# changelog

author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-233.el8]
changelog:
  - [fs] nfs: ensure correct writeback errors are returned on close() (Scott Mayhew) [1849424]
  - [netdrv] net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task() (Dean Nelson) [1824858]
  - [crypto] crypto: ecc - SP800-56A rev 3 local public key validation (Herbert Xu) [1855817]
  - [crypto] crypto: dh - SP800-56A rev 3 local public key validation (Herbert Xu) [1855817]
  - [crypto] crypto: dh - check validity of Z before export (Herbert Xu) [1855817]
  - [lib] lib/mpi: Add mpi_sub_ui() (Herbert Xu) [1855817]
  - [crypto] crypto: ecdh - check validity of Z before export (Herbert Xu) [1855817]
  - [netdrv] net: thunderx: initialize VF's mailbox mutex before first usage (Dean Nelson) [1866827]
  - [kernel] timers: Lower base clock forwarding threshold (Phil Auld) [1833096]
  - [kernel] timers: Remove must_forward_clk (Phil Auld) [1833096]
  - [kernel] timers: Spare timer softirq until next expiry (Phil Auld) [1833096]
  - [kernel] timers: Expand clk forward logic beyond nohz (Phil Auld) [1833096]
  - [kernel] timers: Reuse next expiry cache after nohz exit (Phil Auld) [1833096]
  - [kernel] timers: Always keep track of next expiry (Phil Auld) [1833096]
  - [kernel] timers: Optimize _next_timer_interrupt() level iteration (Phil Auld) [1833096]
  - [kernel] timers: Add comments about calc_index() ceiling work (Phil Auld) [1833096]
  - [kernel] timers: Move trigger_dyntick_cpu() to enqueue_timer() (Phil Auld) [1833096]
  - [kernel] timers: Use only bucket expiry for base->next_expiry value (Phil Auld) [1833096]
  - [kernel] timers: Preserve higher bits of expiration on index calculation (Phil Auld) [1833096]
  - [kernel] timer: Fix wheel index calculation on last level (Phil Auld) [1833096]
  - [kernel] timer: Prevent base->clk from moving backward (Phil Auld) [1833096]
  - [kernel] timer: Read jiffies once when forwarding base clk (Phil Auld) [1833096]
  - [powerpc] powerpc/64: Update Speculation_Store_Bypass in /proc/<pid>/status (Gustavo Duarte) [1773868]
  - [scsi] scsi: virtio-scsi: Correctly handle the case where all LUNs are unplugged (Maxim Levitsky) [1756093]
  - [kvm] kvm: x86: replace kvm_spec_ctrl_test_value with runtime test on the host (Maxim Levitsky) [1853447]
  - [kvm] x86/kvm: Move context tracking where it belongs (Nitesh Narayan Lal) [1854011]
  - [scsi] scsi: megaraid_sas: Clear affinity hint (Tomas Henzl) [1828351]
  - [netdrv] revert "vxlan: fix tos value before xmit" (Andrea Claudi) [1862166]
  - [net] udp: Copy has_conns in reuseport_grow(). (Marcelo Leitner) [1867160]
  - [net] dev: Defer free of skbs in flush_backlog (Marcelo Leitner) [1867160]
  - [include] net: core: reduce recursion limit value (Marcelo Leitner) [1867160]
  - [netdrv] pppoe: only process PADT targeted at local interfaces (Andrea Claudi) [1866850]
  - [net] espintcp: count packets dropped in espintcp_rcv (Sabrina Dubroca) [1866393]
  - [net] espintcp: handle short messages instead of breaking the encap socket (Sabrina Dubroca) [1866393]
  - [net] espintcp: recv() should return 0 when the peer socket is closed (Sabrina Dubroca) [1866393]
  - [net] espintcp: support non-blocking sends (Sabrina Dubroca) [1866393]
  - [net] mptcp: be careful on subflow creation (Davide Caratti) [1862200]
  - [net] mptcp: fix bogus sendmsg() return code under pressure (Davide Caratti) [1862200]
  - [net] mptcp: fix joined subflows with unblocking sk (Davide Caratti) [1862200]
  - [net] subflow: explicitly check for plain tcp rsk (Davide Caratti) [1862200]
  - [net] mptcp: silence warning in subflow_data_ready() (Davide Caratti) [1862200]
  - [net] mptcp: fix race in subflow_data_ready() (Davide Caratti) [1862200]
  - [net] mptcp: fix memory leak in mptcp_subflow_create_socket() (Davide Caratti) [1862200]
  - [net] mptcp: don't leak msk in token container (Davide Caratti) [1862200]
  - [net] ipv4: Silence suspicious RCU usage warning (Guillaume Nault) [1866430]
  - [net] devinet: fix memleak in inetdev_init() (Guillaume Nault) [1866430]
  - [net] ipip: fix wrong address family in init error path (Guillaume Nault) [1866430]
  - [net] inet_csk: Fix so_reuseport bind-address cache in tb->fast* (Guillaume Nault) [1866430]
  - [net] ipmr: Add lockdep expression to ipmr_for_each_table macro (Guillaume Nault) [1866430]
  - [net] ipmr: Fix RCU list debugging warning (Guillaume Nault) [1866430]
  - [net] tcp: make sure listeners don't initialize congestion-control state (Paolo Abeni) [1865904]
  - [net] sched: The error lable position is corrected in ct_init_module (Davide Caratti) [1865890]
  - [net] sched: cls_api: fix nooffloaddevcnt warning dmesg log (Davide Caratti) [1865890]
  - [net] tls: fix race condition causing kernel panic (Sabrina Dubroca) [1861756]
  - [net] tls: free record only on encryption error (Sabrina Dubroca) [1861756]
  - [net] tls: fix encryption error checking (Sabrina Dubroca) [1861756]
  - [net] l2tp: add sk_family checks to l2tp_validate_socket (Guillaume Nault) [1861453]
  - [net] l2tp: do not use inet_hash()/inet_unhash() (Guillaume Nault) [1861453]
  - [net] tipc: allow to build NACK message in link timeout function (Xin Long) [1860877]
  - [net] tipc: fix retransmission on unicast links (Xin Long) [1860877]
  - [net] tipc: fix NULL pointer dereference in tipc_disc_rcv() (Xin Long) [1860877]
  - [net] tipc: remove set but not used variable 'prev' (Xin Long) [1860877]
  - [net] tipc: call tsk_set_importance from tipc_topsrv_create_listener (Xin Long) [1860877]
  - [net] tipc: add support for broadcast rcv stats dumping (Xin Long) [1860877]
  - [net] tipc: enable broadcast retrans via unicast (Xin Long) [1860877]
  - [net] tipc: add back link trace events (Xin Long) [1860877]
  - [net] tipc: introduce Gap ACK blocks for broadcast link (Xin Long) [1860877]
  - [net] tipc: block BH before using dst_cache (Xin Long) [1860877]
  - [net] tipc: fix partial topology connection closure (Xin Long) [1860877]
  - [net] xfrm: policy: match with both mark and mask on user interfaces (Xin Long) [1854116]
  - [scsi] scsi: dh: Add Fujitsu device to devinfo and dh lists (Ewan Milne) [1861418]
  - [x86] kvm: Set KVM_SOFT_MAX_VCPUS to 1024 (Eduardo Habkost) [1856996]
  - [md] dm integrity: fix integrity recalculation that is improperly skipped (Mike Snitzer) [1860160]
  - [netdrv] ibmvnic: Fix IRQ mapping disposal in error path (Steve Best) [1867498]
  - [infiniband] IB/hfi1: Do not destroy link_wq when the device is shut down (Kamal Heib) [1858392]
  - [infiniband] IB/hfi1: Do not destroy hfi1_wq when the device is shut down (Kamal Heib) [1858392]
  - [netdrv] Revert "net/broadcom: Clean broadcom code from driver versions" (Jonathan Toppins) [1867146]
  - [net] devmap: Use bpf_map_area_alloc() for allocating hash buckets (Jiri Benc) [1842380]
  - [kernel] kexec_file: Correctly output debugging information for the PT_LOAD ELF header (Lianbo Jiang) [1861186]
  - [kernel] kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges (Lianbo Jiang) [1861186]
  - [x86] x86/crash: Correct the address boundary of function parameters (Lianbo Jiang) [1861186]
  - [fs] ceph: handle zero-length feature mask in session messages (Jeff Layton) [1866018]
  - [s390] s390/bpf: Tolerate not converging code shrinking (Yauheni Kaliuta) [1857120]
  - [s390] s390/bpf: Use brcl for jumping to exit_ip if necessary (Yauheni Kaliuta) [1857120]
  - [s390] s390/bpf: Fix sign extension in branch_ku (Yauheni Kaliuta) [1857120]
  - [tools] selftests: bpf: test_kmod.sh: Fix running out of srctree (Yauheni Kaliuta) [1857120]
  - [lib] bpf: revert "test_bpf: Flag tests that cannot be jited on s390" (Yauheni Kaliuta) [1857120]
  - [kernel] uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned (Oleg Nesterov) [1848596]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-234.el8]
changelog:
  - [netdrv] vrf: Fix IPv6 with qdisc and xfrm (Sabrina Dubroca) [1868565]
  - [netdrv] vrf: make sure skb->data contains ip header to make routing (Sabrina Dubroca) [1868565]
  - [netdrv] vrf: Check skb for XFRM_TRANSFORMED flag (Sabrina Dubroca) [1868565]
  - [net] Do not clear the sock TX queue in sk_set_socket() (Andrea Claudi) [1850421]
  - [net] Use RCU_INIT_POINTER() to set sk_wq (Andrea Claudi) [1850421]
  - [net] netfilter: ip6tables: Add a .pre_exit hook in all ip6table_foo.c. (Florian Westphal) [1862384]
  - [net] netfilter: iptables: Add a .pre_exit hook in all iptable_foo.c. (Florian Westphal) [1862384]
  - [net] netfilter: ipset: Fix an error code in ip_set_sockfn_get() (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: Don't account for expired elements on insertion (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: Drop spurious condition for overlap detection on insertion (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: Detect partial overlaps on insertion (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() (Florian Westphal) [1862384]
  - [net] netfilter: nf_tables: fix nat hook table deletion (Florian Westphal) [1862384]
  - [net] netfilter: ipset: call ip_set_free() instead of kfree() (Florian Westphal) [1862384]
  - [net] netfilter: ip6tables: Split ip6t_unregister_table() into pre_exit and exit helpers. (Florian Westphal) [1862384]
  - [net] netfilter: iptables: Split ipt_unregister_table() into pre_exit and exit helpers. (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_pipapo: Disable preemption before getting per-CPU pointer (Florian Westphal) [1862384]
  - [net] netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported (Florian Westphal) [1862384]
  - [net] netfilter: conntrack: comparison of unsigned in cthelper confirmation (Florian Westphal) [1862384]
  - [net] netfilter: conntrack: refetch conntrack after nf_conntrack_update() (Florian Westphal) [1862384]
  - [net] netfilter: conntrack: Pass value of ctinfo to __nf_conntrack_update (Florian Westphal) [1862384]
  - [net] netfilter: conntrack: make conntrack userspace helpers work again (Florian Westphal) [1862384]
  - [net] netfilter: nfnetlink_cthelper: unbreak userspace helper support (Florian Westphal) [1862384]
  - [net] netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build (Florian Westphal) [1862384]
  - [net] netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_bitmap: initialize set element extension in lookups (Florian Westphal) [1862384]
  - [net] netfilter: nft_fwd_netdev: validate family and chain type (Florian Westphal) [1862384]
  - [net] netfilter: nft_payload: add missing attribute validation for payload csum flags (Florian Westphal) [1862384]
  - [net] netfilter: cthelper: add missing attribute validation for cthelper (Florian Westphal) [1862384]
  - [net] netfilter: ipset: Fix forceadd evaluation path (Florian Westphal) [1862384]
  - [net] netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets (Florian Westphal) [1862384]
  - [net] netfilter: ctnetlink: netns exit must wait for callbacks (Florian Westphal) [1862384]
  - [arm64] kvm: arm64: Don't inherit exec permission across page-table levels (Andrew Jones) [1869297]
  - [arm64] kvm: arm64: Flush the instruction cache if not unmapping the VM on reboot (Andrew Jones) [1869297]
  - [s390] s390, dcssblk: kaddr and pfn can be NULL to ->direct_access() (Claudio Imbrenda) [1868927]
  - [fs] chardev: Avoid potential use-after-free in 'chrdev_open()' (Vladis Dronov) [1866324] {CVE-2020-0305}
  - [net] net: accept an empty mask in /sys/class/net/*/queues/rx-*/rps_cpus (Nitesh Narayan Lal) [1868433]
  - [x86] Revert "x86/intel: Disable HPET on Intel Ice Lake platforms" (David Arcari) [1868405]
  - [kernel] sched: Fix race against ptrace_freeze_trace() (Oleg Nesterov) [1862560]
  - [kernel] sched: Fix loadavg accounting race (Oleg Nesterov) [1862560]
  - [kernel] kernel/sched/: remove caller signal_pending branch predictions (Oleg Nesterov) [1862560]
  - [kernel] locking/spinlock, sched/core: Clarify requirements for smp_mb__after_spinlock() (Oleg Nesterov) [1862560]
  - [nvme] nvme: multipath: round-robin: eliminate "fallback" variable (Gopal Tiwari) [1868443]
  - [nvme] nvme: multipath: round-robin: fix single non-optimized path case (Gopal Tiwari) [1868443]
  - [nvme] nvme-multipath: do not fall back to __nvme_find_path() for non-optimized paths (Gopal Tiwari) [1868443]
  - [nvme] nvme-multipath: fix logic for non-optimized paths (Gopal Tiwari) [1868443]
  - [tools] selftests/bpf: Fix segmentation fault in test_progs (Yauheni Kaliuta) [1868494]
  - [pci] hv: Fix a timing issue which causes kdump to fail occasionally (Mohammed Gamal) [1861960]
  - [hv] hv: vmbus: Only notify Hyper-V for die events that are oops (Vitaly Kuznetsov) [1868131]
  - [x86] kvm: nsvm: Correctly set the shadow NPT root level in its MMU role (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: x86: drop superfluous mmu_check_root() from fast_pgd_switch() (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: use nested_svm_load_cr3() on guest->host switch (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: implement nested_svm_load_cr3() and use it for host->guest switch (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: move kvm_set_cr3() after nested_svm_uninit_mmu_context() (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: introduce nested_svm_load_cr3()/nested_npt_enabled() (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: prepare to handle errors from enter_svm_guest_mode() (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: reset nested_run_pending upon nested_svm_vmrun_msrpm() failure (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: mmu: stop dereferencing vcpu->arch.mmu to get the context for MMU init (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: split kvm_init_shadow_npt_mmu() from kvm_init_shadow_mmu() (Vitaly Kuznetsov) [1845507]
  - [security] selinux: compute genfs symlink context in case of CephFS (Ondrej Mosnacek) [1865800]
  - [fs] ceph: set sec_context xattr on symlink creation (Ondrej Mosnacek) [1861509]
  - [tools] selftests: bpf: define SO_RCVTIMEO and SO_SNDTIMEO properly for ppc64le (Jiri Benc) [1860386]
  - [tools] bpf: Sync RHEL version of asm-generic/socket.h to tools/ (Jiri Benc) [1860386]
  - [tools] selftests: bpf: skip tests not working on RHEL (Jiri Benc) [1866908]
  - [tools] Revert "selftests: bpf: disable test_lwt_seg6local" (Jiri Benc) [1866908]
  - [tools] Revert "bpf: selftests: remove test_bpftool_build.sh from TEST_PROGS" (Jiri Benc) [1866908]
  - [tools] selftests: add option to skip specific tests in RHEL (Jiri Benc) [1866908]
  - [tools] selftests: bpf: switch off timeout (Jiri Benc) [1866908]
  - [tools] selftest/firmware: Add selftest timeout in settings (Jiri Benc) [1866908]
  - [tools] selftests/harness: Limit step counter reporting (Jiri Benc) [1866908]
  - [tools] selftests/harness: Clean up kern-doc for fixtures (Jiri Benc) [1866908]
  - [tools] selftests: fix condition in run_tests (Jiri Benc) [1866908]
  - [tools] selftests: do not use .ONESHELL (Jiri Benc) [1866908]
  - [tools] selftests/harness: Report skip reason (Jiri Benc) [1866908]
  - [tools] selftests/harness: Display signed values correctly (Jiri Benc) [1866908]
  - [tools] selftests/harness: Refactor XFAIL into SKIP (Jiri Benc) [1866908]
  - [tools] selftests/harness: Switch to TAP output (Jiri Benc) [1866908]
  - [tools] selftests: Add header documentation and helpers (Jiri Benc) [1866908]
  - [tools] kselftest: fix TAP output for skipped tests (Jiri Benc) [1866908]
  - [tools] kselftest: ksft_test_num return type should be unsigned (Jiri Benc) [1866908]
  - [tools] selftests: introduce gen_tar Makefile target (Jiri Benc) [1866908]
  - [tools] kselftest: add fixture variants (Jiri Benc) [1866908]
  - [tools] kselftest: run tests by fixture (Jiri Benc) [1866908]
  - [tools] kselftest: create fixture objects (Jiri Benc) [1866908]
  - [tools] kselftest: factor out list manipulation to a helper (Jiri Benc) [1866908]
  - [tools] selftests: add build/cross-build dependency check script (Jiri Benc) [1866908]
  - [tools] kselftest/runner: allow to properly deliver signals to tests (Jiri Benc) [1866908]
  - [tools] selftests/harness: fix spelling mistake "SIGARLM" -> "SIGALRM" (Jiri Benc) [1866908]
  - [tools] selftests: enforce local header dependency in lib.mk (Jiri Benc) [1866908]
  - [tools] selftests/harness: Handle timeouts cleanly (Jiri Benc) [1866908]
  - [tools] selftests/harness: Move test child waiting logic (Jiri Benc) [1866908]
  - [tools] selftests: Fix kselftest O=objdir build from cluttering top level objdir (Jiri Benc) [1866908]
  - [tools] selftests: allow detection of build failures (Jiri Benc) [1866908]
  - [tools] selftests: fix build behaviour on targets' failures (Jiri Benc) [1866908]
  - [tools] kselftest: Support old perl versions (Jiri Benc) [1866908]
  - [tools] kselftest/runner: Print new line in print of timeout log (Jiri Benc) [1866908]
  - [tools] selftests: Fix dangling documentation references to kselftest_module.sh (Jiri Benc) [1866908]
  - [tools] kselftest: Fix NULL INSTALL_PATH for TARGETS runlist (Jiri Benc) [1866908]
  - [tools] selftests: Move kselftest_module.sh into kselftest/ (Jiri Benc) [1866908]
  - [tools] selftests: gen_kselftest_tar.sh: Do not clobber kselftest/ (Jiri Benc) [1866908]
  - [tools] selftests/kselftest/runner.sh: Add 45 second timeout per test (Jiri Benc) [1866908]
  - [tools] kselftest: exclude failed TARGETS from runlist (Jiri Benc) [1866908]
  - [tools] kselftest: add capability to skip chosen TARGETS (Jiri Benc) [1866908]
  - [tools] selftests: Add kselftest-all and kselftest-install targets (Jiri Benc) [1866908]
  - [tools] selftests: use "$(MAKE)" instead of "make" (Jiri Benc) [1866908]
  - [tools] kselftest: save-and-restore errno to allow for m formatting (Jiri Benc) [1866908]
  - [tools] treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 481 (Jiri Benc) [1866908]
  - [tools] selftests/harness: Allow test to configure timeout (Jiri Benc) [1866908]
  - [tools] selftests: avoid KBUILD_OUTPUT dir cluttering with selftest objects (Jiri Benc) [1866908]
  - [tools] selftests: fix bpf build/test workflow regression when KBUILD_OUTPUT is set (Jiri Benc) [1866908]
  - [tools] selftests: fix install target to use default install path (Jiri Benc) [1866908]
  - [tools] selftests: build and run gpio when output directory is the src dir (Jiri Benc) [1866908]
  - [documentation] doc: kselftest: Fix KBUILD_OUTPUT usage instructions (Jiri Benc) [1866908]
  - [tools] selftests: fix headers_install circular dependency (Jiri Benc) [1866908]
  - [tools] selftests/harness: Add 30 second timeout per test (Jiri Benc) [1866908]
  - [tools] kselftest: Add test module framework header (Jiri Benc) [1866908]
  - [tools] kselftest: Add test runner creation script (Jiri Benc) [1866908]
  - [tools] selftests/harness: Update named initializer syntax (Jiri Benc) [1866908]
  - [tools] selftest: include stdio.h in kselftest.h (Jiri Benc) [1866908]
  - [tools] selftests: do not macro-expand failed assertion expressions (Jiri Benc) [1866908]
  - [documentation] Documentation/dev-tools: clean up kselftest.rst (Jiri Benc) [1866908]
  - [documentation] doc: dev-tools: kselftest.rst: update config file location (Jiri Benc) [1866908]
  - [documentation] doc: dev-tools: kselftest.rst: update contributing new tests (Jiri Benc) [1866908]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-235.el8]
changelog:
  - [s390] scsi: zfcp: Move allocation of the shost object to after xconf- and xport-data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Fence early sysfs interfaces for accesses of shost objects (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Fence adapter status propagation for common statuses (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Move p-t-p port allocation to after xport data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Fence fc_host updates during link-down handling (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Move fc_host updates during xport data handling into fenced function (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Move shost updates during xconfig data handling into fenced function (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Move shost modification after QDIO (re-)open into fenced function (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: fix fc_host attributes that should be unknown on local link down (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: wire previously driver-specific sysfs attributes also to fc_host (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: expose fabric name as common fc_host sysfs attribute (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: add diagnostics buffer for exchange config data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: diagnostics buffer caching and use for exchange port data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: signal incomplete or error for sync exchange config/port data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Fix use-after-free in request timeout handlers (Claudio Imbrenda) [1872796]
  - [tools] selftests/powerpc: Update the stack expansion test (Gustavo Duarte) [1869755]
  - [mm] powerpc: Allow 4224 bytes of stack expansion for the signal frame (Gustavo Duarte) [1869755]
  - [tools] selftests/powerpc: Add test of stack expansion logic (Gustavo Duarte) [1869755]
  - [mm] mm: check that mm is still valid in madvise() (Jeff Moyer) [1874560]
  - [block] block: virtio_blk: fix handling single range discard request (Ming Lei) [1842035]
  - [block] block: respect queue limit of max discard segment (Ming Lei) [1842035]
  - [fs] io_uring: Fix NULL pointer dereference in loop_rw_iter() (Jeff Moyer) [1854649]
  - [fs] io_uring: return locked and pinned page accounting (Jeff Moyer) [1854649]
  - [fs] io_uring: always allow drain/link/hardlink/async sqe flags (Jeff Moyer) [1854649]
  - [fs] io_uring: ensure double poll additions work with both request types (Jeff Moyer) [1854649]
  - [fs] io_uring: fix recvmsg memory leak with buffer selection (Jeff Moyer) [1854649]
  - [fs] io_uring: fix missing msg_name assignment (Jeff Moyer) [1854649]
  - [fs] io_uring: fix memleak in io_sqe_files_register() (Jeff Moyer) [1854649]
  - [fs] io_uring: account user memory freed when exit has been queued (Jeff Moyer) [1854649]
  - [fs] io_uring: fix memleak in __io_sqe_files_update() (Jeff Moyer) [1854649]
  - [fs] io_uring: fix regression with always ignoring signals in io_cqring_wait() (Jeff Moyer) [1854649]
  - [fs] io_uring: use signal based task_work running (Jeff Moyer) [1854649]
  - [kernel] task_work: teach task_work_add() to do signal_wake_up() (Jeff Moyer) [1854649]
  - [fs] io_uring: fix missing ->mm on exit (Jeff Moyer) [1854649]
  - [fs] io_uring: fix potential use after free on fallback request free (Jeff Moyer) [1854649]
  - [fs] io_uring: fix req->work corruption (Jeff Moyer) [1854649]
  - [fs] io_uring: fix NULL-mm for linked reqs (Jeff Moyer) [1854649]
  - [fs] io_uring: fix current->mm NULL dereference on exit (Jeff Moyer) [1854649]
  - [fs] io_uring: fix hanging iopoll in case of -EAGAIN (Jeff Moyer) [1854649]
  - [fs] io_uring: fix io_sq_thread no schedule when busy (Jeff Moyer) [1854649]
  - [fs] io_uring: fix possible race condition against REQ_F_NEED_CLEANUP (Jeff Moyer) [1854649]
  - [fs] io_uring: reap poll completions while waiting for refs to drop on exit (Jeff Moyer) [1854649]
  - [fs] io_uring: acquire 'mm' for task_work for SQPOLL (Jeff Moyer) [1854649]
  - [fs] io_uring: add memory barrier to synchronize io_kiocb's result and iopoll_completed (Jeff Moyer) [1854649]
  - [fs] io_uring: don't fail links for EAGAIN error in IOPOLL mode (Jeff Moyer) [1854649]
  - [fs] io_uring: fix io_kiocb.flags modification race in IOPOLL mode (Jeff Moyer) [1854649]
  - [fs] io_uring: allow O_NONBLOCK async retry (Jeff Moyer) [1854649]
  - [fs] io_uring: use kvfree() in io_sqe_buffer_register() (Jeff Moyer) [1854649]
  - [fs] io_uring: validate the full range of provided buffers for access (Jeff Moyer) [1854649]
  - [fs] io_uring: re-set iov base/len for buffer select retry (Jeff Moyer) [1854649]
  - [fs] io_uring: fix {SQ, IO}POLL with unsupported opcodes (Jeff Moyer) [1854649]
  - [fs] io_uring: disallow close of ring itself (Jeff Moyer) [1854649]
  - [fs] io_uring: fix overflowed reqs cancellation (Jeff Moyer) [1854649]
  - [fs] io_uring: fix flush req->refs underflow (Jeff Moyer) [1854649]
  - [fs] io_uring: async task poll trigger cleanup (Jeff Moyer) [1854649]
  - [fs] io_uring: allow POLL_ADD with double poll_wait() users (Jeff Moyer) [1854649]
  - [fs] io_uring: remove 'fd is io_uring' from close path (Jeff Moyer) [1854649]
  - [nvme] nvme: allow retry for requests with REQ_FAILFAST_TRANSPORT set (Mike Snitzer) [1843515]
  - [nvme] nvme: decouple basic ANA log page re-read support from native multipathing (Mike Snitzer) [1843515]
  - [nvme] nvme: update failover handling to work with REQ_FAILFAST_TRANSPORT (Mike Snitzer) [1843515]
  - [nvme] nvme: Return BLK_STS_TARGET if the DNR bit is set (Mike Snitzer) [1843515]
  - [nvme] nvme: redirect commands on dying queue (Mike Snitzer) [1843515]
  - [nvme] nvme: just check the status code type in nvme_is_path_error (Mike Snitzer) [1843515]
  - [nvme] nvme: refactor command completion (Mike Snitzer) [1843515]
  - [nvme] nvme-multipath: do not reset on unknown status (Mike Snitzer) [1843515]
  - [nvme] Revert "nvme: allow ANA support to be independent of native multipathing" (Mike Snitzer) [1843515]
  - [nvme] Revert "nvme-multipath: do not reset on unknown status" (Mike Snitzer) [1843515]
  - [mm] mm, THP, swap: fix allocating cluster for swapfile by mistake (Gao Xiang) [1855474]
  - [net] sched: act_ct: Fix skb double-free in tcf_ct_handle_fragments() error flow (Marcelo Leitner) [1866391]
  - [net] netfilter: conntrack: allow sctp hearbeat after connection re-use (Florian Westphal) [1865798]
  - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859472] {CVE-2020-14331}
  - [scsi] Revert "scsi: qla2xxx: Disable T10-DIF feature with FC-NVMe during probe" (Nilesh Javali) [1866744]
  - [scsi] Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Fix null pointer access during disconnect from subsystem (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Check if FW supports MQ before enabling (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Fix WARN_ON in qla_nvme_register_hba (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Allow ql2xextended_error_logging special value 1 to be set anytime (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Reduce noisy debug message (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Fix login timeout (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Flush I/O on zone disable (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Flush all sessions on zone disable (Nilesh Javali) [1866744]
  - [tools] bpf: selftests: global_funcs: Check err_str before strstr (Yauheni Kaliuta) [1873163]
  - [netdrv] net/mlx5e: E-Switch, Specify flow_source for rule with no in_port (Alaa Hleihel) [1869602]
  - [netdrv] net/mlx5e: E-Switch, Add misc bit when misc fields changed for mirroring (Alaa Hleihel) [1869602]
  - [tools] selftests/bpf: test for map update access from within EXT programs (=?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?=) [1871071]
  - [tools] selftests/bpf: test for checking return code for the extended prog (=?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?=) [1871071]
  - [tools] selftests/bpf: Add test for freplace program with write access (=?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?=) [1871071]
  - [net] bpf: verifier: use target program's type for access verifications (=?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?=) [1871071]
  - [scsi] scsi: lpfc: Fix NVMe rport deregister and registration during ADISC (Dick Kennedy) [1871223]
  - [scsi] scsi: lpfc: Fix LUN loss after cable pull (Dick Kennedy) [1871223]
  - [infiniband] RDMA/bnxt_re: Do not add user qps to flushlist (Selvin Xavier) [1858674]
  - [fs] NFSv4.0 allow nconnect for v4.0 (Benjamin Coddington) [1842746]
  - [mm] mm/vunmap: add cond_resched() in vunmap_pmd_range (Rafael Aquini) [1871710]
  - [s390] s390/bpf: Maintain 8-byte stack alignment (Jiri Olsa) [1871040]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-236.el8]
changelog:
  - [crypto] pefile: Support multiple signatures in verify_pefile_signature (Lenny Szubowicz) [1862072]
  - [security] integrity: Load certs from the EFI MOK config table (Lenny Szubowicz) [1868306]
  - [security] integrity: Move import of MokListRT certs to a separate routine (Lenny Szubowicz) [1868306]
  - [firmware] efi: Support for MOK variable config table (Lenny Szubowicz) [1868306]
  - [kernel] Move to dual-signing to split signing keys up better (Frantisek Hrbata) [1837434] {CVE-2020-10713}
  - [powerpc] pseries/hotplug-cpu: wait indefinitely for vCPU death (Michael Roth) [1856588]
  - [powerpc] kvm: ppc: book3s hv: Rework secure mem slot dropping (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Move kvmppc_svm_page_out up (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Migrate hot plugged memory (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: In H_SVM_INIT_DONE, migrate remaining normal-GFNs to secure-GFNs (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Track the state GFNs associated with secure VMs (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Disable page merging in H_SVM_INIT_START (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Fix function definition in book3s_hv_uvmem.c (Michael Roth) [1851259]
  - [kernel] mmap locking api: initial implementation as rwsem wrappers (Michael Roth) [1851259]
  - [mm] handle multiple owners of device private pages in migrate_vma (Michael Roth) [1851259]
  - [mm] migrate.c: clean up useless code in migrate_vma_collect_pmd() (Michael Roth) [1851259]
  - [mm] remove the unused MIGRATE_PFN_DEVICE flag (Michael Roth) [1851259]
  - [powerpc] rhel: powerpc: kvm: Increase HDEC threshold to enter guest (David Gibson) [1733467]
  - [netdrv] r8152: Add macpassthru support for ThinkPad Thunderbolt 3 Dock Gen 2 (Michal Schmidt) [1851966]
  - [fs] ceph: fix inode number handling on arches with 32-bit ino_t (Jeff Layton) [1869679]
  - [fs] ceph: don't allow setlease on cephfs (Jeff Layton) [1872382]
  - [block] blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART (Ming Lei) [1859628]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-237.el8]
changelog:
  - [fs] nfsd: avoid a NULL dereference in __cld_pipe_upcall() (Scott Mayhew) [1847225]
  - [net] packet: fix overflow in tpacket_rcv (Hangbin Liu) [1876224] {CVE-2020-14386}
  - [net] packet: make tp_drops atomic (Hangbin Liu) [1876224] {CVE-2020-14386}
  - [net] espintcp: restore IP CB before handing the packet to xfrm (Sabrina Dubroca) [1868201]
  - [fs] Revert "NFSv4: Handle NFS4ERR_OLD_STATEID in CLOSE/OPEN_DOWNGRADE" (Benjamin Coddington) [1865978]
  - [fs] Revert "NFSv4.x recover from pre-mature loss of openstateid" (Benjamin Coddington) [1865978]
  - [infiniband] RDMA/mlx4: Read pkey table length instead of hardcoded value (Alaa Hleihel) [1853564]
  - [net] net/smc: set rx_off for SMCR explicitly (Philipp Rudo) [1875833]
  - [drm] drm/i915: Auto detect DPCD backlight support by default (Lyude Paul) [1872381]
  - [drm] drm/i915: Fix DPCD register order in intel_dp_aux_enable_backlight() (Lyude Paul) [1872381]
  - [drm] drm/i915: Assume 100 brightness when not in DPCD control mode (Lyude Paul) [1872381]
  - [drm] drm/i915: Fix eDP DPCD aux max backlight calculations (Lyude Paul) [1872381]
  - [kernel] tracing: Define MCOUNT_INSN_SIZE when not defined without direct calls (Jiri Olsa) [1857599]
  - [kernel] ftrace: Fix function_graph tracer interaction with BPF trampoline (Jiri Olsa) [1857599]
  - [x86] x86/function_graph: Simplify with function_graph_enter() (Jiri Olsa) [1857599]
  - [kernel] function_graph: Create function_graph_enter() to consolidate architecture code (Jiri Olsa) [1857599]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-238.el8]
changelog:
  - [firmware] efi: don't reserve MOK config table memory region (Kairui Song) [1878584]
  - [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen) [1875316] {CVE-2020-14385}
  - [powerpc] powerpc/pseries: Do not initiate shutdown when system is running on UPS (Diego Domingos) [1870477]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-239.el8]
changelog:
  - [init] init/Kconfig: disable io_uring (Jeff Moyer) [1879754]
  - [block] blk-mq: always allow reserved allocation in hctx_may_queue (Ming Lei) [1740874]
  - [nvme] nvme-rdma: Avoid double freeing of async event data (Gopal Tiwari) [1878140]
  - [kernel] printk: queue wake_up_klogd irq_work only if per-CPU areas are ready (Igor Mammedov) [1867022]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.el8]
changelog:
  - [include] block: allow for_each_bvec to support zero len bvec (Ming Lei) [1872032]
  - [nvme] nvme-pci: disable the write zeros command for Intel 600P/P3100 (David Milburn) [1875391]


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.20-2
changelog:
  - Add manual page for dnssec-importkey-pkcs11 (#1666785)
  - Add versioned depends to all library subpackages


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.20-5
changelog:
  - Fix tsig-request verify (CVE-2020-8622)
  - Prevent PKCS11 daemon crash on crafted packet (CVE-2020-8623)
  - Correct update-policy type subdomain to match documentation (CVE-2020-8624)
  - Include available test


author: systemd maintenance team <systemd-maint@redhat.com> - 239-32
changelog:
  - pid1: fix DefaultTasksMax initialization (#1809037)
  - cgroup: make sure that cpuset is supported on cgroup v2 and disabled with v1 (#1808940)
  - test: introduce TEST-36-NUMAPOLICY (#1808940)
  - test: replace `tail -f` with journal cursor which should be... (#1808940)
  - test: support MPOL_LOCAL matching in unpatched strace versions (#1808940)
  - test: make sure the strace process is indeed dead (#1808940)
  - test: skip the test on systems without NUMA support (#1808940)
  - test: give strace some time to initialize (#1808940)
  - test: add a simple sanity check for systems without NUMA support (#1808940)
  - test: drop the missed || exit 1 expression (#1808940)
  - test: replace cursor file with a plain cursor (#1808940)
  - cryptsetup: Treat key file errors as a failed password attempt (#1763155)
  - swap: finish the secondary swap units' jobs if deactivation of the primary swap unit fails (#1749622)
  - resolved: Recover missing PrivateTmp=yes and ProtectSystem=strict (#1810869)
  - bus_open leak sd_event_source when udevadm trigger。 (#1798504)
  - core: rework StopWhenUnneeded= logic (#1798046)
  - pid1: fix the names of AllowedCPUs= and AllowedMemoryNodes= (#1818054)
  - core: fix re-realization of cgroup siblings (#1818054)
  - basic: use comma as separator in cpuset cgroup cpu ranges (#1818054)
  - core: transition to FINAL_SIGTERM state after ExecStopPost= (#1766479)
  - sd-journal: close journal files that were deleted by journald before we've setup inotify watch (#1796128)
  - sd-journal: remove the dead code and actually fix #14695 (#1796128)
  - udev: downgrade message when we fail to set inotify watch up (#1808051)
  - logind: check PolicyKit before allowing VT switch (#1797679)
  - test: do not use global variable to pass error (#1823767)
  - test: install libraries required by tests (#1823767)
  - test: introduce install_zoneinfo() (#1823767)
  - test: replace duplicated Makefile by symbolic link (#1823767)
  - test: add paths of keymaps in install_keymaps() (#1823767)
  - test: make install_keymaps() optionally install more keymaps (#1823767)
  - test-fs-util: skip some tests when running in unprivileged container (#1823767)
  - test-process-util: skip several verifications when running in unprivileged container (#1823767)
  - test-execute: also check python3 is installed or not (#1823767)
  - test-execute: skip several tests when running in container (#1823767)
  - test: introduce test_is_running_from_builddir() (#1823767)
  - test: make test-catalog relocatable (#1823767)
  - test: parallelize tasks in TEST-24-UNIT-TESTS (#1823767)
  - test: try to determine QEMU_SMP dynamically (#1823767)
  - test: store coredumps in journal (#1823767)
  - pid1: add new kernel cmdline arg systemd.cpu_affinity= (#1812894)
  - udev-rules: make tape-changers also apprear in /dev/tape/by-path/ (#1820112)
  - man: be clearer that .timer time expressions need to be reset to override them (#1816908)
  - Add support for opening files for appending (#1809175)
  - nspawn: move payload to sub-cgroup first, then sync cgroup trees (#1837094)
  - core: move unit_status_emit_starting_stopping_reloading() and related calls to job.c (#1737283)
  - job: when a job was skipped due to a failed condition, log about it (#1737283)
  - core: split out all logic that updates a Job on a unit's unit_notify() invocation (#1737283)
  - core: make log messages about units entering a 'failed' state recognizable (#1737283)
  - core: log a recognizable message when a unit succeeds, too (#1737283)
  - tests: always use the right vtable wrapper calls (#1737283)
  - test-execute: allow filtering test cases by pattern (#1737283)
  - test-execute: provide custom failure message (#1737283)
  - core: ExecCondition= for services (#1737283)
  - Drop support for lz4 < 1.3.0 (#1843871)
  - test-compress: add test for short decompress_startswith calls (#1843871)
  - journal: adapt for new improved LZ4_decompress_safe_partial() (#1843871)
  - fuzz-compress: add fuzzer for compression and decompression (#1843871)
  - seccomp: fix __NR__sysctl usage (#1843871)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-33
changelog:
  - tmpfiles: fix crash with NULL in arg_root and other fixes and tests (#1836024)
  - sulogin-shell: Use force if SYSTEMD_SULOGIN_FORCE set (#1625929)
  - resolvconf: fixes for the compatibility interface (#1835594)
  - mount: don't add Requires for tmp.mount (#1748840)
  - core: coldplug possible nop_job (#1829798)
  - core: add IODeviceLatencyTargetSec (#1831519)
  - time-util: Introduce parse_sec_def_infinity (#1770379)
  - cgroup: use structured initialization (#1770379)
  - core: add CPUQuotaPeriodSec= (#1770379)
  - core: downgrade CPUQuotaPeriodSec= clamping logs to debug (#1770379)
  - sd-bus: avoid magic number in SASL length calculation (#1838081)
  - sd-bus: fix SASL reply to empty AUTH (#1838081)
  - sd-bus: skip sending formatted UIDs via SASL (#1838081)
  - core: add MemoryMin (#1763435)
  - core: introduce cgroup_add_device_allow() (#1763435)
  - test: remove support for suffix in get_testdata_dir() (#1763435)
  - cgroup: Implement default propagation of MemoryLow with DefaultMemoryLow (#1763435)
  - cgroup: Create UNIT_DEFINE_ANCESTOR_MEMORY_LOOKUP (#1763435)
  - unit: Add DefaultMemoryMin (#1763435)
  - cgroup: Polish hierarchically aware protection docs a bit (#1763435)
  - cgroup: Readd some plumbing for DefaultMemoryMin (#1763435)
  - cgroup: Support 0-value for memory protection directives (#1763435)
  - cgroup: Test that it's possible to set memory protection to 0 again (#1763435)
  - cgroup: Check ancestor memory min for unified memory config (#1763435)
  - cgroup: Respect DefaultMemoryMin when setting memory.min (#1763435)
  - cgroup: Mark memory protections as explicitly set in transient units (#1763435)
  - meson: allow setting the version string during configuration (#1804252)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-36
changelog:
  - core: don't consider SERVICE_SKIP_CONDITION for abnormal or failure restarts (#1737283)
  - selinux: do preprocessor check only in selinux-access.c (#1830861)
  - basic/cgroup-util: introduce cg_get_keyed_attribute_full() (#1830861)
  - shared: add generic logic for waiting for a unit to enter some state (#1830861)
  - shared: fix assert call (#1830861)
  - shared: Don't try calling NULL callback in bus_wait_for_units_clear (#1830861)
  - shared: add NULL callback check in one more place (#1830861)
  - core: introduce support for cgroup freezer (#1830861)
  - core/cgroup: fix return value of unit_cgorup_freezer_action() (#1830861)
  - core: fix the return value in order to make sure we don't dipatch method return too early (#1830861)
  - test: add test for cgroup v2 freezer support (#1830861)
  - fix mis-merge (#1848421)
  - tests: sleep a bit and give kernel time to perform the action after manual freeze/thaw (#1848421)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-39
changelog:
  - device: make sure we emit PropertiesChanged signal once we set sysfs (#1793533)
  - device: don't emit PropetiesChanged needlessly (#1793533)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-40
changelog:
  - units: add generic boot-complete.target (#1872243)
  - man: document new "boot-complete.target" unit (#1872243)
  - core: make sure to restore the control command id, too (#1829867)


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.1.1.el8_3]
changelog:
  - [net] Bluetooth: fix kernel oops in store_pending_adv_report (Gopal Tiwari) [1888454 1888455] {CVE-2020-24490}
  - [net] Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888257 1888258] {CVE-2020-12351}
  - [net] Bluetooth: A2MP: Fix not initializing all members (Gopal Tiwari) [1888806 1888807] {CVE-2020-12352}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.2.1.el8_3]
changelog:
  - [tools] selftests: rtnetlink: Test bridge enslavement with different parent IDs (Jonathan Toppins) [1886017 1860479]
  - [tools] selftests: rtnetlink: correct the final return value for the test (Jonathan Toppins) [1886017 1860479]
  - [net] Fix bridge enslavement failure (Jonathan Toppins) [1886017 1860479]
  - [net] netfilter: conntrack: proc: rename stat column (Florian Westphal) [1882094 1875681]
  - [net] netfilter: conntrack: add clash resolution stat counter (Florian Westphal) [1882094 1875681]
  - [net] netfilter: conntrack: remove ignore stats (Florian Westphal) [1882094 1875681]
  - [net] netfilter: conntrack: do not increment two error counters at same time (Florian Westphal) [1882094 1875681]
  - [net] netfilter: conntrack: do not auto-delete clash entries on reply (Florian Westphal) [1882094 1875681]
  - [kernel] time/tick-broadcast: Fix tick_broadcast_offline() lockdep complaint (Alexey Klimov) [1880080 1877380]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.3.1.el8_3]
changelog:
  - [iommu] iommu/amd: Fix the overwritten field in IVMD header (Baoquan He) [1888113 1869148]
  - [fs] xfs: trim IO to found COW extent limit (Eric Sandeen) [1886895 1882549]
  - [char] random32: update the net random state on interrupt and activity (Donghai Qiao) [1888233 1867569] {CVE-2020-16166}
  - [net] openvswitch: fixes crash if nf_conncount_init() fails (Eelco Chaudron) [1879935 1876445]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.4.1.el8_3]
changelog:
  - [kernel] sched/features: Fix !CONFIG_JUMP_LABEL case (Daniel Bristot de Oliveira) [1894073 1885850]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.6.1.el8_3]
changelog:
  - [arm64] paravirt: Initialize steal time when cpu is online (Andrew Jones) [1898758 1879137]
  - [kvm] Revert "x86/kvm: Move context tracking where it belongs" (Nitesh Narayan Lal) [1897716 1890284]
  - [pci] hv: Fix hibernation in case interrupts are not re-created (Mohammed Gamal) [1896435 1846838]
  - [hv] hv: vmbus: hibernation: do not hang forever in vmbus_bus_resume() (Mohammed Gamal) [1896434 1876519]
  - [netdrv] hv_netvsc: Cache the current data path to avoid duplicate call and message (Mohammed Gamal) [1896433 1876527]
  - [netdrv] hv_netvsc: Switch the data path at the right time during hibernation (Mohammed Gamal) [1896433 1876527]
  - [netdrv] hv_netvsc: Fix hibernation for mlx5 VF driver (Mohammed Gamal) [1896433 1876527]
  - [tools] selftests/powerpc: Make alignment handler test P9N DD2.1 vector CI load workaround (Gustavo Duarte) [1897278 1887442]
  - [powerpc] powerpc: Fix undetected data corruption with P9N DD2.1 VSX CI load emulation (Gustavo Duarte) [1897278 1887442]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.7.1.el8_3]
changelog:
  - [fs] writeback: Drop I_DIRTY_TIME_EXPIRE (Waiman Long) [1901547 1860031]
  - [fs] writeback: Fix sync livelock due to b_dirty_time processing (Waiman Long) [1901547 1860031]
  - [fs] writeback: Avoid skipping inode writeback (Waiman Long) [1901547 1860031]
  - [fs] writeback: Protect inode->i_io_list with inode->i_lock (Waiman Long) [1901547 1860031]
  - [fs] fs: Introduce DCACHE_DONTCACHE (Waiman Long) [1901547 1860031]
  - [fs] fs: Lift XFS_IDONTCACHE to the VFS layer (Waiman Long) [1901547 1860031]
  - [fs] dcache: sort the freeing-without-RCU-delay mess for good (Waiman Long) [1901547 1860031]
  - [net] ip_tunnel_core: Fix build for archs without _HAVE_ARCH_IPV6_CSUM (Aaron Conole) [1885766 1849736]
  - [tools] selftests: pmtu.sh: Add tests for UDP tunnels handled by Open vSwitch (Aaron Conole) [1885766 1849736]
  - [tools] selftests: pmtu.sh: Add tests for bridged UDP tunnels (Aaron Conole) [1885766 1849736]
  - [net] geneve: Support for PMTU discovery on directly bridged links (Aaron Conole) [1885766 1849736]
  - [net] vxlan: Support for PMTU discovery on directly bridged links (Aaron Conole) [1885766 1849736]
  - [net] tunnels: PMTU discovery support for directly bridged IP packets (Aaron Conole) [1885766 1849736]
  - [net] ipv4: route: Ignore output interface in FIB lookup for PMTU route (Aaron Conole) [1885766 1849736]
  - [netdrv] geneve: add transport ports in route lookup for geneve (Mark Gray) [1891818 1884481] {CVE-2020-25645}
  - [kernel] PM: hibernate: Batch hibernate and resume IO requests (Lenny Szubowicz) [1894629 1868096]
  - [md] dm: fix comment in __dm_suspend() (Mike Snitzer) [1890233 1881531]
  - [md] dm: fold dm_process_bio() into dm_make_request() (Mike Snitzer) [1890233 1881531]
  - [md] dm: fix missing imposition of queue_limits from dm_wq_work() thread (Mike Snitzer) [1890233 1881531]
  - [md] dm: optimize max_io_len() by inlining max_io_len_target_boundary() (Mike Snitzer) [1890233 1881531]
  - [md] dm: push md->immutable_target optimization down to __process_bio() (Mike Snitzer) [1890233 1881531]
  - [md] dm: change max_io_len() to use blk_max_size_offset() (Mike Snitzer) [1890233 1881531]
  - [md] dm table: stack 'chunk_sectors' limit to account for target-specific splitting (Mike Snitzer) [1890233 1881531]
  - [block] block: allow 'chunk_sectors' to be non-power-of-2 (Mike Snitzer) [1890233 1881531]
  - [block] block: use lcm_not_zero() when stacking chunk_sectors (Mike Snitzer) [1890233 1881531]
  - [md] dm: fix bio splitting and its bio completion order for regular IO (Mike Snitzer) [1890233 1881531]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.8.1.el8_3]
changelog:
  - [s390] s390/dasd: Fix zero write for FBA devices (Ming Lei) [1896787 1881760]
  - [s390] mm/gup: fix gup_fast with dynamic page table folding (Philipp Rudo) [1896351 1883266]
  - [netdrv] ibmveth: Identify ingress large send packets (Gustavo Duarte) [1896299 1887038]
  - [netdrv] ibmveth: Switch order of ibmveth_helper calls (Gustavo Duarte) [1896299 1887038]


author: Iker Pedrosa <ipedrosa@redhat.com> 1.3.1-9
changelog:
  - pam_usertype: new module to tell if uid is in login.defs ranges (#1810474)
  - pam_tty_audit: if kernel audit is disabled return PAM_IGNORE (#1775357)


author: Peter Robinson <pbrobinson@redhat.com> - 1.3.1-12
changelog:
  - Add the motd.d directories (empty) to silence warnings and to
    provide proper ownership for them (#1847501)


author: Iker Pedrosa <ipedrosa@redhat.com> 1.3.1-13
changelog:
  - pam_wheel: if getlogin fails fallback to PAM_RUSER: fixed malformed patch (#1866866)
  - pam_namespace: polyinstantiation refer to gdm doc (#1861841)


author: Karel Zak <kzak@redhat.com> 2.32.1-23
changelog:
  - fix #1826251 - remove MD metadata 0.90 based tests from util-linux CI
  - fix #1812576 - RFE: Bitlocker detection for RHEL 8.3
  - fix #1817726 - add libblkid BLOCK_SIZE
  - fix #1803753 - RHEL-8: col struct char_str c_column field should be of unsigned type and/or larger than 16 bit
  - fix #1812118 - mount -a always tries to mount smb3 share subdir despite being already mounted
  - fix #1824727 - util-linux: Include python3-libmount package in the release
  - fix #1829245 - mount -a tries to mount already mounted cifs shares when we cannot query up to root dir


author: Marian Csontos <mcsontos@redhat.com> - 2.03.09-1
changelog:
  - Fix support for lvconvert --repair of pools used by third party applications.
  - Fix formating of vdopool (vdo_slab_size_mb was smaller by 2 bits).
  - Fix busy loop in dmeventd.
  - Fix lvmlocks.service using incorrect option.


