!2054 release 4.19.90-2504.4.0

From: @chenyi211 
Reviewed-by: @Lostwayzxc 
Signed-off-by: @Lostwayzxc

SOURCE

@@ -1 +1 @@
-4.19.90-2503.3.0
+4.19.90-2504.4.0

kernel.spec

@@ -12,7 +12,7 @@
 
 %global KernelVer %{version}-%{release}.%{_target_cpu}
 
-%global hulkrelease 2503.3.0
+%global hulkrelease 2504.4.0
 
 %define with_patch 1
 
@@ -32,7 +32,7 @@
 
 Name:	 kernel
 Version: 4.19.90
-Release: %{hulkrelease}.0319
+Release: %{hulkrelease}.0325
 Summary: Linux Kernel
 License: GPLv2
 URL:	 http://www.kernel.org/
@@ -850,6 +850,258 @@ fi
 
 %changelog
 
+* Wed Apr 23 2025 chenyi <chenyi211@huawei.com> - 4.19.90-2504.4.0.0325
+- !15624  proc: fix use-after-free in proc_get_inode()
+- !15900  Backport mainline patches to avoid crash caused by rsize being 0
+- !15820  io_uring: prevent opcode speculation
+- !15751  fix-CVE-2022-49538
+- !15914  block: fix resource leak in blk_register_queue() error path
+- !15930  loop: fix UAF in mutex_spin_on_owner()
+- loop: loop_set_status_from_info() check before assignment
+- Revert "loop: loop_set_status_from_info() check before assignment"
+- block: fix resource leak in blk_register_queue() error path
+- smb: client: Update IO sizes after reconnection
+- smb: client: Store original IO parameters and prevent zero IO sizes
+- smb:client: smb: client: Add reverse mapping from tcon to superblocks
+- Revert "cifs: Prevent NULL pointer dereference caused by cifs_sb->rsize is 0"
+- !15830  ASoC: rt5645: Fix errorenous cleanup order
+- ASoC: rt5645: Fix errorenous cleanup order
+- io_uring: prevent opcode speculation
+- ALSA: jack: Fix mutex call in snd_jack_report()
+- ALSA: jack: Access input_dev under mutex
+- proc: fix use-after-free in proc_get_inode()
+
+* Wed Apr 16 2025 chenyi <chenyi211@huawei.com> - 4.19.90-2504.3.0.0324
+- !15862  tty: goldfish: Use tty_port_destroy() to destroy port
+- tty: goldfish: Use tty_port_destroy() to destroy port
+- !15843  tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
+- !15825  Fix CVE-2023-52973 for openEuler-1.0-LTS
+- tty: synclink_gt: Fix null-pointer-dereference in slgt_clean()
+- !15664  CVE-2025-21858
+- !15815  dm raid: fix accesses beyond end of raid member array
+- !15368  nfsd: clear acl_access/acl_default after releasing them
+- !15253  NFSD: prevent underflow in nfssvc_decode_writeargs()
+- vc_screen: don't clobber return value in vcs_read
+- vc_screen: modify vcs_size() handling in vcs_read()
+- vc_screen: move load of struct vc_data pointer in vcs_read() to avoid UAF
+- !15380  media: cx25821: Fix the warning when removing the module
+- !15649  media: uvcvideo: Remove dangling pointers
+- !15814  wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
+- dm raid: fix accesses beyond end of raid member array
+- wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads
+- geneve: Suppress list corruption splat in geneve_destroy_tunnels().
+- geneve: Fix use-after-free in geneve_find_dev().
+- media: uvcvideo: Remove dangling pointers
+- media: cx25821: Fix the warning when removing the module
+- nfsd: clear acl_access/acl_default after releasing them
+- NFSD: prevent underflow in nfssvc_decode_writeargs()
+
+* Wed Apr 09 2025 chenyi <chenyi211@huawei.com> - 4.19.90-2504.2.0.0323
+- !15796  ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
+- !15805  dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
+- !15806  bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
+- !15377  virtio_console: eliminate anonymous module_init & module_exit
+- bus: fsl-mc-bus: fix KASAN use-after-free in fsl_mc_bus_remove()
+- dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
+- ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
+- !15784  HID: betop: check shape of output reports
+- HID: betop: check shape of output reports
+- !15740  ftrace: Avoid potential division by zero in function_stat_show()
+- !15747  bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
+- !15637  net_sched: sch_sfq: don't allow 1 packet limit
+- !15763  dmaengine: Fix double increment of client_count in dma_chan_get()
+- !15761  EDAC/highbank: Fix memory leak in highbank_mc_probe()
+- !15638  CVE-2022-49374
+- !15692  tty: fix deadlock caused by calling printk() under tty_port->lock
+- !15693  rxrpc: Fix listen() setting the bar too high for the prealloc rings
+- !15694  firmware: arm_scmi: Fix list protocols enumeration in the base protocol
+- !15691  media: uvcvideo: Fix double free in error path
+- !15732  drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
+- !15695  fs/dcache: fix bad unlock balance in shrink_dentry_list()
+- dmaengine: Fix double increment of client_count in dma_chan_get()
+- EDAC/highbank: Fix memory leak in highbank_mc_probe()
+- bpf: Fix pointer-leak due to insufficient speculative store bypass mitigation
+- ftrace: Avoid potential division by zero in function_stat_show()
+- !15514  cpufreq: pmac32-cpufreq: Fix refcount leak bug
+- drm/rockchip: vop: fix possible null-ptr-deref in vop_bind()
+- !15677  regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
+- !15678  drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
+- !15632  macsec: fix UAF bug for real_dev
