for holding and releasing the freeze glock (Bob Peterson) [1961849 1932236]
  - gfs2: in signal_our_withdraw wait for unfreeze of _this_ fs only (Bob Peterson) [1961849 1932236]
  - gfs2: Don't freeze the file system during unmount (Bob Peterson) [1961849 1932236]
  - gfs2: Fix regression in freeze_go_sync (Bob Peterson) [1961849 1932236]
  - gfs2: The freeze glock should never be frozen (Bob Peterson) [1961849 1932236]
  - gfs2: When freezing gfs2, use GL_EXACT and not GL_NOCACHE (Bob Peterson) [1961849 1932236]
  - gfs2: read-only mounts should grab the sd_freeze_gl glock (Bob Peterson) [1961849 1932236]
  - gfs2: freeze should work on read-only mounts (Bob Peterson) [1961849 1932236]
  - gfs2: Abort gfs2_freeze if io error is seen (Bob Peterson) [1961849 1932236]
  - CI: Disable result checking for realtime check (Veronika Kabatova)
  - CI: Explicitly disable result checking for private CI (Veronika Kabatova)
  - CI: Rename variable (Veronika Kabatova)
  - CI: Update builder containers (Veronika Kabatova)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.6.1.el8_4]
changelog:
  - openvswitch: fix stack OOB read while fragmenting IPv4 packets (Davide Caratti) [1963940 1924608]
  - net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets (Davide Caratti) [1963940 1924608]
  - net/sched: act_ct: fix wild memory access when clearing fragments (Davide Caratti) [1963940 1924608]
  - net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT (Ivan Vecera)
  - redhat/configs: Add CONFIG_SYSTEM_REVOCATION_KEYS and CONFIG_SYSTEM_REVOCATION_LIST (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: add 'x509_revocation_list' to gitignore (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - integrity: Load mokx variables into the blacklist keyring (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: Add ability to preload revocation certs (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: Move load_system_certificate_list to a common function (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: Add EFI_CERT_X509_GUID support for dbx entries (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - net/sched: cls_api: increase max_reclassify_loop (Davide Caratti) [1965148 1955136]
  - dm writecache: fix performance degradation in ssd mode (Mike Snitzer) [1962241 1961859]
  - scsi: fnic: Use scsi_host_busy_iter() to traverse commands (Ewan D. Milne) [1961705 1949250]
  - scsi: fnic: Kill 'exclude_id' argument to fnic_cleanup_io() (Ewan D. Milne) [1961705 1949250]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.7.1.el8_4]
changelog:
  - net: zero-initialize tc skb extension on allocation (Ivan Vecera) [1965457 1946986]
  - net/sched: cls_flower: fix only mask bit check in the validate_ct_state (Ivan Vecera) [1965457 1946986]
  - net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb (Ivan Vecera) [1965457 1946986]
  - net/sched: act_api: fix miss set post_ct for ovs after do conntrack in act_ct (Ivan Vecera) [1965457 1946986]
  - net/sched: cls_flower: validate ct_state for invalid and reply flags (Ivan Vecera) [1965457 1946986]
  - flow_dissector: fix TTL and TOS dissection on IPv4 fragments (Paolo Abeni) [1963952 1950288]
  - Revert "sctp: Fix SHUTDOWN CTSN Ack in the peer restart case" (Xin Long) [1965632 1953839]
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_b (Xin Long) [1965632 1953839]
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_a (Xin Long) [1965632 1953839]
  - Bluetooth: verify AMP hci_chan before amp_destroy (Gopal Tiwari) [1962544 1962546] {CVE-2021-33034}
  - x86/kvm: Unify kvm_pv_guest_cpu_reboot() with kvm_guest_cpu_offline() (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Disable all PV features on crash (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Disable kvmclock on all CPUs on shutdown (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Teardown PV features on boot CPU as well (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Fix pr_info() for async PF setup/teardown (Lenny Szubowicz) [1964930 1934273]
  - net/sched: act_ct: Fix ct template allocation for zone 0 (Marcelo Ricardo Leitner) [1965150 1881824]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.8.1.el8_4]
changelog:
  - iavf: amend removal of MODULE_VERSION (Stefan Assmann) [1969925 1955738]
  - ixgbe: Amend commit acf03026ec5a to include a version string in module info. (Ken Cox) [1969922 1955759]
  - i40e: amend removal of MODULE_VERSION (Stefan Assmann) [1969923 1955736]
  - redhat/configs: Add CONFIG_PINCTRL_EMMITSBURG (David Arcari) [1963984 1959506]
  - redhat/configs: Remove CONFIG_EMMITSBURG (David Arcari) [1963984 1959506]
  - netlink: add tracepoint at NL_SET_ERR_MSG (Marcelo Ricardo Leitner) [1972938 1956983]
  - Revert "[netdrv] net/intel: remove driver versions from Intel drivers" (Jonathan Toppins) [1969917 1955745]
  - Amends commit ea6244cc248b to include a version string in module info. (Ken Cox) [1969915 1955726]
  - Revert "[netdrv] net/broadcom: Clean broadcom code from driver versions" (Jonathan Toppins) [1969914 1955721]
  - ena: revert removal of MODULE_VERSION from ena (Petr Oros) [1969913 1955712]
  - fm10k: amend removal of MODULE_VERSION (Vladis Dronov) [1969910 1955730]
  - net/sched: act_ct: Offload connections with commit action (Marcelo Ricardo Leitner) [1968679 1965817]
  - netfilter: flowtable: Remove redundant hw refresh bit (Marcelo Ricardo Leitner) [1968679 1965817]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.9.1.el8_4]
changelog:
  - ixgbevf: Amend commit acf03026ec5a to include a version in module info. (Ken Cox) [1969911 1955764]
  - CI: Merge configuration (Veronika Kabatova)
  - igc: amend removal of MODULE_VERSION (Corinna Vinschen) [1969921 1955755]
  - igb: amend removal of MODULE_VERSION (Corinna Vinschen) [1969919 1955748]
  - locking/qrwlock: Fix ordering in queued_write_lock_slowpath() (Waiman Long) [1964419 1950110]
  - scsi: qedf: Do not put host in qedf_vport_create() unconditionally (Nilesh Javali) [1974968 1899384]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.10.1.el8_4]
changelog:
  - igbvf: amend removal of MODULE_VERSION (Corinna Vinschen) [1969920 1955752]
  - bluetooth: eliminate the potential race condition when removing the HCI controller (Gopal Tiwari) [1971464 1971488] {CVE-2021-32399}
  - scsi: ibmvfc: Free channel_setup_buf during device tear down (Steve Best) [1964697 1938102]
  - i40e: Fix parameters in aq_get_phy_register() (Stefan Assmann) [1967099 1907852]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.10.2.el8_4]
changelog:
  - seq_file: Disallow extremely large seq buffer allocations (Ian Kent) [1975181 1975182] {CVE-2021-33909}


author: Akemi Yagi <toracat@centos.org> [4.18.0-305.10.2.el8_4.centos.plus]
changelog:
  - Apply debranding changes
  - Modify config file for x86_64 with extra features turned on including some network adapters,
    some SCSI adapters, ReiserFS
  - Apply patches from CentOS-7 plus kernel
  - Apply driver patches imported from ELRepo
  - Add device IDs that have been removed from RHEL 8 kernels (mpt3sas)
  - Apply patches for e1000 from kernel.org [bug#16284]
  - Added a triggerin scriptlet to rebuild the initramfs image
    when the system microcode package is updated [bug#17562]
  - wireguard added [bug#17652]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.2.1.el8_4]
changelog:
  - net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP (Alaa Hleihel) [1952061 1936742]
  - net/mlx5e: Reject tc rules which redirect from a VF to itself (Alaa Hleihel) [1952065 1932839]
  - net/mlx5: CT: Add support for matching on ct_state inv and rel flags (Alaa Hleihel) [1952062 1942681]
  - KVM: VMX: Don't use vcpu->run->internal.ndata as an array index (Jon Maloy) [1954221 1954219]
  - tools/power turbostat: Revert "[tools] tools/power turbostat: Enable accumulate RAPL display" (Prarit Bhargava) [1952987 1944699]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.11.1.el8_4]
changelog:
  - SUNRPC: Handle major timeout in xprt_adjust_timeout() (Scott Mayhew) [1980613 1979070]
  - net/mlx5e: Disable TLS device offload in kdump mode (Alaa Hleihel) [1969909 1946647]
  - net/mlx5e: Disable TX MPWQE in kdump mode (Alaa Hleihel) [1969909 1946647]
  - drm/i915: Add an encoder hook to sanitize its state during init/resume (Imre Deak) [1981250 1961122]
  - netfilter: x_tables: fix compat match/target pad out-of-bound write (Florian Westphal) [1980500 1980501] {CVE-2021-22555}
  - Bluetooth: btusb: Fix the autosuspend enable and disable (Gopal Tiwari) [1972564 1927375]
  - cifs: handle empty list of targets in cifs_reconnect() (Ronnie Sahlberg) [1973637 1952263]
  - tick/nohz: Update idle_exittime on actual idle exit (Phil Auld) [1978710 1962632]
  - tick/nohz: Remove superflous check for CONFIG_VIRT_CPU_ACCOUNTING_NATIVE (Phil Auld) [1978710 1962632]
  - tick/nohz: Conditionally restart tick on idle exit (Phil Auld) [1978710 1962632]
  - can: bcm: delay release of struct bcm_op after synchronize_rcu() (Hangbin Liu) [1975058 1975059]
  - redhat/configs: Re-enable dptf_power module (Prarit Bhargava) [1968381 1962349]
  - KVM: do not allow mapping valid but non-reference-counted pages (Jon Maloy) [1975514 1975515] {CVE-2021-22543}
  - seq_file: Disallow extremely large seq buffer allocations (Ian Kent) [1975181 1975182] {CVE-2021-33909}


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.12.1.el8_4]
changelog:
  - Revert "nvme-pci: remove last_sq_tail" (Gopal Tiwari) [1965415 1921591]
  - tc-testing: add test for ct DNAT tuple collision (Marcelo Ricardo Leitner) [1982494 1964578]
  - tc-testing: add support for sending various scapy packets (Marcelo Ricardo Leitner) [1982494 1964578]
  - tc-testing: fix list handling (Marcelo Ricardo Leitner) [1982494 1964578]
  - net/sched: act_ct: handle DNAT tuple collision (Marcelo Ricardo Leitner) [1982494 1964578]
  - mm/memcg: Relocate tcpmem to below memory in struct mem_cgroup (Waiman Long) [1980314 1959772]
  - mm/memcg: optimize user context object stock access (Waiman Long) [1980314 1959772]
  - mm/memcg: improve refill_obj_stock() performance (Waiman Long) [1980314 1959772]
  - mm/memcg: cache vmstat data in percpu memcg_stock_pcp (Waiman Long) [1980314 1959772]
  - mm/memcg: move mod_objcg_state() to memcontrol.c (Waiman Long) [1980314 1959772]
  - mm: memcontrol: use obj_cgroup APIs to charge kmem pages (Waiman Long) [1980314 1959772]
  - mm: memcontrol: change ug->dummy_page only if memcg changed (Waiman Long) [1980314 1959772]
  - mm: memcontrol: directly access page->memcg_data in mm/page_alloc.c (Waiman Long) [1980314 1959772]
  - mm: memcontrol: introduce obj_cgroup_{un}charge_pages (Waiman Long) [1980314 1959772]
  - mm: memcontrol: slab: fix obtain a reference to a freeing memcg (Waiman Long) [1980314 1959772]
  - mm: move lruvec stats update functions to vmstat.h (Waiman Long) [1980314 1959772]
  - mm: memcg/slab: rename *_lruvec_slab_state to *_lruvec_kmem_state (Waiman Long) [1980314 1959772]
  - mm: Convert page kmemcg type to a page memcg flag (Waiman Long) [1980314 1959772]
  - mm: Introduce page memcg flags (Waiman Long) [1980314 1959772]
  - mm: memcontrol/slab: Use helpers to access slab page's memcg_data (Waiman Long) [1980314 1959772]
  - mm: memcontrol: Use helpers to read page's memcg data (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: extract check_[new|free]_page_bad() common part to page_bad_reason() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: rename free_pages_check() to check_free_page() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: rename free_pages_check_bad() to check_free_page_bad() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: bad_flags is not necessary for bad_page() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: bad_[reason|flags] is not necessary when PageHWPoison (Waiman Long) [1980314 1959772]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.13.1.el8_4]
changelog:
  - xfrm: Fix wraparound in xfrm_policy_addr_delta() (Sabrina Dubroca) [1981840 1951965]
  - VMCI: Release resource if the work is already queued (Cathy Avery) [1982042 1978518]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.14.1.el8_4]
changelog:
  - tick/nohz: Kick only _queued_ task whose tick dependency is updated (Waiman Long) [1981336 1922901]
  - tick/nohz: Change signal tick dependency to wake up CPUs of member tasks (Waiman Long) [1981336 1922901]
  - tick/nohz: Only wake up a single target cpu when kicking a task (Waiman Long) [1981336 1922901]
  - tick/nohz: Narrow down noise while setting current task's tick dependency (Waiman Long) [1981336 1922901]
  - mlx5: net: zero-initialize tc skb extension on allocation (Jan Stancek) [1982220 1965418]
  - scsi: qedf: Update the max_id value in host structure (Nilesh Javali) [1989097 1954876]
  - scsi: qla2xxx: Reserve extra IRQ vectors (Nilesh Javali) [1986156 1964834]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.15.1.el8_4]
changelog:
  - sched: Fix data-race in wakeup (Phil Auld) [1987296 1937103]
  - mm/page_alloc: bail out on fatal signal during reclaim/compaction retry attempt (Aaron Tomlin) [1984085 1919765]
  - sunrpc: Avoid a KASAN slab-out-of-bounds bug in xdr_set_page_base() (Benjamin Coddington) [1990404 1969751]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.16.1.el8_4]
changelog:
  - kernfs: dont call d_splice_alias() under kernfs node lock (Ian Kent) [1994879 1939133]
  - kernfs: use i_lock to protect concurrent inode updates (Ian Kent) [1994879 1939133]
  - kernfs: switch kernfs to use an rwsem (Ian Kent) [1994879 1939133]
  - kernfs: use VFS negative dentry caching (Ian Kent) [1994879 1939133]
  - kernfs: add a revision to identify directory node changes (Ian Kent) [1994879 1939133]
  - kernfs: move revalidate to be near lookup (Ian Kent) [1994879 1939133]
  - scsi: lpfc: Fix dropped FLOGI during pt2pt discovery recovery (Jan Stancek) [1948608 1923762]
  - net: sched: act_mirred: Reset ct info when mirror/redirect skb (C. Erastus Toe) [1992226 1980532]
  - usb: ehci: Prevent missed ehci interrupts with edge-triggered MSI (Torez Smith) [1993894 1972139]
  - usb: ehci: do not initialise static variables (Torez Smith) [1993894 1972139]
  - usb: host: move EH SINGLE_STEP_SET_FEATURE implementation to core (Torez Smith) [1993894 1972139]
  - USB: ehci: drop workaround for forced irq threading (Torez Smith) [1993894 1972139]
  - usb: ehci: add spurious flag to disable overcurrent checking (Torez Smith) [1993894 1972139]
  - NFS: Only change the cookie verifier if the directory page cache is empty (Benjamin Coddington) [1993895 1982825]
  - NFS: Fix handling of cookie verifier in uncached_readdir() (Benjamin Coddington) [1993895 1982825]
  - nfs: Subsequent READDIR calls should carry non-zero cookieverifier (Benjamin Coddington) [1993895 1982825]
  - KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow (Jon Maloy) [1988225 1988226] {CVE-2021-37576}


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.17.1.el8_4]
changelog:
  - ucounts: Move max_time_namespace according to ucount_type (Alex Gladkov) [1998002 1982954]
  - netfilter: conntrack: remove offload_pickup sysctl again (Florian Westphal) [1995555 1987101]
  - netfilter: flowtable: Set offload timeouts according to proto values (Phil Sutter) [1995554 1979184]
  - netfilter: conntrack: Introduce udp offload timeout configuration (Phil Sutter) [1995554 1979184]
  - netfilter: conntrack: Introduce tcp offload timeout configuration (Phil Sutter) [1995554 1979184]
  - powerpc/64s: Fix crashes when toggling stf barrier (Desnes A. Nunes do Rosario) [1989174 1964484]
  - iavf: fix locking of critical sections (Stefan Assmann) [1997534 1975245]
  - iavf: do not override the adapter state in the watchdog task (Stefan Assmann) [1997534 1975245]


author: Akemi Yagi <toracat@centos.org> [4.18.0-305.17.1.el8_4.centos.plus]
changelog:
  - Apply debranding changes
  - Modify config file for x86_64 with extra features turned on including some network adapters,
    some SCSI adapters, ReiserFS
  - Apply patches from CentOS-7 plus kernel
  - Apply driver patches imported from ELRepo
  - Add device IDs that have been removed from RHEL 8 kernels (mpt3sas)
  - Apply patches for e1000 from kernel.org [bug#16284]
  - Added a triggerin scriptlet to rebuild the initramfs image
    when the system microcode package is updated [bug#17562]
  - wireguard added [bug#17652]
  - Modified generate_bls_conf.sh to prevent displaying the distibution name in grub in which the package was built.


