# changelog

author: Alan Bartlett <ajb@elrepo.org> - 1.1.7-3
changelog:
  - Updated to the 29700 variant of the 1.1.7 source tarball.
  - Set release to 3 so as to be in sync with the EL5 version.


author: Zdenek Prikryl <zprikryl@redhat.com> - 1.0.8-1
changelog:
  - Updated to version 1.0.8
  - power.sh works with ConsoleKit >= 0.3.0 (#470752)
  - Fixed conditions in power.sh, which look for power-managers (#470752)
  - Added check to init script


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-4
changelog:
  - ALMODP-121: Removed files with 1667 uid
  - ALMODP-120: fix httpd24-alt-mod-passenger spec for new httpd24-httpd


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 5.3.7-6
changelog:
  - ALMODP-134: Fix write application custom passenger log to user's tmp under cagefs
  - ALMODP-135: Deleted writing warning to main apache log when using user's custom log


author: Sergey Kokhan <skokhan@cloudlinux.com> - 5.3.7-14
changelog:
  - ALMODP-143: httpd24-alt-mod-passenger installation paths for mod_passenger.so and mod_passenger.conf changed


author: Darya Malyavkina <dmalyavkina@cloudlinux.com> - 7.2.32-2
changelog:
  - MODLS-741: Make LSCRIU log messages with timestamps
  - MODLS-804: Improve mod_lsapi & lsphp error reporting in case of php memory limit reached
  - ALTPHP-961: Update litespeed to 7.7 version


changelog: - Added governor support
author:
  Alexandr Demeshko <ademeshko@cloudlinux.com>, Daria Kavchuk <dkavchuk@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> 10.4.12-1


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 10.4.15-1
changelog:
  - MYSQLG-533: Updated to 10.4.15
  - MYSQLG-523: mysqld init.d symlink added to server package
  - MYSQLG-524: /var/run/mysqld dir added to server package
  - MYSQLG-525: Vendor info fixed in server prein scriptlet
  - MYSQLG-528: mariabackup added to server package


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 10.4.17-2
changelog:
  - MYSQLG-563: libmariadb Provides added to meta-client package
  - MYSQLG-563: libmariadb with symlinks moved into private dir
  - MYSQLG-563: rpm autoreq and autoprov disabled


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 10.5.8-1
changelog:
  - Updated to 10.5.8
  - mysqld init.d symlink added to server package
  - /var/run/mysqld dir added to server package
  - Vendor info fixed in server prein scriptlet
  - mariabackup added to server package
  - mysql(d) systemd service restored
  - log files added to server package
  - libmariadb.so excluded from rpm provides


changelog: - Initial release
author:
  Pavel Mogilnikov <pmogilnikov@cloudlinux.com>, Alisher Matkurbanov <amatkurbanov@cloudlinux.com>, Pavel Negrobov <pnegrobov@cloudlinux.com> 1.0.4-1


author: Alisher Matkurbanov <amatkurbanov@cloudlinux.com> 1.0.5-1
changelog:
  - LU-2000: Add user info to sentry reports
  - LU-2003: Fix sql query failing with empty database
  - LU-1990: Fix python logger sentry errors duplication
  - LU-1972: Refactor WMT unit-tests for using mocks


author: Alexander Tishin <atishin@cloudlinux.com> 0.1-3
changelog:
  - Separate config files for CageFS
  - Rename cl-datacycle to cloudlinux-fchange
  - Start collector service automatically after package install


author: Alexander Tishin <atishin@cloudlinux.com> 0.1-4
changelog:
  - Add user_ro_mode_min_uid parameter to control user read-only mode feature
  - Fix default config file name in the collector


author: Alexander Tishin <atishin@cloudlinux.com>, Igor Savenko <bliss@cloudlinux.com> 0.1-6
changelog:
  - CLEN-43: Provide help for cloudlinux-backup-helper-uid
  - CLEN-44: Fix the way timestamps are handled in cloudlinux-backup-helper
  - Bugfix: atexit deletes pidfile after fork


author: Igor Savenko <bliss@cloudlinux.com> 0.1-9
changelog:
  - CLEN-48: cloullinux-file-change-collector hangs on determining if datacycle.pl is present
  - CLEN-49: Enable choosing type of file event


author: Igor Savenko <bliss@cloudlinux.com> 0.1-13
changelog:
  - CLEN-51: cloudlinux-file-change-collector crashes when database is locked.
    Rivals are terminated now if permitted in config


author: Igor Savenko <bliss@cloudlinux.com> 0.2-3
changelog:
  - CLEN-67: cloudlinux-file-change-collerctor could not flush events list when encounters exception on line parsing


author: Igor Savenko <bliss@cloudlinux.com> 0.2-3
changelog:
  - CLEN-67: cloudlinux-file-change-collector could not flush events list when encounters exception on line parsing


author: Igor Savenko <bliss@cloudlinux.com> 0.2-5
changelog:
  - Bugfix: Make cloudlinux-file-change-collector PID file non-world writeable
  - Bugfix: fixed log write sentence


author: Nalin Dahyabhai <nalin@redhat.com> - 2.8.15-1
changelog:
  - update to 2.8.15
  - update cracklib-words to the current version (2008-05-07)
  - fixup URLs for various dictionary sources that we use
  - fix freeing-an-uninitialized-pointer in the python module (SF#2907102)
  - add a disttag


author: - jim_ramsay@dell.com
changelog:
  - Adjust INSTALL_MOD_DIR since Redhat requires that the module will be placed
    in extra/{name} for weak-modules to work.


author: Simone Caronni <negativo17@gmail.com> - 2.2.0.3-14
changelog:
  - Remove systemd / SysV conversion as per new packaging guidelines.
  - Add patch for #986887 to force tarball creation.


author: Simone Caronni <negativo17@gmail.com> - 2.2.0.3-18
changelog:
  - Add ZFS On Linux patches for additional functionality/bugfixes (#1023598).
    Thanks to Darik Horn and Brian Behlendorf.


author: Simone Caronni <negativo17@gmail.com> - 2.2.0.3-19
changelog:
  - Add macros to the top of the man page to fix displaying on el5/el6 (#986660).
    Thanks to Darik Horn for the fix.


author: Philip J Perry <phil@elrepo.org> - 8.4.1-2
changelog:
  - Rebuilt against RHEL-6.2.
    [http://elrepo.org/bugs/view.php?id=210] and [http://elrepo.org/bugs/view.php?id=252]


author: Akemi Yagi <toracat@elrepo.org> - 0.0-2
changelog:
  - Packaging style now conforms to the ELRepo standard. [Alan Bartlett]
  - Built against kernel 2.6.32-220.el6.


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-102
changelog:
  - CLOS-2215: bad_users_list ownership fixed
  - CLOS-1759: dbgovernor_map mysql charset changed to utf8mb
  - CLOS-1730: Timeouts added to avoid repetive log messages


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-105
changelog:
  - CLOS-2322: Fixed DB limits not applying to users after a MySQL Governor service restart
  - CLOS-2418: MySQL 8.0 community edition repo url changed


author: Dmitry Shibut <dshibut@cloudlinux.com> Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-107
changelog:
  - CLOS-2319: EOLed cl-MariaDB 10.3 removal result to server down
  - CLOS-2471: Fixed wizzard installation


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-109
changelog:
  - CLOS-2572: LVE busy in MySQL processes issue fixed
  - CLOS-2506: Fixed MySQL community downloads URL


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.2-110
changelog:
  - CLOS-2322: Fixed issue with not applying limits after Governor service restart
  - CLOS-2535: Governor threads logging added


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-111

changelog:
  - CLOS-2645: Corrected MariaDB version detection logic for DA config
  - CLOS-2593, CLOS-2613: Added extended logging
  - CLOS-2385: Added watchdog monitoring utility to governor package
  - CLOS-2386: Implemented external Sentry logging mechanism


author:
  Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> Timur Averianov <taverianov@cloudlinux.com> 1.2-111

changelog:
  - CLOS-2645: Corrected MariaDB version detection logic for DA config
  - CLOS-2593, CLOS-2613: Added extended logging
  - CLOS-2385: Added watchdog monitoring utility to governor package
  - CLOS-2386: Implemented external Sentry logging mechanism
  - CLOS-2594, CLOS-2641: Implemented logging from MySQL and uniform logging


author: Rostyslav Tulchii <rtulchii@cloudlinux.com>, Daria Kavchuk <dkavchuk@cloudlinux.com> 1.2-47
changelog:
  - MYSQLG-422: mysql version detection for DirectAdmin improved
  - MYSQLG-421: Deleted one of cagefs force-update after governor installation


author: Sergey Kokhan <skokhan@cloudlinux.com>, Daria Kavchuk <dkavchuk@cloudlinux.com> 1.2-49
changelog:
  - MYSQLG-436: Add CL8 support for governor-mysql
  - MYSQLG-430: removed cpapi usage; cldetect instead


author: Sergey Kokhan <skokhan@cloudlinux.com>, Daria Kavchuk <dkavchuk@cloudlinux.com> 1.2-50
changelog:
  - MYSQLG-451: install script fixes for CL8
  - MYSQLG-419: setting fs.suid_dumpable value based on io permissions


author: Sergey Kokhan <skokhan@cloudlinux.com> 1.2-57
changelog:
  - MYSQLG-519: Added a link to the zendesk article in the error output
  - MYSQLG-502: Added support for gradual rollout repos


author: Sergey Kozhekin <skozhekin@cloudlinux.com>, Daria Kavchuk <dkavchuk@cloudlinux.com> 1.2-61
changelog:
  - MYSQLG-552: deletion procedure for cPanel enhanced
  - MYSQLG-552: MD5 checksum for cl8 added to the "repo_md5" dictionary


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kozhekin <skozhekin@cloudlinux.com> 1.1-44
changelog:
  - MODLS-691: Elastic APM dump request info fixed
  - MODLS-689: Support for lsapi_backend_pgrp_max_reqs and lsapi_backend_pgrp_max_crashes added
  - MODLS-530: benchmark script added
  - MODLS-684: Fix Plesk tests (issue with handlers on both platforms)


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Daria Kavchuk <dkavchuk@cloudlinux.com> 1.1-45
changelog:
  - MODLS-692: connection pool mode updated
  - MODLS-702: Apache restart added to mod_lsapi update
  - MODLS-703: rpm -q from mod_lsapi_stat removed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-46
changelog:
  - MODLS-723: proper request body length for 2G+ files
  - MODLS-722: clean shutdown support for LSAPI 7.6 added
  - MODLS-708: da_mod_lsapi installation added into da_cb_install script


author: Alexandr Demeshko <ademeshko@cloudlinux.com> Sergey Kokhan <skokhan@cloudlinux.com> 1.1-47
changelog:
  - MODLS-727: Removed /var/cpanel/conf/apache/main usage as it was removed in cPanel
  - alt-php74 support added


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-50
changelog:
  - MODLS-745: 1 second Apache restart condition detection added to starter
  - MODLS-746: Fix yum command string for CL8 stable in da_cb_install
  - MODLS-735: lsphp patch updated to to delete criu imgs when lsapi_backend_pgrp_max_crashes triggered
  - MODLS-737: DA hook script modified for CL8 and py3


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-51
changelog:
  - MODLS-789: rpm file integrity check added into da_cb_install
  - MODLS-760: Plesk removing hook fixed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-52
changelog:
  - MODLS-794: added no strict mode for configparser in stat utils
  - MODLS-800: Log level for backend PHP Notices changed


author: Alexandr Demeshko <ademeshko@cloudlinux.com> 1.1-53
changelog:
  - mod_lsapi changed for Litespeed SAPI 7.7
  - MODLS-811: Apache version detection fixed on update mod_lsapi


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.03.55-1
changelog:
  - ipcalc: detect invalid mask
  - ifup-aliases: send gratuitous ARPs when adding addresses
  - network: treat other tunnel interfaces (fixes ifdown stage)
  - kexec-disable.conf: release kexec memory properly
  - network-functions: do not send hostname via dhclient everytime
  - sysconfig/network: NO_DHCP_HOSTNAME option introduced
  - ipv6_add_addr_on_device: replace the existing address on NIC


author: David Kaspar [Dee'Kej] <dkaspar@redhat.com> - 9.03.59-1
changelog:
  - init.d/network: start vpninterfaces
  - ARPUPDATE option introduced
  - init.d/functions: sourcing for ksh fixed


