# changelog

author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.6.1.el8_3]
changelog:
  - [arm64] paravirt: Initialize steal time when cpu is online (Andrew Jones) [1898758 1879137]
  - [kvm] Revert "x86/kvm: Move context tracking where it belongs" (Nitesh Narayan Lal) [1897716 1890284]
  - [pci] hv: Fix hibernation in case interrupts are not re-created (Mohammed Gamal) [1896435 1846838]
  - [hv] hv: vmbus: hibernation: do not hang forever in vmbus_bus_resume() (Mohammed Gamal) [1896434 1876519]
  - [netdrv] hv_netvsc: Cache the current data path to avoid duplicate call and message (Mohammed Gamal) [1896433 1876527]
  - [netdrv] hv_netvsc: Switch the data path at the right time during hibernation (Mohammed Gamal) [1896433 1876527]
  - [netdrv] hv_netvsc: Fix hibernation for mlx5 VF driver (Mohammed Gamal) [1896433 1876527]
  - [tools] selftests/powerpc: Make alignment handler test P9N DD2.1 vector CI load workaround (Gustavo Duarte) [1897278 1887442]
  - [powerpc] powerpc: Fix undetected data corruption with P9N DD2.1 VSX CI load emulation (Gustavo Duarte) [1897278 1887442]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.7.1.el8_3]
changelog:
  - [fs] writeback: Drop I_DIRTY_TIME_EXPIRE (Waiman Long) [1901547 1860031]
  - [fs] writeback: Fix sync livelock due to b_dirty_time processing (Waiman Long) [1901547 1860031]
  - [fs] writeback: Avoid skipping inode writeback (Waiman Long) [1901547 1860031]
  - [fs] writeback: Protect inode->i_io_list with inode->i_lock (Waiman Long) [1901547 1860031]
  - [fs] fs: Introduce DCACHE_DONTCACHE (Waiman Long) [1901547 1860031]
  - [fs] fs: Lift XFS_IDONTCACHE to the VFS layer (Waiman Long) [1901547 1860031]
  - [fs] dcache: sort the freeing-without-RCU-delay mess for good (Waiman Long) [1901547 1860031]
  - [net] ip_tunnel_core: Fix build for archs without _HAVE_ARCH_IPV6_CSUM (Aaron Conole) [1885766 1849736]
  - [tools] selftests: pmtu.sh: Add tests for UDP tunnels handled by Open vSwitch (Aaron Conole) [1885766 1849736]
  - [tools] selftests: pmtu.sh: Add tests for bridged UDP tunnels (Aaron Conole) [1885766 1849736]
  - [net] geneve: Support for PMTU discovery on directly bridged links (Aaron Conole) [1885766 1849736]
  - [net] vxlan: Support for PMTU discovery on directly bridged links (Aaron Conole) [1885766 1849736]
  - [net] tunnels: PMTU discovery support for directly bridged IP packets (Aaron Conole) [1885766 1849736]
  - [net] ipv4: route: Ignore output interface in FIB lookup for PMTU route (Aaron Conole) [1885766 1849736]
  - [netdrv] geneve: add transport ports in route lookup for geneve (Mark Gray) [1891818 1884481] {CVE-2020-25645}
  - [kernel] PM: hibernate: Batch hibernate and resume IO requests (Lenny Szubowicz) [1894629 1868096]
  - [md] dm: fix comment in __dm_suspend() (Mike Snitzer) [1890233 1881531]
  - [md] dm: fold dm_process_bio() into dm_make_request() (Mike Snitzer) [1890233 1881531]
  - [md] dm: fix missing imposition of queue_limits from dm_wq_work() thread (Mike Snitzer) [1890233 1881531]
  - [md] dm: optimize max_io_len() by inlining max_io_len_target_boundary() (Mike Snitzer) [1890233 1881531]
  - [md] dm: push md->immutable_target optimization down to __process_bio() (Mike Snitzer) [1890233 1881531]
  - [md] dm: change max_io_len() to use blk_max_size_offset() (Mike Snitzer) [1890233 1881531]
  - [md] dm table: stack 'chunk_sectors' limit to account for target-specific splitting (Mike Snitzer) [1890233 1881531]
  - [block] block: allow 'chunk_sectors' to be non-power-of-2 (Mike Snitzer) [1890233 1881531]
  - [block] block: use lcm_not_zero() when stacking chunk_sectors (Mike Snitzer) [1890233 1881531]
  - [md] dm: fix bio splitting and its bio completion order for regular IO (Mike Snitzer) [1890233 1881531]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.8.1.el8_3]
changelog:
  - [s390] s390/dasd: Fix zero write for FBA devices (Ming Lei) [1896787 1881760]
  - [s390] mm/gup: fix gup_fast with dynamic page table folding (Philipp Rudo) [1896351 1883266]
  - [netdrv] ibmveth: Identify ingress large send packets (Gustavo Duarte) [1896299 1887038]
  - [netdrv] ibmveth: Switch order of ibmveth_helper calls (Gustavo Duarte) [1896299 1887038]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.9.1.el8_3]
changelog:
  - [net] tunnels: Fix off-by-one in lower MTU bounds for ICMP/ICMPv6 replies (Antoine Tenart) [1902082 1895765]
  - [net] net-sysfs: add backlog len and CPU id to softnet data (Paolo Abeni) [1883314 1866909]
  - [net] try to avoid unneeded backlog flush (Paolo Abeni) [1883314 1866909]
  - [net] skbuff: fix a data race in skb_queue_len() (Paolo Abeni) [1883314 1866909]
  - [powerpc] mm/mmu_gather: invalidate TLB correctly on batch allocation failure and flush (Diego Domingos) [1899208 1805031]
  - [powerpc] powerpc/mmu_gather: enable RCU_TABLE_FREE even for !SMP case (Diego Domingos) [1899208 1805031]
  - [net] netfilter: ctnetlink: add a range check for l3/l4 protonum (Florian Westphal) [1892665 1892666] {CVE-2020-25211}
  - [char] random: decouple random and urandom extrng fops (Vladis Dronov) [1899584 1890711]
  - [char] random: Add a poll handler to extrng_fops (Vladis Dronov) [1886192 1884857]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.11.1.el8_3]
changelog:
  - [scsi] scsi: core: Return BLK_STS_AGAIN for ALUA transitioning (Ewan Milne) [1900112 1867264]
  - [scsi] scsi: scsi_dh_alua: Set 'transitioning' state on Unit Attention (Ewan Milne) [1900112 1867264]
  - [scsi] scsi: scsi_dh_alua: Return BLK_STS_AGAIN for ALUA transitioning state (Ewan Milne) [1900112 1867264]
  - [block] scsi: block: Return status code in blk_mq_end_request() (Ewan Milne) [1900112 1867264]
  - [include] compiler_attributes.h: Add 'fallthrough' pseudo keyword for switch/case use (Ivan Vecera) [1900112 1867168]
  - [net] net: sctp: Rename fallthrough label to unhandled (Ivan Vecera) [1900112 1867168]
  - [idle] intel_idle: Customize IceLake server support (David Arcari) [1897183 1881620]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.12.1.el8_3]
changelog:
  - [net] SUNRPC: Properly set the @subbuf parameter of xdr_buf_subsegment() (Steve Dickson) [1912478 1884361]
  - [net] SUNRPC: Fix ("SUNRPC: Add "@len" parameter to gss_unwrap()") (Steve Dickson) [1912478 1884361]
  - [mm] x86/ioremap: Map EFI runtime services data as encrypted for SEV (Lenny Szubowicz) [1909243 1883134]
  - [kernel] sched/deadline: Unthrottle PI boosted threads while enqueuing (Daniel Bristot de Oliveira) [1913964 1869760]
  - [kernel] sched/deadline: Fix stale throttling on de-/boosted tasks (Daniel Bristot de Oliveira) [1913964 1869760]
  - [fs] NFSv4.1 handle ERR_DELAY error reclaiming locking state on delegation recall (Scott Mayhew) [1908313 1881550]
  - [fs] NFS: Fix interrupted slots by sending a solo SEQUENCE operation (Scott Mayhew) [1908312 1887577]
  - [net] netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal (Antoine Tenart) [1907576 1901026]
  - [powerpc] powerpc/powernv/opal-dump : Use IRQ_HANDLED instead of numbers in interrupt handler (Diego Domingos) [1907301 1891822]
  - [powerpc] powerpc/powernv/dump: Handle multiple writes to ack attribute (Diego Domingos) [1907301 1891822]
  - [powerpc] powerpc/powernv/dump: Fix race while processing OPAL dump (Diego Domingos) [1907301 1891822]
  - [powerpc] powerpc/opal_elog: Handle multiple writes to ack attribute (Diego Domingos) [1907301 1891822]
  - [powerpc] powerpc/powernv/elog: Fix race while processing OPAL error log event (Diego Domingos) [1907301 1891822]
  - [block] block: fix incorrect branching in blk_max_size_offset() (Mike Snitzer) [1905136 1903722]
  - [md] dm: fix IO splitting (Mike Snitzer) [1905136 1903722]
  - [block] block: fix get_max_io_size() (Mike Snitzer) [1905136 1903722]
  - [block] block: Improve physical block alignment of split bios (Mike Snitzer) [1905136 1903722]
  - [block] block: use gcd() to fix chunk_sectors limit stacking (Mike Snitzer) [1905136 1903722]
  - [netdrv] net/mlx5e: Add LAG warning if bond slave is not lag master (Alaa Hleihel) [1892344 1851709]
  - [netdrv] net/mlx5e: Add LAG warning for unsupported tx type (Alaa Hleihel) [1892344 1851709]
  - [netdrv] net/mlx5e: Return a valid errno if can't get lag device index (Alaa Hleihel) [1892344 1851709]
  - [net] openvswitch: handle DNAT tuple collision (Dumitru Ceara) [1892744 1877128]
  - [mm] mm/page_idle.c: skip offline pages (Chris von Recklinghausen) [1903019 1867490]
  - [include] mm/hotplug: invalid PFNs from pfn_to_online_page() (Waiman Long) [1903019 1878006]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.13.1.el8_3]
changelog:
  - [arm64] arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() (Andrew Jones) [1909577 1908439]
  - [arm64] arm64: pgtable: Fix pte_accessible() (Andrew Jones) [1909577 1908439]
  - [net] icmp: randomize the global rate limiter (Guillaume Nault) [1906371 1896516] {CVE-2020-25705}
  - [tools] kvm: x86: do not attempt TSC synchronization on guest writes (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: x86: fix MSR_IA32_TSC read for nested migration (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: delay MSR permission processing to first nested VM run (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: x86: rename KVM_REQ_GET_VMCS12_PAGES (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: use __GFP_ZERO instead of clear_page (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: refactor msr permission bitmap allocation (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: rename a variable in the svm_create_vcpu (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: Avoid freeing uninitialized pointers in svm_set_nested_state() (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: nested: Don't allocate VMCB structures on stack (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: more strict SMM checks when returning to nested guest (Paolo Bonzini) [1905084 1898018]
  - [x86] svm: nsvm: setup nested msr permission bitmap on nested state load (Paolo Bonzini) [1905084 1898018]
  - [x86] svm: nsvm: correctly restore GIF on vmexit from nesting after migration (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: avoid emulation with stale next_rip (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: remove nonsensical EXITINFO1 adjustment on nested NPF (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: Rename svm_nested_virtualize_tpr() to nested_svm_virtualize_tpr() (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: Add svm_ prefix to set/clr/is_intercept() (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: Add vmcb_ prefix to mark_*() functions (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: svm: Rename struct nested_state to svm_nested_state (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: nsvm: Check that DR6[63:32] and DR7[64:32] are not set on vmrun of nested guests (Paolo Bonzini) [1905084 1898018]
  - [x86] kvm: x86: Move the check for upper 32 reserved bits of DR6 to separate function (Paolo Bonzini) [1905084 1898018]
  - [netdrv] net/mlx5e: Add IPv6 traffic class (DSCP) header rewrite support (Alaa Hleihel) [1897688 1889981]
  - [netdrv] net/mlx5e: Fix endianness when calculating pedit mask first bit (Alaa Hleihel) [1897688 1889981]
  - [net] openvswitch: fix to make sure flow_lookup() is not preempted (Eelco Chaudron) [1893281 1888237]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.14.1.el8_3]
changelog:
  - [netdrv] net: usb: lan78xx: Disable interrupts before calling generic_handle_irq() (Waiman Long) [1915814 1904213]
  - [mm] x86/mm/cpa: Prevent large page split when ftrace flips RW on kernel text (Waiman Long) [1915814 1904213]
  - [mm] x86/mm/cpa: Fix cpa_flush_array() TLB invalidation (Waiman Long) [1915814 1904213]
  - [hv] hv: vmbus: Add timeout to vmbus_wait_for_unload (Mohammed Gamal) [1913528 1888980]
  - [kernel] perf/core: Fix race in the perf_mmap_close() function (Michael Petlan) [1897016 1869925] {CVE-2020-14351}
  - [kernel] perf: Make struct ring_buffer less ambiguous (Michael Petlan) [1897016 1869925] {CVE-2020-14351}
  - [tty] tty: Fix ->pgrp locking in tiocspgrp() (Waiman Long) [1908196 1908197] {CVE-2020-29661}
  - [x86] x86/tboot: Don't disable swiotlb when iommu is forced on (Tony Camuso) [1911555 1883395]
  - [iommu] iommu/vt-d: Avoid panic if iommu init fails in tboot system (Tony Camuso) [1911555 1883395]
  - [kernel] sched/deadline: Fix priority inheritance with multiple scheduling classes (Phil Auld) [1908731 1780490]
  - [kernel] locking/rwsem: Remove reader optimistic spinning (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Enable reader optimistic lock stealing (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Prevent potential lock starvation (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Pass the current atomic count to rwsem_down_read_slowpath() (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Fold __down_{read,write}*() (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Introduce rwsem_write_trylock() (Waiman Long) [1908519 1895046]
  - [kernel] locking/rwsem: Better collate rwsem_read_trylock() (Waiman Long) [1908519 1895046]
  - [kernel] rwsem: Implement down_read_interruptible (Waiman Long) [1908519 1895046]
  - [kernel] rwsem: Implement down_read_killable_nested (Waiman Long) [1908519 1895046]
  - [firmware] efi/esrt: Only call efi_mem_reserve() for boot services memory (Kairui Song) [1907775 1878024]
  - [firmware] efi: Drop type and attribute checks in efi_mem_desc_lookup() (Kairui Song) [1907775 1878024]
  - [scsi] scsi: core: Don't start concurrent async scan on same host (Ming Lei) [1905214 1874501]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.15.1.el8_3]
changelog:
  - [x86] kvm: svm: Initialize prev_ga_tag before use (Vitaly Kuznetsov) [1919885 1909254]
  - [net] tls: move mark_tech_preview to tls_init (Sabrina Dubroca) [1918743 1907477]
  - [video] hyperv_fb: Fix the cache type when mapping the VRAM (Mohammed Gamal) [1917711 1908893]
  - [video] hyperv: hyperv_fb: Support deferred IO for Hyper-V frame buffer driver (Mohammed Gamal) [1917711 1908893]
  - [net] esp: select CRYPTO_SEQIV (Vladis Dronov) [1912872 1905088]
  - [crypto] treewide: Use fallthrough pseudo-keyword (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - always try to free Jitter RNG instance (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - should select CTR (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: ctr - no longer needs CRYPTO_SEQIV (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - always seeded with SP800-90B compliant noise source (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: jitter - SP800-90B compliance (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: jitter - add header to fix buildwarnings (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: jitter - fix comments (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: jitter - update implementation to 2.1.2 (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - in-place cipher operation for CTR (Vladis Dronov) [1912872 1905088]
  - [crypto] crypto: drbg - eliminate constant reinitialization of SGL (Vladis Dronov) [1912872 1905088]
  - [netdrv] ionic: start queues before announcing link up (Jonathan Toppins) [1918372 1906250]
  - [drm] drm/i915: Enable Tigerlake support by default (Lyude Paul) [1882620 1877005]
  - [drm] drm/i915: Simplify intel_set_cdclk_{pre, post}_plane_update() calling convention (Lyude Paul) [1882620 1877005]
  - [drm] drm/i915/psr: Program default IO buffer Wake and Fast Wake (Lyude Paul) [1882620 1877005]
  - [kernel] rcu: Force on tick when invoking lots of callbacks (Waiman Long) [1915638 1862812]
  - [kernel] nohz: Add TICK_DEP_BIT_RCU (Waiman Long) [1915638 1862812]
  - [pci] PCI: Mark AMD Navi10 GPU rev 0x00 ATS as broken (Myron Stowe) [1906516 1888310]


author: Akira TAGOH <tagoh@redhat.com> - 0.6.2-8
changelog:
  - Suppress documentation in Flatpak builds
    Resolves: rhbz#1896257
  - build gir with non-parallel to avoid strange behavior.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.11-1
changelog:
  - Fix pvck handling MDA at offset different from 4096.
  - Partial or degraded activation of writecache is not allowed.
  - Enhance error handling in fsadm and handle correct fsck result.
  - Dmeventd lvm plugin ignores higher reserved_stack lvm.conf values.
  - Support using BLKZEROOUT for clearing devices.
  - Fixed interrup handling.
  - Fix block cache when device has too many failing writes.
  - Fix block cache waiting for IO completion with failing disks.
  - Add configure --enable-editline support as an alternative to readline.
  - Enhance reporting and error handling when creating thin volumes.
  - Enable vgsplit for VDO volumes.
  - Lvextend of vdo pool volumes ensure at least 1 new VDO slab is added.
  - Restore lost signal blocking while VG lock is held.
  - Improve estimation of needed extents when creating thin-pool.
  - Use extra 1% when resizing thin-pool metadata LV with --use-policy.
  - Enhance --use-policy percentage rounding.
  - Allow pvmove of writecache origin.
  - Report integrity fields.
  - Integrity volumes defaults to journal mode.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.11-2
changelog:
  - Fix problem with wiping of converted LVs.
  - Fix memleak in scanning.
  - Fix corner case allocation for thin-pools.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.11-3
changelog:
  - Fix mpath filtering of NVMe devices.
  - Check if lvcreate passes read_only_volume_list with tags and skips zeroing.
  - Limit pool metadata spare to 16GiB.
  - Improves conversion and allocation of pool metadata.
  - Fix different limits used for metadata by lvm2 and thin-tools.
  - Fix interrupting lvconvert --splitcache command with striped origin volumes.


author: Jan Černý <jcerny@redhat.com> - 1.3.2-7
changelog:
  - Fix segmentation fault in systemdunitdependency_probe (RHBZ#1793050)
  - Fix crash in textfilecontent probe (RHBZ#1686467)
  - Do not drop empty lines from Ansible remediations (RHBZ#1795563)
  - Fix oscap-ssh --sudo (RHBZ#1803116)
  - Remove useless warnings (RHBZ#1764139)


author: Evgeny Kolesnikov <ekolesni@redhat.com> - 1.3.3-1
changelog:
  - Upgrade to the latest upstream release (rhbz#1829761)
  - Added a Python script that can be used for CLI tailoring (autotailor)
  - Added timezone to XCCDF TestResult start/end time
  - Added yamlfilecontent independent probe (proposal/draft implementation)
  - Added ability to generate `machineconfig` fix
  - Introduced `urn:xccdf:fix:script:kubernetes` fix type in XCCDF
  - Fixed filepath pattern matching in offline mode in textfilecontent58 probe
  - Fixed #170: The rpmverifyfile probe can't verify files from '/bin' directory
  - Fixed #1512: Severity refinement lost in generated guide
  - Fixed #1453: Pointer lost in Swig API
  - The data system_info probe return for offline and online modes is consistent and actual
  - Evaluation Characteristics of the XCCDF report are now consistent with OVAL entities
    from system_info probe


author: Vojtech Trefny <vtrefny@redhat.com> - 2.19-4
changelog:
  - Use libblkid to check swap status before swapon (vtrefny)
    Related: rhbz#1634016
  - Add error codes and Python exceptions for swapon fails (vtrefny)
    Resolves: rhbz#1634016


author: Isaac Boukris <iboukris@redhat.com> - 4.12.3-4
changelog:
  - resolves: #1850980 - Add "additional dns hostname" to keytab
  - resolves: #1850981 - Add net-ads-join dnshostname=fqdn option


author: Andreas Schneider <asn@redhat.com> - 4.12.3-5
changelog:
  - resolves: #1823612 - Fix segfault in 'net ads dns gethostbyname'
  - resolves: #1792553 - Fix 'net ads join createcomputer=OU'


author: Andreas Schneider <asn@redhat.com> - 4.12.3-7
changelog:
  - resolves: #1855711 - Fix 'require_membership_of' documentation in
                         pam_winbind manpage


author: Andreas Schneider <asn@redhat.com> - 4.12.3-9
changelog:
  - related: #1817557 - Move DECRPC mdssvc data files to correct package
  - resolves: #1856676 - Fix lookuprids in winbind


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b03-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b03 (EA)
  - Update release notes for 8u282-b03.
  - Resolves: rhbz#1903904


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.282.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u282-b04 (EA)
  - Update release notes for 8u282-b04.
  - Remove upstreamed patch PR3519
  - Resolves: rhbz#1903904


author: Jan Grulich <jgrulich@redhat.com> - 5.12.5-5
changelog:
  - Fix: Files placed by attacker can influence the working directory and lead to malicious code execution
    Resolves: bz#1814739
    Resolves: bz#1814683

  - Fix: XML entity expansion vulnerability
    Resolves: bz#1822193


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-1
changelog:
  - Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
  - Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
  - Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-2
changelog:
  - Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-3
changelog:
  - Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
  - Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
  - Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
  - Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
                             inotify events, and no updates are triggered
  - Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
                             on GDM login with smart-card
  - Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
  - Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
  - Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
                             if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
                             in SSSD-AD direct integration.
  - Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
  - Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-4
changelog:
  - Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
  - Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
  - Resolves: rhbz#1803134 - Improve "unlock" time when user session already active


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-5
changelog:
  - Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
  - Fixed "requires/provides" rpmdiff warning


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-7
changelog:
  - Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
  - Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-8
changelog:
  - Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
  - Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
  - Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
  - Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-9
changelog:
  - Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied


author: Philip Kovacs <pkdevel@yahoo.com> - 2.1.0-1
changelog:
  - Update to 2.1.0
  - Added enviromnent module for pmi/pmix
  - Added pkgconfig files for pmix/pmi/pmi2
  - Ensure lexer sources are rebuilt
  - Removed obsolete sasl support
  - Use new ldconfig_scriplets macro


author: Jarod Wilson <jarod@redhat.com> - 2.1.1-2
changelog:
  - Add the --with-tests-examples flag to be able to better verify functionality
  - Related: rhbz#1682374


author: Nicola Sella <nsella@redhat.com> - 0.48.0-3
changelog:
  - Add log file level main config option (RhBug:1802074)
  - Accept '==' as an operator in reldeps (RhBug:1847946)


author: Nicola Sella <nsella@redhat.com> - 0.55.0-1
changelog:
  - Add vendor to dnf API (RhBug:1876561)
  - Add formatting function for solver error
  - Add error types in ModulePackageContainer
  - Implement module enable for context part
  - Improve string formatting for translation
  - Remove redundant printf and change logging info to notice (RhBug:1827424)
  - Add allow_vendor_change option (RhBug:1788371) (RhBug:1788371)


author: Nicola Sella <nsella@redhat.com> - 0.55.0-3
changelog:
  - Avoid multilib file conflict in config.h (RhBug:1918818)
  - [modules] Add special handling for src artifacts (RhBug:1809314)


author: Nicola Sella <nsella@redhat.com> - 0.55.0-4
changelog:
  - [context] improve retrieving repository configuration
  - Allow loading incomplete cache and loading ext solv files without its repodata


author: Petr Pisar <ppisar@redhat.com> - 1:4.04-3
changelog:
  - rpcgen tool split from glibc-common package
  - Pass TIRPC header files location to all RPC compilation units
  - Do not iterate over negative UIDs in repquota
  - Fix mistakes in warnquota reported by GCC 8


author: Petr Pisar <ppisar@redhat.com> - 1:4.04-4
changelog:
  - Avoid questions in quotacheck non-interactive mode
  - Report an error when quotacheck fails to cache quota files
  - Report an error if quota file magic is invalid


author: Mark Wielaard <mjw@redhat.com> - 0.182-1
changelog:
  - Upgrade to upstream 0.182
    - backends: Support for tilegx has been removed.
    - config: New /etc/profile.d files to provide default $DEBUGINFOD_URLS.
    - debuginfod: More efficient package traversal, tolerate various
      errors during scanning, grooming progress is more visible and
      interruptible, more prometheus metrics.
    - debuginfod-client: Now supports compressed (kernel) ELF images.
    - libdwfl: Add ZSTD compression support.


author: Uri Lublin <uril@redhat.com> - 3.26.0.0-1
changelog:
  - Rebase to sqlite 3.26.0
  - Fix CVE-2019-8457  CVE-2019-13752 CVE-2019-13753 CVE-2019-13734
  - Fix CVE-2019-19924 CVE-2019-19923 CVE-2019-19925 CVE-2019-19959
  - Fix CVE-2019-20218 CVE-2020-6405  CVE-2020-9327  CVE-2019-5018
  - Fix CVE-2019-16168
    Resolves: rhbz#1826898
  - Fix CVE-2020-13632
    Resolves: rhbz#1845615
  - Fix CVE-2020-13631
    Resolves: rhbz#1845475
  - Fix CVE-2020-13630
    Resolves: rhbz#1845212
  - Fix CVE-2020-13434
    Resolves: rhbz#1845851
  - Fix CVE-2020-15358


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.23-1
changelog:
  - Rebase to 10.3.23
  - Make conflicts between corresponding mariadb and mysql packages explicit
  - Get rid of the Conflicts macro, it was intended to mark conflicts with
    *upstream* packages
    Resolves: #1853159


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.27-1
changelog:
  - Rebase to 10.3.27
  - mariadb-debug_build.patch is no more needed, upstream did the changes:
    https://github.com/MariaDB/server/commit/31eaa2029f3c2a4f8e5609ce8b87682286238d9a#diff-32766783af7cac683980224d63c59929
    https://github.com/MariaDB/server/commit/23c6fb3e6231b8939331e2d9f157092f24ed8f4f#diff-78f3162f137407db5240950beb2bcd7c


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.27-2
changelog:
  - Disable building of the ed25519 client plugin.
    From now on it will be shipped by 'mariadb-connector-c' package


author: Michal Schorm <mschorm@redhat.com> - 3:10.3.27-3
changelog:
  - Remove mariadb_rpl.h from includedir
    This file is shipped in mariadb-connector-c package
  - Require matching version of mariadb-connector-c package


author: Evgenii Kolesnikov <ekolesni@redhat.com> - 1.3.4-1
changelog:
  - Upgrade to the latest upstream release (RHBZ#1887794)
  - Treat GPFS as a remote file system (RHBZ#1840578, RHBZ#1840579)
  - Fixed the most problematic memory issues that were causing OOM situations
    for systems with large amount of files (RHBZ#1824152)
  - Proper handling of OVALs with circular dependencies between definitions (RHBZ#1812476)


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-2.el8]
changelog:
  - man: ip.8: Add missing vrf subcommand description (Andrea Claudi) [1780010]
  - xfrm: not try to delete ipcomp states when using deleteall (Andrea Claudi) [1808634]
  - ip-xfrm: Fix help messages (Andrea Claudi) [1796045]
  - man: rdma.8: Add missing resource subcommand description (Andrea Claudi) [1786576]
  - man: rdma-statistic: Add filter description (Andrea Claudi) [1786565]
  - tc: implement support for action flags (Andrea Claudi) [1770671]
  - Update kernel headers (Andrea Claudi) [1770671]
  - Update kernel headers (Andrea Claudi) [1770671]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-3.el8]
changelog:
  - xfrm: also check for ipv6 state in xfrm_state_keep (Andrea Claudi) [1828033]
  - man: bridge.8: fix bridge link show description (Andrea Claudi) [1817571]
  - ip: fix ip route show json output for multipath nexthops (Andrea Claudi) [1738633]
  - ip link: xstats: fix TX IGMP reports string (Andrea Claudi) [1796041]
  - nstat: print useful error messages in abort() cases (Andrea Claudi) [1824896]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-4.el8]
changelog:
  - tc: f_flower: add options support for erspan (Andrea Claudi) [1830485]
  - tc: f_flower: add options support for vxlan (Andrea Claudi) [1830485]
  - tc: m_tunnel_key: add options support for erpsan (Andrea Claudi) [1830485]
  - tc: m_tunnel_key: add options support for vxlan (Andrea Claudi) [1830485]
  - iproute_lwtunnel: add options support for erspan metadata (Andrea Claudi) [1830485]
  - iproute_lwtunnel: add options support for vxlan metadata (Andrea Claudi) [1830485]
  - iproute_lwtunnel: add options support for geneve metadata (Andrea Claudi) [1830485]
  - Update kernel headers (Andrea Claudi) [1830485]
  - man: ip.8: add reference to mptcp man-page (Andrea Claudi) [1812207]
  - man: mptcp man page (Andrea Claudi) [1812207]
  - ss: allow dumping MPTCP subflow information (Andrea Claudi) [1812207]
  - Update kernel headers (Andrea Claudi) [1812207]
  - Update kernel headers (Andrea Claudi) [1812207]
  - add support for mptcp netlink interface (Andrea Claudi) [1812207]
  - Update kernel headers and import mptcp.h (Andrea Claudi) [1812207]
  - ip: xfrm: add espintcp encapsulation (Andrea Claudi) [1844045]
  - Update kernel headers and import udp.h (Andrea Claudi) [1844045]


author: Andrea Claudi <aclaudi@redhat.com> [5.3.0-5.el8]
changelog:
  - man: tc-ct.8: Add manual page for ct tc action (Andrea Claudi) [1844637]
  - tc: flower: Add matching on conntrack info (Andrea Claudi) [1844637]
  - tc: Introduce tc ct action (Andrea Claudi) [1844637]
  - tc: add NLA_F_NESTED flag to all actions options nested block (Andrea Claudi) [1844637]
  - Import tc_act/tc_ct.h uapi file (Andrea Claudi) [1844637]
  - ss: allow dumping kTLS info (Andrea Claudi) [1812207]
  - devlink: Add health error recovery status monitoring (Andrea Claudi) [1821039]


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.2-1
changelog:
  - New upstream version 1.0.2.
  - Remove patches which are upstream.
  - Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842).
  - Fix previous commit message.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.3-1
changelog:
  - New upstream version 1.0.3.
  - Contains fix for remote code execution vulnerability.
  - Add new libnbd-security(3) man page.


author: Caolán McNamara <caolanm@redhat.com> - 1:6.3.5.2-5
changelog:
  - rhbz#1796893 spreadsheetml2ooo.xsl was not well formed xml
  - rhbz#1796893 fix impress print dialog range


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.56.4-9
changelog:
  - Update GHmac patch to implement g_hmac_copy()
    Resolves: #1786538
  - Update keyfile settings backend
    Resolves: #1728896
  - Fix CVE-2019-13012
    Resolves: #1728632


author: Jiri Kucera <jkucera@redhat.com> - 1.13.1-2
changelog:
  - Remove *.pc files due to 'nothing provides pkgconfig(gpg-error)'
    and 'nothing provides pkgconfig(libassuan)' dnf errors
    Related: #1829822


author: Ondrej Holy <oholy@redhat.com> - 3.28.1-13
changelog:
  - Clear selection if any files don't match the pattern (rhbz#1207179)
  - Fix endless content size calculations (rhbz#1566027)
  - Honor umask when creating new files (rhbz#1778579)
  - Close "There is no application..." dialog after response (rhbz#1816070)


author: Marek Polacek <polacek@redhat.com> 8.3.1-5.1
changelog:
  - consider negative edges in cycle detection (#1817991, PR gcov-profile/91601)
  - fix Fortran debug info for arrays with descriptors (#1655624,
    PR fortran/92775)
  - fix wrong code emitted for movv1qi on s390x (#1784758, PR target/92950)


author: Jan Friesse <jfriesse@redhat.com> 3.0.3-4
changelog:
  - Resolves: rhbz#1780137
  - Resolves: rhbz#1791792
  - Resolves: rhbz#1809864
  - Resolves: rhbz#1816653

  - votequorum: Ignore the icmap_get_* return value (rhbz#1780137)
  - merge upstream commit cddd62f972bca276c934e58f08da84071cec1ddb (rhbz#1780137)
  - man: move cmap_keys man page from section 8 to 7 (rhbz#1791792)
  - merge upstream commit f1d36307e524f9440733f0b01a9fc627a0e1cac7 (rhbz#1791792)
  - votequorum: Reflect runtime change of 2Node to WFA (rhbz#1780137)
  - merge upstream commit 8ce65bf951bc1e5b2d64b60ea027fbdc551d4fc8 (rhbz#1780137)
  - stats: Add stats for scheduler misses (rhbz#1791792)
  - merge upstream commit 48b6894ef41e9a06ccbb696d062d86ef60dc2c4b (rhbz#1791792)
  - stats: Use nanoseconds from epoch for schedmiss (rhbz#1791792)
  - merge upstream commit ebd05fa00826c366922e619b012a0684c6856539 (rhbz#1791792)
  - main: Add schedmiss timestamp into message (rhbz#1791792)
  - merge upstream commit 35662dd0ec53f456445c30c0ef92892f47b25aa2 (rhbz#1791792)
  - votequorum: Change check of expected_votes (rhbz#1809864)
  - merge upstream commit 0c16442f2d93f32a229b87d2672e2dc8025ec704 (rhbz#1809864)
  - quorumtool: exit on invalid expected votes (rhbz#1809864)
  - merge upstream commit 5f543465bb3506b7f4929a426f1c22a9c854cecd (rhbz#1809864)
  - votequorum: set wfa status only on startup (rhbz#1816653)
  - merge upstream commit ca320beac25f82c0c555799e647a47975a333c28 (rhbz#1816653)


author: Jan Friesse <jfriesse@redhat.com> 3.1.0-1
changelog:
  - Resolves: rhbz#1855293
  - Resolves: rhbz#1855303
  - Resolves: rhbz#1870449
  - Resolves: rhbz#1887400

  - New upstream release (rhbz#1855293)
  - Support for reload of crypto configuration (rhbz#1855303)
  - Increase default token timeout to 3000ms (rhbz#1870449)
  - Add support for nodelist callback into quorum service (rhbz#1887400)


author: Jan Friesse <jfriesse@redhat.com> 3.1.0-3
changelog:
  - Resolves: rhbz#1897085
  - Resolves: rhbz#1896493

  - spausedd: Add ability to move process into root cgroup (rhbz#1897085)
  - totemknet: Check both cipher and hash for crypto (rhbz#1896493)


author: Lubomir Rintel <lkundrak@v3.sk> - 1.8.26-2
changelog:
  - Fixes suggested in review by Matthew Krupcale (#1763285):
  - Add gcc BR
  - Fixed the libnma-gtk4 conditional
  - Made dependencies arch-specific where relevant
  - Dropped obsolete macros
  - Install license file with libnma-gtk4


author: Thomas Haller <thaller@redhat.com> - 1.8.28-1
changelog:
  - Update to 1.8.28 release
  - move org.gnome.nm-applet.gschema.xml from network-manager-applet to here.
  - introduce wireless security dialogs


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.4-1
changelog:
  - soname bump to "1"
  - incompatible API changes:
    * bindings: Selection.flags is now an attribute
    * repodata_lookup_num now works like the other lookup_num functions
  - new functions:
    * selection_make_matchsolvable
    * selection_make_matchsolvablelist
    * pool_whatmatchessolvable
    * repodata_search_arrayelement
    * repodata_lookup_kv_uninternalized
    * repodata_search_uninternalized
    * repodata_translate_dir
  - new repowriter interface to write solv files allowing better
    control over what gets written
  - support for filtered file lists with a custom filter
  - dropped support of (since a long time unused) REPOKEY_TYPE_U32
  - selected bug fixes:
    * fix nasty off-by-one error in repo_write
    * do not autouninstall packages because of forcebest updates
    * fixed a couple of null pointer derefs and potential memory
      leaks
    * made disfavoring recommended packages work if strong recommends
      is enabled
    * no longer disable infarch rules when they don't conflict with
      the job
    * repo_add_rpmdb: do not copy bad solvables from the old solv file
    * fix cleandeps updates not updating all packages
  - new features:
    * support rpm's new '^' version separator
    * support set/get_considered_list in bindings
    * new experimental SOLVER_FLAG_ONLY_NAMESPACE_RECOMMENDED flag
    * do favor evaluation before pruning allowing to (dis)favor
      specific package versions
    * bindings: support pool.matchsolvable(), pool.whatmatchessolvable()
      pool.best_solvables() and selection.matchsolvable()
    * experimental DISTTYPE_CONDA and REL_CONDA support


author: Ales Matej <amatej@redhat.org> - 0.7.7-1
changelog:
  - Update to 0.7.7
  - selected bug fixes:
    * fix updating of too many packages in focusbest mode
    * fix handling of disabled installed packages in distupgrade
    * fix repository priority handling for multiversion packages
    * better support of inverval deps in pool_match_dep()
    * support src rpms that have non-empty provides
    * fix favorq leaking between solver runs if the solver is reused
    * fix SOLVER_FLAG_FOCUS_BEST updateing packages without reason
    * be more correct with multiversion packages that obsolete their
      own name
    * allow building with swig-4.0.0
    * lock jobs now take precedence over dup and forcebest jobs
  - new features
    * new POOL_FLAG_WHATPROVIDESWITHDISABLED pool flag 
    * bindings: add get_disabled_list() and set_disabled_list()
    * bindings: add whatcontainsdep()
    * bindings: make the selection filters return the self object
    * MSVC compilation support


author: Ales Matej <amatej@redhat.org> - 0.7.11-1
changelog:
  - Update to 0.7.11
  - selected bug fixes:
    * support arch<->noarch package changes when creating patch
      conflicts from the updateinfo data
    * also support other rpm database types
    * fixed solv_zchunk decoding error if large chunks are used
    * treat retracted pathes as irrelevant
    * made add_update_target work with multiversion installs
  - new features
    * support for SOLVER_BLACKLIST jobs that block the installation of matched
      packages unless they are directly selected by an SOLVER_INSTALL job
    * libsolv now also parses the patch status in the updateinfo parser
    * new solvable_matchessolvable() function
    * support conda constrains dependencies
    * new rpm_stat_database() function
    * new rpm_hash_database_state() function


author: Nicola Sella <nsella@redhat.com> - 0.7.16-1
changelog:
  - Update to 0.7.16
  - selected bug fixes:
    * make testcase_mangle_repo_names deal correctly with freed repos
    [bnc#1177238]
    * fix add_complex_recommends() selecting conflicted packages in
      rare cases leading to crashes
    * improve choicerule generation so that package updates are
      prefered in more cases
    * fix deduceq2addedmap clearing bits outside of the map
    * conda: feature depriorization and fix startswith implementation
    * Fix solvable swapping messing up idarrays
    * fix ruleinfo of complex dependencies returning the wrong origin
    * fix solv_zchunk decoding error if large chunks are used
      [bnc#1159314]
  - new features
    * new testcase_mangle_repo_names() function
    * new solv_fmemopen() function
    * Enable zstd compression support for sle15 and sle15-sp2
    * Support blacklisted packages in solver_findproblemrule()
      [bnc#1172135]
    * Support rules with multiple negative literals in choice rule
      generation
    * build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
      multiple rpm database backends
    * added two new function to make libzypp independent of the rpm
      database format
    * support conda constrains dependencies


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-1
changelog:
  - Update Source to upstream version 0.8.4
    * This version includes the fixes for bz #1768894 & #1821214
    * Previous patches 0001-0009 are included in this version
  - Rename files
    * Previous patches 0010-0019 are now 0011-0020
  - Add 0001-libmultipath-assign-variable-to-make-gcc-happy.patch
  - Add 0002-libmutipath-don-t-close-fd-on-dm_lib_release.patch
  - Add 0003-libmultipath-allow-force-reload-with-no-active-paths.patch
    * make multipath and multipathd reload maps with no active paths
      (bz #1814858)
  - Add 0004-libmpathpersist-depend-on-libmultipath.patch
  - Add 0005-multipath-tools-Makefile-more-dependency-fixes-for-p.patch
  - Add 0006-multipath-tools-Makefile.inc-set-Wno-error-clobbered.patch
  - Add 0007-libmultipath-discovery.c-use-z-qualifier-for-size_t.patch
  - Add 0008-libmultipath-eliminate-more-signed-unsigned-comparis.patch
  - Add 0009-libmultipath-set_uint-fix-parsing-for-32bit.patch
  - Add 0010-multipath-tools-Makefile-add-install-dependency.patch
    * The above 10 patches have been submitted upstream
  - Resolves: bz #1768894, #1814858, #1821214


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-2
changelog:
  - Add 0021-libmultipath-remove-_blacklist_exceptions-functions.patch
  - Add 0022-libmultipath-fix-parser-issue-with-comments-in-strin.patch
  - Add 0023-libmultipath-invert-regexes-that-start-with-exclamat.patch
    * This commit also changes the default devnode blacklist to
      blacklist all devices except scsi, dasd, and nvme.
  - Resolves: bz #1828180


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-3
changelog:
  - Add 0024-libmultipath-make-dm_get_map-status-return-codes-sym.patch
  - Add 0025-multipathd-fix-check_path-errors-with-removed-map.patch
  - Add 0026-libmultipath-make-dm_flush_maps-only-return-0-on-suc.patch
  - Add 0027-multipathd-add-del-maps-multipathd-command.patch
  - Add 0028-multipath-make-flushing-maps-work-like-other-command.patch
  - Add 0029-multipath-delegate-flushing-maps-to-multipathd.patch
  - Add 0030-multipath-add-option-to-skip-multipathd-delegation.patch
    * The above 7 patches fix bz #1845875. Multipath now attempts to
      delegate device removal to multipathd, and multipathd handles
      external device removal better.
  - Add 0031-libmultipath-fix-sysfs-dev_loss_tmo-parsing.patch
    * Fixes bz #1852843
  - Add 0032-kpartx-read-devices-with-direct-IO.patch
    * Fixes bz #1814858
  - Add 0033-kpartx-handle-alternate-bsd-disklabel-location.patch
  - Add 0034-libmultipath-fix-checker-detection-for-nvme-devices.patch
    * fixes bz #1845915
  - Add 0035-Makefile.inc-trim-extra-information-from-systemd-ver.patch
  - Add 0036-kpartx-fix-Wsign-compare-error.patch
  - Resolves: bz #1814858, #1845875, #1845915, #1852843


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-4
changelog:
  - Add 0037-libmultipath-count-pending-paths-as-active-on-loads.patch
    * make udev treat the device as having paths, so it will run kpartx
    * Fixes bz #1846866
  - Resolves: bz #1846866


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-5
changelog:
  - Add 0038-multipath-deal-with-failures-flushing-maps.patch
    * Don't print "fail" if multipath needs to failback to removing
      a device itself.
    * Fixes bz #1845875
  - Modify multipath_conf_syntax CI test
    * It started failing because "multpath -F" can now start multipathd
      via the socket, and the test expected multipathd to not be running
  - Resolves: bz #1845875


author: Michael Catanzaro <mcatanzaro@redhat.com> - 0.9.11-16
changelog:
  - Fix CVE-2019-20839
    Resolves: #1851032
  - Fix CVE-2018-21247
    Resolves: #1852516
  - Fix CVE-2020-14405
    Resolves: #1860527
  - Fix CVE-2020-14397
    Resolves: #1861152


author: Ray Strode <rstrode@redhat.com> - 3.28.3-2
changelog:
  - Add lock to avoid two type object wrappers getting generated at
    the same time in multi-threaded programs.
    Resolves: #1844578


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-3
changelog:
  - Downgrade modesetting "glamor initialization failed" X_ERROR → X_INFO
    Resolves: #1724573
  - Xwayland / Present leak fixes for #1728684


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-5
changelog:
  - xwayland: Hold a pixmap reference in struct xwl_present_event
    Related: #1728684
  - glamor: Fix glamor_poly_fill_rect_gl xRectangle::width/height handling
    Resolves: #1740250


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.8-8
changelog:
  - CVE fixes for: CVE-2020-14345 (#1872391), CVE-2020-14346 (#1872395),
    CVE-2020-14361 (#1872402), CVE-2020-14362 (#1872409)


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.8-3
changelog:
  - Fix for reading compressed kdump dumpfiles from systems with physical memory
    Resolves: rhbz#1819606


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.8-6
changelog:
  - aarch64: Revert to reading CONFIG_ARM64_USER_VA_BITS_52 and CONFIG_ARM64_PA_BITS=52 for 52-bit VA/PA space.
    Resolves: rhbz#1861086


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.8-7
changelog:
  - crash/sadump, kaslr: fix failure of calculating kaslr_offset due to an sadump format restriction
    Resolves: rhbz#1855527


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.8-8
changelog:
  - crash/arm64: Fix arm64 read error with 'idmap_ptrs_per_pgd' symbol with debug kernel
    Resolves: rhbz#1876039


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.9-1
changelog:
  - Rebase to upstream crash version 7.2.9
  - Also minimize the rhel-only patches to the bare minimum.
    Resolves: rhbz#1881854


author: Bhupesh Sharma <bhsharma@redhat.com> - 7.2.9-2
changelog:
  - Fix the sources file to add gdb-7.6 tarball
    [The line was somehow removed when using rhpkg new-sources to
     update the crash tarball location]
    Resolves: rhbz#1881854


author: Marek Polacek <polacek@redhat.com> 8.4.1-1
changelog:
  - update from GCC 8.4 release (#1868446)
  - remove symlinks to 32-bit versions of these static libraries: libasan.a,
    libitm.a, libquadmath.a, libubsan.a, libgfortran.a (#1779597)


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.3-3.1
changelog:
  - Add 0020-libmultipath-make-dm_get_map-status-return-codes-sym.patch
  - Add 0021-multipathd-fix-check_path-errors-with-removed-map.patch
    * The above 2 patches fix bz #1856944. multipathd handles external
      device removal better.
  - Resolves: bz #1856944


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.3-3.3
changelog:
  - Add 0022-libmultipath-fix-files-read-from-config_dir.patch
    * Fix for bz #1858993. Only read files ending in .conf
  - Resolves: bz #1858993


author: Michal Ruprich <michalruprich@gmail.com> - 14:1.9.1-1
changelog:
  - Resolves: #1806422 - rebase libpcap to version 1.9.1
  - Resolves: #1743650 - [RFE] enable inbox support for sniffing offloaded (RDMA) traffic with tcpdump
  - Resolves: #1785330 - Invalid IPv4 addresses are accepted without reporting even a warning
  - Resolves: #1792208 - Resource exhaustion while PHB header length validation


author: Jerry Snitselaar <jsnitsel@redhat.com> - 0.3.15-1
changelog:
  - Rebase to 0.3.15
  - Fix CVE-2020-24330 CVE-2020-24331 CVE-2020-24332
  resolves: rhbz#1725782 rhbz#1877517 rhbz#1882402 rhbz#1882414


author: Danilo C. L. de Paula <ddepaula@redhat.com> - 0.55.3-3
changelog:
  - build: use PIE objects for static libraries
    Resolves: rhbz#1899620
    (meson builds QEMU with PIC objects instead of PIE)


author: Fabiano Fidêncio <fidencio@redhat.com> 3.0.0-1
changelog:
  - Update to 3.0.0 release
  - Resolves: rhbz#1754396 - Provide support for getting "firmwares" info from Domain Capabilities
  - Resolves: rhbz#1753670 - Enable bochs-display for UEFI guests (libvirt-glib)


author: Andreas Schneider <asn@redhat.com> - 4.12.3-1
changelog:
  - resolves: #1666737 - Add a new smbc_readdirplus2() function to libsmbclient
  - resolves: #1842844 - Fix GnuTLS priority list for TLS connections


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.8-0.1.ea
changelog:
  - Update to jdk-11.0.10.0+8
  - Update release notes to 11.0.10.0+8.
  - Update tarball generation script to use PR3818 which handles JDK-8171279 changes
  - Drop JDK-8250861 as applied upstream.
  - Resolves: rhbz#1903908


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-1
changelog:
  - Update to jdk-11.0.10.0+9
  - Update release notes to 11.0.10.0+9
  - Switch to GA mode for final release.
  - Resolves: rhbz#1908972


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-2
changelog:
  - Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode
  - Resolves: rhbz#1894083


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.10.0.9-3
changelog:
  - Removed lib-style provides for fastdebug_suffix_unquoted
  - Fixed missing condition for fastdebug packages being counted as debug ones
  - Fix typo in variable
  - Resolves: rhbz#1908972


author: Than Ngo <than@redhat.com> - 3.14.0-1
changelog:
  - Resolves: #1723863 - ep11 token: Enhanced Support
  - Resolves: #1780285 - ep11 token: Support for new IBM Z hardware z15
  - Resolves: #1780293 - rebase to 3.14.0
  - Resolves: #1800549 - key management tool: list keys function
   -Resolves: #1800555 - key management tool: random key generation function


author: Uri Lublin <uril@redhat.com> - 2.30-2
changelog:
  - Remove PROVIDE() qualifiers from definition of __CTOR_LIST__ and __DTOR_LIST__
    Resolves: rhbz#1846152