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.9.1.el8_3]
changelog:
  - [net] tunnels: Fix off-by-one in lower MTU bounds for ICMP/ICMPv6 replies (Antoine Tenart) [1902082 1895765]
  - [net] net-sysfs: add backlog len and CPU id to softnet data (Paolo Abeni) [1883314 1866909]
  - [net] try to avoid unneeded backlog flush (Paolo Abeni) [1883314 1866909]
  - [net] skbuff: fix a data race in skb_queue_len() (Paolo Abeni) [1883314 1866909]
  - [powerpc] mm/mmu_gather: invalidate TLB correctly on batch allocation failure and flush (Diego Domingos) [1899208 1805031]
  - [powerpc] powerpc/mmu_gather: enable RCU_TABLE_FREE even for !SMP case (Diego Domingos) [1899208 1805031]
  - [net] netfilter: ctnetlink: add a range check for l3/l4 protonum (Florian Westphal) [1892665 1892666] {CVE-2020-25211}
  - [char] random: decouple random and urandom extrng fops (Vladis Dronov) [1899584 1890711]
  - [char] random: Add a poll handler to extrng_fops (Vladis Dronov) [1886192 1884857]


author: Jakub Martisko <jamartis@redhat.com> - 3.10.3-8
changelog:
  * Update the s390 subpackages:
  - The base pakcage is now optimized to z13
  - New subpackage is introduced: z14
  - All remaining subpackages for s390 are being deprecated
  - Clean up of the spec file 
  - Some commented out subpackages were removed form the spec
  - These subpackages were not built/shipped -> no change from the users point of view
  Resolves: #1782560
  Resolves: #1780286
  Resolves: #1782561


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.14.1.el8_2]
changelog:
  - [md] dm mpath: add DM device name to Failing/Reinstating path log messages (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: enhance queue_if_no_path debugging (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: restrict queue_if_no_path state machine (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: simplify __must_push_back (Mike Snitzer) [1852050 1822975]
  - [md] dm: use DMDEBUG macros now that they use pr_debug variants (Mike Snitzer) [1852050 1822975]
  - [include] dm: use dynamic debug instead of compile-time config option (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: switch paths in dm_blk_ioctl() code path (Mike Snitzer) [1852050 1822975]
  - [md] dm multipath: use updated MPATHF_QUEUE_IO on mapping for bio-based mpath (Mike Snitzer) [1852050 1822975]
  - [md] dm: bump version of core and various targets (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: Add timeout mechanism for queue_if_no_path (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: use true_false for bool variable (Mike Snitzer) [1852050 1822975]
  - [md] dm mpath: remove harmful bio-based optimization (Mike Snitzer) [1852050 1822975]
  - [scsi] scsi: libiscsi: fall back to sendmsg for slab pages (Maurizio Lombardi) [1852048 1825775]
  - [s390] s390/mm: fix panic in gup_fast on large pud (Philipp Rudo) [1853336 1816980]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.15.1.el8_2]
changelog:
  - [wireless] iwlwifi: pcie: handle QuZ configs with killer NICs as well (Jarod Wilson) [1857773 1844129]
  - [wireless] iwlwifi: pcie: move power gating workaround earlier in the flow (Jarod Wilson) [1857773 1844129]
  - [nvme] nvme: fix possible deadlock when nvme_update_formats fails (Gopal Tiwari) [1857115 1781927]
  - [iommu] iommu: move flags field before ids in iommu_fwspec (Jerry Snitselaar) [1856966 1833512]
  - [x86] kvm: x86: only do L1TF workaround on affected processors (Vitaly Kuznetsov) [1857796 1800673]
  - [x86] kvm: x86: create mmu/ subdirectory (Vitaly Kuznetsov) [1857796 1800673]
  - [kvm] KVM: SVM: Override default MMIO mask if memory encryption is enabled (Wei Huang) [1857796 1800673]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.16.1.el8_2]
changelog:
  - [infiniband] IB/rdmavt: Free kernel completion queue when done (Gopal Tiwari) [1857757 1805036]
  - [kernel] Move to dual-signing to split signing keys up better (pjones) [1837433 1837434] {CVE-2020-10713}
  - [crypto] pefile: Tolerate other pefile signatures after first (Lenny Szubowicz) [1837433 1837434] {CVE-2020-10713}
  - [acpi] ACPI: configfs: Disallow loading ACPI tables when locked down (Lenny Szubowicz) [1852968 1852969] {CVE-2020-15780}
  - [firmware] efi: Restrict efivar_ssdt_load when the kernel is locked down (Lenny Szubowicz) [1852948 1852949] {CVE-2019-20908}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.17.1.el8_2]
changelog:
  - [net] netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag (Phil Sutter) [1854531 1847553]
  - [net] netfilter: nf_tables: report EOPNOTSUPP on unsupported flags/object type (Phil Sutter) [1854531 1847553]
  - [s390] s390: prevent leaking kernel address in BEAR (Claudio Imbrenda) [1854986 1850907]
  - [s390] scsi: zfcp: Fix panic on ERP timeout for previously dismissed ERP action (Philipp Rudo) [1861355 1857312]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.18.1.el8_2]
changelog:
  - [security] selinux: allow reading labels before policy is loaded (Ondrej Mosnacek) [1861721 1839819]
  - [security] selinux: allow labeling before policy is loaded (Ondrej Mosnacek) [1861722 1777525]
  - [mm] mm/memory_hotplug.c: only respect mem= parameter during boot stage (Baoquan He) [1854207 1838809]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.19.1.el8_2]
changelog:
  - [net] tcp: add sanity tests in tcp_add_backlog() (Guillaume Nault) [1861378 1790843]
  - [net] tcp: implement coalescing on backlog queue (Guillaume Nault) [1861378 1790843]
  - [include] tcp: make tcp_space() aware of socket backlog (Guillaume Nault) [1861378 1790843]
  - [net] tcp: take care of compressed acks in tcp_add_reno_sack() (Guillaume Nault) [1861378 1790843]
  - [include] tcp: hint compiler about sack flows (Guillaume Nault) [1861378 1790843]
  - [net] tcp: drop dst in tcp_add_backlog() (Guillaume Nault) [1861378 1790843]


author: Thomas Haller <thaller@redhat.com> - 1:1.26.0-3
changelog:
  - core: fix managing devices after resuming from sleep (rh #1855563)
  - dhcp: fix BPF filter for internal client on big endian arch (rh #1861488)
  - core: support warning log setting IPv6 MTU with IPv6 disabled (rh #1840989)
  - wifi: fix crash parsing incomplete BSS info (rh #1866395)


author: Antonio Cardace <acardace@redhat.com> - 1:1.26.0-4
changelog:
  - bond: fix Reapply does not update bond options (rh #1847814)
  - dhcp: support DHCPv6 fqdn_fqdn option for hostname (rh #1858344)


author: Antonio Cardace <acardace@redhat.com> - 1:1.26.0-7
changelog:
  - dhcp: add dhcp-vendor-class-identifier option (rh #1871042)
  - initrd: parse 'rd.net.dhcp.vendor-class' kernel cmdline arg (rh #1872299)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.26.0-8
changelog:
  - initrd: accept mac address as interface specifier (rh #1879795)
  - initrd: fix parsing IPv6 prefix length (rh #1879795)


author: Antonio Cardace <acardace@redhat.com> - 1:1.26.0-11
changelog:
  - initrd: disable ipv4 and ipv6 by default for vlan parent connection (rh #1903698)
  - initrd: fix parsing of ip= argument with dotted interface name (rh #1903695)
  - initrd: fix parsing with empty token (rh #1902791)


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.3-3.1
changelog:
  - Add 0020-libmultipath-make-dm_get_map-status-return-codes-sym.patch
  - Add 0021-multipathd-fix-check_path-errors-with-removed-map.patch
    * The above 2 patches fix bz #1856944. multipathd handles external
      device removal better.
  - Resolves: bz #1856944


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.3-3.3
changelog:
  - Add 0022-libmultipath-fix-files-read-from-config_dir.patch
    * Fix for bz #1858993. Only read files ending in .conf
  - Resolves: bz #1858993


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.13.1.el8_3]
changelog:
  - [arm64] arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() (Andrew Jones) [1909577 1908439]
  - [arm64] arm64: pgtable: Fix pte_accessible() (Andrew Jones) [1909577 1908439]
  - [net] icmp: randomize the global rate limiter (Guillaume Nault) [1906371 1896516] {CVE-2020-25705}
  - [tools] kvm: x86: do not attempt TSC synchronization on guest writes (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: x86: fix MSR_IA32_TSC read for nested migration (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: delay MSR permission processing to first nested VM run (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: x86: rename KVM_REQ_GET_VMCS12_PAGES (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: use __GFP_ZERO instead of clear_page (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: refactor msr permission bitmap allocation (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: rename a variable in the svm_create_vcpu (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: Avoid freeing uninitialized pointers in svm_set_nested_state() (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: nested: Don't allocate VMCB structures on stack (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: more strict SMM checks when returning to nested guest (Paolo Bonzini) [1905084 1898018]
  - [x86] svm: nsvm: setup nested msr permission bitmap on nested state load (Paolo Bonzini) [1905084 1898018]
  - [x86] svm: nsvm: correctly restore GIF on vmexit from nesting after migration (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: avoid emulation with stale next_rip (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: remove nonsensical EXITINFO1 adjustment on nested NPF (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: Rename svm_nested_virtualize_tpr() to nested_svm_virtualize_tpr() (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: Add svm_ prefix to set/clr/is_intercept() (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: Add vmcb_ prefix to mark_*() functions (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: Rename struct nested_state to svm_nested_state (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: Check that DR6[63:32] and DR7[64:32] are not set on vmrun of nested guests (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: x86: Move the check for upper 32 reserved bits of DR6 to separate function (Paolo Bonzini) [1905084 1898018]
  - [netdrv] net/mlx5e: Add IPv6 traffic class (DSCP) header rewrite support (Alaa Hleihel) [1897688 1889981]
  - [netdrv] net/mlx5e: Fix endianness when calculating pedit mask first bit (Alaa Hleihel) [1897688 1889981]
  - [net] openvswitch: fix to make sure flow_lookup() is not preempted (Eelco Chaudron) [1893281 1888237]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.14.1.el8_3]
changelog:
  - [netdrv] net: usb: lan78xx: Disable interrupts before calling generic_handle_irq() (Waiman Long) [1915814 1904213]
  - [mm] x86/mm/cpa: Prevent large page split when ftrace flips RW on kernel text (Waiman Long) [1915814 1904213]
  - [mm] x86/mm/cpa: Fix cpa_flush_array() TLB invalidation (Waiman Long) [1915814 1904213]
  - [hv] hv: vmbus: Add timeout to vmbus_wait_for_unload (Mohammed Gamal) [1913528 1888980]
  - [kernel] perf/core: Fix race in the perf_mmap_close() function (Michael Petlan) [1897016 1869925] {CVE-2020-14351}
  - [kernel] perf: Make struct ring_buffer less ambiguous (Michael Petlan) [1897016 1869925] {CVE-2020-14351}
  - [tty] tty: Fix ->pgrp locking in tiocspgrp() (Waiman Long) [1908196 1908197] {CVE-2020-29661}
  - [x86] x86/tboot: Don't disable swiotlb when iommu is forced on (Tony Camuso) [1911555 1883395]
  - [iommu] iommu/vt-d: Avoid panic if iommu init fails in tboot system (Tony Camuso) [1911555 1883395]
  - [kernel] sched/deadline: Fix priority inheritance with multiple scheduling classes (Phil Auld) [1908731 1780490]
  - [kernel] locking/rwsem: Remove reader optimistic spinning (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Enable reader optimistic lock stealing (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Prevent potential lock starvation (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Pass the current atomic count to rwsem_down_read_slowpath() (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Fold __down_{read,write}*() (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Introduce rwsem_write_trylock() (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Better collate rwsem_read_trylock() (Waiman Long) [1908519 1895046]
  - [kernel] rwsem: Implement down_read_interruptible (Waiman Long) [1908519 1895046]
  - [kernel] rwsem: Implement down_read_killable_nested (Waiman Long) [1908519 1895046]
  - [firmware] efi/esrt: Only call efi_mem_reserve() for boot services memory (Kairui Song) [1907775 1878024]
  - [firmware] efi: Drop type and attribute checks in efi_mem_desc_lookup() (Kairui Song) [1907775 1878024]
  - [scsi] scsi: core: Don't start concurrent async scan on same host (Ming Lei) [1905214 1874501]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.15.1.el8_3]
changelog:
  - [x86] kvm: svm: Initialize prev_ga_tag before use (Vitaly Kuznetsov) [1919885 1909254]
  - [net] tls: move mark_tech_preview to tls_init (Sabrina Dubroca) [1918743 1907477]
  - [video] hyperv_fb: Fix the cache type when mapping the VRAM (Mohammed Gamal) [1917711 1908893]
  - [video] hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver (Mohammed Gamal) [1917711 1908893]
  - [net] esp: select CRYPTO_SEQIV (Vladis Dronov) [1912872 1905088]
  - [crypto] treewide: Use fallthrough pseudo-keyword (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - always try to free Jitter RNG instance (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - should select CTR (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: ctr - no longer needs CRYPTO_SEQIV (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - always seeded with SP800-90B compliant noise source (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: jitter - SP800-90B compliance (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: jitter - add header to fix buildwarnings (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: jitter - fix comments (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: jitter - update implementation to 2.1.2 (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - in-place cipher operation for CTR (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - eliminate constant reinitialization of SGL (Vladis Dronov) [1912872 1905088]
  - [netdrv] ionic: start queues before announcing link up (Jonathan Toppins) [1918372 1906250]
  - [drm] drm/i915: Enable Tigerlake support by default (Lyude Paul) [1882620 1877005]
  - [drm] drm/i915: Simplify intel_set_cdclk_{pre, post}_plane_update() calling convention (Lyude Paul) [1882620 1877005]
  - [drm] drm/i915/psr: Program default IO buffer Wake and Fast Wake (Lyude Paul) [1882620 1877005]
  - [kernel] rcu: Force on tick when invoking lots of callbacks (Waiman Long) [1915638 1862812]
  - [kernel] nohz: Add TICK_DEP_BIT_RCU (Waiman Long) [1915638 1862812]
  - [pci] PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken (Myron Stowe) [1906516 1888310]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.16.1.el8_3]
changelog:
  - [netdrv] net/mlx5e: Fix using wrong stats_grps in mlx5e_update_ndo_stats() (Alaa Hleihel) [1921060 1870593]
  - [net] tcp: Fix potential use-after-free due to double kfree() (Florian Westphal) [1915529 1915164]
  - [net] tcp: fix race condition when creating child sockets from syncookies (Florian Westphal) [1915529 1915164]
  - [x86] kvm: ioapic: break infinite recursion on lazy EOI (Vitaly Kuznetsov) [1906438 1882793]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.17.1.el8_3]
changelog:
  - [mm] mm/slub: fix panic in slab_alloc_node() (Oleksandr Natalenko) [1925511 1921056]
  - [s390] s390/early: improve machine detection (Claudio Imbrenda) [1925508 1896307]
  - [infiniband] RDMA/umem: Prevent small pages from being returned by ib_umem_find_best_pgsz() (Kamal Heib) [1924691 1903992]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.18.1.el8_3]
changelog:
  - [scsi] scsi: fnic: Do not call 'scsi_done()' for unhandled commands (Govindarajulu Varadarajan) [1925186 1870397]
  - [target] scsi: target: iscsi: Fix cmd abort fabric stop race (Maurizio Lombardi) [1918354 1908215]
  - [target] scsi: target: Modify core_tmr_abort_task() (Maurizio Lombardi) [1918363 1880395]
  - [s390] s390/crypto: add arch_get_random_long() support (Vladis Dronov) [1915816 1904274]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.19.1.el8_3]
changelog:
  - audit: trigger accompanying records when no rules present (Richard Guy Briggs) [1907520 1896480]
  - revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules present") (Richard Guy Briggs) [1907520 1896480]
  - audit: issue CWD record to accompany LSM_AUDIT_DATA_* records (Richard Guy Briggs) [1907520 1896480]
  - audit: remove unused !CONFIG_AUDITSYSCALL __audit_inode* stubs (Richard Guy Briggs) [1907520 1896480]
  - redhat: use tags from git notes for zstream to generate changelog (Frantisek Hrbata)


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.20.1.el8_3]
changelog:
  - fix regression in "epoll: Keep a reference on files added to the check list" (Carlos Maiolino) [1920775 1920776] {CVE-2020-0466}
  - do_epoll_ctl(): clean the failure exits up a bit (Carlos Maiolino) [1920775 1920776] {CVE-2020-0466}
  - epoll: Keep a reference on files added to the check list (Carlos Maiolino) [1920775 1920776] {CVE-2020-0466}
  - [kernel] sched/features: Distinguish between NORMAL and DEADLINE hrtick (Juri Lelli) [1930735 1912118]
  - [kernel] sched/features: Fix hrtick reprogramming (Juri Lelli) [1930735 1912118]
  - iommu/vt-d: Don't dereference iommu_device if IOMMU_API is not built (Vitaly Kuznetsov) [1932199 1887216]
  - iommu/vt-d: Gracefully handle DMAR units with no supported address widths (Vitaly Kuznetsov) [1932199 1887216]
  - iommu/vt-d: Skip TE disabling on quirky gfx dedicated iommu (Vitaly Kuznetsov) [1932199 1887216]
  - net/vmw_vsock: fix NULL pointer dereference (Jon Maloy) [1925599 1925600] {CVE-2021-26708}
  - net/vmw_vsock: improve locking in vsock_connect_timeout() (Jon Maloy) [1925599 1925600] {CVE-2021-26708}
  - vsock: fix locking in vsock_shutdown() (Jon Maloy) [1925599 1925600] {CVE-2021-26708}
  - vsock: fix the race conditions in multi-transport support (Jon Maloy) [1925599 1925600] {CVE-2021-26708}
  - [base] mm: don't panic when links can't be created in sysfs (Baoquan He) [1930168 1890171]
  - mm: don't rely on system state to detect hot-plug operations (Baoquan He) [1930168 1890171]
  - mm: replace memmap_context by meminit_context (Baoquan He) [1930168 1890171]
  - [tools] kvm: nvmx: check for invalid hdr.vmx.flags (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nvmx: check for required but missing VMCS12 in KVM_SET_NESTED_STATE (Paolo Bonzini) [1923281 1904128]
  - [tools] selftests: kvm: do not set guest mode flag (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: fix CPUID entries returned by KVM_GET_CPUID2 ioctl (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: svm: Fix offset computation bug in __sev_dbg_decrypt() (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nvmx: Sync unsync'd vmcs02 state to vmcs12 on migration (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: get smi pending status correctly (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86/pmu: Fix UBSAN shift-out-of-bounds warning in intel_pmu_refresh() (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: Add more protection against undefined behavior in rsvd_bits() (Paolo Bonzini) [1923281 1904128]
  - [documentation] kvm: Forbid the use of tagged userspace addresses for memslots (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: allow KVM_REQ_GET_NESTED_STATE_PAGES outside guest mode for VMX (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nsvm: cancel KVM_REQ_GET_NESTED_STATE_PAGES on nested vmexit (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nsvm: mark vmcb as dirty when forcingly leaving the guest mode (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nsvm: correctly restore nested_run_pending on migration (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: fix shift out of bounds reported by UBSAN (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits (Paolo Bonzini) [1923281 1904128]
  - [target] scsi: target: Fix XCOPY NAA identifier lookup (Maurizio Lombardi) [1900462 1900463] {CVE-2020-28374}
  - scsi: qla2xxx: Fix mailbox Ch erroneous error (Nilesh Javali) [1924222 1894578]
  - [net] fix iteration for sctp transport seq_files (Xin Long) [1927521 1916824]
  - [scsi] scsi: lpfc: Fix initial FLOGI failure due to BBSCN not supported (Dick Kennedy) [1927921 1887549]
  - [mm] mm, oom: remove oom_lock from oom_reaper (Waiman Long) [1929738 1873759]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.21.1.el8_3]
changelog:
  - KVM: x86: Allow guests to see MSR_IA32_TSX_CTRL even if tsx=off (Paolo Bonzini) [1939013 1912448]
  - gfs2: Fix deadlock between gfs2_{create_inode, inode_lookup} and delete_work_func (Andreas Gruenbacher) [1937109 1903190]
  - gfs2: Don't call cancel_delayed_work_sync from within delete work function (Andreas Gruenbacher) [1937109 1903190]
  - gfs2: Only access gl_delete for iopen glocks (Andreas Gruenbacher) [1937109 1903190]
  - gfs2: Don't sleep during glock hash walk (Andreas Gruenbacher) [1937109 1903190]
  - [netdrv] net/mlx5e: Add missing set of destination vport flags in termtbl create (Alaa Hleihel) [1924689 1851700]
  - [tools] tools arch x86: Sync asm/cpufeatures.h with the kernel sources (David Arcari) [1929740 1916478]
  - [x86] x86/cpu/amd: Call init_amd_zn() om Family 19h processors too (David Arcari) [1929740 1916478]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.22.1.el8_3]
changelog:
  - futex: Handle faults correctly for PI futexes (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Simplify fixup_pi_state_owner() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Use pi_state_update_owner() in put_pi_state() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Provide and use pi_state_update_owner() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Replace pointless printk in fixup_owner() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Ensure the correct return value from futex_lock_pi() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Don't enable IRQs unconditionally in put_pi_state() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Fix incorrect should_fail_futex() handling (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Consistently use fshared as boolean (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Remove needless goto's (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Remove put_futex_key() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930832 1930833] {CVE-2021-27364}
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930855 1930856] {CVE-2021-27365}
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1940423 1930809] {CVE-2021-27363}


author: Marian Csontos <mcsontos@redhat.com> - 2.03.11-1
changelog:
  - Fix pvck handling MDA at offset different from 4096.
  - Partial or degraded activation of writecache is not allowed.
  - Enhance error handling in fsadm and handle correct fsck result.
  - Dmeventd lvm plugin ignores higher reserved_stack lvm.conf values.
  - Support using BLKZEROOUT for clearing devices.
  - Fixed interrup handling.
  - Fix block cache when device has too many failing writes.
  - Fix block cache waiting for IO completion with failing disks.
  - Add configure --enable-editline support as an alternative to readline.
  - Enhance reporting and error handling when creating thin volumes.
  - Enable vgsplit for VDO volumes.
  - Lvextend of vdo pool volumes ensure at least 1 new VDO slab is added.
  - Restore lost signal blocking while VG lock is held.
  - Improve estimation of needed extents when creating thin-pool.
  - Use extra 1% when resizing thin-pool metadata LV with --use-policy.
  - Enhance --use-policy percentage rounding.
  - Allow pvmove of writecache origin.
  - Report integrity fields.
  - Integrity volumes defaults to journal mode.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.11-2
changelog:
  - Fix problem with wiping of converted LVs.
  - Fix memleak in scanning.
  - Fix corner case allocation for thin-pools.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.11-3
changelog:
  - Fix mpath filtering of NVMe devices.
  - Check if lvcreate passes read_only_volume_list with tags and skips zeroing.
  - Limit pool metadata spare to 16GiB.
  - Improves conversion and allocation of pool metadata.
  - Fix different limits used for metadata by lvm2 and thin-tools.
  - Fix interrupting lvconvert --splitcache command with striped origin volumes.


author: Sumit Bose <sbose@redhat.com> - 0.8.2-6
changelog:
  - [abrt] [faf] adcli: raise(): /usr/sbin/adcli killed by 6 [#1806260]
  - No longer able to delete computer from AD using adcli [#1846882]
  - adcli: presetting $computer in $domain domain failed: Cannot set computer
    password: Authentication error [#1846878]
  - Typo in adcli update --help option [#1791611]
  - Manpage and help does not explain the use of "-C" option [#1791545]


author: Peter Jones <pjones@redhat.com> - 2.02-87
changelog:
  - Fix several CVEs
    Resolves: CVE-2020-10713
    Resolves: CVE-2020-14308
    Resolves: CVE-2020-14309
    Resolves: CVE-2020-14310
    Resolves: CVE-2020-14311


author: Steve Dickson <steved@redhat.com> 2.3.3-32
changelog:
  - junction: Fixed debug statement (bz 1831829)
  - Userspace support for the latest nfsdcld daemon (bz 1817756)


author: Steve Dickson <steved@redhat.com> 2.3.3-33
changelog:
  - manpage: Add a description of the 'nconnect' mount option (bz 1761352)
  - nfsdclddb: Redname clddb-tool to nfsdclddb (bz 1836924)


author: Marek Polacek <polacek@redhat.com> 8.3.1-5.1
changelog:
  - consider negative edges in cycle detection (#1817991, PR gcov-profile/91601)
  - fix Fortran debug info for arrays with descriptors (#1655624,
    PR fortran/92775)
  - fix wrong code emitted for movv1qi on s390x (#1784758, PR target/92950)


author: Deepshikha Khandelwal <dkhandel@redhat.com> - 6.0-37.1
changelog:
  - fixes bugs bz#1848890 bz#1848891 bz#1848893 bz#1848894 bz#1848895 
    bz#1848896 bz#1848899 bz#1849533


author: Jakub Martisko <jamartis@redhat.com> - 4.5-2
changelog:
  - fix "in-place edits on FUSE filesystems create files with all-zero mode bits"
  - Resolves: #1835761


author: Jakub Jelen <jjelen@redhat.com> - 8.0p1-5 + 0.10.3-7
changelog:
  - Do not print "no slots" warning by default (#1744220)
  - Unbreak connecting using gssapi through proxy commands (#1749862)
  - Document in manual pages that CASignatureAlgorithms are handled by crypto policies (#1790604)
  - Use SHA2-based signature algorithms by default for signing certificates (#1790610)
  - Prevent simple ProxyJump loops in configuration files (#1804099)
  - Teach ssh-keyscan to use SHA2 RSA variants (#1744108)
  - Do not fail hard if getrandom() is not available and no SSH_USE_STRONG_RNG is specified (#1812120)
  - Improve wording of crypto policies references in manual pages (#1812854)
  - Do not break X11 forwarding if IPv6 is disabled (#1662189)
  - Enable SHA2-based GSSAPI key exchange algorithms by default (#1816226)
  - Mark RDomain server configuration option unsupported in RHEL (#1807686)
  - Clarify crypto policies defaults in manual pages (#1724195)
  - Mention RSA SHA2 variants in ssh-keygen manual page (#1665900)


author: Christopher Snyder <csnyder@redhat.com> 1.27.9-1
changelog:
  - 1840364: Kill rhsmd during post-install on rhel8
    (jhnidek@redhat.com)
  - 1848636, 1849074: Update insights machine-id path (csnyder@redhat.com)
  - 1700441: Create directories, when missing (jhnidek@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.27.10-1
changelog:
  - 1847636: error when registering in intial-setup-graphical
    (wpoteat@redhat.com)
  - Added unit test for this case. (jhnidek@redhat.com)
  - 1845399: List available subscription ondate options failed
    (wpoteat@redhat.com)
  - 1657269: Do not use /var/run, but use /run; ENT-1086 (jhnidek@redhat.com)
  - cockpit: change button order to conform with patternfly guidelines
    (anilsson@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.27.11-1
changelog:
  - 1780028: Remove man page entries for rhsmd (wpoteat@redhat.com)
  - 1838423: Fix getting list of releases from CDN; (jhnidek@redhat.com)
  - 1838670: set permissions on rhsm.conf (jbastian@redhat.com)
  - cockpit: Fix AppStream launchable metainfo (martin@piware.de)
  - 1838967: Sync syspurpose cache on registration (wpoteat@redhat.com)
  - 1859532: Role --list handle wrong proxy conf (unregistered case) (jhnidek@redhat.com)
  - 1859532: No traceback, when wrong proxy conf is used (jhnidek@redhat.com)
  - 1857100: Do not print empty string as valid value (jhnidek@redhat.com)
  - 1634023: Use list of valid syspurpose values provided by candlepin server (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.27.12-1
changelog:
  - 1832990: Add rhsm.no_insights config option, improve messaging
    (csnyder@redhat.com)
  - Add --no-insights option; ENT-2471 (khowell@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.27.13-1
changelog:
  - 1663116: 1663390: 1663402: 1663408: Update translations (wpoteat@redhat.com)
  - 1862425: Fix setting service-level (jhnidek@redhat.com)
  - 1862419: Make repo-override working again (jhnidek@redhat.com)
  - 1858296: Do not print unchanged profile (jhnidek@redhat.com)
  - 1861255: Catch all exception and print traceback to rhsm.log
    (jhnidek@redhat.com)
  - 1841600: D-Bus - update ent. cert., when act. key is used
    (jhnidek@redhat.com)
  - Support Insights registration by default in cockpit (khowell@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.27.14-1
changelog:
  - 1862415: Print proper message, when consumer is deleted; ENT-2709
    (jhnidek@redhat.com)
  - 1855893: Generate redhat.repo properly; ENT-2636 (jhnidek@redhat.com)
  - Revert "Add --no-insights option; ENT-2471" (csnyder@redhat.com)
  - Revert "Add insights-client messaging on registration" (csnyder@redhat.com)
  - Revert "Address review feedback" (csnyder@redhat.com)
  - Revert "1832990: Add rhsm.no_insights config option, improve messaging"
    (csnyder@redhat.com)
  - Automatic commit of package [subscription-manager] release [1.27.13-1].
    (wpoteat@redhat.com)
  - 1663116: 1663390: 1663402: 1663408: Update translations (wpoteat@redhat.com)
  - 1862425: Fix setting service-level; ENT-1862425 (jhnidek@redhat.com)
  - 1862419: Make repo-override working again; ENT-2710 (jhnidek@redhat.com)
  - 1858296: Do not print unchanged profile; ENT-2639 (jhnidek@redhat.com)
  - 1861255: Catch all exception and print traceback to rhsm.log
    (jhnidek@redhat.com)
  - 1841600: D-Bus - update ent. cert., when act. key is used; ENT-2453
    (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.27.15-1
changelog:
  - 1615429: Fix sorting of plugin hooks (csnyder@redhat.com)
  - 1820534: Update translations (csnyder@redhat.com)
  - 1841601: Set default encoding properly; ENT-2499 (jhnidek@redhat.com)
  - 1839199: More rhsmd cleanup (wpoteat@redhat.com)
  - 1869725: Do not print traceback, when profile upload failed; ENT-2754
    (jhnidek@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.27.17-1
changelog:
  - Use python3-requests and not python-requests. (jhnidek@redhat.com)
  - ENT-3289: automatic registration on public cloud (#2407) (jhnidek@redhat.com)
  - ENT-3191: Collect metadata of cloud providers (#2381) (jhnidek@redhat.com)
  - Detecting of cloud providers; ENT-3288 (#2367) (jhnidek@redhat.com)
  - Syntax update to translation commands (#2396) (wpoteat@redhat.com)
  - Update project to use Weblate for translations (#2389) (wpoteat@redhat.com)


author: Eugene Syromiatnikov <esyr@redhat.com> 2.1.0K_dup8.3-1
changelog:
  - bfcc924fa05e36abe7a039ac5ec2be581e20c288
  - ena kernel module for Driver Update Program
  - Resolves: #bz1901520


author: Sahana Prasad <sahana@redhat.com> - 5.56-5
changelog:
  - Fix CVE-2021-20230 stunnel: client certificate not
    correctly verified when redirect and verifyChain options are used.


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.26.0-0.2.1
changelog:
  - device: restart DHCP only for devices that are active or activating (rh #1852612)
  - initrd: fix generating default BOOTIF= connection (rh #1853277)
  - ovs: fix race condition when setting MAC address for ovs interfaces (rh #1852106)


author: Thomas Haller <thaller@redhat.com> - 1:1.26.0-1
changelog:
  - update to 1.26.0
  - device: reset SR-IOV parameters on activation failure (rh #1819587)
  - initrd: enable ipv6.method=auto with ip=dhcp6 (rh #1854323)
  - core: add "nm-shared" zone for firewalld for shared mode (rh #1834907)
  - ppp: fix taking control of link (rh #1849386)


author: Antonio Cardace <acardace@redhat.com> - 1:1.26.0-2
changelog:
  - core: fix generation of local routes for VRF devices (rh #1857133)
  - team: fix crash on failure to connect to teamd (rh #1856723)
  - core: fix detecting failure of master active-connection (rh #1845018)
  - core: fix warning about setting active_slave of bond when activating master (rh #1858326)
  - import translations (rh #1820552)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-1
changelog:
  - Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
  - Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
  - Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-2
changelog:
  - Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-3
changelog:
  - Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
  - Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
  - Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
  - Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
                             inotify events, and no updates are triggered
  - Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
                             on GDM login with smart-card
  - Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
  - Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
  - Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
                             if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
                             in SSSD-AD direct integration.
  - Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
  - Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-4
changelog:
  - Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
  - Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
  - Resolves: rhbz#1803134 - Improve "unlock" time when user session already active


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-5
changelog:
  - Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
  - Fixed "requires/provides" rpmdiff warning


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-7
changelog:
  - Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
  - Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-8
changelog:
  - Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
  - Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
  - Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
  - Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-9
changelog:
  - Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied


author: Ondrej Kozina <okozina@redhat.com> - 2.2.2-1
changelog:
  - Update to cryptsetup 2.2.2
  - LUKS2 reencryption honors activation flags (one time and persistent).
  - LUKS2 reencryption works also without volume keys put in kernel
    keyring service.
  - Resolves: #1757783 #1750680 #1753597 #1743399


author: Ondrej Kozina <okozina@redhat.com> - 2.3.3-2
changelog:
  - patch: Fix possible memory corruption in LUKS2 validation
  	 code in 32bit library.
  - Resolves: #1872294


author: Lianbo Jiang <lijiang@redhat.com> - 1:3.2-6
changelog:
  - Updated to the latest upstream(5b3c8e995026 ("Allow overriding
    build settings from the environment"))
  - Resolves: rhbz#1796581


author: Isaac Boukris <iboukris@redhat.com> - 4.12.3-4
changelog:
  - resolves: #1850980 - Add "additional dns hostname" to keytab
  - resolves: #1850981 - Add net-ads-join dnshostname=fqdn option


author: Andreas Schneider <asn@redhat.com> - 4.12.3-5
changelog:
  - resolves: #1823612 - Fix segfault in 'net ads dns gethostbyname'
  - resolves: #1792553 - Fix 'net ads join createcomputer=OU'


author: Andreas Schneider <asn@redhat.com> - 4.12.3-7
changelog:
  - resolves: #1855711 - Fix 'require_membership_of' documentation in
                         pam_winbind manpage


author: Andreas Schneider <asn@redhat.com> - 4.12.3-9
changelog:
  - related: #1817557 - Move DECRPC mdssvc data files to correct package
  - resolves: #1856676 - Fix lookuprids in winbind


author: Michal Židek <mzidek@redhat.com> - 2.9.5-12
changelog:
  - Resolves: rhbz#1835388 - abrt-addon-ccpp causes failures during openscap scans on CCE-27119-7
  - This is just libreport side (abrt also needs to be patched)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.14.2.el8_2]
changelog:
  - [kernel] Move to dual-signing to split signing keys up better (pjones) [1837433 1837434] {CVE-2020-10713}
  - [crypto] pefile: Tolerate other pefile signatures after first (Lenny Szubowicz) [1837433 1837434] {CVE-2020-10713}
  - [acpi] ACPI: configfs: Disallow loading ACPI tables when locked down (Lenny Szubowicz) [1852968 1852969] {CVE-2020-15780}
  - [firmware] efi: Restrict efivar_ssdt_load when the kernel is locked down (Lenny Szubowicz) [1852948 1852949] {CVE-2019-20908}


author: Isaac Boukris <iboukris@redhat.com> - 2.2.0-1
changelog:
  - Resolves: rhbz#1878114 - Rebase libldb to the version required by Samba
  - Resolves: rhbz#1794349 - Build libldb with lmdb support


author: Ray Strode <rstrode@redhat.com> - 3.28.3-2
changelog:
  - Add lock to avoid two type object wrappers getting generated at
    the same time in multi-threaded programs.
    Resolves: #1844578


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.26.0-0.2
changelog:
  - update to 1.26-rc2 (1.25.91)
  - initrd: set ipv6.method=auto when using IPv4 static configuration (rh #1848943)
  - cloud-setup: add support for Google Cloud load-balancing routes (rh #1821787)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-13
changelog:
  - Added -DDFLTCC parameter to configure to enable 
  - Z hardware-accelerated deflate for s390x architectures (#1659433)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-16
changelog:
  - Permit a deflateParams() parameter change
  - Another fix for Z hardware-accelerated deflate for s390x architectures
  - according to previous change by upstream


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-7
changelog:
  - Disallow dropping Extended Master Secret extension
    on renegotiation
  - Return alert from s_server if ALPN protocol does not match
  - SHA1 is allowed in @SECLEVEL=2 only if allowed by
    TLS SigAlgs configuration


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-9
changelog:
  - Rewire FIPS_drbg API to use the RAND_DRBG
  - Use the well known DH groups in TLS even for 2048 and 1024 bit parameters


author: Tomáš Mráz <tmraz@redhat.com> 1.8.5-3
changelog:
  - new upstream version 1.8.5
  - AES performance improvements backported from master branch
  - FIPS module is implicit with kernel FIPS flag
  - always run the FIPS selftests if FIPS module is installed


author: Jiri Kucera <jkucera@redhat.com> - 1.13.1-2
changelog:
  - Remove *.pc files due to 'nothing provides pkgconfig(gpg-error)'
    and 'nothing provides pkgconfig(libassuan)' dnf errors
    Related: #1829822


author: Nick Clifton <nickc@redhat.com> - 2.30-74
changelog:
  - Stop the BFD library from issueing warning messages about allocated sections being found outside of loadable segments.  (#1630115)
  - Fix linker testsuite failures for the aarch64 and s390x targets.  (#1632775, #1809101)
  - Fix building the binutils with address sanitization enabled.  (#1678323)
  - Add support for the PT_GNU_PROPERTY segment.  (#1721606)
  - Fix an internal error in the GOLD linker.  (#1722715)
  - Fix the generation of corrupt .note.gnu.property notes.  (#1723533)
  - Stop objcopy's --set-section-flags option from setting the 'shared' flag on non-COFF binaries.  (#1807308)
  - Fix a bug in the secondary reloc processing code.  (#1809186)


author: Christopher Snyder <csnyder@redhat.com> 1.27.5-1
changelog:
  - Revert "1667792: added --disable-auto-attach option to register command;
    ENT-1684" (csnyder@redhat.com)
  - 1834792: Try to terminate rhsmd after timeout; ENT-2368 (jhnidek@redhat.com)
  - 1837244: Fix wrong version provided by subscription-manager version; ENT-2388
    (jhnidek@redhat.com)
  - 1838012: prevent redundant remote syspurpose sync (pmoravec@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.28.0-1
changelog:
  - 1804454: collect uuid on aarch64 system (wpoteat@redhat.com)
  - WIP: Try to fix build of rpms on suse. (jhnidek@redhat.com)
  - 1842474: Update local and cache file during sync(); ENT-2433
    (jhnidek@redhat.com)
  - 1725525: Mark one string for translation; ENT-1680 (jhnidek@redhat.com)
  - 1789457: Syspurpose exception message parsing (wpoteat@redhat.com)
  - Fix building sub-man on Fedora 32 (jhnidek@redhat.com)
  - cockpit: Call run-tests from common to run cockpit integration tests
    (sanne.raymaekers@gmail.com)


author: Andrew Price <anprice@redhat.com> - 3.2.0-9
changelog:
  - gfs2_jadd: Handle out-of-space issues
  - gfs2_jadd: error handling overhaul
    Resolves: rhbz#1833141
  - gfs2.5: Update some mentions of gfs2_tool
    Resolves: rhbz#1818983


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-3
changelog:
  - pgrep: uid/gid conversion overflow
  - vmstat: align manpage with procfs wording
  - watch: manpage presumes NTP on system
  - Resolves: rhbz#1827731
  - Resolves: rhbz#1829920
  - Resolves: rhbz#1583669


author: Rafael Aquini <aquini@redhat.com> - 2.21-13
changelog:
  - Fix: huge_page_setup_helper.py: SyntaxError: Missing parentheses in call to 'print' (1821938)
  - libhugetlbfs-tests: harden the testcases to satisfy EXECSHIELD RPMDiff checks (1785296)


author: Daiki Ueno <dueno@redhat.com> - 3.6.14-7
changelog:
  - Increase DH key bits to >= 2048 in self-tests (#1879506)
  - Implement self-tests for KDF and CMAC (#1890870)
  - Fix CVE-2020-24659: heap buffer-overflow when "no_renegotiation" alert is received (#1873959)


author: Andreas Schneider <asn@redhat.com> - 4.12.3-1
changelog:
  - resolves: #1666737 - Add a new smbc_readdirplus2() function to libsmbclient
  - resolves: #1842844 - Fix GnuTLS priority list for TLS connections


author: Jakub Jelen <jjelen@redhat.com> - 0.20.0-3
changelog:
  - Support PIN change for HID Alt tokens (#1830901)
  - Fix CVE-2020-26570, CVE-2020-26571 and CVE-2020-26572
  - Fix right padding of token labels of some cards (#1877973)


author: Xin Long <lxin@redhat.com> - 1.29-1.el8_2.1
changelog:
  - utils/bond2team: keep delivering config to file if stdout not supplied [1865899]
  - utils/bond2team: remove TYPE in ifcfg file [1865899]


author: Ian Kent <ikent@redhat.com> - 5.1.4-41
changelog:
  - bz1835547 - [RHEL8]autofs cannot mount samba/cifs shares that end with a
    dollar sign
    - fix trailing dollar sun entry expansion.
  - Resolves: rhbz#1835547


author: Ian Kent <ikent@redhat.com> - 5.1.4-42
changelog:
  - bz1841456 - automount program crashes with "malloc(): invalid next size
    (unsorted)
    - initialize struct addrinfo for getaddrinfo() calls.
    - fix quoted string length calc in expandsunent().
  -Resolves: rhbz#1841456


author: Ian Kent <ikent@redhat.com> - 5.1.4-43
changelog:
  - bz1841456 - automount program crashes with "malloc(): invalid next size
    (unsorted)
    - fix autofs mount options construction.
  -Related: rhbz#1841456


author: Kamil Dudka <kdudka@redhat.com> - 3.14.0-4
changelog:
  - logrotate.8: encourage admins to use the `su` directive (#1759770)
  - do not abort globbing on broken symlink (#1723265)


author: Phil Sutter <psutter@redhat.com> - 1.8.4-11
changelog:
  - Complete ebtables-nft among match support
  - Replace RHEL-only xtables-monitor fix with upstream solution
  - xtables: Align effect of -4/-6 options with legacy
  - xtables: Drop -4 and -6 support from xtables-{save,restore}
  - Review systemd unit files


author: Phil Sutter <psutter@redhat.com> - 1.8.4-15.1
changelog:
  - tests: shell: Improve concurrent noflush restore test a bit
  - nft: Fix for concurrent noflush restore calls
  - nft: Fix error reporting for refreshed transactions
  - nft: Make batch_add_chain() return the added batch object


author: Phil Sutter <psutter@redhat.com> - 1.8.4-15.2
changelog:
  - tests/shell: Add test for bitwise avoidance fixes
  - ebtables: Optimize masked MAC address matches
  - nft: Optimize class-based IP prefix matches
  - nft: Fix for broken address mask match detection


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-24
changelog:
  - Build Python with -fno-semantic-interposition for better performance
  - https://fedoraproject.org/wiki/Changes/PythonNoSemanticInterpositionSpeedup
  - Also fix test_gdb failures with Link Time Optimizations
  Resolves: rhbz#1724996


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-26
changelog:
  - Skip test_startup_imports from test_site if we have a .pth file in sys.path
  Resolves: rhbz#1814392


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-27
changelog:
  - Add a sentinel value on the Hmac_members table of the fips compliant hmac module
  Resolves: rhbz#1800512


author: Victor Stinner <vstinner@python.org> - 3.6.8-30
changelog:
  - Remove downstream 00178-dont-duplicate-flags-in-sysconfig.patch which
    introduced a bug on distutils.sysconfig.get_config_var('LIBPL')
    (rhbz#1851090).


author: Tomas Orsava <torsava@redhat.com> - 3.6.8-31
changelog:
  - Avoid infinite loop when reading specially crafted TAR files (CVE-2019-20907)
  Resolves: rhbz#1856481
  - Resolve hash collisions for Pv4Interface and IPv6Interface (CVE-2020-14422)
  Resolves: rhbz#1854926


author: Josef Ridky <jridky@redhat.com> - 1:5.8-15
changelog:
  - proxied OIDs unspecified in proxy statement in snmpd.conf (#1658134)
  - UCD-SNMP-MIB::dskTable doesn't update dynamically (#1658185)
  - expand SNMPCONFPATH variable (#1660146)
  - remove file with Apple license (#1690936)
  - log meningful message on duplicate IP address (#1692286)
  - memory reporting adjustment (#1695497 and #1766521)
  - fix typos in man page (#1700262)
  - speedup ipAddressTable loading(#1700391)
  - fix memory leak when shut down librpm (#1763008)
  - services starts after network-online.target (#1775304)
  - add missing part of memory leak patch (#1829860)
  - add support for AES192 and AES256 (#1846252)


author: Ales Matej <amatej@redhat.com> - 1.11.3-1
changelog:
  - Update to 1.11.3
   - Prefer mirrorlist/metalink over baseurl (RhBug:1775184)
   - Fix calling Python API without holding GIL (RhBug:1788918) 
   - Do not unref LrErr_Exception on exit (RhBug:1778854)


author: Nicola Sella <nsella@redhat.com> - 1.12.0-1
changelog:
  - Update to 1.12.0
  - Decode package URL when using for local filename (RhBug:1817130)
  - Fix memory leak in lr_download_metadata() and lr_yum_download_remote()
  - Download sources work when at least one of specified is working (RhBug:1775184)
  - Enable building on OSX


author: Pavel Březina <pbrezina@redhat.com> - 1.2.1-1
changelog:
  - Rebase to authselect-1.2.1 (RHBZ #1810471)
  - CLI commands are now correctly translated (RHBZ #1816009)
  - Remove unsupported features from sssd profile description (RHBZ #1830251)
  - add `with-files-access-provider` to sssd profile (RHBZ #1734094)
  - switch to pam_usertype module (RHBZ #1773567)
  - fix typo in sssd profile description (RHBZ #1787638)
  - add minimal profile (RHBZ #1654018)


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-82
changelog:
  - Drop "Disable multiboot, multiboot2, and linux16 modules on EFI builds"
    Resolves: rhbz#1779480
  - efi/http: Export {fw,http}_path variables to make them global
    Resolves: rhbz#1811561
  - efi/http: Enclose literal IPv6 addresses in square brackets
  - efi/net: Allow to specify a port number in addresses
  - efi/ip4_config: Improve check to detect literal IPv6 addresses
  - efi/net: Print a debug message if parsing the address fails
    Resolves: rhbz#1811560
  - Set image base address before jumping to the PE/COFF entry point
    Resolves: rhbz#1819624


author: Peter Jones <pjones@redhat.com> - 2.02-86
changelog:
  - Couple more late fixes.
    Resolves: CVE-2020-10713
    Resolves: CVE-2020-14308
    Resolves: CVE-2020-14309
    Resolves: CVE-2020-14310
    Resolves: CVE-2020-14311