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.4-70
changelog:
  - CKSIX-230: add the reserved_tairoom to the end
  - KMODLVE-273: stable-1.5 build failure
  - KMODLVE-255: additional debugging for lve integrity
  - KMODLVE-263: create vs destroy race
  - KMODLVE-259: do not spam with killer fault messages


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.4-71
changelog:
  - CKSIX-231: CVE-2019-1125: x86/speculation: Prepare entry code for Spectre v1 swapgs
  - CKSIX-231: CVE-2019-1125: x86/speculation: Enable Spectre v1 swapgs mitigations


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.4-73
changelog:
  - CKSIX-233: CVE-2019-5489: mm/mincore.c: make mincore() more conservative
  - CKSIX-233: CVE-2019-11599: coredump: fix race condition between mmget_not_zero()/get_task_mm() and core dumping
  - KMODLVE-255: disable cgrp debug for systemd own groups


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.4-75
changelog:
  - CKSIX-244: CVE-2018-12207: x86/bugs: Add ITLB_MULTIHIT bug infrastructure
  - CKSIX-244: CVE-2019-11135: x86/speculation/taa: Add sysfs reporting for TSX Async Abort
  - CKSIX-244: CVE-2019-11135: x86/speculation/taa: Add mitigation for TSX Async Abort
  - CKSIX-244: CVE-2019-11135: x86/cpu: Add a "tsx=" cmdline option with TSX  disabled by default
  - CKSIX-244: CVE-2019-11135: x86/boot: Add early cmdline parsing for options with arguments
  - CKSIX-244: CVE-2019-11135: x86/boot: Pass in size to early cmdline parsing
  - CKSIX-244: CVE-2019-11135: x86/boot: Simplify early command line parsing
  - CKSIX-244: CVE-2019-11135: x86/boot: Fix early command-line parsing when partial word matches
  - CKSIX-244: CVE-2019-11135: x86/boot: Fix early command-line parsing when matching at end
  - CKSIX-244: CVE-2019-11135: x86, boot: Carve out early cmdline parsing function
  - CKSIX-244: CVE-2019-11135: x86/cpu: Add a helper function x86_read_arch_cap_msr()
  - CKSIX-244: CVE-2019-11135: x86/msr: Add the IA32_TSX_CTRL MSR
  - CKSIX-243: make io stats available for reading


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.4-76
changelog:
  - CKSIX-246: CVE-2019-1125: add missing entries to cpu_vuln_whitelist
  - CKSIX-243: make io stats avail for reading (part 2)


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.4-77
changelog:
  - CKSIX-245: posix-cpu-timers: avoid "task->signal != NULL" checks
  - CKSIX-250: fix AB-BA deadlock with ub_lock and task lock
  - KMODLVE-318: fix stable-1.5 compilation


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.4-78
changelog:
  - CKSIX-249: CVE-2018-12207: Machine Check Error on Page Size Change
  - CKSIX-249: CVE-2019-0155: Intel GPU blitter manipulation can allow for arbitrary kernel memory write- CKSIX-249: CVE-2019-0154: Intel GPU Denial Of Service while accessing MMIO in lower power state


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.4-79
changelog:
  - CKSIX-255: tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK
  - CKSIX-255: x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
  - CKSIX-255: KVM: x86: Don't let userspace set host-reserved cr4 bits
  - CKSIX-255: KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
  - CKSIX-255: KVM: x86: Protect ioapic_write_indirect() from Spectre-v1/L1TF attacks
  - CKSIX-255: KVM: x86: Protect ioapic_read_indirect() from Spectre-v1/L1TF attacks
  - CKSIX-255: KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
  - CKSIX-255: tcp: clear tp->total_retrans in tcp_disconnect()
  - CKSIX-255: CVE-2020-0543: x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation
  - CKSIX-255: x86/cpu: Add 'table' argument to cpu_matches()
  - CKSIX-255: x86/cpu: Add a steppings field to struct x86_cpu_id
  - CKSIX-255: x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping
  - CLKRN-595: Added netconsole's oops_only feature for logging to sentry
  - CLKRN-595: fix kmodlve compilation on CL6


author: Konstantin Khorenko <khorenko@virtuozzo.com> [3.10.0-327.18.2.vz7.14.13]
changelog:
  - net/skbuff: fix skb_clone() (Andrey Ryabinin) [PSBM-38924 PSBM-47290]
  - ve/netfilter/ipset: allow modules autoload (Pavel Tikhomirov) [PSBM-46102]


author: Konstantin Khorenko <khorenko@virtuozzo.com> [3.10.0-327.18.2.vz7.14.14]
changelog:
  - ms/kmod: remove false positive warning "waiting module removal not supported: please upgrade" (Rusty Russell) [PSBM-27580 OVZ-6748 PSBM-47877]
  - ploop: push_backup: PLOOP_PEEK mode of ioctl(PLOOP_IOC_PUSH_BACKUP_IO) (Maxim Patlasov) [PSBM-47764]
  - cbt: blk_cbt_update_size() must return if cbt->block_max not changed (Maxim Patlasov)
  - cbt: blk_cbt_update_size() should not copy uninitialized data (Maxim Patlasov) [PSBM-48120]


author: Konstantin Khorenko <khorenko@virtuozzo.com> [3.10.0-327.18.2.vz7.14.15]
changelog:
  - ve/vtty: Don't free console mapping until no clients left (Cyrill Gorcunov) [PSBM-39463]
  - fs: do not allow rootfs umount (Vasily Averin) [PSBM-46437]
  - ms/kernel/sysrq: restore touch_nmi_watchdog() in show_state_filter() (Andrey Ryabinin) [PSBM-47486]
  - ploop: fix gendisk disk_stats to be seen on partition (Maxim Patlasov) [PSBM-48266]
  - modules: set module author for Virtuozzo modules (Konstantin Khorenko) [PSBM-43847]
  - ploop: "Parallels loopback device" -> "Virtuozzo loopback device" (Konstantin Khorenko) [PSBM-43847]
  - license: put correct copyrights into file headers (Konstantin Khorenko) [PSBM-43847]
  - license: drop COPYING.Parallels file (Konstantin Khorenko) [PSBM-43847]


author: Konstantin Khorenko <khorenko@virtuozzo.com> [3.10.0-327.18.2.vz7.14.16]
changelog:
  - netlink/diag: report flags for netlink sockets (Andrey Vagin) [PSBM-28386]
  - netlink: add an ability to restore messages in a receive queue (Andrey Vagin) [PSBM-28386]
  - netlink: allow to set peeking offset for sockets (Andrey Vagin) [PSBM-28386 PSBM-48484 PSBM-28386]
  - ploop: io_kaio: fix silly bug in kaio_complete_io_state() (Maxim Patlasov)
  - ploop: fix counting bio_qlen (Maxim Patlasov)
  - ve/device_cgroup: kill ACC_QUOTA permission (Andrey Ryabinin) [PSBM-48482]
  - ve/device_cgroup: allow to change device mount permission via cgroup (Andrey Ryabinin) [PSBM-48431]
  - ve/security: device_cgroup -- Allow manage devices in @pseudosuper state (Cyrill Gorcunov) [PSBM-48421]
  - ve/sysctl: remove unused fs.ve-area-access-check, net.ipv4.tcp_max_tw* (Pavel Tikhomirov) [PSBM-47061]


author: Vladimir Davydov <vdavydov@virtuozzo.com> [3.10.0-327.18.2.vz7.14.17]
changelog:
  - cgroup: fix path mangling for ve cgroups (Vladimir Davydov) [PSBM-48629]
  - cgroup: use cgroup_path_ve helper in cgroup_show_path (Vladimir Davydov)
  - Drop fairsched syscalls (Vladimir Davydov)
  - Use ve init task's css instead of opening cgroup via vfs (Vladimir Davydov) [PSBM-48629]
  - Drop VZCTL_ENV_CREATE (Vladimir Davydov)
  - Drop vz_compat boot param (Vladimir Davydov)
  - mm: memcontrol: fix race between kmem uncharge and charge reparenting (Vladimir Davydov) [OVZ-6756]
  - timers should not get negative argument (Vasily Averin) [PSBM-48475]


author: Konstantin Khorenko <khorenko@virtuozzo.com> [3.10.0-327.18.2.vz7.14.18]
changelog:
  - ve: drop not used CAP_VE_ADMIN and CAP_VE_NET_ADMIN (Vladimir Davydov)
  - ploop: fix barriers for ordinary requests (Maxim Patlasov)
  - ms/mm: memcontrol: reclaim when shrinking memory.high below usage (Johannes Weiner) [PSBM-48546]
  - rh/locks: check for fl->fl_owner != filp in show_fd_locks (Stanislav Kinsburskiy) [PSBM-48727]
  - ve/fs: namespace -- Ignore device permissions during restore (Cyrill Gorcunov) [PSBM-48188]
  - ve: mark DEF_PERMS feature deprecated (Evgenii Shatokhin) [PSBM-40280]


author: Konstantin Khorenko <khorenko@virtuozzo.com> [3.10.0-327.18.2.vz7.14.20]
changelog:
  - ve/net: sit: fix crash on newlink if VE_FEATURE_SIT is disabled (Vladimir Davydov)
  - ve/net: ipip: fix crash on newlink if VE_FEATURE_IPIP is disabled (Vladimir Davydov)
  - ve/net: ip_vti: skip per net init in ve (Vladimir Davydov) [PSBM-48698]
  - ve/net: ipip: enable in container (Vladimir Davydov) [PSBM-48608]
  - ve/fs: namespace -- Don't fail on permissions if @ve->devmnt_list is empty (Cyrill Gorcunov) [PSBM-48188]
  - ploop: deadcode cleanup in dio_submit() (Dmitry Monakhov)
  - ploop: skip redundant fsync for REQ_FUA in post_submit (Dmitry Monakhov)
  - ve/net: enable IPPROTO_ICMP inside Containers (Vasily Averin) [OVZ-6744 PSBM-47413]
  - ve/fairsched: Resurrect proc fairsched files (Vladimir Davydov) [PSBM-48824]
  - ve/binfmt_misc: Allow mount if capable(CAP_SYS_ADMIN) (Kirill Tkhai) [PSBM-47737]


author: Konstantin Khorenko <khorenko@virtuozzo.com> [3.10.0-327.18.2.vz7.14.21]
changelog:
  - ploop: push_backup: implement timeout functions (Maxim Patlasov) [PSBM-48082]
  - ploop: push_backup: health monitor thread (Maxim Patlasov) [PSBM-48082]
  - ploop: push_backup: add timeout tunable (Maxim Patlasov)
  - ploop: push_backup: extend pb_set (Maxim Patlasov)
  - ploop: push_backup: factor rb_erase() out (Maxim Patlasov)
  - ploop: push_backup: introduce pb_set structure (Maxim Patlasov) [PSBM-48082 PSBM-48082]
  - ploop: fixup barrier handling during relocation (Maxim Patlasov)
  - ploop: fix barriers for PLOOP_E_RELOC_NULLIFY (Maxim Patlasov)
  - ploop: generalize issue_flush (Dmitry Monakhov)
  - ploop: remove preflush from dio_submit (Maxim Patlasov)
  - ploop: resurrect delay_fua for io_direct (Maxim Patlasov)
  - ploop: minor rework of ->write_page() io method (Dmitry Monakhov)
  - ploop: resurrect delayed_fua for io_kaio (Maxim Patlasov)
  - ploop: minor rework of ploop_req_delay_fua_possible (Maxim Patlasov) [PSBM-47107]


author: Konstantin Khorenko <khorenko@virtuozzo.com> [3.10.0-327.18.2.vz7.14.22]
changelog:
  - Revert "ve/vmscan: do not throttle kthreads due to too_many_isolated" (Vladimir Davydov)
  - mm: vmscan: never wait on writeback pages (Vladimir Davydov) [PSBM-48115]
  - ub: account memory overcommit failures in UB_PRIVVMPAGES.failcnt (Andrey Ryabinin) [PSBM-48891]
  - ms/netfilter: x_tables: check for bogus target offset (Cyrill Gorcunov) [PSBM-49001]
  - ms/netfilter: x_tables: validate e->target_offset early (Cyrill Gorcunov) [PSBM-49001]
  - ms/netfilter: x_tables: make sure e->next_offset covers remaining blob size (Florian Westphal) [PSBM-49001]