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-28.el8
changelog:
  - kvm-redhat-Install-the-s390-netboot.img-that-we-ve-built.patch [bz#1828317]
  - kvm-linux-headers-update-kvm.h.patch [bz#1828317]
  - kvm-s390x-Don-t-do-a-normal-reset-on-the-initial-cpu.patch [bz#1828317]
  - kvm-s390x-Move-reset-normal-to-shared-reset-handler.patch [bz#1828317]
  - kvm-s390x-Move-initial-reset.patch [bz#1828317]
  - kvm-s390x-Move-clear-reset.patch [bz#1828317]
  - kvm-s390x-Beautify-diag308-handling.patch [bz#1828317]
  - kvm-s390x-kvm-Make-kvm_sclp_service_call-void.patch [bz#1828317]
  - kvm-s390x-Fix-cpu-normal-reset-ri-clearing.patch [bz#1828317]
  - kvm-tests-boot-sector-Fix-the-bad-s390x-assembler-code.patch [bz#1828317]
  - kvm-pc-bios-s390x-Fix-reset-psw-mask.patch [bz#1828317]
  - kvm-s390x-Properly-fetch-and-test-the-short-psw-on-diag3.patch [bz#1828317]
  - kvm-s390x-Rename-and-use-constants-for-short-PSW-address.patch [bz#1828317]
  - kvm-s390x-Add-missing-vcpu-reset-functions.patch [bz#1828317]
  - kvm-s390-sclp-improve-special-wait-psw-logic.patch [bz#1828317]
  - kvm-pc-bios-s390x-Save-iplb-location-in-lowcore.patch [bz#1828317]
  - kvm-s390-ipl-sync-back-loadparm.patch [bz#1828317]
  - kvm-s390-ipl-fix-off-by-one-in-update_machine_ipl_proper.patch [bz#1828317]
  - kvm-s390x-ipl-Consolidate-iplb-validity-check-into-one-f.patch [bz#1828317]
  - kvm-vhost-correctly-turn-on-VIRTIO_F_IOMMU_PLATFORM.patch [bz#1828317]
  - kvm-s390x-Move-diagnose-308-subcodes-and-rcs-into-ipl.h.patch [bz#1828317]
  - kvm-s390x-protvirt-Support-unpack-facility.patch [bz#1828317]
  - kvm-s390x-protvirt-Add-migration-blocker.patch [bz#1828317]
  - kvm-s390x-protvirt-Inhibit-balloon-when-switching-to-pro.patch [bz#1828317]
  - kvm-s390x-protvirt-KVM-intercept-changes.patch [bz#1828317]
  - kvm-s390x-Add-SIDA-memory-ops.patch [bz#1828317]
  - kvm-s390x-protvirt-Move-STSI-data-over-SIDAD.patch [bz#1828317]
  - kvm-s390x-protvirt-SCLP-interpretation.patch [bz#1828317]
  - kvm-s390x-protvirt-Set-guest-IPL-PSW.patch [bz#1828317]
  - kvm-s390x-protvirt-Move-diag-308-data-over-SIDA.patch [bz#1828317]
  - kvm-s390x-protvirt-Disable-address-checks-for-PV-guest-I.patch [bz#1828317]
  - kvm-s390x-protvirt-Move-IO-control-structures-over-SIDA.patch [bz#1828317]
  - kvm-s390x-protvirt-Handle-SIGP-store-status-correctly.patch [bz#1828317]
  - kvm-s390x-Add-unpack-facility-feature-to-GA1.patch [bz#1828317]
  - kvm-s390x-protvirt-Fix-stray-error_report_err-in-s390_ma.patch [bz#1828317]
  - kvm-s390x-pv-Retry-ioctls-on-EINTR.patch [bz#1828317]
  - kvm-s390x-s390-virtio-ccw-Fix-build-on-systems-without-K.patch [bz#1828317]
  - kvm-s390x-pv-Fix-KVM_PV_PREP_RESET-command-wrapper-name.patch [bz#1828317]
  - kvm-spapr-Pass-the-maximum-number-of-vCPUs-to-the-KVM-in.patch [bz#1756946]
  - kvm-introduce-kvm_kernel_irqchip_-functions.patch [bz#1756946]
  - kvm-target-s390x-kvm-Enable-adapter-interruption-suppres.patch [bz#1756946]
  - kvm-vfio-nvlink-Remove-exec-permission-to-avoid-SELinux-.patch [bz#1823275]
  - Resolves: bz#1756946
    ([zKVM] Re-enable KVM_CAP_S390_AIS for new machine types)
  - Resolves: bz#1823275
    (RHEL8.1 - GPU Numa nodes not visible in guest post the pass-through.)
  - Resolves: bz#1828317
    ([IBM 8.3 FEAT] s390x: Base KVM setup for secure guests - qemu part)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-29.el8
changelog:
  - kvm-vfio-ccw-Fix-error-message.patch [bz#1660916]
  - kvm-vfio-ccw-allow-non-prefetch-ORBs.patch [bz#1660916]
  - kvm-linux-headers-support-vfio-ccw-features.patch [bz#1660916]
  - kvm-vfio-ccw-Refactor-cleanup-of-regions.patch [bz#1660916]
  - kvm-vfio-ccw-Add-support-for-the-schib-region.patch [bz#1660916]
  - kvm-vfio-ccw-Refactor-ccw-irq-handler.patch [bz#1660916]
  - kvm-s390x-css-Refactor-the-css_queue_crw-routine.patch [bz#1660916]
  - kvm-vfio-ccw-Add-support-for-the-CRW-region-and-IRQ.patch [bz#1660916]
  - kvm-config-enable-VFIO_CCW.patch [bz#1660916]
  - kvm-virtio-blk-Refactor-the-code-that-processes-queued-r.patch []
  - kvm-virtio-blk-On-restart-process-queued-requests-in-the.patch []
  - kvm-Fix-use-afte-free-in-ip_reass-CVE-2020-1983.patch [bz#1838070]
  - Resolves: bz#1660916
    ([IBM 8.3 FEAT] KVM s390x: DASD passthrough support - qemu part)
  - Resolves: bz#1838070
    (CVE-2020-1983 virt:rhel/qemu-kvm: QEMU: slirp: use-after-free in ip_reass() function in ip_input.c [rhel-8])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-30.el8
changelog:
  - kvm-i386-Mask-SVM-features-if-nested-SVM-is-disabled.patch [bz#1835390]
  - kvm-s390x-sigp-Fix-sense-running-reporting.patch [bz#1854092]
  - kvm-s390x-tcg-clear-local-interrupts-on-reset-normal.patch [bz#1854092]
  - kvm-virtio-net-fix-removal-of-failover-device.patch []
  - Resolves: bz#1835390
    (qemu promote host does not support 'EDX.npt' and 'EDX.nrip-save' when test with Q35 machine type on EPYC host)
  - Resolves: bz#1854092
    (kvm-unit-tests: tcg smp FAIL)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-31.el8
changelog:
  - kvm-qcow2-Fix-alloc_cluster_abort-for-pre-existing-clust.patch [bz#1807057]
  - kvm-iotests-026-Test-EIO-on-preallocated-zero-cluster.patch [bz#1807057]
  - kvm-iotests-026-Test-EIO-on-allocation-in-a-data-file.patch [bz#1807057]
  - kvm-iotests-026-Move-v3-exclusive-test-to-new-file.patch [bz#1807057]
  - Resolves: bz#1807057
    (qcow2_alloc_cluster_abort() frees preallocated zero clusters)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-32.el8
changelog:
  - kvm-i386-Add-2nd-Generation-AMD-EPYC-processors.patch [bz#1780385]
  - kvm-target-i386-sev-provide-proper-error-reporting-for-q.patch [bz#1689341]
  - kvm-target-i386-sev-fail-query-sev-capabilities-if-QEMU-.patch [bz#1689341]
  - kvm-s390x-protvirt-allow-to-IPL-secure-guests-with-no-re.patch [bz#1863034]
  - Resolves: bz#1689341
    (QEMU should report an error and return failure if AMD SEV is not enabled in the kernel)
  - Resolves: bz#1780385
    ([RFE] AMD EPYC-Rome support for KVM / QEMU guest)
  - Resolves: bz#1863034
    (RHEL8.3 Beta - Secure Execution: Unable to start Qemu with "-no-reboot" option (qemu-kvm))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-33.el8
changelog:
  - kvm-Require-libfdt-1.6.0.patch [bz#1867847]
  - Resolves: bz#1867847
    ([ppc] virt module 7629: /usr/libexec/qemu-kvm: undefined symbol: fdt_check_full, version LIBFDT_1.2)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-34.el8
changelog:
  - kvm-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869710]
  - Resolves: bz#1869710
    (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-8.3.0])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-34.el8_3.1
changelog:
  - kvm-seccomp-fix-killing-of-whole-process-instead-of-thre.patch [bz#1890885]
  - Resolves: bz#1890885
    (qemu use SCMP_ACT_TRAP even SCMP_ACT_KILL_PROCESS is available [rhel-8.3.0.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-34.el8_3.2
changelog:
  - kvm-qga-fix-assert-regression-on-guest-shutdown.patch [bz#1900578]
  - Resolves: bz#1900578
    (qemu-ga aborts after guest-shutdown command [rhel-8.3.0.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-34.el8_3.3
changelog:
  - kvm-qapi-enable-use-of-g_autoptr-with-QAPI-types.patch [bz#1913818]
  - kvm-error-Fix-examples-in-error.h-s-big-comment.patch [bz#1913818]
  - kvm-error-Improve-error.h-s-big-comment.patch [bz#1913818]
  - kvm-error-Document-Error-API-usage-rules.patch [bz#1913818]
  - kvm-error-New-macro-ERRP_GUARD.patch [bz#1913818]
  - kvm-qga-add-command-guest-get-disks.patch [bz#1913818]
  - kvm-qga-add-implementation-of-guest-get-disks-for-Linux.patch [bz#1913818]
  - kvm-qga-add-implementation-of-guest-get-disks-for-Window.patch [bz#1913818]
  - kvm-qga-fix-missing-closedir-in-qmp_guest_get_disks.patch [bz#1913818]
  - kvm-qga-update-schema-for-guest-get-disks-dependents-fie.patch [bz#1913818]
  - Resolves: bz#1913818
    (Report logical_name for disks without mounted file-system [rhel-8.3.0.z])


author: Honggang Li <honli@redhat.com> - 1.11.1-1
changelog:
  - Rebase to upstream release v1.11.1
  - EFA Support requires libfabric
  - Resolves: bz1831145, bz1852636


author: Filip Januš <fjanus@redhat.com> - 12.2-1
changelog:
  - Rebase onto: 12.2
  - update of patch(libecpg-10.5-external-libpq.patch) was needed
  - add upstream patch libecpg-12.2-dependency-build.patch
    https://www.postgresql.org/message-id/20200321221303.GA17979%40momjian.us


author: Honza Horak <hhorak@redhat.com> - 13.1-3
changelog:
  - Add Requires: libpgtypes to avoid the need to test interoperability
    between the various combinations of old and new subpackages


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.26.0-0.2.1
changelog:
  - device: restart DHCP only for devices that are active or activating (rh #1852612)
  - initrd: fix generating default BOOTIF= connection (rh #1853277)
  - ovs: fix race condition when setting MAC address for ovs interfaces (rh #1852106)


author: Thomas Haller <thaller@redhat.com> - 1:1.26.0-1
changelog:
  - update to 1.26.0
  - device: reset SR-IOV parameters on activation failure (rh #1819587)
  - initrd: enable ipv6.method=auto with ip=dhcp6 (rh #1854323)
  - core: add "nm-shared" zone for firewalld for shared mode (rh #1834907)
  - ppp: fix taking control of link (rh #1849386)


author: Antonio Cardace <acardace@redhat.com> - 1:1.26.0-2
changelog:
  - core: fix generation of local routes for VRF devices (rh #1857133)
  - team: fix crash on failure to connect to teamd (rh #1856723)
  - core: fix detecting failure of master active-connection (rh #1845018)
  - core: fix warning about setting active_slave of bond when activating master (rh #1858326)
  - import translations (rh #1820552)


author: Deepshikha Khandelwal <dkhandel@redhat.com> - 6.0-37.1
changelog:
  - fixes bugs bz#1848890 bz#1848891 bz#1848893 bz#1848894 bz#1848895 
    bz#1848896 bz#1848899 bz#1849533


author: Jonas Ådahl <jadahl@redhat.com> - 3.32.2-52
changelog:
  - Support polyinstantiation
    Resolves: #1861769
  - Mitigate nouveau misidentifying connectors
    Resolves: #1786496


author: Ondrej Holy <oholy@redhat.com> - 2:2.0.0-47.rc4
changelog:
  - Fix SCARD_INSUFFICIENT_BUFFER error (rhbz#1803054)
  - Do not advertise /usb in help output (rhbz#1761144)


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.40.2-26
changelog:
  - insufficient default memsize to open anaconda default RHEL 8.2 luks device
    resolves: rhbz#1837765


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.40.2-27
changelog:
  - selinux-relabel does not work if SELINUXTYPE != targeted
  - tar-in command does not allow restoring file capabilities
    resolves: rhbz#1384241 rhbz#1828952


author: Tomas Orsava <torsava@redhat.com> - 1.1.1-2
changelog:
  - Convert from Fedora to the python39 module in RHEL8
  - Revert usage of pyproject-rpm-macros
  - Remove dependency on setuptools_scm
  - Resolves: rhbz#1877430


author: Danilo C. L. de Paula <ddepaula@redhat.com> - 4.2.0-23.el8
changelog:
  - Resolves: bz#1810193
    (Upgrade components in virt:rhel module:stream for RHEL-8.3 release)
    Another syncronization


author: Danilo C. L. de Paula <ddepaula@redhat.com> - 4.2.0-25
changelog:
  - Resolves: bz#1810193
    (Upgrade components in virt:rhel module:stream for RHEL-8.3 release)
    Another sync


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-3
changelog:
  - fix CVE-2020-10957 dovecot: malformed NOOP commands leads to DoS (#1840354)
  - fix CVE-2020-10958 dovecot: command followed by sufficient number of newlines
    leads to use-after-free (#1840357)
  - fix CVE-2020-10967 dovecot: sending mail with empty quoted localpart
    leads to DoS (#1840356)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-4
changelog:
  - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866756)
  - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866761)
  - fix CVE-2020-12674 crash due to assert in RPA implementation (#1866768)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-6
changelog:
  - fix mail storage block count parsing (#1894418)
  - MIME parser crashed when boundaries were wrong (#1888111)


author: Chris Leech <cleech@redhat.com> - 6.2.0.878-0.gitd791ce0
changelog:
  - 1761940 iSCSI CHAP authentication not function with FIPS enabled
  - Service file improvements forward ported from RHEL 7.8
  - various static analysis fixes from upstream


author: Chris Leech - 6.2.0.878-5.gitd791ce0
changelog:
  - 1849931, 1869438 go back to MD5 CHAP only by default
    new CHAP modes can cause issue with some targets,
    so SHA1/SHA256/SHA3-256 modes must be configured to enable now


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.6.0-1
changelog:
  - Use 1.6.0 version [bz#1679676]
  - Resolves: bz#1679676
    (dtc changes blocked until gating tests are added)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.56.4-10
changelog:
  - Fix various problems in GMainContext
    Resolves: #1953553
  - Fix CVE-2021-27219
    Resolves: #1960600


author: Karel Zak <kzak@redhat.com> 2.32.1-23
changelog:
  - fix #1826251 - remove MD metadata 0.90 based tests from util-linux CI
  - fix #1812576 - RFE: Bitlocker detection for RHEL 8.3
  - fix #1817726 - add libblkid BLOCK_SIZE
  - fix #1803753 - RHEL-8: col struct char_str c_column field should be of unsigned type and/or larger than 16 bit
  - fix #1812118 - mount -a always tries to mount smb3 share subdir despite being already mounted
  - fix #1824727 - util-linux: Include python3-libmount package in the release
  - fix #1829245 - mount -a tries to mount already mounted cifs shares when we cannot query up to root dir


author: Honggang Li <honli@redhat.com> - 4.2.10-25
changelog:
  - Rebase to latest Fedora release
  - Fix file conflicts in torque-devel multilib packages
  - Resolve: bz1853167


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-13
changelog:
  - Added -DDFLTCC parameter to configure to enable 
  - Z hardware-accelerated deflate for s390x architectures (#1659433)


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-16
changelog:
  - Permit a deflateParams() parameter change
  - Another fix for Z hardware-accelerated deflate for s390x architectures
  - according to previous change by upstream


author: Jerome Marchand <jmarchan@redhat.com> - 0.14.0-2
changelog:
  - Remove criticalstat manpage
  - Remove compactsnoop on non x86_64
  - Suggest to use --binary in deadlock
  - Remove non-existent argument from tcpconnect man page
  - Suggest to install the proper kernel-devel version
  - Fix dbstat and dbslower


author: Honggang Li <honli@redhat.com> - 3.3.2-8
changelog:
  - Sync with Fedora build
  - Update to latest upstream release 3.3.2
  - Resolves: rhbz#1657316, rhbz#1732982, rhbz#1850080


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.8-2.2
changelog:
  - fix CVE-2020-12100 resource exhaustion via deeply nested MIME parts (#1866755)
  - fix CVE-2020-12673 out of bound reads in dovecot NTLM implementation (#1866760)
  - fix CVE-2020-12674 crash due to assert in RPA implementation (#1866767)


author: Tomáš Mráz <tmraz@redhat.com> 1.4.4-1
changelog:
  - Translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer
  - pam_pwquality: Abort the retry loop if user requests it
  - Allow setting retry, enforce_for_root, and local_users_only options
    in the pwquality.conf config file


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1919026 libpwquaily rpm requires cracklib to function but RPM missing requirement [updated]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-231.el8]
changelog:
  - [x86] x86/entry/64: Update comments and sanity tests for create_gap (Jiri Olsa) [1850831]
  - [x86] x86/alternatives: add missing insn.h include (Jiri Olsa) [1850831]
  - [x86] x86/alternatives: Teach text_poke_bp() to emulate instructions (Jiri Olsa) [1850831]
  - [x86] x86/paravirt: Standardize 'insn_buff' variable names (Jiri Olsa) [1850831]
  - [x86] x86_64: Allow breakpoints to emulate call instructions (Jiri Olsa) [1850831]
  - [x86] x86_64: Add gap to int3 to allow for call emulation (Jiri Olsa) [1850831]
  - [x86] x86/alternatives: Sync bp_patching update for avoiding NULL pointer exception (Jiri Olsa) [1850831]
  - [nvme] nvme: add a Identify Namespace Identification Descriptor list quirk (Gopal Tiwari) [1862136]
  - [nvme] nvme: fix identify error status silent ignore (Gopal Tiwari) [1862136]
  - [nvme] nvme: fix possible hang when ns scanning fails during error recovery (Gopal Tiwari) [1862136]
  - [nvme] nvme: refactor nvme_identify_ns_descs error handling (Gopal Tiwari) [1862136]
  - [infiniband] IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE (Kamal Heib) [1850314]
  - [powerpc] powerpc/pseries: PCIE PHB reset (Steve Best) [1747345]
  - [drm] drm/nouveau/kms: Handle -EINPROGRESS in nouveau_display_acpi_ntfy() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms: Fix runtime PM leak in nouveau_display_acpi_ntfy() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms: Invert conditionals in nouveau_display_acpi_ntfy() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms: Use pm_runtime_put_autosuspend() in hpd_work (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms/fbcon: Use pm_runtime_put_autosuspend() in suspend work (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms/fbcon: Fix pm_runtime calls in nouveau_fbcon_output_poll_changed() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms/fbcon: Correct pm_runtime calls in nouveau_fbcon_release() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms: Fix rpm leak in nouveau_connector_hotplug() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms: Handle -EINPROGRESS in nouveau_connector_hotplug() (Lyude Paul) [1827812]
  - [drm] drm/nouveau/fbcon: fix module unload when fbcon init has failed for some reason (Lyude Paul) [1827812]
  - [drm] drm/nouveau/kms/tu102: wait for core update to complete when assigning windows (Lyude Paul) [1827812]
  - [drm] drm/nouveau/disp/gm200-: fix regression from HDA SOR selection changes (Lyude Paul) [1827812]
  - [drm] drm/amd/powerplay: fix a crash when overclocking Vega M (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: Fix NULL dereference in dpm sysfs handlers (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: fix preemption unit test (Lyude Paul) [1827812]
  - [drm] drm/amdgpu/gfx10: fix race condition for kiq (Lyude Paul) [1827812]
  - [drm] drm/amd/display: add dmcub check on RENOIR (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Check DMCU Exists Before Loading (Lyude Paul) [1827812]
  - [drm] drm/nouveau/nouveau: fix page fault on device private memory (Lyude Paul) [1827812]
  - [drm] drm/nouveau/i2c/g94-: increase NV_PMGR_DP_AUXCTL_TRANSACTREQ timeout (Lyude Paul) [1827812]
  - [drm] drm/i915/perf: Use GTT when saving/restoring engine GPR (Lyude Paul) [1827812]
  - [drm] drm/i915/gvt: Fix two CFL MMIO handling caused by regression (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Only swap to a random sibling once upon creation (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Ignore irq enabling on the virtual engines (Lyude Paul) [1827812]
  - [drm] drm/i915: Move cec_notifier to intel_hdmi_connector_unregister, v2 (Lyude Paul) [1827812]
  - [drm] drm/amdgpu/display: create fake mst encoders ahead of time (v4) (Lyude Paul) [1827812]
  - [drm] drm/amd/display: handle failed allocation during stream construction (Lyude Paul) [1827812]
  - [drm] drm/amdgpu/sdma5: fix wptr overwritten in ->get_wptr() (Lyude Paul) [1827812]
  - [drm] drm/amdgpu/powerplay: Modify SMC message name for setting power profile mode (Lyude Paul) [1827812]
  - [drm] drm/i915: Also drop vm.ref along error paths for vma construction (Lyude Paul) [1827812]
  - [drm] drm/i915: Drop vm.ref for duplicate vma on construction (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: asd function needs to be unloaded in suspend phase (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: add TMR destory function for psp (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: don't do soft recovery if gpu_recovery=0 (Lyude Paul) [1827812]
  - [drm] drm/i915: Skip stale object handle for debugfs per-file-stats (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Pin the rings before marking active (Lyude Paul) [1827812]
  - [drm] drm/radeon: fix double free (Lyude Paul) [1827812]
  - [drm] drm: panel-orientation-quirks: Use generic orientation-data for Acer S1003 (Lyude Paul) [1827812]
  - [drm] drm: panel-orientation-quirks: Add quirk for Asus T101HA panel (Lyude Paul) [1827812]
  - [iommu] iommu/vt-d: Don't apply gfx quirks to untrusted devices (Lyude Paul) [1827812]
  - [drm] drm/tegra: hub: Do not enable orphaned window group (Lyude Paul) [1827812]
  - [drm] drm/ttm: Fix dma_fence refcnt leak when adding move fence (Lyude Paul) [1827812]
  - [drm] drm/ttm: Fix dma_fence refcnt leak in ttm_bo_vm_fault_reserved (Lyude Paul) [1827812]
  - [drm] drm/amdgpu/atomfirmware: fix vram_info fetching for renoir (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: use u rather than d for sclk/mclk (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Only revalidate bandwidth on medium and fast updates (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Mark timeline->cacheline as destroyed after rcu grace period (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Fix ineffective setting of max bpc property (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Fix incorrectly pruned modes with deep color (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: add fw release for sdma v5_0 (Lyude Paul) [1827812]
  - [drm] drm/radeon: fix fb_div check in ni_init_smc_spll_table() (Lyude Paul) [1827812]
  - [drm] drm/amd: fix potential memleak in err branch (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Enable output_bpc property on all outputs (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Use kfree() to free rgb_user in calculate_user_regamma_ramp() (Lyude Paul) [1827812]
  - [drm] Revert "drm/amd/display: disable dcn20 abm feature for bring up" (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Move gen4 GT workarounds from init_clock_gating to workarounds (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Move vlv GT workarounds from init_clock_gating to workarounds (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Move ilk GT workarounds from init_clock_gating to workarounds (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Move snb GT workarounds from init_clock_gating to workarounds (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Move ivb GT workarounds from init_clock_gating to workarounds (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Move hsw GT workarounds from init_clock_gating to workarounds (Lyude Paul) [1827812]
  - [drm] drm/i915/gt: Incrementally check for rewinding (Lyude Paul) [1827812]
  - [drm] drm/i915/tc: fix the reset of ln0 (Lyude Paul) [1827812]
  - [drm] drm/i915/icl+: Fix hotplug interrupt disabling after storm detection (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Use kvfree() to free coeff in build_regamma() (Lyude Paul) [1827812]
  - [drm] drm/amdkfd: Use correct major in devcgroup check (Lyude Paul) [1827812]
  - [drm] drm/connector: notify userspace on hotplug after register complete (Lyude Paul) [1827812]
  - [drm] drm/i915: Whitelist context-local timestamp in the gen9 cmdparser (Lyude Paul) [1827812]
  - [drm] drm/i915/gem: Avoid iterating an empty list (Lyude Paul) [1827812]
  - [drm] drm/i915: Fix AUX power domain toggling across TypeC mode resets (Lyude Paul) [1827812]
  - [drm] drm/dp_mst: Increase ACT retry timeout to 3s (Lyude Paul) [1827812]
  - [drm] drm/ast: Don't check new mode if CRTC is being disabled (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: Replace invalid device ID with a valid device ID (Lyude Paul) [1827812]
  - [drm] drm/amdgpu/display: use blanked rather than plane state for sync groups (Lyude Paul) [1827812]
  - [drm] drm/qxl: Use correct notify port address when creating cursor ring (Lyude Paul) [1827812]
  - [drm] drm/dp_mst: Reformat drm_dp_check_act_status() a bit (Lyude Paul) [1827812]
  - [drm] drm/ast: fix missing break in switch statement for format->cppcase 4 (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Revalidate bandwidth before commiting DC updates (Lyude Paul) [1827812]
  - [drm] drm/nouveau: gr/gk20a: Use firmware version 0 (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: Sync with VM root BO when switching VM to CPU update mode (Lyude Paul) [1827812]
  - [drm] drm/amd/powerpay: Disable gfxoff when setting manual mode on picasso and raven (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Do not disable pipe split if mode is not supported (Lyude Paul) [1827812]
  - [drm] drm/amd/display: dmcu wait loop calculation is incorrect in RV (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Correct updating logic of dcn21's pipe VM flags (Lyude Paul) [1827812]
  - [drm] drm/ast: Allocate initial CRTC state of the correct size (Lyude Paul) [1827812]
  - [drm] drm/hisilicon: Enforce 128-byte stride alignment to fix the hardware limitation (Lyude Paul) [1827812]
  - [drm] drm/dp: Lenovo X13 Yoga OLED panel brightness fix (Lyude Paul) [1827812]
  - [drm] drm/i915/dpcd_bl: Unbreak enable_dpcd_backlight modparam (Lyude Paul) [1827812]
  - [drm] drm/i915: Force DPCD backlight mode for some Dell CML 2020 panels (Lyude Paul) [1827812]
  - [drm] drm/i915: Force DPCD backlight mode on X1 Extreme 2nd Gen 4K AMOLED panel (Lyude Paul) [1827812]
  - [drm] drm/dp: Introduce EDID-based quirks (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: Init data to avoid oops while reading pp_num_states (Lyude Paul) [1827812]
  - [drm] drm/amd/display: fix virtual signal dsc setup (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Force watermark value propagation (Lyude Paul) [1827812]
  - [drm] drm: bridge: adv7511: Extend list of audio sample rates (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: fix and cleanup amdgpu_gem_object_close v4 (Lyude Paul) [1827812]
  - [drm] drm/vkms: Hold gem object while still in-use (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Not doing optimize bandwidth if flip pending (Lyude Paul) [1827812]
  - [drm] drm/amd/display: remove invalid dc_is_hw_initialized function (Lyude Paul) [1827812]
  - [drm] drm/amd/display: DP training to set properly SCRAMBLING_DISABLE (Lyude Paul) [1827812]
  - [drm] drm/edid: Add Oculus Rift S to non-desktop list (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Fix potential integer wraparound resulting in a hang (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Added locking for atomic update stream and update planes (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Indicate dsc updates explicitly (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Split program front end part that occur outside lock (Lyude Paul) [1827812]
  - [drm] drm/amd/display: drop cursor position check in atomic test (Lyude Paul) [1827812]
  - [drm] drm/amd/amdgpu: Update update_config() logic (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: Use GEM obj reference for KFD BOs (Lyude Paul) [1827812]
  - [drm] drm/amd/powerplay: perform PG ungate prior to CG ungate (Lyude Paul) [1827812]
  - [drm] drm/amdgpu: drop unnecessary cancel_delayed_work_sync on PG ungate (Lyude Paul) [1827812]
  - [drm] drm/i915: Propagate error from completed fences (Lyude Paul) [1827812]
  - [drm] drm/i915/gvt: Init DPLL/DDI vreg for virtual display instead of inheritance (Lyude Paul) [1827812]
  - [drm] drm/amd/display: Prevent dpcd reads with passive dongles (Lyude Paul) [1827812]
  - [drm] drm/amd/display: fix counter in wait_for_no_pipes_pending (Lyude Paul) [1827812]
  - [gpu] vgaarb: Keep adding VGA device in queue (Lyude Paul) [1827812]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-232.el8]
changelog:
  - [fs] nfs: nfs_file_write() should check for writeback errors (Scott Mayhew) [1852788]
  - [s390] s390/cpum_cf, perf: change DFLT_CCERROR counter name (Philipp Rudo) [1865794]
  - [net] net/smc: unique reason code for exceeded max dmb count (Philipp Rudo) [1865792]
  - [s390] s390/ism: indicate correct error reason in ism_alloc_dmb() (Philipp Rudo) [1865792]
  - [net] net/smc: fix dmb buffer shortage (Philipp Rudo) [1865792]
  - [net] net/smc: put slot when connection is killed (Philipp Rudo) [1865792]
  - [net] net/smc: fix restoring of fallback changes (Philipp Rudo) [1865792]
  - [net] net/smc: remove freed buffer from list (Philipp Rudo) [1865792]
  - [net] net/smc: do not call dma sync for unmapped memory (Philipp Rudo) [1865792]
  - [net] net/smc: fix handling of delete link requests (Philipp Rudo) [1865792]
  - [net] net/smc: move add link processing for new device into llc layer (Philipp Rudo) [1865792]
  - [net] net/smc: drop out-of-flow llc response messages (Philipp Rudo) [1865792]
  - [net] net/smc: protect smc ib device initialization (Philipp Rudo) [1865792]
  - [net] net/smc: fix link lookup for new rdma connections (Philipp Rudo) [1865792]
  - [net] net/smc: clear link during SMC client link down processing (Philipp Rudo) [1865792]
  - [net] net/smc: handle unexpected response types for confirm link (Philipp Rudo) [1865792]
  - [net] net/smc: switch smcd_dev_list spinlock to mutex (Philipp Rudo) [1865792]
  - [net] net/smc: fix sleep bug in smc_pnet_find_roce_resource() (Philipp Rudo) [1865792]
  - [net] net/smc: fix work request handling (Philipp Rudo) [1865792]
  - [net] net/smc: separate LLC wait queues for flow and messages (Philipp Rudo) [1865792]
  - [net] net/smc: pre-fetch send buffer outside of send_lock (Philipp Rudo) [1865792]
  - [nvme] nvme-fc: set max_segments to lldd max value (Ewan Milne) [1853181]
  - [powerpc] ppc64/kexec_file: enable early kernel's OPAL calls (Diego Domingos) [1829715]
  - [powerpc] ppc64/kexec_file: fix kexec load failure with lack of memory hole (Diego Domingos) [1829715]
  - [powerpc] ppc64/kexec_file: add appropriate regions for memory reserve map (Diego Domingos) [1829715]
  - [powerpc] ppc64/kexec_file: prepare elfcore header for crashing kernel (Diego Domingos) [1829715]
  - [powerpc] ppc64/kexec_file: setup backup region for kdump kernel (Diego Domingos) [1829715]
  - [powerpc] ppc64/kexec_file: restrict memory usage of kdump kernel (Diego Domingos) [1829715]
  - [mm] powerpc/drmem: make lmb walk a bit more flexible (Diego Domingos) [1829715]
  - [powerpc] ppc64/kexec_file: avoid stomping memory used by special regions (Diego Domingos) [1829715]
  - [powerpc] powerpc/kexec_file: add helper functions for getting memory ranges (Diego Domingos) [1829715]
  - [powerpc] powerpc/kexec_file: mark PPC64 specific code (Diego Domingos) [1829715]
  - [kernel] kexec_file: allow archs to handle special regions while locating memory hole (Diego Domingos) [1829715]
  - [netdrv] net/mlx5e: CT: Support restore ipv6 tunnel (Alaa Hleihel) [1862975]
  - [netdrv] ionic: unlock queue mutex in error path (Jonathan Toppins) [1854270]
  - [netdrv] ionic: use mutex to protect queue operations (Jonathan Toppins) [1854270]
  - [net] xfrm: esp6: fix the location of the transport header with encapsulation (Sabrina Dubroca) [1857653]
  - [net] ipv4: fill fl4_icmp_{type, code} in ping_v4_sendmsg (Sabrina Dubroca) [1861324]
  - [netdrv] geneve: fix an uninitialized value in geneve_changelink() (Sabrina Dubroca) [1860945]
  - [net] ip_tunnel: fix use-after-free in ip_tunnel_lookup() (Sabrina Dubroca) [1860945]
  - [netdrv] vxlan: Avoid infinite loop when suppressing NS messages with invalid options (Sabrina Dubroca) [1860945]
  - [tools] selftests: mptcp: capture pcap on both sides (Hangbin Liu) [1859880]
  - [tools] selftests/net: report etf errors correctly (Hangbin Liu) [1859880]
  - [tools] selftests: net: ip_defrag: ignore EPERM (Hangbin Liu) [1859880]
  - [tools] selftests: forwarding: pedit_dsfield: Check counter value (Hangbin Liu) [1859880]
  - [tools] selftests: net: tcp_mmap: fix SO_RCVLOWAT setting (Hangbin Liu) [1859880]
  - [tools] selftests: net: tcp_mmap: clear whole tcp_zerocopy_receive struct (Hangbin Liu) [1859880]
  - [tools] selftests: A few improvements to fib_nexthops.sh (Hangbin Liu) [1859880]
  - [tools] selftests: Add tests for vrf and xfrms (Hangbin Liu) [1859880]
  - [tools] selftests: pmtu: implement IPIP, SIT and ip6tnl PMTU discovery tests (Hangbin Liu) [1859880]
  - [tools] selftests/net/forwarding: define libs as TEST_PROGS_EXTENDED (Hangbin Liu) [1859880]
  - [tools] selftests/net/forwarding: add Makefile to install tests (Hangbin Liu) [1859880]
  - [tools] selftests: nft_concat_range: Move option for 'list ruleset' before command (Hangbin Liu) [1859880]
  - [tools] selftests: netfilter: use randomized netns names (Hangbin Liu) [1859880]
  - [tools] kselftests: netfilter: fix leftover net/net-next merge conflict (Hangbin Liu) [1859880]
  - [tools] selftests: netfilter: missing error check when setting up veth interface (Hangbin Liu) [1859880]
  - [net] sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket (Xin Long) [1860673]
  - [net] sctp: check assoc before SCTP_ADDR_{MADE_PRIM, ADDED} event (Xin Long) [1860673]
  - [net] sctp: fix typo sctp_ulpevent_nofity_peer_addr_change (Xin Long) [1860673]
  - [net] sctp: Fix spelling in Kconfig help (Xin Long) [1860673]
  - [net] sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed (Xin Long) [1860673]
  - [net] sctp: Don't add the shutdown timer if its already been added (Xin Long) [1860673]
  - [net] sctp: Fix SHUTDOWN CTSN Ack in the peer restart case (Xin Long) [1860673]
  - [net] sctp: Fix bundling of SHUTDOWN with COOKIE-ACK (Xin Long) [1860673]
  - [net] ip6_vti: use IS_REACHABLE to avoid some compile errors (Xin Long) [1840976 1835075]
  - [net] xfrm: interface: use IS_REACHABLE to avoid some compile errors (Xin Long) [1840976 1835075]
  - [net] xfrm: interface: not xfrmi_ipv6/ipip_handler twice (Xin Long) [1840976 1835075]
  - [net] ip6_vti: not register vti_ipv6_handler twice (Xin Long) [1840976 1835075]
  - [net] ip_vti: not register vti_ipip_handler twice (Xin Long) [1840976 1835075]
  - [net] xfrm: interface: support IPIP and IPIP6 tunnels processing with .cb_handler (Xin Long) [1840976 1835075]
  - [net] xfrm: interface: support IP6IP6 and IP6IP tunnels processing with .cb_handler (Xin Long) [1840976 1835075]
  - [net] ipcomp: assign if_id to child tunnel from parent tunnel (Xin Long) [1840976 1835075]
  - [net] ip6_vti: support IP6IP tunnel processing (Xin Long) [1840976 1835075]
  - [net] ip6_vti: support IP6IP6 tunnel processing with .cb_handler (Xin Long) [1840976 1835075]
  - [net] ip_vti: support IPIP6 tunnel processing (Xin Long) [1840976 1835075]
  - [net] ip_vti: support IPIP tunnel processing with .cb_handler (Xin Long) [1840976 1835075]
  - [net] tunnel6: add tunnel6_input_afinfo for ipip and ipv6 tunnels (Xin Long) [1840976 1835075]
  - [net] tunnel4: add cb_handler to struct xfrm_tunnel (Xin Long) [1840976 1835075]
  - [net] xfrm: add is_ipip to struct xfrm_input_afinfo (Xin Long) [1840976 1835075]
  - [net] tunnel6: support for IPPROTO_MPLS (Xin Long) [1840976 1835075]
  - [net] virtio_vsock: Enhance connection semantics (Stefano Garzarella) [1861735]
  - [net] virtio_vsock: Fix race condition in virtio_transport_recv_pkt (Stefano Garzarella) [1858135]
  - [net] vsock/virtio: annotate 'the_virtio_vsock' RCU pointer (Stefano Garzarella) [1861762]
  - [vhost] vsock/virtio: fix multiple packet delivery to monitoring devices (Stefano Garzarella) [1861762]
  - [vhost] vsock: fix packet delivery order to monitoring devices (Stefano Garzarella) [1861762]
  - [vhost] vsock: accept only packets with the right dst_cid (Stefano Garzarella) [1861762]
  - [vhost] vsock: refuse CID assigned to the guest->host transport (Stefano Garzarella) [1861762]
  - [vhost] vsock: switch to a mutex for vhost_vsock_hash (Stefano Garzarella) [1861762]
  - [net] vsock: fix timeout in vsock_accept() (Stefano Garzarella) [1861762]
  - [net] vsock: Simplify '__vsock_release()' (Stefano Garzarella) [1861762]
  - [netdrv] net/mlx5e: Fix kernel crash when setting vf VLANID on a VF dev (Alaa Hleihel) [1859477]
  - [netdrv] net/mlx5e: Modify uplink state on interface up/down (Alaa Hleihel) [1861720 1859477]
  - [netdrv] net/mlx5e: Fix missing cleanup of ethtool steering during rep rx cleanup (Alaa Hleihel) [1859477 1856660]
  - [netdrv] ixgbe: Add ethtool support to enable 2.5 and 5.0 Gbps support (Ken Cox) [1835962]
  - [x86] x86/purgatory: Add -fno-stack-protector (Lianbo Jiang) [1857528]
  - [x86] x86/purgatory: Fail the build if purgatory.ro has missing symbols (Lianbo Jiang) [1857528]
  - [x86] x86/purgatory: Do not use __builtin_memcpy and __builtin_memset (Lianbo Jiang) [1857528]
  - [x86] x86/boot: Provide KASAN compatible aliases for string routines (Lianbo Jiang) [1857528]
  - [x86] x86/purgatory: Disable various profiling and sanitizing options (Lianbo Jiang) [1857528]
  - [x86] x86/boot: Restrict header scope to make Clang happy (Lianbo Jiang) [1857528]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-233.el8]
changelog:
  - [fs] nfs: ensure correct writeback errors are returned on close() (Scott Mayhew) [1849424]
  - [netdrv] net: thunderx: use spin_lock_bh in nicvf_set_rx_mode_task() (Dean Nelson) [1824858]
  - [crypto] crypto: ecc - SP800-56A rev 3 local public key validation (Herbert Xu) [1855817]
  - [crypto] crypto: dh - SP800-56A rev 3 local public key validation (Herbert Xu) [1855817]
  - [crypto] crypto: dh - check validity of Z before export (Herbert Xu) [1855817]
  - [lib] lib/mpi: Add mpi_sub_ui() (Herbert Xu) [1855817]
  - [crypto] crypto: ecdh - check validity of Z before export (Herbert Xu) [1855817]
  - [netdrv] net: thunderx: initialize VF's mailbox mutex before first usage (Dean Nelson) [1866827]
  - [kernel] timers: Lower base clock forwarding threshold (Phil Auld) [1833096]
  - [kernel] timers: Remove must_forward_clk (Phil Auld) [1833096]
  - [kernel] timers: Spare timer softirq until next expiry (Phil Auld) [1833096]
  - [kernel] timers: Expand clk forward logic beyond nohz (Phil Auld) [1833096]
  - [kernel] timers: Reuse next expiry cache after nohz exit (Phil Auld) [1833096]
  - [kernel] timers: Always keep track of next expiry (Phil Auld) [1833096]
  - [kernel] timers: Optimize _next_timer_interrupt() level iteration (Phil Auld) [1833096]
  - [kernel] timers: Add comments about calc_index() ceiling work (Phil Auld) [1833096]
  - [kernel] timers: Move trigger_dyntick_cpu() to enqueue_timer() (Phil Auld) [1833096]
  - [kernel] timers: Use only bucket expiry for base->next_expiry value (Phil Auld) [1833096]
  - [kernel] timers: Preserve higher bits of expiration on index calculation (Phil Auld) [1833096]
  - [kernel] timer: Fix wheel index calculation on last level (Phil Auld) [1833096]
  - [kernel] timer: Prevent base->clk from moving backward (Phil Auld) [1833096]
  - [kernel] timer: Read jiffies once when forwarding base clk (Phil Auld) [1833096]
  - [powerpc] powerpc/64: Update Speculation_Store_Bypass in /proc/<pid>/status (Gustavo Duarte) [1773868]
  - [scsi] scsi: virtio-scsi: Correctly handle the case where all LUNs are unplugged (Maxim Levitsky) [1756093]
  - [kvm] kvm: x86: replace kvm_spec_ctrl_test_value with runtime test on the host (Maxim Levitsky) [1853447]
  - [kvm] x86/kvm: Move context tracking where it belongs (Nitesh Narayan Lal) [1854011]
  - [scsi] scsi: megaraid_sas: Clear affinity hint (Tomas Henzl) [1828351]
  - [netdrv] revert "vxlan: fix tos value before xmit" (Andrea Claudi) [1862166]
  - [net] udp: Copy has_conns in reuseport_grow(). (Marcelo Leitner) [1867160]
  - [net] dev: Defer free of skbs in flush_backlog (Marcelo Leitner) [1867160]
  - [include] net: core: reduce recursion limit value (Marcelo Leitner) [1867160]
  - [netdrv] pppoe: only process PADT targeted at local interfaces (Andrea Claudi) [1866850]
  - [net] espintcp: count packets dropped in espintcp_rcv (Sabrina Dubroca) [1866393]
  - [net] espintcp: handle short messages instead of breaking the encap socket (Sabrina Dubroca) [1866393]
  - [net] espintcp: recv() should return 0 when the peer socket is closed (Sabrina Dubroca) [1866393]
  - [net] espintcp: support non-blocking sends (Sabrina Dubroca) [1866393]
  - [net] mptcp: be careful on subflow creation (Davide Caratti) [1862200]
  - [net] mptcp: fix bogus sendmsg() return code under pressure (Davide Caratti) [1862200]
  - [net] mptcp: fix joined subflows with unblocking sk (Davide Caratti) [1862200]
  - [net] subflow: explicitly check for plain tcp rsk (Davide Caratti) [1862200]
  - [net] mptcp: silence warning in subflow_data_ready() (Davide Caratti) [1862200]
  - [net] mptcp: fix race in subflow_data_ready() (Davide Caratti) [1862200]
  - [net] mptcp: fix memory leak in mptcp_subflow_create_socket() (Davide Caratti) [1862200]
  - [net] mptcp: don't leak msk in token container (Davide Caratti) [1862200]
  - [net] ipv4: Silence suspicious RCU usage warning (Guillaume Nault) [1866430]
  - [net] devinet: fix memleak in inetdev_init() (Guillaume Nault) [1866430]
  - [net] ipip: fix wrong address family in init error path (Guillaume Nault) [1866430]
  - [net] inet_csk: Fix so_reuseport bind-address cache in tb->fast* (Guillaume Nault) [1866430]
  - [net] ipmr: Add lockdep expression to ipmr_for_each_table macro (Guillaume Nault) [1866430]
  - [net] ipmr: Fix RCU list debugging warning (Guillaume Nault) [1866430]
  - [net] tcp: make sure listeners don't initialize congestion-control state (Paolo Abeni) [1865904]
  - [net] sched: The error lable position is corrected in ct_init_module (Davide Caratti) [1865890]
  - [net] sched: cls_api: fix nooffloaddevcnt warning dmesg log (Davide Caratti) [1865890]
  - [net] tls: fix race condition causing kernel panic (Sabrina Dubroca) [1861756]
  - [net] tls: free record only on encryption error (Sabrina Dubroca) [1861756]
  - [net] tls: fix encryption error checking (Sabrina Dubroca) [1861756]
  - [net] l2tp: add sk_family checks to l2tp_validate_socket (Guillaume Nault) [1861453]
  - [net] l2tp: do not use inet_hash()/inet_unhash() (Guillaume Nault) [1861453]
  - [net] tipc: allow to build NACK message in link timeout function (Xin Long) [1860877]
  - [net] tipc: fix retransmission on unicast links (Xin Long) [1860877]
  - [net] tipc: fix NULL pointer dereference in tipc_disc_rcv() (Xin Long) [1860877]
  - [net] tipc: remove set but not used variable 'prev' (Xin Long) [1860877]
  - [net] tipc: call tsk_set_importance from tipc_topsrv_create_listener (Xin Long) [1860877]
  - [net] tipc: add support for broadcast rcv stats dumping (Xin Long) [1860877]
  - [net] tipc: enable broadcast retrans via unicast (Xin Long) [1860877]
  - [net] tipc: add back link trace events (Xin Long) [1860877]
  - [net] tipc: introduce Gap ACK blocks for broadcast link (Xin Long) [1860877]
  - [net] tipc: block BH before using dst_cache (Xin Long) [1860877]
  - [net] tipc: fix partial topology connection closure (Xin Long) [1860877]
  - [net] xfrm: policy: match with both mark and mask on user interfaces (Xin Long) [1854116]
  - [scsi] scsi: dh: Add Fujitsu device to devinfo and dh lists (Ewan Milne) [1861418]
  - [x86] kvm: Set KVM_SOFT_MAX_VCPUS to 1024 (Eduardo Habkost) [1856996]
  - [md] dm integrity: fix integrity recalculation that is improperly skipped (Mike Snitzer) [1860160]
  - [netdrv] ibmvnic: Fix IRQ mapping disposal in error path (Steve Best) [1867498]
  - [infiniband] IB/hfi1: Do not destroy link_wq when the device is shut down (Kamal Heib) [1858392]
  - [infiniband] IB/hfi1: Do not destroy hfi1_wq when the device is shut down (Kamal Heib) [1858392]
  - [netdrv] Revert "net/broadcom: Clean broadcom code from driver versions" (Jonathan Toppins) [1867146]
  - [net] devmap: Use bpf_map_area_alloc() for allocating hash buckets (Jiri Benc) [1842380]
  - [kernel] kexec_file: Correctly output debugging information for the PT_LOAD ELF header (Lianbo Jiang) [1861186]
  - [kernel] kexec: Improve & fix crash_exclude_mem_range() to handle overlapping ranges (Lianbo Jiang) [1861186]
  - [x86] x86/crash: Correct the address boundary of function parameters (Lianbo Jiang) [1861186]
  - [fs] ceph: handle zero-length feature mask in session messages (Jeff Layton) [1866018]
  - [s390] s390/bpf: Tolerate not converging code shrinking (Yauheni Kaliuta) [1857120]
  - [s390] s390/bpf: Use brcl for jumping to exit_ip if necessary (Yauheni Kaliuta) [1857120]
  - [s390] s390/bpf: Fix sign extension in branch_ku (Yauheni Kaliuta) [1857120]
  - [tools] selftests: bpf: test_kmod.sh: Fix running out of srctree (Yauheni Kaliuta) [1857120]
  - [lib] bpf: revert "test_bpf: Flag tests that cannot be jited on s390" (Yauheni Kaliuta) [1857120]
  - [kernel] uprobes: ensure that uprobe->offset and ->ref_ctr_offset are properly aligned (Oleg Nesterov) [1848596]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-234.el8]
changelog:
  - [netdrv] vrf: Fix IPv6 with qdisc and xfrm (Sabrina Dubroca) [1868565]
  - [netdrv] vrf: make sure skb->data contains ip header to make routing (Sabrina Dubroca) [1868565]
  - [netdrv] vrf: Check skb for XFRM_TRANSFORMED flag (Sabrina Dubroca) [1868565]
  - [net] Do not clear the sock TX queue in sk_set_socket() (Andrea Claudi) [1850421]
  - [net] Use RCU_INIT_POINTER() to set sk_wq (Andrea Claudi) [1850421]
  - [net] netfilter: ip6tables: Add a .pre_exit hook in all ip6table_foo.c. (Florian Westphal) [1862384]
  - [net] netfilter: iptables: Add a .pre_exit hook in all iptable_foo.c. (Florian Westphal) [1862384]
  - [net] netfilter: ipset: Fix an error code in ip_set_sockfn_get() (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: Don't account for expired elements on insertion (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: Drop spurious condition for overlap detection on insertion (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: Detect partial overlaps on insertion (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: Introduce and use nft_rbtree_interval_start() (Florian Westphal) [1862384]
  - [net] netfilter: nf_tables: fix nat hook table deletion (Florian Westphal) [1862384]
  - [net] netfilter: ipset: call ip_set_free() instead of kfree() (Florian Westphal) [1862384]
  - [net] netfilter: ip6tables: Split ip6t_unregister_table() into pre_exit and exit helpers. (Florian Westphal) [1862384]
  - [net] netfilter: iptables: Split ipt_unregister_table() into pre_exit and exit helpers. (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_pipapo: Disable preemption before getting per-CPU pointer (Florian Westphal) [1862384]
  - [net] netfilter: nft_nat: return EOPNOTSUPP if type or flags are not supported (Florian Westphal) [1862384]
  - [net] netfilter: conntrack: comparison of unsigned in cthelper confirmation (Florian Westphal) [1862384]
  - [net] netfilter: conntrack: refetch conntrack after nf_conntrack_update() (Florian Westphal) [1862384]
  - [net] netfilter: conntrack: Pass value of ctinfo to __nf_conntrack_update (Florian Westphal) [1862384]
  - [net] netfilter: conntrack: make conntrack userspace helpers work again (Florian Westphal) [1862384]
  - [net] netfilter: nfnetlink_cthelper: unbreak userspace helper support (Florian Westphal) [1862384]
  - [net] netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build (Florian Westphal) [1862384]
  - [net] netfilter: nf_conntrack_pptp: prevent buffer overflows in debug code (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_bitmap: initialize set element extension in lookups (Florian Westphal) [1862384]
  - [net] netfilter: nft_fwd_netdev: validate family and chain type (Florian Westphal) [1862384]
  - [net] netfilter: nft_payload: add missing attribute validation for payload csum flags (Florian Westphal) [1862384]
  - [net] netfilter: cthelper: add missing attribute validation for cthelper (Florian Westphal) [1862384]
  - [net] netfilter: ipset: Fix forceadd evaluation path (Florian Westphal) [1862384]
  - [net] netfilter: bridge: make sure to pull arp header in br_nf_forward_arp() (Florian Westphal) [1862384]
  - [net] netfilter: nft_set_rbtree: bogus lookup/get on consecutive elements in named sets (Florian Westphal) [1862384]
  - [net] netfilter: ctnetlink: netns exit must wait for callbacks (Florian Westphal) [1862384]
  - [arm64] kvm: arm64: Don't inherit exec permission across page-table levels (Andrew Jones) [1869297]
  - [arm64] kvm: arm64: Flush the instruction cache if not unmapping the VM on reboot (Andrew Jones) [1869297]
  - [s390] s390, dcssblk: kaddr and pfn can be NULL to ->direct_access() (Claudio Imbrenda) [1868927]
  - [fs] chardev: Avoid potential use-after-free in 'chrdev_open()' (Vladis Dronov) [1866324] {CVE-2020-0305}
  - [net] net: accept an empty mask in /sys/class/net/*/queues/rx-*/rps_cpus (Nitesh Narayan Lal) [1868433]
  - [x86] Revert "x86/intel: Disable HPET on Intel Ice Lake platforms" (David Arcari) [1868405]
  - [kernel] sched: Fix race against ptrace_freeze_trace() (Oleg Nesterov) [1862560]
  - [kernel] sched: Fix loadavg accounting race (Oleg Nesterov) [1862560]
  - [kernel] kernel/sched/: remove caller signal_pending branch predictions (Oleg Nesterov) [1862560]
  - [kernel] locking/spinlock, sched/core: Clarify requirements for smp_mb__after_spinlock() (Oleg Nesterov) [1862560]
  - [nvme] nvme: multipath: round-robin: eliminate "fallback" variable (Gopal Tiwari) [1868443]
  - [nvme] nvme: multipath: round-robin: fix single non-optimized path case (Gopal Tiwari) [1868443]
  - [nvme] nvme-multipath: do not fall back to __nvme_find_path() for non-optimized paths (Gopal Tiwari) [1868443]
  - [nvme] nvme-multipath: fix logic for non-optimized paths (Gopal Tiwari) [1868443]
  - [tools] selftests/bpf: Fix segmentation fault in test_progs (Yauheni Kaliuta) [1868494]
  - [pci] hv: Fix a timing issue which causes kdump to fail occasionally (Mohammed Gamal) [1861960]
  - [hv] hv: vmbus: Only notify Hyper-V for die events that are oops (Vitaly Kuznetsov) [1868131]
  - [x86] kvm: nsvm: Correctly set the shadow NPT root level in its MMU role (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: x86: drop superfluous mmu_check_root() from fast_pgd_switch() (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: use nested_svm_load_cr3() on guest->host switch (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: implement nested_svm_load_cr3() and use it for host->guest switch (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: move kvm_set_cr3() after nested_svm_uninit_mmu_context() (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: introduce nested_svm_load_cr3()/nested_npt_enabled() (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: prepare to handle errors from enter_svm_guest_mode() (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: reset nested_run_pending upon nested_svm_vmrun_msrpm() failure (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: mmu: stop dereferencing vcpu->arch.mmu to get the context for MMU init (Vitaly Kuznetsov) [1845507]
  - [x86] kvm: nsvm: split kvm_init_shadow_npt_mmu() from kvm_init_shadow_mmu() (Vitaly Kuznetsov) [1845507]
  - [security] selinux: compute genfs symlink context in case of CephFS (Ondrej Mosnacek) [1865800]
  - [fs] ceph: set sec_context xattr on symlink creation (Ondrej Mosnacek) [1861509]
  - [tools] selftests: bpf: define SO_RCVTIMEO and SO_SNDTIMEO properly for ppc64le (Jiri Benc) [1860386]
  - [tools] bpf: Sync RHEL version of asm-generic/socket.h to tools/ (Jiri Benc) [1860386]
  - [tools] selftests: bpf: skip tests not working on RHEL (Jiri Benc) [1866908]
  - [tools] Revert "selftests: bpf: disable test_lwt_seg6local" (Jiri Benc) [1866908]
  - [tools] Revert "bpf: selftests: remove test_bpftool_build.sh from TEST_PROGS" (Jiri Benc) [1866908]
  - [tools] selftests: add option to skip specific tests in RHEL (Jiri Benc) [1866908]
  - [tools] selftests: bpf: switch off timeout (Jiri Benc) [1866908]
  - [tools] selftest/firmware: Add selftest timeout in settings (Jiri Benc) [1866908]
  - [tools] selftests/harness: Limit step counter reporting (Jiri Benc) [1866908]
  - [tools] selftests/harness: Clean up kern-doc for fixtures (Jiri Benc) [1866908]
  - [tools] selftests: fix condition in run_tests (Jiri Benc) [1866908]
  - [tools] selftests: do not use .ONESHELL (Jiri Benc) [1866908]
  - [tools] selftests/harness: Report skip reason (Jiri Benc) [1866908]
  - [tools] selftests/harness: Display signed values correctly (Jiri Benc) [1866908]
  - [tools] selftests/harness: Refactor XFAIL into SKIP (Jiri Benc) [1866908]
  - [tools] selftests/harness: Switch to TAP output (Jiri Benc) [1866908]
  - [tools] selftests: Add header documentation and helpers (Jiri Benc) [1866908]
  - [tools] kselftest: fix TAP output for skipped tests (Jiri Benc) [1866908]
  - [tools] kselftest: ksft_test_num return type should be unsigned (Jiri Benc) [1866908]
  - [tools] selftests: introduce gen_tar Makefile target (Jiri Benc) [1866908]
  - [tools] kselftest: add fixture variants (Jiri Benc) [1866908]
  - [tools] kselftest: run tests by fixture (Jiri Benc) [1866908]
  - [tools] kselftest: create fixture objects (Jiri Benc) [1866908]
  - [tools] kselftest: factor out list manipulation to a helper (Jiri Benc) [1866908]
  - [tools] selftests: add build/cross-build dependency check script (Jiri Benc) [1866908]
  - [tools] kselftest/runner: allow to properly deliver signals to tests (Jiri Benc) [1866908]
  - [tools] selftests/harness: fix spelling mistake "SIGARLM" -> "SIGALRM" (Jiri Benc) [1866908]
  - [tools] selftests: enforce local header dependency in lib.mk (Jiri Benc) [1866908]
  - [tools] selftests/harness: Handle timeouts cleanly (Jiri Benc) [1866908]
  - [tools] selftests/harness: Move test child waiting logic (Jiri Benc) [1866908]
  - [tools] selftests: Fix kselftest O=objdir build from cluttering top level objdir (Jiri Benc) [1866908]
  - [tools] selftests: allow detection of build failures (Jiri Benc) [1866908]
  - [tools] selftests: fix build behaviour on targets' failures (Jiri Benc) [1866908]
  - [tools] kselftest: Support old perl versions (Jiri Benc) [1866908]
  - [tools] kselftest/runner: Print new line in print of timeout log (Jiri Benc) [1866908]
  - [tools] selftests: Fix dangling documentation references to kselftest_module.sh (Jiri Benc) [1866908]
  - [tools] kselftest: Fix NULL INSTALL_PATH for TARGETS runlist (Jiri Benc) [1866908]
  - [tools] selftests: Move kselftest_module.sh into kselftest/ (Jiri Benc) [1866908]
  - [tools] selftests: gen_kselftest_tar.sh: Do not clobber kselftest/ (Jiri Benc) [1866908]
  - [tools] selftests/kselftest/runner.sh: Add 45 second timeout per test (Jiri Benc) [1866908]
  - [tools] kselftest: exclude failed TARGETS from runlist (Jiri Benc) [1866908]
  - [tools] kselftest: add capability to skip chosen TARGETS (Jiri Benc) [1866908]
  - [tools] selftests: Add kselftest-all and kselftest-install targets (Jiri Benc) [1866908]
  - [tools] selftests: use "$(MAKE)" instead of "make" (Jiri Benc) [1866908]
  - [tools] kselftest: save-and-restore errno to allow for m formatting (Jiri Benc) [1866908]
  - [tools] treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 481 (Jiri Benc) [1866908]
  - [tools] selftests/harness: Allow test to configure timeout (Jiri Benc) [1866908]
  - [tools] selftests: avoid KBUILD_OUTPUT dir cluttering with selftest objects (Jiri Benc) [1866908]
  - [tools] selftests: fix bpf build/test workflow regression when KBUILD_OUTPUT is set (Jiri Benc) [1866908]
  - [tools] selftests: fix install target to use default install path (Jiri Benc) [1866908]
  - [tools] selftests: build and run gpio when output directory is the src dir (Jiri Benc) [1866908]
  - [documentation] doc: kselftest: Fix KBUILD_OUTPUT usage instructions (Jiri Benc) [1866908]
  - [tools] selftests: fix headers_install circular dependency (Jiri Benc) [1866908]
  - [tools] selftests/harness: Add 30 second timeout per test (Jiri Benc) [1866908]
  - [tools] kselftest: Add test module framework header (Jiri Benc) [1866908]
  - [tools] kselftest: Add test runner creation script (Jiri Benc) [1866908]
  - [tools] selftests/harness: Update named initializer syntax (Jiri Benc) [1866908]
  - [tools] selftest: include stdio.h in kselftest.h (Jiri Benc) [1866908]
  - [tools] selftests: do not macro-expand failed assertion expressions (Jiri Benc) [1866908]
  - [documentation] Documentation/dev-tools: clean up kselftest.rst (Jiri Benc) [1866908]
  - [documentation] doc: dev-tools: kselftest.rst: update config file location (Jiri Benc) [1866908]
  - [documentation] doc: dev-tools: kselftest.rst: update contributing new tests (Jiri Benc) [1866908]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-235.el8]
changelog:
  - [s390] scsi: zfcp: Move allocation of the shost object to after xconf- and xport-data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Fence early sysfs interfaces for accesses of shost objects (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Fence adapter status propagation for common statuses (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Move p-t-p port allocation to after xport data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Fence fc_host updates during link-down handling (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Move fc_host updates during xport data handling into fenced function (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Move shost updates during xconfig data handling into fenced function (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Move shost modification after QDIO (re-)open into fenced function (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: fix fc_host attributes that should be unknown on local link down (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: wire previously driver-specific sysfs attributes also to fc_host (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: expose fabric name as common fc_host sysfs attribute (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: add diagnostics buffer for exchange config data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: diagnostics buffer caching and use for exchange port data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: signal incomplete or error for sync exchange config/port data (Claudio Imbrenda) [1872799]
  - [s390] scsi: zfcp: Fix use-after-free in request timeout handlers (Claudio Imbrenda) [1872796]
  - [tools] selftests/powerpc: Update the stack expansion test (Gustavo Duarte) [1869755]
  - [mm] powerpc: Allow 4224 bytes of stack expansion for the signal frame (Gustavo Duarte) [1869755]
  - [tools] selftests/powerpc: Add test of stack expansion logic (Gustavo Duarte) [1869755]
  - [mm] mm: check that mm is still valid in madvise() (Jeff Moyer) [1874560]
  - [block] block: virtio_blk: fix handling single range discard request (Ming Lei) [1842035]
  - [block] block: respect queue limit of max discard segment (Ming Lei) [1842035]
  - [fs] io_uring: Fix NULL pointer dereference in loop_rw_iter() (Jeff Moyer) [1854649]
  - [fs] io_uring: return locked and pinned page accounting (Jeff Moyer) [1854649]
  - [fs] io_uring: always allow drain/link/hardlink/async sqe flags (Jeff Moyer) [1854649]
  - [fs] io_uring: ensure double poll additions work with both request types (Jeff Moyer) [1854649]
  - [fs] io_uring: fix recvmsg memory leak with buffer selection (Jeff Moyer) [1854649]
  - [fs] io_uring: fix missing msg_name assignment (Jeff Moyer) [1854649]
  - [fs] io_uring: fix memleak in io_sqe_files_register() (Jeff Moyer) [1854649]
  - [fs] io_uring: account user memory freed when exit has been queued (Jeff Moyer) [1854649]
  - [fs] io_uring: fix memleak in __io_sqe_files_update() (Jeff Moyer) [1854649]
  - [fs] io_uring: fix regression with always ignoring signals in io_cqring_wait() (Jeff Moyer) [1854649]
  - [fs] io_uring: use signal based task_work running (Jeff Moyer) [1854649]
  - [kernel] task_work: teach task_work_add() to do signal_wake_up() (Jeff Moyer) [1854649]
  - [fs] io_uring: fix missing ->mm on exit (Jeff Moyer) [1854649]
  - [fs] io_uring: fix potential use after free on fallback request free (Jeff Moyer) [1854649]
  - [fs] io_uring: fix req->work corruption (Jeff Moyer) [1854649]
  - [fs] io_uring: fix NULL-mm for linked reqs (Jeff Moyer) [1854649]
  - [fs] io_uring: fix current->mm NULL dereference on exit (Jeff Moyer) [1854649]
  - [fs] io_uring: fix hanging iopoll in case of -EAGAIN (Jeff Moyer) [1854649]
  - [fs] io_uring: fix io_sq_thread no schedule when busy (Jeff Moyer) [1854649]
  - [fs] io_uring: fix possible race condition against REQ_F_NEED_CLEANUP (Jeff Moyer) [1854649]
  - [fs] io_uring: reap poll completions while waiting for refs to drop on exit (Jeff Moyer) [1854649]
  - [fs] io_uring: acquire 'mm' for task_work for SQPOLL (Jeff Moyer) [1854649]
  - [fs] io_uring: add memory barrier to synchronize io_kiocb's result and iopoll_completed (Jeff Moyer) [1854649]
  - [fs] io_uring: don't fail links for EAGAIN error in IOPOLL mode (Jeff Moyer) [1854649]
  - [fs] io_uring: fix io_kiocb.flags modification race in IOPOLL mode (Jeff Moyer) [1854649]
  - [fs] io_uring: allow O_NONBLOCK async retry (Jeff Moyer) [1854649]
  - [fs] io_uring: use kvfree() in io_sqe_buffer_register() (Jeff Moyer) [1854649]
  - [fs] io_uring: validate the full range of provided buffers for access (Jeff Moyer) [1854649]
  - [fs] io_uring: re-set iov base/len for buffer select retry (Jeff Moyer) [1854649]
  - [fs] io_uring: fix {SQ, IO}POLL with unsupported opcodes (Jeff Moyer) [1854649]
  - [fs] io_uring: disallow close of ring itself (Jeff Moyer) [1854649]
  - [fs] io_uring: fix overflowed reqs cancellation (Jeff Moyer) [1854649]
  - [fs] io_uring: fix flush req->refs underflow (Jeff Moyer) [1854649]
  - [fs] io_uring: async task poll trigger cleanup (Jeff Moyer) [1854649]
  - [fs] io_uring: allow POLL_ADD with double poll_wait() users (Jeff Moyer) [1854649]
  - [fs] io_uring: remove 'fd is io_uring' from close path (Jeff Moyer) [1854649]
  - [nvme] nvme: allow retry for requests with REQ_FAILFAST_TRANSPORT set (Mike Snitzer) [1843515]
  - [nvme] nvme: decouple basic ANA log page re-read support from native multipathing (Mike Snitzer) [1843515]
  - [nvme] nvme: update failover handling to work with REQ_FAILFAST_TRANSPORT (Mike Snitzer) [1843515]
  - [nvme] nvme: Return BLK_STS_TARGET if the DNR bit is set (Mike Snitzer) [1843515]
  - [nvme] nvme: redirect commands on dying queue (Mike Snitzer) [1843515]
  - [nvme] nvme: just check the status code type in nvme_is_path_error (Mike Snitzer) [1843515]
  - [nvme] nvme: refactor command completion (Mike Snitzer) [1843515]
  - [nvme] nvme-multipath: do not reset on unknown status (Mike Snitzer) [1843515]
  - [nvme] Revert "nvme: allow ANA support to be independent of native multipathing" (Mike Snitzer) [1843515]
  - [nvme] Revert "nvme-multipath: do not reset on unknown status" (Mike Snitzer) [1843515]
  - [mm] mm, THP, swap: fix allocating cluster for swapfile by mistake (Gao Xiang) [1855474]
  - [net] sched: act_ct: Fix skb double-free in tcf_ct_handle_fragments() error flow (Marcelo Leitner) [1866391]
  - [net] netfilter: conntrack: allow sctp hearbeat after connection re-use (Florian Westphal) [1865798]
  - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859472] {CVE-2020-14331}
  - [scsi] Revert "scsi: qla2xxx: Disable T10-DIF feature with FC-NVMe during probe" (Nilesh Javali) [1866744]
  - [scsi] Revert "scsi: qla2xxx: Fix crash on qla2x00_mailbox_command" (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Fix null pointer access during disconnect from subsystem (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Check if FW supports MQ before enabling (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Fix WARN_ON in qla_nvme_register_hba (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Allow ql2xextended_error_logging special value 1 to be set anytime (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Reduce noisy debug message (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Fix login timeout (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Flush I/O on zone disable (Nilesh Javali) [1866744]
  - [scsi] scsi: qla2xxx: Flush all sessions on zone disable (Nilesh Javali) [1866744]
  - [tools] bpf: selftests: global_funcs: Check err_str before strstr (Yauheni Kaliuta) [1873163]
  - [netdrv] net/mlx5e: E-Switch, Specify flow_source for rule with no in_port (Alaa Hleihel) [1869602]
  - [netdrv] net/mlx5e: E-Switch, Add misc bit when misc fields changed for mirroring (Alaa Hleihel) [1869602]
  - [tools] selftests/bpf: test for map update access from within EXT programs (=?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?=) [1871071]
  - [tools] selftests/bpf: test for checking return code for the extended prog (=?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?=) [1871071]
  - [tools] selftests/bpf: Add test for freplace program with write access (=?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?=) [1871071]
  - [net] bpf: verifier: use target program's type for access verifications (=?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?=) [1871071]
  - [scsi] scsi: lpfc: Fix NVMe rport deregister and registration during ADISC (Dick Kennedy) [1871223]
  - [scsi] scsi: lpfc: Fix LUN loss after cable pull (Dick Kennedy) [1871223]
  - [infiniband] RDMA/bnxt_re: Do not add user qps to flushlist (Selvin Xavier) [1858674]
  - [fs] NFSv4.0 allow nconnect for v4.0 (Benjamin Coddington) [1842746]
  - [mm] mm/vunmap: add cond_resched() in vunmap_pmd_range (Rafael Aquini) [1871710]
  - [s390] s390/bpf: Maintain 8-byte stack alignment (Jiri Olsa) [1871040]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-236.el8]
changelog:
  - [crypto] pefile: Support multiple signatures in verify_pefile_signature (Lenny Szubowicz) [1862072]
  - [security] integrity: Load certs from the EFI MOK config table (Lenny Szubowicz) [1868306]
  - [security] integrity: Move import of MokListRT certs to a separate routine (Lenny Szubowicz) [1868306]
  - [firmware] efi: Support for MOK variable config table (Lenny Szubowicz) [1868306]
  - [kernel] Move to dual-signing to split signing keys up better (Frantisek Hrbata) [1837434] {CVE-2020-10713}
  - [powerpc] pseries/hotplug-cpu: wait indefinitely for vCPU death (Michael Roth) [1856588]
  - [powerpc] kvm: ppc: book3s hv: Rework secure mem slot dropping (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Move kvmppc_svm_page_out up (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Migrate hot plugged memory (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: In H_SVM_INIT_DONE, migrate remaining normal-GFNs to secure-GFNs (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Track the state GFNs associated with secure VMs (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Disable page merging in H_SVM_INIT_START (Michael Roth) [1851259]
  - [powerpc] kvm: ppc: book3s hv: Fix function definition in book3s_hv_uvmem.c (Michael Roth) [1851259]
  - [kernel] mmap locking api: initial implementation as rwsem wrappers (Michael Roth) [1851259]
  - [mm] handle multiple owners of device private pages in migrate_vma (Michael Roth) [1851259]
  - [mm] migrate.c: clean up useless code in migrate_vma_collect_pmd() (Michael Roth) [1851259]
  - [mm] remove the unused MIGRATE_PFN_DEVICE flag (Michael Roth) [1851259]
  - [powerpc] rhel: powerpc: kvm: Increase HDEC threshold to enter guest (David Gibson) [1733467]
  - [netdrv] r8152: Add macpassthru support for ThinkPad Thunderbolt 3 Dock Gen 2 (Michal Schmidt) [1851966]
  - [fs] ceph: fix inode number handling on arches with 32-bit ino_t (Jeff Layton) [1869679]
  - [fs] ceph: don't allow setlease on cephfs (Jeff Layton) [1872382]
  - [block] blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART (Ming Lei) [1859628]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-237.el8]
changelog:
  - [fs] nfsd: avoid a NULL dereference in __cld_pipe_upcall() (Scott Mayhew) [1847225]
  - [net] packet: fix overflow in tpacket_rcv (Hangbin Liu) [1876224] {CVE-2020-14386}
  - [net] packet: make tp_drops atomic (Hangbin Liu) [1876224] {CVE-2020-14386}
  - [net] espintcp: restore IP CB before handing the packet to xfrm (Sabrina Dubroca) [1868201]
  - [fs] Revert "NFSv4: Handle NFS4ERR_OLD_STATEID in CLOSE/OPEN_DOWNGRADE" (Benjamin Coddington) [1865978]
  - [fs] Revert "NFSv4.x recover from pre-mature loss of openstateid" (Benjamin Coddington) [1865978]
  - [infiniband] RDMA/mlx4: Read pkey table length instead of hardcoded value (Alaa Hleihel) [1853564]
  - [net] net/smc: set rx_off for SMCR explicitly (Philipp Rudo) [1875833]
  - [drm] drm/i915: Auto detect DPCD backlight support by default (Lyude Paul) [1872381]
  - [drm] drm/i915: Fix DPCD register order in intel_dp_aux_enable_backlight() (Lyude Paul) [1872381]
  - [drm] drm/i915: Assume 100 brightness when not in DPCD control mode (Lyude Paul) [1872381]
  - [drm] drm/i915: Fix eDP DPCD aux max backlight calculations (Lyude Paul) [1872381]
  - [kernel] tracing: Define MCOUNT_INSN_SIZE when not defined without direct calls (Jiri Olsa) [1857599]
  - [kernel] ftrace: Fix function_graph tracer interaction with BPF trampoline (Jiri Olsa) [1857599]
  - [x86] x86/function_graph: Simplify with function_graph_enter() (Jiri Olsa) [1857599]
  - [kernel] function_graph: Create function_graph_enter() to consolidate architecture code (Jiri Olsa) [1857599]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-238.el8]
changelog:
  - [firmware] efi: don't reserve MOK config table memory region (Kairui Song) [1878584]
  - [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen) [1875316] {CVE-2020-14385}
  - [powerpc] powerpc/pseries: Do not initiate shutdown when system is running on UPS (Diego Domingos) [1870477]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-239.el8]
changelog:
  - [init] init/Kconfig: disable io_uring (Jeff Moyer) [1879754]
  - [block] blk-mq: always allow reserved allocation in hctx_may_queue (Ming Lei) [1740874]
  - [nvme] nvme-rdma: Avoid double freeing of async event data (Gopal Tiwari) [1878140]
  - [kernel] printk: queue wake_up_klogd irq_work only if per-CPU areas are ready (Igor Mammedov) [1867022]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.el8]
changelog:
  - [include] block: allow for_each_bvec to support zero len bvec (Ming Lei) [1872032]
  - [nvme] nvme-pci: disable the write zeros command for Intel 600P/P3100 (David Milburn) [1875391]