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-90.el8_3.1
changelog:
  - Fix another batch of CVEs
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Xin Long <lxin@redhat.com> - 1.29-2
changelog:
  - teamd/lacp: fix segfault due to NULL pointer dereference [1758073]
  - teamd: fix build error in expansion of macro teamd_log_dbgx [1758073]
  - teamd: update ctx->hwaddr after setting team dev to new hwaddr
  - libteam: wapper teamd_log_dbg with teamd_log_dbgx [1758073]


author: Xin Long <lxin@redhat.com> - 1.31-1
changelog:
  - 1.31 release
  - utils/bond2team: remove TYPE in ifcfg file [1858518]
  - utils/bond2team: keep delivering config to file if stdout not supplied [1858518]
  - teamd/lacp: silence ignore none LACP frames
  - Send LACP PDU right after the Actor state has been changed
  - Skip setting the same hwaddr to a lag port if not needed
  - Make all netlink socket RCVBUF sizes configurable
  - Don't return an error when timerfd socket return 0
  - Fix ifinfo_link_with_port race condition with newlink
  - teamd: fix possible race in master ifname callback
  - 1.30 release
  - teamd: Disregard current state when considering port enablement [1851460]


author: Lukas Nykryn <lnykryn@redhat.com> - 049-95.git20200804.1
changelog:
  - multipath: require kpartx binary
  - Replace ln with systemctl
  - multipath: add automatic configuration for multipath
  - 98dracut-systemd: don't wait for root device if remote
  - 90crypt: pull in remote-cryptsetup.target enablement


author: Matej Marusak <mmarusak@redhat.com> - 219-1
changelog:
  - Rebase to upstream version 219
  - Accept upper-case login names for ssh/polkit agent challenges (rhbz#1825749)
  - Show last/failed login (rhbz#1784772)
  - Modernize services page (rhbz#1791193)
  - Search in journal (rhbz#1710731)
  - The default mode is not consistent with the mode in the created bond (rhbz#1817948)
  - Fix deadlock in channel pressure handling (rhbz#1751783)


author: Matej Marusak <mmarusak@redhat.com> - 220-1
changelog:
  - New navigation with integrated switching of hosts
  - Logs: Inline help for filtering
  - Fix cockpit-system AppStream dependency (rhbz#1838003)


author: Martin Pitt <mpitt@redhat.com> - 221-1
changelog:
  - Support for Cross-Origin-Resource-Policy
  - Accounts: Some buttons are hidden when access is limited
  - Developers: Importing "base1/patternfly.css" is deprecated
  - Translation updates (rhbz#1820538)


author: Martin Pitt <mpitt@redhat.com> - 221.1-1
changelog:
  - Put back missing base1/patternfly.css
  - Services: Don't offer 'Start Service' in Limited Access mode


author: Matej Marusak <mmarusak@redhat.com> - 222-1
changelog:
  - Logs: More flexible text filters
  - Services, Dashboard: Hide some buttons when access is limited
  - Webserver: Lock down cockpit.service privileges
  - Localization updates (rhbz#1820538)


author: Martin Pitt <mpitt@redhat.com> - 223-1
changelog:
  - Webserver: Standard-conformant lifetime of web server Certificate
  - Support certificate authentication against Active Directory
  - Fix cockpit-desktop privileges (rhbz#1841104)
  - Translation updates (rhbz#1820538)


author: Matej Marusak <mmarusak@redhat.com> - 224.2-1
changelog:
  - lib: Include current directory in FileAutoComplete option listing (rhbz#1866995)
  - lib: Make sure that the expandable part of table rows has unique key (rhbz#1865821)


author: Robbie Harwood <rharwood@redhat.com> - 1.18-1
changelog:
  - New upstream version (1.18)
  - Resolves: #1802334
  - Resolves: #1820311
  - Resolves: #1791062
  - Resolves: #1784655


author: Robbie Harwood <rharwood@redhat.com> - 1.18.2-3
changelog:
  - Match Heimdal behavior for channel bindings
  - Code hygiene + test stability fix included
  - Resolves: #1840518


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.20.1.el8_2]
changelog:
  - [infiniband] IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE (Kamal Heib) [1872771 1850314]
  - [block] blk-mq: Rerun dispatching in the case of budget contention (Ming Lei) [1869779 1824037]
  - [block] blk-mq: Add blk_mq_delay_run_hw_queues() API call (Ming Lei) [1869779 1824037]
  - [block] blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason to kick (Ming Lei) [1869779 1824037]
  - [block] blk-mq: Put driver tag in blk_mq_dispatch_rq_list() when no budget (Ming Lei) [1869779 1824037]
  - [md] dm mpath: use double checked locking in fast path (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: rename current_pgpath to pgpath in multipath_prepare_ioctl (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: rework __map_bio() (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: factor out multipath_queue_bio (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: push locking down to must_push_back_rq() (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: take m->lock spinlock when testing QUEUE_IF_NO_PATH (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: changes from initial m->flags locking audit (Mike Snitzer) [1869386 1848651]
  - [md] dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue() (Mike Snitzer) [1869386 1848651]
  - [md] dm: do not use waitqueue for request-based DM (Mike Snitzer) [1869386 1848651]
  - [block] blk-mq: consider non-idle request as "inflight" in blk_mq_rq_inflight() (Mike Snitzer) [1869386 1848651]
  - [kernel] sched/deadline: Initialize ->dl_boosted (Phil Auld) [1867612 1854179]
  - [kernel] sched/core: Fix PI boosting between RT and DEADLINE tasks (Phil Auld) [1867612 1854179]
  - [net] net/smc: tolerate future SMCD versions (Philipp Rudo) [1866390 1854992]
  - [net] openvswitch: fixes potential deadlock in dp cleanup code (Eelco Chaudron) [1859216 1845662]
  - [net] openvswitch: reorder masks array based on usage (Eelco Chaudron) [1859216 1845662]
  - [net] openvswitch: take into account de-fragmentation/gso_size in execute_check_pkt_len (Lorenzo Bianconi) [1860169 1851888]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.21.1.el8_2]
changelog:
  - [scsi] scsi: ibmvfc: Fix NULL return compiler warning (Steve Best) [1866371 1810653]
  - [scsi] scsi: ibmvfc: Avoid loss of all paths during SVC node reboot (Steve Best) [1866371 1810653]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.22.1.el8_2]
changelog:
  - [crypto] pefile: Support multiple signatures in verify_pefile_signature (Lenny Szubowicz) [1877530 1862072]
  - [crypto] Revert "pefile: Tolerate other pefile signatures after first" (Bruno Meneguele)
  - [infiniband] IB/hfi1: Fix another case where pq is left on waitlist (Kamal Heib) [1872766 1859209]
  - [infiniband] IB/hfi1: Ensure pq is not left on waitlist (Kamal Heib) [1872766 1859209]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.23.1.el8_2]
changelog:
  - [net] packet: fix overflow in tpacket_rcv (Hangbin Liu) [1876223 1876224] {CVE-2020-14386}
  - [net] packet: make tp_drops atomic (Hangbin Liu) [1876223 1876224] {CVE-2020-14386}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.24.1.el8_2]
changelog:
  - [kernel] timers: Remove must_forward_clk (Phil Auld) [1877417 1833096]
  - [kernel] timers: Spare timer softirq until next expiry (Phil Auld) [1877417 1833096]
  - [kernel] timers: Expand clk forward logic beyond nohz (Phil Auld) [1877417 1833096]
  - [kernel] timers: Reuse next expiry cache after nohz exit (Phil Auld) [1877417 1833096]
  - [kernel] timers: Always keep track of next expiry (Phil Auld) [1877417 1833096]
  - [kernel] timers: Optimize _next_timer_interrupt() level iteration (Phil Auld) [1877417 1833096]
  - [kernel] timers: Add comments about calc_index() ceiling work (Phil Auld) [1877417 1833096]
  - [kernel] timers: Move trigger_dyntick_cpu() to enqueue_timer() (Phil Auld) [1877417 1833096]
  - [kernel] timers: Use only bucket expiry for base->next_expiry value (Phil Auld) [1877417 1833096]
  - [kernel] timers: Preserve higher bits of expiration on index calculation (Phil Auld) [1877417 1833096]
  - [kernel] timer: Fix wheel index calculation on last level (Phil Auld) [1877417 1833096]
  - [kernel] timer: Prevent base->clk from moving backward (Phil Auld) [1877417 1833096]
  - [kernel] timer: Read jiffies once when forwarding base clk (Phil Auld) [1877417 1833096]
  - [infiniband] RDMA/umem: Fix ib_umem_find_best_pgsz() (Kamal Heib) [1872424 1856158]
  - [net] net: accept an empty mask in /sys/class/net/*/queues/rx-*/rps_cpus (Nitesh Narayan Lal) [1870181 1868433]
  - [net] net: Restrict receive packets queuing to housekeeping CPUs (Nitesh Narayan Lal) [1867174 1844520]
  - [pci] PCI: Restrict probe functions to housekeeping CPUs (Nitesh Narayan Lal) [1867174 1844520]
  - [lib] lib: Restrict cpumask_local_spread to houskeeping CPUs (Nitesh Narayan Lal) [1867174 1844520]
  - [s390] s390/pci: Fix unexpected write combine on resource (Philipp Rudo) [1869276 1827311]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.25.1.el8_2]
changelog:
  - [net] netfilter: conntrack: proc: rename stat column (Florian Westphal) [1882095 1875681]
  - [net] netfilter: conntrack: add clash resolution stat counter (Florian Westphal) [1882095 1875681]
  - [net] netfilter: conntrack: remove ignore stats (Florian Westphal) [1882095 1875681]
  - [net] netfilter: conntrack: do not increment two error counters at same time (Florian Westphal) [1882095 1875681]
  - [net] netfilter: conntrack: do not auto-delete clash entries on reply (Florian Westphal) [1882095 1875681]
  - [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen) [1881085 1875316] {CVE-2020-14385}
  - [kernel] time/tick-broadcast: Fix tick_broadcast_offline() lockdep complaint (Alexey Klimov) [1880081 1877380]
  - [net] atomics/treewide: Rename __atomic_add_unless() => atomic_fetch_add_unless() (Yauheni Kaliuta) [1880081 1813370]
  - [kernel] timers: Lower base clock forwarding threshold (Phil Auld) [1877417 1833096]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.26.1.el8_2]
changelog:
  - [firmware] efi: don't reserve MOK config table memory region (Kairui Song) [1879988 1878584]
  - [security] integrity: Load certs from the EFI MOK config table (Lenny Szubowicz) [1877528 1868306]
  - [security] integrity: Move import of MokListRT certs to a separate routine (Lenny Szubowicz) [1877528 1868306]
  - [firmware] efi: Support for MOK variable config table (Lenny Szubowicz) [1877528 1868306]
  - [security] efi: Only print errors about failing to get certs if EFI vars are found (Lenny Szubowicz) [1877528 1804969]
  - [fs] ceph: fix inode number handling on arches with 32-bit ino_t (Jeff Layton) [1875787 1866018]
  - [fs] ceph: handle zero-length feature mask in session messages (Jeff Layton) [1875787 1866018]
  - [fs] ceph: fix endianness bug when handling MDS session feature bits (Jeff Layton) [1875787 1866018]
  - [netdrv] net/mlx5e: Fix missing cleanup of ethtool steering during rep rx cleanup (Alaa Hleihel) [1857777 1856660]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.27.1.el8_2]
changelog:
  - [powerpc] powerpc/pseries: Do not initiate shutdown when system is running on UPS (Diego Domingos) [1882243 1870477]
  - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859471 1859472] {CVE-2020-14331}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.28.1.el8_2]
changelog:
  - [net] Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888256 1888258] {CVE-2020-12351}
  - [net] Bluetooth: A2MP: Fix not initializing all members (Gopal Tiwari) [1888906 1888807] {CVE-2020-12352}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.11.1.el8_3]
changelog:
  - [scsi] scsi: core: Return BLK_STS_AGAIN for ALUA transitioning (Ewan Milne) [1900112 1867264]
  - [scsi] scsi: scsi_dh_alua: Set 'transitioning' state on Unit Attention (Ewan Milne) [1900112 1867264]
  - [scsi] scsi: scsi_dh_alua: Return BLK_STS_AGAIN for ALUA transitioning state (Ewan Milne) [1900112 1867264]
  - [block] scsi: block: Return status code in blk_mq_end_request() (Ewan Milne) [1900112 1867264]
  - [include] compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use (Ivan Vecera) [1900112 1867168]
  - [net] net: sctp: Rename fallthrough label to unhandled (Ivan Vecera) [1900112 1867168]
  - [idle] intel_idle: Customize IceLake server support (David Arcari) [1897183 1881620]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.12.1.el8_3]
changelog:
  - [net] SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() (Steve Dickson) [1912478 1884361]
  - [net] SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()") (Steve Dickson) [1912478 1884361]
  - [mm] x86/ioremap: Map EFI runtime services data as encrypted for SEV (Lenny Szubowicz) [1909243 1883134]
  - [kernel] sched/deadline: Unthrottle PI boosted threads while enqueuing (Daniel Bristot de Oliveira) [1913964 1869760]
  - [kernel] sched/deadline: Fix stale throttling on de-/boosted tasks (Daniel Bristot de Oliveira) [1913964 1869760]
  - [fs] NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation recall (Scott Mayhew) [1908313 1881550]
  - [fs] NFS: Fix interrupted slots by sending a solo SEQUENCE operation (Scott Mayhew) [1908312 1887577]
  - [net] netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal (Antoine Tenart) [1907576 1901026]
  - [powerpc] powerpc/powernv/opal-dump : Use IRQ_HANDLED instead of numbers in interrupt handler (Diego Domingos) [1907301 1891822]
  - [powerpc] powerpc/powernv/dump: Handle multiple writes to ack attribute (Diego Domingos) [1907301 1891822]
  - [powerpc] powerpc/powernv/dump: Fix race while processing OPAL dump (Diego Domingos) [1907301 1891822]
  - [powerpc] powerpc/opal_elog: Handle multiple writes to ack attribute (Diego Domingos) [1907301 1891822]
  - [powerpc] powerpc/powernv/elog: Fix race while processing OPAL error log event (Diego Domingos) [1907301 1891822]
  - [block] block: fix incorrect branching in blk_max_size_offset() (Mike Snitzer) [1905136 1903722]
  - [md] dm: fix IO splitting (Mike Snitzer) [1905136 1903722]
  - [block] block: fix get_max_io_size() (Mike Snitzer) [1905136 1903722]
  - [block] block: Improve physical block alignment of split bios (Mike Snitzer) [1905136 1903722]
  - [block] block: use gcd() to fix chunk_sectors limit stacking (Mike Snitzer) [1905136 1903722]
  - [netdrv] net/mlx5e: Add LAG warning if bond slave is not lag master (Alaa Hleihel) [1892344 1851709]
  - [netdrv] net/mlx5e: Add LAG warning for unsupported tx type (Alaa Hleihel) [1892344 1851709]
  - [netdrv] net/mlx5e: Return a valid errno if can't get lag device index (Alaa Hleihel) [1892344 1851709]
  - [net] openvswitch: handle DNAT tuple collision (Dumitru Ceara) [1892744 1877128]
  - [mm] mm/page_idle.c: skip offline pages (Chris von Recklinghausen) [1903019 1867490]
  - [include] mm/hotplug: invalid PFNs from pfn_to_online_page() (Waiman Long) [1903019 1878006]


author: Michal Ruprich <michalruprich@gmail.com> - 2.0-0.52.20160912git
changelog:
  - Resolves: #1711119 - netstat says "packetes" instead of "packets"
  - Resolves: #1670355 - Exit code on wrong parameter is zero for many net-tools binaries
  - Resolves: #1807989 - The output of `route -A inet6` does not display properly when the 'Use' column output is over 6 digits


author: William Poteat <wpoteat@redhat.com> 1.26.18-1
changelog:
  - 1842474: Update local and cache file during sync(); ENT-2433
    (jhnidek@redhat.com)
  - 1849572: prevent redundant remote syspurpose sync (pmoravec@redhat.com)


author: - Andy Walsh <awalsh@redhat.com> - 6.2.3.91-73
changelog:
  - Removed unused UDS bio statistics.
  - Resolves: rhbz#1827762
  - Removed support for old kernels.
  - Resolves: rhbz#1827762
  - Fixed Coverity errors.
  - Resolves: rhbz#1827763
  - Improved the error message when slab journal locks overflow.
  - Resolves: rhbz#1827761
  - Fixed a bug which could result in VDO issuing I/O while suspended.
  - Resolves: rhbz#1824789
  - Fixed a rare double-enqueue bug in the recovery journal.
  - Resolves: rhbz#1824802
  - Modified VDO to not allocate an index if the VDO device is started
    with deduplication disabled.
  - Resolves: rhbz#1755448
  - Nodified VDO to not log spurious journal lock warnings when cleaning up
    write requests which failed due to the VDO going read-only.
  - Resolves: rhbz#1840455


author: - Andy Walsh <awalsh@redhat.com> - 6.2.3.107-73
changelog:
  - Fixed a bug which can cause a soft lockup if users interrupt processes
    waiting on dm-setup commands.
  - Resolves: rhbz#1844651
  - Fixed a rare race which could cause a suspend of a VDO device to fail.
  - Resolves: rhbz#1847747


author: - Andy Walsh <awalsh@redhat.com> - 6.2.3.107-74
changelog:
  - Updated dependencies to prevent installing kernel-rt incorrectly.
  - Resolves: rhbz#1811923
  - Bumped requirement for new 4.18 kernel
  - Relates: rhbz#1812069


author: - Andy Walsh <awalsh@redhat.com> - 6.2.3.114-74
changelog:
  - Fixed an index bug which can cause vdo stop to hang on systems with many
    cores.
  - Resolves: rhbz#1791056
  - Fixed a bug where VDO would ignore errors from empty flush bios.
  - Resolves: rhbz#1858363


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-35
changelog:
  - 1825254 - CVE-2020-3898 cups: heap based buffer overflow in libcups's ppdFindOption() in ppd-mark.c


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-36
changelog:
  - 1838449 - ipp/socket backends connect to turned off device for eternity (contimeout is not applied)
  - 1689207 - Add failover backend
  - 1833516 - DirtyCleanInterval ignored if there are open client connections


author: Sumit Bose <sbose@redhat.com> - 0.16.3-19
changelog:
  - Realm join fails with error 'Failed to join domain: failed to lookup
    DC info ...'
    Resolves: rhbz#1859503
  - realm command to use option like dnshostname=fqdn
    Resolves: rhbz#1867912


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-15
changelog:
  - do not crash when HTTPS_PROXY and NO_PROXY are used together (#1873327)
  - libcurl: wrong connect-only connection (CVE-2020-8231)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-18
changelog:
  - http: send payload when (proxy) authentication is done (#1918692)
  - curl: Inferior OCSP verification (CVE-2020-8286)
  - libcurl: FTP wildcard stack overflow (CVE-2020-8285)
  - curl: trusting FTP PASV responses (CVE-2020-8284)


author: Javier Martinez Canillas <javierm@redhat.com> - 8.40-39
changelog:
  - grubby-bls: strip only /boot from paths
    Resolves: rhbz#1738238
  - Make grubby to also update GRUB_CMDLINE_LINUX in /etc/default/grub
    Resolves: rhbz#1152027
  - grubby-bls: fix corner case when a kernel param value contains a '='
    Resolves: rhbz#1787584
  - grubby-bls: update man page to match options in current wrapper script
    Resolves: rhbz#1812065
  - grubby-bls: always escape the delimiter character used in sed commands
    Related: rhbz#1787584
  - grubby-bls: add a --no-etc-grub-update option
    Related: rhbz#1152027


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-1
changelog:
  - Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
  - Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
  - Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
  - Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
  - Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
  - Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
  - Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
  - Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
  - Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
  - Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
  - Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
  - Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
  - Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
  - Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
  - Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
  - Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
  - Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-3
changelog:
  - Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
  - Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-4
changelog:
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
  - Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-5
changelog:
  - Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-6
changelog:
  - Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
  - Resolves: rhbz#1915395 - Memory leak in the simple access provider
  - Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-25
changelog:
  - kdump.conf: Specify /etc/kdump/{pre.d,post.d}interface
  - dracut-kdump.sh: Execute the binary and script filesin /etc/kdump/{pre.d,post.d}
  - kdumpctl: Check the update of the binary and script files in /etc/kdump/{pre.d,post.d}
  - dracut-module-setup.sh: Install files under /etc/kdump/{pre.d,post.d} into kdump initramfs


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-26
changelog:
  - Fix kdump failure when mount target specified by dracut_args
  - mkdumprd: Fix dracut error on multiple extra_modules


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-28
changelog:
  - mkdumprd: Fix nfs detection in to_mount
  - Always wrap up call to dracut get_persistent_dev function
  - man: improve description about /etc/kdump/{pre.d,post.d}interface


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-30
changelog:
  - x86_64: enable the kexec file load by default
  - Revert "kdump-lib: switch to the kexec_file_load() syscall on x86_64 by default"


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-31
changelog:
  - ppc64/kdump: use kexec_file_load when secureboot is enabled
  - kdump_pre: make notes more precise
  - dracut-kdump.sh: exit shell when machine reboot
  - kdump.conf: fix a grammar issue
  - kdumpctl: detect modification of scripts by its directory's timestamp
  - module-setup.sh: suppress false alarm
  - kexec-tools.spec: make the existence of pre.d and post.d mandatory


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-2.el8]
changelog:
  - man: ip.8: Add missing vrf subcommand description (Andrea Claudi) [1780010]
  - xfrm: not try to delete ipcomp states when using deleteall (Andrea Claudi) [1808634]
  - ip-xfrm: Fix help messages (Andrea Claudi) [1796045]
  - man: rdma.8: Add missing resource subcommand description (Andrea Claudi) [1786576]
  - man: rdma-statistic: Add filter description (Andrea Claudi) [1786565]
  - tc: implement support for action flags (Andrea Claudi) [1770671]
  - Update kernel headers (Andrea Claudi) [1770671]
  - Update kernel headers (Andrea Claudi) [1770671]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-3.el8]
changelog:
  - xfrm: also check for ipv6 state in xfrm_state_keep (Andrea Claudi) [1828033]
  - man: bridge.8: fix bridge link show description (Andrea Claudi) [1817571]
  - ip: fix ip route show json output for multipath nexthops (Andrea Claudi) [1738633]
  - ip link: xstats: fix TX IGMP reports string (Andrea Claudi) [1796041]
  - nstat: print useful error messages in abort() cases (Andrea Claudi) [1824896]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-4.el8]
changelog:
  - tc: f_flower: add options support for erspan (Andrea Claudi) [1830485]
  - tc: f_flower: add options support for vxlan (Andrea Claudi) [1830485]
  - tc: m_tunnel_key: add options support for erpsan (Andrea Claudi) [1830485]
  - tc: m_tunnel_key: add options support for vxlan (Andrea Claudi) [1830485]
  - iproute_lwtunnel: add options support for erspan metadata (Andrea Claudi) [1830485]
  - iproute_lwtunnel: add options support for vxlan metadata (Andrea Claudi) [1830485]
  - iproute_lwtunnel: add options support for geneve metadata (Andrea Claudi) [1830485]
  - Update kernel headers (Andrea Claudi) [1830485]
  - man: ip.8: add reference to mptcp man-page (Andrea Claudi) [1812207]
  - man: mptcp man page (Andrea Claudi) [1812207]
  - ss: allow dumping MPTCP subflow information (Andrea Claudi) [1812207]
  - Update kernel headers (Andrea Claudi) [1812207]
  - Update kernel headers (Andrea Claudi) [1812207]
  - add support for mptcp netlink interface (Andrea Claudi) [1812207]
  - Update kernel headers and import mptcp.h (Andrea Claudi) [1812207]
  - ip: xfrm: add espintcp encapsulation (Andrea Claudi) [1844045]
  - Update kernel headers and import udp.h (Andrea Claudi) [1844045]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-5.el8]
changelog:
  - man: tc-ct.8: Add manual page for ct tc action (Andrea Claudi) [1844637]
  - tc: flower: Add matching on conntrack info (Andrea Claudi) [1844637]
  - tc: Introduce tc ct action (Andrea Claudi) [1844637]
  - tc: add NLA_F_NESTED flag to all actions options nested block (Andrea Claudi) [1844637]
  - Import tc_act/tc_ct.h uapi file (Andrea Claudi) [1844637]
  - ss: allow dumping kTLS info (Andrea Claudi) [1812207]
  - devlink: Add health error recovery status monitoring (Andrea Claudi) [1821039]


author: Sahana Prasad <sahana@redhat.com> - 1.1.5-3
changelog:
  - Enables building on old kernels [sync fix in Fedora from omosnance].
  - This is required for covscans as they run on RHEL7 machines.


author: Chris Leech - 6.2.0.878-5.gitd791ce0
changelog:
  - 1849931, 1869438 go back to MD5 CHAP only by default
    new CHAP modes can cause issue with some targets,
    so SHA1/SHA256/SHA3-256 modes must be configured to enable now


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-10
changelog:
  - Fixed CVE-2020-13632 (#1845572)
  - Fixed CVE-2020-13631 (#1845474)
  - Fixed CVE-2020-13630 (#1845153)


author: Ales Matej <amatej@redhat.com> - 0.47.0-1
changelog:
  - Update to 0.47.0
  - Allow excluding packages with "excludepkgs" and globs
  - Make parsing of reldeps more strict (RhBug:1788107)
  - Add expanding solvable provides for dependency matching (RhBug:1534123)
  - DnfRepo: fix module_hotfixes keyfile priority level
  - Add custom exceptions to libdnf interface
  - Port to libmodulemd-2 API (RhBug:1693683)
  - Add prereq_ignoreinst & regular_requires properties for pkg (RhBug:1543449)
  - Reset active modules when no module enabled or default (RhBug:1767351)
  - Add comment option to transaction (RhBug:1773679)
  - Baseurl is not exclusive with mirrorlist/metalink (RhBug:1775184)
  - Add new function to reset all modules in C API (dnf_context_reset_all_modules)
  - Handle situation when an unprivileged user cannot create history database (RhBug:1634385)
  - Add query filter: latest by priority
  - Add setter for running kernel protection setting
  - Add DNF_NO_PROTECTED flag to allow empty list of protected packages
  - Config options: only first empty value clears existing (RhBug:1788154)
  - [conf] Set useful default colors when color is enabled
  - [context] Use installonly_limit from global config (RhBug:1256108)
  - [context] Add API to get/set "install_weak_deps"
  - [context] Adds support for includepkgs in repository configuration.
  - [context] Adds support for excludepkgs, exclude, includepkgs, and disable_excludes in main configuration.
  - [context] Added function dnf_transaction_set_dont_solve_goal
  - [context] Added functions dnf_context_get/set_config_file_path
  - [context] Respect "plugins" global conf value
  - [context] Add API to disable/enable plugins
  - [context] Create new repo instead of reusing old one (RhBug:1795004)
  - [context] Error when main config file can't be opened (RhBug:1794864)
  - [context] Add function function dnf_context_is_set_config_file_path
  - [context] Support repositories defined in main configuration file


author: Nicola Sella <nsella@redhat.com> - 0.48.0-1
changelog:
  - Update to 0.48.0
  - swdb: Catch only SQLite3 exceptions and simplify the messages
  - MergedTransaction list multiple comments (RhBug:1773679)
  - Modify CMake to pull *.po files from weblate
  - Optimize DependencyContainer creation from an existing queue
  - fix a memory leak in dnf_package_get_requires()
  - Fix memory leaks on g_build_filename()
  - Fix memory leak in dnf_context_setup()
  - Add `hy_goal_favor` and `hy_goal_disfavor`
  - Define a cleanup function for `DnfPackageSet`
  - dnf-repo: fix dnf_repo_get_public_keys double-free
  - Do not cache RPMDB
  - Use single-quotes around string literals used in SQL statements
  - SQLite3: Do not close the database if it wasn't opened (RhBug:1761976)
  - Don't create a new history DB connection for in-memory DB
  - transaction/Swdb: Use a single logger variable in constructor
  - utils: Add a safe version of pathExists()
  - swdb: Handle the case when pathExists() fails on e.g. permission
  - Repo: prepend "file://" if a local path is used as baseurl
  - Move urlEncode() to utils
  - utils: Add 'exclude' argument to urlEncode()
  - Encode package URL for downloading through librepo (RhBug:1817130)
  - Replace std::runtime_error with libdnf::RepoError
  - Fixes and error handling improvements of the File class
  - [context] Use ConfigRepo for gpgkey and baseurl (RhBug:1807864)
  - [context] support "priority" option in .repo config file (RhBug:1797265)


author: Nicola Sella <nsella@redhat.com> - 0.48.0-3
changelog:
  - Add log file level main config option (RhBug:1802074)
  - Accept '==' as an operator in reldeps (RhBug:1847946)


author: Jan Macku <jamacku@redhat.com> - 10.00.7-1
changelog:
  - Wait for scope link addresses as well as for scope global addresses
  - Remove deprecated option -m of pidof


author: Jan Macku <jamacku@redhat.com> - 10.00.8-1
changelog:
  - rwtab: Add support for chrony
  - ifup-eth: Switch to bc utility, which supports floating point computations.
  - Replace grep -EL with subshell since -L changed behaviour


author: Tomáš Mráz <tmraz@redhat.com> 1.1.1g-11.1
changelog:
  - Implemented new FIPS requirements in regards to KDF and DH selftests
  - Disallow certificates with explicit EC parameters


author: Andreas Schneider <asn@redhat.com> - 4.13.2-1
changelog:
  - resolves: #1878109 - Rebase Samba to version 4.13.2
  - resolves: #1872833 - Add samba-winexe subpackage
  - resolves: #1891688 - Fix CVE-2020-14323
  - resolves: #1892633 - Fix CVE-2020-14318
  - resolves: #1892639 - Fix CVE-2020-14383
  - resolves: #1879835 - Fix CVE-2020-1472
  - resolves: #1888990 - Update smb.conf manpages to describe how to apply
                         config changes.
  - resolves: #1869702 - Fix %U substitution for 'valid users' option
  - resolves: #1818038 - Improve FIPS compliance


author: Andreas Schneider <asn@redhat.com> - 4.13.2-2
changelog:
  - related: #1869702 - Fix spoolss crash
  - resolves: #1896736 - Fix name lookups of FreeIPA users
  - resolves: #1899113 - Fix DFS links


author: Andreas Schneider <asn@redhat.com> - 4.13.3-3
changelog:
  - resolves: #1924615 - Fix a memcache bug when cache is full
  - resolves: #1924571 - Ensure that libwbclient has been updated before
                         restarting services


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.4-1
changelog:
  - Update to version 0.9.4
    https://www.libssh.org/2020/04/09/libssh-0-9-4-and-libssh-0-8-9-security-release/
  - Fixed CVE-2019-14889 (#1781782)
  - Fixed CVE-2020-1730 (#1802422)
  - Create missing directories in the path provided for known_hosts files (#1733914)
  - Removed inclusion of OpenSSH server configuration file from
    libssh_server.config (#1821339)


author: Anderson Sasaki <ansasaki@redhat.com> - 0.9.4-2
changelog:
  - Do not return error when server properly closed the channel (#1849071)
  - Add a test for CVE-2019-14889
  - Do not parse configuration file in torture_knownhosts test


author: Michal Ruprich <michalruprich@gmail.com> - 14:1.9.1-1
changelog:
  - Resolves: #1806422 - rebase libpcap to version 1.9.1
  - Resolves: #1743650 - [RFE] enable inbox support for sniffing offloaded (RDMA) traffic with tcpdump
  - Resolves: #1785330 - Invalid IPv4 addresses are accepted without reporting even a warning
  - Resolves: #1792208 - Resource exhaustion while PHB header length validation


author: Tomáš Mráz <tmraz@redhat.com> 1.4.4-1
changelog:
  - Translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer
  - pam_pwquality: Abort the retry loop if user requests it
  - Allow setting retry, enforce_for_root, and local_users_only options
    in the pwquality.conf config file


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1919026 libpwquaily rpm requires cracklib to function but RPM missing requirement [updated]


author: Than Ngo <than@redhat.com> - 3.14.0-1
changelog:
  - Resolves: #1723863 - ep11 token: Enhanced Support
  - Resolves: #1780285 - ep11 token: Support for new IBM Z hardware z15
  - Resolves: #1780293 - rebase to 3.14.0
  - Resolves: #1800549 - key management tool: list keys function
   -Resolves: #1800555 - key management tool: random key generation function


author: Ales Matej <amatej@redhat.org> - 0.7.11-1
changelog:
  - Update to 0.7.11
  - selected bug fixes:
    * support arch<->noarch package changes when creating patch
      conflicts from the updateinfo data
    * also support other rpm database types
    * fixed solv_zchunk decoding error if large chunks are used
    * treat retracted pathes as irrelevant
    * made add_update_target work with multiversion installs
  - new features
    * support for SOLVER_BLACKLIST jobs that block the installation of matched
      packages unless they are directly selected by an SOLVER_INSTALL job
    * libsolv now also parses the patch status in the updateinfo parser
    * new solvable_matchessolvable() function
    * support conda constrains dependencies
    * new rpm_stat_database() function
    * new rpm_hash_database_state() function


author: Than Ngo <than@redhat.com> - 3.15.0-1
changelog:
  - Resolves: #1847433, rebase to 3.15.0 
  - Resolves: #1851105, PKCS #11 3.0 - baseline provider support
  - Resolves: #1851108, openCryptoki ep11 token: enhanced functionality
  - Resolves: #1851109, openCryptoki key management tool: key deletion function


author: Than Ngo <than@redhat.com> - 3.15.1-1
changelog:
  - Related: #1847433
    upstream fixes:
      - Free generated key in all error cases
      - CCA: Zeroize key buffer to avoid CCA 8/32 error
      - Do not delete the map-btree entry if destroying an object is not allowed
      - Remove now unused header timeb.h
      - TESTCASES: Use FIPS conforming keys for 3DES CBC-MAC test vectors
      - Fix buffer overrun in C_CopyObject
      - TPM: Fix double free in openssl_gen_key


author: Than Ngo <than@redhat.com> - 3.15.1-3
changelog:
  - Resolves: #1902022
     Fix compiling with c++
     Added error message handling for p11sak remove-key command


author: Kamil Dudka <kdudka@redhat.com> - 8.30-8
changelog:
  - df --local: recognize afs, auristorfs, and smb3 as remote fs (#1798030)
  - fix formatting of sha512sum(1) man page (#1688744)


author: Jan Macku <jamacku@redhat.com> - 10.00.10-1
changelog:
  - Allow updating rfkill switch status while in readonly root mode
  - service: Prevent variables from globbing
  - Allow updating mlocate.db while in readonly root mode


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-1
changelog:
  - Update Source to upstream version 0.8.4
    * This version includes the fixes for bz #1768894 & #1821214
    * Previous patches 0001-0009 are included in this version
  - Rename files
    * Previous patches 0010-0019 are now 0011-0020
  - Add 0001-libmultipath-assign-variable-to-make-gcc-happy.patch
  - Add 0002-libmutipath-don-t-close-fd-on-dm_lib_release.patch
  - Add 0003-libmultipath-allow-force-reload-with-no-active-paths.patch
    * make multipath and multipathd reload maps with no active paths
      (bz #1814858)
  - Add 0004-libmpathpersist-depend-on-libmultipath.patch
  - Add 0005-multipath-tools-Makefile-more-dependency-fixes-for-p.patch
  - Add 0006-multipath-tools-Makefile.inc-set-Wno-error-clobbered.patch
  - Add 0007-libmultipath-discovery.c-use-z-qualifier-for-size_t.patch
  - Add 0008-libmultipath-eliminate-more-signed-unsigned-comparis.patch
  - Add 0009-libmultipath-set_uint-fix-parsing-for-32bit.patch
  - Add 0010-multipath-tools-Makefile-add-install-dependency.patch
    * The above 10 patches have been submitted upstream
  - Resolves: bz #1768894, #1814858, #1821214


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-2
changelog:
  - Add 0021-libmultipath-remove-_blacklist_exceptions-functions.patch
  - Add 0022-libmultipath-fix-parser-issue-with-comments-in-strin.patch
  - Add 0023-libmultipath-invert-regexes-that-start-with-exclamat.patch
    * This commit also changes the default devnode blacklist to
      blacklist all devices except scsi, dasd, and nvme.
  - Resolves: bz #1828180


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-3
changelog:
  - Add 0024-libmultipath-make-dm_get_map-status-return-codes-sym.patch
  - Add 0025-multipathd-fix-check_path-errors-with-removed-map.patch
  - Add 0026-libmultipath-make-dm_flush_maps-only-return-0-on-suc.patch
  - Add 0027-multipathd-add-del-maps-multipathd-command.patch
  - Add 0028-multipath-make-flushing-maps-work-like-other-command.patch
  - Add 0029-multipath-delegate-flushing-maps-to-multipathd.patch
  - Add 0030-multipath-add-option-to-skip-multipathd-delegation.patch
    * The above 7 patches fix bz #1845875. Multipath now attempts to
      delegate device removal to multipathd, and multipathd handles
      external device removal better.
  - Add 0031-libmultipath-fix-sysfs-dev_loss_tmo-parsing.patch
    * Fixes bz #1852843
  - Add 0032-kpartx-read-devices-with-direct-IO.patch
    * Fixes bz #1814858
  - Add 0033-kpartx-handle-alternate-bsd-disklabel-location.patch
  - Add 0034-libmultipath-fix-checker-detection-for-nvme-devices.patch
    * fixes bz #1845915
  - Add 0035-Makefile.inc-trim-extra-information-from-systemd-ver.patch
  - Add 0036-kpartx-fix-Wsign-compare-error.patch
  - Resolves: bz #1814858, #1845875, #1845915, #1852843


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-4
changelog:
  - Add 0037-libmultipath-count-pending-paths-as-active-on-loads.patch
    * make udev treat the device as having paths, so it will run kpartx
    * Fixes bz #1846866
  - Resolves: bz #1846866


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-5
changelog:
  - Add 0038-multipath-deal-with-failures-flushing-maps.patch
    * Don't print "fail" if multipath needs to failback to removing
      a device itself.
    * Fixes bz #1845875
  - Modify multipath_conf_syntax CI test
    * It started failing because "multpath -F" can now start multipathd
      via the socket, and the test expected multipathd to not be running
  - Resolves: bz #1845875


author: Florian Festi <ffesti@redhat.com> - 4.14.3-5
changelog:
  - Don't error out when replacing an invalid signature (#1874062)
  - Raise an expection when erasing a package fails in Python (#1872623)
  - Fix builds on NFS filesystems (#1840728)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-12
changelog:
  - Bump up the limit of signature header to 64MB (#1918777)
  - Add fapolicyd plugin (#1923167)
  - Unblock signals in forked scriptlets (#1913765)
  - Fix ambiguous diagnostics output on file triggers (#1883338)
  - Ensure ELF files get stripped when debuginfo is disabled (#1634084)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-13
changelog:
  - Fix minor issues found by COVSCAN in fapolicyd plugin
  - Actually honor libarchive bcond at configure time (#1902887)


author: Bhupesh Sharma <bhsharma@redhat.com> - 1.1.8-1
changelog:
  - Rebase to latest github version Snappy-1.1.8
  - Also change the URL to reflect to the updated github location.


author: Steve Dickson <steved@redhat.com> 2.3.3-38
changelog:
  - exports man page: warn about subdirectory exports (bz 1652437)
  - Don't modify /etc/group on upgrades (bz 1856881)
  - nfs-iostat: divide by zero with fresh mount (bz 1861823)
  - nfsiostat: Drop autofs entries before calling compare_iostats() (bz 1859130)
  - nfsdclddb: clddb-tool was recently renamed to nfsdclddb (bz 1893599)


author: Steve Dickson <steved@redhat.com> 2.3.3-39
changelog:
  - systemd: Ingnore export failures in nfs-server.serivce unit (bz 1894873)
  - exports.man: Remove some outdated verbiage (bz 1769688)


author: - Andy Walsh <awalsh@redhat.com> - 6.2.3.91-14
changelog:
  - Removed unused UDS bio statistics
  - Resolves: rhbz#1827762
  - Added a summary mode to vdoaudit and made this mode the default. Also
    added histograms.
  - Resolves: rhbz#1687996
  - Modified vdostats to accept short (one character) options.
  - Resolves: rhbz#1787472
  - Modified vdo script to use lsblk to identify LVM created VDO volumes.
  - Resolves: rhbz#1825344
  - Modified vdo script to avoid unnecessary config file updates when
    removing VDO volumes.
  - Resolves: rhbz#1804440
  - Fixed a cast which caused a Coverity complaint.
  - Resolves: rhbz#1827763
  - Fixed a cut&paste error in the vdosetuuid man page.
  - Resolves: rhbz#1643297
  - Fixed documentation of logical threads.
  - Resolves: rhbz#1827764
  - Began creation of a package of binaries for investigating VDO issues.
  - Resolves: rhbz#1643297
  - Updated VDO to use udev/systemd rules for startup.
  - Resolves: rhbz#1837759
  - Modified VDO volume creation to use libblkid instead of pvcreate to
    determine whether the underlying storage is already in use. Moved
    these checks from the vdo script into the vdoformat utility.
  - Resolves: rhbz#1771698
  - Modified the vdo status command to treat a running vdo volume is
    authoratative over the config file.
  - Resolves: rhbz#1790983
  - Added a new utility, vdoregenerategeometry, which can be used to
    recover a VDO whose initial blocks have been overwritten
    accidentaly.
  - Resolves: rhbz#1773421


author: - Andy Walsh <awalsh@redhat.com> - 6.2.3.100-14
changelog:
  - Modified vdoformat to display the minimum required physical size for the
    specified parameters if the format fails due to insufficient space.
  - Resolves: rhbz#1683945
  - Modified the vdo status command to report values from running devices
    rather than the config file when the devices are running.
  - Resolves: rhbz#1790983
  - Actually made the new summary mode of vdoaudit the default.
  - Resolves: rhbz#1687996
  - Fixed a bug in vdodumpmetadata and vdodumpblockmap which could result in
    the wrong block(s) being dumped.
  - Resolves: rhbz#1643297


author: - Andy Walsh <awalsh@redhat.com> - 6.2.3.114-14
changelog:
  - Fixed an index bug which can cause vdo stop to hang on systems with many
    cores.
  - Resolves: rhbz#1791056
  - Fixed typos in example monitoring scripts.
  - Resolves: rhbz#1861518


author: Christine Caulfield <ccaulfie@redhat.com> - 1.0.3-11
changelog:
  Correctly set socket directory permissions when
    qb_ipcs_connection_auth_set() is called
    Resolves: rhbz#1836146


author: Marek Polacek <polacek@redhat.com> 8.4.1-1
changelog:
  - update from GCC 8.4 release (#1868446)
  - remove symlinks to 32-bit versions of these static libraries: libasan.a,
    libitm.a, libquadmath.a, libubsan.a, libgfortran.a (#1779597)


author: Phil Sutter <psutter@redhat.com> [0.9.3-12.el8.1]
changelog:
  - src: Set NFT_SET_CONCAT flag for sets with concatenated ranges (Phil Sutter) [1854532]
  - include: Resync nf_tables.h cache copy (Phil Sutter) [1854532]


author: Vit Mojzis <vmojzis@redhat.com> - 4.3.0-1
changelog:
  - SETools 4.3.0 release (#1820079)
  - Revised sediff method for TE rules. This drastically reduced memory and run time.
  - Added infiniband context support to seinfo, sediff, and apol.
  - Added apol configuration for location of Qt assistant.
  - Fixed sediff issue where properties header would display when not requested.
  - Fixed sediff issue with type_transition file name comparison.
  - Fixed permission map socket sendto information flow direction.
  - Added methods to TypeAttribute class to make it a complete Python collection.
  - Genfscon now will look up classes rather than using fixed values which
    were dropped from libsepol.
  - setools requires -console, -console-analyses and -gui packages (#1820078)


author: - Andy Walsh <awalsh@redhat.com> - 6.2.4.14-14
changelog:
  - Added --pending option to the vdo status command to indicate
    configuration options which have been modified but will not take
    effect until the next device start.
  - Resolves: rhbz#1838314


author: Ales Matej <amatej@redhat.com> - 3.4.0-1
changelog:
  - Update to 3.4.0
  - Fix: do not download metadata in remove command
  - Add reinstall command
  - Add "--setopt=tsflags=test" support
  - Add "--setopt=reposdir=<path>" and "--setopt=varsdir=<path1>,<path2>,..." support
  - Add "--config=<path_to_config_file>" support
  - Add "--disableplugin", "--enableplugin" support (RhBug:1781126)
  - Add "--noplugins" support
  - Add "--setopt=cachedir=<path_to_cache_directory>" support
  - Add "--installroot=<path_to_installroot_directory>" support
  - Add "--refresh" support
  - Support "install_weak_deps" conf option and "--setopt=install_weak_deps=0/1"
  - Respect reposdir from conf file
  - Respect "metadata_expire" conf file opton (RhBug:1771147)
  - [repolist] Print padding spaces only if output is terminal


author: Jerry Snitselaar <jsnitsel@redhat.com> - 4.1.1-2
changelog:
  - Fix ESYS_TR hierarchy transition.
  - Refactor fix_esys_hierarchies to return actual TSS2_RC return code.
  - tpm2_alg_util.c: fix a bug where the string rsa3072 wasn't being parsed.
  - tpm2_create.c: Fix an issue where userwithauth attr cleared if policy specified.
  - tpm2_hierarchycontrol: Fix bug where hierarchycontrol operation failed silently.
  - tpm2_nvdefine.c: Fix error reporting message.
  - tpm2_policyor: Fix silent failure for invalid/unspecified policy digest alg.
  resolves: rhbz#1854774


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-34.2
changelog:
  - kdump-lib.sh: Remove is_atomic
  - Refactor kernel image and initrd detection code
  - early-kdump: Use consistent symbol link for kernel and initramfs
  - kdump-lib: strip grub device from kdump_bootdir
  - kdumpctl: fix driver change detection on latest Fedora


author: Richard Hughes <richard@hughsie.com> 1.4.2-1
changelog:
  - New upstream release
  - Backport a patch to fix the synaptics fingerprint reader update.
  - Resolves: #1775277


author: Nicola Sella <nsella@redhat.com> - 3.4.0-3
changelog:
  - Patch: Add support for setting a platform module ID
  - Rename "update" command to "upgrade", "update" remain as compatibility alias


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-9
changelog:
  - do not mistake a regular user process for a namespaced one (#1788696)
  - add HOME_MODE support in login.defs (#1777718)


author: Jerry Snitselaar <jsnitsel@redhat.com> - 2.3.2-3
changelog:
  - Add tss user if doesn't exist.
  - Update exported symbols map for libtss2-mu
  - esys: Check object handle node before calling compute_session_value
  - esys: fix resource name calculation
  - esys: fix Esys_StartAuthSession called with optional params
  - esys: fix keysize of ECC curve TPM2_ECC_NISTP224
  - esys: fixup compute_encrypted_salt error handling
  - esys: use memcmp in byte array comparison
  - esys: zero out ctx->salt after startAuthSession_finish
  - mu: Remove use of VLAs for Marshalling TPML types
  - return proper error code on memory allocation failure
  - sys: match counter variable type for cmdAuthsArray->count
  - tcti-device: getPollHandles should allow num_handles query
  - tctildr: fix segmentation fault if name_conf is too big
  resolves: rhbz#1879071 rhbz#1855180


author: Jan Rybar <jrybar@redhat.com> - 4.93.2-1
changelog:
  - Rebase to lsof-4.93.2
  - Upstream moved to GitHub (original unreachable) and tarball structure changed
  - Manpage patch needed to reflect the tarball changes
  - Resolves: rhbz#1778228


author: Nicola Sella <nsella@redhat.com> - 0.7.16-1
changelog:
  - Update to 0.7.16
  - selected bug fixes:
    * make testcase_mangle_repo_names deal correctly with freed repos
    [bnc#1177238]
    * fix add_complex_recommends() selecting conflicted packages in
      rare cases leading to crashes
    * improve choicerule generation so that package updates are
      prefered in more cases
    * fix deduceq2addedmap clearing bits outside of the map
    * conda: feature depriorization and fix startswith implementation
    * Fix solvable swapping messing up idarrays
    * fix ruleinfo of complex dependencies returning the wrong origin
    * fix solv_zchunk decoding error if large chunks are used
      [bnc#1159314]
  - new features
    * new testcase_mangle_repo_names() function
    * new solv_fmemopen() function
    * Enable zstd compression support for sle15 and sle15-sp2
    * Support blacklisted packages in solver_findproblemrule()
      [bnc#1172135]
    * Support rules with multiple negative literals in choice rule
      generation
    * build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
      multiple rpm database backends
    * added two new function to make libzypp independent of the rpm
      database format
    * support conda constrains dependencies


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-1
changelog:
  - Rebase to upstream release 3.2.1
  - Resolves: rhbz#1873581
  - Resolves: rhbz#1778939
  - Removed dependencies on python-asn1crypto, python-idna


author: Christian Heimes <cheimes@redhat.com> - 3.2.1-4
changelog:
  - CVE-2020-36242: Fixed a bug where certain sequences of update() calls
    when symmetrically encrypting very large payloads (>2GB) could result
    in an integer overflow, leading to buffer overflows.
  - Resolves: rhbz#1926528


author: Javier Martinez Canillas <javierm@redhat.com> - 0.3.0-10
changelog:
  - Add mokutil code to consume data from /sys/firmware/efi/mok-variables/
    as well as attempting to consume numbered mok variables from efivarfs
    when mok-variables aren't present (pjones)
    Resolves: rhbz#1877343


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-91
changelog:
  - Fix tps-rpmtest failing due /boot/grub2/grubenv attributes mismatch
    Resolves: rhbz#1813959
  - Include in EFI build the modules needed for LUKS support
    Resolves: rhbz#1873725
  - Fix keyboards that report IBM PC AT scan codes
    Resolves: rhbz#1897587


author: Jan Hlavac <jhlavac@redhat.com> - 2.02-92
changelog:
  - grub2-install: disable support for EFI platforms
    Resolves: rhbz#1737444
  - Include a few more modules to EFI build needed for LUKS support (javierm)
    Related: rhbz#1873725


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-93
changelog:
  - add keylayouts and at_keyboard modules to UEFI Grub2 (rmetrich)
    Related: rhbz#1897587
  - at_keyboard: use set 1 when keyboard is in Translate mode (rmetrich)
    Resolves: rhbz#1897587
  - add GRUB enhanced debugging features (rmetrich)
    Resolves: rhbz#1776249
  - ieee1275: Avoiding many unecessary open/close (diegodo)
    Resolves: rhbz#1862632
  - ieee1275: device mapper and fibre channel discovery support (diegodo)
    Resolves: rhbz#1873724


