# changelog

author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.23-3
changelog:
  - Bump version to 1.4.3.23-3
  - Resolves: Bug 1944494 - support for RFC 4530 entryUUID attribute
  - Resolves: Bug 1967839 - ACIs are being evaluated against the Replication Manager account in a replication context
  - Resolves: Bug 1970259 - A connection can be erroneously flagged as replication conn during evaluation of an aci with ip bind rule
  - Resolves: Bug 1972590 - Large updates can reset the CLcache to the beginning of the changelog
  - Resolves: Bug 1903221 - Memory leak in 389ds backend (Minor)


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.23-4
changelog:
  - Bump version to 1.4.3.23-4
  - Resolves: Bug 1976906 - Instance crash at restart after changelog configuration
  - Resolves: Bug 1480323 - ns-slapd crash at startup - Segmentation fault in strcmpi_fast() when the Referential Integrity log is manually edited
  - Resolves: Bug 1967596 - Temporary password - add CLI and fix compiler errors


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.23-5
changelog:
  - Bump version to 1.4.3.23-5
  - Resolves: Bug 1951020 - Internal unindexed searches in syncrepl
  - Resolves: Bug 1978279 - ds-replcheck state output message has 'Master' instead of 'Supplier'


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.23-6
changelog:
  - Bump version to 1.4.3.23-6
  - Resolves: Bug 1982787 - CRYPT password hash with asterisk allows any bind attempt to succeed


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.23-7
changelog:
  - Bump version to 1.4.3.23-7
  - Resolves: Bug 1983921 - persistent search returns entries even when an error is returned by content-sync-plugin


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.23-8
changelog:
  - Bump version to 1.4.3.23-8
  - Resolves: Bug 1947044 - add missing patch for import result code
  - Resolves: Bug 1944494 - support for RFC 4530 entryUUID attribute


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.23-9
changelog:
  - Bump version to 1.4.3.23-9
  - Resolves: Bug 1947044 - remove unsupported GOST password storage scheme


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.23-10
changelog:
  - Bump version to 1.4.3.23-10
  - Resolves: Bug 1997138 - LDAP server crashes when dnaInterval attribute is set to 0


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.23-11
changelog:
  - Bump version to 1.4.3.23-11
  - Resolves: Bug 2022005 - ipa user-add fails with "gecos: invalid per syntax: Invalid syntax"
  - Resolves: Bug 2021998 - IPA server is very slow in execution of some searches


author: Mark Reynolds <mreynolds@redhat.com> - 1.4.3.23-12
changelog:
  - Bump version to 1.4.3.23-12
  - Resolves: Bug 2024697 - DB corruption "_entryrdn_insert_key - Same DN (dn: nsuniqueid=ffffffff-ffffffff-ffffffff-ffffffff,<SUFFIX>) is already in the entryrdn file"


author: Thierry Bordaz <tbordaz@redhat.com> - 1.4.3.23-13
changelog:
  - Bump version to 1.4.3.23-13
  - Resolves: Bug 2056488 - Paged search lookthroughlimit counter doesnt take read ahead into account
  - Resolves: Bug 2047166 - Based on 1944494 (RFC 4530 entryUUID attribute) - plugin entryuuid failing
  - Resolves: Bug 2056481 - double-free of the virtual attribute context in persistent search


author: Thierry Bordaz <tbordaz@redhat.com> - 1.4.3.23-14
changelog:
  - Bump version to 1.4.3.23-14
  - Resolves: Bug 2059893 - Paged search lookthroughlimit counter doesnt take read ahead into account
  - Resolves: Bug 2060106 - Based on 1944494 (RFC 4530 entryUUID attribute) - plugin entryuuid failing
  - Resolves: Bug 2060110 - double-free of the virtual attribute context in persistent search


author: Wen Liang <wenliang@redhat.com> - 1:1.32.0-1
changelog:
  - update to 1.32.0 release
  - veth: fix null error when deleting the device (rh #1915278)
  - veth: fix crash when deleting the device profile (rh #1915276)
  - firewall: add new "nftables" firewall-backend (rh #1548825)
  - DNS: fix lookup of hostname via DNS (rh #1970335)


author: Wen Liang <wenliang@redhat.com> - 1:1.32.2-1
changelog:
  - update to 1.32.2 release
  - device: prefer IPv6 not-deprecated addresses for hostname lookup (rh #1820770)
  - docs: describe qdiscs and tfilters in nm-settings manpage (rh #1847894)
  - cloud-setup: preserve IPv4 addresses/routes/rules from profile (rh #1971527)
  - daemon: performance improvements (rh #1847125)
  - dhcp/systemd: ignore FORCERENEW requests for DHCPV4 (rh #1961251, CVE-2020-13529)
  - Add bridge_role in 802-3-ethernet.s390-options using nmcli (rh #1935842)


author: Gris Ge <fge@redhat.com> - 1:1.32.4-1
changelog:
  - Upgrade to 1.32.4 with fixes of:
  - nmcli: show DNS SEARCH field in device information. (rh #1852317)
  - device: avoid crash setting VPN config during unrealize. (rh #1912423)
  - core: send ARP announcements when there is carrier. (rh #1956793)
  - core: add ipv[46].required-timeout option to wait for IP configuration while activating. (rh #1961666)
  - core: start DHCPv6 when a prefix delegation is needed for shared mode. (rh #1973199)
  - ifcfg: log warning about invalid keys in ifcfg files. (rh #1959656)
  - cloud-setup: add support for Aliyun cloud. (rh #1823315)


author: Gris Ge <fge@redhat.com> - 1:1.32.6-1
changelog:
  - Upgrade to 1.32.6 release
  - core: fix adding stale local routes when address changes (rh #1979192)
  - dhcp: handle filename/bootfile_name DHCP option and write it to device state
    file for initrd/kickstart (rh #1979387)
  - initrd: add "ib.pkey=" command line option (rh #1805708)
  - core: introduce "keep-configuration" device option to forcefully activate a
    profile on start (rh #1934122)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.32.8-1
changelog:
  - Upgrade to 1.32.8 release
  - firewalld: configure zones on "Reloaded" signal (rh #1982403)
  - ethtool: support configuring newer gigabit ethernet speeds (rh #1897004)
  - core: fix wrong MTU for bridge interfaces (rh #1973536)
  - cloud-setup: fix gateway address for Aliyun cloud (rh #1823315)


author: Wen Liang <wenliang@redhat.com> - 1:1.32.10-1
changelog:
  - update to 1.32.10 release
  - nm-initrd-generator: add kernel command line options ethtool autoneg and speed (rh #1940934)
  - IP: fix the order of IP addresses during service restart (rh #1988751)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.32.10-3
changelog:
  - preserve the IPv6 multicast route added by kernel (rh #2004212)
  - cloud-setup: better handle other route configuration (rh #1977984)


author: Radovan Sroka <rsroka@redhat.com> - 0.16-6
changelog:
  - ported syslog format from rhel7
    resolves: rhbz#1584136
  - fixed crypto problem with libgcrypt
    resolves: rhbz#1584120


author: Radovan Sroka <rsroka@redhat.com> - 0.16-8
changelog:
  - fixed wrong line wrapping of messages in the syslog format
    resolves: rhbz#1628153
  - fixed coverity issues
    resolves: rhbz#1602441
  - fixed crash when processing .dynamic section
    resolves: rhbz#1597250


author: Radovan Sroka <rsroka@redhat.com> - 0.16-9
changelog:
  - Null pointer dereference fix spotted by coverity
    resolves: rhbz#1676487
  - aide.conf needs updates for RHEL 8
    resolves: rhbz#1708015


author: Attila Lakatos <alakatos@redhat.com> - 0.16-12
changelog:
  - RHEL 8.3
  - minor edit of aide.conf
    resolves: rhbz#1740754
  - do not generate false warnings when report_ignore_e2fsattrs is specified in aide.conf
    resolves: rhbz#1806323


author: Nick Clifton <nickc@redhat.com> - 9.35-2
changelog:
  - Correct the directory chosen for 32-bit LLVM and Clang plugins.  (#1884951)
  - Allow the use of the SHF_LINK_ORDER section flag to discard unused notes.  (Experimental).
  - gcc-plugin: Fix test for empty PowerPC sections.  (#1880634)


author: Nick Clifton <nickc@redhat.com> - 9.46-1
changelog:
  - Annocheck: Support enabling/disabling future fails.
  - GCC plugin: Always record global notes for the .text.startup,
    .text.exit, .text.hot and .text.cold sections.
  - Clang plugin: Add -lLLVM to the build command line.
  - Annocheck: Improve reporting of missing -D_FORTIFY_SOURCE option.  (#1898075)
  - Annocheck: Improve reporting of missing LTO option.
  - Add detecting of gimple compiled binaries.
  - Add --without-gcc-plugin option.
  - Annocheck: Fix bug parsing DW_AT_producer.
  - Add test of .note.gnu.property section for PowerPC.
  - Add test of objcopy's ability to merge notes.
  - Record the -flto setting and produce a soft warning if it is absent.
  - Suppress warnings about _D_GLIBCXX_ASSERTIONS if the source code is known to be something other than C++.


author: Nick Clifton <nickc@redhat.com> - 9.49-1
changelog:
  - annocheck: Fix notes analyzer to accept empty PPC64 notes.
  - gcc plugin: Tweak generation of end symbols for PPC64 when LTO is active.  (#1898075)(#1904479)
  - gcc plugin: Add support for GCC 11's cl_vars array.


author: Nick Clifton <nickc@redhat.com> - 9.64-1
changelog:
  - Annocheck: Fix detection of special function names.  (#1934189)
  - Annocheck: FAIL the deliberate use of -fno-stack-protector, but add some exceptions for glibc.  (#1923439)
  - Annocheck: Add colour to some messages.  Skip the deliberate use of -fno-stack-protector.  (#1923439)
  - Annocheck: Fix some problems with tests for missing notes.
  - Add some GO tests to annocheck.
  - Add a future fail for the presence of RPATH in the dynamic tags.
  - Add the ability to disable the warning message about -D_FORTIFY_SOURCE being missing.
  - Workaround for elflint problems with PPC compiled files.  (#1880634)
  - Fix bogus AArch64 test failures.
  - Improved testing by annocheck.  Add fixed format message mode.
  - Fix inconsistency reporting -fcf-protection and -fstack-clash-protection results.
  - Add support for -D_FORTIFY_SOURCE=3.
  - annocheck: When a binary is produced both by GAS and GCC, select GAS as the real producer.  (#1906171)
  - annocheck: Improve test for LTO compiled binaries that do not have -Wall annotations.  (#1906171)


author: Nick Clifton <nickc@redhat.com> - 9.72-1
changelog:
  - Rebase to 9.72.  (#1960299)
  - annocheck: Accept 0 as a valid number for gcc minor versions and release numbers.
  - gcc-plugin: Add support for ARM and RISCV targets.
  - timing: do not initialise the clock if the timing tool is disabled.
  - gcc-plugin: Replace ICE messsages with verbose messages.
  - Fix the testsuite so that it can be run in parallel.
  - Annocheck: WARN if the annobin plugin was built for a newer version of the compiler than the one on which it was run.  (#1950657)
  - Annocheck: Improve detection of missing GNU-stack support.
  - Correct a package rename (bug #1949570)
  - Require docs subpackage by the other ones because of a license
  - Build-requiring perl-interpreter is enough
  - Fix bz1949570
  - Fix anomolies reported by covscan.
  - Move documentation into a sub-package.


author: Nick Clifton <nickc@redhat.com> - 2.30-100
changelog:
  - Do not strip the static BFD library.  (For real this time).  (#1924068)
  - Remove support for ARM v8.6 ISA.  (#1875912)


author: Nick Clifton <nickc@redhat.com> - 2.30-101
changelog:
  - Fix excessive memory consumption in the BFD librart when parsing corrupt DWARF information.  (#1947134)


author: Pavel Raiskup <praiskup@redhat.com> - 3.3.2-4
changelog:
  - fix out-of-bounds read within lha_read_data_none() (CVE-2017-14503)
  - fix crash on crafted 7zip archives (CVE-2019-1000019)
  - fix infinite loop in ISO9660 (CVE-2019-1000020)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.3.2-7
changelog:
  - fix use-after-free in delayed newc link processing (#1602575)
  - fix a few obvious resource leaks and strcpy() misuses (#1602575)


author: Jindrich Novy <jnovy@redhat.com> - 1.11.6-2
changelog:
  - fix chroot: unmount with MNT_DETACH instead of UnmountMountpoints()
  - bug reference 1772179
  - Related: RHELPLAN-25139


author: Jindrich Novy <jnovy@redhat.com> - 1.11.6-7
changelog:
  - fix "CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build process"
  - Resolves: #1819393


author: Jindrich Novy <jnovy@redhat.com> - 1.11.6-9
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.11-rhel
    (https://github.com/containers/buildah/commit/6a746dc)
  - fixes CVE-2021-3602
  - Related: #1977942


author: Jindrich Novy <jnovy@redhat.com> - 1.11.6-10
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.11-rhel
    (https://github.com/containers/buildah/commit/9a4764a)
  - fixes CVE-2022-27649
  - Resolves: #2067545


author: Jindrich Novy <jnovy@redhat.com> - 1.19.3-3
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/a96b716)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.4-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/76beccc)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/1fb260f)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-2
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/db783f4)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-3
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/9dd415b)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-4
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/e5384ed)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.5-5
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/dcd385e)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.6-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/7aedb16)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.19.9-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/c1d6200)
  - fixes CVE-2021-3602
  - Related: #1977943


author: Jindrich Novy <jnovy@redhat.com> - 1.19.9-2
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.19
    (https://github.com/containers/buildah/commit/7c6701d)
  - fixes CVE-2022-27651
  - Resolves: #2067539


author: Jindrich Novy <jnovy@redhat.com> - 1.22.0-0.2
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/main
    (https://github.com/containers/buildah/commit/42dbc97)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1.22.0-0.3
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/main
    (https://github.com/containers/buildah/commit/f517d85)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1.22.0-0.4
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/main
    (https://github.com/containers/buildah/commit/56ff12f)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1.22.0-2
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.22
    (https://github.com/containers/buildah/commit/71b8003)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1.22.0-3
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.22
    (https://github.com/containers/buildah/commit/98960f2)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1.22.3-2
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.22
    (https://github.com/containers/buildah/commit/4d20222)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.23.1-2
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.23
    (https://github.com/containers/buildah/commit/867c1bc)
  - Related: #2021990


author: Sergio Correia <scorreia@redhat.com> - 13-1
changelog:
  - Update to new upstream release, v13
    Resolves: rhbz#1827225
    Resolves: rhbz#1827665
    Resolves: rhbz#1801556
    Resolves: rhbz#1784448
    Resolves: rhbz#1826917
    Resolves: rhbz#1812014


author: Sergio Correia <scorreia@redhat.com> - 15-1
changelog:
  - Update to latest upstream release, v15
    Resolves: rhbz#1887836
    Resolves: rhbz#1853651
    Resolves: rhbz#1874460


author: Marian Csontos <mcsontos@redhat.com> - 2.03.12-3
changelog:
  - Allow extending thin-pool data with writecache on top.
  - Fix removing thin-pool data converted to writeache.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.12-4
changelog:
  - Fix conversion of writecache LVs to thin pool data volume.
  - Add deviceidtype option for lvmdevices.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.12-6
changelog:
  - Fix handling of pmspare by vgsplit, vgmerge and vgremove.
  - Fix detection of active components of external origin volume.


author: Jindrich Novy <jnovy@redhat.com> - 2:2.0.27-2
changelog:
  - switch to master branch to fix /dev/null ownership issues
    (https://github.com/containers/conmon/commit/372fa19211cfeabdb2bad52a4ab8a4d1b0b0063c)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 2:2.0.27-4
changelog:
  - update to the latest content of https://github.com/containers/conmon/tree/master
    (https://github.com/containers/conmon/commit/3161452)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 2:2.0.27-5
changelog:
  - update to the latest content of https://github.com/containers/conmon/tree/master
    (https://github.com/containers/conmon/commit/b033cb5)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 2:2.0.27-6
changelog:
  - update to the latest content of https://github.com/containers/conmon/tree/master
    (https://github.com/containers/conmon/commit/75e067e)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 0.8.1-2
changelog:
  - backport https://github.com/coreos/go-iptables/pull/62
    from Michael Cambria
  - Resolves: #1627561


author: Jindrich Novy <jnovy@redhat.com> - 0.8.6-2
changelog:
  - propagate proper CFLAGS to CGO_CFLAGS to assure code hardening and optimization
  - Related: #1821193


author: Marek Polacek <polacek@redhat.com> 8.4.1-1
changelog:
  - update from GCC 8.4 release (#1868446)
  - remove symlinks to 32-bit versions of these static libraries: libasan.a,
    libitm.a, libquadmath.a, libubsan.a, libgfortran.a (#1779597)


author: Marek Polacek <polacek@redhat.com> 8.5.0-2
changelog:
  - revert upstream PR85873 gcc-8 fix, apply the fix from gcc-9 (#1960701)
  - fix 'this' adjustment for devirtualized call (PR c++/100797, #1965951)


author: Adrian Reber <adrian@lisas.de> - 3.12-0.1
changelog:
  - Updated to 3.12 (pre-release)
  - Create libs subpackage
  - Build against SELinux (Fedora and RHEL8)
  - Build against libbsd (Fedora)


author: Ondrej Kozina <okozina@redhat.com> - 2.2.0-2
changelog:
  - patch: Fix mapped segments overflow on 32bit architectures.
  - patch: Take optimal io size in account with LUKS2 reencryption.
  - Resolves: #1742815 #1746532


author: Ondrej Kozina <okozina@redhat.com> - 2.2.2-1
changelog:
  - Update to cryptsetup 2.2.2
  - LUKS2 reencryption honors activation flags (one time and persistent).
  - LUKS2 reencryption works also without volume keys put in kernel
    keyring service.
  - Resolves: #1757783 #1750680 #1753597 #1743399


author: Ondrej Kozina <okozina@redhat.com> - 2.3.3-2
changelog:
  - patch: Fix possible memory corruption in LUKS2 validation
  	 code in 32bit library.
  - Resolves: #1872294


author: Ondrej Kozina <okozina@redhat.com> - 2.3.3-4
changelog:
  - patch: Fix reencryption for custom devices with data segments
    set to use cipher_null.
  - Resolves: #1927409


author: Simo Sorce <simo@redhat.com> - 2.1.27-0.4rc7
changelog:
  - Add patch form Upstream PR559 to use RC4 implementation from OpenSSL
  - Resolves bz#1618744
  - Fix multilib issue bz#1663120


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-7
changelog:
  - Add 0052-libmultipath-check-for-null-wwid-before-strcmp.patch
    * Missing part of fix for bz #1897815
  - Add 0053-libmultipath-make-find_err_path_by_dev-static.patch
  - Add 0054-multipathd-avoid-io_err_stat-crash-during-shutdown.patch
  - Add 0055-multipathd-avoid-io_err_stat-ABBA-deadlock.patch
  - Add 0056-multipathd-use-get_monotonic_time-in-io_err_stat-cod.patch
  - Add 0057-multipathd-combine-free_io_err_stat_path-and-destroy.patch
  - Add 0058-multipathd-cleanup-logging-for-marginal-paths.patch
    * The above 6 patches fix bz #1920795
  - Add 0059-libmpathpersist-fix-thread-safety-of-default-functio.patch
    * Fixes bz #1913549
  - Resolves: bz #1897815, #1913549, #1920795


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-9
changelog:
  - Add 0060-kpartx-free-loop-device-after-listing-partitions.patch
    * Fixes bz #1925490
  - Add 0061-RH-fix-find_multipaths-in-mpathconf.patch
    * Fixes bz #1921651
  - Resolves: bz #1921651, #1925490


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-11
changelog:
  - Add 0062-libmultipath-select_action-don-t-drop-map-if-alias-c.patch
    * Fall back to WWID names instead of removing existing device
  - Add 0063-libmultipath-check-if-user_friendly_name-is-in-use.patch
    * make sure to choose a user_friendly_name that isn't in use
    * Fixes bz #1937832
  - Add alias_clash CI test
  - Remove unused multipath.conf
  - Resolves: bz #1937832


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-12
changelog:
  - Add 0064-libmultipath-check-udev_device_get_-return-value-to-.patch
    * Fixes bz #1946940
  - Resolves: bz #1946940


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-13
changelog:
  - Add 0065-libmultipath-cleanup-code-to-strip-wwid-trailing-spa.patch
  - Add 0066-multipathd-add-recheck_wwid-option-to-verify-the-pat.patch
  - Add 0067-libmultipath-avoid-infinite-loop-with-bad-vpd-page-8.patch
  - Add 0068-libmultipath-fix-priorities-in-parse_vpd_pg83.patch
  - Add 0069-RH-make-parse_vpd_pg83-match-scsi_id-output.patch
  - Add 0070-multipathd-improve-getting-parent-udevice-in-rescan_.patch
  - Add 0071-multipathd-don-t-trigger-uevent-for-partitions-on-ww.patch
    * add recheck_wwid option
    * Fixes bz #1907904
  - Resolves: bz #1907904


