# changelog

author: Thomas Haller <thaller@redhat.com> - 1:1.30.0-3
changelog:
  - Increase LimitNOFILE to allow more than 1024 file descriptors (rh #1926599).
    This requires a suitable libndp version that can handle many file descriptors (rh #1933041).


author: Thomas Haller <thaller@redhat.com> - 1:1.30.0-6
changelog:
  - core: fix handling local routes generated by kernel (rh #1907661)
  - initrd: fix crash with rd.znet= argument (rh #1941106)
  - core: fix crash handling path match (rh #1942741)


author: Wen Liang <wenliang@redhat.com> - 1:1.30.0-8
changelog:
  - core: fix finding active connection for controller (rh #1965337)
  - bond: support 'tlb_dynamic_lb' in 'balance-alb' mode (rh #1965948)
  - manager: delete default connection when veth removed (rh #1965336)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.30.0-11
changelog:
  - platform: preserve IPv6 multicast route added by kernel (rh #2007264)
  - cloud-setup: don't interfere with other subnets (rh #2007341)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.30.0-12
changelog:
  - initrd: set an IPv4 required-timeout of 20 seconds, to prefer IPv4
    over IPv6 for default connections (rh #1961666)


author: Thomas Haller <thaller@redhat.com> - 1:1.30.0-0.10
changelog:
  - Update to 1.30-rc1 (1.29.90-dev) (development)
  - cloud-setup: fix removing IPv4 address (rh #1920838)


author: Ian Kent <ikent@redhat.com> - 5.1.4-41
changelog:
  - bz1835547 - [RHEL8]autofs cannot mount samba/cifs shares that end with a
    dollar sign
    - fix trailing dollar sun entry expansion.
  - Resolves: rhbz#1835547


author: Ian Kent <ikent@redhat.com> - 5.1.4-42
changelog:
  - bz1841456 - automount program crashes with "malloc(): invalid next size
    (unsorted)
    - initialize struct addrinfo for getaddrinfo() calls.
    - fix quoted string length calc in expandsunent().
  -Resolves: rhbz#1841456


author: Ian Kent <ikent@redhat.com> - 5.1.4-43
changelog:
  - bz1841456 - automount program crashes with "malloc(): invalid next size
    (unsorted)
    - fix autofs mount options construction.
  -Related: rhbz#1841456


author: Ian Kent <ikent@redhat.com> - 5.1.4-44
changelog:
  - bz1858742 - autofs share doesn't mount when using nobind over RDMA where
    nfs-server and nfs-client are the same systems.
    - mount_nfs.c fix local rdma share not mounting.
  -Resolves: rhbz#1858742


author: Ian Kent <ikent@redhat.com> - 5.1.4-45
changelog:
  - bz1664561 - incorrect of start service command in autofs man page
    - fix incorrect systemctl command syntax in autofs(8).
  -Resolves: rhbz#1664561


author: Ian Kent <ikent@redhat.com> - 5.1.4-46
changelog:
  - bz1664561 - incorrect of start service command in autofs man page
    - actually apply fix patch.
  - fix dates and recent status messages in changelog.
  -Related: rhbz#1664561 rhbz#1858742


author: Ian Kent <ikent@redhat.com> - 5.1.4-47
changelog:
  - bz1887681 - automount force unlink option (-F) does not work as expected
    on autofs-5.0.7-109.el7
    - fix direct mount unlink_mount_tree() path.
    - fix unlink mounts umount order.
    - fix incorrect logical compare in unlink_mount_tree().
    - use bit flag for force unlink mounts.
    - improve force unlink mounts option description.
    - remove logpri fifo on autofs mount fail.
    - add force unlink mounts and exit option.
    - cleanup stale logpri fifo pipes on unlink and exit.
  - Resolves: rhbz#1887681


author: Ian Kent <ikent@redhat.com> - 5.1.4-48
changelog:
  - bz1892184 - autofs: return a connection failure until maps have been fetched
    - fix lookup_nss_read_master() nsswicth check return.
    - fix typo in open_sss_lib().
    - fix sss_master_map_wait timing.
    - add sss ECONREFUSED return handling.
    - use mapname in sss context for setautomntent().
    - add support for new sss autofs proto version call.
    - fix retries check in setautomntent_wait().
    - refactor sss setautomntent().
    - improve sss setautomntent() error handling.
    - refactor sss getautomntent().
    - improve sss getautomntent() error handling.
    - sss introduce calculate_retry_count() function.
    - move readall into struct master.
    - sss introduce a flag to indicate map being read.
    - update sss timeout documentation.
    - refactor sss getautomntbyname().
    - improve sss getautomntbyname() error handling.
    - use a valid timeout in lookup_prune_one_cache().
    - dont prune offset map entries.
    - simplify sss source stale check.
  - Resolves: rhbz#1892184


author: Ian Kent <ikent@redhat.com> - 5.1.4-48.el8_4.1
changelog:
  - bz1973888 - autofs: already mounted as other than autofs or failed to unlink
    entry in tree
    - fix empty mounts list return from unlink_mount_tree().
  - Resolves: rhbz#1973888


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.20-2
changelog:
  - Add manual page for dnssec-importkey-pkcs11 (#1666785)
  - Add versioned depends to all library subpackages


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.20-5
changelog:
  - Fix tsig-request verify (CVE-2020-8622)
  - Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623)
  - Correct update-policy type subdomain to match documentation (CVE-2020-8624)
  - Include available test


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.25-1
changelog:
  - Update to 9.11.25
  - Require libcap from devel package
  - Fix crash on NTA recheck failure (#1893761)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.26-2
changelog:
  - Add DNSTAP support (#1854148), new dnstap-read tool
  - Add JSON support in statistics-channel (#1899257)


author: Bob Relyea <rrelyea@redhat.com> - 2019.2.32-1
changelog:
  - Update to CKBI 2.32 from NSS 3.44
  -  Removing:
  -   # Certificate "Visa eCommerce Root"
  -   # Certificate "AC Raiz Certicamara S.A."
  -   # Certificate "ComSign CA"
  -   # Certificate "Certplus Root CA G1"
  -   # Certificate "Certplus Root CA G2"
  -   # Certificate "OpenTrust Root CA G1"
  -   # Certificate "OpenTrust Root CA G2"
  -   # Certificate "OpenTrust Root CA G3"
  -  Adding:
  -   # Certificate "GlobalSign Root CA - R6"
  -   # Certificate "OISTE WISeKey Global Root GC CA"
  -   # Certificate "GTS Root R1"
  -   # Certificate "GTS Root R2"
  -   # Certificate "GTS Root R3"
  -   # Certificate "GTS Root R4"
  -   # Certificate "UCA Global G2 Root"
  -   # Certificate "UCA Extended Validation Root"
  -   # Certificate "Certigna Root CA"
  -   # Certificate "emSign Root CA - G1"
  -   # Certificate "emSign ECC Root CA - G3"
  -   # Certificate "emSign Root CA - C1"
  -   # Certificate "emSign ECC Root CA - C3"
  -   # Certificate "Hongkong Post Root CA 3"


author: Bob Relyea <rrelyea@redhat.com> - 2020.2.41-81
changelog:
  - Update to CKBI 2.41 from NSS 3.53.0
  -    Removing:
  -     # Certificate "AddTrust Low-Value Services Root"
  -     # Certificate "AddTrust External Root"
  -     # Certificate "UTN USERFirst Email Root CA"
  -     # Certificate "Certplus Class 2 Primary CA"
  -     # Certificate "Deutsche Telekom Root CA 2"
  -     # Certificate "Staat der Nederlanden Root CA - G2"
  -     # Certificate "Swisscom Root CA 2"
  -     # Certificate "Certinomis - Root CA"
  -    Adding:
  -     # Certificate "Entrust Root Certification Authority - G4"


author: Bob Relyea <rrelyea@redhat.com> - 2021.2.48-80.0
changelog:
  - Update to CKBI 2.48 from NSS 3.66
  -    Removing:
  -     # Certificate "Verisign Class 3 Public Primary Certification Authority - G3"
  -     # Certificate "GeoTrust Global CA"
  -     # Certificate "GeoTrust Universal CA"
  -     # Certificate "GeoTrust Universal CA 2"
  -     # Certificate "QuoVadis Root CA"
  -     # Certificate "Sonera Class 2 Root CA"
  -     # Certificate "Taiwan GRCA"
  -     # Certificate "GeoTrust Primary Certification Authority"
  -     # Certificate "thawte Primary Root CA"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G5"
  -     # Certificate "GeoTrust Primary Certification Authority - G3"
  -     # Certificate "thawte Primary Root CA - G2"
  -     # Certificate "thawte Primary Root CA - G3"
  -     # Certificate "GeoTrust Primary Certification Authority - G2"
  -     # Certificate "VeriSign Universal Root Certification Authority"
  -     # Certificate "VeriSign Class 3 Public Primary Certification Authority - G4"
  -     # Certificate "Trustis FPS Root CA"
  -     # Certificate "EE Certification Centre Root CA"
  -     # Certificate "LuxTrust Global Root 2"
  -     # Certificate "Symantec Class 1 Public Primary Certification Authority - G4"
  -     # Certificate "Symantec Class 2 Public Primary Certification Authority - G4"
  -    Adding:
  -     # Certificate "Microsoft ECC Root Certificate Authority 2017"
  -     # Certificate "Microsoft RSA Root Certificate Authority 2017"
  -     # Certificate "e-Szigno Root CA 2017"
  -     # Certificate "certSIGN Root CA G2"
  -     # Certificate "Trustwave Global Certification Authority"
  -     # Certificate "Trustwave Global ECC P256 Certification Authority"
  -     # Certificate "Trustwave Global ECC P384 Certification Authority"
  -     # Certificate "NAVER Global Root Certification Authority"
  -     # Certificate "AC RAIZ FNMT-RCM SERVIDORES SEGUROS"
  -     # Certificate "GlobalSign Secure Mail Root R45"
  -     # Certificate "GlobalSign Secure Mail Root E45"
  -     # Certificate "GlobalSign Root R46"
  -     # Certificate "GlobalSign Root E46"
  -     # Certificate "GLOBALTRUST 2020"
  -     # Certificate "ANF Secure Server Root CA"
  -     # Certificate "Certum EC-384 CA"
  -     # Certificate "Certum Trusted Root CA"


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-10
changelog:
  - fix SMTP end-of-response out-of-bounds read (CVE-2019-3823)
  - fix NTLMv2 type-3 header stack buffer overflow (CVE-2019-3822)
  - fix NTLM type-2 out-of-bounds buffer read (CVE-2018-16890)
  - xattr: strip credentials from any URL that is stored (CVE-2018-20483)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-12
changelog:
  - double free due to subsequent call of realloc() (CVE-2019-5481)
  - fix heap buffer overflow in function tftp_receive_packet() (CVE-2019-5482)
  - fix TFTP receive buffer overflow (CVE-2019-5436)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-15
changelog:
  - do not crash when HTTPS_PROXY and NO_PROXY are used together (#1873327)
  - libcurl: wrong connect-only connection (CVE-2020-8231)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-18
changelog:
  - http: send payload when (proxy) authentication is done (#1918692)
  - curl: Inferior OCSP verification (CVE-2020-8286)
  - libcurl: FTP wildcard stack overflow (CVE-2020-8285)
  - curl: trusting FTP PASV responses (CVE-2020-8284)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-18.el8_4.1
changelog:
  - fix bad connection reuse due to flawed path name checks (CVE-2021-22924)
  - disable metalink support to fix the following vulnerabilities
      CVE-2021-22923 - metalink download sends credentials
      CVE-2021-22922 - wrong content via metalink not discarded


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-18.el8_4.2
changelog:
  - fix STARTTLS protocol injection via MITM (CVE-2021-22947)
  - fix protocol downgrade required TLS bypass (CVE-2021-22946)


author: Eric Garver <egarver@redhat.com> - 0.8.2-2
changelog:
  - fix(cli): add ipset type hash:mac is incompatible with the family parameter
  - fix(cli): add --zone is an invalid option with --direct
  - fix: update dynamic DCE RPC ports in freeipa-trust service
  - fix: core: rich: Catch ValueError on non-numeric priority values
  - fix(rich): icmptypes with one family
  - fix(direct): rule in a zone chain
  - plus additional upstream stable fixes


author: Eric Garver <egarver@redhat.com> - 0.8.2-3
changelog:
  - fix(nftables): packet marks with masks
  - fix(nftables): icmp types with code == 0
  - fix(rich icmptype): verify rule and icmptype families
  - fix(zone): cache rule_str for rich rules
  - improvement(service): IPsec: Update description and add TCP port 4500
  - feat(service): add collectd service
  - feat(service): Add rpc-rquotad.service


author: Richard Hughes <richard@hughsie.com> 1.4.2-1
changelog:
  - New upstream release
  - Backport a patch to fix the synaptics fingerprint reader update.
  - Resolves: #1775277


author: Richard Hughes <richard@hughsie.com> 1.5.4-1
changelog:
  - Rebase package to include support for latest OEM hardware and to
    support deploying UEFI SecureBoot dbx updates.
  - Resolves: #1870811


author: Richard Hughes <richard@hughsie.com> 1.5.5-2
changelog:
  - Do not invalidate all remote timestamps during package install to fix rpm -V.
  - Backport some important high priority fixes from upstream.
  - Resolves: #1926382


author: Richard Hughes <richard@hughsie.com> 1.5.9-1
changelog:
  - Rebase to include the SBAT metadata section to allow fixing BootHole
  - Resolves: rhbz#1933010
  - Resolves: rhbz#1932951
  - Resolves: rhbz#1932907
  - Resolves: rhbz#1932880
  - Resolves: rhbz#1932578
  - Resolves: rhbz#1932552
  - Resolves: rhbz#1932422


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.56.4-9
changelog:
  - Update GHmac patch to implement g_hmac_copy()
    Resolves: #1786538
  - Update keyfile settings backend
    Resolves: #1728896
  - Fix CVE-2019-13012
    Resolves: #1728632


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.56.4-10
changelog:
  - Fix various problems in GMainContext
    Resolves: #1953553
  - Fix CVE-2021-27219
    Resolves: #1960600


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-91
changelog:
  - Fix tps-rpmtest failing due /boot/grub2/grubenv attributes mismatch
    Resolves: rhbz#1813959
  - Include in EFI build the modules needed for LUKS support
    Resolves: rhbz#1873725
  - Fix keyboards that report IBM PC AT scan codes
    Resolves: rhbz#1897587


author: Jan Hlavac <jhlavac@redhat.com> - 2.02-92
changelog:
  - grub2-install: disable support for EFI platforms
    Resolves: rhbz#1737444
  - Include a few more modules to EFI build needed for LUKS support (javierm)
    Related: rhbz#1873725


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-93
changelog:
  - add keylayouts and at_keyboard modules to UEFI Grub2 (rmetrich)
    Related: rhbz#1897587
  - at_keyboard: use set 1 when keyboard is in Translate mode (rmetrich)
    Resolves: rhbz#1897587
  - add GRUB enhanced debugging features (rmetrich)
    Resolves: rhbz#1776249
  - ieee1275: Avoiding many unecessary open/close (diegodo)
    Resolves: rhbz#1862632
  - ieee1275: device mapper and fibre channel discovery support (diegodo)
    Resolves: rhbz#1873724


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-96
changelog:
  - Fix "Add 'at_keyboard_fallback_set' var to force the set manually"
    Related: rhbz#1897587
  - Fix a boot failure due patch "ieee1275: claim up to 256MB memory"
    Resolves: rhbz#1929111