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.18.1.el8_4]
changelog:
  - mfd: intel-lpss: Use devm_ioremap_uc for MMIO (Steve Best) [1989560 1986715]
  - lib: devres: add a helper function for ioremap_uc (Steve Best) [1989560 1986715]
  - ceph: fix test for whether we can skip read when writing beyond EOF (Jeff Layton) [1996680 1971101]
  - arm64: memory: Add missing brackets to untagged_addr() macro (Chris von Recklinghausen) [1997998 1955809]
  - arm64: tags: Preserve tags for addresses translated via TTBR1 (Chris von Recklinghausen) [1997998 1955809]
  - arm64: entry: Move ct_user_exit before any other exception (Chris von Recklinghausen) [1997998 1955809]
  - arm64: memory: Implement __tag_set() as common function (Chris von Recklinghausen) [1997998 1955809]
  - arm64: mm: Really fix sparse warning in untagged_addr() (Chris von Recklinghausen) [1997998 1955809]
  - arm64: untag user pointers in access_ok and __uaccess_mask_ptr (Chris von Recklinghausen) [1997998 1955809]
  - arm64/mm: fix variable 'tag' set but not used (Chris von Recklinghausen) [1997998 1955809]
  - arm64: entry: SP Alignment Fault doesn't write to FAR_EL1 (Chris von Recklinghausen) [1997998 1955809]
  - arm64: compat: Add separate CP15 trapping hook (Chris von Recklinghausen) [1997998 1955809]
  - arm64: don't restore GPRs when context tracking (Chris von Recklinghausen) [1997998 1955809]
  - KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656) (Jon Maloy) [1985429 1985430] {CVE-2021-3656}
  - KVM: SVM: add module param to control the #SMI interception (Jon Maloy) [1985429 1985430] {CVE-2021-3656}
  - tty: Don't hold ldisc lock in tty_reopen() if ldisc present (Waiman Long) [1997999 1968271]
  - tty/ldsem: Add lockdep asserts for ldisc_sem (Waiman Long) [1997999 1968271]
  - tty: Simplify tty->count math in tty_reopen() (Waiman Long) [1997999 1968271]
  - tty: Don't block on IO when ldisc change is pending (Waiman Long) [1997999 1968271]
  - tty: Hold tty_ldisc_lock() during tty_reopen() (Waiman Long) [1997999 1968271]
  - tty: Drop tty->count on tty_reopen() failure (Waiman Long) [1997999 1968271]
  - [s390] s390/vtime: fix increased steal time accounting (Claudio Imbrenda) [1988386 1963075]
  - XArray: Fix splitting to non-zero orders (Chris von Recklinghausen) [1997997 1946304]
  - XArray: Fix split documentation (Chris von Recklinghausen) [1997997 1946304]
  - ima: extend boot_aggregate with kernel measurements (Bruno Meneguele) [1997766 1977422]
  - ceph: reduce contention in ceph_check_delayed_caps() (Jeff Layton) [1995862 1953430]
  - ice: Stop processing VF messages during teardown (Ken Cox) [1997538 1986451]
  - iavf: Set RSS LUT and key in reset handle path (Ken Cox) [1997536 1910853]
  - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) (Jon Maloy) [1985412 1985413] {CVE-2021-3653}
  - scsi: ibmvfc: Fix potential race in ibmvfc_wait_for_ops() (Steve Best) [1969792 1941180]
  - [s390] s390/dasd: add missing discipline function (Claudio Imbrenda) [1995206 1981804]
  - serial_core: switch to ->[sg]et_serial() (Artem Savkov) [1993872 1952415]
  - net/mlx5e: Fix mapping of ct_label zero (Jan Stancek) [1983681 1915308]
  - drm/qxl: add lock asserts to qxl_bo_vmap_locked + qxl_bo_vunmap_locked (Lyude Paul) [1992839 1907341]
  - drm/qxl: rework cursor plane (Lyude Paul) [1992839 1907341]
  - drm/qxl: move shadow handling to new qxl_prepare_shadow() (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix monitors object vmap (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix prime vmap (Lyude Paul) [1992839 1907341]
  - drm/qxl: rename qxl_bo_kmap -> qxl_bo_vmap_locked (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix lockdep issue in qxl_alloc_release_reserved (Lyude Paul) [1992839 1907341]
  - drm/qxl: use ttm bo priorities (Lyude Paul) [1992839 1907341]
  - drm/qxl: more fence wait rework (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly handle device init failures (Lyude Paul) [1992839 1907341]
  - drm/qxl: allocate dumb buffers in ram (Lyude Paul) [1992839 1907341]
  - drm/qxl: simplify qxl_fence_wait (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly free qxl releases (Lyude Paul) [1992839 1907341]
  - drm/qxl: handle shadow in primary destroy (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly pin/unpin shadow (Lyude Paul) [1992839 1907341]
  - drm/qxl: release shadow on shutdown (Lyude Paul) [1992839 1907341]
  - drm/qxl: unpin release objects (Lyude Paul) [1992839 1907341]
  - drm/qxl: use drmm_mode_config_init (Lyude Paul) [1992839 1907341]
  - qxl/ttm: drop the unusued no wait flag to reserve function (Lyude Paul) [1992839 1907341]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.19.1.el8_4]
changelog:
  - libceph: allow addrvecs with a single NONE/blank address (Jeff Layton) [1996682 1972278]
  - ice: Only lock to update netdev dev_addr (Michal Schmidt) [2000129 1995868]
  - ice: don't remove netdev->dev_addr from uc sync list (Ken Cox) [2000130 1961018]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-300.el8]
changelog:
  - [scsi] scsi: qedi: Correct max length of CHAP secret (Nilesh Javali) [1909180]
  - redhat: use tags from git notes for zstream to generate changelog (Frantisek Hrbata)
  - redhat: add CI file for kernel-private (Bruno Meneguele)
  - CI: Drop unused variable (Bruno Meneguele)
  - CI: Enable RT verification (Bruno Meneguele)
  - KVM: SVM: Clear the CR4 register on reset (Vitaly Kuznetsov) [1920788]
  - net: flow_offload: Add original direction flag to ct_metadata (Marcelo Ricardo Leitner) [1921946]
  - net/sched: cls_flower: Add match on the ct_state reply flag (Marcelo Ricardo Leitner) [1921946]
  - net/sched: cls_flower add CT_FLAGS_INVALID flag support (Marcelo Ricardo Leitner) [1921946]
  - net/sched: cls_flower: Reject invalid ct_state flags rules (Marcelo Ricardo Leitner) [1921946]
  - netlink: add mask validation (Marcelo Ricardo Leitner) [1921946]
  - netlink: create helpers for checking type is an int (Marcelo Ricardo Leitner) [1921946]
  - netlink: policy: correct validation type check (Marcelo Ricardo Leitner) [1921946]
  - netlink: make NLA_BINARY validation more flexible (Marcelo Ricardo Leitner) [1921946]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-301.el8]
changelog:
  - ibmvnic: fix a race between open and reset (Diego Domingos) [1940042]
  - ibmvnic: Set to CLOSED state even on error (Diego Domingos) [1940042]
  - ibmvnic: device remove has higher precedence over reset (Diego Domingos) [1940042]
  - ibmvnic: merge do_change_param_reset into do_reset (Diego Domingos) [1940042]
  - ibmvfc: disable MQ channelization by default (Gustavo Luiz Duarte) [1939359]
  - pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() (Steve Dickson) [1926945]
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930833] {CVE-2021-27365}
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930856] {CVE-2021-27363}
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1930809] {CVE-2021-27364}
  - futex: Handle faults correctly for PI futexes (Waiman Long) [1924635]
  - futex: Simplify fixup_pi_state_owner() (Waiman Long) [1924635]
  - futex: Use pi_state_update_owner() in put_pi_state() (Waiman Long) [1924635]
  - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Waiman Long) [1924635]
  - futex: Provide and use pi_state_update_owner() (Waiman Long) [1924635]
  - futex: Replace pointless printk in fixup_owner() (Waiman Long) [1924635]
  - futex: Ensure the correct return value from futex_lock_pi() (Waiman Long) [1924635]
  - futex: Don't enable IRQs unconditionally in put_pi_state() (Waiman Long) [1924635]
  - futex: Fix incorrect should_fail_futex() handling (Waiman Long) [1924635]
  - futex: Consistently use fshared as boolean (Waiman Long) [1924635]
  - futex: Remove needless goto's (Waiman Long) [1924635]
  - futex: Remove put_futex_key() (Waiman Long) [1924635]
  - NFS: Correct size calculation for create reply length (Benjamin Coddington) [1934903]
  - SUNRPC: Set memalloc_nofs_save() for sync tasks (Benjamin Coddington) [1934098]
  - net/mlx5: CT: Add support for matching on ct_state reply flag (Alaa Hleihel) [1919651]
  - net/mlx5e: CT: manage the lifetime of the ct entry object (Alaa Hleihel) [1919651]
  - net/mlx5e: CT: Use per flow counter when CT flow accounting is enabled (Alaa Hleihel) [1919651]
  - net/mlx5e: Fix a use after free on error in mlx5_tc_ct_shared_counter_get() (Alaa Hleihel) [1919651]
  - net/mlx5e: CT: Use the same counter for both directions (Alaa Hleihel) [1919651]
  - ethtool: fix the check logic of at least one channel for RX/TX (Ivan Vecera) [1907406]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-302.el8]
changelog:
  - PCI: rpadlpar: Fix potential drc_name corruption in store functions (Gustavo Luiz Duarte) [1938116]
  - selftests: kvm: Add basic Hyper-V clocksources tests (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Don't touch TSC page values when guest opted for re-enlightenment (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Track Hyper-V TSC page status (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Prevent using not-yet-updated TSC page by secondary CPUs (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Limit guest to writing zero to HV_X64_MSR_TSC_EMULATION_STATUS (Vitaly Kuznetsov) [1931782]
  - drm/i915/guc: Update to use firmware v49.0.1 (Dave Airlie) [1935281] {CVE-2020-12362}
  - time: Enable __kernel_timespec for 32-bit vdso build (Waiman Long) [1936282]
  - lib/idr.c: document calling context for IDA APIs mustn't use locks (Chris von Recklinghausen) [1917764]
  - ida: Free allocated bitmap in error path (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Fix compilation (Chris von Recklinghausen) [1917764]
  - vmalloc: convert to XArray (Chris von Recklinghausen) [1917764]
  - mm: pass addr as unsigned long to vb_free (Chris von Recklinghausen) [1917764]
  - radix tree: Remove multiorder support (Chris von Recklinghausen) [1917764]
  - radix tree test: Convert multiorder tests to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Convert item_delete_rcu to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Convert item_kill_tree to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Move item_insert_order (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Remove multiorder benchmarking (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Remove __item_insert (Chris von Recklinghausen) [1917764]
  - radix tree: Remove radix_tree_clear_tags (Chris von Recklinghausen) [1917764]
  - radix tree: Remove split/join code (Chris von Recklinghausen) [1917764]
  - radix tree: Remove radix_tree_update_node_t (Chris von Recklinghausen) [1917764]
  - mm: Convert truncate to XArray (Chris von Recklinghausen) [1917764]
  - copy rh_kabi.h to tools/testing/radix-tree/linux (Chris von Recklinghausen) [1917764]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-303.el8]
changelog:
  - redhat: switch secureboot kernel image signing to release keys (Jan Stancek)
  - Revert "[md] md/raid5: add a new member of offset into r5dev" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: make async_copy_data() to support different page offset" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid5: add new xor function to support different page offset" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: convert to new xor compution interface" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid6: let syndrome computor support different page offset" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid6: let async recovery function support different page offset" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: let multiple devices of stripe_head share page" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: resize stripe_head when reshape array" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: reallocate page array after setting new stripe_size" (Nigel Croxon) [1936903]
  - ACPI: PNP: compare the string length in the matching_id() (Mark Langsdorf) [1933702]
  - ceph: add missing break when parsing "nowsync" mount option (Jeff Layton) [1932753]
  - get_maintainer.conf: Update with new location of RHMAINTAINERS (Prarit Bhargava)
  - redhat: make pathspec exclusion compatible with old git versions (Herton R. Krzesinski)
  - redhat/scripts: Update merge-subtrees.sh with new subtree location (Prarit Bhargava)
  - tree: Add RHMAINTAINERS soft link in 8.4 (Prarit Bhargava)
  - tree: remove existing redhat/rhdocs subtree in 8.4 (Prarit Bhargava)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-304.el8]
changelog:
  - mm: Revert "remove the account_page_dirtied export" (Waiman Long) [1941257]
  - Revert "[netdrv] net/broadcom: Clean broadcom code from driver versions" (Jonathan Toppins) [1940842]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.1.1.el8_4]
changelog:
  - ALSA: usb-audio: fix NULL ptr dereference in usb_audio_probe (Jaroslav Kysela) [1954545 1870724]
  - ALSA: usb-audio: fix use after free in usb_audio_disconnect (Jaroslav Kysela) [1954545 1870724]
  - ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend() (Jaroslav Kysela) [1954545 1870724]
  - selinux: fix deadlock in security_set_bools() (Ondrej Mosnacek) [1945123 1924230]
  - geneve: do not modify the shared tunnel info when PMTU triggers an ICMP reply (Antoine Tenart) [1944667 1941753]
  - vxlan: do not modify the shared tunnel info when PMTU triggers an ICMP reply (Antoine Tenart) [1944667 1941753]
  - redhat: switch to zstream (Jan Stancek)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-297.el8]
changelog:
  - KVM: SVM: Make symbol 'svm_gp_erratum_intercept' static (Paolo Bonzini) [1769283]
  - KVM: SVM: Fix #GP handling for doubly-nested virtualization (Paolo Bonzini) [1769283]
  - KVM: SVM: Add support for SVM instruction address check change (Paolo Bonzini) [1769283]
  - KVM: SVM: Add emulation support for #GP triggered by SVM instructions (Paolo Bonzini) [1769283]
  - KVM: x86: Factor out x86 instruction emulation with decoding (Paolo Bonzini) [1769283]
  - gfs2: In gfs2_ail1_start_one unplug the IO when needed (Bob Peterson) [1648446]
  - gfs2: Free rd_bits later in gfs2_clear-rgrpd to fix use-after-free (Bob Peterson) [1648446]
  - gfs2: Only access gl_delete for iopen glocks (Bob Peterson) [1648446]
  - gfs2: Fix case in which ail writes are done to jdata holes (Bob Peterson) [1648446]
  - gfs2: simplify gfs2_block_map (Bob Peterson) [1648446]
  - gfs2: Only set PageChecked if we have a transaction (Bob Peterson) [1648446]
  - gfs2: don't lock sd_ail_lock in gfs2_releasepage (Bob Peterson) [1648446]
  - gfs2: make gfs2_ail1_empty_one return the count of active items (Bob Peterson) [1648446]
  - gfs2: Wipe jdata and ail1 in gfs2_journal_wipe, formerly gfs2_meta_wipe (Bob Peterson) [1648446]
  - gfs2: enhance log_blocks trace point to show log blocks free (Bob Peterson) [1648446]
  - gfs2: rename gfs2_write_full_page to gfs2_write_jdata_page, remove parm (Bob Peterson) [1648446]
  - PM: hibernate: flush swap writer after marking (Lenny Szubowicz) [1898677]
  - cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown (Lenny Szubowicz) [1898677]
  - PM / hibernate: memory_bm_find_bit(): Tighten node optimisation (Lenny Szubowicz) [1898677]
  - bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation (Jiri Benc) [1882215]
  - ice, xsk: clear the status bits for the next_to_use descriptor (Jiri Benc) [1906820]
  - net/mlx4_en: Handle TX error CQE (Alaa Hleihel) [1925690]
  - net/mlx4_en: Avoid scheduling restart task if it is already running (Alaa Hleihel) [1925690]
  - blk-mq: test QUEUE_FLAG_HCTX_ACTIVE for sbitmap_shared in hctx_may_queue (Ming Lei) [1922013]
  - blk-mq: Improve performance of non-mq IO schedulers with multiple HW queues (Ming Lei) [1922013]
  - Revert "blk-mq, elevator: Count requests per hctx to improve performance" (Ming Lei) [1922013]
  - bpftool: Disable CAP_BPF check for feature command (Jiri Olsa) [1921542]
  - RDMA/siw: Fix calculation of tx_valid_cpus size (Kamal Heib) [1919502]
  - net/mlx5e: Disable performance optimization for IPv4/IPv6 ethertype (Alaa Hleihel) [1928671 1919807]
  - IB/mlx5: Return appropriate error code instead of ENOMEM (Alaa Hleihel) [1928671]
  - net/mlx5: Disable devlink reload for lag devices (Alaa Hleihel) [1928671 1929166]
  - net/mlx5: Disable devlink reload for multi port slave device (Alaa Hleihel) [1928671 1929166]
  - net/mlx5: Disallow RoCE on lag device (Alaa Hleihel) [1928671 1929166]
  - net/mlx5: Disallow RoCE on multi port slave device (Alaa Hleihel) [1928671 1929166]
  - net/mlx5: Fix health error state handling (Alaa Hleihel) [1928671]
  - net/mlx5e: Change interrupt moderation channel params also when channels are closed (Alaa Hleihel) [1928671]
  - net/mlx5e: Don't change interrupt moderation params when DIM is enabled (Alaa Hleihel) [1928671]
  - net/mlx5e: E-switch, Fix rate calculation for overflow (Alaa Hleihel) [1928671]
  - net/mlx5e: Release skb in case of failure in tc update skb (Alaa Hleihel) [1928671 1929119]
  - net/mlx5e: Check tunnel offload is required before setting SWP (Alaa Hleihel) [1928671 1925439]
  - net/mlx5e: kTLS, Use refcounts to free kTLS RX priv context (Alaa Hleihel) [1928671 1928706]
  - net/mlx5e: Fix CQ params of ICOSQ and async ICOSQ (Alaa Hleihel) [1928671 1928706]
  - net/mlx5e: Replace synchronize_rcu with synchronize_net (Alaa Hleihel) [1928671 1913616]
  - net/mlx5e: Enable XDP for Connect-X IPsec capable devices (Alaa Hleihel) [1928671 1856795]
  - net/mlx5e: Enable striding RQ for Connect-X IPsec capable devices (Alaa Hleihel) [1928671 1926120]
  - fix regression in "epoll: Keep a reference on files added to the check list" (Carlos Maiolino) [1920776] {CVE-2020-0466}
  - do_epoll_ctl(): clean the failure exits up a bit (Carlos Maiolino) [1920776] {CVE-2020-0466}
  - epoll: Keep a reference on files added to the check list (Carlos Maiolino) [1920776] {CVE-2020-0466}