+- !15687  drivers: usb: host: Fix deadlock in oxu_bus_suspend()
+- !15688  usb: usbip: fix a refcount leak in stub_probe()
+- !15713  CVE-2022-49370
+- !15712  drbd: Fix five use after free bugs in get_initial_state
+- !15619  partitions: mac: fix handling of bogus partition table
+- !15723  phy: qcom-qmp: fix reset-controller leak on probe errors
+- !15720  nfc: nci: add flush_workqueue to prevent uaf
+- phy: qcom-qmp: fix reset-controller leak on probe errors
+- nfc: nci: add flush_workqueue to prevent uaf
+- firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle
+- firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle
+- drbd: Fix five use after free bugs in get_initial_state
+- fs/dcache: fix bad unlock balance in shrink_dentry_list()
+- firmware: arm_scmi: Fix list protocols enumeration in the base protocol
+- rxrpc: Fix listen() setting the bar too high for the prealloc rings
+- tty: fix deadlock caused by calling printk() under tty_port->lock
+- media: uvcvideo: Fix double free in error path
+- usb: usbip: fix a refcount leak in stub_probe()
+- drivers: usb: host: Fix deadlock in oxu_bus_suspend()
+- drm: msm: fix possible memory leak in mdp5_crtc_cursor_set()
+- regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt
+- tipc: check attribute length for bearer name
+- tipc: add extack messages for bearer/media failure
+- net_sched: sch_sfq: don't allow 1 packet limit
+- macsec: fix UAF bug for real_dev
+- partitions: mac: fix handling of bogus partition table
+- cpufreq: pmac32-cpufreq: Fix refcount leak bug
+- virtio_console: eliminate anonymous module_init & module_exit
+
+* Tue Apr 01 2025 chenyi <chenyi211@huawei.com> - 4.19.90-2504.1.0.0322
+- !15491  dlm: fix plock invalid read
+- !15468  ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
+- !15466  ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
+- !15653  tty: goldfish: Fix free_irq() on remove
+- !15654  media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
+- !15703  tracing: Make sure trace_printk() can output as soon as it can be used
+- !15702  trace_events_hist: add check for return value of 'create_hist_field'
+- !15708  f2fs: fix dereference of stale list iterator after loop body
+- f2fs: fix dereference of stale list iterator after loop body
+- tracing: Make sure trace_printk() can output as soon as it can be used
+- !15508  scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
+- !15509  ath9k_htc: fix uninit value bugs
+- !15506  phy: qcom-qmp: fix struct clk leak on probe errors
+- !15505  net: sfp: fix memory leak in sfp_probe()
+- trace_events_hist: add check for return value of 'create_hist_field'
+- !15647  nilfs2: do not force clear folio if buffer is referenced
+- !15628  ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
+- !15629  ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
+- !15674  arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
+- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array
+- !15661  ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
+- !15662  media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
+- !15663  ARM: versatile: Add missing of_node_put in dcscb_init
+- !15504  um: Fix out-of-bounds read in LDT setup
+- !15311  net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
+- ARM: versatile: Add missing of_node_put in dcscb_init
+- media: stk1160: If start stream fails, return buffers with VB2_BUF_STATE_QUEUED
+- ath5k: fix OOB in ath5k_eeprom_read_pcal_info_5111
+- !15502  wifi: mac80211: fix use-after-free in chanctx code
+- !15316  ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
+- !15322  can: m_can: m_can_tx_handler(): fix use after free of skb
+- !15497  cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
+- !15655  cifs: Revert two patches to prevent statistics leakage on the lo device.
+- Revert "smb: client: fix TCP timers deadlock after rmmod"
+- Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free"
+- media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init
+- tty: goldfish: Fix free_irq() on remove
+- nilfs2: do not force clear folio if buffer is referenced
+- ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe
+- ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe
+- ath9k_htc: fix uninit value bugs
+- scsi: zorro7xx: Fix a resource leak in zorro7xx_remove_one()
+- phy: qcom-qmp: fix struct clk leak on probe errors
+- net: sfp: fix memory leak in sfp_probe()
+- um: Fix out-of-bounds read in LDT setup
+- wifi: mac80211: fix use-after-free in chanctx code
+- cifs: Fix an infinite loop in cifsd caused by a failed mount attempt on port 139
+- dlm: fix plock invalid read
+- ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix
+- ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe
+- can: m_can: m_can_tx_handler(): fix use after free of skb
+- ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock
+- net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register
+
+* Wed Mar 26 2025 chenyi <chenyi211@huawei.com> - 4.19.90-2503.5.0.0321
+- !15605  mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
+- !15600  vfio/platform: check the bounds of read/write syscalls