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-98
changelog:
  - Fix another batch of CVEs
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-99
changelog:
  - Fix bug of grub2-install not checking for the SBAT option
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Phil Sutter <psutter@redhat.com> - 1.8.4-11
changelog:
  - Complete ebtables-nft among match support
  - Replace RHEL-only xtables-monitor fix with upstream solution
  - xtables: Align effect of -4/-6 options with legacy
  - xtables: Drop -4 and -6 support from xtables-{save,restore}
  - Review systemd unit files


author: Phil Sutter <psutter@redhat.com> - 1.8.4-16
changelog:
  - tests/shell: Add test for bitwise avoidance fixes
  - ebtables: Optimize masked MAC address matches
  - nft: Optimize class-based IP prefix matches
  - nft: Fix for broken address mask match detection
  - nft: cache: Make nft_rebuild_cache() respect fake cache
  - tests: shell: Improve concurrent noflush restore test a bit
  - nft: Fix for concurrent noflush restore calls
  - nft: Fix error reporting for refreshed transactions
  - nft: Make batch_add_chain() return the added batch object


author: Phil Sutter <psutter@redhat.com> - 1.8.4-17
changelog:
  - extensions: dccp: Fix for DCCP type 'INVALID'
  - tests: shell: Merge and extend return codes test
  - nft: Fix command name in ip6tables error message
  - extensions: libxt_CT: add translation for NOTRACK
  - extensions: libipt_icmp: Fix translation of type 'any'
  - tests/shell: Test for fixed extension registration
  - libxtables: Register multiple extensions in ascending order
  - libxtables: Simplify pending extension registration
  - libxtables: Make sure extensions register in revision order


author: Kairui Song <kasong@redhat.com> 2:1.4.0-2
changelog:
  - Fix several memleak problems found by covscan (bz1606969)
  - Fix an possible overflow error (bz1606969)
  - Don't leak socket fd on connection error (bz1606969)
  - Check xen-dyn-event more flexible (bz1576164)


author: Kairui Song <kasong@redhat.com> 2:1.4.0-3
changelog:
  - Update document and remove dead options to fix manpage scan warning (bz1612706)
  - Fix gating test error (bz1680619)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.2.1.el8_4]
changelog:
  - net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP (Alaa Hleihel) [1952061 1936742]
  - net/mlx5e: Reject tc rules which redirect from a VF to itself (Alaa Hleihel) [1952065 1932839]
  - net/mlx5: CT: Add support for matching on ct_state inv and rel flags (Alaa Hleihel) [1952062 1942681]
  - KVM: VMX: Don't use vcpu->run->internal.ndata as an array index (Jon Maloy) [1954221 1954219]
  - tools/power turbostat: Revert "[tools] tools/power turbostat: Enable accumulate RAPL display" (Prarit Bhargava) [1952987 1944699]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.3.1.el8_4]
changelog:
  - Revert "uio: use request_threaded_irq instead" (Vitaly Kuznetsov) [1952952 1946644]
  - drm/ast: Set format registers in primary plane's update (Lyude Paul) [1952900 1923857]
  - net/sched: act_ct: clear post_ct if doing ct_clear (Marcelo Ricardo Leitner) [1956458 1941889]
  - md/raid1: properly indicate failure when ending a failed write request (Nigel Croxon) [1955188 1954588]
  - nitro_enclaves: Fix stale file descriptors on failed usercopy (Vitaly Kuznetsov) [1956379 1953717]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.5.1.el8_4]
changelog:
  - gfs2: report "already frozen/thawed" errors (Bob Peterson) [1961849 1932236]
  - gfs2: move freeze glock outside the make_fs_rw and _ro functions (Bob Peterson) [1961849 1932236]
  - gfs2: Add common helper for holding and releasing the freeze glock (Bob Peterson) [1961849 1932236]
  - gfs2: in signal_our_withdraw wait for unfreeze of _this_ fs only (Bob Peterson) [1961849 1932236]
  - gfs2: Don't freeze the file system during unmount (Bob Peterson) [1961849 1932236]
  - gfs2: Fix regression in freeze_go_sync (Bob Peterson) [1961849 1932236]
  - gfs2: The freeze glock should never be frozen (Bob Peterson) [1961849 1932236]
  - gfs2: When freezing gfs2, use GL_EXACT and not GL_NOCACHE (Bob Peterson) [1961849 1932236]
  - gfs2: read-only mounts should grab the sd_freeze_gl glock (Bob Peterson) [1961849 1932236]
  - gfs2: freeze should work on read-only mounts (Bob Peterson) [1961849 1932236]
  - gfs2: Abort gfs2_freeze if io error is seen (Bob Peterson) [1961849 1932236]
  - CI: Disable result checking for realtime check (Veronika Kabatova)
  - CI: Explicitly disable result checking for private CI (Veronika Kabatova)
  - CI: Rename variable (Veronika Kabatova)
  - CI: Update builder containers (Veronika Kabatova)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.6.1.el8_4]
changelog:
  - openvswitch: fix stack OOB read while fragmenting IPv4 packets (Davide Caratti) [1963940 1924608]
  - net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets (Davide Caratti) [1963940 1924608]
  - net/sched: act_ct: fix wild memory access when clearing fragments (Davide Caratti) [1963940 1924608]
  - net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT (Ivan Vecera)
  - redhat/configs: Add CONFIG_SYSTEM_REVOCATION_KEYS and CONFIG_SYSTEM_REVOCATION_LIST (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: add 'x509_revocation_list' to gitignore (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - integrity: Load mokx variables into the blacklist keyring (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: Add ability to preload revocation certs (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: Move load_system_certificate_list to a common function (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: Add EFI_CERT_X509_GUID support for dbx entries (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - net/sched: cls_api: increase max_reclassify_loop (Davide Caratti) [1965148 1955136]
  - dm writecache: fix performance degradation in ssd mode (Mike Snitzer) [1962241 1961859]
  - scsi: fnic: Use scsi_host_busy_iter() to traverse commands (Ewan D. Milne) [1961705 1949250]
  - scsi: fnic: Kill 'exclude_id' argument to fnic_cleanup_io() (Ewan D. Milne) [1961705 1949250]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.7.1.el8_4]
changelog:
  - net: zero-initialize tc skb extension on allocation (Ivan Vecera) [1965457 1946986]
  - net/sched: cls_flower: fix only mask bit check in the validate_ct_state (Ivan Vecera) [1965457 1946986]
  - net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb (Ivan Vecera) [1965457 1946986]
  - net/sched: act_api: fix miss set post_ct for ovs after do conntrack in act_ct (Ivan Vecera) [1965457 1946986]
  - net/sched: cls_flower: validate ct_state for invalid and reply flags (Ivan Vecera) [1965457 1946986]
  - flow_dissector: fix TTL and TOS dissection on IPv4 fragments (Paolo Abeni) [1963952 1950288]
  - Revert "sctp: Fix SHUTDOWN CTSN Ack in the peer restart case" (Xin Long) [1965632 1953839]
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_b (Xin Long) [1965632 1953839]
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_a (Xin Long) [1965632 1953839]
  - Bluetooth: verify AMP hci_chan before amp_destroy (Gopal Tiwari) [1962544 1962546] {CVE-2021-33034}
  - x86/kvm: Unify kvm_pv_guest_cpu_reboot() with kvm_guest_cpu_offline() (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Disable all PV features on crash (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Disable kvmclock on all CPUs on shutdown (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Teardown PV features on boot CPU as well (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Fix pr_info() for async PF setup/teardown (Lenny Szubowicz) [1964930 1934273]
  - net/sched: act_ct: Fix ct template allocation for zone 0 (Marcelo Ricardo Leitner) [1965150 1881824]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.8.1.el8_4]
changelog:
  - iavf: amend removal of MODULE_VERSION (Stefan Assmann) [1969925 1955738]
  - ixgbe: Amend commit acf03026ec5a to include a version string in module info. (Ken Cox) [1969922 1955759]
  - i40e: amend removal of MODULE_VERSION (Stefan Assmann) [1969923 1955736]
  - redhat/configs: Add CONFIG_PINCTRL_EMMITSBURG (David Arcari) [1963984 1959506]
  - redhat/configs: Remove CONFIG_EMMITSBURG (David Arcari) [1963984 1959506]
  - netlink: add tracepoint at NL_SET_ERR_MSG (Marcelo Ricardo Leitner) [1972938 1956983]
  - Revert "[netdrv] net/intel: remove driver versions from Intel drivers" (Jonathan Toppins) [1969917 1955745]
  - Amends commit ea6244cc248b to include a version string in module info. (Ken Cox) [1969915 1955726]
  - Revert "[netdrv] net/broadcom: Clean broadcom code from driver versions" (Jonathan Toppins) [1969914 1955721]
  - ena: revert removal of MODULE_VERSION from ena (Petr Oros) [1969913 1955712]
  - fm10k: amend removal of MODULE_VERSION (Vladis Dronov) [1969910 1955730]
  - net/sched: act_ct: Offload connections with commit action (Marcelo Ricardo Leitner) [1968679 1965817]
  - netfilter: flowtable: Remove redundant hw refresh bit (Marcelo Ricardo Leitner) [1968679 1965817]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.9.1.el8_4]
changelog:
  - ixgbevf: Amend commit acf03026ec5a to include a version in module info. (Ken Cox) [1969911 1955764]
  - CI: Merge configuration (Veronika Kabatova)
  - igc: amend removal of MODULE_VERSION (Corinna Vinschen) [1969921 1955755]
  - igb: amend removal of MODULE_VERSION (Corinna Vinschen) [1969919 1955748]
  - locking/qrwlock: Fix ordering in queued_write_lock_slowpath() (Waiman Long) [1964419 1950110]
  - scsi: qedf: Do not put host in qedf_vport_create() unconditionally (Nilesh Javali) [1974968 1899384]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.10.1.el8_4]
changelog:
  - igbvf: amend removal of MODULE_VERSION (Corinna Vinschen) [1969920 1955752]
  - bluetooth: eliminate the potential race condition when removing the HCI controller (Gopal Tiwari) [1971464 1971488] {CVE-2021-32399}
  - scsi: ibmvfc: Free channel_setup_buf during device tear down (Steve Best) [1964697 1938102]
  - i40e: Fix parameters in aq_get_phy_register() (Stefan Assmann) [1967099 1907852]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.10.2.el8_4]
changelog:
  - seq_file: Disallow extremely large seq buffer allocations (Ian Kent) [1975181 1975182] {CVE-2021-33909}


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.11.1.el8_4]
changelog:
  - SUNRPC: Handle major timeout in xprt_adjust_timeout() (Scott Mayhew) [1980613 1979070]
  - net/mlx5e: Disable TLS device offload in kdump mode (Alaa Hleihel) [1969909 1946647]
  - net/mlx5e: Disable TX MPWQE in kdump mode (Alaa Hleihel) [1969909 1946647]
  - drm/i915: Add an encoder hook to sanitize its state during init/resume (Imre Deak) [1981250 1961122]
  - netfilter: x_tables: fix compat match/target pad out-of-bound write (Florian Westphal) [1980500 1980501] {CVE-2021-22555}
  - Bluetooth: btusb: Fix the autosuspend enable and disable (Gopal Tiwari) [1972564 1927375]
  - cifs: handle empty list of targets in cifs_reconnect() (Ronnie Sahlberg) [1973637 1952263]
  - tick/nohz: Update idle_exittime on actual idle exit (Phil Auld) [1978710 1962632]
  - tick/nohz: Remove superflous check for CONFIG_VIRT_CPU_ACCOUNTING_NATIVE (Phil Auld) [1978710 1962632]
  - tick/nohz: Conditionally restart tick on idle exit (Phil Auld) [1978710 1962632]
  - can: bcm: delay release of struct bcm_op after synchronize_rcu() (Hangbin Liu) [1975058 1975059]
  - redhat/configs: Re-enable dptf_power module (Prarit Bhargava) [1968381 1962349]
  - KVM: do not allow mapping valid but non-reference-counted pages (Jon Maloy) [1975514 1975515] {CVE-2021-22543}
  - seq_file: Disallow extremely large seq buffer allocations (Ian Kent) [1975181 1975182] {CVE-2021-33909}


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.12.1.el8_4]
changelog:
  - Revert "nvme-pci: remove last_sq_tail" (Gopal Tiwari) [1965415 1921591]
  - tc-testing: add test for ct DNAT tuple collision (Marcelo Ricardo Leitner) [1982494 1964578]
  - tc-testing: add support for sending various scapy packets (Marcelo Ricardo Leitner) [1982494 1964578]
  - tc-testing: fix list handling (Marcelo Ricardo Leitner) [1982494 1964578]
  - net/sched: act_ct: handle DNAT tuple collision (Marcelo Ricardo Leitner) [1982494 1964578]
  - mm/memcg: Relocate tcpmem to below memory in struct mem_cgroup (Waiman Long) [1980314 1959772]
  - mm/memcg: optimize user context object stock access (Waiman Long) [1980314 1959772]
  - mm/memcg: improve refill_obj_stock() performance (Waiman Long) [1980314 1959772]
  - mm/memcg: cache vmstat data in percpu memcg_stock_pcp (Waiman Long) [1980314 1959772]
  - mm/memcg: move mod_objcg_state() to memcontrol.c (Waiman Long) [1980314 1959772]
  - mm: memcontrol: use obj_cgroup APIs to charge kmem pages (Waiman Long) [1980314 1959772]
  - mm: memcontrol: change ug->dummy_page only if memcg changed (Waiman Long) [1980314 1959772]
  - mm: memcontrol: directly access page->memcg_data in mm/page_alloc.c (Waiman Long) [1980314 1959772]
  - mm: memcontrol: introduce obj_cgroup_{un}charge_pages (Waiman Long) [1980314 1959772]
  - mm: memcontrol: slab: fix obtain a reference to a freeing memcg (Waiman Long) [1980314 1959772]
  - mm: move lruvec stats update functions to vmstat.h (Waiman Long) [1980314 1959772]
  - mm: memcg/slab: rename *_lruvec_slab_state to *_lruvec_kmem_state (Waiman Long) [1980314 1959772]
  - mm: Convert page kmemcg type to a page memcg flag (Waiman Long) [1980314 1959772]
  - mm: Introduce page memcg flags (Waiman Long) [1980314 1959772]
  - mm: memcontrol/slab: Use helpers to access slab page's memcg_data (Waiman Long) [1980314 1959772]
  - mm: memcontrol: Use helpers to read page's memcg data (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: extract check_[new|free]_page_bad() common part to page_bad_reason() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: rename free_pages_check() to check_free_page() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: rename free_pages_check_bad() to check_free_page_bad() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: bad_flags is not necessary for bad_page() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: bad_[reason|flags] is not necessary when PageHWPoison (Waiman Long) [1980314 1959772]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.13.1.el8_4]
changelog:
  - xfrm: Fix wraparound in xfrm_policy_addr_delta() (Sabrina Dubroca) [1981840 1951965]
  - VMCI: Release resource if the work is already queued (Cathy Avery) [1982042 1978518]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.14.1.el8_4]
changelog:
  - tick/nohz: Kick only _queued_ task whose tick dependency is updated (Waiman Long) [1981336 1922901]
  - tick/nohz: Change signal tick dependency to wake up CPUs of member tasks (Waiman Long) [1981336 1922901]
  - tick/nohz: Only wake up a single target cpu when kicking a task (Waiman Long) [1981336 1922901]
  - tick/nohz: Narrow down noise while setting current task's tick dependency (Waiman Long) [1981336 1922901]
  - mlx5: net: zero-initialize tc skb extension on allocation (Jan Stancek) [1982220 1965418]
  - scsi: qedf: Update the max_id value in host structure (Nilesh Javali) [1989097 1954876]
  - scsi: qla2xxx: Reserve extra IRQ vectors (Nilesh Javali) [1986156 1964834]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.15.1.el8_4]
changelog:
  - sched: Fix data-race in wakeup (Phil Auld) [1987296 1937103]
  - mm/page_alloc: bail out on fatal signal during reclaim/compaction retry attempt (Aaron Tomlin) [1984085 1919765]
  - sunrpc: Avoid a KASAN slab-out-of-bounds bug in xdr_set_page_base() (Benjamin Coddington) [1990404 1969751]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.16.1.el8_4]
changelog:
  - kernfs: dont call d_splice_alias() under kernfs node lock (Ian Kent) [1994879 1939133]
  - kernfs: use i_lock to protect concurrent inode updates (Ian Kent) [1994879 1939133]
  - kernfs: switch kernfs to use an rwsem (Ian Kent) [1994879 1939133]
  - kernfs: use VFS negative dentry caching (Ian Kent) [1994879 1939133]
  - kernfs: add a revision to identify directory node changes (Ian Kent) [1994879 1939133]
  - kernfs: move revalidate to be near lookup (Ian Kent) [1994879 1939133]
  - scsi: lpfc: Fix dropped FLOGI during pt2pt discovery recovery (Jan Stancek) [1948608 1923762]
  - net: sched: act_mirred: Reset ct info when mirror/redirect skb (C. Erastus Toe) [1992226 1980532]
  - usb: ehci: Prevent missed ehci interrupts with edge-triggered MSI (Torez Smith) [1993894 1972139]
  - usb: ehci: do not initialise static variables (Torez Smith) [1993894 1972139]
  - usb: host: move EH SINGLE_STEP_SET_FEATURE implementation to core (Torez Smith) [1993894 1972139]
  - USB: ehci: drop workaround for forced irq threading (Torez Smith) [1993894 1972139]
  - usb: ehci: add spurious flag to disable overcurrent checking (Torez Smith) [1993894 1972139]
  - NFS: Only change the cookie verifier if the directory page cache is empty (Benjamin Coddington) [1993895 1982825]
  - NFS: Fix handling of cookie verifier in uncached_readdir() (Benjamin Coddington) [1993895 1982825]
  - nfs: Subsequent READDIR calls should carry non-zero cookieverifier (Benjamin Coddington) [1993895 1982825]
  - KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow (Jon Maloy) [1988225 1988226] {CVE-2021-37576}