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.4-41
changelog:
  - Fix a deadlock with hpc backup solution
  - CLKRN-92: Megaraid driver panic fixes
  - CLKRN-94: Improve a symlink attack protection by checking nested symlinks
  - CLKRN-95: Reduce high-order allocation impact in filesystem mount code 
  - CLKRN-97: Fix race condition in common hashtable implementation


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.4-42
changelog:
  - Fix a deadlock with hpc backup solution
  - CLKRN-92: Megaraid driver panic fixes
  - CLKRN-94: Improve a symlink attack protection by checking nested symlinks
  - CLKRN-95: Reduce high-order allocation impact in filesystem mount code
  - CLKRN-97: Fix race condition in common hashtable implementation


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.4-51
changelog:
  - CLKRN-125: net: netfilter: use vmalloc for ftp_buffer allocation
  - CLKRN-124: mm/memcg, ub: fix overflow in mem_cgroup_apply_beancounter()


author: Sergey Fokin <sfokin@cloudlinux.com> - 1.4-58
changelog:
  - CLKRN-63: make symlinks in /sys/dev/char be visible
  - CLKRN-138: cleanup a cpufreq_cpu_data to avoid access aftre free situation


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.4-63
changelog:
  - CLKRN-151: fixup disk errors on HyperV hosts
  - CLKRN-149: tcp: check skb tailroom before collapsing


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.4-64
changelog:
  - CLKRN-128: fs: introduce flag FS_NOTRAVERSAL_FL
  - CLKRN-145: use kern_path call to find target file
  - CLKRN-153: lockref: move lockref counter from unsigned int to signed int


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.4-59
changelog:
  - Updated version to 714 to avoid problems with migration from RHEL/CentOS
  to CloudLinux
  - Code clean-up on working with the filesystem


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.4-62
changelog:
  - Improved kernel GRUB entry checking, fixing error when initramfs might
  not be added in kernel GRUB entry


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.4-76
changelog:
  AL-2163: Reworked detection of the GRUB related issues during kernel installation/update
  CLKRN-175: register events with different number
  CLKRN-170: take into account stack_guard_gap value
  KMODLVE-121: the freezer cgroup is released before closed


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.4-76
changelog:
  - AL-2163: Reworked detection of the GRUB related issues during kernel installation/update
  - CLKRN-175: register events with different number
  - CLKRN-170: take into account stack_guard_gap value
  - KMODLVE-121: the freezer cgroup is released before closed


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-3.1
changelog:
  - KMODLVE-109: don't allow unlinked lves to block lvp cpu limit change
  - KMODLVE-111: need to print error if cgroup rename or rmdir fails


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-5
changelog:
  - AL-2163: Reworked detection of the GRUB related issues during kernel installation/update
  - CLKRN-175: register events with different number
  - CLKRN-170: take into account stack_guard_gap value
  - KMODLVE-96: allow to use self and default commands for lvp info
  - KMODLVE-119: fix potential errors on exit from LVE by using only one namespace
  - KMODLVE-121: fix module panic on exit by closing freezer cgroup first before releasing it
  - KMODLVE-122: fix kernel crash on init if cgroups mount failed


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-7
changelog:
  - CLKRN-147: fix wrong uncharge in UB0
  - CLKRN-187: ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors
  - CLKRN-194: fix for CVE-2017-8824
  - CLKRN-195: mm: Count list_lru_one::nr_items lockless


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-8
changelog:
  - Added patches for Meltdown and Spectre attacks (CVE-2017-5753, CVE-2017-5715,
    CVE-2017-5754)
  - KMODLVE-142: resync stats before returning IO usage
  - KMODLVE-141: better make distclean cleanup
  - KMODLVE-140: fix panic with module loading
  - KMODLVE-139: add ability to set debug level in load time
  - KMODLVE-138: properly check lve_cgroup_kernel_open return value
  - KMODLVE-134: code cleanup for better test coverage
  - KMODLVE-131: improve failure IDs handling
  - KMODLVE-127: lvp_lve_move implementation


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-10
changelog:
  - CLKRN-210: fix CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2'
  Fixed SPEC_CTRL and IBPB_SUPPORT features setting after microcode update
  - CLEN-61: restore serialized access to TSC through mfence
  - Restored patch to fix regression and cover CLKRN-172


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-12
changelog:
  - AL-2579: Fixed GRUB checks when system uses UEFI
  - CLKRN-153: fix possible race between dentry_kill and RCU-walk
  - KMODLVE-149: check a notifier pointer while unregistering notifiers


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-13
changelog:
  - CLKRN-219: fixed boot on Xen PV instances
  - CLKRN-230: fix ACL issue on XFS
  - Improved Meltdown/Spectre patch, returned missing chunks


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-14
changelog:
  - AL-2620: Use find-debuginfo.sh script from Fedora to reduce kernel binary RPM compile time
  - CLKRN-240: Fix NULL pointer dereference in __rds_rdma_map
  - CLKRN-234: fix a possible deadlock in the sctp socket diagnostic code
  - CLKRN-235: sched/numa: fixed softlockup in scheduler when running stressed workloads
  - CLKRN-239: fix Xen PV boot


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-15
changelog:
  - CLKRN-238: Fixed memory allocation size during procfs access
  - KMODLVE-92: Added lve ftrace events to improve debugging
  - KMODLVE-145: Check admin permissions while deleting an LVE
  - KMODLVE-153: Fixed a deadlock scenario on LVE destroy
  - KMODLVE-154: Fixed lvp mapping error which leads to inaccessible lvp
  - KMODLVE-155: Fixed incorrect IO counter value in lvetop


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-16
changelog:
  - CLKRN-250: solve the conflict between user ptrace switch and process visilibilty
    controlled by the hidepid option.


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-18
changelog:
  - CLKRN-266: x86/entry/64: Dont use IST entry for #BP stack
  - CLKRN-266: kvm/x86: fix icebp instruction handling


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-19.1
changelog:
  - Added fix for the CVE-2018-8781
  - Added fix for the CVE-2018-10675
  - CLKRN-287: Fix a CPU soft lockup during the path lookup
  - CLKRN-272: Fix kernel crashes in ia32 emulation layer


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-19.4
changelog:
  - CLKRN-315: fix an issue with the task scheduling during cond_resched()
  - KMODLVE-198: fixed stable-1.5 build


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-5
changelog:
  AL-2163: Reworked detection of the GRUB related issues during kernel installation/update
  CLKRN-175: register events with different number
  CLKRN-170: take into account stack_guard_gap value
  KMODLVE-96: allow to use self and default commands for lvp info
  KMODLVE-119: prevent from setting LVE namespace more than once
  KMODLVE-119: drop the reference to OVZ-container's net_ns
  KMODLVE-121: the freezer cgroup is released before closed
  KMODLVE-122: fix kernel crash on init if cgroups mount failed
  KMODLVE-122: add an lve_call while mounting cgroups


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-21
changelog:
  - CLKRN-322: tcp: avoid collapses in tcp_prune_queue() if possible
  - CLKRN-322: tcp: detect malicious patterns in tcp_collapse_ofo_queue()


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-23
changelog:
  - CLKRN-342: Fixed L1TF backport issues which lead to corrupted page tables
  - CLKRN-348: Fixed CVE-2018-5391
  - ipvs: Fixed infinite loop in ipvs when using ipvs in docker env
  - CLKRN-351: fix kernel crashes in bcache
  - CLKRN-354: exec Limit arguments stack to avoid pathological stack usage


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-24.2
changelog:
  - Datacycle: disabled by default
  - CLKRN-365: fixed protected hardlinks issue
  - KMODLVE-210: add backward compatibility with lve utils


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-24.3
changelog:
  - CLKRN-368: fixed issue with nproc limis during code merge
  - CLKRN-371: NUMPROC precharge is not reliable


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-24.7
changelog:
  - CLKRN-393: fs: I/O throttle on reading directory blocks
  - CLKRN-392: fs: xfs: forcibly convert v1 inodes to v2 inodes
  - CLKRN-386: add /proc/sys to proc whitelist


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-24.9
changelog:
  - CLKRN-421: ext4: handle the rest of ext4_mb_load_buddy() ENOMEM errors
    ext4: use __GFP_NOFAIL in ext4_free_blocks()
  - CLKRN-419: CVE-2018-18559: net/packet: fix a race in packet_bind() and packet_notifier()
  - CLKRN-418: userfaultfd: shmem: UFFDIO_COPY: set the page dirty if VM_WRITE is not set
    userfaultfd: shmem: add i_size checks
    userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas
    userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem
    userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-24.10
changelog:
  - CLKRN-424: IOPS limit support for mq-deadline
  - CLKRN-402: create UB cgroup and related mem, blkio cgroups in EXCL mode
  - ext4 fixes
  - root dentries need RCU-delayed freeing
  - mount: Retest MNT_LOCKED in do_umount
  - mount: Prevent MNT_DETACH from disconnecting locked mounts
  - mm fix reces and clearcache
  - fix mntput/mntput race
  - ipv6: fix possible use-after-free in ip6_xmit()
  - jbd2: don't mark block as modified if the handle is out of credits
  - CLKRN-411: avoid too long stalls in iolimits


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-25.6
changelog:
  - CLKRN-439: libxfs: pack the agfl header structure so XFS_AGFL_SIZE is correct
  - CLKRN-427: Revert "mm/memcontrol: try to free all memcg during offline"


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-25.7
changelog:
  - CLKRN-446: port stable fixes to CL7
  - CLKRN-417: enable kabi check
  - CLKRN-424: IOPS limits support for the noop IO scheduler
  - CLKRN-421: jbd2: do not fail journal because of frozen_buffer allocation failure
  - CLKRN-450: xfs: handle error if xfs_btree_get_bufs fails
  - CLKRN-147: uncharging too much 1 h 0, res numflock ub 0


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-25.8
changelog:
  - CLKRN-457: fix KABI breakage
  - CLKRN-458: CVE-2018-12126: MSBDS Microarchitectural Store Buffer Data Sampling
  - CLKRN-458: CVE-2018-12130: MFBDS Microarchitectural Fill Buffer Data Sampling
  - CLKRN-458: CVE-2018-12127: MLPDS Microarchitectural Load Port Data Sampling
  - CLKRN-458: CVE-2019-11091: MDSUM Microarchitectural Data Sampling Uncacheable Memory


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-25.9
changelog:
  - CLKRN-466: fix Infiniband connectivity
  - CLKRN-464: xfs: Allow user to kill fstrim process
  - xfs: detect agfl count corruption and reset agfl


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-25.11
changelog:
  - CLKRN-421: ratelimit memcg oom message entries to dmesg
  - CLKRN-482: CVE-2019-11477: SACK Panic
  - CLKRN-483: CVE-2019-11478: SACK Slowness  or Excess Resource Usage 
  - CLKRN-485: CVE-2019-11479: Excess Resource Consumption Due to Low MSS Values


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-24.4
changelog:
  - Fixed CVE-2018-3620, CVE-2018-3646, CVE-2018-3693, CVE-2018-5390
    CVE-2017-13215, CVE-2018-10675, CVE-2018-7566
  - CLKRN-362: virtio_balloon: fix another race between migration and ballooning


author: Vasiliy Kleschov <vkleschov@cloudlinux.com> - 1.5-24.5
changelog:
  - AL-3255: Enabled CONFIG_NETLINK_MMAP option to fix network issues in CL 7.6
  - CLKRN-389: restore  memcg_oom_disable sysctl option


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-25.4
changelog:
  - CLKRN-424: IOPS limit support for mq-deadline
  - CLKRN-402: create UB cgroup and related mem, blkio cgroups in EXCL mode
  - ext4 fixes