+- !15633  ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
+- !15634  ALSA: oss: Fix PCM OSS buffer allocation overflow
+- ALSA: oss: Fix PCM OSS buffer allocation overflow
+- ASoC: atmel: Add missing of_node_put() in at91sam9g20ek_audio_probe
+- !15582  CVE-2022-49508
+- !15467  net: mdio: unexport __init-annotated mdio_bus_init()
+- !15465  CVE-2022-49490
+- !15604 v3  rtc: Fix race when disable/enable UIE in rtc_set_time()
+- !15583  block: fix error unwinding in blk_register_queue
+- mm/hugetlb: fix surplus pages in dissolve_free_huge_page()
+- rtc: Fix race when disable/enable UIE in rtc_set_time()
+- rtc: Cleanup for UIE timer/polling emulation support
+- vfio/platform: check the bounds of read/write syscalls
+- !15586  scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
+- scsi: lpfc: Fix null pointer dereference after failing to issue FLOGI and PLOGI
+- !15569  ubi: ubi_create_volume: Fix use-after-free when volume creation failed
+- !15579  block: Fix handling of offline queues in blk_mq_alloc_request_hctx()
+- !15578  scsi: target: tcmu: Fix possible page UAF
+- !15577  drm/plane: Move range check for format_count earlier
+- !15576  drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
+- block: fix error unwinding in blk_register_queue
+- HID: elan: Fix potential double free in elan_input_configured
+- HID: elan: Fix memleak in elan_input_configured
+- block: Fix handling of offline queues in blk_mq_alloc_request_hctx()
+- scsi: target: tcmu: Fix possible page UAF
+- drm/plane: Move range check for format_count earlier
+- drm/amdgpu/cs: make commands with 0 chunks illegal behaviour.
+- ubi: ubi_create_volume: Fix use-after-free when volume creation failed
+- net: mdio: unexport __init-annotated mdio_bus_init()
+- drm/msm/mdp5: Fix global state lock backoff
+- drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected
+
+* Wed Mar 19 2025 chenyi <chenyi211@huawei.com> - 4.19.90-2503.4.0.0320
+- !15574  some CVE fixes
+- rtc: mt6397: check return value after calling platform_get_resource()
+- nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling
+- drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop()
+- !15503  ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
+- !15500  Fix 4 CVEs in JFFS2
+- !15544  ext4: fix race condition between ext4_write and ext4_convert_inline_data
+- !15521  ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
+- ext4: fix race condition between ext4_write and ext4_convert_inline_data
+- ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
+- !15495  drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume
+- !15372  xtensa: Fix refcount leak bug in time.c
+- !15494  mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
+- ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl
+- !15448  vrf: use RCU protection in l3mdev_l3_out()
+- !15433  scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
+- !15432  CVE-2022-49087
+- !15486  mm: fix unexpected zeroed page mapping with zram swap
+- !15487  CVE-2022-49514
+- !15485  media: venus: hfi: avoid null dereference in deinit
+- !15484  drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected
+- jffs2: fix memory leak in jffs2_do_fill_super
+- jffs2: fix memory leak in jffs2_do_mount_fs
+- jffs2: fix memory leak in jffs2_scan_medium
+- jffs2: fix use-after-free in jffs2_clear_xattr_subsystem
+- drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume
+- mips: cpc: Fix refcount leak in mips_cpc_default_phys_base
+- !15371  pinctrl: ralink: Check for null return of devm_kcalloc
+- !15343  ipw2x00: Fix potential NULL dereference in libipw_xmit()
+- !15342  drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
+- !15425  CVE-2022-49513
+- ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe
+- ASoC: mediatek: mt8173: fix device_node leak
+- mm: fix unexpected zeroed page mapping with zram swap
+- media: venus: hfi: avoid null dereference in deinit
+- drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected
+- !15461  be2net: Fix buffer overflow in be_get_module_eeprom
+- !15443  i40e: Fix call trace in setup_tx_descriptors
+- !15442  nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
+- !15458  sfc: fix kernel panic when creating VF
+- be2net: Fix buffer overflow in be_get_module_eeprom
+- sfc: fix kernel panic when creating VF
+- vrf: use RCU protection in l3mdev_l3_out()
+- i40e: Fix call trace in setup_tx_descriptors
+- nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred
+- scsi: qla2xxx: Suppress a kernel complaint in qla_create_qpair()
+- rxrpc: Restore removed timer deletion
+- rxrpc: fix a race in rxrpc_exit_net()
+- cpufreq: governor: Use kobject release() method to free dbs_data
+- cpufreq: Move to_gov_attr_set() to cpufreq.h
+- xtensa: Fix refcount leak bug in time.c
+- pinctrl: ralink: Check for null return of devm_kcalloc
+- ipw2x00: Fix potential NULL dereference in libipw_xmit()
+- drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes
+
 * Wed Mar 12 2025 chenyi <chenyi211@huawei.com> - 4.19.90-2503.3.0.0319
 - !15415  tracing/histograms: Fix memory leak problem
 - !15415  tracing/histograms: Fix memory leak problem