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.17.1.el8_4]
changelog:
  - ucounts: Move max_time_namespace according to ucount_type (Alex Gladkov) [1998002 1982954]
  - netfilter: conntrack: remove offload_pickup sysctl again (Florian Westphal) [1995555 1987101]
  - netfilter: flowtable: Set offload timeouts according to proto values (Phil Sutter) [1995554 1979184]
  - netfilter: conntrack: Introduce udp offload timeout configuration (Phil Sutter) [1995554 1979184]
  - netfilter: conntrack: Introduce tcp offload timeout configuration (Phil Sutter) [1995554 1979184]
  - powerpc/64s: Fix crashes when toggling stf barrier (Desnes A. Nunes do Rosario) [1989174 1964484]
  - iavf: fix locking of critical sections (Stefan Assmann) [1997534 1975245]
  - iavf: do not override the adapter state in the watchdog task (Stefan Assmann) [1997534 1975245]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.18.1.el8_4]
changelog:
  - mfd: intel-lpss: Use devm_ioremap_uc for MMIO (Steve Best) [1989560 1986715]
  - lib: devres: add a helper function for ioremap_uc (Steve Best) [1989560 1986715]
  - ceph: fix test for whether we can skip read when writing beyond EOF (Jeff Layton) [1996680 1971101]
  - arm64: memory: Add missing brackets to untagged_addr() macro (Chris von Recklinghausen) [1997998 1955809]
  - arm64: tags: Preserve tags for addresses translated via TTBR1 (Chris von Recklinghausen) [1997998 1955809]
  - arm64: entry: Move ct_user_exit before any other exception (Chris von Recklinghausen) [1997998 1955809]
  - arm64: memory: Implement __tag_set() as common function (Chris von Recklinghausen) [1997998 1955809]
  - arm64: mm: Really fix sparse warning in untagged_addr() (Chris von Recklinghausen) [1997998 1955809]
  - arm64: untag user pointers in access_ok and __uaccess_mask_ptr (Chris von Recklinghausen) [1997998 1955809]
  - arm64/mm: fix variable 'tag' set but not used (Chris von Recklinghausen) [1997998 1955809]
  - arm64: entry: SP Alignment Fault doesn't write to FAR_EL1 (Chris von Recklinghausen) [1997998 1955809]
  - arm64: compat: Add separate CP15 trapping hook (Chris von Recklinghausen) [1997998 1955809]
  - arm64: don't restore GPRs when context tracking (Chris von Recklinghausen) [1997998 1955809]
  - KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656) (Jon Maloy) [1985429 1985430] {CVE-2021-3656}
  - KVM: SVM: add module param to control the #SMI interception (Jon Maloy) [1985429 1985430] {CVE-2021-3656}
  - tty: Don't hold ldisc lock in tty_reopen() if ldisc present (Waiman Long) [1997999 1968271]
  - tty/ldsem: Add lockdep asserts for ldisc_sem (Waiman Long) [1997999 1968271]
  - tty: Simplify tty->count math in tty_reopen() (Waiman Long) [1997999 1968271]
  - tty: Don't block on IO when ldisc change is pending (Waiman Long) [1997999 1968271]
  - tty: Hold tty_ldisc_lock() during tty_reopen() (Waiman Long) [1997999 1968271]
  - tty: Drop tty->count on tty_reopen() failure (Waiman Long) [1997999 1968271]
  - [s390] s390/vtime: fix increased steal time accounting (Claudio Imbrenda) [1988386 1963075]
  - XArray: Fix splitting to non-zero orders (Chris von Recklinghausen) [1997997 1946304]
  - XArray: Fix split documentation (Chris von Recklinghausen) [1997997 1946304]
  - ima: extend boot_aggregate with kernel measurements (Bruno Meneguele) [1997766 1977422]
  - ceph: reduce contention in ceph_check_delayed_caps() (Jeff Layton) [1995862 1953430]
  - ice: Stop processing VF messages during teardown (Ken Cox) [1997538 1986451]
  - iavf: Set RSS LUT and key in reset handle path (Ken Cox) [1997536 1910853]
  - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) (Jon Maloy) [1985412 1985413] {CVE-2021-3653}
  - scsi: ibmvfc: Fix potential race in ibmvfc_wait_for_ops() (Steve Best) [1969792 1941180]
  - [s390] s390/dasd: add missing discipline function (Claudio Imbrenda) [1995206 1981804]
  - serial_core: switch to ->[sg]et_serial() (Artem Savkov) [1993872 1952415]
  - net/mlx5e: Fix mapping of ct_label zero (Jan Stancek) [1983681 1915308]
  - drm/qxl: add lock asserts to qxl_bo_vmap_locked + qxl_bo_vunmap_locked (Lyude Paul) [1992839 1907341]
  - drm/qxl: rework cursor plane (Lyude Paul) [1992839 1907341]
  - drm/qxl: move shadow handling to new qxl_prepare_shadow() (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix monitors object vmap (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix prime vmap (Lyude Paul) [1992839 1907341]
  - drm/qxl: rename qxl_bo_kmap -> qxl_bo_vmap_locked (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix lockdep issue in qxl_alloc_release_reserved (Lyude Paul) [1992839 1907341]
  - drm/qxl: use ttm bo priorities (Lyude Paul) [1992839 1907341]
  - drm/qxl: more fence wait rework (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly handle device init failures (Lyude Paul) [1992839 1907341]
  - drm/qxl: allocate dumb buffers in ram (Lyude Paul) [1992839 1907341]
  - drm/qxl: simplify qxl_fence_wait (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly free qxl releases (Lyude Paul) [1992839 1907341]
  - drm/qxl: handle shadow in primary destroy (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly pin/unpin shadow (Lyude Paul) [1992839 1907341]
  - drm/qxl: release shadow on shutdown (Lyude Paul) [1992839 1907341]
  - drm/qxl: unpin release objects (Lyude Paul) [1992839 1907341]
  - drm/qxl: use drmm_mode_config_init (Lyude Paul) [1992839 1907341]
  - qxl/ttm: drop the unusued no wait flag to reserve function (Lyude Paul) [1992839 1907341]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.19.1.el8_4]
changelog:
  - libceph: allow addrvecs with a single NONE/blank address (Jeff Layton) [1996682 1972278]
  - ice: Only lock to update netdev dev_addr (Michal Schmidt) [2000129 1995868]
  - ice: don't remove netdev->dev_addr from uc sync list (Ken Cox) [2000130 1961018]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.20.1.el8_4]
changelog:
  - net/mlx5: E-Switch, Allow setting GUID for host PF vport (Alaa Hleihel) [1986837 1967488]
  - net/mlx5: E-Switch, Read PF mac address (Alaa Hleihel) [1986837 1967488]
  - ice: fix Tx queue iteration for Tx timestamp enablement (Ken Cox) [2000128 1999743]
  - ice: restart periodic outputs around time changes (Ken Cox) [1997572 1992750]
  - ice: Fix perout start time rounding (Ken Cox) [1997572 1992750]
  - ice: add support for auxiliary input/output pins (Jonathan Toppins) [1998221 1956913]
  - ice: enable transmit timestamps for E810 devices (Jonathan Toppins) [1998220 1944818]
  - ice: enable receive hardware timestamping (Jonathan Toppins) [1998220 1944818]
  - ice: report the PTP clock index in ethtool .get_ts_info (Jonathan Toppins) [1998220 1944818]
  - ice: register 1588 PTP clock device object for E810 devices (Jonathan Toppins) [1998220 1944818]
  - ice: add low level PTP clock access functions (Jonathan Toppins) [1998220 1944818]
  - ice: add support for set/get of driver-stored firmware parameters (Jonathan Toppins) [1998220 1944818]
  - ice: process 1588 PTP capabilities during initialization (Jonathan Toppins) [1998220 1944818]
  - ice: add support for sideband messages (Jonathan Toppins) [1998220 1944818]
  - ice: Prevent probing virtual functions (Ken Cox) [1997539 1952810]
  - vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU (Gustavo Walbon) [2000602 1891589]
  - powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU (Gustavo Walbon) [2000602 1891589]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.21.1.el8_4]
changelog:
  - HID: make arrays usage and value to be the same (Benjamin Tissoires) [1974941 1974942] {CVE-2021-0512}
  - y2038: remove CONFIG_64BIT_TIME (Waiman Long) [2003569 1965360]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.22.1.el8_4]
changelog:
  - [s390] s390/ap: Fix hanging ioctl caused by wrong msg counter (Claudio Imbrenda) [2002635 1984762]
  - cpuidle: pseries: Do not cap the CEDE0 latency in fixup_cede0_latency() (Diego Domingos) [1997431 1952809]
  - cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards (Diego Domingos) [1997431 1952809]
  - EDAC/amd64: Fix PCI component registration (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId (Aristeu Rozanski) [1982182 1918583]
  - x86/CPU/AMD: Remove amd_get_nb_id() (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Make fam_ops static global (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Allow Reserved types to be overwritten in smca_banks[] (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure() (Aristeu Rozanski) [1982182 1918583]
  - EDAC/amd64: Get rid of the ECC disabled long message (Aristeu Rozanski) [1982182 1918583]
  - EDAC/amd64: Check for memory before fully initializing an instance (Aristeu Rozanski) [1982182 1918583]
  - EDAC/amd64: Use cached data when checking for ECC (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE: Make the number of MCA banks a per-CPU variable (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Don't cache block addresses on SMCA systems (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE: Make mce_banks a per-CPU array (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE: Make struct mce_banks[] static (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Don't report L1 BTB MCA errors on some family 17h models (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Decode MCA_STATUS in bit definition order (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Decode MCA_STATUS[Scrub] bit (Aristeu Rozanski) [1982182 1918583]
  - EDAC, mce_amd: Match error descriptions to latest documentation (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Carve out the MC4_MISC thresholding quirk (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models (Aristeu Rozanski) [1982182 1918583]
  - net: Fix skb->csum update in inet_proto_csum_replace16(). (Balazs Nemeth) [2005980 1975193]
  - RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy (Kamal Heib) [1982040 1931846] {CVE-2020-36385}
  - RDMA/ucma: Fix locking for ctx->events_reported (Kamal Heib) [1982040 1931846] {CVE-2020-36385}
  - RDMA/ucma: Fix the locking of ctx->file (Kamal Heib) [1982040 1931846] {CVE-2020-36385}
  - RDMA/cma: Add missing locking to rdma_accept() (Kamal Heib) [1982040 1931846] {CVE-2020-36385}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.23.1.el8_4]
changelog:
  - CI: handle RT branches in a single config (Veronika Kabatova)
  - CI: Drop private CI config (Veronika Kabatova)
  - CI: extend template use (Veronika Kabatova)
  - xfs: drop unnecessary setfilesize helper (Brian Foster) [2007413 1942348]
  - xfs: drop unused ioend private merge and setfilesize code (Brian Foster) [2007413 1942348]
  - xfs: open code ioend needs workqueue helper (Brian Foster) [2007413 1942348]
  - xfs: drop submit side trans alloc for append ioends (Brian Foster) [2007413 1942348]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.24.1.el8_4]
changelog:
  - lockd: Fix invalid lockowner cast after vfs_test_lock (Benjamin Coddington) [2010820 1986138]
  - e1000e: Do not take care about recovery NVM checksum (Ken Cox) [2002335 1984558]
  - xfs: sync lazy sb accounting on quiesce of read-only mounts (Bill O'Donnell) [2011919 1917220]
  - xfs: remove the unused return value from xfs_log_unmount_write (Bill O'Donnell) [2011919 1917220]
  - powerpc: use stop_machine for partition migration (Frantisek Hrbata) [1993952 1979798]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.25.1.el8_4]
changelog:
  - scsi: ibmvfc: Reinit target retries (Steve Best) [1993892 1965010]
  - scsi: ibmvfc: Avoid move login if fast fail is enabled (Steve Best) [1993892 1965010]
  - scsi: ibmvfc: Handle move login failure (Steve Best) [1993892 1965010]
  - scsi: ibmvfc: Fix invalid state machine BUG_ON() (Steve Best) [1993892 1965010]
  - tpm, tpm_tis: Reserve locality in tpm_tis_resume() (Jerry Snitselaar) [1998219 1920812]
  - tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt() (Jerry Snitselaar) [1998219 1920812]
  - tpm, tpm_tis: Decorate tpm_tis_gen_interrupt() with request_locality() (Jerry Snitselaar) [1998219 1920812]
  - tpm, tpm_tis: Decorate tpm_get_timeouts() with request_locality() (Jerry Snitselaar) [1998219 1920812]
  - tpm_tis: Clean up locality release (Jerry Snitselaar) [1998219 1920812]
  - tpm_tis: Fix check_locality for correct locality acquisition (Jerry Snitselaar) [1998219 1920812]
  - kthread: Fix PF_KTHREAD vs to_kthread() race (Waiman Long) [2010331 2001497]
  - sched/fair: Ignore percpu threads for imbalance pulls (Waiman Long) [2010331 2001497]
  - kthread: Extract KTHREAD_IS_PER_CPU (Waiman Long) [2010331 2001497]
  - sched: Optimize finish_lock_switch() (Waiman Long) [2010331 2001497]
  - sched/hotplug: Ensure only per-cpu kthreads run during hotplug (Waiman Long) [2010331 2001497]
  - sched: Fix balance_callback() (Waiman Long) [2010331 2001497]
  - net/sched: store the last executed chain also for clsact egress (Davide Caratti) [1992230 1980537]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-299.el8]
changelog:
  - md: Set prev_flush_start and flush_bio in an atomic way (Xiao Ni) [1901598]
  - md: improve variable names in md_flush_request() (Xiao Ni) [1901598]
  - hpsa: fix regression issue for old controllers (Joseph Szczypek) [1925711]
  - scsi: hpsa: Correct dev cmds outstanding for retried cmds (Joseph Szczypek) [1925711]
  - vt: Disable KD_FONT_OP_COPY (Dave Airlie) [1903937] {CVE-2020-28974}
  - drm/i915/rkl: Remove require_force_probe protection (Lyude Paul) [1937558]
  - drm/i915/tgl/psr: Disable PSR on Tigerlake for now (Lyude Paul) [1924702]
  - dm raid: fix discard limits for raid0 and raid10 (Mike Snitzer) [1934274]
  - dm: fix __send_changing_extent_only to avoid duplicate dm_target_offset() (Mike Snitzer) [1934274]
  - mm/hugetlb.c: fix unnecessary address expansion of pmd sharing (Waiman Long) [1934212]
  - mm: memcontrol: fix slub memory accounting (Waiman Long) [1934212]
  - mm: memcontrol: fix swap undercounting in cgroup2 (Waiman Long) [1934212]
  - mm: memcontrol: fix NR_ANON_THPS accounting in charge moving (Waiman Long) [1934212]
  - mm, slub: better heuristic for number of cpus when calculating slab order (Waiman Long) [1934212]
  - Revert "mm: memcontrol: avoid workload stalls when lowering memory.high" (Waiman Long) [1934212]
  - selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed (Hangbin Liu) [1931732]
  - selftests/bpf: No need to drop the packet when there is no geneve opt (Hangbin Liu) [1931732]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-300.el8]
changelog:
  - [scsi] scsi: qedi: Correct max length of CHAP secret (Nilesh Javali) [1909180]
  - redhat: use tags from git notes for zstream to generate changelog (Frantisek Hrbata)
  - redhat: add CI file for kernel-private (Bruno Meneguele)
  - CI: Drop unused variable (Bruno Meneguele)
  - CI: Enable RT verification (Bruno Meneguele)
  - KVM: SVM: Clear the CR4 register on reset (Vitaly Kuznetsov) [1920788]
  - net: flow_offload: Add original direction flag to ct_metadata (Marcelo Ricardo Leitner) [1921946]
  - net/sched: cls_flower: Add match on the ct_state reply flag (Marcelo Ricardo Leitner) [1921946]
  - net/sched: cls_flower add CT_FLAGS_INVALID flag support (Marcelo Ricardo Leitner) [1921946]
  - net/sched: cls_flower: Reject invalid ct_state flags rules (Marcelo Ricardo Leitner) [1921946]
  - netlink: add mask validation (Marcelo Ricardo Leitner) [1921946]
  - netlink: create helpers for checking type is an int (Marcelo Ricardo Leitner) [1921946]
  - netlink: policy: correct validation type check (Marcelo Ricardo Leitner) [1921946]
  - netlink: make NLA_BINARY validation more flexible (Marcelo Ricardo Leitner) [1921946]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-301.el8]
changelog:
  - ibmvnic: fix a race between open and reset (Diego Domingos) [1940042]
  - ibmvnic: Set to CLOSED state even on error (Diego Domingos) [1940042]
  - ibmvnic: device remove has higher precedence over reset (Diego Domingos) [1940042]
  - ibmvnic: merge do_change_param_reset into do_reset (Diego Domingos) [1940042]
  - ibmvfc: disable MQ channelization by default (Gustavo Luiz Duarte) [1939359]
  - pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() (Steve Dickson) [1926945]
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930833] {CVE-2021-27365}
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930856] {CVE-2021-27363}
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1930809] {CVE-2021-27364}
  - futex: Handle faults correctly for PI futexes (Waiman Long) [1924635]
  - futex: Simplify fixup_pi_state_owner() (Waiman Long) [1924635]
  - futex: Use pi_state_update_owner() in put_pi_state() (Waiman Long) [1924635]
  - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Waiman Long) [1924635]
  - futex: Provide and use pi_state_update_owner() (Waiman Long) [1924635]
  - futex: Replace pointless printk in fixup_owner() (Waiman Long) [1924635]
  - futex: Ensure the correct return value from futex_lock_pi() (Waiman Long) [1924635]
  - futex: Don't enable IRQs unconditionally in put_pi_state() (Waiman Long) [1924635]
  - futex: Fix incorrect should_fail_futex() handling (Waiman Long) [1924635]
  - futex: Consistently use fshared as boolean (Waiman Long) [1924635]
  - futex: Remove needless goto's (Waiman Long) [1924635]
  - futex: Remove put_futex_key() (Waiman Long) [1924635]
  - NFS: Correct size calculation for create reply length (Benjamin Coddington) [1934903]
  - SUNRPC: Set memalloc_nofs_save() for sync tasks (Benjamin Coddington) [1934098]
  - net/mlx5: CT: Add support for matching on ct_state reply flag (Alaa Hleihel) [1919651]
  - net/mlx5e: CT: manage the lifetime of the ct entry object (Alaa Hleihel) [1919651]
  - net/mlx5e: CT: Use per flow counter when CT flow accounting is enabled (Alaa Hleihel) [1919651]
  - net/mlx5e: Fix a use after free on error in mlx5_tc_ct_shared_counter_get() (Alaa Hleihel) [1919651]
  - net/mlx5e: CT: Use the same counter for both directions (Alaa Hleihel) [1919651]
  - ethtool: fix the check logic of at least one channel for RX/TX (Ivan Vecera) [1907406]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-302.el8]
changelog:
  - PCI: rpadlpar: Fix potential drc_name corruption in store functions (Gustavo Luiz Duarte) [1938116]
  - selftests: kvm: Add basic Hyper-V clocksources tests (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Don't touch TSC page values when guest opted for re-enlightenment (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Track Hyper-V TSC page status (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Prevent using not-yet-updated TSC page by secondary CPUs (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Limit guest to writing zero to HV_X64_MSR_TSC_EMULATION_STATUS (Vitaly Kuznetsov) [1931782]
  - drm/i915/guc: Update to use firmware v49.0.1 (Dave Airlie) [1935281] {CVE-2020-12362}
  - time: Enable __kernel_timespec for 32-bit vdso build (Waiman Long) [1936282]
  - lib/idr.c: document calling context for IDA APIs mustn't use locks (Chris von Recklinghausen) [1917764]
  - ida: Free allocated bitmap in error path (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Fix compilation (Chris von Recklinghausen) [1917764]
  - vmalloc: convert to XArray (Chris von Recklinghausen) [1917764]
  - mm: pass addr as unsigned long to vb_free (Chris von Recklinghausen) [1917764]
  - radix tree: Remove multiorder support (Chris von Recklinghausen) [1917764]
  - radix tree test: Convert multiorder tests to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Convert item_delete_rcu to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Convert item_kill_tree to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Move item_insert_order (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Remove multiorder benchmarking (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Remove __item_insert (Chris von Recklinghausen) [1917764]
  - radix tree: Remove radix_tree_clear_tags (Chris von Recklinghausen) [1917764]
  - radix tree: Remove split/join code (Chris von Recklinghausen) [1917764]
  - radix tree: Remove radix_tree_update_node_t (Chris von Recklinghausen) [1917764]
  - mm: Convert truncate to XArray (Chris von Recklinghausen) [1917764]
  - copy rh_kabi.h to tools/testing/radix-tree/linux (Chris von Recklinghausen) [1917764]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-303.el8]
changelog:
  - redhat: switch secureboot kernel image signing to release keys (Jan Stancek)
  - Revert "[md] md/raid5: add a new member of offset into r5dev" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: make async_copy_data() to support different page offset" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid5: add new xor function to support different page offset" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: convert to new xor compution interface" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid6: let syndrome computor support different page offset" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid6: let async recovery function support different page offset" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: let multiple devices of stripe_head share page" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: resize stripe_head when reshape array" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: reallocate page array after setting new stripe_size" (Nigel Croxon) [1936903]
  - ACPI: PNP: compare the string length in the matching_id() (Mark Langsdorf) [1933702]
  - ceph: add missing break when parsing "nowsync" mount option (Jeff Layton) [1932753]
  - get_maintainer.conf: Update with new location of RHMAINTAINERS (Prarit Bhargava)
  - redhat: make pathspec exclusion compatible with old git versions (Herton R. Krzesinski)
  - redhat/scripts: Update merge-subtrees.sh with new subtree location (Prarit Bhargava)
  - tree: Add RHMAINTAINERS soft link in 8.4 (Prarit Bhargava)
  - tree: remove existing redhat/rhdocs subtree in 8.4 (Prarit Bhargava)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-304.el8]
changelog:
  - mm: Revert "remove the account_page_dirtied export" (Waiman Long) [1941257]
  - Revert "[netdrv] net/broadcom: Clean broadcom code from driver versions" (Jonathan Toppins) [1940842]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.1.1.el8_4]
changelog:
  - ALSA: usb-audio: fix NULL ptr dereference in usb_audio_probe (Jaroslav Kysela) [1954545 1870724]
  - ALSA: usb-audio: fix use after free in usb_audio_disconnect (Jaroslav Kysela) [1954545 1870724]
  - ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend() (Jaroslav Kysela) [1954545 1870724]
  - selinux: fix deadlock in security_set_bools() (Ondrej Mosnacek) [1945123 1924230]
  - geneve: do not modify the shared tunnel info when PMTU triggers an ICMP reply (Antoine Tenart) [1944667 1941753]
  - vxlan: do not modify the shared tunnel info when PMTU triggers an ICMP reply (Antoine Tenart) [1944667 1941753]
  - redhat: switch to zstream (Jan Stancek)