author: Jan Stancek <jstancek@redhat.com> [4.18.0-298.el8]
changelog:
  - drm/i915/gen11+: Only load DRAM information from pcode (Lyude Paul) [1934537]
  - drm/i915/dg1: Wait for pcode/uncore handshake at startup (Lyude Paul) [1934537]
  - powercap/intel_rapl: add support for TigerLake Desktop (David Arcari) [1932457]
  - powerpc/perf: Fix handling of privilege level checks in perf interrupt context (Gustavo Luiz Duarte) [1918411]
  - NFSv4.2: fix error return on memory allocation failure (Scott Mayhew) [1917689]
  - NFSv4.2: improve page handling for GETXATTR (Scott Mayhew) [1917689]
  - NFSv4.2: Fix up the get/listxattr calls to rpc_prepare_reply_pages() (Scott Mayhew) [1917689]
  - NFS: Fix rpcrdma_inline_fixup() crash with new LISTXATTRS operation (Scott Mayhew) [1917689]
  - SUNRPC: Fix up xdr_set_page() (Benjamin Coddington) [1917689]
  - NFSv4: Fix open coded xdr_stream_remaining() (Benjamin Coddington) [1917689]
  - SUNRPC: Clean up the handling of page padding in rpc_prepare_reply_pages() (Benjamin Coddington) [1917689]
  - SUNRPC: Fix up xdr_read_pages() to take arbitrary object lengths (Benjamin Coddington) [1917689]
  - SUNRPC: Clean up helpers xdr_set_iov() and xdr_set_page_base() (Benjamin Coddington) [1917689]
  - SUNRPC: Split out a function for setting current page (Benjamin Coddington) [1917689]
  - SUNRPC: Fix up typo in xdr_init_decode() (Benjamin Coddington) [1917689]
  - NFSv4: Fix the alignment of page data in the getdeviceinfo reply (Benjamin Coddington) [1917689]
  - net: fix pos incrementment in ipv6_route_seq_next (Lorenzo Bianconi) [1926608]
  - ipv6_route_seq_next should increase position index (Lorenzo Bianconi) [1926608]
  - bpf: Clear subreg_def for global function return values (Yauheni Kaliuta) [1934062]
  - igc: Fix returning wrong statistics (Corinna Vinschen) [1910873]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-299.el8]
changelog:
  - md: Set prev_flush_start and flush_bio in an atomic way (Xiao Ni) [1901598]
  - md: improve variable names in md_flush_request() (Xiao Ni) [1901598]
  - hpsa: fix regression issue for old controllers (Joseph Szczypek) [1925711]
  - scsi: hpsa: Correct dev cmds outstanding for retried cmds (Joseph Szczypek) [1925711]
  - vt: Disable KD_FONT_OP_COPY (Dave Airlie) [1903937] {CVE-2020-28974}
  - drm/i915/rkl: Remove require_force_probe protection (Lyude Paul) [1937558]
  - drm/i915/tgl/psr: Disable PSR on Tigerlake for now (Lyude Paul) [1924702]
  - dm raid: fix discard limits for raid0 and raid10 (Mike Snitzer) [1934274]
  - dm: fix __send_changing_extent_only to avoid duplicate dm_target_offset() (Mike Snitzer) [1934274]
  - mm/hugetlb.c: fix unnecessary address expansion of pmd sharing (Waiman Long) [1934212]
  - mm: memcontrol: fix slub memory accounting (Waiman Long) [1934212]
  - mm: memcontrol: fix swap undercounting in cgroup2 (Waiman Long) [1934212]
  - mm: memcontrol: fix NR_ANON_THPS accounting in charge moving (Waiman Long) [1934212]
  - mm, slub: better heuristic for number of cpus when calculating slab order (Waiman Long) [1934212]
  - Revert "mm: memcontrol: avoid workload stalls when lowering memory.high" (Waiman Long) [1934212]
  - selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed (Hangbin Liu) [1931732]
  - selftests/bpf: No need to drop the packet when there is no geneve opt (Hangbin Liu) [1931732]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-79.el8]
changelog:
  - [firmware] drivers/firmware: psci_checker: stash and use topology_core_cpumask for hotplug tests (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: re-introduce numa mask check for scheduler MC selection (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: rename llc_siblings to align with other struct members (Josh Poimboeuf) [1687101]
  - [arm64] arm64: smp: remove cpu and numa topology information when hotplugging out CPU (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: restrict updating siblings_masks to online cpus only (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: add support to remove cpu topology sibling masks (Josh Poimboeuf) [1687101]
  - [arm64] arm64: numa: separate out updates to percpu nodeid and NUMA node cpumap (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: refactor reset_cpu_topology to add support for removing topology (Josh Poimboeuf) [1687101]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.el8]
changelog:
  - [arm64] revert "arm64: tlb: Avoid synchronous TLBIs when freeing page tables" (Christoph von Recklinghausen) [1685697]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.2.1.el8_0]
changelog:
  - [netdrv] qed: Fix qed_mcp_halt|resume() (Manish Chopra) [1704184 1697310]
  - [cpufreq] cpufreq: intel_pstate: Also use CPPC nominal_perf for base_frequency (Prarit Bhargava) [1706739 1696131]
  - [acpi] ACPI / CPPC: Fix guaranteed performance handling (Prarit Bhargava) [1706739 1696131]
  - [arm64] arm64: Add workaround for Fujitsu A64FX erratum 010001 (Mark Langsdorf) [1700902 1666951]
  - [s390] vfio_ap: link the vfio_ap devices to the vfio_ap bus subsystem (Cornelia Huck) [1700290 1686044]
  - [netdrv] net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [netdrv] net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [pci] PCI: pciehp: Fix re-enabling the slot marked for safe removal (Myron Stowe) [1700288 1695922]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.3.1.el8_0]
changelog:
  - [mm] mm: enforce min addr even if capable() in expand_downwards() (Rafael Aquini) [1708829 1687667] {CVE-2019-9213}
  - [powerpc] powerpc/radix: Fix kernel crash with mremap() (Steve Best) [1708617 1674186]
  - [powerpc] powerpc/security: Fix spectre_v2 reporting (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/powernv: Query firmware for count cache flush settings (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/pseries: Query hypervisor for count cache flush settings (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64s: Add support for software count cache flush (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64s: Add new security feature flags for count cache flush (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/asm: Add a patch_site macro & helpers for patching instructions (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64: Call setup_barrier_nospec() from setup_arch() (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (Gustavo Duarte) [1708112 1694456]
  - [of] of: __of_detach_node() - remove node from phandle cache (Steve Best) [1708102 1669198]
  - [of] of: of_node_get()/of_node_put() nodes held in phandle cache (Steve Best) [1708102 1669198]
  - [fs] debugfs: Fix EPERM regression from kernel lockdown check (Lenny Szubowicz) [1708100 1686755]
  - [block] nvme: lock NS list changes while handling command effects (David Milburn) [1701140 1672759]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.4.1.el8_0]
changelog:
  - [netdrv] ice: Do autoneg based on VSI state (Jonathan Toppins) [1709433 1687903]
  - [arm64] arm64: apply workaround on A64FX v1r0 (Mark Langsdorf) [1700901 1692306]
  - [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [s390] s390/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [powerpc] powerpc/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add 'mitigations=' support for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kernel] cpu/speculation: Add 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Fix comment (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add SMT warning message (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [documentation] Documentation: Add MDS vulnerability documentation (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [documentation] Documentation: Move L1TF to separate directory (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Consolidate CPU whitelists (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/msr-index: Cleanup bit defines (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Cast ~SPEC_CTRL_STIBP atomic value to int (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [include] locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [tools] tools include: Adopt linux/bits.h (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.5.1.el8_0]
changelog:
  - [kernel] sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup (Joel Savitz) [1715345 1695651]
  - [kernel] sched/fair: Fix O(nr_cgroups) in the load balancing path (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Fix insertion in rq->leaf_cfs_rq_list (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Add tmp_alone_branch assertion (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b9c (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [rpmspec] apply linux-kernel-test.patch when building ("Herton R. Krzesinski") [1715340 1690534]
  - [rpmspec] Fix cross builds (Jiri Olsa) [1715339 1694956]
  - [kernel] sched/fair: Do not re-read ->h_load_next during hierarchical load calculation (Phil Auld) [1715337 1701762]
  - [kvm] KVM: PPC: Book3S HV: Save/restore vrsave register in kvmhv_p9_guest_entry() (Suraj Jitindar Singh) [1714753 1700272]
  - [powerpc] KVM: PPC: Book3S HV: Perserve PSSCR FAKE_SUSPEND bit on guest exit (Suraj Jitindar Singh) [1714751 1689768]
  - [powerpc] powerpc/powernv/ioda: Fix locked_vm counting for memory used by IOMMU tables (David Gibson) [1714746 1674410]
  - [char] ipmi_si: fix use-after-free of resource->name (Tony Camuso) [1714409 1714410] {CVE-2019-11811}
  - [x86] Update stepping values for coffee lake desktop (David Arcari) [1711048 1704800]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.6.1.el8_0]
changelog:
  - [mm] mm: defer ZONE_DEVICE page initialization to the point where we init pgmap (Waiman Long) [1719635 1666538]
  - [mm] mm: create non-atomic version of SetPageReserved for init use (Waiman Long) [1719635 1666538]
  - [mm] mm: provide kernel parameter to allow disabling page init poisoning (Waiman Long) [1719635 1666538]
  - [mm] mm, slub: restore the original intention of prefetch_freepointer() (Rafael Aquini) [1718237 1714671]
  - [security] selinux: do not report error on connect(AF_UNSPEC) (Ondrej Mosnacek) [1717870 1707828]
  - [security] selinux: Check address length before reading address family (Ondrej Mosnacek) [1717870 1707828]
  - [powerpc] powerpc/tm: Fix stack pointer corruption (Desnes Augusto Nunes do Rosario) [1717869 1707635]
  - [md] dm cache metadata: Fix loading discard bitset (Mike Snitzer) [1717868 1701618]
  - [md] dm mpath: fix missing call of path selector type->end_io (Mike Snitzer) [1717804 1686227]
  - [mm] mm/memory.c: do_fault: avoid usage of stale vm_area_struct ("Herton R. Krzesinski") [1717801 1684734]
  - [net] sunrpc: fix 4 more call sites that were using stack memory with a scatterlist (Scott Mayhew) [1717800 1679183]
  - [net] sunrpc: Don't use stack buffer with scatterlist (Scott Mayhew) [1717800 1679183]
  - [scsi] scsi: mpt3sas: Fix kernel panic during expander reset (Tomas Henzl) [1717791 1677693]
  - [security] selinux: always allow mounting submounts (Ondrej Mosnacek) [1717777 1647723]
  - [drm] drm/bufs: Fix Spectre v1 vulnerability (Rob Clark) [1717382 1663467]
  - [drm] drm/ioctl: Fix Spectre v1 vulnerabilities (Rob Clark) [1717382 1663467]
  - [tools] perf annotate: Fix getting source line failure (Michael Petlan) [1716887 1614435]
  - [iommu] iommu/amd: Set exclusion range correctly (Jerry Snitselaar) [1715336 1702766]
  - [iommu] iommu/amd: Reserve exclusion range in iova-domain (Jerry Snitselaar) [1717344 1694835]
  - [kvm] KVM: PPC: Book3S: Add count cache flush parameters to kvmppc_get_cpu_char() (Vitaly Kuznetsov) [1715018 1694456]
  - [s390] kvm: s390: Fix potential spectre warnings (Thomas Huth) [1714754 1702344]
  - [drm] drm/i915/gvt: Fix mmap range check (Alex Williamson) [1713572 1713573] {CVE-2019-11085}
  - [scsi] scsi: megaraid_sas: return error when create DMA pool failed (Tomas Henzl) [1712862 1712863] {CVE-2019-11810}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.7.1.el8_0]
changelog:
  - [x86] Update stepping values for Whiskey Lake U/Y (David Arcari) [1722372 1704801]
  - [x86] x86/perf/amd: Resolve NMI latency issues for active PMCs (David Arcari) [1722367 1640238]
  - [x86] x86/perf/amd: Resolve race condition when disabling PMC (David Arcari) [1722367 1640238]
  - [edac] EDAC/amd64: Set maximum channel layer size depending on family (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Adjust printed chip select sizes when interleaved (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Recognize x16 symbol size (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Support more than two Unified Memory Controllers (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Use a macro for iterating over Unified Memory Controllers (Gary Hook) [1722365 1690984]
  - [edac] EDAC, amd64: Add Family 17h, models 10h-2fh support (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Add Family 17h Model 30h PCI IDs (Aristeu Rozanski) [1722365 1696603]
  - [x86] mark AMD Rome processors supported (David Arcari) [1721972 1520002]
  - [x86] x86/mce: Handle varying MCA bank counts (David Arcari) [1721233 1668779]
  - [iommu] iommu/vt-d: Disable ATS support on untrusted devices (Jerry Snitselaar) [1700376 1692246]
  - [documentation] thunderbolt: Export IOMMU based DMA protection support to userspace (Jerry Snitselaar) [1700376 1692246]
  - [iommu] iommu/vt-d: Do not enable ATS for untrusted devices (Jerry Snitselaar) [1700376 1692246]
  - [iommu] iommu/vt-d: Force IOMMU on for platform opt in hint (Jerry Snitselaar) [1700376 1692246]
  - [pci] PCI / ACPI: Identify untrusted PCI devices (Myron Stowe) [1700376 1704979]
  - [acpi] ACPI / property: Allow multiple property compatible _DSD entries (Myron Stowe) [1700376 1537397]
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719857 1719858] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719602 1719603] {CVE-2019-11477}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-73.el8]
changelog:
  - [net] tun: forbid iface creation with rtnl ops (Sabrina Dubroca) [1680969]
  - [net] revert "bridge: do not add port to router list when receives query with source 0.0.0.0" (Hangbin Liu) [1679896]
  - [net] sctp: walk the list of asoc safely (Marcelo Leitner) [1679920] {CVE-2019-8956}
  - [net] netfilter: nf_nat: skip nat clash resolution for same-origin entries (Florian Westphal) [1677647]
  - [net] netfilter: nf_conntrack: resolve clash for matching conntracks (Florian Westphal) [1677647]
  - [net] netfilter: nf_tables: fix flush after rule deletion in the same batch (Phil Sutter) [1677672]
  - [net] gro_cell: add napi_disable in gro_cells_destroy (Stefano Brivio) [1674408]
  - [net] sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment (Xin Long) [1669386]
  - [net] ipvs: fix dependency on nf_defrag_ipv6 (Andrea Claudi) [1660808]
  - [net] sctp: check and update stream->out_curr when allocating stream_out (Xin Long) [1651877]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-74.el8]
changelog:
  - [x86] revert "cpu/hotplug: Add SMT policy options" (Josh Poimboeuf) [1683690]
  - [crypto] net: crypto set sk to NULL when af_alg_release (Neil Horman) [1679450] {CVE-2019-8912}
  - [drm] drm/i915/gvt: update force-to-nonpriv register whitelist (Paul Lai) [1643972]
  - [kernel] MODSIGN: Also check platform keyring in mod_verify_sig() (Lenny Szubowicz) [1568532]
  - [kernel] Fix for module sig verification (Lenny Szubowicz) [1568532]
  - [security] efi: Lock down the kernel if booted in secure boot mode (Lenny Szubowicz) [1568532]
  - [firmware] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode (Lenny Szubowicz) [1568532]
  - [x86] Copy secure_boot flag in boot params across kexec reboot (Lenny Szubowicz) [1568532]
  - [fs] debugfs: Restrict debugfs when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [mm] x86/mmiotrace: Lock down the testmmiotrace module (Lenny Szubowicz) [1568532]
  - [kernel] Lock down module params that specify hardware parameters (eg. ioport) (Lenny Szubowicz) [1568532]
  - [tty] Lock down TIOCSSERIAL (Lenny Szubowicz) [1568532]
  - [pcmcia] Prohibit PCMCIA CIS storage when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [acpi] acpi: Disable ACPI table override if the kernel is locked down (Lenny Szubowicz) [1568532]
  - [acpi] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down (Lenny Szubowicz) [1568532]
  - [acpi] ACPI: Limit access to custom_method when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [x86] x86/msr: Restrict MSR access when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [x86] x86: Lock down IO port access when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [pci] PCI: Lock down BAR access when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] uswsusp: Disable when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] hibernate: Disable when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] kexec_load: Disable at runtime if the kernel is locked down (Lenny Szubowicz) [1568532]
  - [char] Restrict /dev/{mem, kmem, port} when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] MODSIGN: Enforce module signatures if the kernel is locked down (Lenny Szubowicz) [1568532]
  - [security] Add a SysRq option to lift kernel lockdown (Lenny Szubowicz) [1568532]
  - [security] Add the ability to lock down access to the running kernel image (Lenny Szubowicz) [1568532]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-75.el8]
changelog:
  - [netdrv] net: hns3: add 8 BD limit for tx flow (Xiaojun Tan) [1676771]
  - [netdrv] net: hns3: fix a SSU buffer checking bug (Xiaojun Tan) [1676771]
  - [netdrv] net: hns3: aligning buffer size in SSU to 256 bytes (Xiaojun Tan) [1676771]
  - [netdrv] net: hns3: getting tx and dv buffer size through firmware (Xiaojun Tan) [1676771]
  - [net] netfilter: nf_nat_snmp_basic: add missing length checks in ASN.1 cbs (Florian Westphal) [1676602]
  - [char] ipmi: fix use-after-free of user->release_barrier.rda (Xiaojun Tan) [1677550]
  - [char] ipmi: Prevent use-after-free in deliver_response (Xiaojun Tan) [1677550]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-76.el8]
changelog:
  - [security] revert "Add a SysRq option to lift kernel lockdown" (Lenny Szubowicz) [1684348]
  - [s390] s390/setup: fix boot crash for machine without EDAT-1 (Philipp Rudo) [1677357]
  - [s390] s390/setup: fix early warning messages (Philipp Rudo) [1677357]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-77.el8]
changelog:
  - [firmware] efi: Reduce the amount of memblock reservations for persistent allocations (Bhupesh Sharma) [1682988]
  - [firmware] efi: Permit multiple entries in persistent memreserve data structure (Bhupesh Sharma) [1682988]
  - [kernel] cpu/hotplug: Create SMT sysfs interface for all arches (Josh Poimboeuf) [1686068]
  - [net] netfilter: nft_set_hash: bogus element self comparison from deactivation path (Florian Westphal) [1678574]
  - [net] netfilter: nft_set_hash: fix lookups with fixed size hash on big endian (Florian Westphal) [1678574]