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-25.5
changelog:
  - root dentries need RCU-delayed freeing
  - mount: Retest MNT_LOCKED in do_umount
  - mount: Prevent MNT_DETACH from disconnecting locked mounts
  - mm fix reces and clearcache
  - fix mntput/mntput race
  - ipv6: fix possible use-after-free in ip6_xmit()
  - jbd2: don't mark block as modified if the handle is out of credits
  - CLKRN-411: avoid too long stalls in iolimits


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-26.1
changelog:
  - CLKRN-421: fs: ext4: dont't mask __GFP_NOFAIL when working with s_buddy_cache
  - CLKRN-480 xfs don't block a slab shrinker


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-26.2
changelog:
  - CLKRN-479: careful cgroups removal for CL7
  - CLKRN-498: fs: xfs: drain m_buf_workqueue before destroying m_log
  - CLKRN-499: ext4: zero out the unused memory region in the extent tree block


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-26.3
changelog:
  - CLKRN-507: don't export /proc/net{tcp,udp,unix} info
  - KMODLVE-259: do not spam with killer fault messages
  - KMODLVE-263: create vs destroy race


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-26.4
changelog:
  - CLKRN-511: CVE-2019-1125: x86/entry/64: Use JMP instead of JMPQ
  - CLKRN-511: CVE-2019-1125: fix compilation and adjust the code
  - CLKRN-511: CVE-2019-1125: x86/speculation: Enable Spectre v1 swapgs mitigations
  - CLKRN-511: CVE-2019-1125: x86/speculation: Prepare entry code for Spectre v1 swapgs
  - CLKRN-504: fs: NFS: use cond_resched() when restarting walk of delegation list
  - KMODLVE-268 improve message for race
  - KMODLVE-273: stable-1.5 build failure
  - KMODLVE-255: additional debugging for lve integrity


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-26.5
changelog:
  - CLKRN-517: CVE-2019-14835: vhost: make sure log_num < in_num
  - CLKRN-515: hugetlbfs: fix memory leak for resv_map
  - CLKRN-515: tcp: Clear sk_send_head after purging the write queue
  - CLKRN-515: x86/kprobes: Avoid kretprobe recursion bug
  - CLKRN-515: ipv4: Fix raw socket lookup for local traffic
  - CLKRN-515: ipv4: ip_do_fragment: Preserve skb_iif during fragmentation
  - CLKRN-515: scsi: storvsc: Fix calculation of sub-channel count
  - CLKRN-515: ipv6/flowlabel: wait rcu grace period before put_pid()
  - CLKRN-515: ipv6: invert flowlabel sharing check in process and user mode
  - CLKRN-515: ext4: cleanup bh release code in ext4_ind_remove_space()
  - CLKRN-515: scsi: libsas: fix a race condition when smp task timeout


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-26.6
changelog:
  - CLKRN-522: CVE-2019-14821: KVM: coalesced_mmio: add bounds checking
  - CLKRN-521: CVE-2019-5489: mm/mincore.c: make mincore() more conservative
  - CLKRN-521: CVE-2019-11599: fix race condition between mmget_not_zero()/get_task_mm() and core dumping
  - CLKRN-520: KVM: VMX: fixes for vmentry_l1d_flush module parameter
  - CLKRN-514: net: tg3: introduce separate timeout values for NVRAM r/w ops


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-27
changelog:
  - CLKRN-542: x86/msr: Add the IA32_TSX_CTRL MSR
  - CLKRN-542: x86/cpu: Add a helper function x86_read_arch_cap_msr()
  - CLKRN-542: x86/cpu: Add a "tsx=" cmdline option with TSX disabled by default
  - CLKRN-542: x86/speculation/taa: Add mitigation for TSX Async Abort
  - CLKRN-542: x86/speculation/taa: Add sysfs reporting for TSX Async Abort
  - CLKRN-542: x86/tsx: Add "auto" option to the tsx= cmdline parameter
  - CLKRN-542: x86/tsx: Add config options to set tsx=on|off|auto
  - CLKRN-542: x86/bugs: Add ITLB_MULTIHIT bug infrastructure
  - CLKRN-542: drm/i915/gen8+: Add RC6 CTX corruption WA
  - CLKRN-539: ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()
  - CLKRN-539: x86/speculation/mds: Apply more accurate check on hypervisor platform
  - CLKRN-539: hpet: Fix division by zero in hpet_time_div()
  - CLKRN-539: sched/numa: Move task_numa_free() to __put_task_struct()
  - CLKRN-539: sched/fair: Don't free p->numa_faults with concurrent readers
  - CLKRN-539: tty/ldsem, locking/rwsem: Add missing ACQUIRE to read_failed sleep loop
  - CLKRN-539: tcp: fix tcp_ecn_withdraw_cwr() to clear TCP_ECN_QUEUE_CWR
  - CLKRN-539: sched/fair: Don't assign runtime for throttled cfs_rq
  - CLKRN-539: signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig
  - CLKRN-539: crypto: talitos - check AES key size
  - CLKRN-539: crypto: ghash - fix unaligned memory access in ghash_setkey()
  - CLKRN-539: x86/ptrace: Fix possible spectre-v1 in ptrace_get_debugreg()
  - KMODLVE-292: preserve task's original umask when entering LVE


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-28
changelog:
  - CLKRN-554: KVM: x86: fix presentation of TSX feature in ARCH_CAPABILITIES
  - CLKRN-554: kvm/x86: Export MDS_NO=0 to guests when TSX is enabled
  - CLKRN-554: KVM: x86: use Intel speculation bugs and features as derived in generic x86 code
  - CLKRN-554: KVM: Introduce kvm_get_arch_capabilities()
  - CLKRN-554: kvm: x86: IA32_ARCH_CAPABILITIES is always supported
  - CLKRN-554: KVM: x86: Emulate MSR_IA32_ARCH_CAPABILITIES on AMD hosts
  - CLKRN-554: CVE-2019-19332: KVM: x86: fix out-of-bounds write in KVM_GET_EMULATED_CPUID
  - CLKRN-554: x86/atomic: Fix smp_mb__{before,after}_atomic()
  - CLKRN-554: filldir[64]: remove WARN_ON_ONCE() for bad directory entries
  - CLKRN-554: Make filldir[64]() verify the directory entry filename is valid
  - CLKRN-554: ext4: add more paranoia checking in ext4_expand_extra_isize handling
  - CLKRN-554: ext4: Introduce ext4_clamp_want_extra_isize()
  - CLKRN-551: mm: do not stall register_shrinker
  - KMODLVE-301: fix lve loading module service
  - KMODLVE-292: fix typo in umask aasignment
  - KMODLVE-288: destroy all lves and lvps before unloading kmodlve
  - KMODLVE-269  don't panic with error UBC init
  - KMODLVE-264 lets protect procfs access with LVP reference.
  - KMODLVE-255: ignore move requests


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-30
changelog:
  - CLKRN-556: bgrt: check BGRT validness on sysfs read access
  - Reverted prviously applied efi bgrt patches since it requirs a lot of changes


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-33
changelog:
  - CLKRN-556: check bgrt pointer to avoid null-ptr dereference
  - CLKRN-574: mm: resolve lock contention issue in get_vmalloc_info()


author: Vladislav Fomin <vfomin@cloudlinux.com> - 1.5-36
changelog:
  - CLKRN-589 xfs: log mount failures don't wait for buffers to be released
  - CLKRN-591: disable CL7 code which duplicate KMODLVE-master functionality


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-37
changelog:
  - CLKRN-597: ext4: wait for existing dio workers in ext4_alloc_file_blocks()
  - CLKRN-597: ext4: check for directory entries too close to block end
  - CLKRN-597: tcp: fix "old stuff" D-SACK causing SACK to be treated as D-SACK
  - CLKRN-597: vfs: fix do_last() regression
  - CLKRN-597: do_last(): fetch directory ->i_mode and ->i_uid before it's too late
  - CLKRN-597: CVE-2000-1134: CVE-2007-3852: CVE-2008-0525: CVE-2009-0416: CVE-2011-48
  34: CVE-2015-1838: CVE-2015-7442: CVE-2016-7489: namei: allow restricted O_CREAT of FIFOs and regular files
  - CLKRN-601: make CONFIG_CL_* entries visible in "menuconfig"
  - CLKRN-597: mm: mempolicy: require at least one nodeid for MPOL_PREFERRED
  - CLKRN-597: jbd2: clear JBD2_ABORT flag before journal_reset to update log tail info when load journal
  - CLKRN-597: x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
  - CLKRN-597: PCI: Don't disable bridge BARs when assigning bus resources
  - CLKRN-597: scsi: qla2xxx: Fix mtcp dump collection failure
  - CLKRN-597: CVE-2020-12114: fs/namespace.c: fix mountpoint reference counter race
  - CLKRN-597: tracing: Fix tracing_stat return values in error handling paths
  - CLKRN-597: tracing: Fix very unlikely race of registering two stat tracers
  - CLKRN-597: ext4, jbd2: ensure panic when aborting with zero errno
  - CLKRN-597: jbd2: switch to use jbd2_journal_abort() when failed to submit the commit record
  - CLKRN-597: KVM: x86: Protect MSR-based index computations from Spectre-v1/L1TF attacks in x86.c
  - CLKRN-597: KVM: x86: Protect kvm_lapic_reg_write() from Spectre-v1/L1TF attacks
  - CLKRN-597: KVM: x86: Refactor picdev_write() to prevent Spectre-v1/L1TF attacks
  - CLKRN-597: KVM: x86: Protect x86_decode_insn from Spectre-v1/L1TF attacks
  - CLKRN-597: tcp: clear tp->total_retrans in tcp_disconnect()
  - CLKRN-597: mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
  - CLKRN-597: net_sched: ematch: reject invalid TCF_EM_SIMPLE
  - CLKRN-607: random: always use batched entropy for get_random_u{32,64}
  - CLKRN-607: x86/speculation: Add Ivy Bridge to affected list
  - CLKRN-607: x86/speculation: Add SRBDS vulnerability and mitigation documentation
  - CLKRN-607: x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation
  - CLKRN-607: x86/cpu: Add 'table' argument to cpu_matches()
  - CLKRN-607: x86/cpu: Add a steppings field to struct x86_cpu_id
  - CLKRN-607: x86/cpu: Rename cpu_data.x86_mask to cpu_data.x86_stepping
  - CLKRN-600: mm: don't clear __GFP_NOFAIL when matching against mask


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-39
changelog:
  - CLKRN-610: mm: don't use "overdraft" feature if oom_guarantee is zero
  - KMODLVE-345: add do_readlinkat helper
  - CLKRN-621: xfs: set format back to extents if xfs_bmap_extents_to_btree
  - CLKRN-621: ip6_gre: fix null-ptr-deref in ip6gre_init_net()
  - CLKRN-621: mm: fix swap cache node allocation mask
  - CLKRN-621: mm/slab: use memzero_explicit() in kzfree()
  - CLKRN-621: sched/core: Fix PI boosting between RT and DEADLINE tasks
  - CLKRN-621: net: core: reduce recursion limit value
  - CLKRN-621: tcp: grow window for OOO packets only for SACK flows
  - CLKRN-621: tcp_cubic: fix spurious HYSTART_DELAY exit upon drop in min RTT
  - KMODLVE-344 generic packet mark
  - CLKRN-619: fix kmodlve srcversion printing
  - KMODLVE-345: prevent "readlink" if symlink is protected
  - KMODLVE-346: iolock vs pagelock deadlock in CL7h/8
  - KMODLVE-339: fix wrong ifdefs for lve sysctl calls
  - KMODLVE-339 cl7: fix cl7 (openvz7) based for master
  - KMODLVE-340 build: fix build with cl8.2
  - KMODLVE-337: limit maximum link count to avoid kernel stack overflow
  - KMODLVE-336: avoid scheduling under radix tree preload
  - KMODLVE-335: a debug patch to get more context info on error
  - KMODLVE-334: properly truncate events output
  - KMODLVE-327: /proc/lve/defaults crashes without .stop handler
  - KMODLVE-331: reset link depth and total limit before lookup a path