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-17
changelog:
  - Add 0074-mpathpersist-fail-commands-when-no-usable-paths-exis.patch
    * Fixes bz #1984723
  - Add 0075-multipath-print-warning-if-multipathd-is-not-running.patch
    * Fixes bz #1973592
  - Add 0076-multipathd-don-t-access-path-if-it-was-deleted.patch
    * Found by coverity
  - Resolves: bz #1973592, #1984723


author: Omair Majid <omajid@redhat.com> - 3.1.114-2
changelog:
  - Update to .NET SDK 3.1.114 and Runtime 3.1.14
  - Add dotnet-sdk-3.1-source-built-artifacts subpackage
  - Resolves: RHBZ#1946721


author: Omair Majid <omajid@redhat.com> - 5.0.202-2
changelog:
  - Update to .NET SDK 5.0.202 and Runtime 5.0.5
  - Create -source-built-artifacts subpackage
  - Resolves: RHBZ#1947600


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-4.1
changelog:
  - Fix multiple CVEs
  - CVE-2022-23852 expat: integer overflow in function XML_GetBuffer
  - CVE-2021-45960 expat: Large number of prefixed XML attributes on a single tag can crash libexpat
  - CVE-2021-46143 expat: Integer overflow in doProlog in xmlparse.c
  - CVE-2022-22827 Integer overflow in storeAtts in xmlparse.c
  - CVE-2022-22826 Integer overflow in nextScaffoldPart in xmlparse.c
  - CVE-2022-22825 Integer overflow in lookup in xmlparse.c
  - CVE-2022-22824 Integer overflow in defineAttribute in xmlparse.c
  - CVE-2022-22823 Integer overflow in build_model in xmlparse.c
  - CVE-2022-22822 Integer overflow in addBinding in xmlparse.c
  - Resolves: CVE-2022-23852
  - Resolves: CVE-2021-45960
  - Resolves: CVE-2021-46143
  - Resolves: CVE-2022-22827
  - Resolves: CVE-2022-22826
  - Resolves: CVE-2022-22825
  - Resolves: CVE-2022-22824
  - Resolves: CVE-2022-22823
  - Resolves: CVE-2022-22822


author: Tomas Korbar <tkorbar@redhat.com> - 2.2.5-4.2
changelog:
  - Fix multiple CVEs
  - Resolves: CVE-2022-25236
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25315


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.2.1-69
changelog:
  - fencing: add "stonith_status_sleep" parameter to set sleep between
    status calls during STONITH action
    Resolves: rhbz#1780825


author: Alexander Scheel <ascheel@redhat.com> - 3.0.20-1
changelog:
  - Update to FreeRADIUS server version 3.0.20
  - Introduce Python 3 support; resolves: bz#1623069
  - DoS issues due to multithreaded BN_CTX access; resolves: bz#1818809
  - Create tmp files in /run; resolves: bz#1805975


author: Alexander Scheel <ascheel@redhat.com> - 3.0.20-2
changelog:
  - Fix breakage caused by OpenSSL FIPS regression
    Related: bz#1855822
    Related: bz#1810911
    Resolves: bz#1672285


author: Ondrej Holy <oholy@redhat.com> - 2:2.0.0-47.rc4
changelog:
  - Fix SCARD_INSUFFICIENT_BUFFER error (rhbz#1803054)
  - Do not advertise /usb in help output (rhbz#1761144)


author: Jindrich Novy <jnovy@redhat.com> - 0.7.2-4
changelog:
  - replace "fuse-overlayfs segfault" patch with improved one
    due to application to a different context
  - Resolves: #1805015


author: Jindrich Novy <jnovy@redhat.com> - 1.1.2-3
changelog:
  - fix "error bind mounting /dev from host into mount namespace"
    (the openat2 syscall is not yet supported by the RHEL8 kernel)
  - Resolves: #1867447


author: Lukas Javorsky <ljavorsk@redhat.com> - 25.3.34-3
changelog:
  - Use downstream garbd-wrapper and garbd.service to ensure compatibility
  - Add upstream versions of garbd-wrapper (called garbd-systemd) and garbd.service
    in case user want's to use them


author: Lukas Javorsky <ljavorsk@redhat.com> - 25.3.34-4
changelog:
  - Explicitly require the 'procps-ng' package
  - Otherwise it will not require it in the lightweight systems (e.g. containers)
  - and Galera won't work properly


author: Nick Clifton <nickc@redhat.com> - 2.35-3
changelog:
  - Do not enable debuginfod support by default.
  - Add run-time dependency on libdebuginfod library when debuginfod support is enabled.


author: Nick Clifton <nickc@redhat.com> - 2.35-5
changelog:
  - Fix building with LTO enabled.
  - Set the sh_entsize field of the AArch64's PLT section to 0.  (PR 26312)


author: Nick Clifton <nickc@redhat.com> - 9.24-1
changelog:
  - Add support for installing clang and llvm plugins.
  - Temporary suppression of aarch64 pointer size check.  (#1860549)


author: Nick Clifton <nickc@redhat.com> - 9.72-1
changelog:
  - Rebase to 9.72.  (#1957319)
  - annocheck: Accept 0 as a valid number for gcc minor versions and release numbers.
  - gcc-plugin: Add support for ARM and RISCV targets.
  - timing: do not initialise the clock if the timing tool is disabled.
  - gcc-plugin: Replace ICE messsages with verbose messages.
  - Fix the testsuite so that it can be run in parallel.
  - Annocheck: WARN if the annobin plugin was built for a newer version of the compiler than the one on which it was run.  (#1950657)
  - Obsolete annobin < 9.66-1 (bug #1949570)
  - Annocheck: Improve detection of missing GNU-stack support.
  - Correct a package rename (bug #1949570)
  - Require docs subpackage by the other ones because of a license
  - Build-requiring perl-interpreter is enough
  - Fix bz1949570
  - Fix anomolies reported by covscan.
  - Move documentation into a sub-package.
  - gcc-plugin: Use a fixed filename when running in LTO mode.
  - Annocheck: Fix detection of special function names.  (#1934189)
  - Annocheck: FAIL the deliberate use of -fno-stack-protector, but add some exceptions for glibc.  (#1923439)
  - Annocheck: Add colour to some messages.  Skip the deliberate use of -fno-stack-protector.  (#1923439)
  - Annocheck: Fix some problems with tests for missing notes.
  - Split plugins into separate sub-packages
  - Add some GO tests to annocheck.
  - Add a future fail for the presence of RPATH in the dynamic tags.
  - Add the ability to disable the warning message about -D_FORTIFY_SOURCE being missing.
  - Workaround for elflint problems with PPC compiled files.  (#1880634)
  - Fix bogus AArch64 test failures.
  - Improved testing by annocheck.  Add fixed format message mode.
  - Fix inconsistency reporting -fcf-protection and -fstack-clash-protection results.
  - Add support for -D_FORTIFY_SOURCE=3.
  - annocheck: When a binary is produced both by GAS and GCC, select GAS as the real producer.  (#1906171)
  - annocheck: Improve test for LTO compiled binaries that do not have -Wall annotations.  (#1906171)
  - annocheck: Mark a missining -D_FORTIFY_SOURCE as a FAIL.
  - annocheck: Fix notes analyzer to accept empty PPC64 notes.
  - gcc plugin: Tweak generation of end symbols for PPC64 when LTO is active.  (#1898075)
  - gcc plugin: Add support for GCC 11's cl_vars array.
  - Annocheck: Support enabling/disabling future fails.
  - GCC plugin: Always record global notes for the .text.startup,
    .text.exit, .text.hot and .text.cold sections.
  - Clang plugin: Add -lLLVM to the build command line.
  - Annocheck: Improve reporting of missing -D_FORTIFY_SOURCE option.  (#1898075)
  - Annocheck: Improve reporting of missing LTO option.
  - Add detecting of gimple compiled binaries.
  - Add --without-gcc-plugin option.
  - Annocheck: Fix bug parsing DW_AT_producer.
  - Add test of .note.gnu.property section for PowerPC.
  - Add test of objcopy's ability to merge notes.
  - NVR bump for another ELN sidetag rebuild.
  - Record the -flto setting and produce a soft warning if it is absent.
  - Suppress warnings about _D_GLIBCXX_ASSERTIONS if the source code is known to be something other than C++.
  - Correct the directory chosen for 32-bit LLVM and Clang plugins.  (#1884951)
  - Allow the use of the SHF_LINK_ORDER section flag to discard unused notes.  (Experimental).
  - Enable the build and installation of the LLVM and Clang plugins.  (Experimental).
  - gcc-plugin: Fix test for empty PowerPC sections.  (#1880634)
  - annocheck: Add tests for the AArch64 BTI and PAC security features.  (#1862478)
  - gcc plugin: Use a 4 byte offset for PowerPC start symbols, so that they do not break disassemblies.
  - gcc plugin: Correct the detection of 32-bit x86 builds.  (#1876197)
  - gcc plugin: Detect any attempt to access the global_options array.
  - gcc plugin: Do not complain about missing pre-processor options when examining a preprocessed input file.  (#1862718)
  - Use more robust checks for AArch64 options.
  - Detect CLANG compiled assembler that is missing IBT support.


author: Nick Clifton <nickc@redhat.com> - 9.79-1
changelog:
  - Annocheck: Fix spelling mistake in -mstack-realign failure message.  (#1977349)
  - gcc-plugin: Do not record global versions of stack protection settings in LTO mode, if not set.  (#1958954)
  - Annocheck: Remove limit on number of input files.
  - Annocheck: Conditionalize test of DF_PIE_1 flag.
  - clang/llvm plugins: Build with correct security options.
  - Annocheck: Better detection of GO compiler version.
  - Annocheck: Better support for symbolic links.
  - Annocheck: In verbose mode, report the reason for skipping specific tests.  (#1969584)


author: Nick Clifton <nickc@redhat.com> - 9.85-1
changelog:
  - Annocheck: Detect a missing CET note.  (#1991931)
  - Annocheck: Do not report future fails for AArch64 notes.
  - Annocheck: Warn about multiple --debug-file, --debug-rpm and --debug-dir options.
  - Annocheck: Process files in command line order.  (#1988714)
  - Annocheck: Reverse AArch64 PAC+BTI check, ie fail if they are enabled.  (#1984995)
  - Annocheck: Add another test exceptions.
  - Annocheck: Add some more test exceptions.
  - Tests: Skip glibc-notes test if the assembler does not support --generate-missing-build-notes.  (#1978573)
  - Tests: Skip objcopy test if objcopy does not support --merge-notes.


author: Marek Polacek <polacek@redhat.com> 11.1.1-2
changelog:
  - update from Fedora gcc 11.1.1-2
  - fix up mausezahn miscompilation (PR tree-optimization/100566)
  - fix build with removed linux/cyclades.h header (PR sanitizer/100379)
  - add a few Provides: bundled (#1859893)


author: Marek Polacek <polacek@redhat.com> 11.1.1-6
changelog:
  - update from Fedora gcc 11.1.1-6 (#1946782)
    - PRs c++/100876, c++/100879, c++/101106, c/100619, c/100783, fortran/95501,
     fortran/95502, fortran/100283, fortran/101123, inline-asm/100785,
     libstdc++/91488, libstdc++/95833, libstdc++/100806, libstdc++/100940,
     middle-end/100250, middle-end/100307, middle-end/100574,
     middle-end/100684, middle-end/100732, middle-end/100876,
     middle-end/101062, middle-end/101167, target/99842, target/99939,
     target/100310, target/100777, target/100856, target/100871,
     target/101016


author: Marek Polacek <polacek@redhat.com> 11.2.1-1
changelog:
  - update from releases/gcc-11-branch (#1986838)
    - GCC 11.2 release
    - PRs middle-end/101586, rtl-optimization/101562


author: Ray Strode <rstrode@redhat.com> - 40.0-10
changelog:
  - Let customers using vendor nvidia driver choose wayland sessions
    Resolves: #1962211
  - Drop unused patches


author: Ray Strode <rstrode@redhat.com> - 40.0-11
changelog:
  - Read session settings from users even if they've never saved
    before. Needed to support accountsservice templated user
    defaults.
    Related: #1812788


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.28-164.2
changelog:
  - CVE-2022-23218, CVE-2022-23219: Fix buffer overflows in sunrpc clnt_create
    for "unix" and svcunix_create (#2045062).


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.3.6-1
changelog:
  - update to 7.3.6 tagged upstream community sources, see CHANGELOG
  - remove dependency on SAML (not supported in the open source version of Grafana)


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.3.6-2
changelog:
  - change working dir to $GRAFANA_HOME in grafana-cli wrapper (fixes Red Hat BZ #1916083)
  - add pcp-redis-datasource to allow_loading_unsigned_plugins config option


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.7-2
changelog:
  - remove unused cryptographic implementations
  - use cryptographic functions from OpenSSL if FIPS mode is enabled


author: Andreas Gerstmayr <agerstmayr@redhat.com> 7.5.8-1
changelog:
  - update to 7.5.8 tagged upstream community sources, see CHANGELOG
  - remove unused dependencies selfsigned, http-signature and gofpdf


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-36
changelog:
  - Resolves: #1896176 - [RFE] ProxyWebsocketIdleTimeout from httpd
    mod_proxy_wstunnel
  - Resolves: #1847585 - mod_ldap: High CPU usage at apr_ldap_rebind_remove()


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-37
changelog:
  - Resolves: #1883648 - [RFE] Update httpd directive SSLProxyMachineCertificateFile
    to be able to handle certs without matching private key


author: Lubos Uhliarik <luhliari@redhat.com> - 2.4.37-40
changelog:
  - Resolves: #1952557 - mod_proxy_wstunnel.html is a malformed XML
  - Resolves: #1937334 - SSLProtocol with based virtual hosts


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-41
changelog:
  - Resolves: #1680111 - httpd sends reply to HTTPS GET using two TLS records
  - Resolves: #1905613 - mod_ssl does not like valid certificate chain
  - Resolves: #1935742 - [RFE] backport samesite/httponly/secure flags for
    usertrack
  - Resolves: #1972500 - CVE-2021-30641 httpd:2.4/httpd: MergeSlashes regression
  - Resolves: #1968307 - CVE-2021-26690 httpd:2.4/httpd: mod_session NULL pointer
    dereference in parser
  - Resolves: #1934741 - Apache trademark update - new logo


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-42
changelog:
  - Resolves: #2007235 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via
    a crafted request uri-path
  - Resolves: #2014063 - CVE-2021-26691 httpd:2.4/httpd: Heap overflow in
    mod_session


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-43
changelog:
  - Related: #2007235 - CVE-2021-40438 httpd:2.4/httpd: mod_proxy: SSRF via
    a crafted request uri-path


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-43.1
changelog:
  - Resolves: #2035062 - CVE-2021-44790 httpd:2.4/httpd: mod_lua: possible buffer
    overflow when parsing multipart content


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-43.2
changelog:
  - Resolves: #2059256 - CVE-2021-34798 httpd:2.4/httpd: NULL pointer dereference
    via malformed requests
  - Resolves: #2059257 - CVE-2021-39275 httpd:2.4/httpd: out-of-bounds write in
    ap_escape_quotes() via malicious input


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.37-43.3
changelog:
  - Resolves: #2065247 - CVE-2022-22720 httpd:2.4/httpd: HTTP request smuggling
    vulnerability in Apache HTTP Server 2.4.52 and earlier


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-5
changelog:
  - Resolves: #1713606 - Fix hangul preedit commit with mouse click
  - Resolves: #1682157 - Integrate ibus-desktop-testing and test cases


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-13
changelog:
  - Resolves: #1897548 - Rebuild IBus emoji with unicode-emoji-13.0-4 and cldr-emoji-annotation-39-2
  - Rebuild ibusemojigen.h and ibusunicodegen.h
  - Add ibus-1897548-emoji-unicode.patch to lookup Unicode names
  - Add U+32FF to IBusUnicodeData
  - Add ibus-po-1.5.19-20210706.tar.gz


author: Thomas Woerner <twoerner@redhat.com> - 4.9.6-1
changelog:
  - Upstream release FreeIPA 4.9.6
    Related: RHBZ#1945038
  - Revise PKINIT upgrade code
    Resolves: RHBZ#1886837
  - ipa-cert-fix man page: add note about certmonger renewal
    Resolves: RHBZ#1780317
  - Certificate Serial Number issue
    Resolves: RHBZ#1919384


author: Thomas Woerner <twoerner@redhat.com> - 4.9.6-2
changelog:
  - IPA server in debug mode fails to run because time.perf_counter_ns is
    Python 3.7+
    Resolves: RHBZ#1974822
  - Add checks to prevent assigning authentication indicators to internal IPA
    services
    Resolves: RHBZ#1979625
  - Unable to set ipaUserAuthType with stageuser-add
    Resolves: RHBZ#1979605


author: Thomas Woerner <twoerner@redhat.com> - 4.9.6-3
changelog:
  - man page: update ipa-server-upgrade.1
    Resolves: RHBZ#1973273
  - Fall back to krbprincipalname when validating host auth indicators
    Resolves: RHBZ#1979625
  - Add dependency for sssd-winbind-idmap to server-trust-ad
    Resolves: RHBZ#1982211


author: Thomas Woerner <twoerner@redhat.com> - 4.9.6-5
changelog:
  - Catch and log errors when adding CA profiles
    Resolves: RHBZ#1999142
  - selinux policy: allow custodia to access /proc/cpuinfo
    Resolves: RHBZ#1998129
  - extdom: LDAP_INVALID_SYNTAX returned instead of LDAP_NO_SUCH_OBJECT
    Resolves: RHBZ#2000263
  - ipa migrate-ds command fails to warn when compat plugin is enabled
    Resolves: RHBZ#1999992
  - Backport latest test fixes in python3-ipatests
    Resolves: RHBZ#2000553


author: Rafael Jeffman <rjeffman@redhat.com> - 4.9.6-12
changelog:
  - ipa-server-install uninstall: remove tdb files
  - ipa-client-samba uninstall: remove tdb files
    Resolves: RHBZ#2065719


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b07 (EA)
  - Update release notes for 8u302-b07.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-1
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b08 (EA)
  - Update release notes for 8u302-b08.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Martin Balao <mbalao@redhat.com> - 1:1.8.0.302.b08-2
changelog:
  - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
  - Resolves: rhbz#1971679


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-2
changelog:
  - Port FIPS system detection support to OpenJDK 8u
  - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure.
  - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM.
  - Resolves: rhbz#1971679


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07
  - Update release notes for 8u312-b05-shenandoah-merge-2021-10-07.
  - Reduce disk footprint by removing build artifacts by default.
  - Switch to EA mode.
  - Remove non-Free test and demo files from source tarball.
  - Related: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
  - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
  - Resolves: rhbz#2014194


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-2
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b07 (EA)
  - Update release notes for 8u312-b07.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b04 (EA)
  - Update release notes for 8u322-b04.
  - Require tzdata 2021c as of JDK-8274407.
  - Switch to EA mode.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Related: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-1
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b06 (EA)
  - Update release notes for 8u322-b06.
  - Switch to GA mode for final release.
  - Require tzdata 2021e as of JDK-8275766.
  - Update tarball generation script to use git following shenandoah-jdk8u's move to github
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-2
changelog:
  - Fix FIPS issues in native code and with initialisation of java.security.Security
  - Related: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b06 (EA)
  - Update release notes for shenandoah-8u332-b06.
  - Switch to EA mode.
  - Remove JDK-8279077 patch now upstream.
  - Related: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-1
changelog:
  - Update to shenandoah-jdk8u332-b09 (GA)
  - Update release notes for 8u332-b09.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-04-19 @ 1pm PT.
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.6-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+6
  - Update release notes to 11.0.12.0+6
  - Skip 11.0.12.0+5 as 11.0.12.0+6 only adds a test change
  - Resolves: rhbz#1967374


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-1
changelog:
  - Update to jdk-11.0.12.0+7
  - Update release notes to 11.0.12.0+7
  - Switch to GA mode for final release.
  - Resolves: rhbz#1972395


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.12.0.7-2
changelog:
  - Add patch in order to fix java.library.path issue on aarch64 (JDK-8269668)
  - Resolves: rhbz#1994104


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-4
changelog:
  - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.misc.
  - Resolves: rhbz#1997357


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-5
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Reduce disk footprint by removing build artifacts by default.
  - Related: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.7-0.1.ea
changelog:
  - Update to jdk-11.0.13.0+7
  - Update release notes to 11.0.13.0+7
  - Update tarball generation script to use git following OpenJDK 11u's move to github
  - Switch to EA mode for 11.0.13 pre-release builds.
  - Remove non-Free test from source tarball.
  - Drop JDK-8269668 patch which is now applied upstream.
  - Related: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.8-2
changelog:
  - Update to jdk-11.0.12.0+8
  - Update release notes to 11.0.12.0+8
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2012334


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.8-4
changelog:
  - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
  - Resolves: rhbz#2014212


