# changelog

author: Peter Bieringer <pb@bieringer.de> - 8.0.9-7
changelog:
  - use latest sources, git commit 9a987645663b2e13191072df9d8866bf65bc85f5
  - add subpackage data-sample including the generated BIN files


author: Peter Bieringer <pb@bieringer.de> - 8.0.9-8
changelog:
  - subpackage data-sample: add suffix "SAMPLE" to included BIN files, fix file permissions
  - use latest sources, git commit 6e49424dfc998856fa790df498bf77520e72ca28


author: Remi Collet <remi@remirepo.net> - 8.0.9-0
changelog:
  - sync with Fedora and rename to IP2location
  - rebuild for #remirepo with release = 0
    to manage update from old version


author: Remi Collet <remi@remirepo.net> - 6.9.4.2-1
changelog:
  - update to version 6.9.4 patchlevel 2
  - open https://github.com/ImageMagick/ImageMagick/issues/202
    6.9.4-2 failed test validate-formats-disk.tap


author: Remi Collet <remi@remirepo.net> - 6.9.5.5-1
changelog:
  - update to version 6.9.5 patchlevel 5
  - add upstream patch for
    https://github.com/ImageMagick/ImageMagick/issues/245


author: Remi Collet <remi@remirepo.net> - 6.9.10.2-2
changelog:
  - change perl version from 6.9A to 6.99 for old perl
    fix Invalid version format (non-numeric data)
    reported as https://github.com/ImageMagick/ImageMagick6/issues/11


author: Remi Collet <remi@remirepo.net> - 6.9.10.35-1
changelog:
  - update to version 6.9.10 patch level 35
  - open https://github.com/ImageMagick/ImageMagick6/issues/37 failed test


author: Remi Collet <remi@remirepo.net> - 6.9.10.45-1
changelog:
  - update to version 6.9.10 patch level 45
  - add HEIC support using libheif from RPMFusion
    in optional heic subpackage


author: Remi Collet <remi@remirepo.net> - 6.9.11.5-1
changelog:
  - update to version 6.9.11 patch level 5
  - open https://github.com/ImageMagick/ImageMagick6/issues/80 failed tests


author: Remi Collet <remi@remirepo.net> - 6.9.6.8-1
changelog:
  - update to version 6.9.6 patchlevel 8
  - new soname libMagickCore=3, libMagickWand=3, libMagick++=7
  - rename to ImageMagick6


author: Remi Collet <remi@remirepo.net> - 6.9.7.1-1
changelog:
  - update to version 6.9.7 patchlevel 1 (broken)
  - open https://github.com/ImageMagick/ImageMagick/issues/340


author: Remi Collet <remi@remirepo.net> - 6.9.8.7-1
changelog:
  - update to version 6.9.8 patch level 7
  - open https://github.com/ImageMagick/ImageMagick/issues/501
    failed tests retaled to openjp2


author: Remi Collet <remi@remirepo.net> - 6.9.9.5-1
changelog:
  - update to version 6.9.9 patch level 5
  - libMagickCore soname bump to 5
  - libMagickWand soname bump to 5
  - libMagick++ soname bump to 8
  - enable raw support


author: Remi Collet <remi@remirepo.net> - 6.9.10.54-1
changelog:
  - update to version 6.9.10 patch level 54
  - build with IMPNG_SETJMP_IS_THREAD_SAFE
  - fix pkgconfig files using patch from
    https://github.com/ImageMagick/ImageMagick6/pull/53


author: Remi Collet <remi@remirepo.net> - 7.0.3.1-1
changelog:
  - update to version 7.0.3 patchlevel 1
  - flag configuration files as %config
  - don't relocate config and date directory


author: Remi Collet <remi@remirepo.net> - 7.0.3.1-1
changelog:
  - update to version 7.0.3 patchlevel 1
  - flag configuration files as %config
  - don't relocate config and data directory


author: Remi Collet <remi@remirepo.net> - 7.0.3.3-1
changelog:
  - update to version 7.0.3 patchlevel 3
  - open https://github.com/ImageMagick/ImageMagick/issues/284
    3 failed tests
  - add upstream patch for #284


author: Remi Collet <remi@remirepo.net> - 7.0.3.9-1
changelog:
  - update to version 7.0.3 patchlevel 9
  - libMagickCore soname bump to 1
  - libMagick++ soname bump to 1


author: Remi Collet <remi@remirepo.net> - 7.0.4.1-1
changelog:
  - update to version 7.0.4 patchlevel 1 (broken)
  - open https://github.com/ImageMagick/ImageMagick/issues/340


author: Remi Collet <remi@remirepo.net> - 7.0.4.6-1
changelog:
  - update to version 7.0.4 patchlevel 6
  - libMagickCore soname bump to 2
  - open https://github.com/ImageMagick/ImageMagick/issues/363
    failed test on 32bits build


author: Remi Collet <remi@remirepo.net> - 7.0.5.8-1
changelog:
  - update to version 7.0.5 patch level 8
  - open https://github.com/ImageMagick/ImageMagick/issues/501
    failed tests retaled to openjp2


author: Remi Collet <remi@remirepo.net> - 7.0.6.5-1
changelog:
  - update to version 7.0.6 patch level 5
  - libMagickCore soname bump to 3
  - libMagickWand soname bump to 3
  - libMagick++ soname bump to 3
  - enable raw support


author: Remi Collet <remi@remirepo.net> - 7.0.8.35-1
changelog:
  - update to version 7.0.8 patch level 35
  - open https://github.com/ImageMagick/ImageMagick/issues/1529 failed tests


author: Remi Collet <remi@remirepo.net> - 7.0.8.45-1
changelog:
  - update to version 7.0.8 patch level 45
  - add HEIC support using libheif from RPMFusion
    in optional heic subpackage


author: Remi Collet <remi@remirepo.net> - 7.0.8.46-1
changelog:
  - update to version 7.0.8 patch level 46
  - open https://github.com/ImageMagick/ImageMagick/issues/1570
    failed tests on non x86_64 arch


author: Ralph Apel <r.apel@r-apel.de> 0:1.8.1-3
changelog:
  - reduce jpackage-utils BR to 1.7.5 ;-)
  - present ant-trax as symlink to ant-nodeps
  - present ant-nodeps subpackage as providing ans obsoleting ant-trax


author: David Walluck <dwalluck@redhat.com> 0:1.8.2-1
changelog:
  - 1.8.2
  - use included pom files
  - nodeps now part of ant (move compat files to main package)
  - fix location of scripts (broke execute ant task)
  - fix jar names and depmaps
  - fix wrong location of ant home in install
  - move some logic from install to prep


author: David Walluck <dwalluck@redhat.com> 0:1.8.2-2
changelog:
  - install testutil jar
  - move poms to proper subpackages
  - fix manifest_only option
  - fix xalan2 Provides/Obsoletes
  - set ant home in ant.conf


author: Jon Ciesla <limb@jcomserv.net> - 1.26-1
changelog:
  - New upstream, BZ 657207.
  - Migrated from sysv to systemd, BZ 659629.
  - Modified to respect sysconfig settings, BZ 609124.
  - Dropped explicit Requires for ncurses.


author: Jon Ciesla <limburgher@gmail.com> - 1.26-2
changelog:
  - Modify cron setup per BZ 445174 comment #6, BZ 819523.
  - Dropped logrotate, conflicts with atop's logging, BZ 542598.
  - Re-add atop.log logrotate section.


author: Karsten Hopp <karsten@redhat.com> 2.69-2
changelog:
  - spec file changes by Ralf Corsépius:
  - Use %bcond_without for --with/out=check.
  - Add BR: perl(Data::Dumper).
  - Remove BR: automake (Testsuite doesn't need automake).
  - Add BR: gcc-gfortran, erlang (Extend testsuite).
  - Remove TESTSUITEFLAGS (Was referring to autoconf < 2.69).
  - Add rpm-4.9 perl-filters %__provides_exclude, %__requires_exclude.
    Remove rpm-4.8 perl-filters (Address RHBZ 823770).
  - Reflect autoconf being GPLv3'ed.
  - Add BR: perl-macros, Remove BR: perl-devel


author: Pavel Raiskup <praiskup@redhat.com> - 2.69-6
changelog:
  - fedora-review (minor) fixes and typos: trim lines, remove defattr(,,), do not
    run `rm -rf %{buildroot} at the beginning of install section, use curly
    brackets only around rpm macros/variables and not around shell variables,
    remove clean section


author: Pavel Raiskup <praiskup@redhat.com> - 2.69-8
changelog:
  - the 'INSTALL' file can be used as template file for packages which are using
    autoconf - mark it for installation again (#661623)


author: Sergey Budnevitch <sb@nginx.com>
changelog:
  - common configure args are now in macros
  - xslt, image-filter and geoip dynamic modules added
  - 1.9.12


author: Konstantin Pavlov <thresh@nginx.com>
changelog:
  - 1.9.13
  - Added perl and nJScript dynamic modules
  - Fixed Requires section for dynamic modules on CentOS7/RHEL7


author: Paul Howarth <paul@city-fan.org> - 1.10.0-1.0.cf
changelog:
  - Update to 1.10.0
    - Added ares_create_query(), to be used instead of ares_mkquery()
    - ares_inet_ntop() and ares_inet_pton() are now recognized c-ares functions
    - Include the ares_parse_soa_reply.* files in the tarball
    - read_udp_packets: bail out loop on bad sockets
    - get_DNS_AdaptersAddresses: fix IPv6 parsing
    - adig: perror() doesn't work for socket errors on windows
    - ares_parse_aaaa_reply: fix memory leak
    - setup_once.h: HP-UX <sys/socket.h> issue workaround
    - configure: several fixes
    - config-dos.h: define strerror() to strerror_s_() for High-C
    - config-dos.h: define HAVE_CLOSE_S for MSDOS/Watt-32
    - ares_build.h.dist: enhance non-configure GCC ABI detection logic
    - ares.h: stricter CARES_EXTERN linkage decorations logic
    - ares_cancel(): cancel requests safely
    - Protocol parsing: check input data more strictly
    - Library init: be recursive, reference count inits/cleanups
    - ares_parse_txt_reply: return a ares_txt_reply node for each sub-string
    - ares_set_servers_csv: fixed IPv6 address parsing
    - Build: fix build on msvc11
  - Revert to old method of ensuring we use our compiler flags


author: Paul Howarth <paul@city-fan.org> - 1.11.0-1.0.cf
changelog:
  - Update to 1.11.0
    - Add a unit test suite
    - Allow builds with code coverage with --enable-code-coverage configure option
    - Allow library-wide override of malloc/free
    - Allow multiple -s options to the ahost command
    - api: Expose the ares_library_initialized() function
    - api: Add ares_set_sortlist(3) entrypoint
    - api: Add entrypoints to allow use of per-server ports
    - api: Introduce 'ares_parse_txt_reply_ext`
    - api: Add ares_set_socket_configure_callback()
    - timeadd: Make static
    - timeoffset: Made static and private
    - nowarn: Use <limits.h> instead of configure for size of long
    - single_domain: Invalid memory access for empty string input
    - ares_build.h: Fix building on 64-bit powerpc
    - Allow specification of search domain in ahost
    - Don't override explicitly specified search domains
    - ares_parse_soa_reply: Do not leak rr_name on allocation failure
    - Update ahost man page to describe -s option
    - host_callback: Fall back to AF_INET on searching with AF_UNSPEC
    - Add -t u option to ahost
    - CONTRIBUTING: Added
    - ares_set_servers_csv: Fix NULL dereference
    - Fix integer shift overflow if both tcp_socket and udp_socket are set
    - Fix acountry memory leak
    - lookup_service: Prevent tmpbuf from overrunning
    - ares_getnameinfo.3: There is no ares_getaddrinfo
    - init_by_defaults: Continue loop if space for hostname not large enough
    - Destroy options if ares_save_options fails
    - ares__read_line: free buf on realloc failure
    - Added define for visual studio 2013
    - windows: Fix slow DNS lookup issue
    - Use libresolv to initialize cares on iPhone targets
    - buildconf: Remove check for libtool, it only requires libtoolize
    - init_by_resolv_conf: Don't exit loop early leaving uninitialized entries
    - ahost: Check the select() return code
    - configure_socket: Explicitly ignore return code
    - read_tcp_data: Don't try to use NULL pointer after malloc failure
    - Distribute all man pages
    - ares_expand_name: Check for valid bits in label length
    - ares__read_line: Clear buf pointer on realloc failure
    - process_answer: Fix things up correctly when removing EDNS option
    - ares_parse_txt_reply: Propagate errors from per-substring loop
    - ares_gethostbyname: Don't leak valid-but-empty hostent
    - ares_init_options: Don't lose init failure
    - ares_dup: Clear new channel on failure
    - config_sortlist: Free any existing sortlist on (re)alloc failure
    - ares_striendstr: Fix so non-NULL return can happen
    - bitncmp: Update comment to match code behaviour
    - ares_set_servers_csv.3: Make return type match code
    - init_by_resolv_conf: Ignore 'fopen' errors to use default values
    - Use "resolve" as synonym of "dns" in nsswitch.conf
    - ares_win32_init: Make LoadLibrary work when using UNICODE too
    - dist: Distribute README.md
    - configure: Build silently by default
    - ares_dup.3: Remove mention of nonexistent function
  - Drop multilib patch, no longer needed
  - Avoid trying to run the test suite for now since Fedora gmock/gtest seems to
    be borked
  - Add upstream support for disabling tests
    (https://github.com/c-ares/c-ares/issues/44)


author: Paul Howarth <paul@city-fan.org> - 1.12.0-1.0.cf
changelog:
  - Update to 1.12.0
    - api: Add ARES_OPT_NOROTATE optmask value
    - CVE-2016-5180: ares_create_query single byte out of buffer write
    - configure: Acknowledge --disable-tests
    - man pages: Fix typos detected by Lintian
    - test: Add missing #includes for dns-proto.cc
    - test: Avoid in6addr_* constants
    - test: Build with MinGW on AppVeyor
    - Makefile.m32: Add support for extra flags
    - Makefile.m32: Add support for CROSSPREFIX
    - configure: Check if tests can get built before enabled
    - ares_library_cleanup: Reset ares_realloc too
    - ahost.c: Add cast to fix C++ compile
    - test: Only pass unused args to GoogleTest
    - build: Commonize MSVC version detection
    - msvc_ver.inc: Support Visual Studio 2015 Update 1, 2, 3
    - test: For AF_UNSPEC, return CNAME only for AAAA, but valid A record
    - ares_getnameinfo: Explicitly clear struct servent before use
    - test: Update fuzzing function prototype
    - init: Fix nsort initialization
    - test: add fuzzing check script to tests
    - web: http => https
    - read_tcp_data: Remove superfluous NULL check
    - LICENSE.md: Add a stand-alone license file
    - SECURITY.md: Suggested "security process" for the project
    - ares_init_options: Only propagate init failures from options
    - headers: Remove checks for and defines of variable sizes
    - test: Fix gMock to work with gcc ≥ 6.x


author: Paul Howarth <paul@city-fan.org> - 1.13.0-1.0.cf
changelog:
  - Update to 1.13.0
    - cmake build system support added
    - Add virtual function set for socket IO: ares_set_socket_functions
    - CVE-2017-1000381: c-ares NAPTR parser out of bounds access
    - macos: Do not set HAVE_CLOCK_GETTIME_MONOTONIC
    - test: Check ares_create_query with too-long name
    - dist: Add ares_library_initialized.* to the tarball
    - Fix build on OpenBSD
    - dist: Ship msvc_ver.inc too
    - test: Add gTest/gMock files to SOURCES
    - test: Add fuzz entrypoint for ares_create_query()
    - configure: clock_gettime workaround
    - docs: Convert INSTALL to MarkDown and tweak
    - ares_process: Fix return type of socket_create function (Win32 warning)
    - docs: Fixed references to ares_set_local_ip4 and ares_set_local_ip6
    - Windows DNS server sorting
    - Use ares_socklen_t instead of socket_t
    - ares_create_query: Use ares_free, not naked free
    - msvc_ver.inc support most recent Visual Studio 2017
    - acountry: Convert char from ISO-8859-1 to UTF-8
    - ares_expand_name: Limit number of indirections
    - configure: Do not check for ar if specified manually
    - Added support for Windows DNS Suffix Search List
    - ares.h: Support compiling with QNX
  - Drop support for EOL distributions prior to F-13
    - Drop BuildRoot: and Group: tags
    - Drop explicit buildroot cleaning in %install section
    - Drop explicit %clean section


author: Paul Howarth <paul@city-fan.org> - 1.13.0-4.0.cf
changelog:
  - ldconfig replaced by RPM File Triggers from Fedora 28
  - Explicit dependency on pkgconfig no longer needed


author: Paul Howarth <paul@city-fan.org> - 1.14.0-1.0.cf
changelog:
  - Update to 1.14.0
    - android: Introduce new ares_library_init_android() call for Oreo support
    - Fix patch for CVE-2017-1000381 not to be overly aggressive
    - win32: Preserve DNS server order returned by Windows when sorting and
      exclude DNS servers in legacy subnets
    - win32: Support most recent Visual Studio 2017
    - gethostbyaddr should fail with ECANCELLED not ENOTFOUND when ares_cancel
      is called
    - win32: Exclude legacy ipv6 subnets
    - android: Applications compiled for Oreo can no longer use
      __system_property_get and must use Java calls to retrieve DNS servers
    - win32: Force use of ANSI functions
    - CMake minimum version is now 3.1
    - ares_gethostbyname.3: Fix callback status values
    - docs: Document WSAStartup requirement
    - Fix a typo in init_by_resolv_conf
    - Android JNI code leaks local references in some cases
    - Force using the ANSI versions of WinAPI functions


author: Paul Howarth <paul@city-fan.org> - 1.15.0-1.0.cf
changelog:
  - Update to 1.15.0
    - Add ares_init_options() configurability for path to resolv.conf file
    - Ability to exclude building of tools (adig, ahost, acountry) in CMake
    - Android: Support for domain search suffix
    - Report ARES_ENOTFOUND for .onion domain names as per RFC7686
    - AIX build fix for trying to include both nameser_compat.h and
      onameser_compat.h
    - Windows: Improve DNS suffixes extracting from WinNT registry
    - Fix modern GCC warnings
    - Apply the IPv6 server blacklist to all nameserver sources, not just Windows
    - Fix warnings emitted by MSVC when using -W4
    - Prevent changing name servers while queries are outstanding
    - Harden and rationalize c-ares timeout computation
    - Distribute ares_android.h
    - ares_set_servers_csv() on failure should not leave channel in a bad state
    - Add missing docs to distribution
  - Fix soname in %files list to avoid accidental soname bumps


author: Adam Jackson <ajax@redhat.com> 1.12.6-2
changelog:
  - *-x{c,li}b-Don-t-crash-when-swapping-a-0-sized-glyph.patch: Fix some
    crashes when client and server endian don't match.


author: Remi Collet <remi@fedoraproject.org> - 2.5.0-2
changelog:
  - use -Wno-implicit-fallthrough, workaround for GCC 7
  - open https://datastax-oss.atlassian.net/browse/CPP-438
    Broken build with GCC 7 and OpenSSL 1.1


author: Remi Collet <remi@fedoraproject.org> - 2.6.0-1
changelog:
  - update to 2.6.0
  - open https://datastax-oss.atlassian.net/browse/CPP-442
    Broken build on EL-6 64-bit


author: Orion Poplawski <orion@cora.nwra.com> - 0.99.2-1
changelog:
  - Update to 0.99.2
  - Enable llvm
  - Drop cliopts patch fixed upstream, use upstream's "--forground" option name
  - Fix main.cvd (fedora #1325482, epel #1325717)
  - Own bytecode.cld (#1176252) and mirrors.dat, ship bytecode.cvd
  - Update daily.cvd
  - Fixup Requires(pre) usage (#1319151)


author: Robert Scheck <robert@fedoraproject.org> - 0.99.2-2
changelog:
  - Ensure that missing or invalid timezone configuration does not
    mangle /etc/freshclam.conf in %post (#1154756)


author: Orion Poplawski <orion@nwra.com> - 0.99.4-1
changelog:
  - Update to 0.99.4
  - Security fixes CVE-2012-6706 CVE-2017-6419 CVE-2017-11423 CVE-2018-1000085
    CVE-2018-0202


author: Pavel Lisy <pavel.lisy@gmail.com> 1.1a-1
changelog:
  - based on libevent-1.1a-3.2.1
  - name changed to compat-libevent11 for use with new libevent from PGDG84 repository
  - Fix some rpmlint warnings (Devrim)


author: <ruben@rubenkerkhof.com> 1.33-3
changelog:
  - Fixed the xinetd file so there's no need to specify the port in /etc/services
  - Create ssl certificates


author: <ruben@rubenkerkhof.com> 1.33-4
changelog:
  - Included a README.fedora with instructions on how to create a self-signed
    certificate
  - Included a mkcert.sh script to create a self-signed certificate
  - Removed the creation of ssl certificate from the %install section


author: Matthias Saou <http://freshrpms.net/> 1.34-4
changelog:
  - Change configuration directory to be /etc/csync2/ since the program requires
    quite a few files, and putting all of them in /etc/ was messy.
  - Include certificate generation upon package installation, based on mod_ssl.
  - Rewrite the csync2-README.quickstart file.
  - Remove db files upon last removal.


author: Angus Salkeld <asalkeld@redhat.com> - 1.34-6
changelog:
  - Cherry pick upstream commit that uses native gnutls and drops openssl wrapper
  - Fix the discovery of the gnutils package


author: Paul Howarth <paul@city-fan.org> - 7.45.0-1.0.cf
changelog:
  - Update to 7.45.0
    - Added CURLOPT_DEFAULT_PROTOCOL
    - Added new tool option --proto-default
    - getinfo: Added CURLINFO_ACTIVESOCKET
    - Turned CURLINFO_* option docs as stand-alone man pages
    - curl: Point out unnecessary uses of -X in verbose mode
    - curl_global_init_mem.3: Stronger thread safety warning
    - buildconf.bat: Fixed issues when ran in directories with special chars
    - cmake: Fix CurlTests check for gethostbyname_r with 5 arguments
    - generate.bat: Fixed issues when ran in directories with special chars
    - generate.bat: Only call buildconf.bat if it exists
    - generate.bat: Added support for generating only the prerequisite files
    - curl.1: Document weaknesses in SSLv2 and SSLv3
    - CURLOPT_HTTP_VERSION.3: Connection re-use goes before version
    - docs: Update the redirect protocols disabled by default
    - inet_pton.c: Fix MSVC run-time check failure
    - CURLMOPT_PUSHFUNCTION.3: Fix argument types
    - rtsp: Support basic/digest authentication
    - rtsp: Stop reading empty DESCRIBE responses
    - travis: Upgrading to container based build
    - travis.yml: Add OS X testbot
    - FTP: Make state machine not get stuck in state
    - openssl: Handle lack of server cert when strict checking disabled
    - configure: Change functions to detect openssl (clones)
    - configure: Detect latest boringssl
    - runtests: Allow for spaces in server-verify curl custom path
    - http2: on_frame_recv: Get a proper 'conn' for the debug logging
    - ntlm: Mark deliberate switch case fall-through
    - http2: Remove dead code
    - curl_easy_{escape,unescape}.3: "char *" vs. "const char *"
    - curl: Point out the conflicting HTTP methods if used
    - cmake: Added Windows SSL support
    - curl_easy_{escape,setopt}.3: Fix example
    - curl_easy_escape.3: Escape '\n'
    - libcurl.m4: Put braces around empty if body
    - buildconf.bat: Fixed double blank line in 'curl manual' warning output
    - sasl: Only define Curl_sasl_digest_get_pair() when CRYPTO_AUTH enabled
    - inet_pton.c: Fix MSVC run-time check failure
    - CURLOPT_FOLLOWLOCATION.3: Mention methods for redirects
    - http2: Don't pass on Connection: headers
    - nss: Do not directly access SSL_ImplementedCiphers
    - docs: Numerous cleanups and spelling fixes
    - FTP: do_more: Add check for wait_data_conn in upload case
    - parse_proxy: Reject illegal port numbers
    - cmake: IPv6 : Disable Unix header check on Windows platform
    - winbuild: Run buildconf.bat if necessary
    - buildconf.bat: Fix syntax error
    - curl_sspi: Fix possibly undefined CRYPT_E_REVOKED
    - nss: Prevent NSS from incorrectly re-using a session
    - libcurl-errors.3: Add two missing error codes
    - openssl: Fix build with < 0.9.8
    - openssl: Refactor certificate parsing to use OpenSSL memory BIO
    - openldap: Only part of LDAP query results received
    - ssl: Add server cert's "sha256//" hash to verbose
    - NTLM: Reset auth-done when using a fresh connection
    - curl: Generate easysrc only on --libcurl
    - tests: Disable 1801 until fixed
    - CURLINFO_TLS_SESSION: Always return backend info
    - gnutls: Support CURLOPT_KEYPASSWD
    - gnutls: Report actual GnuTLS error message for certificate errors
    - tests: Disable 1510 due to CI-problems on github
    - cmake: Put "winsock2.h" before "windows.h" during configure checks
    - cmake: Ensure discovered include dirs are considered
    - configure: Add missing ')' for CURL_CHECK_OPTION_RT
    - build: Fix failures with -Wcast-align and -Werror
    - FTP: Fix uploading ASCII with unknown size
    - readwrite_data: Set a max number of loops
    - http2: Avoid superfluous Curl_expire() calls
    - http2: Set TCP_NODELAY unconditionally
    - docs: Fix unescaped '\n' in man pages
    - openssl: Fix algorithm init to make (gost) engines work
    - win32: Make recent Borland compilers use long long
    - runtests: Fix pid check in checkdied
    - gopher: Don't send NUL byte
    - tool_setopt: Fix c_escape truncated octal
    - hiperfifo: Fix the pointer passed to WRITEDATA
    - getinfo: Fix return code for unknown CURLINFO options


author: Paul Howarth <paul@city-fan.org> - 7.46.0-1.0.cf
changelog:
  - Update to 7.46.0
    - configure: build silently by default
    - cookies: Add support for Public Suffix List with libpsl
    - vtls: Added support for mbedTLS
    - Added CURLOPT_STREAM_DEPENDS
    - Added CURLOPT_STREAM_DEPENDS_E
    - Added CURLOPT_STREAM_WEIGHT
    - Added CURLFORM_CONTENTLEN
    - oauth2: Added support for OAUTHBEARER SASL mechanism to IMAP, POP3 and SNMP
    - des: Fix header conditional for Curl_des_set_odd_parity
    - ntlm: Get rid of unconditional use of long long
    - CURLOPT_CERTINFO.3: Fix reference to CURLINFO_CERTINFO
    - docs: CURLINFO_LASTSOCKET => CURLINFO_ACTIVESOCKET
    - http2: Fix http2_recv to return -1 if recv returned -1
    - curl_global_init_mem: Set function pointers before doing init
    - ntlm: Error out without 64bit support as the code needs it
    - openssl: Fix set up of pkcs12 certificate verification chain
    - acinclude: Remove PKGCONFIG override
    - test1531: case the size to fix the test on non-largefile builds
    - fread_func: Move callback pointer from set to state struct
    - test1601: Fix compilation with --enable-debug and --disable-crypto-auth
    - http2: Don't pass uninitialized name+len pairs to nghttp2_submit_request
    - curlbuild.h: Fix non-configure compiling to mips and sh4 targets
    - tool: Generate easysrc with last cache linked-list
    - cmake: Fix for add_subdirectory(curl) use-case
    - vtls: Fix compiler warning for TLS backends without sha256
    - build: Fix for MSDOS/djgpp
    - checksrc: Add crude // detection
    - http2: on_frame_recv: Trust the conn/data input
    - ftp: Allow CURLOPT_IGNORE_CONTENT_LENGTH to ignore size
    - polarssl/mbedtls: Fix name space pollution
    - build: Fix mingw ssl gdi32 order
    - build: Fix support for PKG_CONFIG
    - MacOSX-Framework: sdk regex fix for sdk 10.10 and later
    - socks: Fix incorrect port numbers in failed connect messages
    - curl.1: -E: s/private certificate/client certificate/
    - curl.h: s/HTTPPOST_/CURL_HTTPOST_/
    - curl_formadd: Support >2GB files on windows
    - http redirects: %-encode bytes outside of ascii range
    - rawstr: Speed up Curl_raw_toupper by 40%
    - curl_ntlm_core: Fix 2 curl_off_t constant overflows
    - getinfo: CURLINFO_ACTIVESOCKET: Fix bad socket value
    - tftp tests: Verify sent options too
    - imap: Don't call imap_atom() when no mailbox specified in LIST command
    - imap: Fixed double quote in LIST command when mailbox contains spaces
    - imap: Don't check for continuation when executing a CUSTOMREQUEST
    - acinclude: Remove check for 16-bit curl_off_t
    - BoringSSL: Work with stricter BIO_get_mem_data()
    - cmake: Add missing feature macros in config header
    - sasl_sspi: Fixed unicode build for digest authentication
    - sasl_sspi: Fix identity memory leak in digest authentication
    - unit1602: Fixed failure in torture test
    - unit1603: Added unit tests for hash functions
    - vtls/openssl: Remove unused traces of yassl ifdefs
    - openssl: Remove #ifdefs for < 0.9.7 support
    - typecheck-gcc.h: Add some missing options
    - curl: Mark two more options strings for --libcurl output
    - openssl: Free modules on cleanup
    - CURLMOPT_PUSHFUNCTION.3: *_byname() returns only the first header
    - getconnectinfo: Don't call recv(2) if socket == -1
    - http2: http_done: Don't free already-freed push headers
    - zsh completion: Preserve single quotes in output
    - os400: Provide options for libssh2 use in compile scripts
    - build: Fix theoretical infinite loops
    - pop3: Differentiate between success and continuation responses
    - examples: Fixed compilation warnings
    - schannel: Use GetVersionEx() when VerifyVersionInfo() isn't available
    - CURLOPT_HEADERFUNCTION.3: fix typo
    - curl: Expanded the -XHEAD warning text
    - done: Make sure the final progress update is made
    - build: Install zsh completion
    - RTSP: Do not add if-modified-since without timecondition
    - curl: Fixed display of URL index in password prompt for --next
    - nonblock: Fix setting non-blocking mode for Amiga
    - http2 push: Add missing inits of new stream
    - http2: Convert some verbose output into debug-only output
    - Curl_read_plain: clean up ifdefs that break statements
  - Explicitly turn off silent building so we can see the compiler flags used
  - Disable OAUTHBEARER tests since they don't work with custom test ports


author: Paul Howarth <paul@city-fan.org> - 7.47.0-1.0.cf
changelog:
  - Update to 7.47.0
    - version: Add flag CURL_VERSION_PSL for libpsl
    - http: Added CURL_HTTP_VERSION_2TLS to do HTTP/2 for HTTPS only
    - curl: Use 2TLS by default
    - curl --expect100-timeout: added
    - Add .dir-locals and set c-basic-offset to 2 (for emacs)
    - curl: Avoid local drive traversal when saving file on Windows
      (CVE-2016-0754)
    - NTLM: Do not resuse proxy connections without diff proxy credentials
      (CVE-2016-0755)
    - tests: Disable the OAUTHBEARER tests when using a non-default port number
    - curl: Remove keepalive #ifdef checks done on libcurl's behalf
    - formdata: Check if length is too large for memory
    - lwip: Fix compatibility issues with later versions
    - openssl: BoringSSL doesn't have CONF_modules_free
    - config-win32: Fix warning HAVE_WINSOCK2_H undefined
    - build: Fix compilation error with CURL_DISABLE_VERBOSE_STRINGS
    - http2: Fix hanging paused stream
    - scripts/Makefile: Fix GNUism and survive no perl
    - openssl: Adapt to 1.1.0+ name changes
    - openssl: Adapt to openssl ≥ 1.1.0 X509 opaque structs
    - HTTP2.md: Spell fix and remove TODO now implemented
    - setstropt: const-correctness
    - cyassl: Fix compiler warning on type conversion
    - gskit: Fix host subject altname verification
    - http2: Support trailer fields
    - wolfssl: Handle builds without SSLv3 support
    - cyassl: Deal with lack of *get_peer_certificate
    - sockfilt: Do not wait on unreliable file or pipe handle
    - make: Build zsh script even in an out-of-tree build
    - test 1326: Fix getting stuck on Windows
    - test 87: Fix file check on Windows
    - configure: Allow static builds on mingw
    - configure: Detect IPv6 support on Windows
    - ConnectionExists: With *PIPEWAIT, wait for connections
    - Makefile.inc: s/curl_SOURCES/CURL_FILES
    - test 16: Fixed for Windows
    - test 252-255: Use datacheck mode text for ASCII-mode LISTings
    - tftpd server: Add Windows support by writing files in binary mode
    - ftplistparser: Fix handling of file LISTings using Windows EOL
    - tests first.c: Fix calculation of sleep timeout on Windows
    - tests (several): Use datacheck mode text for ASCII-mode LISTings
    - CURLOPT_RANGE.3: For HTTP servers, range support is optional
    - test 1515: Add MSYS support by passing a relative path
    - curl_global_init.3: Add Windows-specific info for init via DLL
    - http2: Fix client write for trailers on stream close
    - mbedtls: Fix ALPN support
    - connection reuse: IDN host names fixed
    - http2: Fix PUSH_PROMISE headers being treated as trailers
    - http2: Handle the received SETTINGS frame
    - http2: Ensure that http2_handle_stream_close is called
    - mbedtls: Implement CURLOPT_PINNEDPUBLICKEY
    - runtests: Add mbedTLS to the SSL backends
    - IDN host names: Remove the port number before converting to ACE
    - zsh.pl: Fail if no curl is found
    - scripts: Fix zsh completion generation
    - scripts: Don't generate and install zsh completion when cross-compiling
    - lib: Prefix URLs with lower-case protocol names/schemes
    - ConnectionExists: Only do pipelining/multiplexing when asked
    - configure: Assume IPv6 works when cross-compiled
    - openssl: For 1.1.0+ they now provide a SSLeay() macro of their own
    - openssl: Improved error detection/reporting
    - ssh: CURLOPT_SSH_PUBLIC_KEYFILE now treats "" as NULL again
    - mbedtls: Fix pinned key return value on fail
    - maketgz: Generate date stamp with LC_TIME=C
  - Re-enable previously-disabled tests
  - Fix FTBFS when building curl dynamically with no libcurl.so.4 in system


author: Paul Howarth <paul@city-fan.org> - 7.47.1-1.0.cf
changelog:
  - Update to 7.47.1
    - getredirect.c: Fix variable name
    - tool_doswin: Silence unused function warning
    - cmake: Fixed when OpenSSL enabled on Windows and schannel detected
    - curl.1: Explain remote-name behavior if file already exists
    - tool_operate: Don't sanitize --output path (Windows)
    - URLs: Change all http:// URLs to https:// in documentation & comments
    - sasl_sspi: Fix memory leak in domain populate
    - COPYING: Clarify that Daniel is not the sole author
    - examples/htmltitle: Use _stricmp on Windows
    - examples/asiohiper: Avoid function name collision on Windows
    - idn_win32: Better error checking
    - openssl: Fix signed/unsigned mismatch warning in X509V3_ext
    - curl save files: Check for backslashes on cygwin
  - Update patches as needed