author: Jerome Marchand <jmarchan@redhat.com> - 0.9-2
changelog:
  - Fixes gethostlatency
  - Fixes a struct definition issue that made several tools fail
  - Add CI gating


author: Jerome Marchand <jmarchan@redhat.com> - 0.10.0-3
changelog:
  - Fix ENOMEM issue on arm64 machine with many cpus
  - Fix statsnoop and opensnoop on aarch64
  - Drop tcpdrop on ppc64


author: Kalev Lember <klember@redhat.com> - 3.12.2-1
changelog:
  - Update to 3.12.2
  - Use desktop-file-validate instead of desktop-file-install
  - Update download URLs


author: Jaroslav Škarvada <jskarvad@redhat.com> - 5.6-20
changelog:
  - Fixed installation of multiple drivers and text tables in Dracut module
    if environment variables are used


author: Artem Egorenkov <aegorenk@redhat.com> - 5.6-30
changelog:
  - brltty requires brlapi deleted (duplication of automatically determined dependency)
  - isa macro deleted for brlapi requires brltty
  - brlapi recommends brltty
    Resolves: rhbz#1765611


author: Pavel Raiskup <praiskup@redhat.com> - 3.3.1-1
changelog:
  - the latest release, per release notes:
    https://groups.google.com/forum/#!topic/libarchive-discuss/jfc7lBfrvVg


author: Pavel Raiskup <praiskup@redhat.com> - 3.3.2-4
changelog:
  - fix out-of-bounds read within lha_read_data_none() (CVE-2017-14503)
  - fix crash on crafted 7zip archives (CVE-2019-1000019)
  - fix infinite loop in ISO9660 (CVE-2019-1000020)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.3.2-7
changelog:
  - fix use-after-free in delayed newc link processing (#1602575)
  - fix a few obvious resource leaks and strcpy() misuses (#1602575)


author: Colin Walters <walters@verbum.org> - 0.1.7-1
changelog:
  - New upstream version;
    https://github.com/projectatomic/bubblewrap/releases/tag/v0.1.7
  - Resolves: #1411814


author: Jindrich Novy <jnovy@redhat.com> - 1.11.6-2
changelog:
  - fix chroot: unmount with MNT_DETACH instead of UnmountMountpoints()
  - bug reference 1772179
  - Related: RHELPLAN-25138


author: Jindrich Novy <jnovy@redhat.com> - 1.11.6-5
changelog:
  - fix "Podman support for FIPS Mode requires a bind mount inside the container"
  - Resolves: #1804188


author: Jindrich Novy <jnovy@redhat.com> - 1.11.6-2
changelog:
  - fix chroot: unmount with MNT_DETACH instead of UnmountMountpoints()
  - bug reference 1772179
  - Related: RHELPLAN-25139


author: Jindrich Novy <jnovy@redhat.com> - 1.11.6-7
changelog:
  - fix "CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build process"
  - Resolves: #1819393


author: Jindrich Novy <jnovy@redhat.com> - 1.11.6-8
changelog:
  - fix "CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build process"
  - Resolves: #1819810


author: Jindrich Novy <jnovy@redhat.com> - 1.15.0-2
changelog:
  - fix "CVE-2020-14040 buildah: golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash [rhel-8]"
  - Resolves: #1854717


author: Jindrich Novy <jnovy@redhat.com> - 1.15.1-2
changelog:
  - propagate proper CFLAGS to CGO_CFLAGS to assure code hardening and optimization
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.16.5-3
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.16
    (https://github.com/containers/buildah/commit/9e02bf9)
  - Related: #1888571


author: Jindrich Novy <jnovy@redhat.com> - 1.16.5-5
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.16
    (https://github.com/containers/buildah/commit/56ed75b)
  - Related: #1888571


author: Jindrich Novy <jnovy@redhat.com> - 1.16.7-4
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.16
    (https://github.com/containers/buildah/commit/aaed66b)
  - Related: #1888571


author: Jindrich Novy <jnovy@redhat.com> - 1.19.3-2
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/17521db)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.3-3
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/a96b716)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.4-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/76beccc)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/1fb260f)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-2
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/db783f4)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-3
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/9dd415b)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-4
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/e5384ed)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-5
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/dcd385e)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.6-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/7aedb16)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.7-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/a2854ed)
  - Resolves: #1935376


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-5
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/016b90d)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.20.2-0.1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/master
    (https://github.com/containers/buildah/commit/22fc573)
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 1.20.2-0.2
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/master
    (https://github.com/containers/buildah/commit/135d63d)
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 1.21.3-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.21
    (https://github.com/containers/buildah/commit/7f9540d)
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 1.21.4-2
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.21
    (https://github.com/containers/buildah/commit/d1e9240)
  - Related: #1954702


author: Dan Walsh <dwalsh@redhat.com> - 1.3-1
changelog:
  - Bump to v1.3
  - Vendor in lates containers/image
  - build-using-dockerfile: let -t include transports again
  - Block use of /proc/acpi and /proc/keys from inside containers
  - Fix handling of --registries-conf
  - Fix becoming a maintainer link
  - add optional CI test fo darwin
  - Don't pass a nil error to errors.Wrapf()
  - image filter test: use kubernetes/pause as a "since"
  - Add --cidfile option to from
  - vendor: update containers/storage
  - Contributors need to find the CONTRIBUTOR.md file easier
  - Add a --loglevel option to build-with-dockerfile
  - Create Development plan
  - cmd: Code improvement
  - allow buildah cross compile for a darwin target
  - Add unused function param lint check
  - docs: Follow man-pages(7) suggestions for SYNOPSIS
  - Start using github.com/seccomp/containers-golang
  - umount: add all option to umount all mounted containers
  - runConfigureNetwork(): remove an unused parameter
  - Update github.com/opencontainers/selinux
  - Fix buildah bud --layers
  - Force ownership of /etc/hosts and /etc/resolv.conf to 0:0
  - main: if unprivileged, reexec in a user namespace
  - Vendor in latest imagebuilder
  - Reduce the complexity of the buildah.Run function
  - mount: output it before replacing lastError
  - Vendor in latest selinux-go code
  - Implement basic recognition of the "--isolation" option
  - Run(): try to resolve non-absolute paths using $PATH
  - Run(): don't include any default environment variables
  - build without seccomp
  - vendor in latest runtime-tools
  - bind/mount_unsupported.go: remove import errors
  - Update github.com/opencontainers/runc
  - Add Capabilities lists to BuilderInfo
  - Tweaks for commit tests
  - commit: recognize committing to second storage locations
  - Fix ARGS parsing for run commands
  - Add info on registries.conf to from manpage
  - Switch from using docker to podman for testing in .papr
  - buildah: set the HTTP User-Agent
  - ONBUILD tutorial
  - Add information about the configuration files to the install docs
  - Makefile: add uninstall
  - Add tilde info for push to troubleshooting
  - mount: support multiple inputs
  - Use the right formatting when adding entries to /etc/hosts
  - Vendor in latest go-selinux bindings
  - Allow --userns-uid-map/--userns-gid-map to be global options
  - bind: factor out UnmountMountpoints
  - Run(): simplify runCopyStdio()
  - Run(): handle POLLNVAL results
  - Run(): tweak terminal mode handling
  - Run(): rename 'copyStdio' to 'copyPipes'
  - Run(): don't set a Pdeathsig for the runtime
  - Run(): add options for adding and removing capabilities
  - Run(): don't use a callback when a slice will do
  - setupSeccomp(): refactor
  - Change RunOptions.Stdin/Stdout/Stderr to just be Reader/Writers
  - Escape use of '_' in .md docs
  - Break out getProcIDMappings()
  - Break out SetupIntermediateMountNamespace()
  - Add Multi From Demo
  - Use the c/image conversion code instead of converting configs manually
  - Don't throw away the manifest MIME type and guess again
  - Consolidate loading manifest and config in initConfig
  - Pass a types.Image to Builder.initConfig
  - Require an image ID in importBuilderDataFromImage
  - Use c/image/manifest.GuessMIMEType instead of a custom heuristic
  - Do not ignore any parsing errors in initConfig
  - Explicitly handle "from scratch" images in Builder.initConfig
  - Fix parsing of OCI images
  - Simplify dead but dangerous-looking error handling
  - Don't ignore v2s1 history if docker_version is not set
  - Add --rm and --force-rm to buildah bud
  - Add --all,-a flag to buildah images
  - Separate stdio buffering from writing
  - Remove tty check from images --format
  - Add environment variable BUILDAH_RUNTIME
  - Add --layers and --no-cache to buildah bud
  - Touch up images man
  - version.md: fix DESCRIPTION
  - tests: add containers test
  - tests: add images test
  - images: fix usage
  - fix make clean error
  - Change 'registries' to 'container registries' in man
  - add commit test
  - Add(): learn to record hashes of what we add
  - Minor update to buildah config documentation for entrypoint
  - Bump to v1.2-dev
  - Add registries.conf link to a few man pages


author: Jindrich Novy <jnovy@redhat.com> - 1.5-4.gite94b4f9
changelog:
  - fix "CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build process"
  - Resolves: #1819431


author: Jindrich Novy <jnovy@redhat.com> - 1.5-4.gite94b4f9
changelog:
  - fix "CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build process"
  - Resolves: #1818127


author: David Howells <dhowells@redhat.com> 0.10.6-1
changelog:
  - Note the correct licence.
  - Handle malformed kernel status correctly.
  - Permit culling to be disabled on the command line with the -N flag.
  - Suspend culling when cache space is short and cache objects are pinned.


author: David Howells <dhowells@redhat.com> 0.10.8-1
changelog:
  - Use systemd interaction macros in specfile installation sections [RH BZ 850053].
  - Fix the service file to use /usr/sbin/ rather than /sbin/.
  - Turn on RELRO and PIE build hardening in RPM builds.


author: Kalev Lember <klember@redhat.com> - 1.12.0-1
changelog:
  - Update to 1.12.0
  - Drop manual requires that are automatically handled by pkgconfig dep gen
  - Use license macro for COPYING
  - Tighten -devel subpackage deps with the _isa macro
  - Use make_install macro


author: Josh Stone <jistone@redhat.com> - 1.40.0-1
changelog:
  - Update to 1.40.0.
  - Fix compiletest with newer (local-rebuild) libtest
  - Build compiletest with in-tree libtest
  - Fix ARM EHABI unwinding


author: Josh Stone <jistone@redhat.com> - 1.51.0-1
changelog:
  - Update to 1.51.0. Update to 1.51.0. Includes security fixes for
    CVE-2021-28875 and CVE-2021-28877.


author: Josh Stone <jistone@redhat.com> - 1.52.1-1
changelog:
  - Update to 1.52.1. Includes security fixes for CVE-2020-36323,
    CVE-2021-28876, CVE-2021-28878, CVE-2021-28879, and CVE-2021-31162.


author: Till Maas <opensource@till.name> - 10.2-19
changelog:
  - Rebuilt for Fedora 23 Change
    https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: Frantisek Kluknavsky <fkluknav@redhat.com> - 1.1.11-32
changelog:
  - FTBFS: <sys/sysmacros.h> included where "major" and "minor" macros are in use
    (cdrkit-1.1.11-sysmacros.patch added)
  - https://bugzilla.redhat.com/show_bug.cgi?id=1263599 - man page clarified
    (cdrkit-1.1.11-manpagefix.patch modified)


author: Petr Pisar <ppisar@redhat.com> - 1.1.11-35
changelog:
  - perl dependency renamed to perl-interpreter
    <https://fedoraproject.org/wiki/Changes/perl_Package_to_Install_Core_Modules>


author: Rob Crittenden <rcritten@redhat.com> - 0.79.7-8
changelog:
  - Move systemd tmpfiles from /var/run to /run (#1804928)
  - Improve logging in the SCEP helper (#1807691)
  - Fix sort order of certificates passed into PKCS7_verify (#1808052)
  - Add -N option to SCEP helper to separate web server chain from
    SCEP issuer chain (#1808613)
  - Add template profile, MS v2 template and issuer to getcert list
    output (#1734451)


author: Rob Crittenden <rcritten@redhat.com> - 0.79.7-9
changelog:
  - Call the secport equivalent of PR_ErrorToString
  - Remove a couple of unused varaibles found by coverity


author: Rob Crittenden <rcritten@redhat.com> - 0.79.7-15
changelog:
  - Replace the previous fix for dbus restarting with PartOf in the
    certmonger systemd service file to link the two (#1687698)


author: Rob Crittenden <rcritten@redhat.com> - 0.79.6-4
changelog:
  - Improve handling of NSS tokens (#1624930)
  - Pull in upstream fixes discovered in coverity and clang (#1632449)


author: Rob Crittenden <rcritten@redhat.com> - 0.79.7-4
changelog:
  - Optimize closing of file descriptors on fork (#1763745)
  - Remove NOMODDB flag flag from context init, look for full tokens (#1746543)
  - Retrieve full IPA CA chain (#1710632)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.3.62-1
changelog:
  - use systemctl preset, not systemctl enable
  - fix typo in manpage
  - partly support socket activated services


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.4-1
changelog:
  - ntsysv: show systemd services and sockets
  - fix combination --type xinetd --list service
  - leveldb: restore selinux context for xinetd conf files
  - alternatives: remove unused variable
  - alternatives: warn if the target is not a symlink
  - spec: add link to git
  - lets simplify version


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.5-1
changelog:
  - add systemd-sysv-install alias
  - don't create symlinks if they already exist
  - fix wrongly behaving LDFLAGS


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.6-1
changelog:
  - systemd-sysv-install: don't play ping-pong with systemctl
  - ntsysv: add description to systemd services
  - ntsysv: skip templates
  - Makefile: fix typo


author: Lukáš Nykrýn <lnykryn@redhat.com> - 1.8-1
changelog:
  - alternatives: introduce --keep-missing
  - alternatives: allow family in --set and display it in --config
  - chkconfig: use isXinetdEnabled instead of isOn
  - leveldb: trim leading whitespaces from systemctl
  - leveldb: suppress error messages when selinux is turned off
  - alternatives: always recreate symlinks when the alternative is updated
  - test-alternatives: basic tests for slave links
  - chkconfig: resetpriorities should work on all runlevels


author: Lukas Nykryn <lnykryn@redhat.com> - 1.11-1
changelog:
  - Add tests for --add/remove-slave and use beakerlib
  - alternatives: add-slave and remove-slave
  - leveldb: don't crash on long names
  - alternatives: prettier --list output


author: Miroslav Lichvar <mlichvar@redhat.com> 3.2-2
changelog:
  - fix chronyc getting stuck in infinite loop after clock step
  - don't allow packaging without vendor zone
  - suggest ntp-refclock
  - remove obsolete dependency
  - update description


author: Miroslav Lichvar <mlichvar@redhat.com> 3.3-2
changelog:
  - move pidfile to /var/run/chrony to allow chronyd to remove it on exit
    (#1584585)
  - avoid blocking in getrandom system call (#1592425)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.3-3
changelog:
  - fix PIDFile in local chronyd.service on upgrades from chrony < 3.3-2
    (#1614800)
  - add workaround for late reload of unit file (#1614751)


author: Miroslav Lichvar <mlichvar@redhat.com> 3.5-1
changelog:
  - update to 3.5 (#1685469 #1677218)
  - fix shellcheck warnings in helper scripts (#1711948)
  - update ntp2chrony script


author: David King <amigadave@amigadave.com> - 0.16-1
changelog:
  - Update to 0.16 (#1144863)
  - Remove clean section and BuildRoot tag
  - Update URL and Sourc0
  - Use license macro for COPYING
  - Use parallel make flags
  - Preserve timestamps during install


author: Jeff Layton <jlayton@redhat.com> - 6.7-5
changelog:
  - more updates, switch to rst for manpages
  - update mount.cifs manpage to describe defaults better (BZ#1474539)


author: Sachin Prabhu <sprabhu@redhat.com> - 6.8-3
changelog:
  - Add manual gating tests
  - docs: cleanup rst formating
  - mount.cifs.rst: document new (no)handlecache mount option
  - manpage: update mount.cifs manpage with info about rdma option
  - checkopts: add python script to cross check mount options
  - mount.cifs.rst: document missing options, correct wrong ones
  - checkopts: report duplicated options in man page
  - mount.cifs.rst: more cleanups
  - mount.cifs.rst: document vers=3 mount option
  - mount.cifs.rst: document vers=3.02 mount option
  - cifs: Allow DNS resolver key to expire
  - mount.cifs: be more verbose and helpful regarding mount errors
  - Update mount.cifs with vers=default mount option and SMBv3.0.2
  - mount.cifs.rst: update vers=3.1.1 option description
  - getcifsacl: Do not go to parse_sec_desc if getxattr fails.
  - getcifsacl: Improve help usage and add -h option.
  - setcifsacl: fix adding ACE when owner sid in unexpected location
  - cifs.upcall: fix a compiler warning
  - mount.cifs Add various missing parms from the help text
  - mount.cifs: add more options to help message
  - mount.cifs: detect GMT format of snapshot version
  - Update man page for mount.cifs to add new options
  - mount.cifs.rst: mention kernel version for snapshots
  - Fix authors and maintainers


author: Daniel Kopecek <dkopecek@redhat.com> - 11-2
changelog:
  - Check that key derivation key is available
  - Delete remaining references to the removed http pin
  - Install cryptsetup and tpm2_pcrlist in the initramfs
  - Add device TCTI library to the initramfs
    Resolves: rhbz#1648004
    Resolves: rhbz#1650246


author: Sergio Correia <scorreia@redhat.com> - 13-1
changelog:
  - Update to new upstream release, v13
    Resolves: rhbz#1827225
    Resolves: rhbz#1827665
    Resolves: rhbz#1801556
    Resolves: rhbz#1784448
    Resolves: rhbz#1826917
    Resolves: rhbz#1812014