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-96
changelog:
  - Fix "Add 'at_keyboard_fallback_set' var to force the set manually"
    Related: rhbz#1897587
  - Fix a boot failure due patch "ieee1275: claim up to 256MB memory"
    Resolves: rhbz#1929111


author: Javier Martinez Canillas <javierm@redhat.com> - 2.02-99
changelog:
  - Fix bug of grub2-install not checking for the SBAT option
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Michal Hlavinka <mhlavink@redhat.com> - 3.7.0-1
changelog:
  - pciutils updated to 3.7.0, add support for basic DVSEC and CXL DVSEC (#1856436)
  - add support for RCEC Associated Endpoint (#1856440)


author: Daiki Ueno <dueno@redhat.com> - 3.4.1-5
changelog:
  - Backport powerpc64 optimization patches from upstream (#1855228)
    Patch from Christopher M. Riedl.


author: Nikola Forró <nforro@redhat.com> - 2.7.6.1-18
changelog:
  - schedule interrupted cache update for the next boot, instead of blocking
    system reboot/shutdown
    resolves #1874010


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-9.1
changelog:
  - Resolves: rhbz#1949170 - pam_sss_gss.so doesn't work with large kerberos tickets [rhel-8.4.0.z]
  - Resolves: rhbz#1945656 - No gpo found and ad_gpo_implicit_deny set to True still permits user login [rhel-8.4.0.z]
  - Resolves: rhbz#1945655 - SSSD not detecting subdomain from AD forest (RHEL 8.3) [rhel-8.4.0.z]
  - Resolves: rhbz#1945654 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7 [rhel-8.4.0.z]
  - Resolves: rhbz#1942438 - Wrong default debug level of sssd tools [rhel-8.4.0.z]


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-4
changelog:
  - pidof: new option to show kernel worker threads
  - pidof: empty input causes to show kernel worker threads
  - Resolves: rhbz#1860486
  - Resolves: rhbz#1894526
  - Related: rhbz#1803640
  -


author: Jan Rybar <jrybar@redhat.com> - 3.3.15-5
changelog:
  - version bump due to unspotted malformed backport patch
  - Resolves: rhbz#1860486
  - Resolves: rhbz#1894526
  - Related: rhbz#1803640


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.3.1.el8_4]
changelog:
  - Revert "uio: use request_threaded_irq instead" (Vitaly Kuznetsov) [1952952 1946644]
  - drm/ast: Set format registers in primary plane's update (Lyude Paul) [1952900 1923857]
  - net/sched: act_ct: clear post_ct if doing ct_clear (Marcelo Ricardo Leitner) [1956458 1941889]
  - md/raid1: properly indicate failure when ending a failed write request (Nigel Croxon) [1955188 1954588]
  - nitro_enclaves: Fix stale file descriptors on failed usercopy (Vitaly Kuznetsov) [1956379 1953717]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.5.1.el8_4]
changelog:
  - gfs2: report "already frozen/thawed" errors (Bob Peterson) [1961849 1932236]
  - gfs2: move freeze glock outside the make_fs_rw and _ro functions (Bob Peterson) [1961849 1932236]
  - gfs2: Add common helper for holding and releasing the freeze glock (Bob Peterson) [1961849 1932236]
  - gfs2: in signal_our_withdraw wait for unfreeze of _this_ fs only (Bob Peterson) [1961849 1932236]
  - gfs2: Don't freeze the file system during unmount (Bob Peterson) [1961849 1932236]
  - gfs2: Fix regression in freeze_go_sync (Bob Peterson) [1961849 1932236]
  - gfs2: The freeze glock should never be frozen (Bob Peterson) [1961849 1932236]
  - gfs2: When freezing gfs2, use GL_EXACT and not GL_NOCACHE (Bob Peterson) [1961849 1932236]
  - gfs2: read-only mounts should grab the sd_freeze_gl glock (Bob Peterson) [1961849 1932236]
  - gfs2: freeze should work on read-only mounts (Bob Peterson) [1961849 1932236]
  - gfs2: Abort gfs2_freeze if io error is seen (Bob Peterson) [1961849 1932236]
  - CI: Disable result checking for realtime check (Veronika Kabatova)
  - CI: Explicitly disable result checking for private CI (Veronika Kabatova)
  - CI: Rename variable (Veronika Kabatova)
  - CI: Update builder containers (Veronika Kabatova)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.6.1.el8_4]
changelog:
  - openvswitch: fix stack OOB read while fragmenting IPv4 packets (Davide Caratti) [1963940 1924608]
  - net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets (Davide Caratti) [1963940 1924608]
  - net/sched: act_ct: fix wild memory access when clearing fragments (Davide Caratti) [1963940 1924608]
  - net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT (Ivan Vecera)
  - redhat/configs: Add CONFIG_SYSTEM_REVOCATION_KEYS and CONFIG_SYSTEM_REVOCATION_LIST (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: add 'x509_revocation_list' to gitignore (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - integrity: Load mokx variables into the blacklist keyring (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: Add ability to preload revocation certs (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: Move load_system_certificate_list to a common function (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: Add EFI_CERT_X509_GUID support for dbx entries (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - net/sched: cls_api: increase max_reclassify_loop (Davide Caratti) [1965148 1955136]
  - dm writecache: fix performance degradation in ssd mode (Mike Snitzer) [1962241 1961859]
  - scsi: fnic: Use scsi_host_busy_iter() to traverse commands (Ewan D. Milne) [1961705 1949250]
  - scsi: fnic: Kill 'exclude_id' argument to fnic_cleanup_io() (Ewan D. Milne) [1961705 1949250]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.7.1.el8_4]
changelog:
  - net: zero-initialize tc skb extension on allocation (Ivan Vecera) [1965457 1946986]
  - net/sched: cls_flower: fix only mask bit check in the validate_ct_state (Ivan Vecera) [1965457 1946986]
  - net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb (Ivan Vecera) [1965457 1946986]
  - net/sched: act_api: fix miss set post_ct for ovs after do conntrack in act_ct (Ivan Vecera) [1965457 1946986]
  - net/sched: cls_flower: validate ct_state for invalid and reply flags (Ivan Vecera) [1965457 1946986]
  - flow_dissector: fix TTL and TOS dissection on IPv4 fragments (Paolo Abeni) [1963952 1950288]
  - Revert "sctp: Fix SHUTDOWN CTSN Ack in the peer restart case" (Xin Long) [1965632 1953839]
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_b (Xin Long) [1965632 1953839]
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_a (Xin Long) [1965632 1953839]
  - Bluetooth: verify AMP hci_chan before amp_destroy (Gopal Tiwari) [1962544 1962546] {CVE-2021-33034}
  - x86/kvm: Unify kvm_pv_guest_cpu_reboot() with kvm_guest_cpu_offline() (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Disable all PV features on crash (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Disable kvmclock on all CPUs on shutdown (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Teardown PV features on boot CPU as well (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Fix pr_info() for async PF setup/teardown (Lenny Szubowicz) [1964930 1934273]
  - net/sched: act_ct: Fix ct template allocation for zone 0 (Marcelo Ricardo Leitner) [1965150 1881824]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.8.1.el8_4]
changelog:
  - iavf: amend removal of MODULE_VERSION (Stefan Assmann) [1969925 1955738]
  - ixgbe: Amend commit acf03026ec5a to include a version string in module info. (Ken Cox) [1969922 1955759]
  - i40e: amend removal of MODULE_VERSION (Stefan Assmann) [1969923 1955736]
  - redhat/configs: Add CONFIG_PINCTRL_EMMITSBURG (David Arcari) [1963984 1959506]
  - redhat/configs: Remove CONFIG_EMMITSBURG (David Arcari) [1963984 1959506]
  - netlink: add tracepoint at NL_SET_ERR_MSG (Marcelo Ricardo Leitner) [1972938 1956983]
  - Revert "[netdrv] net/intel: remove driver versions from Intel drivers" (Jonathan Toppins) [1969917 1955745]
  - Amends commit ea6244cc248b to include a version string in module info. (Ken Cox) [1969915 1955726]
  - Revert "[netdrv] net/broadcom: Clean broadcom code from driver versions" (Jonathan Toppins) [1969914 1955721]
  - ena: revert removal of MODULE_VERSION from ena (Petr Oros) [1969913 1955712]
  - fm10k: amend removal of MODULE_VERSION (Vladis Dronov) [1969910 1955730]
  - net/sched: act_ct: Offload connections with commit action (Marcelo Ricardo Leitner) [1968679 1965817]
  - netfilter: flowtable: Remove redundant hw refresh bit (Marcelo Ricardo Leitner) [1968679 1965817]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.9.1.el8_4]
changelog:
  - ixgbevf: Amend commit acf03026ec5a to include a version in module info. (Ken Cox) [1969911 1955764]
  - CI: Merge configuration (Veronika Kabatova)
  - igc: amend removal of MODULE_VERSION (Corinna Vinschen) [1969921 1955755]
  - igb: amend removal of MODULE_VERSION (Corinna Vinschen) [1969919 1955748]
  - locking/qrwlock: Fix ordering in queued_write_lock_slowpath() (Waiman Long) [1964419 1950110]
  - scsi: qedf: Do not put host in qedf_vport_create() unconditionally (Nilesh Javali) [1974968 1899384]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.10.1.el8_4]
changelog:
  - igbvf: amend removal of MODULE_VERSION (Corinna Vinschen) [1969920 1955752]
  - bluetooth: eliminate the potential race condition when removing the HCI controller (Gopal Tiwari) [1971464 1971488] {CVE-2021-32399}
  - scsi: ibmvfc: Free channel_setup_buf during device tear down (Steve Best) [1964697 1938102]
  - i40e: Fix parameters in aq_get_phy_register() (Stefan Assmann) [1967099 1907852]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.11.1.el8_4]
changelog:
  - SUNRPC: Handle major timeout in xprt_adjust_timeout() (Scott Mayhew) [1980613 1979070]
  - net/mlx5e: Disable TLS device offload in kdump mode (Alaa Hleihel) [1969909 1946647]
  - net/mlx5e: Disable TX MPWQE in kdump mode (Alaa Hleihel) [1969909 1946647]
  - drm/i915: Add an encoder hook to sanitize its state during init/resume (Imre Deak) [1981250 1961122]
  - netfilter: x_tables: fix compat match/target pad out-of-bound write (Florian Westphal) [1980500 1980501] {CVE-2021-22555}
  - Bluetooth: btusb: Fix the autosuspend enable and disable (Gopal Tiwari) [1972564 1927375]
  - cifs: handle empty list of targets in cifs_reconnect() (Ronnie Sahlberg) [1973637 1952263]
  - tick/nohz: Update idle_exittime on actual idle exit (Phil Auld) [1978710 1962632]
  - tick/nohz: Remove superflous check for CONFIG_VIRT_CPU_ACCOUNTING_NATIVE (Phil Auld) [1978710 1962632]
  - tick/nohz: Conditionally restart tick on idle exit (Phil Auld) [1978710 1962632]
  - can: bcm: delay release of struct bcm_op after synchronize_rcu() (Hangbin Liu) [1975058 1975059]
  - redhat/configs: Re-enable dptf_power module (Prarit Bhargava) [1968381 1962349]
  - KVM: do not allow mapping valid but non-reference-counted pages (Jon Maloy) [1975514 1975515] {CVE-2021-22543}
  - seq_file: Disallow extremely large seq buffer allocations (Ian Kent) [1975181 1975182] {CVE-2021-33909}


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.12.1.el8_4]
changelog:
  - Revert "nvme-pci: remove last_sq_tail" (Gopal Tiwari) [1965415 1921591]
  - tc-testing: add test for ct DNAT tuple collision (Marcelo Ricardo Leitner) [1982494 1964578]
  - tc-testing: add support for sending various scapy packets (Marcelo Ricardo Leitner) [1982494 1964578]
  - tc-testing: fix list handling (Marcelo Ricardo Leitner) [1982494 1964578]
  - net/sched: act_ct: handle DNAT tuple collision (Marcelo Ricardo Leitner) [1982494 1964578]
  - mm/memcg: Relocate tcpmem to below memory in struct mem_cgroup (Waiman Long) [1980314 1959772]
  - mm/memcg: optimize user context object stock access (Waiman Long) [1980314 1959772]
  - mm/memcg: improve refill_obj_stock() performance (Waiman Long) [1980314 1959772]
  - mm/memcg: cache vmstat data in percpu memcg_stock_pcp (Waiman Long) [1980314 1959772]
  - mm/memcg: move mod_objcg_state() to memcontrol.c (Waiman Long) [1980314 1959772]
  - mm: memcontrol: use obj_cgroup APIs to charge kmem pages (Waiman Long) [1980314 1959772]
  - mm: memcontrol: change ug->dummy_page only if memcg changed (Waiman Long) [1980314 1959772]
  - mm: memcontrol: directly access page->memcg_data in mm/page_alloc.c (Waiman Long) [1980314 1959772]
  - mm: memcontrol: introduce obj_cgroup_{un}charge_pages (Waiman Long) [1980314 1959772]
  - mm: memcontrol: slab: fix obtain a reference to a freeing memcg (Waiman Long) [1980314 1959772]
  - mm: move lruvec stats update functions to vmstat.h (Waiman Long) [1980314 1959772]
  - mm: memcg/slab: rename *_lruvec_slab_state to *_lruvec_kmem_state (Waiman Long) [1980314 1959772]
  - mm: Convert page kmemcg type to a page memcg flag (Waiman Long) [1980314 1959772]
  - mm: Introduce page memcg flags (Waiman Long) [1980314 1959772]
  - mm: memcontrol/slab: Use helpers to access slab page's memcg_data (Waiman Long) [1980314 1959772]
  - mm: memcontrol: Use helpers to read page's memcg data (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: extract check_[new|free]_page_bad() common part to page_bad_reason() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: rename free_pages_check() to check_free_page() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: rename free_pages_check_bad() to check_free_page_bad() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: bad_flags is not necessary for bad_page() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: bad_[reason|flags] is not necessary when PageHWPoison (Waiman Long) [1980314 1959772]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-9.2
changelog:
  - Resolves: rhbz#1985456 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8.4.0.z]


author: Andreas Schneider <asn@redhat.com> - 4.13.3-4
changelog:
  - resolves: #1964314 - Fix ldconfig warning about libsmbldap.so.2
  - resolves: #1964398 - Fix smbd trying to delete files with wrong permissions
  - resolves: #1969831 - Fix memory leak in RPC server


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-7
changelog:
  - RHEL 8.4 ERRATUM
  - CVE-2021-3156
  Resolves: rhbz#1917734
  - CVE-2021-23239 sudo: possible directory existence test due to race condition in sudoedit
  Resolves: rhzb#1916434
  - CVE-2021-23240 sudo: symbolic link attack in SELinux-enabled sudoedit
  Resolves: rhbz#1917038
  - updated upstream url
  Resolves: rhbz#1923825


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-32
changelog:
  - Security fix for CVE-2020-26116: Reject control chars in HTTP method in http.client
  Resolves: rhbz#1883257


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-33
changelog:
  - Add support for upstream architecture names
  https://fedoraproject.org/wiki/Changes/Python_Upstream_Architecture_Names
  Resolves: rhbz#1868003


author: Charalampos Stratakis <cstratak@redhat.com> - 3.6.8-34
changelog:
  - Security fix for CVE-2020-27619: eval() call on content received via HTTP in the CJK codec tests
  Resolves: rhbz#1890237


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-5
changelog:
  - Revert "genhomedircon: check usepasswd" (rhbz#1871786)
  - semanage.conf - improve usepasswd=False explanation (rhbz#1871786)
  - semanage.conf - expand list of ignoredirs (rhbz#1871786)


author: Richard Hughes <richard@hughsie.com> 1.5.4-1
changelog:
  - Rebase package to include support for latest OEM hardware and to
    support deploying UEFI SecureBoot dbx updates.
  - Resolves: #1870811


author: Richard Hughes <richard@hughsie.com> 1.5.5-2
changelog:
  - Do not invalidate all remote timestamps during package install to fix rpm -V.
  - Backport some important high priority fixes from upstream.
  - Resolves: #1926382


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.13.1.el8_4]
changelog:
  - xfrm: Fix wraparound in xfrm_policy_addr_delta() (Sabrina Dubroca) [1981840 1951965]
  - VMCI: Release resource if the work is already queued (Cathy Avery) [1982042 1978518]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.14.1.el8_4]
changelog:
  - tick/nohz: Kick only _queued_ task whose tick dependency is updated (Waiman Long) [1981336 1922901]
  - tick/nohz: Change signal tick dependency to wake up CPUs of member tasks (Waiman Long) [1981336 1922901]
  - tick/nohz: Only wake up a single target cpu when kicking a task (Waiman Long) [1981336 1922901]
  - tick/nohz: Narrow down noise while setting current task's tick dependency (Waiman Long) [1981336 1922901]
  - mlx5: net: zero-initialize tc skb extension on allocation (Jan Stancek) [1982220 1965418]
  - scsi: qedf: Update the max_id value in host structure (Nilesh Javali) [1989097 1954876]
  - scsi: qla2xxx: Reserve extra IRQ vectors (Nilesh Javali) [1986156 1964834]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.15.1.el8_4]
changelog:
  - sched: Fix data-race in wakeup (Phil Auld) [1987296 1937103]
  - mm/page_alloc: bail out on fatal signal during reclaim/compaction retry attempt (Aaron Tomlin) [1984085 1919765]
  - sunrpc: Avoid a KASAN slab-out-of-bounds bug in xdr_set_page_base() (Benjamin Coddington) [1990404 1969751]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.16.1.el8_4]
changelog:
  - kernfs: dont call d_splice_alias() under kernfs node lock (Ian Kent) [1994879 1939133]
  - kernfs: use i_lock to protect concurrent inode updates (Ian Kent) [1994879 1939133]
  - kernfs: switch kernfs to use an rwsem (Ian Kent) [1994879 1939133]
  - kernfs: use VFS negative dentry caching (Ian Kent) [1994879 1939133]
  - kernfs: add a revision to identify directory node changes (Ian Kent) [1994879 1939133]
  - kernfs: move revalidate to be near lookup (Ian Kent) [1994879 1939133]
  - scsi: lpfc: Fix dropped FLOGI during pt2pt discovery recovery (Jan Stancek) [1948608 1923762]
  - net: sched: act_mirred: Reset ct info when mirror/redirect skb (C. Erastus Toe) [1992226 1980532]
  - usb: ehci: Prevent missed ehci interrupts with edge-triggered MSI (Torez Smith) [1993894 1972139]
  - usb: ehci: do not initialise static variables (Torez Smith) [1993894 1972139]
  - usb: host: move EH SINGLE_STEP_SET_FEATURE implementation to core (Torez Smith) [1993894 1972139]
  - USB: ehci: drop workaround for forced irq threading (Torez Smith) [1993894 1972139]
  - usb: ehci: add spurious flag to disable overcurrent checking (Torez Smith) [1993894 1972139]
  - NFS: Only change the cookie verifier if the directory page cache is empty (Benjamin Coddington) [1993895 1982825]
  - NFS: Fix handling of cookie verifier in uncached_readdir() (Benjamin Coddington) [1993895 1982825]
  - nfs: Subsequent READDIR calls should carry non-zero cookieverifier (Benjamin Coddington) [1993895 1982825]
  - KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow (Jon Maloy) [1988225 1988226] {CVE-2021-37576}


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.17.1.el8_4]
changelog:
  - ucounts: Move max_time_namespace according to ucount_type (Alex Gladkov) [1998002 1982954]
  - netfilter: conntrack: remove offload_pickup sysctl again (Florian Westphal) [1995555 1987101]
  - netfilter: flowtable: Set offload timeouts according to proto values (Phil Sutter) [1995554 1979184]
  - netfilter: conntrack: Introduce udp offload timeout configuration (Phil Sutter) [1995554 1979184]
  - netfilter: conntrack: Introduce tcp offload timeout configuration (Phil Sutter) [1995554 1979184]
  - powerpc/64s: Fix crashes when toggling stf barrier (Desnes A. Nunes do Rosario) [1989174 1964484]
  - iavf: fix locking of critical sections (Stefan Assmann) [1997534 1975245]
  - iavf: do not override the adapter state in the watchdog task (Stefan Assmann) [1997534 1975245]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.18.1.el8_4]
changelog:
  - mfd: intel-lpss: Use devm_ioremap_uc for MMIO (Steve Best) [1989560 1986715]
  - lib: devres: add a helper function for ioremap_uc (Steve Best) [1989560 1986715]
  - ceph: fix test for whether we can skip read when writing beyond EOF (Jeff Layton) [1996680 1971101]
  - arm64: memory: Add missing brackets to untagged_addr() macro (Chris von Recklinghausen) [1997998 1955809]
  - arm64: tags: Preserve tags for addresses translated via TTBR1 (Chris von Recklinghausen) [1997998 1955809]
  - arm64: entry: Move ct_user_exit before any other exception (Chris von Recklinghausen) [1997998 1955809]
  - arm64: memory: Implement __tag_set() as common function (Chris von Recklinghausen) [1997998 1955809]
  - arm64: mm: Really fix sparse warning in untagged_addr() (Chris von Recklinghausen) [1997998 1955809]
  - arm64: untag user pointers in access_ok and __uaccess_mask_ptr (Chris von Recklinghausen) [1997998 1955809]
  - arm64/mm: fix variable 'tag' set but not used (Chris von Recklinghausen) [1997998 1955809]
  - arm64: entry: SP Alignment Fault doesn't write to FAR_EL1 (Chris von Recklinghausen) [1997998 1955809]
  - arm64: compat: Add separate CP15 trapping hook (Chris von Recklinghausen) [1997998 1955809]
  - arm64: don't restore GPRs when context tracking (Chris von Recklinghausen) [1997998 1955809]
  - KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656) (Jon Maloy) [1985429 1985430] {CVE-2021-3656}
  - KVM: SVM: add module param to control the #SMI interception (Jon Maloy) [1985429 1985430] {CVE-2021-3656}
  - tty: Don't hold ldisc lock in tty_reopen() if ldisc present (Waiman Long) [1997999 1968271]
  - tty/ldsem: Add lockdep asserts for ldisc_sem (Waiman Long) [1997999 1968271]
  - tty: Simplify tty->count math in tty_reopen() (Waiman Long) [1997999 1968271]
  - tty: Don't block on IO when ldisc change is pending (Waiman Long) [1997999 1968271]
  - tty: Hold tty_ldisc_lock() during tty_reopen() (Waiman Long) [1997999 1968271]
  - tty: Drop tty->count on tty_reopen() failure (Waiman Long) [1997999 1968271]
  - [s390] s390/vtime: fix increased steal time accounting (Claudio Imbrenda) [1988386 1963075]
  - XArray: Fix splitting to non-zero orders (Chris von Recklinghausen) [1997997 1946304]
  - XArray: Fix split documentation (Chris von Recklinghausen) [1997997 1946304]
  - ima: extend boot_aggregate with kernel measurements (Bruno Meneguele) [1997766 1977422]
  - ceph: reduce contention in ceph_check_delayed_caps() (Jeff Layton) [1995862 1953430]
  - ice: Stop processing VF messages during teardown (Ken Cox) [1997538 1986451]
  - iavf: Set RSS LUT and key in reset handle path (Ken Cox) [1997536 1910853]
  - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) (Jon Maloy) [1985412 1985413] {CVE-2021-3653}
  - scsi: ibmvfc: Fix potential race in ibmvfc_wait_for_ops() (Steve Best) [1969792 1941180]
  - [s390] s390/dasd: add missing discipline function (Claudio Imbrenda) [1995206 1981804]
  - serial_core: switch to ->[sg]et_serial() (Artem Savkov) [1993872 1952415]
  - net/mlx5e: Fix mapping of ct_label zero (Jan Stancek) [1983681 1915308]
  - drm/qxl: add lock asserts to qxl_bo_vmap_locked + qxl_bo_vunmap_locked (Lyude Paul) [1992839 1907341]
  - drm/qxl: rework cursor plane (Lyude Paul) [1992839 1907341]
  - drm/qxl: move shadow handling to new qxl_prepare_shadow() (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix monitors object vmap (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix prime vmap (Lyude Paul) [1992839 1907341]
  - drm/qxl: rename qxl_bo_kmap -> qxl_bo_vmap_locked (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix lockdep issue in qxl_alloc_release_reserved (Lyude Paul) [1992839 1907341]
  - drm/qxl: use ttm bo priorities (Lyude Paul) [1992839 1907341]
  - drm/qxl: more fence wait rework (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly handle device init failures (Lyude Paul) [1992839 1907341]
  - drm/qxl: allocate dumb buffers in ram (Lyude Paul) [1992839 1907341]
  - drm/qxl: simplify qxl_fence_wait (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly free qxl releases (Lyude Paul) [1992839 1907341]
  - drm/qxl: handle shadow in primary destroy (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly pin/unpin shadow (Lyude Paul) [1992839 1907341]
  - drm/qxl: release shadow on shutdown (Lyude Paul) [1992839 1907341]
  - drm/qxl: unpin release objects (Lyude Paul) [1992839 1907341]
  - drm/qxl: use drmm_mode_config_init (Lyude Paul) [1992839 1907341]
  - qxl/ttm: drop the unusued no wait flag to reserve function (Lyude Paul) [1992839 1907341]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.19.1.el8_4]
changelog:
  - libceph: allow addrvecs with a single NONE/blank address (Jeff Layton) [1996682 1972278]
  - ice: Only lock to update netdev dev_addr (Michal Schmidt) [2000129 1995868]
  - ice: don't remove netdev->dev_addr from uc sync list (Ken Cox) [2000130 1961018]


author: Filip Januš <fjanus@redhat.com> 5.3.28-42
changelog:
  - Apply the previous change only on aarch64 to limit the risk of unwanted impact
  - Resolves: #1992402


author: systemd maintenance team <systemd-maint@redhat.com> - 239-42
changelog:
  - logind: don't print warning when user@.service template is masked (#1880270)
  - build: use simple project version in pkgconfig files (#1862714)
  - basic/virt: try the /proc/1/sched hack also for PID1 (#1868877)
  - seccomp: rework how the S[UG]ID filter is installed (#1860374)
  - vconsole-setup: downgrade log message when setting font fails on dummy console (#1889996)
  - units: fix systemd.special man page reference in system-update-cleanup.service (#1871827)
  - units: drop reference to sushell man page (#1871827)
  - sd-bus: break the loop in bus_ensure_running() if the bus is not connecting (#1885553)
  - core: add new API for enqueing a job with returning the transaction data (#846319)
  - systemctl: replace switch statement by table of structures (#846319)
  - systemctl: reindent table (#846319)
  - systemctl: Only wait when there's something to wait for. (#846319)
  - systemctl: clean up start_unit_one() error handling (#846319)
  - systemctl: split out extra args generation into helper function of its own (#846319)
  - systemctl: add new --show-transaction switch (#846319)
  - test: add some basic testing that "systemctl start -T" does something (#846319)
  - man: document the new systemctl --show-transaction option (#846319)
  - socket: New option 'FlushPending' (boolean) to flush socket before entering listening state (#1870638)
  - core: remove support for API bus "started outside our own logic" (#1764282)
  - mount-setup: fix segfault in mount_cgroup_controllers when using gcc9 compiler (#1868877)
  - dbus-execute: make transfer of CPUAffinity endian safe (#12711) (#1740657)
  - core: add support for setting CPUAffinity= to special "numa" value (#1740657)
  - basic/user-util: always use base 10 for user/group numbers (#1848373)
  - parse-util: sometimes it is useful to check if a string is a valid integer, but not actually parse it (#1848373)
  - basic/parse-util: add safe_atoux64() (#1848373)
  - parse-util: allow tweaking how to parse integers (#1848373)
  - parse-util: allow '-0' as alternative to '0' and '+0' (#1848373)
  - parse-util: make return parameter optional in safe_atou16_full() (#1848373)
  - parse-util: rewrite parse_mode() on top of safe_atou_full() (#1848373)
  - user-util: be stricter in parse_uid() (#1848373)
  - strv: add new macro STARTSWITH_SET() (#1848373)
  - parse-util: also parse integers prefixed with 0b and 0o (#1848373)
  - tests: beef up integer parsing tests (#1848373)
  - shared/user-util: add compat forms of user name checking functions (#1848373)
  - shared/user-util: emit a warning on names with dots (#1848373)
  - user-util: Allow names starting with a digit (#1848373)
  - shared/user-util: allow usernames with dots in specific fields (#1848373)
  - user-util: switch order of checks in valid_user_group_name_or_id_full() (#1848373)
  - user-util: rework how we validate user names (#1848373)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-43
changelog:
  - man: mention System Administrator's Guide in systemctl manpage (#1623116)
  - udev: introduce udev net_id "naming schemes" (#1827462)
  - meson: make net.naming-scheme= default configurable (#1827462)
  - man: describe naming schemes in a new man page (#1827462)
  - udev/net_id: parse _SUN ACPI index as a signed integer (#1827462)
  - udev/net_id: don't generate slot based names if multiple devices might claim the same slot (#1827462)
  - fix typo in ProtectSystem= option (#1871139)
  - remove references of non-existent man pages (#1876807)
  - log: Prefer logging to CLI unless JOURNAL_STREAM is set (#1865840)
  - locale-util: add new helper locale_is_installed() (#1755287)
  - test: add test case for locale_is_installed() (#1755287)
  - tree-wide: port various bits over to locale_is_installed() (#1755287)
  - install: allow instantiated units to be enabled via presets (#1812972)
  - install: small refactor to combine two function calls into one function (#1812972)
  - test: fix a memleak (#1812972)
  - docs: Add syntax for templated units to systemd.preset man page (#1812972)
  - shared/install: fix preset operations for non-service instantiated units (#1812972)
  - introduce setsockopt_int() helper (#1887181)
  - socket-util: add generic socket_pass_pktinfo() helper (#1887181)
  - core: add new PassPacketInfo= socket unit property (#1887181)
  - resolved: tweak cmsg calculation (#1887181)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-44
changelog:
  - ci: PowerTools repo was renamed to powertools in RHEL 8.3 (#1871827)
  - ci: use quay.io instead of Docker Hub to avoid rate limits (#1871827)
  - ci: move jobs from Travis CI to GH Actions (#1871827)
  - unit: make UNIT() cast function deal with NULL pointers (#1871827)
  - use link to RHEL-8 docs (#1623116)
  - cgroup: Also set blkio.bfq.weight (#1657810)
  - units: make sure initrd-cleanup.service terminates before switching to rootfs (#1657810)
  - core: reload SELinux label cache on daemon-reload (#1888912)
  - selinux: introduce mac_selinux_create_file_prepare_at() (#1888912)
  - selinux: add trigger for policy reload to refresh internal selabel cache (#1888912)
  - udev/net_id: give RHEL-8.4 naming scheme a name (#1827462)
  - basic/stat-util: make mtime check stricter and use entire timestamp (#1642728)
  - udev: make algorithm that selects highest priority devlink less susceptible to race conditions (#1642728)
  - test: create /dev/null in test-udev.pl (#1642728)
  - test: missing "die" (#1642728)
  - udev-test: remove a check for whether the test is run in a container (#1642728)
  - udev-test: skip the test only if it can't setup its environment (#1642728)
  - udev-test: fix test skip condition (#1642728)
  - udev-test: fix missing directory test/run (#1642728)
  - udev-test: check if permitted to create block device nodes (#1642728)
  - test-udev: add a testcase of too long line (#1642728)
  - test-udev: use proper semantics for too long line with continuation (#1642728)
  - test-udev: add more tests for line continuations and comments (#1642728)
  - test-udev: add more tests for line continuation (#1642728)
  - test-udev: fix alignment and drop unnecessary white spaces (#1642728)
  - test/udev-test.pl: cleanup if skipping test (#1642728)
  - test: add test cases for empty string match (#1642728)
  - test: add test case for multi matches when use "||" (#1642728)
  - udev-test: do not rely on "mail" group being defined (#1642728)
  - test/udev-test.pl: allow multiple devices per test (#1642728)
  - test/udev-test.pl: create rules only once (#1642728)
  - test/udev-test.pl: allow concurrent additions and removals (#1642728)
  - test/udev-test.pl: use computed devnode name (#1642728)
  - test/udev-test.pl: test correctness of symlink targets (#1642728)
  - test/udev-test.pl: allow checking multiple symlinks (#1642728)
  - test/udev-test.pl: fix wrong test descriptions (#1642728)
  - test/udev-test.pl: last_rule is unsupported (#1642728)
  - test/udev-test.pl: Make some tests a little harder (#1642728)
  - test/udev-test.pl: remove bogus rules from magic subsys test (#1642728)
  - test/udev-test.pl: merge "space and var with space" tests (#1642728)
  - test/udev-test.pl: merge import parent tests into one (#1642728)
  - test/udev-test.pl: count "good" results (#1642728)
  - tests/udev-test.pl: add multiple device test (#1642728)
  - test/udev-test.pl: add repeat count (#1642728)
  - test/udev-test.pl: generator for large list of block devices (#1642728)
  - test/udev-test.pl: suppress umount error message at startup (#1642728)
  - test/udev_test.pl: add "expected good" count (#1642728)
  - test/udev-test: gracefully exit when imports fail (#1642728)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45
changelog:
  - Revert "test: add test cases for empty string match" and "test: add test case for multi matches when use ||" (#1931947)
  - test/sys-script.py: add missing DEVNAME entries to uevents (#1931947)
  - sd-event: split out helper functions for reshuffling prioqs (#1819868)
  - sd-event: split out enable and disable codepaths from sd_event_source_set_enabled() (#1819868)
  - sd-event: mention that two debug logged events are ignored (#1819868)
  - sd-event: split clock data allocation out of sd_event_add_time() (#1819868)
  - sd-event: split out code to add/remove timer event sources to earliest/latest prioq (#1819868)
  - sd-event: fix delays assert brain-o (#17790) (#1819868)
  - sd-event: let's suffix last_run/last_log with "_usec" (#1819868)
  - sd-event: refuse running default event loops in any other thread than the one they are default for (#1819868)
  - sd-event: ref event loop while in sd_event_prepare() ot sd_event_run() (#1819868)
  - sd-event: follow coding style with naming return parameter (#1819868)
  - sd-event: remove earliest_index/latest_index into common part of event source objects (#1819868)
  - sd-event: update state at the end in event_source_enable (#1819868)
  - sd-event: increase n_enabled_child_sources just once (#1819868)
  - sd-event: add ability to ratelimit event sources (#1819868)
  - test: add ratelimiting test (#1819868)
  - core: prevent excessive /proc/self/mountinfo parsing (#1819868)
  - udev: run link_update() with increased retry count in second invocation (#1931947)
  - pam-systemd: use secure_getenv() rather than getenv() (#1687514)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45.1
changelog:
  - Revert "udev: run link_update() with increased retry count in second invocation" (#1963980)
  - Revert "udev: make algorithm that selects highest priority devlink less susceptible to race conditions" (#1963980)
  - test/udev-test.pl: drop test cases that add mutliple devices (#1963980)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.25-1
changelog:
  - Update to 9.11.25
  - Require libcap from devel package
  - Fix crash on NTA recheck failure (#1893761)


author: Petr Menšík <pemensik@redhat.com> - 32:9.11.26-2
changelog:
  - Add DNSTAP support (#1854148), new dnstap-read tool
  - Add JSON support in statistics-channel (#1899257)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-17
changelog:
  - Fixed DFLTCC compression level switching issues (#1875492)
  - Enabled HW compression for compression levels 1 through 6 (#1847438)
  - Fixed inflateSyncPoint() bad return value on z15 (#1888930)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-303.el8]
changelog:
  - redhat: switch secureboot kernel image signing to release keys (Jan Stancek)
  - Revert "[md] md/raid5: add a new member of offset into r5dev" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: make async_copy_data() to support different page offset" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid5: add new xor function to support different page offset" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: convert to new xor compution interface" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid6: let syndrome computor support different page offset" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid6: let async recovery function support different page offset" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: let multiple devices of stripe_head share page" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: resize stripe_head when reshape array" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: reallocate page array after setting new stripe_size" (Nigel Croxon) [1936903]
  - ACPI: PNP: compare the string length in the matching_id() (Mark Langsdorf) [1933702]
  - ceph: add missing break when parsing "nowsync" mount option (Jeff Layton) [1932753]
  - get_maintainer.conf: Update with new location of RHMAINTAINERS (Prarit Bhargava)
  - redhat: make pathspec exclusion compatible with old git versions (Herton R. Krzesinski)
  - redhat/scripts: Update merge-subtrees.sh with new subtree location (Prarit Bhargava)
  - tree: Add RHMAINTAINERS soft link in 8.4 (Prarit Bhargava)
  - tree: remove existing redhat/rhdocs subtree in 8.4 (Prarit Bhargava)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-304.el8]
changelog:
  - mm: Revert "remove the account_page_dirtied export" (Waiman Long) [1941257]
  - Revert "[netdrv] net/broadcom: Clean broadcom code from driver versions" (Jonathan Toppins) [1940842]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.1.1.el8_4]
changelog:
  - ALSA: usb-audio: fix NULL ptr dereference in usb_audio_probe (Jaroslav Kysela) [1954545 1870724]
  - ALSA: usb-audio: fix use after free in usb_audio_disconnect (Jaroslav Kysela) [1954545 1870724]
  - ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend() (Jaroslav Kysela) [1954545 1870724]
  - selinux: fix deadlock in security_set_bools() (Ondrej Mosnacek) [1945123 1924230]
  - geneve: do not modify the shared tunnel info when PMTU triggers an ICMP reply (Antoine Tenart) [1944667 1941753]
  - vxlan: do not modify the shared tunnel info when PMTU triggers an ICMP reply (Antoine Tenart) [1944667 1941753]
  - redhat: switch to zstream (Jan Stancek)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.2.1.el8_4]
changelog:
  - net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP (Alaa Hleihel) [1952061 1936742]
  - net/mlx5e: Reject tc rules which redirect from a VF to itself (Alaa Hleihel) [1952065 1932839]
  - net/mlx5: CT: Add support for matching on ct_state inv and rel flags (Alaa Hleihel) [1952062 1942681]
  - KVM: VMX: Don't use vcpu->run->internal.ndata as an array index (Jon Maloy) [1954221 1954219]
  - tools/power turbostat: Revert "[tools] tools/power turbostat: Enable accumulate RAPL display" (Prarit Bhargava) [1952987 1944699]


author: Andrew Price <anprice@redhat.com> - 3.2.0-11
changelog:
  - gfs2_jadd: Use fallocate to preallocate journals
  - gfs2_jadd: Don't fsync after each block written
    Resolves: rhbz#1942434


author: RAdovan Sroka <rsroka@redhat.com> - 1.8.29-7.1
changelog:
  RHEL 8.4.0 ZSTREAM ERRATUM
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#2015136


author: Thomas Haller <thaller@redhat.com> - 1:1.30.0-0.10
changelog:
  - Update to 1.30-rc1 (1.29.90-dev) (development)
  - cloud-setup: fix removing IPv4 address (rh #1920838)


author: Thomas Haller <thaller@redhat.com> - 1:1.30.0-3
changelog:
  - Increase LimitNOFILE to allow more than 1024 file descriptors (rh #1926599).
    This requires a suitable libndp version that can handle many file descriptors (rh #1933041).


author: Thomas Haller <thaller@redhat.com> - 1:1.30.0-6
changelog:
  - core: fix handling local routes generated by kernel (rh #1907661)
  - initrd: fix crash with rd.znet= argument (rh #1941106)
  - core: fix crash handling path match (rh #1942741)


author: Wen Liang <wenliang@redhat.com> - 1:1.30.0-8
changelog:
  - core: fix finding active connection for controller (rh #1965337)
  - bond: support 'tlb_dynamic_lb' in 'balance-alb' mode (rh #1965948)
  - manager: delete default connection when veth removed (rh #1965336)


author: Javier Martinez Canillas <javierm@redhat.com> - 0.3.0-10
changelog:
  - Add mokutil code to consume data from /sys/firmware/efi/mok-variables/
    as well as attempting to consume numbered mok variables from efivarfs
    when mok-variables aren't present (pjones)
    Resolves: rhbz#1907418


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.30.0-0.8
changelog:
  - Update to 1.29.10 (development)
  - bond: introduce new 'vlan+srcmac' xmit_hash_policy option (rh #1915457)
  - ovs: clean up interfaces from ovsdb at startup (rh #1861296)


author: Antonio Cardace <acardace@redhat.com> - 1:1.30.0-0.9
changelog:
  - Update to 1.29.11 (development)
  - bond: fix changing mode when the device is created externally (rh #1870691)
  - ovs: fix firewalld configuration for ovs-ports (rh #1921107)
  - ovs: avoid race condition when system interface is removed from ovsdb (rh #1923248)
  - doc: mention NETMASK as alternative to PREFIX for addresses in `man nm-settings-ifcfg-rh` (rh #1925123)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.0-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
  - Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
  - Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
  - Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
  - Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
  - Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
  - Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
  - Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
  - Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
  - Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
  - Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
  - Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
  - Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
  - Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
  - Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
  - Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
  - Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
  - Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
  - Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
  - Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
  - Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
  - Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
  - Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
  - Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
  - Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
  - Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
  - Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
  - Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
  - Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Phil Sutter <psutter@redhat.com> - 1.8.4-16
changelog:
  - tests/shell: Add test for bitwise avoidance fixes
  - ebtables: Optimize masked MAC address matches
  - nft: Optimize class-based IP prefix matches
  - nft: Fix for broken address mask match detection
  - nft: cache: Make nft_rebuild_cache() respect fake cache
  - tests: shell: Improve concurrent noflush restore test a bit
  - nft: Fix for concurrent noflush restore calls
  - nft: Fix error reporting for refreshed transactions
  - nft: Make batch_add_chain() return the added batch object


author: Phil Sutter <psutter@redhat.com> - 1.8.4-17
changelog:
  - extensions: dccp: Fix for DCCP type 'INVALID'
  - tests: shell: Merge and extend return codes test
  - nft: Fix command name in ip6tables error message
  - extensions: libxt_CT: add translation for NOTRACK
  - extensions: libipt_icmp: Fix translation of type 'any'
  - tests/shell: Test for fixed extension registration
  - libxtables: Register multiple extensions in ascending order
  - libxtables: Simplify pending extension registration
  - libxtables: Make sure extensions register in revision order


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45.3
changelog:
  - sd-event: change ordering of pending/ratelimited events (#1984406)
  - sd-event: drop unnecessary "else" (#1984406)
  - sd-event: use CMP() macro (#1984406)
  - sd-event: use usec_add() (#1984406)
  - sd-event: make event_source_time_prioq_reshuffle() accept all event source type (#1984406)
  - sd-event: always reshuffle time prioq on changing online/offline state (#1984406)
  - meson: remove strange dep that causes meson to enter infinite loop (#1984406)
  - copy: handle copy_file_range() weirdness on procfs/sysfs (#1984406)
  - ci: run unit tests on z-stream branches as well (#1984406)
  - remove a left-over break (#1984406)


author: Abhi Das <adas@redhat.com> - 4.3-20
changelog:
  - rhbz#1895017 - unsquashfs does not preserve file capabilities
    rhbz#1754815 - Kdump: Building kdump initramfs img may fail with 'dracut: Failed making squash image' occasionally
    Resolves: rhbz#1895017, rhbz#1754815


author: Marek Polacek <polacek@redhat.com> 8.5.0-2
changelog:
  - revert upstream PR85873 gcc-8 fix, apply the fix from gcc-9 (#1960701)
  - fix 'this' adjustment for devirtualized call (PR c++/100797, #1965951)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-417
changelog:
  - Fix Time-Local tests to pass after year 2019 (bug #1807120)
  - Run-require perl(Encode) by perl-libs (bug #1903503)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4:5.26.3-419
changelog:
  - Fix CVE-2020-10543 (bug #1839273)
  - Fix CVE-2020-10878 (bug #1839276)
  - Fix a file mode of a perl-example.stp example (bug #1913693)


author: Thomas Haller <thaller@redhat.com> - 1:1.32.0-0.5
changelog:
  - update to 1.32-rc1 (1.31.90) (release candidate)
  - core: allow to preserved external TFilter and QDisc settings (rh #1928078)
  - bond: support "tlb_dynamic_lb" in "balance-alb" mode (rh #1959934)


author: Wen Liang <wenliang@redhat.com> - 1:1.32.0-1
changelog:
  - update to 1.32.0 release
  - veth: fix null error when deleting the device (rh #1915278)
  - veth: fix crash when deleting the device profile (rh #1915276)
  - firewall: add new "nftables" firewall-backend (rh #1548825)
  - DNS: fix lookup of hostname via DNS (rh #1970335)


author: Wen Liang <wenliang@redhat.com> - 1:1.32.2-1
changelog:
  - update to 1.32.2 release
  - device: prefer IPv6 not-deprecated addresses for hostname lookup (rh #1820770)
  - docs: describe qdiscs and tfilters in nm-settings manpage (rh #1847894)
  - cloud-setup: preserve IPv4 addresses/routes/rules from profile (rh #1971527)
  - daemon: performance improvements (rh #1847125)
  - dhcp/systemd: ignore FORCERENEW requests for DHCPV4 (rh #1961251, CVE-2020-13529)
  - Add bridge_role in 802-3-ethernet.s390-options using nmcli (rh #1935842)


author: Gris Ge <fge@redhat.com> - 1:1.32.4-1
changelog:
  - Upgrade to 1.32.4 with fixes of:
  - nmcli: show DNS SEARCH field in device information. (rh #1852317)
  - device: avoid crash setting VPN config during unrealize. (rh #1912423)
  - core: send ARP announcements when there is carrier. (rh #1956793)
  - core: add ipv[46].required-timeout option to wait for IP configuration while activating. (rh #1961666)
  - core: start DHCPv6 when a prefix delegation is needed for shared mode. (rh #1973199)
  - ifcfg: log warning about invalid keys in ifcfg files. (rh #1959656)
  - cloud-setup: add support for Aliyun cloud. (rh #1823315)


author: Gris Ge <fge@redhat.com> - 1:1.32.6-1
changelog:
  - Upgrade to 1.32.6 release
  - core: fix adding stale local routes when address changes (rh #1979192)
  - dhcp: handle filename/bootfile_name DHCP option and write it to device state
    file for initrd/kickstart (rh #1979387)
  - initrd: add "ib.pkey=" command line option (rh #1805708)
  - core: introduce "keep-configuration" device option to forcefully activate a
    profile on start (rh #1934122)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.32.8-1
changelog:
  - Upgrade to 1.32.8 release
  - firewalld: configure zones on "Reloaded" signal (rh #1982403)
  - ethtool: support configuring newer gigabit ethernet speeds (rh #1897004)
  - core: fix wrong MTU for bridge interfaces (rh #1973536)
  - cloud-setup: fix gateway address for Aliyun cloud (rh #1823315)


author: Wen Liang <wenliang@redhat.com> - 1:1.32.10-1
changelog:
  - update to 1.32.10 release
  - nm-initrd-generator: add kernel command line options ethtool autoneg and speed (rh #1940934)
  - IP: fix the order of IP addresses during service restart (rh #1988751)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.32.10-3
changelog:
  - preserve the IPv6 multicast route added by kernel (rh #2004212)
  - cloud-setup: better handle other route configuration (rh #1977984)


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-37
changelog:
  - Doc: improve the usage documentation of the logger
  - Update the kdump sysconfig
  - Capitalize the configuration name of log level
  - Add the rd.kdumploglvl option to control log level in the second kernel
  - Appropriately converts logger numeric level to syslog log level
  - Remove unused log levels for kdump logger
  - Add sanity checks for the log levels
  - Add code comments to help better understanding
  - Doc: add a documentation for the usage of logger
  - Improve debugging in the kdump kernel
  - kdumpctl: add the '-d' option to enable the kexec loading debugging messages
  - kdump.sysconfig: add the kdump logger configurations
  - enable the logger for kdump
  - introduce the kdump logger from the dracut


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-38
changelog:
  - Don's try to restart dracut-initqueue if it's already failed
  - fadump-howto: update about 'nocma' and 'off' options for 'fadump=' parameter
  - dracut-module-setup.sh: use auto6 for ipv6
  - module-setup.sh: enable vlan on team interface
  - Fix rootfs detection in dump_fs
  - Remove RHEL-only patch: kexec-tools-2.0.18-makedumpfile-arm64-Add-support-for-ARMv8.2-LVA-52-bi.patch
  - Rebase to makedumpfile-1.6.8 (step1)


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-43
changelog:
  - Always include watchdog-modules
  - mkdumprd: Ensure kdumpbase is added
  - Move watchdog detect and install code to module-setup.sh
  - Add a helper to omit non-mandatory dracut module
  - Move some dracut module dependencies checks to module-setup.sh
  - Set watchdog's pretimeout to zero in kdump kernel
  - kdump-lib.sh: Use a more generic helper to detect omitted dracut module
  - Fix the watchdog drivers detection code
  - Add a helper for detecting watchdog drivers
  - Remove a redundant nfs check
  - kdumpctl: split the driver detection from fs dection function
  - kdump.service: use ConditionKernelCommandLine=crashkernel
  - Revert "Append both nofail and x-systemd.before to kdump mount target"
  - Revert "Don's try to restart dracut-initqueue if it's already failed"
  - Fix dump_fs mount point detection and fallback mount
  - kdump.conf: Update doc about core_collector for ssh target
  - Save the final failure information to log file if saving vmcore failed
  - Doc: Improve the kdump sysconfig document
  - kdumpctl: fix a variable expansion in check_fence_kdump_config()
  - Fedora 33 rhpkg build bug


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-44
changelog:
  - module-setup.sh: don't polute the namespace unnecessarily
  - module-setup.sh: don't source $dracutfunctions
  - logger: source the logger file individually
  - dracut-module-setup.sh: enable ForwardToConsole=yes in fadump mode