author: Paul Howarth <paul@city-fan.org> - 7.48.0-1.0.cf
changelog:
  - Update to 7.48.0
    - configure: --with-ca-fallback: Use built-in TLS CA fallback
    - TFTP: Add --tftp-no-options to expose CURLOPT_TFTP_NO_OPTIONS
    - getinfo: CURLINFO_TLS_SSL_PTR supersedes CURLINFO_TLS_SESSION
    - Added CODE_STYLE.md
    - Proxy-Connection: Stop sending this header by default
    - os400: Sync ILE/RPG definitions with latest public header files
    - cookies: Allow spaces in cookie names, cut off trailing spaces
    - tool_urlglob: Allow reserved dos device names (Windows)
    - openssl: Remove most BoringSSL #ifdefs
    - tool_doswin: Support for literal path prefix \\?\
    - mbedtls: Fix ALPN usage segfault
    - mbedtls: Fix memory leak when destroying SSL connection data
    - nss: Do not count enabled cipher-suites
    - examples/cookie_interface.c: Add cleanup call
    - examples: Adhere to curl code style
    - curlx_tvdiff: Handle 32bit time_t overflows
    - dist: Ship buildconf.bat too
    - curl.1: --disable-{eprt,epsv} are ignored for IPv6 hosts
    - generate.bat: Fix comment bug by removing old comments
    - test1604: Add to Makefile.inc so it gets run
    - gtls: Fix for builds lacking encrypted key file support
    - SCP: Use libssh2_scp_recv2 to support > 2GB files on windows
    - CURLOPT_CONNECTTIMEOUT_MS.3: Fix example to use milliseconds option
    - cookie: Do not refuse cookies to localhost
    - openssl: Avoid direct PKEY access with OpenSSL 1.1.0
    - http: Don't break the header into chunks if HTTP/2
    - http2: Don't decompress gzip decoding automatically
    - curlx.c: i2s_ASN1_IA5STRING() clashes with an openssl function
    - curl.1: Add a missing dash
    - curl.1: HTTP headers for --cookie must be Set-Cookie style
    - CURLOPT_COOKIEFILE.3: HTTP headers must be Set-Cookie style
    - curl_sasl: Fix memory leak in digest parser
    - src/Makefile.m32: Add CURL_{LD,C}FLAGS_EXTRAS support
    - CURLOPT_DEBUGFUNCTION.3: Fix example
    - runtests: Fixed usage of %PWD on MinGW64
    - tests/sshserver.pl: Use RSA instead of DSA for host auth
    - multi_remove_handle: Keep the timeout list until after disconnect
    - Curl_read: Check for activated HTTP/1 pipelining, not only requested
    - configure: Warn on invalid ca bundle or path
    - file: Try reading from files with no size
    - getinfo: Add support for mbedTLS TLS session info
    - formpost: Fix memory leaks in AddFormData error branches
    - makefile.m32: Allow to pass .dll/.exe-specific LDFLAGS
    - url: If Curl_done is premature then pipeline not in use
    - cookie: Remove redundant check
    - cookie: Don't expire session cookies in remove_expired
    - makefile.m32: Fix to allow -ssh2-winssl combination
    - checksrc.bat: Fixed cannot find perl if installed but not in path
    - build-openssl.bat: Fixed cannot find perl if installed but not in path
    - mbedtls: Fix user-specified SSL protocol version
    - makefile.m32: Add missing libs for static -winssl-ssh2 builds
    - test46: Change cookie expiry date
    - pipeline: Sanity check pipeline pointer before accessing it
    - openssl: Use the correct OpenSSL/BoringSSL/LibreSSL in messages
    - ftp_done: Clear tunnel_state when secondary socket closes
    - opt-docs: Fix heading macros
    - imap/pop3/smtp: Fixed connections upgraded with TLS are not reused
    - curl_multi_wait: Never return -1 in 'numfds'
    - url.c: Fix clang warning: no newline at end of file
    - krb5: Improved type handling to avoid clang compiler warnings
    - cookies: First n/v pair in Set-Cookie: is the cookie, then parameters
    - multi: Avoid blocking during CURLM_STATE_WAITPROXYCONNECT
    - multi hash: Ensure modulo performed on curl_socket_t
    - curl: glob_range: No need to check unsigned variable for negative
    - easy: Add check to malloc() when running event-based
    - CURLOPT_SSLENGINE.3: Only for OpenSSL built with engine support
    - version: Thread safety
    - openssl: verbose: Show matching SAN pattern
    - openssl: Adapt to OpenSSL 1.1.0 API breakage in ERR_remove_thread_state()
    - formdata.c: Fixed compilation warning
    - configure: Use cpp -P when needed
    - imap.c: Fixed compilation warning with /Wall enabled
    - config-w32.h: Fixed compilation warning when /Wall enabled
    - ftp/imap/pop3/smtp: Fixed compilation warning when /Wall enabled
    - build: Added missing Visual Studio filter files for VC10 onwards
    - easy: Remove poll failure check in easy_transfer
    - mbedtls: Fix compiler warning
    - build-wolfssl: Update VS properties for wolfSSL v3.9.0
    - Fixed various compilation warnings when verbose strings disabled
  - Update patches as needed


author: Paul Howarth <paul@city-fan.org> - 7.50.0-1.1.cf
changelog:
  - Fix confusion in test suite about whether or not HTTP2 support is available
  - Use the default ports for the test suite; it's not robust enough to support
    running under different ports


author: Paul Howarth <paul@city-fan.org> - 7.50.1-1.0.cf
changelog:
  - Update to 7.50.1
    - TLS: Switch off SSL session id when client cert is used (CVE-2016-5419)
    - TLS: Only reuse connections with the same client cert (CVE-2016-5420)
    - curl_multi_cleanup: Clear connection pointer for easy handles
      (CVE-2016-5421)
    - Include the CURLINFO_HTTP_VERSION(3) man page into the release tarball
    - Include the http2-server.pl script in the release tarball
    - test558: Fix test by stripping file paths from FD lines
    - spnego: Corrected misplaced * in Curl_auth_spnego_cleanup() declaration
    - tests: Fix for http/2 feature
    - cmake: Fix for schannel support
    - curl.h: Make public types void * again
    - win32: Fix a potential memory leak in Curl_load_library
    - travis: Fix OSX build by re-installing libtool
    - mbedtls: Fix debug function name


author: Paul Howarth <paul@city-fan.org> - 7.50.1-2.0.cf
changelog:
  - Work around race condition in PK11_FindSlotByName()
  - Fix incorrect use of a previously loaded certificate from file
    (related to CVE-2016-5420)


author: Paul Howarth <paul@city-fan.org> - 7.50.2-1.0.cf
changelog:
  - Update to 7.50.2
    - nss: Fix incorrect use of a previously loaded certificate from file
      (CVE-2016-7141)
    - nss: Work around race condition in PK11_FindSlotByName()
    - mbedtls: Added support for NTLM
    - SSH: Fixed SFTP/SCP transfer problems
    - multi: Make Curl_expire() work with 0 ms timeouts
    - mk-ca-bundle.pl: -m keeps ca cert meta data in output
    - TFTP: Fix upload problem with piped input
    - CURLOPT_TCP_NODELAY: now enabled by default
    - mbedtls: Set verbose TLS debug when MBEDTLS_DEBUG is defined
    - http2: Always wait for readable socket
    - cmake: Enable win32 large file support by default
    - cmake: Enable win32 threaded resolver by default
    - winbuild: Avoid setting redundant CFLAGS to compile commands
    - curl.h: Make CURL_NO_OLDIES define CURL_STRICTER
    - docs: Make more markdown files use .md extension
    - docs: CONTRIBUTE and LICENSE-MIXING were converted to markdown
    - winbuild: Allow changing C compiler via environment variable CC
    - rtsp: Accept any RTSP session id
    - HTTP: Retry failed HEAD requests on reused connections too
    - configure: Add zlib search with pkg-config
    - openssl: Accept subjectAltName iPAddress if no dNSName match
    - MANUAL: Remove invalid link to LDAP documentation
    - socks: Improved connection procedure
    - proxy: Reject attempts to use unsupported proxy schemes
    - proxy: Bring back use of "Proxy-Connection:"
    - curl: Allow "pkcs11:" prefix for client certificates
    - spnego_sspi: Fix memory leak in case *outlen is zero
    - SOCKS: Improve verbose output of SOCKS5 connection sequence
    - SOCKS: Display the hostname returned by the SOCKS5 proxy server
    - http/sasl: Query authentication mechanism supported by SSPI before using
    - sasl: Don't use GSSAPI authentication when domain name not specified
    - win: Basic support for Universal Windows Platform apps
    - ftp: Fix wrong poll on the secondary socket
    - openssl: Build warning-free with 1.1.0 (again)
    - HTTP: Stop parsing headers when switching to unknown protocols
    - test219: Add http as a required feature
    - TLS: random file/egd doesn't have to match for conn reuse
    - schannel: Disable ALPN for Wine since it is causing problems
    - http2: Make sure stream errors don't needlessly close the connection
    - http2: Return CURLE_HTTP2_STREAM for unexpected stream close
    - darwinssl: --cainfo is intended for backward compatibility only
    - Speed caps: Not based on average speeds anymore
    - configure: Make the cpp -P detection not clobber CPPFLAGS
    - http2: Use named define instead of magic constant in read callback
    - http2: Skip the content-length parsing, detect unknown size
    - http2: Return EOF when done uploading without known size
    - darwinssl: Test for errSecSuccess in PKCS12 import rather than noErr
    - openssl: Fix CURLINFO_SSL_VERIFYRESULT
  - Disable various ssh tests for F12..F15, which are failing for reasons unknown
  - Build with c-ares rather than POSIX threaded DNS resolver for F12..F15,
    which resolves some other test failures, and allows dropping of workaround
    patch for old applications on F12 and F13
  - Update patches as needed


author: Paul Howarth <paul@city-fan.org> - 7.50.3-1.0.cf
changelog:
  - Update to 7.50.3
    - CVE-2016-7167: Escape and unescape integer overflows
    - mk-ca-bundle.pl: Use SHA256 instead of SHA1
    - checksrc: Detect strtok() use
    - errors: New alias CURLE_WEIRD_SERVER_REPLY
    - http2: Support > 64bit sized uploads
    - openssl: Fix bad memory free (regression)
    - CMake: Hide private library symbols
    - http: Refuse to pass on response body when NO_NODY was set
    - cmake: Fix curl-config --static-libs
    - mbedtls: Switch off NTLM in build if md4 isn't available
    - curl: --create-dirs on Windows groks both forward and backward slashes


author: Paul Howarth <paul@city-fan.org> - 7.51.0-1.0.cf
changelog:
  - Update to 7.51.0
    - nss: Additional cipher suites are now accepted by CURLOPT_SSL_CIPHER_LIST
    - New option: CURLOPT_KEEP_SENDING_ON_ERROR
    - CVE-2016-8615: Cookie injection for other servers
    - CVE-2016-8616: Case insensitive password comparison
    - CVE-2016-8617: OOB write via unchecked multiplication
    - CVE-2016-8618: Double-free in curl_maprintf
    - CVE-2016-8619: Double-free in krb5 code
    - CVE-2016-8620: glob parser write/read out of bounds
    - CVE-2016-8621: curl_getdate read out of bounds
    - CVE-2016-8622: URL unescape heap overflow via integer truncation
    - CVE-2016-8623: Use-after-free via shared cookies
    - CVE-2016-8624: Invalid URL parsing with '#'
    - CVE-2016-8625: IDNA 2003 makes curl use wrong host
    - openssl: Fix per-thread memory leak using 1.0.1 or 1.0.2
    - http: Accept "Transfer-Encoding: chunked" for HTTP/2 as well
    - LICENSE-MIXING.md: Update with mbedTLS dual licensing
    - examples/imap-append: Set size of data to be uploaded
    - test2048: Fix url
    - darwinssl: Disable RC4 cipher-suite support
    - CURLOPT_PINNEDPUBLICKEY.3: Fix the AVAILABILITY formatting
    - openssl: Don’t call CRYTPO_cleanup_all_ex_data
    - libressl: Fix version output
    - easy: Reset all statistical session info in curl_easy_reset
    - curl_global_cleanup.3: Don't unload the lib with sub threads running
    - dist: Add CurlSymbolHiding.cmake to the tarball
    - docs: Remove that --proto is just used for initial retrieval
    - configure: Fixed builds with libssh2 in a custom location
    - curl.1: --trace supports % for sending to stderr!
    - cookies: Same domain handling changed to match browser behaviour
    - formpost: Trying to attach a directory no longer crashes
    - CURLOPT_DEBUGFUNCTION.3: Fixed unused argument warning
    - formpost: Avoid silent snprintf() truncation
    - ftp: Fix Curl_ftpsendf
    - mprintf: Return error on too many arguments
    - smb: Properly check incoming packet boundaries
    - GIT-INFO: Remove the Mac 10.1-specific details
    - resolve: Add error message when resolving using SIGALRM
    - cmake: Add nghttp2 support
    - dist: Remove PDF and HTML converted docs from the releases
    - configure: Disable poll() in macOS builds
    - vtls: Only re-use session-ids using the same scheme
    - pipelining: Skip to-be-closed connections when pipelining
    - win: Fix Universal Windows Platform build
    - curl: Do not set CURLOPT_SSLENGINE to DEFAULT automatically
    - maketgz: Make it support "only" generating version info
    - Curl_socket_check: Add extra check to avoid integer overflow
    - gopher: Properly return error for poll failures
    - curl: Set INTERLEAVEDATA too
    - polarssl: Clear thread array at init
    - polarssl: Fix unaligned SSL session-id lock
    - polarssl: Reduce #ifdef madness with a macro
    - curl_multi_add_handle: Set timeouts in closure handles
    - configure: Set min version flags for builds on mac
    - INSTALL: Converted to markdown => INSTALL.md
    - curl_multi_remove_handle: Fix a double-free
    - multi: Fix infinite loop in curl_multi_cleanup()
    - nss: Fix tight loop in non-blocking TLS handshake over proxy
    - mk-ca-bundle: Change URL retrieval to HTTPS-only by default
    - mbedtls: Stop using deprecated include file
    - docs: Fix req->data in multi-uv example
    - configure: Fix test syntax for monotonic clock_gettime
    - CURLMOPT_MAX_PIPELINE_LENGTH.3: Clarify it's not for HTTP/2
  - Use libidn2 from Fedora 25 onwards


author: Paul Howarth <paul@city-fan.org> - 7.52.0-1.0.cf
changelog:
  - Update to 7.52.0
    - nss: Map CURL_SSLVERSION_DEFAULT to NSS default
    - vtls: Support TLS 1.3 via CURL_SSLVERSION_TLSv1_3
    - curl: Introduce the --tlsv1.3 option to force TLS 1.3
    - curl: Add --retry-connrefused
    - proxy: Support HTTPS proxy and SOCKS+HTTP(s)
    - Add CURLINFO_SCHEME, CURLINFO_PROTOCOL, and %{scheme}
    - curl: Add --fail-early
    - CVE-2016-9586: printf floating point buffer overflow
    - CVE-2016-9952: Win CE schannel cert wildcard matches too much
    - CVE-2016-9953: Win CE schannel cert name out of buffer read
    - msvc: Removed a straggling reference to strequal.c
    - winbuild: Remove strcase.obj from curl build
    - examples: Bugfixed multi-uv.c
    - configure: Verify that compiler groks -Werror=partial-availability
    - mbedtls: Fix build with mbedtls versions < 2.4.0
    - dist: Add unit test CMakeLists.txt to the tarball
    - curl -w: Added more decimal digits to timing counters
    - easy: Initialize info variables on easy init and duphandle
    - cmake: Disable poll for macOS
    - http2: Don't send header fields prohibited by HTTP/2 spec
    - ssh: Check md5 fingerprints case insensitively (regression)
    - openssl: Initial TLS 1.3 adaptions
    - curl_formadd.3: *_FILECONTENT and *_FILE need the file to be kept
    - printf: Fix ".*f" handling
    - examples/fileupload.c: fclose the file as well
    - SPNEGO: Fix memory leak when authentication fails
    - realloc: Use Curl_saferealloc to avoid common mistakes
    - openssl: Make sure to fail in the unlikely event that PRNG seeding fails
    - URL-parser: For file://[host]/ URLs, the [host] must be localhost
    - timeval: Prefer time_t to hold seconds instead of long
    - Curl_rand: Fixed and moved to rand.c
    - glob: Fix [a-c] globbing regression
    - darwinssl: Fix SSL client certificate not found on MacOS Sierra
    - curl.1: Clarify --dump-header only writes received headers
    - http2: Fix address sanitizer memcpy warning
    - http2: Use huge HTTP/2 windows
    - connects: Don't mix unix domain sockets with regular ones
    - url: Fix conn reuse for local ports and interfaces
    - x509: Limit ASN.1 structure sizes to 256K
    - checksrc: Add more checks
    - winbuild: Add config option ENABLE_NGHTTP2
    - http2: Check nghttp2_session_set_local_window_size exists
    - http2: Fix crashes when parent stream gets aborted
    - CURLOPT_CONNECT_TO: Skip non-matching "connect-to" entries
    - URL parser: Reject non-numerical port numbers
    - CONNECT: Reject TE or CL in 2xx responses
    - CONNECT: Read responses one byte at a time
    - curl: Support zero-length argument strings in config files
    - openssl: Don't use OpenSSL's ERR_PACK
    - curl.1: Generated with the new man page system
    - curl_easy_recv: Improve documentation and example program
    - Curl_getconnectinfo: Avoid checking if the connection is closed
    - CIPHERS.md: Attempt to document TLS cipher names


author: Paul Howarth <paul@city-fan.org> - 7.52.1-1.0.cf
changelog:
  - Update to 7.52.1
    - CVE-2016-9594: Uninitialized random
    - lib557: Fix checksrc warnings
    - lib: Fix MSVC compiler warnings
    - lib557.c: Use a shorter MAXIMIZE representation
    - tests: Run checksrc on debug builds


author: Paul Howarth <paul@city-fan.org> - 7.53.0-1.0.cf
changelog:
  - Update to 7.53.0
    - CVE-2017-2629: Make SSL_VERIFYSTATUS work again
    - unix_socket: Added --abstract-unix-socket and CURLOPT_ABSTRACT_UNIX_SOCKET
    - CURLOPT_BUFFERSIZE: Support enlarging receive buffer
    - gnutls-random: Check return code for failed random
    - openssl-random: Check return code when asking for random
    - http: Remove "Curl_http_done: called premature" message
    - cyassl: Use time_t instead of long for timeout
    - build-wolfssl: Sync config with wolfSSL 3.10
    - ftp-gss: Check for init before use
    - configure: Accept --with-libidn2 instead
    - ftp: Failure to resolve proxy should return that error code
    - curl.1: Add three more exit codes
    - docs/ciphers: Link to our own new page about ciphers
    - vtls: s/SSLEAY/OPENSSL - fixes multi_socket timeouts with openssl
    - darwinssl: Fix iOS build
    - darwinssl: Fix CFArrayRef leak
    - cmake: Use crypt32.lib when building with OpenSSL on windows
    - curl_formadd.3: CURLFORM_CONTENTSLENGTH not needed when chunked
    - digest_sspi: Copy terminating NUL as well
    - curl: Fix --remote-time incorrect times on Windows
    - curl.1: Several updates and corrections
    - content_encoding: Change return code on a failure
    - curl.h: CURLE_FUNCTION_NOT_FOUND is no longer in use
    - docs: TCP_KEEPALIVE start and interval default to 60
    - darwinssl: --insecure overrides --cacert if both settings are in use
    - TheArtOfHttpScripting: Grammar
    - CIPHERS.md: Document GSKit ciphers
    - wolfssl: Support setting cipher list
    - wolfssl: Display negotiated SSL version and cipher
    - lib506: Fix build for Open Watcom
    - asiohiper: Improved socket handling
    - examples: Make the C++ examples follow our code style too
    - tests/sws: Retry send() on EWOULDBLOCK
    - cmake: Fix passing _WINSOCKAPI_ macro to compiler
    - smtp: Fix STARTTLS denied error message
    - imap/pop3: Don't print response character in STARTTLS denied messages
    - rand: Make it work without TLS backing
    - url: Fix parsing for when 'file' is the default protocol
    - url: Allow file://X:/path URLs on windows again
    - gnutls: Check for alpn and ocsp in configure
    - IDN: Use TR46 'non-transitional' for toASCII translations
    - url: Fix NO_PROXY env var to work properly with --proxy option
    - CURLOPT_PREQUOTE.3: Takes a struct curl_slist*, not a char*
    - docs: Add note about libcurl copying strings to CURLOPT_* manpages
    - curl: Reset the easy handle at --next
    - --next docs: --trace and --trace-ascii are also global
    - --write-out docs: 'time_total' is not always shown with ms precision
    - http: Print correct HTTP string in verbose output when using HTTP/2
    - docs: Improved language in README.md HISTORY.md CONTRIBUTE.md
    - http2: Disable server push if not requested
    - nss: Use the correct lock in nss_find_slot_by_name()
    - usercertinmem.c: Improve the short description
    - CURLOPT_CONNECT_TO: Fix compile warnings
    - docs: Non-blocking SSL handshake is now supported with NSS
    - *.rc: Escape non-ASCII/non-UTF-8 character for clarity
    - mbedTLS: Fix multi interface non-blocking handshake
    - PolarSSL: Fix multi interface non-blocking handshake
    - VC: Remove the makefile.vc6 build infra
    - telnet: Fix windows compiler warnings
    - cookies: Do not assume a valid domain has a dot
    - polarssl: Fix hangs
    - gnutls: Disable TLS session tickets
    - mbedtls: Disable TLS session tickets
    - mbedtls: Implement CTR-DRBG and HAVEGE random generators
    - openssl: Don't use certificate after transferring ownership
    - cmake: Support curl --xattr when built with cmake
    - OS400: Fix symbols
    - docs: Add more HTTPS proxy documentation
    - docs: Use more HTTPS links
    - cmdline-opts: Fixed build and test in out of source tree builds
    - CHANGES.0: Removed
    - schannel: Remove incorrect SNI disabled message
    - darwinssl: Avoid parsing certificates when not in verbose mode
    - test552: Fix typos
    - telnet: Fix typos
    - transfer: Only retry nobody-requests for HTTP
    - http2: Reset push header counter fixes crash
    - nss: Make FTPS work with --proxytunnel
    - test1139: Added the --manual keyword since the manual is required
    - polarssl, mbedtls: Fix detection of pending data
    - http_proxy: Fix tiny memory leak upon edge case connecting to proxy
    - URL: Only accept ";options" in SMTP/POP3/IMAP URL schemes
    - curl.1: ftp.sunet.se is no longer an FTP mirror
    - tool_operate: Show HTTPS-Proxy options on CURLE_SSL_CACERT
    - http2: Fix memory-leak when denying push streams
    - configure: Allow disabling pthreads, fall back on Win32 threads
    - curl: Fix typo in time condition warning message
    - axtls: Adapt to API changes
    - tool_urlglob: Allow a glob range with the same start and stop
    - winbuild: Add note on auto-detection of MACHINE in Makefile.vc
    - http: Fix missing 'Content-Length: 0' while negotiating auth
    - proxy: Fix hostname resolution and IDN conversion
    - docs: Fix timeout handling in multi-uv example
    - digest_sspi: Fix nonce-count generation in HTTP digest
    - sftp: Improved checks for create dir failures
    - smb: Use getpid replacement for windows UWP builds
    - digest_sspi: Handle 'stale=TRUE' directive in HTTP digest


author: Paul Howarth <paul@city-fan.org> - 7.53.1-1.0.cf
changelog:
  - Update to 7.53.1
    - cyassl: Fix typo
    - url: Improve CURLOPT_PROXY_CAPATH error handling
    - urldata: Include curl_sspi.h when Windows SSPI is enabled
    - formdata: check for EOF when reading from stdin
    - tests: Set CHARSET and LANG to UTF-8 in 1035, 2046 and 2047
    - url: Default the proxy CA bundle location to CURL_CA_BUNDLE
    - rand: Added missing #ifdef HAVE_FCNTL_H around fcntl.h header


author: Paul Howarth <paul@city-fan.org> - 7.53.1-4.0.cf
changelog:
  - Fix out of bounds read in curl --write-out (CVE-2017-7407)
  - Make the dependency on nss-pem arch-specific from F-25 onwards (#1428550)
  - Drop support for EOL distributions prior to F-13
    - Drop BuildRoot: and Group: tags
    - Drop buildroot cleaning in %install
    - Drop explicit %clean section
    - Drop explicit dependency on pkgconfig


author: Paul Howarth <paul@city-fan.org> - 7.54.0-1.0.cf
changelog:
  - Update to 7.54.0
    - Add CURL_SSLVERSION_MAX_* constants to CURLOPT_SSLVERSION
    - Add --max-tls
    - Add CURLOPT_SUPPRESS_CONNECT_HEADERS
    - Add --suppress-connect-headers
    - CVE-2017-7468: switch off SSL session id when client cert is used
    - cmake: Replace invalid UTF-8 byte sequence
    - tests: Use consistent environment variables for setting charset
    - proxy: Fixed a memory leak on OOM
    - ftp: Removed an erroneous free in an OOM path
    - docs: De-duplicate file lists in the Makefiles
    - ftp: Fixed a NULL pointer dereference on OOM
    - gopher: Fixed detection of an error condition from Curl_urldecode
    - url: Fix unix-socket support for proxy-disabled builds
    - test1139: Allow for the possibility that the man page is not rebuilt
    - cyassl: Get library version string at runtime
    - digest_sspi: Fix compilation warning
    - tests: Enable HTTP/2 tests to run with non-default port numbers
    - warnless: Suppress compiler warning
    - darwinssl: Warn that disabling host verify also disables SNI
    - configure: Fix for --enable-pthreads
    - checksrc.bat: Ignore curl_config.h.in, curl_config.h
    - no-keepalive.d: Fix typo
    - configure: Fix --with-zlib when a path is specified
    - build: Fix gcc7 implicit fallthrough warnings
    - Fix potential use of uninitialized variables
    - CURLOPT_SSL_CTX_FUNCTION.3: Fix EXAMPLE formatting errors
    - CMake: Reorganize SSL support, separate WinSSL and SSPI
    - CMake: Add DarwinSSL support
    - CMake: Add mbedTLS support
    - ares: Return error at once if timed out before name resolve starts
    - BINDINGS: Added C++, perl, go and Scilab bindings
    - URL: Return error on malformed URLs with junk after port number
    - KNOWN_BUGS: Add DarwinSSL won't import PKCS#12 without a password
    - http2: Fix assertion error on redirect with CL=0
    - updatemanpages.pl: Update man pages to use current date and versions
    - --insecure: Clarify that this option is for server connections
    - mkhelp: Simplified the gzip code
    - build: Fixed making man page in out-of-tree tarball builds
    - tests: Disabled 1903 due to flakiness
    - openssl: Add two /* FALLTHROUGH */ to satisfy coverity
    - cmdline-opts: Fixed a few typos
    - authneg: Clear auth.multi flag at http_done
    - curl_easy_reset: Also reset the authentication state
    - proxy: Skip SSL initialization for closed connections
    - http_proxy: Ignore TE and CL in CONNECT 2xx responses
    - tool_writeout: Fixed a buffer read overrun on --write-out
    - make: Regenerate docs/curl.1 by running make in docs
    - winbuild: Add basic support for OpenSSL 1.1.x
    - build: Removed redundant DEPENDENCIES from makefiles
    - CURLINFO_LOCAL_PORT.3: Added example
    - curl: Show HTTPS-Proxy options on CURLE_SSL_CACERT
    - tests: Strip more options from non-HTTP --libcurl tests
    - tests: Fixed the documented test server port numbers
    - runtests.pl: Fixed display of the Gopher IPv6 port number
    - multi: Fix streamclose() crash in debug mode
    - cmake: Build manual pages
    - cmake: Add support for building HTML and PDF docs
    - mbedtls: Add support for CURLOPT_SSL_CTX_FUNCTION
    - make: Introduce 'test-nonflaky' target
    - CURLINFO_PRIMARY_IP.3: Add example
    - tests/README: Mention nroff for --manual tests
    - mkhelp: Disable compression if the perl gzip module is unavailable
    - openssl: Fall back on SSL_ERROR_* string when no error detail
    - asiohiper: Make sure socket is open in event_cb
    - tests/README: Make "Run" section foolproof
    - curl: Check for end of input in writeout backslash handling
    - .gitattributes: Turn off CRLF for *.am
    - multi: Fix MinGW-w64 compiler warnings
    - schannel: Fix variable shadowing warning
    - openssl: Exclude DSA code when OPENSSL_NO_DSA is defined
    - http: Fix proxy connection reuse with basic-auth
    - pause: Handle mixed types of data when paused
    - http: Do not treat FTPS over CONNECT as HTTPS
    - conncache: Make hashkey avoid malloc
    - make: Use the variable MAKE for recursive calls
    - curl: Fix callback argument inconsistency
    - NTLM: Check for features with #ifdef instead of #if
    - cmake: Add several missing files to the dist
    - select: Use correct SIZEOF_ constant
    - connect: Fix unreferenced parameter warning
    - schannel: Fix unused variable warning
    - gcc7: Fix ‘*’ in boolean context
    - http2: Silence unused parameter warnings
    - ssh: Fix narrowing conversion warning
    - telnet: (win32) Fix read callback return variable
    - docs: Explain --fail-early does not imply --fail
    - docs: Added examples for CURLINFO_FILETIME.3 and CURLOPT_FILETIME.3
    - tests/server/util: Remove in6addr_any for recent MinGW
    - multi: Make curl_multi_wait avoid malloc in the typical case
    - include: curl/system.h is a run-time version of curlbuild.h
    - easy: Silence compiler warning
    - llist: Replace Curl_llist_alloc with Curl_llist_init
    - hash: Move key into hash struct to reduce mallocs
    - url: Don't free postponed data on connection reuse
    - curl_sasl: Declare mechtable static
    - curl: Fix Windows Unicode build
    - multi: Fix queueing of pending easy handles
    - tool_operate: Fix MinGW compiler warning
    - low_speed_limit: Improved function for longer time periods
    - gtls: Fix compiler warning
    - sspi: Print out InitializeSecurityContext() error message
    - schannel: Fix compiler warnings
    - vtls: fix unreferenced variable warnings
    - INSTALL.md: Fix secure transport configure arguments
    - CURLINFO_SCHEME.3: Fix variable type
    - libcurl-thread.3: Also mention threaded-resolver
    - nss: Load CA certificates even with --insecure
    - openssl: Fix this statement may fall through
    - poll: Prefer <poll.h> over <sys/poll.h>
    - polarssl: Unbreak build with versions < 1.3.8
    - Curl_expire_latest: Ignore already expired timers
    - configure: Turn implicit function declarations into errors
    - mbedtls: Fix memory leak in error path
    - http2: Fix handle leak in error path
    - .gitattributes: Force shell scripts to LF
    - configure.ac: Ignore CR after version numbers
    - extern-scan.pl: Strip trailing CR
    - openssl: Make SSL_ERROR_to_str more future-proof
    - openssl: Fix thread-safety bugs in error-handling
    - openssl: Don't try to print nonexistant peer private keys
    - nss: Fix MinGW compiler warnings
  - Switch to lzma-compressed upstream tarball


author: Paul Howarth <paul@city-fan.org> - 7.56.0-1.0.cf
changelog:
  - Update to 7.56.0
    - curl: Enable compression for SCP/SFTP with --compressed-ssh
    - libcurl: Enable compression for SCP/SFTP with CURLOPT_SSH_COMPRESSION
    - vtls: Added dynamic changing SSL backend with curl_global_sslset()
    - New MIME API, curl_mime_init() and friends
    - openssl: Initial SSLKEYLOGFILE implementation
    - FTP: zero terminate the entry path even on bad input (CVE-2017-1000254)
    - examples/ftpuploadresume.c: Use portable code
    - runtests: Match keywords case insensitively
    - travis: Build the examples too
    - strtoofft: Reduce integer overflow risks globally
    - zsh.pl: Produce a working completion script again
    - cmake: Remove dead code for CURL_DISABLE_RTMP
    - progress: Track total times following redirects
    - configure: Fix --disable-threaded-resolver
    - cmake: Remove dead code for DISABLED_THREADSAFE
    - configure: Fix clang version detection
    - darwinssl: Fix error: variable length array used
    - travis: Add metalink to some osx builds
    - configure: Check for __builtin_available() availability
    - http_proxy: Fix build error for CURL_DOES_CONVERSIONS
    - examples/ftpuploadresume: checksrc compliance
    - ftp: Fix CWD when doing multicwd then nocwd on same connection
    - system.h: Remove all CURL_SIZEOF_* defines
    - http: Don't wait on CONNECT when there is no proxy
    - system.h: Check for __ppc__ as well
    - http2_recv: Return error better on fatal h2 errors
    - scripts/contri*sh: Use "git log --use-mailmap"
    - tftp: Fix memory leak on too long filename
    - system.h: Fix build for hppa
    - cmake: Enable picky compiler options with clang and gcc
    - makefile.m32: Add support for libidn2
    - curl: Turn off MinGW CRT's globbing
    - request-target.d: Mention added in 7.55.0
    - curl: Shorten and clean up CA cert verification error message
    - imap: Support PREAUTH
    - CURLOPT_USERPWD.3: See also CURLOPT_PROXYUSERPWD
    - examples/threaded-ssl: Mention that this is for openssl before 1.1
    - winbuild: Fix embedded manifest option
    - tests: Make sure libtests and unittests call curl_global_cleanup()
    - system.h: include sys/poll.h for AIX
    - darwinssl: Handle long strings in TLS certs
    - strtooff: Fix build for systems with long long but no strtoll
    - asyn-thread: Improved cleanup after OOM situations
    - HELP-US.md: "How to get started helping out in the curl project"
    - curl.h: CURLSSLBACKEND_WOLFSSL used wrong value
    - unit1301: Fix error message on first test
    - ossfuzz: Moving towards the ideal integration
    - http: Fix a memory leakage in checkrtspprefix()
    - examples/post-callback: Stop returning one byte at a time
    - schannel: return CURLE_SSL_CACERT on failed verification
    - MAIL-ETIQUETTE: Added "1.9 Your emails are public"
    - http-proxy: Treat all 2xx as CONNECT success
    - openssl: Use OpenSSL's default ciphers by default
    - runtests.pl: Support attribute "nonewline" in part verify/upload
    - configure: Remove --enable-soname-bump and SONAME_BUMP
    - travis: Add c-ares enabled builds linux + osx
    - vtls: Fix WolfSSL 3.12 build problems
    - http-proxy: When not doing CONNECT, that phase is done immediately
    - configure: Fix curl_off_t check's include order
    - configure: Use -Wno-varargs on clang 3.9[.X] debug builds
    - rtsp: Do not call fwrite() with NULL pointer FILE *
    - mbedtls: Enable CA path processing
    - travis: Add build without HTTP/SMTP/IMAP
    - checksrc: Verify more code style rules
    - HTTP proxy: On connection re-use, still use the new remote port
    - tests: Add initial gssapi test using stub implementation
    - rtsp: Segfault when using WRITEDATA
    - docs: Clarify the CURLOPT_INTERLEAVE* options behavior
    - non-ascii: Use iconv() with 'char **' argument
    - server/getpart: Provide dummy function to build conversion enabled
    - conversions: Fix several compiler warnings
    - openssl: Add missing includes
    - schannel: Support partial send for when data is too large
    - socks: Fix incorrect port number in SOCKS4 error message
    - curl: Fix integer overflow in timeout options
  - Re-enable temporarily disabled IDN2 test-cases