author: Sergio Correia <scorreia@redhat.com> - 15-1
changelog:
  - Update to latest upstream release, v15
    Resolves: rhbz#1887836
    Resolves: rhbz#1853651
    Resolves: rhbz#1874460


author: Jan Pokorný <jpokorny+rpm-clufter@fedoraproject.org> - 0.77.1-1
changelog:
  - drop no longer favoured Group tag
  - replace unqualified python invocations with explicit python3
  - bump upstream package, see https://pagure.io/clufter/releases


author: Jan Pokorný <jpokorny+rpm-clufter@fedoraproject.org> - 0.77.1-2
changelog:
  - stop creating Python 2 packages by default (nothing in Fedora uses it)
  - fix a previously omitted unqualified python invocation


author: Jan Pokorný <jpokorny+rpm-clufter@fedoraproject.org> - 0.77.1-3
changelog:
  - fix previously omitted unqualified python invocations, drop no longer
    needed byte-compilation products through a full grip on such a process,
    and also use -I switch to python3 instead of possibly weaker -Es


author: Jan Pokorný <jpokorny+rpm-clufter@fedoraproject.org> - 0.77.1-4
changelog:
  - fix missing explicit BuildRequires to ensure environment for compiling
    C code per the guidelines, and to fix FTBFS: rhbz#1603658
    (contributed by Igor Gnatenko <ignatenkobrain@fedoraproject.org>)
  - fix a thinko in py_byte_compile space-contained argument passing
    (https://github.com/rpm-software-management/rpm/issues/222#issuecomment-410026431)
  - fix a violation of "unversioned docdirs" guideline
    (https://fedoraproject.org//wiki/Changes/UnversionedDocdirs)
    Resolves: rhbz#1638027


author: Patsy Franklin <pfrankli@redhat.com> - 3.11.0-2
changelog:
  - Choose correct version of python to use.  Require the correct
    sphinx build depending on which python we choose. (#1583117)


author: Marian Csontos <mcsontos@redhat.com> - 2.02.181-1
changelog:
  - Reject conversions on raid1 LVs with split tracked SubLVs.
  - Reject conversions on raid1 split tracked SubLVs.
  - Fix dmstats list failing when no regions exist.
  - Reject conversions of LVs under snapshot.
  - Limit suggested options on incorrect option for lvconvert subcommand.
  - Add vdo plugin for monitoring VDO devices.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.00-0.2
changelog:
  - New upstream release.
  - Deduplication and compression - support for VDO volumes.
  - Dropped lvmetad, clvmd and liblvm2app.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.02-1
changelog:
  - Fix libdevmapper-event linking issue.
  - Fix missing proper initialization of pv_list struct when adding pv.
  - Fix (de)activation of RaidLVs with visible SubLVs.
  - Prohibit mirrored 'mirror' log via lvcreate and lvconvert.
  - Use sync io if async io_setup fails, or use_aio=0 is set in config.
  - Fix more issues reported by coverity scan.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.02-3
changelog:
  - Fix handling of exported VGs lvmdbusd.
  - Restore missing man info lvcreate --zero for thin-pools.
  - Drop misleadning comment for metadata minimum_io_size for VDO segment.
  - Ensure migration_threshold for cache is at least 8 chunks.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.02-4
changelog:
  - Introduce LVM_SUPPRESS_SYSLOG to suppress syslog usage by generator.
  - Fix generator querying config options missing from lvm.conf.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.02-6
changelog:
  * Thu Feb 07 2019 Marian Csontos <mcsontos@redhat.com> - 2.03.02-5
  - Improve -lXXX%VG modifier which improves cache segment estimation.


author: Martin Pitt <mpitt@redhat.com> - 176-1
changelog:
  - Fix Cockpit activation message (/etc/issue.d) rhbz#1615316
  - Suggest other browsers when browser is unsupported rhbz#1619993


author: Martin Pitt <mpitt@redhat.com> - 177-1
changelog:
  - Support centrally-managed SSH known hosts rhbz#1622835
  - Drop support for Internet Explorer rhbz#1619993


author: Martin Pitt <mpitt@redhat.com> - 178-1
changelog:
  - Fix remote unauthenticated crash with crafted URLs rhbz#1627634
  - Fix large downloads stalling after a few megabytes rhbz#1626847
  - Recommend system-logos to ensure correct branding rhbz#1626066


author: Martin Pitt <mpitt@redhat.com> - 179-1
changelog:
  - Various crash fixes (coverity) rhbz#1635182
  - Updates for React 16 (for future backports) rhbz#1635182
  - Fix building with platform-python rhbz#1631174


author: Martin Pitt <mpitt@redhat.com> - 183-1
changelog:
  - Kernel Dump: Support non-local targets rhbz#1651691
  - Fix firewall page oops when not selecting anything rhbz#1652207
  - Fix changing user's own password rhbz#1652304
  - Never send Content-Length with chunked encoding rhbz#1652511
  - Include "Web Console" in package description rhbz#1653617
  - Respect SSH configuration


author: Martin Pitt <mpitt@redhat.com> - 184-1
changelog:
  - Integration of Cockpit pages on the desktop rhbz#1651264
  - Fix crash in Simplified Chinese locale rhbz#1653544
  - Update screenshots in AppStream data rhbz#1656982
  - Update translations from Zanata rhbz#1608292
  - Improve login error message if cockpit-system is not installed rhbz#1650467
  - Mark deleted cookie as HttpOnly to pacify security scanners rhbz#1656441


author: Martin Pitt <mpitt@redhat.com> - 189-1
changelog:
  - Add search box to Services page rhbz#1657752
  - Connect to firewalld as superuser rhbz#1664158
  - Fix log filtering rhbz#1665421
  - Show error message for invalid IdM domain names rhbz#1659333
  - Changing passwords as root does not ask for current password rhbz#1666005


author: Martin Pitt <mpitt@redhat.com> - 191-1
changelog:
  - System: Enable/disable SMT rhbz#1678956
  - Logs: Add service filtering rhbz#1657756
  - Networking: Add custom firewall ports rhbz#1660400


author: Martin Pitt <mpitt@redhat.com> - 196-1
changelog:
  - Networking: Add Firewall Zones configuration rhbz#1678473
  - Fix ssh login to unknown hosts rhbz#1701174
  - Fix login when ~/.bashrc prints to stdout rhbz#1716223
  - Much better On/Off buttons, also avoid text overlap rhbz#1677593


author: Martin Pitt <mpitt@redhat.com> - 196.1-1
changelog:
  - networkmanager: Show correct IPv6 route metric in dialog (rhbz#1719575)
  - networkmanager: Ensure that endianess is always set (rhbz#1728213)
  - Update translations (rhbz#1689977)


author: Matej Marusak <mmmarusak@redhat.com> - 209-1
changelog:
  - New overview design
  - Session timeouts
  - Banners on login screen
  - Client certificate authentication
  - Dropped support for pam_rhost


author: Martin Pitt <mpitt@redhat.com> - 210-1
changelog:
  - Overview: Add CPU utilization to usage card
  - Dashboard: Support SSH identity unlocking when adding new machines
  - SElinux: Introduce an Ansible automation script
  - Translation updates (partially fixes rhbz#1754958)


author: Martin Pitt <mpitt@redhat.com> - 211-1
changelog:
  - Fix HTTPS requests > 4 KiB (rhbz#1785509)
  - Better support for various TLS certificate formats
  - Switch from Zanata to Weblate
  - Overview layout optimizations
  - Translation updates (rhbz#1754958)


author: Martin Pitt <mpitt@redhat.com> - 211.1-1
changelog:
  - system: Fix graph layout across all browsers (rhbz#1792623)
  - websocket: Fix unaligned access in send_prefixed_message_rfc6455()


author: Matej Marusak <mmarusak@redhat.com> - 211.2-1
changelog:
  - Users: Fix reboot warnings of changed roles
  - Translation updates (rhbz#1754958)
  - Fix CPU mitigations to recognize kernel options at the beginning of line


author: Matej Marusak <mmarusak@redhat.com> - 219-1
changelog:
  - Rebase to upstream version 219
  - Accept upper-case login names for ssh/polkit agent challenges (rhbz#1825749)
  - Show last/failed login (rhbz#1784772)
  - Modernize services page (rhbz#1791193)
  - Search in journal (rhbz#1710731)
  - The default mode is not consistent with the mode in the created bond (rhbz#1817948)
  - Fix deadlock in channel pressure handling (rhbz#1751783)


author: Matej Marusak <mmarusak@redhat.com> - 220-1
changelog:
  - New navigation with integrated switching of hosts
  - Logs: Inline help for filtering
  - Fix cockpit-system AppStream dependency (rhbz#1838003)


author: Martin Pitt <mpitt@redhat.com> - 221-1
changelog:
  - Support for Cross-Origin-Resource-Policy
  - Accounts: Some buttons are hidden when access is limited
  - Developers: Importing "base1/patternfly.css" is deprecated
  - Translation updates (rhbz#1820538)


author: Martin Pitt <mpitt@redhat.com> - 221.1-1
changelog:
  - Put back missing base1/patternfly.css
  - Services: Don't offer 'Start Service' in Limited Access mode


author: Matej Marusak <mmarusak@redhat.com> - 222-1
changelog:
  - Logs: More flexible text filters
  - Services, Dashboard: Hide some buttons when access is limited
  - Webserver: Lock down cockpit.service privileges
  - Localization updates (rhbz#1820538)


author: Martin Pitt <mpitt@redhat.com> - 223-1
changelog:
  - Webserver: Standard-conformant lifetime of web server Certificate
  - Support certificate authentication against Active Directory
  - Fix cockpit-desktop privileges (rhbz#1841104)
  - Translation updates (rhbz#1820538)


author: Matej Marusak <mmarusak@redhat.com> - 224.2-1
changelog:
  - lib: Include current directory in FileAutoComplete option listing (rhbz#1866995)
  - lib: Make sure that the expandable part of table rows has unique key (rhbz#1865821)


author: Katerina Koukiou <kkoukiou@redht.com> - 233.1-1
changelog:
  - Non-admin users no longer see Cockpit in motd (rhbz#1872562)
  - Improved host editing
  - Replace system's graph page with a completely new USE method page
  - Logging of remote IP addresses
  - shell: Any page can be the shell
  - Accounts: Allow setting weak passwords (rhbz#1652390)
  - Terminal: Fix issue with prompt not returning when clicking reset button in disoconnected session (rhbz#1897430)


author: Martin Pitt <mpitt@redhat.com> - 235-1
changelog:
  - Login: Improved handling of SSH host keys
  - Overview: Editable motd
  - Adjust tests for sos 4.x to fix gating tests (rhbz#1895912)


author: Martin Pitt <mpitt@redhat.com> - 238-1
changelog:
  - Web server: Preserve permissions of administrator-provided certificates
  - System: Performance page shows busiest CPU cores


author: Martin Pitt <mpitt@redhat.com> - 238.1-1
changelog:
  - Several UI alignment fixes
  - Re-drop unit tests from built packages
  - Metrics: Don't show swap column when no swap is present
  - Metrics: Don't show duplicate events


author: mosquito <sensor.wen@gmail.com> - 1.22.2-7
changelog:
  - Add GL_ARB_shader_texture_lod and copy_sub_image support (#1421055)
  - Add pkgconfig(egl) BReq for rawhide
  - Move BReqs to pkgconfig


author: Richard Hughes <richard@hughsie.com> 1.4.0-1
changelog:
  - New upstream version
  - Port to the Meson build system
  - Correctly build the ICC transfer curve for Rec709
  - Do not spin the Huey LEDs when the sensor is embedded
  - Do not use /tmp to create profiles
  - Use a different Huey unlock code on the W700 laptop


author: Richard Hughes <richard@hughsie.com> 1.4.1-1
changelog:
  - New upstream version
  - Include all the files in the GIR target
  - Include the correct file when using Colord-1.0.gir
  - Use gio-2.0 when generating the VAPI


author: Richard Hughes <richard@hughsie.com> 1.4.2-1
changelog:
  - New upstream version
  - Avoid buffer overflow when reading profile_id
  - Fix the detection of duplicate EDIDs
  - Set cd-create-profile date to SOURCE_DATE_EPOCH


author: Richard Hughes <richard@hughsie.com> 0.1.26-1
changelog:
  - New upstream version.
  - Install the cd-convert utility
  - Do not link against the unused gio-unix-2.0


author: Jan Grulich <jgrulich@redhat.com> - 0.26-1
changelog:
  - Spec file based on exiv2 package to provide old libraries before API change
    Resolves: bz#1757349


author: Jan Grulich <jgrulich@redhat.com> - 0.26-11
changelog:
  - Fix heap-based buffer overflow vulnerability in jp2image.cpp that may lead to DoS
    Resolves: bz#1990397


author: Tomáš Mráz <tmraz@redhat.com> 1.0.2m-1
changelog:
  - minor upstream release 1.0.2m fixing security issues
  - fix locking of RNG in FIPS mode for some obscure use-cases


author: Jindrich Novy <jnovy@redhat.com> - 2:2.0.27-2
changelog:
  - switch to master branch to fix /dev/null ownership issues
    (https://github.com/containers/conmon/commit/372fa19211cfeabdb2bad52a4ab8a4d1b0b0063c)
  - Related: #1954702


author: Jindrich Novy <jnovy@redhat.com> - 2:2.0.26-3
changelog:
  - fix "Permission on /dev/null are changing from 666 to 777 after running podman as root [rhel-8.4.0.z]"
  - Resolves: #1961682


author: Jindrich Novy <jnovy@redhat.com> - 0.8.1-2
changelog:
  - backport https://github.com/coreos/go-iptables/pull/62
    from Michael Cambria
  - Resolves: #1627561


author: Kamil Dudka <kdudka@redhat.com> - 8.29-5
changelog:
  - drop BR for bison, which is not used during the build
  - make sure that parse-datetime.{c,y} ends up in debuginfo (#1555079)
  - fix build failure with glibc-2.28


author: Kamil Dudka <kdudka@redhat.com> - 8.29-7
changelog:
  - add provides to coreutils-single to make it a drop-in replacement (#1572693)
  - reintroduce very old Provides (mktemp, sh-utils, textwrap, fileutils, stat)


author: Kamil Dudka <kdudka@redhat.com> - 8.29-8
changelog:
  - ls: increase the allowed abmon width from 5 to 12 (#1577872)
  - date, ls: pick strftime fixes from glibc to improve locale support (#1577872)


author: Kamil Dudka <kdudka@redhat.com> - 8.30-5
changelog:
  - sync: fix open() fallback bug (#1602463)
  - fix implicit declaration warning in coreutils-getgrouplist.patch (#1602463)


author: Kamil Dudka <kdudka@redhat.com> - 8.30-8
changelog:
  - df --local: recognize afs, auristorfs, and smb3 as remote fs (#1798030)
  - fix formatting of sha512sum(1) man page (#1688744)


author: Jan Friesse <jfriesse@redhat.com> 2.99.5-2
changelog:
  - Resolves: rhbz#1654630

  - man: Add some information about address resolution (rhbz#1654630)
  - merge upstream commit 8d50bd946dd7e01da75f06da3f885e7dc82f4f12 (rhbz#1654630)
  - config: Look up hostnames in a defined order (rhbz#1654630)
  - merge upstream commit 3d7f136f86a56dd9d9caa9060f7a01e8b681eb7f (rhbz#1654630)


author: Jan Friesse <jfriesse@redhat.com> 3.0.0-2
changelog:
  - Resolves: rhbz#1665211

  - totemip: Use AF_UNSPEC for ipv4-6 and ipv6-4 (rhbz#1665211)
  - merge upstream commit 2ab4d4188670356dcb82a80f2fc4598f5145c77d (rhbz#1665211)


author: Jan Friesse <jfriesse@redhat.com> 3.0.2-3.1
changelog:
  - Resolves: rhbz#1765619

  - totemsrp: Reduce MTU to left room second mcast (rhbz#1765619)
  - merge upstream commit ee8b8993d98b3f6af9c058194228fc534fcd0796 (rhbz#1765619)


author: Jan Friesse <jfriesse@redhat.com> 3.0.2-4
changelog:
  - Resolves: rhbz#1745624
  - Resolves: rhbz#1745642
  - Resolves: rhbz#1749263
  - Resolves: rhbz#1765025

  - totem: fix check if all nodes have same number of links (rhbz#1749263)
  - merge upstream commit 816324c94cfb917b11f43954b8757424db28b390 (rhbz#1749263)
  - totem: Increase ring_id seq after load (rhbz#1745624)
  - merge upstream commit 3675daceeeeb72af043f5c051daed463fdd2d2a1 (rhbz#1745624)
  - man: Fix link_mode priority description (rhbz#1745642)
  - merge upstream commit 0a323ff2ed0f2aff9cb691072906e69cb96ed662 (rhbz#1745642)
  - totemsrp: Reduce MTU to left room second mcast (rhbz#1765025)
  - merge upstream commit ee8b8993d98b3f6af9c058194228fc534fcd0796 (rhbz#1765025)


author: Jan Friesse <jfriesse@redhat.com> 3.0.3-4
changelog:
  - Resolves: rhbz#1780137
  - Resolves: rhbz#1791792
  - Resolves: rhbz#1809864
  - Resolves: rhbz#1816653