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.2.1.rt7.74.el8_4]
changelog:
  - net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP (Alaa Hleihel) [1952061 1936742]
  - net/mlx5e: Reject tc rules which redirect from a VF to itself (Alaa Hleihel) [1952065 1932839]
  - net/mlx5: CT: Add support for matching on ct_state inv and rel flags (Alaa Hleihel) [1952062 1942681]
  - KVM: VMX: Don't use vcpu->run->internal.ndata as an array index (Jon Maloy) [1954224 1954219] {CVE-2021-3501}
  - tools/power turbostat: Revert "[tools] tools/power turbostat: Enable accumulate RAPL display" (Prarit Bhargava) [1952987 1944699]


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.3.1.rt7.75.el8_4]
changelog:
  - Revert "uio: use request_threaded_irq instead" (Vitaly Kuznetsov) [1952952 1946644]
  - drm/ast: Set format registers in primary plane's update (Lyude Paul) [1952900 1923857]
  - net/sched: act_ct: clear post_ct if doing ct_clear (Marcelo Ricardo Leitner) [1956458 1941889]
  - md/raid1: properly indicate failure when ending a failed write request (Nigel Croxon) [1955188 1954588]
  - nitro_enclaves: Fix stale file descriptors on failed usercopy (Vitaly Kuznetsov) [1956380 1953717] {CVE-2021-3543}


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.6.1.rt7.78.el8_4]
changelog:
  - openvswitch: fix stack OOB read while fragmenting IPv4 packets (Davide Caratti) [1963940 1924608]
  - net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets (Davide Caratti) [1963940 1924608]
  - net/sched: act_ct: fix wild memory access when clearing fragments (Davide Caratti) [1963940 1924608]
  - net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT (Ivan Vecera) [1965970 1946798]
  - redhat/configs: Add CONFIG_SYSTEM_REVOCATION_KEYS and CONFIG_SYSTEM_REVOCATION_LIST (Vladis Dronov) [1965271 1893794] {CVE-2020-26541}
  - certs: add 'x509_revocation_list' to gitignore (Vladis Dronov) [1965271 1893794] {CVE-2020-26541}
  - integrity: Load mokx variables into the blacklist keyring (Vladis Dronov) [1965271 1893794] {CVE-2020-26541}
  - certs: Add ability to preload revocation certs (Vladis Dronov) [1965271 1893794] {CVE-2020-26541}
  - certs: Move load_system_certificate_list to a common function (Vladis Dronov) [1965271 1893794] {CVE-2020-26541}
  - certs: Add EFI_CERT_X509_GUID support for dbx entries (Vladis Dronov) [1965271 1893794] {CVE-2020-26541}
  - net/sched: cls_api: increase max_reclassify_loop (Davide Caratti) [1965148 1955136]
  - dm writecache: fix performance degradation in ssd mode (Mike Snitzer) [1962241 1961859]
  - scsi: fnic: Use scsi_host_busy_iter() to traverse commands (Ewan D. Milne) [1961705 1949250]
  - scsi: fnic: Kill 'exclude_id' argument to fnic_cleanup_io() (Ewan D. Milne) [1961705 1949250]


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.7.1.rt7.79.el8_4]
changelog:
  - net: zero-initialize tc skb extension on allocation (Ivan Vecera) [1965457 1946986]
  - net/sched: cls_flower: fix only mask bit check in the validate_ct_state (Ivan Vecera) [1965457 1946986]
  - net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb (Ivan Vecera) [1965457 1946986]
  - net/sched: act_api: fix miss set post_ct for ovs after do conntrack in act_ct (Ivan Vecera) [1965457 1946986]
  - net/sched: cls_flower: validate ct_state for invalid and reply flags (Ivan Vecera) [1965457 1946986]
  - flow_dissector: fix TTL and TOS dissection on IPv4 fragments (Paolo Abeni) [1963952 1950288]
  - Revert "sctp: Fix SHUTDOWN CTSN Ack in the peer restart case" (Xin Long) [1965632 1953839]
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_b (Xin Long) [1965632 1953839]
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_a (Xin Long) [1965632 1953839]
  - Bluetooth: verify AMP hci_chan before amp_destroy (Gopal Tiwari) [1962513 1962514] {CVE-2021-33034}
  - x86/kvm: Unify kvm_pv_guest_cpu_reboot() with kvm_guest_cpu_offline() (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Disable all PV features on crash (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Disable kvmclock on all CPUs on shutdown (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Teardown PV features on boot CPU as well (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Fix pr_info() for async PF setup/teardown (Lenny Szubowicz) [1964930 1934273]
  - net/sched: act_ct: Fix ct template allocation for zone 0 (Marcelo Ricardo Leitner) [1965150 1881824]


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.10.1.rt7.82.el8_4]
changelog:
  - igbvf: amend removal of MODULE_VERSION (Corinna Vinschen) [1969920 1955752]
  - bluetooth: eliminate the potential race condition when removing the HCI controller (Gopal Tiwari) [1971468 1971489] {CVE-2021-32399}
  - scsi: ibmvfc: Free channel_setup_buf during device tear down (Steve Best) [1964697 1938102]
  - i40e: Fix parameters in aq_get_phy_register() (Stefan Assmann) [1967099 1907852]


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.10.2.rt7.83.el8_4]
changelog:
  - seq_file: Disallow extremely large seq buffer allocations (Ian Kent) [1975186 1975182] {CVE-2021-33909}


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.11.1.rt7.83.el8_4]
changelog:
  - SUNRPC: Handle major timeout in xprt_adjust_timeout() (Scott Mayhew) [1980613 1979070]
  - net/mlx5e: Disable TLS device offload in kdump mode (Alaa Hleihel) [1969909 1946647]
  - net/mlx5e: Disable TX MPWQE in kdump mode (Alaa Hleihel) [1969909 1946647]
  - drm/i915: Add an encoder hook to sanitize its state during init/resume (Imre Deak) [1981250 1961122]
  - netfilter: x_tables: fix compat match/target pad out-of-bound write (Florian Westphal) [1980505 1980506] {CVE-2021-22555}
  - Bluetooth: btusb: Fix the autosuspend enable and disable (Gopal Tiwari) [1972564 1927375]
  - cifs: handle empty list of targets in cifs_reconnect() (Ronnie Sahlberg) [1973637 1952263]
  - tick/nohz: Update idle_exittime on actual idle exit (Phil Auld) [1978710 1962632]
  - tick/nohz: Remove superflous check for CONFIG_VIRT_CPU_ACCOUNTING_NATIVE (Phil Auld) [1978710 1962632]
  - tick/nohz: Conditionally restart tick on idle exit (Phil Auld) [1978710 1962632]
  - can: bcm: delay release of struct bcm_op after synchronize_rcu() (Hangbin Liu) [1975058 1975059]
  - redhat/configs: Re-enable dptf_power module (Prarit Bhargava) [1968381 1962349]
  - KVM: do not allow mapping valid but non-reference-counted pages (Jon Maloy) [1975516 1975517] {CVE-2021-22543}
  - seq_file: Disallow extremely large seq buffer allocations (Ian Kent) [1975186 1975187] {CVE-2021-33909}


author: Chris White <chwhite@redhat.com> [4.18.0-305.12.1.rt7.84.el8_4]
changelog:
  - [rt] mm/memcg: make get_obj_stock() RT friendly (Luis Claudio R. Goncalves) [1987102 1983261] 
  - memcontrol: Add an argument to refill_stock() to indicate locking (Luis Claudio R. Goncalves) [1987102 1983261]
  - Revert "nvme-pci: remove last_sq_tail" (Gopal Tiwari) [1965415 1921591]
  - tc-testing: add test for ct DNAT tuple collision (Marcelo Ricardo Leitner) [1982494 1964578]
  - tc-testing: add support for sending various scapy packets (Marcelo Ricardo Leitner) [1982494 1964578]
  - tc-testing: fix list handling (Marcelo Ricardo Leitner) [1982494 1964578]
  - net/sched: act_ct: handle DNAT tuple collision (Marcelo Ricardo Leitner) [1982494 1964578]
  - mm/memcg: Relocate tcpmem to below memory in struct mem_cgroup (Waiman Long) [1980314 1959772]
  - mm/memcg: optimize user context object stock access (Waiman Long) [1980314 1959772]
  - mm/memcg: improve refill_obj_stock() performance (Waiman Long) [1980314 1959772]
  - mm/memcg: cache vmstat data in percpu memcg_stock_pcp (Waiman Long) [1980314 1959772]
  - mm/memcg: move mod_objcg_state() to memcontrol.c (Waiman Long) [1980314 1959772]
  - mm: memcontrol: use obj_cgroup APIs to charge kmem pages (Waiman Long) [1980314 1959772]
  - mm: memcontrol: change ug->dummy_page only if memcg changed (Waiman Long) [1980314 1959772]
  - mm: memcontrol: directly access page->memcg_data in mm/page_alloc.c (Waiman Long) [1980314 1959772]
  - mm: memcontrol: introduce obj_cgroup_{un}charge_pages (Waiman Long) [1980314 1959772]
  - mm: memcontrol: slab: fix obtain a reference to a freeing memcg (Waiman Long) [1980314 1959772]
  - mm: move lruvec stats update functions to vmstat.h (Waiman Long) [1980314 1959772]
  - mm: memcg/slab: rename *_lruvec_slab_state to *_lruvec_kmem_state (Waiman Long) [1980314 1959772]
  - mm: Convert page kmemcg type to a page memcg flag (Waiman Long) [1980314 1959772]
  - mm: Introduce page memcg flags (Waiman Long) [1980314 1959772]
  - mm: memcontrol/slab: Use helpers to access slab page's memcg_data (Waiman Long) [1980314 1959772]
  - mm: memcontrol: Use helpers to read page's memcg data (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: extract check_[new|free]_page_bad() common part to page_bad_reason() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: rename free_pages_check() to check_free_page() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: rename free_pages_check_bad() to check_free_page_bad() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: bad_flags is not necessary for bad_page() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: bad_[reason|flags] is not necessary when PageHWPoison (Waiman Long) [1980314 1959772]


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.13.1.rt7.85.el8_4]
changelog:
  - mm/zswap: Initialize the local-lock (Andrew Halaney) [1980641 1905765]
  - xfrm: Fix wraparound in xfrm_policy_addr_delta() (Sabrina Dubroca) [1981840 1951965]
  - VMCI: Release resource if the work is already queued (Cathy Avery) [1982042 1978518]


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.14.1.rt7.86.el8_4]
changelog:
  - [rt] build kernel-rt-4.18.0-305.14.1.rt7.86.el8_4 [1990013]
  - time/hrtimer: Embed hrtimer mode into hrtimer_sleeper (Juri Lelli) [1986063 1966600]
  - time/hrtimer: Add PINNED_HARD mode for realtime hrtimers (Juri Lelli) [1986063 1966600]
  - sched/fair: Bail rebalance early if SD_LOAD_BALANCE is not set (Juri Lelli) [1990272 1875275]
  - spec: create a changelog entry with the RT Update Source BZ (Luis Claudio R. Goncalves)
  - tick/nohz: Kick only _queued_ task whose tick dependency is updated (Waiman Long) [1981336 1922901]
  - tick/nohz: Change signal tick dependency to wake up CPUs of member tasks (Waiman Long) [1981336 1922901]
  - tick/nohz: Only wake up a single target cpu when kicking a task (Waiman Long) [1981336 1922901]
  - tick/nohz: Narrow down noise while setting current task's tick dependency (Waiman Long) [1981336 1922901]
  - mlx5: net: zero-initialize tc skb extension on allocation (Jan Stancek) [1982220 1965418]
  - scsi: qedf: Update the max_id value in host structure (Nilesh Javali) [1989097 1954876]
  - scsi: qla2xxx: Reserve extra IRQ vectors (Nilesh Javali) [1986156 1964834]


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.15.1.rt7.87.el8_4]
changelog:
  - [rt] build kernel-rt-4.18.0-305.15.1.rt7.87.el8_4 [1990013]
  - sched: Fix data-race in wakeup (Phil Auld) [1987296 1937103]
  - mm/page_alloc: bail out on fatal signal during reclaim/compaction retry attempt (Aaron Tomlin) [1984085 1919765]
  - sunrpc: Avoid a KASAN slab-out-of-bounds bug in xdr_set_page_base() (Benjamin Coddington) [1993255 1969751] {CVE-2021-38201}


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.16.1.rt7.88.el8_4]
changelog:
  - [rt] build kernel-rt-4.18.0-305.16.1.rt7.88.el8_4 [1990013]
  - rcu: Make rcu_normal_after_boot writable again (Juri Lelli) [1995431 1994249]
  - kernfs: dont call d_splice_alias() under kernfs node lock (Ian Kent) [1994879 1939133]
  - kernfs: use i_lock to protect concurrent inode updates (Ian Kent) [1994879 1939133]
  - kernfs: switch kernfs to use an rwsem (Ian Kent) [1994879 1939133]
  - kernfs: use VFS negative dentry caching (Ian Kent) [1994879 1939133]
  - kernfs: add a revision to identify directory node changes (Ian Kent) [1994879 1939133]
  - kernfs: move revalidate to be near lookup (Ian Kent) [1994879 1939133]
  - scsi: lpfc: Fix dropped FLOGI during pt2pt discovery recovery (Jan Stancek) [1948608 1923762]
  - net: sched: act_mirred: Reset ct info when mirror/redirect skb (C. Erastus Toe) [1992226 1980532]
  - usb: ehci: Prevent missed ehci interrupts with edge-triggered MSI (Torez Smith) [1993894 1972139]
  - usb: ehci: do not initialise static variables (Torez Smith) [1993894 1972139]
  - usb: host: move EH SINGLE_STEP_SET_FEATURE implementation to core (Torez Smith) [1993894 1972139]
  - USB: ehci: drop workaround for forced irq threading (Torez Smith) [1993894 1972139]
  - usb: ehci: add spurious flag to disable overcurrent checking (Torez Smith) [1993894 1972139]
  - NFS: Only change the cookie verifier if the directory page cache is empty (Benjamin Coddington) [1993895 1982825]
  - NFS: Fix handling of cookie verifier in uncached_readdir() (Benjamin Coddington) [1993895 1982825]
  - nfs: Subsequent READDIR calls should carry non-zero cookieverifier (Benjamin Coddington) [1993895 1982825]
  - KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow (Jon Maloy) [1988225 1988226] {CVE-2021-37576}
  - redhat: Temporary workaround for CKI pipelines (Juri Lelli)