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-45
changelog:
  - origin/rhel-8.4.0) Revert "Revert "Append both nofail and x-systemd.before to kdump mount target""
  - kdump.conf: add ipv6 example for nfs and ssh dump
  - fix kdump failure of saving vmcore with the scp + ipv6 method


author: Jan Stancek <jstancek@redhat.com> [4.18.0-296.el8]
changelog:
  - perf/x86/intel/uncore: With > 8 nodes, get pci bus die id from NUMA info (Prarit Bhargava) [1766743]
  - perf/x86/intel/uncore: Store the logical die id instead of the physical die id. (Prarit Bhargava) [1766743]
  - mm: fix page reference leak in soft_offline_page() (Aristeu Rozanski) [1768372]
  - mm,hwpoison: try to narrow window race for free pages (Aristeu Rozanski) [1768372]
  - mm,hwpoison: double-check page count in __get_any_page() (Aristeu Rozanski) [1768372]
  - mm,hwpoison: introduce MF_MSG_UNSPLIT_THP (Aristeu Rozanski) [1768372]
  - mm,hwpoison: return 0 if the page is already poisoned in soft-offline (Aristeu Rozanski) [1768372]
  - mm,hwpoison: refactor soft_offline_huge_page and __soft_offline_page (Aristeu Rozanski) [1768372]
  - mm,hwpoison: rework soft offline for in-use pages (Aristeu Rozanski) [1768372]
  - mm,hwpoison: rework soft offline for free pages (Aristeu Rozanski) [1768372]
  - mm,hwpoison: unify THP handling for hard and soft offline (Aristeu Rozanski) [1768372]
  - mm,hwpoison: kill put_hwpoison_page (Aristeu Rozanski) [1768372]
  - mm,hwpoison: refactor madvise_inject_error (Aristeu Rozanski) [1768372]
  - mm,hwpoison: unexport get_hwpoison_page and make it static (Aristeu Rozanski) [1768372]
  - mm,hwpoison-inject: don't pin for hwpoison_filter (Aristeu Rozanski) [1768372]
  - mm, hwpoison: remove recalculating hpage (Aristeu Rozanski) [1768372]
  - mm,hwpoison: cleanup unused PageHuge() check (Aristeu Rozanski) [1768372]
  - mm/madvise.c: replace with page_size() in madvise_inject_error() (Aristeu Rozanski) [1768372]
  - mm, soft-offline: convert parameter to pfn (Aristeu Rozanski) [1768372]
  - tick/nohz: Revert "Narrow down noise while setting current task's tick dependency" (Waiman Long) [1931004]
  - kvm: Add kvm_stat.service file and kvm_stat logrotate config to the tools (Thomas Huth) [1919930]
  - igc: fix link speed advertising (Corinna Vinschen) [1769701]
  - [crypto] crypto: qat - add capability detection logic in qat_4xxx (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add AES-XTS support for QAT GEN4 devices (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add AES-CTR support for QAT GEN4 devices (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - fix excluded_middle.cocci warnings (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add qat_4xxx driver (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add hook to initialize vector routing table (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - target fw images to specific AEs (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add gen4 firmware loader (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add support for broadcasting mode (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add support for shared ustore (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - allow to target specific AEs (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add FCU CSRs to chip info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add CSS3K support (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - use ae_mask (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add check for null pointer (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add misc control CSR to chip info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add wake up event to chip info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add clock enable CSR to chip info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add reset CSR and mask to chip info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add local memory size to chip info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add support for lm2 and lm3 (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add next neighbor to chip_info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - replace check based on DID (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - introduce chip info structure (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - refactor long expressions (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - refactor qat_uclo_set_ae_mode() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - move defines to header files (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove global CSRs helpers (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - refactor AE start (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - change micro word data mask (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - change type for ctx_mask (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add support for relative FW ucode loading (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - rename qat_uclo_del_uof_obj() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - introduce additional parenthesis (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove unnecessary parenthesis (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - fix error message (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - fix CSR access (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - support for mof format in fw loader (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - replace pci with PCI in comments (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove cast for mailbox CSR (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove unneeded semicolon (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - extend ae_mask (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - allow for instances in different banks (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - refactor qat_crypto_dev_config() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - refactor qat_crypto_create_instances() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - change return value in adf_cfg_key_val_get() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - change return value in adf_cfg_add_key_value_param() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove unnecessary void* casts (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - call functions in adf_sriov if available (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove hardcoded bank irq clear flag mask (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - abstract writes to arbiter enable (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - use BIT_ULL() - 1 pattern for masks (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - replace constant masks with GENMASK (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - abstract build ring base (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - enable ring after pair is programmed (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - register crypto instances based on capability (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add support for capability detection (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - abstract arbiter access (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove unused macros in arbiter module (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove writes into WQCFG (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - update constants table (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - use admin mask to send fw constants (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - change admin sequence (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - rename ME in AE (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add packed to init admin structures (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - abstract admin interface (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - relocate GEN2 CSR access code (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - split transport CSR access logic (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - fix configuration of iov threads (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - num_rings_per_bank is device dependent (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - mask device capabilities with soft straps (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - update IV in software (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove unused function (Vladis Dronov) [1833004]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-297.el8]
changelog:
  - KVM: SVM: Make symbol 'svm_gp_erratum_intercept' static (Paolo Bonzini) [1769283]
  - KVM: SVM: Fix #GP handling for doubly-nested virtualization (Paolo Bonzini) [1769283]
  - KVM: SVM: Add support for SVM instruction address check change (Paolo Bonzini) [1769283]
  - KVM: SVM: Add emulation support for #GP triggered by SVM instructions (Paolo Bonzini) [1769283]
  - KVM: x86: Factor out x86 instruction emulation with decoding (Paolo Bonzini) [1769283]
  - gfs2: In gfs2_ail1_start_one unplug the IO when needed (Bob Peterson) [1648446]
  - gfs2: Free rd_bits later in gfs2_clear-rgrpd to fix use-after-free (Bob Peterson) [1648446]
  - gfs2: Only access gl_delete for iopen glocks (Bob Peterson) [1648446]
  - gfs2: Fix case in which ail writes are done to jdata holes (Bob Peterson) [1648446]
  - gfs2: simplify gfs2_block_map (Bob Peterson) [1648446]
  - gfs2: Only set PageChecked if we have a transaction (Bob Peterson) [1648446]
  - gfs2: don't lock sd_ail_lock in gfs2_releasepage (Bob Peterson) [1648446]
  - gfs2: make gfs2_ail1_empty_one return the count of active items (Bob Peterson) [1648446]
  - gfs2: Wipe jdata and ail1 in gfs2_journal_wipe, formerly gfs2_meta_wipe (Bob Peterson) [1648446]
  - gfs2: enhance log_blocks trace point to show log blocks free (Bob Peterson) [1648446]
  - gfs2: rename gfs2_write_full_page to gfs2_write_jdata_page, remove parm (Bob Peterson) [1648446]
  - PM: hibernate: flush swap writer after marking (Lenny Szubowicz) [1898677]
  - cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown (Lenny Szubowicz) [1898677]
  - PM / hibernate: memory_bm_find_bit(): Tighten node optimisation (Lenny Szubowicz) [1898677]
  - bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation (Jiri Benc) [1882215]
  - ice, xsk: clear the status bits for the next_to_use descriptor (Jiri Benc) [1906820]
  - net/mlx4_en: Handle TX error CQE (Alaa Hleihel) [1925690]
  - net/mlx4_en: Avoid scheduling restart task if it is already running (Alaa Hleihel) [1925690]
  - blk-mq: test QUEUE_FLAG_HCTX_ACTIVE for sbitmap_shared in hctx_may_queue (Ming Lei) [1922013]
  - blk-mq: Improve performance of non-mq IO schedulers with multiple HW queues (Ming Lei) [1922013]
  - Revert "blk-mq, elevator: Count requests per hctx to improve performance" (Ming Lei) [1922013]
  - bpftool: Disable CAP_BPF check for feature command (Jiri Olsa) [1921542]
  - RDMA/siw: Fix calculation of tx_valid_cpus size (Kamal Heib) [1919502]
  - net/mlx5e: Disable performance optimization for IPv4/IPv6 ethertype (Alaa Hleihel) [1928671 1919807]
  - IB/mlx5: Return appropriate error code instead of ENOMEM (Alaa Hleihel) [1928671]
  - net/mlx5: Disable devlink reload for lag devices (Alaa Hleihel) [1928671 1929166]
  - net/mlx5: Disable devlink reload for multi port slave device (Alaa Hleihel) [1928671 1929166]
  - net/mlx5: Disallow RoCE on lag device (Alaa Hleihel) [1928671 1929166]
  - net/mlx5: Disallow RoCE on multi port slave device (Alaa Hleihel) [1928671 1929166]
  - net/mlx5: Fix health error state handling (Alaa Hleihel) [1928671]
  - net/mlx5e: Change interrupt moderation channel params also when channels are closed (Alaa Hleihel) [1928671]
  - net/mlx5e: Don't change interrupt moderation params when DIM is enabled (Alaa Hleihel) [1928671]
  - net/mlx5e: E-switch, Fix rate calculation for overflow (Alaa Hleihel) [1928671]
  - net/mlx5e: Release skb in case of failure in tc update skb (Alaa Hleihel) [1928671 1929119]
  - net/mlx5e: Check tunnel offload is required before setting SWP (Alaa Hleihel) [1928671 1925439]
  - net/mlx5e: kTLS, Use refcounts to free kTLS RX priv context (Alaa Hleihel) [1928671 1928706]
  - net/mlx5e: Fix CQ params of ICOSQ and async ICOSQ (Alaa Hleihel) [1928671 1928706]
  - net/mlx5e: Replace synchronize_rcu with synchronize_net (Alaa Hleihel) [1928671 1913616]
  - net/mlx5e: Enable XDP for Connect-X IPsec capable devices (Alaa Hleihel) [1928671 1856795]
  - net/mlx5e: Enable striding RQ for Connect-X IPsec capable devices (Alaa Hleihel) [1928671 1926120]
  - fix regression in "epoll: Keep a reference on files added to the check list" (Carlos Maiolino) [1920776] {CVE-2020-0466}
  - do_epoll_ctl(): clean the failure exits up a bit (Carlos Maiolino) [1920776] {CVE-2020-0466}
  - epoll: Keep a reference on files added to the check list (Carlos Maiolino) [1920776] {CVE-2020-0466}


author: Jan Stancek <jstancek@redhat.com> [4.18.0-298.el8]
changelog:
  - drm/i915/gen11+: Only load DRAM information from pcode (Lyude Paul) [1934537]
  - drm/i915/dg1: Wait for pcode/uncore handshake at startup (Lyude Paul) [1934537]
  - powercap/intel_rapl: add support for TigerLake Desktop (David Arcari) [1932457]
  - powerpc/perf: Fix handling of privilege level checks in perf interrupt context (Gustavo Luiz Duarte) [1918411]
  - NFSv4.2: fix error return on memory allocation failure (Scott Mayhew) [1917689]
  - NFSv4.2: improve page handling for GETXATTR (Scott Mayhew) [1917689]
  - NFSv4.2: Fix up the get/listxattr calls to rpc_prepare_reply_pages() (Scott Mayhew) [1917689]
  - NFS: Fix rpcrdma_inline_fixup() crash with new LISTXATTRS operation (Scott Mayhew) [1917689]
  - SUNRPC: Fix up xdr_set_page() (Benjamin Coddington) [1917689]
  - NFSv4: Fix open coded xdr_stream_remaining() (Benjamin Coddington) [1917689]
  - SUNRPC: Clean up the handling of page padding in rpc_prepare_reply_pages() (Benjamin Coddington) [1917689]
  - SUNRPC: Fix up xdr_read_pages() to take arbitrary object lengths (Benjamin Coddington) [1917689]
  - SUNRPC: Clean up helpers xdr_set_iov() and xdr_set_page_base() (Benjamin Coddington) [1917689]
  - SUNRPC: Split out a function for setting current page (Benjamin Coddington) [1917689]
  - SUNRPC: Fix up typo in xdr_init_decode() (Benjamin Coddington) [1917689]
  - NFSv4: Fix the alignment of page data in the getdeviceinfo reply (Benjamin Coddington) [1917689]
  - net: fix pos incrementment in ipv6_route_seq_next (Lorenzo Bianconi) [1926608]
  - ipv6_route_seq_next should increase position index (Lorenzo Bianconi) [1926608]
  - bpf: Clear subreg_def for global function return values (Yauheni Kaliuta) [1934062]
  - igc: Fix returning wrong statistics (Corinna Vinschen) [1910873]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-299.el8]
changelog:
  - md: Set prev_flush_start and flush_bio in an atomic way (Xiao Ni) [1901598]
  - md: improve variable names in md_flush_request() (Xiao Ni) [1901598]
  - hpsa: fix regression issue for old controllers (Joseph Szczypek) [1925711]
  - scsi: hpsa: Correct dev cmds outstanding for retried cmds (Joseph Szczypek) [1925711]
  - vt: Disable KD_FONT_OP_COPY (Dave Airlie) [1903937] {CVE-2020-28974}
  - drm/i915/rkl: Remove require_force_probe protection (Lyude Paul) [1937558]
  - drm/i915/tgl/psr: Disable PSR on Tigerlake for now (Lyude Paul) [1924702]
  - dm raid: fix discard limits for raid0 and raid10 (Mike Snitzer) [1934274]
  - dm: fix __send_changing_extent_only to avoid duplicate dm_target_offset() (Mike Snitzer) [1934274]
  - mm/hugetlb.c: fix unnecessary address expansion of pmd sharing (Waiman Long) [1934212]
  - mm: memcontrol: fix slub memory accounting (Waiman Long) [1934212]
  - mm: memcontrol: fix swap undercounting in cgroup2 (Waiman Long) [1934212]
  - mm: memcontrol: fix NR_ANON_THPS accounting in charge moving (Waiman Long) [1934212]
  - mm, slub: better heuristic for number of cpus when calculating slab order (Waiman Long) [1934212]
  - Revert "mm: memcontrol: avoid workload stalls when lowering memory.high" (Waiman Long) [1934212]
  - selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed (Hangbin Liu) [1931732]
  - selftests/bpf: No need to drop the packet when there is no geneve opt (Hangbin Liu) [1931732]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-300.el8]
changelog:
  - [scsi] scsi: qedi: Correct max length of CHAP secret (Nilesh Javali) [1909180]
  - redhat: use tags from git notes for zstream to generate changelog (Frantisek Hrbata)
  - redhat: add CI file for kernel-private (Bruno Meneguele)
  - CI: Drop unused variable (Bruno Meneguele)
  - CI: Enable RT verification (Bruno Meneguele)
  - KVM: SVM: Clear the CR4 register on reset (Vitaly Kuznetsov) [1920788]
  - net: flow_offload: Add original direction flag to ct_metadata (Marcelo Ricardo Leitner) [1921946]
  - net/sched: cls_flower: Add match on the ct_state reply flag (Marcelo Ricardo Leitner) [1921946]
  - net/sched: cls_flower add CT_FLAGS_INVALID flag support (Marcelo Ricardo Leitner) [1921946]
  - net/sched: cls_flower: Reject invalid ct_state flags rules (Marcelo Ricardo Leitner) [1921946]
  - netlink: add mask validation (Marcelo Ricardo Leitner) [1921946]
  - netlink: create helpers for checking type is an int (Marcelo Ricardo Leitner) [1921946]
  - netlink: policy: correct validation type check (Marcelo Ricardo Leitner) [1921946]
  - netlink: make NLA_BINARY validation more flexible (Marcelo Ricardo Leitner) [1921946]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-301.el8]
changelog:
  - ibmvnic: fix a race between open and reset (Diego Domingos) [1940042]
  - ibmvnic: Set to CLOSED state even on error (Diego Domingos) [1940042]
  - ibmvnic: device remove has higher precedence over reset (Diego Domingos) [1940042]
  - ibmvnic: merge do_change_param_reset into do_reset (Diego Domingos) [1940042]
  - ibmvfc: disable MQ channelization by default (Gustavo Luiz Duarte) [1939359]
  - pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() (Steve Dickson) [1926945]
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930833] {CVE-2021-27365}
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930856] {CVE-2021-27363}
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1930809] {CVE-2021-27364}
  - futex: Handle faults correctly for PI futexes (Waiman Long) [1924635]
  - futex: Simplify fixup_pi_state_owner() (Waiman Long) [1924635]
  - futex: Use pi_state_update_owner() in put_pi_state() (Waiman Long) [1924635]
  - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Waiman Long) [1924635]
  - futex: Provide and use pi_state_update_owner() (Waiman Long) [1924635]
  - futex: Replace pointless printk in fixup_owner() (Waiman Long) [1924635]
  - futex: Ensure the correct return value from futex_lock_pi() (Waiman Long) [1924635]
  - futex: Don't enable IRQs unconditionally in put_pi_state() (Waiman Long) [1924635]
  - futex: Fix incorrect should_fail_futex() handling (Waiman Long) [1924635]
  - futex: Consistently use fshared as boolean (Waiman Long) [1924635]
  - futex: Remove needless goto's (Waiman Long) [1924635]
  - futex: Remove put_futex_key() (Waiman Long) [1924635]
  - NFS: Correct size calculation for create reply length (Benjamin Coddington) [1934903]
  - SUNRPC: Set memalloc_nofs_save() for sync tasks (Benjamin Coddington) [1934098]
  - net/mlx5: CT: Add support for matching on ct_state reply flag (Alaa Hleihel) [1919651]
  - net/mlx5e: CT: manage the lifetime of the ct entry object (Alaa Hleihel) [1919651]
  - net/mlx5e: CT: Use per flow counter when CT flow accounting is enabled (Alaa Hleihel) [1919651]
  - net/mlx5e: Fix a use after free on error in mlx5_tc_ct_shared_counter_get() (Alaa Hleihel) [1919651]
  - net/mlx5e: CT: Use the same counter for both directions (Alaa Hleihel) [1919651]
  - ethtool: fix the check logic of at least one channel for RX/TX (Ivan Vecera) [1907406]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-302.el8]
changelog:
  - PCI: rpadlpar: Fix potential drc_name corruption in store functions (Gustavo Luiz Duarte) [1938116]
  - selftests: kvm: Add basic Hyper-V clocksources tests (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Don't touch TSC page values when guest opted for re-enlightenment (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Track Hyper-V TSC page status (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Prevent using not-yet-updated TSC page by secondary CPUs (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Limit guest to writing zero to HV_X64_MSR_TSC_EMULATION_STATUS (Vitaly Kuznetsov) [1931782]
  - drm/i915/guc: Update to use firmware v49.0.1 (Dave Airlie) [1935281] {CVE-2020-12362}
  - time: Enable __kernel_timespec for 32-bit vdso build (Waiman Long) [1936282]
  - lib/idr.c: document calling context for IDA APIs mustn't use locks (Chris von Recklinghausen) [1917764]
  - ida: Free allocated bitmap in error path (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Fix compilation (Chris von Recklinghausen) [1917764]
  - vmalloc: convert to XArray (Chris von Recklinghausen) [1917764]
  - mm: pass addr as unsigned long to vb_free (Chris von Recklinghausen) [1917764]
  - radix tree: Remove multiorder support (Chris von Recklinghausen) [1917764]
  - radix tree test: Convert multiorder tests to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Convert item_delete_rcu to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Convert item_kill_tree to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Move item_insert_order (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Remove multiorder benchmarking (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Remove __item_insert (Chris von Recklinghausen) [1917764]
  - radix tree: Remove radix_tree_clear_tags (Chris von Recklinghausen) [1917764]
  - radix tree: Remove split/join code (Chris von Recklinghausen) [1917764]
  - radix tree: Remove radix_tree_update_node_t (Chris von Recklinghausen) [1917764]
  - mm: Convert truncate to XArray (Chris von Recklinghausen) [1917764]
  - copy rh_kabi.h to tools/testing/radix-tree/linux (Chris von Recklinghausen) [1917764]


author: Daiki Ueno <dueno@redhat.com> - 0.23.21-4
changelog:
  - Fix realloc usage on proxy cleanup (#1894979)
  - Make 'trust anchor --store' preserve all attributes from .p11-kit files


author: Daiki Ueno <dueno@redhat.com> - 0.23.22-1
changelog:
  - Rebase to 0.23.22 to fix memory safety issues (CVE-2020-29361, CVE-2020-29362, and CVE-2020-29363)
  - Preserve DT_NEEDED information from the previous version, flagged by rpmdiff
  - Add xsltproc to BR


author: Martin Pitt <mpitt@redhat.com> - 238.1-1
changelog:
  - Several UI alignment fixes
  - Re-drop unit tests from built packages
  - Metrics: Don't show swap column when no swap is present
  - Metrics: Don't show duplicate events


author: Matej Marusak <mmarusak@redhat.com> - 242-1
changelog:
  - Network: Fix device connection button (rhbz#1946874)
  - Network: Fully show MAC dropdown in add bond dialog (rhbz#1946877)


author: Katerina Koukiou <kkoukiou@redhat.com> - 244.1-1
changelog:
  - Shell: sudo is invoked only when explicitly requested
  - Dynamically manage motd/issue symlinks in package scripts (rhbz#1876848)


author: Martin Pitt <mpitt@redhat.com> - 250-1
changelog:
  - Shell: Improve admin switcher and session menu
  - Update Insights links to point to console.redhat.com (rhbz#1984841)


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-18.el8_4.1
changelog:
  - fix bad connection reuse due to flawed path name checks (CVE-2021-22924)
  - disable metalink support to fix the following vulnerabilities
      CVE-2021-22923 - metalink download sends credentials
      CVE-2021-22922 - wrong content via metalink not discarded


author: Christopher Snyder <csnyder@redhat.com> 1.28.5-1
changelog:
  - removing yarn (jmolet@redhat.com)
  - Revert "1847910: DNF plugins are part of sub-man RPM, libdnf RPM; ENT-2536"
    (csnyder@redhat.com)
  - 1886745: Fix __init__ of CPProvider; ENT-3147 (jhnidek@redhat.com)
  - 1833316: unset-addons argument is missing in the bash completion of
    syspurpose (wpoteat@redhat.com)
  - 1875595: Service-Level set issues (wpoteat@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.28.6-1
changelog:
  - 1850624: Uncaught JSONDecodeError when content_access.json is empty and
    registering to Satellite6 (wpoteat@redhat.com)
  - 1831082: Better messages for attach --auto for SCA mode; ENT-3175
    (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.28.7-1
changelog:
  - 1855437: Fixed rpm dependency of subscription-manager; ENT-3250 (#2365)
    (jhnidek@redhat.com)
  - 1894450: Fix issue with identity command; ENT-3235 (#2364)
    (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.28.8-1
changelog:
  - 1904541: subscription-manager should not prompt for "Organization" when only
    one organization (#2372) (wpoteat@redhat.com)
  - 1801570: drop scrollkeeper/rarian as a dependency from rhsm-gtk
    (csnyder@redhat.com)


author: William Poteat <wpoteat@redhat.com> 1.28.10-1
changelog:
  - Use python3-requests and not python-requests. (jhnidek@redhat.com)
  - ENT-3289: automatic registration on public cloud (#2407) (jhnidek@redhat.com)
  - ENT-3191: Collect metadata of cloud providers (#2381) (jhnidek@redhat.com)
  - Detecting of cloud providers; ENT-3288 (#2367) (jhnidek@redhat.com)
  - 1899677: Extract of strings for translations (#2399) (wpoteat@redhat.com)
  - Syntax update to translation commands (#2395) (wpoteat@redhat.com)
  - Update project to use Weblate for translations (#2388) (wpoteat@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.28.11-1
changelog:
  - Translated using Weblate (Japanese) (suanand@redhat.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (suanand@redhat.com)
  - 1922173: Repeat auto-register only, when first attempt fail (#2420)
    (jhnidek@redhat.com)


author: Christopher Snyder <csnyder@redhat.com> 1.28.13-1
changelog:
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (suanand@redhat.com)
  - Translated using Weblate (Chinese (Traditional) (zh_TW)) (jsefler@redhat.com)
  - Translated using Weblate (Chinese (Simplified) (zh_CN)) (jsefler@redhat.com)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.30.0-11
changelog:
  - platform: preserve IPv6 multicast route added by kernel (rh #2007264)
  - cloud-setup: don't interfere with other subnets (rh #2007341)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.30.0-12
changelog:
  - initrd: set an IPv4 required-timeout of 20 seconds, to prefer IPv4
    over IPv6 for default connections (rh #1961666)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.56.4-9
changelog:
  - Update GHmac patch to implement g_hmac_copy()
    Resolves: #1786538
  - Update keyfile settings backend
    Resolves: #1728896
  - Fix CVE-2019-13012
    Resolves: #1728632


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.56.4-10
changelog:
  - Fix CVE-2021-27218
    Resolves: #1939072
  - Fix CVE-2021-27219
    Resolves: #1939108
  - Fix CVE-2021-28153
    Resolves: #1939118


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.56.4-13
changelog:
  - Rename and consolidate existing patches for better maintainability
  - Refresh CVE-2021-27219 patcheset, using better-targeted fixes
    Resolves: #1939108


author: - Andy Walsh <awalsh@redhat.com> - 6.2.4.14-74
changelog:
  - Fixed a bug which causes the UDS index to consume an excessive
    number of CPU cycles when the VDO device is idle.
  - Resolves: rhbz#1870660


author: - Andy Walsh <awalsh@redhat.com> - 6.2.4.26-74
changelog:
  - Modified physical growth to validate the new VDO size against the size of
    the underlying storage.
  - Resolves: rhbz#1732922
  - Fixed issues which prevented lvrename from working on lvm managed
    VDO devices.
  - Resolves: rhbz#1888419


author: Jerry Snitselaar <jsnitsel@redhat.com> - 0.3.15-1
changelog:
  - Rebase to 0.3.15
  - Fix CVE-2020-24330 CVE-2020-24331 CVE-2020-24332
  resolves: rhbz#1725782 rhbz#1877517 rhbz#1882402 rhbz#1882414


author: Miroslav Lichvar <mlichvar@redhat.com> 6.1-8.20180224
changelog:
  - fix buffer overflow in terminfo entry hashtable (CVE-2019-17594)
  - handle missing character after backslash in terminfo entry (CVE-2019-17595)


author: Sumit Bose <sbose@redhat.com> - 0.16.3-20
changelog:
  - realmd should handle default_realm in krb5.conf
    Resolves: rhbz#1791016
  - [RFE] Enable LDAPS functionality in realmd join
    Resolves: rhbz#1826964


author: Josef Ridky <jridky@redhat.com> - 1:5.8-19
changelog:
  - revert permission of config files to 600 (#1601060)
  - fix error message when the address specified by clientaddr option
    is wrong or cannot be bound (#1877375)
  - log error with /proc/net/if_inet6 only when IPv6 is enabled (#1824367)
  - fix issue with quoting empty passphrase (#1817225)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.56.4-10
changelog:
  - Fix various problems in GMainContext
    Resolves: #1953553
  - Fix CVE-2021-27219
    Resolves: #1960600


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-15
changelog:
  - Add out-of-bounds checks to hdrblobInit() (#1929445)
  - Fixes CVE-2021-20266
  - Fix regression in brp-strip causing kmods to lose SecureBoot sig (#1967291)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-16
changelog:
  - Add support for read-only sqlite rpmdb (#1938928)
  - Drop compat .decode() method from returned Py3 strings (#1840142)


author: Andreas Schneider <asn@redhat.com> - 4.14.4-2
changelog:
  - resolves: rhbz#1944657 - Update to version 4.14.4
  - resolves: rhbz#1949445 - Fix CVE-2021-20254
  - resolves: rhbz#1947945 - Fix libsmbldap.so.2 not being a symbolic link
  - resolves: rhbz#1908506 - Fix creating the gencache user directory
  - resolves: rhbz#1901029 - Build the vfs_io_uring module


author: Andreas Schneider <asn@redhat.com> - 4.14.4-0
changelog:
  - related: rhbz#1944657 - Update to version 4.14.5
  - resolves: rhbz#1969787 - Fix memory leak in RPC server
  - resolves: rhbz#1954974 - Validate smb.conf option for domain members with testparm
  - resolves: rhbz#1963298 - Fix smbd trying to delete files with wrong permissions
  - resolves: rhbz#1890008 - Update rpcclient manpage to list all available commands
  - resolves: rhbz#1857254 - Update smbcacls manpage to document inhertance flags


author: Andreas Schneider <asn@redhat.com> - 4.14.4-1
changelog:
  - resolves: rhbz#1974792 - Create a subpackage for vfs-io-uring
  - resolves: rhbz#1965397 - Raise log level for dfs ENOENT debug message


author: Katerina Koukiou <kkoukiou@redht.com> - 233.1-1
changelog:
  - Non-admin users no longer see Cockpit in motd (rhbz#1872562)
  - Improved host editing
  - Replace system's graph page with a completely new USE method page
  - Logging of remote IP addresses
  - shell: Any page can be the shell
  - Accounts: Allow setting weak passwords (rhbz#1652390)
  - Terminal: Fix issue with prompt not returning when clicking reset button in disoconnected session (rhbz#1897430)


author: Martin Pitt <mpitt@redhat.com> - 235-1
changelog:
  - Login: Improved handling of SSH host keys
  - Overview: Editable motd
  - Adjust tests for sos 4.x to fix gating tests (rhbz#1895912)


author: Martin Pitt <mpitt@redhat.com> - 238-1
changelog:
  - Web server: Preserve permissions of administrator-provided certificates
  - System: Performance page shows busiest CPU cores


author: David King <dking@redhat.com> - 2.9.7-9.1
changelog:
  - Fix CVE-2021-3516 (#1956975)
  - Fix CVE-2021-3517 (#1957000)
  - Fix CVE-2021-3518 (#1957027)
  - Fix CVE-2021-3537 (#1957283)


author: Honggang Li <honli@redhat.com> - 1.11.1-1
changelog:
  - Rebase to upstream release v1.11.1
  - EFA Support requires libfabric
  - Resolves: bz1831145, bz1852636


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.20.1.el8_4]
changelog:
  - net/mlx5: E-Switch, Allow setting GUID for host PF vport (Alaa Hleihel) [1986837 1967488]
  - net/mlx5: E-Switch, Read PF mac address (Alaa Hleihel) [1986837 1967488]
  - ice: fix Tx queue iteration for Tx timestamp enablement (Ken Cox) [2000128 1999743]
  - ice: restart periodic outputs around time changes (Ken Cox) [1997572 1992750]
  - ice: Fix perout start time rounding (Ken Cox) [1997572 1992750]
  - ice: add support for auxiliary input/output pins (Jonathan Toppins) [1998221 1956913]
  - ice: enable transmit timestamps for E810 devices (Jonathan Toppins) [1998220 1944818]
  - ice: enable receive hardware timestamping (Jonathan Toppins) [1998220 1944818]
  - ice: report the PTP clock index in ethtool .get_ts_info (Jonathan Toppins) [1998220 1944818]
  - ice: register 1588 PTP clock device object for E810 devices (Jonathan Toppins) [1998220 1944818]
  - ice: add low level PTP clock access functions (Jonathan Toppins) [1998220 1944818]
  - ice: add support for set/get of driver-stored firmware parameters (Jonathan Toppins) [1998220 1944818]
  - ice: process 1588 PTP capabilities during initialization (Jonathan Toppins) [1998220 1944818]
  - ice: add support for sideband messages (Jonathan Toppins) [1998220 1944818]
  - ice: Prevent probing virtual functions (Ken Cox) [1997539 1952810]
  - vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU (Gustavo Walbon) [2000602 1891589]
  - powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU (Gustavo Walbon) [2000602 1891589]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.21.1.el8_4]
changelog:
  - HID: make arrays usage and value to be the same (Benjamin Tissoires) [1974941 1974942] {CVE-2021-0512}
  - y2038: remove CONFIG_64BIT_TIME (Waiman Long) [2003569 1965360]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.22.1.el8_4]
changelog:
  - [s390] s390/ap: Fix hanging ioctl caused by wrong msg counter (Claudio Imbrenda) [2002635 1984762]
  - cpuidle: pseries: Do not cap the CEDE0 latency in fixup_cede0_latency() (Diego Domingos) [1997431 1952809]
  - cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards (Diego Domingos) [1997431 1952809]
  - EDAC/amd64: Fix PCI component registration (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId (Aristeu Rozanski) [1982182 1918583]
  - x86/CPU/AMD: Remove amd_get_nb_id() (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Make fam_ops static global (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Allow Reserved types to be overwritten in smca_banks[] (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure() (Aristeu Rozanski) [1982182 1918583]
  - EDAC/amd64: Get rid of the ECC disabled long message (Aristeu Rozanski) [1982182 1918583]
  - EDAC/amd64: Check for memory before fully initializing an instance (Aristeu Rozanski) [1982182 1918583]
  - EDAC/amd64: Use cached data when checking for ECC (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE: Make the number of MCA banks a per-CPU variable (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Don't cache block addresses on SMCA systems (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE: Make mce_banks a per-CPU array (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE: Make struct mce_banks[] static (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Don't report L1 BTB MCA errors on some family 17h models (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Decode MCA_STATUS in bit definition order (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Decode MCA_STATUS[Scrub] bit (Aristeu Rozanski) [1982182 1918583]
  - EDAC, mce_amd: Match error descriptions to latest documentation (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Carve out the MC4_MISC thresholding quirk (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models (Aristeu Rozanski) [1982182 1918583]
  - net: Fix skb->csum update in inet_proto_csum_replace16(). (Balazs Nemeth) [2005980 1975193]
  - RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy (Kamal Heib) [1982040 1931846] {CVE-2020-36385}
  - RDMA/ucma: Fix locking for ctx->events_reported (Kamal Heib) [1982040 1931846] {CVE-2020-36385}
  - RDMA/ucma: Fix the locking of ctx->file (Kamal Heib) [1982040 1931846] {CVE-2020-36385}
  - RDMA/cma: Add missing locking to rdma_accept() (Kamal Heib) [1982040 1931846] {CVE-2020-36385}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.23.1.el8_4]
changelog:
  - CI: handle RT branches in a single config (Veronika Kabatova)
  - CI: Drop private CI config (Veronika Kabatova)
  - CI: extend template use (Veronika Kabatova)
  - xfs: drop unnecessary setfilesize helper (Brian Foster) [2007413 1942348]
  - xfs: drop unused ioend private merge and setfilesize code (Brian Foster) [2007413 1942348]
  - xfs: open code ioend needs workqueue helper (Brian Foster) [2007413 1942348]
  - xfs: drop submit side trans alloc for append ioends (Brian Foster) [2007413 1942348]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.24.1.el8_4]
changelog:
  - lockd: Fix invalid lockowner cast after vfs_test_lock (Benjamin Coddington) [2010820 1986138]
  - e1000e: Do not take care about recovery NVM checksum (Ken Cox) [2002335 1984558]
  - xfs: sync lazy sb accounting on quiesce of read-only mounts (Bill O'Donnell) [2011919 1917220]
  - xfs: remove the unused return value from xfs_log_unmount_write (Bill O'Donnell) [2011919 1917220]
  - powerpc: use stop_machine for partition migration (Frantisek Hrbata) [1993952 1979798]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.25.1.el8_4]
changelog:
  - scsi: ibmvfc: Reinit target retries (Steve Best) [1993892 1965010]
  - scsi: ibmvfc: Avoid move login if fast fail is enabled (Steve Best) [1993892 1965010]
  - scsi: ibmvfc: Handle move login failure (Steve Best) [1993892 1965010]
  - scsi: ibmvfc: Fix invalid state machine BUG_ON() (Steve Best) [1993892 1965010]
  - tpm, tpm_tis: Reserve locality in tpm_tis_resume() (Jerry Snitselaar) [1998219 1920812]
  - tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt() (Jerry Snitselaar) [1998219 1920812]
  - tpm, tpm_tis: Decorate tpm_tis_gen_interrupt() with request_locality() (Jerry Snitselaar) [1998219 1920812]
  - tpm, tpm_tis: Decorate tpm_get_timeouts() with request_locality() (Jerry Snitselaar) [1998219 1920812]
  - tpm_tis: Clean up locality release (Jerry Snitselaar) [1998219 1920812]
  - tpm_tis: Fix check_locality for correct locality acquisition (Jerry Snitselaar) [1998219 1920812]
  - kthread: Fix PF_KTHREAD vs to_kthread() race (Waiman Long) [2010331 2001497]
  - sched/fair: Ignore percpu threads for imbalance pulls (Waiman Long) [2010331 2001497]
  - kthread: Extract KTHREAD_IS_PER_CPU (Waiman Long) [2010331 2001497]
  - sched: Optimize finish_lock_switch() (Waiman Long) [2010331 2001497]
  - sched/hotplug: Ensure only per-cpu kthreads run during hotplug (Waiman Long) [2010331 2001497]
  - sched: Fix balance_callback() (Waiman Long) [2010331 2001497]
  - net/sched: store the last executed chain also for clsact egress (Davide Caratti) [1992230 1980537]


author: Jiri Kucera <jkucera@redhat.com> - 1.113-2
changelog:
  - Fix typo in pam-panel-icon manpage
    Do not use deprecated selinux API
    Do not use fexecve
    Resolves: #1775931


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.10.2.el8_4]
changelog:
  - seq_file: Disallow extremely large seq buffer allocations (Ian Kent) [1975181 1975182] {CVE-2021-33909}


author: Karel Zak <kzak@redhat.com> 2.32.1-25
changelog:
  - fix #1884194 - RHEL-8: chrt command does not support the -R option
  - fix #1855759 - mount.8: clarify (no)suid behavior on file capabilities
  - fix #1861670 - lsblk can not show serial information for virtio disk
  - fix #1883783 - lscpu: avoid segfault on PowerPC systems with valid hardware configurations
  - fix #1900498 - libfdisk/libmount: backport two patches for upstream systemd
  - fix #1883056 - lscpu support for Fujitsu A64FX
  - fix #1882740 - lscpu: use SMBIOS Type 4 strings for CPU vendor and model on ARM


author: Mark Wielaard <mjw@redhat.com> - 0.182-1
changelog:
  - Upgrade to upstream 0.182
    - backends: Support for tilegx has been removed.
    - config: New /etc/profile.d files to provide default $DEBUGINFOD_URLS.
    - debuginfod: More efficient package traversal, tolerate various
      errors during scanning, grooming progress is more visible and
      interruptible, more prometheus metrics.
    - debuginfod-client: Now supports compressed (kernel) ELF images.
    - libdwfl: Add ZSTD compression support.


author: Vladis Dronov <vdronov@redhat.com> - 6.8-4
changelog:
  - There is no need to hardcode _sbindir anymore, also the old value is incorrect
  - Update the rngd.service file
  - Fix a busyloop bug (bz 1956248)
  - Fix /dev/hwrng permission issue (bz 1955522)


author: Than Ngo <than@redhat.com> - 3.15.1-7
changelog:
  - Resolves: #1995919, pkcstok_migrate leaves options with multiple strings in opencryptoki.conf options without double-quotes


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-10
changelog:
  - python/semanage: Sort imports in alphabetical order
  - python/semanage: empty stdout before exiting on BrokenPipeError (#1822100)


author: Ondrej Kozina <okozina@redhat.com> - 2.3.3-4
changelog:
  - patch: Fix reencryption for custom devices with data segments
    set to use cipher_null.
  - Resolves: #1927409


author: systemd maintenance team <systemd-maint@redhat.com> - 239-45
changelog:
  - Revert "test: add test cases for empty string match" and "test: add test case for multi matches when use ||" (#1935124)
  - test/sys-script.py: add missing DEVNAME entries to uevents (#1935124)
  - sd-event: split out helper functions for reshuffling prioqs (#1937315)
  - sd-event: split out enable and disable codepaths from sd_event_source_set_enabled() (#1937315)
  - sd-event: mention that two debug logged events are ignored (#1937315)
  - sd-event: split clock data allocation out of sd_event_add_time() (#1937315)
  - sd-event: split out code to add/remove timer event sources to earliest/latest prioq (#1937315)
  - sd-event: fix delays assert brain-o (#17790) (#1937315)
  - sd-event: let's suffix last_run/last_log with "_usec" (#1937315)
  - sd-event: refuse running default event loops in any other thread than the one they are default for (#1937315)
  - sd-event: ref event loop while in sd_event_prepare() ot sd_event_run() (#1937315)
  - sd-event: follow coding style with naming return parameter (#1937315)
  - sd-event: remove earliest_index/latest_index into common part of event source objects (#1937315)
  - sd-event: update state at the end in event_source_enable (#1937315)
  - sd-event: increase n_enabled_child_sources just once (#1937315)
  - sd-event: add ability to ratelimit event sources (#1937315)
  - test: add ratelimiting test (#1937315)
  - core: prevent excessive /proc/self/mountinfo parsing (#1937315)
  - udev: run link_update() with increased retry count in second invocation (#1935124)
  - pam-systemd: use secure_getenv() rather than getenv() (#1936866)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-46
changelog:
  - Revert "udev: run link_update() with increased retry count in second invocation" (#1942299)
  - Revert "udev: make algorithm that selects highest priority devlink less susceptible to race conditions" (#1942299)
  - test/udev-test.pl: drop test cases that add mutliple devices (#1942299)


author: Jan Macku <jamacku@redhat.com> - 239-47
changelog:
  - systemd-binfmt: Add safeguard in triggers (#1787144)
  - spec: Requires(post) openssl-libs to fix missing /etc/machine-id (#1947438)
  - spec: Go back to using systemctl preset-all in post (#1783263, #1647172, #1118740)
  - spec: Disable libiptc support (#1817265)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-48
changelog:
  - cgroup: Also set io.bfq.weight (#1927290)
  - seccomp: allow turning off of seccomp filtering via env var (#1916835)
  - meson: remove strange dep that causes meson to enter infinite loop (#1970860)
  - copy: handle copy_file_range() weirdness on procfs/sysfs (#1970860)
  - core: Hide "Deactivated successfully" message (#1954802)
  - util: rework in_initrd() to make use of path_is_temporary_fs() (#1959339)
  - initrd: extend SYSTEMD_IN_INITRD to accept non-ramfs rootfs (#1959339)
  - initrd: do a debug log if failed to detect rootfs type (#1959339)
  - initrd: do a debug log if /etc/initrd-release doesn't take effect (#1959339)
  - units: assign user-runtime-dir@.service to user-%i.slice (#1946453)
  - units: order user-runtime-dir@.service after systemd-user-sessions.service (#1946453)
  - units: make sure user-runtime-dir@.service is Type=oneshot (#1946453)
  - user-runtime-dir: downgrade a few log messages to LOG_DEBUG that we ignore (#1946453)
  - shared/install: Preserve escape characters for escaped unit names (#1952686)
  - basic/virt: Detect PowerVM hypervisor (#1937989)
  - man: document differences in clean exit status for Type=oneshot (#1940078)
  - busctl: add a timestamp to the output of the busctl monitor command (#1909214)
  - basic/cap-list: parse/print numerical capabilities (#1946943)
  - shared/mount-util: convert to libmount (#1885143)
  - mount-util: bind_remount: avoid calling statvfs (#1885143)
  - mount-util: use UMOUNT_NOFOLLOW in recursive umounter (#1885143)
  - test-install-root: create referenced targets (#1835351)
  - install: warn if WantedBy targets don't exist (#1835351)
  - test-install-root: add test for unknown WantedBy= target (#1835351)
  - ceph is a network filesystem (#1952013)
  - sysctl: set kernel.core_pipe_limit=16 (#1949729)
  - core: don't drop timer expired but not yet processed when system date is changed (#1899402)
  - core: Detect initial timer state from serialized data (#1899402)
  - rc-local: order after network-online.target (#1934028)
  - set core ulimit to 0 like on RHEL-7 (#1905582)
  - test-mountpointutil-util: do not assert in test_mnt_id() (#1910425)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-49
changelog:
  - remove a left-over break (#1970860)
  - basic/unit-name: do not use strdupa() on a path (#1974700)
  - sd-event: change ordering of pending/ratelimited events (#1968528)
  - sd-event: drop unnecessary "else" (#1968528)
  - sd-event: use CMP() macro (#1968528)
  - sd-event: use usec_add() (#1968528)
  - sd-event: make event_source_time_prioq_reshuffle() accept all event source type (#1968528)
  - sd-event: always reshuffle time prioq on changing online/offline state (#1968528)
  - ci: run unit tests on z-stream branches as well (#1970860)
  - ci: drop forgotten Travis references (#1934504)
  - ci: run unit tests on CentOS 8 Stream as well (#1934504)
  - ci: add missing test dependencies (#1934504)
  - meson: bump timeout for test-udev to 180s (#1934504)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-50
changelog:
  - Added option --check-inhibitors for non-tty usage (#1269726)
  - logind: Introduce RebootWithFlags and others (#1269726)
  - logind: add …WithFlags methods to policy (#1269726)
  - logind: simplify flags handling a bit (#1269726)
  - Update link to RHEL documentation (#1982584)
  - Set default core ulimit to 0, but keep the hard limit ulimited (#1905582)
  - shared/seccomp-util: address family filtering is broken on ppc (#1982650)
  - logind: rework Seat/Session/User object allocation and freeing a bit (#1642460)
  - logind: fix serialization/deserialization of user's "display session" (#1642460)
  - logind: turn of stdio locking when writing session files too (#1642460)
  - units: set StopWhenUnneeded= for the user slice units too (#1642460)
  - units: improve Description= string a bit (#1642460)
  - logind: improve logging in manager_connect_console() (#1642460)
  - logind: save/restore User object's "stopping" field during restarts (#1642460)
  - logind: correct bad clean-up path (#1642460)
  - logind: fix bad error propagation (#1642460)
  - logind: never elect a session that is stopping as display (#1642460)
  - logind: introduce little helper that checks whether a session is ready (#1642460)
  - logind: propagate session stop errors (#1642460)
  - logind: rework how we manage the slice and user-runtime-dir@.service unit for each user (#1642460)
  - logind: optionally, keep the user@.service instance for eached logged in user around for a while (#1642460)
  - logind: add a RequiresMountsFor= dependency from the session scope unit to the home directory of the user (#1642460)
  - logind: improve error propagation of user_check_linger_file() (#1642460)
  - logind: automatically GC lingering users for who now user@.service (nor slice, not runtime dir service) is running anymore (#1642460)
  - pam_systemd: simplify code which with we set environment variables (#1642460)
  - logind: validate /run/user/1000 before we set it (#1642460)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51
changelog:
  - define newly needed constants (#1850986)
  - sd-netlink: support IFLA_PROP_LIST and IFLA_ALT_IFNAME attributes (#1850986)
  - sd-netlink: introduce sd_netlink_message_read_strv() (#1850986)
  - sd-netlink: introduce sd_netlink_message_append_strv() (#1850986)
  - test: add a test for sd_netlink_message_{append,read}_strv() (#1850986)
  - util: introduce ifname_valid_full() (#1850986)
  - rename function (#1850986)
  - udev: support AlternativeName= setting in .link file (#1850986)
  - network: make Name= in [Match] support alternative names of interfaces (#1850986)
  - udev: extend the length of ID_NET_NAME_XXX= to ALTIFNAMSIZ (#1850986)
  - udev: do not fail if kernel does not support alternative names (#1850986)
  - udev: introduce AlternativeNamesPolicy= setting (#1850986)
  - network: set AlternativeNamesPolicy= in 99-default.link (#1850986)
  - random-util: call initialize_srand() after fork() (#1850986)
  - sd-netlink: introduce rtnl_resolve_link_alternative_names() (#1850986)
  - udev: sort alternative names (#1850986)
  - netlink: introduce rtnl_get/delete_link_alternative_names() (#1850986)
  - netlink: do not fail when new interface name is already used as an alternative name (#1850986)
  - udev: do not try to reassign alternative names (#1850986)
  - Fix LGTM build (#1850986)
  - sd-hwdb: allow empty properties (#1930568)
  - Update hwdb (#1930568)


author: Karel Zak <kzak@redhat.com> 2.32.1-28
changelog:
  - fix #1906157 - after su from root to a normal user mesg is unable to show current status
  - fix #1917852 - findmnt: add option to list all fs-independent flags
  - fix #1922299 - throws error using /sbin/nologin: invalid option -- 'c'
  - fix #1940607 - lsblk sometimes returns block devices in wrong order with --pairs
  - fix #1919529 - [RFE] RHEL-8: Support option flags with mount(8) --bind
  - fix #1946921 - RHEL8: mount --rbind -o rprivate doesn't do recursive bind mount


author: Lukas Nykryn <lnykryn@redhat.com> - 049-127.git20210107
changelog:
  - match the whole string
  - match simplified rd.zfcp format too
  - base: hardcode rhel red
  - 95iscsi:
  - iscsi: fix error messages with iSCSI root
  - 95nvmf: add module for NVMe-oF
  - Write dns values passed by ip argument to ifcfg-* files
  - dracut.sh: added help for --regenerate-all
  - 35network-legacy: fix classless static route parsing
  - network: fix glob matching ipv6 addresses
  - dasd: only install /etc/dasd.conf if present
  - 90multipath: install kpartx's 11-dm-parts.rules
  - network/net-lib.sh: Configure all iBFT interfaces
  - Change the order of NFS servers during the boot NFS server
  - install: string_hash_func should not be fed with NULL
  - Consider also drm_dev_register when looking for gpu driver
  - fix graphics startup failure with the rhgb paramter in
  - Configure the runner for team interfaces
  - network-manager: set kernel hostname from the command line
  - 95nvmf: add NVMe over TCP support
  - 95fcoe: Add the rd.nofcoe option to disable the FCoE module
  - 04watchdog: split the watchdog module install
  - dracut.spec: include the 04watchdog-modules module
  - 95fcoe: ensure needed modules are installed


author: Lukas Nykryn <lnykryn@redhat.com> - 049-131.git20210107
changelog:
  - 00systemd: when putting systemd-vconsole-setup.service as a
  - 51-dracut-rescue.install: Don't use BLS fragment shipped by


author: Lukas Nykryn <lnykryn@redhat.com> - 049-133.git20210112
changelog:
  - 95fcoe: Fix startup when fcoe module is included
  - Fix pre-trigger stage by replacing exit with return in


author: Steve Dickson <steved@redhat.com> 2.3.3-42
changelog:
  - gssd: Add options to allow for the use of ~/.k5identity file (bz 1868087)
  - man: Correct gssd(8) description of rpc-timeout and context-timeout (bz 1908232)
  - exportfs: fix unexporting of '/' (bz 1944119)


author: Steve Dickson <steved@redhat.com> 2.3.3-44
changelog:
  - gssd: Deal with failed thread creation (bz 1981400)
  - gssd: Add timeout for upcall threads (bz 1981403)
  - gssd: Cleaned up debug messages (bz 1961056)
  - spec: Updated description of the nfs-utils rpm (bz 1981419)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.0.31-3
changelog:
  - Resolve issues found by rpmdiff
    - add explicit Requires: on subpackages to avoid the need to test
      interoperability between the various combinations of old and new
      subpackages
    - add code to restore binary compatibility in libIPMIlanserv.so
      and libOpenIPMIcmdlang.so broken in 2.0.31, while keeping
      compatibility with 2.0.31 as well.