  - votequorum: Ignore the icmap_get_* return value (rhbz#1780137)
  - merge upstream commit cddd62f972bca276c934e58f08da84071cec1ddb (rhbz#1780137)
  - man: move cmap_keys man page from section 8 to 7 (rhbz#1791792)
  - merge upstream commit f1d36307e524f9440733f0b01a9fc627a0e1cac7 (rhbz#1791792)
  - votequorum: Reflect runtime change of 2Node to WFA (rhbz#1780137)
  - merge upstream commit 8ce65bf951bc1e5b2d64b60ea027fbdc551d4fc8 (rhbz#1780137)
  - stats: Add stats for scheduler misses (rhbz#1791792)
  - merge upstream commit 48b6894ef41e9a06ccbb696d062d86ef60dc2c4b (rhbz#1791792)
  - stats: Use nanoseconds from epoch for schedmiss (rhbz#1791792)
  - merge upstream commit ebd05fa00826c366922e619b012a0684c6856539 (rhbz#1791792)
  - main: Add schedmiss timestamp into message (rhbz#1791792)
  - merge upstream commit 35662dd0ec53f456445c30c0ef92892f47b25aa2 (rhbz#1791792)
  - votequorum: Change check of expected_votes (rhbz#1809864)
  - merge upstream commit 0c16442f2d93f32a229b87d2672e2dc8025ec704 (rhbz#1809864)
  - quorumtool: exit on invalid expected votes (rhbz#1809864)
  - merge upstream commit 5f543465bb3506b7f4929a426f1c22a9c854cecd (rhbz#1809864)
  - votequorum: set wfa status only on startup (rhbz#1816653)
  - merge upstream commit ca320beac25f82c0c555799e647a47975a333c28 (rhbz#1816653)


author: Jan Friesse <jfriesse@redhat.com> 3.1.0-1
changelog:
  - Resolves: rhbz#1855293
  - Resolves: rhbz#1855303
  - Resolves: rhbz#1870449
  - Resolves: rhbz#1887400

  - New upstream release (rhbz#1855293)
  - Support for reload of crypto configuration (rhbz#1855303)
  - Increase default token timeout to 3000ms (rhbz#1870449)
  - Add support for nodelist callback into quorum service (rhbz#1887400)


author: Jan Friesse <jfriesse@redhat.com> 3.1.0-3
changelog:
  - Resolves: rhbz#1897085
  - Resolves: rhbz#1896493

  - spausedd: Add ability to move process into root cgroup (rhbz#1897085)
  - totemknet: Check both cipher and hash for crypto (rhbz#1896493)


author: Jan Friesse <jfriesse@redhat.com> 3.0.0-4
changelog:
  - Resolves: rhbz#1827256

  - Add explicit corosync-qdevice and corosync-qnetd dependency for revdeps CI test


author: Psychotic Build System <builder@psychotic.ninja> - 1.0.0-1
changelog:
  - Forked from the Psychotic Ninja 'stikkit-1.0.6-7' package and rebased to 1.0.0
  - Renamed stikkit->cpaste; stikkit.1->cpaste.1; README.Psychotic->README.CentOS
  - Updated README.CentOS
  - Updated stikkit.1
  - Path references changed from /stikkit/ to /cpaste/


author: Pablo Greco <pablo@fliagreco.com.ar> - 1.0.0-2
changelog:
  - Backport patch from stikkit to support private pastes
  - Backport patch from stikkit to change useragent
  - Use last invalid arg as filename, no need to use -i to paste a file


author: Ondrej Vasik <ovasik@redhat.com> - 2.11-36
changelog:
  - in 2015, file name in CVE-2014-9112 shows in a bit different timestamp
    format (fix FTBFS, #1239416)


author: Marek Polacek <polacek@redhat.com> 8.2.1-1.3
changelog:
  - change the default -march on s390x to z13 with tuning for z14 (#1571124)
  - use --disable-multilib on s390x


author: Jeff Law <law@redhat.com 8.2.1-3.4
changelog:
  - Backport PPC string inlines from trunk which allow for valgrind's
    memcheck to work properly (#1652929)
  - Backport bugfix for clz pattern on s390 affecting jemalloc (#1652016)


author: Marek Polacek <polacek@redhat.com> 8.3.1-3
changelog:
  - update from Fedora 8.3.1-3 (#1680182)
  - remove load and test FP splitter (#1673116)
  - fix *movsi_from_df (#1677652)
  - add missing headers
  - add support for live patching (#1668903)
  - retire gcc8-rh1612514.patch, gcc8-rh1652016.patch, gcc8-rh1652929-?.patch


author: Marek Polacek <polacek@redhat.com> 8.3.1-4
changelog:
  - update from Fedora 8.3.1-4 (#1680182)
  - drop gcc8-pr60790.patch, gcc8-pr89629.patch, gcc8-rh1668903-4.patch


author: Marek Polacek <polacek@redhat.com> 8.3.1-4.2
changelog:
  - backport the -fuse-ld=lld option (#1670535)
  - TLS model fix (#1678555, PR c++/85400)
  - two small autoFDO fixes (#1686082)
  - libgomp update (#1707568)
  - member template redeclaration fix (#1652704, PR c++/86747)
  - turn libgcc_s.so into a linker script on i?86, x86_64, ppc64le and also on
    ppc and ppc64 for 64-bit multilib (#1708309)
  - avoid using unaligned vsx or lxvd2x/stxvd2x for memcpy/memmove inline
    expansion (#1666977)


author: Marek Polacek <polacek@redhat.com> 8.3.1-4.5
changelog:
  - fix shift count operand printing (#1730380)
  - fix tree-outof-ssa.c ICE with vector types (PR middle-end/90139, #1730454)
  - fix out-of-ssa with unsupported vector types (PR rtl-optimization/90756,
    - fix ICE with template placeholder for TTP (PR c++/86098, #1730454)


author: Marek Polacek <polacek@redhat.com> 8.3.1-5
changelog:
  - update from Fedora gcc-8.3.1-5 (#1747157)
  - use unspec_volatile for darn (PR target/91481, #1760205, CVE-2019-15847)


author: Marek Polacek <polacek@redhat.com> 8.3.1-5.1
changelog:
  - consider negative edges in cycle detection (#1817991, PR gcov-profile/91601)
  - fix Fortran debug info for arrays with descriptors (#1655624,
    PR fortran/92775)
  - fix wrong code emitted for movv1qi on s390x (#1784758, PR target/92950)


author: Marek Polacek <polacek@redhat.com> 8.4.1-1
changelog:
  - update from GCC 8.4 release (#1868446)
  - remove symlinks to 32-bit versions of these static libraries: libasan.a,
    libitm.a, libquadmath.a, libubsan.a, libgfortran.a (#1779597)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.9.6-8
changelog:
  - Python 2 binary package renamed to python2-cracklib
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Dave Anderson <anderson@redhat.com> - 7.2.3-12
changelog:
  - Address covscan issues
    Resolves: rhbz#1602466
  - Fix for x86_64 5-level pagetable vmalloc range expansion
    Resolves: rhbz#1637125


author: Dave Anderson <anderson@redhat.com> - 7.2.3-16
changelog:
  - Resurrect "dev -p" option.
  - Fix "dev -[dD]" options to account for request_queue.in_flight[] removal.
    Resolves: rhbz#1662039
  - Command line input fixes
    Resolves: rhbz#1664061


author: Dave Anderson <anderson@redhat.com> - 7.2.6-1
changelog:
  - Rebase to latest upstream sources
    Resolves: rhbz#1686560 
  - Utilize the VMCOREINFO PT_NOTE in /proc/kcore header
    Resolves: rhbz#1627528
  - Support extraction of CONFIG_PROC_VMCORE_DEVICE_DUMP data from dumpfile header
    Resolves: rhbz#1702535


author: Dave Anderson <anderson@redhat.com> - 7.2.6-2
changelog:
  - Fix "p" command regression
    Resolves: rhbz#1718417  
  - Fix arm64 debug kernel read error message during initialization
    Resolves: rhbz#1718736


author: Dave Anderson <anderson@redhat.com> - 7.2.7-2
changelog:
  - Rebase to latest upstream sources
    Resolves: rhbz#1738619
  - Support for KASLR on s390x
    Resolves: rhbz# 1753172


author: Dave Anderson <anderson@redhat.com> - 7.2.7-3
changelog:
  - Rebase to github commit 6c1c8ac6
    Resolves: rhbz#1738619
  - Fix "log -a" option
    Resolves: rhbz#1785537
  - Fix for ELF kdump vmcores form s390x KASLR kernels
    Resolves: rhbz#1786996


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.8-3
changelog:
  - Fix for reading compressed kdump dumpfiles from systems with physical memory
    Resolves: rhbz#1819606


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.8-6
changelog:
  - aarch64: Revert to reading CONFIG_ARM64_USER_VA_BITS_52 and CONFIG_ARM64_PA_BITS=52 for 52-bit VA/PA space.
    Resolves: rhbz#1861086


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.8-7
changelog:
  - crash/sadump, kaslr: fix failure of calculating kaslr_offset due to an sadump format restriction
    Resolves: rhbz#1855527


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.8-8
changelog:
  - crash/arm64: Fix arm64 read error with 'idmap_ptrs_per_pgd' symbol with debug kernel
    Resolves: rhbz#1876039


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.9-1
changelog:
  - Rebase to upstream crash version 7.2.9
  - Also minimize the rhel-only patches to the bare minimum.
    Resolves: rhbz#1881854


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.9-2
changelog:
  - Fix the sources file to add gdb-7.6 tarball
    [The line was somehow removed when using rhpkg new-sources to
     update the crash tarball location]
    Resolves: rhbz#1881854


author: Dave Anderson <anderson@redhat.com> - 1.3.1-3
changelog:
  - Fix x86_64 "invalid structure member offset: thread_struct_fs"
    Resolves: rhbz#1589019
  - Fix arm64 "invalid structure member offset: thread_struct_fpsimd_state"
    Resolves: rhbz#1625810


author: Bhupesh Sharma <bhsharma@redhat.com> - 1.5.1-1
changelog:
  - Rebase crash-gcore-command to github upstream version crash-gcore-command-1.5.1
    Resolves: rhbz#1851747


author: Bhupesh Sharma <bhsharma@redhat.com> - 1.6.0-1
changelog:
  - Rebase crash-gcore-command to github upstream version crash-gcore-command-1.6.0
    Resolves: rhbz#1903465


author: Dave Anderson <anderson@redhat.com> - 1.0.3-2.el7
changelog:
  - Add RPM_OPT_FLAGS to gcc line in ptdump.mk
    Resolves: rhbz#1450708
  - Set gdb scope to get appropriate ring_buffer structure
    Resolves: rhbz#1451181


author: Dave Anderson <anderson@redhat.com> - 1.0.3-5
changelog:
  - ptdump: fix build warning: warning: this ‘if’ clause does not guard
  - ptdump: fix failure: ptdump: invalid size request: 0 type: "read page for write" 
  - ptdump: fix heap memory and fd leak when fault happens
    Resolves: rhbz#1786497


author: Dave Anderson <anderson@redhat.com> - 2.0.12
changelog:
  - Differentiate ppc64 .ring_buffer_read text symbol from ring_buffer_read data symbol
  - Fix for ring_buffer_per_cpu.nr_pages size change on big-endian systems 
  - Fix for Linux 4.7 change to the TRACE_EVENT_FL_TRACEPOINT flag
    Resolves: rhbz#1441914
    Resolves: rhbz#1440726


author: Dave Anderson <anderson@redhat.com> - 2.0.13
changelog:
  - Build requires crash-devel-7.2.0-2 and usage requires crash-7.2.0-2
    because of load_module structure change.
    Resolves: rhbz#1520825


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.11.0-2
changelog:
  - Consistently produce valid URLs by prepending protocol. (RhBug:1632121)
  - modifyrepo_c: Prevent doubling of compression (test.gz.gz) (RhBug:1639287)
  - Correct pkg count in headers if there were invalid pkgs (RhBug:1596211)
  - Add support for modular errata (RhBug:1656584)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.11.0-3
changelog:
  - Backport patch to switch off timestamps on documentation in order to remove
    file conflicts (RhBug:1738788)


author: Ales Matej <amatej@redhat.com> - 0.15.1-1
changelog:
  - Update to 0.15.1
  - Allow pip to see installation of python3-createrepo_c
  - Imporove documentation
  - Remove dependency on deltarpm in favour of drpm
  - Obsolete createrepo on all Fedoras again (RhBug:1702771)
  - Fix issue with createrepo_c hanging at the end (RhBug:1714666)
  - Don't include packages with forbidden control chars in repodata
  - Depend on the appropriate minimum version of libmodulemd
  - Add --pkgorigins mode for Koji
  - Prevent exiting with 0 if errors occur while finalizing repodata.
  - Add support for reading and merging module metadata
  - Update --keep-all-metadata to keep all additional metadata, not just updateinfo and groupfile (RhBug:1639287)
  - mergerepo_c: Add support for --koji simple mode
  - Fix generating corrupted sqlite files (RhBug: 1696808)
  - Do not obsolete createrepo on Fedora < 31
  - mergerepo_c: check if nevra is NULL and warn user about src.rpm naming
  - Include file timestamp in repomd.xml to allow reproducing exact metadata as produced in the past
  - Enhance support of zchunk
  - Support of zchunk
  - [spec] Fix ldconfig for rhel <= 7
  - Fix "CR_DELTA_RPM_SUPPORT" redefined warnings
  - Set to build against Python 3 by default
  - Update README
  - Add mergerepo_c --repo-prefix-search and --repo-prefix-replace.
  - Fix missing packages in mergerepo_c in case multiple VR exists for single pkg in repo.


author: Ales Matej <amatej@redhat.com> - 0.15.1-2
changelog:
  - Add reboot_suggested to UpdateRecord (RhBug:1772466)
  - Explicitly output boolean values for updateinfo.xml (RhBug:1772466)
  - Fix modifyrepo_c with modules.yaml as a symbolic link (RhBug:1776399)


author: Ales Matej <amatej@redhat.com> - 0.15.10-1
changelog:
  - Update to 0.15.10
  - New option --recycle-pkglist for --update mode
  - Add restart_suggested field to updatecollectionpackage in updateinfo.xml
  - Add relogin_suggested field to updatecollectionpackage in updateinfo.xml (Rhbug:1779751)
  - Export all changelog entries to other.xml in compatibility mode
  - Enhance error handling when locating repositories (RhBug:1762697)
  - Clean up temporary .repodata on sigint
  - Support issued date in epoch format set by Python API (RhBug:1779751)
  - Allow parsing of xml repodata from string via new API functions (RhBug:1804308)
  - Fix a bug when setting updateCollectionModule (RhBug:1821781)


author: Nicola Sella <nsella@redhat.com> - 0.16.2-1
changelog:
  - Update to 0.16.2
  - Add module metadata support to createrepo_c (RhBug:1795936)
  - Fix various memory leaks


author: Adrian Reber <adrian@lisas.de> - 3.12-0.1
changelog:
  - Updated to 3.12 (pre-release)
  - Create libs subpackage
  - Build against SELinux (Fedora and RHEL8)
  - Build against libbsd (Fedora)


author: Jindrich Novy <jnovy@redhat.com> - 0.15-2
changelog:
  - backport "exec: check read bytes from sync" (gscrivan@redhat.com)
    (https://github.com/containers/crun/issues/511)
  - Related: #1888571


author: Ondrej Kozina <okozina@redhat.com> - 2.0.4-1
changelog:
  - Update to cryptsetup 2.0.4.
  - patch: Add RHEL system library paths in configure.
  - patch: Increase default LUKS2 header size to 8 MiBs.
  - patch: update tests to be compatible with larger headers.
  - Set default format to LUKS2.
  - Cleanup changelog.
  - Resolves: #1564540 #1595257 #1595266 #1595881 #1600164


author: Ondrej Kozina <okozina@redhat.com> - 2.0.4-2
changelog:
  - patch: fix device alignment bug when processing hinted
    value by device topology info.
  - Resolves: #1614219


author: Ondrej Kozina <okozina@redhat.com> - 2.0.6-1
changelog:
  - Update to cryptsetup 2.0.6
  - Enables all supported metadata sizes in LUKS2 validation code.
  - Resolves: #1653383


author: Ondrej Kozina <okozina@redhat.com> - 2.2.0-2
changelog:
  - patch: Fix mapped segments overflow on 32bit architectures.
  - patch: Take optimal io size in account with LUKS2 reencryption.
  - Resolves: #1742815 #1746532


author: Ondrej Kozina <okozina@redhat.com> - 2.2.2-1
changelog:
  - Update to cryptsetup 2.2.2
  - LUKS2 reencryption honors activation flags (one time and persistent).
  - LUKS2 reencryption works also without volume keys put in kernel
    keyring service.
  - Resolves: #1757783 #1750680 #1753597 #1743399

  - Resolves: #1742815 #1746532


author: Ondrej Kozina <okozina@redhat.com> - 2.2.2-1
changelog:
  - Update to cryptsetup 2.2.2
  - LUKS2 reencryption honors activation flags (one time and persistent).
  - LUKS2 reencryption works also without volume keys put in kernel
    keyring service.
  - Resolves: #1757783 #1750680 #1753597 #1743399


author: Ondrej Kozina <okozina@redhat.com> - 2.3.3-2
changelog:
  - patch: Fix possible memory corruption in LUKS2 validation
  	 code in 32bit library.
  - Resolves: #1872294


author: Ondrej Kozina <okozina@redhat.com> - 2.3.3-4
changelog:
  - patch: Fix reencryption for custom devices with data segments
    set to use cipher_null.
  - Resolves: #1927409


author: Vladis Dronov <vdronov@redhat.com> - 15.9-8
changelog:
  - Fix a double-free in changestring() (bz1886165)
  - Update Requires to include coreutils and ed
  - Adjust cscope-coverity-fixes.patch removing the fclose(script) chunk
  - Adjust BuildRequires and remove trailing spaces
  - Remove older source version from .gitignore
  - Rename cscope-invindex-sizing.patch as it is for the older upstream version


author: Andreas Schneider <asn@redhat.com> - 4.9.1-6
changelog:
  - resolves: #1642092 - Harden [homes] share export
  - resolves: #1648846 - Fix out of bound array access in ctdb
  - resolves: #1657266 - Fix tmp directory creation in /run


author: Andreas Schneider <asn@redhat.com> - 4.9.1-7
changelog:
  - resolves: #1658690 - Add smbc_setOptionProtocols()
  - resolves: #1658678 - Fix spoolss client operations against Windows


author: Andreas Schneider <asn@redhat.com> - 4.10.4-0
changelog:
  - related: #1638001 - Rebase to Samba version 4.10.4
  - resolves: #1597298 - Build Samba with python3
  - resolves: #1658558 - Add 'net ads leave --keep-account' option
  - resolves: #1669004 - Fix systemd status notifications
  - resolves: #1672167 - Fix printing cache timeout in debug output
  - resolves: #1696525 - Fix CVE-2019-3880


author: Andreas Schneider <asn@redhat.com> - 4.10.4-1
changelog:
  - resolves: #1712378 - Fix smbspool CUPS backend
  - resolves: #1696612 - Fix 'net ads join -U admin@parentdomain'


author: Andreas Schneider <asn@redhat.com> - 4.10.4-100
changelog:
  - resolves: #1760824 - Avoid overlinking with librt and libpthread
  - resolves: #1759236 - Fix forest trusts enumeration
  - resolves: #1761719 - Fix CUPS username/password authentication with smbspool


author: Andreas Schneider <asn@redhat.com> - 4.11.2-4
changelog:
  - related: #1754409 - Add patch to avoid overlinking with libnsl and libsocket
  - related: #1754409 - Fix permissions for pidl
  - related: #1754409 - Fix logrotate script
  - related: #1754409 - Add missing README files