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.17.1.rt7.89.el8_4]
changelog:
  - [rt] build kernel-rt-4.18.0-305.17.1.rt7.89.el8_4 [1990013]
  - ucounts: Move max_time_namespace according to ucount_type (Alex Gladkov) [1998002 1982954]
  - netfilter: conntrack: remove offload_pickup sysctl again (Florian Westphal) [1995555 1987101]
  - netfilter: flowtable: Set offload timeouts according to proto values (Phil Sutter) [1995554 1979184]
  - netfilter: conntrack: Introduce udp offload timeout configuration (Phil Sutter) [1995554 1979184]
  - netfilter: conntrack: Introduce tcp offload timeout configuration (Phil Sutter) [1995554 1979184]
  - powerpc/64s: Fix crashes when toggling stf barrier (Desnes A. Nunes do Rosario) [1989174 1964484]
  - iavf: fix locking of critical sections (Stefan Assmann) [1997534 1975245]
  - iavf: do not override the adapter state in the watchdog task (Stefan Assmann) [1997534 1975245]


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.18.1.rt7.90.el8_4]
changelog:
  - [rt] build kernel-rt-4.18.0-305.18.1.rt7.90.el8_4 [2001131]
  - mfd: intel-lpss: Use devm_ioremap_uc for MMIO (Steve Best) [1989560 1986715]
  - lib: devres: add a helper function for ioremap_uc (Steve Best) [1989560 1986715]
  - ceph: fix test for whether we can skip read when writing beyond EOF (Jeff Layton) [1996680 1971101]
  - arm64: memory: Add missing brackets to untagged_addr() macro (Chris von Recklinghausen) [1997998 1955809]
  - arm64: tags: Preserve tags for addresses translated via TTBR1 (Chris von Recklinghausen) [1997998 1955809]
  - arm64: entry: Move ct_user_exit before any other exception (Chris von Recklinghausen) [1997998 1955809]
  - arm64: memory: Implement __tag_set() as common function (Chris von Recklinghausen) [1997998 1955809]
  - arm64: mm: Really fix sparse warning in untagged_addr() (Chris von Recklinghausen) [1997998 1955809]
  - arm64: untag user pointers in access_ok and __uaccess_mask_ptr (Chris von Recklinghausen) [1997998 1955809]
  - arm64/mm: fix variable 'tag' set but not used (Chris von Recklinghausen) [1997998 1955809]
  - arm64: entry: SP Alignment Fault doesn't write to FAR_EL1 (Chris von Recklinghausen) [1997998 1955809]
  - arm64: compat: Add separate CP15 trapping hook (Chris von Recklinghausen) [1997998 1955809]
  - arm64: don't restore GPRs when context tracking (Chris von Recklinghausen) [1997998 1955809]
  - KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656) (Jon Maloy) [1985436 1985437] {CVE-2021-3656}
  - KVM: SVM: add module param to control the #SMI interception (Jon Maloy) [1985436 1985437] {CVE-2021-3656}
  - tty: Don't hold ldisc lock in tty_reopen() if ldisc present (Waiman Long) [1997999 1968271]
  - tty/ldsem: Add lockdep asserts for ldisc_sem (Waiman Long) [1997999 1968271]
  - tty: Simplify tty->count math in tty_reopen() (Waiman Long) [1997999 1968271]
  - tty: Don't block on IO when ldisc change is pending (Waiman Long) [1997999 1968271]
  - tty: Hold tty_ldisc_lock() during tty_reopen() (Waiman Long) [1997999 1968271]
  - tty: Drop tty->count on tty_reopen() failure (Waiman Long) [1997999 1968271]
  - [s390] s390/vtime: fix increased steal time accounting (Claudio Imbrenda) [1988386 1963075]
  - XArray: Fix splitting to non-zero orders (Chris von Recklinghausen) [1997997 1946304]
  - XArray: Fix split documentation (Chris von Recklinghausen) [1997997 1946304]
  - ima: extend boot_aggregate with kernel measurements (Bruno Meneguele) [1997766 1977422]
  - ceph: reduce contention in ceph_check_delayed_caps() (Jeff Layton) [1995862 1953430]
  - ice: Stop processing VF messages during teardown (Ken Cox) [1997538 1986451]
  - iavf: Set RSS LUT and key in reset handle path (Ken Cox) [1997536 1910853]
  - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) (Jon Maloy) [1985419 1985420] {CVE-2021-3653}
  - scsi: ibmvfc: Fix potential race in ibmvfc_wait_for_ops() (Steve Best) [1969792 1941180]
  - [s390] s390/dasd: add missing discipline function (Claudio Imbrenda) [1995206 1981804]
  - serial_core: switch to ->[sg]et_serial() (Artem Savkov) [1993872 1952415]
  - net/mlx5e: Fix mapping of ct_label zero (Jan Stancek) [1983681 1915308]
  - drm/qxl: add lock asserts to qxl_bo_vmap_locked + qxl_bo_vunmap_locked (Lyude Paul) [1992839 1907341]
  - drm/qxl: rework cursor plane (Lyude Paul) [1992839 1907341]
  - drm/qxl: move shadow handling to new qxl_prepare_shadow() (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix monitors object vmap (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix prime vmap (Lyude Paul) [1992839 1907341]
  - drm/qxl: rename qxl_bo_kmap -> qxl_bo_vmap_locked (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix lockdep issue in qxl_alloc_release_reserved (Lyude Paul) [1992839 1907341]
  - drm/qxl: use ttm bo priorities (Lyude Paul) [1992839 1907341]
  - drm/qxl: more fence wait rework (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly handle device init failures (Lyude Paul) [1992839 1907341]
  - drm/qxl: allocate dumb buffers in ram (Lyude Paul) [1992839 1907341]
  - drm/qxl: simplify qxl_fence_wait (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly free qxl releases (Lyude Paul) [1992839 1907341]
  - drm/qxl: handle shadow in primary destroy (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly pin/unpin shadow (Lyude Paul) [1992839 1907341]
  - drm/qxl: release shadow on shutdown (Lyude Paul) [1992839 1907341]
  - drm/qxl: unpin release objects (Lyude Paul) [1992839 1907341]
  - drm/qxl: use drmm_mode_config_init (Lyude Paul) [1992839 1907341]
  - qxl/ttm: drop the unusued no wait flag to reserve function (Lyude Paul) [1992839 1907341]


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.19.1.rt7.91.el8_4]
changelog:
  - [rt] build kernel-rt-4.18.0-305.19.1.rt7.91.el8_4 [2001131]
  - libceph: allow addrvecs with a single NONE/blank address (Jeff Layton) [1996682 1972278]
  - ice: Only lock to update netdev dev_addr (Michal Schmidt) [2000129 1995868]
  - ice: don't remove netdev->dev_addr from uc sync list (Ken Cox) [2000130 1961018]


author: Luis Claudio R. Goncalves <lgoncalv@redhat.com> [4.18.0-305.20.1.rt7.92.el8_4]
changelog:
  - [rt] build kernel-rt-4.18.0-305.20.1.rt7.92.el8_4 [2004117]
  - net/mlx5: E-Switch, Allow setting GUID for host PF vport (Alaa Hleihel)
  - net/mlx5: E-Switch, Read PF mac address (Alaa Hleihel)
  - ice: fix Tx queue iteration for Tx timestamp enablement (Ken Cox)
  - ice: restart periodic outputs around time changes (Ken Cox)
  - ice: Fix perout start time rounding (Ken Cox)
  - ice: add support for auxiliary input/output pins (Jonathan Toppins)
  - ice: enable transmit timestamps for E810 devices (Jonathan Toppins)
  - ice: enable receive hardware timestamping (Jonathan Toppins)
  - ice: report the PTP clock index in ethtool .get_ts_info (Jonathan Toppins)
  - ice: register 1588 PTP clock device object for E810 devices (Jonathan Toppins)
  - ice: add low level PTP clock access functions (Jonathan Toppins)
  - ice: add support for set/get of driver-stored firmware parameters (Jonathan Toppins)
  - ice: process 1588 PTP capabilities during initialization (Jonathan Toppins)
  - ice: add support for sideband messages (Jonathan Toppins)
  - ice: Prevent probing virtual functions (Ken Cox)
  - vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU (Gustavo Walbon)
  - powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU (Gustavo Walbon)


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.21.1.rt7.93.el8_4]
changelog:
  - [rt] build kernel-rt-4.18.0-305.21.1.rt7.93.el8_4 [2004117]
  - HID: make arrays usage and value to be the same (Benjamin Tissoires) [1974946 1974947] {CVE-2021-0512}
  - y2038: remove CONFIG_64BIT_TIME (Waiman Long) [2003569 1965360]


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.22.1.rt7.94.el8_4]
changelog:
  - [rt] build kernel-rt-4.18.0-305.22.1.rt7.94.el8_4 [2004117]
  - [s390] s390/ap: Fix hanging ioctl caused by wrong msg counter (Claudio Imbrenda) [2002635 1984762]
  - cpuidle: pseries: Do not cap the CEDE0 latency in fixup_cede0_latency() (Diego Domingos) [1997431 1952809]
  - cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards (Diego Domingos) [1997431 1952809]
  - EDAC/amd64: Fix PCI component registration (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId (Aristeu Rozanski) [1982182 1918583]
  - x86/CPU/AMD: Remove amd_get_nb_id() (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Make fam_ops static global (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Allow Reserved types to be overwritten in smca_banks[] (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure() (Aristeu Rozanski) [1982182 1918583]
  - EDAC/amd64: Get rid of the ECC disabled long message (Aristeu Rozanski) [1982182 1918583]
  - EDAC/amd64: Check for memory before fully initializing an instance (Aristeu Rozanski) [1982182 1918583]
  - EDAC/amd64: Use cached data when checking for ECC (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE: Make the number of MCA banks a per-CPU variable (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Don't cache block addresses on SMCA systems (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE: Make mce_banks a per-CPU array (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE: Make struct mce_banks[] static (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Don't report L1 BTB MCA errors on some family 17h models (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Decode MCA_STATUS in bit definition order (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Decode MCA_STATUS[Scrub] bit (Aristeu Rozanski) [1982182 1918583]
  - EDAC, mce_amd: Match error descriptions to latest documentation (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Carve out the MC4_MISC thresholding quirk (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models (Aristeu Rozanski) [1982182 1918583]
  - net: Fix skb->csum update in inet_proto_csum_replace16(). (Balazs Nemeth) [2005980 1975193]
  - RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy (Kamal Heib) [1982040 1931846] {CVE-2020-36385}
  - RDMA/ucma: Fix locking for ctx->events_reported (Kamal Heib) [1982040 1931846] {CVE-2020-36385}
  - RDMA/ucma: Fix the locking of ctx->file (Kamal Heib) [1982040 1931846] {CVE-2020-36385}
  - RDMA/cma: Add missing locking to rdma_accept() (Kamal Heib) [1982040 1931846] {CVE-2020-36385}


author: Luis Claudio R. Goncalves <lgoncalv@redhat.com> [4.18.0-305.23.1.rt7.95.el8_4]
changelog:
  - [rt] build kernel-rt-4.18.0-305.23.1.rt7.95.el8_4 [2004117]
  - CI: handle RT branches in a single config (Veronika Kabatova)
  - CI: Drop private CI config (Veronika Kabatova)
  - CI: extend template use (Veronika Kabatova)
  - xfs: drop unnecessary setfilesize helper (Brian Foster)
  - xfs: drop unused ioend private merge and setfilesize code (Brian Foster)
  - xfs: open code ioend needs workqueue helper (Brian Foster)
  - xfs: drop submit side trans alloc for append ioends (Brian Foster)


author: Juri Lelli <juri.lelli@redhat.com> [4.18.0-305.24.1.rt7.96.el8_4]
changelog:
  - [rt] build kernel-rt-4.18.0-305.24.1.rt7.96.el8_4 [2004117]
  - lockd: Fix invalid lockowner cast after vfs_test_lock (Benjamin Coddington)
  - e1000e: Do not take care about recovery NVM checksum (Ken Cox)
  - xfs: sync lazy sb accounting on quiesce of read-only mounts (Bill O'Donnell)
  - xfs: remove the unused return value from xfs_log_unmount_write (Bill O'Donnell)
  - powerpc: use stop_machine for partition migration (Frantisek Hrbata)


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-305.25.1.rt7.97.el8_4]
changelog:
  - [rt] build kernel-rt-4.18.0-305.25.1.rt7.97.el8_4 [2004117]
  - scsi: ibmvfc: Reinit target retries (Steve Best) [1993892 1965010]
  - scsi: ibmvfc: Avoid move login if fast fail is enabled (Steve Best) [1993892 1965010]
  - scsi: ibmvfc: Handle move login failure (Steve Best) [1993892 1965010]
  - scsi: ibmvfc: Fix invalid state machine BUG_ON() (Steve Best) [1993892 1965010]
  - tpm, tpm_tis: Reserve locality in tpm_tis_resume() (Jerry Snitselaar) [1998219 1920812]
  - tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt() (Jerry Snitselaar) [1998219 1920812]
  - tpm, tpm_tis: Decorate tpm_tis_gen_interrupt() with request_locality() (Jerry Snitselaar) [1998219 1920812]
  - tpm, tpm_tis: Decorate tpm_get_timeouts() with request_locality() (Jerry Snitselaar) [1998219 1920812]
  - tpm_tis: Clean up locality release (Jerry Snitselaar) [1998219 1920812]
  - tpm_tis: Fix check_locality for correct locality acquisition (Jerry Snitselaar) [1998219 1920812]
  - kthread: Fix PF_KTHREAD vs to_kthread() race (Waiman Long) [2010331 2001497]
  - sched/fair: Ignore percpu threads for imbalance pulls (Waiman Long) [2010331 2001497]
  - kthread: Extract KTHREAD_IS_PER_CPU (Waiman Long) [2010331 2001497]
  - sched: Optimize finish_lock_switch() (Waiman Long) [2010331 2001497]
  - sched/hotplug: Ensure only per-cpu kthreads run during hotplug (Waiman Long) [2010331 2001497]
  - sched: Fix balance_callback() (Waiman Long) [2010331 2001497]
  - net/sched: store the last executed chain also for clsact egress (Davide Caratti) [1992230 1980537]


author: Luis Claudio R. Goncalves <lgoncalv@redhat.com> [4.18.0-299.rt7.66.el8]
changelog:
  - md: Set prev_flush_start and flush_bio in an atomic way (Xiao Ni) [1901598]
  - md: improve variable names in md_flush_request() (Xiao Ni) [1901598]
  - hpsa: fix regression issue for old controllers (Joseph Szczypek) [1925711]
  - scsi: hpsa: Correct dev cmds outstanding for retried cmds (Joseph Szczypek) [1925711]
  - vt: Disable KD_FONT_OP_COPY (Dave Airlie) [1903938] {CVE-2020-28974}
  - drm/i915/rkl: Remove require_force_probe protection (Lyude Paul) [1937558]
  - drm/i915/tgl/psr: Disable PSR on Tigerlake for now (Lyude Paul) [1924702]
  - dm raid: fix discard limits for raid0 and raid10 (Mike Snitzer) [1934274]
  - dm: fix __send_changing_extent_only to avoid duplicate dm_target_offset() (Mike Snitzer) [1934274]
  - mm/hugetlb.c: fix unnecessary address expansion of pmd sharing (Waiman Long) [1934212]
  - mm: memcontrol: fix slub memory accounting (Waiman Long) [1934212]
  - mm: memcontrol: fix swap undercounting in cgroup2 (Waiman Long) [1934212]
  - mm: memcontrol: fix NR_ANON_THPS accounting in charge moving (Waiman Long) [1934212]
  - mm, slub: better heuristic for number of cpus when calculating slab order (Waiman Long) [1934212]
  - Revert "mm: memcontrol: avoid workload stalls when lowering memory.high" (Waiman Long) [1934212]
  - selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed (Hangbin Liu) [1931732]
  - selftests/bpf: No need to drop the packet when there is no geneve opt (Hangbin Liu) [1931732]


author: Luis Claudio R. Goncalves <lgoncalv@redhat.com> [4.18.0-302.rt7.69.el8]
changelog:
  - PCI: rpadlpar: Fix potential drc_name corruption in store functions (Gustavo Luiz Duarte) [1938116]
  - selftests: kvm: Add basic Hyper-V clocksources tests (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Don't touch TSC page values when guest opted for re-enlightenment (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Track Hyper-V TSC page status (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Prevent using not-yet-updated TSC page by secondary CPUs (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Limit guest to writing zero to HV_X64_MSR_TSC_EMULATION_STATUS (Vitaly Kuznetsov) [1931782]
  - drm/i915/guc: Update to use firmware v49.0.1 (Dave Airlie) [1935284] {CVE-2020-12362}
  - time: Enable __kernel_timespec for 32-bit vdso build (Waiman Long) [1936282]
  - lib/idr.c: document calling context for IDA APIs mustn't use locks (Chris von Recklinghausen) [1917764]
  - ida: Free allocated bitmap in error path (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Fix compilation (Chris von Recklinghausen) [1917764]
  - vmalloc: convert to XArray (Chris von Recklinghausen) [1917764]
  - mm: pass addr as unsigned long to vb_free (Chris von Recklinghausen) [1917764]
  - radix tree: Remove multiorder support (Chris von Recklinghausen) [1917764]
  - radix tree test: Convert multiorder tests to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Convert item_delete_rcu to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Convert item_kill_tree to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Move item_insert_order (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Remove multiorder benchmarking (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Remove __item_insert (Chris von Recklinghausen) [1917764]
  - radix tree: Remove radix_tree_clear_tags (Chris von Recklinghausen) [1917764]
  - radix tree: Remove split/join code (Chris von Recklinghausen) [1917764]
  - radix tree: Remove radix_tree_update_node_t (Chris von Recklinghausen) [1917764]
  - mm: Convert truncate to XArray (Chris von Recklinghausen) [1917764]
  - copy rh_kabi.h to tools/testing/radix-tree/linux (Chris von Recklinghausen) [1917764]


author: Luis Claudio R. Goncalves <lgoncalv@redhat.com> [4.18.0-303.rt7.70.el8]
changelog:
  - [rt] fix futex mismerges from -301 (Luis Claudio R. Goncalves) [1944757]
  - redhat: switch secureboot kernel image signing to release keys (Jan Stancek)
  - Revert "[md] md/raid5: add a new member of offset into r5dev" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: make async_copy_data() to support different page offset" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid5: add new xor function to support different page offset" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: convert to new xor compution interface" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid6: let syndrome computor support different page offset" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid6: let async recovery function support different page offset" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: let multiple devices of stripe_head share page" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: resize stripe_head when reshape array" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: reallocate page array after setting new stripe_size" (Nigel Croxon) [1936903]
  - ACPI: PNP: compare the string length in the matching_id() (Mark Langsdorf) [1933702]
  - ceph: add missing break when parsing "nowsync" mount option (Jeff Layton) [1932753]
  - get_maintainer.conf: Update with new location of RHMAINTAINERS (Prarit Bhargava)
  - redhat: make pathspec exclusion compatible with old git versions (Herton R. Krzesinski)
  - redhat/scripts: Update merge-subtrees.sh with new subtree location (Prarit Bhargava)
  - tree: Add RHMAINTAINERS soft link in 8.4 (Prarit Bhargava)
  - tree: remove existing redhat/rhdocs subtree in 8.4 (Prarit Bhargava)