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Replaced hardcoded 11 by featurever where appropriate
  - Fixed comment of `for slowdebug` to correct `any debug`
  - Related: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Update to jdk-11.0.14.0+8
  - Update release notes to 11.0.14.0+8
  - Switch to EA mode for 11.0.14 pre-release builds.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Rename blacklisted.certs to blocked.certs following JDK-8253866
  - Rebase RH1996182 login patch and drop redundant security policy extension after JDK-8269034
  - Related: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-1
changelog:
  - Update to jdk-11.0.14.0+9
  - Update release notes to 11.0.14.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-01-18 @ 1pm PT.
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.8-0.1.ea
changelog:
  - Update to jdk-11.0.15.0+8
  - Update release notes to 11.0.15.0+8
  - Switch to EA mode for 11.0.15 pre-release builds.
  - Rebase RH1996182 FIPS patch after JDK-8254410
  - Related: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-1
changelog:
  - Update to jdk-11.0.15.0+9
  - Update release notes to 11.0.15.0+9
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-2
changelog:
  - Remove security items from release notes that were only in 17u and N/A for 11u
  - Related: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.33-0.5.ea
changelog:
  - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.access.
  - Resolves: rhbz#1996182


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.35-3
changelog:
  - Update release notes to document the major changes between OpenJDK 11 & 17.
  - Resolves: rhbz#1994084


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-1
changelog:
  - January 2022 security update to jdk 17.0.2+8
  - Rebase RH1995150 & RH1996182 patches following JDK-8275863 addition to module-info.java
  - Rename libsvml.so to libjsvml.so following JDK-8276025
  - ** This tarball is embargoed until 2022-01-18 @ 1pm PT. **
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-3
changelog:
  - Update tapsets from IcedTea 6.x repository with fix for JDK-8015774 changes (_heap->_heaps) and @JAVA_SPEC_VER@
  - Update icedtea_sync.sh with a VCS mode that retrieves sources from a Mercurial repository
  - Related: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-5
changelog:
  - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
  - Resolves: rhbz#2018189


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-6
changelog:
  - Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode
  - Resolves: rhbz#2055396


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.5-0.1.ea
changelog:
  - Update to jdk-17.0.3.0+5
  - Update release notes to 17.0.3.0+5
  - Switch to EA mode for 17.0.3 pre-release builds.
  - Add JDK-8283911 to fix bad DEFAULT_PROMOTED_VERSION_PRE value
  - Related: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.6-1
changelog:
  - April 2022 security update to jdk 17.0.3+6
  - Update to jdk-17.0.3.0+6 pre-release tarball (17usec.17.0.3+5-220408)
  - Add JDK-8284548 regression fix missing from pre-release tarball but in jdk-17.0.3+6/jdk-17.0.3-ga
  - Update release notes to 17.0.3.0+6
  - Add missing README.md and generate_source_tarball.sh
  - Introduce tests/tests.yml, based on the one in java-11-openjdk
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
  - Resolves: rhbz#2073575


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.6-2
changelog:
  - JDK-8275082 should be listed as also resolving JDK-8278008 & CVE-2022-21476
  - Related: rhbz#2073575