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-40
changelog:
  - CLKRN-638 xfs: prevent dropping ioend completions during buftarg wait
  - CLKRN-636: perf probe: Fix memory leakage when the probe point is not found
  - CLKRN-636: xfs: fix inode quota reservation checks
  - CLKRN-636: xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init
  - CLKRN-636: ext4: fix potential negative array index in do_split()
  - CLKRN-636: fix regression in "epoll: Keep a reference on files added to the check list"
  - CLKRN-636: do_epoll_ctl(): clean the failure exits up a bit
  - CLKRN-636: epoll: Keep a reference on files added to the check list
  - CLKRN-636: net: Fix potential wrong skb->protocol in skb_vlan_untag()
  - CLKRN-636: bonding: fix a potential double-unregister
  - CLKRN-636: PCI: Fix pci_create_slot() reference count leak
  - CLKRN-636: netfilter: nf_tables: fix destination register zeroing
  - CLKRN-636: tg3: Fix soft lockup when tg3_reset_task() fails.
  - CLKRN-636: net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init()
  - CLKRN-636: bnxt: don't enable NAPI until rings are ready
  - CLKRN-636: net: disable netpoll on fresh napis
  - CLKRN-636: iommu/vt-d: Serialize IOMMU GCMD register modifications
  - CLKRN-636: mm/hugetlb: fix a race between hugetlb sysctl handlers
  - CLKRN-633: update kernel config for master kmodlve
  - CLKRN-628: fs/binfmt_misc.c: do not allow offset overflow
  - CLKRN-611: fix use-after-free of shm file via remap_file_pages()
  - CLKRN-635: implement an ability to hide /proc/net{tcp,udp,unix}
  - CLKRN-634 get/drop reference to device in revalidate and  check_events
  - KMODLVE-348: limit warnings output
  - KMODLVE-361: disable BUG_ON(1) in LVE removal code
  - KMODLVE-330: BUG: sleeping function called from invalid context
  - KMODLVE-358: CL6h 1.5-39 loading module problem
  - KMODLVE-355: Fix ftrace hooks cleanup path


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-41
changelog:
  - CLKRN-640: use kernel built-in procfs access checks
  - CLKRN-640: enable kernel built-in procfs access checks
  - KMODLVE-366: check link_body properly
  - KMODLVE-363: add ability to account CPU/IO throttling time
  - KMODLVE-354: disallow to disable 'ftrace_enabled' parameter


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-42
changelog:
  - CLKRN-648: xfs: push the AIL in xlog_grant_head_wake
  - KMODLVE-370: lvp creating problem on kmodlve 2.0
  - KMODLVE-367: Investigate issue with unavailability to create LVE
  - KMODLVE-363: whitelist the task_sched_stat
  - KMODLVE-363: make task_sched_stat global, add missing removal code
  - CLKRN-640: enable procfs code only for CL8


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-43
changelog:
  - CLKRN-658: libfs: fix error cast of negative value in simple_attr_write()
  - CLKRN-658: perf lock: Don't free "lock_seq_stat" if read_count isn't zero
  - CLKRN-658: don't dump the threads that had been already exiting when zapped.
  - CLKRN-658: ext4: correctly report "not supported" for {usr,grp}jquota when !CONFIG_QUOTA
  - CLKRN-658: perf: Fix get_recursion_context()
  - CLKRN-658: xfs: fix a missing unlock on error in xfs_fs_map_blocks
  - CLKRN-658: iommu/amd: Increase interrupt remapping table limit to 512 entries
  - CLKRN-658: i40e: Fix of memory leak and integer truncation in i40e_virtchnl.c
  - CLKRN-658: i40e: Wrong truncation from u16 to u8
  - CLKRN-658: perf tools: Add missing swap for ino_generation
  - CLKRN-658: time: Prevent undefined behaviour in timespec64_to_ns()


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-44
changelog:
  - CLKRN-648: xfs: use sync buffer I/O for sync delwri queue submission
  - CLKRN-648: xfs: refactor buffer submission into a common helper
  - CLKRN-648: xfs: push buffer of flush locked dquot to avoid quotacheck deadlock
  - CLKRN-648: xfs: fix use-after-free race in xfs_buf_rele
  - CLKRN-638 xfs: acquire superblock freeze protection on eofblocks scans" into lve
  - CLKRN-667: added CONFIG_CL_PROC_PROTECTION=y to the config for debug kernel
  - KMODLVE-374: remove trace_printk() calls
  - KMODLVE-353: lve_enter_pid_flags() API call
  - KMODLVE-373: do not kill unkillable threads in lve_enter
  - KMODLVE-380: enable sleep in hooks and avoid calling the hooked func
  - KMODLVE-385: prevent jump out of the container's root via procfs symlinks
  - KMODLVE-383: do not cpu-starve in __lve_init
  - CLKRN-659: fix procfs access
  - KMODLVE-377: use module_mutex when resolving names
  - CLKRN-678: Revert "CLKRN-648: xfs: use sync buffer I/O for sync delwri queue submission"
  - CLKRN-678: Revert "CLKRN-648: xfs: refactor buffer submission into a common helper"
  - KMODLVE-382: fix for permissions of /proc/<pid>/task/<pid>/io file
  - KMODLVE-384: reduce memory consumption by lve procfs
  - KMODLVE-379 out of bound access


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-44
changelog:
  - CLKRN-648: xfs: use sync buffer I/O for sync delwri queue submission
  - CLKRN-648: xfs: refactor buffer submission into a common helper
  - CLKRN-648: xfs: push buffer of flush locked dquot to avoid quotacheck deadlock
  - CLKRN-648: xfs: fix use-after-free race in xfs_buf_rele
  - CLKRN-638 xfs: acquire superblock freeze protection on eofblocks scans" into lve
  - CLKRN-667: added CONFIG_CL_PROC_PROTECTION=y to the config for debug kernel
  - KMODLVE-374: remove trace_printk() calls
  - KMODLVE-353: lve_enter_pid_flags() API call
  - KMODLVE-373: do not kill unkillable threads in lve_enter
  - KMODLVE-380: enable sleep in hooks and avoid calling the hooked func
  - KMODLVE-385: prevent jump out of the container's root via procfs symlinks
  - KMODLVE-383: do not cpu-starve in __lve_init
  - CLKRN-659: fix procfs access
  - KMODLVE-377: use module_mutex when resolving names
  - CLKRN-678: Revert "CLKRN-648: xfs: use sync buffer I/O for sync delwri queue submission"
  - CLKRN-678: Revert "CLKRN-648: xfs: refactor buffer submission into a common helper"
  - CLKRN-673: disable THP by default
  - KMODLVE-382: fix for permissions of /proc/<pid>/task/<pid>/io file
  - KMODLVE-384: reduce memory consumption by lve procfs
  - KMODLVE-379 out of bound access


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-46
changelog:
  - CLKRN-686: futex: Provide and use pi_state_update_owner()
  - CLKRN-686: futex: Replace pointless printk in fixup_owner()
  - CLKRN-686: futex: Handle faults correctly for PI futexes
  - CKSIX-269: fix complete_all issue


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-47
changelog:
  - CLKRN-675: restore docker containers compatibility
  - KMODLVE-391: lvp reference is not used
  - KMODLVE-392: loadavg for root should be fully accounted


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-49
changelog:
  - KMODLVE-398: don't use ref-style in RCU-lookup
  - KMODLVE-392: wrong assignment in get_avenrun handler


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-57
changelog:
  - KMODLVE-424: fix incorrect IO throttling accounting for CL7
  - KMODLVE-431: whitelist nf_conntrack_max
  - KMODLVE-430: add missing LVE_API_ENTER/EXIT directives
  - KMODLVE-421: incorrect db_governor/sql start order


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-58
changelog:
  - CLKRN-781: whitelist /proc/lve/task_sched_stat
  - CLKRN-775: net: ipv6: send unsolicited NA on admin up


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-59
changelog:
  - CVE-2021-22555: CLKRN-793: netfilter: x_tables: fix compat match/target pad out-of-bound  write
  - KMODLVE-417: fine-grained options for lve_enter
  - KMODLVE-417: iolimits should be disabled explicitly for CL8


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-61
changelog:
  - CLKRN-801: disable vfs_cache_min_ratio
  - CLKRN-721: CVE-2021-27365: scsi: iscsi: Verify lengths on passthrough PDUs
  - CLKRN-804: datacycle should filter events by fsuid, not euid
  - CLKRN-739: allow access to /proc/sys/net/core/xfrm_acq_expires for ipsec service
  - KMODLVE-438: pump kapi version
  - CLKRN-803: fixed searching for modules to avoid broken weak-modules links


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-62
changelog:
  - CLKRN-836: call iolimits hooks always with mq
  - CLKRN-821: datacycle path names should be mangled
  - CLKRN-823: smartpqi: correct lun reset issues
  - KMODLVE-448: don't load the module if there's no CONFIG_SECURITY_PATH defined
  - KMODLVE-450: datacycle cannot flush ids > 65535


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-63
changelog:
  - CLKRN-827: ext4: add prefetching for block allocation bitmaps
  - CLKRN-838: jbd2: fix deadlock while checkpoint thread waits commit
  - CLKRN-838: jbd2: fold __process_buffer() into jbd2_log_do_checkpoint()


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-64
changelog:
  - CLKRN-863: CVE-2020-36385:  RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy
  - CLKRN-863: CVE-2020-36385: RDMA/ucma: Fix locking for ctx->events_reported
  - CLKRN-863: CVE-2020-36385: RDMA/ucma: Fix the locking of ctx->file
  - CLKRN-863: CVE-2020-36385: RDMA/cma: Add missing locking to rdma_accept()
  - KMODLVE-478: add missing LVE_API_* directives into setuid feature
  - CLKRN-859: added CAP_SYS_ADMIN capability allowing ptrace children
  - KMODLVE-470: don't restrict root process from traversing symlinks
  - KMODLVE-461: register usage cleanup
  - KMODLVE-460: unused label removal


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-65
changelog:
  - CLKRN-802: ext2: fix sleeping in atomic bugs on error
  - CLKRN-802: proc/vmcore: fix clearing user buffer by properly using clear_user()
  - CLKRN-802: netlink: annotate data races around nlk->bound
  - CLKRN-802: scsi: ses: Fix unsigned comparison with less than zero
  - CLKRN-802: scsi: core: Put LLD module refcnt after SCSI device is released
  - CLKRN-802: ipv6: tcp: drop silly ICMPv6 packet too big messages
  - CLKRN-802: tcp: annotate data races around tp->mtu_info
  - CLKRN-802: tracing: Fix bug in rb_per_cpu_empty() that might cause deadloop.
  - CLKRN-802: workqueue: fix UAF in pwq_unbound_release_workfn()
  - KMODLVE-485: iolimits are not applied to XFS


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-67
changelog:
  - CLKRN-911: virtio-balloon: fix managed page counts when migrating pages between zones
  - CLKRN-929: CVE-2022-0492: cgroup-v1: Require capabilities to set release_agent
  - KMODLVE-508: replace immutable cgroups with rmdir hooks


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-68
changelog:
  - CLKRN-944: CVE-2022-1016: netfilter: nf_tables: initialize registers in nft_do_chain()
  - CLKRN-943: CVE-2022-1015: netfilter: nf_tables: validate registers coming from userspace.


author: Anatoly Stepanov <astepanov@cloudlinux.com> - 1.5-69
changelog:
  - CLKRN-951: Revert "hide cgroups in /proc/cgroups in order to cheat systemd"
  - CLKRN-955: scsi: aacraid: fix illegal IO beyond last LBA
  - CLKRN-955: scsi: aacraid: fix shutdown crash when init fails
  - CLKRN-955: scsi: aacraid: Prevent crash in case of free interrupt during scsi EH path
  - KMODLVE-515: add missing path_put in lve_namespace_set_root


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-70
changelog:
  - KMODLVE-523: rmdir hooks are not being called
  - KMODLVE-516: network-manager has no access to mtu
  - KMODLVE-591: user_ptrace checks should account CAP_SYS_PTRACE