author: Nicola Sella <nsella@redhat.com> - 0.55.0-1
changelog:
  - Add vendor to dnf API (RhBug:1876561)
  - Add formatting function for solver error
  - Add error types in ModulePackageContainer
  - Implement module enable for context part
  - Improve string formatting for translation
  - Remove redundant printf and change logging info to notice (RhBug:1827424)
  - Add allow_vendor_change option (RhBug:1788371) (RhBug:1788371)


author: Nicola Sella <nsella@redhat.com> - 0.55.0-3
changelog:
  - Avoid multilib file conflict in config.h (RhBug:1918818)
  - [modules] Add special handling for src artifacts (RhBug:1809314)


author: Nicola Sella <nsella@redhat.com> - 0.55.0-4
changelog:
  - [context] improve retrieving repository configuration
  - Allow loading incomplete cache and loading ext solv files without its repodata


author: Marian Csontos <mcsontos@redhat.com> - 2.03.12-3
changelog:
  - Allow extending thin-pool data with writecache on top.
  - Fix removing thin-pool data converted to writeache.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.12-4
changelog:
  - Fix conversion of writecache LVs to thin pool data volume.
  - Add deviceidtype option for lvmdevices.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.12-6
changelog:
  - Fix handling of pmspare by vgsplit, vgmerge and vgremove.
  - Fix detection of active components of external origin volume.


author: Artem Egorenkov <aegorenk@redhat.com> - 3.4.0-23
changelog:
  - New flag for no sensors added. This flag is used in VM environment
    to make sensors binaries not fail if no sensors was detected.


author: Petr Pisar <ppisar@redhat.com> - 8.42-5
changelog:
  - Fix CVE-2019-20838 (a subject buffer overread in JIT when UTF is disabled
    and \X or \R has a greater than 1 fixed quantifier) (bug #1852252)
  - Fix CVE-2020-14155 (an integer overflow when parsing numbers after "(?C"))
    (bug #1851552)


author: Sumit Bose <sbose@redhat.com> - 0.8.2-8
changelog:
  - Add --use-ldaps option to adcli update as well [#1883467]
  - Cannot join a pre-staged Computer Account on AD in Custom OU using Delegated
    user [#1734764]
  - missing documentation for required AD rights for adcli join and net
    join [#1852080]
  - [RFE] Add new mode to just create an AD account to be able to connect to
    LDAP [#1854112]


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-6
changelog:
  - Add 0039-libmultipath-factor-out-code-to-get-vpd-page-data.patch
  - Add 0040-libmultipath-limit-reading-0xc9-vpd-page.patch
    * Only check for rdac support on configured devices, or devices where
      vpd page 0x00 indicates support for vpd page 0xc9
    * Fixes bz #1877415
  - Add 0041-libmultipath-add-device-to-hwtable.c.patch
    * Add support for Fujitsu Eternus AB/HB
    * Fixes bz #1857429
  - Add 0042-libmultipath-move-fast_io_fail-defines-to-structs.h.patch
  - Add 0043-libmultipath-add-eh_deadline-multipath.conf-paramete.patch
    * Fixes bz #1819897
  - Add 0044-libmultipath-don-t-dlclose-tur-checker-DSO.patch
    * Fixes bz #1875384
  - Add 0045-libmultipath-warn-about-missing-braces-at-end-of-mul.patch
    * Fixes bz #1897530
  - Add 0046-libmultipath-ignore-multipaths-sections-without-wwid.patch
    * Fixes bz #1897815
  - Add 0047-tests-fix-missing-priority-blacklist-test.patch
  - Add 0048-mpathpersist-Fix-Register-and-Ignore-with-0x00-SARK.patch
    * Make mpathpersist Register and Ignore command clear the registration
      with a 0x0 SARK, like sg_persist does.
    * Fixes bz #1894103
  - Add 0049-mpathpersist-update-prkeys-file-on-changing-registra.patch
    * Fixes bz #1900522
    * The above 11 patches have all been submitted upstream
  - Resolves: bz #1819897, #1857429, #1875384, #1877415, #1894103, #1897530
  - Resolves: bz #1897815, #1900522


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-6
changelog:
  - Add 0050-multipathd-Fix-multipathd-stopping-on-shutdown.patch
    * Fixes bz #1892496
  - Add 0051-multipath.conf.5-Improve-checker_timeout-description.patch
    * Fixes bz #1906073
  - Resolves: bz #1892496, #1906073


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-7
changelog:
  - Add 0052-libmultipath-check-for-null-wwid-before-strcmp.patch
    * Missing part of fix for bz #1897815
  - Add 0053-libmultipath-make-find_err_path_by_dev-static.patch
  - Add 0054-multipathd-avoid-io_err_stat-crash-during-shutdown.patch
  - Add 0055-multipathd-avoid-io_err_stat-ABBA-deadlock.patch
  - Add 0056-multipathd-use-get_monotonic_time-in-io_err_stat-cod.patch
  - Add 0057-multipathd-combine-free_io_err_stat_path-and-destroy.patch
  - Add 0058-multipathd-cleanup-logging-for-marginal-paths.patch
    * The above 6 patches fix bz #1920795
  - Add 0059-libmpathpersist-fix-thread-safety-of-default-functio.patch
    * Fixes bz #1913549
  - Resolves: bz #1897815, #1913549, #1920795


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-9
changelog:
  - Add 0060-kpartx-free-loop-device-after-listing-partitions.patch
    * Fixes bz #1925490
  - Add 0061-RH-fix-find_multipaths-in-mpathconf.patch
    * Fixes bz #1921651
  - Resolves: bz #1921651, #1925490


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-10
changelog:
  - Add 0062-libmultipath-select_action-don-t-drop-map-if-alias-c.patch
    * Fall back to WWID names instead of removing existing device
  - Add 0063-libmultipath-check-if-user_friendly_name-is-in-use.patch
    * make sure to choose a user_friendly_name that isn't in use
    * Fixes bz #1923777
  - Add alias_clash CI test
  - Resolves: bz #1923777


author: Kamil Dudka <kdudka@redhat.com> - 7.61.1-18.el8_4.2
changelog:
  - fix STARTTLS protocol injection via MITM (CVE-2021-22947)
  - fix protocol downgrade required TLS bypass (CVE-2021-22946)


author: Richard Hughes <richard@hughsie.com> 1.5.9-1
changelog:
  - Rebase to include the SBAT metadata section to allow fixing BootHole
  - Resolves: rhbz#1933010
  - Resolves: rhbz#1932951
  - Resolves: rhbz#1932907
  - Resolves: rhbz#1932880
  - Resolves: rhbz#1932578
  - Resolves: rhbz#1932552
  - Resolves: rhbz#1932422


author: Panu Matilainen <pmatilai@redhat.com> - 1.18-1
changelog:
  - Rebase to popt 1.18 (https://github.com/rpm-software-management/popt/releases/tag/popt-1.18-release)
  - Update URLs to rebooted upstream
  - Clean up ancient cruft from spec, use modern build macros


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-12
changelog:
  - lib/sssd: redirect warning message to file (#1749001)
  - useradd: clarify valid usernames/groupnames (#1869432)
  - login.defs: link login specific information to its own package (#1804766)


author: Tomas Bzatek <tbzatek@redhat.com> - 0.32-1
changelog:
  - Upgrade to 0.32 upstream snapshot (#1855766)
  - Fix NVMe device parsing (#1687841, #1845977)
  - Fix WWN string reporting (#1846559)
  - Implement SCSI identifier sort priority (#1846566)


author: Richard W.M. Jones <rjones@redhat.com> - 1.18-8
changelog:
  - Add support for Nutanix AHV
    resolves: rhbz#1756381
  - Add all patches since 1.18 was released, up to 1.20 and beyond.


author: Vladis Dronov <vdronov@redhat.com> - 6.8-4
changelog:
  - There is no need to hardcode _sbindir anymore, also the old value is
    incorrect
  - Update the rngd.service file
  - Fix a busyloop bug (bz 1956248)
  - Fix /dev/hwrng permission issue (bz 1955522)


author: Vladis Dronov <vdronov@redhat.com> - 6.8-6
changelog:
  - Adjust rngd-wake-threshold.service and post section so udevadm is not
    run in a container (bz 1975554)


author: Vladis Dronov <vdronov@redhat.com> - 6.13-1.git.d207e0b6
changelog:
  - Update to the upstream v6.13 + tip of origin/master + onecpu
    branch + revert of 2ce93190
  - Rebuild rng-tools against the latest jitterentropy library
    3.0.2-2.git.409828cf with fixes for an important issue
  - Fix a number of issues (bz 1974103, bz 1980421, bz 1859154)


author: Sahana Prasad <sahana@redhat.com> 1.1.1g-14
changelog:
  - Fix CVE-2021-3450 openssl: CA certificate check bypass with
    X509_V_FLAG_X509_STRICT
  - Fix CVE-2021-3449 NULL pointer deref in signature_algorithms processing


author: Daiki Ueno <dueno@redhat.com> 1.1.1g-16
changelog:
  - Use AI_ADDRCONFIG only when explicit host name is given
  - Allow only curves defined in RFC 8446 in TLS 1.3


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:1.1.1k-2
changelog:
  - Fixes FIPS_selftest to work in FIPS mode. Resolves: rhbz#1940085
  - Using safe primes for FIPS DH self-test


author: Sahana Prasad <sahana@redhat.com> - 1:1.1.1k-4
changelog:
  - Fixes bugs in s390x AES code.
  - Uses the first detected address family if IPv6 is not available
  - Reverts the changes in https://github.com/openssl/openssl/pull/13305
    as it introduces a regression if server has a DSA key pair, the handshake fails
    when the protocol is not explicitly set to TLS 1.2. However, if the patch is reverted,
    it has an effect on the "ssl_reject_handshake" feature in nginx. Although, this feature
    will continue to work, TLS 1.3 protocol becomes unavailable/disabled. This is already
    known - https://trac.nginx.org/nginx/ticket/2071#comment:1
    As per https://github.com/openssl/openssl/issues/16075#issuecomment-879939938, nginx
    could early callback instead of servername callback.
  - Resolves: rhbz#1978214
  - Related: rhbz#1934534


author: Jakub Martisko <jamartis@redhat.com> - 6.0-45
changelog:
  Fix a false positive zipbomb detection
  Related: 1954649
  Related: 1953565
  Related: 1969876
  Resolves: 1970326


author: Pavla Kratochvilova <pkratoch@redhat.com> - 3.8.0-1
changelog:
  - Update to 3.8.0
  - Don't set default value of "assumeyes" to TRUE
  - Support for user confirmation and assumeyes, assumeno, defaultyes
  - Add commands: distro-sync, makecache
  - Add subcommands support
  - Add support for command aliases
  - Added alias "update" to "upgrade" command
  - Relicense to GPLv2+
  - Add support for setting allow_vendor_change
  - [download] Support for "--resolve", "--alldeps" and "--archlist=" arguments
  - [download] several optimizations
  - Support "--setopt=keepcache=0/1"
  - Extend "--setopt" to support repository options


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-11
changelog:
  - Add 0062-libmultipath-select_action-don-t-drop-map-if-alias-c.patch
    * Fall back to WWID names instead of removing existing device
  - Add 0063-libmultipath-check-if-user_friendly_name-is-in-use.patch
    * make sure to choose a user_friendly_name that isn't in use
    * Fixes bz #1937832
  - Add alias_clash CI test
  - Remove unused multipath.conf
  - Resolves: bz #1937832


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-12
changelog:
  - Add 0064-libmultipath-check-udev_device_get_-return-value-to-.patch
    * Fixes bz #1946940
  - Resolves: bz #1946940


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-13
changelog:
  - Add 0065-libmultipath-cleanup-code-to-strip-wwid-trailing-spa.patch
  - Add 0066-multipathd-add-recheck_wwid-option-to-verify-the-pat.patch
  - Add 0067-libmultipath-avoid-infinite-loop-with-bad-vpd-page-8.patch
  - Add 0068-libmultipath-fix-priorities-in-parse_vpd_pg83.patch
  - Add 0069-RH-make-parse_vpd_pg83-match-scsi_id-output.patch
  - Add 0070-multipathd-improve-getting-parent-udevice-in-rescan_.patch
  - Add 0071-multipathd-don-t-trigger-uevent-for-partitions-on-ww.patch
    * add recheck_wwid option
    * Fixes bz #1907904
  - Resolves: bz #1907904


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-17
changelog:
  - Add 0074-mpathpersist-fail-commands-when-no-usable-paths-exis.patch
    * Fixes bz #1984723
  - Add 0075-multipath-print-warning-if-multipathd-is-not-running.patch
    * Fixes bz #1973592
  - Add 0076-multipathd-don-t-access-path-if-it-was-deleted.patch
    * Found by coverity
  - Resolves: bz #1973592, #1984723


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.0.1763-16
changelog:
  - 2004974 - CVE-2021-3796 vim: use-after-free in nv_replace() in normal.c [rhel-8.5.0]
  - 2004891 - CVE-2021-3778 vim: heap-based buffer overflow in utf_ptr2char() in mbyte.c [rhel-8.5.0]


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.10.1-3
changelog:
  - Replace arch-dependent /usr/include/urcu/config.h with arch-independent
    stub when needed. (bz #1853168)
  - Added CI gating tests (bz #1682555)
  - Resolves: bz #1682555, #1853168


author: Christopher Snyder <csnyder@redhat.com> 1.28.13-4
changelog:
  - 1993897 - [RFE] subscription-manager should return a module stream's
    "activity" in the modular profile (wpoteat@redhat.com)


author: Bill O'Donnell <billodo@redhat.com> 5.0.0-6
changelog:
  - xfs_repair: improve AG btree ptr validation (libxfs_verify_agbno) (#1887288)
  - mkfs.xfs: fix ASSERT on too-small device with stripe geometry (#1887401)
  - xfs_repair: fix rebuilding btree block less than minrecs (#1759452)


author: Bill O'Donnell <billodo@redhat.com> 5.0.0-7
changelog:
  - xfs_quota: document how the default quota is stored (#1850188)
  - xfs_db: skip type change if type_f unchanged (#1867474)


author: Ian Kent <ikent@redhat.com> - 5.1.4-44
changelog:
  - bz1858742 - autofs share doesn't mount when using nobind over RDMA where
    nfs-server and nfs-client are the same systems.
    - mount_nfs.c fix local rdma share not mounting.
  -Resolves: rhbz#1858742


author: Ian Kent <ikent@redhat.com> - 5.1.4-45
changelog:
  - bz1664561 - incorrect of start service command in autofs man page
    - fix incorrect systemctl command syntax in autofs(8).
  -Resolves: rhbz#1664561


author: Ian Kent <ikent@redhat.com> - 5.1.4-46
changelog:
  - bz1664561 - incorrect of start service command in autofs man page
    - actually apply fix patch.
  - fix dates and recent status messages in changelog.
  -Related: rhbz#1664561 rhbz#1858742


author: Ian Kent <ikent@redhat.com> - 5.1.4-47
changelog:
  - bz1887681 - automount force unlink option (-F) does not work as expected
    on autofs-5.0.7-109.el7
    - fix direct mount unlink_mount_tree() path.
    - fix unlink mounts umount order.
    - fix incorrect logical compare in unlink_mount_tree().
    - use bit flag for force unlink mounts.
    - improve force unlink mounts option description.
    - remove logpri fifo on autofs mount fail.
    - add force unlink mounts and exit option.
    - cleanup stale logpri fifo pipes on unlink and exit.
  - Resolves: rhbz#1887681


author: Ian Kent <ikent@redhat.com> - 5.1.4-48
changelog:
  - bz1892184 - autofs: return a connection failure until maps have been fetched
    - fix lookup_nss_read_master() nsswicth check return.
    - fix typo in open_sss_lib().
    - fix sss_master_map_wait timing.
    - add sss ECONREFUSED return handling.
    - use mapname in sss context for setautomntent().
    - add support for new sss autofs proto version call.
    - fix retries check in setautomntent_wait().
    - refactor sss setautomntent().
    - improve sss setautomntent() error handling.
    - refactor sss getautomntent().
    - improve sss getautomntent() error handling.
    - sss introduce calculate_retry_count() function.
    - move readall into struct master.
    - sss introduce a flag to indicate map being read.
    - update sss timeout documentation.
    - refactor sss getautomntbyname().
    - improve sss getautomntbyname() error handling.
    - use a valid timeout in lookup_prune_one_cache().
    - dont prune offset map entries.
    - simplify sss source stale check.
  - Resolves: rhbz#1892184


author: Phil Sutter <psutter@redhat.com> - 1.8.4-18
changelog:
  - xtables-translate: Fix translation of odd netmasks
  - nft: Fix bitwise expression avoidance detection
  - xtables-monitor: 'LL=0x304' is not very convenient, print LOOPBACK instead.
  - xtables-monitor: print packet first
  - xtables-monitor: fix packet family protocol
  - xtables-monitor: fix rule printing
  - xtables-monitor: Fix ip6tables rule printing


author: Phil Sutter <psutter@redhat.com> - 1.8.4-20
changelog:
  - extensions: SECMARK: Use a better context in test case
  - extensions: sctp: Translate --chunk-types option
  - extensions: sctp: Fix nftables translation
  - extensions: SECMARK: Implement revision 1
  - nft: cache: Retry if kernel returns EINTR


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-3
changelog:
  - fix p2p_listen unexpectedly stopped after 5 seconds (rh #1693684)
  - allow changing 'bridge' via D-Bus (rh #1888050)
  - expose OWE configurability via D-Bus (rh #1888718)


author: Davide Caratti <dcaratti@redhat.com> - 1:2.9-5
changelog:
  - P2P: Fix a corner case in peer addition based on PD Request (CVE-2021-27803)
  - Fix buffer overflow when processing P2P group information (CVE-2021-0326)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.0-1
changelog:
  - Update to 0.62.0
  - Hardening: add signature check with rpmcliVerifySignatures (RhBug:1932079)
  - Support allow_vendor_change setting in dnf context API
  - Add a new option module_obsoletes
  - Add new API applyObsoletes() function to apply modular obsoletes
  - Do not allow 1 as installonly_limit value (RhBug:1926261)
  - Add a config option to check TLS certificate revocation status (using OCSP stapling), defaults to false (RhBug:1814383)
  - Swdb: Add a method to get the current transaction
  - [context,API] Functions for accessing main/global configuration options
  - [context,API] Function for adding setopt
  - Add getter for modular obsoletes from ModuleMetadata
  - Add ModulePackage.getStaticContext() and getRequires()
  - Fix modular queries with the new solver
  - Fix: Fully set ssl in newHandle function
  - [conf] Add options for working with certificates used with proxy
  - Modify module NSVCA parsing - context definition (RhBug:1926771)
  - [context] Fix: dnf_package_is_installonly (RhBug:1928056)
  - Add getApplicablePackages to advisory and isApplicable to advisorymodule
  - Keep isAdvisoryApplicable to preserve API
  - [context] Support config file option "proxy_auth_method", defaults "any"
  - Support main config file options "installonlypkgs" and "protected_packages". Changes behaviour of microdnf and PackageKit.
  - Properly handle multiple collections in updateinfo.xml (RhBug:1804234)
  - Fix a crash when [media] section in .treeinfo is missing for bootable media (RhBug:1946024)
  - Add new dnf_context_module_install() C API


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.0-2
changelog:
  - Fix: dnf_context_module_install: memory leaks
  - covscan: remove unused vars, mark private func static, return values
  - DNF does not fail on non UTF-8 file names in a package


author: Ian Kent <ikent@redhat.com> - 5.1.4-48.el8_4.1
changelog:
  - bz1973888 - autofs: already mounted as other than autofs or failed to unlink
    entry in tree
    - fix empty mounts list return from unlink_mount_tree().
  - Resolves: rhbz#1973888


author: Zoltan Fridrich <zfridric@redhat.com> - 2.26-5
changelog:
  - added CAP_PERFMON, CAP_BPF and CAP_CHECKPOINT_RESTORE capabilities
    resolves: rhbz#1946982 rhbz#1921576


author: Andrea Claudi <aclaudi@redhat.com> [5.9.0-2.el8]
changelog:
  - tc: flower: fix json output with mpls lse (Andrea Claudi) [1885770]
  - tc-mpls: fix manpage example and help message string (Andrea Claudi) [1885770]
  - tc-vlan: fix help and error message strings (Andrea Claudi) [1885770]
  - m_mpls: test the 'mac_push' action after 'modify' (Andrea Claudi) [1885770]
  - m_mpls: add mac_push action (Andrea Claudi) [1885770]
  - m_vlan: add pop_eth and push_eth actions (Andrea Claudi) [1885770]
  - Update kernel headers (Andrea Claudi) [1885770]


author: Peter Jones <pjones@redhat.com> - 1.74-7
changelog:
  - Make gcc use -Wl,-z,now -Wl,-z,relro -pie.  Dunno why the default didn't
    pick this up.
    Resolves: rhbz#1624158


author: Jakub Jelen <jjelen@redhat.com> - 1.8.5-6
changelog:
  - Fix for CVE-2021-33560 (#1971421)
  - Enable HW optimizations in FIPS (#1976137)
  - Performance enchancements for ChaCha20 and Poly1305 (#1855231)


author: Lumír Balhar <lbalhar@redhat.com> - 3.6.8-39
changelog:
  - Security fix for CVE-2021-3733: Denial of service when identifying crafted invalid RFCs
  Resolves: rhbz#1995234


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-39
changelog:
  - 1941437 - cupsd doesn't log job ids when logging into journal
  - 1782216 - Print queue is paused after ipp backend ends with CUPS_BACKEND_STOP
  - 1938384 - CUPS doesn't start if sssd starts after cupsd


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.2.6-40
changelog:
  - 1955964 - PreserveJobHistory doesn't work with seconds
  - 1927452 - CVE-2020-10001 cups: access to uninitialized buffer in ipp.c [rhel-8]


author: Phil Sutter <psutter@redhat.com> [0.9.3-17.el8]
changelog:
  - json: don't leave dangling pointers on hlist (Phil Sutter) [1900565]
  - json: Fix seqnum_to_json() functionality (Phil Sutter) [1900565]
  - json: echo: Speedup seqnum_to_json() (Phil Sutter) [1900565]
  - proto: Fix ARP header field ordering (Phil Sutter) [1896334]
  - proto: add sctp crc32 checksum fixup (Phil Sutter) [1895804]
  - mergesort: unbreak listing with binops (Phil Sutter) [1891790]
  - evaluate: missing datatype definition in implicit_set_declaration() (Phil Sutter) [1877022]
  - evaluate: Perform set evaluation on implicitly declared (anonymous) sets (Phil Sutter) [1877022]
  - src: store expr, not dtype to track data in sets (Phil Sutter) [1877022]


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2:3.5.8-2
changelog:
  - Fixed cleanup crash when processing messages with whitespace only fullname
    Resolves: rhbz#1977732


author: Michal Grzedzicki <mge@fb.com> - 9.54-4
changelog:
  - backport fix for --dco-identify real max sectors calculation from upstream version 9.62 (#1959918)


author: Anna Khaitovich <akhaitov@redhat.com> - 0.13.1-0.3
changelog:
  - Don't package empty /usr/share/doc/json-c
  - Resolves: rhbz#1741076
  - Do not use --enable-rdrand
  - Resolves: rhbz#1806532


author: Phil Sutter <psutter@redhat.com> [0.9.3-19.el8]
changelog:
  - evaluate: Reject quoted strings containing only wildcard (Phil Sutter) [1818117]
  - tests: monitor: use correct $nft value in EXIT trap (Phil Sutter) [1919203]
  - monitor: Fix for use after free when printing map elements (Phil Sutter) [1919203]
  - tests: Disable tests known to fail on RHEL8 (Phil Sutter) [1919203]


author: Phil Sutter <psutter@redhat.com> [0.9.3-20.el8]
changelog:
  - src: Optimize prefix matches on byte-boundaries (Phil Sutter) [1934926]
  - src: Support odd-sized payload matches (Phil Sutter) [1934926]
  - spec: Add an rpminspect.yaml file to steer rpminspect (Phil Sutter) [1962184]
  - spec: Explicitly state dist string in Release tag (Phil Sutter) [1962184]


author: Phil Sutter <psutter@redhat.com> [0.9.3-21.el8]
changelog:
  - tests: shell: Fix bogus testsuite failure with 100Hz (Phil Sutter) [1919203]
  - doc: nft.8: Extend monitor description by trace (Phil Sutter) [1820365]
  - include: missing sctp_chunk.h in Makefile.am (Phil Sutter) [1979334]
  - exthdr: Implement SCTP Chunk matching (Phil Sutter) [1979334]
  - scanner: sctp: Move to own scope (Phil Sutter) [1979334]
  - scanner: introduce start condition stack (Phil Sutter) [1979334]
  - json: Simplify non-tcpopt exthdr printing a bit (Phil Sutter) [1979334]
  - json: tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcpopt: allow to check for presence of any tcp option (Phil Sutter) [1979334]
  - tcpopt: split tcpopt_hdr_fields into per-option enum (Phil Sutter) [1979334]
  - tcpopt: rename noop to nop (Phil Sutter) [1979334]
  - tcpopts: clean up parser -> tcpopt.c plumbing (Phil Sutter) [1979334]
  - parser: merge sack-perm/sack-permitted and maxseg/mss (Phil Sutter) [1979334]
  - tests/py: Move tcpopt.t to any/ directory (Phil Sutter) [1979334]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-339.el8]
changelog:
  - smb2: fix use-after-free in smb2_ioctl_query_info() (Ronnie Sahlberg) [1952781]
  - dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (Mike Snitzer) [1996854]
  - md/raid10: Remove rcu_dereference when it doesn't need rcu lock to protect (Nigel Croxon) [1978115]
  - scsi: csiostor: Mark known unused variable as __always_unused (Raju Rangoju) [1961333]
  - scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() (Raju Rangoju) [1961333]
  - scsi: csiostor: Remove set but not used variable 'rln' (Raju Rangoju) [1961333]
  - scsi: csiostor: Return value not required for csio_dfs_destroy (Raju Rangoju) [1961333]
  - scsi: csiostor: Fix NULL check before debugfs_remove_recursive (Raju Rangoju) [1961333]
  - scsi: csiostor: Don't enable IRQs too early (Raju Rangoju) [1961333]
  - scsi: csiostor: Fix spelling typos (Raju Rangoju) [1961333]
  - scsi: csiostor: Prefer pcie_capability_read_word() (Raju Rangoju) [1961333]
  - scsi: target: cxgbit: Unmap DMA buffer before calling target_execute_cmd() (Raju Rangoju) [1961394]
  - net: Use skb_frag_off accessors (Raju Rangoju) [1961394]
  - net: Use skb accessors in network drivers (Raju Rangoju) [1961394]
  - cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in cxgb4 and ulds (Raju Rangoju) [1961394]
  - scsi: libcxgbi: Fix a use after free in cxgbi_conn_xmit_pdu() (Raju Rangoju) [1961394]
  - scsi: libcxgbi: Use kvzalloc instead of opencoded kzalloc/vzalloc (Raju Rangoju) [1961394]
  - scsi: libcxgbi: Remove unnecessary NULL checks for 'tdata' pointer (Raju Rangoju) [1961394]
  - scsi: cxgb4i: Remove an unnecessary NULL check for 'cconn' pointer (Raju Rangoju) [1961394]
  - scsi: cxgb4i: Clean up a debug printk (Raju Rangoju) [1961394]
  - scsi: cxgb4i: Fix dereference of pointer tdata before it is null checked (Raju Rangoju) [1961394]
  - scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy() (Raju Rangoju) [1961394]
  - scsi: libcxgbi: remove unused function to stop warning (Raju Rangoju) [1961394]
  - scsi: libcxgbi: add a check for NULL pointer in cxgbi_check_route() (Raju Rangoju) [1961394]
  - net/chelsio: Delete drive and module versions (Raju Rangoju) [1961394]
  - chelsio: Replace zero-length array with flexible-array member (Raju Rangoju) [1961394]
  - [netdrv] treewide: prefix header search paths with $(srctree)/ (Raju Rangoju) [1961394]
  - libcxgb: fix incorrect ppmax calculation (Raju Rangoju) [1961394]
  - scsi: cxgb4i: Fix TLS dependency (Raju Rangoju) [1961394]
  - [target] treewide: Use fallthrough pseudo-keyword (Raju Rangoju) [1961394]
  - scsi: cxgb4i: Add support for iSCSI segmentation offload (Raju Rangoju) [1961394]
  - [target] treewide: Use sizeof_field() macro (Raju Rangoju) [1961394]
  - [target] treewide: replace '---help---' in Kconfig files with 'help' (Raju Rangoju) [1961394]
  - scsi: cxgb4i: Remove superfluous null check (Raju Rangoju) [1961394]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-340.el8]
changelog:
  - blk-mq: fix is_flush_rq (Ming Lei) [1992700]
  - blk-mq: fix kernel panic during iterating over flush request (Ming Lei) [1992700]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-341.el8]
changelog:
  - mptcp: Only send extra TCP acks in eligible socket states (Paolo Abeni) [1997178]
  - mptcp: fix possible divide by zero (Paolo Abeni) [1997178]
  - mptcp: drop tx skb cache (Paolo Abeni) [1997178]
  - mptcp: fix memory leak on address flush (Paolo Abeni) [1997178]
  - ice: Only lock to update netdev dev_addr (Michal Schmidt) [1995868]
  - ice: restart periodic outputs around time changes (Ken Cox) [1992750]
  - ice: Fix perout start time rounding (Ken Cox) [1992750]
  - net/sched: ets: fix crash when flipping from 'strict' to 'quantum' (Davide Caratti) [1981184]
  - ovl: prevent private clone if bind mount is not allowed (Miklos Szeredi) [1993131] {CVE-2021-3732}
  - gfs2: Don't call dlm after protocol is unmounted (Bob Peterson) [1997193]
  - gfs2: don't stop reads while withdraw in progress (Bob Peterson) [1997193]
  - gfs2: Mark journal inodes as "don't cache" (Bob Peterson) [1997193]
  - bpf: bpftool: Add -fno-asynchronous-unwind-tables to BPF Clang invocation (Yauheni Kaliuta) [1997124]
  - perf/x86/intel: Apply mid ACK for small core (Michael Petlan) [1838573]
  - perf/x86/intel/lbr: Zero the xstate buffer on allocation (Michael Petlan) [1838573]
  - perf: Fix task context PMU for Hetero (Michael Petlan) [1838573]
  - perf/x86/intel: Fix fixed counter check warning for some Alder Lake (Michael Petlan) [1838573]
  - perf/x86/lbr: Remove cpuc->lbr_xsave allocation from atomic context (Michael Petlan) [1838573]
  - x86/fpu/xstate: Fix an xstate size check warning with architectural LBRs (Michael Petlan) [1838573]
  - perf/x86/rapl: Add support for Intel Alder Lake (Michael Petlan) [1838573]
  - perf/x86/cstate: Add Alder Lake CPU support (Michael Petlan) [1838573]
  - perf/x86/msr: Add Alder Lake CPU support (Michael Petlan) [1838573]
  - perf/x86/intel/uncore: Add Alder Lake support (Michael Petlan) [1838573]
  - perf: Extend PERF_TYPE_HARDWARE and PERF_TYPE_HW_CACHE (Michael Petlan) [1838573]
  - perf/x86/intel: Add Alder Lake Hybrid support (Michael Petlan) [1838573]
  - perf/x86: Support filter_match callback (Michael Petlan) [1838573]
  - perf/x86/intel: Add attr_update for Hybrid PMUs (Michael Petlan) [1838573]
  - perf/x86: Add structures for the attributes of Hybrid PMUs (Michael Petlan) [1838573]
  - perf/x86: Register hybrid PMUs (Michael Petlan) [1838573]
  - perf/x86: Factor out x86_pmu_show_pmu_cap (Michael Petlan) [1838573]
  - perf/x86: Remove temporary pmu assignment in event_init (Michael Petlan) [1838573]
  - perf/x86/intel: Factor out intel_pmu_check_extra_regs (Michael Petlan) [1838573]
  - perf/x86/intel: Factor out intel_pmu_check_event_constraints (Michael Petlan) [1838573]
  - perf/x86/intel: Factor out intel_pmu_check_num_counters (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for extra_regs (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for event constraints (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for hardware cache event (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for unconstrained (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for counters (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for intel_ctrl (Michael Petlan) [1838573]
  - perf/x86/intel: Hybrid PMU support for perf capabilities (Michael Petlan) [1838573]
  - perf/x86: Track pmu in per-CPU cpu_hw_events (Michael Petlan) [1838573]
  - perf/x86/intel/lbr: Support XSAVES for arch LBR read (Michael Petlan) [1838573]
  - perf/x86/intel/lbr: Support XSAVES/XRSTORS for LBR context switch (Michael Petlan) [1838573]
  - x86/fpu/xstate: Add helpers for LBR dynamic supervisor feature (Michael Petlan) [1838573]
  - x86/fpu/xstate: Support dynamic supervisor feature for LBR (Michael Petlan) [1838573]
  - x86/fpu: Use proper mask to replace full instruction mask (Michael Petlan) [1838573]
  - x86/cpu: Add helper function to get the type of the current hybrid CPU (Michael Petlan) [1838573]
  - x86/cpufeatures: Enumerate Intel Hybrid Technology feature bit (Michael Petlan) [1838573]
  - HID: make arrays usage and value to be the same (Benjamin Tissoires) [1974942]
  - ACPI: PM: s2idle: Invert Microsoft UUID entry and exit (David Arcari) [1960440]
  - platform/x86: amd-pmc: Fix undefined reference to __udivdi3 (David Arcari) [1960440]
  - platform/x86: amd-pmc: Fix missing unlock on error in amd_pmc_send_cmd() (David Arcari) [1960440]
  - platform/x86: amd-pmc: Use return code on suspend (David Arcari) [1960440]
  - platform/x86: amd-pmc: Add new acpi id for future PMC controllers (David Arcari) [1960440]
  - platform/x86: amd-pmc: Add support for ACPI ID AMDI0006 (David Arcari) [1960440]
  - platform/x86: amd-pmc: Add support for logging s0ix counters (David Arcari) [1960440]
  - platform/x86: amd-pmc: Add support for logging SMU metrics (David Arcari) [1960440]
  - platform/x86: amd-pmc: call dump registers only once (David Arcari) [1960440]
  - platform/x86: amd-pmc: Fix SMU firmware reporting mechanism (David Arcari) [1960440]
  - platform/x86: amd-pmc: Fix command completion code (David Arcari) [1960440]
  - usb: pci-quirks: disable D3cold on xhci suspend for s2idle on AMD Renoir (David Arcari) [1960440]
  - ACPI: PM: Only mark EC GPE for wakeup on Intel systems (David Arcari) [1960440]
  - ACPI: PM: Adjust behavior for field problems on AMD systems (David Arcari) [1960440]
  - ACPI: PM: s2idle: Add support for new Microsoft UUID (David Arcari) [1960440]
  - ACPI: PM: s2idle: Add support for multiple func mask (David Arcari) [1960440]
  - ACPI: PM: s2idle: Refactor common code (David Arcari) [1960440]
  - ACPI: PM: s2idle: Use correct revision id (David Arcari) [1960440]
  - ACPI: PM: s2idle: Add missing LPS0 functions for AMD (David Arcari) [1960440]
  - lockd: Fix invalid lockowner cast after vfs_test_lock (Benjamin Coddington) [1986138]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-342.el8]
changelog:
  - selftest: netfilter: add test case for unreplied tcp connections (Florian Westphal) [1991523]
  - netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state (Florian Westphal) [1991523]
  - net/sched: store the last executed chain also for clsact egress (Davide Caratti) [1980537]
  - ice: fix Tx queue iteration for Tx timestamp enablement (Ken Cox) [1999743]
  - perf evsel: Add missing cloning of evsel->use_config_name (Michael Petlan) [1838635]
  - perf Documentation: Document intel-hybrid support (Michael Petlan) [1838635]
  - perf tests: Skip 'perf stat metrics (shadow stat) test' for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Convert perf time to TSC' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Session topology' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Parse and process metrics' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Track with sched_switch' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Skip 'Setup struct perf_event_attr' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Add hybrid cases for 'Roundtrip evsel->name' test (Michael Petlan) [1838635]
  - perf tests: Add hybrid cases for 'Parse event definition strings' test (Michael Petlan) [1838635]
  - perf record: Uniquify hybrid event name (Michael Petlan) [1838635]
  - perf stat: Warn group events from different hybrid PMU (Michael Petlan) [1838635]
  - perf stat: Filter out unmatched aggregation for hybrid event (Michael Petlan) [1838635]
  - perf stat: Add default hybrid events (Michael Petlan) [1838635]
  - perf record: Create two hybrid 'cycles' events by default (Michael Petlan) [1838635]
  - perf parse-events: Support event inside hybrid pmu (Michael Petlan) [1838635]
  - perf parse-events: Compare with hybrid pmu name (Michael Petlan) [1838635]
  - perf parse-events: Create two hybrid raw events (Michael Petlan) [1838635]
  - perf parse-events: Create two hybrid cache events (Michael Petlan) [1838635]
  - perf parse-events: Create two hybrid hardware events (Michael Petlan) [1838635]
  - perf stat: Uniquify hybrid event name (Michael Petlan) [1838635]
  - perf pmu: Add hybrid helper functions (Michael Petlan) [1838635]
  - perf pmu: Save detected hybrid pmus to a global pmu list (Michael Petlan) [1838635]
  - perf pmu: Save pmu name (Michael Petlan) [1838635]
  - perf pmu: Simplify arguments of __perf_pmu__new_alias (Michael Petlan) [1838635]
  - perf jevents: Support unit value "cpu_core" and "cpu_atom" (Michael Petlan) [1838635]
  - tools headers uapi: Update tools's copy of linux/perf_event.h (Michael Petlan) [1838635]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-343.el8]
changelog:
  - rcu: Avoid unneeded function call in rcu_read_unlock() (Waiman Long) [1997500]
  - mt76: connac: do not schedule mac_work if the device is not running (Íñigo Huguet) [1956419 1972045]
  - mt7921e: enable module in config (Íñigo Huguet) [1956419 1972045]
  - Revert tools/power/cpupower: Read energy_perf_bias from sysfs (Steve Best) [1999926]
  - libnvdimm/namespace: Differentiate between probe mapping and runtime mapping (Jeff Moyer) [1795719]
  - libnvdimm/pfn_dev: Don't clear device memmap area during generic namespace probe (Jeff Moyer) [1795719]
  - perf/x86/intel/uncore: Clean up error handling path of iio mapping (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Fix for iio mapping on Skylake Server (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Generic support for the MMIO type of uncore blocks (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Generic support for the PCI type of uncore blocks (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Rename uncore_notifier to uncore_pci_sub_notifier (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Generic support for the MSR type of uncore blocks (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Parse uncore discovery tables (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Expose an Uncore unit to IIO PMON mapping (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Wrap the max dies calculation into an accessor (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Expose an Uncore unit to PMON mapping (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Validate MMIO address before accessing (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Record the size of mapped area (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Fix oops when counting IMC uncore events on some TGL (Michael Petlan) [1837330]
  - crypto: qat - remove unused macro in FW loader (Vladis Dronov) [1920086]
  - crypto: qat - check return code of qat_hal_rd_rel_reg() (Vladis Dronov) [1920086]
  - crypto: qat - report an error if MMP file size is too large (Vladis Dronov) [1920086]
  - crypto: qat - check MMP size before writing to the SRAM (Vladis Dronov) [1920086]
  - crypto: qat - return error when failing to map FW (Vladis Dronov) [1920086]
  - crypto: qat - enable detection of accelerators hang (Vladis Dronov) [1920086]
  - crypto: qat - Fix a double free in adf_create_ring (Vladis Dronov) [1920086]
  - crypto: qat - fix error path in adf_isr_resource_alloc() (Vladis Dronov) [1920086]
  - crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init (Vladis Dronov) [1920086]
  - crypto: qat - don't release uninitialized resources (Vladis Dronov) [1920086]
  - crypto: qat - fix use of 'dma_map_single' (Vladis Dronov) [1920086]
  - crypto: qat - fix unmap invalid dma address (Vladis Dronov) [1920086]
  - crypto: qat - fix spelling mistake: "messge" -> "message" (Vladis Dronov) [1920086]
  - crypto: qat - reduce size of mapped region (Vladis Dronov) [1920086]
  - crypto: qat - change format string and cast ring size (Vladis Dronov) [1920086]
  - crypto: qat - fix potential spectre issue (Vladis Dronov) [1920086]
  - crypto: qat - configure arbiter mapping based on engines enabled (Vladis Dronov) [1920086]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-344.el8]
changelog:
  - perf/x86/intel: Fix PEBS-via-PT reload base value for Extended PEBS (Michael Petlan) [1998051]
  - perf/x86/intel/uncore: Fix Add BW copypasta (Michael Petlan) [1998051]
  - perf/x86/intel/uncore: Add BW counters for GT, IA and IO breakdown (Michael Petlan) [1998051]
  - Revert "ice: Add initial support framework for LAG" (Michal Schmidt) [1999016]
  - net: re-initialize slow_gro flag at gro_list_prepare time (Paolo Abeni) [2002367]
  - cxgb4: dont touch blocked freelist bitmap after free (Rahul Lakkireddy) [1998148]
  - cxgb4vf: configure ports accessible by the VF (Rahul Lakkireddy) [1961329]
  - scsi: lpfc: Fix memory leaks in error paths while issuing ELS RDF/SCR request (Dick Kennedy) [1976332]
  - scsi: lpfc: Keep NDLP reference until after freeing the IOCB after ELS handling (Dick Kennedy) [1976332]
  - scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash (Dick Kennedy) [1976332]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-345.el8]
changelog:
  - e1000e: Do not take care about recovery NVM checksum (Ken Cox) [1984558]
  - qrtr: disable CONFIG_QRTR for non x86_64 archs (Íñigo Huguet) [1999642]
  - ceph: fix possible null-pointer dereference in ceph_mdsmap_decode() (Jeff Layton) [1989999]
  - ceph: fix dereference of null pointer cf (Jeff Layton) [1989999]
  - ceph: correctly handle releasing an embedded cap flush (Jeff Layton) [1989999]
  - ceph: take snap_empty_lock atomically with snaprealm refcount change (Jeff Layton) [1989999]
  - ceph: don't WARN if we're still opening a session to an MDS (Jeff Layton) [1989999]
  - rbd: don't hold lock_rwsem while running_list is being drained (Jeff Layton) [1989999]
  - rbd: always kick acquire on "acquired" and "released" notifications (Jeff Layton) [1989999]
  - ceph: take reference to req->r_parent at point of assignment (Jeff Layton) [1989999]
  - ceph: eliminate ceph_async_iput() (Jeff Layton) [1989999]
  - ceph: don't take s_mutex in ceph_flush_snaps (Jeff Layton) [1989999]
  - ceph: don't take s_mutex in try_flush_caps (Jeff Layton) [1989999]
  - ceph: don't take s_mutex or snap_rwsem in ceph_check_caps (Jeff Layton) [1989999]
  - ceph: eliminate session->s_gen_ttl_lock (Jeff Layton) [1989999]
  - ceph: allow ceph_put_mds_session to take NULL or ERR_PTR (Jeff Layton) [1989999]
  - ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm (Jeff Layton) [1989999]
  - ceph: add some lockdep assertions around snaprealm handling (Jeff Layton) [1989999]
  - ceph: decoding error in ceph_update_snap_realm should return -EIO (Jeff Layton) [1989999]
  - ceph: add IO size metrics support (Jeff Layton) [1989999]
  - ceph: update and rename __update_latency helper to __update_stdev (Jeff Layton) [1989999]
  - ceph: simplify the metrics struct (Jeff Layton) [1989999]
  - libceph: fix doc warnings in cls_lock_client.c (Jeff Layton) [1989999]
  - libceph: remove unnecessary ret variable in ceph_auth_init() (Jeff Layton) [1989999]
  - libceph: kill ceph_none_authorizer::reply_buf (Jeff Layton) [1989999]
  - ceph: make ceph_queue_cap_snap static (Jeff Layton) [1989999]
  - ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty (Jeff Layton) [1989999]
  - libceph: set global_id as soon as we get an auth ticket (Jeff Layton) [1989999]
  - libceph: don't pass result into ac->ops->handle_reply() (Jeff Layton) [1989999]
  - ceph: fix error handling in ceph_atomic_open and ceph_lookup (Jeff Layton) [1989999]
  - ceph: must hold snap_rwsem when filling inode for async create (Jeff Layton) [1989999]
  - libceph: Fix spelling mistakes (Jeff Layton) [1989999]
  - libceph: don't set global_id until we get an auth ticket (Jeff Layton) [1989999]
  - libceph: bump CephXAuthenticate encoding version (Jeff Layton) [1989999]
  - ceph: don't allow access to MDS-private inodes (Jeff Layton) [1989999]
  - ceph: fix up some bare fetches of i_size (Jeff Layton) [1989999]
  - ceph: support getting ceph.dir.rsnaps vxattr (Jeff Layton) [1989999]
  - ceph: drop pinned_page parameter from ceph_get_caps (Jeff Layton) [1989999]
  - ceph: fix inode leak on getattr error in __fh_to_dentry (Jeff Layton) [1989999]
  - ceph: only check pool permissions for regular files (Jeff Layton) [1989999]
  - ceph: send opened files/pinned caps/opened inodes metrics to MDS daemon (Jeff Layton) [1989999]
  - ceph: avoid counting the same request twice or more (Jeff Layton) [1989999]
  - ceph: rename the metric helpers (Jeff Layton) [1989999]
  - ceph: fix kerneldoc copypasta over ceph_start_io_direct (Jeff Layton) [1989999]
  - ceph: don't use d_add in ceph_handle_snapdir (Jeff Layton) [1989999]
  - ceph: don't clobber i_snap_caps on non-I_NEW inode (Jeff Layton) [1989999]
  - ceph: fix fall-through warnings for Clang (Jeff Layton) [1989999]
  - net: ceph: Fix a typo in osdmap.c (Jeff Layton) [1989999]
  - ceph: don't allow type or device number to change on non-I_NEW inodes (Jeff Layton) [1989999]
  - ceph: defer flushing the capsnap if the Fb is used (Jeff Layton) [1989999]
  - ceph: allow queueing cap/snap handling after putting cap references (Jeff Layton) [1989999]
  - ceph: clean up inode work queueing (Jeff Layton) [1989999]
  - ceph: fix flush_snap logic after putting caps (Jeff Layton) [1989999]
  - libceph: fix "Boolean result is used in bitwise operation" warning (Jeff Layton) [1989999]
  - new helper: inode_wrong_type() (Jeff Layton) [1989999]
  - kabi: Adding symbol single_release (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol single_open (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol seq_read (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol seq_printf (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol seq_lseek (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol unregister_chrdev_region (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_init (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_del (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_alloc (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_add (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol alloc_chrdev_region (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol pcie_capability_read_word (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pcie_capability_read_dword (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pcie_capability_clear_and_set_word (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_write_config_dword (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_write_config_byte (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_set_power_state (drivers/pci/pci.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_read_config_dword (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_read_config_byte (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_irq_vector (drivers/pci/msi.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_get_device (drivers/pci/search.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_free_irq_vectors (drivers/pci/msi.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_alloc_irq_vectors_affinity (drivers/pci/msi.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol kexec_crash_loaded (kernel/kexec_core.c) (Čestmír Kalina) [1945491]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-346.el8]
changelog:
  - redhat: switch secureboot kernel image signing to release keys (Bruno Meneguele)
  - CI: handle RT branches in a single config (Veronika Kabatova)
  - CI: Fix RT check branch name (Veronika Kabatova)
  - CI: Drop private CI config (Veronika Kabatova)
  - CI: extend template use (Veronika Kabatova)
  - Revert "Merge: mt7921e: enable new Mediatek wireless hardware" (Bruno Meneguele) [2009501]
  - megaraid_sas: fix concurrent access to ISR between IRQ polling and real interrupt (Tomas Henzl) [2009022]
  - scsi: megaraid_sas: mq_poll support (Tomas Henzl) [2009022]
  - [PATCH v2] scsi: qla2xxx: Suppress unnecessary log messages during login (Nilesh Javali) [1982186]
  - scsi: qla2xxx: Fix excessive messages during device logout (Nilesh Javali) [1982186]
  - PCI: pciehp: Ignore Link Down/Up caused by DPC (Myron Stowe) [1981741]
  - arm64: kpti: Fix "kpti=off" when KASLR is enabled (Mark Salter) [1979731]
  - arm64: Fix CONFIG_ARCH_RANDOM=n build (Mark Salter) [1979731]
  - redhat/configs: aarch64: add CONFIG_ARCH_RANDOM (Mark Salter) [1979731]
  - arm64: Implement archrandom.h for ARMv8.5-RNG (Mark Salter) [1979731]
  - arm64: kconfig: Fix alignment of E0PD help text (Mark Salter) [1979731]
  - arm64: Use register field helper in kaslr_requires_kpti() (Mark Salter) [1979731]
  - arm64: Simplify early check for broken TX1 when KASLR is enabled (Mark Salter) [1979731]
  - arm64: Use a variable to store non-global mappings decision (Mark Salter) [1979731]
  - arm64: Don't use KPTI where we have E0PD (Mark Salter) [1979731]
  - arm64: Factor out checks for KASLR in KPTI code into separate function (Mark Salter) [1979731]
  - redhat/configs: Add CONFIG_ARM64_E0PD (Mark Salter) [1979731]
  - arm64: Add initial support for E0PD (Mark Salter) [1979731]
  - arm64: cpufeature: Export matrix and other features to userspace (Mark Salter) [1980098]
  - arm64: docs: cpu-feature-registers: Document ID_AA64PFR1_EL1 (Mark Salter) [1980098]
  - docs/arm64: cpu-feature-registers: Rewrite bitfields that don't follow [e, s] (Mark Salter) [1980098]
  - docs/arm64: cpu-feature-registers: Documents missing visible fields (Mark Salter) [1980098]
  - arm64: Introduce system_capabilities_finalized() marker (Mark Salter) [1980098]
  - arm64: entry.S: Do not preempt from IRQ before all cpufeatures are enabled (Mark Salter) [1980098]
  - docs/arm64: elf_hwcaps: Document HWCAP_SB (Mark Salter) [1980098]
  - docs/arm64: elf_hwcaps: sort the HWCAP{, 2} documentation by ascending value (Mark Salter) [1980098]
  - arm64: cpufeature: Treat ID_AA64ZFR0_EL1 as RAZ when SVE is not enabled (Mark Salter) [1980098]
  - arm64: cpufeature: Effectively expose FRINT capability to userspace (Mark Salter) [1980098]
  - arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} (Mark Salter) [1980098]
  - arm64: Expose FRINT capabilities to userspace (Mark Salter) [1980098]
  - arm64: Expose ARMv8.5 CondM capability to userspace (Mark Salter) [1980098]
  - docs: arm64: convert perf.txt to ReST format (Mark Salter) [1980098]
  - docs: arm64: convert docs to ReST and rename to .rst (Mark Salter) [1980098]
  - Documentation/arm64: HugeTLB page implementation (Mark Salter) [1980098]
  - Documentation/arm64/sve: Couple of improvements and typos (Mark Salter) [1980098]
  - arm64: cpufeature: Fix missing ZFR0 in __read_sysreg_by_encoding() (Mark Salter) [1980098]
  - arm64: Expose SVE2 features for userspace (Mark Salter) [1980098]
  - arm64: Advertise ARM64_HAS_DCPODP cpu feature (Mark Salter) [1980098]
  - arm64: add CVADP support to the cache maintenance helper (Mark Salter) [1980098]
  - arm64: Fix minor issues with the dcache_by_line_op macro (Mark Salter) [1980098]
  - arm64: Expose DC CVADP to userspace (Mark Salter) [1980098]
  - arm64: Handle trapped DC CVADP (Mark Salter) [1980098]
  - arm64: HWCAP: encapsulate elf_hwcap (Mark Salter) [1980098]
  - arm64: HWCAP: add support for AT_HWCAP2 (Mark Salter) [1980098]
  - x86/MCE/AMD, EDAC/mce_amd: Add new SMCA bank types (Aristeu Rozanski) [1965331]
  - x86/MCE/AMD, EDAC/mce_amd: Remove struct smca_hwid.xec_bitmap (Aristeu Rozanski) [1965331]
  - EDAC, mce_amd: Print ExtErrorCode and description on a single line (Aristeu Rozanski) [1965331]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.el8]
changelog:
  - drm/nouveau/fifo/ga102: initialise chid on return from channel creation (Ben Skeggs) [1997878]
  - drm/nouveau/ga102-: support ttm buffer moves via copy engine (Ben Skeggs) [1997878]
  - drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows (Ben Skeggs) [1997878]
  - drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences (Ben Skeggs) [1997878]
  - drm/nouveau/disp: power down unused DP links during init (Ben Skeggs) [1997878]
  - drm/nouveau: recognise GA107 (Ben Skeggs) [1997878]