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-5
changelog:
  - Revert "genhomedircon: check usepasswd" (rhbz#1871786)
  - semanage.conf - improve usepasswd=False explanation (rhbz#1871786)
  - semanage.conf - expand list of ignoredirs (rhbz#1871786)


author: Artem Egorenkov <aegorenk@redhat.com> - 5.6-30
changelog:
  - brltty requires brlapi deleted (duplication of automatically determined dependency)
  - isa macro deleted for brlapi requires brltty
  - brlapi recommends brltty
    Resolves: rhbz#1765611


author: Petr Viktorin <pviktori@redhat.com> - 1.1-1
changelog:
  - Update to 1.1 to fix Python 3.8 compatibility in tests
    https://bugzilla.redhat.com/show_bug.cgi?id=1758446


author: Tomas Popela <tpopela@redhat.com> - 1.6.1-7
changelog:
  - Rebuild with newer annobin to fix rpmdiff problems
  - Fix the build with a newer opencv
  - Resolves: rhbz#1703994


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-39.el8
changelog:
  - kvm-ppc-spapr-Add-hotremovable-flag-on-DIMM-LMBs-on-drme.patch [bz#1901837]
  - kvm-ppc-spapr-re-assert-IRQs-during-event-scan-if-there-.patch [bz#1901837]
  - kvm-slirp-check-pkt_len-before-reading-protocol-header.patch [bz#1902237]
  - kvm-s390x-s390-virtio-ccw-Reset-PCI-devices-during-subsy.patch [bz#1905386]
  - kvm-qapi-enable-use-of-g_autoptr-with-QAPI-types.patch [bz#1859494]
  - kvm-error-Fix-examples-in-error.h-s-big-comment.patch [bz#1859494]
  - kvm-error-Improve-error.h-s-big-comment.patch [bz#1859494]
  - kvm-error-Document-Error-API-usage-rules.patch [bz#1859494]
  - kvm-error-New-macro-ERRP_GUARD.patch [bz#1859494]
  - kvm-qga-add-command-guest-get-disks.patch [bz#1859494]
  - kvm-qga-add-implementation-of-guest-get-disks-for-Linux.patch [bz#1859494]
  - kvm-qga-add-implementation-of-guest-get-disks-for-Window.patch [bz#1859494]
  - kvm-qga-fix-missing-closedir-in-qmp_guest_get_disks.patch [bz#1859494]
  - kvm-qga-update-schema-for-guest-get-disks-dependents-fie.patch [bz#1859494]
  - Resolves: bz#1859494
    (Report logical_name for disks without mounted file-system)
  - Resolves: bz#1901837
    (Failed to hotunplug pc-dimm device)
  - Resolves: bz#1902237
    (CVE-2020-29129 CVE-2020-29130 virt:rhel/qemu-kvm: QEMU: slirp: out-of-bounds access while processing ARP/NCSI packets [rhel-8])
  - Resolves: bz#1905386
    (RHEL8.3 - s390x/s390-virtio-ccw: Reset PCI devices during subsystem reset (qemu-kvm))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-40.el8
changelog:
  - kvm-redhat-link-etc-qemu-ga-fsfreeze-hook-to-etc-qemu-kv.patch [bz#1910267]
  - kvm-qga-rename-Error-parameter-to-more-common-errp.patch [bz#1910326]
  - kvm-util-Introduce-qemu_get_host_name.patch [bz#1910326]
  - kvm-qga-Use-qemu_get_host_name-instead-of-g_get_host_nam.patch [bz#1910326]
  - kvm-redhat-add-un-pre-install-systemd-hooks-for-qemu-ga.patch [bz#1910220]
  - Resolves: bz#1910267
    (There is no soft link '/etc/qemu-kvm/fsfreeze-hook')
  - Resolves: bz#1910326
    (Incorrect hostname returned by  qga command 'guest-get-host-name')
  - Resolves: bz#1910220
    (qemu-ga service still active and can work after qemu-guest-agent been removed)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-41.el8
changelog:
  - kvm-udev-kvm-check-remove-the-exceeded-subscription-limi.patch [bz#1909244]
  - kvm-hw-arm-smmu-common-Factorize-some-code-in-smmu_ptw_6.patch [bz#1843852]
  - kvm-hw-arm-smmu-common-Add-IOTLB-helpers.patch [bz#1843852]
  - kvm-hw-arm-smmu-Introduce-smmu_get_iotlb_key.patch [bz#1843852]
  - kvm-hw-arm-smmu-Introduce-SMMUTLBEntry-for-PTW-and-IOTLB.patch [bz#1843852]
  - kvm-hw-arm-smmu-common-Manage-IOTLB-block-entries.patch [bz#1843852]
  - kvm-hw-arm-smmuv3-Introduce-smmuv3_s1_range_inval-helper.patch [bz#1843852]
  - kvm-hw-arm-smmuv3-Get-prepared-for-range-invalidation.patch [bz#1843852]
  - kvm-hw-arm-smmuv3-Fix-potential-integer-overflow-CID-143.patch [bz#1843852]
  - kvm-memory-Rename-memory_region_notify_one-to-memory_reg.patch [bz#1843852]
  - kvm-memory-Add-IOMMUTLBEvent.patch [bz#1843852]
  - kvm-memory-Add-IOMMU_NOTIFIER_DEVIOTLB_UNMAP-IOMMUTLBNot.patch [bz#1843852]
  - kvm-intel_iommu-Skip-page-walking-on-device-iotlb-invali.patch [bz#1843852]
  - kvm-memory-Skip-bad-range-assertion-if-notifier-is-DEVIO.patch [bz#1843852]
  - kvm-memory-clamp-cached-translation-in-case-it-points-to.patch [bz#1904393]
  - kvm-hw-ehci-check-return-value-of-usb_packet_map.patch [bz#1898628]
  - kvm-hw-net-e1000e-advance-desc_offset-in-case-of-null-de.patch [bz#1903070]
  - Resolves: bz#1909244
    (Remove KVM guest count and limit info message)
  - Resolves: bz#1843852
    (qemu core dumped: qemu-kvm: /builddir/build/BUILD/qemu-4.2.0/memory.c:1928: memory_region_notify_one: Assertion `entry->iova >= notifier->start && entry_end <= notifier->end' failed.)
  - Resolves: bz#1904393
    (CVE-2020-27821 virt:rhel/qemu-kvm: QEMU: heap buffer overflow in msix_table_mmio_write() in hw/pci/msix.c [rhel-8])
  - Resolves: bz#1898628
    (CVE-2020-25723 virt:rhel/qemu-kvm: QEMU: assertion failure through usb_packet_unmap() in hw/usb/hcd-ehci.c [rhel-8])
  - Resolves: bz#1903070
    (CVE-2020-25707 CVE-2020-28916 virt:rhel/qemu-kvm: various flaws [rhel-8])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-42.el8
changelog:
  - kvm-linux-headers-add-vfio-DMA-available-capability.patch [bz#1905391]
  - kvm-s390x-pci-Move-header-files-to-include-hw-s390x.patch [bz#1905391]
  - kvm-vfio-Create-shared-routine-for-scanning-info-capabil.patch [bz#1905391]
  - kvm-vfio-Find-DMA-available-capability.patch [bz#1905391]
  - kvm-s390x-pci-Add-routine-to-get-the-vfio-dma-available-.patch [bz#1905391]
  - kvm-s390x-pci-Honor-DMA-limits-set-by-vfio.patch [bz#1905391]
  - kvm-s390x-fix-build-for-without-default-devices.patch [bz#1905391]
  - Resolves: bz#1905391
    (RHEL8.4 - s390x/pci: Honor vfio DMA limiting (qemu-kvm))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-43.el8
changelog:
  - kvm-Drop-bogus-IPv6-messages.patch [bz#1918054]
  - Resolves: bz#1918054
    (CVE-2020-10756 virt:rhel/qemu-kvm: QEMU: slirp: networking out-of-bounds read information disclosure vulnerability [rhel-8.4.0])


author: Jon Maloy <jmaloy@redhat.com> - 4.2.0-44.el8
changelog:
  - kvm-spapr-Improve-handling-of-fdt-buffer-size.patch [bz#1901837]
  - kvm-spapr-Fold-h_cas_compose_response-into-h_client_arch.patch [bz#1901837]
  - kvm-spapr-Don-t-use-spapr_drc_needed-in-CAS-code.patch [bz#1901837]
  - kvm-spapr-Fix-handling-of-unplugged-devices-during-CAS-a.patch [bz#1901837]
  - kvm-spapr-Allow-memory-unplug-to-always-succeed.patch [bz#1901837]
  - kvm-spapr-Improve-handling-of-memory-unplug-with-old-gue.patch [bz#1901837]
  - kvm-block-Require-aligned-image-size-to-avoid-assertion-.patch [bz#1834281]
  - kvm-file-posix-Allow-byte-aligned-O_DIRECT-with-NFS.patch [bz#1834281]
  - kvm-block-iscsi-fix-heap-buffer-overflow-in-iscsi_aio_io.patch [bz#1912974]
  - Resolves: bz#1834281
    (qemu-img convert abort when converting image with unaligned size)
  - Resolves: bz#1901837
    (Failed to hotunplug pc-dimm device)
  - Resolves: bz#1912974
    (CVE-2020-11947 virt:rhel/qemu-kvm: QEMU: heap buffer overflow in iscsi_aio_ioctl_cb() in block/iscsi.c may lead to information disclosure [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 4.2.0-45.el8
changelog:
  - kvm-virtiofsd-extract-lo_do_open-from-lo_open.patch [bz#1919111]
  - kvm-virtiofsd-optionally-return-inode-pointer-from-lo_do.patch [bz#1919111]
  - kvm-virtiofsd-prevent-opening-of-special-files-CVE-2020-.patch [bz#1919111]
  - Resolves: bz#1919111
    (CVE-2020-35517 virt:rhel/qemu-kvm: QEMU: virtiofsd: potential privileged host device access from guest [rhel-8.4.0])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-46.el8
changelog:
  - kvm-redhat-makes-qemu-respect-system-s-crypto-profile.patch [bz#1902960]
  - kvm-spapr-Adjust-firmware-path-of-PCI-devices.patch [bz#1912891]
  - Resolves: bz#1902960
    (QEMU doesn't honour system crypto policies)
  - Resolves: bz#1912891
    ([ppc64le] --disk cdimage.iso,bus=usb fails to boot)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-47.el8
changelog:
  - kvm-x86-cpu-Enable-AVX512_VP2INTERSECT-cpu-feature.patch [bz#1790620]
  - kvm-target-i386-add-fast-short-REP-MOV-support.patch [bz#1790620]
  - kvm-x86-cpu-Populate-SVM-CPUID-feature-bits.patch [bz#1790620]
  - kvm-i386-Add-the-support-for-AMD-EPYC-3rd-generation-pro.patch [bz#1790620]
  - Resolves: bz#1790620
    ([RFE] AMD Milan - Add KVM/support for EPYC-Milan CPU Model - Slow Train)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-48.el8
changelog:
  - kvm-ide-atapi-check-logical-block-address-and-read-size-.patch [bz#1917451]
  - Resolves: bz#1917451
    (CVE-2020-29443 virt:rhel/qemu-kvm: QEMU: ide: atapi: OOB access while processing read commands [rhel-8.4.0])


author: Wim Taymans <wtaymans@redhat.com> - 1.7.0-7
changelog:
  - Fix for CVE-2019-9232, CVE-2019-9433, CVE-2019-9371, CVE-2019-2126
  - Resolves: rhbz#1796086, rhbz#1796100, rhbz#1796448, rhbz#1796454
  - Remove php-cli BR


author: Steve Dickson <steved@redhat.com> 2.3.3-32
changelog:
  - junction: Fixed debug statement (bz 1831829)
  - Userspace support for the latest nfsdcld daemon (bz 1817756)


author: Steve Dickson <steved@redhat.com> 2.3.3-33
changelog:
  - manpage: Add a description of the 'nconnect' mount option (bz 1761352)
  - nfsdclddb: Redname clddb-tool to nfsdclddb (bz 1836924)


author: Steve Dickson <steved@redhat.com> 2.3.3-38
changelog:
  - exports man page: warn about subdirectory exports (bz 1652437)
  - Don't modify /etc/group on upgrades (bz 1856881)
  - nfs-iostat: divide by zero with fresh mount (bz 1861823)
  - nfsiostat: Drop autofs entries before calling compare_iostats() (bz 1859130)
  - nfsdclddb: clddb-tool was recently renamed to nfsdclddb (bz 1893599)


author: Steve Dickson <steved@redhat.com> 2.3.3-39
changelog:
  - systemd: Ingnore export failures in nfs-server.serivce unit (bz 1894873)
  - exports.man: Remove some outdated verbiage (bz 1769688)


author: Andreas Schneider <asn@redhat.com> - 4.13.2-1
changelog:
  - resolves: #1878109 - Rebase Samba to version 4.13.2
  - resolves: #1872833 - Add samba-winexe subpackage
  - resolves: #1891688 - Fix CVE-2020-14323
  - resolves: #1892633 - Fix CVE-2020-14318
  - resolves: #1892639 - Fix CVE-2020-14383
  - resolves: #1879835 - Fix CVE-2020-1472
  - resolves: #1888990 - Update smb.conf manpages to describe how to apply
                         config changes.
  - resolves: #1869702 - Fix %U substitution for 'valid users' option
  - resolves: #1818038 - Improve FIPS compliance


author: Andreas Schneider <asn@redhat.com> - 4.13.2-2
changelog:
  - related: #1869702 - Fix spoolss crash
  - resolves: #1896736 - Fix name lookups of FreeIPA users
  - resolves: #1899113 - Fix DFS links


author: Andreas Schneider <asn@redhat.com> - 4.13.3-3
changelog:
  - resolves: #1924615 - Fix a memcache bug when cache is full
  - resolves: #1924571 - Ensure that libwbclient has been updated before
                         restarting services


author: Jeff Moyer <jmoyer@redhat.com> - 1.0.7-2.el8
changelog:
  - Fix versioning.  The installed library is 1.0.7, make the rpm match.
  - bump release number for build, which includes -fPIC fix
  - Related: rhbz#1862551


author: Andrea Claudi <aclaudi@redhat.com> [5.9.0-2.el8]
changelog:
  - tc: flower: fix json output with mpls lse (Andrea Claudi) [1885770]
  - tc-mpls: fix manpage example and help message string (Andrea Claudi) [1885770]
  - tc-vlan: fix help and error message strings (Andrea Claudi) [1885770]
  - m_mpls: test the 'mac_push' action after 'modify' (Andrea Claudi) [1885770]
  - m_mpls: add mac_push action (Andrea Claudi) [1885770]
  - m_vlan: add pop_eth and push_eth actions (Andrea Claudi) [1885770]
  - Update kernel headers (Andrea Claudi) [1885770]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.19.1.el8_2]
changelog:
  - [net] tcp: add sanity tests in tcp_add_backlog() (Guillaume Nault) [1861378 1790843]
  - [net] tcp: implement coalescing on backlog queue (Guillaume Nault) [1861378 1790843]
  - [include] tcp: make tcp_space() aware of socket backlog (Guillaume Nault) [1861378 1790843]
  - [net] tcp: take care of compressed acks in tcp_add_reno_sack() (Guillaume Nault) [1861378 1790843]
  - [include] tcp: hint compiler about sack flows (Guillaume Nault) [1861378 1790843]
  - [net] tcp: drop dst in tcp_add_backlog() (Guillaume Nault) [1861378 1790843]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.20.1.el8_2]
changelog:
  - [infiniband] IB/rdmavt: Fix RQ counting issues causing use of an invalid RWQE (Kamal Heib) [1872771 1850314]
  - [block] blk-mq: Rerun dispatching in the case of budget contention (Ming Lei) [1869779 1824037]
  - [block] blk-mq: Add blk_mq_delay_run_hw_queues() API call (Ming Lei) [1869779 1824037]
  - [block] blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason to kick (Ming Lei) [1869779 1824037]
  - [block] blk-mq: Put driver tag in blk_mq_dispatch_rq_list() when no budget (Ming Lei) [1869779 1824037]
  - [md] dm mpath: use double checked locking in fast path (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: rename current_pgpath to pgpath in multipath_prepare_ioctl (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: rework __map_bio() (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: factor out multipath_queue_bio (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: push locking down to must_push_back_rq() (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: take m->lock spinlock when testing QUEUE_IF_NO_PATH (Mike Snitzer) [1869386 1848651]
  - [md] dm mpath: changes from initial m->flags locking audit (Mike Snitzer) [1869386 1848651]
  - [md] dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue() (Mike Snitzer) [1869386 1848651]
  - [md] dm: do not use waitqueue for request-based DM (Mike Snitzer) [1869386 1848651]
  - [block] blk-mq: consider non-idle request as "inflight" in blk_mq_rq_inflight() (Mike Snitzer) [1869386 1848651]
  - [kernel] sched/deadline: Initialize ->dl_boosted (Phil Auld) [1867612 1854179]
  - [kernel] sched/core: Fix PI boosting between RT and DEADLINE tasks (Phil Auld) [1867612 1854179]
  - [net] net/smc: tolerate future SMCD versions (Philipp Rudo) [1866390 1854992]
  - [net] openvswitch: fixes potential deadlock in dp cleanup code (Eelco Chaudron) [1859216 1845662]
  - [net] openvswitch: reorder masks array based on usage (Eelco Chaudron) [1859216 1845662]
  - [net] openvswitch: take into account de-fragmentation/gso_size in execute_check_pkt_len (Lorenzo Bianconi) [1860169 1851888]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.21.1.el8_2]
changelog:
  - [scsi] scsi: ibmvfc: Fix NULL return compiler warning (Steve Best) [1866371 1810653]
  - [scsi] scsi: ibmvfc: Avoid loss of all paths during SVC node reboot (Steve Best) [1866371 1810653]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.22.1.el8_2]
changelog:
  - [crypto] pefile: Support multiple signatures in verify_pefile_signature (Lenny Szubowicz) [1877530 1862072]
  - [crypto] Revert "pefile: Tolerate other pefile signatures after first" (Bruno Meneguele)
  - [infiniband] IB/hfi1: Fix another case where pq is left on waitlist (Kamal Heib) [1872766 1859209]
  - [infiniband] IB/hfi1: Ensure pq is not left on waitlist (Kamal Heib) [1872766 1859209]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.23.1.el8_2]
changelog:
  - [net] packet: fix overflow in tpacket_rcv (Hangbin Liu) [1876223 1876224] {CVE-2020-14386}
  - [net] packet: make tp_drops atomic (Hangbin Liu) [1876223 1876224] {CVE-2020-14386}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.24.1.el8_2]
changelog:
  - [kernel] timers: Remove must_forward_clk (Phil Auld) [1877417 1833096]
  - [kernel] timers: Spare timer softirq until next expiry (Phil Auld) [1877417 1833096]
  - [kernel] timers: Expand clk forward logic beyond nohz (Phil Auld) [1877417 1833096]
  - [kernel] timers: Reuse next expiry cache after nohz exit (Phil Auld) [1877417 1833096]
  - [kernel] timers: Always keep track of next expiry (Phil Auld) [1877417 1833096]
  - [kernel] timers: Optimize _next_timer_interrupt() level iteration (Phil Auld) [1877417 1833096]
  - [kernel] timers: Add comments about calc_index() ceiling work (Phil Auld) [1877417 1833096]
  - [kernel] timers: Move trigger_dyntick_cpu() to enqueue_timer() (Phil Auld) [1877417 1833096]
  - [kernel] timers: Use only bucket expiry for base->next_expiry value (Phil Auld) [1877417 1833096]
  - [kernel] timers: Preserve higher bits of expiration on index calculation (Phil Auld) [1877417 1833096]
  - [kernel] timer: Fix wheel index calculation on last level (Phil Auld) [1877417 1833096]
  - [kernel] timer: Prevent base->clk from moving backward (Phil Auld) [1877417 1833096]
  - [kernel] timer: Read jiffies once when forwarding base clk (Phil Auld) [1877417 1833096]
  - [infiniband] RDMA/umem: Fix ib_umem_find_best_pgsz() (Kamal Heib) [1872424 1856158]
  - [net] net: accept an empty mask in /sys/class/net/*/queues/rx-*/rps_cpus (Nitesh Narayan Lal) [1870181 1868433]
  - [net] net: Restrict receive packets queuing to housekeeping CPUs (Nitesh Narayan Lal) [1867174 1844520]
  - [pci] PCI: Restrict probe functions to housekeeping CPUs (Nitesh Narayan Lal) [1867174 1844520]
  - [lib] lib: Restrict cpumask_local_spread to houskeeping CPUs (Nitesh Narayan Lal) [1867174 1844520]
  - [s390] s390/pci: Fix unexpected write combine on resource (Philipp Rudo) [1869276 1827311]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.25.1.el8_2]
changelog:
  - [net] netfilter: conntrack: proc: rename stat column (Florian Westphal) [1882095 1875681]
  - [net] netfilter: conntrack: add clash resolution stat counter (Florian Westphal) [1882095 1875681]
  - [net] netfilter: conntrack: remove ignore stats (Florian Westphal) [1882095 1875681]
  - [net] netfilter: conntrack: do not increment two error counters at same time (Florian Westphal) [1882095 1875681]
  - [net] netfilter: conntrack: do not auto-delete clash entries on reply (Florian Westphal) [1882095 1875681]
  - [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric Sandeen) [1881085 1875316] {CVE-2020-14385}
  - [kernel] time/tick-broadcast: Fix tick_broadcast_offline() lockdep complaint (Alexey Klimov) [1880081 1877380]
  - [net] atomics/treewide: Rename __atomic_add_unless() => atomic_fetch_add_unless() (Yauheni Kaliuta) [1880081 1813370]
  - [kernel] timers: Lower base clock forwarding threshold (Phil Auld) [1877417 1833096]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.26.1.el8_2]
changelog:
  - [firmware] efi: don't reserve MOK config table memory region (Kairui Song) [1879988 1878584]
  - [security] integrity: Load certs from the EFI MOK config table (Lenny Szubowicz) [1877528 1868306]
  - [security] integrity: Move import of MokListRT certs to a separate routine (Lenny Szubowicz) [1877528 1868306]
  - [firmware] efi: Support for MOK variable config table (Lenny Szubowicz) [1877528 1868306]
  - [security] efi: Only print errors about failing to get certs if EFI vars are found (Lenny Szubowicz) [1877528 1804969]
  - [fs] ceph: fix inode number handling on arches with 32-bit ino_t (Jeff Layton) [1875787 1866018]
  - [fs] ceph: handle zero-length feature mask in session messages (Jeff Layton) [1875787 1866018]
  - [fs] ceph: fix endianness bug when handling MDS session feature bits (Jeff Layton) [1875787 1866018]
  - [netdrv] net/mlx5e: Fix missing cleanup of ethtool steering during rep rx cleanup (Alaa Hleihel) [1857777 1856660]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.27.1.el8_2]
changelog:
  - [powerpc] powerpc/pseries: Do not initiate shutdown when system is running on UPS (Diego Domingos) [1882243 1870477]
  - [video] vgacon: Fix for missing check in scrollback handling (Lyude Paul) [1859471 1859472] {CVE-2020-14331}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.28.1.el8_2]
changelog:
  - [net] Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888256 1888258] {CVE-2020-12351}
  - [net] Bluetooth: A2MP: Fix not initializing all members (Gopal Tiwari) [1888906 1888807] {CVE-2020-12352}


author: Karel Zak <kzak@redhat.com> 2.32.1-25
changelog:
  - fix #1884194 - RHEL-8: chrt command does not support the -R option
  - fix #1855759 - mount.8: clarify (no)suid behavior on file capabilities
  - fix #1861670 - lsblk can not show serial information for virtio disk
  - fix #1883783 - lscpu: avoid segfault on PowerPC systems with valid hardware configurations
  - fix #1900498 - libfdisk/libmount: backport two patches for upstream systemd
  - fix #1883056 - lscpu support for Fujitsu A64FX
  - fix #1882740 - lscpu: use SMBIOS Type 4 strings for CPU vendor and model on ARM