author: Paul Howarth <paul@city-fan.org> - 7.56.1-1.0.cf
changelog:
  - Update to 7.56.1
    - imap: If a FETCH response has no size, don't call write callback
      (CVE-2017-1000257)
    - ftp: UBsan fixup 'pointer index expression overflowed
    - failf: Skip the sprintf() if there are no consumers
    - fuzzer: Move to using external curl-fuzzer
    - lib/Makefile.m32: Allow customizing dll suffixes
    - docs: Fix typo in curl_mime_data_cb man page
    - darwinssl: Add support for TLSv1.3
    - build: Fix --disable-crypto-auth
    - lib/config-win32.h: Let SMB/SMBS be enabled with OpenSSL/NSS
    - openssl: Fix build without HAVE_OPAQUE_EVP_PKEY
    - strtoofft: Remove extraneous null check
    - multi_cleanup: Call DONE on handles that never got that
    - tests: Added flaky keyword to tests 587 and 644
    - pingpong: Return error when trying to send without connection
    - remove_handle: Call multi_done() first, then clear dns cache pointer
    - mime: Be tolerant about setting twice the same header list in a part
    - mime: Improve unbinding top multipart from easy handle.
    - mime: Avoid resetting a part's encoder when part's contents change
    - mime: Refuse to add subparts to one of their own descendants
    - RTSP: Avoid integer overflow on funny RTSP responses
    - curl: Don't pass semicolons when parsing Content-Disposition
    - openssl: Enable PKCS12 support for !BoringSSL
    - FAQ: s/CURLOPT_PROGRESSFUNCTION/CURLOPT_XFERINFOFUNCTION
    - CURLOPT_NOPROGRESS.3: Also refer to xferinfofunction
    - CURLOPT_XFERINFODATA.3: Fix duplicate see also
    - test298: Verify --ftp-method nowcwd with URL encoded path
    - FTP: URL decode path for dir listing in nocwd mode
    - smtp_done: Fix memory leak on send failure
    - ftpserver: Support case insensitive commands
    - test950: Verify SMTP with custom request
    - openssl: Don't use old BORINGSSL_YYYYMM macros
    - setopt: Update current connection SSL verify params
    - winbuild/BUILD.WINDOWS.txt: Mention WITH_NGHTTP2
    - curl: Reimplement stdin buffering in -F option
    - mime: Keep "text/plain" content type if user-specified
    - mime: Fix the content reader to handle >16K data properly
    - configure: Remove the C++ compiler check
    - memdebug: Trace send, recv and socket
    - runtests: Use valgrind for torture as well
    - ldap: Silence clang warning
    - makefile.m32: Allow to override gcc, ar and ranlib
    - setopt: Avoid integer overflows when setting millsecond values
    - setopt: Range check most long options
    - ftp: Reject illegal IP/port in PASV 227 response
    - mime: Do not reuse previously computed multipart size
    - vtls: Change struct Curl_ssl 'close' field name to 'close_one'
    - os400: Add missing symbols in config file
    - mime: Limit bas64-encoded lines length to 76 characters
    - mk-ca-bundle: Remove URL for aurora
    - mk-ca-bundle: Fix URL for NSS


author: Paul Howarth <paul@city-fan.org> - 7.57.0-1.0.cf
changelog:
  - Update to 7.57.0
    - auth: Add support for RFC7616 - HTTP Digest access authentication
    - share: Add support for sharing the connection cache
    - HTTP: Implement Brotli content encoding
    - Fix CVE-2017-8816: NTLM buffer overflow via integer overflow
    - Fix CVE-2017-8817: FTP wildcard out of bounds read
    - Fix CVE-2017-8818: SSL out of buffer access
    - curl_mime_filedata.3: Fix typos
    - libtest: Add required test libraries for lib1552 and lib1553
    - Fix time diffs for systems using unsigned time_t
    - ftplistparser: Memory leak fix: always free temporary memory
    - multi: Allow table handle sizes to be overridden
    - wildcards: Don't use with non-supported protocols
    - curl_fnmatch: Return error on illegal wildcard pattern
    - transfer: Fix chunked-encoding upload too early exit
    - curl_setup: Improve detection of CURL_WINDOWS_APP
    - resolvers: Only include anything if needed
    - setopt: Fix CURLOPT_SSH_AUTH_TYPES option read
    - appveyor: Add a win32 build
    - Curl_timeleft: Change return type to timediff_t
    - cmake: Export libcurl and curl targets to use by other cmake projects
    - curl: In -F option arg, comma is a delimiter for files only
    - curl: Improved ";type=" handling in -F option arguments
    - timeval: Use mach_absolute_time() on MacOS
    - curlx: The timeval functions are no longer provided as curlx_*
    - mkhelp.pl: Do not generate comment with current date
    - memdebug: Use send/recv signature for curl_dosend/curl_dorecv
    - cookie: Avoid NULL dereference
    - url: Fix CURLOPT_POSTFIELDSIZE arg value check to allow -1
    - include: Remove conncache.h inclusion from where it's not needed
    - CURLOPT_MAXREDIRS: Allow -1 as a value
    - tests: Fixed torture tests on tests 556 and 650
    - http2: Fixed OOM handling in upgrade request
    - url: Fix CURLOPT_DNS_CACHE_TIMEOUT arg value check to allow -1
    - CURLOPT_INFILESIZE: Accept -1
    - curl: Pass through [] in URLs instead of calling globbing error
    - curl: Speed up handling of many URLs
    - ntlm: Avoid malloc(0) for zero length passwords
    - url: Remove faulty arg value check from CURLOPT_SSH_AUTH_TYPES
    - HTTP: Support multiple Content-Encodings
    - travis: Add a job with brotli enabled
    - url: Remove unnecessary NULL-check
    - fnmatch: Remove dead code
    - connect: Store IPv6 connection status after valid connection
    - imap: Deal with commands case insensitively
    - --interface: Add support for Linux VRF
    - content_encoding: Fix inflate_stream for no bytes available
    - cmake: Correctly include curl.rc in Windows builds
    - cmake: Add missing setmode check
    - connect.c: Remove executable bit on file
    - SMB: Fix uninitialized local variable
    - zlib/brotli: Only include header files in modules needing them
    - URL: Return error on malformed URLs with junk after IPv6 bracket
    - openssl: Fix too broad use of HAVE_OPAQUE_EVP_PKEY
    - macOS: Fix missing connectx function with Xcode version older than 9.0
    - --resolve: Allow IP address within [] brackets
    - examples/curlx: Fix code style
    - ntlm: Remove unnecessary NULL-check to please scan-build
    - Curl_llist_remove: Fix potential NULL pointer deref
    - mime: Fix "Value stored to 'sz' is never read" scan-build error
    - openssl: Fix "Value stored to 'rc' is never read" scan-build error
    - http2: Fix "Value stored to 'hdbuf' is never read" scan-build error
    - http2: Fix "Value stored to 'end' is never read" scan-build error
    - Curl_open: Fix OOM return error correctly
    - url: Reject ASCII control characters and space in host names
    - examples/rtsp: Clear RANGE again after use
    - connect: Improve the bind error message
    - make: Fix "make distclean"
    - connect: Add support for new TCP Fast Open API on Linux
    - metalink: Fix memory leak and NULL pointer dereference
    - URL: Update "file:" URL handling
    - ssh: Remove check for a NULL pointer
    - global_init: Ignore CURL_GLOBAL_SSL's absence


author: Paul Howarth <paul@city-fan.org> - 7.58.0-1.0.cf
changelog:
  - Update to 7.58.0
    - New libssh-powered SSH SCP/SFTP back-end
    - curl-config: Add --ssl-backends
    - http2: Fix incorrect trailer buffer size (CVE-2018-1000005)
    - http: Prevent custom Authorization headers in redirects (CVE-2018-1000007)
    - travis: Add boringssl build
    - examples/xmlstream.c: Don't switch off CURL_GLOBAL_SSL
    - SSL: Avoid magic allocation of SSL backend specific data
    - lib: Don't export all symbols, just everything curl_*
    - libssh2: Send the correct CURLE error code on scp file not found
    - libssh2: Return CURLE_UPLOAD_FAILED on failure to upload
    - openssl: Enable pkcs12 in boringssl builds
    - libssh2: Remove dead code from SSH_SFTP_QUOTE
    - sasl_getmessage: Make sure we have a long enough string to pass
    - conncache: Fix several lock issues
    - threaded-shared-conn.c: New example
    - conncache: Only allow multiplexing within same multi handle
    - configure: Check for netinet/in6.h
    - URL: Tolerate backslash after drive letter for FILE:
    - openldap: Add commented out debug possibilities
    - include: Get netinet/in.h before linux/tcp.h
    - CONNECT: Keep close connection flag in http_connect_state struct
    - BINDINGS: Another PostgreSQL client
    - curl: Limit -# update frequency for unknown total size
    - configure: Add AX_CODE_COVERAGE only if using gcc
    - curl.h: Remove incorrect comment about ERRORBUFFER
    - openssl: Improve data-pending check for https proxy
    - curl: Remove __EMX__ #ifdefs
    - CURLOPT_PRIVATE.3: Fix grammar
    - sftp: Allow quoted commands to use relative paths
    - CURLOPT_DNS_CACHE_TIMEOUT.3: See also CURLOPT_RESOLVE
    - RESOLVE: Output verbose text when trying to set a duplicate name
    - openssl: Disable file buffering for Win32 SSLKEYLOGFILE
    - multi_done: Prune DNS cache
    - tests: Update .gitignore for libtests
    - tests: Mark data files as non-executable in git
    - CURLOPT_DNS_LOCAL_IP4.3: Fixed the "SEE ALSO" to not self-reference
    - curl.1: Documented two missing valid exit codes
    - curl.1: Mention http:// and https:// as valid proxy prefixes
    - vtls: Replaced getenv() with curl_getenv()
    - setopt: Less *or equal* than INT_MAX/1000 should be fine
    - examples/smtp-mail.c: Use separate defines for options and mail
    - curl: Support >256 bytes warning messages
    - conncache: Fix a return code
    - krb5: Fix a potential access of uninitialized memory
    - rand: Add a clang-analyzer work-around
    - CURLOPT_READFUNCTION.3: Refer to argument with correct name
    - brotli: Allow compiling with version 0.6.0
    - content_encoding: Rework zlib_inflate
    - curl_easy_reset: Release mime-related data
    - examples/rtsp: Fix error handling macros
    - build-openssl.bat: Added support for VC15
    - build-wolfssl.bat: Added support for VC15
    - build: Added Visual Studio 2017 project files
    - winbuild: Added support for VC15
    - curl: Support size modifiers for --max-filesize
    - examples/cacertinmem: Ignore cert-already-exists error
    - brotli: Data at the end of content can be lost
    - curl_version_info.3: Call the argument 'age'
    - openssl: Fix memory leak of SSLKEYLOGFILE filename
    - build: Remove HAVE_LIMITS_H check
    - --mail-rcpt: Fix short-text description
    - scripts: Allow all perl scripts to be run directly
    - progress: Calculate transfer speed on milliseconds if possible
    - system.h: Check __LONG_MAX__ for defining curl_off_t
    - easy: Fix connection ownership in curl_easy_pause
    - setopt: Reintroduce non-static Curl_vsetopt() for OS400 support
    - setopt: Fix SSLVERSION to allow CURL_SSLVERSION_MAX_ values
    - configure.ac: Append extra linker flags instead of prepending them
    - HTTP: Bail out on negative Content-Length: values
    - docs: Comment about CURLE_READ_ERROR returned by curl_mime_filedata
    - mime: Clone mime tree upon easy handle duplication
    - openssl: Enable SSLKEYLOGFILE support by default
    - smtp/pop3/imap_get_message: Decrease the data length too...
    - CURLOPT_TCP_NODELAY.3: Fix typo
    - SMB: Fix numeric constant suffix and variable types
    - ftp-wildcard: Fix matching an empty string with "*[^a]"
    - curl_fnmatch: only allow 5 '*' sections in a single pattern
    - openssl: Fix potential memory leak in SSLKEYLOGFILE logic
    - SSH: Fix state machine for ssh-agent authentication
    - examples/url2file.c: Add missing curl_global_cleanup() call
    - http2: Don't close connection when single transfer is stopped
    - libcurl-env.3: First version
    - curl: Progress bar refresh, get width using ioctl()
    - CONNECT_TO: Fail attempt to set an IPv6 numerical without IPv6 support


author: Paul Howarth <paul@city-fan.org> - 7.58.0-2.0.cf
changelog:
  - Use libssh (instead of libssh2) to implement SCP/SFTP in libcurl from
    Fedora 28 onwards (#1531483)


author: Paul Howarth <paul@city-fan.org> - 7.58.0-3.0.cf
changelog:
  - Temporarily work around internal compiler error on x86_64 (#1540549)
  - Disable brp-ldconfig to make RemovePathPostfixes work with shared libs again


author: Paul Howarth <paul@city-fan.org> - 7.61.0-1.0.cf
changelog:
  - Update to 7.61.0
    - CVE-2018-0500: smtp: Fix SMTP send buffer overflow
    - getinfo: Add microsecond precise timers for seven intervals
    - curl: Show headers in bold, switch off with --no-styled-output
    - httpauth: Add support for Bearer tokens
    - Add CURLOPT_TLS13_CIPHERS and CURLOPT_PROXY_TLS13_CIPHERS
    - curl: --tls13-ciphers and --proxy-tls13-ciphers
    - Add CURLOPT_DISALLOW_USERNAME_IN_URL
    - curl: --disallow-username-in-url
    - schannel: Disable client cert option if APIs not available
    - schannel: Disable manual verify if APIs not available
    - tests/libtest/Makefile: Do not unconditionally add gcc-specific flags
    - openssl: Acknowledge --tls-max for default version too
    - stub_gssapi: Fix 'unused parameter' warnings
    - examples/progressfunc: Make it build on both new and old libcurls
    - docs: Mention it is HA Proxy protocol "version 1"
    - curl_fnmatch: Only allow two asterisks for matching
    - docs: Clarify CURLOPT_HTTPGET
    - configure: Replace a AC_TRY_RUN with CURL_RUN_IFELSE
    - configure: Do compile-time SIZEOF checks instead of run-time
    - checksrc: Make sure sizeof() is used *with* parentheses
    - CURLOPT_ACCEPT_ENCODING.3: Add brotli and clarify a bit
    - schannel: Make CAinfo parsing resilient to CR/LF
    - tftp: Make sure error is zero terminated before printfing it
    - http resume: Skip body if http code 416 (range error) is ignored
    - configure: Add basic test of --with-ssl prefix
    - cmake: Set -d postfix for debug builds
    - multi: Provide a socket to wait for in Curl_protocol_getsock
    - content_encoding: Handle zlib versions too old for Z_BLOCK
    - winbuild: Only delete OUTFILE if it exists
    - winbuild: In MakefileBuild.vc fix typo DISTDIR->DIRDIST
    - schannel: Add failf calls for client certificate failures
    - cmake: Fix the test for fsetxattr and strerror_r
    - curl.1: Fix cmdline-opts reference errors
    - cmdline-opts/gen.pl: Warn if mutexes: or see-also: list non-existing options
    - cmake: Check for getpwuid_r
    - configure: Fix ssh2 linking when built with a static mbedtls
    - psl: Use latest psl and refresh it periodically
    - fnmatch: Insist on escaped bracket to match
    - KNOWN_BUGS: Restore text regarding #2101
    - INSTALL: LDFLAGS=-Wl,-R/usr/local/ssl/lib
    - configure: Override AR_FLAGS to silence warning
    - os400: Implement mime api EBCDIC wrappers
    - curl.rc: Embed manifest for correct Windows version detection
    - strictness: Correct {infof, failf} format specifiers
    - tests: Update .gitignore for libtests
    - configure: Check for declaration of getpwuid_r
    - fnmatch: Use the system one if available
    - CURLOPT_RESOLVE: Always purge old entry first
    - multi: Remove a potentially bad DEBUGF()
    - curl_addrinfo: Use same #ifdef conditions in source as header
    - build: Remove the Borland specific makefiles
    - axTLS: Not considered fit for use
    - cmdline-opts/cert-type.d: Mention "p12" as a recognized type
    - system.h: Add support for IBM xlc C compiler
    - tests/libtest: Add lib1521 to nodist_SOURCES
    - mk-ca-bundle.pl: Leave certificate name untouched
    - boringssl + schannel: undef X509_NAME in lib/schannel.h
    - openssl: Assume engine support in 1.0.1 or later
    - cppcheck: Fix warnings
    - test 46: Make test pass after year 2025
    - schannel: Support selecting ciphers
    - Curl_debug: Remove dead printhost code
    - test 1455: Unflakified
    - Curl_init_do: Handle NULL connection pointer passed in
    - progress: Remove a set of unused defines
    - mk-ca-bundle.pl: Make -u delete certdata.txt if found not changed
    - GOVERNANCE.md: Explains how this project is run
    - configure: Use pkg-config for c-ares detection
    - configure: Enhance ability to build with static openssl
    - maketgz: Fix sed issues on OSX
    - multi: Fix memory leak when stopped during name resolve
    - CURLOPT_INTERFACE.3: Interface names not supported on Windows
    - url: Fix dangling conn->data pointer
    - cmake: Allow multiple SSL backends
    - system.h: Fix for gcc on 32 bit OpenServer
    - ConnectionExists: Make sure conn->data is set when "taking" a connection
    - multi: Fix crash due to dangling entry in connect-pending list
    - CURLOPT_SSL_VERIFYPEER.3: Add performance note
    - netrc: Use a larger buffer to support longer passwords 
    - url: Check Curl_conncache_add_conn return code
    - configure: Add dependent libraries after crypto
    - easy_perform: Faster local name resolves by using *multi_timeout()
    - getnameinfo: Not used, removed all configure checks
    - travis: Add a build using the synchronous name resolver
    - CURLINFO_TLS_SSL_PTR.3: Improve the example
    - openssl: Allow TLS 1.3 by default
    - openssl: Make the requested TLS version the *minimum* wanted
    - openssl: Remove some dead code
    - telnet: Fix clang warnings
    - DEPRECATE: New doc describing planned item removals
    - example/crawler.c: Simple crawler based on libxml2
    - libssh: Goto DISCONNECT state on error, not SESSION_FREE
    - CMake: Remove unused functions
    - darwinssl: Allow High Sierra users to build the code using GCC
    - scripts: Include _curl as part of CLEANFILES
    - examples: Fix -Wformat warnings
    - curl_setup: Include <winerror.h> before <windows.h>
    - schannel: Make more cipher options conditional
    - CMake: Remove redundant and old end-of-block syntax
    - post303.d: Clarify that this is an RFC violation
  - Add patch to fix builds with openssl < 1.0.1


author: Paul Howarth <paul@city-fan.org> - 7.61.0-5.0.cf
changelog:
  - ssl: Set engine implicitly when a PKCS#11 URI is provided (#1219544)
  - Relax crypto policy for the test-suite to make it pass again (#1610888)


author: Paul Howarth <paul@city-fan.org> - 7.61.1-1.0.cf
changelog:
  - Update to 7.61.1
    - Fix NTLM password overflow via integer overflow (CVE-2018-14618)
    - CURLINFO_SIZE_UPLOAD: Fix missing counter update
    - CURLOPT_ACCEPT_ENCODING.3: List them comma-separated
    - CURLOPT_SSL_CTX_FUNCTION.3: Might cause accidental connection reuse
    - Curl_getoff_all_pipelines: Improved for multiplexed
    - DEPRECATE: Remove release date from 7.62.0
    - HTTP: Don't attempt to needlessly decompress redirect body
    - INTERNALS: Require GnuTLS ≥ 2.11.3
    - README.md: Add LGTM.com code quality grade for C/C++
    - SSLCERTS: Improve the openssl command line
    - Silence GCC 8 cast-function-type warnings
    - ares: Check for NULL in completed-callback
    - asyn-thread: Remove unused macro
    - auth: Only pick CURLAUTH_BEARER if we *have* a Bearer token
    - auth: Pick Bearer authentication whenever a token is available
    - cmake: CMake config files are defining CURL_STATICLIB for static builds
    - cmake: Respect BUILD_SHARED_LIBS
    - cmake: Update scripts to use consistent style
    - cmake: Bumped minimum version to 3.4
    - cmake: Link curl to the OpenSSL targets instead of lib absolute paths
    - configure: Conditionally enable pedantic-errors
    - configure: Fix for -lpthread detection with OpenSSL and pkg-config
    - conn: Remove the boolean 'inuse' field
    - content_encoding: Accept up to 4 unknown trailer bytes after raw deflate data
    - cookie tests: Treat files as text
    - cookies: Support creation-time attribute for cookies
    - curl: Fix segfault when -H @headerfile is empty
    - curl: Add http code 408 to transient list for --retry
    - curl: Fix time-of-check, time-of-use race in dir creation
    - curl: Use Content-Disposition before the "URL end" for -OJ
    - curl: Warn the user if a given file name looks like an option
    - curl_threads: Silence bad-function-cast warning
    - darwinssl: Add support for ALPN negotiation
    - docs/CURLOPT_URL: Fix indentation
    - docs/CURLOPT_WRITEFUNCTION: Size is always 1
    - docs/SECURITY-PROCESS: Mention bounty, drop pre-notify
    - docs/examples: Add hiperfifo example using linux epoll/timerfd
    - docs: Add disallow-username-in-url.d and haproxy-protocol.d to dist
    - docs: Clarify NO_PROXY env variable functionality
    - docs: Improved the manual pages of some callbacks
    - docs: Mention NULL is fine input to several functions
    - formdata: Remove unused macro HTTPPOST_CONTENTTYPE_DEFAULT
    - gopher: Do not translate '?' to '%09'
    - header output: Switch off all styles, not just unbold
    - hostip: Fix unused variable warning
    - http2: Use correct format identifier for stream_id
    - http2: Abort the send_callback if not setup yet
    - http2: Avoid set_stream_user_data() before stream is assigned
    - http2: Check nghttp2_session_set_stream_user_data return code
    - http2: Clear the drain counter in Curl_http2_done
    - http2: Make sure to send after RST_STREAM
    - http2: Separate easy handle from connections better
    - http: Fix for tiny "HTTP/0.9" response
    - http_proxy: Remove unused macro SELECT_TIMEOUT
    - lib/Makefile: Only do symbol hiding if told to
    - lib1502: Fix memory leak in torture test
    - lib1522: Fix curl_easy_setopt argument type
    - libcurl-thread.3: Expand somewhat on the NO_SIGNAL motivation
    - mime: Check Curl_rand_hex's return code
    - multi: Always do the COMPLETED procedure/state
    - openssl: Assume engine support in 1.0.0 or later
    - openssl: Fix debug messages
    - projects: Improve Windows perl detection in batch scripts
    - retry: Return error if rewind was necessary but didn't happen
    - reuse_conn(): Memory leak - free old_conn->options
    - schannel: Client certificate store opening fix
    - schannel: Enable CALG_TLS1PRF for w32api ≥ 5.1
    - schannel: Fix MinGW compile break
    - sftp: Don't send post-quote sequence when retrying a connection
    - smb: Fix memory leak on early failure
    - smb: Fix memory-leak in URL parse error path
    - smb_getsock: Always wait for write socket too
    - ssh-libssh: Fix infinite connect loop on invalid private key
    - ssh-libssh: Reduce excessive verbose output about pubkey auth
    - ssh-libssh: Use FALLTHROUGH to silence gcc8
    - ssl: Set engine implicitly when a PKCS#11 URI is provided
    - sws: Handle EINTR when calling select()
    - system_win32: Fix version checking
    - telnet: Remove unused macros TELOPTS and TELCMDS
    - test1143: Disable MSYS2's POSIX path conversion
    - test1148: Disable if decimal separator is not point
    - test1307: (fnmatch testing) disabled
    - test1422: Add required file feature
    - test1531: Add timeout
    - test1540: Remove unused macro TEST_HANG_TIMEOUT
    - test214: Disable MSYS2's POSIX path conversion for URL
    - test320: Treat curl320.out file as binary
    - tests/http_pipe.py: Use /usr/bin/env to find python
    - tests: Don't use Windows path %PWD for SSH tests
    - tests: Fixes for Windows line endings
    - tool_operate: Fix setting proxy TLS 1.3 ciphers
    - travis: Build darwinssl on macos 10.12 to fix linker errors
    - travis: Execute "set -eo pipefail" for coverage build
    - travis: Run a 'make checksrc' too
    - travis: Update to GCC-8
    - travis: Verify that man pages can be regenerated
    - upload: Allocate upload buffer on-demand
    - upload: Change default UPLOAD_BUFSIZE to 64KB
    - urldata: Remove unused pipe_broke struct field
    - vtls: Re-instantiate engine on duplicated handles
    - windows: Implement send buffer tuning
    - wolfSSL/CyaSSL: Fix memory leak in Curl_cyassl_random


author: Paul Howarth <paul@city-fan.org> - 7.61.1-2.0.cf
changelog:
  - Enforce versioned libpsl dependency for libcurl (#1631804)
  - test320: Update expected output for gnutls-3.6.4
  - Drop 0105-curl-7.61.0-tests-ssh-keygen.patch, no longer needed (#1622594)
  - test1456: Seems to be flaky so disable it


author: Paul Howarth <paul@city-fan.org> - 7.61.1-3.0.cf
changelog:
  - Enable TLS 1.3 post-handshake auth in OpenSSL
  - Update the documentation of --tlsv1.0 in curl(1) man page


author: Paul Howarth <paul@city-fan.org> - 7.64.0-1.0.cf
changelog:
  - Update to 7.64.0
    - CVE-2018-16890: NTLM type-2 out-of-bounds buffer read
    - CVE-2019-3822: NTLMv2 type-3 header stack buffer overflow
    - CVE-2019-3823: SMTP end-of-response out-of-bounds read
    - cookies: Leave secure cookies alone
    - hostip: Support wildcard hosts
    - http: Implement trailing headers for chunked transfers
    - http: Added options for allowing HTTP/0.9 responses
    - timeval: Use high resolution timestamps on Windows
    - FAQ: Remove mention of sourceforge for github
    - OS400: Handle memory error in list conversion
    - OS400: Upgrade ILE/RPG binding
    - README: Add codacy code quality badge
    - Revert http_negotiate: do not close connection
    - THANKS: Added several missing names from year ≤ 2000
    - build: Make 'tidy' target work for metalink builds
    - cmake: Added checks for variadic macros
    - cmake: Updated check for HAVE_POLL_FINE to match autotools
    - cmake: Use lowercase for function name like the rest of the code
    - configure: Detect xlclang separately from clang
    - configure: Fix recv/send/select detection on Android
    - configure: Rewrite --enable-code-coverage
    - conncache_unlock: Avoid indirection by changing input argument type
    - cookie: Fix comment typo
    - cookies: Allow secure override when done over HTTPS
    - cookies: Extend domain checks to non psl builds
    - cookies: Skip custom cookies when redirecting cross-site
    - curl --xattr: Strip credentials from any URL that is stored
    - curl -J: Refuse to append to the destination file
    - curl/urlapi.h: include "curl.h" first
    - curl_multi_remove_handle() don't block terminating c-ares requests
    - darwinssl: Accept setting max-tls with default min-tls
    - disconnect: Separate connections and easy handles better
    - disconnect: Set conn->data for protocol disconnect
    - docs/version.d: Mention MultiSSL
    - docs: Fix the --tls-max description
    - docs: Use $(INSTALL_DATA) to install man page
    - docs: Use meaningless port number in CURLOPT_LOCALPORT example
    - gopher: Always include the entire gopher-path in request
    - http2: Clear pause stream id if it gets closed
    - if2ip: Remove unused function Curl_if_is_interface_name
    - libssh: Do not let libssh create socket
    - libssh: Enable CURLOPT_SSH_KNOWNHOSTS and CURLOPT_SSH_KEYFUNCTION for libssh
    - libssh: free sftp_canonicalize_path() data correctly
    - libtest/stub_gssapi: Use "real" snprintf
    - mbedtls: Use VERIFYHOST
    - multi: Multiplexing improvements
    - multi: Set the EXPIRE_*TIMEOUT timers at TIMER_STARTSINGLE time
    - ntlm: Fix NTMLv2 compliance
    - ntlm_sspi: Add support for channel binding
    - openssl: Adapt to 3.0.0, OpenSSL_version_num() is deprecated
    - openssl: Fix the SSL_get_tlsext_status_ocsp_resp call
    - openvms: Fix OpenSSL discovery on VAX
    - openvms: Fix typos in documentation
    - os400: Add a missing closing bracket
    - os400: Fix extra parameter syntax error
    - pingpong: Change default response timeout to 120 seconds
    - pingpong: Ignore regular timeout in disconnect phase
    - printf: Fix format specifiers
    - runtests.pl: Fix perl call to include srcdir
    - schannel: Fix compiler warning
    - schannel: Preserve original certificate path parameter
    - schannel: Stop calling it "winssl"
    - sigpipe: If mbedTLS is used, ignore SIGPIPE
    - smb: Fix incorrect path in request if connection reused
    - ssh: Log the libssh2 error message when ssh session startup fails
    - test1558: Verify CURLINFO_PROTOCOL on file:// transfer
    - test1561: Improve test name
    - test1653: Make it survive torture tests
    - tests: Allow tests to pass by 2037-02-12
    - tests: Move objnames-* from lib into tests
    - timediff: Fix math for unsigned time_t
    - timeval: Disable MSVC Analyzer GetTickCount warning
    - tool_cb_prg: Avoid integer overflow
    - travis: Added cmake build for osx
    - urlapi: Fix port parsing of eol colon
    - urlapi: Distinguish possibly empty query
    - urlapi: Fix parsing ipv6 with zone index
    - urldata: Rename easy_conn to just conn
    - winbuild: Conditionally use /DZLIB_WINAPI
    - wolfssl: Fix memory-leak in threaded use
    - spnego_sspi: Add support for channel binding


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-26
changelog:
  - force NSS to ask for a new client certificate when connecting second time
    to the same host (#694294)


author: Jason L Tibbitts III <tibbs@math.uh.edu> - 2.6-15
changelog:
  - Tweak default config file and add info to README.Fedora asking folks not to
    use sync and to report bugs upstream if they do.


author: Eric Sandeen <sandeen@@redhat.com> 1.42-3
changelog:
  - Add broken system clock config to e2fsck.conf to let boot
    continue even if system clock very wrong.


author: Carl George <carl.george@rackspace.com> - 2.9.0-1.ius
changelog:
  - Latest upstream
  - Use perl(MOD::NAME) format for perl-DBD-SQLite dep (Fedora)
  - Define __global_ldflags on EL < 7 (Fedora)
  - Remove all '.gitignore' files from packages (Fedora)


author: Thorsten Leemhuis <fedora[AT]leemhuis.info> - 1.26-1
changelog:
  - ship AUTHORS NEWS docs/*
  - integrated changes from Julian Sikorski <belegdol[at]gmail[dot]com>
  -- Updated to 1.26
  -- Dropped dos2unix BR, not needed anymore
  -- Made Source0 use macros
  -- Fixed License tag
  -- Fixed file permissions
  -- Converted ChangeLog to utf-8


author: Dominik Mierzejewski <rpm [AT] greysector [DOT] net> - 1.28-1
changelog:
  - update to 1.28
  - drop redundant BRs
  - fix Source URL and use bz2 tarball
  - fix rpath
  - include manpage


author: Ondrej Vasik <ovasik@redhat.com> 2.4.29-1
changelog:
  - iso_codes package no longer provides tab files, do generate
    them on fly with sed (thanks D. Tardon)


author: Remi Collet <remi@fedoraproject.org> - 2.2.1-2
changelog:
  - Update to 2.2.1 (from Fedora)
  - remove unneeded sources
  - fix EL-5 and EL-6 build
  - obsolete gd-last when needed
  - use libwebp instead of libvpx for webp images


author: Remi Collet <remi@fedoraproject.org> - 2.2.5-1
changelog:
  - Update to 2.2.5
  - fix double-free in gdImagePngPtr(). CVE-2017-6362
  - fix buffer over-read into uninitialized memory. CVE-2017-7890


author: mskalick@redhat.com - 2.2.5-5
changelog:
  - Check return value in gdImageBmpPtr to avoid double free (CVE-2018-1000222)
  - Don't mark gdimagegrayscale/basic test as failing


author: odubaj@redhat.com - 2.2.5-10
changelog:
  - Fixed heap based buffer overflow in gd_color_match.c:gdImageColorMatch() in libgd as used in imagecolormatch()
  - Resolves: RHBZ#1678104 (CVE-2019-6977)
  - Fixed potential double-free in gdImage*Ptr()
  - Resolves: RHBZ#1671391 (CVE-2019-6978)


author: BJ Dierkes <wdierkes@rackspace.com> - 0.33-3
changelog:
  - Rebuilt for latest boost.
  - BuildRequires: boost-thread
  - Added -lboost_system to LDFLAGS to work around boost issue
    related to boost-thread.


author: BJ Dierkes <wdierkes@rackspace.com> - 0.35-1
changelog:
  - Latest sources from upstream. Release notes here:
    https://launchpad.net/gearmand/trunk/0.35
  - Removed Patch3: gearmand-0.33-lp1020778.patch (applied upstream)
  - Added zlib support
  - Added MySQL support


author: BJ Dierkes <wdierkes@rackspace.com> - 0.39-1
changelog:
  - Latest sources from upstream. Release notes here:
    https://launchpad.net/gearmand/trunk/0.39
  - Added Postgres support
  - Added Sqlite support


author: BJ Dierkes <wdierkes@rackspace.com> - 1.1.2-1
changelog:
  - Bumping to 1.2 branch (1.1.2 current development version).
    Release notes are available here:
    https://launchpad.net/gearmand/1.2/1.1.2
  - Repackaged libgearman-1.0, and libgearman-1.0-devel under the
    devel sub-package.
  - Updated scriptlets per BZ#850127


author: Ken Dreyer <ktdreyer@ktdreyer.com> - 1.1.8-1
changelog:
  - Update to latest upstream release.
  - Add EL5 and EL6 conditionals to unify the spec across all branches.
  - Add mandirs.
  - Add /var/log/gearmand.log.
  - Add tokyocabinet support.
  - Remove commented patches.
  - rpmlint fixes (macros in comments).