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-7
changelog:
  - Trivial style fixes
  - Free contents of modkey in semanage_direct_remove
  - Fix USE_AFTER_FREE (CWE-672) in semanage_direct_write_langext()
  - add missing include to boolean_record.c
  - move module hashing into libsemanage
  - move compressed file handling into a separate object
  - clean up semanage_direct_commit() a bit
  - optionally rebuild policy when modules are changed externally
  - add command-line option to detect module changes (#2049186)


author: Gopal Tiwari <gtiwari@redhat.com> - 5.56-1
changelog:
  + bluez-5.56-1
  - Fixing (#1965057)
  - Removing bccmd, enabling hid2hci as upstream removed the support in bluez-5.56


author: Sergio Correia <scorreia@redhat.com> - 3.0.5-1
changelog:
  - Rebase audit package on 8.6
    Resolves: rhbz#1939406
    Resolves: rhbz#1906065
    Resolves: rhbz#1921447
    Resolves: rhbz#1927884
    Resolves: rhbz#1921658


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-2
changelog:
  - Adjust sample-rules dir permissions
    Resolves: rhbz#2054727 - /usr/share/audit/sample-rules is no longer readable by non-root users


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-2.1
changelog:
  - Fix path normalization in auparse
    Resolves: rhbz#2061726 - auparse missing information when used with --format-text


author: Sergio Correia <scorreia@redhat.com> - 3.0.7-2.2
changelog:
  - Drop ProtectHome from auditd.service as it interferes with rules
    Resolves: rhbz#2070705 - Default systemd service config blocks audit watch rules in some directories


author: Jakub Martisko <jamartis@redhat.com> - 4.5-5
changelog:
  - Minor cleanup - remove unused patch from the spec file too (related to 4.5-3)
  - Resolves: rhbz#1869253


author: Jakub Jelen <jjelen@redhat.com> - 1.9.5-1
changelog:
  - Rebase to 1.9.5 version to address race conditions (#2014641)
  - Drop dowstream polkit policy to avoid repeated authentication requests in remote sessions (#1928154)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.1.1.el8_5]
changelog:
  - lib/timerqueue: Rely on rbtree semantics for next timer (Phil Auld) [2014677 2007099] {CVE-2021-20317}
  - mm/hmm: make HMM_MIRROR an implicit option (Rafael Aquini) [2017519 1998534]
  - mm/hmm: allow HMM_MIRROR on all architectures with MMU (Rafael Aquini) [2017519 1998534]
  - mm: don't select MIGRATE_VMA_HELPER from HMM_MIRROR (Rafael Aquini) [2017519 1998534]
  - mm: sort out the DEVICE_PRIVATE Kconfig mess (Rafael Aquini) [2017519 1998534]
  - ceph: skip existing superblocks that are blocklisted or shut down when mounting (Jeffrey Layton) [2017071 2011462]
  - redhat: switch release to zstream (Bruno Meneguele)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.2.1.el8_5]
changelog:
  - tipc: fix size validations for the MSG_CRYPTO type (Bruno Meneguele) [2020506 2020507] {CVE-2021-43267}
  - net: Fix skb->csum update in inet_proto_csum_replace16(). (Balazs Nemeth) [2005981 1975193]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.3.1.el8_5]
changelog:
  - net-sysfs: try not to restart the syscall if it will fail eventually (Antoine Tenart) [2021165 2016005]
  - ovl: fix missing negative dentry check in ovl_rename() (Miklos Szeredi) [2016378 2010887 2013318] {CVE-2021-20321}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.4.1.el8_5]
changelog:
  - [RHEL8.6 BZ 1849234] cifs: report error instead of invalid when revalidating a dentry fails (Ronnie Sahlberg) [2017177 1849234]
  - kthread: Fix PF_KTHREAD vs to_kthread() race (Waiman Long) [2010333 2001497]
  - sched/fair: Ignore percpu threads for imbalance pulls (Waiman Long) [2010333 2001497]
  - kthread: Extract KTHREAD_IS_PER_CPU (Waiman Long) [2010333 2001497]
  - sched: Optimize finish_lock_switch() (Waiman Long) [2010333 2001497]
  - sched/hotplug: Ensure only per-cpu kthreads run during hotplug (Waiman Long) [2010333 2001497]
  - sched: Fix balance_callback() (Waiman Long) [2010333 2001497]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.6.1.el8_5]
changelog:
  - x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically (Prarit Bhargava) [2024678 2021219]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.7.1.el8_5]
changelog:
  - sched: Fix CPU hotplug / tighten is_per_cpu_kthread() (Waiman Long) [2026450 2024869]
  - sched: Prepare to use balance_push in ttwu() (Waiman Long) [2026450 2024869]
  - sched: Don't run cpu-online with balance_push() enabled (Waiman Long) [2026450 2024869]
  - workqueue: Tag bound workers with KTHREAD_IS_PER_CPU (Waiman Long) [2026450 2024869]
  - workqueue: Use cpu_possible_mask instead of cpu_active_mask to break affinity (Waiman Long) [2026450 2024869]
  - sched: Fix hotplug vs CPU bandwidth control (Waiman Long) [2026450 2024869]
  - workqueue: Manually break affinity on hotplug (Waiman Long) [2026450 2024869]
  - sched/hotplug: Consolidate task migration on CPU unplug (Waiman Long) [2026450 2024869]
  - sched/core: Wait for tasks being pushed away on hotplug (Waiman Long) [2026450 2024869]


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-59
changelog:
  - makedumpfile: printk: use committed/finalized state values
  - makedumpfile: printk: add support for lockless ringbuffer
  - kexec-tools: printk: Use %zu to format size_t
  - kexec-tools: printk: Use ULL suffix for 64-bit constants
  - kexec-tools: printk: add support for lockless ringbuffer


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-60
changelog:
  - fadump-init: clean up mount points properly
  - fadump: kdumpctl should check the modules used by the fadump initramfs
  - fadump: isolate fadump initramfs image within the default one
  - mkdumprd: Use xz for squash image compression


author: Pingfan Liu <piliu@redhat.com> - 2.0.20-66
changelog:
  - kdump/ppc64: suppress the error message "Could not find a registered notification tool" from servicelog_notify
  - Enable zstd compression for makedumpfile in kexec-tools.spec


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.28-188
changelog:
  - CVE-2022-23218, CVE-2022-23219: Fix buffer overflows in sunrpc clnt_create
    for "unix" and svcunix_create (#2045063).


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-7 + 0.10.3-7
changelog:
  - SFTP sort upon the modification time (#1909988)
  - ssh-keygen printing fingerprint issue with Windows keys (#1901518)
  - PIN is lost when iterating over tokens when adding pkcs11 keys to ssh-agent (#1843372)
  - ssh-agent segfaults during ssh-add -s pkcs11 (#1868996)
  - ssh-copy-id could not resolve ipv6 address ends with colon (#1933517)
  - sshd provides PAM an incorrect error code (#1879503)


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.0p1-9
changelog:
  - CVE-2020-14145 openssh: Observable Discrepancy leading to an information
    leak in the algorithm negotiation (#1882252)
  - Hostbased ssh authentication fails if session ID contains a '/' (#1944125)


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.1.1.el8]
changelog:
  - megaraid_sas: Add new messaging - a fix (Tomas Henzl) [2055248]
  - HID: amd_sfh: Add interrupt handler to process interrupts (Benjamin Tissoires) [2054929]
  - HID: amd_sfh: Add functionality to clear interrupts (Benjamin Tissoires) [2054929]
  - HID: amd_sfh: Disable the interrupt for all command (Benjamin Tissoires) [2054929]
  - HID: amd_sfh: Correct the structure field name (Benjamin Tissoires) [2054929]
  - HID: amd_sfh: Handle amd_sfh work buffer in PM ops (Benjamin Tissoires) [2054929]
  - HID: amd_sfh: Add illuminance mask to limit ALS max value (Benjamin Tissoires) [2054929]
  - HID: amd_sfh: Increase sensor command timeout (Benjamin Tissoires) [2054929]
  - HID: amd_sfh: Update Copyright details (Benjamin Tissoires) [2054929]
  - HID: amd_sfh: switch from 'pci_' to 'dev_' API (Benjamin Tissoires) [2054929]
  - HID: amd_sfh: Use dma_set_mask_and_coherent() (Benjamin Tissoires) [2054929]
  - HID: amd_sfh: switch from 'pci_' to 'dma_' API (Benjamin Tissoires) [2054929]
  - dm stats: fix too short end duration_ns when using precise_timestamps (Benjamin Marzinski) [2057166]
  - dm: fix double accounting of flush with data (Benjamin Marzinski) [2057166]
  - dm: interlock pending dm_io and dm_wait_for_bios_completion (Benjamin Marzinski) [2057166]
  - x86/MCE/AMD, EDAC/mce_amd: Support non-uniform MCA bank type enumeration (Aristeu Rozanski) [2050410 2048786 2050412]
  - x86/MCE/AMD, EDAC/mce_amd: Add new SMCA bank types (Aristeu Rozanski) [2050410 2048786 2050412]
  - EDAC/amd64: Add support for AMD Family 19h Models 10h-1Fh and A0h-AFh (Aristeu Rozanski) [2050410 2048786 2050412]
  - EDAC: Add RDDR5 and LRDDR5 memory types (Aristeu Rozanski) [2050410 2048786 2050412]
  - EDAC/amd64: Handle three rank interleaving mode (Aristeu Rozanski) [2050410 2048786 2050412]
  - EDAC/amd64: Set proper family type for Family 19h Models 20h-2Fh (Aristeu Rozanski) [2050410 2048786 2050412]
  - netfilter: nf_queue: handle socket prefetch (Florian Westphal) [2009786]
  - netfilter: nf_queue: fix possible use-after-free (Florian Westphal) [2009786]
  - selftests: netfilter: add nfqueue TCP_NEW_SYN_RECV socket race test (Florian Westphal) [2009786]
  - netfilter: nf_queue: don't assume sk is full socket (Florian Westphal) [2009786]
  - Enable HSA_AMD_SVM config (Donald Dutile) [2025123]
  - mm/memremap_pages: support multiple ranges per invocation (Donald Dutile) [2025123]
  - mm/memremap_pages: convert to 'struct range' (Donald Dutile) [2025123]
  - device-dax: add an allocation interface for device-dax instances (Donald Dutile) [2025123]
  - device-dax: make pgmap optional for instance creation (Donald Dutile) [2025123]
  - device-dax: move instance creation parameters to 'struct dev_dax_data' (Donald Dutile) [2025123]
  - device-dax: drop the dax_region.pfn_flags attribute (Donald Dutile) [2025123]
  - memremap: rename MEMORY_DEVICE_DEVDAX to MEMORY_DEVICE_GENERIC (Donald Dutile) [2025123]
  - PCI/P2PDMA: Introduce private pagemap structure (Donald Dutile) [2025123]
  - security: implement sctp_assoc_established hook in selinux (Ondrej Mosnacek) [2015525 2048251]
  - security: add sctp_assoc_established hook (Ondrej Mosnacek) [2015525 2048251]
  - security: call security_sctp_assoc_request in sctp_sf_do_5_1D_ce (Ondrej Mosnacek) [2015525 2048251]
  - security: pass asoc to sctp_assoc_request and sctp_sk_clone (Ondrej Mosnacek) [2015525 2048251]
  - net: sctp: Fix some typos (Ondrej Mosnacek) [2015525 2048251]
  - iwlwifi: mvm: read 6E enablement flags from DSM and pass to FW (Íñigo Huguet) [1923170 1936001]
  - net/mlx5: Lag, Make mlx5_lag_is_multipath() be static inline (Amir Tzin) [1982193]
  - net/mlx5e: nullify cq->dbg pointer in mlx5_debug_cq_remove() (Amir Tzin) [1982193]
  - net/mlx5: DR, Ignore modify TTL if device doesn't support it (Amir Tzin) [1982193 2028504]
  - net/mlx5: Warn for devlink reload when there are VFs alive (Amir Tzin) [1982193]
  - net/mlx5: DR, Fix lower case macro prefix "mlx5_" to "MLX5_" (Amir Tzin) [1982193]
  - net/mlx5e: Fix wrong features assignment in case of error (Amir Tzin) [1982193]
  - net/mlx5e: Fix ICOSQ recovery flow for XSK (Amir Tzin) [1982193]
  - net/mlx5e: Fix interoperability between XSK and ICOSQ recovery flow (Amir Tzin) [1982193]
  - net/mlx5e: Wrap the tx reporter dump callback to extract the sq (Amir Tzin) [1982193]
  - net/mlx5: Fix tc max supported prio for nic mode (Amir Tzin) [1982193]
  - net/mlx5: Fix SF health recovery flow (Amir Tzin) [1982193]
  - net/mlx5: Fix error print in case of IRQ request failed (Amir Tzin) [1982193]
  - net/mlx5: DR, Fix NULL vs IS_ERR checking in dr_domain_init_resources (Amir Tzin) [1982193]
  - mlx5: fix mlx5i_grp_sw_update_stats() stack usage (Amir Tzin) [1982193]
  - mlx5: fix psample_sample_packet link error (Amir Tzin) [1982193]
  - net/mlx5: Fix format-security build warnings (Amir Tzin) [1982193]
  - net/mlx5e: Fix missing IPsec statistics on uplink representor (Amir Tzin) [1982193]
  - net/mlx5e: IPsec: Fix Software parser inner l3 type setting in case of encapsulation (Amir Tzin) [1982193]
  - net/mlx5: E-Switch, return error if encap isn't supported (Amir Tzin) [1982193]
  - net/mlx5: Lag, update tracker when state change event received (Amir Tzin) [1982193]
  - net/mlx5e: CT, Fix multiple allocations and memleak of mod acts (Amir Tzin) [1982193 2017675]
  - net/mlx5: Update error handler for UCTX and UMEM (Amir Tzin) [1982193]
  - net/mlx5: E-Switch, Fix resetting of encap mode when entering switchdev (Amir Tzin) [1982193]
  - net/mlx5e: Wait for concurrent flow deletion during neigh/fib events (Amir Tzin) [1982193]
  - net/mlx5e: kTLS, Fix crash in RX resync flow (Amir Tzin) [1982193]
  - net/mlx5e: IPsec: Fix work queue entry ethernet segment checksum flags (Amir Tzin) [1982193]
  - net/mlx5e: IPsec: Fix a misuse of the software parser's fields (Amir Tzin) [1982193]
  - net/mlx5e: Fix vlan data lost during suspend flow (Amir Tzin) [1982193]
  - net/mlx5: Lag, change multipath and bonding to be mutually exclusive (Amir Tzin) [1982193]
  - net/mlx5: Lag, move lag destruction to a workqueue (Amir Tzin) [1982193]
  - RDMA/mlx5: Initialize the ODP xarray when creating an ODP MR (Amir Tzin) [1982193]
  - net/mlx5e: Mutually exclude RX-FCS and RX-port-timestamp (Amir Tzin) [1982193]
  - net/mlx5e: Switchdev representors are not vlan challenged (Amir Tzin) [1982193]
  - net/mlx5e: Fix memory leak in mlx5_core_destroy_cq() error path (Amir Tzin) [1982193]
  - net/mlx5: Fix cleanup of bridge delayed work (Amir Tzin) [1982193]
  - RDMA/mlx5: Set user priority for DCT (Amir Tzin) [1982193]
  - net/mlx5: DR, Fix typo 'offeset' to 'offset' (Amir Tzin) [1982193]
  - net/mlx5: DR, Fix vport number data type to u16 (Amir Tzin) [1982193]
  - net/mlx5e: Fix the presented RQ index in PTP stats (Amir Tzin) [1982193]
  - net/mlx5: Fix setting number of EQs of SFs (Amir Tzin) [1982193]
  - net/mlx5: Fix length of irq_index in chars (Amir Tzin) [1982193]
  - net/mlx5: Avoid generating event after PPS out in Real time mode (Amir Tzin) [1982193]
  - net/mlx5: Force round second at 1PPS out start time (Amir Tzin) [1982193]
  - net/mlx5: E-Switch, Fix double allocation of acl flow counter (Amir Tzin) [1982193]
  - net/mlx5e: Keep the value for maximum number of channels in-sync (Amir Tzin) [1982193]
  - net/mlx5e: IPSEC RX, enable checksum complete (Amir Tzin) [1982193]
  - net/mlx5: DR, Fix code indentation in dr_ste_v1 (Amir Tzin) [1982193]
  - RDMA/mlx5: Fix xlt_chunk_align calculation (Amir Tzin) [1982193]
  - RDMA/mlx5: Fix number of allocated XLT entries (Amir Tzin) [1982193]
  - net/mlx5e: Fix mutual exclusion between CQE compression and HW TS (Amir Tzin) [1982193]
  - net/mlx5: Fix potential sleeping in atomic context (Amir Tzin) [1982193]
  - net/mlx5: FWTrace, cancel work on alloc pd error flow (Amir Tzin) [1982193]
  - net/mlx5: DR, fix a potential use-after-free bug (Amir Tzin) [1982193]
  - net/mlx5e: Use correct eswitch for stack devices with lag (Amir Tzin) [1982193]
  - net/mlx5: E-Switch, Set vhca id valid flag when creating indir fwd group (Amir Tzin) [1982193]
  - net/mlx5: Remove all auxiliary devices at the unregister event (Amir Tzin) [1982193]
  - net/mlx5: Lag, fix multipath lag activation (Amir Tzin) [1982193]
  - net/mlx5: Fix variable type to match 64bit (Amir Tzin) [1982193]
  - net/mlx5: Fix typo in comments (Amir Tzin) [1982193]
  - net/mlx5e: Remove Duplicated hunk in function __parse_cls_flower() (Amir Tzin) [1982193]
  - net/mlx5: Fix unpublish devlink parameters (Amir Tzin) [1982193]
  - RDMA/mlx5: Delete not-available udata check (Amir Tzin) [1982193]
  - net/mlx5: Fix missing return value in mlx5_devlink_eswitch_inline_mode_set() (Amir Tzin) [1982193]
  - net/mlx5e: Block LRO if firmware asks for tunneled LRO (Amir Tzin) [1982193]
  - net/mlx5e: Prohibit inner indir TIRs in IPoIB (Amir Tzin) [1982193]
  - net: switchdev: zero-initialize struct switchdev_notifier_fdb_info emitted by drivers towards the bridge (Amir Tzin) [1982193]
  - net/mlx5: Fix return value from tracer initialization (Amir Tzin) [1982193]
  - net/mlx5: Synchronize correct IRQ when destroying CQ (Amir Tzin) [1982193 1982219]
  - net/mlx5e: TC, Fix error handling memory leak (Amir Tzin) [1982193]
  - net/mlx5: Destroy pool->mutex (Amir Tzin) [1982193]
  - net/mlx5: Set all field of mlx5_irq before inserting it to the xarray (Amir Tzin) [1982193]
  - net/mlx5: Fix order of functions in mlx5_irq_detach_nb() (Amir Tzin) [1982193]
  - net/mlx5: Block switchdev mode while devlink traps are active (Amir Tzin) [1982193]
  - net/mlx5e: Destroy page pool after XDP SQ to fix use-after-free (Amir Tzin) [1982193]
  - net/mlx5: Bridge, fix ageing time (Amir Tzin) [1982193]
  - net/mlx5e: Avoid creating tunnel headers for local route (Amir Tzin) [1982193]
  - net/mlx5: DR, Add fail on error check on decap (Amir Tzin) [1982193]
  - net/mlx5: Don't skip subfunction cleanup in case of error in module init (Amir Tzin) [1982193]
  - RDMA/mlx5: Delay emptying a cache entry when a new MR is added to it recently (Amir Tzin) [1982193]
  - net/mlx5: Fix mlx5_vport_tbl_attr chain from u16 to u32 (Amir Tzin) [1982193]
  - net/mlx5e: Fix nullptr in mlx5e_hairpin_get_mdev() (Amir Tzin) [1982193]
  - net/mlx5: Unload device upon firmware fatal error (Amir Tzin) [1982193]
  - net/mlx5e: Fix page allocation failure for ptp-RQ over SF (Amir Tzin) [1982193]
  - net/mlx5e: Fix page allocation failure for trap-RQ over SF (Amir Tzin) [1982193]
  - net/mlx5e: Consider PTP-RQ when setting RX VLAN stripping (Amir Tzin) [1982193]
  - net/mlx5e: Add NETIF_F_HW_TC to hw_features when HTB offload is available (Amir Tzin) [1982193]
  - net/mlx5e: RX, Avoid possible data corruption when relaxed ordering and LRO combined (Amir Tzin) [1982193]
  - net/mlx5: E-Switch, handle devcom events only for ports on the same device (Amir Tzin) [1982193]
  - net/mlx5: E-Switch, Set destination vport vhca id only when merged eswitch is supported (Amir Tzin) [1982193]
  - net/mlx5e: Disable Rx ntuple offload for uplink representor (Amir Tzin) [1982193]
  - net/mlx5e: kTLS, Add stats for number of deleted kTLS TX offloaded connections (Amir Tzin) [1982193]
  - net/mlx5: SF, Improve performance in SF allocation (Amir Tzin) [1982193]
  - net/mlx5: Increase hairpin buffer size (Amir Tzin) [1982193]
  - net/mlx5: DR, Add support for flow sampler offload (Amir Tzin) [1982193]
  - net/mlx5: Compare sampler flow destination ID in fs_core (Amir Tzin) [1982193]
  - net/mlx5: remove "default n" from Kconfig (Amir Tzin) [1982193]
  - net/mlx5: Fix spelling mistake "enught" -> "enough" (Amir Tzin) [1982193]
  - net/mlx5: Use cpumask_available() in mlx5_eq_create_generic() (Amir Tzin) [1982193]
  - net/mlx5: Fix missing error code in mlx5_init_fs() (Amir Tzin) [1982193]
  - RDMA/mlx5: Support real-time timestamp directly from the device (Amir Tzin) [1982193]
  - RDMA/mlx5: Refactor get_ts_format functions to simplify code (Amir Tzin) [1982193]
  - RDMA/mlx5: Enable Relaxed Ordering by default for kernel ULPs (Amir Tzin) [1982193]
  - net/mlx5: Round-Robin EQs over IRQs (Amir Tzin) [1982193]
  - net/mlx5: Separate between public and private API of sf.h (Amir Tzin) [1982193]
  - net/mlx5: Enlarge interrupt field in CREATE_EQ (Amir Tzin) [1982193]
  - net/mlx5: Allocating a pool of MSI-X vectors for SFs (Amir Tzin) [1982193]
  - net/mlx5: Change IRQ storage logic from static to dynamic (Amir Tzin) [1982193]
  - net/mlx5: Moving rmap logic to EQs (Amir Tzin) [1982193]
  - net/mlx5: Extend mlx5_irq_request to request IRQ from the kernel (Amir Tzin) [1982193]
  - net/mlx5: Removing rmap per IRQ (Amir Tzin) [1982193]
  - net/mlx5: Clean license text in eq.[c|h] files (Amir Tzin) [1982193]
  - net/mlx5: Provide cpumask at EQ creation phase (Amir Tzin) [1982193]
  - net/mlx5: Introduce API for request and release IRQs (Amir Tzin) [1982193]
  - net/mlx5: Delay IRQ destruction till all users are gone (Amir Tzin) [1982193]
  - net/mlx5: Change ownership model for lag (Amir Tzin) [1982193]
  - net/mlx5: Lag, Don't rescan if the device is going down (Amir Tzin) [1982193]
  - net/mlx5: Lag, refactor disable flow (Amir Tzin) [1982193]
  - net/mlx5: Bridge, add tracepoints (Amir Tzin) [1982193 1982234]
  - net/mlx5: Bridge, filter tagged packets that didn't match tagged fg (Amir Tzin) [1982193 1982234]
  - net/mlx5: Bridge, support pvid and untagged vlan configurations (Amir Tzin) [1982193 1982234]
  - net/mlx5: Bridge, match FDB entry vlan tag (Amir Tzin) [1982193 1982234]
  - net/mlx5: Bridge, implement infrastructure for vlans (Amir Tzin) [1982193 1982234]
  - net/mlx5: Bridge, dynamic entry ageing (Amir Tzin) [1982193 1982234]
  - net/mlx5: Bridge, handle FDB events (Amir Tzin) [1982193 1982234]
  - docs: networking: Add missing mlx5 documentation (Amir Tzin) [1982193]
  - net/mlx5: Bridge, add offload infrastructure (Amir Tzin) [1982193 1982234]
  - net/mlx5e: Refactor mlx5e_eswitch_{*}rep() helpers (Amir Tzin) [1982193 1982234]
  - net/mlx5: Create TC-miss priority and table (Amir Tzin) [1982193 1982234]
  - net/mlx5: DR, Support EMD tag in modify header for STEv1 (Amir Tzin) [1982193 1982234]
  - net/mlx5: DR, Added support for INSERT_HEADER reformat type (Amir Tzin) [1982193 1982234]
  - net/mlx5: Added new parameters to reformat context (Amir Tzin) [1982193 1982234]
  - net/mlx5: DR, Allow encap action for RX for supporting devices (Amir Tzin) [1982193 1982234]
  - net/mlx5: DR, Split reformat state to Encap and Decap (Amir Tzin) [1982193 1982234]
  - net/mlx5: mlx5_ifc support for header insert/remove (Amir Tzin) [1982193 1982234]
  - net/mlx5e: Remove unreachable code in mlx5e_xmit() (Amir Tzin) [1982193]
  - net/mlx5e: RX, Re-place page pool numa node change logic (Amir Tzin) [1982193]
  - net/mlx5e: Zero-init DIM structures (Amir Tzin) [1982193]
  - net/mlx5e: IPoIB, Add support for NDR speed (Amir Tzin) [1982193]
  - net/mlx5e: Remove the repeated declaration (Amir Tzin) [1982193]
  - net/mlx5: check for allocation failure in mlx5_ft_pool_init() (Amir Tzin) [1982193]
  - mlx5: count all link events (Amir Tzin) [1982193]
  - net/mlx5: Expose FW version over defined keyword (Amir Tzin) [1982193]
  - net/mlx5: Use boolean arithmetic to evaluate roce_lag (Amir Tzin) [1982193]
  - net/mlx5: Remove unnecessary spin lock protection (Amir Tzin) [1982193]
  - net/mlx5: Cap the maximum flow group size to 16M entries (Amir Tzin) [1982193]
  - net/mlx5: DR, Set max table size to 2G entries (Amir Tzin) [1982193]
  - net/mlx5: Move chains ft pool to be used by all firmware steering (Amir Tzin) [1982193]
  - net/mlx5: Move table size calculation to steering cmd layer (Amir Tzin) [1982193]
  - net/mlx5: Add case for FS_FT_NIC_TX FT in MLX5_CAP_FLOWTABLE_TYPE (Amir Tzin) [1982193]
  - net/mlx5: DR, Remove unused field of send_ring struct (Amir Tzin) [1982193]
  - net/mlx5e: RX, Remove unnecessary check in RX CQE compression handling (Amir Tzin) [1982193]
  - net/mlx5: CT: Avoid reusing modify header context for natted entries (Amir Tzin) [1982193]
  - net/mlx5e: CT, Remove newline from ct_dbg call (Amir Tzin) [1982193]
  - RDMA/mlx5: Take qp type from mlx5_ib_qp (Amir Tzin) [1982193]
  - RDMA/mlx5: Add SQD2RTS bit to the alloc ucontext response (Amir Tzin) [1982193]
  - RDMA/mlx5: Support SQD2RTS for modify QP (Amir Tzin) [1982193]
  - RDMA/mlx5: Remove redundant assignment to ret (Amir Tzin) [1982193]
  - firewire: fix support status (Tomas Henzl) [2055319]
  - dlci: fix support status (Tomas Henzl) [2055319]
  - dlink: fix support status (Tomas Henzl) [2055319]
  - rxe: fix support status (Tomas Henzl) [2055319]
  - qic: fix support status (Tomas Henzl) [2055319]
  - Revert "ceph: enable async dirops by default" (Jeffrey Layton) [2052542]
  - libceph: optionally use bounce buffer on recv path in crc mode (Jeffrey Layton) [2024725]
  - libceph: make recv path in secure mode work the same as send path (Jeffrey Layton) [2024725]
  - mm: use kmap_local_page in memzero_page (Jeffrey Layton) [2024725]
  - mm: call flush_dcache_page() in memcpy_to_page() and memzero_page() (Jeffrey Layton) [2024725]
  - iov_iter: lift memzero_page() to highmem.h (Jeffrey Layton) [2024725]
  - mm/highmem: Convert memcpy_[to|from]_page() to kmap_local_page() (Jeffrey Layton) [2024725]
  - mm/highmem: Lift memcpy_[to|from]_page to core (Jeffrey Layton) [2024725]
  - ceph: set pool_ns in new inode layout for async creates (Jeffrey Layton) [2046021]
  - ceph: properly put ceph_string reference after async create attempt (Jeffrey Layton) [2046021]
  - ceph: put the requests/sessions when it fails to alloc memory (Jeffrey Layton) [2046021]
  - ceph: remove redundant Lsx caps check (Jeffrey Layton) [2046021]
  - ceph: don't check for quotas on MDS stray dirs (Jeffrey Layton) [2046021]
  - ceph: drop send metrics debug message (Jeffrey Layton) [2046021]
  - ceph: Fix incorrect statfs report for small quota (Jeffrey Layton) [2011104]
  - scsi: qla2xxx: stop timer in shutdown path (Nilesh Javali) [2056055]
  - Revert "PCI: Add support for dev_groups to struct pci_driver" (Michel Dänzer) [2054595]
  - drm/amdgpu: Assign amdgpu_sysfs_groups to struct device_driver directly (Michel Dänzer) [2054595]
  - EDAC/i10nm: Retrieve and print retry_rd_err_log registers (Aristeu Rozanski) [1998359]
  - redhat: enable zstream release numbering for rhel 8.6 (Augusto Caringi)
  - redhat: generate distgit changelog in genspec.sh as well (Jan Stancek)
  - redhat: always upload kabi tarballs (Jan Stancek)
  - redhat: make genspec prefer metadata from git notes (Jan Stancek)


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.2.1.el8]
changelog:
  - ice: fix getting UDP tunnel entry (Jonathan Toppins) [2015409]
  - ice: convert to new udp_tunnel infrastructure (Jonathan Toppins) [2015409]
  - selftests: kvm: Check whether SIDA memop fails for normal guests (Thomas Huth) [2050807]
  - KVM: s390: Return error on SIDA memop on normal guest (Thomas Huth) [2050807] {CVE-2022-0516}
  - lib/iov_iter: initialize "flags" in new pipe_buffer (Jan Stancek) [2060875] {CVE-2022-0847}
  - fget: clarify and improve __fget_files() implementation (Patrick Talbert) [2032303]
  - fget: check that the fd still exists after getting a ref to it (Patrick Talbert) [2032303] {CVE-2021-4083}
  - drm/ast: Create threshold values for AST2600 (Jocelyn Falempe) [2053358]
  - cgroup-v1: Correct privileges check in release_agent writes (Waiman Long) [2052167]
  - cgroup-v1: Require capabilities to set release_agent (Waiman Long) [2052167] {CVE-2022-0492}
  - spec: Fix separate tools build (Yauheni Kaliuta) [2056301]
  - net/mlx5: DR, Add support for update FTE (Amir Tzin) [2047231]
  - net/mlx5: DR, Improve rule tracking memory consumption (Amir Tzin) [2047231]
  - net/mlx5: DR, Remove rehash ctrl struct from dr_htbl (Amir Tzin) [2047231]
  - net/mlx5: DR, Remove HW specific STE type from nic domain (Amir Tzin) [2047231]
  - net/mlx5: DR, Merge DR_STE_SIZE enums (Amir Tzin) [2047231]
  - net/mlx5: DR, Skip source port matching on FDB RX domain (Amir Tzin) [2047231]
  - net/mlx5: DR, Add ignore_flow_level support for multi-dest flow tables (Amir Tzin) [2047231]
  - net/mlx5: DR, replace uintN_t with kernel-style types (Amir Tzin) [2047231]
  - net/mlx5: DR, Support IPv6 matching on flow label for STEv0 (Amir Tzin) [2047231]
  - net/mlx5: DR, Reduce print level for FT chaining level check (Amir Tzin) [2047231]
  - net/mlx5: DR, Warn and ignore SW steering rule insertion on QP err (Amir Tzin) [2047231]
  - net/mlx5: DR, Improve error flow in actions_build_ste_arr (Amir Tzin) [2047231]
  - net/mlx5: DR, Enable QP retransmission (Amir Tzin) [2047231]
  - net/mlx5: DR, Enable VLAN pop on TX and VLAN push on RX (Amir Tzin) [2047231]
  - net/mlx5: DR, Split modify VLAN state to separate pop/push states (Amir Tzin) [2047231]
  - net/mlx5: DR, Added support for REMOVE_HEADER packet reformat (Amir Tzin) [2047231]
  - net/mlx4_en: Resolve bad operstate value (Amir Tzin) [1982190]
  - net/mlx4_en: Fix an use-after-free bug in mlx4_en_try_alloc_resources() (Amir Tzin) [1982190]
  - RDMA/mlx4: Do not fail the registration on port stats (Amir Tzin) [1982190]
  - RDMA/mlx4: Return missed an error if device doesn't support steering (Amir Tzin) [1982190]
  - net/mlx4_en: Don't allow aRFS for encapsulated packets (Amir Tzin) [1982190]
  - mlx4: Fix missing error code in mlx4_load_one() (Amir Tzin) [1982190]
  - net/mlx4: Fix fall-through warning for Clang (Amir Tzin) [1982190]
  - mlx4: Remove rcu_read_lock() around XDP program invocation (Amir Tzin) [1982190]
  - IB/mlx4: Avoid field-overflowing memcpy() (Amir Tzin) [1982190]
  - RDMA/mlx4: Do not map the core_clock page to user space unless enabled (Amir Tzin) [1982190]
  - net/mlx4: Treat VFs fair when handling comm_channel_events (Amir Tzin) [1982190]
  - RDMA/mlx4: Remove an unused variable (Amir Tzin) [1982190]


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.3.1.el8]
changelog:
  - net/mlx5e: TC, Remove redundant error logging (Amir Tzin) [2023907]
  - net/mlx5: DR, Warn on failure to destroy objects due to refcount (Amir Tzin) [2022325]
  - net/mlx5: DR, Add support for dumping steering info (Amir Tzin) [2022325]
  - net/mlx5: DR, Add missing reserved fields to dr_match_param (Amir Tzin) [2022325]
  - net/mlx5: DR, Add check for flex parser ID value (Amir Tzin) [2022325]
  - net/mlx5: DR, Rename list field in matcher struct to list_node (Amir Tzin) [2022325]
  - net/mlx5: DR, Remove unused struct member in matcher (Amir Tzin) [2022325]
  - net/mlx5: DR, Fix error flow in creating matcher (Amir Tzin) [2022325]
  - net/mlx5e: Avoid implicit modify hdr for decap drop rule (Amir Tzin) [2015434]
  - net/mlx5e: TC, Fix memory leak with rules with internal port (Amir Tzin) [2015434]
  - net/mlx5e: Fix skb memory leak when TC classifier action offloads are disabled (Amir Tzin) [2015434]
  - net/mlx5: Fix some error handling paths in 'mlx5e_tc_add_fdb_flow()' (Amir Tzin) [2015434]
  - net/mlx5: E-Switch, Check group pointer before reading bw_share value (Amir Tzin) [2015434]
  - net/mlx5: E-Switch, fix single FDB creation on BlueField (Amir Tzin) [2015434]
  - net/mlx5: E-switch, Respect BW share of the new group (Amir Tzin) [2015434]
  - net/mlx5: DR, Fix check for unsupported fields in match param (Amir Tzin) [2015434]
  - net/mlx5: E-Switch, rebuild lag only when needed (Amir Tzin) [2015434]
  - net/mlx5e: Delete forward rule for ct or sample action (Amir Tzin) [2015434]
  - net/mlx5: E-Switch, Use indirect table only if all destinations support it (Amir Tzin) [2015434]
  - net/mlx5: Support internal port as decap route device (Amir Tzin) [2015434]
  - net/mlx5e: Term table handling of internal port rules (Amir Tzin) [2015434]
  - net/mlx5e: Add indirect tc offload of ovs internal port (Amir Tzin) [2015434]
  - net/{mlx5|nfp|bnxt}: Remove unnecessary RTNL lock assert (Amir Tzin) [2015434]
  - net/mlx5e: Offload internal port as encap route device (Amir Tzin) [2015434]
  - net/mlx5e: Offload tc rules that redirect to ovs internal port (Amir Tzin) [2015434]
  - net/mlx5e: Accept action skbedit in the tc actions list (Amir Tzin) [2015434]
  - net/mlx5: E-Switch, Add ovs internal port mapping to metadata support (Amir Tzin) [2015434]
  - net/mlx5e: Use generic name for the forwarding dev pointer (Amir Tzin) [2015434]
  - net/mlx5e: Refactor rx handler of represetor device (Amir Tzin) [2015434]
  - net/mlx5: DR, Add check for unsupported fields in match param (Amir Tzin) [2015434]
  - net/mlx5: Allow skipping counter refresh on creation (Amir Tzin) [2015434]
  - net/mlx5e: IPsec: Refactor checksum code in tx data path (Amir Tzin) [2015434]
  - net/mlx5: CT: Remove warning of ignore_flow_level support for VFs (Amir Tzin) [2015434]
  - net/mlx5: Add esw assignment back in mlx5e_tc_sample_unoffload() (Amir Tzin) [2015434]
  - net/mlx5: Bridge, fix uninitialized variable usage (Amir Tzin) [2015434]
  - net/mlx5: Lag, don't update lag if lag isn't supported (Amir Tzin) [2015434]
  - net/mlx5: E-switch, Return correct error code on group creation failure (Amir Tzin) [2015434]
  - net/mlx5: Bridge, support LAG (Amir Tzin) [2015434]
  - net/mlx5: Bridge, allow merged eswitch connectivity (Amir Tzin) [2015434]
  - net/mlx5: Bridge, extract FDB delete notification to function (Amir Tzin) [2015434]
  - net/mlx5: Bridge, identify port by vport_num+esw_owner_vhca_id pair (Amir Tzin) [2015434]
  - net/mlx5: Bridge, obtain core device from eswitch instead of priv (Amir Tzin) [2015434]
  - net/mlx5: Bridge, release bridge in same function where it is taken (Amir Tzin) [2015434]
  - net/mlx5: Lag, Create shared FDB when in switchdev mode (Amir Tzin) [2015434]
  - net/mlx5: E-Switch, add logic to enable shared FDB (Amir Tzin) [2015434]
  - net/mlx5: Lag, properly lock eswitch if needed (Amir Tzin) [2015434]
  - net/mlx5: Add send to vport rules on paired device (Amir Tzin) [2015434]
  - net/mlx5: E-Switch, Add event callback for representors (Amir Tzin) [2015434]
  - net/mlx5e: Use shared mappings for restoring from metadata (Amir Tzin) [2015434]
  - net/mlx5e: Add an option to create a shared mapping (Amir Tzin) [2015434]
  - net/mlx5: E-Switch, set flow source for send to uplink rule (Amir Tzin) [2015434]
  - RDMA/mlx5: Add shared FDB support (Amir Tzin) [2015434]
  - {net, RDMA}/mlx5: Extend send to vport rules (Amir Tzin) [2015434]
  - RDMA/mlx5: Fill port info based on the relevant eswitch (Amir Tzin) [2015434]
  - net/mlx5: Lag, add initial logic for shared FDB (Amir Tzin) [2015434]
  - net/mlx5: Return mdev from eswitch (Amir Tzin) [2015434]
  - net/mlx5: E-switch, Add QoS tracepoints (Amir Tzin) [2015434]
  - net/mlx5: E-switch, Allow to add vports to rate groups (Amir Tzin) [2015434]
  - net/mlx5: E-switch, Allow setting share/max tx rate limits of rate groups (Amir Tzin) [2015434]
  - net/mlx5: E-switch, Introduce rate limiting groups API (Amir Tzin) [2015434]
  - net/mlx5: E-switch, Enable devlink port tx_{share|max} rate control (Amir Tzin) [2015434]
  - net/mlx5: E-switch, Move QoS related code to dedicated file (Amir Tzin) [2015434]
  - net/mlx5e: TC, Support sample offload action for tunneled traffic (Amir Tzin) [2015434]
  - net/mlx5e: TC, Restore tunnel info for sample offload (Amir Tzin) [2015434]
  - net/mlx5e: TC, Remove CONFIG_NET_TC_SKB_EXT dependency when restoring tunnel (Amir Tzin) [2015434]
  - net/mlx5e: Refactor ct to use post action infrastructure (Amir Tzin) [2015434]
  - net/mlx5e: Introduce post action infrastructure (Amir Tzin) [2015434]
  - net/mlx5e: CT, Use xarray to manage fte ids (Amir Tzin) [2015434]
  - net/mlx5e: Move sample attribute to flow attribute (Amir Tzin) [2015434]
  - net/mlx5e: Move esw/sample to en/tc/sample (Amir Tzin) [2015434]
  - net/mlx5e: Remove mlx5e dependency from E-Switch sample (Amir Tzin) [2015434]
  - net/mlx5: DR, Fix querying eswitch manager vport for ECPF (Amir Tzin) [2018097]
  - net/mlx5: DR, Handle eswitch manager and uplink vports separately (Amir Tzin) [2018097]
  - net/mlx5: DR, Add missing string for action type SAMPLER (Amir Tzin) [2018097]
  - net/mlx5: DR, init_next_match only if needed (Amir Tzin) [2018097]
  - net/mlx5: DR, Increase supported num of actions to 32 (Amir Tzin) [2018097]
  - net/mlx5: DR, Add support for SF vports (Amir Tzin) [2018097]
  - net/mlx5: DR, Support csum recalculation flow table on SFs (Amir Tzin) [2018097]
  - net/mlx5: DR, Align error messages for failure to obtain vport caps (Amir Tzin) [2018097]
  - net/mlx5: DR, Add missing query for vport 0 (Amir Tzin) [2018097]
  - net/mlx5: DR, Replace local WIRE_PORT macro with the existing MLX5_VPORT_UPLINK (Amir Tzin) [2018097]
  - scsi: lpfc: Fix pt2pt NVMe PRLI reject LOGO loop (Dick Kennedy) [1943202]
  - nvme-tcp: change target from tech-preview to unmaintained (John Meneghini) [2061577]
  - drm/amd/display: Don't reinitialize DMCUB on s0ix resume (Karol Herbst) [2059680]
  - tcp: Add snd_wnd to TCP_INFO (Davide Caratti) [2056608]
  - tcp: Add TCP_INFO counter for packets received out-of-order (Davide Caratti) [2056608]
  - net/mlx5: Move MODIFY_RQT command to ignore list in internal error state (Amir Tzin) [1982236]
  - net/mlx5e: Add TX max rate support for MQPRIO channel mode (Amir Tzin) [1982236]
  - net/mlx5e: Specify SQ stats struct for mlx5e_open_txqsq() (Amir Tzin) [1982236]
  - net/mlx5e: Allow only complete TXQs partition in MQPRIO channel mode (Amir Tzin) [1982236]
  - net/mlx5e: Mutually exclude setting of TX-port-TS and MQPRIO in channel mode (Amir Tzin) [1982236]
  - net/mlx5e: Fix condition when retrieving PTP-rqn (Amir Tzin) [1982236]
  - net/mlx5: Fix inner TTC table creation (Amir Tzin) [1982236]
  - net/mlx5e: Fix division by 0 in mlx5e_select_queue for representors (Amir Tzin) [1982236]
  - net/mlx5e: Improve MQPRIO resiliency (Amir Tzin) [1982236]
  - net/mlx5e: Support MQPRIO channel mode (Amir Tzin) [1982236]
  - net/mlx5e: Handle errors of netdev_set_num_tc() (Amir Tzin) [1982236]
  - net/mlx5e: Maintain MQPRIO mode parameter (Amir Tzin) [1982236]
  - net/mlx5e: Abstract MQPRIO params (Amir Tzin) [1982236]
  - net/mlx5e: Support flow classification into RSS contexts (Amir Tzin) [1982236]
  - net/mlx5e: Support multiple RSS contexts (Amir Tzin) [1982236]
  - net/mlx5e: Dynamically allocate TIRs in RSS contexts (Amir Tzin) [1982236]
  - net/mlx5e: Convert RSS to a dedicated object (Amir Tzin) [1982236]
  - net/mlx5e: Introduce abstraction of RSS context (Amir Tzin) [1982236]
  - net/mlx5e: Introduce TIR create/destroy API in rx_res (Amir Tzin) [1982236]
  - net/mlx5e: Do not try enable RSS when resetting indir table (Amir Tzin) [1982236]
  - net/mlx5: Embed mlx5_ttc_table (Amir Tzin) [1982236]
  - net/mlx5: Move TTC logic to fs_ttc (Amir Tzin) [1982236]
  - net/mlx5e: Decouple TTC logic from mlx5e (Amir Tzin) [1982236]
  - net/mlx5e: Rename some related TTC args and functions (Amir Tzin) [1982236]
  - net/mlx5e: Rename traffic type enums (Amir Tzin) [1982236]
  - net/mlx5e: Allocate the array of channels according to the real max_nch (Amir Tzin) [1982236]
  - net/mlx5e: Hide all implementation details of mlx5e_rx_res (Amir Tzin) [1982236]
  - net/mlx5e: Introduce mlx5e_channels API to get RQNs (Amir Tzin) [1982236]
  - net/mlx5e: Use a new initializer to build uniform indir table (Amir Tzin) [1982236]
  - net/mlx5e: Use the new TIR API for kTLS (Amir Tzin) [1982236]
  - net/mlx5e: Move management of indir traffic types to rx_res (Amir Tzin) [1982236]
  - net/mlx5e: Convert TIR to a dedicated object (Amir Tzin) [1982236]
  - net/mlx5e: Create struct mlx5e_rss_params_hash (Amir Tzin) [1982236]
  - net/mlx5e: Remove mdev from mlx5e_build_indir_tir_ctx_common() (Amir Tzin) [1982236]
  - net/mlx5e: Remove lro_param from mlx5e_build_indir_tir_ctx_common() (Amir Tzin) [1982236]
  - net/mlx5e: Remove mlx5e_priv usage from mlx5e_build_*tir_ctx*() (Amir Tzin) [1982236]
  - net/mlx5e: Use mlx5e_rqt_get_rqtn to access RQT hardware id (Amir Tzin) [1982236]
  - net/mlx5e: Take RQT out of TIR and group RX resources (Amir Tzin) [1982236]
  - net/mlx5e: Move RX resources to a separate struct (Amir Tzin) [1982236]
  - net/mlx5e: Move mlx5e_build_rss_params() call to init_rx (Amir Tzin) [1982236]
  - net/mlx5e: Convert RQT to a dedicated object (Amir Tzin) [1982236]
  - net/mlx5e: Check if inner FT is supported outside of create/destroy functions (Amir Tzin) [1982236]
  - net/mlx5: Take TIR destruction out of the TIR list lock (Amir Tzin) [1982236]
  - PCI: pciehp: Ignore Link Down/Up caused by error-induced Hot Reset (Myron Stowe) [2060122]
  - PCI/portdrv: Rename pm_iter() to pcie_port_device_iter() (Myron Stowe) [2060122]
  - iommu/vt-d: Fix double list_add when enabling VMD in scalable mode (Jerry Snitselaar) [2062094]