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.11.2-10
changelog:
  - resolves: #1790353 - Fix access check in DsRGetForestTrustInformation
  - resolves: #1791209 - Fix CVE-2019-14907


author: Andreas Schneider <asn@redhat.com> - 4.11.2-12
changelog:
  - related: #1781232 - Improve debug output of smbclient
  - resolves: #1794461 - Do not return bogus inode numbers in
                         cli_qpathinfo2()/cli_qpathinfo3() for SMB1
  - resolves: #1794442 - Fix segfault in smbd_do_qfilepathinfo()


author: Andreas Schneider <asn@redhat.com> - 4.12.3-1
changelog:
  - resolves: #1666737 - Add a new smbc_readdirplus2() function to libsmbclient
  - resolves: #1842844 - Fix GnuTLS priority list for TLS connections


author: Isaac Boukris <iboukris@redhat.com> - 4.12.3-4
changelog:
  - resolves: #1850980 - Add "additional dns hostname" to keytab
  - resolves: #1850981 - Add net-ads-join dnshostname=fqdn option


author: Andreas Schneider <asn@redhat.com> - 4.12.3-5
changelog:
  - resolves: #1823612 - Fix segfault in 'net ads dns gethostbyname'
  - resolves: #1792553 - Fix 'net ads join createcomputer=OU'


author: Andreas Schneider <asn@redhat.com> - 4.12.3-7
changelog:
  - resolves: #1855711 - Fix 'require_membership_of' documentation in
                         pam_winbind manpage


author: Andreas Schneider <asn@redhat.com> - 4.12.3-9
changelog:
  - related: #1817557 - Move DECRPC mdssvc data files to correct package
  - resolves: #1856676 - Fix lookuprids in winbind


author: Andreas Schneider <asn@redhat.com> - 4.13.2-1
changelog:
  - resolves: #1878109 - Rebase Samba to version 4.13.2
  - resolves: #1872833 - Add samba-winexe subpackage
  - resolves: #1891688 - Fix CVE-2020-14323
  - resolves: #1892633 - Fix CVE-2020-14318
  - resolves: #1892639 - Fix CVE-2020-14383
  - resolves: #1879835 - Fix CVE-2020-1472
  - resolves: #1888990 - Update smb.conf manpages to describe how to apply
                         config changes.
  - resolves: #1869702 - Fix %U substitution for 'valid users' option
  - resolves: #1818038 - Improve FIPS compliance


author: Andreas Schneider <asn@redhat.com> - 4.13.2-2
changelog:
  - related: #1869702 - Fix spoolss crash
  - resolves: #1896736 - Fix name lookups of FreeIPA users
  - resolves: #1899113 - Fix DFS links


author: Andreas Schneider <asn@redhat.com> - 4.13.3-3
changelog:
  - resolves: #1924615 - Fix a memcache bug when cache is full
  - resolves: #1924571 - Ensure that libwbclient has been updated before
                         restarting services


author: Andreas Schneider <asn@redhat.com> - 4.13.3-4
changelog:
  - resolves: #1964314 - Fix ldconfig warning about libsmbldap.so.2
  - resolves: #1964398 - Fix smbd trying to delete files with wrong permissions
  - resolves: #1969831 - Fix memory leak in RPC server


author: Andreas Schneider <asn@redhat.com> - 4.9.0rc3-3
changelog:
  - related: #1614232 - Update to Samba 4.9.0rc3
  - resolves: #1554753 - Fix CVE-2018-1050
  - resolves: #1617912 - Fix CVE-2018-10858
  - resolves: #1617913 - Fix CVE-2018-10918
  - resolves: #1617914 - Fix CVE-2018-10919
  - resolves: #1617915 - Fix CVE-2018-1139
  - resolves: #1612522 - Manpage fixes


author: Andreas Schneider <asn@redhat.com> - 4.9.0rc5-3
changelog:
  - related: #1614232 - Update to Samba 4.9.0rc5
  - resolves: #1610909 - Re-enable glubsterfs vfs module
  - resolves: #1624170 - Build with -fstack-protectore-strong if available
  - resolves: #1602685 - Fixed issues found by covscan


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.9.1-3
changelog:
  - Temporarily remove smbtorture from samba-test due to Python 2 linkage
  - related: #1609661 - samba-test package cannot be installed due to unresolved dependencies


author: Andreas Schneider <asn@redhat.com> - 4.9.1-5
changelog:
  - resolves: #1644327 - Segfault if wrong 'passdb backend' is configured
  - resolves: #1647959 - Segfault in the debug system with hardended build


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-21
changelog:
  - 1602469 - fixed covscan issues
  - 1625899 - cups 2.2.6 lpr command fails against old cups 1.3.9 server
  - 1625913 - ssl options aren't initialized when no SSLOptions directive is set in /etc/cups/client.conf
  - 1618009 - Enabling cups.path causes high load when jobs are submitted to CUPS
  - 1630805 - Make cups systemd unit files more upstream-like


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-22
changelog:
  - 1622431 - Jobs with multiple files don't complete when backend fails
  - CVE-2018-4700 cups: Predictable session cookie breaks CSRF protection [rhel-8]


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-30
changelog:
  - 1774462 - CVE-2019-8675 - buffer overflow in SNMP and IPP, memory disclosure and DoS in scheduler
  - 1774463 - CVE-2019-8696


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-35
changelog:
  - 1825254 - CVE-2020-3898 cups: heap based buffer overflow in libcups's ppdFindOption() in ppd-mark.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-36
changelog:
  - 1838449 - ipp/socket backends connect to turned off device for eternity (contimeout is not applied)
  - 1689207 - Add failover backend
  - 1833516 - DirtyCleanInterval ignored if there are open client connections


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.20.0-13
changelog:
  - 1602470 - covscan fixes from upstream
  - 1632268 - cups-filters needs to obsolete ghostscript-cups and foomatic-filters
  - 1626996 - cups-filters: Sticky EOF behavior in glibc breaks descriptor concatenation using dup2


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-6
changelog:
  - SASL password overflow via integer overflow (CVE-2018-16839)
  - fix use-after-free in handle close (CVE-2018-16840)
  - fix bad arethmetic when outputting warnings to stderr (CVE-2018-16842)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-10
changelog:
  - fix SMTP end-of-response out-of-bounds read (CVE-2019-3823)
  - fix NTLMv2 type-3 header stack buffer overflow (CVE-2019-3822)
  - fix NTLM type-2 out-of-bounds buffer read (CVE-2018-16890)
  - xattr: strip credentials from any URL that is stored (CVE-2018-20483)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-12
changelog:
  - double free due to subsequent call of realloc() (CVE-2019-5481)
  - fix heap buffer overflow in function tftp_receive_packet() (CVE-2019-5482)
  - fix TFTP receive buffer overflow (CVE-2019-5436)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-15
changelog:
  - do not crash when HTTPS_PROXY and NO_PROXY are used together (#1873327)
  - libcurl: wrong connect-only connection (CVE-2020-8231)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-18
changelog:
  - http: send payload when (proxy) authentication is done (#1918692)
  - curl: Inferior OCSP verification (CVE-2020-8286)
  - libcurl: FTP wildcard stack overflow (CVE-2020-8285)
  - curl: trusting FTP PASV responses (CVE-2020-8284)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-18.el8_4.1
changelog:
  - fix bad connection reuse due to flawed path name checks (CVE-2021-22924)
  - disable metalink support to fix the following vulnerabilities
      CVE-2021-22923 - metalink download sends credentials
      CVE-2021-22922 - wrong content via metalink not discarded


author: Simo Sorce <simo@redhat.com> - 2.1.27-0.4rc7
changelog:
  - Add patch form Upstream PR559 to use RC4 implementation from OpenSSL
  - Resolves bz#1618744
  - Fix multilib issue bz#1663120


author: Jeff Moyer <jmoyer@redhat.com> - 67-1.el8
changelog:
  - Rebase to v67.  This brings in the following features:
    - support for the 'security frozen' sysfs attribute
    - support for using pmem as system ram
    - various cleanup and bug fixes
  - Fix load-keys failure in initramfs (Jeff Moyer)
  - Resolves: bz#1724531 bz#1730673 bz#1741164 bz#1741165 bz#1749888 bz#1749889


author: Jeff Moyer <jmoyer@redhat.com> - 1.4-4
changelog:
  - Get rid of SuSe conditionals (Jeff Moyer)
  - Remove the %check section. (Jeff Moyer)
  - Resolves: rhbz#1580829


author: Jeff Moyer <jmoyer@redhat.com> - 1.4-5.el8
changelog:
  - use 
    CFLAGS="${CFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CFLAGS ; 
    CXXFLAGS="${CXXFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection}" ; export CXXFLAGS ; 
    FFLAGS="${FFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FFLAGS ; 
    FCFLAGS="${FCFLAGS:--O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -I/usr/lib64/gfortran/modules}" ; export FCFLAGS ; 
    LDFLAGS="${LDFLAGS:--Wl,-z,relro  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld}" ; export LDFLAGS instead of -O2 -g -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -fexceptions -fstack-protector-strong -grecord-gcc-switches -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m64 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection
  - Resolves: rhbz#1630611


author: Jeff Moyer <jmoyer@redhat.com> - 1.5-1.el8
changelog:
  - rebase to pmdk-1.5, and rename to nvml (Jeff Moyer)
  - broken libpmemcto was removed
  - c++ bindings were moved to a separate project/package
  - Fix library requires to be =n-v-r instead of >= (Jeff Moyer)
  - resolves: rhbz#1488828


author: Jeff Moyer <jmoyer@redhat.com> - 1.6-2.el8
changelog:
  - Add explicit version dependencies
  - Fix up broken link line in build system
  - Related: rhbz#1598527


author: Jeff Moyer <jmoyer@redhat.com> - 1.9.2-1.el8
changelog:
  - Package pmdk version 1.9.2 for stream 1-fileformat-v6-rhel-8.3.1
  - libvmem is no longer packaged as part of pmdk.
  - ppc64le packages are now built
  - Related: rhbz#1524652, rhbz#1780388, rhbz#1854812, rhbz#1860860


author: David Herrmann <dh.herrmann@gmail.com> - 1:1.12.8-2
changelog:
  - Extract 'dbus-tools' package from 'dbus-daemon' to provide all command-line
    utilities independent of the actual message bus. They are valid to be used
    with independent message-bus implementations, so they should not needlessly
    pull in dbus-daemon.


author: Martin Pitt <mpitt@redhat.com>
changelog:
  - Drop unpublished -doc package to fix FTBFS rhbz#1640736
  - Add dist-git smoketest rhbz#1625683
  - Move dbus system user creation to correct package rhbz#1634496


author: David Herrmann <dh.herrmann@gmail.com> - 1:1.12.8-1
changelog:
  - Turn 'dbus' package into 'dbus-daemon' package, but keep 'dbus' for
    compatibility around and make it pull in the new 'dbus-daemon' package.


author: David Herrmann <dh.herrmann@gmail.com> - 1:1.12.8-1
changelog:
  - Extract 'dbus-common' package from 'dbus-daemon' to provide XML configuration
    and setup files as independent package ready for alternative Message Bus
    implementations to be used.


author: David King <amigadave@amigadave.com> - 0.104-1
changelog:
  - Update to 0.104
  - Remove RPATH
  - Remove executable bit from sourced script
  - Move man page to main package and update glob
  - Make the build output more verbose


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.2.4-9
changelog:
  - Python 2 binary package renamed to python2-dbus
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.2.4-10
changelog:
  - Also add Provides for the old name without %_isa
  - Use %python_provide for the python3 subpackage and drop manual Provide which
    conflicts with %python_provide in the python2 subpackage.


author: Peter Jones <pjones@redhat.com> - 8-1
changelog:
  - Update to dbxtool 8
  - Make a "make coverity" rule to scan the source
    Results at: https://scan.coverity.com/projects/rhboot-dbxtool
  - Don't try to apply anything if PK and KEK aren't enrolled
  - Add --force and --quiet for the PK/KEK checker, and use them in the
    systemd service.
    Resolves: rhbz#1489942
  - Add a .syntastic_c_config for vim's Syntastic modules
  - Use tsearch()/tfind()/tdestroy() from libc instead of ccan htables
  - Don't open the dbx file with O_RDWR|O_CREAT, use O_RDONLY.
  - Lots of minor bug fixes gcc -Wextra and friends found.


author: Peter Jones <pjones@redhat.com> - 8-2
changelog:
  - Don't use -f in dbxtool.service; that'll make it do the thing we're
    trying to avoid.
    Resolves: rhbz#1489942


author: Kalev Lember <klember@redhat.com> - 0.27.1-1
changelog:
  - Update to 0.27.1
  - Switch to the meson build system
  - Don't set group tags
  - Remove obsolete rpm scriptlets
  - Fix gtk-doc directory ownership
  - Tighten soname glob


author: Marek Kasik <mkasik@redhat.com> - 0.28.0-2
changelog:
  - Check mtimes of files in /etc/dconf/db/*.d/ directories
  - when running "dconf update"
  - Related: #1570569


author: Olivier Fourdan <ofourdan@redhat.com> - 0.28.0-3
changelog:
  - Backport fix for emission of spurious changed signals
  - for all keys at once crashing gnome-shell
  - Resolves: #1666176


author: Alejandro Sáez <asm@redhat.com> - 1.3.2-3
changelog:
  - Resolves: rhbz#1758612
    - Resolves: rhbz#1780554
    - Add patch: 1781-pkg-terminal-Fix-exit-status.patch


author: Alejandro Sáez <asm@redhat.com> - 1.3.2-3
changelog:
  - Resolves: rhbz#1758612
  - Resolves: rhbz#1780554
  - Add patch: 1781-pkg-terminal-Fix-exit-status.patch


author: Marian Csontos <mcsontos@redhat.com> - 2.03.05-2
changelog:
  - Fix scanning of PVs with size not matching device.
  - Allow --stripe/--stripesize in mirror conversions.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.05-3
changelog:
  - Remove unsupported OPTIONS+="event_timeout" udev rule from 11-dm-lvm.rules.
  - Prevent creating VGs with PVs with different logical block sizes.
  - Fix metadata writes from corrupting with large physical block size.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.07-1
changelog:
  - Ensure minimum required region size on striped RaidLV creation.
  - Fix resize of thin-pool with data and metadata of different segtype.
  - Improve mirror type leg splitting.
  - Fix activation order when removing merged snapshot.
  - Experimental VDO support for lvmdbusd.
  - Correctly set read_ahead for LVs when pvmove is finished.
  - Add support for DM_DEVICE_GET_TARGET_VERSION into device_mapper.
  - Activate thin-pool layered volume as 'read-only' device.
  - Ignore crypto devices with UUID signature CRYPT-SUBDEV.
  - Synchronize with udev when dropping snapshot.
  - Add missing device synchronization point before removing pvmove node.
  - See WHATS_NEW for more.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.08-1
changelog:
  - VDO and writecache volume improvements.
  - Prohibit reshaping of stacked raid LVs to prevent corruption.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.09-1
changelog:
  - Fix support for lvconvert --repair of pools used by third party applications.
  - Fix formating of vdopool (vdo_slab_size_mb was smaller by 2 bits).
  - Fix busy loop in dmeventd.
  - Fix lvmlocks.service using incorrect option.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.11-1
changelog:
  - Fix pvck handling MDA at offset different from 4096.
  - Partial or degraded activation of writecache is not allowed.
  - Enhance error handling in fsadm and handle correct fsck result.
  - Dmeventd lvm plugin ignores higher reserved_stack lvm.conf values.
  - Support using BLKZEROOUT for clearing devices.
  - Fixed interrup handling.
  - Fix block cache when device has too many failing writes.
  - Fix block cache waiting for IO completion with failing disks.
  - Add configure --enable-editline support as an alternative to readline.
  - Enhance reporting and error handling when creating thin volumes.
  - Enable vgsplit for VDO volumes.
  - Lvextend of vdo pool volumes ensure at least 1 new VDO slab is added.
  - Restore lost signal blocking while VG lock is held.
  - Improve estimation of needed extents when creating thin-pool.
  - Use extra 1% when resizing thin-pool metadata LV with --use-policy.
  - Enhance --use-policy percentage rounding.
  - Allow pvmove of writecache origin.
  - Report integrity fields.
  - Integrity volumes defaults to journal mode.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.11-2
changelog:
  - Fix problem with wiping of converted LVs.
  - Fix memleak in scanning.
  - Fix corner case allocation for thin-pools.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.11-3
changelog:
  - Fix mpath filtering of NVMe devices.
  - Check if lvcreate passes read_only_volume_list with tags and skips zeroing.
  - Limit pool metadata spare to 16GiB.
  - Improves conversion and allocation of pool metadata.
  - Fix different limits used for metadata by lvm2 and thin-tools.
  - Fix interrupting lvconvert --splitcache command with striped origin volumes.