author: Remi Collet <remi@fedoraproject.org> - 0.85.5-1
changelog:
  - update to 0.85.5
    https://github.com/glpi-project/glpi/issues?q=milestone:0.85.5
  - use system ircmaxell/password-compat


author: Remi Collet <remi@remirepo.net> - 9.1.6-3
changelog:
  - add max version for all dependencies
  - fix dependency issue with php-phpmailer6
  - EL7: remove SELinux rules as default policy includes them


author: Petr Machata <pmachata@redhat.com> - 1:0.8.10-10
changelog:
  - Rebuild for boost 1.54.0
  - Boost doesn't use tagged sonames anymore, drop the -mt suffix
    from gnash-0.8.10-boost-1.50.patch


author: Nick Urbanik <nicku(at)vtc.edu.hk> 0.38-1.1nu
changelog:
  - Change %make to /usr/bin/make
  - check config.cache exists before trying to delete it
  - Fix the files list for documentation.
  - add back the gtk frontend
  - Added the correct build require for gtk frontend
  - various other fixes to get it to build.


author: David Woodhouse <David.Woodhouse@intel.com> - 0-0.2.20110830.hgd525a9bab875
changelog:
  - Add support for expanding PAM environment variables in secret key file name:
    http://code.google.com/p/google-authenticator/issues/detail?id=108


author: Petr Stodulka <pstodulk@redhat.com> - 1.6-6
changelog:
  - changed spec file - build section
    obey compiler macros gcc, gcc -E, g++ (#667144)
  - zgrep inherits color setup from grep (#1034839)


author: Till Maas <opensource@till.name> - 1.6-7
changelog:
  - Rebuilt for Fedora 23 Change
    https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code


author: David Bezemer <info@davidbezemer.nl>
changelog:
  - reworked installation structure
  - included rsylog config for logging
  - copy default error files
  - updated to 1.6.9


author: Shakthi Kannan <shakthimaan [AT] fedoraproject dot org> 0.10.0-3
changelog:
  - Removed INSTALL_LIB from install target as we use INSTALL_LIBRARY_PATH.
  - Use 'client library' in Summary.


author: Ver:2.30-6.0
changelog:
  - Please refer to online documentation by searching for the 
  "HP Array Configuration Utility CLI" using the search box on
  http://www.hp.com. Then select the Download software link,
  select your operation system. Under the Enhancements tab is a 
  description of the changes. (Severity: Low)


author: Miloš Jakubíček <xjakub@fi.muni.cz> - 0.9-3
changelog:
  - include patch by Petr Holasek (pholasek@redhat.com) that adds
    libpagemap support and introduces new -p cmd option and USS,
    PSS, SWAP columns


author: Miloš Jakubíček <xjakub@fi.muni.cz> - 1.0-1
changelog:
  - Update to 1.0
  - Build with --enable-openvz --enable-vserver --enable-taskstats
    --enable-unicode --enable-native-affinity --enable-cgroup
  - Drop htop-0.9-system-plpa.patch (no PLPA needed anymore)


author: Eike Rathke <erack@redhat.com> - 50.1.2-6
changelog:
  - Resolves: rhbz#966141 various flaws in Layout Engine font processing
  - Resolves: rhbz#966077 aarch64 support for icu-config.sh wrapper


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 3.5.1-1
changelog:
  - New upstream release
  - Updated nopprof patch to match new release
  - Fixed a few bogus changelog entries


author: Remi Collet <remi@fedoraproject.org> - 1.3.0-1
changelog:
  - Update to 1.3.0
  - open https://jira.mongodb.org/browse/CDRIVER-1039
    libbson 1.3.0 man pages broken installation


author: Remi Collet <remi@fedoraproject.org> - 1.3.1-1
changelog:
  - Update to 1.3.1
  - workaround for man pages are no more generated / installed
    https://jira.mongodb.org/browse/CDRIVER-1069
  - workaround for man pages installation broken
    https://jira.mongodb.org/browse/CDRIVER-1068


author: Adrian Reber <adrian@lisas.de> - 10.2+0.90-2
changelog:
  - added missing files from git: COPYING-GPL and COPYING-LGPL
  - added patch from git for missing pkgconfig requires
    and fixed FSF address


author: Adrian Reber <adrian@lisas.de> - 10.2+0.90-3
changelog:
  - included upstreamed patches which are changing the license
    headers to be LGPLv2+ for the library parts and GPLv2+ for the
    binaries


author: Jan Safranek <jsafrane@redhat.com> 0.36-4
changelog:
  - Fix libcgroup.so link to the right soname (#599367)
  - Fix segmentation fault in cgget tool (#601071)
  - Fix lscgroup commandline parsing (#601095)


author: Jan Safranek <jsafrane@redhat.com> 0.36-5
changelog:
  - Relax the dependency on redhat-lsb package (#607537)
  - Fix installation of -devel libraries (#607538)


author: Jan Safranek <jsafrane@redhat.com> 0.37-1.el6
changelog:
  - Updated to 0.37
    - added new 'cgsnapshot' tool to generate cgconfig.conf (#649195)
    - fixed 'cgget' reading long variable values like devices.list (#626127)
    - fixed reading list of mounted controllers on library init (#635984)
    - fixed the library not to change current working directory when creating
      groups (#628895)
    - new user 'cgred' was added for better security - /bin/cgexec tool is no
      longer SUID to root but SGID to the new 'cgred' user, which has write
      access to /var/run/cgred.socket
    - may other fixes an enhancements
  - Removed rpath from compiled binaries
  - Fixed spelling and rpmlint errors in the .spec file (#634939)
  - Fixed exit code of cgclassify tool (#667957)


author: Jan Safranek <jsafrane@redhat.com> 0.37-2.el6
changelog:
  - Fixed buffer overflow when parsing cgexec command line parameters.
  - Added checking of source of netlink messages to cgrulesengd daemon.
  - Resolves: CVE-2011-1006 CVE-2011-1022


author: Jan Safranek <jsafrane@redhat.com> 0.37-3.el6
changelog:
  - Fixed 'cgred' group not being created as system-group during installation
    of the package.
  - Resolves: #715413


author: Remi Collet <remi@remirepo.net> - 2.7.6-2
changelog:
  - fix new symbols visibility, using patch from
    https://github.com/couchbase/libcouchbase/pull/27
    for https://issues.couchbase.com/browse/CCBC-803


author: Remi Collet <remi@remirepo.net> - 2.8.2-1
changelog:
  - update to 2.8.2
  - pull patches and other changes from Fedora
  - add libuv backend
  - move backends in optional sub-packages
  - enable upstream test suite on F25+
  - disable dtrace


author: Paul Howarth <paul@city-fan.org> 7.11.2-16.cf
changelog:
  - fix CVE-2009-2417 (incorrect verification of SSL certificate with NUL in name)
  - remake patches on FC2 (autoconf 2.59 / automake 1.8.3 / libtool 1.5.6) to
    avoid the need to run autotools during package build
  - drop buildreqs automake and libtool


author: Paul Howarth <paul@city-fan.org> 7.11.2-19.cf
changelog:
  - fix zlib-compression causing curl to pass more than CURL_MAX_WRITE_SIZE bytes
    to write callback (CVE-2010-0734, #563220)
  - add workaround for broken ProFTPD SSL auth (#134133)
  - renumber patches as per RHEL4 package
  - handle move of kerberos installation prefix in krb5 >= 1.8
  - enable built-in manual for non-compat build (requires buildreq groff)
  - comment patches in spec file


author: Paul Howarth <paul@city-fan.org> 7.11.2-21.cf
changelog:
  - fix libcurl inappropriate GSSAPI delegation (CVE-2011-2192)
  - nobody else likes macros for commands
  - use %global in preference to %define


author: Paul Howarth <paul@city-fan.org> 7.11.2-23.cf
changelog:
  - fix SSL CBC IV vulnerability (CVE-2011-3389)
  - use a patch rather than scripted iconv to fix character encoding


author: Paul Howarth <paul@city-fan.org> 7.11.2-24.cf
changelog:
  - fix cookie domain tailmatch vulnerability (CVE-2013-1944)
  - fix libcurl URL decode buffer boundary flaw (CVE-2013-2174)


author: Paul Howarth <paul@city-fan.org> 7.15.5-10.cf
changelog:
  - fix zlib-compression causing curl to pass more than CURL_MAX_WRITE_SIZE bytes
    to write callback (CVE-2010-0734, #563220)
  - fix curl-config missing vernum value (#174556)
  - document lack of IPv6, FTPS and LDAP support if using a socks proxy (#473128)
  - avoid tight loop if an upload connection is broken (#479967)
  - add options --ftp-account/--ftp-alternative-to-user to program help (#517084)
  - fix crash when reusing connection after negotiate-auth (#517199)
  - add support for CRL loading from a PEM file (#532069)
  - handle move of kerberos installation prefix in krb5 >= 1.8
  - enable built-in manual for non-compat build (requires buildreq groff)
  - comment patches in spec file


author: Paul Howarth <paul@city-fan.org> 7.15.5-12.cf
changelog:
  - avoid use of uninitialized variable on failure of a LDAP request (#670523)
  - proxy tunnel support for LDAP requests (#670523)


author: Jindrich Novy <jnovy@redhat.com> 5.0.21-0.2
changelog:
  - remove C# documentation
  - disable/remove rpath
  - fix description
  - tighten dependencies
  - run ldconfig for cxx and sql subpackages


author: Jindrich Novy <jnovy@redhat.com> 5.1.19-1
changelog:
  - update to 5.1.19
  - rename -devel-static to -static subpackage (#617800)
  - build java on all arches


author: Steve Dickson <steved@redhat.com> 2.0.18-1
changelog:
  - Updated to latest stable upstream version: 2.0.18-stable
  - Moved documentation into its own rpm (bz 810138)


author: Remi Collet <remi@fedoraproject.org> - 2.0.21-4
changelog:
  - merge changes from rawhide:
    - Add missing directory /usr/include/event2
    - Correct summary and description of -devel and -doc packages
  - re-add doc sub-package


author: LTN Packager <packager-el6rpms@LinuxTECH.NET> - 0.19.2-3
changelog:
  - spec-file imported from http://packages.sw.be/fribidi/
  - cleaned up spec-file
  - updated to latest version
  - added patch from Mageia
  - split into three packages


author: Nalin Dahyabhai <nalin@redhat.com> - 1.7-3
changelog:
  - turn off common lisp bindings the right way
  - drop finger output
  - recode the changelog into UTF-8 if it isn't UTF-8 (rpmlint)


author: Jan Vcelak <jvcelak@fedoraproject.org> 1.1.1-4
changelog:
  - remove utils subpackage and place mmdblookup into devel subpackage
  - remove Group from the spec file
  - move NOTICE and Changes.md to devel subpackage


author: MediaArea.net SARL <info@mediaarea.net> - 0.7.63-0
changelog:
  - See History.txt for more info and real dates
  - Previous packages made by Toni Graffy <toni@links2linux.de>
  - Fedora style made by Vasiliy N. Glazov <vascom2@gmail.com>


author: Remi Collet <remi@fedoraproject.org> - 1.0.11-1
changelog:
  - update to 1.0.11, soname bump to libmemcached.so.11
  - drop broken SASL support
  - don't generate parser (bison 2.6 not supported)


author: Remi Collet <remi@fedoraproject.org> - 1.0.12-1
changelog:
  - update to 1.0.12
  - add aclocal/ax_lib_libmemcached.m4
  - abi-compliance-checker verdict : Compatible
  - uggly hack for man pages


author: Remi Collet <remi@fedoraproject.org> - 1.0.14-1
changelog:
  - update to 1.0.14
  - libmemcachedprotocol removed
  - sasl support is back
  - run test during build
  - report various issues to upstream
    https://bugs.launchpad.net/libmemcached/+bug/1079994 (bigendian)
    https://bugs.launchpad.net/libmemcached/+bug/1079995 (config.h)
    https://bugs.launchpad.net/libmemcached/+bug/1079996 (dtrace)
    https://bugs.launchpad.net/libmemcached/+bug/1079997 (-ldl)
    https://bugs.launchpad.net/libmemcached/+bug/1080000 (touch)


author: Remi Collet <remi@fedoraproject.org> - 1.0.15-1
changelog:
  - update to 1.0.15
  - libmemcachedprotocol is back
  - add memaslap command line tool
  - report various issues to upstream
    https://bugs.launchpad.net/libmemcached/+bug/1094413 (libevent)
    https://bugs.launchpad.net/libmemcached/+bug/1094414 (c99 MODE)


author: Remi Collet <remi@fedoraproject.org> - 1.0.16-1
changelog:
  - update to 1.0.16
  - ignore test result for memaslap (XFAIL but PASS)
    https://bugs.launchpad.net/libmemcached/+bug/1115357


author: Remi Collet <remi@fedoraproject.org> - 1.0.17-1
changelog:
  - update to 1.0.17
  - fix option --with-memcached and report regression
    https://bugs.launchpad.net/libmemcached/+bug/1164440
  - broken build when -fsanitize=thread available
    https://bugs.launchpad.net/libmemcached/+bug/1164442


author: Remi Collet <remi@fedoraproject.org> - 1.0.16-2
changelog:
  - move libraries in new libs sub packages
  - add provides for bundled(bobjenkins-hash) #1041351
  - apply libpthread workaround #1037707
  - spec cleanups


author: Alejandro Alvarez <aalvarez@cern.ch> - 0.1.2-2
changelog:
  - Escaped macros in changelog
  - Changed packages summaries
  - Renamed -docs to -doc, and changed its group to Documentation
  - Fixed -devel dependencies
  - Removed -docs dependency on the main package
  - All header files specified explicitly


author: Alejandro Alvarez <aalvarez@cern.ch> - 0.1.2-3
changelog:
  - Added BuildRequires: CUnit-devel
  - Added %check section
  - Removed %defattr
  - Moved man pages to devel package; there is no need for -doc


author: Hans de Goede <j.w.r.degoede@gmail.com> - 1.13.7-1
changelog:
  - New upstream bugfix release 1.13.7
  - Properly build and install development documentation (rf#2257)


author: Richard Shaw <hobbes1069@gmail.com> - 1.14.3-1
changelog:
  - Update to latest upstream release.
  - Move README and README.remote to correct package. Fixes #1898.


author: Hans de Goede <j.w.r.degoede@gmail.com> - 1.15.1-1
changelog:
  - New upstream release 1.15.1 (rf#2716)
  - Drop obsolete esound and arts plugins from mpg123-plugins-extras


author: Hans de Goede <j.w.r.degoede@gmail.com> - 1.19.0-1
changelog:
  - Update to 1.19.0
  - Enable (optional) use of NEON on arm
  - Add missing %{?_isa} to libmpg123 Requires in -devel (rf#3194)


author: Remi Collet <remi@fedoraproject.org> - 0.5.0-1
changelog:
  - update to 0.5.0
  - open https://github.com/alanxz/rabbitmq-c/issues/169 (version is 0.5.1-pre)
  - open https://github.com/alanxz/rabbitmq-c/issues/170 (amqp_get_server_properties)


author: Remi Collet <remi@remirepo.net> - 0.11.0~RC1-1
changelog:
  - update to 0.11.0-RC1
  - open https://github.com/edenhill/librdkafka/issues/1290
    broken build on 32-bit architecture
  - add upstream for i686 build


author: Remi Collet <remi@fedoraproject.org> - 1.0.4-1
changelog:
  - update to 1.0.4
  - add upstream patch for segfault on RHEL-6 i386
    https://github.com/jedisct1/libsodium/issues/307


author: Allisson Azevedo <allisson@gmail.com> 0.9.8.1-3
changelog:
  - Fixed macros consistency.
  - Modified make install to keep timestamps.
  - Added libsphinxclient package.


author: Allisson Azevedo <allisson@gmail.com> 0.9.9-1
changelog:
  - Update to 0.9.9 (#556997).
  - Added sphinx-0.9.9-fix_static.patch to fix FTBS.
  - Run sphinx searchd as non-root user (#541464).


author: Christof Damian <christof@damian.net> - 2.0.7-1
changelog:
  - upstream 2.0.7
  - move default log file location to /var/log/sphinx
  - use systemd macros BZ 850323
  - Remove obsoleted patches
  - add java and php subpackages ( bug 566787 )
  - change default listen address to localhost ( bug 566792 )
  - add ghost for files in /var/run/ ( bug 656694 )
  - add COPYING file to lib package


author: Paul Howarth <paul@city-fan.org> - 1.5.0-1.0.cf
changelog:
  - Update to 1.5.0
    - Added Windows Cryptography API: Next Generation based backend
    - Security Advisory for CVE-2015-1782, using SSH_MSG_KEXINIT data unbounded
    - Missing _libssh2_error in _libssh2_channel_write
    - knownhost: Fix DSS keys being detected as unknown
    - knownhost: Restore behaviour of 'libssh2_knownhost_writeline' with short
      buffer
    - libssh2.h: On Windows, a socket is of type SOCKET, not int
    - libssh2_priv.h: A 1 bit bit-field should be unsigned
    - Windows build: Do not export externals from static library
    - Fixed two potential use-after-frees of the payload buffer
    - Fixed a few memory leaks in error paths
    - userauth: Fixed an attempt to free from stack on error
    - agent_list_identities: Fixed memory leak on OOM
    - knownhosts: Abort if the hosts buffer is too small
    - sftp_close_handle: Ensure the handle is always closed
    - channel_close: Close the channel even in the case of errors
    - Docs: Added missing libssh2_session_handshake.3 file
    - Docs: Fixed a bunch of typos
    - userauth_password: Pass on the underlying error code
    - _libssh2_channel_forward_cancel: Accessed struct after free
    - _libssh2_packet_add: Avoid using uninitialized memory
    - _libssh2_channel_forward_cancel: Avoid memory leaks on error
    - _libssh2_channel_write: Client spins on write when window full
    - Windows build: Fix build errors
    - publickey_packet_receive: Avoid junk in returned pointers
    - channel_receive_window_adjust: Store windows size always
    - userauth_hostbased_fromfile: Zero assign to avoid uninitialized use
    - configure: Change LIBS not LDFLAGS when checking for libs
    - agent_connect_unix: Make sure there's a trailing zero
    - MinGW build: Fixed redefine warnings
    - sftpdir.c: Added authentication method detection
    - Watcom build: Added support for WinCNG build
    - configure.ac: Replace AM_CONFIG_HEADER with AC_CONFIG_HEADERS
    - sftp_statvfs: Fix for servers not supporting statfvs extension
    - knownhost.c: Use LIBSSH2_FREE macro instead of free
    - Fixed compilation using mingw-w64
    - knownhost.c: Fixed that 'key_type_len' may be used uninitialized
    - configure: Display individual crypto backends on separate lines
    - Examples on Windows: Check for WSAStartup return code
    - Examples on Windows: Check for socket return code
    - agent.c: Check return code of MapViewOfFile
    - kex.c: Fix possible NULL pointer de-reference with session->kex
    - packet.c: Fix possible NULL pointer de-reference within listen_state
    - Tests on Windows: Check for WSAStartup return code
    - userauth.c: Improve readability and clarity of for-loops
    - Examples on Windows: Use native SOCKET-type instead of int
    - packet.c: i < 256 was always true and i would overflow to 0
    - kex.c: Make sure mlist is not set to NULL
    - session.c: Check return value of session_nonblock in debug mode
    - session.c: Check return value of session_nonblock during startup
    - userauth.c: Make sure that sp_len is positive and avoid overflows
    - knownhost.c: Fix use of uninitialized argument variable wrote
    - openssl: Initialise the digest context before calling EVP_DigestInit()
    - libssh2_agent_init: Init ->fd to LIBSSH2_INVALID_SOCKET
    - configure.ac: Add zlib to Requires.private in libssh2.pc if using zlib
    - configure.ac: Rework crypto library detection
    - configure.ac: Reorder --with-* options in --help output
    - configure.ac: Call zlib zlib and not libz in text but keep option names
    - Fix non-autotools builds: Always define the LIBSSH2_OPENSSL CPP macro
    - sftp: seek: Don't flush buffers on same offset
    - sftp: statvfs: Along error path, reset the correct 'state' variable
    - sftp: Add support for fsync (OpenSSH extension)
    - _libssh2_channel_read: Fix data drop when out of window
    - comp_method_zlib_decomp: Improve buffer growing algorithm
    - _libssh2_channel_read: Honour window_size_initial
    - window_size: Redid window handling for flow control reasons
    - knownhosts: Handle unknown key types


author: Paul Howarth <paul@city-fan.org> - 1.6.0-1.0.cf
changelog:
  - Update to 1.6.0
    - Added CMake build system
    - Added libssh2_userauth_publickey_frommemory()
    - wait_socket: Wrong use of difftime()
    - userauth: Fixed prompt text no longer being copied to the prompt's struct
    - mingw build: Allow to pass custom CFLAGS
    - Let mansyntax.sh work regardless of where it is called from
    - Init HMAC_CTX before using it
    - direct_tcpip: Fixed channel write
    - WinCNG: Fixed backend breakage
    - OpenSSL: Fix bug caused by introducing libssh2_hmac_ctx_init
    - userauth.c: Fix possible dereferences of a null pointer
    - wincng: Added explicit clear memory feature to WinCNG backend
    - openssl.c: Fix possible segfault in case EVP_DigestInit fails
    - wincng: Fix return code of libssh2_md5_init()
    - kex: Do not ignore failure of libssh2_sha1_init()
    - scp: Fix that scp_send may transmit uninitialized memory
    - scp.c: Improved command length calculation
    - nonblocking examples: Fix warning about unused tvdiff on Mac OS X
    - configure: Make clear-memory default but WARN if backend unsupported
    - OpenSSL: Enable use of OpenSSL that doesn't have DSA
    - OpenSSL: Use correct no-blowfish #define
    - kex: Fix libgcrypt memory leaks of bignum
    - libssh2_channel_open: More detailed error message
    - wincng: Fixed memleak in (block) cipher destructor


author: Paul Howarth <paul@city-fan.org> - 1.7.0-1.0.cf
changelog:
  - Update to 1.7.0
    - diffie_hellman_sha256: convert bytes to bits (CVE-2016-0787); see
      http://www.libssh2.org/adv_20160223.html
    - libssh2_session_set_last_error: Add function
    - mac: Add support for HMAC-SHA-256 and HMAC-SHA-512
    - WinCNG: support for SHA256/512 HMAC
    - kex: Added diffie-hellman-group-exchange-sha256 support
    - OS/400 crypto library QC3 support
    - SFTP: Increase speed and datasize in SFTP read
    - openssl: Make libssh2_sha1 return error code
    - openssl: Fix memleak in _libssh2_dsa_sha1_verify()
    - cmake: Include CMake files in the release tarballs
    - Fix builds with Visual Studio 2015
    - hostkey.c: Fix compiling error when OPENSSL_NO_MD5 is defined
    - GNUmakefile: Add support for LIBSSH2_LDFLAG_EXTRAS
    - GNUmakefile: Add -m64 CFLAGS when targeting mingw64
    - kex: free server host key before allocating it (again)
    - SCP: Add libssh2_scp_recv2 to support large (> 2GB) files on windows
    - channel: Detect bad usage of libssh2_channel_process_startup
    - userauth: Fix off by one error when reading public key file
    - kex: Removed dupe entry from libssh2_kex_methods
    - _libssh2_error: Support allocating the error message
    - hostkey: Fix invalid memory access if libssh2_dsa_new fails
    - hostkey: Align code path of ssh_rsa_init to ssh_dss_init
    - libssh2.pc.in: Fix the output of pkg-config --libs
    - wincng: Fixed possible memory leak in _libssh2_wincng_hash
    - wincng: Fixed _libssh2_wincng_hash_final return value
    - Add OpenSSL 1.1.0-pre2 compatibility
    - agent_disconnect_unix: Unset the agent fd after closing it
    - sftp: Stop reading when buffer is full
    - sftp: Send at least one read request before reading
    - sftp: Don't return EAGAIN if data was written to buffer
    - sftp: Check read packet file offset
    - configure: build "silent" if possible
    - openssl: Add OpenSSL 1.1.0-pre3-dev compatibility
    - GNUmakefile: List system libs after user libs
  - Update pkgconfig patch


author: Paul Howarth <paul@city-fan.org> - 1.7.0-3.0.cf
changelog:
  - diffie_hellman_sha1: Convert bytes to bits (additional fix for CVE-2016-0787)
  - Drop UTF-8 patch, which breaks things rather than fixes them


author: Paul Howarth <paul@city-fan.org> - 1.8.0-1.0.cf
changelog:
  - Update to 1.8.0
    - Added a basic dockerised test suite
    - crypto: Add support for the mbedTLS backend
    - libgcrypt: Fixed a NULL pointer dereference on OOM
    - VMS: Can't use %zd for off_t format
    - VMS: Update vms/libssh2_config.h
    - Windows: Link with crypt32.lib
    - libssh2_channel_open: Speeling error fixed in channel error message
    - msvc: Fixed 14 compilation warnings
    - tests: HAVE_NETINET_IN_H was not defined correctly
    - openssl: Add OpenSSL 1.1.0 compatibility
    - cmake: Add CLEAR_MEMORY option, analogously to that for autoconf
    - configure: Make the --with-* options override the OpenSSL default
    - libssh2_wait_socket: Set err_msg on errors
    - libssh2_wait_socket: Fix comparison with api_timeout to use milliseconds


author: Paul Howarth <paul@city-fan.org> - 1.8.0-3.0.cf
changelog:
  - Drop support for EOL distributions prior to F-13
    - Drop BuildRoot: and Group: tags
    - Drop explicit buildroot cleaning in %install section
    - Drop explicit %clean section
    - noarch sub-packages always available now
    - libselinux-utils always available now


author: Paul Howarth <paul@city-fan.org> - 1.8.0-5.0.cf
changelog:
  - scp: Do not NUL-terminate the command for remote exec (#1489736, GH#208)
  - Make devel package dependency on main package arch-specific


author: Paul Howarth <paul@city-fan.org> - 1.8.0-10.0.cf
changelog:
  - Explicitly run the test suite in the en_US.UTF-8 locale to work around flaky
    locale settings in mock builders


author: Ilyas R. Khasyanov <umask@yandex.ru> 20080125-umask.3
changelog:
  - build for umask repo / CentOS
  - up to last version available via HTTP (2008-01-25)
  - add requires libstemmer for stemwords rpm
  - fix install macros


author: Remi Collet <remi@remirepo.net> - 0.2.21-1
changelog:
  - initial package
  - add patch for -Werror=format-security from
    https://github.com/brechtsanders/xlsxio/pull/53


author: Remi Collet <remi@remirepo.net> - 0.2.27-1
changelog:
  - update to 0.2.27
  - open https://github.com/brechtsanders/xlsxio/issues/75
    behavior change in EMPTY management (infinite loop)


author: Remi Collet <remi@remirepo.net> - 0.7.6-1
changelog:
  - initial package
  - open https://github.com/jmcnamara/libxlsxwriter/issues/166 library layout
    fixed by https://github.com/jmcnamara/libxlsxwriter/pull/170
  - open https://github.com/jmcnamara/libxlsxwriter/issues/167 soname
  - open https://github.com/jmcnamara/libxlsxwriter/issues/168 cmake version
    fixed by https://github.com/jmcnamara/libxlsxwriter/pull/169


author: Daniel Veillard <veillard@redhat.com> - 2.7.7-1
changelog:
  - Upstream release of 2.7.7
  - fix serious trouble with zlib >= 1.2.4
  - xmllint new option --xpath
  - various HTML parser improvements
  - includes a number of nug fixes


author: Daniel Veillard <veillard@redhat.com> - 2.7.8-1
changelog:
  - Upstream release of 2.7.8
  - various bug fixes, including potential crashes
  - new non-destructive formatting option
  - date parsing updated to RFC 5646


author: Toshio Kuratomi <toshio@fedoraproject.org> - 2.9.2-8
changelog:
  - Remove executable permissions from documentation.  Complies with packaging
    guidelines and solves issue of libxml2-python3 package depending on python2


author: Daniel Veillard <veillard@redhat.com> - 2.9.2-1
changelog:
  - upstream release of 2.9.3
  - Fixes for CVE-2015-8035, CVE-2015-7942, CVE-2015-7941, CVE-2015-1819
    CVE-2015-7497, CVE-2015-7498, CVE-2015-5312, CVE-2015-7499, CVE-2015-7500
    and CVE-2015-8242
  - many other bug fixes


author: Remi Collet <remi@fedoraproject.org> - 1.0.1-1
changelog:
  - update to 1.0.1
  - soname bump from .2 to .4
  - drop ziptorrent
  - create "tools" sub package
  - rename to libzip-last to allow parallel installation


author: Remi Collet <remi@remirepo.net> - 1.5.1-1
changelog:
  - update to 1.5.1
  - drop dependency on zlib-devel and bzip2-devel no more
    referenced in libzip.pc
  - drop rpath patch merged upstream


author: Remi Collet <remi@remirepo.net> - 1.5.2-1
changelog:
  - update to 1.5.2
  - add all explicit cmake options to ensure openssl is used
    even in local build with other lilbraries available


author: Remi Collet <remi@remirepo.net> - 1.7.0-1
changelog:
  - update to 1.7.0
  - really enable lzma support (excepted on EL-6)
  - patch zipconf.h to re-add missing LIBZIP_VERSION_* macros


author: Remi Collet <remi@remirepo.net> - 1.7.2-1
changelog:
  - update to 1.7.2
  - fix installation layout using patch from
    https://github.com/nih-at/libzip/pull/190
  - fix pkgconfig usability using patch from
    https://github.com/nih-at/libzip/pull/191


author: Paul Wouters <pwouters@redhat.com> - 2.1.4-1
changelog:
  - Updated to 2.1.4
  - Merged in changes of rhbz#805849
  - Fixed URL/Source
  - Added initscripts
  - Removed prelink/executestack handling - gcc should handle it
    (and prelink causes FIPS issues)


author: Paul Wouters <pwouters@redhat.com> - 2.1.4-2
changelog:
  - Comment out the LSYNCD_OPTIONS options per default, it accidentally
    caused the options from the initscript/systemd service to ignored


author: Troy C. <tzero@fedoraproject.org> - 2.1.4-4
changelog:
  - Add log directory (#908151)
  - Remove unnecessary service restart in logrotate (#915873)
  - Enable PIE compiler flags (#955203)


author: Jason Taylor <jtfas90@gmail.com> - 2.2.1-1
changelog:
  - updated to latest upstream (resolves #1383855)
  - updated lsyncd.service (resolves #1369274 #1383855)
  - updated to github home page and source


author: Joe Orton <jorton@redhat.com> - 0:1.4.15-1
changelog:
  - update to 1.4.15 (#782395)
  - switch to simple systemd service (#878198)
  - use systemd scriptlet macros (Václav Pavlín, #850204)


author: Miroslav Lichvar <mlichvar@redhat.com> - 0:1.4.28-1
changelog:
  - update to 1.4.28
  - listen only on loopback interface by default (#1182542)
  - use upstream unit file (#1350939)
  - remove obsolete macros and scriptlet


author: Remi Collet <remi@remirepo.net> - 0:1.5.4-1
changelog:
  - Update to 1.5.4
  - enable extstore feature on 64-bit
  - open https://github.com/memcached/memcached/issues/319
    extstore broken build on 32-bit


author: Vit Mojzis <vmojzis@redhat.com> - 0:1.5.10-2
changelog:
  - selinux: Update to 1.0.2
  - selinux: Use license file from memcached-selinux tar
  - add "Requires" for selinux subpackage


author: Remi Collet <remi@remirepo.net> - 1.6.0-1
changelog:
  - update to 1.6.0 (2020-3-8)
  - add patch for GCC 10 from
    https://github.com/memcached/memcached/pull/622


author: Enrico Scholz <enrico.scholz@informatik.tu-chemnitz.de> - 4.2.3-1400
changelog:
  - added patches to fix races in dkim, geoip and p0f modules
  - conditionalized -upstart subpackage
  - added conditional to build it with libbind (required for RHEL5)


author: Remi Collet <remi@fedoraproject.org> - 1.2.0-0.4.20150903git3eaf73e
changelog:
  - update to version 1.2.0beta1 from git snapshot
  - https://jira.mongodb.org/browse/CDRIVER-828 missing tests/json


author: Remi Collet <remi@fedoraproject.org> - 1.2.0-0.5.20150903git3eaf73e
changelog:
  - add patch to export library verson in the API
    open https://github.com/mongodb/mongo-c-driver/pull/265


author: Remi Collet <remi@fedoraproject.org> - 1.3.3-2
changelog:
  - cleanup for review
  - move libraries in "libs" sub-package
  - add patch to skip online tests
    open https://github.com/mongodb/mongo-c-driver/pull/314
  - temporarily disable test suite on arm  (#1303864)
  - temporarily disable test suite on i686/F24+ (#1313018)


author: Remi Collet <remi@fedoraproject.org> - 1.3.5-1
changelog:
  - update to 1.3.5
  - use --disable-automatic-init-and-cleanup build option
  - ignore check for libbson version = libmongoc version


author: Martin Pala <martinp@tildeslash.com>
changelog:
  - Upgraded to monit-5.15
  - Added rpmbuild options for building without PAM (--without pam)
  - Added rpmbuild options for building without SSL (--without ssl)
  - Dropped build dependency on flex and bison


author: Scott R. Shinn <scott@atomicorp.com>
changelog:
  - Merged in from opensuse. Which not only never worked, but was only accessible via google cache. 
  - Updated to 0.2.1


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.37-1
changelog:
  - update to MySQL 5.5.37 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-37.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.38-1
changelog:
  - update to MySQL 5.5.38 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-38.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.39-1
changelog:
  - update to MySQL 5.5.39 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-39.html
  - disable dtrace


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.40-1
changelog:
  - update to MySQL 5.5.40 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-40.html
  - add /etc/my.cnf.d for split configuration files


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.41-1
changelog:
  - update to MySQL 5.5.41 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-41.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.42-1
changelog:
  - update to MySQL 5.5.42 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-42.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.43-1
changelog:
  - update to MySQL 5.5.43 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-43.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.44-1
changelog:
  - update to MySQL 5.5.44 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-44.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.45-1
changelog:
  - update to MySQL 5.5.45 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-45.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.46-1
changelog:
  - update to MySQL 5.5.46 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-46.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.47-1
changelog:
  - update to MySQL 5.5.47 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-47.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.48-1
changelog:
  - update to MySQL 5.5.48 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-48.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.49-1
changelog:
  - update to MySQL 5.5.49 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-49.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.50-1
changelog:
  - update to MySQL 5.5.50 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-50.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.51-1
changelog:
  - update to MySQL 5.5.51 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-51.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.52-1
changelog:
  - update to MySQL 5.5.52 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-52.html