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.26.0-0.2
changelog:
  - update to 1.26-rc2 (1.25.91)
  - initrd: set ipv6.method=auto when using IPv4 static configuration (rh #1848943)
  - cloud-setup: add support for Google Cloud load-balancing routes (rh #1821787)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-299.el8]
changelog:
  - md: Set prev_flush_start and flush_bio in an atomic way (Xiao Ni) [1901598]
  - md: improve variable names in md_flush_request() (Xiao Ni) [1901598]
  - hpsa: fix regression issue for old controllers (Joseph Szczypek) [1925711]
  - scsi: hpsa: Correct dev cmds outstanding for retried cmds (Joseph Szczypek) [1925711]
  - vt: Disable KD_FONT_OP_COPY (Dave Airlie) [1903937] {CVE-2020-28974}
  - drm/i915/rkl: Remove require_force_probe protection (Lyude Paul) [1937558]
  - drm/i915/tgl/psr: Disable PSR on Tigerlake for now (Lyude Paul) [1924702]
  - dm raid: fix discard limits for raid0 and raid10 (Mike Snitzer) [1934274]
  - dm: fix __send_changing_extent_only to avoid duplicate dm_target_offset() (Mike Snitzer) [1934274]
  - mm/hugetlb.c: fix unnecessary address expansion of pmd sharing (Waiman Long) [1934212]
  - mm: memcontrol: fix slub memory accounting (Waiman Long) [1934212]
  - mm: memcontrol: fix swap undercounting in cgroup2 (Waiman Long) [1934212]
  - mm: memcontrol: fix NR_ANON_THPS accounting in charge moving (Waiman Long) [1934212]
  - mm, slub: better heuristic for number of cpus when calculating slab order (Waiman Long) [1934212]
  - Revert "mm: memcontrol: avoid workload stalls when lowering memory.high" (Waiman Long) [1934212]
  - selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed (Hangbin Liu) [1931732]
  - selftests/bpf: No need to drop the packet when there is no geneve opt (Hangbin Liu) [1931732]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-300.el8]
changelog:
  - [scsi] scsi: qedi: Correct max length of CHAP secret (Nilesh Javali) [1909180]
  - redhat: use tags from git notes for zstream to generate changelog (Frantisek Hrbata)
  - redhat: add CI file for kernel-private (Bruno Meneguele)
  - CI: Drop unused variable (Bruno Meneguele)
  - CI: Enable RT verification (Bruno Meneguele)
  - KVM: SVM: Clear the CR4 register on reset (Vitaly Kuznetsov) [1920788]
  - net: flow_offload: Add original direction flag to ct_metadata (Marcelo Ricardo Leitner) [1921946]
  - net/sched: cls_flower: Add match on the ct_state reply flag (Marcelo Ricardo Leitner) [1921946]
  - net/sched: cls_flower add CT_FLAGS_INVALID flag support (Marcelo Ricardo Leitner) [1921946]
  - net/sched: cls_flower: Reject invalid ct_state flags rules (Marcelo Ricardo Leitner) [1921946]
  - netlink: add mask validation (Marcelo Ricardo Leitner) [1921946]
  - netlink: create helpers for checking type is an int (Marcelo Ricardo Leitner) [1921946]
  - netlink: policy: correct validation type check (Marcelo Ricardo Leitner) [1921946]
  - netlink: make NLA_BINARY validation more flexible (Marcelo Ricardo Leitner) [1921946]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-301.el8]
changelog:
  - ibmvnic: fix a race between open and reset (Diego Domingos) [1940042]
  - ibmvnic: Set to CLOSED state even on error (Diego Domingos) [1940042]
  - ibmvnic: device remove has higher precedence over reset (Diego Domingos) [1940042]
  - ibmvnic: merge do_change_param_reset into do_reset (Diego Domingos) [1940042]
  - ibmvfc: disable MQ channelization by default (Gustavo Luiz Duarte) [1939359]
  - pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() (Steve Dickson) [1926945]
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930833] {CVE-2021-27365}
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930856] {CVE-2021-27363}
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1930809] {CVE-2021-27364}
  - futex: Handle faults correctly for PI futexes (Waiman Long) [1924635]
  - futex: Simplify fixup_pi_state_owner() (Waiman Long) [1924635]
  - futex: Use pi_state_update_owner() in put_pi_state() (Waiman Long) [1924635]
  - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Waiman Long) [1924635]
  - futex: Provide and use pi_state_update_owner() (Waiman Long) [1924635]
  - futex: Replace pointless printk in fixup_owner() (Waiman Long) [1924635]
  - futex: Ensure the correct return value from futex_lock_pi() (Waiman Long) [1924635]
  - futex: Don't enable IRQs unconditionally in put_pi_state() (Waiman Long) [1924635]
  - futex: Fix incorrect should_fail_futex() handling (Waiman Long) [1924635]
  - futex: Consistently use fshared as boolean (Waiman Long) [1924635]
  - futex: Remove needless goto's (Waiman Long) [1924635]
  - futex: Remove put_futex_key() (Waiman Long) [1924635]
  - NFS: Correct size calculation for create reply length (Benjamin Coddington) [1934903]
  - SUNRPC: Set memalloc_nofs_save() for sync tasks (Benjamin Coddington) [1934098]
  - net/mlx5: CT: Add support for matching on ct_state reply flag (Alaa Hleihel) [1919651]
  - net/mlx5e: CT: manage the lifetime of the ct entry object (Alaa Hleihel) [1919651]
  - net/mlx5e: CT: Use per flow counter when CT flow accounting is enabled (Alaa Hleihel) [1919651]
  - net/mlx5e: Fix a use after free on error in mlx5_tc_ct_shared_counter_get() (Alaa Hleihel) [1919651]
  - net/mlx5e: CT: Use the same counter for both directions (Alaa Hleihel) [1919651]
  - ethtool: fix the check logic of at least one channel for RX/TX (Ivan Vecera) [1907406]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-302.el8]
changelog:
  - PCI: rpadlpar: Fix potential drc_name corruption in store functions (Gustavo Luiz Duarte) [1938116]
  - selftests: kvm: Add basic Hyper-V clocksources tests (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Don't touch TSC page values when guest opted for re-enlightenment (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Track Hyper-V TSC page status (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Prevent using not-yet-updated TSC page by secondary CPUs (Vitaly Kuznetsov) [1931782]
  - KVM: x86: hyper-v: Limit guest to writing zero to HV_X64_MSR_TSC_EMULATION_STATUS (Vitaly Kuznetsov) [1931782]
  - drm/i915/guc: Update to use firmware v49.0.1 (Dave Airlie) [1935281] {CVE-2020-12362}
  - time: Enable __kernel_timespec for 32-bit vdso build (Waiman Long) [1936282]
  - lib/idr.c: document calling context for IDA APIs mustn't use locks (Chris von Recklinghausen) [1917764]
  - ida: Free allocated bitmap in error path (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Fix compilation (Chris von Recklinghausen) [1917764]
  - vmalloc: convert to XArray (Chris von Recklinghausen) [1917764]
  - mm: pass addr as unsigned long to vb_free (Chris von Recklinghausen) [1917764]
  - radix tree: Remove multiorder support (Chris von Recklinghausen) [1917764]
  - radix tree test: Convert multiorder tests to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Convert item_delete_rcu to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Convert item_kill_tree to XArray (Chris von Recklinghausen) [1917764]
  - radix tree tests: Move item_insert_order (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Remove multiorder benchmarking (Chris von Recklinghausen) [1917764]
  - radix tree test suite: Remove __item_insert (Chris von Recklinghausen) [1917764]
  - radix tree: Remove radix_tree_clear_tags (Chris von Recklinghausen) [1917764]
  - radix tree: Remove split/join code (Chris von Recklinghausen) [1917764]
  - radix tree: Remove radix_tree_update_node_t (Chris von Recklinghausen) [1917764]
  - mm: Convert truncate to XArray (Chris von Recklinghausen) [1917764]
  - copy rh_kabi.h to tools/testing/radix-tree/linux (Chris von Recklinghausen) [1917764]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-303.el8]
changelog:
  - redhat: switch secureboot kernel image signing to release keys (Jan Stancek)
  - Revert "[md] md/raid5: add a new member of offset into r5dev" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: make async_copy_data() to support different page offset" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid5: add new xor function to support different page offset" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: convert to new xor compution interface" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid6: let syndrome computor support different page offset" (Nigel Croxon) [1936903]
  - Revert "[crypto] md/raid6: let async recovery function support different page offset" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: let multiple devices of stripe_head share page" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: resize stripe_head when reshape array" (Nigel Croxon) [1936903]
  - Revert "[md] md/raid5: reallocate page array after setting new stripe_size" (Nigel Croxon) [1936903]
  - ACPI: PNP: compare the string length in the matching_id() (Mark Langsdorf) [1933702]
  - ceph: add missing break when parsing "nowsync" mount option (Jeff Layton) [1932753]
  - get_maintainer.conf: Update with new location of RHMAINTAINERS (Prarit Bhargava)
  - redhat: make pathspec exclusion compatible with old git versions (Herton R. Krzesinski)
  - redhat/scripts: Update merge-subtrees.sh with new subtree location (Prarit Bhargava)
  - tree: Add RHMAINTAINERS soft link in 8.4 (Prarit Bhargava)
  - tree: remove existing redhat/rhdocs subtree in 8.4 (Prarit Bhargava)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-304.el8]
changelog:
  - mm: Revert "remove the account_page_dirtied export" (Waiman Long) [1941257]
  - Revert "[netdrv] net/broadcom: Clean broadcom code from driver versions" (Jonathan Toppins) [1940842]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.1.1.el8_4]
changelog:
  - ALSA: usb-audio: fix NULL ptr dereference in usb_audio_probe (Jaroslav Kysela) [1954545 1870724]
  - ALSA: usb-audio: fix use after free in usb_audio_disconnect (Jaroslav Kysela) [1954545 1870724]
  - ALSA: usb-audio: Disable USB autosuspend properly in setup_disable_autosuspend() (Jaroslav Kysela) [1954545 1870724]
  - selinux: fix deadlock in security_set_bools() (Ondrej Mosnacek) [1945123 1924230]
  - geneve: do not modify the shared tunnel info when PMTU triggers an ICMP reply (Antoine Tenart) [1944667 1941753]
  - vxlan: do not modify the shared tunnel info when PMTU triggers an ICMP reply (Antoine Tenart) [1944667 1941753]
  - redhat: switch to zstream (Jan Stancek)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.2.1.el8_4]
changelog:
  - net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP (Alaa Hleihel) [1952061 1936742]
  - net/mlx5e: Reject tc rules which redirect from a VF to itself (Alaa Hleihel) [1952065 1932839]
  - net/mlx5: CT: Add support for matching on ct_state inv and rel flags (Alaa Hleihel) [1952062 1942681]
  - KVM: VMX: Don't use vcpu->run->internal.ndata as an array index (Jon Maloy) [1954221 1954219]
  - tools/power turbostat: Revert "[tools] tools/power turbostat: Enable accumulate RAPL display" (Prarit Bhargava) [1952987 1944699]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.3.1.el8_4]
changelog:
  - Revert "uio: use request_threaded_irq instead" (Vitaly Kuznetsov) [1952952 1946644]
  - drm/ast: Set format registers in primary plane's update (Lyude Paul) [1952900 1923857]
  - net/sched: act_ct: clear post_ct if doing ct_clear (Marcelo Ricardo Leitner) [1956458 1941889]
  - md/raid1: properly indicate failure when ending a failed write request (Nigel Croxon) [1955188 1954588]
  - nitro_enclaves: Fix stale file descriptors on failed usercopy (Vitaly Kuznetsov) [1956379 1953717]


author: Wim Taymans <wtaymans@redhat.com> - 0.3.13-12
changelog:
  - Add explicit Requires for the -libs package.
  - Do NVR bump to move twolame-devel from buildroot to CRB
  - Resolves: rhbz#1843275


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.1.1.el8_3]
changelog:
  - [net] Bluetooth: fix kernel oops in store_pending_adv_report (Gopal Tiwari) [1888454 1888455] {CVE-2020-24490}
  - [net] Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel (Gopal Tiwari) [1888257 1888258] {CVE-2020-12351}
  - [net] Bluetooth: A2MP: Fix not initializing all members (Gopal Tiwari) [1888806 1888807] {CVE-2020-12352}


author: Mike FABIAN <mfabian@redhat.com> - 1.9.16-1
changelog:
  - update to 1.9.16
  - Avoid running initialization code of ibus_table_location.py
    when using ibus-table-createdb.
  - Make it work on Python 3.6 (Unbreak sqlite on Python 3.6)
    (Resolves: rhbz#1413580).


author: Mike FABIAN <mfabian@redhat.com> - 1.9.17-1
changelog:
  - update to 1.9.17
  - Load .desktop file for ibus-setup-table correctly under Gnome Wayland
  - Set WM_CLASS of ibus-setup-table correctly


author: Mike FABIAN <mfabian@redhat.com> - 1.9.18-1
changelog:
  - update to 1.9.18
  - validate ibus-table.appdata.xml in %check
  - Update translations from zanata (pt_BR updated, es new)
  - Don't query user database if user define phrase and
    dynamic adjust are disabled (thanks to heiher)
  - Enable hash map based cache for user database enabled
    (thanks to heiher)
  - Import hash map based cache for table database (thanks to
    heiher)
  - Install appstream metadata to /usr/share/metainfo/ (thanks
    to jbicha)
  - Fix some appdata validation issues (thanks to jbicha)
  - Fix bug in Unihan_Variants.txt, 著 U+8457 is both
    simplified *and* traditional Chinese (thanks to heiher)


author: Ales Matej <amatej@redhat.com> - 1.10.6-1
changelog:
  - Update to 1.10.6
  - Imporove handling of xattr to re-download damadged files (RhBug:1690894)
  - Rephrase repository GPG check error message (RhBug:1741442)
  - Add sleep before next try when all mirrors were tried (RhBug:1741931)
  - Raise logging level of error messages (RhBug:1737709)
  - Handle webservers that don't support ranges when downloading zck
  - Define LRO_SUPPORTS_CACHEDIR only with zchunk (RhBug:1726141)
  - Allow to use mirrors multiple times for a target (RhBug:1678588)
  - Allow to try baseurl multiple times (RhBug:1678588)


author: Ales Matej <amatej@redhat.com> - 1.11.0-1
changelog:
  - Update to 1.11.0
   - Retry mirrorlist/metalink downloads several times (RhBug:1741931)
   - Improve variable substitutions in URLs and add ${variable} support


author: Ales Matej <amatej@redhat.com> - 1.11.3-1
changelog:
  - Update to 1.11.3
   - Prefer mirrorlist/metalink over baseurl (RhBug:1775184)
   - Fix calling Python API without holding GIL (RhBug:1788918) 
   - Do not unref LrErr_Exception on exit (RhBug:1778854)


author: Nicola Sella <nsella@redhat.com> - 1.12.0-1
changelog:
  - Update to 1.12.0
  - Decode package URL when using for local filename (RhBug:1817130)
  - Fix memory leak in lr_download_metadata() and lr_yum_download_remote()
  - Download sources work when at least one of specified is working (RhBug:1775184)
  - Enable building on OSX


author: Miro Hrončok <mhroncok@redhat.com> - 3.9.0~rc2-2
changelog:
  - Use upstream architecture names on Fedora 34+
  - https://fedoraproject.org/wiki/Changes/Python_Upstream_Architecture_Names


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.30.0-0.8
changelog:
  - Update to 1.29.10 (development)
  - bond: introduce new 'vlan+srcmac' xmit_hash_policy option (rh #1915457)
  - ovs: clean up interfaces from ovsdb at startup (rh #1861296)


author: Antonio Cardace <acardace@redhat.com> - 1:1.30.0-0.9
changelog:
  - Update to 1.29.11 (development)
  - bond: fix changing mode when the device is created externally (rh #1870691)
  - ovs: fix firewalld configuration for ovs-ports (rh #1921107)
  - ovs: avoid race condition when system interface is removed from ovsdb (rh #1923248)
  - doc: mention NETMASK as alternative to PREFIX for addresses in `man nm-settings-ifcfg-rh` (rh #1925123)


author: Thomas Haller <thaller@redhat.com> - 1:1.30.0-0.10
changelog:
  - Update to 1.30-rc1 (1.29.90-dev) (development)
  - cloud-setup: fix removing IPv4 address (rh #1920838)


author: Thomas Haller <thaller@redhat.com> - 1:1.30.0-3
changelog:
  - Increase LimitNOFILE to allow more than 1024 file descriptors (rh #1926599).
    This requires a suitable libndp version that can handle many file descriptors (rh #1933041).


author: Thomas Haller <thaller@redhat.com> - 1:1.30.0-6
changelog:
  - core: fix handling local routes generated by kernel (rh #1907661)
  - initrd: fix crash with rd.znet= argument (rh #1941106)
  - core: fix crash handling path match (rh #1942741)


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.10.1-3
changelog:
  - Replace arch-dependent /usr/include/urcu/config.h with arch-independent
    stub when needed. (bz #1853168)
  - Added CI gating tests (bz #1682555)
  - Resolves: bz #1682555, #1853168


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-1
changelog:
  - Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
  - Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
  - Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
  - Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
  - Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
  - Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
  - Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
  - Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
  - Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
  - Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
  - Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
  - Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
  - Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
  - Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
  - Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
  - Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
  - Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-3
changelog:
  - Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
  - Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-4
changelog:
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
  - Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-5
changelog:
  - Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-6
changelog:
  - Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
  - Resolves: rhbz#1915395 - Memory leak in the simple access provider
  - Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: Miro Hrončok <mhroncok@redhat.com> - 1.8.0-7
changelog:
  - Subpackage python2-py has been removed
    See https://fedoraproject.org/wiki/Changes/Mass_Python_2_Package_Removal


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.2.1.el8_3]
changelog:
  - [tools] selftests: rtnetlink: Test bridge enslavement with different parent IDs (Jonathan Toppins) [1886017 1860479]
  - [tools] selftests: rtnetlink: correct the final return value for the test (Jonathan Toppins) [1886017 1860479]
  - [net] Fix bridge enslavement failure (Jonathan Toppins) [1886017 1860479]
  - [net] netfilter: conntrack: proc: rename stat column (Florian Westphal) [1882094 1875681]
  - [net] netfilter: conntrack: add clash resolution stat counter (Florian Westphal) [1882094 1875681]
  - [net] netfilter: conntrack: remove ignore stats (Florian Westphal) [1882094 1875681]
  - [net] netfilter: conntrack: do not increment two error counters at same time (Florian Westphal) [1882094 1875681]
  - [net] netfilter: conntrack: do not auto-delete clash entries on reply (Florian Westphal) [1882094 1875681]
  - [kernel] time/tick-broadcast: Fix tick_broadcast_offline() lockdep complaint (Alexey Klimov) [1880080 1877380]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.3.1.el8_3]
changelog:
  - [iommu] iommu/amd: Fix the overwritten field in IVMD header (Baoquan He) [1888113 1869148]
  - [fs] xfs: trim IO to found COW extent limit (Eric Sandeen) [1886895 1882549]
  - [char] random32: update the net random state on interrupt and activity (Donghai Qiao) [1888233 1867569] {CVE-2020-16166}
  - [net] openvswitch: fixes crash if nf_conncount_init() fails (Eelco Chaudron) [1879935 1876445]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.4.1.el8_3]
changelog:
  - [kernel] sched/features: Fix !CONFIG_JUMP_LABEL case (Daniel Bristot de Oliveira) [1894073 1885850]


author: Jon Maloy <jmaloy@redhat.com> - 4.2.0-34.el8_3.4
changelog:
  - kvm-virtiofsd-extract-lo_do_open-from-lo_open.patch [bz#1919109]
  - kvm-virtiofsd-optionally-return-inode-pointer-from-lo_do.patch [bz#1919109]
  - kvm-virtiofsd-prevent-opening-of-special-files-CVE-2020-.patch [bz#1919109]
  - Resolves: bz#1919109
    (CVE-2020-35517 virt:rhel/qemu-kvm: QEMU: virtiofsd: potential privileged host device access from guest [rhel-8.3.0.z])


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-6
changelog:
  - Add 0039-libmultipath-factor-out-code-to-get-vpd-page-data.patch
  - Add 0040-libmultipath-limit-reading-0xc9-vpd-page.patch
    * Only check for rdac support on configured devices, or devices where
      vpd page 0x00 indicates support for vpd page 0xc9
    * Fixes bz #1877415
  - Add 0041-libmultipath-add-device-to-hwtable.c.patch
    * Add support for Fujitsu Eternus AB/HB
    * Fixes bz #1857429
  - Add 0042-libmultipath-move-fast_io_fail-defines-to-structs.h.patch
  - Add 0043-libmultipath-add-eh_deadline-multipath.conf-paramete.patch
    * Fixes bz #1819897
  - Add 0044-libmultipath-don-t-dlclose-tur-checker-DSO.patch
    * Fixes bz #1875384
  - Add 0045-libmultipath-warn-about-missing-braces-at-end-of-mul.patch
    * Fixes bz #1897530
  - Add 0046-libmultipath-ignore-multipaths-sections-without-wwid.patch
    * Fixes bz #1897815
  - Add 0047-tests-fix-missing-priority-blacklist-test.patch
  - Add 0048-mpathpersist-Fix-Register-and-Ignore-with-0x00-SARK.patch
    * Make mpathpersist Register and Ignore command clear the registration
      with a 0x0 SARK, like sg_persist does.
    * Fixes bz #1894103
  - Add 0049-mpathpersist-update-prkeys-file-on-changing-registra.patch
    * Fixes bz #1900522
    * The above 11 patches have all been submitted upstream
  - Resolves: bz #1819897, #1857429, #1875384, #1877415, #1894103, #1897530
  - Resolves: bz #1897815, #1900522


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-6
changelog:
  - Add 0050-multipathd-Fix-multipathd-stopping-on-shutdown.patch
    * Fixes bz #1892496
  - Add 0051-multipath.conf.5-Improve-checker_timeout-description.patch
    * Fixes bz #1906073
  - Resolves: bz #1892496, #1906073


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-7
changelog:
  - Add 0052-libmultipath-check-for-null-wwid-before-strcmp.patch
    * Missing part of fix for bz #1897815
  - Add 0053-libmultipath-make-find_err_path_by_dev-static.patch
  - Add 0054-multipathd-avoid-io_err_stat-crash-during-shutdown.patch
  - Add 0055-multipathd-avoid-io_err_stat-ABBA-deadlock.patch
  - Add 0056-multipathd-use-get_monotonic_time-in-io_err_stat-cod.patch
  - Add 0057-multipathd-combine-free_io_err_stat_path-and-destroy.patch
  - Add 0058-multipathd-cleanup-logging-for-marginal-paths.patch
    * The above 6 patches fix bz #1920795
  - Add 0059-libmpathpersist-fix-thread-safety-of-default-functio.patch
    * Fixes bz #1913549
  - Resolves: bz #1897815, #1913549, #1920795


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-9
changelog:
  - Add 0060-kpartx-free-loop-device-after-listing-partitions.patch
    * Fixes bz #1925490
  - Add 0061-RH-fix-find_multipaths-in-mpathconf.patch
    * Fixes bz #1921651
  - Resolves: bz #1921651, #1925490


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-10
changelog:
  - Add 0062-libmultipath-select_action-don-t-drop-map-if-alias-c.patch
    * Fall back to WWID names instead of removing existing device
  - Add 0063-libmultipath-check-if-user_friendly_name-is-in-use.patch
    * make sure to choose a user_friendly_name that isn't in use
    * Fixes bz #1923777
  - Add alias_clash CI test
  - Resolves: bz #1923777


author: Ondrej Dubaj <odubaj@redhat.com> - 1.2.11-17
changelog:
  - Fixed DFLTCC compression level switching issues (#1875492)
  - Enabled HW compression for compression levels 1 through 6 (#1847438)
  - Fixed inflateSyncPoint() bad return value on z15 (#1888930)


author: Marek Kasik <mkasik@redhat.com> - 3.28.4-3
changelog:
  - Add requirement on evince-libs for nautilus and browser-plugin
  - subpackages (RPMDiff)
  - Related: #1717353


author: Marek Kasik <mkasik@redhat.com> - 3.28.4-7
changelog:
  - Set "application-id" property for evince's GApplication
  - to "org.gnome.evince.Application" to avoid a critical warning.
  - Resolves: #1842017


author: Vratislav Podzimek <vpodzime@redhat.com> - 1.1-1
changelog:
  - Add NEWS.rst file (vtrefny)
  - Fix source and url in spec file (vtrefny)
  - Use only one git tag for new releases (vtrefny)
  - Actually translate the units when expected (vpodzime)
  - Add two temporary test files to .gitignore (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 1.2-1
changelog:
  - Use only version as a tag of the last release (vpodzime)
  - Do not require the glib-2.0 pkgconfig package (vpodzime)
  - Do not lie about tag creation (vpodzime)


author: Vojtech Trefny <vtrefny@redhat.com> - 1.3-1
changelog:
  - Allow building libbytesize without Python 2 support (vtrefny)
  - Sync spec with downstream (vtrefny)
  - Add gcc to BuildRequires (vtrefny)
  - Fix links for documentation and GH project (vtrefny)
  - Add a HACKING.rst file (vpodzime)
  - Do not segfault when trying to bs_size_free NULL (vtrefny)


author: Vojtech Trefny <vtrefny@redhat.com> - 1.4-1
changelog:
  - Squashed 'translation-canary/' changes from 840c2d6..fccbb1b (vtrefny)
  - Make sure the test script fails if one of the test runs fail (vtrefny)
  - Do not try to run python2 tests without python2 support (vtrefny)
  - Fix licence header for "gettext.h" (vtrefny)
  - Do not use rpm to check for Zanata client (vtrefny)
  - Use new ldconfig_scriptlets macro in spec (vtrefny)


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.16.1.el8_3]
changelog:
  - [netdrv] net/mlx5e: Fix using wrong stats_grps in mlx5e_update_ndo_stats() (Alaa Hleihel) [1921060 1870593]
  - [net] tcp: Fix potential use-after-free due to double kfree() (Florian Westphal) [1915529 1915164]
  - [net] tcp: fix race condition when creating child sockets from syncookies (Florian Westphal) [1915529 1915164]
  - [x86] kvm: ioapic: break infinite recursion on lazy EOI (Vitaly Kuznetsov) [1906438 1882793]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.17.1.el8_3]
changelog:
  - [mm] mm/slub: fix panic in slab_alloc_node() (Oleksandr Natalenko) [1925511 1921056]
  - [s390] s390/early: improve machine detection (Claudio Imbrenda) [1925508 1896307]
  - [infiniband] RDMA/umem: Prevent small pages from being returned by ib_umem_find_best_pgsz() (Kamal Heib) [1924691 1903992]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.18.1.el8_3]
changelog:
  - [scsi] scsi: fnic: Do not call 'scsi_done()' for unhandled commands (Govindarajulu Varadarajan) [1925186 1870397]
  - [target] scsi: target: iscsi: Fix cmd abort fabric stop race (Maurizio Lombardi) [1918354 1908215]
  - [target] scsi: target: Modify core_tmr_abort_task() (Maurizio Lombardi) [1918363 1880395]
  - [s390] s390/crypto: add arch_get_random_long() support (Vladis Dronov) [1915816 1904274]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.19.1.el8_3]
changelog:
  - audit: trigger accompanying records when no rules present (Richard Guy Briggs) [1907520 1896480]
  - revert: 1320a4052ea1 ("audit: trigger accompanying records when no rules present") (Richard Guy Briggs) [1907520 1896480]
  - audit: issue CWD record to accompany LSM_AUDIT_DATA_* records (Richard Guy Briggs) [1907520 1896480]
  - audit: remove unused !CONFIG_AUDITSYSCALL __audit_inode* stubs (Richard Guy Briggs) [1907520 1896480]
  - redhat: use tags from git notes for zstream to generate changelog (Frantisek Hrbata)


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.20.1.el8_3]
changelog:
  - fix regression in "epoll: Keep a reference on files added to the check list" (Carlos Maiolino) [1920775 1920776] {CVE-2020-0466}
  - do_epoll_ctl(): clean the failure exits up a bit (Carlos Maiolino) [1920775 1920776] {CVE-2020-0466}
  - epoll: Keep a reference on files added to the check list (Carlos Maiolino) [1920775 1920776] {CVE-2020-0466}
  - [kernel] sched/features: Distinguish between NORMAL and DEADLINE hrtick (Juri Lelli) [1930735 1912118]
  - [kernel] sched/features: Fix hrtick reprogramming (Juri Lelli) [1930735 1912118]
  - iommu/vt-d: Don't dereference iommu_device if IOMMU_API is not built (Vitaly Kuznetsov) [1932199 1887216]
  - iommu/vt-d: Gracefully handle DMAR units with no supported address widths (Vitaly Kuznetsov) [1932199 1887216]
  - iommu/vt-d: Skip TE disabling on quirky gfx dedicated iommu (Vitaly Kuznetsov) [1932199 1887216]
  - net/vmw_vsock: fix NULL pointer dereference (Jon Maloy) [1925599 1925600] {CVE-2021-26708}
  - net/vmw_vsock: improve locking in vsock_connect_timeout() (Jon Maloy) [1925599 1925600] {CVE-2021-26708}
  - vsock: fix locking in vsock_shutdown() (Jon Maloy) [1925599 1925600] {CVE-2021-26708}
  - vsock: fix the race conditions in multi-transport support (Jon Maloy) [1925599 1925600] {CVE-2021-26708}
  - [base] mm: don't panic when links can't be created in sysfs (Baoquan He) [1930168 1890171]
  - mm: don't rely on system state to detect hot-plug operations (Baoquan He) [1930168 1890171]
  - mm: replace memmap_context by meminit_context (Baoquan He) [1930168 1890171]
  - [tools] kvm: nvmx: check for invalid hdr.vmx.flags (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nvmx: check for required but missing VMCS12 in KVM_SET_NESTED_STATE (Paolo Bonzini) [1923281 1904128]
  - [tools] selftests: kvm: do not set guest mode flag (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: fix CPUID entries returned by KVM_GET_CPUID2 ioctl (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: svm: Fix offset computation bug in __sev_dbg_decrypt() (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nvmx: Sync unsync'd vmcs02 state to vmcs12 on migration (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: get smi pending status correctly (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86/pmu: Fix UBSAN shift-out-of-bounds warning in intel_pmu_refresh() (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: Add more protection against undefined behavior in rsvd_bits() (Paolo Bonzini) [1923281 1904128]
  - [documentation] kvm: Forbid the use of tagged userspace addresses for memslots (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: allow KVM_REQ_GET_NESTED_STATE_PAGES outside guest mode for VMX (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nsvm: cancel KVM_REQ_GET_NESTED_STATE_PAGES on nested vmexit (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nsvm: mark vmcb as dirty when forcingly leaving the guest mode (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: nsvm: correctly restore nested_run_pending on migration (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: fix shift out of bounds reported by UBSAN (Paolo Bonzini) [1923281 1904128]
  - [x86] kvm: x86: reinstate vendor-agnostic check on SPEC_CTRL cpuid bits (Paolo Bonzini) [1923281 1904128]
  - [target] scsi: target: Fix XCOPY NAA identifier lookup (Maurizio Lombardi) [1900462 1900463] {CVE-2020-28374}
  - scsi: qla2xxx: Fix mailbox Ch erroneous error (Nilesh Javali) [1924222 1894578]
  - [net] fix iteration for sctp transport seq_files (Xin Long) [1927521 1916824]
  - [scsi] scsi: lpfc: Fix initial FLOGI failure due to BBSCN not supported (Dick Kennedy) [1927921 1887549]
  - [mm] mm, oom: remove oom_lock from oom_reaper (Waiman Long) [1929738 1873759]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.21.1.el8_3]
changelog:
  - KVM: x86: Allow guests to see MSR_IA32_TSX_CTRL even if tsx=off (Paolo Bonzini) [1939013 1912448]
  - gfs2: Fix deadlock between gfs2_{create_inode, inode_lookup} and delete_work_func (Andreas Gruenbacher) [1937109 1903190]
  - gfs2: Don't call cancel_delayed_work_sync from within delete work function (Andreas Gruenbacher) [1937109 1903190]
  - gfs2: Only access gl_delete for iopen glocks (Andreas Gruenbacher) [1937109 1903190]
  - gfs2: Don't sleep during glock hash walk (Andreas Gruenbacher) [1937109 1903190]
  - [netdrv] net/mlx5e: Add missing set of destination vport flags in termtbl create (Alaa Hleihel) [1924689 1851700]
  - [tools] tools arch x86: Sync asm/cpufeatures.h with the kernel sources (David Arcari) [1929740 1916478]
  - [x86] x86/cpu/amd: Call init_amd_zn() om Family 19h processors too (David Arcari) [1929740 1916478]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-240.22.1.el8_3]
changelog:
  - futex: Handle faults correctly for PI futexes (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Simplify fixup_pi_state_owner() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Use pi_state_update_owner() in put_pi_state() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Provide and use pi_state_update_owner() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - rtmutex: Remove unused argument from rt_mutex_proxy_unlock() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Replace pointless printk in fixup_owner() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Ensure the correct return value from futex_lock_pi() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Don't enable IRQs unconditionally in put_pi_state() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Fix incorrect should_fail_futex() handling (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Consistently use fshared as boolean (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Remove needless goto's (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - futex: Remove put_futex_key() (Waiman Long) [1924633 1924635] {CVE-2021-3347}
  - scsi: iscsi: Verify lengths on passthrough PDUs (Chris Leech) [1930832 1930833] {CVE-2021-27364}
  - scsi: iscsi: Ensure sysfs attributes are limited to PAGE_SIZE (Chris Leech) [1930855 1930856] {CVE-2021-27365}
  - scsi: iscsi: Restrict sessions and handles to admin capabilities (Chris Leech) [1940423 1930809] {CVE-2021-27363}


author: Evgeny Kolesnikov <ekolesni@redhat.com> - 1.3.3-6
changelog:
  - Enable profile composition with a specific platform (RHBZ#1896676)
  - Enable YAML probe to work with sets of values (RHBZ#1895715)


author: Mike FABIAN <mfabian@redhat.com> - 1.5.36-1
changelog:
  - Update to 1.5.36
  - Make the default for self.show_status_info_in_auxiliary_text False
    (Resolves: rhbz#156435)
  - Adapt hunspell_suggest.py to work with pyhunspell 0.5.4


author: Mike FABIAN <mfabian@redhat.com> - 1.5.37-1
changelog:
  - Update to 1.5.37
  - Update translations from Zanata (pl and uk updated)
  - Make “Add direct input” option work correctly when
    “Remember last preedit input method” option is off
  - Fix test case for Korean
  - Rewrite setup UI completely in Python, without using Glade
  - Fix format string in debug message when a dictionary .aff file has no encoding
    (Resolves: rhbz#1575659)
  - Return False in read_training_data_from_file() if file cannot be opened


author: Mike FABIAN <mfabian@redhat.com> - 1.5.38-2
changelog:
  - Update to 1.5.38
  - Refresh french translation (thanks to Thierry Thomas)
  - Mark comments in the emoji-picker about dialog as translatable


author: Mike FABIAN <mfabian@redhat.com> - 2.0.0-1
changelog:
  - Update to 2.0.0
  - Update translations because of the merge of the engines (de, pl, uk updated)
  - Update emoji annotations from CLDR
  - Do not hardcode icon names in desktop files
    (Resolves: https://github.com/mike-fabian/ibus-typing-booster/issues/17)
  - Change the default for “Unicode symbols and emoji predictions” to “False”
  - Merge all typing-booster engines into one
  - Change the UI of the setup tool to make it possible to select
    multiple input methods and dictionaries
  - Move the buttons to learn from a file and to delete learned data to the options tab
  - Use the same “About” dialog in the setup tool as in emoji-picker


author: Mike FABIAN <mfabian@redhat.com> - 2.0.2-1
changelog:
  - Update to 2.0.2
  - Better Tab handling, use Tab to switch to the next candidate, not to commit
  - Update to 2.0.1
  - Update translations from zanata (ja updated)
  - Update emoji annotations from CLDR
  - Fix some bugs in the usage of “prefix” for prefixes other than “/usr” (For FreeBSD)
  - Make itb_util.get_ime_help() work on FreeBSD
  - Update UnicodeData.txt to Unicode 11.0.0
  - Remove useless 't-nil vi-base': 'vi-base.mim', from M17N_INPUT_METHODS
  - Remove extra space in entry for sa-IAST input method to make it work
  - Show in the setup tool in the input listbox whether minput_open_im() succeeded.
  - Use the rocket icon emoji_u1f680.svg from the “Noto Color Emoji” font


author: Mike FABIAN <mfabian@redhat.com> - 2.1.0-1
changelog:
  - Update to 2.1.0
  - emoji-picker: Show a concise description of a selected emoji in the header bar
  - Update the setup UI when settings are changed outside of the setup UI
  - Migrate IBusConfig to GSettings (The old settings are
    unfortunately lost, so one has to open the setup tool
    and recreate ones favourite settings).
  - Read emoji data files always in UTF-8


author: Mike FABIAN <mfabian@redhat.com> - 2.1.0-3
changelog:
  - Make “make check“ test cases work again when building the rpm
    (To avoid that rpmdiff in the errata tool reports a problem)
  - Related: rhbz#1619153


author: Mike FABIAN <mfabian@redhat.com> - 2.1.0-5
changelog:
  - Prevent also BackSpace from reopening a preedit when the
    option “Arrow keys can reopen a preedit” is off
  - Resolves: rhbz#1925030


author: Rafael Aquini <aquini@redhat.com> - 1.10.0-1
changelog:
  - Update to memkind source file to 1.10.0 upstream (1780394)
  - add Tier1 tests for CI gating (1688933)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-34.el8_3.5
changelog:
  - kvm-Drop-bogus-IPv6-messages.patch [bz#1939493]
  - Resolves: bz#1939493
    (CVE-2020-10756 virt:rhel/qemu-kvm: QEMU: slirp: networking out-of-bounds read information disclosure vulnerability [rhel-8.3.0.z] [rhel-8.3.0.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-99.el8_2.3
changelog:
  - kvm-Drop-bogus-IPv6-messages.patch [bz#1838092 bz#1867075 bz#1870421]
  - Resolves: bz#1838092
    (CVE-2020-10756 virt:8.2/qemu-kvm: QEMU: slirp: networking out-of-bounds read information disclosure vulnerability [rhel-av-8])
  - Resolves: bz#1867075
    (CVE-2020-10756 virt:8.3/qemu-kvm: QEMU: slirp: networking out-of-bounds read information disclosure vulnerability [rhel-av-8])
  - Resolves: bz#1870421
    (CVE-2020-10756 virt:rhel/qemu-kvm: QEMU: slirp: networking out-of-bounds read information disclosure vulnerability [rhel-8.2.0.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 2.12.0-99.el8_2.4
changelog:
  - kvm-usb-fix-setup_len-init-CVE-2020-14364.patch [bz#1869708]
  - Resolves: bz#1869708
    (CVE-2020-14364 qemu-kvm: QEMU: usb: out-of-bounds r/w access issue while processing usb packets [rhel-8.2.0.z])


author: Anna Khaitovich <akhaitov@redhat.com> - 0.13.1-0.3
changelog:
  - Don't package empty /usr/share/doc/json-c
  - Resolves: rhbz#1741076
  - Do not use --enable-rdrand
  - Resolves: rhbz#1806532


author: Peter Jones <pjones@redhat.com> - 15.3-0~1
changelog:
  - Update to shim 15.3
    - Support for revocations via the ".sbat" section and SBAT EFI variable
    - A new unit test framework and a bunch of unit tests
    - No external gnu-efi dependency
    - Better CI
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Peter Jones <pjones@redhat.com> - 15.4-1
changelog:
  - Update to shim 15.4
    - Support for revocations via the ".sbat" section and SBAT EFI variable
    - A new unit test framework and a bunch of unit tests
    - No external gnu-efi dependency
    - Better CI
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Peter Jones <pjones@redhat.com> - 15.4-2
changelog:
  - Fix the ia32 build.
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Peter Jones <pjones@redhat.com> - 15.4-3
changelog:
  - Build with the correct certificate trust list for this OS.
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Peter Jones <pjones@redhat.com> - 15.4-4
changelog:
  - Fix the sbat data to actually match /this/ product.
    Resolves: CVE-2020-14372
    Resolves: CVE-2020-25632
    Resolves: CVE-2020-25647
    Resolves: CVE-2020-27749
    Resolves: CVE-2020-27779
    Resolves: CVE-2021-20225
    Resolves: CVE-2021-20233


author: Bhupesh Sharma <bhsharma@redhat.com> - 1.1.8-1
changelog:
  - Rebase to latest github version Snappy-1.1.8
  - Also change the URL to reflect to the updated github location.


author: Petr Pisar <ppisar@redhat.com> - 10.31-6
changelog:
  - Fix global search/replace in pcre2test and pcre2_substitute() when the pattern
    matches an empty string, but never at the starting offset


author: Petr Pisar <ppisar@redhat.com> - 10.31-7
changelog:
  - Fix checking that a lookbehind assertion has a fixed length if the
    lookbehind assertion is used inside a lookahead assertion
  - Fix parsing VERSION conditions


author: Petr Pisar <ppisar@redhat.com> - 10.31-8
changelog:
  - Fix backtracking atomic groups when they are not separated by something with
    a backtracking point


author: Petr Pisar <ppisar@redhat.com> - 10.31-9
changelog:
  - Recognize all Unicode space characters with /x option in a pattern
    (bug #1617960)
  - Fix changing dynamic options (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 255,
    (bug #1617960)
  - Fix autopossessifying a repeated negative class with no characters less than
    256 that is followed by a positive class with only characters less than 256,
    (bug #1617960)


author: Petr Pisar <ppisar@redhat.com> - 10.32-1
changelog:
  - 10.32 bump (bug #1628200)
  - Fix a subject buffer overread in JIT when UTF is disabled and \X or \R has
    a greater than 1 fixed quantifier (bug #1628200)
  - Fix matching a zero-repeated subroutine call at a start of a pattern
    (bug #1628200)
  - Fix heap limit checking overflow in pcre2_dfa_match() (bug #1628200)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-296.el8]
changelog:
  - perf/x86/intel/uncore: With > 8 nodes, get pci bus die id from NUMA info (Prarit Bhargava) [1766743]
  - perf/x86/intel/uncore: Store the logical die id instead of the physical die id. (Prarit Bhargava) [1766743]
  - mm: fix page reference leak in soft_offline_page() (Aristeu Rozanski) [1768372]
  - mm,hwpoison: try to narrow window race for free pages (Aristeu Rozanski) [1768372]
  - mm,hwpoison: double-check page count in __get_any_page() (Aristeu Rozanski) [1768372]
  - mm,hwpoison: introduce MF_MSG_UNSPLIT_THP (Aristeu Rozanski) [1768372]
  - mm,hwpoison: return 0 if the page is already poisoned in soft-offline (Aristeu Rozanski) [1768372]
  - mm,hwpoison: refactor soft_offline_huge_page and __soft_offline_page (Aristeu Rozanski) [1768372]
  - mm,hwpoison: rework soft offline for in-use pages (Aristeu Rozanski) [1768372]
  - mm,hwpoison: rework soft offline for free pages (Aristeu Rozanski) [1768372]
  - mm,hwpoison: unify THP handling for hard and soft offline (Aristeu Rozanski) [1768372]
  - mm,hwpoison: kill put_hwpoison_page (Aristeu Rozanski) [1768372]
  - mm,hwpoison: refactor madvise_inject_error (Aristeu Rozanski) [1768372]
  - mm,hwpoison: unexport get_hwpoison_page and make it static (Aristeu Rozanski) [1768372]
  - mm,hwpoison-inject: don't pin for hwpoison_filter (Aristeu Rozanski) [1768372]
  - mm, hwpoison: remove recalculating hpage (Aristeu Rozanski) [1768372]
  - mm,hwpoison: cleanup unused PageHuge() check (Aristeu Rozanski) [1768372]
  - mm/madvise.c: replace with page_size() in madvise_inject_error() (Aristeu Rozanski) [1768372]
  - mm, soft-offline: convert parameter to pfn (Aristeu Rozanski) [1768372]
  - tick/nohz: Revert "Narrow down noise while setting current task's tick dependency" (Waiman Long) [1931004]
  - kvm: Add kvm_stat.service file and kvm_stat logrotate config to the tools (Thomas Huth) [1919930]
  - igc: fix link speed advertising (Corinna Vinschen) [1769701]
  - [crypto] crypto: qat - add capability detection logic in qat_4xxx (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add AES-XTS support for QAT GEN4 devices (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add AES-CTR support for QAT GEN4 devices (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - fix excluded_middle.cocci warnings (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add qat_4xxx driver (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add hook to initialize vector routing table (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - target fw images to specific AEs (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add gen4 firmware loader (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add support for broadcasting mode (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add support for shared ustore (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - allow to target specific AEs (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add FCU CSRs to chip info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add CSS3K support (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - use ae_mask (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add check for null pointer (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add misc control CSR to chip info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add wake up event to chip info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add clock enable CSR to chip info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add reset CSR and mask to chip info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add local memory size to chip info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add support for lm2 and lm3 (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add next neighbor to chip_info (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - replace check based on DID (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - introduce chip info structure (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - refactor long expressions (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - refactor qat_uclo_set_ae_mode() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - move defines to header files (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove global CSRs helpers (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - refactor AE start (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - change micro word data mask (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - change type for ctx_mask (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add support for relative FW ucode loading (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - rename qat_uclo_del_uof_obj() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - introduce additional parenthesis (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove unnecessary parenthesis (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - fix error message (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - fix CSR access (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - fix status check in qat_hal_put_rel_rd_xfer() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - support for mof format in fw loader (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - replace pci with PCI in comments (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove cast for mailbox CSR (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove unneeded semicolon (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - extend ae_mask (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - allow for instances in different banks (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - refactor qat_crypto_dev_config() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - refactor qat_crypto_create_instances() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - change return value in adf_cfg_key_val_get() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - change return value in adf_cfg_add_key_value_param() (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove unnecessary void* casts (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - call functions in adf_sriov if available (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove hardcoded bank irq clear flag mask (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - abstract writes to arbiter enable (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - use BIT_ULL() - 1 pattern for masks (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - replace constant masks with GENMASK (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - abstract build ring base (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - enable ring after pair is programmed (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - register crypto instances based on capability (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add support for capability detection (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - abstract arbiter access (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove unused macros in arbiter module (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove writes into WQCFG (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - update constants table (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - use admin mask to send fw constants (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - change admin sequence (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - rename ME in AE (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - add packed to init admin structures (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - abstract admin interface (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - relocate GEN2 CSR access code (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - split transport CSR access logic (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - fix configuration of iov threads (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - num_rings_per_bank is device dependent (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - mask device capabilities with soft straps (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - update IV in software (Vladis Dronov) [1833004]
  - [crypto] crypto: qat - remove unused function (Vladis Dronov) [1833004]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-297.el8]
changelog:
  - KVM: SVM: Make symbol 'svm_gp_erratum_intercept' static (Paolo Bonzini) [1769283]
  - KVM: SVM: Fix #GP handling for doubly-nested virtualization (Paolo Bonzini) [1769283]
  - KVM: SVM: Add support for SVM instruction address check change (Paolo Bonzini) [1769283]
  - KVM: SVM: Add emulation support for #GP triggered by SVM instructions (Paolo Bonzini) [1769283]
  - KVM: x86: Factor out x86 instruction emulation with decoding (Paolo Bonzini) [1769283]
  - gfs2: In gfs2_ail1_start_one unplug the IO when needed (Bob Peterson) [1648446]
  - gfs2: Free rd_bits later in gfs2_clear-rgrpd to fix use-after-free (Bob Peterson) [1648446]
  - gfs2: Only access gl_delete for iopen glocks (Bob Peterson) [1648446]
  - gfs2: Fix case in which ail writes are done to jdata holes (Bob Peterson) [1648446]
  - gfs2: simplify gfs2_block_map (Bob Peterson) [1648446]
  - gfs2: Only set PageChecked if we have a transaction (Bob Peterson) [1648446]
  - gfs2: don't lock sd_ail_lock in gfs2_releasepage (Bob Peterson) [1648446]
  - gfs2: make gfs2_ail1_empty_one return the count of active items (Bob Peterson) [1648446]
  - gfs2: Wipe jdata and ail1 in gfs2_journal_wipe, formerly gfs2_meta_wipe (Bob Peterson) [1648446]
  - gfs2: enhance log_blocks trace point to show log blocks free (Bob Peterson) [1648446]
  - gfs2: rename gfs2_write_full_page to gfs2_write_jdata_page, remove parm (Bob Peterson) [1648446]
  - PM: hibernate: flush swap writer after marking (Lenny Szubowicz) [1898677]
  - cpufreq: Avoid cpufreq_suspend() deadlock on system shutdown (Lenny Szubowicz) [1898677]
  - PM / hibernate: memory_bm_find_bit(): Tighten node optimisation (Lenny Szubowicz) [1898677]
  - bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation (Jiri Benc) [1882215]
  - ice, xsk: clear the status bits for the next_to_use descriptor (Jiri Benc) [1906820]
  - net/mlx4_en: Handle TX error CQE (Alaa Hleihel) [1925690]
  - net/mlx4_en: Avoid scheduling restart task if it is already running (Alaa Hleihel) [1925690]
  - blk-mq: test QUEUE_FLAG_HCTX_ACTIVE for sbitmap_shared in hctx_may_queue (Ming Lei) [1922013]
  - blk-mq: Improve performance of non-mq IO schedulers with multiple HW queues (Ming Lei) [1922013]
  - Revert "blk-mq, elevator: Count requests per hctx to improve performance" (Ming Lei) [1922013]
  - bpftool: Disable CAP_BPF check for feature command (Jiri Olsa) [1921542]
  - RDMA/siw: Fix calculation of tx_valid_cpus size (Kamal Heib) [1919502]
  - net/mlx5e: Disable performance optimization for IPv4/IPv6 ethertype (Alaa Hleihel) [1928671 1919807]
  - IB/mlx5: Return appropriate error code instead of ENOMEM (Alaa Hleihel) [1928671]
  - net/mlx5: Disable devlink reload for lag devices (Alaa Hleihel) [1928671 1929166]
  - net/mlx5: Disable devlink reload for multi port slave device (Alaa Hleihel) [1928671 1929166]
  - net/mlx5: Disallow RoCE on lag device (Alaa Hleihel) [1928671 1929166]
  - net/mlx5: Disallow RoCE on multi port slave device (Alaa Hleihel) [1928671 1929166]
  - net/mlx5: Fix health error state handling (Alaa Hleihel) [1928671]
  - net/mlx5e: Change interrupt moderation channel params also when channels are closed (Alaa Hleihel) [1928671]
  - net/mlx5e: Don't change interrupt moderation params when DIM is enabled (Alaa Hleihel) [1928671]
  - net/mlx5e: E-switch, Fix rate calculation for overflow (Alaa Hleihel) [1928671]
  - net/mlx5e: Release skb in case of failure in tc update skb (Alaa Hleihel) [1928671 1929119]
  - net/mlx5e: Check tunnel offload is required before setting SWP (Alaa Hleihel) [1928671 1925439]
  - net/mlx5e: kTLS, Use refcounts to free kTLS RX priv context (Alaa Hleihel) [1928671 1928706]
  - net/mlx5e: Fix CQ params of ICOSQ and async ICOSQ (Alaa Hleihel) [1928671 1928706]
  - net/mlx5e: Replace synchronize_rcu with synchronize_net (Alaa Hleihel) [1928671 1913616]
  - net/mlx5e: Enable XDP for Connect-X IPsec capable devices (Alaa Hleihel) [1928671 1856795]
  - net/mlx5e: Enable striding RQ for Connect-X IPsec capable devices (Alaa Hleihel) [1928671 1926120]
  - fix regression in "epoll: Keep a reference on files added to the check list" (Carlos Maiolino) [1920776] {CVE-2020-0466}
  - do_epoll_ctl(): clean the failure exits up a bit (Carlos Maiolino) [1920776] {CVE-2020-0466}
  - epoll: Keep a reference on files added to the check list (Carlos Maiolino) [1920776] {CVE-2020-0466}


author: Jan Stancek <jstancek@redhat.com> [4.18.0-298.el8]
changelog:
  - drm/i915/gen11+: Only load DRAM information from pcode (Lyude Paul) [1934537]
  - drm/i915/dg1: Wait for pcode/uncore handshake at startup (Lyude Paul) [1934537]
  - powercap/intel_rapl: add support for TigerLake Desktop (David Arcari) [1932457]
  - powerpc/perf: Fix handling of privilege level checks in perf interrupt context (Gustavo Luiz Duarte) [1918411]
  - NFSv4.2: fix error return on memory allocation failure (Scott Mayhew) [1917689]
  - NFSv4.2: improve page handling for GETXATTR (Scott Mayhew) [1917689]
  - NFSv4.2: Fix up the get/listxattr calls to rpc_prepare_reply_pages() (Scott Mayhew) [1917689]
  - NFS: Fix rpcrdma_inline_fixup() crash with new LISTXATTRS operation (Scott Mayhew) [1917689]
  - SUNRPC: Fix up xdr_set_page() (Benjamin Coddington) [1917689]
  - NFSv4: Fix open coded xdr_stream_remaining() (Benjamin Coddington) [1917689]
  - SUNRPC: Clean up the handling of page padding in rpc_prepare_reply_pages() (Benjamin Coddington) [1917689]
  - SUNRPC: Fix up xdr_read_pages() to take arbitrary object lengths (Benjamin Coddington) [1917689]
  - SUNRPC: Clean up helpers xdr_set_iov() and xdr_set_page_base() (Benjamin Coddington) [1917689]
  - SUNRPC: Split out a function for setting current page (Benjamin Coddington) [1917689]
  - SUNRPC: Fix up typo in xdr_init_decode() (Benjamin Coddington) [1917689]
  - NFSv4: Fix the alignment of page data in the getdeviceinfo reply (Benjamin Coddington) [1917689]
  - net: fix pos incrementment in ipv6_route_seq_next (Lorenzo Bianconi) [1926608]
  - ipv6_route_seq_next should increase position index (Lorenzo Bianconi) [1926608]
  - bpf: Clear subreg_def for global function return values (Yauheni Kaliuta) [1934062]
  - igc: Fix returning wrong statistics (Corinna Vinschen) [1910873]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.15.1.el8_2]
changelog:
  - [wireless] iwlwifi: pcie: handle QuZ configs with killer NICs as well (Jarod Wilson) [1857773 1844129]
  - [wireless] iwlwifi: pcie: move power gating workaround earlier in the flow (Jarod Wilson) [1857773 1844129]
  - [nvme] nvme: fix possible deadlock when nvme_update_formats fails (Gopal Tiwari) [1857115 1781927]
  - [iommu] iommu: move flags field before ids in iommu_fwspec (Jerry Snitselaar) [1856966 1833512]
  - [x86] kvm: x86: only do L1TF workaround on affected processors (Vitaly Kuznetsov) [1857796 1800673]
  - [x86] kvm: x86: create mmu/ subdirectory (Vitaly Kuznetsov) [1857796 1800673]
  - [kvm] KVM: SVM: Override default MMIO mask if memory encryption is enabled (Wei Huang) [1857796 1800673]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.16.1.el8_2]
changelog:
  - [infiniband] IB/rdmavt: Free kernel completion queue when done (Gopal Tiwari) [1857757 1805036]
  - [kernel] Move to dual-signing to split signing keys up better (pjones) [1837433 1837434] {CVE-2020-10713}
  - [crypto] pefile: Tolerate other pefile signatures after first (Lenny Szubowicz) [1837433 1837434] {CVE-2020-10713}
  - [acpi] ACPI: configfs: Disallow loading ACPI tables when locked down (Lenny Szubowicz) [1852968 1852969] {CVE-2020-15780}
  - [firmware] efi: Restrict efivar_ssdt_load when the kernel is locked down (Lenny Szubowicz) [1852948 1852949] {CVE-2019-20908}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.17.1.el8_2]
changelog:
  - [net] netfilter: nf_tables: reintroduce the NFT_SET_CONCAT flag (Phil Sutter) [1854531 1847553]
  - [net] netfilter: nf_tables: report EOPNOTSUPP on unsupported flags/object type (Phil Sutter) [1854531 1847553]
  - [s390] s390: prevent leaking kernel address in BEAR (Claudio Imbrenda) [1854986 1850907]
  - [s390] scsi: zfcp: Fix panic on ERP timeout for previously dismissed ERP action (Philipp Rudo) [1861355 1857312]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-193.18.1.el8_2]
changelog:
  - [security] selinux: allow reading labels before policy is loaded (Ondrej Mosnacek) [1861721 1839819]
  - [security] selinux: allow labeling before policy is loaded (Ondrej Mosnacek) [1861722 1777525]
  - [mm] mm/memory_hotplug.c: only respect mem= parameter during boot stage (Baoquan He) [1854207 1838809]