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.4.1.el8_5]
changelog:
  - [RHEL8.6 BZ 1849234] cifs: report error instead of invalid when revalidating a dentry fails (Ronnie Sahlberg) [2017177 1849234]
  - kthread: Fix PF_KTHREAD vs to_kthread() race (Waiman Long) [2010333 2001497]
  - sched/fair: Ignore percpu threads for imbalance pulls (Waiman Long) [2010333 2001497]
  - kthread: Extract KTHREAD_IS_PER_CPU (Waiman Long) [2010333 2001497]
  - sched: Optimize finish_lock_switch() (Waiman Long) [2010333 2001497]
  - sched/hotplug: Ensure only per-cpu kthreads run during hotplug (Waiman Long) [2010333 2001497]
  - sched: Fix balance_callback() (Waiman Long) [2010333 2001497]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.6.1.el8_5]
changelog:
  - x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically (Prarit Bhargava) [2024678 2021219]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.7.1.el8_5]
changelog:
  - sched: Fix CPU hotplug / tighten is_per_cpu_kthread() (Waiman Long) [2026450 2024869]
  - sched: Prepare to use balance_push in ttwu() (Waiman Long) [2026450 2024869]
  - sched: Don't run cpu-online with balance_push() enabled (Waiman Long) [2026450 2024869]
  - workqueue: Tag bound workers with KTHREAD_IS_PER_CPU (Waiman Long) [2026450 2024869]
  - workqueue: Use cpu_possible_mask instead of cpu_active_mask to break affinity (Waiman Long) [2026450 2024869]
  - sched: Fix hotplug vs CPU bandwidth control (Waiman Long) [2026450 2024869]
  - workqueue: Manually break affinity on hotplug (Waiman Long) [2026450 2024869]
  - sched/hotplug: Consolidate task migration on CPU unplug (Waiman Long) [2026450 2024869]
  - sched/core: Wait for tasks being pushed away on hotplug (Waiman Long) [2026450 2024869]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.8.1.el8_5]
changelog:
  - ice: Fix VF true promiscuous mode (Jonathan Toppins) [2026698 1970643]
  - ice: Remove toggling of antispoof for VF trusted promiscuous mode (Jonathan Toppins) [2026698 1970643]
  - ice: Fix replacing VF hardware MAC to existing MAC filter (Jonathan Toppins) [2026698 1970643]
  - ice: Fix not stopping Tx queues for VFs (Jonathan Toppins) [2026698 1970643]
  - ice: Fix race conditions between virtchnl handling and VF ndo ops (Jonathan Toppins) [2026698 1970643]
  - net/netif_receive_skb_core: Use migrate_disable() (Luis Claudio R. Goncalves) [2027689 2024168]
  - crypto: jitter - consider 32 LSB for APT (Herbert Xu) [2029365 1994390]
  - xfs: fix I_DONTCACHE (Carlos Maiolino) [2028534 2024969]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.9.1.el8_5]
changelog:
  - ixgbe: Revert "bpf, devmap: Move drop error path to devmap for XDP_REDIRECT" (Ken Cox) [2029845 2024240]
  - i40e: Revert "bpf, devmap: Move drop error path to devmap for XDP_REDIRECT" (Stefan Assmann) [2029845 2024225]
  - rcu/nocb: Perform deferred wake up before last idle's need_resched() check (Waiman Long) [2029449 2008340]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.10.1.el8_5]
changelog:
  - selftests: add a test case for mirred egress to ingress (Xin Long) [2024411 1983894]
  - net: sched: act_mirred: drop dst for the direction from egress to ingress (Xin Long) [2024411 1983894]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.11.1.el8_5]
changelog:
  - blk-mq: avoid to iterate over stale request (Ming Lei) [2034396 1997338]
  - rcu: Tighten rcu_advance_cbs_nowake() checks (Daniel Vacek) [2032579 2013408]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.12.1.el8_5]
changelog:
  - tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() (Guillaume Nault) [2021574 2016210]
  - kernel.spec: Add support to use vmlinux.h (Jiri Olsa) [2031053 1989087]
  - spec: Add vmlinux.h to kernel-devel package (Jiri Olsa) [2031053 1989087]
  - x86/mce: Avoid infinite loop for copy from user recovery (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Rename kill_it to kill_current_task (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Recover from poison found while copying from user space (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Delay clearing IA32_MCG_STATUS to the end of do_machine_check() (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Send #MC singal from task work (Prarit Bhargava) [2008789 1999550]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-348.12.2.el8_5]
changelog:
  - vfs: Out-of-bounds write of heap buffer in fs_context.c (Frantisek Hrbata) [2040585 2040586] {CVE-2022-0185}
  - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Bruno Meneguele) [2034864 2034865] {CVE-2021-4155}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-341.el8]
changelog:
  - mptcp: Only send extra TCP acks in eligible socket states (Paolo Abeni) [1997178]
  - mptcp: fix possible divide by zero (Paolo Abeni) [1997178]
  - mptcp: drop tx skb cache (Paolo Abeni) [1997178]
  - mptcp: fix memory leak on address flush (Paolo Abeni) [1997178]
  - ice: Only lock to update netdev dev_addr (Michal Schmidt) [1995868]
  - ice: restart periodic outputs around time changes (Ken Cox) [1992750]
  - ice: Fix perout start time rounding (Ken Cox) [1992750]
  - net/sched: ets: fix crash when flipping from 'strict' to 'quantum' (Davide Caratti) [1981184]
  - ovl: prevent private clone if bind mount is not allowed (Miklos Szeredi) [1993131] {CVE-2021-3732}
  - gfs2: Don't call dlm after protocol is unmounted (Bob Peterson) [1997193]
  - gfs2: don't stop reads while withdraw in progress (Bob Peterson) [1997193]
  - gfs2: Mark journal inodes as "don't cache" (Bob Peterson) [1997193]
  - bpf: bpftool: Add -fno-asynchronous-unwind-tables to BPF Clang invocation (Yauheni Kaliuta) [1997124]
  - perf/x86/intel: Apply mid ACK for small core (Michael Petlan) [1838573]
  - perf/x86/intel/lbr: Zero the xstate buffer on allocation (Michael Petlan) [1838573]
  - perf: Fix task context PMU for Hetero (Michael Petlan) [1838573]
  - perf/x86/intel: Fix fixed counter check warning for some Alder Lake (Michael Petlan) [1838573]
  - perf/x86/lbr: Remove cpuc->lbr_xsave allocation from atomic context (Michael Petlan) [1838573]
  - x86/fpu/xstate: Fix an xstate size check warning with architectural LBRs (Michael Petlan) [1838573]
  - perf/x86/rapl: Add support for Intel Alder Lake (Michael Petlan) [1838573]
  - perf/x86/cstate: Add Alder Lake CPU support (Michael Petlan) [1838573]
  - perf/x86/msr: Add Alder Lake CPU support (Michael Petlan) [1838573]
  - perf/x86/intel/uncore: Add Alder Lake support (Michael Petlan) [1838573]
  - perf: Extend PERF_TYPE_HARDWARE and PERF_TYPE_HW_CACHE (Michael Petlan) [1838573]
  - perf/x86/intel: Add Alder Lake Hybrid support (Michael Petlan) [1838573]
  - perf/x86: Support filter_match callback (Michael Petlan) [1838573]
  - perf/x86/intel: Add attr_update for Hybrid PMUs (Michael Petlan) [1838573]
  - perf/x86: Add structures for the attributes of Hybrid PMUs (Michael Petlan) [1838573]
  - perf/x86: Register hybrid PMUs (Michael Petlan) [1838573]
  - perf/x86: Factor out x86_pmu_show_pmu_cap (Michael Petlan) [1838573]
  - perf/x86: Remove temporary pmu assignment in event_init (Michael Petlan) [1838573]
  - perf/x86/intel: Factor out intel_pmu_check_extra_regs (Michael Petlan) [1838573]
  - perf/x86/intel: Factor out intel_pmu_check_event_constraints (Michael Petlan) [1838573]
  - perf/x86/intel: Factor out intel_pmu_check_num_counters (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for extra_regs (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for event constraints (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for hardware cache event (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for unconstrained (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for counters (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for intel_ctrl (Michael Petlan) [1838573]
  - perf/x86/intel: Hybrid PMU support for perf capabilities (Michael Petlan) [1838573]
  - perf/x86: Track pmu in per-CPU cpu_hw_events (Michael Petlan) [1838573]
  - perf/x86/intel/lbr: Support XSAVES for arch LBR read (Michael Petlan) [1838573]
  - perf/x86/intel/lbr: Support XSAVES/XRSTORS for LBR context switch (Michael Petlan) [1838573]
  - x86/fpu/xstate: Add helpers for LBR dynamic supervisor feature (Michael Petlan) [1838573]
  - x86/fpu/xstate: Support dynamic supervisor feature for LBR (Michael Petlan) [1838573]
  - x86/fpu: Use proper mask to replace full instruction mask (Michael Petlan) [1838573]
  - x86/cpu: Add helper function to get the type of the current hybrid CPU (Michael Petlan) [1838573]
  - x86/cpufeatures: Enumerate Intel Hybrid Technology feature bit (Michael Petlan) [1838573]
  - HID: make arrays usage and value to be the same (Benjamin Tissoires) [1974942]
  - ACPI: PM: s2idle: Invert Microsoft UUID entry and exit (David Arcari) [1960440]
  - platform/x86: amd-pmc: Fix undefined reference to __udivdi3 (David Arcari) [1960440]
  - platform/x86: amd-pmc: Fix missing unlock on error in amd_pmc_send_cmd() (David Arcari) [1960440]
  - platform/x86: amd-pmc: Use return code on suspend (David Arcari) [1960440]
  - platform/x86: amd-pmc: Add new acpi id for future PMC controllers (David Arcari) [1960440]
  - platform/x86: amd-pmc: Add support for ACPI ID AMDI0006 (David Arcari) [1960440]
  - platform/x86: amd-pmc: Add support for logging s0ix counters (David Arcari) [1960440]
  - platform/x86: amd-pmc: Add support for logging SMU metrics (David Arcari) [1960440]
  - platform/x86: amd-pmc: call dump registers only once (David Arcari) [1960440]
  - platform/x86: amd-pmc: Fix SMU firmware reporting mechanism (David Arcari) [1960440]
  - platform/x86: amd-pmc: Fix command completion code (David Arcari) [1960440]
  - usb: pci-quirks: disable D3cold on xhci suspend for s2idle on AMD Renoir (David Arcari) [1960440]
  - ACPI: PM: Only mark EC GPE for wakeup on Intel systems (David Arcari) [1960440]
  - ACPI: PM: Adjust behavior for field problems on AMD systems (David Arcari) [1960440]
  - ACPI: PM: s2idle: Add support for new Microsoft UUID (David Arcari) [1960440]
  - ACPI: PM: s2idle: Add support for multiple func mask (David Arcari) [1960440]
  - ACPI: PM: s2idle: Refactor common code (David Arcari) [1960440]
  - ACPI: PM: s2idle: Use correct revision id (David Arcari) [1960440]
  - ACPI: PM: s2idle: Add missing LPS0 functions for AMD (David Arcari) [1960440]
  - lockd: Fix invalid lockowner cast after vfs_test_lock (Benjamin Coddington) [1986138]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-342.el8]
changelog:
  - selftest: netfilter: add test case for unreplied tcp connections (Florian Westphal) [1991523]
  - netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state (Florian Westphal) [1991523]
  - net/sched: store the last executed chain also for clsact egress (Davide Caratti) [1980537]
  - ice: fix Tx queue iteration for Tx timestamp enablement (Ken Cox) [1999743]
  - perf evsel: Add missing cloning of evsel->use_config_name (Michael Petlan) [1838635]
  - perf Documentation: Document intel-hybrid support (Michael Petlan) [1838635]
  - perf tests: Skip 'perf stat metrics (shadow stat) test' for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Convert perf time to TSC' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Session topology' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Parse and process metrics' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Track with sched_switch' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Skip 'Setup struct perf_event_attr' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Add hybrid cases for 'Roundtrip evsel->name' test (Michael Petlan) [1838635]
  - perf tests: Add hybrid cases for 'Parse event definition strings' test (Michael Petlan) [1838635]
  - perf record: Uniquify hybrid event name (Michael Petlan) [1838635]
  - perf stat: Warn group events from different hybrid PMU (Michael Petlan) [1838635]
  - perf stat: Filter out unmatched aggregation for hybrid event (Michael Petlan) [1838635]
  - perf stat: Add default hybrid events (Michael Petlan) [1838635]
  - perf record: Create two hybrid 'cycles' events by default (Michael Petlan) [1838635]
  - perf parse-events: Support event inside hybrid pmu (Michael Petlan) [1838635]
  - perf parse-events: Compare with hybrid pmu name (Michael Petlan) [1838635]
  - perf parse-events: Create two hybrid raw events (Michael Petlan) [1838635]
  - perf parse-events: Create two hybrid cache events (Michael Petlan) [1838635]
  - perf parse-events: Create two hybrid hardware events (Michael Petlan) [1838635]
  - perf stat: Uniquify hybrid event name (Michael Petlan) [1838635]
  - perf pmu: Add hybrid helper functions (Michael Petlan) [1838635]
  - perf pmu: Save detected hybrid pmus to a global pmu list (Michael Petlan) [1838635]
  - perf pmu: Save pmu name (Michael Petlan) [1838635]
  - perf pmu: Simplify arguments of __perf_pmu__new_alias (Michael Petlan) [1838635]
  - perf jevents: Support unit value "cpu_core" and "cpu_atom" (Michael Petlan) [1838635]
  - tools headers uapi: Update tools's copy of linux/perf_event.h (Michael Petlan) [1838635]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-343.el8]
changelog:
  - rcu: Avoid unneeded function call in rcu_read_unlock() (Waiman Long) [1997500]
  - mt76: connac: do not schedule mac_work if the device is not running (Íñigo Huguet) [1956419 1972045]
  - mt7921e: enable module in config (Íñigo Huguet) [1956419 1972045]
  - Revert tools/power/cpupower: Read energy_perf_bias from sysfs (Steve Best) [1999926]
  - libnvdimm/namespace: Differentiate between probe mapping and runtime mapping (Jeff Moyer) [1795719]
  - libnvdimm/pfn_dev: Don't clear device memmap area during generic namespace probe (Jeff Moyer) [1795719]
  - perf/x86/intel/uncore: Clean up error handling path of iio mapping (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Fix for iio mapping on Skylake Server (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Generic support for the MMIO type of uncore blocks (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Generic support for the PCI type of uncore blocks (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Rename uncore_notifier to uncore_pci_sub_notifier (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Generic support for the MSR type of uncore blocks (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Parse uncore discovery tables (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Expose an Uncore unit to IIO PMON mapping (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Wrap the max dies calculation into an accessor (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Expose an Uncore unit to PMON mapping (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Validate MMIO address before accessing (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Record the size of mapped area (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Fix oops when counting IMC uncore events on some TGL (Michael Petlan) [1837330]
  - crypto: qat - remove unused macro in FW loader (Vladis Dronov) [1920086]
  - crypto: qat - check return code of qat_hal_rd_rel_reg() (Vladis Dronov) [1920086]
  - crypto: qat - report an error if MMP file size is too large (Vladis Dronov) [1920086]
  - crypto: qat - check MMP size before writing to the SRAM (Vladis Dronov) [1920086]
  - crypto: qat - return error when failing to map FW (Vladis Dronov) [1920086]
  - crypto: qat - enable detection of accelerators hang (Vladis Dronov) [1920086]
  - crypto: qat - Fix a double free in adf_create_ring (Vladis Dronov) [1920086]
  - crypto: qat - fix error path in adf_isr_resource_alloc() (Vladis Dronov) [1920086]
  - crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init (Vladis Dronov) [1920086]
  - crypto: qat - don't release uninitialized resources (Vladis Dronov) [1920086]
  - crypto: qat - fix use of 'dma_map_single' (Vladis Dronov) [1920086]
  - crypto: qat - fix unmap invalid dma address (Vladis Dronov) [1920086]
  - crypto: qat - fix spelling mistake: "messge" -> "message" (Vladis Dronov) [1920086]
  - crypto: qat - reduce size of mapped region (Vladis Dronov) [1920086]
  - crypto: qat - change format string and cast ring size (Vladis Dronov) [1920086]
  - crypto: qat - fix potential spectre issue (Vladis Dronov) [1920086]
  - crypto: qat - configure arbiter mapping based on engines enabled (Vladis Dronov) [1920086]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-344.el8]
changelog:
  - perf/x86/intel: Fix PEBS-via-PT reload base value for Extended PEBS (Michael Petlan) [1998051]
  - perf/x86/intel/uncore: Fix Add BW copypasta (Michael Petlan) [1998051]
  - perf/x86/intel/uncore: Add BW counters for GT, IA and IO breakdown (Michael Petlan) [1998051]
  - Revert "ice: Add initial support framework for LAG" (Michal Schmidt) [1999016]
  - net: re-initialize slow_gro flag at gro_list_prepare time (Paolo Abeni) [2002367]
  - cxgb4: dont touch blocked freelist bitmap after free (Rahul Lakkireddy) [1998148]
  - cxgb4vf: configure ports accessible by the VF (Rahul Lakkireddy) [1961329]
  - scsi: lpfc: Fix memory leaks in error paths while issuing ELS RDF/SCR request (Dick Kennedy) [1976332]
  - scsi: lpfc: Keep NDLP reference until after freeing the IOCB after ELS handling (Dick Kennedy) [1976332]
  - scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash (Dick Kennedy) [1976332]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-345.el8]
changelog:
  - e1000e: Do not take care about recovery NVM checksum (Ken Cox) [1984558]
  - qrtr: disable CONFIG_QRTR for non x86_64 archs (Íñigo Huguet) [1999642]
  - ceph: fix possible null-pointer dereference in ceph_mdsmap_decode() (Jeff Layton) [1989999]
  - ceph: fix dereference of null pointer cf (Jeff Layton) [1989999]
  - ceph: correctly handle releasing an embedded cap flush (Jeff Layton) [1989999]
  - ceph: take snap_empty_lock atomically with snaprealm refcount change (Jeff Layton) [1989999]
  - ceph: don't WARN if we're still opening a session to an MDS (Jeff Layton) [1989999]
  - rbd: don't hold lock_rwsem while running_list is being drained (Jeff Layton) [1989999]
  - rbd: always kick acquire on "acquired" and "released" notifications (Jeff Layton) [1989999]
  - ceph: take reference to req->r_parent at point of assignment (Jeff Layton) [1989999]
  - ceph: eliminate ceph_async_iput() (Jeff Layton) [1989999]
  - ceph: don't take s_mutex in ceph_flush_snaps (Jeff Layton) [1989999]
  - ceph: don't take s_mutex in try_flush_caps (Jeff Layton) [1989999]
  - ceph: don't take s_mutex or snap_rwsem in ceph_check_caps (Jeff Layton) [1989999]
  - ceph: eliminate session->s_gen_ttl_lock (Jeff Layton) [1989999]
  - ceph: allow ceph_put_mds_session to take NULL or ERR_PTR (Jeff Layton) [1989999]
  - ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm (Jeff Layton) [1989999]
  - ceph: add some lockdep assertions around snaprealm handling (Jeff Layton) [1989999]
  - ceph: decoding error in ceph_update_snap_realm should return -EIO (Jeff Layton) [1989999]
  - ceph: add IO size metrics support (Jeff Layton) [1989999]
  - ceph: update and rename __update_latency helper to __update_stdev (Jeff Layton) [1989999]
  - ceph: simplify the metrics struct (Jeff Layton) [1989999]
  - libceph: fix doc warnings in cls_lock_client.c (Jeff Layton) [1989999]
  - libceph: remove unnecessary ret variable in ceph_auth_init() (Jeff Layton) [1989999]
  - libceph: kill ceph_none_authorizer::reply_buf (Jeff Layton) [1989999]
  - ceph: make ceph_queue_cap_snap static (Jeff Layton) [1989999]
  - ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty (Jeff Layton) [1989999]
  - libceph: set global_id as soon as we get an auth ticket (Jeff Layton) [1989999]
  - libceph: don't pass result into ac->ops->handle_reply() (Jeff Layton) [1989999]
  - ceph: fix error handling in ceph_atomic_open and ceph_lookup (Jeff Layton) [1989999]
  - ceph: must hold snap_rwsem when filling inode for async create (Jeff Layton) [1989999]
  - libceph: Fix spelling mistakes (Jeff Layton) [1989999]
  - libceph: don't set global_id until we get an auth ticket (Jeff Layton) [1989999]
  - libceph: bump CephXAuthenticate encoding version (Jeff Layton) [1989999]
  - ceph: don't allow access to MDS-private inodes (Jeff Layton) [1989999]
  - ceph: fix up some bare fetches of i_size (Jeff Layton) [1989999]
  - ceph: support getting ceph.dir.rsnaps vxattr (Jeff Layton) [1989999]
  - ceph: drop pinned_page parameter from ceph_get_caps (Jeff Layton) [1989999]
  - ceph: fix inode leak on getattr error in __fh_to_dentry (Jeff Layton) [1989999]
  - ceph: only check pool permissions for regular files (Jeff Layton) [1989999]
  - ceph: send opened files/pinned caps/opened inodes metrics to MDS daemon (Jeff Layton) [1989999]
  - ceph: avoid counting the same request twice or more (Jeff Layton) [1989999]
  - ceph: rename the metric helpers (Jeff Layton) [1989999]
  - ceph: fix kerneldoc copypasta over ceph_start_io_direct (Jeff Layton) [1989999]
  - ceph: don't use d_add in ceph_handle_snapdir (Jeff Layton) [1989999]
  - ceph: don't clobber i_snap_caps on non-I_NEW inode (Jeff Layton) [1989999]
  - ceph: fix fall-through warnings for Clang (Jeff Layton) [1989999]
  - net: ceph: Fix a typo in osdmap.c (Jeff Layton) [1989999]
  - ceph: don't allow type or device number to change on non-I_NEW inodes (Jeff Layton) [1989999]
  - ceph: defer flushing the capsnap if the Fb is used (Jeff Layton) [1989999]
  - ceph: allow queueing cap/snap handling after putting cap references (Jeff Layton) [1989999]
  - ceph: clean up inode work queueing (Jeff Layton) [1989999]
  - ceph: fix flush_snap logic after putting caps (Jeff Layton) [1989999]
  - libceph: fix "Boolean result is used in bitwise operation" warning (Jeff Layton) [1989999]
  - new helper: inode_wrong_type() (Jeff Layton) [1989999]
  - kabi: Adding symbol single_release (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol single_open (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol seq_read (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol seq_printf (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol seq_lseek (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol unregister_chrdev_region (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_init (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_del (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_alloc (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_add (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol alloc_chrdev_region (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol pcie_capability_read_word (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pcie_capability_read_dword (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pcie_capability_clear_and_set_word (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_write_config_dword (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_write_config_byte (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_set_power_state (drivers/pci/pci.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_read_config_dword (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_read_config_byte (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_irq_vector (drivers/pci/msi.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_get_device (drivers/pci/search.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_free_irq_vectors (drivers/pci/msi.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_alloc_irq_vectors_affinity (drivers/pci/msi.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol kexec_crash_loaded (kernel/kexec_core.c) (Čestmír Kalina) [1945491]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-346.el8]
changelog:
  - redhat: switch secureboot kernel image signing to release keys (Bruno Meneguele)
  - CI: handle RT branches in a single config (Veronika Kabatova)
  - CI: Fix RT check branch name (Veronika Kabatova)
  - CI: Drop private CI config (Veronika Kabatova)
  - CI: extend template use (Veronika Kabatova)
  - Revert "Merge: mt7921e: enable new Mediatek wireless hardware" (Bruno Meneguele) [2009501]
  - megaraid_sas: fix concurrent access to ISR between IRQ polling and real interrupt (Tomas Henzl) [2009022]
  - scsi: megaraid_sas: mq_poll support (Tomas Henzl) [2009022]
  - [PATCH v2] scsi: qla2xxx: Suppress unnecessary log messages during login (Nilesh Javali) [1982186]
  - scsi: qla2xxx: Fix excessive messages during device logout (Nilesh Javali) [1982186]
  - PCI: pciehp: Ignore Link Down/Up caused by DPC (Myron Stowe) [1981741]
  - arm64: kpti: Fix "kpti=off" when KASLR is enabled (Mark Salter) [1979731]
  - arm64: Fix CONFIG_ARCH_RANDOM=n build (Mark Salter) [1979731]
  - redhat/configs: aarch64: add CONFIG_ARCH_RANDOM (Mark Salter) [1979731]
  - arm64: Implement archrandom.h for ARMv8.5-RNG (Mark Salter) [1979731]
  - arm64: kconfig: Fix alignment of E0PD help text (Mark Salter) [1979731]
  - arm64: Use register field helper in kaslr_requires_kpti() (Mark Salter) [1979731]
  - arm64: Simplify early check for broken TX1 when KASLR is enabled (Mark Salter) [1979731]
  - arm64: Use a variable to store non-global mappings decision (Mark Salter) [1979731]
  - arm64: Don't use KPTI where we have E0PD (Mark Salter) [1979731]
  - arm64: Factor out checks for KASLR in KPTI code into separate function (Mark Salter) [1979731]
  - redhat/configs: Add CONFIG_ARM64_E0PD (Mark Salter) [1979731]
  - arm64: Add initial support for E0PD (Mark Salter) [1979731]
  - arm64: cpufeature: Export matrix and other features to userspace (Mark Salter) [1980098]
  - arm64: docs: cpu-feature-registers: Document ID_AA64PFR1_EL1 (Mark Salter) [1980098]
  - docs/arm64: cpu-feature-registers: Rewrite bitfields that don't follow [e, s] (Mark Salter) [1980098]
  - docs/arm64: cpu-feature-registers: Documents missing visible fields (Mark Salter) [1980098]
  - arm64: Introduce system_capabilities_finalized() marker (Mark Salter) [1980098]
  - arm64: entry.S: Do not preempt from IRQ before all cpufeatures are enabled (Mark Salter) [1980098]
  - docs/arm64: elf_hwcaps: Document HWCAP_SB (Mark Salter) [1980098]
  - docs/arm64: elf_hwcaps: sort the HWCAP{, 2} documentation by ascending value (Mark Salter) [1980098]
  - arm64: cpufeature: Treat ID_AA64ZFR0_EL1 as RAZ when SVE is not enabled (Mark Salter) [1980098]
  - arm64: cpufeature: Effectively expose FRINT capability to userspace (Mark Salter) [1980098]
  - arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} (Mark Salter) [1980098]
  - arm64: Expose FRINT capabilities to userspace (Mark Salter) [1980098]
  - arm64: Expose ARMv8.5 CondM capability to userspace (Mark Salter) [1980098]
  - docs: arm64: convert perf.txt to ReST format (Mark Salter) [1980098]
  - docs: arm64: convert docs to ReST and rename to .rst (Mark Salter) [1980098]
  - Documentation/arm64: HugeTLB page implementation (Mark Salter) [1980098]
  - Documentation/arm64/sve: Couple of improvements and typos (Mark Salter) [1980098]
  - arm64: cpufeature: Fix missing ZFR0 in __read_sysreg_by_encoding() (Mark Salter) [1980098]
  - arm64: Expose SVE2 features for userspace (Mark Salter) [1980098]
  - arm64: Advertise ARM64_HAS_DCPODP cpu feature (Mark Salter) [1980098]
  - arm64: add CVADP support to the cache maintenance helper (Mark Salter) [1980098]
  - arm64: Fix minor issues with the dcache_by_line_op macro (Mark Salter) [1980098]
  - arm64: Expose DC CVADP to userspace (Mark Salter) [1980098]
  - arm64: Handle trapped DC CVADP (Mark Salter) [1980098]
  - arm64: HWCAP: encapsulate elf_hwcap (Mark Salter) [1980098]
  - arm64: HWCAP: add support for AT_HWCAP2 (Mark Salter) [1980098]
  - x86/MCE/AMD, EDAC/mce_amd: Add new SMCA bank types (Aristeu Rozanski) [1965331]
  - x86/MCE/AMD, EDAC/mce_amd: Remove struct smca_hwid.xec_bitmap (Aristeu Rozanski) [1965331]
  - EDAC, mce_amd: Print ExtErrorCode and description on a single line (Aristeu Rozanski) [1965331]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.el8]
changelog:
  - drm/nouveau/fifo/ga102: initialise chid on return from channel creation (Ben Skeggs) [1997878]
  - drm/nouveau/ga102-: support ttm buffer moves via copy engine (Ben Skeggs) [1997878]
  - drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows (Ben Skeggs) [1997878]
  - drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences (Ben Skeggs) [1997878]
  - drm/nouveau/disp: power down unused DP links during init (Ben Skeggs) [1997878]
  - drm/nouveau: recognise GA107 (Ben Skeggs) [1997878]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.1.1.el8_5]
changelog:
  - lib/timerqueue: Rely on rbtree semantics for next timer (Phil Auld) [2014677 2007099] {CVE-2021-20317}
  - mm/hmm: make HMM_MIRROR an implicit option (Rafael Aquini) [2017519 1998534]
  - mm/hmm: allow HMM_MIRROR on all architectures with MMU (Rafael Aquini) [2017519 1998534]
  - mm: don't select MIGRATE_VMA_HELPER from HMM_MIRROR (Rafael Aquini) [2017519 1998534]
  - mm: sort out the DEVICE_PRIVATE Kconfig mess (Rafael Aquini) [2017519 1998534]
  - ceph: skip existing superblocks that are blocklisted or shut down when mounting (Jeffrey Layton) [2017071 2011462]
  - redhat: switch release to zstream (Bruno Meneguele)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.2.1.el8_5]
changelog:
  - tipc: fix size validations for the MSG_CRYPTO type (Bruno Meneguele) [2020506 2020507] {CVE-2021-43267}
  - net: Fix skb->csum update in inet_proto_csum_replace16(). (Balazs Nemeth) [2005981 1975193]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-348.13.1.el8_5]
changelog:
  - vfs: Out-of-bounds write of heap buffer in fs_context.c (Frantisek Hrbata) [2040585 2040586] {CVE-2022-0185}
  - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Bruno Meneguele) [2034864 2034865] {CVE-2021-4155}
  - af_unix: fix garbage collect vs MSG_PEEK (Patrick Talbert) [2031974 2031975] {CVE-2021-0920}
  - cgroup: verify that source is a string (Waiman Long) [2034608 2034609] {CVE-2021-4154}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-348.14.1.el8_5]
changelog:
  - tcp: fix page frag corruption on page fault (Paolo Abeni) [2041529 1996074]
  - net: fix sk_page_frag() recursion from memory reclaim (Paolo Abeni) [2041529 1996074]
  - KVM: s390: index kvm->arch.idle_mask by vcpu_idx (Thomas Huth) [2040769 2026230]
  - redhat: set LC_ALL=C before sorting config content (Frantisek Hrbata)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.15.1.el8_5]
changelog:
  - net/mlx5: DR, Use FW API when updating FW-owned flow table (Michal Schmidt) [2042663 2042651]
  - KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall (Vitaly Kuznetsov) [2043237 1868572]
  - drm/mgag200: Select clock in PLL update functions (Bruno Meneguele) [2034949 1953926]
  - drm/i915: Fix HAS_LSPCON macro for platforms between GEN9 and GEN10 (Bruno Meneguele) [2027335 2005586]
  - crypto: qat - power up 4xxx device (Vladis Dronov) [2016437 1960307]
  - RDMA/core: Fix a double free in add_port error flow (Kamal Heib) [2038724 2008555]
  - powerpc/iommu: Report the correct most efficient DMA mask for PCI devices (Steve Best) [2018928 2007425]
  - powerpc/dma: Fix dma_map_ops::get_required_mask (Steve Best) [2018928 2007425]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.16.1.el8_5]
changelog:
  - drm/vmwgfx: Fix stale file descriptors on failed usercopy (Dave Airlie) [2047601 2047602] {CVE-2022-22942}
  - net: openvswitch: Fix ct_state nat flags for conns arriving from tc (Marcelo Ricardo Leitner) [2043548 2040334]
  - net: openvswitch: Fix matching zone id for invalid conns arriving from tc (Marcelo Ricardo Leitner) [2043550 2040452]
  - net/sched: flow_dissector: Fix matching on zone id for invalid conns (Marcelo Ricardo Leitner) [2043550 2040452]
  - net/sched: Extend qdisc control block with tc control block (Marcelo Ricardo Leitner) [2043550 2040452]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.17.1.el8_5]
changelog:
  - vfs: check dentry is still valid in get_link() (Ian Kent) [2052558 2014846]
  - xfs: don't expose internal symlink metadata buffers to the vfs (Brian Foster) [2052558 2014846]
  - CI: Use appropriate zstream builder (Veronika Kabatova)
  - CI: Enable baseline realtime checks (Veronika Kabatova)
  - CI: Rename pipelines to include release names (Veronika Kabatova)
  - cgroup-v1: Require capabilities to set release_agent (Waiman Long) [2052166 2052167] {CVE-2022-0492}
  - ice: Remove boolean vlan_promisc flag from function (Jonathan Toppins) [2051951 2030400]
  - ceph: put the requests/sessions when it fails to alloc memory (Jeffrey Layton) [2053725 2017796]
  - ceph: fix off by one bugs in unsafe_request_wait() (Jeffrey Layton) [2053725 2017796]
  - ceph: flush the mdlog before waiting on unsafe reqs (Jeffrey Layton) [2053725 2017796]
  - ceph: flush mdlog before umounting (Jeffrey Layton) [2053725 2017796]
  - ceph: make iterate_sessions a global symbol (Jeffrey Layton) [2053725 2017796]
  - ceph: make ceph_create_session_msg a global symbol (Jeffrey Layton) [2053725 2017796]
  - xfs: check sb_meta_uuid for dabuf buffer recovery (Bill O'Donnell) [2049292 2020764]
  - drm/i915: Flush TLBs before releasing backing store (Patrick Talbert) [2044328 2044329] {CVE-2022-0330}
  - hugetlb: fix hugetlb cgroup refcounting during vma split (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings (Waiman Long) [2039015 2032811]
  - mm/hugetlb: change hugetlb_reserve_pages() to type bool (Waiman Long) [2039015 2032811]
  - hugetlb: fix an error code in hugetlb_reserve_pages() (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: fix offline of hugetlb cgroup with reservations (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: fix reservation accounting (Waiman Long) [2039015 2032811]
  - mm/hugetlb: narrow the hugetlb_lock protection area during preparing huge page (Waiman Long) [2039015 2032811]
  - mm/hugetlb: a page from buddy is not on any list (Waiman Long) [2039015 2032811]
  - mm/hugetlb: not necessary to coalesce regions recursively (Waiman Long) [2039015 2032811]
  - selftests/vm/write_to_hugetlbfs.c: fix unused variable warning (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add hugetlb_cgroup reservation tests (Waiman Long) [2039015 2032811]
  - hugetlb: support file_region coalescing again (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: support noreserve mappings (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add accounting for shared mappings (Waiman Long) [2039015 2032811]
  - hugetlb: disable region_add file_region coalescing (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add reservation accounting for private mappings (Waiman Long) [2039015 2032811]
  - mm/hugetlb_cgroup: fix hugetlb_cgroup migration (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add interface for charge/uncharge hugetlb reservations (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add hugetlb_cgroup reservation counter (Waiman Long) [2039015 2032811]
  - hugetlb: remove duplicated code (Waiman Long) [2039015 2032811]
  - hugetlb: region_chg provides only cache entry (Waiman Long) [2039015 2032811]
  - hugetlbfs: always use address space in inode for resv_map pointer (Waiman Long) [2039015 2032811]
  - hugetlbfs: fix potential over/underflow setting node specific nr_hugepages (Waiman Long) [2039015 2032811]
  - hugetlb: allow to free gigantic pages regardless of the configuration (Waiman Long) [2039015 2032811]
  - powerpc/pseries: Fix update of LPAR security flavor after LPM (Steve Best) [2027448 1997294]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.18.1.el8_5]
changelog:
  - selftests: kvm: Check whether SIDA memop fails for normal guests (Thomas Huth) [2050806 2050807] {CVE-2022-0516}
  - KVM: s390: Return error on SIDA memop on normal guest (Thomas Huth) [2050806 2050807] {CVE-2022-0516}
  - iommu/amd: Remove iommu_init_ga() (Jerry Snitselaar) [2030854 1998265]
  - iommu/amd: Relocate GAMSup check to early_enable_iommus (Jerry Snitselaar) [2030854 1998265]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.19.1.el8_5]
changelog:
  - tipc: improve size validations for received domain records (Xin Long) [2048970 2048971] {CVE-2022-0435}
  - smb3: do not error on fsync when readonly (Ronnie Sahlberg) [2055824 2037811]
  - security: implement sctp_assoc_established hook in selinux (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - security: add sctp_assoc_established hook (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - security: call security_sctp_assoc_request in sctp_sf_do_5_1D_ce (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - security: pass asoc to sctp_assoc_request and sctp_sk_clone (Bruno Meneguele) [2054112 2054117 2015525 2048251]
  - net: sctp: Fix some typos (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - RDMA/bnxt_re: Fix stats counters (Selvin Xavier) [2049684 2001893]
  - net: check skb sec_path when re-initializing slow_gro in gro_list_prepare (Xin Long) [2047427 2030476]
  - cpufreq: intel_pstate: Add Icelake servers support in no-HWP mode (David Arcari) [2036888 2003695]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.20.1.el8_5]
changelog:
  - lib/iov_iter: initialize "flags" in new pipe_buffer (Jan Stancek) [2060874 2060875] {CVE-2022-0847}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.21.1.el8_5]
changelog:
  - netfilter: nf_queue: handle socket prefetch (Florian Westphal) [2061446 2009786]
  - netfilter: nf_queue: fix possible use-after-free (Florian Westphal) [2061446 2009786]
  - selftests: netfilter: add nfqueue TCP_NEW_SYN_RECV socket race test (Florian Westphal) [2061446 2009786]
  - netfilter: nf_queue: don't assume sk is full socket (Florian Westphal) [2061446 2009786]
  - netfilter: nf_tables_offload: incorrect flow offload action array size (Florian Westphal) [2056867 2056728] {CVE-2022-25636}
  - netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create (Florian Westphal) [2056867 2056728] {CVE-2022-25636}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.22.1.el8_5]
changelog:
  - scsi: lpfc: Fix non-recovery of remote ports following an unsolicited LOGO (Dick Kennedy) [2058193 2027558]
  - cifs: check all path components in resolved dfs target (Ronnie Sahlberg) [2056329 2030880]
  - RDMA/cma: Do not change route.addr.src_addr.ss_family (Kamal Heib) [2032073 2032074] {CVE-2021-4028}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.3.1.el8_5]
changelog:
  - net-sysfs: try not to restart the syscall if it will fail eventually (Antoine Tenart) [2021165 2016005]
  - ovl: fix missing negative dentry check in ovl_rename() (Miklos Szeredi) [2016378 2010887 2013318] {CVE-2021-20321}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.4.1.rt7.134.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.4.1.rt7.134.el8_5 [1939539]
  - [RHEL8.6 BZ 1849234] cifs: report error instead of invalid when revalidating a dentry fails (Ronnie Sahlberg) [2017177 1849234]
  - kthread: Fix PF_KTHREAD vs to_kthread() race (Waiman Long) [2010333 2001497]
  - sched/fair: Ignore percpu threads for imbalance pulls (Waiman Long) [2010333 2001497]
  - kthread: Extract KTHREAD_IS_PER_CPU (Waiman Long) [2010333 2001497]
  - sched: Optimize finish_lock_switch() (Waiman Long) [2010333 2001497]
  - sched/hotplug: Ensure only per-cpu kthreads run during hotplug (Waiman Long) [2010333 2001497]
  - sched: Fix balance_callback() (Waiman Long) [2010333 2001497]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.5.1.rt7.135.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.5.1.rt7.135.el8_5 [1939539]
  - blk-mq: still set q->make_request_fn for blk-mq (Ming Lei) [2016384 1999728]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.6.1.rt7.136.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.6.1.rt7.136.el8_5 [1939539]
  - x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically (Prarit Bhargava) [2024678 2021219]
  - sched/vtime: Work around an unitialized variable warning (Leah Leshchinsky)
  - [rt] disable KASAN, KCSAN and UBSAN for kernel-rt (Leah Leshchinsky)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.7.1.rt7.137.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.7.1.rt7.137.el8_5 [1939539]
  - sched/core: Re-add dropped __migrate_disabled() check (Fernando Pacheco)
  - sched: Fix CPU hotplug / tighten is_per_cpu_kthread() (Waiman Long) [2026450 2024869]
  - sched: Prepare to use balance_push in ttwu() (Waiman Long) [2026450 2024869]
  - sched: Don't run cpu-online with balance_push() enabled (Waiman Long) [2026450 2024869]
  - workqueue: Tag bound workers with KTHREAD_IS_PER_CPU (Waiman Long) [2026450 2024869]
  - workqueue: Use cpu_possible_mask instead of cpu_active_mask to break affinity (Waiman Long) [2026450 2024869]
  - sched: Fix hotplug vs CPU bandwidth control (Waiman Long) [2026450 2024869]
  - workqueue: Manually break affinity on hotplug (Waiman Long) [2026450 2024869]
  - sched/hotplug: Consolidate task migration on CPU unplug (Waiman Long) [2026450 2024869]
  - sched/core: Wait for tasks being pushed away on hotplug (Waiman Long) [2026450 2024869]
  - sched/core: Prep code for merging mr1787 (Fernando Pacheco)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.8.1.rt7.138.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.8.1.rt7.138.el8_5 [1939539]
  - ice: Fix VF true promiscuous mode (Jonathan Toppins) [2026698 1970643]
  - ice: Remove toggling of antispoof for VF trusted promiscuous mode (Jonathan Toppins) [2026698 1970643]
  - ice: Fix replacing VF hardware MAC to existing MAC filter (Jonathan Toppins) [2026698 1970643]
  - ice: Fix not stopping Tx queues for VFs (Jonathan Toppins) [2026698 1970643]
  - ice: Fix race conditions between virtchnl handling and VF ndo ops (Jonathan Toppins) [2026698 1970643]
  - net/netif_receive_skb_core: Use migrate_disable() (Luis Claudio R. Goncalves) [2027689 2024168]
  - crypto: jitter - consider 32 LSB for APT (Herbert Xu) [2029365 1994390]
  - xfs: fix I_DONTCACHE (Carlos Maiolino) [2028534 2024969]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.9.1.rt7.139.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.9.1.rt7.139.el8_5 [2032059]
  - ixgbe: Revert "bpf, devmap: Move drop error path to devmap for XDP_REDIRECT" (Ken Cox) [2029845 2024240]
  - i40e: Revert "bpf, devmap: Move drop error path to devmap for XDP_REDIRECT" (Stefan Assmann) [2029845 2024225]
  - rcu/nocb: Perform deferred wake up before last idle's need_resched() check (Waiman Long) [2029449 2008340]
  - locking/rwsem-rt: Remove might_sleep() in __up_read() (Andrew Halaney) [2029422 1903578]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.10.1.rt7.140.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.10.1.rt7.140.el8_5 [2032059]
  - selftests: add a test case for mirred egress to ingress (Xin Long) [2024411 1983894]
  - net: sched: act_mirred: drop dst for the direction from egress to ingress (Xin Long) [2024411 1983894]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.11.1.rt7.141.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.11.1.rt7.141.el8_5 [2032059]
  - blk-mq: avoid to iterate over stale request (Ming Lei) [2034396 1997338]
  - rcu: Tighten rcu_advance_cbs_nowake() checks (Daniel Vacek) [2032579 2013408]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.12.1.rt7.142.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.12.1.rt7.142.el8_5 [2032059]
  - tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() (Guillaume Nault) [2021574 2016210]
  - kernel.spec: Add support to use vmlinux.h (Jiri Olsa) [2031053 1989087]
  - spec: Add vmlinux.h to kernel-devel package (Jiri Olsa) [2031053 1989087]
  - x86/mce: Avoid infinite loop for copy from user recovery (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Rename kill_it to kill_current_task (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Recover from poison found while copying from user space (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Delay clearing IA32_MCG_STATUS to the end of do_machine_check() (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Send #MC singal from task work (Prarit Bhargava) [2008789 1999550]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-348.12.2.rt7.143.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.12.2.rt7.143.el8_5 [2032059]
  - vfs: Out-of-bounds write of heap buffer in fs_context.c (Frantisek Hrbata) [2040580 2040581] {CVE-2022-0185}
  - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Bruno Meneguele) [2034869 2034870] {CVE-2021-4155}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-342.rt7.123.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-342.rt7.123.el8 [1939539]
  - selftest: netfilter: add test case for unreplied tcp connections (Florian Westphal) [1991523]
  - netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state (Florian Westphal) [1991523]
  - net/sched: store the last executed chain also for clsact egress (Davide Caratti) [1980537]
  - ice: fix Tx queue iteration for Tx timestamp enablement (Ken Cox) [1999743]
  - perf evsel: Add missing cloning of evsel->use_config_name (Michael Petlan) [1838635]
  - perf Documentation: Document intel-hybrid support (Michael Petlan) [1838635]
  - perf tests: Skip 'perf stat metrics (shadow stat) test' for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Convert perf time to TSC' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Session topology' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Parse and process metrics' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Track with sched_switch' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Skip 'Setup struct perf_event_attr' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Add hybrid cases for 'Roundtrip evsel->name' test (Michael Petlan) [1838635]
  - perf tests: Add hybrid cases for 'Parse event definition strings' test (Michael Petlan) [1838635]
  - perf record: Uniquify hybrid event name (Michael Petlan) [1838635]
  - perf stat: Warn group events from different hybrid PMU (Michael Petlan) [1838635]
  - perf stat: Filter out unmatched aggregation for hybrid event (Michael Petlan) [1838635]
  - perf stat: Add default hybrid events (Michael Petlan) [1838635]
  - perf record: Create two hybrid 'cycles' events by default (Michael Petlan) [1838635]
  - perf parse-events: Support event inside hybrid pmu (Michael Petlan) [1838635]
  - perf parse-events: Compare with hybrid pmu name (Michael Petlan) [1838635]
  - perf parse-events: Create two hybrid raw events (Michael Petlan) [1838635]
  - perf parse-events: Create two hybrid cache events (Michael Petlan) [1838635]
  - perf parse-events: Create two hybrid hardware events (Michael Petlan) [1838635]
  - perf stat: Uniquify hybrid event name (Michael Petlan) [1838635]
  - perf pmu: Add hybrid helper functions (Michael Petlan) [1838635]
  - perf pmu: Save detected hybrid pmus to a global pmu list (Michael Petlan) [1838635]
  - perf pmu: Save pmu name (Michael Petlan) [1838635]
  - perf pmu: Simplify arguments of __perf_pmu__new_alias (Michael Petlan) [1838635]
  - perf jevents: Support unit value "cpu_core" and "cpu_atom" (Michael Petlan) [1838635]
  - tools headers uapi: Update tools's copy of linux/perf_event.h (Michael Petlan) [1838635]