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.53-1
changelog:
  - update to MySQL 5.5.53 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-53.html
  - add /var/lib/mysql-files directory


author: Remi Collet <RPMS@FamilleCollet.com> - 5.5.54-1
changelog:
  - update to MySQL 5.5.54 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-54.html


author: Remi Collet <remi@remirepo.net> - 5.5.55-1
changelog:
  - update to MySQL 5.5.55 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-55.html


author: Remi Collet <remi@remirepo.net> - 5.5.56-1
changelog:
  - update to MySQL 5.5.56 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-56.html


author: Remi Collet <remi@remirepo.net> - 5.5.57-1
changelog:
  - update to MySQL 5.5.57 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-57.html


author: Remi Collet <remi@remirepo.net> - 5.5.58-1
changelog:
  - update to MySQL 5.5.58 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-58.html


author: Remi Collet <remi@remirepo.net> - 5.5.59-1
changelog:
  - update to MySQL 5.5.59 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-59.html


author: Remi Collet <remi@remirepo.net> - 5.5.60-1
changelog:
  - update to MySQL 5.5.60 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-60.html


author: Remi Collet <remi@remirepo.net> - 5.5.61-1
changelog:
  - update to MySQL 5.5.61 Community Server GA
    http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-61.html


author: Geert Vanderkelen <geert.vanderkelen@oracle.com> - 2.0.2-1
changelog:
  - Added pre and postun scripts for sles
  - Making version a variable and using _libdir
  - Adding -DWITH_MYSQL and building libmysqlclient statically in


author: Bharathy Satish <bharathy.x.satish@oracle.com> - 5.7.10-1
changelog:
  - Added new decompression utilities lz4_decompress and zlib_decompress binaries to
    client subpackage.


author: Bjorn Munch <bjorn.munch@oracle.com> - 5.7.10-1
changelog:
  - Added lines to remove man pages we are not ready to include yet
  - Added lz4_decompress and zlib_decompress binaries to client subpackage
  - Drop support for el5, use scl to build on el6


author: Balasubramanian Kandasamy <balasubramanian.kandasamy@oracle.com> - 5.8.0-0.1
changelog:
  - Updated compatver to 5.6.31
  - Add example component to test package
  - Add test_udf_services.so plugin
  - Add keyring_udf.so plugin to server subpackage
  - Add keyring_okv.so plugin to commercial server subpackage
  - Purge man page for mysql_install_db in preparation for its removal
  - Include mysql-keyring directory
  - Provide keyring_file.so plugin


author: Erlend Dahl <erlend.dahl@oracle.com> - 8.0.0-0.1
changelog:
  - Change the version number to 8.0.0
  - Add manual page for ibd2sdi utility
  - Adapt MySQL server 5.7 packaging to MySQL Cluster 7.5
  - Remove mysql_config from client subpackage


author: Erlend Dahl <erlend.dahl@oracle.com> - 8.0.12-0.1
changelog:
  - Move mysqlx to default plugin
  - Add component_mysqlx_global_reset.so
  - Change the global milestone to 'dmr'
  - Add meb as sub package
  - Remove obsoleted mysqltest man pages
  - Independently choose SSL for the 5.6 compat lib, depending on commercial
  - Include udf_example.so in test package
  - Add component_validate_password component
  - Add License Book, remove COPYING
  - No longer need to remove obsoleted mysqltest man pages
  - Add perl modules for test subpackage
  - Add router as subpackage


author: Georgi Kodinov <georgi.kodinov@oracle.com> - 8.0.13-1
changelog:
  - Added test_services_host_application_signal test plugin
  - Adapt to numbered share directory for NDB files
  - Add Router


author: Bjorn Munch <bjorn.munch@oracle.com> - 8.0.17-1
changelog:
  - Add router man pages
  - Bundle mecab as usual on el8
  - Ship debuginfo and separate server-debug package on el8
  - Some clean up


author: Murthy Narkedimilli <murthy.narkedimilli@oracle.com> - 1.6.1-1
changelog:
  - Added new utilities binaries mysqlbinlogpurge, mysqlbinlogrotate and mysqlslavetrx
  - Changed the build prefix for SLES platform.
  - Added condition to include the mysql_utilities-*.egg-info file


author: Murthy Narkedimilli <murthy.narkedimilli@oracle.com> - 1.5.5-1
changelog:
  - Updated the SuSe version to 1315 to handle mysql_utilities-*.egg-info file.
  - Updated the Version to 1.5.5


author: Konstantin Pavlov <thresh@nginx.com>
changelog:
  - 1.11.3.
  - njs updated to 0.1.0.
  - njs stream dynamic module added to nginx-module-njs package.
  - geoip stream dynamic module added to nginx-module-geoip package.


author: Konstantin Pavlov <thresh@nginx.com>
changelog:
  - 1.11.9
  - Extended hardening build flags.
  - Added check-reload target to init script / systemd service.


author: Konstantin Pavlov <thresh@nginx.com>
changelog:
  - 1.11.13
  - CentOS7/RHEL7: made upgrade loops/timeouts configurable via
    /etc/sysconfig/nginx.
  - Bumped upgrade defaults to five loops one second each.


author: Sergey Budnevitch <sb@nginx.com>
changelog:
  - 1.4.7
  - spec cleanup
  - openssl version dependence added
  - upgrade() function in the init script improved
  - warning added when binary upgrade returns non-zero exit code


author: Sergey Budnevitch <sb@nginx.com>
changelog:
  - 1.5.12
  - spec cleanup
  - openssl version dependence added
  - upgrade() function in the init script improved
  - warning added when binary upgrade returns non-zero exit code


author: Remi Collet <remi@remirepo.net> -6.9.4-1
changelog:
  - update to 6.9.4 (from Fedora)
  - report build failure on EL-6
    https://github.com/kkos/oniguruma/issues/166


author: Remi Collet <remi@remirepo.net> -6.9.5+rev1-4
changelog:
  - From Fedora: Revert fix for CVE-2020-26159, marked as false
    https://github.com/kkos/oniguruma/issues/221


changelog: - Updatet to an newer git version because of some pulseaudio fixes.
author:
  Thomas Kowaliczek <linuxdonald@linuxdonald.de> - 1.10.622-3.3793919892e6d61e5fec3abeaaeebc3f2332be13


changelog: - Fixed broken upgrade paths.
author:
  Thomas Kowaliczek <linuxdonald@linuxdonald.de> - 1.10.622-4.3793919892e6d61e5fec3abeaaeebc3f2332be13


changelog: - Fixed small spec verion info.
author:
  Thomas Kowaliczek <linuxdonald@linuxdonald.de> - 1.10.622-5.3793919892e6d61e5fec3abeaaeebc3f2332be13


changelog: - Newer git version with more Pulseaudio fixes. Have fun.
author:
  Thomas Kowaliczek <linuxdonald@linuxdonald.de> - 1.10.622-6.0ceaa01c3de75c946ff2e7591e7f69b28ec00409


changelog: - Newer git version that fix more problems with pulseaudio.
author:
  Thomas Kowaliczek <linuxdonald@linuxdonald.de> - 1.10.622-7.931f5875cdc4ce0ac61a5110f11e962426e53d99


changelog: - Fixed Bug 567870
author:
  Thomas Kowaliczek <linuxdonald@linuxdonald.de> - 1.11.753-2.a9e0e57797c6f4321d5776e1f29bf1e75b11e6a1


author: Remi Collet <Fedora@FamilleCollet.com> 7.0.2p8-1
changelog:
  - update to 7.0.2p8
  - del destdir.patch ("make install DESTDIR" is now ok)
  - add gcc43.patch for Fedora 9


author: Sid Steward <ssteward@accesspdf.com> - 2.02-1
changelog:
  - Updated to release 2.02.
  - Removed patch since related source file has been removed
  - Changed jre-gcj dependency to libgcj


author: Paul Rombouts <p.a.rombouts@home.nl>
changelog:
  - Ensured that modification times of acconfig.h and configure.in
    are not changed by patching to avoid unwanted reconfigure during make phase.


author: Paul Rombouts <p.a.rombouts@home.nl>
changelog:
  - TCP-query support is now compiled in by default,
    but can be disabled using "--without tcpqueries".


author: Paul Rombouts <p.a.rombouts@home.nl>
changelog:
  - Instead of using a fixed default value for run_as_uid,
    I let useradd choose the uid if run_as_uid is undefined.


author: Tomislav Plavcic <tomislav.plavcic@percona.com>
changelog:
  - Update to new release Percona XtraBackup 2.3.2
  - Renamed the package to percona-xtrabackup since 2.3 became GA


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.5.1.el6]
changelog:
  - [fs] xfs: use maximum schedule timeout when ail is empty (Brian Foster) [921958 883905]
  - [net] xfrm_user: fix info leak in copy_to_user_tmpl() (Thomas Graf) [922428 922429] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_policy() (Thomas Graf) [922428 922429] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_state() (Thomas Graf) [922428 922429] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_auth() (Thomas Graf) [922428 922429] {CVE-2012-6537}
  - [net] atm: fix info leak in getsockopt(SO_ATMPVC) (Thomas Graf) [922386 922387] {CVE-2012-6546}
  - [net] atm: fix info leak via getsockname() (Thomas Graf) [922386 922387] {CVE-2012-6546}
  - [fs] nls: improve UTF8 -> UTF16 string conversion routine (Nikola Pajkovsky) [916118 916119] {CVE-2013-1773}
  - [fs] fat: Fix stat->f_namelen (Nikola Pajkovsky) [916118 916119] {CVE-2013-1773}
  - [netdrv] tun: fix ioctl() based info leaks (Thomas Graf) [922350 922351] {CVE-2012-6547}
  - [virt] x86: Add a check to catch Xen emulation of Hyper-V (Andrew Jones) [923204 918239]
  - [fs] cifs: fix expand_dfs_referral (Sachin Prabhu) [923098 902492]
  - [fs] cifs: factor smb_vol allocation out of cifs_setup_volume_info (Sachin Prabhu) [923098 902492]
  - [fs] cifs: have cifs_cleanup_volume_info not take a double pointer (Sachin Prabhu) [923098 902492]
  - [fs] nfs: Dont allow NFS silly-renamed files to be deleted, no signal (Dave Wysochanski) [920266 905095]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.6.1.el6]
changelog:
  - [virt] kvm: accept unaligned MSR_KVM_SYSTEM_TIME writes (Petr Matousek) [917020 917021] {CVE-2013-1796}
  - [char] tty: hold lock across tty buffer finding and buffer filling (Prarit Bhargava) [928686 901780]
  - [net] tcp: fix for zero packets_in_flight was too broad (Thomas Graf) [927309 920794]
  - [net] tcp: frto should not set snd_cwnd to 0 (Thomas Graf) [927309 920794]
  - [net] tcp: fix an infinite loop in tcp_slow_start() (Thomas Graf) [927309 920794]
  - [net] tcp: fix ABC in tcp_slow_start() (Thomas Graf) [927309 920794]
  - [netdrv] ehea: avoid accessing a NULL vgrp (Steve Best) [921535 911359]
  - [net] sunrpc: Get rid of the redundant xprt->shutdown bit field (J. Bruce Fields) [915579 893584]
  - [virt] kvm: do not #GP on unaligned MSR_KVM_SYSTEM_TIME write (Gleb Natapov) [917020 917021] {CVE-2013-1796}
  - [drm] i915: bounds check execbuffer relocation count (Nikola Pajkovsky) [920523 920525] {CVE-2013-0913}
  - [x86] irq: add quirk for broken interrupt remapping on 55XX chipsets (Neil Horman) [911267 887006]
  - [kvm] Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (Gleb Natapov) [917024 917025] {CVE-2013-1797}
  - [kvm] Fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (Gleb Natapov) [917020 917021] {CVE-2013-1796}
  - [kvm] Fix bounds checking in ioapic indirect register reads (Gleb Natapov) [917030 917032] {CVE-2013-1798}
  - [kvm] x86: release kvmclock page on reset (Gleb Natapov) [917024 917025] {CVE-2013-1797}
  - [security] keys: Fix race with concurrent install_user_keyrings() (David Howells) [916681 913258] {CVE-2013-1792}
  - [virt] hv_balloon: Make adjustments to the pressure report (Jason Wang) [909156 902232]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.8.1.el6]
changelog:
  - [fs] raw: don't call set_blocksize when not changing the blocksize (Jeff Moyer) [951406 909482]
  - [x86] Allow greater than 1TB of RAM on AMD x86_64 sytems (Larry Woodman) [952570 876275]
  - [netdrv] ixgbe: Only set gso_type to SKB_GSO_TCPV4 as RSC does not support IPv6 (Michael S. Tsirkin) [927292 908196]
  - [netdrv] bnx2x: set gso_type (Michael S. Tsirkin) [927292 908196]
  - [netdrv] qlcnic: set gso_type (Michael S. Tsirkin) [927292 908196]
  - [netdrv] ixgbe: fix gso type (Michael S. Tsirkin) [927292 908196]
  - [fs] gfs2: Allocate reservation structure before rename and link (Robert S Peterson) [924847 922999]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.9.1.el6]
changelog:
  - [fs] nfs: Fix handling of revoked delegations by setattr (Steve Dickson) [960415 952329]
  - [fs] nfs: Return the delegation if the server returns NFS4ERR_OPENMODE (Steve Dickson) [960415 952329]
  - [fs] nfs: Fix another potential state manager deadlock (Steve Dickson) [960436 950598]
  - [fs] nfs: Fix another open/open_recovery deadlock (Steve Dickson) [960433 916806]
  - [fs] nfs: Hold reference to layout hdr in layoutget (Steve Dickson) [960429 916726]
  - [fs] nfs: add "pnfs_" prefix to get_layout_hdr() and put_layout_hdr() (Steve Dickson) [960429 916726]
  - [fs] nfs: nfs4_open_done first must check that GETATTR decoded a file type (Steve Dickson) [960412 916722]
  - [net] sunrpc: Dont start the retransmission timer when out of socket space (Steve Dickson) [960426 916735]
  - [fs] nfs: Dont use SetPageError in the NFS writeback code (Steve Dickson) [960420 912867]
  - [fs] nfs: Dont decode skipped layoutgets (Steve Dickson) [927294 904025]
  - [fs] nfs: nfs4_proc_layoutget returns void (Steve Dickson) [927294 904025]
  - [fs] nfs: defer release of pages in layoutget (Steve Dickson) [927294 904025]
  - [fs] nfs: Use kcalloc() when allocating arrays (Steve Dickson) [927294 904025]
  - [fs] nfs: Fix an ABBA locking issue with session and state serialisation (Steve Dickson) [960417 912842]
  - [fs] nfs: Fix a race in the pNFS return-on-close code (Steve Dickson) [960417 912842]
  - [fs] nfs: Do not accept delegated opens when a delegation recall is in effect (Steve Dickson) [960417 912842]
  - [fs] nfs: Fix a reboot recovery race when opening a file (Steve Dickson) [952613 908524]
  - [fs] nfs: Ensure delegation recall and byte range lock removal don't conflict (Steve Dickson) [952613 908524]
  - [fs] nfs: Fix up the return values of nfs4_open_delegation_recall (Steve Dickson) [952613 908524]
  - [fs] nfs: Dont lose locks when a server reboots during delegation return (Steve Dickson) [952613 908524]
  - [fs] nfs: Move nfs4_wait_clnt_recover and nfs4_client_recover_expired_lease (Steve Dickson) [952613 908524]
  - [fs] nfs: Add NFSDBG_STATE (Steve Dickson) [952613 908524]
  - [fs] nfs: nfs_inode_return_delegation() should always flush dirty data (Steve Dickson) [952613 908524]
  - [fs] nfs: nfs_client_return_marked_delegations cant flush data (Steve Dickson) [952613 908524]
  - [fs] nfs: Prevent deadlocks between state recovery and file locking (Steve Dickson) [952613 908524]
  - [fs] nfs: Allow the state manager to mark an open_owner as being recovered (Steve Dickson) [952613 908524]
  - [kernel] seqlock: Dont smp_rmb in seqlock reader spin loop (Steve Dickson) [952613 908524]
  - [kernel] seqlock: add 'raw_seqcount_begin()' function (Steve Dickson) [952613 908524]
  - [kernel] seqlock: optimise seqlock (Steve Dickson) [952613 908524]
  - [fs] nfs: don't allow nfs_find_actor to match inodes of the wrong type (Jeff Layton) [921964 913660]
  - [net] sunrpc: Add barriers to ensure read ordering in rpc_wake_up_task_queue_locked (Dave Wysochanski) [956979 840860]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.10.1.el6]
changelog:
  - [scsi] be2iscsi : Fix the NOP-In handling code path (Nikola Pajkovsky) [955504 947550]
  - [scsi] be2iscsi: Fix memory leak in control path of driver (Rob Evers) [955504 947550]
  - [virt] kvm: validate userspace_addr of memslot (Petr Matousek) [950496 950498] {CVE-2013-1943}
  - [virt] kvm: fix copy to user with irq disabled (Michael S. Tsirkin) [949985 906602] {CVE-2013-1935}
  - [net] veth: Dont kfree_skb() after dev_forward_skb() (Jiri Benc) [957712 957713] {CVE-2013-2017}
  - [net] tcp: Reallocate headroom if it would overflow csum_start (Thomas Graf) [954298 896233]
  - [net] tcp: take care of misalignments (Thomas Graf) [954298 896233]
  - [net] skbuff.c cleanup (Thomas Graf) [954298 896233]
  - [idle] intel_idle: Initialize driver_data correctly in ivb_cstates on IVB processor (Prarit Bhargava) [960864 953630]
  - [x86] Prevent panic in init_memory_mapping() when booting more than 1TB on AMD systems (Larry Woodman) [962482 869736]
  - [mm] enforce mmap_min_addr on x86_64 (Rik van Riel) [961431 790921]
  - [mm] optional next-fit policy for arch_get_unmapped_area (Rik van Riel) [961431 790921]
  - [mm] fix quadratic behaviour in get_unmapped_area_topdown (Rik van Riel) [961431 790921]
  - [scsi] Revert: qla2xxx: Optimize existing port name server query matching (Chad Dupuis) [950529 924804]
  - [scsi] Revert: qla2xxx: Avoid losing any fc ports when loop id's are exhausted (Chad Dupuis) [950529 924804]
  - [fs] defer do_filp_open() access checks to may_open() (Eric Sandeen) [928683 920752]
  - [md] dm thin: bump the target version numbers (Mike Snitzer) [924823 922931]
  - [md] dm-thin: fix discard corruption (Mike Snitzer) [924823 922931]
  - [md] persistent-data: rename node to btree_node (Mike Snitzer) [924823 922931]
  - [md] dm: fix limits initialization when there are no data devices (Mike Snitzer) [923096 908851]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.11.1.el6]
changelog:
  - [kernel] perf: fix perf_swevent_enabled array out-of-bound access (Petr Matousek) [962793 962794] {CVE-2013-2094}


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.12.1.el6]
changelog:
  - [fs] Panic in gfs2_inplace_reserve after fix from BZ#875753 (Robert S Peterson) [924847 922999]
  - [nfs] sunrpc: Prevent an rpc_task wakeup race (Dave Wysochanski) [956979 840860]
  - [nfs] sunrpc: clarify comments on rpc_make_runnable (Dave Wysochanski) [956979 840860]
  - [x86] acpi: Avoid SRAT table checks for Fujitsu Primequest systems (Prarit Bhargava) [973198 966853]
  - [x86] oprofile: Fix crash when unloading module in nmi timer mode (Don Zickus) [972586 828936]
  - [block] propagate proper return codes from blk_get_request callers (Jeff Moyer) [958684 927918]
  - [block] Check the return value from blk_get_request (Jeff Moyer) [958684 927918]
  - [virt] kvm/mmu: fix hashing for TDP and non-paging modes (Marcelo Tosatti) [966432 908751]
  - [virt] kvm/mmu: Fix free memory accounting race in mmu_alloc_roots() (Marcelo Tosatti) [966432 908751]
  - [virt] kvm/mmu: Don't flush shadow when enabling dirty tracking (Marcelo Tosatti) [966432 908751]


author: Nikola Pajkovsky <npajkovs@redhat.com> [2.6.32-358.13.1.el6]
changelog:
  - [wireless] b43: stop format string leaking into error msgs (John Linville) [971387 971389] {CVE-2013-2852}
  - [pci] make sriov work with hotplug remove (Takahiro MUNEDA) [973555 965002]
  - [net] rtnl: fix info leak on RTM_GETLINK request for VF devices (Flavio Leitner) [923657 923659] {CVE-2013-2634 CVE-2013-2635}
  - [net] dcbnl: fix various netlink info leaks (Flavio Leitner) [923657 923659] {CVE-2013-2634 CVE-2013-2635}
  - [net] bonding: fix enslaving in alb mode when link down (Veaceslav Falico) [969306 965132]
  - [net] tcp: Fix oops from tcp_collapse() when using splice() (Nikola Pajkovsky) [968871 863512] {CVE-2013-2128}
  - [usb] uhci: fix IRQ race during initialization (Dave Young) [968557 915834]
  - [netdrv] e1000e: enable VLAN RX/TX in PROMISC mode (Stefan Assmann) [963564 886420]
  - [netdrv] bnx2x: strip VLAN header in PROMISC mode (Stefan Assmann) [963564 886420]
  - [net] vlan: handle packets with empty vlan_group via VLAN code (Stefan Assmann) [963564 886420]
  - [fs] namei.c: Dont allow to create hardlink for deleted file (Brian Foster) [956296 908158]
  - [fs] gfs2: Reinstate withdraw ack system (Robert S Peterson) [927308 908093]
  - [fs] nfs: open a file descriptor for fsync in nfs4 recovery (J. Bruce Fields) [964046 915479]
  - [net] macvlan: remove bogus check in macvlan_handle_frame() (Jiri Pirko) [962370 952785]
  - [net] macvlan: fix passthru mode race between dev removal and rx path (Jiri Pirko) [962370 952785]
  - [kernel] rcu: Replace list_first_entry_rcu() with list_first_or_null_rcu() (Jiri Pirko) [962370 952785]
  - [net] bluetooth/rfcomm: Fix missing msg_namelen update in rfcomm_sock_recvmsg() (Weiping Pan) [955653 955654] {CVE-2013-3225}
  - [net] bluetooth: fix possible info leak in bt_sock_recvmsg() (Radomir Vrbovsky) [955603 955604] {CVE-2013-3224}
  - [fs] gfs2: Issue discards in 512b sectors (Robert S Peterson) [927317 922779]
  - [fs] udf: avoid info leak on export (Nikola Pajkovsky) [922354 922355] {CVE-2012-6548}
  - [scsi] lpfc: Fixed deadlock between hbalock and nlp_lock use (Rob Evers) [962368 960717]
  - [kernel] tracing: Fix possible NULL pointer dereferences (Weiping Pan) [952212 952213] {CVE-2013-3301}
  - [kernel] tracing: Fix panic when lseek() called on "trace" opened for writing (Weiping Pan) [952212 952213] {CVE-2013-3301}
  - [net] atm: update msg_namelen in vcc_recvmsg() (Nikola Pajkovsky) [955224 955225] {CVE-2013-3222}
  - [x86] apic: Work around boot failure on HP ProLiant DL980 G7 Server systems (Prarit Bhargava) [969326 912963]
  - [x86] apic: Use probe routines to simplify apic selection (Prarit Bhargava) [969326 912963]
  - [x86] x2apic: Simplify apic init in SMP and UP builds (Prarit Bhargava) [969326 912963]
  - [kvm] vmx: provide the vmclear function and a bitmap to support VMCLEAR in kdump (Andrew Jones) [962372 908608]
  - [x86] kexec: VMCLEAR VMCSs loaded on all cpus if necessary (Andrew Jones) [962372 908608]
  - [fs] ext3: Fix format string issues (Nikola Pajkovsky) [920784 920785] {CVE-2013-1848}
  - [kernel] signal: always clear sa_restorer on execve (Nikola Pajkovsky) [920505 920506] {CVE-2013-0914}


author: Devrim Gunduz <devrim@CommandPrompt.com> 2.2.5-1
changelog:
  - Update to 2.2.5, for various fixes described at
    http://lists.pgfoundry.org/pipermail/pgpool-general/2009-October/002188.html
  - Re-apply a fix for Red Hat Bugzilla #442372


author: Devrim GUNDUZ <devrim@gunduz.org> - 3.0.1
changelog:
  - Update to 3.0.1
  - Apply many 9.0+ specific changes, and use alternatives method.
  - Apply some changes to init script.


author: Kir Kolyshkin <kir@openvz.org> 1.9-1
changelog:
  - New functionality:
  -- libploop.so: implement SONAME and versioning
  -- Introduce ploop_get_devs() to get all mounted devices per dd.xml
  - Fixes:
  -- make_fs(): reserve max possible GDT block for online resize
  -- do_lock(): set FD_CLOEXEC explicitly on lock fd
  -- fix raw image creation (broken in ploop 1.8)
  -- return SYSEXIT_SYS on ploop_find_dev_by_uuid() failure
  -- ploop.spec: run ldconfig on install/uninstall
  - Improvements:
  -- Display mount data in error message on mount() failure
  -- dynload.h: pad the struct ploop_functions to 64 pointers
  -- gensym.sh: add code to check sizeof(struct ploop_function)
  -- etc/Makefile: ploop.conf should not be executable
  -- Makefile.inc: support Debian multiarch
  -- Makefile: add distclean target
  -- Makefile cleanups


author: Kir Kolyshkin <kir@openvz.org> 1.10-1
changelog:
  - New functionality:
  --  Added check for and repair of sparse images
  --  ploop check: long options support
  --  ploop check: add --raw, --repair-sparse
  --  ploop-check: add -b BLOCKSIZE argument
  --  ploop-check: accept DiskDescriptor.xml argument
  --  ploop umount -d: allow to specify partition device (#2788)
  --  mount.ploop: implement -v and -f options, as per mount(8)
  --  umount.ploop: add -n option (ignored)
  --  mount.ploop: add -s (ignored) and -* (reported as error)
  --  Added ploop info -s
  --  ploop init: use v2 format by default
  --  ploop init: create ext4 by default
  - Fixes:
  --  ploop_get_devs(): fix snprintf usage
  --  ploop_global_lock(): create lockdir if not exist (#2767)
  --  ploop_grow_delta_offline(): Fix uninitialized struct
  --  ploop_ioff_to_sec(): fix for v2
  --  lib/ploop.h: include sys/syscall.h (Debian #728173)
  --  umount.ploop: fixed (#2788)
  --  get_image_param(): added online (from sysfs) and offline (from image) cases
  --  make_fs(): turn off periodic fs checks (#2769)
  --  ploop_store_diskdescriptor(): check rename()
  --  ploop_store_diskdescriptor(): don't return -1
  --  resize_gpt_partition(): check fsync()
  --  ploop_balloon_change_size(): don't pass -1 to close()
  --  ploop_grow_image(): fix an error check
  --  Don't ignore chmod() failures
  --  print_output(): fix output
  --  make_fs(): fix max_online_resize type overflow
  --  do_umount(): fix diagnostic lsof verbose level
  --  plooptool_stat(): close file descriptors
  --  ploop convert -f: do not return SYSEXIT_PLOOPFMT
  --  ploop check: fix exit codes
  --  make_fs(): create ext4 fs with 128M journal
  - Improvements:
  --  Support RHEL5/e4fsutils (tune4fs, dumpe4fs) (#2812)
  --  do_lock(): open file in read/write mode (#2730)
  --  ploop_send: use ioctl_device for PLOOP_IOC_SYNC
  --  use access() not stat() where possible
  --  umount.ploop: improve mtab handling
  --  mount.ploop: use case in option parsing
  --  {mount,umount}.ploop: don't hardcore ploop path
  --  ploop-check.c: rename uppercased functions
  --  ploop snapshot-list usage: fit to 80 cols
  --  fsck: use fsck.ext4 not e2fsck (#2812)
  --  check_size(): limit max ploop size to 16T
  --  ploop_resize_image(): fail if umount failed
  --  print_output(): improve output
  --  ploop_mount(): fix/improve error message
  --  dumpe2fs(): don't hardcode path to dumpe2fs
  --  print_output(): use our own default PATH
  --  do_umount(): refactor and improve
  --  do_umount(): eliminate extra 'lsof' call on EBUSY
  --  do_umount(): don't call lsof again if not found
  --  print_output(): check return from pclose()
  --  print_output(): return exit code from command
  --  Fix some wrongly used exit codes
  --  Remove unused exit codes
  - Documentation:
  --  ploop(8): document check, balloon discard, info, list, copy commands
  --  ploop(8): describe exit codes
  --  ploop(8): better resize description
  --  ploop(8): fix ploop umount -d description
  --  ploop(8): fix ploop mount -d description
  --  ploop(8): improve convert description
  --  ploop(8): add missing OPTIONS section
  --  ploop(8): make IMAGE FORMATS a subheader
  --  ploop(8): other small fixes and improvements
  --  ploop usage: improve
  --  ploop usage: update ploop check synopsys
  --  ploop init: fix/improve usage
  --  ploop usage: fix mount/umount/resize
  - Build system:
  --  ploop.spec: require -lib of the same release
  --  ploop.spec: require lsof and findutils
  --  Makefile.inc: add -Wformat-security
  --  Makefile.inc: proper LIBDIR for Debian case
  --  Makefile.inc: add CPPFLAGS to CFLAGS
  --  Makefile.inc: prepend, not append, debug CFLAGS
  --  tools/Makefile: simplify SOURCES define
  --  setver.sh: introduce build id
  --  setver.sh: use getopt
  --  Remove stand-alone binaries: ploop-check, ploop-grow, ploop-merge, ploop-stat, ploop-copy
  --  Makefile: add Coverity generation logic


author: Kir Kolyshkin <kir@openvz.org> 1.11-1
changelog:
  - New functionality and important changes:
  -- support for 4K sector size (including GPT conversion)
  -- ploop replace
  -- temp snapshots support (ploop tsnapshot, ploop_create_temporary_snapshot())
  -- ploop copy: implement fdatasync before freeze (improves CT frozen time)
  -- New DiskDescriptor.xml read API (ploop_*_dd())
  -- Obsolete *_diskdescriptor() calls
  -- Obsolete ploop_get_base_delta_uuid()
  -- ploop_log(): implement subsecond timestamps (with verbosity >= 4)
  -- add ploop_is_mounted()
  -- ploop snapshot-list: add snapshot mode (-s)
  -- ploop check dd.xml: add -u UUID option
  -- ploop mount: remove -u base feature
  -- ploop tool: add -v option to set verbosity
  - Fixes:
  -- skip max fs size check on snapshot delta creation
  -- ploop_resize_image: resize up to end of device
  -- ploop_delete_top_delta(): fix wrt top_guid
  -- ploop_read_diskdescriptor(): fix get_basedir() len argument
  -- check_and_repair_sparse: handle EOF properly (#2897)
  -- ploop_resize_image: add missing gpt size sync
  -- ploop snapshot-merge/delete: deny snapshot deleting if mounted (#2887)
  -- grow_lower_delta(): fix a memory leak
  -- ploop check: fix -b option parsing
  -- get_partition_device_name(): fix chmod argument
  -- fix alignment on GPT partition resize
  -- fix GPT partition alignment on ploop init
  - Improvements:
  -- ploop_resize_image: enhanced inflate balloon to max size logic
  -- tools: add {} to specified UUID if necessary
  -- check_and_repair_sparse(): log filefrag output
  -- print_sys_block_ploop(): speed up
  -- ploop check: try to repair non-top deltas if they can be opened r/w
  -- e2fsck: return fsck exit code to caller
  -- make_fs(): add -i to mkfs
  -- fsync_safe(): use SYSEXIT_FSYNC
  -- Fix uuid strings size, use define
  - Documentation:
  -- ploop snapshot-list: fix and update usage
  -- ploop copy: fix usage
  -- ploop(8): document snapshot-list -s option
  -- ploop(8): document ploop replace
  - Build system:
  -- Makefile.inc: fix dpkg-architecture handling (#2877)
  -- Makefile: add ability to add local rules
  -- gensym.sh: better usage and error diag
  -- gensym.sh: add run mode


author: Kir Kolyshkin <kir@openvz.org> 1.12-1
changelog:
  - New functionality:
  -- ploop copy: implement two-way protocol
  -- ploop copy send: implement async read/send
  -- ploop copy send: add profiling
  -- delete_snapshot(): handle snapshots with multiple refs
  -- tune_fs(): use EXT4_IOC_SET_RSV_BLOCKS if available
  -- Introduce ploop_get_max_size()
  -- Introduce ploop_copy_{send,receive}, obsoleting ploop_{send,receive}
  -- Introduce ploop_create_dd()
  -- ploop info: add -d to show ploop device
  -- ploop_check(): open image RO, reopen RW later
  -- check_and_repair_sparse(): reopen image rw if needed
  - Fixes:
  -- ploop copy: fix open_mount_point err handling
  -- ploop copy: improve fd checks
  -- ploop_store_diskdescriptor: fsync DiskDescriptor.xml upon writing
  -- ploop_resize_image(): handle get_mount_dir() error
  -- ploop_resize_image: auto-mount fs
  -- do_delete_snapshot: fix wrt temp snapshot uuid
  -- ploop_switch_snapshot_ex(): don't return 0 if guid_old is bad
  -- do_delete_snapshot: deny delete top delta in case parent snapshot is temp
  -- merge_temporary_snapshots: fix infinite loop
  -- ploop_switch_snapshot_ex: fixed case with PLOOP_SNAP_SKIP_TOPDELTA_CREATE
  -- ploop_delete_snapshot: fix for temp snapshot
  -- create_snapshot: clear stale top delta inuse flag
  -- e2fsck: make it quiet


author: Kir Kolyshkin <kir@openvz.org> 1.12.1-1
changelog:
  - Fixes:
  -- ploop copy send: fix a race that could result in image corruption
  -- resize: fix resize working on an older (pre 042stab092.1) kernel
  - Improvements:
  -- ploop mount: warn if host filesystem uses data=writeback (#3030)
  -- snapshot-switch: don't show ENOENT remove error
  -- ploop_is_large_disk_supported(): check ploop module first


author: Kir Kolyshkin <kir@openvz.org> 1.12.2-1
changelog:
  - Fixes:
  -- ploop balloon discard: fix wrt 042stab10x kernel (#3156)
  -- ploop_merge_snapshot_by_guid: fix offline merge with raw base image
  -- reread_part(): repeat ioctl if EBUSY (#3081)
  - Improvements:
  -- check_mount_restrictions(): check for all images
  -- ploop check dd.xml: lock dd
  -- ploop check dd.xml: skip check if ploop is used
  -- check_deltas(): read-only check for non-top deltas