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.4.1.el8]
changelog:
  - igb: refactor XDP registration (Corinna Vinschen) [2040171]
  - igc: avoid kernel warning when changing RX ring parameters (Corinna Vinschen) [2040171]
  - scsi: qedi: Fix cmd_cleanup_cmpl counter mismatch issue (Nilesh Javali) [2054565]
  - EDAC/amd64: Save max number of controllers for F19 M70 (Aristeu Rozanski) [2064285]
  - CI: Use 8.6-rt branch for rhel8 realtime_check (Chris White)
  - blk-mq: avoid extending delays of active hctx from blk_mq_delay_run_hw_queues (Ming Lei) [2046525]
  - tipc: fix incorrect order of state message data sanity check (Xin Long) [2048971]
  - tipc: improve size validations for received domain records (Xin Long) [2048971] {CVE-2022-0435}
  - efi/x86: Call efi_parse_options() from efi_main() (Lenny Szubowicz) [2049233]


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.5.1.el8]
changelog:
  - scsi: mpi3mr: Fix flushing !WQ_MEM_RECLAIM events warning (Tomas Henzl) [2052278]
  - scsi: mpi3mr: Fix memory leaks (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Fix reporting of actual data transfer size (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Fix cmnd getting marked as in use forever (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Fix hibernation issue (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Fix printing of pending I/O count (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Fix deadlock while canceling the fw event (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Fixes around reply request queues (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Enhanced Task Management Support Reply handling (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Use TM response codes from MPI3 headers (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Increase internal cmnds timeout to 60s (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Do access status validation before adding devices (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Update MPI3 headers - part2 (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Update MPI3 headers - part1 (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Don't reset IOC if cmnds flush with reset status (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Replace spin_lock() with spin_lock_irqsave() (Tomas Henzl) [2054814]
  - scsi: mpi3mr: Add debug APIs based on logging_level bits (Tomas Henzl) [2054814]
  - scsi: mpt3sas: Remove scsi_dma_map() error messages (Tomas Henzl) [2057021]
  - net/mlx5: Fix wrong limitation of metadata match on ecpf (Amir Tzin) [2049094]
  - nfsd: fix use-after-free due to delegation race (Thiago Becker) [2053262]
  - dma-buf: cma_heap: Fix mutex locking section (Michel Dänzer) [2044440]
  - drm/amdkfd: Check for null pointer after calling kmemdup (Michel Dänzer) [2044440]
  - drm/atomic: Check new_crtc_state->active to determine if CRTC needs disable in self refresh mode (Michel Dänzer) [2044440]
  - drm/amd: avoid suspend on dGPUs w/ s2idle support when runtime PM enabled (Michel Dänzer) [2044440]
  - drm/i915/overlay: Prevent divide by zero bugs in scaling (Michel Dänzer) [2044440]
  - dma-buf: heaps: Fix potential spectre v1 gadget (Michel Dänzer) [2044440]
  - drm/amd/display: Force link_rate as LINK_RATE_RBR2 for 2018 15" Apple Retina panels (Michel Dänzer) [2044440]
  - drm/amd/display: watermark latencies is not enough on DCN31 (Michel Dänzer) [2044440]
  - drm/amd/pm: correct the MGpuFanBoost support for Beige Goby (Michel Dänzer) [2044440]
  - drm/i915/adlp: Fix TypeC PHY-ready status readout (Michel Dänzer) [2044440]
  - drm/nouveau: fix off by one in BIOS boundary checking (Michel Dänzer) [2044440]
  - drm/i915: Disable DSB usage for now (Michel Dänzer) [2044440]
  - Revert "drm/ast: Support 1600x900 with 108MHz PCLK" (Michel Dänzer) [2044440]
  - drm/amd/display: Fix FP start/end for dcn30_internal_validate_bw. (Michel Dänzer) [2044440]
  - drm/atomic: Add the crtc to affected crtc only if uapi.enable = true (Michel Dänzer) [2044440]
  - drm/amdgpu: Use correct VIEWPORT_DIMENSION for DCN2 (Michel Dänzer) [2044440]
  - drm/amd/display: reset dcn31 SMU mailbox on failures (Michel Dänzer) [2044440]
  - drm/vmwgfx: Remove explicit transparent hugepages support (Michel Dänzer) [2044440]
  - drm/radeon: fix error handling in radeon_driver_open_kms (Michel Dänzer) [2044440]
  - drm/i915/display/ehl: Update voltage swing table (Michel Dänzer) [2044440]
  - drm/nouveau/kms/nv04: use vzalloc for nv04_display (Michel Dänzer) [2044440]
  - drm/amd/display: Fix the uninitialized variable in enable_stream_features() (Michel Dänzer) [2044440]
  - amdgpu/pm: Make sysfs pm attributes as read-only for VFs (Michel Dänzer) [2044440]
  - drm/amdgpu: fixup bad vram size on gmc v8 (Michel Dänzer) [2044440]
  - drm/amd/amdgpu: fix gmc bo pin count leak in SRIOV (Michel Dänzer) [2044440]
  - drm/amd/amdgpu: fix psp tmr bo pin count leak in SRIOV (Michel Dänzer) [2044440]
  - drm/amdkfd: Fix error handling in svm_range_add (Michel Dänzer) [2044440]
  - drm/vmwgfx: Introduce a new placement for MOB page tables (Michel Dänzer) [2044440]
  - drm/vmwgfx: Release ttm memory if probe fails (Michel Dänzer) [2044440]
  - drm/amd/display: add else to avoid double destroy clk_mgr (Michel Dänzer) [2044440]
  - drm/amdgpu/display: set vblank_disable_immediate for DC (Michel Dänzer) [2044440]
  - drm/amd/display: check top_pipe_to_program pointer (Michel Dänzer) [2044440]
  - drm: panel-orientation-quirks: Add quirk for the Lenovo Yoga Book X91F/L (Michel Dänzer) [2044440]
  - drm/amd/display: Fix out of bounds access on DNC31 stream encoder regs (Michel Dänzer) [2044440]
  - drm/amd/display: Fix bug in debugfs crc_win_update entry (Michel Dänzer) [2044440]
  - drm/radeon/radeon_kms: Fix a NULL pointer dereference in radeon_driver_open_kms() (Michel Dänzer) [2044440]
  - drm/amdgpu: Fix a NULL pointer dereference in amdgpu_connector_lcd_native_mode() (Michel Dänzer) [2044440]
  - drm/vmwgfx: Fail to initialize on broken configs (Michel Dänzer) [2044440]
  - drm/vmwgfx: Remove the deprecated lower mem limit (Michel Dänzer) [2044440]
  - drm/vboxvideo: fix a NULL vs IS_ERR() check (Michel Dänzer) [2044440]
  - drm: fix null-ptr-deref in drm_dev_init_release() (Michel Dänzer) [2044440]
  - drm/ttm: Put BO in its memory manager's lru list (Michel Dänzer) [2044440]
  - dma_fence_array: Fix PENDING_ERROR leak in dma_fence_array_signaled() (Michel Dänzer) [2044440]
  - drm/amd/display: explicitly set is_dsc_supported to false before use (Michel Dänzer) [2044440]
  - drm/i915: Avoid bitwise vs logical OR warning in snb_wm_latency_quirk() (Michel Dänzer) [2044440]
  - drm/amd/pm: keep the BACO feature enabled for suspend (Michel Dänzer) [2044440]
  - Revert "drm/amdgpu: stop scheduler when calling hw_fini (v2)" (Michel Dänzer) [2044440]
  - drm/amd/display: Added power down for DCN10 (Michel Dänzer) [2044440]
  - drm/amd/display: fix B0 TMDS deepcolor no dislay issue (Michel Dänzer) [2044440]
  - drm/amdgpu: put SMU into proper state on runpm suspending for BOCO capable platform (Michel Dänzer) [2044440]
  - drm/amd/pm: skip setting gfx cgpg in the s0ix suspend-resume (Michel Dänzer) [2044440]
  - drm/amd/pm: Fix xgmi link control on aldebaran (Michel Dänzer) [2044440]
  - drm/amdgpu: fix dropped backing store handling in amdgpu_dma_buf_move_notify (Michel Dänzer) [2044440]
  - drm/amd/display: Changed pipe split policy to allow for multi-display pipe split (Michel Dänzer) [2044440]
  - drm/amdgpu: add support for IP discovery gc_info table v2 (Michel Dänzer) [2044440]
  - drm/amdgpu: When the VCN(1.0) block is suspended, powergating is explicitly enabled (Michel Dänzer) [2044440]
  - drm/nouveau: wait for the exclusive fence after the shared ones v2 (Michel Dänzer) [2044440]
  - drm/nouveau: always wait for the exclusive fence (Michel Dänzer) [2044440]
  - drm/amd/display: Set optimize_pwr_state for DCN31 (Michel Dänzer) [2044440]
  - drm/amd/display: Send s0i2_rdy in stream_count == 0 optimization (Michel Dänzer) [2044440]
  - drm/amd/pm: fix reading SMU FW version from amdgpu_firmware_info on YC (Michel Dänzer) [2044440]
  - drm/amdgpu: don't override default ECO_BITs setting (Michel Dänzer) [2044440]
  - drm/amdgpu: correct register access for RLC_JUMP_TABLE_RESTORE (Michel Dänzer) [2044440]
  - drm/amd/pm: fix a potential gpu_metrics_table memory leak (Michel Dänzer) [2044440]
  - drm/amd/display: Set exit_optimized_pwr_state for DCN31 (Michel Dänzer) [2044440]
  - drm/i915/display: Fix an unsigned subtraction which can never be negative. (Michel Dänzer) [2044440]
  - drm/ast: potential dereference of null pointer (Michel Dänzer) [2044440]
  - drm: simpledrm: fix wrong unit with pixel clock (Michel Dänzer) [2044440]
  - Revert "drm/fb-helper: improve DRM fbdev emulation device names" (Michel Dänzer) [2044440]
  - drm/i915/hdmi: Turn DP++ TMDS output buffers back on in encoder->shutdown() (Michel Dänzer) [2044440]
  - drm/i915/hdmi: convert intel_hdmi_to_dev to intel_hdmi_to_i915 (Michel Dänzer) [2044440]
  - drm/amdkfd: process_info lock not needed for svm (Michel Dänzer) [2044440]
  - drm/amd/display: add connector type check for CRC source set (Michel Dänzer) [2044440]
  - drm/amdkfd: fix double free mem structure (Michel Dänzer) [2044440]
  - drm/amd/display: Fix for the no Audio bug with Tiled Displays (Michel Dänzer) [2044440]
  - drm/amdgpu: check atomic flag to differeniate with legacy path (Michel Dänzer) [2044440]
  - drm/amd/display: Fix DPIA outbox timeout after S3/S4/reset (Michel Dänzer) [2044440]
  - drm/syncobj: Deal with signalled fences in drm_syncobj_find_fence. (Michel Dänzer) [2044440]
  - drm/i915/dp: Perform 30ms delay after source OUI write (Michel Dänzer) [2044440]
  - drm/amd/display: Allow DSC on supported MST branch devices (Michel Dänzer) [2044440]
  - dma-buf: system_heap: Use 'for_each_sgtable_sg' in pages free flow (Michel Dänzer) [2044440]
  - drm/amd/amdgpu: fix potential memleak (Michel Dänzer) [2044440]
  - drm/amd/amdkfd: Fix kernel panic when reset failed and been triggered again (Michel Dänzer) [2044440]
  - drm/amd/pm: Remove artificial freq level on Navi1x (Michel Dänzer) [2044440]
  - drm/amdgpu/gfx9: switch to golden tsc registers for renoir+ (Michel Dänzer) [2044440]
  - drm/amd/display: Set plane update flags for all planes in reset (Michel Dänzer) [2044440]
  - drm/amd/display: Fix DPIA outbox timeout after GPU reset (Michel Dänzer) [2044440]
  - drm/aspeed: Fix vga_pw sysfs output (Michel Dänzer) [2044440]
  - drm/nouveau/acr: fix a couple NULL vs IS_ERR() checks (Michel Dänzer) [2044440]
  - drm/amd/display: Fix OLED brightness control on eDP (Michel Dänzer) [2044440]
  - drm/amdgpu: IH process reset count when restart (Michel Dänzer) [2044440]
  - drm/amd/pm: avoid duplicate powergate/ungate setting (Michel Dänzer) [2044440]
  - drm/amdgpu: fix set scaling mode Full/Full aspect/Center not works on vga and dvi connectors (Michel Dänzer) [2044440]
  - drm/i915: Fix type1 DVI DP dual mode adapter heuristic for modern platforms (Michel Dänzer) [2044440]
  - drm/i915/dp: Ensure max link params are always valid (Michel Dänzer) [2044440]
  - drm/i915/dp: Ensure sink rate values are always valid (Michel Dänzer) [2044440]
  - drm/prime: Fix use after free in mmap with drm_gem_ttm_mmap (Michel Dänzer) [2044440]
  - drm/udl: fix control-message timeout (Michel Dänzer) [2044440]
  - drm/amd/display: Limit max DSC target bpp for specific monitors (Michel Dänzer) [2044440]
  - drm/amd/display: Update swizzle mode enums (Michel Dänzer) [2044440]
  - drm/cma-helper: Release non-coherent memory with dma_free_noncoherent() (Michel Dänzer) [2044440]
  - Revert "drm/i915/tgl/dsi: Gate the ddi clocks after pll mapping" (Michel Dänzer) [2044440]
  - drm/nouveau: hdmigv100.c: fix corrupted HDMI Vendor InfoFrame (Michel Dänzer) [2044440]
  - x86/speculation: Check CPU capability before applying IBRS spectre v2 mitigation (Waiman Long) [2062156 2062166] {CVE-2022-0001 CVE-2022-0002 CVE-2021-26401}
  - x86/speculation: Warn about eIBRS + LFENCE + Unprivileged eBPF + SMT (Waiman Long) [2062156 2062166] {CVE-2022-0001 CVE-2022-0002 CVE-2021-26401}
  - x86/speculation: Warn about Spectre v2 LFENCE mitigation (Waiman Long) [2062156 2062166] {CVE-2022-0001 CVE-2022-0002 CVE-2021-26401}
  - x86/speculation: Update link to AMD speculation whitepaper (Waiman Long) [2062166] {CVE-2021-26401}
  - x86/speculation: Use generic retpoline by default on AMD (Waiman Long) [2062166] {CVE-2021-26401}
  - x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting (Waiman Long) [2062156] {CVE-2022-0001 CVE-2022-0002}
  - Documentation/hw-vuln: Update spectre doc (Waiman Long) [2062156] {CVE-2022-0001 CVE-2022-0002}
  - x86/speculation: Add eIBRS + Retpoline options (Waiman Long) [2062156] {CVE-2022-0001 CVE-2022-0002}
  - x86/speculation: Rename RETPOLINE_AMD to RETPOLINE_LFENCE (Waiman Long) [2062156] {CVE-2022-0001 CVE-2022-0002}
  - x86,bugs: Unconditionally allow spectre_v2=retpoline,amd (Waiman Long) [2062156] {CVE-2022-0001 CVE-2022-0002}
  - x86: deduplicate the spectre_v2_user documentation (Waiman Long) [2062156] {CVE-2022-0001 CVE-2022-0002}
  - fuse: fix pipe buffer lifetime for direct_io (Miklos Szeredi) [2064863] {CVE-2022-1011}
  - ice: Do not enable VLAN pruning when spoofchk is enabled (Ivan Vecera) [2062343]
  - ice: don't allow to run ice_send_event_to_aux() in atomic ctx (Ivan Vecera) [2062343]
  - ice: fix 'scheduling while atomic' on aux critical err interrupt (Ivan Vecera) [2062343]
  - ice: Fix MAC address setting (Ivan Vecera) [2062343]
  - ice: Clear default forwarding VSI during release (Ivan Vecera) [2062343]
  - ice: Fix broken IFF_ALLMULTI handling (Ivan Vecera) [2062343]
  - iavf: Fix hang during reboot/shutdown (Ivan Vecera) [2062343]
  - iavf: Fix double free in iavf_reset_task (Ivan Vecera) [2062343]
  - ice: destroy flow director filter mutex after releasing VSIs (Ivan Vecera) [2062343]
  - ice: fix NULL pointer dereference in ice_update_vsi_tx_ring_stats() (Ivan Vecera) [2062343]
  - iavf: Fix adopting new combined setting (Ivan Vecera) [2062343]
  - iavf: Fix handling of vlan strip virtual channel messages (Ivan Vecera) [2062343]
  - iavf: Fix __IAVF_RESETTING state usage (Ivan Vecera) [2062343]
  - iavf: Fix missing check for running netdev (Ivan Vecera) [2062343]
  - iavf: Fix deadlock in iavf_reset_task (Ivan Vecera) [2062343]
  - iavf: Fix race in init state (Ivan Vecera) [2062343]
  - iavf: Fix locking for VIRTCHNL_OP_GET_OFFLOAD_VLAN_V2_CAPS (Ivan Vecera) [2062343]
  - iavf: Fix init state closure on remove (Ivan Vecera) [2062343]
  - iavf: Add waiting so the port is initialized in remove (Ivan Vecera) [2062343]
  - iavf: Rework mutexes for better synchronisation (Ivan Vecera) [2062343]
  - iavf: remove an unneeded variable (Ivan Vecera) [2062343]
  - iavf: Fix limit of total number of queues to active queues of VF (Ivan Vecera) [2062343]
  - iavf: Restrict maximum VLAN filters for VIRTCHNL_VF_OFFLOAD_VLAN_V2 (Ivan Vecera) [2062343]
  - iavf: Add support for VIRTCHNL_VF_OFFLOAD_VLAN_V2 offload enable/disable (Ivan Vecera) [2062343]
  - iavf: Add support for VIRTCHNL_VF_OFFLOAD_VLAN_V2 hotpath (Ivan Vecera) [2062343]
  - iavf: Add support VIRTCHNL_VF_OFFLOAD_VLAN_V2 during netdev config (Ivan Vecera) [2062343]
  - iavf: Add support for VIRTCHNL_VF_OFFLOAD_VLAN_V2 negotiation (Ivan Vecera) [2062343]
  - virtchnl: Add support for new VLAN capabilities (Ivan Vecera) [2062343]
  - virtchnl: Use the BIT() macro for capability/offload flags (Ivan Vecera) [2062343]
  - virtchnl: Remove unused VIRTCHNL_VF_OFFLOAD_RSVD define (Ivan Vecera) [2062343]
  - virtchnl: Add missing padding to virtchnl_proto_hdrs (Ivan Vecera) [2062343]
  - ice: Fix race condition during interface enslave (Ivan Vecera) [2062343]
  - ice: Fix curr_link_speed advertised speed (Ivan Vecera) [2062343]
  - ice: Don't use GFP_KERNEL in atomic context (Ivan Vecera) [2062343]
  - ice: Fix error with handling of bonding MTU (Ivan Vecera) [2062343]
  - ice: stop disabling VFs due to PF error responses (Ivan Vecera) [2062343]
  - ice: initialize local variable 'tlv' (Ivan Vecera) [2062343]
  - ice: check the return of ice_ptp_gettimex64 (Ivan Vecera) [2062343]
  - ice: fix concurrent reset and removal of VFs (Ivan Vecera) [2062343]
  - ice: fix setting l4 port flag when adding filter (Ivan Vecera) [2062343]
  - ice: Match on all profiles in slow-path (Ivan Vecera) [2062343]
  - ice: enable parsing IPSEC SPI headers for RSS (Ivan Vecera) [2062343]
  - ice: Avoid RTNL lock when re-creating auxiliary device (Ivan Vecera) [2062343]
  - ice: Fix KASAN error in LAG NETDEV_UNREGISTER handler (Ivan Vecera) [2062343]
  - ice: fix IPIP and SIT TSO offload (Ivan Vecera) [2062343]
  - ice: fix an error code in ice_cfg_phy_fec() (Ivan Vecera) [2062343]
  - ice: Use bitmap_free() to free bitmap (Ivan Vecera) [2062343]
  - ice: Optimize a few bitmap operations (Ivan Vecera) [2062343]
  - ice: Slightly simply ice_find_free_recp_res_idx (Ivan Vecera) [2062343]
  - ice: improve switchdev's slow-path (Ivan Vecera) [2062343]
  - ice: replay advanced rules after reset (Ivan Vecera) [2062343]
  - ice: Add flow director support for channel mode (Ivan Vecera) [2062343]
  - ice: trivial: fix odd indenting (Ivan Vecera) [2062343]
  - ice: support crosstimestamping on E822 devices if supported (Ivan Vecera) [2062343]
  - ice: exit bypass mode once hardware finishes timestamp calibration (Ivan Vecera) [2062343]
  - ice: ensure the hardware Clock Generation Unit is configured (Ivan Vecera) [2062343]
  - ice: implement basic E822 PTP support (Ivan Vecera) [2062343]
  - ice: convert clk_freq capability into time_ref (Ivan Vecera) [2062343]
  - ice: introduce ice_ptp_init_phc function (Ivan Vecera) [2062343]
  - ice: use 'int err' instead of 'int status' in ice_ptp_hw.c (Ivan Vecera) [2062343]
  - ice: PTP: move setting of tstamp_config (Ivan Vecera) [2062343]
  - ice: introduce ice_base_incval function (Ivan Vecera) [2062343]
  - ice: xsk: fix cleaned_count setting (Ivan Vecera) [2062343]
  - ice: xsk: allow empty Rx descriptors on XSK ZC data path (Ivan Vecera) [2062343]
  - ice: xsk: allocate separate memory for XDP SW ring (Ivan Vecera) [2062343]
  - ice: xsk: return xsk buffers back to pool when cleaning the ring (Ivan Vecera) [2062343]
  - ice: use modern kernel API for kick (Ivan Vecera) [2062343]
  - ice: tighter control over VSI_DOWN state (Ivan Vecera) [2062343]
  - ice: use prefetch methods (Ivan Vecera) [2062343]
  - ice: update to newer kernel API (Ivan Vecera) [2062343]
  - ice: support immediate firmware activation via devlink reload (Ivan Vecera) [2062343]
  - ice: reduce time to read Option ROM CIVD data (Ivan Vecera) [2062343]
  - ice: move ice_devlink_flash_update and merge with ice_flash_pldm_image (Ivan Vecera) [2062343]
  - ice: move and rename ice_check_for_pending_update (Ivan Vecera) [2062343]
  - ice: devlink: add shadow-ram region to snapshot Shadow RAM (Ivan Vecera) [2062343]
  - ice: Remove unused ICE_FLOW_SEG_HDRS_L2_MASK (Ivan Vecera) [2062343]
  - ice: Remove unnecessary casts (Ivan Vecera) [2062343]
  - ice: Propagate error codes (Ivan Vecera) [2062343]
  - ice: Remove excess error variables (Ivan Vecera) [2062343]
  - ice: Cleanup after ice_status removal (Ivan Vecera) [2062343]
  - ice: Remove enum ice_status (Ivan Vecera) [2062343]
  - ice: Use int for ice_status (Ivan Vecera) [2062343]
  - ice: Remove string printing for ice_status (Ivan Vecera) [2062343]
  - ice: Refactor status flow for DDP load (Ivan Vecera) [2062343]
  - ice: Refactor promiscuous functions (Ivan Vecera) [2062343]
  - ice: refactor PTYPE validating (Ivan Vecera) [2062343]
  - ice: Add package PTYPE enable information (Ivan Vecera) [2062343]
  - ice: safer stats processing (Ivan Vecera) [2062343]
  - ice: fix adding different tunnels (Ivan Vecera) [2062343]
  - ice: fix choosing UDP header type (Ivan Vecera) [2062343]
  - ice: ignore dropped packets during init (Ivan Vecera) [2062343]
  - ice: rearm other interrupt cause register after enabling VFs (Ivan Vecera) [2062343]
  - net/ice: Remove unused enum (Ivan Vecera) [2062343]
  - net/ice: Fix boolean assignment (Ivan Vecera) [2062343]
  - net/ice: Add support for enable_iwarp and enable_roce devlink param (Ivan Vecera) [2062343]
  - ice: avoid bpf_prog refcount underflow (Ivan Vecera) [2062343]
  - ice: fix vsi->txq_map sizing (Ivan Vecera) [2062343]
  - ice: Hide bus-info in ethtool for PRs in switchdev mode (Ivan Vecera) [2062343]
  - ice: Clear synchronized addrs when adding VFs in switchdev mode (Ivan Vecera) [2062343]
  - ice: fix error return code in ice_get_recp_frm_fw() (Ivan Vecera) [2062343]
  - ice: Fix clang -Wimplicit-fallthrough in ice_pull_qvec_from_rc() (Ivan Vecera) [2062343]
  - ice: Add support to print error on PHY FW load failure (Ivan Vecera) [2062343]
  - ice: Add support for changing MTU on PR in switchdev mode (Ivan Vecera) [2062343]
  - ice: send correct vc status in switchdev (Ivan Vecera) [2062343]
  - ice: support for GRE in eswitch (Ivan Vecera) [2062343]
  - ice: low level support for tunnels (Ivan Vecera) [2062343]
  - ice: VXLAN and Geneve TC support (Ivan Vecera) [2062343]
  - ice: support for indirect notification (Ivan Vecera) [2062343]
  - ice: Add tc-flower filter support for channel (Ivan Vecera) [2062343]
  - ice: enable ndo_setup_tc support for mqprio_qdisc (Ivan Vecera) [2062343]
  - ice: Add infrastructure for mqprio support via ndo_setup_tc (Ivan Vecera) [2062343]
  - ice: fix an error code in ice_ena_vfs() (Ivan Vecera) [2062343]
  - ice: use devm_kcalloc() instead of devm_kzalloc() (Ivan Vecera) [2062343]
  - ice: Make use of the helper function devm_add_action_or_reset() (Ivan Vecera) [2062343]
  - ice: Refactor PR ethtool ops (Ivan Vecera) [2062343]
  - ice: Forbid trusted VFs in switchdev mode (Ivan Vecera) [2062343]
  - ice: Manage act flags for switchdev offloads (Ivan Vecera) [2062343]
  - ice: introduce XDP_TX fallback path (Ivan Vecera) [2062343]
  - ice: optimize XDP_TX workloads (Ivan Vecera) [2062343]
  - ice: propagate xdp_ring onto rx_ring (Ivan Vecera) [2062343]
  - ice: do not create xdp_frame on XDP_TX (Ivan Vecera) [2062343]
  - ice: unify xdp_rings accesses (Ivan Vecera) [2062343]
  - ice: ndo_setup_tc implementation for PR (Ivan Vecera) [2062343]
  - ice: ndo_setup_tc implementation for PF (Ivan Vecera) [2062343]
  - ice: Allow changing lan_en and lb_en on all kinds of filters (Ivan Vecera) [2062343]
  - ice: cleanup rules info (Ivan Vecera) [2062343]
  - ice: allow deleting advanced rules (Ivan Vecera) [2062343]
  - ice: allow adding advanced rules (Ivan Vecera) [2062343]
  - ice: create advanced switch recipe (Ivan Vecera) [2062343]
  - ice: manage profiles and field vectors (Ivan Vecera) [2062343]
  - ice: implement low level recipes functions (Ivan Vecera) [2062343]
  - ice: add port representor ethtool ops and stats (Ivan Vecera) [2062343]
  - ice: switchdev slow path (Ivan Vecera) [2062343]
  - ice: rebuild switchdev when resetting all VFs (Ivan Vecera) [2062343]
  - ice: enable/disable switchdev when managing VFs (Ivan Vecera) [2062343]
  - ice: introduce new type of VSI for switchdev (Ivan Vecera) [2062343]
  - ice: set and release switchdev environment (Ivan Vecera) [2062343]
  - net: export metadata_dst_free() (Ivan Vecera) [2062343]
  - ice: allow changing lan_en and lb_en on dflt rules (Ivan Vecera) [2062343]
  - ice: manage VSI antispoof and destination override (Ivan Vecera) [2062343]
  - ice: allow process VF opcodes in different ways (Ivan Vecera) [2062343]
  - ice: introduce VF port representor (Ivan Vecera) [2062343]
  - ice: Move devlink port to PF/VF struct (Ivan Vecera) [2062343]
  - ice: support basic E-Switch mode control (Ivan Vecera) [2062343]
  - ethernet: use eth_hw_addr_set() for dev->addr_len cases (Ivan Vecera) [2062343]
  - ethernet: use eth_hw_addr_set() instead of ether_addr_copy() (Ivan Vecera) [2062343]
  - ice: Use xdp_buf instead of rx_buf for xsk zero-copy (Ivan Vecera) [2062343]
  - ice: fix FDIR init missing when reset VF (Ivan Vecera) [2062343]
  - intel: Remove rcu_read_lock() around XDP program invocation (Ivan Vecera) [2062343]
  - intel: Update drivers to use ethtool_sprintf (Ivan Vecera) [2062343]
  - ice: fix conversion to new udp_tunnel infrastructure (Ivan Vecera) [2062343]
  - intel-ethernet: clean up W=1 warnings in kdoc (Ivan Vecera) [2062343]
  - PCI: Use 'pci_channel_state_t' instead of 'enum pci_channel_state' (Ivan Vecera) [2062343]
  - treewide: Use sizeof_field() macro (Ivan Vecera) [2062343]
  - devlink: Add 'enable_iwarp' generic device param (Ivan Vecera) [2062343]
  - devlink: Add new "enable_vnet" generic device param (Ivan Vecera) [2062343]
  - devlink: Add new "enable_rdma" generic device param (Ivan Vecera) [2062343]
  - devlink: Add new "enable_eth" generic device param (Ivan Vecera) [2062343]
  - gfs2: dequeue iopen holder in gfs2_inode_lookup error (Bob Peterson) [2061665]


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.6.1.el8]
changelog:
  - configs: enable CONFIG_RMI4_F3A (Benjamin Tissoires) [2067219]
  - Input: synaptics-rmi4 - add support for F3A (Benjamin Tissoires) [2067219]
  - RDMA/cma: Do not change route.addr.src_addr.ss_family (Kamal Heib) [2032074] {CVE-2021-4028}
  - drm/i915/adl_s: Remove require_force_probe protection (Michel Dänzer) [2025896]
  - drm/i915/adl_s: Update ADL-S PCI IDs (Michel Dänzer) [2025896]
  - drm/i915: Limit Wa_22010178259 to affected platforms (Michel Dänzer) [2025896]
  - drm/i915/adl_s: Fix dma_mask_size to 39 bit (Michel Dänzer) [2025896]
  - drm/i915/dmc: Update DMC to v2.14 on ADL-P (Michel Dänzer) [2060051]
  - drm/i915: Update memory bandwidth formulae (Michel Dänzer) [2060051]
  - drm/i915/fb: Fold modifier CCS type/tiling attribute to plane caps (Michel Dänzer) [2060051]
  - drm/i915/fb: Don't store bitmasks in the intel_plane_caps enum (Michel Dänzer) [2060051]
  - drm/i915/adl_p: Add ddc pin mapping (Michel Dänzer) [2060051]
  - iommu/amd: Fix I/O page table memory leak (Jerry Snitselaar) [2053210]
  - iommu/amd: Recover from event log overflow (Jerry Snitselaar) [2053210]


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.7.1.el8]
changelog:
  - netfilter: nf_tables_offload: incorrect flow offload action array size (Florian Westphal) [2056728] {CVE-2022-25636}
  - netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create (Florian Westphal) [2056728]
  - KVM: SVM: Allow AVIC support on system w/ physical APIC ID > 255 (Bandan Das) [2033068]
  - PCI/ACPI: Fix acpi_pci_osc_control_set() kernel-doc comment (Mark Langsdorf) [2049209]
  - PCI/ACPI: Check for _OSC support in acpi_pci_osc_control_set() (Mark Langsdorf) [2049209]
  - PCI/ACPI: Move _OSC query checks to separate function (Mark Langsdorf) [2049209]
  - PCI/ACPI: Move supported and control calculations to separate functions (Mark Langsdorf) [2049209]
  - PCI/ACPI: Remove OSC_PCI_SUPPORT_MASKS and OSC_PCI_CONTROL_MASKS (Mark Langsdorf) [2049209]
  - kabi: Adding symbol blkdev_get_by_dev (fs/block_dev.c) (Čestmír Kalina) [2010296]
  - kabi: Adding symbol thaw_bdev (fs/block_dev.c) (Čestmír Kalina) [2010296]
  - kabi: Adding symbol freeze_bdev (fs/block_dev.c) (Čestmír Kalina) [2010296]
  - s390/cio: make ccw_device_dma_* more robust (Thomas Huth) [2066709]
  - perf/x86/intel/uncore: Make uncore_discovery clean for 64 bit addresses (Michael Petlan) [2069237]
  - redhat: switch secureboot kernel image signing to release keys (Augusto Caringi)
  - ice: xsk: Stop Rx processing when ntc catches ntu (Ivan Vecera) [2069082]
  - ice: xsk: Fix indexing in ice_tx_xsk_pool() (Ivan Vecera) [2069082]
  - ice: Fix kernel crash in XDP scenario (Ivan Vecera) [2069082]


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.8.1.el8]
changelog:
  - esp6: fix check on ipv6_skip_exthdr's return value (Sabrina Dubroca) [2054075]
  - scsi: iscsi: Fix nop handling during conn recovery (Chris Leech) [2069969]
  - scsi: iscsi: Merge suspend fields (Chris Leech) [2069969]
  - scsi: iscsi: Fix offload conn cleanup when iscsid restarts (Chris Leech) [2069969]
  - scsi: iscsi: Move iscsi_ep_disconnect (Chris Leech) [2069969]
  - CI: Remove deprecated option (Veronika Kabatova)


author: Augusto Caringi <acaringi@redhat.com> [4.18.0-372.9.1.el8]
changelog:
  - scsi: qedi: Fix failed disconnect handling (Chris Leech) [2071519]
  - scsi: iscsi: Fix unbound endpoint error handling (Chris Leech) [2071519]
  - scsi: iscsi: Fix conn cleanup and stop race during iscsid restart (Chris Leech) [2071519]
  - scsi: iscsi: Fix endpoint reuse regression (Chris Leech) [2071519]
  - scsi: iscsi: Release endpoint ID when its freed (Chris Leech) [2071519]
  - scsi: iscsi: Fix offload conn cleanup when iscsid restarts (Chris Leech) [2071519]
  - Revert "scsi: iscsi: Fix offload conn cleanup when iscsid restarts" (Chris Leech) [2071519]
  - scsi: iscsi: Speed up session unblocking and removal (Chris Leech) [2071519]
  - scsi: iscsi: Fix recovery and unblocking race (Chris Leech) [2071519]
  - scsi: iscsi: Unblock session then wake up error handler (Chris Leech) [2071519]
  - bnxt_en: make hw-tc-offload default to off (Ken Cox) [2005101]
  - bnxt_en: reject indirect blk offload when hw-tc-offload is off (Ken Cox) [2005101]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.1
changelog:
  - Resolves: rhbz#2014460 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing [rhel-8.5.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.2
changelog:
  - Resolves: rhbz#2018440 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest) [rhel-8.5.0.z]
  - Resolves: rhbz#2016923 - autofs lookups for unknown mounts are delayed for 50s [rhel-8.5.0.z]
  - Resolves: rhbz#2021499 - Make backtrace less "chatty" (avoid duplicate backtraces) [rhel-8.5.0.z]
  - Resolves: rhbz#2013379 - Lookup with fully-qualified name does not work with 'cache_first = True' [rhel-8.5.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.3
changelog:
  - Resolves: rhbz#2028828 - pam responder does not call initgroups to refresh the user entry [rhel-8.5.0.z]


author: Daiki Ueno <dueno@redhat.com> - 3.6.16-1
changelog:
  - Update to upstream 3.6.16 release (#1956783)
  - Fix potential use-after-free in key_share handling (#1927597)
  - Fix potential use-after-free in pre_shared_key handling (#1927593)
  - Stop gnutls-serv relying on AI_ADDRCONFIG to decide listening address (#1908334)
  - Fix cert expiration issue in tests (#1908110)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51.1
changelog:
  - sd-event: take ref on event loop object before dispatching event sources (#2024903)
  - pid1: fix free of uninitialized pointer in unit_fail_if_noncanonical() (#2024903)
  - Disable iptables for CI (#2024903)
  - test-seccomp: accept ENOSYS from sysctl(2) too (#2024903)
  - Disable libpitc to fix CentOS Stream CI (#2024903)
  - test: accept that char device 0/0 can now be created witout privileges (#2024903)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51.3
changelog:
  - Do not fail if the same alt. name is set again (#2030027)
  - meson: avoid bogus meson warning (#2030027)
  - meson: do not fail if rsync is not installed with meson 0.57.2 (#2030027)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.8.1.el8_5]
changelog:
  - ice: Fix VF true promiscuous mode (Jonathan Toppins) [2026698 1970643]
  - ice: Remove toggling of antispoof for VF trusted promiscuous mode (Jonathan Toppins) [2026698 1970643]
  - ice: Fix replacing VF hardware MAC to existing MAC filter (Jonathan Toppins) [2026698 1970643]
  - ice: Fix not stopping Tx queues for VFs (Jonathan Toppins) [2026698 1970643]
  - ice: Fix race conditions between virtchnl handling and VF ndo ops (Jonathan Toppins) [2026698 1970643]
  - net/netif_receive_skb_core: Use migrate_disable() (Luis Claudio R. Goncalves) [2027689 2024168]
  - crypto: jitter - consider 32 LSB for APT (Herbert Xu) [2029365 1994390]
  - xfs: fix I_DONTCACHE (Carlos Maiolino) [2028534 2024969]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.9.1.el8_5]
changelog:
  - ixgbe: Revert "bpf, devmap: Move drop error path to devmap for XDP_REDIRECT" (Ken Cox) [2029845 2024240]
  - i40e: Revert "bpf, devmap: Move drop error path to devmap for XDP_REDIRECT" (Stefan Assmann) [2029845 2024225]
  - rcu/nocb: Perform deferred wake up before last idle's need_resched() check (Waiman Long) [2029449 2008340]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.10.1.el8_5]
changelog:
  - selftests: add a test case for mirred egress to ingress (Xin Long) [2024411 1983894]
  - net: sched: act_mirred: drop dst for the direction from egress to ingress (Xin Long) [2024411 1983894]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.11.1.el8_5]
changelog:
  - blk-mq: avoid to iterate over stale request (Ming Lei) [2034396 1997338]
  - rcu: Tighten rcu_advance_cbs_nowake() checks (Daniel Vacek) [2032579 2013408]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.12.1.el8_5]
changelog:
  - tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() (Guillaume Nault) [2021574 2016210]
  - kernel.spec: Add support to use vmlinux.h (Jiri Olsa) [2031053 1989087]
  - spec: Add vmlinux.h to kernel-devel package (Jiri Olsa) [2031053 1989087]
  - x86/mce: Avoid infinite loop for copy from user recovery (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Rename kill_it to kill_current_task (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Recover from poison found while copying from user space (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Delay clearing IA32_MCG_STATUS to the end of do_machine_check() (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Send #MC singal from task work (Prarit Bhargava) [2008789 1999550]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-348.12.2.el8_5]
changelog:
  - vfs: Out-of-bounds write of heap buffer in fs_context.c (Frantisek Hrbata) [2040585 2040586] {CVE-2022-0185}
  - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Bruno Meneguele) [2034864 2034865] {CVE-2021-4155}


author: David King <dking@redhat.com> - 2.9.7-10
changelog:
  - Fix CVE-2021-3516 (#1956976)
  - Fix CVE-2021-3517 (#1957001)
  - Fix CVE-2021-3518 (#1957028)
  - Fix CVE-2021-3537 (#1957284)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.4
changelog:
  - Resolves: rhbz#2030651 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries [rhel-8.5.0.z]
  - Resolves: rhbz#2035285 - AD Domain in the AD Forest Missing after sssd latest update [rhel-8.5.0.z]


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.28-164.2
changelog:
  - CVE-2022-23218, CVE-2022-23219: Fix buffer overflows in sunrpc clnt_create
    for "unix" and svcunix_create (#2045062).


author: Radovan Sroka <rsroka@redhat.com> - 1.8.29-8
changelog:
  RHEL 8.6.0 ERRATUM
  - sudoedit does not work with selinux args
  Resolves: rhbz#2029551
  - Make sure SIGCHLD is not ignored when sudo is executed
  Resolves: rhbz#1999751
  - [RFE] pass KRB5CCNAME to pam_authenticate environment if available
  Resolves: rhbz#1917379
  - utmp resource leak in sudo
  Resolves: rhbz#1986572


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.1-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
  - Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
  - Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
  - Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
  - Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
  - Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
  - Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
  - Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
  - Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
  - Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
  - Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-3
changelog:
  - Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51.4
changelog:
  - mount: don't propagate errors from mount_setup_unit() further up (#2039327)
  - test: make TEST-47 less racy (#2039327)
  - macro: define HAS_FEATURE_ADDRESS_SANITIZER also on gcc (#2039327)
  - tests: add helper function to autodetect CI environments (#2039327)
  - strv: rework FOREACH_STRING() macro (#2039327)
  - test,systemctl: use "const char*" instead of "char*" (#2039327)
  - ci: pass the $GITHUB_ACTIONS variable to the CentOS container (#2039327)
  - core: rename unit_{start_limit|condition|assert}_test() to unit_test_xyz() (#2037395)
  - core: Check unit start rate limiting earlier (#2037395)
  - sd-event: introduce callback invoked when event source ratelimit expires (#2037395)
  - core: rename/generalize UNIT(u)->test_start_limit() hook (#2037395)
  - mount: make mount units start jobs not runnable if /p/s/mountinfo ratelimit is in effect (#2037395)
  - mount: retrigger run queue after ratelimit expired to run delayed mount start jobs (#2037395)
  - pid1: add a manager_trigger_run_queue() helper (#2037395)
  - unit: add jobs that were skipped because of ratelimit back to run_queue (#2037395)
  - udev/net_id: introduce naming scheme for RHEL-8.5 (#2040244)
  - udev/net_id: remove extraneous bracket (#2040244)


author: systemd maintenance team <systemd-maint@redhat.com> - 239-51.5
changelog:
  - mount: do not update exec deps on mountinfo changes (#2038878)
  - core/mount: add implicit unit dependencies even if when mount unit is generated from /proc/self/mountinfo (#2038878)


author: Andrea Claudi <aclaudi@redhat.com> [5.12.0-1.el8]
changelog:
  - tc: f_flower: Add missing ct_state flags to usage description (Andrea Claudi) [1957243]
  - tc: f_flower: Add option to match on related ct state (Andrea Claudi) [1957243]


author: Andrea Claudi <aclaudi@redhat.com> [5.12.0-3.el8]
changelog:
  - tc: htb: improve burst error messages (Andrea Claudi) [1910745]
  - tc: u32: Fix key folding in sample option (Andrea Claudi) [1979425]
  - police: Fix normal output back to what it was (Andrea Claudi) [1981393]
  - police: Add support for json output (Andrea Claudi) [1981393]
  - police: add support for packet-per-second rate limiting (Andrea Claudi) [1981393]
  - Update kernel headers (Andrea Claudi) [1981393]
  - mptcp: add support for port based endpoint (Andrea Claudi) [1984733]


author: Than Ngo <than@redhat.com> - 3.16.0-1
changelog:
  - Resolves: #1919223, rebase to 3.16.0
  - Resolves: #1922195, Event Notification Support
  - Resolves: #1959936, Soft token does not check if an EC key is valid
  - Resolves: #1851104, import and export of secure key objects
  - Resolves: #1851106, openCryptoki ep11 token: protected key support
  - Resolves: #1851107, openCryptoki ep11 token: support attribute bound keys


author: Than Ngo <than@redhat.com> - 3.16.0-5
changelog:
  - Resolves: #1987256, pkcstok_migrate leaves options with multiple strings in opencryptoki.conf options without double-quotes


author: Andreas Schneider <asn@redhat.com> - 4.14.4-4
changelog:
  - resolves: rhbz#2021163
    Fix CVE-2016-2124
  - resolves: rhbz#2021167
    Fix CVE-2021-23192
  - resolves: rhbz#2021171
    Fix CVE-2020-25717


author: Andreas Schneider <asn@redhat.com> - 4.14.5-5
changelog:
  - resolves: rhbz#2021493 - Add missing PAC buffer types to krb5pac.idl
  - related: rbhz#2021171 - Fix regression with 'allow trusted domains = no'


author: Andreas Schneider <asn@redhat.com> - 4.14.5-9
changelog:
  - resolves: rhbz#2046174 - Fix username map script regression of CVE-2020-25717
  - resolves: rhbz#2046160 - Fix possible segfault while joining a domain
  - resolves: rhbz#2046152 - Fix CVE-2021-44142


author: Clemens Lang <cllang@redhat.com> - 1:1.1.1k-6
changelog:
  - Fixes CVE-2022-0778 openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates
  - Resolves: rhbz#2067144


author: Ondrej Dubaj <odubaj@redhat.com> - 3.26.0-14
changelog:
  - Fixed CVE-2019-5827 (#1710184)
  - Fixed CVE-2019-13750 (#1786510)
  - Fixed CVE-2019-13751 (#1786522)
  - Fixed CVE-2019-19603 (#1792013)
  - Fixed CVE-2020-13435 (#1841233)


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.11-14
changelog:
  - Introduced new memory size parameter values for UDS indexes which have
    been converted from vdo script management to LVM.
  - Related: rhbz1928284
  - Modified vdo script to fail if the same option is supplied multiple
    times.
  - Resolves: rhbz#1944087
  - Fixed permissions on the vdo script's lock directory.
  - Resolves: rhbz#1952105


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.21-14
changelog:
  - Added a tool for converting a VDO volume from the vdo management script
    to LVM. The tool can be invoked from the new vdo convert command.
  - Related: rhbz#1928284
  - Fixed a (relatively harmless) buffer overflow in vdo userspace tools.
  - Resolves: rhbz#1927938


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.41-14
changelog:
  - Integrated the vdo to lvm conversion tool into the vdo management script
    and modified the tool itself to correctly convert the UDS index so that
    dedupe information is not lost by conversion.
  - Resolves: rhbz#1928284


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.62-14
changelog:
  - Removed extraneous fields from the super block of a converted index.
  - Resolves: rhbz#1965546
  - Added a parameter to the lvm conversion tool to specify the amount of
    space to free up.
  - Resolves: rhbz#1966827
  - Fixed calculation of the number of expiring chapters in a converted
    index.
  - Resolves: rhbz#1975546


author: - Andy Walsh <awalsh@redhat.com> - 6.2.5.74-14
changelog:
  - Renamed vdo2LVM to vdopreparelvm and moved its installation location to
    /usr/libexec so that it is not in common default paths as this utility is
    intended to be called from LVM, not directly by users.
  - Related: rhbz#1986930


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-20
changelog:
  - Add --path query option (#1940895)
  - Macroize find-debuginfo script location (#2019540)
  - Validate and require subkey binding sigs on PGP pubkeys (#1958480)
  - Fixes CVE-2021-3521


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-22
changelog:
  - Fix spurious %transfiletriggerpostun execution (#2023693)
  - Skip recorded symlinks in --setperms (#1900662)


author: Than Ngo <than@redhat.com> - 2.21-17
changelog:
  - Resolves: #2025709, check shell correctly 
  - Resolves: #2009547, which treats function contents as aliases when parsing ksh