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-38
changelog:
  - Don's try to restart dracut-initqueue if it's already failed
  - fadump-howto: update about 'nocma' and 'off' options for 'fadump=' parameter
  - dracut-module-setup.sh: use auto6 for ipv6
  - module-setup.sh: enable vlan on team interface
  - Fix rootfs detection in dump_fs
  - Remove RHEL-only patch: kexec-tools-2.0.18-makedumpfile-arm64-Add-support-for-ARMv8.2-LVA-52-bi.patch
  - Rebase to makedumpfile-1.6.8 (step1)


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-43
changelog:
  - Always include watchdog-modules
  - mkdumprd: Ensure kdumpbase is added
  - Move watchdog detect and install code to module-setup.sh
  - Add a helper to omit non-mandatory dracut module
  - Move some dracut module dependencies checks to module-setup.sh
  - Set watchdog's pretimeout to zero in kdump kernel
  - kdump-lib.sh: Use a more generic helper to detect omitted dracut module
  - Fix the watchdog drivers detection code
  - Add a helper for detecting watchdog drivers
  - Remove a redundant nfs check
  - kdumpctl: split the driver detection from fs dection function
  - kdump.service: use ConditionKernelCommandLine=crashkernel
  - Revert "Append both nofail and x-systemd.before to kdump mount target"
  - Revert "Don's try to restart dracut-initqueue if it's already failed"
  - Fix dump_fs mount point detection and fallback mount
  - kdump.conf: Update doc about core_collector for ssh target
  - Save the final failure information to log file if saving vmcore failed
  - Doc: Improve the kdump sysconfig document
  - kdumpctl: fix a variable expansion in check_fence_kdump_config()
  - Fedora 33 rhpkg build bug


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-44
changelog:
  - module-setup.sh: don't polute the namespace unnecessarily
  - module-setup.sh: don't source $dracutfunctions
  - logger: source the logger file individually
  - dracut-module-setup.sh: enable ForwardToConsole=yes in fadump mode


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-45
changelog:
  - origin/rhel-8.4.0) Revert "Revert "Append both nofail and x-systemd.before to kdump mount target""
  - kdump.conf: add ipv6 example for nfs and ssh dump
  - fix kdump failure of saving vmcore with the scp + ipv6 method


author: Artem Savkov <asavkov@redhat.com> [1-1.el8]
changelog:
  - serspace applications can misuse the KVM API to cause a write of 16 bytes at an offset up to 32 GB from vcpu->run [1954230] {CVE-2021-3501}


author: Yannick Cote <ycote@redhat.com> [1-2.el8]
changelog:
  - kernel: use-after-free in net/bluetooth/hci_event.c when destroying an hci_chan [1962521] {CVE-2021-33034}


author: Artem Savkov <asavkov@redhat.com> [1-3.el8]
changelog:
  - kernel: size_t-to-int conversion vulnerability in the filesystem layer [1975190] {CVE-2021-33909}
  - kernel: race condition for removal of the HCI controller [1971478] {CVE-2021-32399}


author: Artem Savkov <asavkov@redhat.com> [1-4.el8]
changelog:
  - race condition in net/can/bcm.c leads to local privilege escalation [1975066] {CVE-2021-3609}
  - out-of-bounds write in xt_compat_target_from_user() in net/netfilter/x_tables.c [1980520] {CVE-2021-22555}
  - Improper handling of VM_IO|VM_PFNMAP vmas in KVM can bypass RO checks [1975762] {CVE-2021-22543}


author: Filip Januš <fjanus@redhat.com> 5.3.28-42
changelog:
  - Apply the previous change only on aarch64 to limit the risk of unwanted impact
  - Resolves: #1992402


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.4-1
changelog:
  - soname bump to "1"
  - incompatible API changes:
    * bindings: Selection.flags is now an attribute
    * repodata_lookup_num now works like the other lookup_num functions
  - new functions:
    * selection_make_matchsolvable
    * selection_make_matchsolvablelist
    * pool_whatmatchessolvable
    * repodata_search_arrayelement
    * repodata_lookup_kv_uninternalized
    * repodata_search_uninternalized
    * repodata_translate_dir
  - new repowriter interface to write solv files allowing better
    control over what gets written
  - support for filtered file lists with a custom filter
  - dropped support of (since a long time unused) REPOKEY_TYPE_U32
  - selected bug fixes:
    * fix nasty off-by-one error in repo_write
    * do not autouninstall packages because of forcebest updates
    * fixed a couple of null pointer derefs and potential memory
      leaks
    * made disfavoring recommended packages work if strong recommends
      is enabled
    * no longer disable infarch rules when they don't conflict with
      the job
    * repo_add_rpmdb: do not copy bad solvables from the old solv file
    * fix cleandeps updates not updating all packages
  - new features:
    * support rpm's new '^' version separator
    * support set/get_considered_list in bindings
    * new experimental SOLVER_FLAG_ONLY_NAMESPACE_RECOMMENDED flag
    * do favor evaluation before pruning allowing to (dis)favor
      specific package versions
    * bindings: support pool.matchsolvable(), pool.whatmatchessolvable()
      pool.best_solvables() and selection.matchsolvable()
    * experimental DISTTYPE_CONDA and REL_CONDA support


author: Ales Matej <amatej@redhat.org> - 0.7.7-1
changelog:
  - Update to 0.7.7
  - selected bug fixes:
    * fix updating of too many packages in focusbest mode
    * fix handling of disabled installed packages in distupgrade
    * fix repository priority handling for multiversion packages
    * better support of inverval deps in pool_match_dep()
    * support src rpms that have non-empty provides
    * fix favorq leaking between solver runs if the solver is reused
    * fix SOLVER_FLAG_FOCUS_BEST updateing packages without reason
    * be more correct with multiversion packages that obsolete their
      own name
    * allow building with swig-4.0.0
    * lock jobs now take precedence over dup and forcebest jobs
  - new features
    * new POOL_FLAG_WHATPROVIDESWITHDISABLED pool flag 
    * bindings: add get_disabled_list() and set_disabled_list()
    * bindings: add whatcontainsdep()
    * bindings: make the selection filters return the self object
    * MSVC compilation support


author: Ales Matej <amatej@redhat.org> - 0.7.11-1
changelog:
  - Update to 0.7.11
  - selected bug fixes:
    * support arch<->noarch package changes when creating patch
      conflicts from the updateinfo data
    * also support other rpm database types
    * fixed solv_zchunk decoding error if large chunks are used
    * treat retracted pathes as irrelevant
    * made add_update_target work with multiversion installs
  - new features
    * support for SOLVER_BLACKLIST jobs that block the installation of matched
      packages unless they are directly selected by an SOLVER_INSTALL job
    * libsolv now also parses the patch status in the updateinfo parser
    * new solvable_matchessolvable() function
    * support conda constrains dependencies
    * new rpm_stat_database() function
    * new rpm_hash_database_state() function


author: Nicola Sella <nsella@redhat.com> - 0.7.16-1
changelog:
  - Update to 0.7.16
  - selected bug fixes:
    * make testcase_mangle_repo_names deal correctly with freed repos
    [bnc#1177238]
    * fix add_complex_recommends() selecting conflicted packages in
      rare cases leading to crashes
    * improve choicerule generation so that package updates are
      prefered in more cases
    * fix deduceq2addedmap clearing bits outside of the map
    * conda: feature depriorization and fix startswith implementation
    * Fix solvable swapping messing up idarrays
    * fix ruleinfo of complex dependencies returning the wrong origin
    * fix solv_zchunk decoding error if large chunks are used
      [bnc#1159314]
  - new features
    * new testcase_mangle_repo_names() function
    * new solv_fmemopen() function
    * Enable zstd compression support for sle15 and sle15-sp2
    * Support blacklisted packages in solver_findproblemrule()
      [bnc#1172135]
    * Support rules with multiple negative literals in choice rule
      generation
    * build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
      multiple rpm database backends
    * added two new function to make libzypp independent of the rpm
      database format
    * support conda constrains dependencies


author: David King <dking@redhat.com> - 2.9.7-9.1
changelog:
  - Fix CVE-2021-3516 (#1956975)
  - Fix CVE-2021-3517 (#1957000)
  - Fix CVE-2021-3518 (#1957027)
  - Fix CVE-2021-3537 (#1957283)


author: Xiao Ni <xni@redhat.com> - 4.1.12
changelog:
  - Update mdadm to latest upstream && change tmpfiles directory && correct changelog date
  - Resolves rhbz#1800521 and rhbz#1657265


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20200609-1
changelog:
  - Update Intel CPU microcode to microcode-20200609 release (#1845967):
    - Fixed a typo in the release note file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20200609-2
changelog:
  - Blacklist latest microcode revision for 06-[89]e-0x CPUs (AML-Y,
    CFL-H/S/U/Xeon E, CML-Y, KBL-G/H/S/X/U/Y/Xeon E3 v6, WHL-U) on Dell systems,
    use revision 0xae/0xb4/0xb8 by default, provide the latest revision
    and intermediate revision 0xca in caveats (#1807960, #1846097).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20200609-3
changelog:
  - Add README file to the documentation directory.
  - Add publicly-sourced codenames list to supply to gen_provides.sh; update
    the latter to handle the somewhat different format.
  - Add SUMMARY.intel-ucode file containing metadata information from
    the microcode file headers.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20201027-1
changelog:
  - Update Intel CPU microcode to microcode-20201027 release, addresses
    CVE-2020-8694, CVE-2020-8695, CVE-2020-8696, CVE-2020-8698
    (#1893266, #1893254, #1893234):
    - Addition of 06-55-0b/0xbf (CPX-SP A1) microcode at revision 0x700001e;
    - Addition of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode at revision 0x68;
    - Addition of 06-a5-02/0x20 (CML-H R1) microcode at revision 0xe0;
    - Addition of 06-a5-03/0x22 (CML-S 6+2 G1) microcode at revision 0xe0;
    - Addition of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode at revision 0xe0;
    - Addition of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode at revision
      0xe0;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xdc up to 0xe2;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006906 up
      to 0x2006a08;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xdc up to 0xe2;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xd6 up
      to 0xe0;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xd6 up to 0xde;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xd6 up
      to 0xde;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xd6 up
      to 0xde;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      from revision 0x43 up to 0x44;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000157
      up to 0x1000159;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4002f01
      up to 0x4003003;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5002f01 up to 0x5003003;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x38 up
      to 0x40;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x16 up
      to 0x1e;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x16 up
      to 0x18;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0x78
      up to 0xa0;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xca
      up to 0xe0.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20201112-1
changelog:
  - Update Intel CPU microcode to microcode-20201112 release (#1896912):
    - Addition of 06-8a-01/0x10 (LKF B2/B3) microcode at revision 0x28;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x32 up
      to 0x34;
    - Updated releasenote file.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20201112-2
changelog:
  - Do not use "grep -q" in a pipe in check_caveats (#1902021).
  - Add 06-55-04/06-55-06/06-55-07 (SKX-SP/CLX-SP) microcode-20201110 caveats
    (#1902884).


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20210216-1
changelog:
  - Update Intel CPU microcode to microcode-20210216 release (#1902884):
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a08 up
      to 0x2006a0a;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003003
      up to 0x4003006;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003003 up to 0x5003006.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20210216-1.20210525.1
changelog:
  - Update Intel CPU microcode to microcode-20210525 release, addresses
    CVE-2020-24489, CVE-2020-24511, CVE-2020-24512, and CVE-2020-24513
    (#1962663, #1962713, #1962733, #1962679):
    - Addition of 06-55-05/0xb7 (CLX-SP A0) microcode at revision 0x3000010;
    - Addition of 06-6a-05/0x87 (ICX-SP C0) microcode at revision 0xc0002f0;
    - Addition of 06-6a-06/0x87 (ICX-SP D0) microcode at revision 0xd0002a0;
    - Addition of 06-86-04/0x01 (SNR B0) microcode at revision 0xb00000f;
    - Addition of 06-86-05/0x01 (SNR B1) microcode (in intel-ucode/06-86-04)
      at revision 0xb00000f;
    - Addition of 06-86-04/0x01 (SNR B0) microcode (in intel-ucode/06-86-05)
      at revision 0xb00000f;
    - Addition of 06-86-05/0x01 (SNR B1) microcode at revision 0xb00000f;
    - Addition of 06-8c-02/0xc2 (TGL-R C0) microcode at revision 0x16;
    - Addition of 06-8d-01/0xc2 (TGL-H R0) microcode at revision 0x2c;
    - Addition of 06-96-01/0x01 (EHL B1) microcode at revision 0x11;
    - Addition of 06-9c-00/0x01 (JSL A0/A1) microcode at revision 0x1d;
    - Addition of 06-a7-01/0x02 (RKL-S B0) microcode at revision 0x40;
    - Update of 06-4e-03/0xc0 (SKL-U/U 2+3e/Y D0/K1) microcode (in
      intel-06-4e-03/intel-ucode/06-4e-03) from revision 0xe2 up to 0xea;
    - Update of 06-4f-01/0xef (BDX-E/EP/EX/ML B0/M0/R0) microcode (in
      intel-06-4f-01/intel-ucode/06-4f-01) from revision 0xb000038 up
      to 0xb00003e;
    - Update of 06-55-04/0xb7 (SKX-D/SP/W/X H0/M0/M1/U0) microcode (in
      intel-06-55-04/intel-ucode/06-55-04) from revision 0x2006a0a up
      to 0x2006b06;
    - Update of 06-5e-03/0x36 (SKL-H/S/Xeon E3 N0/R0/S0) microcode (in
      intel-06-5e-03/intel-ucode/06-5e-03) from revision 0xe2 up to 0xea;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0x68 up to 0x88;
    - Update of 06-8e-09/0x10 (AML-Y 2+2 H0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up
      to 0xea;
    - Update of 06-8e-09/0xc0 (KBL-U/U 2+3e/Y H0/J1) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-09) from revision 0xde up
      to 0xea;
    - Update of 06-8e-0a/0xc0 (CFL-U 4+3e D0, KBL-R Y0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0a) from revision 0xe0 up
      to 0xea;
    - Update of 06-8e-0b/0xd0 (WHL-U W0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0b) from revision 0xde up
      to 0xea;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xde up to 0xea;
    - Update of 06-9e-09/0x2a (KBL-G/H/S/X/Xeon E3 B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-09) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0a/0x22 (CFL-H/S/Xeon E U0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0a) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0b/0x02 (CFL-E/H/S B0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0b) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0c/0x22 (CFL-H/S/Xeon E P0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0c) from revision 0xde up
      to 0xea;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0xde up
      to 0xea;
    - Update of 06-3f-02/0x6f (HSX-E/EN/EP/EP 4S C0/C1/M1/R2) microcode
      from revision 0x44 up to 0x46;
    - Update of 06-3f-04/0x80 (HSX-EX E0) microcode from revision 0x16 up
      to 0x19;
    - Update of 06-55-03/0x97 (SKX-SP B1) microcode from revision 0x1000159
      up to 0x100015b;
    - Update of 06-55-06/0xbf (CLX-SP B0) microcode from revision 0x4003006
      up to 0x4003102;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003006 up to 0x5003102;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x700001e
      up to 0x7002302;
    - Update of 06-56-03/0x10 (BDX-DE V2/V3) microcode from revision
      0x7000019 up to 0x700001b;
    - Update of 06-56-04/0x10 (BDX-DE Y0) microcode from revision 0xf000017
      up to 0xf000019;
    - Update of 06-56-05/0x10 (BDX-NS A0/A1, HWL A1) microcode from revision
      0xe00000f up to 0xe000012;
    - Update of 06-5c-09/0x03 (APL D0) microcode from revision 0x40 up
      to 0x44;
    - Update of 06-5c-0a/0x03 (APL B1/F1) microcode from revision 0x1e up
      to 0x20;
    - Update of 06-5f-01/0x01 (DNV B0) microcode from revision 0x2e up
      to 0x34;
    - Update of 06-7a-01/0x01 (GLK B0) microcode from revision 0x34 up
      to 0x36;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x18 up
      to 0x1a;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xa0
      up to 0xa6;
    - Update of 06-8a-01/0x10 (LKF B2/B3) microcode from revision 0x28 up
      to 0x2a;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xe0 up
      to 0xea;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xe0
      up to 0xea;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xe0
      up to 0xec;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xe0
      up to 0xe8;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K0) microcode from revision
      0xe0 up to 0xea.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4:20210216-1.20210525.2
changelog:
  - Make intel-06-2d-07, intel-06-4e-03, intel-06-4f-01, intel-06-55-04,
    intel-06-5e-03, intel-06-8c-01, intel-06-8e-9e-0x-0xca,
    and intel-06-8e-9e-0x-dell caveats dependent on intel caveat.
  - Enable 06-8c-01 microcode update by default (#1972328).
  - Enable 06-5e-03 microcode update by default (#1972325).