author: Kir Kolyshkin <kir@openvz.org> 1.13-1
changelog:
  - New functionality:
  -- snapshot-merge: add -n, merge to new delta ability
  -- Logging to PLOOP_LOG_FILE (if variable is defined during compilation)
  -- ploop restore-descriptor: create dd.xml by image (single image only)
  -- ploop replace: add -k, --keep-name to keep the replaced delta file name
  -- ploop replace: implement offline replace
  -- snapshot-delete: introduce specific SYSEXIT_NOSNAP error
  -- Alternative (incompatible) implementation of ploop copy (C and Python API)
  - Fixes:
  -- ploop_replace_image(): fix wrt level
  -- ploop grow: update size in DiskDescriptor.xml after growing
  -- normalize_image_name(): fix for a corner case
  -- ploop_replace_image(): always unlock dd.xml
  -- {mount,umount}.ploop: fixes for filenames with spaces, tabs etc.
  -- umount.ploop: fix mtab removal (#3164)
  -- umount.ploop: fix for file names with a semicolon
  -- scripts/mount.ploop: don't hardcode paths to modprobe and readlink
  -- ploop_umount(): don't return -1, use SYSEXIT_*
  -- ploop_merge_snapshot_by_guid(): fix error message, don't print (null)
  -- ploop tsnapshot(): fix usage
  -- grow_lower_delta(): fix a memory leak
  -- ploop_merge_snapshot_by_guid(): fix error message
  -- check_snapshot_mount(): add is_device_inuse() check
  - Improvements:
  -- print_sys_block_ploop(): print less info
  -- Remove delta_fops abstraction layer
  -- ploop merge: obsolete/disable form with DD.xml (use snapshot-merge)
  -- ploop snapshot-merge: fix/improve message about merged deltas
  -- find_level_by_delta(): rework/improve
  -- ploop_switch_snapshot(): rm non-const cast
  -- local_delta_open(): make first arg const
  -- [style] ploop_replace_image: reuse oldfile var
  -- merge_image(): document the function
  -- ploop_di_merge_image(): remove last argument
  -- Rename get_child_by_uuid() to find_child_by_guid()
  -- ploop_merge_snapshot_by_guid(): untangle MERGE_WITH_{PARENT,CHILD} mess
  -- ploop_merge_snapshot_by_guid: fix ending message
  -- Rework check_snapshot_mount()
  -- ploop_di_merge_image: fix error messages
  -- ploop_merge_snapshot_by_guid(): fix error message
  - Documentation:
  -- ploop tool: usage formatting fixes
  -- ploop(8): expand description of snapshot-merge
  -- ploop(8): describe replace -k, --keep-name option
  -- ploop(8): describe restore-descriptor command
  -- ploop(8): describe snapshot-merge -n option
  - Build system:
  -- ploop.spec: no perms for symlink
  -- Makefile.inc: add VERSION and RELEASE vars to specify package version
  -- setver.sh: modify to use VERSION/RELEASE from Makefile.inc
  -- setver.sh: add -o, --oldpackage flag


author: Kir Kolyshkin <kir@openvz.org> 1.13.2-1
changelog:
  - Fix online top delta merge/delete (#3215)
  - Fix messages and use-after-free in ploop_merge_snapshot_by_guid()
  - ploop(8): document SYSEXIT_NOSNAP
  - ploop.spec: complete 1.13 changelog


author: Kir Kolyshkin <kir@openvz.org> 1.14-1
changelog:
  - New functionality:
  -- ploop init: add --nolazy
  -- ploop snapshot-merge: add -U
  -- ploop_create_param: add flags, define NOLAZY flag
  -- do_ioctl(): run lsof on EBUSY
  -- Add pkg-config support
  - Fixes:
  -- Fix restore-descriptor for raw images
  -- ploop_get_top_delta_fname(): use ploop_lock(), return SYSEXIT_*
  -- Fix POWER compilation
  -- ploop_create_image(): do not return -1, use SYSEXIT_* code
  -- ploop snapshot-switch: fix SIGSEGV parsing cmdline
  -- is_xml_fname(): fix a potential SIGSEGV
  - Improvements:
  -- do_ioctl(): implement exponential wait time
  -- mount.ploop: check if mtab is not symlink
  -- ploop_replace_image: use mkstemp() not mktemp()
  -- print_sys_block_ploop(): more compact output
  -- ploop_umount_image(): simplify unlock on return
  -- make_fs(): don't hardcode argv index
  -- read_diskdescriptor(): remove
  -- tools/Makefile: fix LDLIBS to avoid overlinking
  - Documentation:
  -- ploop(8): document --nolazy flag for ploop init
  -- ploop(8): document -U for ploop snapshot-merge
  -- include/libploop.h: document mount and snapshot switch params
  - Build system:
  -- Makefiles: move -lpthread to the proper place
  -- ploop.spec: fix a date in %changelog
  -- ploop.spec: no %attr for symlink


author: Kir Kolyshkin <kir@openvz.org> 1.15-1
changelog:
  - New functionality:
  -- ploop defragmentation support using e4defrag2
  -- mount_image: return SYSEXIT_NOSNAP error
  -- Add ploop_get_base_delta_fname()
  -- Allow to create image > 16TB (without filesystem inside)
  - Fixes:
  -- Fix resizing image mounted inside mnt namespace
  -- ploop_get_devs: fix NULL pointer dereference
  -- copy_delta(): avoid double-free
  -- fix infinite loop in ploop balloon discard
  -- Fix compile with gcc-5.3.0
  -- ploop_mount_fs: don't mount ro when finding balloon inode
  -- Remove temp mount point after ploop resize
  -- Repair DiskDescriptot.xml on process PLOOP_MNTN_MERGE stage
  - Improvements:
  -- make_fs(): drop lazy_journal_init
  -- scripts/umount.ploop: rm unused var
  -- do_delete_snapshot(): don't use PLOOP_MERGE_WITH_CHILD
  -- ploop_merge_snapshot_by_guid(): remove merge_mode
  -- balloon.c: no need to include libgen.h
  -- defrag_complete: fix a typo
  -- defrag_complete(): report errors
  -- defrag_complete(): check for cmdline
  -- defrag_complete(): report stale pidfile
  -- gensym.sh: busybox sed compatibility
  -- musl (Alpine Linux) compile fixes
  -- mount_image(): kill flags argument
  -- do_mntn_merge(): fix the check for same file
  -- find_image_idx_by_file: get_basedir() only if needed
  -- discard/defrag: take into account image size change caused by defrag
  - Documentation:
  -- ploop balloon discard: document --defrag
  -- ploop(8): document --defrag
  - Build system:
  -- setver.sh: fix a typo


author: Kir Kolyshkin <kir@openvz.org> 1.1-1
changelog:
  - support for variable block size
  - default block size changed from 256K to 1M
  - ploop_set_log_file(): make NULL a valid argument
  - logger: introduce, use and expose PLOOP_LOG_NOCONSOLE
  - ploop_getdevice(): expose
  - ploop_store_diskdescriptor(): fix for a case when image is in root dir
  - Fixed expanded to preallocated conversion
  - Remove some unused functions and non-existent function prototypes
  - Introduce and use SYSEXIT_MKNOD error code
  - Changed image -> device mapping schema
  - Use strcasecmp for guid comparison
  - Made ploop_merge_param.guid field const
  - tools/ploop: remove -b option
  - tools/ploop: remove unused and untested replace & add commands
  - Log/error message fixes, improvements, and unification
  - Makefiles: fixes, improvements


author: Kir Kolyshkin <kir@openvz.org> 1.2-1
changelog:
  - Added ploop_get_dev() function
  - Added ploop_set_component_name() function
  - Fix: do not clear in-use flag in ploop_fsck()
  - ploop-fsck: add -d flag to forcefully drop "in use" image flag
  - Fixed handling blocksize for raw images
  - Added user_xattr,acl to default mount options
  - ploop_mount(): added ability to pass MS_NOATIME flag
  - ploop-balloon: add discard command to compact ploop image
  - ploop_get_info(): return old info in case statfs() failed
  - expanded2preallocated(): if fallocate not supported, use ftruncate
  - ploop_resize_image(): Check is it possible to fallocate before inflating balloon file
  - Fixed merging all snapshots
  - Some fixes in ploop tool usage
  - Some log message fixes
  - Add function, source file and line number to error messages if DEBUG is set
  - Build system fixes/improvements


author: Kir Kolyshkin <kir@openvz.org> 1.3-1
changelog:
  - New functionality
    - ploop copy is working now
    - added pcopy's send_process() and receive_process() to lib
    - ploop mount: added -c <component_name> option
    - ploop(8): added (still incomplete)
    - ploop balloon discard: add --to-free and --min-block
    - add Preallocated item to DiskDescriptor.xml
    - add add ploop_get_mnt_by_dev() to lib
  - Bug fixes
    - fixed offline snapshot creation
    - fixed race between register/unregister_ploop_dev()
    - create image: if fallocate is not supported, fail
    - ploop init, ploop mount: fix -b option value validation
    - ploop mount: fix usage, -d is optional
    - ploop info: fix usage, DiskDescriptor.xml is required
    - ploop.spec: make main package require -lib of the same version
    - fixed a few ioctl-related error messages
    - ploop_create_snapshot(): check for number of snapshots limit (127)
    - ploop.spec: do not own _libdir
    - fix SYSEXIT_PARAM value
    - tools/ploop.c: do not use ploop_err()
    - tools: fixed/improved usage for many commands
    - tools: do not forget to print newlines
    - make install: use /usr/lib64 LIBDIR for x86_64
    - ploop_create_image(): free disk descriptor if fstype is NULL
    - create_balloon_file(): fix file name in error message
    - create_balloon_file(): umount and remove temp mnt point
    - create_balloon_file(): fix error message and return code
    - parse_xml(): add Blocksize validation
  - Improvements and cleanups
    - ploop lib: add visibility=hidden for internal functions
    - tools: use parse_size() and is_xml_name() where possible
    - remove merge_top_only param of get_delta_info()
    - ploop balloon: make it accept either -m or -d or both
    - ploop convert: change -t to -f
    - tools: unify parsing -f option
    - various code and headers cleanups
    - setver.sh: add -v, -b, -i


author: Kir Kolyshkin <kir@openvz.org> 1.4-1
changelog:
  - ploop copy: fix data loss during migration (#2287)
  - ploop(8): fixed according to doc team review
  - ploop mount: tell about unsupported underlying fs
  - ploop-copy: improve usage
  - ploop-copy -s: added mode to copy to local file
  - tools/ploop.c: do not return -1 from main()
  - tools/ploop.c: fix/unify working with diskdescriptor


author: Kir Kolyshkin <kir@openvz.org> 1.5-1
changelog:
  - NOTE: this version requires vzkernel >= 2.6.32-042stab061.1
  - New functionality:
  - * switch from old /dev/ploop/ symlink-based to new kernel cookie registration
  - * snapshots: switch to schema with constant top delta uuid
  - * use /proc/vz/ploop_minor based interface to get free minor
  - * if ploop is in maintenance state, try to complete it before doing
      snapshot/resize/merge/mount/umount/copy operation
  - * ploop mount: use in-kernel I/O module autodetection
  - * ploop balloon discard: new iterative compacting support
  - * ploop balloon discard: implement --stat
  - * ploop balloon discard: implement --automount
  - * ploop balloon discard: cancellation support
  - * ploop balloon: allow DiskDescriptor.xml argument
  - * ploop umount: implement -c component_name
  - * ploop list: implement
  - * /sbin/mount.ploop: do load ploop modules
  - Bug fixes:
  - * do not crash on empty DiskDescriptor.xml (libxml2 workaround)
  - * ploop convert: fix converting from expanded to raw
  - * ploop copy: fixed check for opened fd
  - * ploop copy: do not leak opened fds
  - * ploop create: fix gpt partition creation to be 4096 aligned
  - * ploop create, resize: round up size to be cluster aligned
  - * tools: few exit code fixes
  - * multiple usage, log and error message fixes
  - Improvements:
  - * ploop mount: check that mount point is a directory
  - * ploop umount: reduce retry count from 60 to 6
  - * ploop umount: print lsof output in case of failed umount
  - * ploop create: for prealloc image, use ftruncate if fallocate not supported
  - * ploop create, resize: add check for correct block device size
  - * scripts: de-bash-ify
  - * assorted code refactoring, cleanups and nitpicks
  - Library API changes:
  - * add ploop_resolve_functions() to aid in dynamic library loading
  - * introduce optimized ploop_get_info_by_descr(), remove ploop_get_info()
  - * replace ploop_{alloc,read}_diskdescriptor() with ploop_read_disk_descr()
  - * remove ploop_getdevice()


author: Kir Kolyshkin <kir@openvz.org> 1.6-1
changelog:
  - New functionality:
  - * offline image shrink support
  - * tools: added snapshot-list functionality
  - * extend switch snapshot functionality: ploop_switch_snapshot_ex()
  - * ploop.spec: disable udev iosched config for ploop devices
  - * ploop list: added functionality to list mount points
  - Bug fixes:
  - * ploop_mount_fs(): use mount_data for first mount
  - * ploop_mount(): do not allow to use ploop on fs w/o extents
  - * ploop_{create,resize}_image(): fixed size checks and rounding
  - * ploop_create_image(): fix memory leak on error path
  - * ploop_get_info(): fix reported disk size after switching snapshot
  - * ploop_get_info(): fix when ploop device is not mounted
  - * ploop_{umount,resize}_image() and many others: do not return -1
  - Improvements:
  - * much faster resize when using resize2fs with EXT4_IOC_RESIZE_FS support
  - * ploop discard: add cancellation support
  - * ploop_resize_image(): use real blocksize
  - * parse_xml(): deny processing DiskDescriptor.xml with several <Storage>
  - * do not auto-generate dynload.h, instead check if it's uptodate
  - * create_image(): display error message for incorrect parameters case
  - * introduce/use SYSEXIT_DEV_NOT_MOUNTED and SYSEXIT_FSCK errors
  - * alloc_diskdescriptor(): log error if calloc() fails
  - * ploop.spec: require util-linux, e2fsprogs etc.
  - * ploop.spec: require libs of the proper arch


author: Kir Kolyshkin <kir@openvz.org> 1.7-1
changelog:
  - New functionality:
  -- Large ploop image format support
  --- Now image size limit is 64 TB (was 2TB)
  --- Kernel >= 042stab078 is required
  -- Move ploop_grow* functions from tools to lib
  -- ploop grow: add DiskDescriptor.xml support
  -- ploop init, ploop_create_image(): add FS blocksize parameter
  - Improvements:
  -- make_fs(): create ext4fs with lazy_itable_init
  --- 3x smaller size and 3x faster creation time for 20GB image
  -- lib/ploop.h: "unexport" some internal functions
  -- Use /proc/self/mountinfo to get mount point by device
  -- More clear errors on parsing DiskDescriptor.xml
  -- print_output(): generalize print_lsof(), improve
  -- add_delta(): print more diags if EBUSY
  -- extend_delta_array(): print errors, return SYSEXIT_*
  -- run_prg(): print error if execvp() failed
  -- lib/balloon.c: print file name in an error message
  -- Introduce and use p_memalign(), fix errno handling
  -- Improvements and fixes to ploop_grow_*() to be used from library
  -- ploop_read_disk_descr(): set *di to NULL in case of error
  -- ploop_find_dev(): always assume ploop cookie is supported
  -- resize_fs(): try harder to find resize2fs binary
  -- Makefile.inc: ability to add CFLAGS
  - Fixes:
  -- lib/lock.c: create_file(): make sure dir exists (#2493, #2597)
  -- lib/fsutils.c: use ploop_execvp, drop absolute paths to binaries (#2595)
  -- ploop_log(): fix loglevel checking for file logging
  -- ploop_snapshot_switch_param: guids are const
  -- Recreate ploopXpY devices on ploop mount
  -- ploop_find_dev(): treat ENODEV as ENOENT on /sys reads
  -- use basename() to strip device from path
  -- ploop list: check for extra arguments
  -- ploop balloon: fix -f option processing
  -- Fixed lots of memory leaks, mostly on error paths
  -- open_delta(): simplify error handling
  -- Fixes for other issues big and small, reported by Coverity


author: Kir Kolyshkin <kir@openvz.org> 1.7.1-1
changelog:
  - Fixes:
  -- default image format is V1, unless specified explicitly
  -- tmpfiles.d file added for /var/lock/ploop (#2493)
  -- fixed creating strange directories under ./ (#2623)


author: Kir Kolyshkin <kir@openvz.org> 1.8-1
changelog:
  - New functionality:
  -- convert from/to v1/v2 ploop version format (ploop convert -v)
  -- ploop_mount_fs(): add option to run fsck
  -- ploop mount: add -F to run fsck for inner fs
  -- export ploop_is_large_disk_supported()
  -- add/export ploop_get_spec()
  -- ploop fsck: rename to ploop check
  - Fixes:
  -- resize_gpt_partition(): skip if there is no partition
  -- switch snapshot: read parameters from image we are to switch to
  -- ploop create: error out if DiskDescriptor.xml exists
  -- e2fsck(): properly check e2fsck binary exit code
  -- ploop grow: check size wrt format
  -- tools/Makefile: don't strip binaries on install
  -- ploop init: fix an error message
  - Improvements:
  -- create_image(): remove useless assignment
  -- number of log messages improved/fixed
  -- tools parse_size(): print error
  -- tools/ploop: allow T suffix for blockdev size
  -- ploop_grow_delta_offline(): use delta.version
  -- tune_fs(): drop absolute path to tune2fs
  - Documentation:
  -- ploop init usage: add -v VERSION
  -- ploop --help: rm -P from ploop mount syntax
  -- ploop(8): add -v for ploop init
  -- ploop(8): add ploop resize to SYNOPSYS
  -- ploop(8): add ploop convert
  -- ploop(8): add -F for ploop mount


author: Jeffrey Ness <jeffrey.ness@rackspace.com> - 2.7.6-2.ius
changelog:
  - Resolve issue with crypt module and undefined symbol
    https://bugs.launchpad.net/ius/+bug/1320912


author: Carl George <carl.george@rackspace.com> - 2.7.7-1.ius
changelog:
  - Latest upstream source
  - Correct upstream url
  - Move lib2to3/tests from python-libs to python-test
  - Fix bogus dates in changelog
  - Update Patch16, Patch112, Patch138, Patch147, Patch157, Patch173, Patch5000


author: Carl George <carl.george@rackspace.com> - 2.7.9-1.ius
changelog:
  - Latest upstream source
  - Refresh patches 55, 112, 146, 156
  - Readline is too old, skip test_readline (patch203)


author: Carl George <carl.george@rackspace.com> - 2.7.9-3.ius
changelog:
  - Build against bundled expat on el5
  - Build against stock expat on el6
  - Disable building against expat21, but leave it as an option


author: Carl George <carl.george@rackspace.com> - 2.7.10-1.ius
changelog:
  - Latest upstream
  - Remove _default_patch_fuzz to avoid patches being silently misapplied
  - Remove patch200 and patch201
  - Refresh patch1, patch6, patch111, patch112, patch130, patch136, patch137,
    patch142, patch147, patch153, patch156 (imported from Fedora)


author: Carl George <carl.george@rackspace.com> - 2.7.13-1.ius
changelog:
  - Latest upstream
  - Import patch102 from Fedora, and rebase it
  - Rebase patch146
  - (lib)db4-devel build requirement cleanup
  - Improve logic for exporting CC and LINKCC
  - Own systemtap dirs (rhbz#710733) (Fedora)
  - Remove patch203, fixed upstream
  - Skip test_sqlite on EL5


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-1
changelog:
  - 2.7.3: refresh patch 102 (lib64); drop upstream patches 11 (ascii-to-lower),
  115 (pydoc robustness), 145 (linux2), 148 (gdbm magic values), 151 (deadlock
  in fork); refresh patch 112 (debug build); revise patch 127
  (test_structmember); fix test_gdb (patch 153); refresh patch 137 (distutils
  tests); add python2.pc to python-devel; regenerate the autotool intermediates
  patch (patch 300)


author: David Malcolm <dmalcolm@redhat.com> - 2.7.3-4
changelog:
  - avoid allocating thunks in ctypes unless absolutely necessary, to avoid
  generating SELinux denials on "import ctypes" and "import uuid" when embedding
  Python within httpd (patch 155; rhbz#814391)


author: Carl George <carl.george@rackspace.com> - 1.0-1.ius
changelog:
  - Initial port from Fedora to IUS
  - Define and use python2_sitelib and python2_sitearch
  - Switch to using globals


author: Carl George <carl.george@rackspace.com> - 3.3.5-2.ius
changelog:
  - Update upstream url
  - Override __os_install_post to fix .pyc/pyo magic
  - Implement python packaging best practices


author: Carl George <carl.george@rackspace.com> - 4.5.1-1.ius
changelog:
  - Latest upstream
  - Switch to GitHub source via srcurl.net
  - Use configure/install flags from Fedora
  - Filter auto-provides


author: Ben Harper <ben.harper@rackspace.com> - 8.1.1-1.ius
changelog:
  - Upstream 8.1.1
  - update Source0 url to pypi.io see
    https://bitbucket.org/pypa/pypi/issues/438/backwards-compatible-un-hashed-package


author: Ben Harper <ben.harper@rackspace.com> - 20.10.1-1.ius
changelog:
  - updating to 20.10.1
  - update Source0 url to pypi.io see
    https://bitbucket.org/pypa/pypi/issues/438/backwards-compatible-un-hashed-package


author: Carl George <carl.george@rackspace.com> - 21.2.2-1.ius
changelog:
  - Latest upstream
  - Switch Source0 URL to upstream recommendation
  - License changed to MIT https://github.com/pypa/setuptools/commit/d0bd7a5


author: Carl George <carl.george@rackspace.com> - 0.23.0-1.ius
changelog:
  - Initial port to IUS
  - Remove patches (merged upstream)
  - Implement python packaging best practicies
  - Disable test suite


author: Carl George <carl.george@rackspace.com> - 0.24.0-1.ius
changelog:
  - Latest upstream
  - Remove egg2wheel and wininst2wheel scripts since they are no longer installed by default


author: David Malcolm <dmalcolm@redhat.com> - 3.3.0-0.1.b1
changelog:
  * Fri Jun 22 2012 David Malcolm <dmalcolm@redhat.com> - 3.2.3-10
  - use macro for power64 (rhbz#834653)


author: David Malcolm <dmalcolm@redhat.com> - 3.3.0-0.1.b1
changelog:
  - 3.2 -> 3.3: https://fedoraproject.org/wiki/Features/Python_3.3
  - 3.3.0b1: refresh patches 3, 55, 102, 111, 113, 114, 134, 157; drop upstream
  patch 147; regenenerate autotools patch; drop "--with-wide-unicode" from
  configure (PEP 393); "plat-linux2" -> "plat-linux" (upstream issue 12326);
  "bz2" -> "_bz2" and "crypt" -> "_crypt"; egg-info files are no longer shipped
  for stdlib (upstream issues 10645 and 12218); email/test moved to
  test/test_email; add /usr/bin/pyvenv[-3.3] and venv module (PEP 405); add
  _decimal and _lzma modules; make collections modules explicit in payload again
  (upstream issue 11085); add _testbuffer module to tests subpackage (added in
  upstream commit 3f9b3b6f7ff0); fix test failures (patches 160 and 161);
  workaround erroneously shared _sysconfigdata.py upstream issue #14774; fix
  distutils.sysconfig traceback (patch 162); add BuildRequires: xz-devel (for
  _lzma module); skip some tests within test_socket (patch 163)


author: David Malcolm <dmalcolm@redhat.com> - 3.3.0-0.3.b2
changelog:
  - 3.3b1 -> 3.3b2; drop upstreamed patch 152; refresh patches 3, 102, 111,
  134, 153, 160; regenenerate autotools patch; rework systemtap patch to work
  correctly when LANG=C (patch 55); importlib.test was moved to
  test.test_importlib upstream


author: Ben Harper <ben.harper@rackspace.com> - 20.10.1-1.ius
changelog:
  - updating to 20.10.1
  - update Source0 url to pypi.io see
    https://bitbucket.org/pypa/pypi/issues/438/backwards-compatible-un-hashed-package
  - remove CHANGES.txt and README.txt in docs as they are no longer included


author: Thomas Spura <tomspur@fedoraproject.org> - 3.4.3-4
changelog:
  - python3-devel: Require python-macros for version independant macros such as
    python_provide. See fpc#281 and fpc#534.


author: Carl George <carl.george@rackspace.com> - 3.5.0-2.ius
changelog:
  - Port from Fedora to IUS
  - Allow altinstall via main_python3 macro (borrowed from EPEL)
  - Use correct paths to brp-* files in __os_install_post macro
  - Use correct macros directory with _macrosdir
  - Disable Patch199 with sslv3 macro
  - Relax expat requirement, and make using system expat optional
  - Include bundled wheels when not using rewheel
  - Remove dependency on python-macros
  - Modify macros to be specific to python35u
  - Move libpython* files from -devel to -libs
  - Enable test suite
  - Skip test_ensurepip and test_venv when building with rewheel
  - Skip test_readline when el < 7
  - Add patch to skip new finalization tests
  - Disable rewheel


author: Carl George <carl.george@rackspace.com> - 3.5.1-2.ius
changelog:
  - Remove COUNT_ALLOCS and autotooling patches per rhbz#1291325 (Fedora)
  - Drop patch199 (merged upstream)


author: Carl George <carl.george@rackspace.com> - 3.5.3-1.ius
changelog:
  - Latest upstream
  - Rebase patch55, patch146, patch180
  - Remove patch184, patch203, patch400 (resolved upstream)
  - Revert to wheels included in main tarball


author: Carl George <carl.george@rackspace.com> - 3.6.0-1.ius
changelog:
  - Latest upstream
  - Remove subpackage structure
  - Use python35u names and macros
  - Conditionalize cssselect requirement
  - Conditionalize Cython requirement
  - Conditionalize test suite, only run on EL7+
  - Remove Source1


author: Ben Harper <ben.harper@rackspace.com> - 3.7.2-1.ius
changelog:
  - Latest upstream
  - Add Patch0 to disable some tests that started failing in 3.7.2 see:
    https://bugs.launchpad.net/lxml/+bug/1655054


author: Carl George <carl.george@rackspace.com> - 7.1.2-1.ius
changelog:
  - Initial import from Fedora
  - Remove subpackage structure and related things
  - Use python35u names and macros
  - Remove pip and pip3 to allow parallel installs
  - Latest upstream


author: Carl George <carl.george@rackspace.com> - 20.2.2-2.ius
changelog:
  - Latest upstream
  - License changed to MIT
  - Drop unused patches
  - Remove wheel support
  - Strip shebangs
  - Remove unneeded files
  - Include CHANGES.txt and README.txt in docs
  - Run correct version of py.test in %check


author: Charalampos Stratakis <cstratak@redhat.com> - 3.5.2-6
changelog:
  - Use proper patch numbering and base upstream branch for
  porting ssl and hashlib modules to OpenSSL 1.1.0
  - Drop hashlib patch for now
  - Add riscv64 arch to 64bit and no-valgrind arches


author: Carl George <carl.george@rackspace.com> - 3.6.0-1.ius
changelog:
  - Port from Fedora to IUS
  - Remove rewheel
  - Undo https://fedoraproject.org/wiki/Changes/System_Python
  - Import altinstall changes from EPEL's python34
  - Cleanup libpython* files
  - Add macros to optionally include the latest wheels of setuptools and pip
  - Set minimum sqlite version
  - Patch186 merged upstream


author: Carl George <carl.george@rackspace.com> - 3.6.0-2.ius
changelog:
  - Don't blow up on EL7 kernel (random generator) (rhbz#1410175) (Fedora)
  - Define HAVE_LONG_LONG as 1 for backwards compatibility (Fedora)
  - Fix error check, so that Random.seed actually uses OS randomness (rhbz#1412275) (Fedora)


author: Carl George <carl.george@rackspace.com> - 3.6.1-1.ius
changelog:
  - Latest upstream
  - Add --executable option to install.py command (Fedora)
  - Fix syntax error in %py_byte_compile macro (rhbz#1433569) (Fedora)
  - Skip test_aead_aes_gcm during rpmbuild (Fedora)


author: Carl George <carl.george@rackspace.com> - 3.6.1-2.ius
changelog:
  - EL6 support
  - Remove minimum sqlite version (pybt#10740 and pybt#29098)
  - Require correct version of expat{,-devel}
  - Install the Makefile in its proper location (rhbz#1438219) (Fedora)
  - Skip tan0064 in test_math and test_cmath on 32bit


author: Carl George <carl.george@rackspace.com> - 3.6.2-1.ius
changelog:
  - Latest upstream
  - Rebase patch180
  - Remove patch249, resolved upstream pybt#28787
  - Remove patch258, resolved upstream pybt#29324


author: Carl George <carl@george.computer> - 3.6.3-1.ius
changelog:
  - Latest upstream
  - Skip test_bdist_rpm using test config rather than a patch (removes patch 137) (Fedora)
  - Add patch277 to fix two hanging tests from test_subprocess (Fedora)
  - Fix memory corruption due to allocator mix rhbz#1498207 (Fedora)
  - Use a larger stack size on EL6
  - Conditionalize systemtap-devel BuildRequires (Fedora)
  - Drop patches 157 and 188
  - Merge lib64 patches (104 into 102) (Fedora)
  - Merge patches 180, 206, 243, 5001 (architecture naming) into new patch 274 (Fedora)
  - Run autotools to generate the configure script before building (Fedora)
  - Use bundled expat on EL6
  - Move windows executables to the devel subpackage (rhbz#1426257) (Fedora)
  - Drop patch252, as it was deemed unnecessary and could possibly collide with `pip --editable` option (Fedora)
  - Use autoconf268 on EL6


author: Carl George <carl@george.computer> - 3.6.5-1.ius
changelog:
  - Latest upstream
  - Fix deprecation warning on using imp in check-pyc-and-pyo-timestamps.py (Fedora)
  - Skip test_zlib on el6


author: Tomas Orsava <torsava@redhat.com> - 8.1.2-1
changelog:
  - Update to 8.1.2
  - Moved to a new PyPI URL format
  - Updated the prefix-stripping patch because of upstream changes in pip/wheel.py


author: Tomas Orsava <torsava@redhat.com> - 9.0.1-4
changelog:
  - Provide symlinks to executables to comply with Fedora guidelines for Python
  Resolves: rhbz#1406922


author: Rex Dieter <rdieter@fedoraproject.org> 4.7.1-10
changelog:
  - -config subpkg
  - qt-x11 pulls in phonon (#672088)
  - qtconfig.desktop: drop NoDisplay (f15+ only, for now)


author: Rex Dieter <rdieter@fedoraproject.org> 1:4.7.1-15
changelog:
  - -assistant subpkg (#660287)
  - -config drop Obsoletes: qt-x11 (avoid/workaround #674326)
  - -config unconditionally drop NoDisplay (since we're dropping the Obsoletes too)
  - -designer-plugin-phonon subpkg (#672088)


author: Axel Thimm <Axel.Thimm@ATrpms.net> - 1:4.7.1-3_15
changelog:
  - Allow the compatibility package to provide more dependencies.
  - Obsolete qt44.
  - Allow better positioning in ld.so search.


author: Silas Sewell <silas@sewell.ch> - 1.2.6-3
changelog:
  - Add Fedora build flags
  - Send all scriplet output to /dev/null
  - Remove debugging flags
  - Add redis.conf check to init script


author: Remi Collet <remi@fedoraproject.org> - 3.0.0-2
changelog:
  - rebuild with new redis-shutdown from rawhide
  - improved description from rawhide
  - use redis/redis owner for directories under /var


author: Remi Collet <remi@fedoraproject.org> - 3.0.1-1
changelog:
  - Redis 3.0.1 - Release date: 5 May 2015
  - Upgrade urgency: LOW for Redis and Cluster, MODERATE for Sentinel.


author: Remi Collet <remi@fedoraproject.org> - 3.0.2-1
changelog:
  - Redis 3.0.2 - Release date: 4 Jun 2015
  - Upgrade urgency: HIGH for Redis because of a security issue.
                     LOW for Sentinel.


author: Remi Collet <remi@fedoraproject.org> - 3.2.1-1
changelog:
  - Redis 3.2.1 - Release date: Fri Jun 17 15:01:56 CEST 2016
  - Upgrade urgency HIGH: Critical fix to Redis Sentinel,
    due to 3.2.0 regression compared to 3.0.


author: Remi Collet <remi@fedoraproject.org> - 3.2.2-1
changelog:
  - Redis 3.2.2 - Release date: Thu Jul 28 14:14:54 CEST 2016
  - Upgrade urgency MODERATE:
    A Redis server and a Sentinel crash are now fixed.
    GEORADIUS errors in reported entries are fixed.


author: Remi Collet <remi@fedoraproject.org> - 3.2.3-1
changelog:
  - Redis 3.2.3 - Release date: Tue Aug 02 10:55:24 CEST 2016
  - Upgrade urgency MODERATE: Fix replication delay and redis-cli
    security issue.


author: Remi Collet <remi@fedoraproject.org> - 3.2.3-2
changelog:
  - add man pages from https://github.com/antirez/redis/pull/3491
  - data and configuration should not be publicly readable
  - remove /var/run/redis with systemd
  - provide redis-check-rdb as a symlink to redis-server


author: Remi Collet <remi@fedoraproject.org> - 3.2.4-1
changelog:
  - Redis 3.2.4 - Released Mon Sep 26 08:58:21 CEST 2016
  - Upgrade urgency CRITICAL: Redis 3.2 and unstable contained
    a security vulnerability fixed by this release.


author: Remi Collet <remi@fedoraproject.org> - 3.2.5-1
changelog:
  - Redis 3.2.5 - Released Wed Oct 26 09:16:40 CEST 2016
  - Upgrade urgency LOW: This release only fixes a compilation issue


author: Remi Collet <remi@fedoraproject.org> - 3.2.7-1
changelog:
  - Redis 3.2.7 - Released Tue Jan 31 16:21:41 CET 2017
  - Upgrade urgency HIGH: This release fixes important security and
    correctness issues.


author: Remi Collet <remi@fedoraproject.org> - 3.2.8-1
changelog:
  - Redis 3.2.8 - Released Sun Feb 12 16:11:18 CET 2017
  - Upgrade urgency CRITICAL: This release reverts back the Jemalloc upgrade
    that is believed to potentially cause a server deadlock. A MIGRATE crash
    is also fixed.


author: Remi Collet <remi@remirepo.net> - 3.2.9-1
changelog:
  - Redis 3.2.9 - Released Mon May 17 17:35:38 CEST 2017
  - Upgrade urgency LOW: A few rarely harmful bugs were fixed.