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-71
changelog:
  - CLKRN-974: drm/vmwgfx: Fix two list_for_each loop exit tests
  - CLKRN-974: drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
  - CLKRN-974: drm/vmwgfx: Fix double free in vmw_recv_msg()
  - CLKRN-974: drm/vmwgfx: fix memory leak when too many retries have occurred
  - CLKRN-974: drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define()
  - CLKRN-974: drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read
  - CLKRN-974: drm/vmwgfx: Don't send drm sysfs hotplug events on initial master set
  - CLKRN-974: drm/vmwgfx: Don't double-free the mode stored in par->set_mode
  - CLKRN-974: drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user
  - CLKRN-974: drm/vmwgfx: Fix setting of dma masks
  - CLKRN-974: drm/vmwgfx: Fix 32-bit VMW_PORT_HB_[IN|OUT] macros
  - CLKRN-974: drm/vmwgfx: Fix a buffer object leak
  - CLKRN-974: drm/vmwgfx: Fix a destoy-while-held mutex problem.
  - CLKRN-974: drm/vmwgfx: Potential off by one in vmw_view_add()
  - CLKRN-974: perf/core: Fix address filter parser for multiple filters
  - CLKRN-974: ext4: don't BUG if someone dirty pages without asking ext4 first
  - CLKRN-974: ext4: force overhead calculation if the s_overhead_cluster makes no sense
  - CLKRN-974: ext4: fix overhead calculation to account for the reserved gdt blocks
  - CLKRN-974: ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
  - CLKRN-974: ipv4: drop dst in multicast routing path
  - CLKRN-974: ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
  - CLKRN-974: inotify: show inotify mask flags in proc fdinfo
  - CLKRN-974: ext4: fix bug_on in ext4_writepages
  - CLKRN-974: ext4: fix use-after-free in ext4_rename_dir_prepare
  - CLKRN-974: md: protect md_unregister_thread from reentrancy
  - CLKRN-974: ext4: make variable "count" signed
  - CLKRN-974: ext4: fix bug_on ext4_mb_use_inode_pa
  - CLKRN-974: dm era: commit metadata in postsuspend after worker stops


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 1.5-71
changelog:
  - CLKRN-881: backport XFS corruption fix from Centos 7
  - CLKRN-974: drm/vmwgfx: Fix two list_for_each loop exit tests
  - CLKRN-974: drm/vmwgfx: prevent memory leak in vmw_cmdbuf_res_add
  - CLKRN-974: drm/vmwgfx: Fix double free in vmw_recv_msg()
  - CLKRN-974: drm/vmwgfx: fix memory leak when too many retries have occurred
  - CLKRN-974: drm/vmwgfx: NULL pointer dereference from vmw_cmd_dx_view_define()
  - CLKRN-974: drm/vmwgfx: integer underflow in vmw_cmd_dx_set_shader() leading to an invalid read
  - CLKRN-974: drm/vmwgfx: Don't send drm sysfs hotplug events on initial master set
  - CLKRN-974: drm/vmwgfx: Don't double-free the mode stored in par->set_mode
  - CLKRN-974: drm/vmwgfx: Return error code from vmw_execbuf_copy_fence_user
  - CLKRN-974: drm/vmwgfx: Fix setting of dma masks
  - CLKRN-974: drm/vmwgfx: Fix 32-bit VMW_PORT_HB_[IN|OUT] macros
  - CLKRN-974: drm/vmwgfx: Fix a buffer object leak
  - CLKRN-974: drm/vmwgfx: Fix a destoy-while-held mutex problem.
  - CLKRN-974: drm/vmwgfx: Potential off by one in vmw_view_add()
  - CLKRN-974: perf/core: Fix address filter parser for multiple filters
  - CLKRN-974: ext4: don't BUG if someone dirty pages without asking ext4 first
  - CLKRN-974: ext4: force overhead calculation if the s_overhead_cluster makes no sense
  - CLKRN-974: ext4: fix overhead calculation to account for the reserved gdt blocks
  - CLKRN-974: ext4: limit length to bitmap_maxbytes - blocksize in punch_hole
  - CLKRN-974: ipv4: drop dst in multicast routing path
  - CLKRN-974: ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
  - CLKRN-974: inotify: show inotify mask flags in proc fdinfo
  - CLKRN-974: ext4: fix bug_on in ext4_writepages
  - CLKRN-974: ext4: fix use-after-free in ext4_rename_dir_prepare
  - CLKRN-974: md: protect md_unregister_thread from reentrancy
  - CLKRN-974: ext4: make variable "count" signed
  - CLKRN-974: ext4: fix bug_on ext4_mb_use_inode_pa
  - CLKRN-974: dm era: commit metadata in postsuspend after worker stops


author: Denis Kirjanov <dkirjanov@cloudlnux.com> - 1.5-74
changelog:
  - CLKRN-1061: introduce __fcheck_files() to fix rcu_dereference_check_fdtable(), kill rcu_my_thread_group_empty()
  - CLKRN-1061: netfilter: nf_tables: disallow non-stateful expression in sets earlier
  - CLKRN-1061: perf: Fix sys_perf_event_open() race against self
  - CLKRN-1061: RDMA/cma: Do not change route.addr.src_addr.ss_family
  - CLKRN-1061: xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
  - CLKRN-1061: Bluetooth: use correct lock to prevent UAF of hdev object
  - CLKRN-1061: Bluetooth: fix use-after-free error in lock_sock_nested()
  - CLKRN-1061: media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
  - CLKRN-1061: CVE-2021-3564: Bluetooth: fix the erroneous flush_work() order
  - CLKRN-1061: CVE-2020-0465: HID: core: Sanitize event code and type when mapping input
  - CLKRN-1061: [media] firewire: don't break long lines
  - CLKRN-1061: [media] firewire: firedtv-avc: potential buffer overflow
  - CLKRN-1061: perf/core: Fix a memory leak in perf_event_parse_addr_filter()
  - CLKRN-1061: net_sched: cls_route: remove the right filter from hashtable
  - CLKRN-1061: bluetooth: eliminate the potential race condition when removing the HCI controller
  - CLKRN-1061: CVE-2021-29650: netfilter: x_tables: Use correct memory barriers.
  - CLKRN-1061: CVE-2020-8648: vt: selection, close sel_buffer race
  - CLKRN-1061: CVE-2021-29154:  bpf, x86: Validate computation of branch displacements for x86-64
  - CLKRN-1061: CVE-2020-14331: Fix for missing check in vgacon scrollback handling
  - CLKRN-1061: net-sysfs: Call dev_hold always in rx_queue_add_kobject
  - CLKRN-1061: net-sysfs: Call dev_hold always in netdev_queue_add_kobject
  - CLKRN-1061: net-sysfs: call dev_hold if kobject_init_and_add success
  - CLKRN-1061: Bluetooth: A2MP: Fix not initializing all members
  - CLKRN-1061: Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel
  - CLKRN-1061: [usb] USB: core: Fix races in character device registration and deregistraion
  - CLKRN-1061: [usb] usb: cdc-acm: make sure a refcount is taken early enough
  - CLKRN-1061: [usb] USB: adutux: fix use-after-free on disconnect
  - CLKRN-1061: [fs] ext4: fix support for inode sizes > 1024 bytes
  - CLKRN-1061: [fs] ext4: forbid i_extra_isize not divisible by 4
  - CLKRN-1061: [fs] ext4: validate the debug_want_extra_isize mount option at parse time
  - CLKRN-1061: CVE-2019-19062: [crypto] crypto: user - fix memory leak in crypto_report
  - CLKRN-1061: [media] media: v4l: event: Prevent freeing event subscriptions while accessed
  - CLKRN-1061: [wireless] rtlwifi: prevent memory leak in rtl_usb_probe
  - CLKRN-1061: [wireless] iwlwifi: dbg_ini: fix memory leak in alloc_sgtable
  - CLKRN-1061: CVE-2019-19524: [input] Input: ff-memless - kill timer in destroy()
  - CLKRN-1061: CVE-2017-18551: [i2c] i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
  - CLKRN-1061: [fs] ext4: work around deleting a file with i_nlink == 0 safely
  - CLKRN-1061: [netdrv] can: peak_usb: fix slab info leak
  - CLKRN-1061: [fs] fs/proc/proc_sysctl.c: Fix a NULL pointer dereference
  - CLKRN-1061: [media] media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap
  - CLKRN-1061: [scsi] scsi: libsas: delete sas port if expander discover failed
  - CLKRN-1061: CVE-2019-15917: [bluetooth] Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()
  - CLKRN-1061: [netdrv] fjes: Handle workqueue allocation failure
  - CLKRN-1061: [scsi] scsi: qla2xxx: fix a potential NULL pointer dereference
  - CLKRN-1061: CVE-2019-17053: [net] ieee802154: enforce CAP_NET_RAW for raw sockets
  - CLKRN-1061: CVE-2019-16994: [net] sit: fix memory leak in sit_init_net()
  - CLKRN-1061: CVE-2019-17055: [isdn] mISDN: enforce CAP_NET_RAW for raw sockets
  - CLKRN-1061: CVE-2019-18808: [crypto] crypto: ccp - Release all allocated memory if sha type is invalid
  - CLKRN-1061: [fs] nfs: Correct an nfs page array calculation error
  - CLKRN-1061: [security] selinux: properly handle multiple messages in selinux_netlink_send()
  - CLKRN-1061: [scsi] scsi: sg: add sg_remove_request in sg_write
  - CLKRN-1061: CVE-2020-12826: [fs] signal: Extend exec_id to 64bits
  - CLKRN-1061: CVE-2020-10732: [fs] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
  - CLKRN-1061: CVE-2020-10942: [vhost] vhost: Check docket sk_family instead of call getname
  - CLKRN-1061: [input] Input: add safety guards to input_set_keycode()
  - CLKRN-1061: [x86] kvm: x86: clear stale x86_emulate_ctxt->intercept value
  - CLKRN-1061: [x86] kvm: vmx: check descriptor table exits on instruction emulation
  - CLKRN-1061: [x86] kvm: nvmx: Check IO instruction VM-exit conditions
  - CLKRN-1061: [x86] kvm: nvmx: Refactor IO bitmap checks into helper function
  - CLKRN-1061: [x86] kvm: nvmx: Don't emulate instructions in guest mode
  - CLRKN-1061: [net] ipv6: constify ip6_dst_lookup_{flow|tail}() sock arguments
  - CLKRN-1061: CVE-2020-8649: CVE-2020-8647 [video] vgacon: Fix a UAF in vgacon_invert_region
  - CLKRN-1061: [wireless] mwifiex: Fix mem leak in mwifiex_tm_cmd
  - CLKRN-1061: [block] floppy: check FDC index for errors before assigning it
  - CLKRN-1061: mac80211: drop robust management frames from unknown TA
  - CLKRN-1061: mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
  - CLKRN-1061: mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()
  - CLKRN-1061: HID: hiddev: avoid opening a disconnected device
  - CLKRN-1061: CVE-2020-10757: mm: Fix mremap not considering huge pmd devmap
  - CLKRN-1061: vfio-pci: Invalidate mmaps and block MMIO access on disabled memory
  - CLKRN-1061: [scsi] scsi: qedi: remove memset/memcpy to nfunc and use func instead
  - CLKRN-1061: blktrace: Protect q->blk_trace with RCU
  - CLKRN-1061: netlabel: cope with NULL catmap
  - CLKRN-1061: CVE-2019-16746: [net] nl80211: validate beacon head
  - CLKRN-1061: [net] mac80211: Do not send Layer 2 Update frame before authorization
  - CLKRN-1061: cfg80211: Use const more consistently in for_each_element macros
  - CLKRN-1061: ieee80211: fix for_each_element_extid()
  - CLKRN-1061: cfg80211: add and use strongly typed element iteration macros
  - CLKRN-1061: CVE-2019-3901: [kernel] perf/core: Fix perf_event_open() vs. execve() race
  - CLKRN-1061: binfmt_elf: switch to new creds when switching to new mm
  - CLKRN-1061: CVE-2019-10638: [net] inet: switch IP ID generator to siphash
  - CLKRN-1061: CVE-2019-10638: [lib] siphash: add cryptographically secure PRF
  - CLKRN-1061: CVE-2019-10638: [fs] dcache: allow word-at-a-time name hashing with big-endian CPUs
  - CLKRN-1061: CVE-2019-15221: [sound] ALSA: line6: Fix memory leak at line6_init_pcm() error path
  - CLKRN-1061: CVE-2019-15221: [sound] ALSA: line6: Fix write on zero-sized buffer
  - CLKRN-1061: CVE-2019-14283: [block] floppy: fix out-of-bounds read in copy_buffer
  - CLKRN-1061: CVE-2019-10207: [bluetooth] Bluetooth: hci_uart: check for missing tty operations