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-5
changelog:
  - Restructure the build so a minimal initial build is then used for the final build (with docs)
  - This reduces pressure on the system JDK and ensures the JDK being built can do a full build
  - Reduce disk footprint by removing build artifacts by default.
  - Related: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.7-0.1.ea
changelog:
  - Update to jdk-11.0.13.0+7
  - Update release notes to 11.0.13.0+7
  - Update tarball generation script to use git following OpenJDK 11u's move to github
  - Switch to EA mode for 11.0.13 pre-release builds.
  - Remove non-Free test from source tarball.
  - Drop JDK-8269668 patch which is now applied upstream.
  - Related: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.8-2
changelog:
  - Update to jdk-11.0.12.0+8
  - Update release notes to 11.0.12.0+8
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2012334


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.8-4
changelog:
  - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
  - Resolves: rhbz#2014212


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Replaced hardcoded 11 by featurever where appropriate
  - Fixed comment of `for slowdebug` to correct `any debug`
  - Related: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.8-0.1.ea
changelog:
  - Update to jdk-11.0.14.0+8
  - Update release notes to 11.0.14.0+8
  - Switch to EA mode for 11.0.14 pre-release builds.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Rename blacklisted.certs to blocked.certs following JDK-8253866
  - Rebase RH1996182 login patch and drop redundant security policy extension after JDK-8269034
  - Related: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-1
changelog:
  - Update to jdk-11.0.14.0+9
  - Update release notes to 11.0.14.0+9
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-01-18 @ 1pm PT.
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-2
changelog:
  - Fix FIPS issues in native code and with initialisation of java.security.Security
  - Related: rhbz#2039366


author: Josef Ridky <jridky@redhat.com> - 2.0.14-5
changelog:
  - Fix CVE-2021-26927 (#1933860)
  - Fix CVE-2021-26926 (#1922316)
  - Fix CVE-2021-3272 (#1922283)
  - Fix CVE-2020-27828 (#1905692)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b07 (EA)
  - Update release notes for 8u302-b07.
  - Switch to EA mode.
  - Cleanup architecture handling
  - Fixed not-including fastdebug build in case of --without fastdebug
  - Re-order source files to sync with Fedora.
  - Introduced nm based check to verify alt-java on x86_64 is patched, and no other alt-java or java is patched
  - Patch600, rh1750419-redhat_alt_java.patch, amended to die, if it is used wrongly
  - Introduced ssbd_arches with currently only valid arch of x86_64 to separate real alt-java architectures
  - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics.
  - Remove restriction on disabling product build, as debug packages no longer have javadoc packages.
  - Fix name of javadoc debug packages in Obsoletes declarations and add version where it was removed.
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b08 (EA)
  - Update release notes for 8u302-b08.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07
  - Update release notes for 8u312-b05-shenandoah-merge-2021-10-07.
  - Reduce disk footprint by removing build artifacts by default.
  - Switch to EA mode.
  - Remove non-Free test and demo files from source tarball.
  - Related: rhbz#2011826


author: Martin Balao <mbalao@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
  - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
  - Resolves: rhbz#2014201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
  - Port FIPS system detection support to OpenJDK 8u
  - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure.
  - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM.
  - Resolves: rhbz#2014201


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.4.ea
changelog:
  - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
  - Resolves: rhbz#2014193


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b07-1
changelog:
  - Update to aarch64-shenandoah-jdk8u312-b07 (EA)
  - Update release notes for 8u312-b07.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.6-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+6
  - Update release notes to 11.0.12.0+6
  - Switch to EA mode for 11.0.12 pre-release builds.
  - Update ECC patch following JDK-8226374 (bug ID yet to be confirmed)
  - Re-order source files to sync with Fedora.
  - Remove explicit compiler flags which should be handled by the upstream build
    (-std=gnu++98, -fno-delete-null-pointer-checks, -fno-lifetime-dse)
  - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics.
  - Remove restriction on disabling product build, as debug packages no longer have javadoc packages.
  - Correct bug ID JDK-8264846 to intended ID of JDK-8264848
  - Skip 11.0.12.0+5 as 11.0.12.0+6 only adds a test change
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-0
changelog:
  - Update to jdk-11.0.12.0+7
  - Update release notes to 11.0.12.0+7
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-07-20 @ 1pm PT.
  - Resolves: rhbz#1972395


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-2
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b06 (EA)
  - Update release notes for 8u322-b06.
  - Switch to GA mode for final release.
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-3
changelog:
  - Fix FIPS issues in native code and with initialisation of java.security.Security
  - Resolves: rhbz#2021263


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-4
changelog:
  - Refactor build functions so we can build just HotSpot without any attempt at installation.
  - Introduce architecture restriction logic for the gdb test. (RH2041970)
  - Pass compiler flags to the ADLC build (JDK-8281098)
  - Adjust JDK8199936/PR3533 -mstackrealign patch to instead pass -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4
  - Explicitly list JIT architectures rather than relying on those with slowdebug builds
  - Disable the serviceability agent on Zero architectures even when the architecture itself is supported
  - Add backport of JDK-8257794 to fix bogus assert on slowdebug x86-32 Zero builds
  - Sync minor placement differences with Fedora & RHEL 9
  - Resolves: rhbz#2022815


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-5
changelog:
  - Separate crypto policy initialisation from FIPS initialisation, now they are no longer interdependent
  - Resolves: rhbz#2052817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-6
changelog:
  - Detect NSS at runtime for FIPS detection
  - Turn off build-time NSS linking and go back to an explicit Requires on NSS
  - Resolves: rhbz#2052828


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.322.b06-8
changelog:
  - alternatives creation moved to posttrans
  - Thus fixing the old reisntall issue:
  - https://bugzilla.redhat.com/show_bug.cgi?id=1200302
  - https://bugzilla.redhat.com/show_bug.cgi?id=1976053
  - Resolves: rhbz#2008192


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.322.b06-11
changelog:
  - Storing and restoring alterntives during update manually
  - Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and select (as auto) system JDK/JRE
  -- The move of alternatives creation to posttrans to fix:
  -- Bug 1200302 - dnf reinstall breaks alternatives
  -- Had caused the alternatives to be removed, and then created again,
  -- instead of being added, and then removing the old, and thus persisting
  -- the selection in family
  -- Thus this fix, is storing the family of manually selected master, and if
  -- stored, then it is restoring the family of the master
  - Resolves: rhbz#2008192


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.7-0.1.ea
changelog:
  - Update to jdk-11.0.13.0+7
  - Update release notes to 11.0.13.0+7
  - Update tarball generation script to use git following OpenJDK 11u's move to github
  - Switch to EA mode for 11.0.13 pre-release builds.
  - Remove non-Free test from source tarball.
  - Related: rhbz#2011826


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.13.0.8-1
changelog:
  - Update to jdk-11.0.12.0+8
  - Update release notes to 11.0.12.0+8
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2021-10-19 @ 1pm PT.
  - Resolves: rhbz#2012333


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b05 (EA)
  - Update release notes for 8u302-b05.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.1.ea
changelog:
  - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics.
  - Resolves: rhbz#1966233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b05-0.2.ea
changelog:
  - Remove restriction on disabling product build, as debug packages no longer have javadoc packages.
  - Fix name of javadoc debug packages in Obsoletes declarations and add version where it was removed.
  - Resolves: rhbz#1966233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b06-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b06 (EA)
  - Update release notes for 8u302-b06.
  - Resolves: rhbz#1967812


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u302-b07 (EA)
  - Update release notes for 8u302-b07.
  - Resolves: rhbz#1967812


author: Martin Balao <mbalao@redhat.com> - 1:1.8.0.302.b08-2
changelog:
  - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
  - Resolves: rhbz#1971679


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.302.b08-2
changelog:
  - Port FIPS system detection support to OpenJDK 8u
  - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure.
  - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM.
  - Resolves: rhbz#1971679


author: Andreas Schneider <asn@redhat.com> - 4.14.4-2
changelog:
  - resolves: rhbz#1944657 - Update to version 4.14.4
  - resolves: rhbz#1949445 - Fix CVE-2021-20254
  - resolves: rhbz#1947945 - Fix libsmbldap.so.2 not being a symbolic link
  - resolves: rhbz#1908506 - Fix creating the gencache user directory
  - resolves: rhbz#1901029 - Build the vfs_io_uring module


author: Andreas Schneider <asn@redhat.com> - 4.14.4-0
changelog:
  - related: rhbz#1944657 - Update to version 4.14.5
  - resolves: rhbz#1969787 - Fix memory leak in RPC server
  - resolves: rhbz#1954974 - Validate smb.conf option for domain members with testparm
  - resolves: rhbz#1963298 - Fix smbd trying to delete files with wrong permissions
  - resolves: rhbz#1890008 - Update rpcclient manpage to list all available commands
  - resolves: rhbz#1857254 - Update smbcacls manpage to document inhertance flags


author: Andreas Schneider <asn@redhat.com> - 4.14.4-1
changelog:
  - resolves: rhbz#1974792 - Create a subpackage for vfs-io-uring
  - resolves: rhbz#1965397 - Raise log level for dfs ENOENT debug message


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.33-0.5.ea
changelog:
  - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.access.
  - Resolves: rhbz#1996182


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.35-3
changelog:
  - Update release notes to document the major changes between OpenJDK 11 & 17.
  - Resolves: rhbz#1994084


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-1
changelog:
  - January 2022 security update to jdk 17.0.2+8
  - Rebase RH1995150 & RH1996182 patches following JDK-8275863 addition to module-info.java
  - Rename libsvml.so to libjsvml.so following JDK-8276025
  - ** This tarball is embargoed until 2022-01-18 @ 1pm PT. **
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-3
changelog:
  - Update tapsets from IcedTea 6.x repository with fix for JDK-8015774 changes (_heap->_heaps) and @JAVA_SPEC_VER@
  - Update icedtea_sync.sh with a VCS mode that retrieves sources from a Mercurial repository
  - Related: rhbz#2039366


author: Jan Grulich <jgrulich@redhat.com> - 0.27.3-4
changelog:
  - CVE-2021-29458 exiv2: out-of-bounds read in Exiv2::Internal::CrwMap::encode
    Resolves: bz#1953758

  - CVE-2021-29457 exiv2: heap-based buffer overflow in Exiv2::Jp2Image::doWriteMetadata
    Resolves: bz#1953772


author: Jan Grulich <jgrulich@redhat.com> - 0.27.3-5
changelog:
  - CVE-2021-29473 exiv2: out-of-bounds read in Exiv2::Jp2Image::doWriteMetadata
    Resolves: bz#1954065

  - CVE-2021-29470 exiv2: out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header
    Resolves: bz#1955014


author: Jan Grulich <jgrulich@redhat.com> - 0.27.3-6
changelog:
  - CVE-2021-29623 exiv2: a read of uninitialized memory may lead to information leak
    Resolves: bz#1964182

  - CVE-2021-32617 exiv2: DoS due to quadratic complexity in ProcessUTF8Portion
    Resolves: bz#1964188


author: Jan Grulich <jgrulich@redhat.com> - 0.27.4-3
changelog:
  - Fix out-of-bounds read in Exiv2::Jp2Image::printStructure
    Resolves: bz#1993282

  - Fix out-of-bounds read in Exiv2::Jp2Image::encodeJp2Header
    Resolves: bz#1993245


author: Jiri Denemark <jdenemar@redhat.com> - 7.8.0-1
changelog:
  - Rebased to libvirt-7.8.0 (rhbz#2012802)
  - The rebase also fixes the following bugs:
      rhbz#1839070, rhbz#1942275, rhbz#1995865, rhbz#1806857, rhbz#1924616
      rhbz#1978574, rhbz#1989457, rhbz#1965589, rhbz#1677608, rhbz#1926508
      rhbz#1810863, rhbz#1845468, rhbz#1738392, rhbz#1965140


author: Jiri Denemark <jdenemar@redhat.com> - 7.9.0-1
changelog:
  - Rebased to libvirt-7.9.0 (rhbz#2012802)
  - The rebase also fixes the following bugs:
      rhbz#2011731, rhbz#2012385, rhbz#2013539


author: Jiri Denemark <jdenemar@redhat.com> - 7.10.0-1
changelog:
  - Rebased to libvirt-7.10.0 (rhbz#2012802)
  - The rebase also fixes the following bugs:
      rhbz#1845468, rhbz#2017928, rhbz#2024419, rhbz#1953389, rhbz#1510237


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-0rc1.1
changelog:
  - Rebased to libvirt-8.0.0-rc1 (rhbz#2012802)
  - The rebase also fixes the following bugs:
      rhbz#1689202, rhbz#2014369, rhbz#2030119, rhbz#2029380, rhbz#2035237
      rhbz#2035714, rhbz#2034180


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-2
changelog:
  - Revert "report error when virProcessGetStatInfo() is unable to parse data" (rhbz#2041610)
  - qemu: fix inactive snapshot revert (rhbz#2043584)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-3
changelog:
  - qemuDomainSetupDisk: Initialize 'targetPaths' (rhbz#2046172)
  - RHEL: Remove <glib-2.64.0 workaround for GSource race (rhbz#2045879)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-4
changelog:
  - qemu_command: Generate memory only after controllers (rhbz#2050697)
  - qemu: Validate domain definition even on migration (rhbz#2050702)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-5
changelog:
  - node_device: Rework udevKludgeStorageType() (rhbz#2056673)
  - node_device: Treat NVMe disks as regular disks (rhbz#2056673)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.1.16-1
changelog:
  - Update to 0.1.16
  - Make inline function __comps_objmrtree_all also static (RhBug:1793424)
  - Fix memory leaks and resource leaks
  - Fix: Check result "comps_parse_parsed_init()"


author: Andreas Schneider <asn@redhat.com> - 4.13.3-4
changelog:
  - resolves: #1964314 - Fix ldconfig warning about libsmbldap.so.2
  - resolves: #1964398 - Fix smbd trying to delete files with wrong permissions
  - resolves: #1969831 - Fix memory leak in RPC server


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.28-164.2
changelog:
  - CVE-2022-23218, CVE-2022-23219: Fix buffer overflows in sunrpc clnt_create
    for "unix" and svcunix_create (#2045062).


author: Gopal Tiwari <gtiwari@redhat.com> - 5.56-1
changelog:
  + bluez-5.56-1
  - Fixing (#1965057)
  - Removing bccmd, enabling hid2hci as upstream removed the support in bluez-5.56


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-11
changelog:
  - Add 0062-libmultipath-select_action-don-t-drop-map-if-alias-c.patch
    * Fall back to WWID names instead of removing existing device
  - Add 0063-libmultipath-check-if-user_friendly_name-is-in-use.patch
    * make sure to choose a user_friendly_name that isn't in use
    * Fixes bz #1937832
  - Add alias_clash CI test
  - Remove unused multipath.conf
  - Resolves: bz #1937832


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-12
changelog:
  - Add 0064-libmultipath-check-udev_device_get_-return-value-to-.patch
    * Fixes bz #1946940
  - Resolves: bz #1946940


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-13
changelog:
  - Add 0065-libmultipath-cleanup-code-to-strip-wwid-trailing-spa.patch
  - Add 0066-multipathd-add-recheck_wwid-option-to-verify-the-pat.patch
  - Add 0067-libmultipath-avoid-infinite-loop-with-bad-vpd-page-8.patch
  - Add 0068-libmultipath-fix-priorities-in-parse_vpd_pg83.patch
  - Add 0069-RH-make-parse_vpd_pg83-match-scsi_id-output.patch
  - Add 0070-multipathd-improve-getting-parent-udevice-in-rescan_.patch
  - Add 0071-multipathd-don-t-trigger-uevent-for-partitions-on-ww.patch
    * add recheck_wwid option
    * Fixes bz #1907904
  - Resolves: bz #1907904


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-17
changelog:
  - Add 0074-mpathpersist-fail-commands-when-no-usable-paths-exis.patch
    * Fixes bz #1984723
  - Add 0075-multipath-print-warning-if-multipathd-is-not-running.patch
    * Fixes bz #1973592
  - Add 0076-multipathd-don-t-access-path-if-it-was-deleted.patch
    * Found by coverity
  - Resolves: bz #1973592, #1984723


author: Milan Crha <mcrha@redhat.com> - 3.28.5-17
changelog:
  - Resolves: #1972749 (PrintableOptions.cmake: Correct variable name comparison)
  - Resolves: #1971676 (ECalBackendFile: Free interval tree only when being allocated)


author: Takao Fujiwara <tfujiwar@redhat.com> - 1.5.19-13
changelog:
  - Resolves: #1897548 - Rebuild IBus emoji with unicode-emoji-13.0-4 and cldr-emoji-annotation-39-2
  - Rebuild ibusemojigen.h and ibusunicodegen.h
  - Add ibus-1897548-emoji-unicode.patch to lookup Unicode names
  - Add U+32FF to IBusUnicodeData
  - Add ibus-po-1.5.19-20210706.tar.gz


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.312.b05-0.2.ea
changelog:
  - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
  - Resolves: rhbz#2014194


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b04-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b04 (EA)
  - Update release notes for 8u322-b04.
  - Require tzdata 2021c as of JDK-8274407.
  - Switch to EA mode.
  - Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
  - Related: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.322.b06-1
changelog:
  - Update to aarch64-shenandoah-jdk8u322-b06 (EA)
  - Update release notes for 8u322-b06.
  - Switch to GA mode for final release.
  - Require tzdata 2021e as of JDK-8275766.
  - Update tarball generation script to use git following shenandoah-jdk8u's move to github
  - Resolves: rhbz#2039366


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b06-0.1.ea
changelog:
  - Update to shenandoah-jdk8u332-b06 (EA)
  - Update release notes for shenandoah-8u332-b06.
  - Switch to EA mode.
  - Remove JDK-8279077 patch now upstream.
  - Related: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-1
changelog:
  - Update to shenandoah-jdk8u332-b09 (GA)
  - Update release notes for 8u332-b09.
  - Switch to GA mode for final release.
  - This tarball is embargoed until 2022-04-19 @ 1pm PT.
  - Resolves: rhbz#2073422


author: Jan Friesse <jfriesse@redhat.com> 3.1.4-1
changelog:
  - Related: rhbz#1948973
  - Resolves: rhbz#1962139

  - New upstream release (rhbz#1948973)
  - stats: fix crash when iterating over deleted keys (rhbz#1962139)


author: Wen Liang <wenliang@redhat.com> - 1:1.30.0-8
changelog:
  - core: fix finding active connection for controller (rh #1965337)
  - bond: support 'tlb_dynamic_lb' in 'balance-alb' mode (rh #1965948)
  - manager: delete default connection when veth removed (rh #1965336)


author: Than Ngo <than@redhat.com> - 3.15.1-7
changelog:
  - Resolves: #1995919, pkcstok_migrate leaves options with multiple strings in opencryptoki.conf options without double-quotes


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.10.1.el8_4]
changelog:
  - igbvf: amend removal of MODULE_VERSION (Corinna Vinschen) [1969920 1955752]
  - bluetooth: eliminate the potential race condition when removing the HCI controller (Gopal Tiwari) [1971464 1971488] {CVE-2021-32399}
  - scsi: ibmvfc: Free channel_setup_buf during device tear down (Steve Best) [1964697 1938102]
  - i40e: Fix parameters in aq_get_phy_register() (Stefan Assmann) [1967099 1907852]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.11.1.el8_4]
changelog:
  - SUNRPC: Handle major timeout in xprt_adjust_timeout() (Scott Mayhew) [1980613 1979070]
  - net/mlx5e: Disable TLS device offload in kdump mode (Alaa Hleihel) [1969909 1946647]
  - net/mlx5e: Disable TX MPWQE in kdump mode (Alaa Hleihel) [1969909 1946647]
  - drm/i915: Add an encoder hook to sanitize its state during init/resume (Imre Deak) [1981250 1961122]
  - netfilter: x_tables: fix compat match/target pad out-of-bound write (Florian Westphal) [1980500 1980501] {CVE-2021-22555}
  - Bluetooth: btusb: Fix the autosuspend enable and disable (Gopal Tiwari) [1972564 1927375]
  - cifs: handle empty list of targets in cifs_reconnect() (Ronnie Sahlberg) [1973637 1952263]
  - tick/nohz: Update idle_exittime on actual idle exit (Phil Auld) [1978710 1962632]
  - tick/nohz: Remove superflous check for CONFIG_VIRT_CPU_ACCOUNTING_NATIVE (Phil Auld) [1978710 1962632]
  - tick/nohz: Conditionally restart tick on idle exit (Phil Auld) [1978710 1962632]
  - can: bcm: delay release of struct bcm_op after synchronize_rcu() (Hangbin Liu) [1975058 1975059]
  - redhat/configs: Re-enable dptf_power module (Prarit Bhargava) [1968381 1962349]
  - KVM: do not allow mapping valid but non-reference-counted pages (Jon Maloy) [1975514 1975515] {CVE-2021-22543}
  - seq_file: Disallow extremely large seq buffer allocations (Ian Kent) [1975181 1975182] {CVE-2021-33909}


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.12.1.el8_4]
changelog:
  - Revert "nvme-pci: remove last_sq_tail" (Gopal Tiwari) [1965415 1921591]
  - tc-testing: add test for ct DNAT tuple collision (Marcelo Ricardo Leitner) [1982494 1964578]
  - tc-testing: add support for sending various scapy packets (Marcelo Ricardo Leitner) [1982494 1964578]
  - tc-testing: fix list handling (Marcelo Ricardo Leitner) [1982494 1964578]
  - net/sched: act_ct: handle DNAT tuple collision (Marcelo Ricardo Leitner) [1982494 1964578]
  - mm/memcg: Relocate tcpmem to below memory in struct mem_cgroup (Waiman Long) [1980314 1959772]
  - mm/memcg: optimize user context object stock access (Waiman Long) [1980314 1959772]
  - mm/memcg: improve refill_obj_stock() performance (Waiman Long) [1980314 1959772]
  - mm/memcg: cache vmstat data in percpu memcg_stock_pcp (Waiman Long) [1980314 1959772]
  - mm/memcg: move mod_objcg_state() to memcontrol.c (Waiman Long) [1980314 1959772]
  - mm: memcontrol: use obj_cgroup APIs to charge kmem pages (Waiman Long) [1980314 1959772]
  - mm: memcontrol: change ug->dummy_page only if memcg changed (Waiman Long) [1980314 1959772]
  - mm: memcontrol: directly access page->memcg_data in mm/page_alloc.c (Waiman Long) [1980314 1959772]
  - mm: memcontrol: introduce obj_cgroup_{un}charge_pages (Waiman Long) [1980314 1959772]
  - mm: memcontrol: slab: fix obtain a reference to a freeing memcg (Waiman Long) [1980314 1959772]
  - mm: move lruvec stats update functions to vmstat.h (Waiman Long) [1980314 1959772]
  - mm: memcg/slab: rename *_lruvec_slab_state to *_lruvec_kmem_state (Waiman Long) [1980314 1959772]
  - mm: Convert page kmemcg type to a page memcg flag (Waiman Long) [1980314 1959772]
  - mm: Introduce page memcg flags (Waiman Long) [1980314 1959772]
  - mm: memcontrol/slab: Use helpers to access slab page's memcg_data (Waiman Long) [1980314 1959772]
  - mm: memcontrol: Use helpers to read page's memcg data (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: extract check_[new|free]_page_bad() common part to page_bad_reason() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: rename free_pages_check() to check_free_page() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: rename free_pages_check_bad() to check_free_page_bad() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: bad_flags is not necessary for bad_page() (Waiman Long) [1980314 1959772]
  - mm/page_alloc.c: bad_[reason|flags] is not necessary when PageHWPoison (Waiman Long) [1980314 1959772]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.13.1.el8_4]
changelog:
  - xfrm: Fix wraparound in xfrm_policy_addr_delta() (Sabrina Dubroca) [1981840 1951965]
  - VMCI: Release resource if the work is already queued (Cathy Avery) [1982042 1978518]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.14.1.el8_4]
changelog:
  - tick/nohz: Kick only _queued_ task whose tick dependency is updated (Waiman Long) [1981336 1922901]
  - tick/nohz: Change signal tick dependency to wake up CPUs of member tasks (Waiman Long) [1981336 1922901]
  - tick/nohz: Only wake up a single target cpu when kicking a task (Waiman Long) [1981336 1922901]
  - tick/nohz: Narrow down noise while setting current task's tick dependency (Waiman Long) [1981336 1922901]
  - mlx5: net: zero-initialize tc skb extension on allocation (Jan Stancek) [1982220 1965418]
  - scsi: qedf: Update the max_id value in host structure (Nilesh Javali) [1989097 1954876]
  - scsi: qla2xxx: Reserve extra IRQ vectors (Nilesh Javali) [1986156 1964834]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.15.1.el8_4]
changelog:
  - sched: Fix data-race in wakeup (Phil Auld) [1987296 1937103]
  - mm/page_alloc: bail out on fatal signal during reclaim/compaction retry attempt (Aaron Tomlin) [1984085 1919765]
  - sunrpc: Avoid a KASAN slab-out-of-bounds bug in xdr_set_page_base() (Benjamin Coddington) [1990404 1969751]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.16.1.el8_4]
changelog:
  - kernfs: dont call d_splice_alias() under kernfs node lock (Ian Kent) [1994879 1939133]
  - kernfs: use i_lock to protect concurrent inode updates (Ian Kent) [1994879 1939133]
  - kernfs: switch kernfs to use an rwsem (Ian Kent) [1994879 1939133]
  - kernfs: use VFS negative dentry caching (Ian Kent) [1994879 1939133]
  - kernfs: add a revision to identify directory node changes (Ian Kent) [1994879 1939133]
  - kernfs: move revalidate to be near lookup (Ian Kent) [1994879 1939133]
  - scsi: lpfc: Fix dropped FLOGI during pt2pt discovery recovery (Jan Stancek) [1948608 1923762]
  - net: sched: act_mirred: Reset ct info when mirror/redirect skb (C. Erastus Toe) [1992226 1980532]
  - usb: ehci: Prevent missed ehci interrupts with edge-triggered MSI (Torez Smith) [1993894 1972139]
  - usb: ehci: do not initialise static variables (Torez Smith) [1993894 1972139]
  - usb: host: move EH SINGLE_STEP_SET_FEATURE implementation to core (Torez Smith) [1993894 1972139]
  - USB: ehci: drop workaround for forced irq threading (Torez Smith) [1993894 1972139]
  - usb: ehci: add spurious flag to disable overcurrent checking (Torez Smith) [1993894 1972139]
  - NFS: Only change the cookie verifier if the directory page cache is empty (Benjamin Coddington) [1993895 1982825]
  - NFS: Fix handling of cookie verifier in uncached_readdir() (Benjamin Coddington) [1993895 1982825]
  - nfs: Subsequent READDIR calls should carry non-zero cookieverifier (Benjamin Coddington) [1993895 1982825]
  - KVM: PPC: Book3S: Fix H_RTAS rets buffer overflow (Jon Maloy) [1988225 1988226] {CVE-2021-37576}


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.17.1.el8_4]
changelog:
  - ucounts: Move max_time_namespace according to ucount_type (Alex Gladkov) [1998002 1982954]
  - netfilter: conntrack: remove offload_pickup sysctl again (Florian Westphal) [1995555 1987101]
  - netfilter: flowtable: Set offload timeouts according to proto values (Phil Sutter) [1995554 1979184]
  - netfilter: conntrack: Introduce udp offload timeout configuration (Phil Sutter) [1995554 1979184]
  - netfilter: conntrack: Introduce tcp offload timeout configuration (Phil Sutter) [1995554 1979184]
  - powerpc/64s: Fix crashes when toggling stf barrier (Desnes A. Nunes do Rosario) [1989174 1964484]
  - iavf: fix locking of critical sections (Stefan Assmann) [1997534 1975245]
  - iavf: do not override the adapter state in the watchdog task (Stefan Assmann) [1997534 1975245]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.18.1.el8_4]
changelog:
  - mfd: intel-lpss: Use devm_ioremap_uc for MMIO (Steve Best) [1989560 1986715]
  - lib: devres: add a helper function for ioremap_uc (Steve Best) [1989560 1986715]
  - ceph: fix test for whether we can skip read when writing beyond EOF (Jeff Layton) [1996680 1971101]
  - arm64: memory: Add missing brackets to untagged_addr() macro (Chris von Recklinghausen) [1997998 1955809]
  - arm64: tags: Preserve tags for addresses translated via TTBR1 (Chris von Recklinghausen) [1997998 1955809]
  - arm64: entry: Move ct_user_exit before any other exception (Chris von Recklinghausen) [1997998 1955809]
  - arm64: memory: Implement __tag_set() as common function (Chris von Recklinghausen) [1997998 1955809]
  - arm64: mm: Really fix sparse warning in untagged_addr() (Chris von Recklinghausen) [1997998 1955809]
  - arm64: untag user pointers in access_ok and __uaccess_mask_ptr (Chris von Recklinghausen) [1997998 1955809]
  - arm64/mm: fix variable 'tag' set but not used (Chris von Recklinghausen) [1997998 1955809]
  - arm64: entry: SP Alignment Fault doesn't write to FAR_EL1 (Chris von Recklinghausen) [1997998 1955809]
  - arm64: compat: Add separate CP15 trapping hook (Chris von Recklinghausen) [1997998 1955809]
  - arm64: don't restore GPRs when context tracking (Chris von Recklinghausen) [1997998 1955809]
  - KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656) (Jon Maloy) [1985429 1985430] {CVE-2021-3656}
  - KVM: SVM: add module param to control the #SMI interception (Jon Maloy) [1985429 1985430] {CVE-2021-3656}
  - tty: Don't hold ldisc lock in tty_reopen() if ldisc present (Waiman Long) [1997999 1968271]
  - tty/ldsem: Add lockdep asserts for ldisc_sem (Waiman Long) [1997999 1968271]
  - tty: Simplify tty->count math in tty_reopen() (Waiman Long) [1997999 1968271]
  - tty: Don't block on IO when ldisc change is pending (Waiman Long) [1997999 1968271]
  - tty: Hold tty_ldisc_lock() during tty_reopen() (Waiman Long) [1997999 1968271]
  - tty: Drop tty->count on tty_reopen() failure (Waiman Long) [1997999 1968271]
  - [s390] s390/vtime: fix increased steal time accounting (Claudio Imbrenda) [1988386 1963075]
  - XArray: Fix splitting to non-zero orders (Chris von Recklinghausen) [1997997 1946304]
  - XArray: Fix split documentation (Chris von Recklinghausen) [1997997 1946304]
  - ima: extend boot_aggregate with kernel measurements (Bruno Meneguele) [1997766 1977422]
  - ceph: reduce contention in ceph_check_delayed_caps() (Jeff Layton) [1995862 1953430]
  - ice: Stop processing VF messages during teardown (Ken Cox) [1997538 1986451]
  - iavf: Set RSS LUT and key in reset handle path (Ken Cox) [1997536 1910853]
  - KVM: nSVM: avoid picking up unsupported bits from L2 in int_ctl (CVE-2021-3653) (Jon Maloy) [1985412 1985413] {CVE-2021-3653}
  - scsi: ibmvfc: Fix potential race in ibmvfc_wait_for_ops() (Steve Best) [1969792 1941180]
  - [s390] s390/dasd: add missing discipline function (Claudio Imbrenda) [1995206 1981804]
  - serial_core: switch to ->[sg]et_serial() (Artem Savkov) [1993872 1952415]
  - net/mlx5e: Fix mapping of ct_label zero (Jan Stancek) [1983681 1915308]
  - drm/qxl: add lock asserts to qxl_bo_vmap_locked + qxl_bo_vunmap_locked (Lyude Paul) [1992839 1907341]
  - drm/qxl: rework cursor plane (Lyude Paul) [1992839 1907341]
  - drm/qxl: move shadow handling to new qxl_prepare_shadow() (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix monitors object vmap (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix prime vmap (Lyude Paul) [1992839 1907341]
  - drm/qxl: rename qxl_bo_kmap -> qxl_bo_vmap_locked (Lyude Paul) [1992839 1907341]
  - drm/qxl: fix lockdep issue in qxl_alloc_release_reserved (Lyude Paul) [1992839 1907341]
  - drm/qxl: use ttm bo priorities (Lyude Paul) [1992839 1907341]
  - drm/qxl: more fence wait rework (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly handle device init failures (Lyude Paul) [1992839 1907341]
  - drm/qxl: allocate dumb buffers in ram (Lyude Paul) [1992839 1907341]
  - drm/qxl: simplify qxl_fence_wait (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly free qxl releases (Lyude Paul) [1992839 1907341]
  - drm/qxl: handle shadow in primary destroy (Lyude Paul) [1992839 1907341]
  - drm/qxl: properly pin/unpin shadow (Lyude Paul) [1992839 1907341]
  - drm/qxl: release shadow on shutdown (Lyude Paul) [1992839 1907341]
  - drm/qxl: unpin release objects (Lyude Paul) [1992839 1907341]
  - drm/qxl: use drmm_mode_config_init (Lyude Paul) [1992839 1907341]
  - qxl/ttm: drop the unusued no wait flag to reserve function (Lyude Paul) [1992839 1907341]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.19.1.el8_4]
changelog:
  - libceph: allow addrvecs with a single NONE/blank address (Jeff Layton) [1996682 1972278]
  - ice: Only lock to update netdev dev_addr (Michal Schmidt) [2000129 1995868]
  - ice: don't remove netdev->dev_addr from uc sync list (Ken Cox) [2000130 1961018]


author: Martin Balao <mbalao@redhat.com> - 1:17.0.0.0.33-0.2.ea
changelog:
  - Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
  - Related: rhbz#1995150


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.0.0.33-0.2.ea
changelog:
  - Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure.
  - Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM.
  - Related: rhbz#1995150


author: Martin Balao <mbalao@redhat.com> - 1:17.0.0.0.33-0.3.ea
changelog:
  - Add patch to disable non-FIPS crypto in the SUN and SunEC security providers.
  - Resolves: rhbz#1995150


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.6-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+6
  - Update release notes to 11.0.12.0+6
  - Skip 11.0.12.0+5 as 11.0.12.0+6 only adds a test change
  - Resolves: rhbz#1967374


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-1
changelog:
  - Update to jdk-11.0.12.0+7
  - Update release notes to 11.0.12.0+7
  - Switch to GA mode for final release.
  - Resolves: rhbz#1972395


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:11.0.12.0.7-2
changelog:
  - Add patch in order to fix java.library.path issue on aarch64 (JDK-8269668)
  - Resolves: rhbz#1994104


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.7-4
changelog:
  - Extend the default security policy to accomodate PKCS11 accessing jdk.internal.misc.
  - Resolves: rhbz#1997357


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-36
changelog:
  - network: make it safe to call networkSetupPrivateChains() multiple times (rhbz#1942805)
  - network: force re-creation of iptables private chains on firewalld restart (rhbz#1942805)
  - hostdev: Update mdev pointer reference after checking device type (rhbz#1940449)
  - hostdev: mdev: Lookup mdevs by sysfs path rather than mdev struct (rhbz#1940449)
  - qemu_firmware: don't error out for unknown firmware features (rhbz#1961562)
  - docs: improve description of secure attribute for loader element (rhbz#1929357)
  - conf: introduce virDomainDefParseBootInitOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootKernelOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootFirmwareOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootLoaderOptions (rhbz#1929357)
  - conf: introduce virDomainDefParseBootAcpiOptions (rhbz#1929357)
  - conf: use switch in virDomainDefParseBootOptions (rhbz#1929357)
  - conf: introduce support for firmware auto-selection feature filtering (rhbz#1929357)
  - qemu: implement support for firmware auto-selection feature filtering (rhbz#1929357)
  - domain_conf: Don't leak def->os.firmwareFeatures (rhbz#1929357)
  - conf: remove duplicated firmware type attribute (rhbz#1929357)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-37
changelog:
  - security: fix SELinux label generation logic (CVE-2021-3631)
  - storage_driver: Unlock object on ACL fail in storagePoolLookupByTargetPath (CVE-2021-3667)


author: Pavel Cahyna <pcahyna@redhat.com> - 2.0.31-3
changelog:
  - Resolve issues found by rpmdiff
    - add explicit Requires: on subpackages to avoid the need to test
      interoperability between the various combinations of old and new
      subpackages
    - add code to restore binary compatibility in libIPMIlanserv.so
      and libOpenIPMIcmdlang.so broken in 2.0.31, while keeping
      compatibility with 2.0.31 as well.


author: Omair Majid <omajid@redhat.com> - 5.0.202-2
changelog:
  - Update to .NET SDK 5.0.202 and Runtime 5.0.5
  - Create -source-built-artifacts subpackage
  - Resolves: RHBZ#1947600


author: Jiri Kucera <jkucera@redhat.com> - 1.13.1-8
changelog:
  - Add LICENSES file into the tarball, update License field
    Add pkgconfig files to gpgme-devel
    Resolves: #1882423, #1953905


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-14
changelog:
  - Fixes for CVE-2021-25290, CVE-2021-25292, CVE-2021-25293, CVE-2021-27921
  CVE-2021-27922, and CVE-2021-27923
  Resolves: rhbz#1934685 rhbz#1934699 rhbz#1934705 rhbz#1935384 rhbz#1935396 rhbz#1935401


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-15
changelog:
  - Fixes for CVE-2021-25288, CVE-2021-25287, CVE-2021-28675, CVE-2021-28676,
  CVE-2021-28677 and CVE-2021-28678
  Resolves: rhbz#1958231, rhbz#1958226, rhbz#1958240, rhbz#1958252, rhbz#1958257, rhbz#1958263


author: Charalampos Stratakis <cstratak@redhat.com> - 5.1.1-18
changelog:
  - Fixup for CVE-2022-22817
  - Security fixes for CVE-2022-22815, CVE-2022-22816
  Resolves: rhbz#2042522


author: Gris Ge <fge@redhat.com> - 1.1.0-3
changelog:
  - Fix state=ignore for OVS interface. RHBZ#1944054
  - Fix verification for next hop address 0.0.0.0. RHBZ#1985879


author: Ana Cabral <acabral@redhat.com> - 1.1.1-0.1.alpha1
changelog:
  - Upgrade to 1.1.1 alpha1.
  - Canonicalize ipv6 addresses for dns nameservers. RHBZ#1911241
  - Throw better error when peer is missing for veth interfaces. RHBZ#1973973


author: Marek Polacek <polacek@redhat.com> 8.5.0-2
changelog:
  - revert upstream PR85873 gcc-8 fix, apply the fix from gcc-9 (#1960701)
  - fix 'this' adjustment for devirtualized call (PR c++/100797, #1965951)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.0-1
changelog:
  - Update to 0.62.0
  - Hardening: add signature check with rpmcliVerifySignatures (RhBug:1932079)
  - Support allow_vendor_change setting in dnf context API
  - Add a new option module_obsoletes
  - Add new API applyObsoletes() function to apply modular obsoletes
  - Do not allow 1 as installonly_limit value (RhBug:1926261)
  - Add a config option to check TLS certificate revocation status (using OCSP stapling), defaults to false (RhBug:1814383)
  - Swdb: Add a method to get the current transaction
  - [context,API] Functions for accessing main/global configuration options
  - [context,API] Function for adding setopt
  - Add getter for modular obsoletes from ModuleMetadata
  - Add ModulePackage.getStaticContext() and getRequires()
  - Fix modular queries with the new solver
  - Fix: Fully set ssl in newHandle function
  - [conf] Add options for working with certificates used with proxy
  - Modify module NSVCA parsing - context definition (RhBug:1926771)
  - [context] Fix: dnf_package_is_installonly (RhBug:1928056)
  - Add getApplicablePackages to advisory and isApplicable to advisorymodule
  - Keep isAdvisoryApplicable to preserve API
  - [context] Support config file option "proxy_auth_method", defaults "any"
  - Support main config file options "installonlypkgs" and "protected_packages". Changes behaviour of microdnf and PackageKit.
  - Properly handle multiple collections in updateinfo.xml (RhBug:1804234)
  - Fix a crash when [media] section in .treeinfo is missing for bootable media (RhBug:1946024)
  - Add new dnf_context_module_install() C API


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.0-2
changelog:
  - Fix: dnf_context_module_install: memory leaks
  - covscan: remove unused vars, mark private func static, return values
  - DNF does not fail on non UTF-8 file names in a package