author: Steve Dickson <steved@redhat.com> 2.3.3-38
changelog:
  - exports man page: warn about subdirectory exports (bz 1652437)
  - Don't modify /etc/group on upgrades (bz 1856881)
  - nfs-iostat: divide by zero with fresh mount (bz 1861823)
  - nfsiostat: Drop autofs entries before calling compare_iostats() (bz 1859130)
  - nfsdclddb: clddb-tool was recently renamed to nfsdclddb (bz 1893599)


author: Steve Dickson <steved@redhat.com> 2.3.3-39
changelog:
  - systemd: Ingnore export failures in nfs-server.serivce unit (bz 1894873)
  - exports.man: Remove some outdated verbiage (bz 1769688)


author: luto@kernel.org - 1.9-1
changelog:
  - Update to 1.9
  - Certain fabric functionality may not work yet due to missing dracut
    support and missing hostid and hostnqn configuration.


author: Than Ngo <than@redhat.com> - 3.15.0-1
changelog:
  - Resolves: #1847433, rebase to 3.15.0 
  - Resolves: #1851105, PKCS #11 3.0 - baseline provider support
  - Resolves: #1851108, openCryptoki ep11 token: enhanced functionality
  - Resolves: #1851109, openCryptoki key management tool: key deletion function


author: Than Ngo <than@redhat.com> - 3.15.1-1
changelog:
  - Related: #1847433
    upstream fixes:
      - Free generated key in all error cases
      - CCA: Zeroize key buffer to avoid CCA 8/32 error
      - Do not delete the map-btree entry if destroying an object is not allowed
      - Remove now unused header timeb.h
      - TESTCASES: Use FIPS conforming keys for 3DES CBC-MAC test vectors
      - Fix buffer overrun in C_CopyObject
      - TPM: Fix double free in openssl_gen_key


author: Than Ngo <than@redhat.com> - 3.15.1-3
changelog:
  - Resolves: #1902022
     Fix compiling with c++
     Added error message handling for p11sak remove-key command


author: Than Ngo <than@redhat.com> - 3.15.1-7
changelog:
  - Resolves: #1995919, pkcstok_migrate leaves options with multiple strings in opencryptoki.conf options without double-quotes


author: Matus Honek <mhonek@redhat.com> - 2.4.46-6
changelog:
  - Build with LDAP_USE_NON_BLOCKING_TLS (#1594928)
  - Remove unused leftover MozNSS Compat. Layer references (cont.) (#1557967)


author: Petr Pisar <ppisar@redhat.com> - 4:5.26.2-412
changelog:
  - perl-devel requires redhat-rpm-config because of hardened compiler profiles
    (bug #1557667)
  - Do not clobber file bytes in :encoding layer (RT#132833)
  - Fix line numbers in multi-line s/// (RT#131930)
  - Fix parsing extended bracketed character classes (RT#132167)
  - Fix a possibly unitialized memory read in the Perl parser (RT#133074)
  - Fix an infinite loop in the regular expression compiler (RT#133185)


author: Petr Pisar <ppisar@redhat.com> - 4:5.26.2-413
changelog:
  - Adjust tests to gdbm-1.15 (RT#133295)
  - Fix an integer wrap when allocating memory for an environment variable
    (RT#133204)
  - Fix printing a warning about a wide character when matching a regular
    expression while ISO-8859-1 locale is in effect
  - Fix invoking a check for wide characters while ISO-8859-1 locale is in effect


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-416
changelog:
  - 5.26.3 bump (bug #1655526)
  - Fix CVE-2018-18311 (integer overflow leading to buffer overflow) (bug #1654920)
  - Fix CVE-2018-18312 (heap buffer overflow in regcomp.c) (bug #1654922)
  - Fix CVE-2018-18313 (heap buffer overflow read in regcomp.c) (bug #1654924)
  - Fix CVE-2018-18314 (heap based buffer overflow) (bug #1654925)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-417
changelog:
  - Fix Time-Local tests to pass after year 2019 (bug #1807120)
  - Run-require perl(Encode) by perl-libs (bug #1903503)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-419
changelog:
  - Fix CVE-2020-10543 (bug #1839273)
  - Fix CVE-2020-10878 (bug #1839276)
  - Fix a file mode of a perl-example.stp example (bug #1913693)


author: Jan Rybar <jrybar@redhat.com> - 0.115-7
changelog:
  - pkttyagent: polkit-agent-helper-1 timeout leaves tty echo disabled
  - Mitigation of regression caused by fix of CVE-2018-19788
  - Resolves: rhbz#1693781
  - Resolves: rhbz#1693814


author: Victor Stinner <vstinner@python.org> - 3.6.8-30
changelog:
  - Remove downstream 00178-dont-duplicate-flags-in-sysconfig.patch which
    introduced a bug on distutils.sysconfig.get_config_var('LIBPL')
    (rhbz#1851090).


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-31
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-32
changelog:
  - Security fix for CVE-2020-26116: Reject control chars in HTTP method in http.client
  Resolves: rhbz#1883257


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-33
changelog:
  - Add support for upstream architecture names
  https://fedoraproject.org/wiki/Changes/Python_Upstream_Architecture_Names
  Resolves: rhbz#1868003


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-34
changelog:
  - Security fix for CVE-2020-27619: eval() call on content received via HTTP in the CJK codec tests
  Resolves: rhbz#1890237


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-39
changelog:
  - Security fix for CVE-2021-3733: Denial of service when identifying crafted invalid RFCs
  Resolves: rhbz#1995234


author: Neil Horman <nhorman@redhat.com> - 6.8-2
changelog:
  - Fix erroneous message due to bad errno check (bz 1776710)
  - Enable addition of 0 value for fill-watermark (bz 1776710)


author: Vladis Dronov <vdronov@redhat.com> - 6.8-4
changelog:
  - There is no need to hardcode _sbindir anymore, also the old value is incorrect
  - Update the rngd.service file
  - Fix a busyloop bug (bz 1956248)
  - Fix /dev/hwrng permission issue (bz 1955522)


author: Florian Festi <ffesti@redhat.com> - 4.14.3-5
changelog:
  - Don't error out when replacing an invalid signature (#1874062)
  - Raise an expection when erasing a package fails in Python (#1872623)
  - Fix builds on NFS filesystems (#1840728)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-12
changelog:
  - Bump up the limit of signature header to 64MB (#1918777)
  - Add fapolicyd plugin (#1923167)
  - Unblock signals in forked scriptlets (#1913765)
  - Fix ambiguous diagnostics output on file triggers (#1883338)
  - Ensure ELF files get stripped when debuginfo is disabled (#1634084)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-13
changelog:
  - Fix minor issues found by COVSCAN in fapolicyd plugin
  - Actually honor libarchive bcond at configure time (#1902887)


author: Andreas Schneider <asn@redhat.com> - 4.13.2-1
changelog:
  - resolves: #1878109 - Rebase Samba to version 4.13.2
  - resolves: #1872833 - Add samba-winexe subpackage
  - resolves: #1891688 - Fix CVE-2020-14323
  - resolves: #1892633 - Fix CVE-2020-14318
  - resolves: #1892639 - Fix CVE-2020-14383
  - resolves: #1879835 - Fix CVE-2020-1472
  - resolves: #1888990 - Update smb.conf manpages to describe how to apply
                         config changes.
  - resolves: #1869702 - Fix %U substitution for 'valid users' option
  - resolves: #1818038 - Improve FIPS compliance


author: Andreas Schneider <asn@redhat.com> - 4.13.2-2
changelog:
  - related: #1869702 - Fix spoolss crash
  - resolves: #1896736 - Fix name lookups of FreeIPA users
  - resolves: #1899113 - Fix DFS links


author: Andreas Schneider <asn@redhat.com> - 4.13.3-3
changelog:
  - resolves: #1924615 - Fix a memcache bug when cache is full
  - resolves: #1924571 - Ensure that libwbclient has been updated before
                         restarting services


author: Andreas Schneider <asn@redhat.com> - 4.13.3-4
changelog:
  - resolves: #1964314 - Fix ldconfig warning about libsmbldap.so.2
  - resolves: #1964398 - Fix smbd trying to delete files with wrong permissions
  - resolves: #1969831 - Fix memory leak in RPC server


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-59
changelog:
  - Add cron_dbus_chat_system_job() interface
  Resolves: rhbz#1883906
  - Dontaudit firewalld dac_override capability
  Resolves: rhbz#1759010
  - Allow tcsd the setgid capability
  Resolves: rhbz#1898694
  - Allow timedatex dbus chat with cron system domain
  Resolves: rhbz#1883906
  - Allow systemd_hostnamed_t domain to dbus chat with sosreport_t domain
  Resolves: rhbz#1854299
  - Allow pcp-pmcd manage perf_events
  Resolves: rhbz#1901958
  - Label /dev/isst_interface as cpu_device_t
  Resolves: rhbz#1902227
  - Allow ipsec set the context of a SPD entry to the default context
  Resolves: rhbz#1880474
  - Allow sysadm_u user and unconfined_domain_type manage perf_events
  Resolves: rhbz#1901958
  - Add manage_perf_event_perms object permissions set
  Resolves: rhbz#1901958
  - Add perf_event access vectors.
  Resolves: rhbz#1901958
  - Remove "ipa = module" from modules-targeted-contrib.conf
  Resolves: rhbz#1461914


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-60
changelog:
  - Allow wireshark create and use rdma socket
  Resolves: rhbz#1844370
  - Allow to use nnp_transition in pulseaudio_role
  Resolves: rhbz#1854471
  - Allow certmonger fsetid capability
  Resolves: rhbz#1873211
  - Add rsync_sys_admin tunable to allow rsync sys_admin capability
  Resolves: rhbz#1889673
  - Allow sysadm read and write /dev/rfkill
  Resolves: rhbz#1831630
  - Allow staff_u run pam_console_apply
  Resolves: rhbz#1817690
  - Label /dev/vhost-vdpa-[0-9]+ as vhost_device_t
  Resolves: rhbz#1907485


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-61
changelog:
  - Add kpatch_exec() interface
  Resolves: rhbz#1895322
  - Allow rhsmcertd execute kpatch
  Resolves: rhbz#1895322
  - Allow openvswitch_t perf_event open permission
  Resolves: rhbz#1916046
  - Allow openvswitch fowner capability and create netlink sockets
  Resolves: rhbz#1883980
  - Add net_broadcast capability to openvswitch_t domain
  Resolves: rhbz#1883980
  - Update interface modutils_read_module_deps to allow caller domain also mmap modules_dep_t files
  Resolves: rhbz#1883980
  - Allow machinectl to run pull-tar
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-62
changelog:
  - Allow rhsmcertd_t domain transition to kpatch_t
  Resolves: rhbz#1895322
  - Revert "Add kpatch_exec() interface"
  Resolves: rhbz#1895322
  - Revert "Allow rhsmcertd execute kpatch"
  Resolves: rhbz#1895322
  - Dontaudit NetworkManager_t domain to write to kdump temp pipies
  Resolves: rhbz#1842897
  - Allow NetworkManager_t domain to get status of samba services
  Resolves: rhbz#1781806
  - Allow openvswitch create and use xfrm netlink sockets
  Resolves: rhbz#1916046
  - Allow openvswitch_t perf_event write permission
  Resolves: rhbz#1916046
  - Add write_perf_event_perms object permission set
  Related: rhbz#1916046


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-63
changelog:
  - Allow rtkit_daemon_t domain set process nice value in user namespaces
  Resolves: rhbz#1910507
  - Allow gpsd read and write ptp4l_t shared memory.
  Resolves: rhbz#1803845
  - Label /var/run/pcsd-ruby.socket socket with cluster_var_run_t type
  Resolves: rhbz#1804626
  - Allow Certmonger to use opencryptoki services
  Resolves: rhbz#1894132
  - Dontaudit vhostmd to write in /var/lib/rpm/ dir and allow signull rpm
  Resolves: rhbz#1815603
  - Allow rhsmcertd_t read kpatch lib files
  Resolves: rhbz#1895322
  - Allow ipsec_t connectto ipsec_mgmt_t
  Resolves: rhbz#1848355
  - Allow IPsec to use opencryptoki services
  Resolves: rhbz#1894132
  - Allow systemd-importd create /run/systemd/machines.lock file
  Resolves: rhbz#1788055


author: Zdenek Pytela <zpytela@redhat.com> - 3.14.3-64
changelog:
  - Allow unconfined_t and kprop_t to create krb5_0.rcache2 with the right context
  Resolves: rhbz#1874527
  Resolves: rhbz#1877044
  - Allow rhsmcertd bind tcp sockets to a generic node
  Resolves: rhbz#1923985
  - Allow ipsec_mgmt_t mmap ipsec_conf_file_t files
  Resolves: rhbz#1889542
  - Allow strongswan start using swanctl method
  Resolves: rhbz#1889542
  - Allow systemd-importd manage machines.lock file
  Resolves: rhbz#1788055


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-1
changelog:
  - Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
  - Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
  - Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
  - Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
  - Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
  - Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
  - Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
  - Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
  - Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
  - Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
  - Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
  - Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
  - Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
  - Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
  - Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
  - Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
  - Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-3
changelog:
  - Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
  - Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-4
changelog:
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
  - Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-5
changelog:
  - Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-6
changelog:
  - Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
  - Resolves: rhbz#1915395 - Memory leak in the simple access provider
  - Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-9.1
changelog:
  - Resolves: rhbz#1949170 - pam_sss_gss.so doesn't work with large kerberos tickets [rhel-8.4.0.z]
  - Resolves: rhbz#1945656 - No gpo found and ad_gpo_implicit_deny set to True still permits user login [rhel-8.4.0.z]
  - Resolves: rhbz#1945655 - SSSD not detecting subdomain from AD forest (RHEL 8.3) [rhel-8.4.0.z]
  - Resolves: rhbz#1945654 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7 [rhel-8.4.0.z]
  - Resolves: rhbz#1942438 - Wrong default debug level of sssd tools [rhel-8.4.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-9.2
changelog:
  - Resolves: rhbz#1985456 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8.4.0.z]


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-6
changelog:
  - Pull upstream fix for ioctl evdev bitset decoding, fix the tests (#1747214).
  - Include commit v4.26~65 "s390x: beautify sthyi data tail prints" (#1747514).
  - Include upstream patches that fix issues reported by covscan (#1747526):
    91281fec "v4l2: avoid shifting left a signed number by 31 bit",
    522ad3a0 "syscall.c: avoid infinite loop in subcalls parsing",
    9446038e "kvm: avoid bogus vcpu_info assignment in vcpu_register", and
    2b64854e "xlat: use unsgined type for mount_flags fallback values".


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-7
changelog:
  - Fix printing stack traces for early syscalls on process attach (#1790053):
    69b2c33a "unwind-libdw: fix initialization of libdwfl cache" and
    8e515c74 "tests: add strace-k-p test".
  - Properly decode struct sockaddr_hci without hci_channel field.
  - Update tests-m32/ioctl_evdev.c and tests-mx32/ioctl_evdev.c
    in 0002-evdev-fix-decoding-of-EVIOCGBIT-0.patch.
  - Update tests-m32/Makefile.in and tests-mx32/Makefile.in
    in 0032-tests-check-decoding-of-successful-evdev-ioctl.patch.


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-8
changelog:
  - Fix expected alignment for IPC tests (#1795251):
    4377e3a1 "tests: fix expected output for some ipc tests", and
    a75c7c4b "tests: fix -a argument in ipc_msgbuf-Xraw test".
  - Update tests-m32/looping_threads.test and tests-mx32/looping_threads.test
    in 0025-tests-check-tracing-of-looping-threads.patch.
  - Update the bpf syscall decoder:
    d6c71dd0 "Fix preprocessor indentation",
    cabd6955 "bpf: print struct bpf_prog_info.gpl_compatible",
    14a9b6ca "bpf: add support for btf_* fields in BPF_MAP_CREATE",
    27bd13d3 "bpf: add support for btf_* fields in struct bpf_map_info",
    d1f90bcd "bpf: add support for *jited_ksyms and *jited_func_lens fields
             in struct bpf_prog_info", and
    940fe50f "bpf: add support for new twelve fields in struct bpf_prog_info".
    c661605b "tests: robustify bpf-obj_get_info_by_fd test against future kernels"


author: Eugene Syromiatnikov <esyr@redhat.com> - 4.24-9
changelog:
  - Fix the "extra tokens at end of #ifdef directive" warning:
    579f2702 "bpf: exclude bit fields from the check".