author: Denis Kirjanov <dkirjanov@cloudlnux.com> - 1.5-74
changelog:
  - CLKRN-1061: introduce __fcheck_files() to fix rcu_dereference_check_fdtable(), kill rcu_my_thread_group_empty()
  - CLKRN-1061: CVE-2022-32250: CVE-2022-1966: netfilter: nf_tables: disallow non-stateful expression in sets earlier
  - CLKRN-1061: perf: Fix sys_perf_event_open() race against self
  - CLKRN-1061: RDMA/cma: Do not change route.addr.src_addr.ss_family
  - CLKRN-1061: xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate
  - CLKRN-1061: Bluetooth: use correct lock to prevent UAF of hdev object
  - CLKRN-1061: Bluetooth: fix use-after-free error in lock_sock_nested()
  - CLKRN-1061: media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()
  - CLKRN-1061: CVE-2021-3564: Bluetooth: fix the erroneous flush_work() order
  - CLKRN-1061: CVE-2020-0465: HID: core: Sanitize event code and type when mapping input
  - CLKRN-1061: [media] firewire: don't break long lines
  - CLKRN-1061: [media] firewire: firedtv-avc: potential buffer overflow
  - CLKRN-1061: perf/core: Fix a memory leak in perf_event_parse_addr_filter()
  - CLKRN-1061: net_sched: cls_route: remove the right filter from hashtable
  - CLKRN-1061: bluetooth: eliminate the potential race condition when removing the HCI controller
  - CLKRN-1061: CVE-2021-29650: netfilter: x_tables: Use correct memory barriers.
  - CLKRN-1061: CVE-2020-8648: vt: selection, close sel_buffer race
  - CLKRN-1061: CVE-2021-29154:  bpf, x86: Validate computation of branch displacements for x86-64
  - CLKRN-1061: CVE-2020-14331: Fix for missing check in vgacon scrollback handling
  - CLKRN-1061: net-sysfs: Call dev_hold always in rx_queue_add_kobject
  - CLKRN-1061: net-sysfs: Call dev_hold always in netdev_queue_add_kobject
  - CLKRN-1061: net-sysfs: call dev_hold if kobject_init_and_add success
  - CLKRN-1061: Bluetooth: A2MP: Fix not initializing all members
  - CLKRN-1061: Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel
  - CLKRN-1061: [usb] USB: core: Fix races in character device registration and deregistraion
  - CLKRN-1061: [usb] usb: cdc-acm: make sure a refcount is taken early enough
  - CLKRN-1061: [usb] USB: adutux: fix use-after-free on disconnect
  - CLKRN-1061: [fs] ext4: fix support for inode sizes > 1024 bytes
  - CLKRN-1061: [fs] ext4: forbid i_extra_isize not divisible by 4
  - CLKRN-1061: [fs] ext4: validate the debug_want_extra_isize mount option at parse time
  - CLKRN-1061: CVE-2019-19062: [crypto] crypto: user - fix memory leak in crypto_report
  - CLKRN-1061: [media] media: v4l: event: Prevent freeing event subscriptions while accessed
  - CLKRN-1061: [wireless] rtlwifi: prevent memory leak in rtl_usb_probe
  - CLKRN-1061: [wireless] iwlwifi: dbg_ini: fix memory leak in alloc_sgtable
  - CLKRN-1061: CVE-2019-19524: [input] Input: ff-memless - kill timer in destroy()
  - CLKRN-1061: CVE-2017-18551: [i2c] i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA
  - CLKRN-1061: [fs] ext4: work around deleting a file with i_nlink == 0 safely
  - CLKRN-1061: [netdrv] can: peak_usb: fix slab info leak
  - CLKRN-1061: [fs] fs/proc/proc_sysctl.c: Fix a NULL pointer dereference
  - CLKRN-1061: [media] media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap
  - CLKRN-1061: [scsi] scsi: libsas: delete sas port if expander discover failed
  - CLKRN-1061: CVE-2019-15917: [bluetooth] Bluetooth: hci_ldisc: Postpone HCI_UART_PROTO_READY bit set in hci_uart_set_proto()
  - CLKRN-1061: [netdrv] fjes: Handle workqueue allocation failure
  - CLKRN-1061: [scsi] scsi: qla2xxx: fix a potential NULL pointer dereference
  - CLKRN-1061: CVE-2019-17053: [net] ieee802154: enforce CAP_NET_RAW for raw sockets
  - CLKRN-1061: CVE-2019-16994: [net] sit: fix memory leak in sit_init_net()
  - CLKRN-1061: CVE-2019-17055: [isdn] mISDN: enforce CAP_NET_RAW for raw sockets
  - CLKRN-1061: CVE-2019-18808: [crypto] crypto: ccp - Release all allocated memory if sha type is invalid
  - CLKRN-1061: [fs] nfs: Correct an nfs page array calculation error
  - CLKRN-1061: [security] selinux: properly handle multiple messages in selinux_netlink_send()
  - CLKRN-1061: [scsi] scsi: sg: add sg_remove_request in sg_write
  - CLKRN-1061: CVE-2020-12826: [fs] signal: Extend exec_id to 64bits
  - CLKRN-1061: CVE-2020-10732: [fs] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info()
  - CLKRN-1061: CVE-2020-10942: [vhost] vhost: Check docket sk_family instead of call getname
  - CLKRN-1061: [input] Input: add safety guards to input_set_keycode()
  - CLKRN-1061: [x86] kvm: x86: clear stale x86_emulate_ctxt->intercept value
  - CLKRN-1061: [x86] kvm: vmx: check descriptor table exits on instruction emulation
  - CLKRN-1061: [x86] kvm: nvmx: Check IO instruction VM-exit conditions
  - CLKRN-1061: [x86] kvm: nvmx: Refactor IO bitmap checks into helper function
  - CLKRN-1061: [x86] kvm: nvmx: Don't emulate instructions in guest mode
  - CLRKN-1061: [net] ipv6: constify ip6_dst_lookup_{flow|tail}() sock arguments
  - CLKRN-1061: CVE-2020-8649: CVE-2020-8647 [video] vgacon: Fix a UAF in vgacon_invert_region
  - CLKRN-1061: [wireless] mwifiex: Fix mem leak in mwifiex_tm_cmd
  - CLKRN-1061: [block] floppy: check FDC index for errors before assigning it
  - CLKRN-1061: mac80211: drop robust management frames from unknown TA
  - CLKRN-1061: mwifiex: Fix possible buffer overflows in mwifiex_ret_wmm_get_status()
  - CLKRN-1061: mwifiex: Fix possible buffer overflows in mwifiex_cmd_append_vsie_tlv()
  - CLKRN-1061: HID: hiddev: avoid opening a disconnected device
  - CLKRN-1061: CVE-2020-10757: mm: Fix mremap not considering huge pmd devmap
  - CLKRN-1061: vfio-pci: Invalidate mmaps and block MMIO access on disabled memory
  - CLKRN-1061: [scsi] scsi: qedi: remove memset/memcpy to nfunc and use func instead
  - CLKRN-1061: blktrace: Protect q->blk_trace with RCU
  - CLKRN-1061: netlabel: cope with NULL catmap
  - CLKRN-1061: CVE-2019-16746: [net] nl80211: validate beacon head
  - CLKRN-1061: [net] mac80211: Do not send Layer 2 Update frame before authorization
  - CLKRN-1061: cfg80211: Use const more consistently in for_each_element macros
  - CLKRN-1061: ieee80211: fix for_each_element_extid()
  - CLKRN-1061: cfg80211: add and use strongly typed element iteration macros
  - CLKRN-1061: CVE-2019-3901: [kernel] perf/core: Fix perf_event_open() vs. execve() race
  - CLKRN-1061: binfmt_elf: switch to new creds when switching to new mm
  - CLKRN-1061: CVE-2019-10638: [net] inet: switch IP ID generator to siphash
  - CLKRN-1061: CVE-2019-10638: [lib] siphash: add cryptographically secure PRF
  - CLKRN-1061: CVE-2019-10638: [fs] dcache: allow word-at-a-time name hashing with big-endian CPUs
  - CLKRN-1061: CVE-2019-15221: [sound] ALSA: line6: Fix memory leak at line6_init_pcm() error path
  - CLKRN-1061: CVE-2019-15221: [sound] ALSA: line6: Fix write on zero-sized buffer
  - CLKRN-1061: CVE-2019-14283: [block] floppy: fix out-of-bounds read in copy_buffer
  - CLKRN-1061: CVE-2019-10207: [bluetooth] Bluetooth: hci_uart: check for missing tty operations


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-76
changelog:
  - CLKRN-1076: substituted ipset allocating memory to kvzalloc
  - CLKRN-1083: CVE-2022-2588: net_sched: cls_route: remove from list when handle is 0


author: Denis Kirjanov <dkirjanov@cloudlnux.com>> - 1.5-77
changelog:
  - CLKRN-1061: fget: check that the fd still exists after getting a ref to it
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: KVM: x86/speculation: Disable Fill buffer clear within guests
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: x86/speculation/mmio: Reuse SRBDS mitigation for SBDS
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: x86/speculation/srbds: Update SRBDS mitigation selection
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: cpu/speculation: Add prototype for cpu_show_srbds()
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: x86/speculation/mmio: Enable CPU Fill buffer         clearing on idle
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: x86/speculation/mmio: Add mitigation for Processor MMIO Stale Data
  - CLKRN-1078: CVE: CVE-2022-21123: CVE: CVE-2022-21125: CVE: CVE-2022-21166: x86/speculation/mmio: Enumerate Processor MMIO Stale Data bug


author: Denis Kirjanov <dkirjanov@cloudlnux.com>> - 1.5-79
changelog:
  - KRNTSTNG-292: Fix oom_kill counter in CL7
  - CLKRN-1013: Move CL7 XFS to Centos 7/OpenVZ current implementation


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-80
changelog:
  - CLKRN-1077: disable kmem accounting due to memory leak
  - CVE: mm/rmap: Fix anon_vma->degree ambiguity leading to  double-reuse
  - CVE: mm: rmap: explicitly reset vma->anon_vma in unlink_anon_vmas()
  - CVE: CVE-2022-4378: proc: proc_skip_spaces() shouldn't think it is working on C strings
  - CVE: CVE-2022-4378: proc: avoid integer type confusion in get_proc_long
  - CVE: CVE-2022-2964: net: usb: ax88179_178a: Fix packet receiving
  - CVE: CVE-2022-2964: net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
  - CVE: CVE-2022-2964: net: usb: Merge cpu_to_le32s + memcpy to put_unaligned_le32
  - CVE: CVE-2022-2964: ax88179_178a: Merge memcpy + le32_to_cpus to get_unaligned_le32
  - CVE: CVE-2022-2964: net: usb: ax88179_178a: fix packet alignment padding


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-81
changelog:
  - KMODLVE-589: avoid crashes in os_set_dac_override()
  - CLKRN-1093: allow freezable sleep in kmodlve


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-82
changelog:
  - CVE: Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
  - CVE: usb: mon: make mmapped memory read only
  - CLKRN-1176: added patch to fix ttypushback vulnerability
  - KMODLVE-596: fix cgroup stat parsing


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-83
changelog:
  - CLKRN-1406: revert some changes related to prod_net_disable2 - made the behaviour obliged
  - CLKRN-1399: improved fs.enforce_symlinksifowner option to close the SecureLink creating vulnerability