author: Luis Claudio R. Goncalves <lgoncalv@redhat.com> [4.18.0-342.rt7.124.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-342.rt7.124.el8 [1939539]
  - [rt] wqueue: fix bad unlock balance in destroy_workqueue() [1998682]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-343.rt7.125.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-343.rt7.125.el8 [1939539]
  - rcu: Avoid unneeded function call in rcu_read_unlock() (Waiman Long) [1997500]
  - mt76: connac: do not schedule mac_work if the device is not running (Íñigo Huguet) [1956419 1972045]
  - mt7921e: enable module in config (Íñigo Huguet) [1956419 1972045]
  - Revert tools/power/cpupower: Read energy_perf_bias from sysfs (Steve Best) [1999926]
  - libnvdimm/namespace: Differentiate between probe mapping and runtime mapping (Jeff Moyer) [1795719]
  - libnvdimm/pfn_dev: Don't clear device memmap area during generic namespace probe (Jeff Moyer) [1795719]
  - perf/x86/intel/uncore: Clean up error handling path of iio mapping (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Fix for iio mapping on Skylake Server (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Generic support for the MMIO type of uncore blocks (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Generic support for the PCI type of uncore blocks (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Rename uncore_notifier to uncore_pci_sub_notifier (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Generic support for the MSR type of uncore blocks (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Parse uncore discovery tables (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Expose an Uncore unit to IIO PMON mapping (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Wrap the max dies calculation into an accessor (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Expose an Uncore unit to PMON mapping (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Validate MMIO address before accessing (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Record the size of mapped area (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Fix oops when counting IMC uncore events on some TGL (Michael Petlan) [1837330]
  - crypto: qat - remove unused macro in FW loader (Vladis Dronov) [1920086]
  - crypto: qat - check return code of qat_hal_rd_rel_reg() (Vladis Dronov) [1920086]
  - crypto: qat - report an error if MMP file size is too large (Vladis Dronov) [1920086]
  - crypto: qat - check MMP size before writing to the SRAM (Vladis Dronov) [1920086]
  - crypto: qat - return error when failing to map FW (Vladis Dronov) [1920086]
  - crypto: qat - enable detection of accelerators hang (Vladis Dronov) [1920086]
  - crypto: qat - Fix a double free in adf_create_ring (Vladis Dronov) [1920086]
  - crypto: qat - fix error path in adf_isr_resource_alloc() (Vladis Dronov) [1920086]
  - crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init (Vladis Dronov) [1920086]
  - crypto: qat - don't release uninitialized resources (Vladis Dronov) [1920086]
  - crypto: qat - fix use of 'dma_map_single' (Vladis Dronov) [1920086]
  - crypto: qat - fix unmap invalid dma address (Vladis Dronov) [1920086]
  - crypto: qat - fix spelling mistake: "messge" -> "message" (Vladis Dronov) [1920086]
  - crypto: qat - reduce size of mapped region (Vladis Dronov) [1920086]
  - crypto: qat - change format string and cast ring size (Vladis Dronov) [1920086]
  - crypto: qat - fix potential spectre issue (Vladis Dronov) [1920086]
  - crypto: qat - configure arbiter mapping based on engines enabled (Vladis Dronov) [1920086]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-344.rt7.126.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-344.rt7.126.el8 [1939539]
  - perf/x86/intel: Fix PEBS-via-PT reload base value for Extended PEBS (Michael Petlan) [1998051]
  - perf/x86/intel/uncore: Fix Add BW copypasta (Michael Petlan) [1998051]
  - perf/x86/intel/uncore: Add BW counters for GT, IA and IO breakdown (Michael Petlan) [1998051]
  - Revert "ice: Add initial support framework for LAG" (Michal Schmidt) [1999016]
  - net: re-initialize slow_gro flag at gro_list_prepare time (Paolo Abeni) [2002367]
  - cxgb4: dont touch blocked freelist bitmap after free (Rahul Lakkireddy) [1998148]
  - cxgb4vf: configure ports accessible by the VF (Rahul Lakkireddy) [1961329]
  - scsi: lpfc: Fix memory leaks in error paths while issuing ELS RDF/SCR request (Dick Kennedy) [1976332]
  - scsi: lpfc: Keep NDLP reference until after freeing the IOCB after ELS handling (Dick Kennedy) [1976332]
  - scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash (Dick Kennedy) [1976332]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-345.rt7.127.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-345.rt7.127.el8 [1939539]
  - e1000e: Do not take care about recovery NVM checksum (Ken Cox) [1984558]
  - qrtr: disable CONFIG_QRTR for non x86_64 archs (Íñigo Huguet) [1999642]
  - ceph: fix possible null-pointer dereference in ceph_mdsmap_decode() (Jeff Layton) [1989999]
  - ceph: fix dereference of null pointer cf (Jeff Layton) [1989999]
  - ceph: correctly handle releasing an embedded cap flush (Jeff Layton) [1989999]
  - ceph: take snap_empty_lock atomically with snaprealm refcount change (Jeff Layton) [1989999]
  - ceph: don't WARN if we're still opening a session to an MDS (Jeff Layton) [1989999]
  - rbd: don't hold lock_rwsem while running_list is being drained (Jeff Layton) [1989999]
  - rbd: always kick acquire on "acquired" and "released" notifications (Jeff Layton) [1989999]
  - ceph: take reference to req->r_parent at point of assignment (Jeff Layton) [1989999]
  - ceph: eliminate ceph_async_iput() (Jeff Layton) [1989999]
  - ceph: don't take s_mutex in ceph_flush_snaps (Jeff Layton) [1989999]
  - ceph: don't take s_mutex in try_flush_caps (Jeff Layton) [1989999]
  - ceph: don't take s_mutex or snap_rwsem in ceph_check_caps (Jeff Layton) [1989999]
  - ceph: eliminate session->s_gen_ttl_lock (Jeff Layton) [1989999]
  - ceph: allow ceph_put_mds_session to take NULL or ERR_PTR (Jeff Layton) [1989999]
  - ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm (Jeff Layton) [1989999]
  - ceph: add some lockdep assertions around snaprealm handling (Jeff Layton) [1989999]
  - ceph: decoding error in ceph_update_snap_realm should return -EIO (Jeff Layton) [1989999]
  - ceph: add IO size metrics support (Jeff Layton) [1989999]
  - ceph: update and rename __update_latency helper to __update_stdev (Jeff Layton) [1989999]
  - ceph: simplify the metrics struct (Jeff Layton) [1989999]
  - libceph: fix doc warnings in cls_lock_client.c (Jeff Layton) [1989999]
  - libceph: remove unnecessary ret variable in ceph_auth_init() (Jeff Layton) [1989999]
  - libceph: kill ceph_none_authorizer::reply_buf (Jeff Layton) [1989999]
  - ceph: make ceph_queue_cap_snap static (Jeff Layton) [1989999]
  - ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty (Jeff Layton) [1989999]
  - libceph: set global_id as soon as we get an auth ticket (Jeff Layton) [1989999]
  - libceph: don't pass result into ac->ops->handle_reply() (Jeff Layton) [1989999]
  - ceph: fix error handling in ceph_atomic_open and ceph_lookup (Jeff Layton) [1989999]
  - ceph: must hold snap_rwsem when filling inode for async create (Jeff Layton) [1989999]
  - libceph: Fix spelling mistakes (Jeff Layton) [1989999]
  - libceph: don't set global_id until we get an auth ticket (Jeff Layton) [1989999]
  - libceph: bump CephXAuthenticate encoding version (Jeff Layton) [1989999]
  - ceph: don't allow access to MDS-private inodes (Jeff Layton) [1989999]
  - ceph: fix up some bare fetches of i_size (Jeff Layton) [1989999]
  - ceph: support getting ceph.dir.rsnaps vxattr (Jeff Layton) [1989999]
  - ceph: drop pinned_page parameter from ceph_get_caps (Jeff Layton) [1989999]
  - ceph: fix inode leak on getattr error in __fh_to_dentry (Jeff Layton) [1989999]
  - ceph: only check pool permissions for regular files (Jeff Layton) [1989999]
  - ceph: send opened files/pinned caps/opened inodes metrics to MDS daemon (Jeff Layton) [1989999]
  - ceph: avoid counting the same request twice or more (Jeff Layton) [1989999]
  - ceph: rename the metric helpers (Jeff Layton) [1989999]
  - ceph: fix kerneldoc copypasta over ceph_start_io_direct (Jeff Layton) [1989999]
  - ceph: don't use d_add in ceph_handle_snapdir (Jeff Layton) [1989999]
  - ceph: don't clobber i_snap_caps on non-I_NEW inode (Jeff Layton) [1989999]
  - ceph: fix fall-through warnings for Clang (Jeff Layton) [1989999]
  - net: ceph: Fix a typo in osdmap.c (Jeff Layton) [1989999]
  - ceph: don't allow type or device number to change on non-I_NEW inodes (Jeff Layton) [1989999]
  - ceph: defer flushing the capsnap if the Fb is used (Jeff Layton) [1989999]
  - ceph: allow queueing cap/snap handling after putting cap references (Jeff Layton) [1989999]
  - ceph: clean up inode work queueing (Jeff Layton) [1989999]
  - ceph: fix flush_snap logic after putting caps (Jeff Layton) [1989999]
  - libceph: fix "Boolean result is used in bitwise operation" warning (Jeff Layton) [1989999]
  - new helper: inode_wrong_type() (Jeff Layton) [1989999]
  - kabi: Adding symbol single_release (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol single_open (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol seq_read (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol seq_printf (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol seq_lseek (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol unregister_chrdev_region (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_init (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_del (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_alloc (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_add (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol alloc_chrdev_region (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol pcie_capability_read_word (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pcie_capability_read_dword (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pcie_capability_clear_and_set_word (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_write_config_dword (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_write_config_byte (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_set_power_state (drivers/pci/pci.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_read_config_dword (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_read_config_byte (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_irq_vector (drivers/pci/msi.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_get_device (drivers/pci/search.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_free_irq_vectors (drivers/pci/msi.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_alloc_irq_vectors_affinity (drivers/pci/msi.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol kexec_crash_loaded (kernel/kexec_core.c) (Čestmír Kalina) [1945491]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-346.rt7.128.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-346.rt7.128.el8 [1939539]
  - redhat: switch secureboot kernel image signing to release keys (Bruno Meneguele)
  - CI: handle RT branches in a single config (Veronika Kabatova)
  - CI: Fix RT check branch name (Veronika Kabatova)
  - CI: Drop private CI config (Veronika Kabatova)
  - CI: extend template use (Veronika Kabatova)
  - Revert "Merge: mt7921e: enable new Mediatek wireless hardware" (Bruno Meneguele) [2009501]
  - megaraid_sas: fix concurrent access to ISR between IRQ polling and real interrupt (Tomas Henzl) [2009022]
  - scsi: megaraid_sas: mq_poll support (Tomas Henzl) [2009022]
  - [PATCH v2] scsi: qla2xxx: Suppress unnecessary log messages during login (Nilesh Javali) [1982186]
  - scsi: qla2xxx: Fix excessive messages during device logout (Nilesh Javali) [1982186]
  - PCI: pciehp: Ignore Link Down/Up caused by DPC (Myron Stowe) [1981741]
  - arm64: kpti: Fix "kpti=off" when KASLR is enabled (Mark Salter) [1979731]
  - arm64: Fix CONFIG_ARCH_RANDOM=n build (Mark Salter) [1979731]
  - redhat/configs: aarch64: add CONFIG_ARCH_RANDOM (Mark Salter) [1979731]
  - arm64: Implement archrandom.h for ARMv8.5-RNG (Mark Salter) [1979731]
  - arm64: kconfig: Fix alignment of E0PD help text (Mark Salter) [1979731]
  - arm64: Use register field helper in kaslr_requires_kpti() (Mark Salter) [1979731]
  - arm64: Simplify early check for broken TX1 when KASLR is enabled (Mark Salter) [1979731]
  - arm64: Use a variable to store non-global mappings decision (Mark Salter) [1979731]
  - arm64: Don't use KPTI where we have E0PD (Mark Salter) [1979731]
  - arm64: Factor out checks for KASLR in KPTI code into separate function (Mark Salter) [1979731]
  - redhat/configs: Add CONFIG_ARM64_E0PD (Mark Salter) [1979731]
  - arm64: Add initial support for E0PD (Mark Salter) [1979731]
  - arm64: cpufeature: Export matrix and other features to userspace (Mark Salter) [1980098]
  - arm64: docs: cpu-feature-registers: Document ID_AA64PFR1_EL1 (Mark Salter) [1980098]
  - docs/arm64: cpu-feature-registers: Rewrite bitfields that don't follow [e, s] (Mark Salter) [1980098]
  - docs/arm64: cpu-feature-registers: Documents missing visible fields (Mark Salter) [1980098]
  - arm64: Introduce system_capabilities_finalized() marker (Mark Salter) [1980098]
  - arm64: entry.S: Do not preempt from IRQ before all cpufeatures are enabled (Mark Salter) [1980098]
  - docs/arm64: elf_hwcaps: Document HWCAP_SB (Mark Salter) [1980098]
  - docs/arm64: elf_hwcaps: sort the HWCAP{, 2} documentation by ascending value (Mark Salter) [1980098]
  - arm64: cpufeature: Treat ID_AA64ZFR0_EL1 as RAZ when SVE is not enabled (Mark Salter) [1980098]
  - arm64: cpufeature: Effectively expose FRINT capability to userspace (Mark Salter) [1980098]
  - arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} (Mark Salter) [1980098]
  - arm64: Expose FRINT capabilities to userspace (Mark Salter) [1980098]
  - arm64: Expose ARMv8.5 CondM capability to userspace (Mark Salter) [1980098]
  - docs: arm64: convert perf.txt to ReST format (Mark Salter) [1980098]
  - docs: arm64: convert docs to ReST and rename to .rst (Mark Salter) [1980098]
  - Documentation/arm64: HugeTLB page implementation (Mark Salter) [1980098]
  - Documentation/arm64/sve: Couple of improvements and typos (Mark Salter) [1980098]
  - arm64: cpufeature: Fix missing ZFR0 in __read_sysreg_by_encoding() (Mark Salter) [1980098]
  - arm64: Expose SVE2 features for userspace (Mark Salter) [1980098]
  - arm64: Advertise ARM64_HAS_DCPODP cpu feature (Mark Salter) [1980098]
  - arm64: add CVADP support to the cache maintenance helper (Mark Salter) [1980098]
  - arm64: Fix minor issues with the dcache_by_line_op macro (Mark Salter) [1980098]
  - arm64: Expose DC CVADP to userspace (Mark Salter) [1980098]
  - arm64: Handle trapped DC CVADP (Mark Salter) [1980098]
  - arm64: HWCAP: encapsulate elf_hwcap (Mark Salter) [1980098]
  - arm64: HWCAP: add support for AT_HWCAP2 (Mark Salter) [1980098]
  - x86/MCE/AMD, EDAC/mce_amd: Add new SMCA bank types (Aristeu Rozanski) [1965331]
  - x86/MCE/AMD, EDAC/mce_amd: Remove struct smca_hwid.xec_bitmap (Aristeu Rozanski) [1965331]
  - EDAC, mce_amd: Print ExtErrorCode and description on a single line (Aristeu Rozanski) [1965331]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-347.rt7.129.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-347.rt7.129.el8 [1939539]
  - PCI: Mark TI C667X to avoid bus reset (Alex Williamson) [1975768]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.rt7.130.el8]
changelog:
  - [rt] build kernel-rt-4.18.0-348.rt7.130.el8 [1939539]
  - drm/nouveau/fifo/ga102: initialise chid on return from channel creation (Ben Skeggs) [1997878]
  - drm/nouveau/ga102-: support ttm buffer moves via copy engine (Ben Skeggs) [1997878]
  - drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows (Ben Skeggs) [1997878]
  - drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences (Ben Skeggs) [1997878]
  - drm/nouveau/disp: power down unused DP links during init (Ben Skeggs) [1997878]
  - drm/nouveau: recognise GA107 (Ben Skeggs) [1997878]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.1.1.rt7.131.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.1.1.rt7.131.el8_5 [1939539]
  - lib/timerqueue: Rely on rbtree semantics for next timer (Phil Auld) [2014677 2007099] {CVE-2021-20317}
  - mm/hmm: make HMM_MIRROR an implicit option (Rafael Aquini) [2017519 1998534]
  - mm/hmm: allow HMM_MIRROR on all architectures with MMU (Rafael Aquini) [2017519 1998534]
  - mm: don't select MIGRATE_VMA_HELPER from HMM_MIRROR (Rafael Aquini) [2017519 1998534]
  - mm: sort out the DEVICE_PRIVATE Kconfig mess (Rafael Aquini) [2017519 1998534]
  - ceph: skip existing superblocks that are blocklisted or shut down when mounting (Jeffrey Layton) [2017071 2011462]
  - redhat: switch release to zstream (Bruno Meneguele)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.2.1.rt7.132.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.2.1.rt7.132.el8_5 [1939539]
  - tipc: fix size validations for the MSG_CRYPTO type (Bruno Meneguele) [2020511 2020512] {CVE-2021-43267}
  - net: Fix skb->csum update in inet_proto_csum_replace16(). (Balazs Nemeth) [2005981 1975193]