author: Remi Collet <remi@remirepo.net> - 4.0.0-0.4.RC3
changelog:
  - rebuild with some fedora changes:
   - Add RuntimeDirectory=redis to systemd unit file (RHBZ #1454700)
   - Fix a shutdown failure with Unix domain sockets (RHBZ #1444988)


author: Remi Collet <remi@remirepo.net> - 4.0.1-1
changelog:
  - Redis 4.0.1 - Released Mon Jul 24 15:51:31 CEST 2017
  - Upgrade urgency MODERATE: A few serious but non critical bugs


author: Remi Collet <remi@remirepo.net> - 4.0.2-3
changelog:
  - add doc and devel subpackages, synced from Fedora
  - keep man pages in main package
  - minor fix for EL-6 and tests


author: Remi Collet <remi@remirepo.net> - 4.0.3-1
changelog:
  - Redis 4.0.3 - Released Thu Nov 30 13:14:50 CET 2017
  - Upgrade urgency CRITICAL: Several PSYNC2 bugs can corrupt the
    slave data set after a restart and a successful PSYNC2 handshake.
  - drop duplicated documentation from main package


author: Nathan Scott <nathans@redhat.com> - 4.0.4-1
changelog:
  - Upstream 4.0.4 release.
  - Update to current upstream redis-doc also.
  - Fix man page issues (RHBZ #1513594 and RHBZ #1515417).


author: Remi Collet <remi@remirepo.net> - 4.0.5-1
changelog:
  - Redis 4.0.5 - Released Thu Dec 1 16:03:32 CET 2017
  - Upgrade urgency CRITICAL: Redis 4.0.4 fix for PSYNC2 was broken,
    causing the slave to crash when receiving an RDB file from the
    master that contained a duplicated Lua script.


author: Remi Collet <remi@remirepo.net> - 4.0.6-1
changelog:
  - Redis 4.0.6 - Released Thu Dec 4 17:54:10 CET 2017
  - Upgrade urgency CRITICAL: More errors in the fixes for PSYNC2
    in Redis 4.0.5 were identified.


author: Remi Collet <remi@remirepo.net> - 4.0.7-1
changelog:
  - Redis 4.0.7 - Released Wed Jan 24 11:01:40 CET 2018
  - Upgrade urgency MODERATE: Several bugs fixed, but none of critical level.
  - Update to current upstream redis-doc


author: Remi Collet <remi@remirepo.net> - 4.0.8-1
changelog:
  - Update to 4.0.8 - Released Fri Feb 2 11:17:40 CET 2018
  - Upgrade urgency CRITICAL ONLY for Redis Cluster users.


author: Remi Collet <remi@remirepo.net> - 4.0.9-1
changelog:
  - Update to 4.0.9 - Released Mon Mar 26 17:52:32 CEST 2018
  - Upgrade urgency CRITICAL: Critical upgrade for users
    using AOF with the fsync policy set to "always".


author: Remi Collet <remi@remirepo.net> - 4.0.10-1
changelog:
  - Update to 4.0.10 - Released Wed Jun 13 12:49:13 CEST 2018
  - Upgrade urgency CRITICAL: This release fixes important security issues.
                        HIGH: This release fixes a SCAN commands family bug.
                    MODERATE: This release fixes a PSYNC2 edge case with expires.
                    MODERATE: Sentinel related fixes.
                         LOW: All the other issues


author: Remi Collet <remi@remirepo.net> - 4.0.2-1
changelog:
  - Redis 4.0.2 - Released Thu Sep 21 15:47:53 CEST 2017
  - Upgrade urgency HIGH: Several potentially critical bugs fixed.


author: Remi Collet <remi@remirepo.net> - 5.0.0~RC2-1
changelog:
  - Redis 5.0 RC2 (4.9.102) - Released Wed Jun 13 12:49:13 CEST 2018
  - Upgrade urgency CRITICAL: This release fixes important security issues.
                        HIGH: This release fixes a SCAN commands family bug.
                    MODERATE: This release fixes a PSYNC2 edge case with expires.
                    MODERATE: Sentinel related fixes.
                         LOW: All the other issues


author: Remi Collet <remi@remirepo.net> - 5.0.0~RC4-1
changelog:
  - Redis 5.0 RC4 (4.9.104) - Released Fri Aug 03 13:51:02 CEST 2018
  - Drop the pandoc build dependency, install only markdown.


author: Remi Collet <remi@remirepo.net> - 5.0.0-1
changelog:
  - Redis 5.0.0 - Released Wed Oct 17 13:28:26 CEST 2018
  - Upgrade urgency CRITICAL: Several fixes to streams AOF and replication.
  - Update to current upstream redis-doc


author: Remi Collet <remi@remirepo.net> - 5.0.1-1
changelog:
  - Redis 5.0.1 - Released Wed Nov 07 13:09:30 CET 2018
  - Upgrade urgency: URGENT if you use Redis Streams. MODERATE otherwise.


author: Remi Collet <remi@remirepo.net> - 5.0.2-1
changelog:
  - Redis 5.0.2 - Released Thu Nov 22 11:22:37 CET 2018
  - Upgrade urgency: CRITICAL if you use streams and consumer groups.
    HIGH if you use redis-cli with Redis Cluster. LOW otherwise.


author: Remi Collet <remi@remirepo.net> - 5.0.3-1
changelog:
  - Redis 5.0.3 - Released Tue Dec 11 18:17:26 CET 2018
  - Upgrade urgency HIGH: Redis 5 is consolidating, upgrading is a good idea.


author: Remi Collet <remi@remirepo.net> - 5.0.5-1
changelog:
  - Redis 5.0.5 - Released Wed May 15 17:57:41 CEST 2019
  - Upgrade urgency CRITICAL: This release fixes an important AOF
    fysnc bug and other less critical issues.
  - drop redis-trib sub-package now in redis-cli (F30, EL8)


author: Remi Collet <remi@remirepo.net> - 5.0.6-1
changelog:
  - Redis 5.0.6 - Released Wed Sep 25 12:33:56 CEST 2019
  - Upgrade urgency CRITICAL: Only in case of exposed instances
    to untrusted users.


author: Remi Collet <remi@remirepo.net> - 5.0.7-1
changelog:
  - Redis 5.0.7 - Released Tue Nov 19 17:52:44 CET 2019
  - Upgrade urgency HIGH: many issues fixed, some may have an impact.


author: Remi Collet <remi@remirepo.net> - 6.0.0-1
changelog:
  - Redis 6.0.0 GA - Released Thu Apr 30 14:55:02 CEST 2020
  - Upgrade urgency CRITICAL: many bugs fixed compared to the last RC


author: Remi Collet <remi@remirepo.net> - 6.0.1-1
changelog:
  - Redis 6.0.1 - Released Sat May 02 00:06:07 CEST 2020
  - Upgrade urgency HIGH:
    This release fixes a crash when builiding against Libc malloc.


author: Remi Collet <remi@remirepo.net> - 6.0.2-1
changelog:
  - Redis 6.0.2 - Released Fri May 15 22:24:36 CEST 2020
  - Upgrade urgency MODERATE: many not critical bugfixes in different areas.
    Critical fix to client side caching when keys are evicted from the
    tracking table but no notifications are sent.


author: Remi Collet <remi@remirepo.net> - 6.0.3-1
changelog:
  - Redis 6.0.3 - Released Sat May 16 18:10:21 CEST 2020
  - Upgrade urgency CRITICAL: a crash introduced in 6.0.2 is now fixed.


author: Remi Collet <remi@remirepo.net> - 6.0.3-3
changelog:
  - add comment for TimeoutStartSec and TimeoutStopSec in limit.conf
  - fix missing notification to systemd for sentinel
    patch from https://github.com/antirez/redis/pull/7168


author: Remi Collet <remi@remirepo.net> - 6.0.4-2
changelog:
  - Redis 6.0.4 - Released Thu May 28 11:36:45 CEST 2020
  - Upgrade urgency CRITICAL: this release fixes a severe replication bug.


author: Remi Collet <remi@remirepo.net> - 6.0.5-1
changelog:
  - Redis 6.0.5 - Released Tue Jun 09 11:56:08 CEST 2020
  - Upgrade urgency MODERATE: several bugs with moderate impact are fixed here.


author: Remi Collet <remi@remirepo.net> - 6.0.6-1
changelog:
  - Redis 6.0.6 - Released Mon Jul 20 09:31:30 IDT 2020
  - Upgrade urgency MODERATE: several bugs with moderate impact are fixed here.
  - open https://github.com/redis/redis/pull/7543 fix deprecated tail syntax


author: Remi Collet <remi@remirepo.net> - 6.0.7-1
changelog:
  - Redis 6.0.7 - Released Fri Aug 28 11:05:09 IDT 2020
  - Upgrade urgency MODERATE: several bugs with moderate impact are fixed.
  - drop patch merged upstream


author: Remi Collet <remi@remirepo.net> - 6.0.8-1
changelog:
  - Redis 6.0.8 - Released Wed Sep 09 23:34:17 IDT 2020
  - Upgrade urgency HIGH: Anyone who's using Redis 6.0.7 with Sentinel or
    CONFIG REWRITE command is affected and should upgrade ASAP.


author: Adam Vollrath <adam@endpoint.com>
changelog:
  - Refactored to use Phusion's installer instead of building from source
  - Changed prefix to just /usr/local
  - Added check for existing /usr/local/bin/ruby
  - Split rubygems into a subpackage


author: Alan Sundell <alan@sundell.net> 0.13-1
changelog:
  - new upstream source (see ChangeLog)
      adds --hostname, --no-sync, --libexec-dir options
      exports root, stage, hostname, verbose to script
          environment
      minor fixes for bugs introduced in 0.12.2


author: Alan Sundell <alan@sundell.net> 0.13.1-1
changelog:
  - New upstream source (see ChangeLog).
      adds unit tests
      slack-runscript mentions when it skips a non-executable script
          when --verbose is on
      fix bug causing undefined subroutine reference when a backend failed


author: Alan Sundell <alan@sundell.net> 0.15.0-1
changelog:
  - New upstream source (see ChangeLog).
      three new options:
        --sleep SECS  (random sleep for crontabs)
        --rsh COMMAND (instead of default ssh; will replace :: syntax in future)
        --version     (print version)
      numerous packaging and installation fixes


author: Remi Collet <remi@remirepo.net> - 1.7-1
changelog:
  - initial package
  - open https://github.com/nginx/unit/pull/215 system crypto policy
  - open https://github.com/nginx/unit/pull/212 systemd improvments


author: Christian Krause <chkr@fedoraproject.org> - 0.5.3-13.svn457
changelog:
  - Use tmpfiles.d service to correctly handle /var/run/vpnc (#656719)
  - Update vpnc-script:
    - fix negative MTU (#693235)
    - use restorecon to relabel /dev/net and /var/run/vpnc (#731382)
  - Various minor spec file cleanup


author: Kir Kolyshkin <kir@openvz.org> - 4.6.1-1
changelog:
  - Fixes:
  -- vzctl set: require swap to be set for VSwap
  -- fill_vswap_ub(): fix a potential segfault
  -- ndsend: clear reserved2 field (#2804)
  -- vzubc: fix to work in old mawk (#2793)
  -- vzlist: fix bogus CTIDs in list (#2830)
  -- vzctl start: don't fail if VE_ROOT does not exist (#2807)


author: Kir Kolyshkin <kir@openvz.org> - 4.7-1
changelog:
  - New functionality and important changes:
  -- Disable conntrack for VE0 by default (#2755)
  -- vzctl set --diskspace: add --offline-resize (#2281)
  -- vzctl create: use ploop by default
  -- vzctl create, vzctl convert: honor diskinodes for ploop (#2898)
  -- vzctl create: add --diskinodes
  -- vzctl set: new option --netfilter to replace --iptables
  -- vzmigrate: support for copying CT dump file
  -- vzmigrate: introduce/use vzfsync for ploop (to shorten CT freeze time)
  -- bash-completion: CTIDs on ploop for compact
  -- vzctl create: honor MOUNT_OPTS
  -- vzctl console: add set_console dist script (#2865)
  -- vzctl snapshot-switch: add --skip_arpdetect option
  -- vzctl snapshot-switch: add --skip-resume, --skip-config
  -- vzctl set --diskinodes, DISKINODES: allow suffixes (KMG)
  -- vzpid: new option "-p" to show in-container PID(s)
  -- etc/vz.conf: add SKIP_ARPDETECT example
  -- etc/vz.conf: use ploop by default
  -- etc/vz.conf: use vswap config by default
  -- etc/vz.conf: merge IP6TABLES to IPTABLES_MODULES
  - Fixes:
  -- vzctl destroy: fix locking (#2814)
  -- debian-add_ip.sh: setup loopback device at least (#2859)
  -- vzctl start --wait: fix for non-standard Debian 7
  -- postcreate.sh: add Fedora 20+
  -- postcreate.sh: set file caps for suse 13.1+
  -- vzmigrate: fix ploop for diff VE_PRIVATE case (#2875)
  -- vzmigrate: hide ploop getdev output
  -- vzctl status, snapshot-list: don't mess with stdout even when verbose
  -- vzlist: don't spoil output with ploop messages
  -- logger.c: fix wrt ploop logging
  -- etc/network/if-up.d/vzifup-post: fix for Debian Wheezy (#2914)
  -- hooks_ct.c: bind-mount root to itself (fix for kernel v3.11+)
  -- hooks_ct: mount /proc and /sys before umounting old root
  -- bash_completion: replace exit with return
  -- bash_completion.d: add --quiet to vzctl
  -- vzmigrate: call vzctl status with --quiet
  -- vzcptcheck: fix program name in usage
  - Improvements:
  -- add_reach_runlevel_mark(): improve error messages
  -- set(): don't ignore fail from fill_vswap_ub()
  -- vzctl restore: warn in CPT_SET_LOCKFD2 not supported
  -- config.c: add SKIP_ARPDETECT to ignored list
  -- vzmigrate: lock CT locally
  -- vzmigrate --live: check for running CT earlier
  -- destroy_dump(): don't log "Removing" if no dump
  -- etc/conf/*sample: tune DISKINODES for ploop diskspace/diskinodes ratio
  -- etc/conf/ve-unlimited.conf-sample: remove
  -- hooks_ct: remove non-working devpts mount
  -- hooks_ct: mount devtmpfs in CT
  -- ct_chroot(): do not change a set of CT0's mounts
  -- parse_netif_str(): improve NETIF= param parsing
  -- setup_hardlink_dir(): show error if mkdir() failed
  - Documentation:
  -- vzctl(8): document MAX_VEID (#2784)
  -- vzctl --help: fix convert synopsys
  - Build system:
  -- setver.sh: rework buildid
  -- setver.sh: make it work on fresh git source
  -- autogen.sh, setver.sh: fix build from screwed git repo
  -- vzctl.spec: require bridge-utils (as we use brctl)


author: Kir Kolyshkin <kir@openvz.org> - 4.7.2-1
changelog:
  - vzlist: don't complain about missing ploop-lib (#2952)
  - setup_console: don't execute on older kernels (#2961)
  - clean_hardlink_dir(): note unlink/rmdir errors
  - vzctl(8): fix a typo


author: Kir Kolyshkin <kir@openvz.org> - 4.8-1
changelog:
  - New functionality and important changes:
  -- vzctl set: add NUMA --nodemask (sponsored by FastVPS)
  -- vzmigrate: speed up by using se ploop copy with feedback if available
  -- vzmigrate: speed up by reusing ssh connection
  -- init.d/vz: show CT stop status
  -- init.d/vz: implement parallel CT start (#2954, #2084)
  -- init.d/vz, vz.conf: use/expose VE_PARALLEL
  -- vzctl start,restore: add --skip-remount
  -- vzctl snapshot-switch: add --must-restore
  -- vzmigrate: ability to run ploop copy with timestamps
  - Fixes:
  -- vzctl.spec: disable VE0 conntracks only if unused (#2755)
  -- vzmigrate: fix for --snapshot (#2907)
  -- vzmigrate: don't run vzfsync if there is no need (#3055)
  -- vzmigrate: undo_lock if check_cpt_props failed
  -- vzmigrate: don't exit 1 on success
  -- vzlist: fix showing DISABLED (#3029)
  -- vzlist: fix cpulimit rounding (#3063)
  -- redhat-set_hostname.sh: fix for F15+/RHEL7 (#3051)
  -- vzctl compact: use built-in PATH (#2990)
  -- postcreate.sh: fix caps for suexec
  - Improvements:
  -- debian-add_ip.sh: support for Ubuntu 14.04
  -- postcreate.sh: add RHEL7/CentOS7 support
  -- vzctl create --diskinodes: check for max ploop size
  -- vzctl set --ostemplate: require --save (#2909)
  -- vzmigrate: don't specify default cipher
  -- vzmigrate: use getopt for option parsing
  -- vzmigrate: detect "can't lock CT" error
  -- vzmigrate: don't use rsync --delete-excluded
  -- cpumask: allow for up to 4096 CPUs
  -- vz_setcpu(): don't ignore errors from set_cpu*
  -- fixed a few memory leaks and non-closed fds reported by Coverity
  -- compare_osrelease(): fix for 3.x kernels
  -- parse_{chkpnt,restore}_opt: don't print error twice
  -- parse*opt(): add/improve extra args check
  -- vzctl create: improve "no ploop" error message
  - Documentation:
  -- vznnc(8): add
  -- vzctl --help: fix iolimit
  -- vzctl(8): document set --ostemplate (#2909)
  -- vzctl(8): add --nodemask, --must-restore, --skip-remount
  -- vzctl(8): improve --netfilter
  -- vz.conf(5): document VE_PARALLEL
  -- vzmigrate(8), vzmigrate --help: document --ssh-mux
  - Build system:
  -- setver.sh: check for ./configure to run autogen
  -- setver.sh: abort if autogen.sh/configure fails


author: Kir Kolyshkin <kir@openvz.org> - 4.9-1
changelog:
  - New functionality and important changes:
  -- vzmigrate: check CPU caps for suspended CT
  -- suse-{add,del}_ip.sh: support for IP mask
  -- vz.conf: allow list of interfaces in NEIGHBOUR_DEVS (#1289, #3192)
  -- Introduce funtoo-set_hostname (#3097)
  -- vz-postinstall: add a way to disable stock distro kernels from repos
  -- vzctl set --devnodes|--devices: made cumulative, fix
  -- vzctl set --devnodes: remove devices from CT
  -- vzctl start/resume: load kernel modules needed for CT
  -- vzctl create: disallow VE_PRIVATE be a mount point (#3166)
  -- vzevent: try to run a script for all known events
  -- vzctl restore|resume: add --skip-fsck
  - Fixes:
  -- redhat-add_ip.sh: support for Fedora 21 and RHEL/CentOS 7.1 (#3169)
  -- vzctl snapshot-delete: ignore ploop 'no guid found'
  -- suse-add_ip.sh: fix for venet routing in SUSE 13.2
  -- osrelease.conf: add suse 13.2
  -- vzctl chkpnt: workaround for ENOSPC
  -- ct_enter(): enter mnt namespace last (#3038)
  -- vzmigrate: fix for vzfsync if VE_PRIVATE differs (#3170)
  -- init.d/vz-gentoo: fix a typo
  -- vzctl.spec: fix iptables checking for RHEL5 (#2755)
  -- vzmigrate: use DUMPDIR for CT dump (#3054)
  -- vzmigrate: don't hardcode /vz/lock, use LOCKDIR (#2976)
  -- vzmigrate: use C locale (#3049)
  -- vzlist: fix cpuunits rounding (#3120)
  -- snapshot-switch --must-restore: fix restoring config
  -- fs_create: lock private
  -- vps_create: minor fixes to cleanup logic
  -- make_dir_mode(): ignore EEXIST from mkdir()
  -- vzlist -j: output valid JSON for no CTs
  -- init.d/vz-redhat: fix exit codes according to LSB (#3195)
  - Improvements:
  -- vzmigrate: random ports for ploop copy (#3052)
  -- vzctl start: close extra fds later (#3091)
  -- vzctl start: mkdir /proc in CT if needed (#3091)
  -- vzctl create: fix an error message
  -- vzctl.spec: require recent RHEL6 kernel (#3094)
  -- init.d/vz*: load pio_kaio
  -- suse-add_ip.sh: fix a warning
  -- suse-del_ip.sh: remove venet routes
  -- init.d/vz-redhat: fix a bashism (#3148)
  -- vzctl delete: do rm config/dump even if failed to rm VE_PRIVATE
  -- dists/scripts/{funtoo,gentoo}*: remove env var doc
  -- debian-add_ip.sh: silent an error
  -- vzeventd: ignore non-existent event scripts
  - Documentation:
  -- vzeventd(8): document new behavior
  -- vzcptcheck(8): describe caps check w/o CTID
  -- vz.conf(5): describe new NEIGHBOUR_DEV syntax


author: Kir Kolyshkin <kir@openvz.org> - 4.9.1-1
changelog:
  - create_hardlink_dir(): fix wrong owner/perms case (#3222)
  - vzctl.spec: drop the "Conflicts: vzkernel" (#3219)


author: Kir Kolyshkin <kir@openvz.org> - 4.9.2-1
changelog:
  - store_devnodes: fix NULL deref (#3228)
  - vps-create.sh: use stat -f instead of df
  - vzctl.spec: require attr package


author: Kir Kolyshkin <kir@openvz.org> - 4.9.3-1
changelog:
  - set_console.sh: ubuntu 15.04 systemd console support
  - vzoversell: handle unlimited RAM CTs
  - vzctl umount: fix exit code if CT is running
  - vz.conf, vps-net_add: add FORCE_ROUTE to change existing route to CT


author: Kir Kolyshkin <kir@openvz.org> - 4.10-1
changelog:
  - postcreate.sh: support for Debian 8/Ubuntu 15.04+ xattrs
  - vzctl create: add pigz support (if available)
  - vzlist: add netfilter, capability output fields
  - compilation fixes for Alpine Linux / musl libc
  - vzctl destroy: handle the semi-mounted ploop
  - vzubc: allow for more than 999%


author: Kir Kolyshkin <kir@openvz.org> - 4.5-1
changelog:
  - New functionality:
  -- vztmpl-dl: add --upload-all, --ignore-errors
  -- vztmpl-dl: add --list-remote, --list-local
  -- vztmpl-dl: do not check GPG signatures by default
  -- vztmpl-dl: add --gpg-check and --update options
  -- vz-postinstall: enable iptables for bridges (#2641)
  -- vz-postinstall: be verbose about what we do
  -- vzmigrate: support for VE_PRIVATE being a symlink (#2694)
  - Fixes:
  -- ndsend: fix option field in sending packets (#2709)
  -- libvzchown: link to -ldl (#2705)
  -- vps_create(): save LOCAL_UID/GID=0 if !userns for upstream CT
  -- vzctl.spec: run vz-postinstall on a fresh install only
  -- vz-postinstall: do not change rp_filter sysctl
  -- vzmigrate: remove a bashism
  -- vzctl create: fix running postcreate action wrt --ostemplate path/tmpl
  -- vzctl create: use proper version of basename()
  -- vzdaemon_stop(): don't return error if stopped already
  -- read_resolv_conf(): fix potential buffer overflow
  -- vzctl_env_switch_snapshot: fix leak on error path
  -- vzctl_env_convert_ploop(): check chmod return code
  - Improvements:
  -- veth: improve veth random MAC generation (#2695)
  -- vzctl start: always mount /dev/pts for upstream CT
  -- vzmigrate: add / to paths for rsync (#2686)
  -- load_ploop_lib(): load .so.1, try .so too (for ploop-1.9)
  -- scripts: use VPSCONFDIR instead of PKGCONFDIR/conf
  -- vzctl.spec: add /var/lib/vz as a symlink to /vz
  -- vzctl.spec: don't mark symlink as %dir
  -- vzctl.spec: remove a bunch of defines
  -- vzctl.spec: use /var/lib not /var/lib
  -- vzctl.spec: quote rpm macros
  -- vzctl.spec: remove extra slashes
  - Documentation:
  -- vztmpl-dl: improve usage
  -- vztmpl-dl(8): describe new options


author: Kir Kolyshkin <kir@openvz.org> - 4.5.1-1
changelog:
  - Fixes:
  -- Fix loading older (<1.9) ploop library (#2719)
  -- Fix installing rpm for people using /var/lib/vz (#2722)


author: Kir Kolyshkin <kir@openvz.org> - 4.6-1
changelog:
  - New functionality:
  -- Add iolimit and iopslimit (need kernel >= 042stab084.2)
  -- Add optional VM_OVERCOMMIT/--vm_overcommit parameter
  -- In VSwap mode, set some secondary UBCs if unset:
  --- lockedpages=oomguarpages=ram
  --- vmguarpages=ram+swap
  --- privvmpages=(ram+swap)*vm_overcommit (if set)
  -- vzoversell: add
  -- vztmpl-dl: add --list-orphans
  -- vztmpl-dl: add --quiet/--no-quiet
  -- vzubc: don't show unlimited ubcs by default; add -v to show
  -- vzlist: add new fields (vm_overcommit, iolimit, iopslimit)
  - Fixes:
  -- Fix quota on ploop for RHEL5 CT
  -- vzctl console: hack to force redraw on reattach
  -- set_ublimit(): don't set unknown UBs to unlim (#2760)
  -- init.d/vzeventd: set reboot_event (#2764)
  -- arch.conf: add POST_CREATE (#2371)
  -- configure: fix libdir for Debian/Ubuntu case
  -- ct_env_create_real(): fix build for IA64
  -- vzctl create, vzctl exec: do skip fsck
  -- init.d/vz-gentoo: fix setting default for NET_MODULES and PLOOP_MODULES
  -- init.d/vz-redhat: don't reset cpulimits for all CTs
  - Improvements:
  -- Add a way to not modify sysctl.conf on installation (#2375)
  -- vzctl set --reset_ub: only allow for running CT
  -- init.d/vzeventd-redhat: switch to strict bash
  -- vz-postinstall: don't add bridge params to sysctl.conf
  -- vzlist: skip mounted status check if not needed
  -- vzubc: print errors to stderr
  -- vzctl start: don't start CT if /proc mount failed
  -- vzevent-stop: check for suspend/chkpnt
  -- init.d/vz*: unset io limits before stopping CT
  -- [build] setver.sh: add build_id, use getopt
  -- assorted minor code improvements
  - Documentation:
  -- vzctl(8), ctid.conf(5): document vm_overcommit
  -- vzctl(8): fix per-CT action script prefix
  -- vz.conf(5): LOGFILE don't have a default
  -- man: don't hardcode configurable paths
  -- vzlist(8): fix a subsection reference
  -- vzlist(8): fix indentation


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.17.1.el6]
changelog:
  - [kernel] hrtimer: add force_hrtimer_reprogram kernel parameter (Prarit Bhargava) [1292082 1285142]
  - [mm] fix anon_vma->degree underflow in anon_vma endless growing prevention (Jerome Marchand) [1285693 1151823]
  - [mm] fix corner case in anon_vma endless growing prevention (Jerome Marchand) [1285693 1151823]
  - [mm] prevent endless growth of anon_vma hierarchy (Jerome Marchand) [1285693 1151823]
  - [mm] avoid anon_vma_chain allocation under anon_vma lock (Jerome Marchand) [1285693 1151823]
  - [mm] avoid repeated anon_vma lock/unlock sequences in unlink_anon_vmas() (Jerome Marchand) [1285693 1151823]
  - [mm] avoid repeated anon_vma lock/unlock sequences in anon_vma_clone() (Jerome Marchand) [1285693 1151823]
  - [scsi] only re-lock door after EH on devices that were reset (Ewan Milne) [1282464 995234]
  - [fs] fs: Unhash and evict unused children dentries after rmdir (Lukas Czerner) [1282621 1241030]
  - [fs] revert 'vfs: Unhash and evict unused children dentries after rmdir' (Carlos Maiolino) [1282621 1241030]
  - [netdrv] macvtap: fix network header pointer for VLAN tagged pkts (Ivan Vecera) [1280206 1213846]
  - [net] Fix vlan_get_protocol for stacked vlan (Ivan Vecera) [1280206 1213846]
  - [scsi] ipr: Fix incorrect trace indexing (Gustavo Duarte) [1280211 1209543]
  - [scsi] ipr: Fix invalid array indexing for HRRQ (Gustavo Duarte) [1280211 1209543]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-573.18.1.el6]
changelog:
  - [netdrv] bonding: "primary_reselect" with "failure" is not working properly (Jarod Wilson) [1295924 1290672]
  - [net] netpoll: Close race condition between poll_one_napi and napi_disable (Neil Horman) [1295370 1252212]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.20.1.el6]
changelog:
  - [sched] kernel: sched: Fix nohz load accounting -- again (Rafael Aquini) [1300349 1167755]
  - [sched] kernel: sched: Move sched_avg_update to update_cpu_load (Rafael Aquini) [1300349 1167755]
  - [sched] kernel: sched: Cure more NO_HZ load average woes (Rafael Aquini) [1300349 1167755]
  - [sched] kernel: sched: Cure load average vs NO_HZ woes (Rafael Aquini) [1300349 1167755]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.21.1.el6]
changelog:
  - [fs] pipe: fix offset and len mismatch on pipe_iov_copy_to_user failure (Seth Jennings) [1310148 1302223] {CVE-2016-0774}
  - [fs] gfs2: Add missing else in trans_add_meta/data (Robert S Peterson) [1304332 1267995]
  - [fs] fs-cache: Synchronise object death state change vs operation submission (David Howells) [1308471 1096893]
  - [fs] fs-cache: Reduce cookie ref count if submit fails (David Howells) [1308471 1096893]
  - [mm] memcg: oom_notify use-after-free fix (Rafael Aquini) [1302763 1294400]
  - [x86] fix corruption of XMM registers when interrupt handlers use FPU (Mikulas Patocka) [1298994 1259023]
  - [net] tcp: honour SO_BINDTODEVICE for TW_RST case too (Florian Westphal) [1303044 1292300]
  - [net] add inet_sk_transparent() helper (Florian Westphal) [1303044 1292300]
  - [net] ipv6: tcp_ipv6 policy route issue (Florian Westphal) [1303044 1292300]
  - [net] ipv6: reuse rt6_need_strict (Florian Westphal) [1303044 1292300]
  - [net] tcp: resets are misrouted (Florian Westphal) [1303044 1292300]
  - [net] tcp: tcp_v4_send_reset: binding oif to iif in no sock case (Florian Westphal) [1303044 1292300]
  - [crypto] api: Only abort operations on fatal signal (Herbert Xu) [1296014 1272314]
  - [crypto] testmgr: don't use interruptible wait in tests (Herbert Xu) [1296014 1272314]
  - [kernel] sched: add wait_for_completion_killable_timeout (Herbert Xu) [1296014 1272314]
  - [net] sctp: add routing output fallback (Xin Long) [1307073 1229124]
  - [net] sctp: fix dst leak (Xin Long) [1307073 1229124]
  - [net] sctp: fix src address selection if using secondary addresses (Xin Long) [1307073 1229124]
  - [net] sctp: reduce indent level on sctp_v4_get_dst (Xin Long) [1307073 1229124]
  - [scsi] hpsa: Update driver revision to RH5 (Joseph Szczypek) [1306192 1244959]
  - [scsi] hpsa: fix issues with multilun devices (Joseph Szczypek) [1306192 1244959]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.22.1.el6]
changelog:
  - [mm] always decrement anon_vma degree when the vma list is empty (Jerome Marchand) [1318364 1309898]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.23.1.el6]
changelog:
  - [x86] perf: Add more Broadwell model numbers (Jiri Olsa) [1320035 1242694]
  - [perf] perf/x86/intel: Remove incorrect model number from Haswell perf (Jiri Olsa) [1320035 1242694]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.24.1.el6]
changelog:
  - [sched] fix KABI break (Seth Jennings) [1314878 1230310]
  - [sched] fair: Test list head instead of list entry in throttle_cfs_rq (Seth Jennings) [1314878 1230310]
  - [sched] sched,perf: Fix periodic timers (Seth Jennings) [1314878 1230310]
  - [sched] sched: debug: Remove the cfs bandwidth timer_active printout (Seth Jennings) [1314878 1230310]
  - [sched] Cleanup bandwidth timers (Seth Jennings) [1314878 1230310]
  - [sched] sched: core: Use hrtimer_start_expires (Seth Jennings) [1314878 1230310]
  - [sched] fair: Fix unlocked reads of some cfs_b->quota/period (Seth Jennings) [1314878 1230310]
  - [sched] Fix potential near-infinite distribute_cfs_runtime loop (Seth Jennings) [1314878 1230310]
  - [sched] fair: Fix tg_set_cfs_bandwidth deadlock on rq->lock (Seth Jennings) [1314878 1230310]
  - [sched] Fix hrtimer_cancel/rq->lock deadlock (Seth Jennings) [1314878 1230310]
  - [sched] Fix cfs_bandwidth misuse of hrtimer_expires_remaining (Seth Jennings) [1314878 1230310]
  - [sched] Refine the code in unthrottle_cfs_rq (Seth Jennings) [1314878 1230310]
  - [sched] Update rq clock earlier in unthrottle_cfs_rq (Seth Jennings) [1314878 1230310]
  - [block] Fix q_suspended logic error for io submission (David Milburn) [1314209 1227342]
  - [block] nvme: No lock while DMA mapping data (David Milburn) [1314209 1227342]
  - [netdrv] ixgbe: finish ixgbe: Update ixgbe to use new vlan accleration (John Greene) [1315706 1249244]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.25.1.el6]
changelog:
  - [x86] nmi/64: Fix a paravirt stack-clobbering bug in the NMI code (Denys Vlasenko) [1259580 1259581] {CVE-2015-5157}
  - [x86] nmi/64: Switch stacks on userspace NMI entry (Denys Vlasenko) [1259580 1259581] {CVE-2015-5157}
  - [fs] anon_inodes implement dname (Aristeu Rozanski) [1322707 1296019]
  - [fs] xfs: Avoid pathological backwards allocation (Bill O'Donnell) [1320031 1302777]
  - [net] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event (Jacob Tanenbaum) [1297421 1297422] {CVE-2015-8767}
  - [net] udp: move logic out of udp[46]_ufo_send_check (Sabrina Dubroca) [1319276 1299975]
  - [net] af_unix: Guard against other == sk in unix_dgram_sendmsg (Jakub Sitnicki) [1315696 1309241]
  - [md] raid10: don't clear bitmap bit when bad-block-list write fails (Jes Sorensen) [1320863 1273546]
  - [md] raid1: don't clear bitmap bit when bad-block-list write fails (Jes Sorensen) [1320863 1273546]
  - [md] raid10: submit_bio_wait returns 0 on success (Jes Sorensen) [1320863 1273546]
  - [md] raid1: submit_bio_wait() returns 0 on success (Jes Sorensen) [1320863 1273546]
  - [md] crash in md-raid1 and md-raid10 due to incorrect list manipulation (Jes Sorensen) [1320863 1273546]
  - [md] raid10: ensure device failure recorded before write request returns (Jes Sorensen) [1320863 1273546]
  - [md] raid1: ensure device failure recorded before write request returns (Jes Sorensen) [1320863 1273546]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.26.1.el6]
changelog:
  - [kernel] revert "sched: core: Use hrtimer_start_expires" (Jiri Olsa) [1326043 1324318]
  - [kernel] Revert "Cleanup bandwidth timers" (Jiri Olsa) [1326043 1324318]
  - [kernel] revert "fair: Test list head instead of list entry in throttle_cfs_rq" (Jiri Olsa) [1326043 1324318]
  - [kernel] revert "sched, perf: Fix periodic timers" (Jiri Olsa) [1326043 1324318]
  - [kernel] Revert "fix KABI break" (Jiri Olsa) [1326043 1324318]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-633.el6]
changelog:
  - [s390] lib: export udelay_simple for systemtap (Hendrik Brueckner) [1233912]
  - [netdrv] ixgbe: fix RSS limit for X550 (John Greene) [1314583]
  - [netdrv] mlx4_core: Fix error message deprecation for ConnectX-2 cards (Don Dutile) [1316013]
  - [dm] thin metadata: don't issue prefetches if a transaction abort has failed (Mike Snitzer) [1310661]
  - [scsi] be2iscsi: Add warning message for unsupported adapter (Maurizio Lombardi) [1253016]
  - [scsi] be2iscsi: Revert "Add warning message for, unsupported adapter" (Maurizio Lombardi) [1253016]
  - [scsi] hpsa: update copyright information (Joseph Szczypek) [1315469]
  - [scsi] hpsa: correct abort tmf for hba devices (Joseph Szczypek) [1315469]
  - [scsi] hpsa: correct ioaccel2 sg chain len (Joseph Szczypek) [1315469]
  - [scsi] hpsa: fix physical target reset (Joseph Szczypek) [1315469]
  - [scsi] hpsa: fix hpsa_adjust_hpsa_scsi_table (Joseph Szczypek) [1315469]
  - [scsi] hpsa: correct transfer length for 6 byte read/write commands (Joseph Szczypek) [1315469]
  - [scsi] hpsa: abandon rescans on memory alloaction failures (Joseph Szczypek) [1315469]
  - [scsi] hpsa: allow driver requested rescans (Joseph Szczypek) [1315469]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-634.el6]
changelog:
  - [scsi] cxgbi: Convert over to dst_neigh_lookup (Sai Vemuri) [1296461]
  - [netdrv] cxgb4: For T4, don't read the Firmware Mailbox Control register (Sai Vemuri) [1296469]
  - [netdrv] cxgb4: Use ACCES_ONCE macro to read queue's consumer index (Sai Vemuri) [1296484]
  - [netdrv] cxgb4: prevent simultaneous execution of service_ofldq (Sai Vemuri) [1296483]
  - [netdrv] cxgb4: Adds PCI device id for new T5 adapters (Sai Vemuri) [1296481]
  - [netdrv] cxgb4: Don't disallow turning off auto-negotiation (Sai Vemuri) [1296476]
  - [mm] check if section present during memory block registering (Xunlei Pang) [1297840]
  - [tty] ldisc: Close/Reopen race prevention should check tty->ldisc (Denys Vlasenko) [1312383]
  - [fs] proc-vmcore: wrong data type casting fix (Baoquan He) [1312206]
  - [infiniband] iw_cxgb3: Ignore positive return values from the ofld send functions (Sai Vemuri) [1296999]
  - [netdrv] cxgb4: Deal with wrap-around of queue for Work request (Sai Vemuri) [1296482]
  - [infiniband] iw_cxgb4: detect fatal errors while creating listening filters (Sai Vemuri) [1296480]
  - [md] dm snapshot: suspend merging snapshot when doing exception handover (Mike Snitzer) [1177389]
  - [md] dm snapshot: suspend origin when doing exception handover (Mike Snitzer) [1177389]
  - [md] dm snapshot: allocate a per-target structure for snapshot-origin target (Mike Snitzer) [1177389]
  - [md] dm: fix a race condition in dm_get_md (Mike Snitzer) [1177389]
  - [infiniband] iw_cxgb4: pass the ord/ird in connect reply events (Sai Vemuri) [1296478]
  - [infiniband] iw_cxgb4: fix misuse of ep->ord for minimum ird calculation (Sai Vemuri) [1296478]
  - [infiniband] iw_cxgb4: reverse the ord/ird in the ESTABLISHED upcall (Sai Vemuri) [1296478]
  - [usb] Revert "Revert 'Update USB default wakeup settings'" (Torez Smith) [1319081]
  - [netdrv] ibmveth: add support for TSO6 (Gustavo Duarte) [1318412]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-635.el6]
changelog:
  - [mm] backing-dev: ensure wakeup_timer is deleted (Jeff Moyer) [1318930]
  - [hv] vss: run only on supported host versions (Vitaly Kuznetsov) [1319813]
  - [sound] hda: Fix internal speaker for HP Z240 (Jaroslav Kysela) [1316673]
  - [perf] trace: Fix race condition at the end of started workloads (Jiri Olsa) [1302928]
  - [fs] nfsd: Combine decode operations for v4 and v4.1 (J. Bruce Fields) [1314536]
  - [hv] revert "vmbus: avoid scheduling in interrupt context in vmbus_initiate_unload" (Vitaly Kuznetsov) [1318882]
  - [hv] revert "vmbus: don't loose HVMSG_TIMER_EXPIRED messages" (Vitaly Kuznetsov) [1318882]
  - [hv] revert "vmbus: avoid unneeded compiler optimizations in vmbus_wait_for_unload" (Vitaly Kuznetsov) [1318882]
  - [hv] revert "vmbus: remove code duplication in message handling" (Vitaly Kuznetsov) [1318882]
  - [hv] revert "vmbus: avoid wait_for_completion on crash" (Vitaly Kuznetsov) [1318882]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-636.el6]
changelog:
  - [netdrv] mlx4_en: Choose time-stamping shift value according to HW frequency (Kamal Heib) [1320448]
  - [fs] anon_inodes implement dname (Aristeu Rozanski) [1296019]
  - [net] packet: set transport header before doing xmit (John Greene) [1309526]
  - [net] tuntap: set transport header before passing it to kernel (John Greene) [1309526]
  - [netdrv] macvtap: set transport header before passing skb to lower device (John Greene) [1309526]
  - [net] ipv6: tcp: add rcu locking in tcp_v6_send_synack() (Jakub Sitnicki) [1312740]
  - [net] ipv6: sctp: add rcu protection around np->opt (Jakub Sitnicki) [1312740]
  - [net] ipv6: add complete rcu protection around np->opt (Jakub Sitnicki) [1312740]
  - [net] dccp: remove unnecessary codes in ipv6.c (Jakub Sitnicki) [1312740]
  - [net] ipv6: remove unnecessary codes in tcp_ipv6.c (Jakub Sitnicki) [1312740]
  - [net] ipv6: Refactor update of IPv6 flowi destination address for srcrt (RH) option (Jakub Sitnicki) [1312740]
  - [net] ipv6: protect flow label renew against GC (Sabrina Dubroca) [1313231]
  - [net] ipv6: fix possible deadlock in ip6_fl_purge / ip6_fl_gc (Sabrina Dubroca) [1313231]
  - [perf] annotate: Support full source file paths for srcline fix (Jiri Olsa) [1304472 1304479]
  - [perf] tools: Support full source file paths for srcline (Jiri Olsa) [1304472 1304479]
  - [perf] annotate: Fix -i option, which is currently ignored (Jiri Olsa) [1304472 1304479]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-637.el6]
changelog:
  - [netdrv] mlx4-en: add missing patch to init rss_rings in get_profile (Don Dutile) [1321164]
  - [netdrv] mlx4-en: disable traffic class queueing by default (Don Dutile) [1321164]
  - [netdrv] mlx4_core: Fix mailbox leak in error flow when performing update qp (Don Dutile) [1321164]
  - [x86] nmi/64: Fix a paravirt stack-clobbering bug in the NMI code (Denys Vlasenko) [1259581] {CVE-2015-5157}
  - [x86] nmi/64: Switch stacks on userspace NMI entry (Denys Vlasenko) [1259581] {CVE-2015-5157}