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 1.5-84
changelog:
  - CLKRN-1532: (CVE-2024-1086) netfilter: nf_tables: reject QUEUE/DROP verdict parameters
  - CLKRN-1203: switch back to using rh_reserved for tag links
  - CLKRN-1411: use monotonic clock for iolimits


author: Baoquan He <bhe@redhat.com> - 2.0.0-303
changelog:
  - mkdumprd: Remove load_selinux_policy script, resolves bug 1323086
  - mkdumprd: pass the value of DEV_ID to kdump, resolves bug 1322802


author: Baoquan He <bhe@redhat.com> - 2.0.0-306
changelog:
  - mkdumprd: fix env for mdadm, resolves bug 1404263
  - mkdumprd: create node for partition within RAID device, resolves bug 1404263
  - mkdumprd: refactor block_mknod(), resolves bug 1404263
  - uefi: Pass efi_smbios_addr to 2nd kernel, resolves bug 1404552


author: Pingfan Liu <piliu@redhat.com> - 2.0.0-309
changelog:
  - mkdumprd: Fix mkdumprd fail when cluster node uses ipv6
  - mkdumprd: fix the search criteria for detection of RAID devices


author: - Andy Walsh <awalsh@redhat.com> - 6.1.0.168-16
changelog:
  - Updated source to use GitHub
  - Fixed module version checking for upgrades.
  - Removed debug kernel requirement from spec file.
  - Fixed a deadlock resulting from sleeping while holding a spinlock while
    getting statistics.
  - Resolves: rhbz#1567742
  - Fixed bugs arising from attempts to access sysfs nodes during startup and
    shutdown.
  - Resolves: rhbz#1567744
  - Removed the prepare_ioctl() function to avoid signature changes since this
    function currently does nothing.
  - Resolves: rhbz#1572494


author: - Andy Walsh <awalsh@redhat.com> - 6.1.0.181-17
changelog:
  - Fixed a bug which would cause kernel panics when a VDO device is stacked on a
    RAID50 device.
  - Resolves: rhbz#1599668
  - Fixed a bug which could cause data loss when discarding unused portions of a
    VDO's logical space.
  - Resolves: rhbz#1600058
  - Modified grow physical to fail in the prepare step if the size isn't
    changing, avoiding a suspend-and-resume cycle.
  - Resolves: rhbz#1600662
  - Fixed a bug which would cause attempts to grow the physical size of a VDO
    device to fail if the device below the VDO was resized while the VDO was
    offline.
  - Resolves: rhbz#1591180


author: Jarod Wilson <jarod@redhat.com> - 20140911-0.1.git365e80c
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - Adds Intel Quick Assist Technology firmware (rhbz 1127338)
  - Updates bnx2x adapter firmware to version 7.10.51 (rhbz 1089403)
  - Updates myri10ge adapter firmware to version 1.4.57 (rhbz 1063702)
  - Removes firmware for drivers not shipped with Red Hat Enterprise Linux 7 (rhbz 1016595)


author: Rafael Aquini <aquini@redhat.com> - 20150612-37.git3161bfa
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - cxgb4: Update firmware to revision 1.13.32.0 (rhbz 1189256)
  - qat: Update to the latest upstream firmware (rhbz 1173792)
  - Use a common version number for both the iwl*-firmware packages and linux-firmware itself


author: Rafael Aquini <aquini@redhat.com> - 20150904-42.git6ebf5d5
changelog:
  - Add Intel Omni-Path Architecture hfi1 Firmware (rhbz 1194910)
  - Update skl firmware for gpu (rhbz 1210012)


author: Jarod Wilson <jarod@redhat.com> - 20150904-43.git6ebf5d5
changelog:
  - Add more old chelsio firmwares, they nuked the one the driver in
    RHEL7.2 is expecting from upstream (rhbz 1262128)
  - Remove amd-ucode again, it simply breaks too many systems (rhbz 1246393)


author: Rafael Aquini <aquini@redhat.com> - 20171011-57.gitbf04291
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - ath10k: Update to the latest firmware released version (rhbz 1457363)
  - opa: update Intel Omni-Path Architecture firmware (rhbz 1452785)
  - chelsio: Pull in the latest firmware 1.16.63.0 (rhbz 1458328)
  - qla2xxx: Update firmware version to 8.07.00 (rhbz 1427148)


author: Rafael Aquini <aquini@redhat.com> - 20171127-58.git17e6288
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - iwlwifi: Firmware update for 3160, 3168, 7260, 7265 and 7265D WIFI devices (rhbz 1508709)
  - iwlwifi: Firmware update for 8260 and 8265 WIFI devices (rhbz 1508711)
  - iwlwifi: Firmware update for 9260 and 9560 WIFI devices (rhbz 1501166)
  - Fixes CVE-2016-0801 CVE-2017-0561 CVE-2017-9417


author: Rafael Aquini <aquini@redhat.com> - 20180113-60.git65b1c68
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - netr: Add Netronome TC flower firmware (rhbz 1518900)
  - Revert amd-ucode for fam17h (rhbz 1533945)


author: Rafael Aquini <aquini@redhat.com> - 20180220-62.git6d51311
changelog:
  - nfp: NIC stops transmitting for small MSS values when TSO is enabled (rhbz 1542263)
  - chelsio: pull in latests firmware 1.17.14.0 (rhbz 1538590)


author: Rafael Aquini <aquini@redhat.com> - 20170530-54.gitdf40d15
changelog:
  - Update to latest upstream linux-firmware image for assorted updates
  - opa: HFI firmware problems with new OPA switch firmware (rhbz 1452253)


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> - 1.1.15-1.cloudlinux.22
changelog:
  - RHNCLT-7: force "normal" kernel installation in hybrid-to-normal script
  - RHNCLT-10: add --force option in clnreg_ks wrapper
  - RHNCLT-10: call rhn_check and check exit code before registration


author: Ondrej Vasik <ovasik@redhat.com> 2.8.14-15
changelog:
  - reserve 180:180 for aeolus (#804203)
  - reserve 182:182 for katello (#804204)
  - reserve 183:183 for elasticsearch (#804205)
  - drop root's supplementary groups (#724007)


author: Ondrej Vasik <ovasik@redhat.com> 2.8.14-21
changelog:
  - reserve uid 189 for hacluster (#872208)
  - reserve gid 189 for haclient (#872208)
  - reserve 160:160 for swift (openstack-swift) (#991502)
  - reserve 161:161 for glance (openstack-glance) (#991502)
  - reserve 162:162 for nova (openstack-nova) (#991502)
  - reserve 163:163 for keystone (openstack-keystone) (#991502)
  - reserve 164:164 for quantum (openstack-quantum) (#991502)
  - reserve 165:165 uidgid pair for cinder (#991502)
  - reserve 166:166 uidgid pair for ceilometer (#991502)
  - reserve 187:187 for heat (openstack-heat) (#991502)
  - reserve 185:185 for jboss-as (#991502)


author: Ondrej Vasik <ovasik@redhat.com> 2.8.14-22
changelog:
  - reserve 142:142 for activemq (#1086921)
  - reserve 167:167 for ceph (ceph-common) (#1221042)
  - change reservation for 185:185 from jboss-as to jboss (#1192412)


author: aspiers@suse.com
changelog:
  - Fix .spec file bug which was causing Frankenstein kernel modules:
    https://github.com/draios/sysdig/issues/496#issuecomment-165929462


author: mpluskal@suse.com
changelog:
  - Update to 0.7.1
    * Fix sysdig-probe compilation for kernel < 3.4.0
    * Fix compilation on OSX
  - Changes for 0.7.0
    * Fix sysdig-probe for kernel 4.4
    * Fix a remotely possible deadlock during ioctl calls
    * Fix Kubernetes support when data returned from the API server
      is particularly big
    * Minor bugfixes
    * Spectrogram views in csysdig: spectro_all (System call latency
      spectrogram) and spectro_file (File I/O latency spectrogram)
    * Ability to authenticate to a Kubernetes API server using a
      certificate, via -K <file_name> or --k8s-api-cert=<file_name>.
      Can also be specified via the environment variable
      SYSDIG_K8S_API_CERT
    * Ability to sort columns in csysdig views using the keyboard
    * --filter-proclist: apply the filter to the process table
    * -M: add the possibility to stop collecting after X seconds
      evt.latency.quantized: 10-base log of the delta between an
      exit event and the correspondent enter event evt.latency.human:
      delta between an exit event and the correspondent enter event,
      as a human readable string (e.g. 10.3ms)


author: mpluskal@suse.com
changelog:
  - Update to 0.8.0
    * Bug fixes
      + Better terminal mouse handling for csysdig
      + Minor bugfixes
    * New and updated features
      + rkt support (when running sysdig in a container, bind
      mounting the rkt directory is necessary, e.g. -v
      /var/lib/rkt:/host/var/lib/rkt:ro for Docker)
      + chroot event
      + container.type: the container type, e.g. docker or rkt
      + Prebuild sysdig-probe for Debian kernels


author: mpluskal@suse.com
changelog:
  - Update to 0.9.0
    * Mesos and Marathon support:
    + csysdig views: Mesos Tasks, Mesos Frameworks, Marathon Apps,
      arathon Groups
    + -m sysdig/csysdig parameter to specify URLs for Mesos Master
      Marathon API
    + -pm sysdig parameter to get a Mesos-friendly event output
    + Filter fields: mesos.task.name, mesos.task.id,
      mesos.task.label, mesos.task.labels, mesos.framework.name,
      mesos.framework.id, marathon.app.name, marathon.app.id,
      marathon.app.label, marathon.app.labels, marathon.group.name,
      marathon.group.id
    * icontains filter comparison operator: case-insensitive string
      comparison
    * Support for SSL based authentication and bearer token
      authentication against the Kubernetes API server. Previously,
      SSL was just supported for CA verification. See the updated
      documentation for -K
    * New actions on csysdig views: lsof and renice
    * New network filter fields that support a CIDR notation
      (e.g. 127.0.0.1/24): fd.net, fd.cnet, fd.snet, fd.lnet, fd.rnet


author: mpluskal@suse.com
changelog:
  - Update to version 0.10.0:
    * setsid event
    * proc.sid filter field: the session id of the process
      generating the event
    * proc.sname filter field: the name of the current process
      session leader
    * --force-term-compat command line option: try to configure
      simple terminal
    * settings (xterm-1002) that work better with terminals like
      putty
    * Many minor bugfixes
    * builds with gcc6 (boo#985121)
  - Use pkgconfig() style dependencies
  - Build with lua-5.1 as builds fail with lua-5.2 and later


author: mpluskal@suse.com
changelog:
  - Update to version 0.11.0:
    * Support for tracers. A way to add user level events to sysdig
      stream. Seeannouncement blog post.
    * New csysdig views: Traces List, Traces Summary, Traces
      Spectogram
    * New evtin.* and span.* filters startswith operand for strings,
      ex: fd.name startswith /etc
    * evt.is_open_{read,write} fields, true or false if an event is
      an open() in read or write
    * Improved performances of Kubernetes metadata parsing.
    * Bug fixes for IPv6
  - Add sysdig-do-not-use-private-jq-api.patch to allow building
    with system JQ


author: mpluskal@suse.com
changelog:
  - Use current macros for KMP building
    * drop sysdig-kmp-preamble
  - Use exclusivearch instead of excluding architectures


author: mpluskal@suse.com
changelog:
  - Update to version 0.12.1:
    * Compilation issues when using non-bundled OpenSSL #672
    * Compilation issues under S390 architecture
    * Various issues on k8s parsing
    * Stale thread info when parsing processes within containers #665
    * Avoid getting cwd from driver, causes issues on Kernel 4.8
  - Changes for version 0.12.0:
    * New filters container.mount.* to match container mount points
    * New filter container.privileged to match containers running in
      privileged mode
    * Support latest kubernetes features: k8s.deployment.* and
      k8s.rs.* filters are now available
    * Added glob operator for strings, works as classic shell glob
      path matcher
    * Added pmatch operator
    * Add less package on docker image
  - Drop upstreamed sysdig-do-not-use-private-jq-api.patch
  - Enable building on s390x


author: mpluskal@suse.com
changelog:
  - Update to version 0.13.0 (boo#1017181):
    * Ability to open concatenated capture files
    * evtin.* fields can be used also for displaying now
    * Fix driver for Kernel 4.9
    * Fix on IPv4 mapped IPv6 parsing
    * Fix memory leak #694
    * Fix issue #687 about connecting to an K8s API server via HTTPS