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-37.1.el8
changelog:
  - network: Implement virConnectSupportsFeature() (rhbz#2038812)
  - lib: Fix calling of virNetworkUpdate() driver callback (rhbz#2038812)


author: Thomas Haller <thaller@redhat.com> - 1:1.32.0-0.5
changelog:
  - update to 1.32-rc1 (1.31.90) (release candidate)
  - core: allow to preserved external TFilter and QDisc settings (rh #1928078)
  - bond: support "tlb_dynamic_lb" in "balance-alb" mode (rh #1959934)


author: Wen Liang <wenliang@redhat.com> - 1:1.32.0-1
changelog:
  - update to 1.32.0 release
  - veth: fix null error when deleting the device (rh #1915278)
  - veth: fix crash when deleting the device profile (rh #1915276)
  - firewall: add new "nftables" firewall-backend (rh #1548825)
  - DNS: fix lookup of hostname via DNS (rh #1970335)


author: Wen Liang <wenliang@redhat.com> - 1:1.32.2-1
changelog:
  - update to 1.32.2 release
  - device: prefer IPv6 not-deprecated addresses for hostname lookup (rh #1820770)
  - docs: describe qdiscs and tfilters in nm-settings manpage (rh #1847894)
  - cloud-setup: preserve IPv4 addresses/routes/rules from profile (rh #1971527)
  - daemon: performance improvements (rh #1847125)
  - dhcp/systemd: ignore FORCERENEW requests for DHCPV4 (rh #1961251, CVE-2020-13529)
  - Add bridge_role in 802-3-ethernet.s390-options using nmcli (rh #1935842)


author: Gris Ge <fge@redhat.com> - 1:1.32.4-1
changelog:
  - Upgrade to 1.32.4 with fixes of:
  - nmcli: show DNS SEARCH field in device information. (rh #1852317)
  - device: avoid crash setting VPN config during unrealize. (rh #1912423)
  - core: send ARP announcements when there is carrier. (rh #1956793)
  - core: add ipv[46].required-timeout option to wait for IP configuration while activating. (rh #1961666)
  - core: start DHCPv6 when a prefix delegation is needed for shared mode. (rh #1973199)
  - ifcfg: log warning about invalid keys in ifcfg files. (rh #1959656)
  - cloud-setup: add support for Aliyun cloud. (rh #1823315)


author: Gris Ge <fge@redhat.com> - 1:1.32.6-1
changelog:
  - Upgrade to 1.32.6 release
  - core: fix adding stale local routes when address changes (rh #1979192)
  - dhcp: handle filename/bootfile_name DHCP option and write it to device state
    file for initrd/kickstart (rh #1979387)
  - initrd: add "ib.pkey=" command line option (rh #1805708)
  - core: introduce "keep-configuration" device option to forcefully activate a
    profile on start (rh #1934122)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.32.8-1
changelog:
  - Upgrade to 1.32.8 release
  - firewalld: configure zones on "Reloaded" signal (rh #1982403)
  - ethtool: support configuring newer gigabit ethernet speeds (rh #1897004)
  - core: fix wrong MTU for bridge interfaces (rh #1973536)
  - cloud-setup: fix gateway address for Aliyun cloud (rh #1823315)


author: Wen Liang <wenliang@redhat.com> - 1:1.32.10-1
changelog:
  - update to 1.32.10 release
  - nm-initrd-generator: add kernel command line options ethtool autoneg and speed (rh #1940934)
  - IP: fix the order of IP addresses during service restart (rh #1988751)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.32.10-3
changelog:
  - preserve the IPv6 multicast route added by kernel (rh #2004212)
  - cloud-setup: better handle other route configuration (rh #1977984)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-35.1.el8
changelog:
  - network: make it safe to call networkSetupPrivateChains() multiple times (rhbz#1958301)
  - network: force re-creation of iptables private chains on firewalld restart (rhbz#1958301)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-339.el8]
changelog:
  - smb2: fix use-after-free in smb2_ioctl_query_info() (Ronnie Sahlberg) [1952781]
  - dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (Mike Snitzer) [1996854]
  - md/raid10: Remove rcu_dereference when it doesn't need rcu lock to protect (Nigel Croxon) [1978115]
  - scsi: csiostor: Mark known unused variable as __always_unused (Raju Rangoju) [1961333]
  - scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() (Raju Rangoju) [1961333]
  - scsi: csiostor: Remove set but not used variable 'rln' (Raju Rangoju) [1961333]
  - scsi: csiostor: Return value not required for csio_dfs_destroy (Raju Rangoju) [1961333]
  - scsi: csiostor: Fix NULL check before debugfs_remove_recursive (Raju Rangoju) [1961333]
  - scsi: csiostor: Don't enable IRQs too early (Raju Rangoju) [1961333]
  - scsi: csiostor: Fix spelling typos (Raju Rangoju) [1961333]
  - scsi: csiostor: Prefer pcie_capability_read_word() (Raju Rangoju) [1961333]
  - scsi: target: cxgbit: Unmap DMA buffer before calling target_execute_cmd() (Raju Rangoju) [1961394]
  - net: Use skb_frag_off accessors (Raju Rangoju) [1961394]
  - net: Use skb accessors in network drivers (Raju Rangoju) [1961394]
  - cxgb4/chtls/cxgbit: Keeping the max ofld immediate data size same in cxgb4 and ulds (Raju Rangoju) [1961394]
  - scsi: libcxgbi: Fix a use after free in cxgbi_conn_xmit_pdu() (Raju Rangoju) [1961394]
  - scsi: libcxgbi: Use kvzalloc instead of opencoded kzalloc/vzalloc (Raju Rangoju) [1961394]
  - scsi: libcxgbi: Remove unnecessary NULL checks for 'tdata' pointer (Raju Rangoju) [1961394]
  - scsi: cxgb4i: Remove an unnecessary NULL check for 'cconn' pointer (Raju Rangoju) [1961394]
  - scsi: cxgb4i: Clean up a debug printk (Raju Rangoju) [1961394]
  - scsi: cxgb4i: Fix dereference of pointer tdata before it is null checked (Raju Rangoju) [1961394]
  - scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy() (Raju Rangoju) [1961394]
  - scsi: libcxgbi: remove unused function to stop warning (Raju Rangoju) [1961394]
  - scsi: libcxgbi: add a check for NULL pointer in cxgbi_check_route() (Raju Rangoju) [1961394]
  - net/chelsio: Delete drive and module versions (Raju Rangoju) [1961394]
  - chelsio: Replace zero-length array with flexible-array member (Raju Rangoju) [1961394]
  - [netdrv] treewide: prefix header search paths with $(srctree)/ (Raju Rangoju) [1961394]
  - libcxgb: fix incorrect ppmax calculation (Raju Rangoju) [1961394]
  - scsi: cxgb4i: Fix TLS dependency (Raju Rangoju) [1961394]
  - [target] treewide: Use fallthrough pseudo-keyword (Raju Rangoju) [1961394]
  - scsi: cxgb4i: Add support for iSCSI segmentation offload (Raju Rangoju) [1961394]
  - [target] treewide: Use sizeof_field() macro (Raju Rangoju) [1961394]
  - [target] treewide: replace '---help---' in Kconfig files with 'help' (Raju Rangoju) [1961394]
  - scsi: cxgb4i: Remove superfluous null check (Raju Rangoju) [1961394]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-340.el8]
changelog:
  - blk-mq: fix is_flush_rq (Ming Lei) [1992700]
  - blk-mq: fix kernel panic during iterating over flush request (Ming Lei) [1992700]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-341.el8]
changelog:
  - mptcp: Only send extra TCP acks in eligible socket states (Paolo Abeni) [1997178]
  - mptcp: fix possible divide by zero (Paolo Abeni) [1997178]
  - mptcp: drop tx skb cache (Paolo Abeni) [1997178]
  - mptcp: fix memory leak on address flush (Paolo Abeni) [1997178]
  - ice: Only lock to update netdev dev_addr (Michal Schmidt) [1995868]
  - ice: restart periodic outputs around time changes (Ken Cox) [1992750]
  - ice: Fix perout start time rounding (Ken Cox) [1992750]
  - net/sched: ets: fix crash when flipping from 'strict' to 'quantum' (Davide Caratti) [1981184]
  - ovl: prevent private clone if bind mount is not allowed (Miklos Szeredi) [1993131] {CVE-2021-3732}
  - gfs2: Don't call dlm after protocol is unmounted (Bob Peterson) [1997193]
  - gfs2: don't stop reads while withdraw in progress (Bob Peterson) [1997193]
  - gfs2: Mark journal inodes as "don't cache" (Bob Peterson) [1997193]
  - bpf: bpftool: Add -fno-asynchronous-unwind-tables to BPF Clang invocation (Yauheni Kaliuta) [1997124]
  - perf/x86/intel: Apply mid ACK for small core (Michael Petlan) [1838573]
  - perf/x86/intel/lbr: Zero the xstate buffer on allocation (Michael Petlan) [1838573]
  - perf: Fix task context PMU for Hetero (Michael Petlan) [1838573]
  - perf/x86/intel: Fix fixed counter check warning for some Alder Lake (Michael Petlan) [1838573]
  - perf/x86/lbr: Remove cpuc->lbr_xsave allocation from atomic context (Michael Petlan) [1838573]
  - x86/fpu/xstate: Fix an xstate size check warning with architectural LBRs (Michael Petlan) [1838573]
  - perf/x86/rapl: Add support for Intel Alder Lake (Michael Petlan) [1838573]
  - perf/x86/cstate: Add Alder Lake CPU support (Michael Petlan) [1838573]
  - perf/x86/msr: Add Alder Lake CPU support (Michael Petlan) [1838573]
  - perf/x86/intel/uncore: Add Alder Lake support (Michael Petlan) [1838573]
  - perf: Extend PERF_TYPE_HARDWARE and PERF_TYPE_HW_CACHE (Michael Petlan) [1838573]
  - perf/x86/intel: Add Alder Lake Hybrid support (Michael Petlan) [1838573]
  - perf/x86: Support filter_match callback (Michael Petlan) [1838573]
  - perf/x86/intel: Add attr_update for Hybrid PMUs (Michael Petlan) [1838573]
  - perf/x86: Add structures for the attributes of Hybrid PMUs (Michael Petlan) [1838573]
  - perf/x86: Register hybrid PMUs (Michael Petlan) [1838573]
  - perf/x86: Factor out x86_pmu_show_pmu_cap (Michael Petlan) [1838573]
  - perf/x86: Remove temporary pmu assignment in event_init (Michael Petlan) [1838573]
  - perf/x86/intel: Factor out intel_pmu_check_extra_regs (Michael Petlan) [1838573]
  - perf/x86/intel: Factor out intel_pmu_check_event_constraints (Michael Petlan) [1838573]
  - perf/x86/intel: Factor out intel_pmu_check_num_counters (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for extra_regs (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for event constraints (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for hardware cache event (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for unconstrained (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for counters (Michael Petlan) [1838573]
  - perf/x86: Hybrid PMU support for intel_ctrl (Michael Petlan) [1838573]
  - perf/x86/intel: Hybrid PMU support for perf capabilities (Michael Petlan) [1838573]
  - perf/x86: Track pmu in per-CPU cpu_hw_events (Michael Petlan) [1838573]
  - perf/x86/intel/lbr: Support XSAVES for arch LBR read (Michael Petlan) [1838573]
  - perf/x86/intel/lbr: Support XSAVES/XRSTORS for LBR context switch (Michael Petlan) [1838573]
  - x86/fpu/xstate: Add helpers for LBR dynamic supervisor feature (Michael Petlan) [1838573]
  - x86/fpu/xstate: Support dynamic supervisor feature for LBR (Michael Petlan) [1838573]
  - x86/fpu: Use proper mask to replace full instruction mask (Michael Petlan) [1838573]
  - x86/cpu: Add helper function to get the type of the current hybrid CPU (Michael Petlan) [1838573]
  - x86/cpufeatures: Enumerate Intel Hybrid Technology feature bit (Michael Petlan) [1838573]
  - HID: make arrays usage and value to be the same (Benjamin Tissoires) [1974942]
  - ACPI: PM: s2idle: Invert Microsoft UUID entry and exit (David Arcari) [1960440]
  - platform/x86: amd-pmc: Fix undefined reference to __udivdi3 (David Arcari) [1960440]
  - platform/x86: amd-pmc: Fix missing unlock on error in amd_pmc_send_cmd() (David Arcari) [1960440]
  - platform/x86: amd-pmc: Use return code on suspend (David Arcari) [1960440]
  - platform/x86: amd-pmc: Add new acpi id for future PMC controllers (David Arcari) [1960440]
  - platform/x86: amd-pmc: Add support for ACPI ID AMDI0006 (David Arcari) [1960440]
  - platform/x86: amd-pmc: Add support for logging s0ix counters (David Arcari) [1960440]
  - platform/x86: amd-pmc: Add support for logging SMU metrics (David Arcari) [1960440]
  - platform/x86: amd-pmc: call dump registers only once (David Arcari) [1960440]
  - platform/x86: amd-pmc: Fix SMU firmware reporting mechanism (David Arcari) [1960440]
  - platform/x86: amd-pmc: Fix command completion code (David Arcari) [1960440]
  - usb: pci-quirks: disable D3cold on xhci suspend for s2idle on AMD Renoir (David Arcari) [1960440]
  - ACPI: PM: Only mark EC GPE for wakeup on Intel systems (David Arcari) [1960440]
  - ACPI: PM: Adjust behavior for field problems on AMD systems (David Arcari) [1960440]
  - ACPI: PM: s2idle: Add support for new Microsoft UUID (David Arcari) [1960440]
  - ACPI: PM: s2idle: Add support for multiple func mask (David Arcari) [1960440]
  - ACPI: PM: s2idle: Refactor common code (David Arcari) [1960440]
  - ACPI: PM: s2idle: Use correct revision id (David Arcari) [1960440]
  - ACPI: PM: s2idle: Add missing LPS0 functions for AMD (David Arcari) [1960440]
  - lockd: Fix invalid lockowner cast after vfs_test_lock (Benjamin Coddington) [1986138]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-342.el8]
changelog:
  - selftest: netfilter: add test case for unreplied tcp connections (Florian Westphal) [1991523]
  - netfilter: conntrack: do not renew entry stuck in tcp SYN_SENT state (Florian Westphal) [1991523]
  - net/sched: store the last executed chain also for clsact egress (Davide Caratti) [1980537]
  - ice: fix Tx queue iteration for Tx timestamp enablement (Ken Cox) [1999743]
  - perf evsel: Add missing cloning of evsel->use_config_name (Michael Petlan) [1838635]
  - perf Documentation: Document intel-hybrid support (Michael Petlan) [1838635]
  - perf tests: Skip 'perf stat metrics (shadow stat) test' for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Convert perf time to TSC' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Session topology' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Parse and process metrics' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Support 'Track with sched_switch' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Skip 'Setup struct perf_event_attr' test for hybrid (Michael Petlan) [1838635]
  - perf tests: Add hybrid cases for 'Roundtrip evsel->name' test (Michael Petlan) [1838635]
  - perf tests: Add hybrid cases for 'Parse event definition strings' test (Michael Petlan) [1838635]
  - perf record: Uniquify hybrid event name (Michael Petlan) [1838635]
  - perf stat: Warn group events from different hybrid PMU (Michael Petlan) [1838635]
  - perf stat: Filter out unmatched aggregation for hybrid event (Michael Petlan) [1838635]
  - perf stat: Add default hybrid events (Michael Petlan) [1838635]
  - perf record: Create two hybrid 'cycles' events by default (Michael Petlan) [1838635]
  - perf parse-events: Support event inside hybrid pmu (Michael Petlan) [1838635]
  - perf parse-events: Compare with hybrid pmu name (Michael Petlan) [1838635]
  - perf parse-events: Create two hybrid raw events (Michael Petlan) [1838635]
  - perf parse-events: Create two hybrid cache events (Michael Petlan) [1838635]
  - perf parse-events: Create two hybrid hardware events (Michael Petlan) [1838635]
  - perf stat: Uniquify hybrid event name (Michael Petlan) [1838635]
  - perf pmu: Add hybrid helper functions (Michael Petlan) [1838635]
  - perf pmu: Save detected hybrid pmus to a global pmu list (Michael Petlan) [1838635]
  - perf pmu: Save pmu name (Michael Petlan) [1838635]
  - perf pmu: Simplify arguments of __perf_pmu__new_alias (Michael Petlan) [1838635]
  - perf jevents: Support unit value "cpu_core" and "cpu_atom" (Michael Petlan) [1838635]
  - tools headers uapi: Update tools's copy of linux/perf_event.h (Michael Petlan) [1838635]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-343.el8]
changelog:
  - rcu: Avoid unneeded function call in rcu_read_unlock() (Waiman Long) [1997500]
  - mt76: connac: do not schedule mac_work if the device is not running (Íñigo Huguet) [1956419 1972045]
  - mt7921e: enable module in config (Íñigo Huguet) [1956419 1972045]
  - Revert tools/power/cpupower: Read energy_perf_bias from sysfs (Steve Best) [1999926]
  - libnvdimm/namespace: Differentiate between probe mapping and runtime mapping (Jeff Moyer) [1795719]
  - libnvdimm/pfn_dev: Don't clear device memmap area during generic namespace probe (Jeff Moyer) [1795719]
  - perf/x86/intel/uncore: Clean up error handling path of iio mapping (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Fix for iio mapping on Skylake Server (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Generic support for the MMIO type of uncore blocks (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Generic support for the PCI type of uncore blocks (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Rename uncore_notifier to uncore_pci_sub_notifier (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Generic support for the MSR type of uncore blocks (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Parse uncore discovery tables (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Expose an Uncore unit to IIO PMON mapping (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Wrap the max dies calculation into an accessor (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Expose an Uncore unit to PMON mapping (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Validate MMIO address before accessing (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Record the size of mapped area (Michael Petlan) [1837330]
  - perf/x86/intel/uncore: Fix oops when counting IMC uncore events on some TGL (Michael Petlan) [1837330]
  - crypto: qat - remove unused macro in FW loader (Vladis Dronov) [1920086]
  - crypto: qat - check return code of qat_hal_rd_rel_reg() (Vladis Dronov) [1920086]
  - crypto: qat - report an error if MMP file size is too large (Vladis Dronov) [1920086]
  - crypto: qat - check MMP size before writing to the SRAM (Vladis Dronov) [1920086]
  - crypto: qat - return error when failing to map FW (Vladis Dronov) [1920086]
  - crypto: qat - enable detection of accelerators hang (Vladis Dronov) [1920086]
  - crypto: qat - Fix a double free in adf_create_ring (Vladis Dronov) [1920086]
  - crypto: qat - fix error path in adf_isr_resource_alloc() (Vladis Dronov) [1920086]
  - crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init (Vladis Dronov) [1920086]
  - crypto: qat - don't release uninitialized resources (Vladis Dronov) [1920086]
  - crypto: qat - fix use of 'dma_map_single' (Vladis Dronov) [1920086]
  - crypto: qat - fix unmap invalid dma address (Vladis Dronov) [1920086]
  - crypto: qat - fix spelling mistake: "messge" -> "message" (Vladis Dronov) [1920086]
  - crypto: qat - reduce size of mapped region (Vladis Dronov) [1920086]
  - crypto: qat - change format string and cast ring size (Vladis Dronov) [1920086]
  - crypto: qat - fix potential spectre issue (Vladis Dronov) [1920086]
  - crypto: qat - configure arbiter mapping based on engines enabled (Vladis Dronov) [1920086]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-344.el8]
changelog:
  - perf/x86/intel: Fix PEBS-via-PT reload base value for Extended PEBS (Michael Petlan) [1998051]
  - perf/x86/intel/uncore: Fix Add BW copypasta (Michael Petlan) [1998051]
  - perf/x86/intel/uncore: Add BW counters for GT, IA and IO breakdown (Michael Petlan) [1998051]
  - Revert "ice: Add initial support framework for LAG" (Michal Schmidt) [1999016]
  - net: re-initialize slow_gro flag at gro_list_prepare time (Paolo Abeni) [2002367]
  - cxgb4: dont touch blocked freelist bitmap after free (Rahul Lakkireddy) [1998148]
  - cxgb4vf: configure ports accessible by the VF (Rahul Lakkireddy) [1961329]
  - scsi: lpfc: Fix memory leaks in error paths while issuing ELS RDF/SCR request (Dick Kennedy) [1976332]
  - scsi: lpfc: Keep NDLP reference until after freeing the IOCB after ELS handling (Dick Kennedy) [1976332]
  - scsi: lpfc: Move initialization of phba->poll_list earlier to avoid crash (Dick Kennedy) [1976332]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-345.el8]
changelog:
  - e1000e: Do not take care about recovery NVM checksum (Ken Cox) [1984558]
  - qrtr: disable CONFIG_QRTR for non x86_64 archs (Íñigo Huguet) [1999642]
  - ceph: fix possible null-pointer dereference in ceph_mdsmap_decode() (Jeff Layton) [1989999]
  - ceph: fix dereference of null pointer cf (Jeff Layton) [1989999]
  - ceph: correctly handle releasing an embedded cap flush (Jeff Layton) [1989999]
  - ceph: take snap_empty_lock atomically with snaprealm refcount change (Jeff Layton) [1989999]
  - ceph: don't WARN if we're still opening a session to an MDS (Jeff Layton) [1989999]
  - rbd: don't hold lock_rwsem while running_list is being drained (Jeff Layton) [1989999]
  - rbd: always kick acquire on "acquired" and "released" notifications (Jeff Layton) [1989999]
  - ceph: take reference to req->r_parent at point of assignment (Jeff Layton) [1989999]
  - ceph: eliminate ceph_async_iput() (Jeff Layton) [1989999]
  - ceph: don't take s_mutex in ceph_flush_snaps (Jeff Layton) [1989999]
  - ceph: don't take s_mutex in try_flush_caps (Jeff Layton) [1989999]
  - ceph: don't take s_mutex or snap_rwsem in ceph_check_caps (Jeff Layton) [1989999]
  - ceph: eliminate session->s_gen_ttl_lock (Jeff Layton) [1989999]
  - ceph: allow ceph_put_mds_session to take NULL or ERR_PTR (Jeff Layton) [1989999]
  - ceph: clean up locking annotation for ceph_get_snap_realm and __lookup_snap_realm (Jeff Layton) [1989999]
  - ceph: add some lockdep assertions around snaprealm handling (Jeff Layton) [1989999]
  - ceph: decoding error in ceph_update_snap_realm should return -EIO (Jeff Layton) [1989999]
  - ceph: add IO size metrics support (Jeff Layton) [1989999]
  - ceph: update and rename __update_latency helper to __update_stdev (Jeff Layton) [1989999]
  - ceph: simplify the metrics struct (Jeff Layton) [1989999]
  - libceph: fix doc warnings in cls_lock_client.c (Jeff Layton) [1989999]
  - libceph: remove unnecessary ret variable in ceph_auth_init() (Jeff Layton) [1989999]
  - libceph: kill ceph_none_authorizer::reply_buf (Jeff Layton) [1989999]
  - ceph: make ceph_queue_cap_snap static (Jeff Layton) [1989999]
  - ceph: remove bogus checks and WARN_ONs from ceph_set_page_dirty (Jeff Layton) [1989999]
  - libceph: set global_id as soon as we get an auth ticket (Jeff Layton) [1989999]
  - libceph: don't pass result into ac->ops->handle_reply() (Jeff Layton) [1989999]
  - ceph: fix error handling in ceph_atomic_open and ceph_lookup (Jeff Layton) [1989999]
  - ceph: must hold snap_rwsem when filling inode for async create (Jeff Layton) [1989999]
  - libceph: Fix spelling mistakes (Jeff Layton) [1989999]
  - libceph: don't set global_id until we get an auth ticket (Jeff Layton) [1989999]
  - libceph: bump CephXAuthenticate encoding version (Jeff Layton) [1989999]
  - ceph: don't allow access to MDS-private inodes (Jeff Layton) [1989999]
  - ceph: fix up some bare fetches of i_size (Jeff Layton) [1989999]
  - ceph: support getting ceph.dir.rsnaps vxattr (Jeff Layton) [1989999]
  - ceph: drop pinned_page parameter from ceph_get_caps (Jeff Layton) [1989999]
  - ceph: fix inode leak on getattr error in __fh_to_dentry (Jeff Layton) [1989999]
  - ceph: only check pool permissions for regular files (Jeff Layton) [1989999]
  - ceph: send opened files/pinned caps/opened inodes metrics to MDS daemon (Jeff Layton) [1989999]
  - ceph: avoid counting the same request twice or more (Jeff Layton) [1989999]
  - ceph: rename the metric helpers (Jeff Layton) [1989999]
  - ceph: fix kerneldoc copypasta over ceph_start_io_direct (Jeff Layton) [1989999]
  - ceph: don't use d_add in ceph_handle_snapdir (Jeff Layton) [1989999]
  - ceph: don't clobber i_snap_caps on non-I_NEW inode (Jeff Layton) [1989999]
  - ceph: fix fall-through warnings for Clang (Jeff Layton) [1989999]
  - net: ceph: Fix a typo in osdmap.c (Jeff Layton) [1989999]
  - ceph: don't allow type or device number to change on non-I_NEW inodes (Jeff Layton) [1989999]
  - ceph: defer flushing the capsnap if the Fb is used (Jeff Layton) [1989999]
  - ceph: allow queueing cap/snap handling after putting cap references (Jeff Layton) [1989999]
  - ceph: clean up inode work queueing (Jeff Layton) [1989999]
  - ceph: fix flush_snap logic after putting caps (Jeff Layton) [1989999]
  - libceph: fix "Boolean result is used in bitwise operation" warning (Jeff Layton) [1989999]
  - new helper: inode_wrong_type() (Jeff Layton) [1989999]
  - kabi: Adding symbol single_release (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol single_open (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol seq_read (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol seq_printf (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol seq_lseek (fs/seq_file.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol unregister_chrdev_region (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_init (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_del (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_alloc (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol cdev_add (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol alloc_chrdev_region (fs/char_dev.c) (Čestmír Kalina) [1945486]
  - kabi: Adding symbol pcie_capability_read_word (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pcie_capability_read_dword (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pcie_capability_clear_and_set_word (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_write_config_dword (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_write_config_byte (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_set_power_state (drivers/pci/pci.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_read_config_dword (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_read_config_byte (drivers/pci/access.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_irq_vector (drivers/pci/msi.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_get_device (drivers/pci/search.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_free_irq_vectors (drivers/pci/msi.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol pci_alloc_irq_vectors_affinity (drivers/pci/msi.c) (Čestmír Kalina) [1945485]
  - kabi: Adding symbol kexec_crash_loaded (kernel/kexec_core.c) (Čestmír Kalina) [1945491]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-346.el8]
changelog:
  - redhat: switch secureboot kernel image signing to release keys (Bruno Meneguele)
  - CI: handle RT branches in a single config (Veronika Kabatova)
  - CI: Fix RT check branch name (Veronika Kabatova)
  - CI: Drop private CI config (Veronika Kabatova)
  - CI: extend template use (Veronika Kabatova)
  - Revert "Merge: mt7921e: enable new Mediatek wireless hardware" (Bruno Meneguele) [2009501]
  - megaraid_sas: fix concurrent access to ISR between IRQ polling and real interrupt (Tomas Henzl) [2009022]
  - scsi: megaraid_sas: mq_poll support (Tomas Henzl) [2009022]
  - [PATCH v2] scsi: qla2xxx: Suppress unnecessary log messages during login (Nilesh Javali) [1982186]
  - scsi: qla2xxx: Fix excessive messages during device logout (Nilesh Javali) [1982186]
  - PCI: pciehp: Ignore Link Down/Up caused by DPC (Myron Stowe) [1981741]
  - arm64: kpti: Fix "kpti=off" when KASLR is enabled (Mark Salter) [1979731]
  - arm64: Fix CONFIG_ARCH_RANDOM=n build (Mark Salter) [1979731]
  - redhat/configs: aarch64: add CONFIG_ARCH_RANDOM (Mark Salter) [1979731]
  - arm64: Implement archrandom.h for ARMv8.5-RNG (Mark Salter) [1979731]
  - arm64: kconfig: Fix alignment of E0PD help text (Mark Salter) [1979731]
  - arm64: Use register field helper in kaslr_requires_kpti() (Mark Salter) [1979731]
  - arm64: Simplify early check for broken TX1 when KASLR is enabled (Mark Salter) [1979731]
  - arm64: Use a variable to store non-global mappings decision (Mark Salter) [1979731]
  - arm64: Don't use KPTI where we have E0PD (Mark Salter) [1979731]
  - arm64: Factor out checks for KASLR in KPTI code into separate function (Mark Salter) [1979731]
  - redhat/configs: Add CONFIG_ARM64_E0PD (Mark Salter) [1979731]
  - arm64: Add initial support for E0PD (Mark Salter) [1979731]
  - arm64: cpufeature: Export matrix and other features to userspace (Mark Salter) [1980098]
  - arm64: docs: cpu-feature-registers: Document ID_AA64PFR1_EL1 (Mark Salter) [1980098]
  - docs/arm64: cpu-feature-registers: Rewrite bitfields that don't follow [e, s] (Mark Salter) [1980098]
  - docs/arm64: cpu-feature-registers: Documents missing visible fields (Mark Salter) [1980098]
  - arm64: Introduce system_capabilities_finalized() marker (Mark Salter) [1980098]
  - arm64: entry.S: Do not preempt from IRQ before all cpufeatures are enabled (Mark Salter) [1980098]
  - docs/arm64: elf_hwcaps: Document HWCAP_SB (Mark Salter) [1980098]
  - docs/arm64: elf_hwcaps: sort the HWCAP{, 2} documentation by ascending value (Mark Salter) [1980098]
  - arm64: cpufeature: Treat ID_AA64ZFR0_EL1 as RAZ when SVE is not enabled (Mark Salter) [1980098]
  - arm64: cpufeature: Effectively expose FRINT capability to userspace (Mark Salter) [1980098]
  - arm64: cpufeature: Fix feature comparison for CTR_EL0.{CWG,ERG} (Mark Salter) [1980098]
  - arm64: Expose FRINT capabilities to userspace (Mark Salter) [1980098]
  - arm64: Expose ARMv8.5 CondM capability to userspace (Mark Salter) [1980098]
  - docs: arm64: convert perf.txt to ReST format (Mark Salter) [1980098]
  - docs: arm64: convert docs to ReST and rename to .rst (Mark Salter) [1980098]
  - Documentation/arm64: HugeTLB page implementation (Mark Salter) [1980098]
  - Documentation/arm64/sve: Couple of improvements and typos (Mark Salter) [1980098]
  - arm64: cpufeature: Fix missing ZFR0 in __read_sysreg_by_encoding() (Mark Salter) [1980098]
  - arm64: Expose SVE2 features for userspace (Mark Salter) [1980098]
  - arm64: Advertise ARM64_HAS_DCPODP cpu feature (Mark Salter) [1980098]
  - arm64: add CVADP support to the cache maintenance helper (Mark Salter) [1980098]
  - arm64: Fix minor issues with the dcache_by_line_op macro (Mark Salter) [1980098]
  - arm64: Expose DC CVADP to userspace (Mark Salter) [1980098]
  - arm64: Handle trapped DC CVADP (Mark Salter) [1980098]
  - arm64: HWCAP: encapsulate elf_hwcap (Mark Salter) [1980098]
  - arm64: HWCAP: add support for AT_HWCAP2 (Mark Salter) [1980098]
  - x86/MCE/AMD, EDAC/mce_amd: Add new SMCA bank types (Aristeu Rozanski) [1965331]
  - x86/MCE/AMD, EDAC/mce_amd: Remove struct smca_hwid.xec_bitmap (Aristeu Rozanski) [1965331]
  - EDAC, mce_amd: Print ExtErrorCode and description on a single line (Aristeu Rozanski) [1965331]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.el8]
changelog:
  - drm/nouveau/fifo/ga102: initialise chid on return from channel creation (Ben Skeggs) [1997878]
  - drm/nouveau/ga102-: support ttm buffer moves via copy engine (Ben Skeggs) [1997878]
  - drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows (Ben Skeggs) [1997878]
  - drm/nouveau/kms/nv50: workaround EFI GOP window channel format differences (Ben Skeggs) [1997878]
  - drm/nouveau/disp: power down unused DP links during init (Ben Skeggs) [1997878]
  - drm/nouveau: recognise GA107 (Ben Skeggs) [1997878]


author: Marian Csontos <mcsontos@redhat.com> - 2.03.12-3
changelog:
  - Allow extending thin-pool data with writecache on top.
  - Fix removing thin-pool data converted to writeache.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.12-4
changelog:
  - Fix conversion of writecache LVs to thin pool data volume.
  - Add deviceidtype option for lvmdevices.


author: Marian Csontos <mcsontos@redhat.com> - 2.03.12-6
changelog:
  - Fix handling of pmspare by vgsplit, vgmerge and vgremove.
  - Fix detection of active components of external origin volume.


author: Andreas Schneider <asn@redhat.com> - 4.14.4-4
changelog:
  - resolves: rhbz#2021163
    Fix CVE-2016-2124
  - resolves: rhbz#2021167
    Fix CVE-2021-23192
  - resolves: rhbz#2021171
    Fix CVE-2020-25717


author: Andreas Schneider <asn@redhat.com> - 4.14.5-5
changelog:
  - resolves: rhbz#2021493 - Add missing PAC buffer types to krb5pac.idl
  - related: rbhz#2021171 - Fix regression with 'allow trusted domains = no'


author: Andreas Schneider <asn@redhat.com> - 4.14.5-9
changelog:
  - resolves: rhbz#2046174 - Fix username map script regression of CVE-2020-25717
  - resolves: rhbz#2046160 - Fix possible segfault while joining a domain
  - resolves: rhbz#2046152 - Fix CVE-2021-44142


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.17-1
changelog:
  - Update to 0.7.17
  - selected bug fixes:
    * repo_write: fix handling of nested flexarray
    * improve choicerule generation a bit more to cover more cases
    * harden testcase parser against repos being added too late
    * support python-3.10
    * check /var/lib/rpm macro in rpmdb code
  - new features:
    * handle default/visible/langonly attributes in comps parser
    * support multiple collections in updateinfo parser
    * add '-D' option in rpmdb2solv to set the dbpath


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.19-1
changelog:
  - Update to 0.7.19
  - repo_add_conda: add flag to skip v2 packages
  - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt
  - fix error handling in solv_xfopen_fd()
  - fix memory leaks


author: Lumír Balhar <lbalhar@redhat.com> - 5.1.1-7
changelog:
  - Add upstream patch to solve build-time warning
  - Move patches to dist-git
  - Resolves: rhbz#1639348


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.44.0-4
changelog:
  - Autodetect backing format for qemu-img create -b
  - Move appliance to separate subpackage
  - Read rpm database through librpm
    resolves: rhbz#2013916, rhbz#1989520, rhbz#1836094


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.28-188
changelog:
  - CVE-2022-23218, CVE-2022-23219: Fix buffer overflows in sunrpc clnt_create
    for "unix" and svcunix_create (#2045063).


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.8-0.1.ea
changelog:
  - Update to jdk-11.0.15.0+8
  - Update release notes to 11.0.15.0+8
  - Switch to EA mode for 11.0.15 pre-release builds.
  - Rebase RH1996182 FIPS patch after JDK-8254410
  - Related: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-1
changelog:
  - Update to jdk-11.0.15.0+9
  - Update release notes to 11.0.15.0+9
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
  - Resolves: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.9-2
changelog:
  - Remove security items from release notes that were only in 17u and N/A for 11u
  - Related: rhbz#2073422


author: Karel Zak <kzak@redhat.com> 2.32.1-28
changelog:
  - fix #1906157 - after su from root to a normal user mesg is unable to show current status
  - fix #1917852 - findmnt: add option to list all fs-independent flags
  - fix #1922299 - throws error using /sbin/nologin: invalid option -- 'c'
  - fix #1940607 - lsblk sometimes returns block devices in wrong order with --pairs
  - fix #1919529 - [RFE] RHEL-8: Support option flags with mount(8) --bind
  - fix #1946921 - RHEL8: mount --rbind -o rprivate doesn't do recursive bind mount


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-5
changelog:
  - Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
  - Resolves: rhbz#2018189


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-6
changelog:
  - Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode
  - Resolves: rhbz#2055396


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.5-0.1.ea
changelog:
  - Update to jdk-17.0.3.0+5
  - Update release notes to 17.0.3.0+5
  - Switch to EA mode for 17.0.3 pre-release builds.
  - Add JDK-8283911 to fix bad DEFAULT_PROMOTED_VERSION_PRE value
  - Related: rhbz#2073422


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.6-1
changelog:
  - April 2022 security update to jdk 17.0.3+6
  - Update to jdk-17.0.3.0+6 pre-release tarball (17usec.17.0.3+5-220408)
  - Add JDK-8284548 regression fix missing from pre-release tarball but in jdk-17.0.3+6/jdk-17.0.3-ga
  - Update release notes to 17.0.3.0+6
  - Add missing README.md and generate_source_tarball.sh
  - Introduce tests/tests.yml, based on the one in java-11-openjdk
  - Switch to GA mode for release
  - ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
  - Resolves: rhbz#2073575


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.6-2
changelog:
  - JDK-8275082 should be listed as also resolving JDK-8278008 & CVE-2022-21476
  - Related: rhbz#2073575


author: Than Ngo <than@redhat.com> - 3.16.0-1
changelog:
  - Resolves: #1919223, rebase to 3.16.0
  - Resolves: #1922195, Event Notification Support
  - Resolves: #1959936, Soft token does not check if an EC key is valid
  - Resolves: #1851104, import and export of secure key objects
  - Resolves: #1851106, openCryptoki ep11 token: protected key support
  - Resolves: #1851107, openCryptoki ep11 token: support attribute bound keys


author: Than Ngo <than@redhat.com> - 3.16.0-5
changelog:
  - Resolves: #1987256, pkcstok_migrate leaves options with multiple strings in opencryptoki.conf options without double-quotes


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-6
changelog:
  - Fix FIPS issues in native code and with initialisation of java.security.Security
  - Resolves: rhbz#2023378


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-7
changelog:
  - Separate crypto policy initialisation from FIPS initialisation, now they are no longer interdependent
  - Resolves: rhbz#2051590


author: Jiri Vanek <jvanek@redhat.com> - 1:17.0.2.0.8-8
changelog:
  - alternatives creation moved to posttrans
  - Thus fixing the old reisntall issue:
  - https://bugzilla.redhat.com/show_bug.cgi?id=1200302
  - https://bugzilla.redhat.com/show_bug.cgi?id=1976053
  - Resolves: rhbz#2008200


author: Jiri Vanek <jvanek@redhat.com> - 1:17.0.2.0.8-10
changelog:
  - Storing and restoring alterntives during update manually
  - Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and select (as auto) system JDK/JRE
  -- The move of alternatives creation to posttrans to fix:
  -- Bug 1200302 - dnf reinstall breaks alternatives
  -- Had caused the alternatives to be removed, and then created again,
  -- instead of being added, and then removing the old, and thus persisting
  -- the selection in family
  -- Thus this fix, is storing the family of manually selected master, and if
  -- stored, then it is restoring the family of the master
  - Resolves: rhbz#2008200


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-12
changelog:
  - Detect NSS at runtime for FIPS detection
  - Turn off build-time NSS linking and go back to an explicit Requires on NSS
  - Resolves: rhbz#2051605


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:17.0.2.0.8-13
changelog:
  - Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
    secmod.db file as part of nss
  - Resolves: rhbz#2023536


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.2.0.8-15
changelog:
  - Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode
  - Resolves: rhbz#2052070


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.1.1.el8_5]
changelog:
  - lib/timerqueue: Rely on rbtree semantics for next timer (Phil Auld) [2014677 2007099] {CVE-2021-20317}
  - mm/hmm: make HMM_MIRROR an implicit option (Rafael Aquini) [2017519 1998534]
  - mm/hmm: allow HMM_MIRROR on all architectures with MMU (Rafael Aquini) [2017519 1998534]
  - mm: don't select MIGRATE_VMA_HELPER from HMM_MIRROR (Rafael Aquini) [2017519 1998534]
  - mm: sort out the DEVICE_PRIVATE Kconfig mess (Rafael Aquini) [2017519 1998534]
  - ceph: skip existing superblocks that are blocklisted or shut down when mounting (Jeffrey Layton) [2017071 2011462]
  - redhat: switch release to zstream (Bruno Meneguele)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.2.1.el8_5]
changelog:
  - tipc: fix size validations for the MSG_CRYPTO type (Bruno Meneguele) [2020506 2020507] {CVE-2021-43267}
  - net: Fix skb->csum update in inet_proto_csum_replace16(). (Balazs Nemeth) [2005981 1975193]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.3.1.el8_5]
changelog:
  - net-sysfs: try not to restart the syscall if it will fail eventually (Antoine Tenart) [2021165 2016005]
  - ovl: fix missing negative dentry check in ovl_rename() (Miklos Szeredi) [2016378 2010887 2013318] {CVE-2021-20321}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.4.1.el8_5]
changelog:
  - [RHEL8.6 BZ 1849234] cifs: report error instead of invalid when revalidating a dentry fails (Ronnie Sahlberg) [2017177 1849234]
  - kthread: Fix PF_KTHREAD vs to_kthread() race (Waiman Long) [2010333 2001497]
  - sched/fair: Ignore percpu threads for imbalance pulls (Waiman Long) [2010333 2001497]
  - kthread: Extract KTHREAD_IS_PER_CPU (Waiman Long) [2010333 2001497]
  - sched: Optimize finish_lock_switch() (Waiman Long) [2010333 2001497]
  - sched/hotplug: Ensure only per-cpu kthreads run during hotplug (Waiman Long) [2010333 2001497]
  - sched: Fix balance_callback() (Waiman Long) [2010333 2001497]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.6.1.el8_5]
changelog:
  - x86/Kconfig: Do not enable AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT automatically (Prarit Bhargava) [2024678 2021219]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.7.1.el8_5]
changelog:
  - sched: Fix CPU hotplug / tighten is_per_cpu_kthread() (Waiman Long) [2026450 2024869]
  - sched: Prepare to use balance_push in ttwu() (Waiman Long) [2026450 2024869]
  - sched: Don't run cpu-online with balance_push() enabled (Waiman Long) [2026450 2024869]
  - workqueue: Tag bound workers with KTHREAD_IS_PER_CPU (Waiman Long) [2026450 2024869]
  - workqueue: Use cpu_possible_mask instead of cpu_active_mask to break affinity (Waiman Long) [2026450 2024869]
  - sched: Fix hotplug vs CPU bandwidth control (Waiman Long) [2026450 2024869]
  - workqueue: Manually break affinity on hotplug (Waiman Long) [2026450 2024869]
  - sched/hotplug: Consolidate task migration on CPU unplug (Waiman Long) [2026450 2024869]
  - sched/core: Wait for tasks being pushed away on hotplug (Waiman Long) [2026450 2024869]


author: Parag Nemade <pnemade AT redhat DOT com> - 0.31.1-53
changelog:
  - Resolves: CVE-2019-19004 : integer overflow in input-bmp.c
  - Resolves: CVE-2019-19005 : fix bitmap double free in main.c


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-10.1
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985027)


author: Omair Majid <omajid@redhat.com> - 3.1.114-2
changelog:
  - Update to .NET SDK 3.1.114 and Runtime 3.1.14
  - Add dotnet-sdk-3.1-source-built-artifacts subpackage
  - Resolves: RHBZ#1946721


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.1-0.3.ea
changelog:
  - Remove explicit compiler flags which should be handled by the upstream build
    (-std=gnu++98, -fno-delete-null-pointer-checks, -fno-lifetime-dse)
  - Resolves: rhbz#1966234


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.2-0.1.ea
changelog:
  - Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics.
  - Remove restriction on disabling product build, as debug packages no longer have javadoc packages.
  - Resolves: rhbz#1966234


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.12.0.4-0.0.ea
changelog:
  - Update to jdk-11.0.12.0+4
  - Update release notes to 11.0.12.0+4
  - Correct bug ID JDK-8264846 to intended ID of JDK-8264848
  - Resolves: rhbz#1967374


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-6
changelog:
  - Resolves: rhbz#1980800 allow convert to csv to write each sheet to
    separate file
  - Resolves: rhbz#1992695 two style tags where there should be one


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-7
changelog:
  - Resolves: rhbz#2013858 CVE-2021-25633
  - Resolves: rhbz#2014215 CVE-2021-25634
  - Resolves: rhbz#2014209 CVE-2021-25635


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-9
changelog:
  - Related: rhbz#2029810 set NoDisplay=true for .desktop on s390x/aarch64
  - Related: rhbz#2029810 don't Require any vclplug for s390x/aarch64


author: Jan Grulich <jgrulich@redhat.com> - 0.27.3-3
changelog:
  - Fix heap-based buffer overflow vulnerability in jp2image.cpp that may lead to DoS
    Resolves: bz#1990355


author: Lukas Czerner <lczerner@redhat.com> 1.45.4-1
changelog:
  - Rebase to the release 1.45.4 (#1783777)
  - provide rhel6/7 compatible fs_type in mke2fs.conf (#1780279)
  - fix crafted ext4 partition leads to out-of-bounds write (#1768709)
  - include note about supported rhel8 features and options (#1788573)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.40.1-43
changelog:
  - Fixed races during pdf documentation build which should build docs correctly
    Related: CVE-2020-18032


author: Filip Januš <fjanus@redhat.com> 5.3.28-42
changelog:
  - Apply the previous change only on aarch64 to limit the risk of unwanted impact
  - Resolves: #1992402


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.5.1.el8_4]
changelog:
  - gfs2: report "already frozen/thawed" errors (Bob Peterson) [1961849 1932236]
  - gfs2: move freeze glock outside the make_fs_rw and _ro functions (Bob Peterson) [1961849 1932236]
  - gfs2: Add common helper for holding and releasing the freeze glock (Bob Peterson) [1961849 1932236]
  - gfs2: in signal_our_withdraw wait for unfreeze of _this_ fs only (Bob Peterson) [1961849 1932236]
  - gfs2: Don't freeze the file system during unmount (Bob Peterson) [1961849 1932236]
  - gfs2: Fix regression in freeze_go_sync (Bob Peterson) [1961849 1932236]
  - gfs2: The freeze glock should never be frozen (Bob Peterson) [1961849 1932236]
  - gfs2: When freezing gfs2, use GL_EXACT and not GL_NOCACHE (Bob Peterson) [1961849 1932236]
  - gfs2: read-only mounts should grab the sd_freeze_gl glock (Bob Peterson) [1961849 1932236]
  - gfs2: freeze should work on read-only mounts (Bob Peterson) [1961849 1932236]
  - gfs2: Abort gfs2_freeze if io error is seen (Bob Peterson) [1961849 1932236]
  - CI: Disable result checking for realtime check (Veronika Kabatova)
  - CI: Explicitly disable result checking for private CI (Veronika Kabatova)
  - CI: Rename variable (Veronika Kabatova)
  - CI: Update builder containers (Veronika Kabatova)


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.6.1.el8_4]
changelog:
  - openvswitch: fix stack OOB read while fragmenting IPv4 packets (Davide Caratti) [1963940 1924608]
  - net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packets (Davide Caratti) [1963940 1924608]
  - net/sched: act_ct: fix wild memory access when clearing fragments (Davide Caratti) [1963940 1924608]
  - net: Treat __napi_schedule_irqoff() as __napi_schedule() on PREEMPT_RT (Ivan Vecera)
  - redhat/configs: Add CONFIG_SYSTEM_REVOCATION_KEYS and CONFIG_SYSTEM_REVOCATION_LIST (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: add 'x509_revocation_list' to gitignore (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - integrity: Load mokx variables into the blacklist keyring (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: Add ability to preload revocation certs (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: Move load_system_certificate_list to a common function (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - certs: Add EFI_CERT_X509_GUID support for dbx entries (Vladis Dronov) [1965270 1893793] {CVE-2020-26541}
  - net/sched: cls_api: increase max_reclassify_loop (Davide Caratti) [1965148 1955136]
  - dm writecache: fix performance degradation in ssd mode (Mike Snitzer) [1962241 1961859]
  - scsi: fnic: Use scsi_host_busy_iter() to traverse commands (Ewan D. Milne) [1961705 1949250]
  - scsi: fnic: Kill 'exclude_id' argument to fnic_cleanup_io() (Ewan D. Milne) [1961705 1949250]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.7.1.el8_4]
changelog:
  - net: zero-initialize tc skb extension on allocation (Ivan Vecera) [1965457 1946986]
  - net/sched: cls_flower: fix only mask bit check in the validate_ct_state (Ivan Vecera) [1965457 1946986]
  - net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb (Ivan Vecera) [1965457 1946986]
  - net/sched: act_api: fix miss set post_ct for ovs after do conntrack in act_ct (Ivan Vecera) [1965457 1946986]
  - net/sched: cls_flower: validate ct_state for invalid and reply flags (Ivan Vecera) [1965457 1946986]
  - flow_dissector: fix TTL and TOS dissection on IPv4 fragments (Paolo Abeni) [1963952 1950288]
  - Revert "sctp: Fix SHUTDOWN CTSN Ack in the peer restart case" (Xin Long) [1965632 1953839]
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_b (Xin Long) [1965632 1953839]
  - sctp: do asoc update earlier in sctp_sf_do_dupcook_a (Xin Long) [1965632 1953839]
  - Bluetooth: verify AMP hci_chan before amp_destroy (Gopal Tiwari) [1962544 1962546] {CVE-2021-33034}
  - x86/kvm: Unify kvm_pv_guest_cpu_reboot() with kvm_guest_cpu_offline() (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Disable all PV features on crash (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Disable kvmclock on all CPUs on shutdown (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Teardown PV features on boot CPU as well (Lenny Szubowicz) [1964930 1934273]
  - x86/kvm: Fix pr_info() for async PF setup/teardown (Lenny Szubowicz) [1964930 1934273]
  - net/sched: act_ct: Fix ct template allocation for zone 0 (Marcelo Ricardo Leitner) [1965150 1881824]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.8.1.el8_4]
changelog:
  - iavf: amend removal of MODULE_VERSION (Stefan Assmann) [1969925 1955738]
  - ixgbe: Amend commit acf03026ec5a to include a version string in module info. (Ken Cox) [1969922 1955759]
  - i40e: amend removal of MODULE_VERSION (Stefan Assmann) [1969923 1955736]
  - redhat/configs: Add CONFIG_PINCTRL_EMMITSBURG (David Arcari) [1963984 1959506]
  - redhat/configs: Remove CONFIG_EMMITSBURG (David Arcari) [1963984 1959506]
  - netlink: add tracepoint at NL_SET_ERR_MSG (Marcelo Ricardo Leitner) [1972938 1956983]
  - Revert "[netdrv] net/intel: remove driver versions from Intel drivers" (Jonathan Toppins) [1969917 1955745]
  - Amends commit ea6244cc248b to include a version string in module info. (Ken Cox) [1969915 1955726]
  - Revert "[netdrv] net/broadcom: Clean broadcom code from driver versions" (Jonathan Toppins) [1969914 1955721]
  - ena: revert removal of MODULE_VERSION from ena (Petr Oros) [1969913 1955712]
  - fm10k: amend removal of MODULE_VERSION (Vladis Dronov) [1969910 1955730]
  - net/sched: act_ct: Offload connections with commit action (Marcelo Ricardo Leitner) [1968679 1965817]
  - netfilter: flowtable: Remove redundant hw refresh bit (Marcelo Ricardo Leitner) [1968679 1965817]


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.9.1.el8_4]
changelog:
  - ixgbevf: Amend commit acf03026ec5a to include a version in module info. (Ken Cox) [1969911 1955764]
  - CI: Merge configuration (Veronika Kabatova)
  - igc: amend removal of MODULE_VERSION (Corinna Vinschen) [1969921 1955755]
  - igb: amend removal of MODULE_VERSION (Corinna Vinschen) [1969919 1955748]
  - locking/qrwlock: Fix ordering in queued_write_lock_slowpath() (Waiman Long) [1964419 1950110]
  - scsi: qedf: Do not put host in qedf_vport_create() unconditionally (Nilesh Javali) [1974968 1899384]


author: Mark Wielaard <mjw@redhat.com> - 0.186-1
changelog:
  - Upgrade to upstream 0.186
    - debuginfod-client: Default $DEBUGINFOD_URLS is computed from
      drop-in files /etc/debuginfod/*.urls rather than
      hardcoded into the /etc/profile.d/debuginfod*
      scripts.
      Add $DEBUGINFOD_MAXSIZE and $DEBUGINFOD_MAXTIME settings
      for skipping large/slow transfers.
      Add $DEBUGINFOD_RETRY for retrying aborted lookups.
    - debuginfod: Supply extra HTTP response headers, describing
      archive/file names that satisfy the requested buildid content.
      Support -d :memory: option for in-memory databases.
      Protect against loops in federated server configurations.
      Add -r option to use -I/-X regexes for grooming stale files.
      Protect against wasted CPU from duplicate concurrent requests.
      Limit the duration of groom ops roughly to rescan (-t) times.
      Add --passive mode for serving from read-only database.
      Several other performance improvements & prometheus metrics.
    - libdw: Support for the NVIDIA Cuda line map extensions.
      DW_LNE_NVIDIA_inlined_call and DW_LNE_NVIDIA_set_function_name
      are defined in dwarf.h. New functions dwarf_linecontext and
      dwarf_linefunctionname.
    - translations: Update Japanese translation.


author: Omair Majid <omajid@redhat.com> - 3.1.416-4
changelog:
  - Update to .NET SDK 3.1.416 and Runtime 3.1.22
  - Resolves: RHBZ#2011820
  - Resolves: RHBZ#2003077
  - Resolves: RHBZ#2031428


author: Christine Caulfield <ccaulfie@redhat.com> - 1.22-1
changelog:
  Rebase to 1.22
    Resolves: rhbz#1999976

    * Wed Sep 23 2020 Christine Caulfield <ccaulfie@redhat.com> - 1.18-1
    Rebase to 1.18
    Resolves: rhbz#1855301


author: Tomas Orsava <torsava@redhat.com> - 2.6.0-5
changelog:
  - Require the Python interpreter directly instead of using the package name
  - Resolves: rhbz#1633617


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-7
changelog:
  - Resolves: rhbz#1634268 - ECP signature check fails with
                             LASSO_DS_ERROR_SIGNATURE_NOT_FOUND when
                             assertion signed instead of response


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-8
changelog:
  - Resolves: rhbz#1730018 - lasso includes "Destination" attribute in SAML
                             AuthnRequest populated with SP
                             AssertionConsumerServiceURL when ECP workflow
                             is used which leads to IdP-side errors