author: Fernando Pacheco <fpacheco@redhat.com> [4.18.0-348.13.1.rt7.143.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.13.1.rt7.143.el8_5 [2032059]
  - kernel/locking: Export __rt_mutex_init to non-GPL (Juri Lelli) [2038423 2028992]
  - vfs: Out-of-bounds write of heap buffer in fs_context.c (Frantisek Hrbata) [2040580 2040581] {CVE-2022-0185}
  - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Bruno Meneguele) [2034869 2034870] {CVE-2021-4155}
  - af_unix: fix garbage collect vs MSG_PEEK (Patrick Talbert) [2031982 2031983] {CVE-2021-0920}
  - cgroup: verify that source is a string (Waiman Long) [2034613 2034614] {CVE-2021-4154}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-348.14.1.rt7.144.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.14.1.rt7.144.el8_5 [2045589]
  - redhat: don't copy Module.kabi files to dist-git (Frantisek Hrbata)
  - tcp: fix page frag corruption on page fault (Paolo Abeni) [2041529 1996074]
  - net: fix sk_page_frag() recursion from memory reclaim (Paolo Abeni) [2041529 1996074]
  - KVM: s390: index kvm->arch.idle_mask by vcpu_idx (Thomas Huth) [2040769 2026230]
  - redhat: set LC_ALL=C before sorting config content (Frantisek Hrbata)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.15.1.rt7.145.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.15.1.rt7.145.el8_5 [2045589]
  - net/mlx5: DR, Use FW API when updating FW-owned flow table (Michal Schmidt) [2042663 2042651]
  - KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall (Vitaly Kuznetsov) [2043237 1868572]
  - drm/mgag200: Select clock in PLL update functions (Bruno Meneguele) [2034949 1953926]
  - drm/i915: Fix HAS_LSPCON macro for platforms between GEN9 and GEN10 (Bruno Meneguele) [2027335 2005586]
  - crypto: qat - power up 4xxx device (Vladis Dronov) [2016437 1960307]
  - RDMA/core: Fix a double free in add_port error flow (Kamal Heib) [2038724 2008555]
  - powerpc/iommu: Report the correct most efficient DMA mask for PCI devices (Steve Best) [2018928 2007425]
  - powerpc/dma: Fix dma_map_ops::get_required_mask (Steve Best) [2018928 2007425]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.16.1.rt7.146.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.16.1.rt7.146.el8_5 [2045589]
  - drm/vmwgfx: Fix stale file descriptors on failed usercopy (Dave Airlie) [2047610 2047611] {CVE-2022-22942}
  - net: openvswitch: Fix ct_state nat flags for conns arriving from tc (Marcelo Ricardo Leitner) [2043548 2040334]
  - net: openvswitch: Fix matching zone id for invalid conns arriving from tc (Marcelo Ricardo Leitner) [2043550 2040452]
  - net/sched: flow_dissector: Fix matching on zone id for invalid conns (Marcelo Ricardo Leitner) [2043550 2040452]
  - net/sched: Extend qdisc control block with tc control block (Marcelo Ricardo Leitner) [2043550 2040452]
  - redhat/Makefile: fix access issue on shared build system (Bruno Meneguele)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.17.1.rt7.147.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.17.1.rt7.147.el8_5 [2045589]
  - vfs: check dentry is still valid in get_link() (Ian Kent) [2052558 2014846]
  - xfs: don't expose internal symlink metadata buffers to the vfs (Brian Foster) [2052558 2014846]
  - CI: Use appropriate zstream builder (Veronika Kabatova)
  - CI: Enable baseline realtime checks (Veronika Kabatova)
  - CI: Rename pipelines to include release names (Veronika Kabatova)
  - cgroup-v1: Require capabilities to set release_agent (Waiman Long) [2052176 2052177] {CVE-2022-0492}
  - ice: Remove boolean vlan_promisc flag from function (Jonathan Toppins) [2051951 2030400]
  - ceph: put the requests/sessions when it fails to alloc memory (Jeffrey Layton) [2053725 2017796]
  - ceph: fix off by one bugs in unsafe_request_wait() (Jeffrey Layton) [2053725 2017796]
  - ceph: flush the mdlog before waiting on unsafe reqs (Jeffrey Layton) [2053725 2017796]
  - ceph: flush mdlog before umounting (Jeffrey Layton) [2053725 2017796]
  - ceph: make iterate_sessions a global symbol (Jeffrey Layton) [2053725 2017796]
  - ceph: make ceph_create_session_msg a global symbol (Jeffrey Layton) [2053725 2017796]
  - xfs: check sb_meta_uuid for dabuf buffer recovery (Bill O'Donnell) [2049292 2020764]
  - drm/i915: Flush TLBs before releasing backing store (Patrick Talbert) [2044333 2044334] {CVE-2022-0330}
  - hugetlb: fix hugetlb cgroup refcounting during vma split (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings (Waiman Long) [2039015 2032811]
  - mm/hugetlb: change hugetlb_reserve_pages() to type bool (Waiman Long) [2039015 2032811]
  - hugetlb: fix an error code in hugetlb_reserve_pages() (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: fix offline of hugetlb cgroup with reservations (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: fix reservation accounting (Waiman Long) [2039015 2032811]
  - mm/hugetlb: narrow the hugetlb_lock protection area during preparing huge page (Waiman Long) [2039015 2032811]
  - mm/hugetlb: a page from buddy is not on any list (Waiman Long) [2039015 2032811]
  - mm/hugetlb: not necessary to coalesce regions recursively (Waiman Long) [2039015 2032811]
  - selftests/vm/write_to_hugetlbfs.c: fix unused variable warning (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add hugetlb_cgroup reservation tests (Waiman Long) [2039015 2032811]
  - hugetlb: support file_region coalescing again (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: support noreserve mappings (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add accounting for shared mappings (Waiman Long) [2039015 2032811]
  - hugetlb: disable region_add file_region coalescing (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add reservation accounting for private mappings (Waiman Long) [2039015 2032811]
  - mm/hugetlb_cgroup: fix hugetlb_cgroup migration (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add interface for charge/uncharge hugetlb reservations (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add hugetlb_cgroup reservation counter (Waiman Long) [2039015 2032811]
  - hugetlb: remove duplicated code (Waiman Long) [2039015 2032811]
  - hugetlb: region_chg provides only cache entry (Waiman Long) [2039015 2032811]
  - hugetlbfs: always use address space in inode for resv_map pointer (Waiman Long) [2039015 2032811]
  - hugetlbfs: fix potential over/underflow setting node specific nr_hugepages (Waiman Long) [2039015 2032811]
  - hugetlb: allow to free gigantic pages regardless of the configuration (Waiman Long) [2039015 2032811]
  - powerpc/pseries: Fix update of LPAR security flavor after LPM (Steve Best) [2027448 1997294]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.18.1.rt7.148.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.18.1.rt7.148.el8_5 [2045589]
  - selftests: kvm: Check whether SIDA memop fails for normal guests (Thomas Huth) [2050811 2050812] {CVE-2022-0516}
  - KVM: s390: Return error on SIDA memop on normal guest (Thomas Huth) [2050811 2050812] {CVE-2022-0516}
  - iommu/amd: Remove iommu_init_ga() (Jerry Snitselaar) [2030854 1998265]
  - iommu/amd: Relocate GAMSup check to early_enable_iommus (Jerry Snitselaar) [2030854 1998265]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.19.1.rt7.149.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.19.1.rt7.149.el8_5 [2045589]
  - tipc: improve size validations for received domain records (Xin Long) [2048976 2048977] {CVE-2022-0435}
  - smb3: do not error on fsync when readonly (Ronnie Sahlberg) [2055824 2037811]
  - security: implement sctp_assoc_established hook in selinux (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - security: add sctp_assoc_established hook (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - security: call security_sctp_assoc_request in sctp_sf_do_5_1D_ce (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - security: pass asoc to sctp_assoc_request and sctp_sk_clone (Bruno Meneguele) [2054112 2054117 2015525 2048251]
  - net: sctp: Fix some typos (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - RDMA/bnxt_re: Fix stats counters (Selvin Xavier) [2049684 2001893]
  - net: check skb sec_path when re-initializing slow_gro in gro_list_prepare (Xin Long) [2047427 2030476]
  - cpufreq: intel_pstate: Add Icelake servers support in no-HWP mode (David Arcari) [2036888 2003695]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.20.1.rt7.150.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.20.1.rt7.150.el8_5 [2045589]
  - lib/iov_iter: initialize "flags" in new pipe_buffer (Jan Stancek) [2060879 2060880] {CVE-2022-0847}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.21.1.rt7.151.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.21.1.rt7.151.el8_5 [2045589]
  - netfilter: nf_queue: handle socket prefetch (Florian Westphal) [2061446 2009786]
  - netfilter: nf_queue: fix possible use-after-free (Florian Westphal) [2061446 2009786]
  - selftests: netfilter: add nfqueue TCP_NEW_SYN_RECV socket race test (Florian Westphal) [2061446 2009786]
  - netfilter: nf_queue: don't assume sk is full socket (Florian Westphal) [2061446 2009786]
  - netfilter: nf_tables_offload: incorrect flow offload action array size (Florian Westphal) [2056867 2056728] {CVE-2022-25636}
  - netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create (Florian Westphal) [2056867 2056728] {CVE-2022-25636}
  - rt: update the authentication scheme for the bugzilla script (Luis Claudio R. Goncalves)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.22.1.rt7.152.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.22.1.rt7.152.el8_5 [2067266]
  - scsi: lpfc: Fix non-recovery of remote ports following an unsolicited LOGO (Dick Kennedy) [2058193 2027558]
  - cifs: check all path components in resolved dfs target (Ronnie Sahlberg) [2056329 2030880]
  - RDMA/cma: Do not change route.addr.src_addr.ss_family (Kamal Heib) [2032073 2032074] {CVE-2021-4028}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.23.1.rt7.153.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.23.1.rt7.153.el8_5 [2067266]
  - gfs2: dequeue iopen holder in gfs2_inode_lookup error (Bob Peterson) [2069750 2061665]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.3.1.rt7.133.el8_5]
changelog:
  - [rt] build kernel-rt-4.18.0-348.3.1.rt7.133.el8_5 [1939539]
  - net-sysfs: try not to restart the syscall if it will fail eventually (Antoine Tenart) [2021165 2016005]
  - ovl: fix missing negative dentry check in ovl_rename() (Miklos Szeredi) [2016378 2010887 2013318] {CVE-2021-20321}


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 1.10-3
changelog:
  PMTUd: Fix MTU calculation when using crypto
    Resolves: rhbz#1736872
    host: Fix defrag buffer reclaim logic that could cause delivery
          of corrupted data
    ResolveS: rhbz#1761711


author: Paul Wouters <pwouters@redhat.com> - 4.1-1
changelog:
  - Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.1
  - Resolves: rhbz#1889836 libreswan: add 3.x compat patches for obsoleted/removed keywords of 4.0 and re-port ikev2= patch


author: Paul Wouters <pwouters@redhat.com> - 4.2-1
changelog:
  - Resolves: rhbz#1891128 [Rebase] rebase libreswan to 4.2
  - Resolves: rhbz#1025061 - IKEv2 support for Labeled IPsec


author: Paul Wouters <pwouters@redhat.com> - 4.3-3
changelog:
  - Resolves: rhbz#1933064 - IKEv2 support for Labeled IPsec
  - Resolves: rhbz#1935150 RFE: Support IKE and ESP over TCP: RFC 8229
  - Resolves: rhbz#1935339 virtual_private setting is missing in the default config


author: Daiki Ueno <dueno@redhat.com> - 4.4-1
changelog:
  - Resolves: rhbz#1958968 Rebase libreswan to 4.4
  - Resolves: rhbz#1954423 Libreswan: TS_UNACCEPTABLE on multiple connections between the same peers


author: Jindrich Novy <jnovy@redhat.com> - 4.3.0-3
changelog:
  - fix static analysis issues merged upstream
    (https://gitlab.freedesktop.org/slirp/libslirp/-/merge_requests/41)
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 4.3.0-4
changelog:
  - fix "CVE-2020-10756 QEMU: slirp: networking out-of-bounds read information disclosure vulnerability"
  - Related: #1821193


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-29
changelog:
  - qemu: substitute missing model name for host-passthrough (rhbz#1850680)
  - rpc: gendispatch: handle empty flags (CVE-2020-25637)
  - rpc: add support for filtering @acls by uint params (CVE-2020-25637)
  - rpc: require write acl for guest agent in virDomainInterfaceAddresses (CVE-2020-25637)
  - qemu: agent: set ifname to NULL after freeing (CVE-2020-25637)
  - qemu: Fix domfsinfo for non-PCI device information from guest agent (rhbz#1858771)
  - virDomainNetFindIdx: add support for CCW addresses (rhbz#1837495)
  - check for NULL before calling g_regex_unref (rhbz#1861176)
  - virhostcpu.c: fix 'die_id' parsing for Power hosts (rhbz#1876742)
  - qemuFirmwareFillDomain: Fill NVRAM template on migration too (rhbz#1880418)
  - node_device: refactor udevProcessCCW (rhbz#1853289, rhbz#1865932)
  - node_device: detect CSS devices (rhbz#1853289, rhbz#1865932)
  - virsh: nodedev: ability to filter CSS capabilities (rhbz#1853289, rhbz#1865932)
  - node_device: detect DASD devices (rhbz#1853289, rhbz#1865932)
  - udevProcessCSS: Check if def->driver is non-NULL (rhbz#1853289, rhbz#1865932)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-30
changelog:
  - cpu_map: Add missing x86 features in 0x7 CPUID leaf (rhbz#1861506)
  - cpu_map: Add missing x86 features in 0x80000008 CPUID leaf (rhbz#1861506)
  - cpu_map: Add missing AMD SVM features (rhbz#1861506)
  - Add testdata for AMD EPYC 7502 (rhbz#1861506)
  - cpu_map: Defined and enable EPYC-Rome model (rhbz#1861506)
  - cpu_map: Remove monitor feature from EPYC-Rome (rhbz#1861506)
  - tests: qemuxml2argv: Use existing machine type for 'numatune-distances' case (rhbz#1749518)
  - qemuxml2xmltest: Add "numatune-distance" test case (rhbz#1749518)
  - conf: Move and rename virDomainParseScaledValue() (rhbz#1749518)
  - numa_conf: Drop CPU from name of two functions (rhbz#1749518)
  - qemu_command: Rename qemuBuildNumaArgStr() (rhbz#1749518)
  - qemuBuildMachineCommandLine: Drop needless check (rhbz#1749518)
  - numa_conf: Make virDomainNumaSetNodeCpumask() return void (rhbz#1749518)
  - Allow NUMA nodes without vCPUs (rhbz#1749518)
  - conf: Parse and format HMAT (rhbz#1749518)
  - conf: Validate NUMA HMAT configuration (rhbz#1749518)
  - numa: expose HMAT APIs (rhbz#1749518)
  - qemu: Introduce QEMU_CAPS_NUMA_HMAT capability (rhbz#1749518)
  - qemu: Build HMAT command line (rhbz#1749518)
  - qemuBuildNumaCommandLine: Fix @masterInitiator check (rhbz#1749518)
  - numa_conf: Properly check for caches in virDomainNumaDefValidate() (rhbz#1749518)
  - RNG: Allow interleaving of /domain/cpu/numa/cell children (rhbz#1749518)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-31
changelog:
  - conf: properly clear out autogenerated macvtap names when formatting/parsing (rhbz#1872610)
  - qemu: format 'ramfb' attribute for mediated devices (rhbz#1876297)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-32
changelog:
  - util: replace macvtap name reservation bitmap with a simple counter (rhbz#1874304)
  - util: assign tap device names using a monotonically increasing integer (rhbz#1874304)
  - util: virNetDevTapCreate: initialize fd to -1 (rhbz#1874304)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-33
changelog:
  - cpu_map: Fix Icelake Server model number (rhbz#1537734)
  - cputestdata: Add test data for Snowridge (rhbz#1537734)
  - cpu_map: Add support for fsrm CPU feature (rhbz#1537734)
  - cpu_map: Add support for core-capability CPU feature (rhbz#1537734)
  - cpu_map: Add support for split-lock-detect CPU feature (rhbz#1537734)
  - cpu_map: Define and enable Snowridge model (rhbz#1537734)
  - util: fix typo in VIR_MOCK_WRAP_RET_ARGS() (rhbz#1607929)
  - util/tests: enable locking on iptables/ebtables commandlines in unit tests (rhbz#1607929)
  - util/tests: enable locking on iptables/ebtables commandlines by default (rhbz#1607929)
  - tests: fix iptables test case commandline options in virfirewalltest.c (rhbz#1607929)
  - network: be more verbose about the reason for a firewall reload (rhbz#1607929)
  - util: always check for ebtables/iptables binaries, even when using firewalld (rhbz#1607929)
  - util: synchronize with firewalld before we start calling iptables directly (rhbz#1607929)
  - util: call iptables directly rather than via firewalld (rhbz#1607929)
  - util: virhostcpu: Fail when fetching CPU Stats for invalid cpu (rhbz#1915183)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-34
changelog:
  - qemu: move cgroup cpu period and quota defines to vircgroup.h (rhbz#1915733)
  - vircgroupv1: use defines for cpu period and quota limits (rhbz#1915733)
  - vircgroupv2: use defines for cpu period and quota limits (rhbz#1915733)
  - vircgroup: fix cpu quota maximum limit (rhbz#1915733)
  - util: add virNetDevGetPhysPortName (rhbz#1918708)
  - util: avoid manual VIR_FREE of a g_autofree pointer in virPCIGetName() (rhbz#1918708)
  - util: Add phys_port_name support on virPCIGetNetName (rhbz#1918708)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-35
changelog:
  - vircgroupv2: properly detect placement of running VM (rhbz#1798463)
  - virsystemd: export virSystemdHasMachined (rhbz#1798463)
  - virsystemd: introduce virSystemdGetMachineByPID (rhbz#1798463)
  - virsystemd: introduce virSystemdGetMachineUnitByPID (rhbz#1798463)
  - vircgroup: use DBus call to systemd for some APIs (rhbz#1798463)
  - vircgroupv1: refactor virCgroupV1DetectPlacement (rhbz#1798463)
  - vircgroupv2: move task into cgroup before enabling controllers (rhbz#1798463)
  - vircgroup: introduce virCgroupV1Exists and virCgroupV2Exists (rhbz#1798463)
  - vircgroup: introduce nested cgroup to properly work with systemd (rhbz#1798463)
  - tests: add cgroup nested tests (rhbz#1798463)
  - vircgroup: correctly free nested virCgroupPtr (rhbz#1798463)
  - qemu: Add virtio related options to vsock (rhbz#1931548)
  - domain_validate: use defines for cpu period and quota limits (rhbz#1798463)
  - docs: use proper cpu quota value in our documentation (rhbz#1798463)
  - vircgroup: enforce range limit for cpu.shares (rhbz#1798463)
  - cgroup: use virCgroupSetCpuShares instead of virCgroupSetupCpuShares (rhbz#1798463)
  - cpumap: Add support for ibrs CPU feature (rhbz#1926864)
  - cpumap: Add support for svme-addr-check CPU feature (rhbz#1926864)
  - cpu_map: Add EPYC-Milan x86 CPU model (rhbz#1926864)
  - cpu_map: Install x86_EPYC-Milan.xml (rhbz#1926864)
  - cpu_map: Fix spelling of svme-addr-chk feature (rhbz#1926864)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-36
changelog:
  - network: make it safe to call networkSetupPrivateChains() multiple times (rhbz#1942805)
  - network: force re-creation of iptables private chains on firewalld restart (rhbz#1942805)
  - hostdev: Update mdev pointer reference after checking device type (rhbz#1940449)
  - hostdev: mdev: Lookup mdevs by sysfs path rather than mdev struct (rhbz#1940449)
  - qemu_firmware: don't error out for unknown firmware features (rhbz#1961562)
  - docs: improve description of secure attribute for loader element (rhbz#1929357)
  - conf: introduce virDomainDefParseBootInitOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootKernelOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootFirmwareOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootLoaderOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootAcpiOptions (rhbz#1929357)
  - conf: use switch in virDomainDefParseBootOptions (rhbz#1929357)
  - conf: introduce support for firmware auto-selection feature filtering (rhbz#1929357)
  - qemu: implement support for firmware auto-selection feature filtering (rhbz#1929357)
  - domain_conf: Don't leak def->os.firmwareFeatures (rhbz#1929357)
  - conf: remove duplicated firmware type attribute (rhbz#1929357)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-37
changelog:
  - security: fix SELinux label generation logic (CVE-2021-3631)
  - storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath (CVE-2021-3667)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-37.1.el8
changelog:
  - network: Implement virConnectSupportsFeature() (rhbz#2038812)
  - lib: Fix calling of virNetworkUpdate() driver callback (rhbz#2038812)