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-5
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed problem with sudo-1.8.23 and 'who am i'
  Resolves: rhbz#1673886
  - Backporting sudo bug with expired passwords
  Resolves: rhbz#1676819


author: Radovan Sroka <rsroka@redhat.com> - 1.8.25-6
changelog:
  - RHEL 8.1 ERRATUM
  - Fixed The LDAP backend which is not properly parsing sudoOptions,
    resulting in selinux roles not being applied
  Resolves: rhbz#1738326


author: Radovan Sroka <rsroka@redhat.com> - 1.8.28p1-1
changelog:
  - RHEL 8.2 ERRATUM
  - rebase to 1.8.28p1
  Resolves: rhbz#1733961
  - fixed man page for always_set_home
  Resolves: rhbz#1576880
  - sudo does not work with notbefore/after
  Resolves: rhbz#1679508
  - NOTBEFORE showing value of sudoNotAfter Ldap attribute
  Resolves: rhbz#1715516
  - CVE-2019-14287 sudo
  - Privilege escalation via 'Runas' specification with 'ALL' keyword
  Resolves: rhbz#1760697


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-7
changelog:
  - RHEL 8.4 ERRATUM
  - CVE-2021-3156
  Resolves: rhbz#1917734
  - CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
  Resolves: rhzb#1916434
  - CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
  Resolves: rhbz#1917038
  - updated upstream url
  Resolves: rhbz#1923825


author: RAdovan Sroka <rsroka@redhat.com> - 1.8.29-7.1
changelog:
  RHEL 8.4.0 ZSTREAM ERRATUM
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#2015136


author: systemd maintenance team <systemd-maint@redhat.com> - 239-39
changelog:
  - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793533)
  - device: don't emit PropetiesChanged needlessly (#1793533)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-40
changelog:
  - units: add generic boot-complete.target (#1872243)
  - man: document new "boot-complete.target" unit (#1872243)
  - core: make sure to restore the control command id, too (#1829867)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-42
changelog:
  - logind: don't print warning when user@.service template is masked (#1880270)
  - build: use simple project version in pkgconfig files (#1862714)
  - basic/virt: try the /proc/1/sched hack also for PID1 (#1868877)
  - seccomp: rework how the S[UG]ID filter is installed (#1860374)
  - vconsole-setup: downgrade log message when setting font fails on dummy console (#1889996)
  - units: fix systemd.special man page reference in system-update-cleanup.service (#1871827)
  - units: drop reference to sushell man page (#1871827)
  - sd-bus: break the loop in bus_ensure_running() if the bus is not connecting (#1885553)
  - core: add new API for enqueing a job with returning the transaction data (#846319)
  - systemctl: replace switch statement by table of structures (#846319)
  - systemctl: reindent table (#846319)
  - systemctl: Only wait when there's something to wait for. (#846319)
  - systemctl: clean up start_unit_one() error handling (#846319)
  - systemctl: split out extra args generation into helper function of its own (#846319)
  - systemctl: add new --show-transaction switch (#846319)
  - test: add some basic testing that "systemctl start -T" does something (#846319)
  - man: document the new systemctl --show-transaction option (#846319)
  - socket: New option 'FlushPending' (boolean) to flush socket before entering listening state (#1870638)
  - core: remove support for API bus "started outside our own logic" (#1764282)
  - mount-setup: fix segfault in mount_cgroup_controllers when using gcc9 compiler (#1868877)
  - dbus-execute: make transfer of CPUAffinity endian safe (#12711) (#1740657)
  - core: add support for setting CPUAffinity= to special "numa" value (#1740657)
  - basic/user-util: always use base 10 for user/group numbers (#1848373)
  - parse-util: sometimes it is useful to check if a string is a valid integer, but not actually parse it (#1848373)
  - basic/parse-util: add safe_atoux64() (#1848373)
  - parse-util: allow tweaking how to parse integers (#1848373)
  - parse-util: allow '-0' as alternative to '0' and '+0' (#1848373)
  - parse-util: make return parameter optional in safe_atou16_full() (#1848373)
  - parse-util: rewrite parse_mode() on top of safe_atou_full() (#1848373)
  - user-util: be stricter in parse_uid() (#1848373)
  - strv: add new macro STARTSWITH_SET() (#1848373)
  - parse-util: also parse integers prefixed with 0b and 0o (#1848373)
  - tests: beef up integer parsing tests (#1848373)
  - shared/user-util: add compat forms of user name checking functions (#1848373)
  - shared/user-util: emit a warning on names with dots (#1848373)
  - user-util: Allow names starting with a digit (#1848373)
  - shared/user-util: allow usernames with dots in specific fields (#1848373)
  - user-util: switch order of checks in valid_user_group_name_or_id_full() (#1848373)
  - user-util: rework how we validate user names (#1848373)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-43
changelog:
  - man: mention System Administrator's Guide in systemctl manpage (#1623116)
  - udev: introduce udev net_id "naming schemes" (#1827462)
  - meson: make net.naming-scheme= default configurable (#1827462)
  - man: describe naming schemes in a new man page (#1827462)
  - udev/net_id: parse _SUN ACPI index as a signed integer (#1827462)
  - udev/net_id: don't generate slot based names if multiple devices might claim the same slot (#1827462)
  - fix typo in ProtectSystem= option (#1871139)
  - remove references of non-existent man pages (#1876807)
  - log: Prefer logging to CLI unless JOURNAL_STREAM is set (#1865840)
  - locale-util: add new helper locale_is_installed() (#1755287)
  - test: add test case for locale_is_installed() (#1755287)
  - tree-wide: port various bits over to locale_is_installed() (#1755287)
  - install: allow instantiated units to be enabled via presets (#1812972)
  - install: small refactor to combine two function calls into one function (#1812972)
  - test: fix a memleak (#1812972)
  - docs: Add syntax for templated units to systemd.preset man page (#1812972)
  - shared/install: fix preset operations for non-service instantiated units (#1812972)
  - introduce setsockopt_int() helper (#1887181)
  - socket-util: add generic socket_pass_pktinfo() helper (#1887181)
  - core: add new PassPacketInfo= socket unit property (#1887181)
  - resolved: tweak cmsg calculation (#1887181)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-44
changelog:
  - ci: PowerTools repo was renamed to powertools in RHEL 8.3 (#1871827)
  - ci: use quay.io instead of Docker Hub to avoid rate limits (#1871827)
  - ci: move jobs from Travis CI to GH Actions (#1871827)
  - unit: make UNIT() cast function deal with NULL pointers (#1871827)
  - use link to RHEL-8 docs (#1623116)
  - cgroup: Also set blkio.bfq.weight (#1657810)
  - units: make sure initrd-cleanup.service terminates before switching to rootfs (#1657810)
  - core: reload SELinux label cache on daemon-reload (#1888912)
  - selinux: introduce mac_selinux_create_file_prepare_at() (#1888912)
  - selinux: add trigger for policy reload to refresh internal selabel cache (#1888912)
  - udev/net_id: give RHEL-8.4 naming scheme a name (#1827462)
  - basic/stat-util: make mtime check stricter and use entire timestamp (#1642728)
  - udev: make algorithm that selects highest priority devlink less susceptible to race conditions (#1642728)
  - test: create /dev/null in test-udev.pl (#1642728)
  - test: missing "die" (#1642728)
  - udev-test: remove a check for whether the test is run in a container (#1642728)
  - udev-test: skip the test only if it can't setup its environment (#1642728)
  - udev-test: fix test skip condition (#1642728)
  - udev-test: fix missing directory test/run (#1642728)
  - udev-test: check if permitted to create block device nodes (#1642728)
  - test-udev: add a testcase of too long line (#1642728)
  - test-udev: use proper semantics for too long line with continuation (#1642728)
  - test-udev: add more tests for line continuations and comments (#1642728)
  - test-udev: add more tests for line continuation (#1642728)
  - test-udev: fix alignment and drop unnecessary white spaces (#1642728)
  - test/udev-test.pl: cleanup if skipping test (#1642728)
  - test: add test cases for empty string match (#1642728)
  - test: add test case for multi matches when use "||" (#1642728)
  - udev-test: do not rely on "mail" group being defined (#1642728)
  - test/udev-test.pl: allow multiple devices per test (#1642728)
  - test/udev-test.pl: create rules only once (#1642728)
  - test/udev-test.pl: allow concurrent additions and removals (#1642728)
  - test/udev-test.pl: use computed devnode name (#1642728)
  - test/udev-test.pl: test correctness of symlink targets (#1642728)
  - test/udev-test.pl: allow checking multiple symlinks (#1642728)
  - test/udev-test.pl: fix wrong test descriptions (#1642728)
  - test/udev-test.pl: last_rule is unsupported (#1642728)
  - test/udev-test.pl: Make some tests a little harder (#1642728)
  - test/udev-test.pl: remove bogus rules from magic subsys test (#1642728)
  - test/udev-test.pl: merge "space and var with space" tests (#1642728)
  - test/udev-test.pl: merge import parent tests into one (#1642728)
  - test/udev-test.pl: count "good" results (#1642728)
  - tests/udev-test.pl: add multiple device test (#1642728)
  - test/udev-test.pl: add repeat count (#1642728)
  - test/udev-test.pl: generator for large list of block devices (#1642728)
  - test/udev-test.pl: suppress umount error message at startup (#1642728)
  - test/udev_test.pl: add "expected good" count (#1642728)
  - test/udev-test: gracefully exit when imports fail (#1642728)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45
changelog:
  - Revert "test: add test cases for empty string match" and "test: add test case for multi matches when use ||" (#1931947)
  - test/sys-script.py: add missing DEVNAME entries to uevents (#1931947)
  - sd-event: split out helper functions for reshuffling prioqs (#1819868)
  - sd-event: split out enable and disable codepaths from sd_event_source_set_enabled() (#1819868)
  - sd-event: mention that two debug logged events are ignored (#1819868)
  - sd-event: split clock data allocation out of sd_event_add_time() (#1819868)
  - sd-event: split out code to add/remove timer event sources to earliest/latest prioq (#1819868)
  - sd-event: fix delays assert brain-o (#17790) (#1819868)
  - sd-event: let's suffix last_run/last_log with "_usec" (#1819868)
  - sd-event: refuse running default event loops in any other thread than the one they are default for (#1819868)
  - sd-event: ref event loop while in sd_event_prepare() ot sd_event_run() (#1819868)
  - sd-event: follow coding style with naming return parameter (#1819868)
  - sd-event: remove earliest_index/latest_index into common part of event source objects (#1819868)
  - sd-event: update state at the end in event_source_enable (#1819868)
  - sd-event: increase n_enabled_child_sources just once (#1819868)
  - sd-event: add ability to ratelimit event sources (#1819868)
  - test: add ratelimiting test (#1819868)
  - core: prevent excessive /proc/self/mountinfo parsing (#1819868)
  - udev: run link_update() with increased retry count in second invocation (#1931947)
  - pam-systemd: use secure_getenv() rather than getenv() (#1687514)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45.1
changelog:
  - Revert "udev: run link_update() with increased retry count in second invocation" (#1963980)
  - Revert "udev: make algorithm that selects highest priority devlink less susceptible to race conditions" (#1963980)
  - test/udev-test.pl: drop test cases that add mutliple devices (#1963980)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45.3
changelog:
  - sd-event: change ordering of pending/ratelimited events (#1984406)
  - sd-event: drop unnecessary "else" (#1984406)
  - sd-event: use CMP() macro (#1984406)
  - sd-event: use usec_add() (#1984406)
  - sd-event: make event_source_time_prioq_reshuffle() accept all event source type (#1984406)
  - sd-event: always reshuffle time prioq on changing online/offline state (#1984406)
  - meson: remove strange dep that causes meson to enter infinite loop (#1984406)
  - copy: handle copy_file_range() weirdness on procfs/sysfs (#1984406)
  - ci: run unit tests on z-stream branches as well (#1984406)
  - remove a left-over break (#1984406)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1792264
    - oracle: turned off NUMA balancing
      resolves: rhbz#1782233
    - man: documented the possibility to apply multiple profiles
      resolves: rhbz#1794337
    - cpu-partitioning: disabled kernel.timer_migration
      resolves: rhbz#1797629
    - profiles: new profile optimize-serial-console
      resolves: rhbz#1840689
    - added support for a post-loaded profile
      resolves: rhbz#1798183
    - plugins: new irqbalance plugin
      resolves: rhbz#1784645
    - throughput-performance: added architecture specific tuning for Marvell ThunderX
      resolves: rhbz#1746961
    - throughput-performance: added architecture specific tuning for AMD
      resolves: rhbz#1746957
    - scheduler: added support for cgroups
      resolves: rhbz#1784648


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.14.0-4
changelog:
  - realtime-virtual-host: remove lapic advancement calculation and
    related qemu-kvm-tools-rhev requirement
    Resolves: rhbz#1845717


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.15.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: rhbz#1874052
    - added plugin service for linux services control
      resolves: rhbz#1869991
    - scheduler: added default_irq_smp_affinity option
      resolves: rhbz#1896348
    - bootloader: skip boom managed BLS snippets
      resolves: rhbz#1901532
    - scheduler: added perf_process_fork option to enable processing of fork
      resolves: rhbz#1894610
    - scheduler: added perf_mmap_pages option to set perf buffer size
      resolves: rhbz#1890219
    - bootloader: fixed cmdline duplication with BLS and grub2-mkconfig
      resolves: rhbz#1777874


author: Patsy Griffin <patsy@redhat.com> - 2020a-1
changelog:
  - Rebase to tzdata-2020a
    - Morocco will spring forward on 2020-05-31 rather than
      previously predicted 2020-05-24.
    - Canada's Yukon region changed to year round UTC -07
      effective 2020-03-08.
    - America/Godthab was renamed to America/Nuuk.


author: Patsy Griffin <patsy@redhat.com> - 2020b-1
changelog:
  - Rebase to tzdata-2020b
    - Yukon timezones represented by America/Whitehorse and
      America/Dawson will change time zone rules from -08/-07 to
      permanent -07 on 2020-11-01, not on 2020-03-08 as 2020a had it.
    - The most recent winter(+08)/summer(+11) transition for Casey Station,
      Antarctica was 2020-10-04 00:01.
    - Remove obsolete files pacificnew, systemv, and yearistype.sh
      from the distribution.


author: Patsy Griffin <patsy@redhat.com> - 2020b-2
changelog:
  - Include the upstream patch to support pacificnew for java tzupdater.
  - Set POSIXRULES macro to continue installing posixrules file.


author: Patsy Griffin <patsy@redhat.com> - 2020c-1
changelog:
  - Rebase to tzdata-2020c
    - Fiji starts DST later than usual, on 2020-12-20.
    - Rearguard now provides an empty file pacificnew to support
      downstream software that expects it.


author: Patsy Griffin <patsy@redhat.com> - 2020d-1
changelog:
  - Rebase to tzdata-2020d
   - Palestine will end summer time on 2020-10-24 rather than the
     predicted 2020-10-31.


author: Patsy Griffin <patsy@redhat.com> - 2020f-1
changelog:
  - Rebase to tzdata-2020f including changes for tzdata-2020e
    - tzdata-2020f fixes a bug in tzdata-2020e that caused an
      invalid zi file in rearguard format
    - Volgograd changes time zone from UTC+04 to UTC+03 on 2020-12-27.
    - Australia/Currie is identical to Australia/Hobart for all
      timestamps since 1970 and was therefore created by mistake,
      now moved to the "backward" file.


author: Patsy Griffin <patsy@redhat.com> - 2021b-1
changelog:
  - Rebase to tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.


author: Patsy Griffin <patsy@redhat.com> - 2019c-1
changelog:
  - Rebase to tzdata-2019c
    - Fiji will observe DST from 2019-11-10 to 2020-01-12.
    - Norfolk Island will begin observing Australian-style DST on 2019-10-06.


author: Patsy Griffin <patsy@redhat.com> - 2021c-1
changelog:
  - Rebase to tzdata-2021c - supersedes tzdata-2021b
    - Revert most of 2021b changes to 'backward'.
    - Fix 'zic -b fat' bug in pre-1970 32-bit data.
    - Fix two Link line typos.
    - Distribute SECURITY file.
  - Includes changes in tzdata-2021b
    - Innclude patch for Mayen
    - Jordan now starts DST on February's last Thursday.
    - Samoa no longer observes DST.
    - Merge more location-based Zones whose timestamps agree since 1970.
    - Move some backward-compatibility links to 'backward'.
    - Rename Pacific/Enderbury to Pacific/Kanton.
    - Correct many pre-1993 transitions in Malawi, Portugal, etc.
    - zic now creates each output file or link atomically.
    - zic -L no longer omits the POSIX TZ string in its output.
    - zic fixes for truncation and leap second table expiration.
    - zic now follows POSIX for TZ strings using all-year DST.
    - Fix some localtime crashes and bugs in obscure cases.
    - zdump -v now outputs more-useful boundary cases.
    - tzfile.5 better matches a draft successor to RFC 8536.


author: Patsy Griffin <patsy@redhat.com> - 2021e-1
changelog:
  - Rebase to tzdata-2021e - supersedes tzdata-2021d
    - Pacific/Fiji suspended DST for the 2021/2022 season.
    - 'zic -r' now marks unspecified timestamps with "-00".
    - Palestine will fall back 2021-10-29 at 01:00, rather
      than the predicted 2021-10-30.


author: Jakub Martisko <jamartis@redhat.com> - 6.0-38
changelog:
  - Fix CVE-2018-1000035 - heap based buffer overflow when opening
    password protected files.
    Resolves: 1537043


author: Jakub Martisko <jamartis@redhat.com> - 6.0-40
changelog:
  - fix several possibly unterminated strings
    When copying to OEM_CP and ISO_CP strings, the string could end unterminated
    (stncpy does not append '\0').
  - Related: #1602721


author: Jakub Martisko <jamartis@redhat.com> - 6.0-45
changelog:
  Fix a false positive zipbomb detection
  Related: 1954649
  Related: 1953565
  Related: 1969876
  Resolves: 1970326


author: Richard W.M. Jones <rjones@redhat.com> - 1.18-1
changelog:
  - New upstream version 1.18.
  - Update RPM description section with complete list of supported guests.
  - If ‘make check’ fails, dump ‘test-suite.log’.


author: Richard W.M. Jones <rjones@redhat.com> - 1.18-8
changelog:
  - Add support for Nutanix AHV
    resolves: rhbz#1756381
  - Add all patches since 1.18 was released, up to 1.20 and beyond.