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-9
changelog:
  - Resolves: rhbz#1888195 - [RFE] release (built) python3-lasso pkg (coming
                             from lasso)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-10
changelog:
  - Resolves: rhbz#1951653 - CVE-2021-28091 lasso: XML signature wrapping
                             vulnerability when parsing SAML responses [rhel-8]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-11
changelog:
  - Bump release to force the package through OSCI as the previous
    build reached CI just in time for an outage
  - Related: rhbz#1888195 - [RFE] release (built) python3-lasso pkg (comingfrom lasso)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-12
changelog:
  - Fix a dead code issue in the signature wrapping patch
  - Resolves: rhbz#1951653 - CVE-2021-28091 lasso: XML signature wrapping
                             vulnerability when parsing SAML responses [rhel-8]


author: Nikola Forró <nforro@redhat.com> - 4.0.9-19
changelog:
  - Fix CVE-2020-35521 (#1945539)
  - Fix CVE-2020-35522 (#1945555)
  - Fix CVE-2020-35523 (#1945542)
  - Fix CVE-2020-35524 (#1945546)


author: Steve Dickson <steved@redhat.com> 2.3.3-42
changelog:
  - gssd: Add options to allow for the use of ~/.k5identity file (bz 1868087)
  - man: Correct gssd(8) description of rpc-timeout and context-timeout (bz 1908232)
  - exportfs: fix unexporting of '/' (bz 1944119)


author: Steve Dickson <steved@redhat.com> 2.3.3-44
changelog:
  - gssd: Deal with failed thread creation (bz 1981400)
  - gssd: Add timeout for upcall threads (bz 1981403)
  - gssd: Cleaned up debug messages (bz 1961056)
  - spec: Updated description of the nfs-utils rpm (bz 1981419)


author: Marek Polacek <polacek@redhat.com> 10.2.1-1
changelog:
  - GCC 10.2 release
  - add symlink to liblto_plugin.so in /usr/lib/bfd-plugins
  - disable -flto in %{optflags}, lto bootstrap will be enabled the GCC way
    later
  - require MPFR Library version 3.1.0 (or later)


author: Marek Polacek <polacek@redhat.com> 10.2.1-1.2
changelog:
  - avoid stack overflow in std::vector (PR libstdc++/94540, #1859670)
  - adjust some libstdc++_nonshared.a symbols
  - apply gcc10-libgfortran-compat-2.patch


author: Marek Polacek <polacek@redhat.com> 10.2.1-2
changelog:
  - update from Fedora gcc 10.2.1-2
  - emit debug info for C/C++ external function declarations used in the TU
    (PR debug/96383)
  - discard SHN_UNDEF global symbols from LTO debuginfo (PR lto/96385)
  - strip also -flto=auto from optflags


author: Marek Polacek <polacek@redhat.com> 10.2.1-8
changelog:
  - update from Fedora gcc 10.2.1-8 (#1878887)
  - emit DW_AT_declaration on declaration-only DIEs (#1897272, PR debug/97060)
  - add BuildRequires: make and Requires: make, the latter for -flto reasons


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.6-1
changelog:
  - Update to 3.9.6
  - Fix CVE-2021-29921: Improper input validation of octal strings in the ipaddress module
  Resolves: rhbz#1957458


author: Dodji Seketeli <dodji@redhat.com> - 2.4-1
changelog:
  - Update to 2.4 upstream tarball
  - Drop patches: cppcheck-1.83-tinyxml.patch, cppcheck-1.81-translations.patch, cppcheck-1.78-cfgdir.patch.
  - Bump BuildRequires for tinyxml2-devel to 2.6.0 at least.
  - Add BuildRequires pandoc.
  - There is no more bundled tinyxml in this new version of cppcheck.
  - Use the man/build-html.sh script to build the html version of the manual
  - Adjust $datadir/CppCheck to $datadir/Cppcheck.
  - Add $bindir/cppcheck*.qm files to the package.
  - Resolves: rhbz#1959478


author: Andrea Claudi <aclaudi@redhat.com> [5.12.0-1.el8]
changelog:
  - tc: f_flower: Add missing ct_state flags to usage description (Andrea Claudi) [1957243]
  - tc: f_flower: Add option to match on related ct state (Andrea Claudi) [1957243]


author: Andrea Claudi <aclaudi@redhat.com> [5.12.0-3.el8]
changelog:
  - tc: htb: improve burst error messages (Andrea Claudi) [1910745]
  - tc: u32: Fix key folding in sample option (Andrea Claudi) [1979425]
  - police: Fix normal output back to what it was (Andrea Claudi) [1981393]
  - police: Add support for json output (Andrea Claudi) [1981393]
  - police: add support for packet-per-second rate limiting (Andrea Claudi) [1981393]
  - Update kernel headers (Andrea Claudi) [1981393]
  - mptcp: add support for port based endpoint (Andrea Claudi) [1984733]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.0-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
  - Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
  - Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
  - Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
  - Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
  - Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
  - Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
  - Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
  - Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
  - Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
  - Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
  - Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
  - Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
  - Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
  - Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
  - Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
  - Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
  - Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
  - Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
  - Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
  - Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
  - Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
  - Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
  - Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
  - Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
  - Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
  - Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
  - Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
  - Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.30.0-11
changelog:
  - platform: preserve IPv6 multicast route added by kernel (rh #2007264)
  - cloud-setup: don't interfere with other subnets (rh #2007341)


author: Fernando Fernandez Mancera <ferferna@redhat.com> - 1:1.30.0-12
changelog:
  - initrd: set an IPv4 required-timeout of 20 seconds, to prefer IPv4
    over IPv6 for default connections (rh #1961666)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-11
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985028)


author: Marek Polacek <polacek@redhat.com> 10.3.1-1
changelog:
  - update from Fedora gcc 10.3.1-1 (#1929382)
  - drop gcc10-pr97060.patch
  - use --enable-cet
  - ship gcc-accel-nvptx-none-lto-dump
  - backport PR96939 fixes


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-9.1
changelog:
  - Resolves: rhbz#1949170 - pam_sss_gss.so doesn't work with large kerberos tickets [rhel-8.4.0.z]
  - Resolves: rhbz#1945656 - No gpo found and ad_gpo_implicit_deny set to True still permits user login [rhel-8.4.0.z]
  - Resolves: rhbz#1945655 - SSSD not detecting subdomain from AD forest (RHEL 8.3) [rhel-8.4.0.z]
  - Resolves: rhbz#1945654 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7 [rhel-8.4.0.z]
  - Resolves: rhbz#1942438 - Wrong default debug level of sssd tools [rhel-8.4.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-9.2
changelog:
  - Resolves: rhbz#1985456 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8.4.0.z]


author: Tomáš Mráz <tmraz@redhat.com> - 2:4.6-8
changelog:
  - properly audit group password change
  - do not add uid of a new (not yet added) user to the audit message
  - use lckpwdf() again to disable concurrent edits of databases by
    other applications
  - clarify chage manual page in regards to shadow and passwd
    inconsistency
  - fix minor issues in groupadd and login.defs manual pages
  - Ignore LOGIN_PLAIN_PROMPT variable in login.defs
  - force regeneration of getdate.c otherwise the date parsing fix
    is not applied


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-9
changelog:
  - do not mistake a regular user process for a namespaced one (#1788696)
  - add HOME_MODE support in login.defs (#1777718)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-12
changelog:
  - lib/sssd: redirect warning message to file (#1749001)
  - useradd: clarify valid usernames/groupnames (#1869432)
  - login.defs: link login specific information to its own package (#1804766)


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-15
changelog:
  - Creation of subid and subid-devel subpackages (#2013009)
  - libsubid: creation and nsswitch support
  - libsubid: don't print error messages on stderr by default
  - libsubid: libsubid_init return false if out of memory
  - libsubid: don't return owner in list_owner_ranges API call
  - libsubid: libsubid_init don't print messages on error
  - libsubid: fix newusers when nss provides subids
  - libsubid: make shadow_logfd not extern
  - useradd: fix SUB_UID_COUNT=0
  - man: mention NSS in new[ug]idmap manpages
  - man: clarify subid delegation


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.6-16
changelog:
  - getsubids: provide system binary and man page. Resolves: #2013016
  - groupdel: fix SIGSEGV when passwd does not exist. Resolves: #1986782


author: Petr Pisar <ppisar@redhat.com> - 8.42-5
changelog:
  - Fix CVE-2019-20838 (a subject buffer overread in JIT when UTF is disabled
    and \X or \R has a greater than 1 fixed quantifier) (bug #1852252)
  - Fix CVE-2020-14155 (an integer overflow when parsing numbers after "(?C"))
    (bug #1851552)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-4
changelog:
  - Fix FIPS issues in native code and with initialisation of java.security.Security
  - Resolves: rhbz#2021559


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-5
changelog:
  - Refactor build functions so we can build just HotSpot without any attempt at installation.
  - Sync gdb test with java-1.8.0-openjdk.
  - Improve architecture restrictions for the gdb test.
  - Replace -mstackrealign with -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4 on x86_32 for stack alignment
  - Explicitly list JIT architectures rather than relying on those with slowdebug builds
  - Disable the serviceability agent on Zero architectures even when the architecture itself is supported
  - Add backport of JDK-8257794 to fix bogus assert on slowdebug x86-32 Zero builds
  - Related: rhbz#2052809


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.0.9-6
changelog:
  - Separate crypto policy initialisation from FIPS initialisation, now they are no longer interdependent
  - Resolves: rhbz#2052816


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.1.1-1
changelog:
  - Update to jdk-11.0.14.1+1
  - Update release notes to 11.0.14.1+1
  - Require tzdata 2021e as of JDK-8275766.
  - Resolves: rhbz#2052809
  - Resolves: rhbz#1966234


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.14.1.1-6
changelog:
  - Detect NSS at runtime for FIPS detection
  - Turn off build-time NSS linking and go back to an explicit Requires on NSS
  - Resolves: rhbz#2052827


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-53.el8
changelog:
  - kvm-virtiofsd-Whitelist-fchmod.patch [bz#1967914]
  - kvm-spapr-Fix-EEH-capability-issue-on-KVM-guest-for-PCI-.patch [bz#1957866]
  - kvm-Compress-lines-for-immediate-return.patch [bz#1970912]
  - kvm-file-posix-Handle-EINVAL-fallocate-return-value.patch [bz#1970912]
  - Resolves: bz#1967914
    ([virtio-fs] virtiofsd quit when coping file to a folder in virtio-fs mounted volume(windows guest))
  - Resolves: bz#1957866
    (RHEL8.4 - EEH capability disabled on KVM guest and recovery of PCI passthru device fails(CX5 / mlx5_core) (qemu-kvm))
  - Resolves: bz#1970912
    (Deployment fails with "Invalid or missing agent token received")


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-54.el8
changelog:
  - kvm-redhat-Fix-unversioned-Obsoletes-warning.patch [bz#1967329]
  - Resolves: bz#1967329
    (Make qemu-kvm use versioned obsoletes for qemu-kvm-ma and qemu-kvm-rhev)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-55.el8
changelog:
  - kvm-net-introduce-qemu_receive_packet.patch [bz#1932917]
  - kvm-e1000-switch-to-use-qemu_receive_packet-for-loopback.patch [bz#1932917]
  - kvm-dp8393x-switch-to-use-qemu_receive_packet-for-loopba.patch [bz#1932917]
  - kvm-sungem-switch-to-use-qemu_receive_packet-for-loopbac.patch [bz#1932917]
  - kvm-tx_pkt-switch-to-use-qemu_receive_packet_iov-for-loo.patch [bz#1932917]
  - kvm-rtl8139-switch-to-use-qemu_receive_packet-for-loopba.patch [bz#1932917]
  - kvm-pcnet-switch-to-use-qemu_receive_packet-for-loopback.patch [bz#1932917]
  - kvm-cadence_gem-switch-to-use-qemu_receive_packet-for-lo.patch [bz#1932917]
  - kvm-lan9118-switch-to-use-qemu_receive_packet-for-loopba.patch [bz#1932917]
  - Resolves: bz#1932917
    (CVE-2021-3416 virt:rhel/qemu-kvm: QEMU: net: infinite loop in loopback mode may lead to stack overflow)


author: Miroslav Rezanina <mrezanin@redhat.com> - 4.2.0-56
changelog:
  - kvm-glib-compat-add-g_unix_get_passwd_entry_qemu.patch [bz#1967716]
  - kvm-qga-add-ssh-add-remove-authorized-keys.patch [bz#1967716]
  - kvm-qga-add-reset-argument-to-ssh-add-authorized-keys.patch [bz#1967716]
  - kvm-qga-add-ssh-get-authorized-keys.patch [bz#1967716]
  - kvm-Add-mtod_check.patch [bz#1970819 bz#1970835 bz#1970843 bz#1970853]
  - kvm-bootp-limit-vendor-specific-area-to-input-packet-mem.patch [bz#1970819 bz#1970835 bz#1970843 bz#1970853]
  - kvm-bootp-check-bootp_input-buffer-size.patch [bz#1970819]
  - kvm-upd6-check-udp6_input-buffer-size.patch [bz#1970835]
  - kvm-tftp-check-tftp_input-buffer-size.patch [bz#1970843]
  - kvm-tftp-introduce-a-header-structure.patch [bz#1970819 bz#1970835 bz#1970843 bz#1970853]
  - kvm-udp-check-upd_input-buffer-size.patch [bz#1970853]
  - kvm-Fix-DHCP-broken-in-libslirp-v4.6.0.patch [bz#1970819 bz#1970835 bz#1970843 bz#1970853]
  - kvm-net-check-if-the-file-descriptor-is-valid-before-usi.patch [bz#1982134]
  - kvm-net-detect-errors-from-probing-vnet-hdr-flag-for-TAP.patch [bz#1982134]
  - Resolves: bz#1967716
    (RFE: rebuild guest agent to include public ssh injection api support)
  - Resolves: bz#1970819
    (CVE-2021-3592 virt:rhel/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information disclosure (bootp) [rhel-8])
  - Resolves: bz#1970835
    (CVE-2021-3593 virt:rhel/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp6) [rhel-8])
  - Resolves: bz#1970843
    (CVE-2021-3595 virt:rhel/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information disclosure (tftp) [rhel-8])
  - Resolves: bz#1970853
    (CVE-2021-3594 virt:rhel/qemu-kvm: QEMU: slirp: invalid pointer initialization may lead to information disclosure (udp) [rhel-8])
  - Resolves: bz#1982134
    (QEMU core dump while booting guest with a non-exist fd on tap)


author: Miroslav Rezanina <mrezanin@redhat.com> - 4.2.0-57
changelog:
  - kvm-aio-wait-delegate-polling-of-main-AioContext-if-BQL-.patch [bz#1969848]
  - kvm-async-use-explicit-memory-barriers.patch [bz#1969848]
  - Resolves: bz#1969848
    (qemu-img convert hangs on aarch64)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-58.el8
changelog:
  - kvm-virtiofsd-Disable-remote-posix-locks-by-default.patch [bz#1967496]
  - kvm-virtiofsd-Fix-the-help-message-of-posix-lock.patch [bz#1967496]
  - Resolves: bz#1967496
    ([virtio-fs] nfs/xfstest generic/089 generic/478 generic/632 failed)


author: Jon Maloy <jmaloy@redhat.com> - 4.2.0-59
changelog:
  - kvm-scsi-make-io_timeout-configurable.patch [bz#1994041]
  - Resolves: bz#1994041
    (qemu-kvm scsi: change default passthrough timeout to non-infinite)


author: Jon Maloy <jmaloy@redhat.com> - 4.2.0-59.el8_5
changelog:
  - kvm-hw-scsi-scsi-disk-MODE_PAGE_ALLS-not-allowed-in-MODE.patch [bz#2025605]
  - kvm-e1000-fix-tx-re-entrancy-problem.patch [bz#2025011]
  - Resolves: bz#2025605
    (CVE-2021-3930 virt:rhel/qemu-kvm: QEMU: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c [rhel-8.5.0.z])
  - Resolves: bz#2025011
    (CVE-2021-20257 virt:rhel/qemu-kvm: QEMU: net: e1000: infinite loop while processing transmit descriptors [rhel-8.5.0.z])


author: Jon Maloy <jmaloy@redhat.com> - 4.2.0-59.el8_5.2
changelog:
  - kvm-virtiofsd-Drop-membership-of-all-supplementary-group.patch [bz#2048627]
  - Resolves: bz#2048627
    (CVE-2022-0358 virt:rhel/qemu-kvm: QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405 [rhel-8.5.0.z])


author: Jon Maloy <jmaloy@redhat.com> - 4.2.0-60.el8_5.2
changelog:
  - kvm-target-i386-Declare-constants-for-XSAVE-offsets.patch [bz#2065239]
  - kvm-target-i386-Consolidate-the-X86XSaveArea-offset-chec.patch [bz#2065239]
  - kvm-target-i386-Clarify-the-padding-requirements-of-X86X.patch [bz#2065239]
  - kvm-target-i386-Pass-buffer-and-length-to-XSAVE-helper.patch [bz#2065239]
  - kvm-target-i386-Make-x86_ext_save_areas-visible-outside-.patch [bz#2065239]
  - kvm-target-i386-Observe-XSAVE-state-area-offsets.patch [bz#2065239]
  - kvm-target-i386-Populate-x86_ext_save_areas-offsets-usin.patch [bz#2065239]
  - Resolves: bz#2065239
    (KVM Fedora 35 guest x86 programs randomly crash in signal handler [rhel-8.5.0.z])


author: Nikola Forró <nforro@redhat.com> - 0.3.15-1
changelog:
  - Rebase to version 0.3.15
  - Use gcc-toolset-11 to benefit from POWER 10 optimizations
    resolves: #1983218


author: Nikola Forró <nforro@redhat.com> - 0.3.15-3
changelog:
  - Fix missing header files in openblas-devel subpackage by enabling
    gcc-toolset-11 in %install as well
    related: #1983218


author: Phil Sutter <psutter@redhat.com> [1.1.5-5.el8]
changelog:
  - set: expose nftnl_set_elem_nlmsg_build() (Phil Sutter) [2040754]
  - expr: dynset: release stateful expression from .free path (Phil Sutter) [2040478]
  - set_elem: missing set and build for NFTNL_SET_ELEM_EXPR (Phil Sutter) [2040478]


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-51.el8
changelog:
  - kvm-linux-headers-Add-VFIO_CCW_REQ_IRQ_INDEX.patch [bz#1940450]
  - kvm-vfio-ccw-Connect-the-device-request-notifier.patch [bz#1940450]
  - kvm-pc-bios-s390-ccw-fix-off-by-one-error.patch [bz#1942880]
  - kvm-pc-bios-s390-ccw-break-loop-if-a-null-block-number-i.patch [bz#1942880]
  - kvm-pc-bios-s390-ccw-don-t-try-to-read-the-next-block-if.patch [bz#1942880]
  - Resolves: bz#1940450
    (RHEL8.5 - Mediated Device already in use by same domain we are booting (vfio-ccw/Multipath Testing) (kvm) - qemu-kvm part (also has kernel and libvirt parts))
  - Resolves: bz#1942880
    (RHEL8.4 Nightly[0322] - KVM guest fails to find zipl boot menu index (qemu-kvm))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-52.el8
changelog:
  - kvm-file-posix-Mitigate-file-fragmentation-with-extent-s.patch [bz#1877163]
  - kvm-block-file-posix-Fix-problem-with-fallocate-PUNCH_HO.patch [bz#1944861]
  - kvm-spapr-Remove-stale-comment-about-power-saving-LPCR-b.patch [bz#1969768]
  - kvm-spapr-Set-LPCR-to-current-AIL-mode-when-starting-a-n.patch [bz#1969768]
  - Resolves: bz#1877163
    ([FJ 8.3 Bug] The progress bar of the "virt-clone --nonsparse" command shows the progress rate exceeding 100%.)
  - Resolves: bz#1944861
    (Qemu-img convert fails when source image is on gpfs)
  - Resolves: bz#1969768
    ([ppc64le] Hotplug vcpu device hit call trace:[qemu output] KVM: unknown exit, hardware reason 7fff9ce87ed8)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.1
changelog:
  - Resolves: rhbz#2014460 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing [rhel-8.5.0.z]


author: Charalampos Stratakis <cstratak@redhat.com> - 5.1.1-18
changelog:
  - Fixup for CVE-2022-22817
  - Security fixes for CVE-2022-22815, CVE-2022-22816
  Resolves: rhbz#2042511, rhbz#2042522


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.56.4-10
changelog:
  - Fix CVE-2021-27218
    Resolves: #1939072
  - Fix CVE-2021-27219
    Resolves: #1939108
  - Fix CVE-2021-28153
    Resolves: #1939118


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.56.4-13
changelog:
  - Rename and consolidate existing patches for better maintainability
  - Refresh CVE-2021-27219 patcheset, using better-targeted fixes
    Resolves: #1939108


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-2
changelog:
  - kvm-redhat-Add-rhel8.6.0-machine-type-for-s390x.patch [bz#2005325]
  - kvm-redhat-Define-pseries-rhel8.6.0-machine-type.patch [bz#2031041]
  - Resolves: bz#2005325
    (Fix CPU Model for new IBM Z Hardware - qemu part)
  - Resolves: bz#2031041
    (Add rhel-8.6.0 machine types for RHEL 8.6 [ppc64le])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-4
changelog:
  - kvm-hw-arm-virt-Register-iommu-as-a-class-property.patch [bz#2031039]
  - kvm-hw-arm-virt-Register-its-as-a-class-property.patch [bz#2031039]
  - kvm-hw-arm-virt-Rename-default_bus_bypass_iommu.patch [bz#2031039]
  - kvm-hw-arm-virt-Add-8.6-machine-type.patch [bz#2031039]
  - kvm-hw-arm-virt-Check-no_tcg_its-and-minor-style-changes.patch [bz#2031039]
  - kvm-rhel-machine-types-x86-set-prefer_sockets.patch [bz#2029582]
  - Resolves: bz#2031039
    (Add rhel-8.6.0 machine types for RHEL 8.6 [aarch64])
  - Resolves: bz#2029582
    ([8.6] machine types: 6.2: Fix prefer_sockets)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-5
changelog:
  - kvm-acpi-validate-hotplug-selector-on-access.patch [bz#2036580]
  - kvm-x86-Add-q35-RHEL-8.6.0-machine-type.patch [bz#2031035]
  - Resolves: bz#2036580
    (CVE-2021-4158 virt:rhel/qemu-kvm: QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c [rhel-8])
  - Resolves: bz#2031035
    (Add rhel-8.6.0 machine types for RHEL 8.6 [x86])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-6
changelog:
  - kvm-virtiofsd-Drop-membership-of-all-supplementary-group.patch [bz#2046198]
  - kvm-softmmu-fix-device-deletion-events-with-device-JSON-.patch [bz#2033279]
  - kvm-block-backend-prevent-dangling-BDS-pointers-across-a.patch [bz#2021778 bz#2036178]
  - kvm-iotests-stream-error-on-reset-New-test.patch [bz#2021778 bz#2036178]
  - kvm-block-rbd-fix-handling-of-holes-in-.bdrv_co_block_st.patch [bz#2037135]
  - kvm-block-rbd-workaround-for-ceph-issue-53784.patch [bz#2037135]
  - Resolves: bz#2046198
    (CVE-2022-0358 virt:av/qemu-kvm: QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405 [rhel-8.6])
  - Resolves: bz#2033279
    ([wrb][qemu-kvm 6.2] The hot-unplugged device can not be hot-plugged back)
  - Resolves: bz#2021778
    (Qemu core dump when do full backup during system reset)
  - Resolves: bz#2036178
    (Qemu core dumped when do block-stream to a snapshot node on non-enough space storage)
  - Resolves: bz#2037135
    (Booting from Local Snapshot Core Dumped Whose Backing File Is Based on RBD)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-7
changelog:
  - kvm-numa-Enable-numa-for-SGX-EPC-sections.patch [bz#1518984]
  - kvm-numa-Support-SGX-numa-in-the-monitor-and-Libvirt-int.patch [bz#1518984]
  - kvm-doc-Add-the-SGX-numa-description.patch [bz#1518984]
  - kvm-Enable-SGX-RH-Only.patch [bz#1518984]
  - kvm-qapi-Cleanup-SGX-related-comments-and-restore-sectio.patch [bz#1518984]
  - kvm-block-io-Update-BSC-only-if-want_zero-is-true.patch [bz#2041480]
  - kvm-iotests-block-status-cache-New-test.patch [bz#2041480]
  - Resolves: bz#1518984
    ([Intel 8.6 Feat] qemu-kvm: SGX 1.5 (SGX1 + Flexible Launch Control) support)
  - Resolves: bz#2041480
    ([incremental_backup] Inconsistent block status reply in qemu-nbd)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-8
changelog:
  - kvm-block-nbd-Delete-reconnect-delay-timer-when-done.patch [bz#2035185]
  - kvm-block-nbd-Assert-there-are-no-timers-when-closed.patch [bz#2035185]
  - kvm-iotests.py-Add-QemuStorageDaemon-class.patch [bz#2035185]
  - kvm-iotests-281-Test-lingering-timers.patch [bz#2035185]
  - kvm-block-nbd-Move-s-ioc-on-AioContext-change.patch [bz#2035185]
  - kvm-iotests-281-Let-NBD-connection-yield-in-iothread.patch [bz#2035185]
  - Resolves: bz#2035185
    (Qemu core dump when start guest with nbd node or do block jobs to nbd node)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-9
changelog:
  - kvm-Revert-redhat-Add-hw_compat_4_2_extra-and-apply-to-u.patch [bz#2061856]
  - kvm-Revert-redhat-Enable-FDC-device-for-upstream-machine.patch [bz#2061856]
  - kvm-Revert-redhat-Expose-upstream-machines-pc-4.2-and-pc.patch [bz#2061856]
  - kvm-hw-virtio-vdpa-Fix-leak-of-host-notifier-memory-regi.patch [bz#2027208]
  - kvm-pci-expose-TYPE_XIO3130_DOWNSTREAM-name.patch [bz#2054597]
  - kvm-acpi-pcihp-pcie-set-power-on-cap-on-parent-slot.patch [bz#2054597]
  - Resolves: bz#2061856
    (Revert IBM-specific Ubuntu-compatibility machine type for 8.6-AV GA)
  - Resolves: bz#2027208
    ([virtual network][vDPA] qemu crash after hot unplug vdpa device)
  - Resolves: bz#2054597
    (Do operation to disk will hang in the guest of target host after hotplugging and migrating)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-10
changelog:
  - kvm-vmxcap-Add-5-level-EPT-bit.patch [bz#2056986]
  - kvm-i386-Add-Icelake-Server-v6-CPU-model-with-5-level-EP.patch [bz#2056986]
  - kvm-acpi-fix-QEMU-crash-when-started-with-SLIC-table.patch [bz#2059311]
  - kvm-tests-acpi-whitelist-expected-blobs-before-changing-.patch [bz#2059311]
  - kvm-tests-acpi-add-SLIC-table-test.patch [bz#2059311]
  - kvm-tests-acpi-SLIC-update-expected-blobs.patch [bz#2059311]
  - kvm-tests-acpi-manually-pad-OEM_ID-OEM_TABLE_ID-for-test.patch [bz#2059311]
  - kvm-tests-acpi-whitelist-nvdimm-s-SSDT-and-FACP.slic-exp.patch [bz#2059311]
  - kvm-acpi-fix-OEM-ID-OEM-Table-ID-padding.patch [bz#2059311]
  - kvm-tests-acpi-update-expected-blobs.patch [bz#2059311]
  - kvm-tests-acpi-test-short-OEM_ID-OEM_TABLE_ID-values-in-.patch [bz#2059311]
  - kvm-rhel-workaround-for-lack-of-binary-patches-in-SRPM.patch [bz#2059311]
  - Resolves: bz#2056986
    (Win11 (q35+edk2) guest broke after install wsl2 through 'wsl --install -d Ubuntu-20.04')
  - Resolves: bz#2059311
    (Guest can not start with SLIC acpi table)


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-11
changelog:
  - kvm-target-i386-properly-reset-TSC-on-reset.patch [bz#1975840]
  - Resolves: bz#1975840
    (Windows guest hangs after updating and restarting from the guest OS)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.2
changelog:
  - Resolves: rhbz#2018440 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest) [rhel-8.5.0.z]
  - Resolves: rhbz#2016923 - autofs lookups for unknown mounts are delayed for 50s [rhel-8.5.0.z]
  - Resolves: rhbz#2021499 - Make backtrace less "chatty" (avoid duplicate backtraces) [rhel-8.5.0.z]
  - Resolves: rhbz#2013379 - Lookup with fully-qualified name does not work with 'cache_first = True' [rhel-8.5.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.3
changelog:
  - Resolves: rhbz#2028828 - pam responder does not call initgroups to refresh the user entry [rhel-8.5.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.4
changelog:
  - Resolves: rhbz#2030651 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries [rhel-8.5.0.z]
  - Resolves: rhbz#2035285 - AD Domain in the AD Forest Missing after sssd latest update [rhel-8.5.0.z]


author: Jan Grulich <jgrulich@redhat.com> - 0.27.5-1
changelog:
  - Exiv2 0.27.5
    Resolves: bz#2018422

    Fix stack exhaustion issue in the printIFDStructure function leading to DoS
    Resolves: bz#2003673


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-48.el8_4
changelog:
  - kvm-net-remove-an-assert-call-in-eth_get_gso_type.patch [bz#1939494]
  - kvm-libqos-usb-hcd-ehci-use-32-bit-write-for-config-regi.patch [bz#1944621]
  - kvm-libqos-pci-pc-use-32-bit-write-for-EJ-register.patch [bz#1944621]
  - kvm-memory-Revert-memory-accept-mismatching-sizes-in-mem.patch [bz#1944621]
  - kvm-acpi-accept-byte-and-word-access-to-core-ACPI-regist.patch [bz#1944621]
  - kvm-xhci-fix-valid.max_access_size-to-access-address-reg.patch [bz#1944621]
  - kvm-softmmu-memory-Log-invalid-memory-accesses.patch [bz#1944621]
  - kvm-hw-intc-arm_gic-Fix-interrupt-ID-in-GICD_SGIR-regist.patch [bz#1952986]
  - Resolves: bz#1939494
    (CVE-2020-27617 virt:rhel/qemu-kvm: QEMU: net: an assert failure via eth_get_gso_type [rhel-8.4.0.z])
  - Resolves: bz#1944621
    (CVE-2020-13754 virt:rhel/qemu-kvm: QEMU: msix: OOB access during mmio operations may lead to DoS [rhel-8.4.0.z])
  - Resolves: bz#1952986
    (CVE-2021-20221 virt:rhel/qemu-kvm: qemu: out-of-bound heap buffer access via an interrupt ID field [rhel-8.4.0.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-48.el8_4.2
changelog:
  - kvm-pc-bios-s390-ccw-fix-off-by-one-error.patch [bz#1975679]
  - kvm-pc-bios-s390-ccw-break-loop-if-a-null-block-number-i.patch [bz#1975679]
  - kvm-pc-bios-s390-ccw-don-t-try-to-read-the-next-block-if.patch [bz#1975679]
  - Resolves: bz#1975679
    (RHEL8.4 Nightly[0322] - KVM guest fails to find zipl boot menu index (qemu-kvm) [rhel-8.4.0.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-48.el8_4.3
changelog:
  - kvm-net-introduce-qemu_receive_packet.patch [bz#1932917]
  - kvm-e1000-switch-to-use-qemu_receive_packet-for-loopback.patch [bz#1932917]
  - kvm-dp8393x-switch-to-use-qemu_receive_packet-for-loopba.patch [bz#1932917]
  - kvm-sungem-switch-to-use-qemu_receive_packet-for-loopbac.patch [bz#1932917]
  - kvm-tx_pkt-switch-to-use-qemu_receive_packet_iov-for-loo.patch [bz#1932917]
  - kvm-rtl8139-switch-to-use-qemu_receive_packet-for-loopba.patch [bz#1932917]
  - kvm-pcnet-switch-to-use-qemu_receive_packet-for-loopback.patch [bz#1932917]
  - kvm-cadence_gem-switch-to-use-qemu_receive_packet-for-lo.patch [bz#1932917]
  - kvm-lan9118-switch-to-use-qemu_receive_packet-for-loopba.patch [bz#1932917]
  - Resolves: bz#1932917
    (CVE-2021-3416 virt:rhel/qemu-kvm: QEMU: net: infinite loop in loopback mode may lead to stack overflow [rhel-8.4.z])


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-7
changelog:
  - Trivial style fixes
  - Free contents of modkey in semanage_direct_remove
  - Fix USE_AFTER_FREE (CWE-672) in semanage_direct_write_langext()
  - add missing include to boolean_record.c
  - move module hashing into libsemanage
  - move compressed file handling into a separate object
  - clean up semanage_direct_commit() a bit
  - optionally rebuild policy when modules are changed externally
  - add command-line option to detect module changes (#2049186)


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 3.8-6
changelog:
  - Python 2 binary package renamed to python2-libvoikko
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Mike FABIAN <mfabian@redhat.com> - 4.1.1-1
changelog:
  - Rebase to 4.1.1 from Fedora 29 (provides only python3-libvoikko,
    removes python2-libvoikko)
  - Resolves: rhbz#1636062


author: Mike FABIAN <mfabian@redhat.com> - 4.1.1-2
changelog:
  - Fix man file names for Flatpak builds, exclude __pycache__ files from Flatpak builds
  - Resolves: rhbz#1896322


author: Jan Friesse <jfriesse@redhat.com> 3.1.5-2
changelog:
  - Resolves: rhbz#2002115
  - Resolves: rhbz#2024658

  - totem: Add cancel_hold_on_retransmit config option (rhbz#2002115)
  - merge upstream commit cdf72925db5a81e546ca8e8d7d8291ee1fc77be4 (rhbz#2002115)
  - totemsrp: Switch totempg buffers at the right time (rhbz#2024658)
  - merge upstream commit e7a82370a7b5d3ca342d5e42e25763fa2c938739 (rhbz#2024658)


author: Kalev Lember <klember@redhat.com> - 3.36.1-3
changelog:
  - Upload correct 3.36.1 tarball
  - Fix hardcoded desktop and appdata names to match what's in RHEL 8.3
  - Add back shell extensions support
  - Resolves: #1839774


author: Merlin Mathesius <mmathesi@redhat.com> - 1027-1
changelog:
  - Version bump. Now supported for all architectures.
  - Generate man pages since they are no longer included in source archive.


author: Jerry Snitselaar <jsnitsel@redhat.com> - 1234-5
changelog:
  - Move header files to ibmtss directory.
  - Check return value of TSS_Hash_Generate.
  resolves: rhbz#1636245


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.0-1
changelog:
  - Update to 1.14.0
  - Fix the key string parsing in url_substitution
  - When zchunk enabled and not using HTTP/S protocol, download the whole file (RhBug:1886706)
  - Add an option LRO_SSLVERIFYSTATUS to check TLS certificate revocation status (using OCSP stapling) (RhBug:1814383)
  - Fix: lr_perform() - Avoid 100% CPU usage
  - Add support for working with certificates used with proxy
  - Reposync does not re-download unchanged packages (RhBug:1931904)
  - Fix memory leaks


author: Evgenii Kolesnikov <ekolesni@redhat.com> - 1.3.5-1
changelog:
  - Upgrade to the latest upstream release (RHBZ#1953092)
  - Fix segfault when using --stig-viewer option and latest XML file from DoD (RHBZ#1912000)
  - Improve doc about --stig-viewer (RHBZ#1918759)
  - Backport an upstream patch adding CentOS CPE (RHBZ#1907935)


author: Evgenii Kolesnikov <ekolesni@redhat.com> - 1.3.5-3
changelog:
  - Waive known issue with hugepages in upstream testsuite (RHBZ#1912000)
  - Fix issues reported by the coverity scan
  - Introduce OSBuild 'blueprint' fix type


author: Jan Stancek <jstancek@redhat.com> [4.18.0-305.10.2.el8_4]
changelog:
  - seq_file: Disallow extremely large seq buffer allocations (Ian Kent) [1975181 1975182] {CVE-2021-33909}


author: Nikola Forró <nforro@redhat.com> - 2.4.0-1
changelog:
  - Rebase to 2.4.0
  - Resolves: CVE-2018-5727 (#1538467)
  - Resolves: CVE-2018-5785 (#1538556)
  - Resolves: CVE-2018-20845 (#1730679)
  - Resolves: CVE-2018-20847 (#1734337)
  - Resolves: CVE-2019-12973 (#1739076)
  - Resolves: CVE-2020-15389 (#1855115)
  - Resolves: CVE-2020-27814 (#1908965)
  - Resolves: CVE-2020-27823 (#1906222)
  - Resolves: CVE-2020-27824 (#1906216)
  - Resolves: CVE-2020-27842 (#1908165)
  - Resolves: CVE-2020-27843 (#1908164)
  - Resolves: CVE-2020-27845 (#1908168)


author: Richard Hughes <richard@hughsie.com> - 1.0-1
changelog:
  - New upstream release
  - This fixes the security bug known as CVE-2018-5345
  - Add new API for fwupd
  - Do not encode timezone in generated files
  - Fix countless memory leaks when parsing corrupt files
  - Fix the calculation of the checksum on big endian machines
  - Switch to the Meson buildsystem


author: Brian C. Lane <bcl@redhat.com> - 3.2-39
changelog:
  - tests: Add a test for resizepart on a busy partition (bcl)
    Related: rhbz#1861804
  - parted: Preserve resizepart End when prompted for busy partition (bcl)
    Resolves: rhbz#1861804
  - Fix end_input usage in do_resizepart (bcl)
    Related: rhbz#1861804
  - tests: Test incomplete resizepart command (bcl)
    Related: rhbz#1861804
  - Fix resizepart iec unit end sector (psusi)
    Related: rhbz#1861804
  - libparted: Fix endian bug in bsd.c (AWilcox)
    Resolves: rhbz#1980105


author: Ray Strode <rstrode@redhat.com> - 40.0-19
changelog:
  - Synchronize permission and group ownership for log dir between
    rpm file manifest and daemon expectations.
    Resolves: #1878119


author: Karel Zak <kzak@redhat.com> 2.32.1-29
changelog:
  - fix #1988955 - script command continues without stopping.
  - fix #2041498 - incorrect partition size calculation for BLKPG_* ioctls
  - fix #2011602 - logger from util-linux incorrectly handles long messages
  - fix #1916151 - [RFE] spread fstrim.timer across time
  - fix #1894192 - Update or backport setpriv --pdeathsig
  - fix #2026511 - blkid fails to complete when targeting  non-block devices


author: Karel Zak <kzak@redhat.com> 2.32.1-31
changelog:
  - improve #2026511 fix - blkid fails to complete when targeting non-block devices
  - fix #1950187 - Ambient capabilities failed to applied to non-root user


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.2.9-24
changelog:
  - Fix important coverity issues
    Resolves: #1989603
  - Fix incorrect use of temporary paths
    Resolves: #1989605


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-348.14.1.el8_5]
changelog:
  - tcp: fix page frag corruption on page fault (Paolo Abeni) [2041529 1996074]
  - net: fix sk_page_frag() recursion from memory reclaim (Paolo Abeni) [2041529 1996074]
  - KVM: s390: index kvm->arch.idle_mask by vcpu_idx (Thomas Huth) [2040769 2026230]
  - redhat: set LC_ALL=C before sorting config content (Frantisek Hrbata)


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.15.1.el8_5]
changelog:
  - net/mlx5: DR, Use FW API when updating FW-owned flow table (Michal Schmidt) [2042663 2042651]
  - KVM: x86: Wait for IPIs to be delivered when handling Hyper-V TLB flush hypercall (Vitaly Kuznetsov) [2043237 1868572]
  - drm/mgag200: Select clock in PLL update functions (Bruno Meneguele) [2034949 1953926]
  - drm/i915: Fix HAS_LSPCON macro for platforms between GEN9 and GEN10 (Bruno Meneguele) [2027335 2005586]
  - crypto: qat - power up 4xxx device (Vladis Dronov) [2016437 1960307]
  - RDMA/core: Fix a double free in add_port error flow (Kamal Heib) [2038724 2008555]
  - powerpc/iommu: Report the correct most efficient DMA mask for PCI devices (Steve Best) [2018928 2007425]
  - powerpc/dma: Fix dma_map_ops::get_required_mask (Steve Best) [2018928 2007425]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.16.1.el8_5]
changelog:
  - drm/vmwgfx: Fix stale file descriptors on failed usercopy (Dave Airlie) [2047601 2047602] {CVE-2022-22942}
  - net: openvswitch: Fix ct_state nat flags for conns arriving from tc (Marcelo Ricardo Leitner) [2043548 2040334]
  - net: openvswitch: Fix matching zone id for invalid conns arriving from tc (Marcelo Ricardo Leitner) [2043550 2040452]
  - net/sched: flow_dissector: Fix matching on zone id for invalid conns (Marcelo Ricardo Leitner) [2043550 2040452]
  - net/sched: Extend qdisc control block with tc control block (Marcelo Ricardo Leitner) [2043550 2040452]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.17.1.el8_5]
changelog:
  - vfs: check dentry is still valid in get_link() (Ian Kent) [2052558 2014846]
  - xfs: don't expose internal symlink metadata buffers to the vfs (Brian Foster) [2052558 2014846]
  - CI: Use appropriate zstream builder (Veronika Kabatova)
  - CI: Enable baseline realtime checks (Veronika Kabatova)
  - CI: Rename pipelines to include release names (Veronika Kabatova)
  - cgroup-v1: Require capabilities to set release_agent (Waiman Long) [2052166 2052167] {CVE-2022-0492}
  - ice: Remove boolean vlan_promisc flag from function (Jonathan Toppins) [2051951 2030400]
  - ceph: put the requests/sessions when it fails to alloc memory (Jeffrey Layton) [2053725 2017796]
  - ceph: fix off by one bugs in unsafe_request_wait() (Jeffrey Layton) [2053725 2017796]
  - ceph: flush the mdlog before waiting on unsafe reqs (Jeffrey Layton) [2053725 2017796]
  - ceph: flush mdlog before umounting (Jeffrey Layton) [2053725 2017796]
  - ceph: make iterate_sessions a global symbol (Jeffrey Layton) [2053725 2017796]
  - ceph: make ceph_create_session_msg a global symbol (Jeffrey Layton) [2053725 2017796]
  - xfs: check sb_meta_uuid for dabuf buffer recovery (Bill O'Donnell) [2049292 2020764]
  - drm/i915: Flush TLBs before releasing backing store (Patrick Talbert) [2044328 2044329] {CVE-2022-0330}
  - hugetlb: fix hugetlb cgroup refcounting during vma split (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings (Waiman Long) [2039015 2032811]
  - mm/hugetlb: change hugetlb_reserve_pages() to type bool (Waiman Long) [2039015 2032811]
  - hugetlb: fix an error code in hugetlb_reserve_pages() (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: fix offline of hugetlb cgroup with reservations (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: fix reservation accounting (Waiman Long) [2039015 2032811]
  - mm/hugetlb: narrow the hugetlb_lock protection area during preparing huge page (Waiman Long) [2039015 2032811]
  - mm/hugetlb: a page from buddy is not on any list (Waiman Long) [2039015 2032811]
  - mm/hugetlb: not necessary to coalesce regions recursively (Waiman Long) [2039015 2032811]
  - selftests/vm/write_to_hugetlbfs.c: fix unused variable warning (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add hugetlb_cgroup reservation tests (Waiman Long) [2039015 2032811]
  - hugetlb: support file_region coalescing again (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: support noreserve mappings (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add accounting for shared mappings (Waiman Long) [2039015 2032811]
  - hugetlb: disable region_add file_region coalescing (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add reservation accounting for private mappings (Waiman Long) [2039015 2032811]
  - mm/hugetlb_cgroup: fix hugetlb_cgroup migration (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add interface for charge/uncharge hugetlb reservations (Waiman Long) [2039015 2032811]
  - hugetlb_cgroup: add hugetlb_cgroup reservation counter (Waiman Long) [2039015 2032811]
  - hugetlb: remove duplicated code (Waiman Long) [2039015 2032811]
  - hugetlb: region_chg provides only cache entry (Waiman Long) [2039015 2032811]
  - hugetlbfs: always use address space in inode for resv_map pointer (Waiman Long) [2039015 2032811]
  - hugetlbfs: fix potential over/underflow setting node specific nr_hugepages (Waiman Long) [2039015 2032811]
  - hugetlb: allow to free gigantic pages regardless of the configuration (Waiman Long) [2039015 2032811]
  - powerpc/pseries: Fix update of LPAR security flavor after LPM (Steve Best) [2027448 1997294]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.18.1.el8_5]
changelog:
  - selftests: kvm: Check whether SIDA memop fails for normal guests (Thomas Huth) [2050806 2050807] {CVE-2022-0516}
  - KVM: s390: Return error on SIDA memop on normal guest (Thomas Huth) [2050806 2050807] {CVE-2022-0516}
  - iommu/amd: Remove iommu_init_ga() (Jerry Snitselaar) [2030854 1998265]
  - iommu/amd: Relocate GAMSup check to early_enable_iommus (Jerry Snitselaar) [2030854 1998265]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.19.1.el8_5]
changelog:
  - tipc: improve size validations for received domain records (Xin Long) [2048970 2048971] {CVE-2022-0435}
  - smb3: do not error on fsync when readonly (Ronnie Sahlberg) [2055824 2037811]
  - security: implement sctp_assoc_established hook in selinux (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - security: add sctp_assoc_established hook (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - security: call security_sctp_assoc_request in sctp_sf_do_5_1D_ce (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - security: pass asoc to sctp_assoc_request and sctp_sk_clone (Bruno Meneguele) [2054112 2054117 2015525 2048251]
  - net: sctp: Fix some typos (Ondrej Mosnacek) [2054112 2054117 2015525 2048251]
  - RDMA/bnxt_re: Fix stats counters (Selvin Xavier) [2049684 2001893]
  - net: check skb sec_path when re-initializing slow_gro in gro_list_prepare (Xin Long) [2047427 2030476]
  - cpufreq: intel_pstate: Add Icelake servers support in no-HWP mode (David Arcari) [2036888 2003695]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.20.1.el8_5]
changelog:
  - lib/iov_iter: initialize "flags" in new pipe_buffer (Jan Stancek) [2060874 2060875] {CVE-2022-0847}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.21.1.el8_5]
changelog:
  - netfilter: nf_queue: handle socket prefetch (Florian Westphal) [2061446 2009786]
  - netfilter: nf_queue: fix possible use-after-free (Florian Westphal) [2061446 2009786]
  - selftests: netfilter: add nfqueue TCP_NEW_SYN_RECV socket race test (Florian Westphal) [2061446 2009786]
  - netfilter: nf_queue: don't assume sk is full socket (Florian Westphal) [2061446 2009786]
  - netfilter: nf_tables_offload: incorrect flow offload action array size (Florian Westphal) [2056867 2056728] {CVE-2022-25636}
  - netfilter: nftables_offload: KASAN slab-out-of-bounds Read in nft_flow_rule_create (Florian Westphal) [2056867 2056728] {CVE-2022-25636}


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.22.1.el8_5]
changelog:
  - scsi: lpfc: Fix non-recovery of remote ports following an unsolicited LOGO (Dick Kennedy) [2058193 2027558]
  - cifs: check all path components in resolved dfs target (Ronnie Sahlberg) [2056329 2030880]
  - RDMA/cma: Do not change route.addr.src_addr.ss_family (Kamal Heib) [2032073 2032074] {CVE-2021-4028}


author: Richard W.M. Jones <rjones@redhat.com> - 8.6-1
changelog:
  - Rebase to ntfs-3g 2021.8.22
  - Fixes: CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289,
    CVE-2021-35266, CVE-2021-35267, CVE-2021-35268, CVE-2021-35269,
    CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE-2021-39254
    resolves: rhbz#2004490


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-3
changelog:
  - cil: Fix out-of-bound read of file context pattern ending with "\"
  - cil: Destroy classperms list when resetting classpermission (#1983517)
  - cil: Destroy classperm list when resetting map perms (#1983521)
  - cil: cil_reset_classperms_set() should not reset classpermission (#1983525)
  - cil: Set class field to NULL when resetting struct cil_classperms
  - cil: More strict verification of constraint leaf expressions
  - cil: Exit with an error if declaration name is a reserved word
  - cil: Allow permission expressions when using map classes
  - cil: Reorder checks for invalid rules when building AST
  - cil: Cleanup build AST helper functions
  - cil: Create new first child helper function for building AST
  - cil: Remove unused field from struct cil_args_resolve
  - cil: Destroy disabled optional blocks after pass is complete
  - cil: Check if name is a macro parameter first
  - cil: fix NULL pointer dereference in __cil_insert_name
  - cil: Report disabling an optional block only at high verbose levels
  - cil: Use AST to track blocks and optionals when resolving
  - cil: Reorder checks for invalid rules when resolving AST
  - cil: Sync checks for invalid rules in booleanifs
  - cil: Check for statements not allowed in optional blocks (#1983530)


author: Honggang Li <honli@redhat.com> - 4.1.1-2
changelog:
  - fbtl-posix: link to common_ompio
  - Require environment(modules)
  - Revert upstream commit c36d7459b6331c4da82
  - Resolves: rhbz#1974780, rhbz#1971771


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 4.2.0-50.el8
changelog:
  - kvm-hw-intc-arm_gic-Fix-interrupt-ID-in-GICD_SGIR-regist.patch [bz#1925430]
  - kvm-libqos-usb-hcd-ehci-use-32-bit-write-for-config-regi.patch [bz#1842478]
  - kvm-libqos-pci-pc-use-32-bit-write-for-EJ-register.patch [bz#1842478]
  - kvm-memory-Revert-memory-accept-mismatching-sizes-in-mem.patch [bz#1842478]
  - kvm-acpi-accept-byte-and-word-access-to-core-ACPI-regist.patch [bz#1842478]
  - kvm-xhci-fix-valid.max_access_size-to-access-address-reg.patch [bz#1842478]
  - kvm-softmmu-memory-Log-invalid-memory-accesses.patch [bz#1842478]
  - Resolves: bz#1925430
    (CVE-2021-20221 virt:rhel/qemu-kvm: qemu: out-of-bound heap buffer access via an interrupt ID field [rhel-8.5.0])
  - Resolves: bz#1842478
    (CVE-2020-13754 virt:rhel/qemu-kvm: QEMU: msix: OOB access during mmio operations may lead to DoS [rhel-8.5.0])


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.8.1.el8_5]
changelog:
  - ice: Fix VF true promiscuous mode (Jonathan Toppins) [2026698 1970643]
  - ice: Remove toggling of antispoof for VF trusted promiscuous mode (Jonathan Toppins) [2026698 1970643]
  - ice: Fix replacing VF hardware MAC to existing MAC filter (Jonathan Toppins) [2026698 1970643]
  - ice: Fix not stopping Tx queues for VFs (Jonathan Toppins) [2026698 1970643]
  - ice: Fix race conditions between virtchnl handling and VF ndo ops (Jonathan Toppins) [2026698 1970643]
  - net/netif_receive_skb_core: Use migrate_disable() (Luis Claudio R. Goncalves) [2027689 2024168]
  - crypto: jitter - consider 32 LSB for APT (Herbert Xu) [2029365 1994390]
  - xfs: fix I_DONTCACHE (Carlos Maiolino) [2028534 2024969]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.9.1.el8_5]
changelog:
  - ixgbe: Revert "bpf, devmap: Move drop error path to devmap for XDP_REDIRECT" (Ken Cox) [2029845 2024240]
  - i40e: Revert "bpf, devmap: Move drop error path to devmap for XDP_REDIRECT" (Stefan Assmann) [2029845 2024225]
  - rcu/nocb: Perform deferred wake up before last idle's need_resched() check (Waiman Long) [2029449 2008340]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.10.1.el8_5]
changelog:
  - selftests: add a test case for mirred egress to ingress (Xin Long) [2024411 1983894]
  - net: sched: act_mirred: drop dst for the direction from egress to ingress (Xin Long) [2024411 1983894]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.11.1.el8_5]
changelog:
  - blk-mq: avoid to iterate over stale request (Ming Lei) [2034396 1997338]
  - rcu: Tighten rcu_advance_cbs_nowake() checks (Daniel Vacek) [2032579 2013408]


author: Bruno Meneguele <bmeneg@redhat.com> [4.18.0-348.12.1.el8_5]
changelog:
  - tcp: don't free a FIN sk_buff in tcp_remove_empty_skb() (Guillaume Nault) [2021574 2016210]
  - kernel.spec: Add support to use vmlinux.h (Jiri Olsa) [2031053 1989087]
  - spec: Add vmlinux.h to kernel-devel package (Jiri Olsa) [2031053 1989087]
  - x86/mce: Avoid infinite loop for copy from user recovery (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Rename kill_it to kill_current_task (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Recover from poison found while copying from user space (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Delay clearing IA32_MCG_STATUS to the end of do_machine_check() (Prarit Bhargava) [2008789 1999550]
  - x86/mce: Send #MC singal from task work (Prarit Bhargava) [2008789 1999550]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-348.12.2.el8_5]
changelog:
  - vfs: Out-of-bounds write of heap buffer in fs_context.c (Frantisek Hrbata) [2040585 2040586] {CVE-2022-0185}
  - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Bruno Meneguele) [2034864 2034865] {CVE-2021-4155}


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.2-1
changelog:
  - resolves: rhbz#2013596 - Rebase to version 4.15.2
  - resolves: rhbz#1999294 - Remove noisy error message in winbindd
  - resolves: rhbz#1958881 - Don't require winbind being online for krb5 auth
                             with one-way trusts
  - resolves: rhbz#2019461 - Fix deleting directories with dangling symlinks


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.3-1
changelog:
  - related: rhbz#2013596 - Rebase to version 4.15.3
  - resolves: rhbz#2028029 - Fix possible null pointer dereference in winbind
  - resolves: rhbz#1912549 - Winexe: Kerberos Auth is respected via --use-kerberos=desired


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.4-0
changelog:
  - Update to Samba 4.15.4
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2039153 - Fix CVE-2021-20316
  - resolves: rhbz#1912549 - Winexe: Kerberos flag not invoking Kerberos Auth
  - resolves: rhbz#2039157 - Fix CVE-2021-43566
  - resolves: rhbz#2038148 - Failed to authenticate users after upgrade samba package to release samba-4.14.5-7
  - resolves: rhbz#2035528 - [smb] Segmentation fault when joining the domain
  - resolves: rhbz#2038796 - filename_convert_internal: open_pathref_fsp [xxx] failed: NT_STATUS_ACCESS_DENIED


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-0
changelog:
  - Update to Samba 4.15.5
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2046127 - Fix CVE-2021-44141
  - resolves: rhbz#2046153 - Fix CVE-2021-44142
  - resolves: rhbz#2044404 - Printing no longer works on Windows 7
  - resolves: rhbz#2043154 - Fix systemd notifications
  - resolves: rhbz#2049602 - Disable NTLMSSP for ldap client connections (e.g. libads)


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-1
changelog:
  - resolves: #1995849 - [RFE] Change change password change prompt phrasing
  - resolves: #2029417 - virusfilter_vfs_openat: Not scanned: Directory or special file


author: Andreas Schneider <asn@redhat.com> - 4.15.5-5
changelog:
  - resolves: rhbz#2064325 - Fix 'create krb5 conf = yes` when a KDC has a
                             single IP address.