author: David King <dking@redhat.com> - 2.9.7-10
changelog:
  - Fix CVE-2021-3516 (#1956976)
  - Fix CVE-2021-3517 (#1957001)
  - Fix CVE-2021-3518 (#1957028)
  - Fix CVE-2021-3537 (#1957284)


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.27-1
changelog:
  - Rebase to 10.3.27
  - mariadb-debug_build.patch is no more needed, upstream did the changes:
    https://github.com/MariaDB/server/commit/31eaa2029f3c2a4f8e5609ce8b87682286238d9a#diff-32766783af7cac683980224d63c59929
    https://github.com/MariaDB/server/commit/23c6fb3e6231b8939331e2d9f157092f24ed8f4f#diff-78f3162f137407db5240950beb2bcd7c


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.27-2
changelog:
  - Disable building of the ed25519 client plugin.
    From now on it will be shipped by 'mariadb-connector-c' package


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.27-3
changelog:
  - Remove mariadb_rpl.h from includedir
    This file is shipped in mariadb-connector-c package
  - Require matching version of mariadb-connector-c package


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.0-1
changelog:
  - new version 1.16.0
  - enable ngx_stream_ssl_preread module
  - main package does NOT require all-modules package


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.16.1-1
changelog:
  - update to 1.16.1
  - Resolves: #1745697 - CVE-2019-9511 nginx:1.16/nginx: HTTP/2: large amount
    of data request leads to denial of service
  - Resolves: #1745690 - CVE-2019-9513 nginx:1.16/nginx: HTTP/2: flood using
    PRIORITY frames resulting in excessive resource consumption
  - Resolves: #1745645 - CVE-2019-9516 nginx:1.16/nginx: HTTP/2: 0-length
    headers leads to denial of service


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.18.0-2
changelog:
  - new version 1.18.0
  - Resolves: #1668717 - [RFE] Support loading certificates from hardware token
    (PKCS#11)
  - Increased types_hash_max_size to 4096 in default config
  - Drop location / from default config (rhbz#1564768)
  - Drop default_sever from default config (rhbz#1373822)


author: Lubos Uhliarik <luhliari@redhat.com> - 1:1.18.0-3
changelog:
  - Resolves: #1651377 - centralizing default index.html on nginx
  - Resolves: #1825683 - Outdated Red Hat branding used in nginx default pages


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.16.0-1
changelog:
  - Resolves CVE-2021-22883 CVE-2021-22884
  - Resolves: RHBZ#1934566, RHBZ#1934599
  - Rebase, remove ini patch


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.17.3-1
changelog:
  - Resolves: RHBZ#1979844, RHBZ#1977829
  - Resolves: RHBZ#1842826
  - Resolves CVE-2021-22918(libuv), use system cipher list


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.17.3-3
changelog:
  - Resolves: RHBZ#1945513, RHBZ#1945287
  - Resolves CVE-2021-23362 CVE-2021-27290
  - Bump for missing mentions of CVEs


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.17.5-1
changelog:
  - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939, CVE-2021-22940,
  - CVE-2021-23343, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672
  - Resolves RHBZ#1847529 (make FIPS always available)
  - Resolves: RHBZ#1988600, RHBZ#1993815, RHBZ#1993809, RHBZ#1993096
  - Resolves: RHBZ#1986743, RHBZ#1993947, RHBZ#1993940, RHBZ#1989427
  - Resolves: RHBZ#1951620 (make FIPS always available)


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:14.18.2-1
changelog:
  - Resolves: RHBZ#2027609
  - Resolves: RHBZ#2027649, RHBZ#2027646, RHBZ#2027642, RHBZ#2027635
  - Rebase to new version to fix CVEs


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.1.0-1
changelog:
  - Resolves: RHBZ#1953991
  - Rebase to v16.x
  - Update version of gcc and gcc-c++ needed
  - Remove libs conditionals
  - Remove unused patches
  - Bundle nghttp3 and ngtcp2


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.4.2-1
changelog:
  - Resolves: RHBZ#1979847
  - Resolves CVE-2021-22918(libuv)
  - Use system cipher list(1842826, 1952915)


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.7.0-1
changelog:
  - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939,
  - CVE-2021-22940, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672
  - Resolves: RHBZ#1988608, RHBZ#1993816, RHBZ#1993810
  - Resolves: RHBZ#1993097, RHBZ#1993948, RHBZ#1993941, RHBZ#1994963


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.7.0-2
changelog:
  - Resolves CVE-2021-22930, CVE-2021-22931, CVE-2021-22939,
  - CVE-2021-22940, CVE-2021-32803, CVE-2021-32804, CVE-2021-3672
  - Resolves: RHBZ#1988608, RHBZ#1993816, RHBZ#1993810
  - Resolves: RHBZ#1993097, RHBZ#1993948, RHBZ#1993941, RHBZ#1994963
  - fix python3 in gyp


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.8.0-1
changelog:
  - Resolves CVE-2021-32803, CVE-2021-32804, CVE-2021-37701, CVE-2021-37712
  - Resolves: RHBZ#1993948, RHBZ#1993941, RHBZ#2000151, RHBZ#2002176


author: Zuzana Svetlikova <zsvetlik@redhat.com> - 1:16.13.1-1
changelog:
  - Resolves: RHBZ#2027644, RHBZ#2027643, RHBZ#2027638, RHBZ#2027633
  - Resolves: RHBZ#2027610
  - Rebase to LTS release and to fix multiple low and medium CVEs


author: Bob Relyea <rrelyea@redhat.com> - 3.67.0-4
changelog:
  - Better fix for the sdb timeout. The issue wasn't a race, it was
    the sqlite timeout waiting to begin a transaction under heavy
    thread usage.


author: Jindrich Novy <jnovy@redhat.com> - 1.2.1-1
changelog:
  - update to https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.1
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.2.1-1
changelog:
  - update to
    https://github.com/containers/oci-seccomp-bpf-hook/releases/tag/v1.2.1
  - require crun >= 0.17
  - Related: #1883490


author: Than Ngo <than@redhat.com> - 3.15.1-3
changelog:
  - Resolves: #1902022
     Fix compiling with c++
     Added error message handling for p11sak remove-key command


author: Than Ngo <than@redhat.com> - 3.16.0-1
changelog:
  - Resolves: #1919223, rebase to 3.16.0
  - Resolves: #1922195, Event Notification Support
  - Resolves: #1959936, Soft token does not check if an EC key is valid
  - Resolves: #1851104, import and export of secure key objects
  - Resolves: #1851106, openCryptoki ep11 token: protected key support
  - Resolves: #1851107, openCryptoki ep11 token: support attribute bound keys


author: Than Ngo <than@redhat.com> - 3.16.0-5
changelog:
  - Resolves: #1987256, pkcstok_migrate leaves options with multiple strings in opencryptoki.conf options without double-quotes


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-12
changelog:
  - Implemented new FIPS requirements in regards to KDF and DH selftests
  - Disallow certificates with explicit EC parameters


author: Sahana Prasad <sahana@redhat.com> 1.1.1g-14
changelog:
  - Fix CVE-2021-3450 openssl: CA certificate check bypass with
    X509_V_FLAG_X509_STRICT
  - Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing


author: Daiki Ueno <dueno@redhat.com> 1.1.1g-16
changelog:
  - Use AI_ADDRCONFIG only when explicit host name is given
  - Allow only curves defined in RFC 8446 in TLS 1.3


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067144


author: Colin Walters <walters@verbum.org> - 2020.4-1
changelog:
  - https://github.com/ostreedev/ostree/releases/tag/v2020.4
  - We plan to use per-object-fsync for etcd in OpenShift 4
  - Resolves: #1861507


author: Colin Walters <walters@verbum.org> - 2020.5-2
changelog:
  - Update to https://github.com/ostreedev/ostree/releases/tag/v2020.5
    Specifically to fix readonly-sysroot for e.g. RHEL Edge and
    older RHCOS versions
  - Related: #1861507


author: Colin Walters <walters@verbum.org> - 2020.5-3
changelog:
  - Backport
    https://github.com/ostreedev/ostree/pull/2179/commits/06ed04a816141914adb9bd3e32392801fce5bc8e
    Resolves: #1867601


author: Luca BRUNO <lucab@redhat.com> - 2021.3-1
changelog:
  - New upstream version
    https://github.com/ostreedev/ostree/releases/tag/v2021.3
    Resolves: rhbz#1981865


author: Colin Walters <walters@verbum.org> - 2021.3-2
changelog:
  - Backport
    https://github.com/ostreedev/ostree/pull/2453/commits/e6a560b40797324aa8b90e7100c6d50bff91f14d
    Resolves: rhbz#2029578


author: Red Hat PKI Team <rhcs-maint@redhat.com> 10.10.4-1
changelog:
  - Rebase to PKI 10.10.4
  - Bug 1664435 - Error instantiating class for challenge_password with SCEP request
  - Bug 1912418 - OCSP and TKS cloning failed due to duplicate replica ID
  - Bug 1916686 - Memory leak during ACME performance test
  - Bug 1919282 - ACME cert enrollment failed with HTTP 500


author: Ray Strode <rstrode@redhat.com> - 0.9.4-10.git1688935.1
changelog:
  - Fix typo in --with-runtimedir argument to actually stop using
    /var/run and instead use /run instead
    Resolves: #2057275


author: Jindrich Novy <jnovy@redhat.com> - 3.0.0-0.39rc2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0
    (https://github.com/containers/podman/commit/2b89fe7)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 3.0.0-1
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0
    (https://github.com/containers/podman/commit/ddd8a17)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 3.0.0-2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0
    (https://github.com/containers/podman/commit/797f1ea)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-1
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0
    (https://github.com/containers/podman/commit/7e286bc)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0
    (https://github.com/containers/podman/commit/9a2fc37)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-4
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0.1-rhel
    (https://github.com/containers/podman/commit/eebd611)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-5
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0.1-rhel
    (https://github.com/containers/podman/commit/2bed76e)
  - fixes CVE-2021-3602
  - Related: #1977943


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-7
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0.1-rhel
    (https://github.com/containers/podman/commit/4f91b37)
  - Resolves: #2011410


author: Jindrich Novy <jnovy@redhat.com> - 3.0.1-8
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.0.1-rhel
    (https://github.com/containers/podman/commit/c5d8129)
  - fixes CVE-2022-27649
  - Resolves: #2067511


author: Jindrich Novy <jnovy@redhat.com> - 1:3.4.3-9
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.4
    (https://github.com/containers/podman/commit/815f36a)
  - Related: #2021990


author: Jindrich Novy <jnovy@redhat.com> - 1:3.4.2-2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.4.2-rhel
    (https://github.com/containers/podman/commit/f601d7a)
  - Related: #2021990


author: Jindrich Novy <jnovy@redhat.com> - 1:3.4.2-4
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.4.2-rhel
    (https://github.com/containers/podman/commit/4853c18)
  - Related: #2021990


author: Jindrich Novy <jnovy@redhat.com> - 1:3.4.2-5
changelog:
  - add Patch0: https://patch-diff.githubusercontent.com/raw/containers/podman/pull/12540.patch
    which reverts removal of code which is in fact required for proper podman functionality
  - Related: #2021990


author: Jindrich Novy <jnovy@redhat.com> - 1:3.4.2-6
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.4.2-rhel
    (https://github.com/containers/podman/commit/90fb2cf)
  - Related: #2021990


author: Jindrich Novy <jnovy@redhat.com> - 1:3.4.2-7
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.4.2-rhel
    (https://github.com/containers/podman/commit/30a6e0d)
  - Related: #2021990


author: Jindrich Novy <jnovy@redhat.com> - 1:3.4.2-8
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.4.2-rhel
    (https://github.com/containers/podman/commit/75e9870)
  - Related: #2021990


author: Jindrich Novy <jnovy@redhat.com> - 1:3.4.2-9
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v3.4.2-rhel
    (https://github.com/containers/podman/commit/16e80e0)
  - Related: #2021990


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-24
changelog:
  - fix CVE-2021-20188
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/2c7b579)
  - Related: #1920383


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-26
changelog:
  - fix regression introduced by fix of CVE-2021-20188
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/bcbbbc4)
  - Resolves: #1934649


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-27
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/c19e460)
  - Resolves: #2062401


author: Jindrich Novy <jnovy@redhat.com> - 1.6.4-28
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/9407ffd)
  - fixes CVE-2022-27651
  - Resolves: #2067545


author: Marek Kasik <mkasik@redhat.com> - 0.66.0-25
changelog:
  - Check whether input is RGB in PSOutputDev::checkPageSlice()
  - also when using "-optimizecolorspace" flag
  - Resolves: #1697576


author: Patrik Novotný <panovotn@redhat.com> - 12.5-1
changelog:
  - Rebase to upstream release 12.5
    Resolves: rhbz#1898330
    Resolves: rhbz#1898224
    Resolves: rhbz#1898244


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-14
changelog:
  - Fixes for CVE-2021-25290, CVE-2021-25292, CVE-2021-25293, CVE-2021-27921
  CVE-2021-27922, and CVE-2021-27923
  Resolves: rhbz#1934685 rhbz#1934699 rhbz#1934705 rhbz#1935384 rhbz#1935396 rhbz#1935401


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-15
changelog:
  - Fixes for CVE-2021-25288, CVE-2021-25287, CVE-2021-28675, CVE-2021-28676,
  CVE-2021-28677 and CVE-2021-28678
  Resolves: rhbz#1958231, rhbz#1958226, rhbz#1958240, rhbz#1958252, rhbz#1958257, rhbz#1958263


author: Charalampos Stratakis <cstratak@redhat.com> - 5.1.1-18
changelog:
  - Fixup for CVE-2022-22817
  - Security fixes for CVE-2022-22815, CVE-2022-22816
  Resolves: rhbz#2042522


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-51.el8
changelog:
  - kvm-linux-headers-Add-VFIO_CCW_REQ_IRQ_INDEX.patch [bz#1940450]
  - kvm-vfio-ccw-Connect-the-device-request-notifier.patch [bz#1940450]
  - kvm-pc-bios-s390-ccw-fix-off-by-one-error.patch [bz#1942880]
  - kvm-pc-bios-s390-ccw-break-loop-if-a-null-block-number-i.patch [bz#1942880]
  - kvm-pc-bios-s390-ccw-don-t-try-to-read-the-next-block-if.patch [bz#1942880]
  - Resolves: bz#1940450
    (RHEL8.5 - Mediated Device already in use by same domain we are booting (vfio-ccw/Multipath Testing) (kvm) - qemu-kvm part (also has kernel and libvirt parts))
  - Resolves: bz#1942880
    (RHEL8.4 Nightly[0322] - KVM guest fails to find zipl boot menu index (qemu-kvm))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-52.el8
changelog:
  - kvm-file-posix-Mitigate-file-fragmentation-with-extent-s.patch [bz#1877163]
  - kvm-block-file-posix-Fix-problem-with-fallocate-PUNCH_HO.patch [bz#1944861]
  - kvm-spapr-Remove-stale-comment-about-power-saving-LPCR-b.patch [bz#1969768]
  - kvm-spapr-Set-LPCR-to-current-AIL-mode-when-starting-a-n.patch [bz#1969768]
  - Resolves: bz#1877163
    ([FJ 8.3 Bug] The progress bar of the "virt-clone --nonsparse" command shows the progress rate exceeding 100%.)
  - Resolves: bz#1944861
    (Qemu-img convert fails when source image is on gpfs)
  - Resolves: bz#1969768
    ([ppc64le] Hotplug vcpu device hit call trace:[qemu output] KVM: unknown exit, hardware reason 7fff9ce87ed8)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-53.el8
changelog:
  - kvm-virtiofsd-Whitelist-fchmod.patch [bz#1967914]
  - kvm-spapr-Fix-EEH-capability-issue-on-KVM-guest-for-PCI-.patch [bz#1957866]
  - kvm-Compress-lines-for-immediate-return.patch [bz#1970912]
  - kvm-file-posix-Handle-EINVAL-fallocate-return-value.patch [bz#1970912]
  - Resolves: bz#1967914
    ([virtio-fs] virtiofsd quit when coping file to a folder in virtio-fs mounted volume(windows guest))
  - Resolves: bz#1957866
    (RHEL8.4 - EEH capability disabled on KVM guest and recovery of PCI passthru device fails(CX5 / mlx5_core) (qemu-kvm))
  - Resolves: bz#1970912
    (Deployment fails with "Invalid or missing agent token received")