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.7-1
changelog:
  - Update Source to 0.7.7
    * Previous patches 0001-0009 & 0016 are included in this commit
  - Add upstream patches since 0.7.7
    * patches 0001-0012 are from upstream commits since 0.7.7
  - Add 0013-libmultipath-print-correct-default-for-delay_-_check.patch
    * fix minor configuration printing issue. posted upstream
  - Add 0014-multipath.conf.5-clarify-property-whitelist-handling.patch
    * clarify property blacklist_excecptions handling in man page
      posted upstream
  - Add 0015-mpathpersist-add-all_tg_pt-option.patch
    * add new all_tg_pt multpiath.conf option. posted upstream
  - Add 0016-libmultipath-remove-rbd-code.patch
    * remove unused rbd code. posted upstream
  - Add 0017-mpathpersist-fix-aptpl-support.patch
    * add ":aptpl" suffix for reservation_key to fix aptpl support.
      posted upstream
  - Add 0018-multipath-don-t-check-timestamps-without-a-path.patch
    * fix multipath null dereference crash. posted upstream
  - Add 0019-libmultipath-fix-detect-alua-corner-case.patch
    * fix alua detection with retain_hardware_handler set to off. posted
      upstream
  - Add 0020-multipath-fix-setting-conf-version.patch
    * multipath wasn't setting the kernel version correctly. posted
      upstream
  - Add 0028-RH-reset-default-find_mutipaths-value-to-off.patch
    * default to RHEL7 and older device detection style. Redhat specific,
      to keep customer experience the same.
  - Rename files
    * Previous patches 0010-0015 & 0017 are now patches 0021-0027
  - Modify 0021-RH-fixup-udev-rules-for-redhat.patch
    * Fix spurious compile warning with redhat compile options
  - Modify 0022-RH-Remove-the-property-blacklist-exception-builtin.patch
    * clarify changes in man page


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.7-2.gitef6d98b
changelog:
  - Update Source to latest upstream commit
    * Previous patches 0001-0018 are included in this commit
  - Rename files
    * Previous patches 0019-0028 are now patches 0002-0003 & 0012-0019
  - Add 0001-libmultipath-remove-last-of-rbd-code.patch
  - Add 0004-mpathpersist-add-param-alltgpt-option.patch
    * mpathpersist now accepts --param-alltgpt
  - Add 0005-libmutipath-remove-unused-IDE-bus-type.patch
  - Add 0006-multipathd-add-new-protocol-path-wildcard.patch
    * multipathd show paths format now accepts %PATCH for the path protocol/transport
  - Add 0007-libmultipath-add-protocol-blacklist-option.patch
    * You can now use the "protocol" blacklist section parameter to blacklist
      by protocol/transport
  - Add 0008-libmultipath-remove-_filter_-blacklist-functions.patch
  - Add 0009-multipath-tests-change-to-work-with-old-make-version.patch
  - Add 0010-multipath-tests-add-blacklist-tests.patch
  - Add 0011-mpathpersist-add-missing-param-rk-usage-info.patch
  - Refresh 0013-RH-Remove-the-property-blacklist-exception-builtin.patch
  - Modify 0016-RH-add-mpathconf.patch
    * improve usage message and man page
  - Modify device-mapper-multipath.spec
    * updated dependencies


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.8-1
changelog:
  - Update Source to upstream version 0.7.8
    * Previous patches 0001-0011 are included in this version
  - Rename files
    * Previous patches 0012-0019 are now patches 0007-0014
  - Add 0001-multipath-tweak-logging-style.patch
  - Add 0002-multipathd-check-for-NULL-udevice-in-cli_add_path.patch
  - Add 0003-libmultipath-remove-max_fds-code-duplication.patch
  - Add 0004-multipathd-set-return-code-for-multipathd-commands.patch
  - Add 0005-mpathpersist-fix-registration-rollback-issue.patch
  - Add 0006-libmultipath-timeout-on-unresponsive-tur-thread.patch
    * The above 6 patches have been submitted upstream
  - Resolves: bz #1606947, #1631883


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.8-2
changelog:
  - Add 0015-libmultipath-free-allocated-value-in-set_int.patch
  - Add 0016-kpartx-fix-new-memory-leak-in-dm_find_part.patch
  - change hardcoded /usr/lib/udev/rules.d to _udevrulesdir
  - Resolves: bz #1606947


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.8-3
changelog:
  - Add 0017-BZ-1648397-fix-mpp-hwe-handling-when-paths-are-freed.patch
    * Fix crash by deleting in use hardware entry list pointer
  - Add 0018-libmultipath-cleanup-pthread_cleanup_pop-call.patch
    * Fix compiler warning
  - Add 0019-libmultipath-fix-false-removes-in-dmevents-polling-c.patch
    * The above 3 patches have been accepted upstream
  - Resolves: bz #1648397


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.8-5
changelog:
  - Add 0021-BZ-1673167-Fix-miscounting-active-paths.patch
  - Add 0022-BZ-1673167-ignore-failed-wwid-recheck.patch
  - Resolves: bz #1673167


author: Benjamin Marzinski <bmarzins@redhat.com> 0.7.8-6
changelog:
  - Fix multipath_conf_syntax CI test
    * need to wait for udev to settle before removing multipath device
  - Resolves: bz #1673167


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.0-1
changelog:
  - Update Source to upstream version 0.8.0
    * Previous patches 0001-0006 & 0015-0019 are included in this commit
  - Rename files
    * Previous patches 0007-0014 are now 0018-0025
    * Previous patches 0020-0023 are now 0001, 0006 & 0007
  - Add 0002-libmultipath-handle-existing-paths-in-marginal_path-.patch
  - Add 0003-multipathd-cleanup-marginal-paths-checking-timers.patch
  - Add 0004-libmultipath-fix-marginal-paths-queueing-errors.patch
  - Add 0005-libmultipath-fix-marginal_paths-nr_active-check.patch
  - Add 0008-libmutipath-continue-to-use-old-state-on-PATH_PENDIN.patch
  - Add 0009-multipathd-use-update_path_groups-instead-of-reload_.patch
  - Add 0010-multipath.conf-add-missing-options-to-man-page.patch
  - Add 0011-libmultipath-add-get_uid-fallback-code-for-NVMe-devi.patch
  - Add 0012-libmulitpath-cleanup-uid_fallback-code.patch
  - Add 0013-multipathd-handle-changed-wwids-by-removal-and-addit.patch
    * Multipath will now automatically remove and re-add paths if
      their wwid changes
  - Add 0014-multipathd-remove-wwid_changed-path-attribute.patch
  - Add 0015-multipathd-ignore-disable_changed_wwids.patch
    * Since paths are now getting removed and re-added there is
      no need to disable them.
  - Add 0016-multipathd-Don-t-use-fallback-code-after-getting-wwi.patch
  - Add 0017-libmultipath-silence-dm_is_mpath-error-messages.patch
  - Add 0026-RH-Fix-nvme-compilation-warning.patch
  - Add 0027-Fix-systemd-version-detection.patch
    * The above 16 patches have been submitted upstream
  - Add 0028-RH-attempt-to-get-ANA-info-via-sysfs-first.patch
    * Red Hat has a sysfs method to access the ANA state, which isn't
      upstream, and will not be. This will probably go away in the
      future.
  - Resolves: bz #1498546


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.0-2
changelog:
  - Add 0029-BZ-1700451-check-on-multipathd-without-starting-it.patch
  - Add 0030-BZ-1700451-test-socket-connection-in-non-blocking-mo.patch
    * the "multipath -u" call in 62-multipath.rules should no longer hang
      on multipathd startup.
  - Resolves: bz #1700451


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.0-3
changelog:
  - Add 0031-libmultipath-handle-clock_gettime-failures-in-tur-ch.patch
  - Add 0032-kpartx-fail-if-dup-of-dasd-file-descriptor-fails.patch
  - Add 0033-multipathd-fix-REALLOC_REPLY-with-max-length-reply.patch
  - Add 0034-multipathd-handle-NULL-return-from-genhelp_handler.patch
    * The above 4 patches have been submitted upstream
  - Related: bz #1498546


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.0-4
changelog:
  - Add 0035-BZ-1700911-hwtable-add-Lenovo-DE-series.patch
  - Add 0036-libmultipath-make-vector_foreach_slot_backwards-work.patch
    * Fix for bz #1713459
  - Fixes for bz #1666322 and #1669097 were included in 0.8.0 upstream
    code
  - Resolves: bz #1666322, #1669097, #1700911, #1713459


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.3-1
changelog:
  - Update Source to upstream version 0.8.3
    * This version includes the fixes for bz #1690515, #1703439,
        * Previous patches 0001-0017 & 0031-0036 are included in this version
  - Rename files
    * Previous patches 0018-0026 & 0028 are now 0004-0013
    * 0008-RH-add-mpathconf.patch has been modified to add a
      --property_blacklist option to fix bz #1753729
  - Add 0001-multipathd-warn-when-configuration-has-been-changed.patch
    * Multipath now logs a warning message when the configuration file
      has been changed to fix bz #1750594
  - Add 0002-libmultipath-fix-leak-in-foreign-code.patch
  - Add 0003-Fix-leak-in-mpathpersist.patch
    * The above 3 patches have been submitted upstream
  - Resolves: bz #1690515, #1703439, #1719562, #1747534, #1750594, #1753729


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.3-3
changelog:
  - Rename files
    * Previous patches 0004-0013 are now 0010-0019
    * 0014-RH-add-mpathconf.patch now makes mpathconf default to not
      printing foreign devices (bz #1760709)
  - Add 0004-libmultipath-remove-unused-path-prio_args.patch
  - Add 0005-libmultipath-constify-get_unaligned_be.patch
  - Add 0006-libmultipath-add-missing-hwe-mpe-variable-merges.patch
  - Add 0007-libmultipath-fix-sgio_get_vpd-looping.patch
  - Add 0008-libmultipath-add-vend_id-to-get_vpd_sgio.patch
  - Add 0009-libmultipath-add-code-to-get-vendor-specific-vpd-dat.patch
    * Add the '%g' maps and paths format wildcard, and the vpd_vendor
      multipath.conf devices section parameter. (bz #1527212)
  - Resolves: bz #1527212, #1760709


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.3-3.1
changelog:
  - Add 0020-libmultipath-make-dm_get_map-status-return-codes-sym.patch
  - Add 0021-multipathd-fix-check_path-errors-with-removed-map.patch
    * The above 2 patches fix bz #1856944. multipathd handles external
      device removal better.
  - Resolves: bz #1856944


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.3-3.3
changelog:
  - Add 0022-libmultipath-fix-files-read-from-config_dir.patch
    * Fix for bz #1858993. Only read files ending in .conf
  - Resolves: bz #1858993


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-1
changelog:
  - Update Source to upstream version 0.8.4
    * This version includes the fixes for bz #1768894 & #1821214
    * Previous patches 0001-0009 are included in this version
  - Rename files
    * Previous patches 0010-0019 are now 0011-0020
  - Add 0001-libmultipath-assign-variable-to-make-gcc-happy.patch
  - Add 0002-libmutipath-don-t-close-fd-on-dm_lib_release.patch
  - Add 0003-libmultipath-allow-force-reload-with-no-active-paths.patch
    * make multipath and multipathd reload maps with no active paths
      (bz #1814858)
  - Add 0004-libmpathpersist-depend-on-libmultipath.patch
  - Add 0005-multipath-tools-Makefile-more-dependency-fixes-for-p.patch
  - Add 0006-multipath-tools-Makefile.inc-set-Wno-error-clobbered.patch
  - Add 0007-libmultipath-discovery.c-use-z-qualifier-for-size_t.patch
  - Add 0008-libmultipath-eliminate-more-signed-unsigned-comparis.patch
  - Add 0009-libmultipath-set_uint-fix-parsing-for-32bit.patch
  - Add 0010-multipath-tools-Makefile-add-install-dependency.patch
    * The above 10 patches have been submitted upstream
  - Resolves: bz #1768894, #1814858, #1821214


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-2
changelog:
  - Add 0021-libmultipath-remove-_blacklist_exceptions-functions.patch
  - Add 0022-libmultipath-fix-parser-issue-with-comments-in-strin.patch
  - Add 0023-libmultipath-invert-regexes-that-start-with-exclamat.patch
    * This commit also changes the default devnode blacklist to
      blacklist all devices except scsi, dasd, and nvme.
  - Resolves: bz #1828180


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-3
changelog:
  - Add 0024-libmultipath-make-dm_get_map-status-return-codes-sym.patch
  - Add 0025-multipathd-fix-check_path-errors-with-removed-map.patch
  - Add 0026-libmultipath-make-dm_flush_maps-only-return-0-on-suc.patch
  - Add 0027-multipathd-add-del-maps-multipathd-command.patch
  - Add 0028-multipath-make-flushing-maps-work-like-other-command.patch
  - Add 0029-multipath-delegate-flushing-maps-to-multipathd.patch
  - Add 0030-multipath-add-option-to-skip-multipathd-delegation.patch
    * The above 7 patches fix bz #1845875. Multipath now attempts to
      delegate device removal to multipathd, and multipathd handles
      external device removal better.
  - Add 0031-libmultipath-fix-sysfs-dev_loss_tmo-parsing.patch
    * Fixes bz #1852843
  - Add 0032-kpartx-read-devices-with-direct-IO.patch
    * Fixes bz #1814858
  - Add 0033-kpartx-handle-alternate-bsd-disklabel-location.patch
  - Add 0034-libmultipath-fix-checker-detection-for-nvme-devices.patch
    * fixes bz #1845915
  - Add 0035-Makefile.inc-trim-extra-information-from-systemd-ver.patch
  - Add 0036-kpartx-fix-Wsign-compare-error.patch
  - Resolves: bz #1814858, #1845875, #1845915, #1852843


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-4
changelog:
  - Add 0037-libmultipath-count-pending-paths-as-active-on-loads.patch
    * make udev treat the device as having paths, so it will run kpartx
    * Fixes bz #1846866
  - Resolves: bz #1846866


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-5
changelog:
  - Add 0038-multipath-deal-with-failures-flushing-maps.patch
    * Don't print "fail" if multipath needs to failback to removing
      a device itself.
    * Fixes bz #1845875
  - Modify multipath_conf_syntax CI test
    * It started failing because "multpath -F" can now start multipathd
      via the socket, and the test expected multipathd to not be running
  - Resolves: bz #1845875


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-6
changelog:
  - Add 0039-libmultipath-factor-out-code-to-get-vpd-page-data.patch
  - Add 0040-libmultipath-limit-reading-0xc9-vpd-page.patch
    * Only check for rdac support on configured devices, or devices where
      vpd page 0x00 indicates support for vpd page 0xc9
    * Fixes bz #1877415
  - Add 0041-libmultipath-add-device-to-hwtable.c.patch
    * Add support for Fujitsu Eternus AB/HB
    * Fixes bz #1857429
  - Add 0042-libmultipath-move-fast_io_fail-defines-to-structs.h.patch
  - Add 0043-libmultipath-add-eh_deadline-multipath.conf-paramete.patch
    * Fixes bz #1819897
  - Add 0044-libmultipath-don-t-dlclose-tur-checker-DSO.patch
    * Fixes bz #1875384
  - Add 0045-libmultipath-warn-about-missing-braces-at-end-of-mul.patch
    * Fixes bz #1897530
  - Add 0046-libmultipath-ignore-multipaths-sections-without-wwid.patch
    * Fixes bz #1897815
  - Add 0047-tests-fix-missing-priority-blacklist-test.patch
  - Add 0048-mpathpersist-Fix-Register-and-Ignore-with-0x00-SARK.patch
    * Make mpathpersist Register and Ignore command clear the registration
      with a 0x0 SARK, like sg_persist does.
    * Fixes bz #1894103
  - Add 0049-mpathpersist-update-prkeys-file-on-changing-registra.patch
    * Fixes bz #1900522
    * The above 11 patches have all been submitted upstream
  - Resolves: bz #1819897, #1857429, #1875384, #1877415, #1894103, #1897530
  - Resolves: bz #1897815, #1900522


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-6
changelog:
  - Add 0050-multipathd-Fix-multipathd-stopping-on-shutdown.patch
    * Fixes bz #1892496
  - Add 0051-multipath.conf.5-Improve-checker_timeout-description.patch
    * Fixes bz #1906073
  - Resolves: bz #1892496, #1906073


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-7
changelog:
  - Add 0052-libmultipath-check-for-null-wwid-before-strcmp.patch
    * Missing part of fix for bz #1897815
  - Add 0053-libmultipath-make-find_err_path_by_dev-static.patch
  - Add 0054-multipathd-avoid-io_err_stat-crash-during-shutdown.patch
  - Add 0055-multipathd-avoid-io_err_stat-ABBA-deadlock.patch
  - Add 0056-multipathd-use-get_monotonic_time-in-io_err_stat-cod.patch
  - Add 0057-multipathd-combine-free_io_err_stat_path-and-destroy.patch
  - Add 0058-multipathd-cleanup-logging-for-marginal-paths.patch
    * The above 6 patches fix bz #1920795
  - Add 0059-libmpathpersist-fix-thread-safety-of-default-functio.patch
    * Fixes bz #1913549
  - Resolves: bz #1897815, #1913549, #1920795


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-9
changelog:
  - Add 0060-kpartx-free-loop-device-after-listing-partitions.patch
    * Fixes bz #1925490
  - Add 0061-RH-fix-find_multipaths-in-mpathconf.patch
    * Fixes bz #1921651
  - Resolves: bz #1921651, #1925490


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-10
changelog:
  - Add 0062-libmultipath-select_action-don-t-drop-map-if-alias-c.patch
    * Fall back to WWID names instead of removing existing device
  - Add 0063-libmultipath-check-if-user_friendly_name-is-in-use.patch
    * make sure to choose a user_friendly_name that isn't in use
    * Fixes bz #1923777
  - Add alias_clash CI test
  - Resolves: bz #1923777


author: Marian Csontos <mcsontos@redhat.com> - 0.7.2-1
changelog:
  - Update to latest upstream release including various bug fixes and new features.
  - Fix segfault when dump tools are given a tiny metadata file.
  - Fix -V exiting with 1.
  - Fix thin_check when running on XML dump instead of binary data.
  - Speed up free block searching.


author: Marian Csontos <mcsontos@redhat.com> - 0.7.3-1
changelog:
  - Update to latest bugfix and documentation update release.
  - *_restore tools wipe superblock as a last resort.
  - Add thin_check --override-mapping-root.