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-348.13.1.el8_5]
changelog:
  - vfs: Out-of-bounds write of heap buffer in fs_context.c (Frantisek Hrbata) [2040585 2040586] {CVE-2022-0185}
  - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Bruno Meneguele) [2034864 2034865] {CVE-2021-4155}
  - af_unix: fix garbage collect vs MSG_PEEK (Patrick Talbert) [2031974 2031975] {CVE-2021-0920}
  - cgroup: verify that source is a string (Waiman Long) [2034608 2034609] {CVE-2021-4154}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.20.1.el8_4]
changelog:
  - net/mlx5: E-Switch, Allow setting GUID for host PF vport (Alaa Hleihel) [1986837 1967488]
  - net/mlx5: E-Switch, Read PF mac address (Alaa Hleihel) [1986837 1967488]
  - ice: fix Tx queue iteration for Tx timestamp enablement (Ken Cox) [2000128 1999743]
  - ice: restart periodic outputs around time changes (Ken Cox) [1997572 1992750]
  - ice: Fix perout start time rounding (Ken Cox) [1997572 1992750]
  - ice: add support for auxiliary input/output pins (Jonathan Toppins) [1998221 1956913]
  - ice: enable transmit timestamps for E810 devices (Jonathan Toppins) [1998220 1944818]
  - ice: enable receive hardware timestamping (Jonathan Toppins) [1998220 1944818]
  - ice: report the PTP clock index in ethtool .get_ts_info (Jonathan Toppins) [1998220 1944818]
  - ice: register 1588 PTP clock device object for E810 devices (Jonathan Toppins) [1998220 1944818]
  - ice: add low level PTP clock access functions (Jonathan Toppins) [1998220 1944818]
  - ice: add support for set/get of driver-stored firmware parameters (Jonathan Toppins) [1998220 1944818]
  - ice: process 1588 PTP capabilities during initialization (Jonathan Toppins) [1998220 1944818]
  - ice: add support for sideband messages (Jonathan Toppins) [1998220 1944818]
  - ice: Prevent probing virtual functions (Ken Cox) [1997539 1952810]
  - vfio/pci/nvlink2: Do not attempt NPU2 setup on POWER8NVL NPU (Gustavo Walbon) [2000602 1891589]
  - powerpc/powernv/npu: Do not attempt NPU2 setup on POWER8NVL NPU (Gustavo Walbon) [2000602 1891589]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.21.1.el8_4]
changelog:
  - HID: make arrays usage and value to be the same (Benjamin Tissoires) [1974941 1974942] {CVE-2021-0512}
  - y2038: remove CONFIG_64BIT_TIME (Waiman Long) [2003569 1965360]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.22.1.el8_4]
changelog:
  - [s390] s390/ap: Fix hanging ioctl caused by wrong msg counter (Claudio Imbrenda) [2002635 1984762]
  - cpuidle: pseries: Do not cap the CEDE0 latency in fixup_cede0_latency() (Diego Domingos) [1997431 1952809]
  - cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards (Diego Domingos) [1997431 1952809]
  - EDAC/amd64: Fix PCI component registration (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Use struct cpuinfo_x86.cpu_die_id for AMD NodeId (Aristeu Rozanski) [1982182 1918583]
  - x86/CPU/AMD: Remove amd_get_nb_id() (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Make fam_ops static global (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Allow Reserved types to be overwritten in smca_banks[] (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure() (Aristeu Rozanski) [1982182 1918583]
  - EDAC/amd64: Get rid of the ECC disabled long message (Aristeu Rozanski) [1982182 1918583]
  - EDAC/amd64: Check for memory before fully initializing an instance (Aristeu Rozanski) [1982182 1918583]
  - EDAC/amd64: Use cached data when checking for ECC (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE: Make the number of MCA banks a per-CPU variable (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Don't cache block addresses on SMCA systems (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE: Make mce_banks a per-CPU array (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE: Make struct mce_banks[] static (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Don't report L1 BTB MCA errors on some family 17h models (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Decode MCA_STATUS in bit definition order (Aristeu Rozanski) [1982182 1918583]
  - EDAC/mce_amd: Decode MCA_STATUS[Scrub] bit (Aristeu Rozanski) [1982182 1918583]
  - EDAC, mce_amd: Match error descriptions to latest documentation (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Carve out the MC4_MISC thresholding quirk (Aristeu Rozanski) [1982182 1918583]
  - x86/MCE/AMD: Turn off MC4_MISC thresholding on all family 0x15 models (Aristeu Rozanski) [1982182 1918583]
  - net: Fix skb->csum update in inet_proto_csum_replace16(). (Balazs Nemeth) [2005980 1975193]
  - RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy (Kamal Heib) [1982040 1931846] {CVE-2020-36385}
  - RDMA/ucma: Fix locking for ctx->events_reported (Kamal Heib) [1982040 1931846] {CVE-2020-36385}
  - RDMA/ucma: Fix the locking of ctx->file (Kamal Heib) [1982040 1931846] {CVE-2020-36385}
  - RDMA/cma: Add missing locking to rdma_accept() (Kamal Heib) [1982040 1931846] {CVE-2020-36385}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.23.1.el8_4]
changelog:
  - CI: handle RT branches in a single config (Veronika Kabatova)
  - CI: Drop private CI config (Veronika Kabatova)
  - CI: extend template use (Veronika Kabatova)
  - xfs: drop unnecessary setfilesize helper (Brian Foster) [2007413 1942348]
  - xfs: drop unused ioend private merge and setfilesize code (Brian Foster) [2007413 1942348]
  - xfs: open code ioend needs workqueue helper (Brian Foster) [2007413 1942348]
  - xfs: drop submit side trans alloc for append ioends (Brian Foster) [2007413 1942348]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.24.1.el8_4]
changelog:
  - lockd: Fix invalid lockowner cast after vfs_test_lock (Benjamin Coddington) [2010820 1986138]
  - e1000e: Do not take care about recovery NVM checksum (Ken Cox) [2002335 1984558]
  - xfs: sync lazy sb accounting on quiesce of read-only mounts (Bill O'Donnell) [2011919 1917220]
  - xfs: remove the unused return value from xfs_log_unmount_write (Bill O'Donnell) [2011919 1917220]
  - powerpc: use stop_machine for partition migration (Frantisek Hrbata) [1993952 1979798]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-305.25.1.el8_4]
changelog:
  - scsi: ibmvfc: Reinit target retries (Steve Best) [1993892 1965010]
  - scsi: ibmvfc: Avoid move login if fast fail is enabled (Steve Best) [1993892 1965010]
  - scsi: ibmvfc: Handle move login failure (Steve Best) [1993892 1965010]
  - scsi: ibmvfc: Fix invalid state machine BUG_ON() (Steve Best) [1993892 1965010]
  - tpm, tpm_tis: Reserve locality in tpm_tis_resume() (Jerry Snitselaar) [1998219 1920812]
  - tpm, tpm_tis: Extend locality handling to TPM2 in tpm_tis_gen_interrupt() (Jerry Snitselaar) [1998219 1920812]
  - tpm, tpm_tis: Decorate tpm_tis_gen_interrupt() with request_locality() (Jerry Snitselaar) [1998219 1920812]
  - tpm, tpm_tis: Decorate tpm_get_timeouts() with request_locality() (Jerry Snitselaar) [1998219 1920812]
  - tpm_tis: Clean up locality release (Jerry Snitselaar) [1998219 1920812]
  - tpm_tis: Fix check_locality for correct locality acquisition (Jerry Snitselaar) [1998219 1920812]
  - kthread: Fix PF_KTHREAD vs to_kthread() race (Waiman Long) [2010331 2001497]
  - sched/fair: Ignore percpu threads for imbalance pulls (Waiman Long) [2010331 2001497]
  - kthread: Extract KTHREAD_IS_PER_CPU (Waiman Long) [2010331 2001497]
  - sched: Optimize finish_lock_switch() (Waiman Long) [2010331 2001497]
  - sched/hotplug: Ensure only per-cpu kthreads run during hotplug (Waiman Long) [2010331 2001497]
  - sched: Fix balance_callback() (Waiman Long) [2010331 2001497]
  - net/sched: store the last executed chain also for clsact egress (Davide Caratti) [1992230 1980537]


author: Peter Jones <pjones@redhat.com> - 35-1
changelog:
  - Update to efivar 35
  - fixes for older compilers
  - efi_get_variable_exists()
  - Lots of stuff to make CI work.
  - use usleep() to avoid hitting the kernel rate limiter on efivarfs
  - better EFI_GUID macro
  - add efi_guid_fwupdate (0abba7dc-e516-4167-bbf5-4d9d1c739416)


author: Peter Jones <pjones@redhat.com> - 36-1
changelog:
  - Update to efivar 36 (and some change)
    Resolves: rhbz#1635019
  - Add NVDIMM support
  - Re-written linux interface parser to handle how devices are
    partitioned better, and for cleaner code, with one file per device
    type.
  - lots of verbosity updates
  - better CI
  - analysis with clang's analyzer as well as coverity
  - Better handling of immutable bits in sysfs
  - LIBEFIVAR_OPS=help
  - lots of code cleanups.
  - Add emmc device support
  - Add SAS port expander support
  - Support for ACPI root nodes that are less common
    (i.e. ACPI Generic Container and Embedded Controller PNP nodes)
  - Make abbreviated device paths if we can't parse a device's info
  - Don't require NVME to have an EUI


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-2
changelog:
  - [RFE] RFE backport allow enabling ZEROCOPY live migration to libvirt-python on RHEL8 to be consumed by VDSM (rhbz#2092756)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-5.1.el8
changelog:
  - conf: Introduce memory allocation threads (rhbz#2075569)
  - qemu_capabilities: Detect memory-backend-*.prealloc-threads property (rhbz#2075569)
  - qemu_validate: Validate prealloc threads against qemuCpas (rhbz#2075569)
  - qemu_command: Generate prealloc-threads property (rhbz#2075569)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-5.2.el8
changelog:
  - cpu_map: Disable cpu64-rhel* for host-model and baseline (rhbz#2084030)
  - cputest: Drop some old artificial baseline tests (rhbz#2084030)
  - cputest: Give better names to baseline tests (rhbz#2084030)
  - cputest: Add some real world baseline tests (rhbz#2084030)
  - cpu_x86: Consolidate signature match in x86DecodeUseCandidate (rhbz#2084030)
  - cpu_x86: Refactor feature list comparison in x86DecodeUseCandidate (rhbz#2084030)
  - cpu_x86: Penalize disabled features when computing CPU model (rhbz#2084030)
  - cpu_x86: Ignore enabled features for input models in x86DecodeUseCandidate (rhbz#2084030)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-5.3.el8
changelog:
  - virDomainDiskDefValidate: Improve error messages for 'startupPolicy' checks (rhbz#2109571)
  - domain_validate: Split out validation of disk startup policy (rhbz#2109571)
  - virDomainDiskDefValidateStartupPolicy: Validate disk type better (rhbz#2109571)
  - virDomainDiskTranslateSourcePool: Fix check of 'startupPolicy' definition (rhbz#2109571)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-5.4.el8
changelog:
  - conf: Move virDomainObj::originalMemlock into qemuDomainObjPrivate (rhbz#2117272)
  - qemu_domain: Format qemuDomainObjPrivate::originalMemlock (rhbz#2117272)
  - qemu: Add qemuDomainSetMaxMemLock helper (rhbz#2117272)
  - qemu_migration: Use qemuDomainSetMaxMemLock (rhbz#2117272)
  - qemu_migration: Restore original memory locking limit (rhbz#2117272)
  - Add VIR_MIGRATE_ZEROCOPY flag (rhbz#2117272)
  - virsh: Add support for VIR_MIGRATE_ZEROCOPY flag (rhbz#2117272)
  - qemu_migration: Implement VIR_MIGRATE_ZEROCOPY flag (rhbz#2117272)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-5.5.el8
changelog:
  - qemu_process: Don't require a hugetlbfs mount for memfd (rhbz#2132177)
  - qemu_namespace: Tolerate missing ACLs when creating a path in namespace (rhbz#2132177)
  - qemu_namespace: Fix a corner case in qemuDomainGetPreservedMounts() (rhbz#2132177)
  - qemu_namespace: Introduce qemuDomainNamespaceSetupPath() (rhbz#2132177)
  - qemu_process.c: Propagate hugetlbfs mounts on reconnect (rhbz#2132177)
  - qemuProcessReconnect: Don't build memory paths (rhbz#2132177)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-6
changelog:
  - conf: Introduce memory allocation threads (rhbz#2067126)
  - qemu_capabilities: Detect memory-backend-*.prealloc-threads property (rhbz#2067126)
  - qemu_validate: Validate prealloc threads against qemuCpas (rhbz#2067126)
  - qemu_command: Generate prealloc-threads property (rhbz#2067126)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-7
changelog:
  - cpu_map: Disable cpu64-rhel* for host-model and baseline (rhbz#1851227)
  - cputest: Drop some old artificial baseline tests (rhbz#1851227)
  - cputest: Give better names to baseline tests (rhbz#1851227)
  - cputest: Add some real world baseline tests (rhbz#1851227)
  - cpu_x86: Consolidate signature match in x86DecodeUseCandidate (rhbz#1851227)
  - cpu_x86: Refactor feature list comparison in x86DecodeUseCandidate (rhbz#1851227)
  - cpu_x86: Penalize disabled features when computing CPU model (rhbz#1851227)
  - cpu_x86: Ignore enabled features for input models in x86DecodeUseCandidate (rhbz#1851227)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-8
changelog:
  - nwfilter: fix crash when counting number of network filters (CVE-2022-0897, rhbz#2063902)
  - virDomainDiskDefValidate: Improve error messages for 'startupPolicy' checks (rhbz#2095758)
  - domain_validate: Split out validation of disk startup policy (rhbz#2095758)
  - virDomainDiskDefValidateStartupPolicy: Validate disk type better (rhbz#2095758)
  - virDomainDiskTranslateSourcePool: Fix check of 'startupPolicy' definition (rhbz#2095758)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-9
changelog:
  - conf: virtiofs: add thread_pool element (rhbz#2079582)
  - qemu: virtiofs: format --thread-pool-size (rhbz#2079582)
  - conf: Move virDomainObj::originalMemlock into qemuDomainObjPrivate (rhbz#2089433)
  - qemu_domain: Format qemuDomainObjPrivate::originalMemlock (rhbz#2089433)
  - qemu: Add qemuDomainSetMaxMemLock helper (rhbz#2089433)
  - qemu_migration: Use qemuDomainSetMaxMemLock (rhbz#2089433)
  - qemu_migration: Restore original memory locking limit (rhbz#2089433)
  - Add VIR_MIGRATE_ZEROCOPY flag (rhbz#2089433)
  - virsh: Add support for VIR_MIGRATE_ZEROCOPY flag (rhbz#2089433)
  - qemu_migration: Implement VIR_MIGRATE_ZEROCOPY flag (rhbz#2089433)


author: Jiri Denemark <jdenemar@redhat.com> - 8.0.0-10
changelog:
  - security_selinux.c: Relabel existing mode="bind" UNIX sockets (rhbz#2101575)
  - RHEL: qemu_migration: Fix restoring memlock limit on destination (rhbz#2107954)


author: Carlos O'Donell <carlos@redhat.com> - 2.28-209
changelog:
  - Improve dynamic loader auditing interface (LD_AUDIT) (#2047981)
  - Add dlinfo() API support for RTLD_DI_PHDR (#2097898)


author: Florian Weimer <fweimer@redhat.com> - 2.28-211
changelog:
  - Preserve GLRO (dl_naudit) internal ABI (#2119304)
  - Avoid s390x ABI change due to z16 recognition on s390x (#2119304)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-1
changelog:
  - dovecot updated to 2.3.16, pigeonhole to 0.5.16
  - fix CVE-2021-33515 plaintext commands injection (#1980014)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-9
changelog:
  - allow spaces in user/group names (#2042408)
  - always write kernel policy when check_ext_changes is specified (#2089802)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.332.b09-2
changelog:
  - Update to shenandoah-jdk8u332-b09 (GA)
  - Update release notes for 8u332-b09.
  - Drop JDK-8279077 now included upstream.
  - Resolves: rhbz#2074645


author: Ana Cabral <acabral@redhat.com> - 1.8.36-1
changelog:
  - Update to 1.8.36 release (rh #2062686)
  - Include OWE wireless security (rh #2060327)
  - Fix OWE wireless security entry in Hidden Networks dialog (rh #2057514)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.15.0.10-2
changelog:
  - Update to jdk-11.0.15.0+10
  - Update release notes to 11.0.15.0+10
  - Rebase RH1996182 FIPS patch after JDK-8254410
  - Resolves: rhbz#2073592


author: Francisco Ferrari Bihurriet <fferrari@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
  - Resolves: rhbz#2108251


author: Jiri Vanek <jvanek@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Add additional patch during tarball generation to align tests with ECC changes
  - Related: rhbz#2084649


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.0.8-1
changelog:
  - Update to jdk-11.0.16+8
  - Update release notes to 11.0.16+8
  - Use same tarball naming style as java-17-openjdk and java-latest-openjdk
  - Drop JDK-8257794 patch now upstreamed
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Make use of the vendor version string to store our version & release rather than an upstream release date
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Rebase FIPS patches from fips branch and simplify by using a single patch from that repository
  - * RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
  - * RH2090378: Revert to disabling system security properties and FIPS mode support together
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - Enable system security properties in the RPM (now disabled by default in the FIPS repo)
  - Improve security properties test to check both enabled and disabled behaviour
  - Run security properties test with property debugging on
  - Resolves: rhbz#2106514
  - Resolves: rhbz#2099917
  - Resolves: rhbz#2108248
  - Resolves: rhbz#2084649


author: Francisco Ferrari Bihurriet <fferrari@redhat.com> - 1:1.8.0.332.b09-2
changelog:
  - RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
  - Resolves: rhbz#2108566


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.342.b07-1
changelog:
  - Update to shenandoah-jdk8u342-b07
  - Update release notes for shenandoah-8u342-b07.
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Use "git apply" with patches in the tarball script to allow binary diffs
  - Remove redundant "REPOS" variable from tarball script
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Rebase FIPS patches from fips branch and simplify by using a single patch from that repository
  - * RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
  - * RH2090378: Revert to disabling system security properties and FIPS mode support together
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - Perform configuration changes (e.g. nss.cfg, nss.fips.cfg, tzdb.dat) in installjdk
  - Enable system security properties in the RPM (now disabled by default in the FIPS repo)
  - Improve security properties test to check both enabled and disabled behaviour
  - Run security properties test with property debugging on
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Resolves: rhbz#2099911
  - Resolves: rhbz#2108564
  - Resolves: rhbz#2084648
  - Resolves: rhbz#2106506


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.3.0.7-2
changelog:
  - April 2022 security update to jdk 17.0.3+7
  - Update to jdk-17.0.3.0+7 tarball
  - Update release notes to 17.0.3.0+7
  - Add missing README.md and generate_source_tarball.sh
  - Resolves: rhbz#2073576


author: Francisco Ferrari Bihurriet <fferrari@redhat.com> - 1:17.0.3.0.7-2
changelog:
  - RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
  - Resolves: rhbz#2108190


author: Jayashree Huttanagoudar <jhuttana@redhat.com> - 1:17.0.4.0.1-0.2.ea
changelog:
  - Fix issue where CheckVendor.java test erroneously passes when it should fail.
  - Add proper quoting so '&' is not treated as a special character by the shell.
  - Related: rhbz#2084650


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.0.8-1
changelog:
  - Update to jdk-17.0.4.0+8
  - Update release notes to 17.0.4.0+8
  - Need to include the '.S' suffix in debuginfo checks after JDK-8284661
  - Print release file during build, which should now include a correct SOURCE value from .src-rev
  - Update tarball script with IcedTea GitHub URL and .src-rev generation
  - Include script to generate bug list for release notes
  - Update tzdata requirement to 2022a to match JDK-8283350
  - Move EA designator check to prep so failures can be caught earlier
  - Make EA designator check non-fatal while upstream is not maintaining it
  - Explicitly require crypto-policies during build and runtime for system security properties
  - Make use of the vendor version string to store our version & release rather than an upstream release date
  - Include a test in the RPM to check the build has the correct vendor information.
  - Rebase FIPS patches from fips-17u branch and simplify by using a single patch from that repository
  - * RH2094027: SunEC runtime permission for FIPS
  - * RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
  - * RH2090378: Revert to disabling system security properties and FIPS mode support together
  - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
  - Enable system security properties in the RPM (now disabled by default in the FIPS repo)
  - Improve security properties test to check both enabled and disabled behaviour
  - Run security properties test with property debugging on
  - Turn on system security properties as part of the build's install section
  - Move cacerts replacement to install section and retain original of this and tzdb.dat
  - Run tests on the installed image, rather than the build image
  - Introduce variables to refer to the static library installation directories
  - Use relative symlinks so they work within the image
  - Run debug symbols check during build stage, before the install strips them
  - Resolves: rhbz#2084650
  - Resolves: rhbz#2099913
  - Resolves: rhbz#2108206
  - Resolves: rhbz#2108209
  - Resolves: rhbz#2106521


author: Jiri Vanek <jvanek@redhat.com> - 1:17.0.4.0.8-0.2.ea
changelog:
  - Returned absolute symlinks
  - Relative symlinks are breaking cjc, and deeper investigations are necessary
  -- why cjc intentionally skips relative symllinks
  - Images have to be workarounded differently
  - Related: rhbz#2084650


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.0.8-0.2.ea
changelog:
  - Revert the following changes until copy-java-configs has adapted to relative symlinks:
  - * Move cacerts replacement to install section and retain original of this and tzdb.dat
  - * Run tests on the installed image, rather than the build image
  - * Introduce variables to refer to the static library installation directories
  - * Use relative symlinks so they work within the image
  - * Run debug symbols check during build stage, before the install strips them
  - The move of turning on system security properties is retained so we don't ship with them off
  - Related: rhbz#2084650


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.0.8-0.2.ea
changelog:
  - Add rpminspect.yaml to turn off Java bytecode inspections
  - java-17-openjdk deliberately produces Java 17 bytecode, not the default Java 11 bytecode
  - Resolves: rhbz#2109106


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.1.1-1
changelog:
  - Update to jdk-17.0.4.1+1
  - Update release notes to 17.0.4.1+1
  - Add patch to provide translations for Europe/Kyiv added in tzdata2022b
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2120059


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.4.1.1-2
changelog:
  - Update FIPS support to bring in latest changes
  - * RH2023467: Enable FIPS keys export
  - * RH2104724: Avoid import/export of DH private keys
  - * RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
  - * Build the systemconf library on all platforms
  - * RH2048582: Support PKCS#12 keystores
  - * RH2020290: Support TLS 1.3 in FIPS mode
  - Resolves: rhbz#2123561
  - Resolves: rhbz#2123564
  - Resolves: rhbz#2123566
  - Resolves: rhbz#2123568
  - Resolves: rhbz#2123572


author: Ana Cabral <acabral@redhat.com> - 1:1.39.5-1
changelog:
  - Update to 1.39.5 release (development)
  - device: commit l3cfg on link change only when the device is activating (rh #2079054)
  - l3cfg: during reapply, also clear IPv6 temporary addresses (rh #2082230)
  - dhcp: support overlong DHCP host names (rh #2033643)
  - cloud-setup: reorder addresses to honor "primary_ip_address" (rh #2082000)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.39.6-1
changelog:
  - Update to 1.39.6 release (development)
  - Implement ACD (address conflict detection) for DHCPv4 (rh #1713380)


author: Lubomir Rintel <lkundrak@v3.sk> - 1:1.39.7-1
changelog:
  - Update to 1.39.7 release (development)
  - core: cancel the IP check on deactivation (rh #2080928)
  - core: ensure DHCP is restarted every time the link goes up (rh #2079406)
  - core: fix a leak of L3 configuration memory (rh #2083453)
  - ppp: fix a race with pppd when removing addresses (rh #2085382)
  - wifi: fix a crash when checking WEP supplicant capability (rh #2092782)


author: Lubomir Rintel <lkundrak@v3.sk> - 1:1.39.8-1
changelog:
  - Update to 1.39.8 release (development)
  - core: make ipv6.addr-gen-mode default configurable (rh #1743161) (rh #2082682)
  - dhcpv6: finish DAD before considering a lease to be good (rh #2096386)
  - core: add connection.wait-activation-delay property (rh #2008337)


author: Vojtech Bubela <vbubela@redhat.com> - 1:1.39.10-1
changelog:
  - Update to 1.39.10 release (development)
  - initrd: set a default carrier timeout of 10 seconds in initrd (rh #2079277)
  - dhcp: wait DAD completion for DHCPv6 addresses (rh #2096386)
  - libnm: support wait-activation-delay property (rh #2008337)
  - veth: fix veth activation on booting (rh #2105956)
  - support a ipv6.addr-gen-mode knob in the global config (rh #208268)


author: Beniamino Galvani <bgalvani@redhat.com> - 1:1.39.11-1
changelog:
  - Update to 1.39.11 release (development)
  - dhcp: fix EXTENDED DHCP event to accept lease for dhclient plugin (rh #2109285)
  - ovs: honor unmanaged setting also for interfaces that fail (rh #2077950)


author: Ana Cabral <acabral@redhat.com> - 1:1.39.90-1
changelog:
  - Update to 1.39.90 release (release candidate)
  - bridge: fix reapply of non-bridge properties (rh #2092762)
  - bridge: fix wired.mtu reapply (rh #2076131)


author: Phil Sutter <psutter@redhat.com> [0.9.3-17.el8]
changelog:
  - json: don't leave dangling pointers on hlist (Phil Sutter) [1900565]
  - json: Fix seqnum_to_json() functionality (Phil Sutter) [1900565]
  - json: echo: Speedup seqnum_to_json() (Phil Sutter) [1900565]
  - proto: Fix ARP header field ordering (Phil Sutter) [1896334]
  - proto: add sctp crc32 checksum fixup (Phil Sutter) [1895804]
  - mergesort: unbreak listing with binops (Phil Sutter) [1891790]
  - evaluate: missing datatype definition in implicit_set_declaration() (Phil Sutter) [1877022]
  - evaluate: Perform set evaluation on implicitly declared (anonymous) sets (Phil Sutter) [1877022]
  - src: store expr, not dtype to track data in sets (Phil Sutter) [1877022]


author: Phil Sutter <psutter@redhat.com> [0.9.3-19.el8]
changelog:
  - evaluate: Reject quoted strings containing only wildcard (Phil Sutter) [1818117]
  - tests: monitor: use correct $nft value in EXIT trap (Phil Sutter) [1919203]
  - monitor: Fix for use after free when printing map elements (Phil Sutter) [1919203]
  - tests: Disable tests known to fail on RHEL8 (Phil Sutter) [1919203]


author: Phil Sutter <psutter@redhat.com> [0.9.3-20.el8]
changelog:
  - src: Optimize prefix matches on byte-boundaries (Phil Sutter) [1934926]
  - src: Support odd-sized payload matches (Phil Sutter) [1934926]
  - spec: Add an rpminspect.yaml file to steer rpminspect (Phil Sutter) [1962184]
  - spec: Explicitly state dist string in Release tag (Phil Sutter) [1962184]


author: Phil Sutter <psutter@redhat.com> [0.9.3-21.el8]
changelog:
  - tests: shell: Fix bogus testsuite failure with 100Hz (Phil Sutter) [1919203]
  - doc: nft.8: Extend monitor description by trace (Phil Sutter) [1820365]
  - include: missing sctp_chunk.h in Makefile.am (Phil Sutter) [1979334]
  - exthdr: Implement SCTP Chunk matching (Phil Sutter) [1979334]
  - scanner: sctp: Move to own scope (Phil Sutter) [1979334]
  - scanner: introduce start condition stack (Phil Sutter) [1979334]
  - json: Simplify non-tcpopt exthdr printing a bit (Phil Sutter) [1979334]
  - json: tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcp: add raw tcp option match support (Phil Sutter) [1979334]
  - tcpopt: allow to check for presence of any tcp option (Phil Sutter) [1979334]
  - tcpopt: split tcpopt_hdr_fields into per-option enum (Phil Sutter) [1979334]
  - tcpopt: rename noop to nop (Phil Sutter) [1979334]
  - tcpopts: clean up parser -> tcpopt.c plumbing (Phil Sutter) [1979334]
  - parser: merge sack-perm/sack-permitted and maxseg/mss (Phil Sutter) [1979334]
  - tests/py: Move tcpopt.t to any/ directory (Phil Sutter) [1979334]


author: Phil Sutter <psutter@redhat.com> [0.9.3-22.el8]
changelog:
  - json: Drop pointless assignment in exthdr_expr_json() (Phil Sutter) [1999059]
  - parser_json: Fix for memleak in tcp option error path (Phil Sutter) [1999059]
  - parser_bison: Fix for implicit declaration of isalnum (Phil Sutter) [1999059]
  - parser_json: Fix error reporting for invalid syntax (Phil Sutter) [1994141]


author: Phil Sutter <psutter@redhat.com> [0.9.3-23.el8]
changelog:
  - tests: cover baecd1cf2685 ("segtree: Fix segfault when restoring a huge interval set") (Phil Sutter) [1908127]
  - segtree: Fix segfault when restoring a huge interval set (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-24.el8]
changelog:
  - tests: shell: better parameters for the interval stack overflow test (Phil Sutter) [1908127]
  - tests: shell: $NFT needs to be invoked unquoted (Phil Sutter) [1908127]


author: Phil Sutter <psutter@redhat.com> [0.9.3-25.el8]
changelog:
  - mnl: do not build nftnl_set element list (Phil Sutter) [2047821]
  - tests: py: add dnat to port without defining destination address (Phil Sutter) [2030773]
  - evaluate: fix inet nat with no layer 3 info (Phil Sutter) [2030773]
  - evaluate: attempt to set_eval flag if dynamic updates requested (Phil Sutter) [2039594]
  - src: support for restoring element counters (Phil Sutter) [2039594]
  - netlink: remove unused parameter from netlink_gen_stmt_stateful() (Phil Sutter) [2039594]


author: Phil Sutter <psutter@redhat.com> [0.9.3-26.el8]
changelog:
  - libnftables: call nft_cmd_expand() only with CMD_ADD (Phil Sutter) [2073287]
  - src: add CMD_OBJ_SETELEMS (Phil Sutter) [2073287]
  - src: rename CMD_OBJ_SETELEM to CMD_OBJ_ELEMENTS (Phil Sutter) [2073287]
  - rule: fix element cache update in __do_add_setelems() (Phil Sutter) [2073287]
  - rule: memleak in __do_add_setelems() (Phil Sutter) [2073287]
  - tests: shell: auto-removal of chain hook on netns removal (Phil Sutter) [2070924]
  - mnl: do not use expr->identifier to fetch device name (Phil Sutter) [2070924]


author: Petr Menšík <pemensik@redhat.com> - 32:9.16.23-0.7.1
changelog:
  - Fix possible serve-stale related crash (CVE-2022-3080)
  - Fix memory leak in ECDSA verify processing (CVE-2022-38177)
  - Fix memory leak in EdDSA verify processing (CVE-2022-38178)


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-20
changelog:
  - Add 0079-libmultipath-use-typedef-for-keyword-handler-and-pri.patch
  - Add 0080-libmultipath-print-the-correct-file-when-parsing-fai.patch
  - Add 0081-libmultipath-pass-file-and-line-number-to-keyword-ha.patch
  - Add 0082-libmultipath-make-set_int-take-a-range-for-valid-val.patch
  - Add 0083-libmultipath-improve-checks-for-set_str.patch
  - Add 0084-libmultipath-split-set_int-to-enable-reuse.patch
  - Add 0085-libmultipath-cleanup-invalid-config-handling.patch
  - Add 0086-libmultipath-don-t-return-error-on-invalid-values.patch
    * Above 8 patches fix bz #1900595
  - Add 0087-multipathd-avoid-unnecessary-path-read-only-reloads.patch
    * Fixes bz #2009624
  - Resolves: bz #1900595, #2009624, #2021823


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-21
changelog:
  - Add 0088-libmultipath-make-helper-function-to-trigger-path-ue.patch
  - Add 0089-multipathd-trigger-udev-change-on-path-addition.patch
  - Resolves: bz #1862032


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-23
changelog:
  - Add 0091-multipath-tools-add-HPE-MSA-1060-2060-to-hwtable.patch
    * Partial fix for bz #2058222
  - Add 0092-multipath-tools-update-mpp-force_readonly-in-ev_add_.patch
    * Fixes bz #2065468
  - Add 0093-updated-HPE-MSA-builtin-config.patch
    * Fixes bz #2058222
  - Resolves bz #2065468, #2058222


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-24
changelog:
  - Add 0094-multipath-return-failure-on-an-invalid-remove-comman.patch
    * Fixes bz #2052054
  - Add 0095-libmultipath-steal-the-src-string-pointer-in-merge_s.patch
  - Add 0096-libmultipath-enable-linear-ordering-of-bus-proto-tup.patch
  - Add 0097-libmultipath-use-bus_protocol_id-in-snprint_path_pro.patch
  - Add 0098-libmultipath-make-protocol_name-global.patch
  - Add 0099-libmultipath-add-a-protocol-subsection-to-multipath..patch
  - Add 0100-libmultipath-Set-the-scsi-timeout-parameters-by-path.patch
  - Add 0101-libmultipath-check-the-overrides-pctable-for-path-va.patch
  - Add 0102-libmultipath-fix-eh_deadline-documentation.patch
  - Add 0103-libmultipath-Add-documentation-for-the-protocol-subs.patch
  - Add 0104-libmultipath-use-symbolic-value-for-invalid-pcentry.patch
    * The above 10 patches implement feature from bz #2065477
  - Resolves: bz #2052054, #2065477


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-25
changelog:
  - Add 0105-multipathd-handle-fpin-events.patch
  - Add 0106-multipathd-disallow-changing-to-from-fpin-marginal-p.patch
  - Resolves: bz #2083077


author: Benjamin Marzinski <bmarzins@redhat.com> 0.8.4-27
changelog:
  - Add 0108-multipathd-Add-missing-ctype-include.patch
  - Add 0109-multipathd-replace-libreadline-with-libedit.patch
    * replace readline with libedit, to avoid license conflicts
  - Resolves: bz #2119887


author: Rob Crittenden <rcritten@redhat.com> - 1.51.0-7
changelog:
  - lib: Prevent more integer overflows (CVE-2022-22822 to CVE-2022-22827)
    (#2058567, #2058576, #2058582, #2058589, #2058595, #2058602)
  - Prevent integer overflow on m_groupSize in doProlog
    (CVE-2021-46143) (#2058560)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.345.b01-1
changelog:
  - Update to shenandoah-jdk8u345-b01 (GA)
  - Update release notes for 8u345-b01.
  - Resolves: rhbz#2115457


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-1
changelog:
  - Update to shenandoah-jdk8u352-b08 (GA)
  - Update release notes for shenandoah-8u352-b08.
  - Rebase FIPS patch against 8u352-b07
  - * This tarball is embargoed until 2022-10-18 @ 1pm PT. *
  - Resolves: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.352.b08-2
changelog:
  - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
  - Add test to ensure timezones can be translated
  - Related: rhbz#2133695


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-1
changelog:
  - Update to jdk-11.0.16.1+1
  - Update release notes to 11.0.16.1+1
  - Add patch to provide translations for Europe/Kyiv added in tzdata2022b
  - Add test to ensure timezones can be translated
  - Resolves: rhbz#2121184


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Omair Majid <omajid@redhat.com> - 6.0.100-1
changelog:
  - Fix build against clang 13
  - Resolves: RHBZ#2003061
  - Resolves: RHBZ#2015536
  - Resolves: RHBZ#2014666


author: Ray Strode <rstrode@redhat.com> - 40.0-24
changelog:
  - Fix typo that prevents the correct session type from being
    used when user switching.
    Resolves: #2034092


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-12
changelog:
  - kvm-display-qxl-render-fix-race-condition-in-qxl_cursor-.patch [bz#2040738]
  - kvm-vhost-vsock-detach-the-virqueue-element-in-case-of-e.patch [bz#2063262]
  - Resolves: bz#2040738
    (CVE-2021-4207 virt:rhel/qemu-kvm: QEMU: QXL: double fetch in qxl_cursor() can lead to heap buffer overflow [rhel-8])
  - Resolves: bz#2063262
    (CVE-2022-26354 virt:rhel/qemu-kvm: QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak [rhel-8])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-13
changelog:
  - kvm-s390x-ipl-support-extended-kernel-command-line-size.patch [bz#2043830]
  - kvm-virtio-net-fix-map-leaking-on-error-during-receive.patch [bz#2063206]
  - kvm-qcow2-Improve-refcount-structure-rebuilding.patch [bz#1519071]
  - kvm-iotests-108-Test-new-refcount-rebuild-algorithm.patch [bz#1519071]
  - kvm-qcow2-Add-errp-to-rebuild_refcount_structure.patch [bz#1519071]
  - kvm-iotests-108-Fix-when-missing-user_allow_other.patch [bz#1519071]
  - Resolves: bz#2043830
    ([IBM 8.7 FEAT] KVM: Allow long kernel command lines for QEMU)
  - Resolves: bz#2063206
    (CVE-2022-26353 virt:rhel/qemu-kvm: QEMU: virtio-net: map leaking on error during receive [rhel-8])
  - Resolves: bz#1519071
    (Fail to rebuild the reference count tables of qcow2 image on host block devices (e.g. LVs))


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-14
changelog:
  - kvm-Revert-redhat-Add-some-devices-for-exporting-upstrea.patch [bz#2065043]
  - kvm-target-i386-properly-reset-TSC-on-reset.patch [bz#2070417]
  - kvm-ui-cursor-fix-integer-overflow-in-cursor_alloc-CVE-2.patch [bz#2040734]
  - Resolves: bz#2065043
    (Remove upstream-only devices from the qemu-kvm binary)
  - Resolves: bz#2070417
    (Windows guest hangs after updating and restarting from the guest OS [rhel-8.7.0])
  - Resolves: bz#2040734
    (CVE-2021-4206 virt:rhel/qemu-kvm: QEMU: QXL: integer overflow in cursor_alloc() can lead to heap buffer overflow [rhel-8.7])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-15
changelog:
  - kvm-virtio-gpu-do-not-byteswap-padding.patch [bz#1916415]
  - kvm-linux-headers-update-to-5.16-rc1.patch [bz#1916415]
  - kvm-linux-headers-Update-headers-to-v5.17-rc1.patch [bz#1916415]
  - kvm-linux-headers-include-missing-changes-from-5.17.patch [bz#1916415]
  - kvm-x86-Fix-the-64-byte-boundary-enumeration-for-extende.patch [bz#1916415]
  - kvm-x86-Add-AMX-XTILECFG-and-XTILEDATA-components.patch [bz#1916415]
  - kvm-x86-Grant-AMX-permission-for-guest.patch [bz#1916415]
  - kvm-x86-Add-XFD-faulting-bit-for-state-components.patch [bz#1916415]
  - kvm-x86-Add-AMX-CPUIDs-enumeration.patch [bz#1916415]
  - kvm-x86-add-support-for-KVM_CAP_XSAVE2-and-AMX-state-mig.patch [bz#1916415]
  - kvm-x86-Support-XFD-and-AMX-xsave-data-migration.patch [bz#1916415]
  - kvm-target-i386-kvm-do-not-access-uninitialized-variable.patch [bz#1916415]
  - kvm-KVM-x86-workaround-invalid-CPUID-0xD-9-info-on-some-.patch [bz#1916415]
  - kvm-virtio-net-setup-vhost_dev-and-notifiers-for-cvq-onl.patch [bz#2069946]
  - kvm-virtio-net-align-ctrl_vq-index-for-non-mq-guest-for-.patch [bz#2069946]
  - kvm-vhost-vdpa-fix-improper-cleanup-in-net_init_vhost_vd.patch [bz#2069946]
  - kvm-vhost-net-fix-improper-cleanup-in-vhost_net_start.patch [bz#2069946]
  - kvm-vhost-vdpa-backend-feature-should-set-only-once.patch [bz#2069946]
  - kvm-vhost-vdpa-change-name-and-polarity-for-vhost_vdpa_o.patch [bz#2069946]
  - kvm-virtio-net-don-t-handle-mq-request-in-userspace-hand.patch [bz#2069946]
  - kvm-ide-Increment-BB-in-flight-counter-for-TRIM-BH.patch [bz#2029980]
  - kvm-block-Make-bdrv_refresh_limits-non-recursive.patch [bz#2072932]
  - kvm-iotests-Allow-using-QMP-with-the-QSD.patch [bz#2072932]
  - kvm-iotests-graph-changes-while-io-New-test.patch [bz#2072932]
  - Resolves: bz#1916415
    ([Intel 8.7 FEAT] qemu-kvm Sapphire Rapids (SPR) AMX Instructions)
  - Resolves: bz#2069946
    (PXE boot crash qemu when using multiqueue vDPA)
  - Resolves: bz#2029980
    (Failed assertion in IDE emulation with Ceph backend)
  - Resolves: bz#2072932
    (Qemu coredump when refreshing block limits on an actively used iothread block device [rhel.8.7])


author: Jon Maloy <jmaloy@redhat.com> - 6.2.0-16
changelog:
  - kvm-virtiofsd-Fix-breakage-due-to-fuse_init_in-size-chan.patch [bz#2097209]
  - kvm-hw-block-fdc-Prevent-end-of-track-overrun-CVE-2021-3.patch [bz#1951521]
  - kvm-tests-qtest-fdc-test-Add-a-regression-test-for-CVE-2.patch [bz#1951521]
  - Resolves: bz#2097209
    ([virtiofs] mount virtiofs failed: SELinux: (dev virtiofs, type virtiofs) getxattr errno 111)
  - Resolves: bz#1951521
    (CVE-2021-3507 virt:rhel/qemu-kvm: QEMU: fdc: heap buffer overflow in DMA read data transfers [rhel-8])


author: Camilla Conte <cconte@redhat.com> - 6.2.0-17
changelog:
  - kvm-migration-Never-call-twice-qemu_target_page_size.patch [bz#2072049]
  - kvm-multifd-Rename-used-field-to-num.patch [bz#2072049]
  - kvm-multifd-Add-missing-documentation.patch [bz#2072049]
  - kvm-multifd-The-variable-is-only-used-inside-the-loop.patch [bz#2072049]
  - kvm-multifd-remove-used-parameter-from-send_prepare-meth.patch [bz#2072049]
  - kvm-multifd-remove-used-parameter-from-send_recv_pages-m.patch [bz#2072049]
  - kvm-multifd-Fill-offset-and-block-for-reception.patch [bz#2072049]
  - kvm-multifd-Make-zstd-compression-method-not-use-iovs.patch [bz#2072049]
  - kvm-multifd-Make-zlib-compression-method-not-use-iovs.patch [bz#2072049]
  - kvm-migration-All-this-fields-are-unsigned.patch [bz#2072049]
  - kvm-multifd-Move-iov-from-pages-to-params.patch [bz#2072049]
  - kvm-multifd-Make-zlib-use-iov-s.patch [bz#2072049]
  - kvm-multifd-Make-zstd-use-iov-s.patch [bz#2072049]
  - kvm-multifd-Remove-send_write-method.patch [bz#2072049]
  - kvm-multifd-Use-a-single-writev-on-the-send-side.patch [bz#2072049]
  - kvm-multifd-Use-normal-pages-array-on-the-send-side.patch [bz#2072049]
  - kvm-QIOChannel-Add-flags-on-io_writev-and-introduce-io_f.patch [bz#2072049]
  - kvm-QIOChannelSocket-Implement-io_writev-zero-copy-flag-.patch [bz#2072049]
  - kvm-migration-Add-zero-copy-send-parameter-for-QMP-HMP-f.patch [bz#2072049]
  - kvm-migration-Add-migrate_use_tls-helper.patch [bz#2072049]
  - kvm-multifd-multifd_send_sync_main-now-returns-negative-.patch [bz#2072049]
  - kvm-multifd-Send-header-packet-without-flags-if-zero-cop.patch [bz#2072049]
  - kvm-multifd-Implement-zero-copy-write-in-multifd-migrati.patch [bz#2072049]
  - kvm-QIOChannelSocket-Introduce-assert-and-reduce-ifdefs-.patch [bz#2072049]
  - kvm-QIOChannelSocket-Fix-zero-copy-send-so-socket-flush-.patch [bz#2072049]
  - kvm-migration-Change-zero_copy_send-from-migration-param.patch [bz#2072049]
  - kvm-migration-Add-migration_incoming_transport_cleanup.patch [bz#2097652]
  - kvm-migration-Allow-migrate-recover-to-run-multiple-time.patch [bz#2097652]
  - kvm-pc-bios-s390-ccw-virtio-Introduce-a-macro-for-the-DA.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-bootmap-Improve-the-guessing-logic-.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-blkdev-Simplify-fix-virtio_i.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-blkdev-Remove-virtio_assume_.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-Set-missing-status-bits-whil.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-Read-device-config-after-fea.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-Beautify-the-code-for-readin.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-Split-virtio-scsi-code-from-virtio_.patch [bz#2098076]
  - kvm-pc-bios-s390-ccw-virtio-blkdev-Request-the-right-fea.patch [bz#2098076]
  - Resolves: bz#2072049
    (Pull  MSG_ZEROCOPY on QEMU Live Migration Patches into RHEL 8)
  - Resolves: bz#2097652
    (The migration port is not released if use it again for recovering postcopy migration)
  - Resolves: bz#2098076
    (virtio-blk: Can't boot fresh installation from used virtio-blk dasd disk under certain conditions)