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-54.el8
changelog:
  - kvm-redhat-Fix-unversioned-Obsoletes-warning.patch [bz#1967329]
  - Resolves: bz#1967329
    (Make qemu-kvm use versioned obsoletes for qemu-kvm-ma and qemu-kvm-rhev)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-55.el8
changelog:
  - kvm-net-introduce-qemu_receive_packet.patch [bz#1932917]
  - kvm-e1000-switch-to-use-qemu_receive_packet-for-loopback.patch [bz#1932917]
  - kvm-dp8393x-switch-to-use-qemu_receive_packet-for-loopba.patch [bz#1932917]
  - kvm-sungem-switch-to-use-qemu_receive_packet-for-loopbac.patch [bz#1932917]
  - kvm-tx_pkt-switch-to-use-qemu_receive_packet_iov-for-loo.patch [bz#1932917]
  - kvm-rtl8139-switch-to-use-qemu_receive_packet-for-loopba.patch [bz#1932917]
  - kvm-pcnet-switch-to-use-qemu_receive_packet-for-loopback.patch [bz#1932917]
  - kvm-cadence_gem-switch-to-use-qemu_receive_packet-for-lo.patch [bz#1932917]
  - kvm-lan9118-switch-to-use-qemu_receive_packet-for-loopba.patch [bz#1932917]
  - Resolves: bz#1932917
    (CVE-2021-3416 virt:rhel/qemu-kvm: QEMU: net: infinite loop in loopback mode may lead to stack overflow)


author: Miroslav Rezanina <mrezanin@redhat.com> - 4.2.0-56
changelog:
  - kvm-glib-compat-add-g_unix_get_passwd_entry_qemu.patch [bz#1967716]
  - kvm-qga-add-ssh-add-remove-authorized-keys.patch [bz#1967716]
  - kvm-qga-add-reset-argument-to-ssh-add-authorized-keys.patch [bz#1967716]
  - kvm-qga-add-ssh-get-authorized-keys.patch [bz#1967716]
  - kvm-Add-mtod_check.patch [bz#1970819 bz#1970835 bz#1970843 bz#1970853]
  - kvm-bootp-limit-vendor-specific-area-to-input-packet-mem.patch [bz#1970819 bz#1970835 bz#1970843 bz#1970853]
  - kvm-bootp-check-bootp_input-buffer-size.patch [bz#1970819]
  - kvm-upd6-check-udp6_input-buffer-size.patch [bz#1970835]
  - kvm-tftp-check-tftp_input-buffer-size.patch [bz#1970843]
  - kvm-tftp-introduce-a-header-structure.patch [bz#1970819 bz#1970835 bz#1970843 bz#1970853]
  - kvm-udp-check-upd_input-buffer-size.patch [bz#1970853]
  - kvm-Fix-DHCP-broken-in-libslirp-v4.6.0.patch [bz#1970819 bz#1970835 bz#1970843 bz#1970853]
  - kvm-net-check-if-the-file-descriptor-is-valid-before-usi.patch [bz#1982134]
  - kvm-net-detect-errors-from-probing-vnet-hdr-flag-for-TAP.patch [bz#1982134]
  - Resolves: bz#1967716
    (RFE: rebuild guest agent to include public ssh injection api support)
  - Resolves: bz#1970819
    (CVE-2021-3592 virt:rhel/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) [rhel-8])
  - Resolves: bz#1970835
    (CVE-2021-3593 virt:rhel/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) [rhel-8])
  - Resolves: bz#1970843
    (CVE-2021-3595 virt:rhel/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) [rhel-8])
  - Resolves: bz#1970853
    (CVE-2021-3594 virt:rhel/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) [rhel-8])
  - Resolves: bz#1982134
    (QEMU core dump while booting guest with a non-exist fd on tap)


author: Miroslav Rezanina <mrezanin@redhat.com> - 4.2.0-57
changelog:
  - kvm-aio-wait-delegate-polling-of-main-AioContext-if-BQL-.patch [bz#1969848]
  - kvm-async-use-explicit-memory-barriers.patch [bz#1969848]
  - Resolves: bz#1969848
    (qemu-img convert hangs on aarch64)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-58.el8
changelog:
  - kvm-virtiofsd-Disable-remote-posix-locks-by-default.patch [bz#1967496]
  - kvm-virtiofsd-Fix-the-help-message-of-posix-lock.patch [bz#1967496]
  - Resolves: bz#1967496
    ([virtio-fs] nfs/xfstest generic/089 generic/478 generic/632 failed)


author: Jon Maloy <jmaloy@redhat.com> - 4.2.0-59
changelog:
  - kvm-scsi-make-io_timeout-configurable.patch [bz#1994041]
  - Resolves: bz#1994041
    (qemu-kvm scsi: change default passthrough timeout to non-infinite)


author: Jon Maloy <jmaloy@redhat.com> - 4.2.0-59.el8_5
changelog:
  - kvm-hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch [bz#2025605]
  - kvm-e1000-fix-tx-re-entrancy-problem.patch [bz#2025011]
  - Resolves: bz#2025605
    (CVE-2021-3930 virt:rhel/qemu-kvm: QEMU: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c [rhel-8.5.0.z])
  - Resolves: bz#2025011
    (CVE-2021-20257 virt:rhel/qemu-kvm: QEMU: net: e1000: infinite loop while processing transmit descriptors [rhel-8.5.0.z])


author: Jon Maloy <jmaloy@redhat.com> - 4.2.0-59.el8_5.2
changelog:
  - kvm-virtiofsd-Drop-membership-of-all-supplementary-group.patch [bz#2048627]
  - Resolves: bz#2048627
    (CVE-2022-0358 virt:rhel/qemu-kvm: QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405 [rhel-8.5.0.z])


author: Jon Maloy <jmaloy@redhat.com> - 4.2.0-60.el8_5.2
changelog:
  - kvm-target-i386-Declare-constants-for-XSAVE-offsets.patch [bz#2065239]
  - kvm-target-i386-Consolidate-the-X86XSaveArea-offset-chec.patch [bz#2065239]
  - kvm-target-i386-Clarify-the-padding-requirements-of-X86X.patch [bz#2065239]
  - kvm-target-i386-Pass-buffer-and-length-to-XSAVE-helper.patch [bz#2065239]
  - kvm-target-i386-Make-x86_ext_save_areas-visible-outside-.patch [bz#2065239]
  - kvm-target-i386-Observe-XSAVE-state-area-offsets.patch [bz#2065239]
  - kvm-target-i386-Populate-x86_ext_save_areas-offsets-usin.patch [bz#2065239]
  - Resolves: bz#2065239
    (KVM Fedora 35 guest x86 programs randomly crash in signal handler [rhel-8.5.0.z])


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-91
changelog:
  - ethmonitor: fix vlan regex
  - iface-vlan: make vlan parameter not unique
  - nfsserver: error-check unmount
  - VirtualDomain: fix pid status regex
  - podman: return NOT_RUNNING when monitor cmd fails
  - awsvip: dont partially match similar IPs during
  - aws agents: dont spam log files
  - aws-vpc-move-ip: add ENI lookup

    Resolves: rhbz#1891883, rhbz#1902045, rhbz#1924363, rhbz#1932863
    Resolves: rhbz#1920698, rhbz#1939992, rhbz#1940094, rhbz#1939281


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-93
changelog:
  - db2: add PRIMARY/REMOTE_CATCHUP_PENDING/CONNECTED status to promote-check
  - pgsqlms: new resource agent
  - python-pygments: fix CVE-2021-27291 and CVE-2021-20270

    Resolves: rhbz#1872754, rhbz#1934651, rhbz#1935422, rhbz#1943464


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-95
changelog:
  - lvmlockd: remove cmirrord support, as cmirrord is incompatible w/lvmlockd

    Resolves: rhbz#1969968


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.1.1-98.2
changelog:
  - gcp-vpc-move-route/gcp-vpc-move-vip: add serviceaccount JSON file
    support
  - gcp-pd-move/gcp-vpc-move-route: dont fail with configuration rc
    when it might be a network hickup

    Resolves: rhbz#2011839
    Resolves: rhbz#2008955


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-12
changelog:
  - Bump up the limit of signature header to 64MB (#1918777)
  - Add fapolicyd plugin (#1923167)
  - Unblock signals in forked scriptlets (#1913765)
  - Fix ambiguous diagnostics output on file triggers (#1883338)
  - Ensure ELF files get stripped when debuginfo is disabled (#1634084)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-13
changelog:
  - Fix minor issues found by COVSCAN in fapolicyd plugin
  - Actually honor libarchive bcond at configure time (#1902887)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-15
changelog:
  - Add out-of-bounds checks to hdrblobInit() (#1929445)
  - Fixes CVE-2021-20266
  - Fix regression in brp-strip causing kmods to lose SecureBoot sig (#1967291)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-16
changelog:
  - Add support for read-only sqlite rpmdb (#1938928)
  - Drop compat .decode() method from returned Py3 strings (#1840142)


author: Jun Aruga <jaruga@redhat.com> - 2.5.1-99
changelog:
  - Fix generated rdoc template issues.
    * ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch
    Resolves: rhbz#1612026


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-99
changelog:
  - Additional OpenSSL 1.1.1 fixes.
    * ruby-2.6.0-fix-test-failure-with-TLS-1.3-maint.patch
    * ruby-2.6.0-config-support-include-directive.patch
    * ruby-2.6.0-use-larger-keys-for-SSL-tests.patch
    Related: rhbz#1616213


author: Vít Ondruch <vondruch@redhat.com> - 2.5.1-100
changelog:
  - Properly harden package using -fstack-protector-strong.
    * ruby-2.6.0-configure-fstack-protector-strong.patch
    Resolves: rhbz#1624168


author: Vít Ondruch <vondruch@redhat.com> - 2.5.5-104
changelog:
  - Update to Ruby 2.5.5.
    * Remove Patch25: ruby-2.6.0-Update-for-tzdata-2018f.patch; subsumed
    * Remove Patch11: ruby-2.6.0-Try-to-update-cert.patch; subsumed
    * Remove Patch19: ruby-2.6.0-net-http-net-ftp-fix-session-resumption-with
        -TLS-1.3.patch; subsumed
    Resolves: rhbz#1688758
  - Don't ship .stp files when SystemTap support is disabled.
    Related: rhbz#1657915
  - Fix CovScan issues.
    Resolves: rhbz#1628592


author: Jun Aruga <jaruga@redhat.com> - 2.5.5-105
changelog:
  - Use ffi_closure_alloc to avoid segmentation fault by libffi on aarch64.
    Resolves: rhbz#1727832
  - Properly support %prerelease in %gemspec_ macros.
    Related: rhbz#1688758
  - Fix rdoc gzipped javascript pages are not the same across multilib.
    Resolves: rhbz#1719647


author: Pavel Valena <pvalena@redhat.com> - 2.5.9-107
changelog:
  - Update to Ruby 2.5.9.
    * Remove Patch20: ruby-2.6.0-rdoc-6.0.1-fix-template-typo.patch; subsumed
    Resolves: rhbz#1757844
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given and address
    contains leading zero
    Resolves: rhbz#1950308


author: Jarek Prokop <jprokop@redhat.com> - 2.5.9-108
changelog:
  - Fix command injection vulnerability in RDoc.
    Resolves: CVE-2021-31799
  - Fix StartTLS stripping vulnerability in Net::IMAP
    Resolves: CVE-2021-32066
  - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
    Resolves: CVE-2021-31810


author: Jun Aruga <jaruga@redhat.com> - 2.6.3-105
changelog:
  - Update to Ruby 2.6.3 by merging Fedora master branch (commit: 1cc2a49)
    * Properly generate "ruby(rubygems)" versioned dependencies.
    * Extract composition of dependecy strings into helper.
    * Loosen RDoc dependency.
    * Upstream fix adding -C flag instead of changing directory for gem build.
    * Remove obsolete Group tag
    * Fix ".include =" support in openssl.cnf.
    * Link IRB back to StdLib.
    * Link IRB files instead of directories.
    * Exclude irb.rb from ruby-libs.
    Resolves: rhbz#1672575


author: Jun Aruga <jaruga@redhat.com> - 2.6.3-106
changelog:
  - Use ffi_closure_alloc to avoid segmentation fault by libffi on aarch64.
    Resolves: rhbz#1727832
  - Properly support %prerelease in %gemspec_ macros.
    Related: rhbz#1672575


author: Jarek Prokop <jprokop@redhat.com> - 2.6.7-107
changelog:
  - Upgrade to Ruby 2.6.7.
    Resolves: rhbz#1757846
  - Resolv::DNS: timeouts if multiple IPv6 name servers are given an address
    containing leading zero
    Resolves: rhbz#1950307
  - Fix: Rubygem-bundler: Don't use insecure tmp directory as home
    allows for execution of malicious code.
    Resolves: CVE-2019-3881


author: Jun Aruga <jaruga@redhat.com> - 2.6.9-108
changelog:
  - Upgrade to Ruby 2.6.9.
  - Skip JIT tests in RHEL 8.
  - Fix the issues required to start the "make test-bundler" itself.
  - Fix Bundler dependency confusion.
    Resolves: CVE-2020-36327


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-68.rc92
changelog:
  - update to https://github.com/opencontainers/runc/releases/tag/v1.0.0-rc92
  - propagate proper CFLAGS to CGO_CFLAGS to assure code hardening and optimization
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.0.0-73.rc95
changelog:
  - fix podman run --pid=host command causes OCI permission error
  - rc95 fixes CVE-2021-30465
  - Related: #2070961


author: Andreas Schneider <asn@redhat.com> - 4.14.4-0
changelog:
  - related: rhbz#1944657 - Update to version 4.14.5
  - resolves: rhbz#1969787 - Fix memory leak in RPC server
  - resolves: rhbz#1954974 - Validate smb.conf option for domain members with testparm
  - resolves: rhbz#1963298 - Fix smbd trying to delete files with wrong permissions
  - resolves: rhbz#1890008 - Update rpcclient manpage to list all available commands
  - resolves: rhbz#1857254 - Update smbcacls manpage to document inhertance flags


author: Andreas Schneider <asn@redhat.com> - 4.14.4-1
changelog:
  - resolves: rhbz#1974792 - Create a subpackage for vfs-io-uring
  - resolves: rhbz#1965397 - Raise log level for dfs ENOENT debug message


author: Andreas Schneider <asn@redhat.com> - 4.14.4-4
changelog:
  - resolves: rhbz#2021163
    Fix CVE-2016-2124
  - resolves: rhbz#2021167
    Fix CVE-2021-23192
  - resolves: rhbz#2021171
    Fix CVE-2020-25717


author: Andreas Schneider <asn@redhat.com> - 4.14.5-5
changelog:
  - resolves: rhbz#2021493 - Add missing PAC buffer types to krb5pac.idl
  - related: rbhz#2021171 - Fix regression with 'allow trusted domains = no'


author: Andreas Schneider <asn@redhat.com> - 4.14.5-9
changelog:
  - resolves: rhbz#2046174 - Fix username map script regression of CVE-2020-25717
  - resolves: rhbz#2046160 - Fix possible segfault while joining a domain
  - resolves: rhbz#2046152 - Fix CVE-2021-44142


author: Andreas Schneider <asn@redhat.com> - 4.13.3-3
changelog:
  - resolves: #1924615 - Fix a memcache bug when cache is full
  - resolves: #1924571 - Ensure that libwbclient has been updated before
                         restarting services


author: Andreas Schneider <asn@redhat.com> - 4.14.4-2
changelog:
  - resolves: rhbz#1944657 - Update to version 4.14.4
  - resolves: rhbz#1949445 - Fix CVE-2021-20254
  - resolves: rhbz#1947945 - Fix libsmbldap.so.2 not being a symbolic link
  - resolves: rhbz#1908506 - Fix creating the gencache user directory
  - resolves: rhbz#1901029 - Build the vfs_io_uring module


author: Eduardo Santiago <santiago@redhat.com> - 1:0.1.41-3
changelog:
  - patch broken gating tests: improper 'jq' usage, and use 'registry:2.6'
    (instead of :2) to work around broken image pushed by docker


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-7
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/2e90a8a)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-9
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/a05ddb8)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-10
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/6c0e35a)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-11
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/b4210c0)
  - Resolves: #1914884


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.1-12
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/3abb778)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/e72dd9c)
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.2-10
changelog:
  - update shortnames from Pyxis
  - sync with the vendored versions in 3.0-8.5.0
  - bump release to assure upgrade path from 3.0-8.4.0
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.2.4-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.2
    (https://github.com/containers/skopeo/commit/9921983)
  - update shortnames from Pyxis
  - Related: #2009153


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.0-7
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.4
    (https://github.com/containers/skopeo/commit/ea32394)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.1-2
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.4
    (https://github.com/containers/skopeo/commit/130f32f)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 1:1.4.2-0.1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.4
    (https://github.com/containers/skopeo/commit/01e51ce)
  - Related: #1934415


author: Jindrich Novy <jnovy@redhat.com> - 0.4.0-1
changelog:
  - update to v.0.4.0
  - sync with fedora spec
  - drop applied CVE-2019-14378 patch
  - Resolves: #1766774


author: Jindrich Novy <jnovy@redhat.com> - 1.1.1-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.1
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.2-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.2
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.3
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.4-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.4
  - Related: #1821193


author: Jindrich Novy <jnovy@redhat.com> - 1.1.6-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.6
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.7-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.7
  - Related: #1883490


author: Jindrich Novy <jnovy@redhat.com> - 1.1.8-1
changelog:
  - update to
    https://github.com/rootless-containers/slirp4netns/releases/tag/v1.1.8
  - Related: #1883490


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-5
changelog:
  - Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-6
changelog:
  - Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
  - Resolves: rhbz#1915395 - Memory leak in the simple access provider
  - Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.0-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
  - Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
  - Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
  - Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
  - Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
  - Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
  - Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
  - Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
  - Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
  - Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
  - Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
  - Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
  - Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
  - Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
  - Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
  - Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
  - Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
  - Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
  - Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
  - Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
  - Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
  - Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
  - Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
  - Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
  - Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
  - Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
  - Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
  - Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
  - Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.1
changelog:
  - Resolves: rhbz#2014460 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing [rhel-8.5.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.2
changelog:
  - Resolves: rhbz#2018440 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest) [rhel-8.5.0.z]
  - Resolves: rhbz#2016923 - autofs lookups for unknown mounts are delayed for 50s [rhel-8.5.0.z]
  - Resolves: rhbz#2021499 - Make backtrace less "chatty" (avoid duplicate backtraces) [rhel-8.5.0.z]
  - Resolves: rhbz#2013379 - Lookup with fully-qualified name does not work with 'cache_first = True' [rhel-8.5.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.3
changelog:
  - Resolves: rhbz#2028828 - pam responder does not call initgroups to refresh the user entry [rhel-8.5.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.4
changelog:
  - Resolves: rhbz#2030651 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries [rhel-8.5.0.z]
  - Resolves: rhbz#2035285 - AD Domain in the AD Forest Missing after sssd latest update [rhel-8.5.0.z]


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-4
changelog:
  - Removing build-time dependency on sharutils(rhbz#1587877)
  - Changing git dependency to smaller git-core


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.2-6
changelog:
  - Resolves: #1715423 - tcpdump pre creates user and groups unconditionally
  - Resolves: #1655622 - CVE-2018-19519 Stack-based buffer over-read in print-hncp.c:print_prefix() via crafted pcap


author: Michal Ruprich <mruprich@redhat.com> - 14:4.9.3-2
changelog:
  - Resolves: #1860216 - tcpdump can not parse mptcp options
  - Resolves: #1901635 - ppp decapsulator can be convinced to allocate a large amount of memory
  - Adding tedude test to gating


author: Jan Grulich <jgrulich@redhat.com> - 1.11.0-1
changelog:
  - Update to 1.11.0
    Resolves: bz#1880985
  - Backport fix to allow Tigervnc use boolean values in config files
    Resolves: bz#1883415


author: Jan Grulich <jgrulich@redhat.com> - 1.11.0-2
changelog:
  - Revert removal of vncserver
    Resolves: bz#1897504
  - Correctly start vncsession as a daemon
    Resolves: bz#1897498


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16.3
changelog:
  - 2028341 - CVE-2021-3984 vim: illegal memory access when C-indenting could lead to Heap Buffer Overflow [rhel-8.6.0]
  - 2028430 - CVE-2021-4019 vim: heap-based buffer overflow in find_help_tags() in src/help.c [rhel-8.6.0]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16.4
changelog:
  - CVE-2021-4193 vim: vulnerable to Out-of-bounds Read
  - CVE-2021-4192 vim: vulnerable to Use After Free


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16.5
changelog:
  - CVE-2022-0261 vim: Heap-based Buffer Overflow in block_insert() in src/ops.c
  - CVE-2022-0318 vim: heap-based buffer overflow in utf_head_off() in mbyte.c


author: Tomas Korbar <tkorbar@redhat.com> - 2:8.0.1763-16.8
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - Resolves: rhbz#2049403


author: Tomas Korbar <tkorbar@redhat.com> - 2:8.0.1763-16.9
changelog:
  - CVE-2022-0392 vim: heap-based buffer overflow in getexmodeline() in ex_getln.c
  - Improve fix
  - Resolves: rhbz#2049403


author: Tomas Korbar <tkorbar@redhat.com> - 2:8.0.1763-16.11
changelog:
  - CVE-2022-0413 vim: use after free in src/ex_cmds.c
  - Fix specfile problems
  - Resolves: rhbz#2048525


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16
changelog:
  - 2004974 - CVE-2021-3796 vim: use-after-free in nv_replace() in normal.c [rhel-8.5.0]
  - 2004891 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-8.5.0]


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-11
changelog:
  - IBM Z hardware-accelerated deflate for s390x architectures
  - IBM CRC32 optimalization for POWER 8+ architectures
  - fixed firefox crash due to zlib (#1741266)
  - added test for crc32


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-13
changelog:
  - Added -DDFLTCC parameter to configure to enable 
  - Z hardware-accelerated deflate for s390x architectures (#1659433)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-16
changelog:
  - Permit a deflateParams() parameter change
  - Another fix for Z hardware-accelerated deflate for s390x architectures
  - according to previous change by upstream


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-17
changelog:
  - Fixed DFLTCC compression level switching issues (#1875492)
  - Enabled HW compression for compression levels 1 through 6 (#1847438)
  - Fixed inflateSyncPoint() bad return value on z15 (#1888930)