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-638.el6]
changelog:
  - [mm] hugetlb: prevent BUG_ON in hugetlb_fault -> hugetlb_cow (Dave Anderson) [1303495]
  - [mm] hugetlb: fix race condition in hugetlb_fault (Dave Anderson) [1303495]
  - [s390] kdump: fix wrong BUG_ON statement (Hendrik Brueckner) [1321316]
  - [scsi] cxgb4i: Increased the value of MAX_IMM_TX_PKT_LEN from 128 to 256 bytes (Sai Vemuri) [1320193]
  - [fs] nfs: fix a regression causing deadlock in nfs_wb_page_cancel() (Benjamin Coddington) [1135601]
  - [netdrv] cxgb4/ethtool: Get/set rx checksum (Sai Vemuri) [1225167]
  - [netdrv] cxgb4vf:The RX checksum feature was not completely ported to cxgb4vf driver (Sai Vemuri) [1225167]
  - [netdrv] cxgb4/cxgb4vf: Enable GRO (Sai Vemuri) [1225167]
  - [netdrv] cxgb4: Enable RX checksum offload flag (Sai Vemuri) [1225167]
  - [netdrv] cxgb4: Report correct link speed for unsupported ones (Sai Vemuri) [1296467]
  - [netdrv] cxgb4: Use vmalloc, if kmalloc fails (Sai Vemuri) [1296473]
  - [netdrv] cxgb4: Enhance driver to update FW, when FW is too old (Sai Vemuri) [1296472]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-639.el6]
changelog:
  - [input] wacom: fix ExpressKeys remote events (Aristeu Rozanski) [1318027]
  - [fs] revert "writeback: remove wb_list" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: bdi_writeback_task must set task state before calling schedule" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: merge bdi_writeback_task and bdi_start_fn" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: harmonize writeback threads naming" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: fix possible race when creating bdi threads" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wake-ups in the forker thread - 1" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wake-ups in the forker thread - 2" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wake-ups in bdi threads" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: simplify bdi code a little" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not remove bdi from bdi_list" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: move last_active to bdi" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: restructure bdi forker loop a little" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: move bdi threads exiting logic to the forker thread" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: prevent unnecessary bdi threads wakeups" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: optimize periodic bdi thread wakeups" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: remove unnecessary init_timer call" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: cleanup bdi_register" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: fix bad _bh spinlock nesting" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wakeup events when forking bdi threads" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: Fix lost wake-up shutting down writeback thread" (Jeff Moyer) [1322297]
  - [mm] revert "backing-dev: ensure wakeup_timer is deleted" (Jeff Moyer) [1322297]
  - [perf] revert: perf changes out of "sched, perf: Fix periodic timers" (Jiri Olsa) [1322488]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-640.el6]
changelog:
  - [net] use GFP_ATOMIC in dst_ops_extend_register (Sabrina Dubroca) [1323252]
  - [kernel] revert "sched: core: Use hrtimer_start_expires" (Jiri Olsa) [1324318]
  - [kernel] Revert "Cleanup bandwidth timers" (Jiri Olsa) [1324318]
  - [kernel] revert "fair: Test list head instead of list entry in throttle_cfs_rq" (Jiri Olsa) [1324318]
  - [kernel] revert "sched, perf: Fix periodic timers" (Jiri Olsa) [1324318]
  - [kernel] Revert "fix KABI break" (Jiri Olsa) [1324318]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-641.el6]
changelog:
  - [netdrv] ixgbe: restore proper CHECKSUM_UNNECESSARY behavior for LRO packets (Neil Horman) [1318426]
  - [netdrv] revert " net/mlx5_core: Add pci error handlers to mlx5_core driver" (Don Dutile) [1324599]
  - [x86] kernel: espfix not working for 32-bit KVM paravirt guests (Jacob Tanenbaum) [1172767] {CVE-2014-8134}


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-642.el6]
changelog:
  - [scsi] fc: revert - ensure scan_work isn't active when freeing fc_rport (Ewan Milne) [1326447]
  - [netdrv] ixgbe: Update ixgbe driver to use __netdev_pick_tx in ixgbe_select_queue (John Greene) [1310749]
  - [netdrv] mlx5e: Fix adding vlan rule with vid zero twice (Kamal Heib) [1322809]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.1.1.el6]
changelog:
  - [net] tcp/dccp: warn user for preferred ip_local_port_range (Florian Westphal) [1333571 1314774]
  - [net] tcp/dccp: try to not exhaust ip_local_port_range in connect() (Florian Westphal) [1333571 1314774]
  - [net] tcp: improve REUSEADDR/NOREUSEADDR cohabitation (Florian Westphal) [1333571 1314774]
  - [base] firmware: Add lock for firmware devices (Lyude Paul) [1333572 1309875]
  - [net] netlabel: fix a problem with netlbl_secattr_catmap_setrng (Paul Moore) [1333579 1321174]
  - [md] dm: only initialize the request_queue once (Mike Snitzer) [1333575 1328329]
  - [md] raid10: include bio_end_io_list in nr_queued to prevent freeze_array hang (Jes Sorensen) [1333576 1320595]
  - [md] raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang (Jes Sorensen) [1333576 1320595]
  - [md] raid5: Compare apples to apples (or sectors to sectors) (Jes Sorensen) [1333581 1295969]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.2.1.el6]
changelog:
  - [sched] Revert "kernel: sched: Cure load average vs NO_HZ woes" (Rafael Aquini) [1343015 1326373]
  - [sched] Revert "kernel: sched: Cure more NO_HZ load average woes" (Rafael Aquini) [1343015 1326373]
  - [sched] Revert "kernel: sched: Move sched_avg_update to update_cpu_load" (Rafael Aquini) [1343015 1326373]
  - [sched] Revert "kernel: sched: Fix nohz load accounting -- again" (Rafael Aquini) [1343015 1326373]
  - [fs] lockd: Don't try to register/unregister callbacks on the inet6addr_chain if the ipv6 module isn't loaded (Scott Mayhew) [1341496 1336483]
  - [fs] nfsd: Don't try to register/unregister callbacks on the inet6addr_chain if the ipv6 module isn't loaded (Scott Mayhew) [1341496 1336483]
  - [isdn] avoid calling tty_ldisc_flush() in atomic context (Sabrina Dubroca) [1337443 1328115]
  - [redhat] Update dracut dependency to pull in ecb module (Herbert Xu) [1334431 1315832]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.3.1.el6]
changelog:
  - [infiniband] security: Restrict use of the write interface (Don Dutile) [1332547 1332548] {CVE-2016-4565}


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.4.1.el6]
changelog:
  - [ipmi] Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg() (David Arcari) [1355980 1347189]
  - [fs] ext4: Remove useless spinlock in ext4_getattr() (Lukas Czerner) [1355981 1315933]
  - [net] tcp: increase size at which tcp_bound_to_half_wnd bounds to > TCP_MSS_DEFAULT (Davide Caratti) [1354446 1349776]
  - [net] tcp: Prevent overzealous packetization by SWS logic (Davide Caratti) [1354446 1349776]
  - [fs] configfs: fix race between dentry put and lookup (Robert S Peterson) [1353828 1333448]
  - [drm] move idr2 implementation to lib (Milos Vyletel) [1353827 1316790]
  - [fs] cifs: Create dedicated keyring for spnego operations (Scott Mayhew) [1351670 1267754]
  - [infiniband] srp: Fix backport error in ib_srp::srp_queuecommand (Don Dutile) [1348062 1321094]
  - [fs] gfs2: don't set rgrp gl_object until it's inserted into rgrp tree (Robert S Peterson) [1347539 1344740]
  - [sched] avoid kernel panic during power off (Frank Ramsay) [1343894 1313035]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.5.1.el6]
changelog:
  - [scsi] megaraid_sas: Do not fire MR_DCMD_PD_LIST_QUERY to controllers which do not support it (Tomas Henzl) [1359039 1352826]
  - [scsi] libfc: sanity check cpu number extracted from xid (Chris Leech) [1359036 1351356]
  - [security] keys: potential uninitialized variable (Mateusz Guzik) [1345945 1345946] {CVE-2016-4470}
  - [fs] gfs2: Lock holder cleanup (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Large-filesystem fix for 32-bit systems (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Get rid of gfs2_ilookup (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Fix gfs2_lookup_by_inum lock inversion (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Initialize iopen glock holder for new inodes (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Release iopen glock in gfs2_create_inode error cases (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Wait for iopen glock dequeues (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Re-add an omission from upstream (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Eliminate parameter non_block on gfs2_inode_lookup (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Don't filter out I_FREEING inodes anymore (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Check if iopen is held when deleting inode (Robert S Peterson) [1359037 1173286]
  - [fs] gfs2: Don't do glock put when inode creation fails (Robert S Peterson) [1359037 1173286]
  - [fs] gfs2: Prevent delete work from occurring on glocks used for create (Robert S Peterson) [1359037 1173286]
  - [fs] gfs2: Always use iopen glock for gl_deletes (Robert S Peterson) [1359037 1173286]
  - [fs] gfs2: Update master statfs buffer with sd_statfs_spin locked (Robert S Peterson) [1359037 1173286]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.6.1.el6]
changelog:
  - [net] tcp: make challenge acks less predictable (Florian Westphal) [1355606 1355607] {CVE-2016-5696}
  - [fs] sunrpc: move NO_CRKEY_TIMEOUT to the auth->au_flags (Scott Mayhew) [1366962 1294939]
  - [usbhid] hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Yauheni Kaliuta) [1359999 1360008] {CVE-2016-5829}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-687.el6]
changelog:
  - [netdrv] sfc: reduce severity of PIO buffer alloc failures (Jarod Wilson) [1410750]
  - [netdrv] sfc: avoid division by zero (Jarod Wilson) [1410750]
  - [netdrv] sfc: Insert multicast filters as well as mismatch filters in promiscuous mode (Jarod Wilson) [1410750]
  - [netdrv] sfc: get timer configuration from adapter (Jarod Wilson) [1410750]
  - [netdrv] sfc: warn if other functions have been reset by MCFW (Jarod Wilson) [1410750]
  - [netdrv] sfc: add output flag decoding to efx_mcdi_set_workaround (Jarod Wilson) [1410750]
  - [netdrv] sfc: get PIO buffer size from the NIC (Jarod Wilson) [1410750]
  - [netdrv] sfc: set interrupt moderation via MCDI (Jarod Wilson) [1410750]
  - [netdrv] sfc: allow asynchronous MCDI without completion function (Jarod Wilson) [1410750]
  - [netdrv] sfc: on MC reset, clear PIO buffer linkage in TXQs (Jarod Wilson) [1410750]
  - [netdrv] sfc: Downgrade EPERM messages from MCDI to debug (Jarod Wilson) [1410750]
  - [netdrv] sfc: cope with ENOSYS from efx_mcdi_get_workarounds() (Jarod Wilson) [1410750]
  - [netdrv] sfc: enable cascaded multicast filters in MCFW (Jarod Wilson) [1410750]
  - [netdrv] sfc: work around TRIGGER_INTERRUPT command not working on SFC9140 (Jarod Wilson) [1410750]
  - [dm] raid: fix transient device failure processing (Mike Snitzer) [1404425]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-690.el6]
changelog:
  - [drm] core: Do not preserve framebuffer on rmfb, v4 (Rob Clark) [1405267]
  - [scsi] mpt3sas: Fix for block device of raid exists even after deleting raid disk (Tomas Henzl) [1416552]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-691.el6]
changelog:
  - [net] tcp: correct memory barrier usage in tcp_check_space() (Oleg Nesterov) [1386136]
  - [fs] epoll: prevent missed events on EPOLL_CTL_MOD (Oleg Nesterov) [1386136]
  - [acpi] acpica: Fix regression in FADT revision checks (Lenny Szubowicz) [1418339]
  - [net] ipv6: stop sending PTB packets for MTU < 1280 (Hannes Frederic Sowa) [1415931] {CVE-2016-10142}
  - [net] fix dst_ops_extend leaks (Sabrina Dubroca) [1399633]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-692.el6]
changelog:
  - [fs] gfs2: Limit number of transaction blocks requested for truncates (Robert S Peterson) [1401058]
  - [fs] revert "sunrpc: make AF_LOCAL connect synchronous" (Benjamin Coddington) [1420044]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-693.el6]
changelog:
  - [netdrv] sfc: Add efx_nic member with fixed netdev features (Jarod Wilson) [1419396]
  - [netdrv] sfc: Take mac_lock before calling efx_ef10_filter_table_probe (Jarod Wilson) [1419396]
  - [netdrv] sfc: Fix VLAN filtering feature if vPort has VLAN_RESTRICT flag (Jarod Wilson) [1419396]
  - [netdrv] sfc: clean fallbacks between promisc/normal in efx_ef10_filter_sync_rx_mode (Jarod Wilson) [1419396]
  - [netdrv] sfc: support cascaded multicast filters (Jarod Wilson) [1419396]
  - [netdrv] sfc: Make failed filter removal less noisy (Jarod Wilson) [1410750]
  - [netdrv] sfc: re-factor efx_ef10_filter_sync_rx_mode() (Jarod Wilson) [1410750]
  - [netdrv] sfc: refactor debug-or-warnings printks (Jarod Wilson) [1410750]
  - [net] implement netif_cond_dbg macro (Jarod Wilson) [1410750]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-694.el6]
changelog:
  - [fs] posix_acl: Clear SGID bit when setting file permissions (Andreas Grunbacher) [1371252] {CVE-2016-7097}
  - [fs] switch posix_acl_equiv_mode() to umode_t * (Andreas Grunbacher) [1371252] {CVE-2016-7097}
  - [perf] sched latency: Fix thread pid reuse issue (Jiri Olsa) [1400743]
  - [fs] ext4: fix races of writeback with punch hole and zero range (Lukas Czerner) [1394786]
  - [fs] ext4: validate s_reserved_gdt_blocks on mount (Lukas Czerner) [1394786]
  - [fs] ext4: release bh in make_indexed_dir (Lukas Czerner) [1394786]
  - [fs] ext4: reinforce check of i_dtime when clearing high fields of uid and gid (Lukas Czerner) [1394786]
  - [fs] ext4: validate that metadata blocks do not overlap superblock (Lukas Czerner) [1394786]
  - [fs] ext4: short-cut orphan cleanup on error (Lukas Czerner) [1394786]
  - [fs] ext4: fix reference counting bug on block allocation error (Lukas Czerner) [1394786]
  - [fs] ext4: check for extents that wrap around (Lukas Czerner) [1394786]
  - [fs] ext4: silence UBSAN in ext4_mb_init() (Lukas Czerner) [1394786]
  - [fs] ext4: address UBSAN warning in mb_find_order_for_block() (Lukas Czerner) [1394786]
  - [fs] ext4: clean up error handling when orphan list is corrupted (Lukas Czerner) [1394786]
  - [fs] ext4: fix hang when processing corrupted orphaned inode list (Lukas Czerner) [1394786]
  - [fs] jbd2: Fix unreclaimed pages after truncate in data=journal mode (Lukas Czerner) [1394786]
  - [fs] ext4: Fix handling of extended tv_sec (Lukas Czerner) [1394786]
  - [fs] create and use seq_show_option for escaping (Lukas Czerner) [1394786]
  - [fs] ext4: replace open coded nofail allocation in ext4_free_blocks() (Lukas Czerner) [1394786]
  - [fs] ext4: Introduce EFSBADCRC and EFSCORRUPTED error codes (Lukas Czerner) [1394786]
  - [block] ensure request->part is valid (Jeff Moyer) [1416341]
  - [sound] alsa: hda - fix Lewisburg audio issue (Jaroslav Kysela) [1413134]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-696.el6]
changelog:
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1424628] {CVE-2017-6074}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.2.1.el6]
changelog:
  - [sched] fair: Rework throttle_count sync (Jiri Olsa) [1436241 1250762]
  - [sched] fair: Reorder cgroup creation code (Jiri Olsa) [1436241 1250762]
  - [sched] fair: Initialize throttle_count for new task-groups lazily (Jiri Olsa) [1436241 1250762]
  - [sched] fair: Do not announce throttled next buddy in dequeue_task_fair() (Jiri Olsa) [1436241 1250762]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.3.1.el6]
changelog:
  - [netdrv] be2net: Fix endian issue in logical link config command (Ivan Vecera) [1442979 1436527]
  - [scsi] lpfc: update for rhel6 11.0.0.6 (Maurizio Lombardi) [1439636 1429881]
  - [scsi] lpfc: The lpfc driver does not issue RFF_ID and RFT_ID in the correct sequence (Maurizio Lombardi) [1439636 1429881]
  - [x86] vmalloc_sync: avoid syncing vmalloc area on crashing cpu (Pingfan Liu) [1443499 1146727]
  - [kernel] audit: plug cred memory leak in audit_filter_rules (Richard Guy Briggs) [1443234 1434560]
  - [net] tcp: avoid infinite loop in tcp_splice_read() (Davide Caratti) [1430577 1430578] {CVE-2017-6214}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.4.1.el6]
changelog:
  - [fs] xfs: handle array index overrun in xfs_dir2_leaf_readbuf() (Carlos Maiolino) [1445179 1440361]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.5.1.el6]
changelog:
  - [fs] sunrpc: Ensure that we wait for connections to complete before retrying (Dave Wysochanski) [1450850 1448170]
  - [net] ipv6: check raw payload size correctly in ioctl (Jamie Bainbridge) [1450870 1441909]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.6.1.el6]
changelog:
  - [netdrv] ixgbe: fix setup_fc for x550em (Ken Cox) [1457347 1442030]
  - [fs] nfsd: stricter decoding of write-like NFSv2/v3 ops (J. Bruce Fields) [1449274 1446755] {CVE-2017-7895}
  - [fs] nfsd4: minor NFSv2/v3 write decoding cleanup (J. Bruce Fields) [1449274 1446755] {CVE-2017-7895}
  - [scsi] libfc: quarantine timed out xids (Chris Leech) [1455550 1431440]
  - [fs] nfsv4: fix getacl ERANGE for some ACL buffer sizes (J. Bruce Fields) [1449096 869942]
  - [fs] nfsv4: fix getacl head length estimation (J. Bruce Fields) [1449096 869942]
  - [mm] hugetlb: check for pte NULL pointer in page_check_address() (Herton R. Krzesinski) [1444351 1431508]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.7.1.el6]
changelog:
  - [kernel] audit: acquire creds selectively to reduce atomic op overhead (Paul Moore) [1460164 1454847]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.8.1.el6]
changelog:
  - [fs] sunrpc: Enable the keepalive option for TCP sockets (Dave Wysochanski) [1462094 1458421]
  - [mm] enlarge stack guard gap (Larry Woodman) [1452729 1452730] {CVE-2017-1000364}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.9.1.el6]
changelog:
  - [mm] allow JVM to implement its own stack guard pages (Larry Woodman) [1466667 1464237]
  - [mm] enlarge stack guard gap (Larry Woodman) [1466667 1464237]
  - Revert: [mm] enlarge stack guard gap (Larry Woodman) [1466667 1464237]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.10.1.el6]
changelog:
  - [mm] backport upstream large stack guard patch to RHEL6 (Larry Woodman) [1466667 1464237]
  - Revert: [mm] allow JVM to implement its own stack guard pages (Larry Woodman) [1466667 1464237]
  - Revert: [mm] enlarge stack guard gap (Larry Woodman) [1466667 1464237]
  - [fs] sunrpc: Handle EADDRNOTAVAIL on connection failures [1472128 1459978]
  - [scsi] scsi_transport_srp: Fix a race condition (Don Dutile) [1462097 1417305]
  - [scsi] scsi_transport_srp: Introduce srp_wait_for_queuecommand() (Don Dutile) [1462097 1417305]
  - [block] make blk_cleanup_queue() wait until request_fn finished (Don Dutile) [1462097 1417305]
  - [s390] kernel: initial cr0 bits (Hendrik Brueckner) [1460194 1445326]
  - [s390] zfcp: do not trace pure benign residual HBA responses at default level (Hendrik Brueckner) [1460193 1421760]
  - [s390] zfcp: fix rport unblock race with LUN recovery (Hendrik Brueckner) [1460190 1421761]
  - [scsi] bnx2fc: fix race condition in bnx2fc_get_host_stats() (Maurizio Lombardi) [1467323 1393672]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-696.10.2.el6]
changelog:
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1490060 1490062] {CVE-2017-1000251}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.12.1.el6]
changelog:
  - [fs] gfs2: clear gl_object when deleting an inode in gfs2_delete_inode (Robert S Peterson) [1479397 1464541]
  - [fs] gfs2: clear gl_object if gfs2_create_inode fails (Robert S Peterson) [1479397 1464541]
  - [fs] gfs2: set gl_object in inode lookup only after block type check (Robert S Peterson) [1479397 1464541]
  - [fs] gfs2: introduce helpers for setting and clearing gl_object (Robert S Peterson) [1479397 1464541]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.13.1.el6]
changelog:
  - [netdv] brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx() (Stanislaw Gruszka) [1474783 1474782] {CVE-2017-7541}
  - [x86] fix /proc/mtrr with base/size more than 44bits (Jerome Marchand) [1482855 1466530]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.14.1.el6]
changelog:
  - [fs] nfs: don't disconnect open-owner on NFS4ERR_BAD_SEQID (Dave Wysochanski) [1491123 1459636]
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1490060 1490062] {CVE-2017-1000251}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.15.1.el6]
changelog:
  - [fs] binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings (Petr Matousek) [1492959 1492961] {CVE-2017-1000253}
  - [fs] binfmt_elf.c: fix bug in loading of PIE binaries (Petr Matousek) [1492959 1492961] {CVE-2017-1000253}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.16.1.el6]
changelog:
  - [net] packet: fix tp_reserve race in packet_set_ring (Stefano Brivio) [1481941 1481943] {CVE-2017-1000111}
  - [net] packet: fix overflow in check for tp_frame_nr (Stefano Brivio) [1481941 1481943] {CVE-2017-1000111}
  - [net] packet: fix overflow in check for tp_reserve (Stefano Brivio) [1481941 1481943] {CVE-2017-1000111}
  - [netdrv] sfc: tx ring can only have 2048 entries for all EF10 NICs (Jarod Wilson) [1498019 1441773]
  - [fs] sunrpc: always treat the invalid cache as unexpired (Thiago Becker) [1497976 1477288]
  - [fs] sunrpc: xpt_auth_cache should be ignored when expired (Thiago Becker) [1497976 1477288]
  - [net] tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Davide Caratti) [1488344 1488340] {CVE-2017-14106}
  - [net] tcp: fix 0 divide in __tcp_select_window() (Davide Caratti) [1488344 1488340] {CVE-2017-14106}
  - [scsi] lpfc: fix "integer constant too large" error on 32bit archs (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: version 11.0.1.6 is 11.0.0.6 with no_hba_reset patches (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: Vport creation is failing with "Link Down" error (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: Fix panic on BFS configuration (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: Fix eh_deadline setting for sli3 adapters (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: Correct panics with eh_timeout and eh_deadline (Maurizio Lombardi) [1487220 1441169]
  - [net] udp: consistently apply ufo or fragmentation (Davide Caratti) [1481532 1481529] {CVE-2017-1000112}
  - [net] ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output (Davide Caratti) [1481532 1481529] {CVE-2017-1000112}
  - [net] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output (Davide Caratti) [1481532 1481529] {CVE-2017-1000112}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.17.1.el6]
changelog:
  - [fs] nfsd: reorder nfsd_cache_match to check more powerful discriminators first (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: split DRC global spinlock into per-bucket locks (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: convert num_drc_entries to an atomic_t (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: remove the cache_hash list (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: convert the lru list into a per-bucket thing (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: clean up drc cache in preparation for global spinlock elimination (Thiago Becker) [1509876 1435787]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.18.1.el6]
changelog:
  - [s390] s390/qdio: clear DSCI prior to scanning multiple input queues (Hendrik Brueckner) [1513314 1467962]
  - [net] sctp: do not loose window information if in rwnd_over (Marcelo Leitner) [1514443 1492220]
  - [net] sctp: fix recovering from 0 win with small data chunks (Marcelo Leitner) [1514443 1492220]
  - [s390] zfcp: fix erp_action use-before-initialize in REC action trace (Hendrik Brueckner) [1512425 1497000]
  - [hv] vmbus: Fix error code returned by vmbus_post_msg() (Vitaly Kuznetsov) [1506145 1491846]
  - [hv] vmbus: Increase the time between retries in vmbus_post_msg() (Vitaly Kuznetsov) [1506145 1491846]
  - [hv] vmbus: Raise retry/wait limits in vmbus_post_msg() (Vitaly Kuznetsov) [1506145 1491846]
  - [hv] vmbus: Reduce the delay between retries in vmbus_post_msg() (Vitaly Kuznetsov) [1506145 1491846]
  - [scsi] be2iscsi: fix bad extern declaration (Maurizio Lombardi) [1507512 1497152]
  - [kernel] mqueue: fix a use-after-free in sys_mq_notify() (Davide Caratti) [1476122 1476124] {CVE-2017-11176}
  - [net] ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() (Matteo Croce) [1477008 1477006] {CVE-2017-7542}
  - [net] ipv6: avoid overflow of offset in ip6_find_1stfragopt (Matteo Croce) [1477008 1477006] {CVE-2017-7542}
  - [net] ipv6: Fix leak in ipv6_gso_segment() (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}
  - [net] gre: fix a possible skb leak (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}
  - [net] ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}
  - [net] ipv6: Check ip6_find_1stfragopt() return value properly (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}
  - [net] ipv6: Prevent overrun when parsing v6 header options (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.18.5.el6]
changelog:
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Add back STUFF_RSB to interrupt and error paths (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: make is_kaiser_pgd reliable (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] revert: mm/kaiser: Disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: fix pgd freeing in error path (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix 32-bit program crash with 64-bit kernel on AMD boxes (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] Remove __cpuinitdata from some data & function (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] KVM/spec_ctrl: allow IBRS to stay enabled in host userland (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Remove STUFF_RSB in error and interrupt code (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] [kvm] Pad RSB on VM transition (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [security] Add SPEC_CTRL Kconfig option (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpuid: Provide get_scattered_cpuid_leaf() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpuid: Cleanup cpuid_regs definitions (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] microcode: Share native MSR accessing variants (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] nop: Make the ASM_NOP* macros work from assembly (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpu: Clean up and unify the NOP selection infrastructure (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Further simplify the paranoid_exit code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Don't switch to trampoline stack in paranoid_exit (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [fs] prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [kernel] locking/barriers: introduce new memory barrier gmb() (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] Fix typo preventing msr_set/clear_bit from having an effect (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] Add another set of MSR accessor functions (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: fix RESTORE_CR3 crash in kaiser_stop_machine (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: use atomic ops to poison/unpoison user pagetables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: trampoline stack comments (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Check if PUD is large when validating a kernel address (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] Separate out entry text section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] linux/const.h: Add _BITUL() and _BITULL() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] linux/mmdebug.h: add VM_WARN_ON() and VM_WARN_ON_ONCE() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] stddef.h: Move offsetofend() from vfio.h to a generic kernel header (Waiman Long) [1519799 1519802] {CVE-2017-5754}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.18.6.el6]
changelog:
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: __load_cr3 in resume from RAM after kernel %gs has been restored (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: Revert the __GFP_COMP flag change (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Waiman Long) [1519799 1519802] {CVE-2017-5754}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.18.7.el6]
changelog:
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Eliminate redundnat FEATURE Not Present messages (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: enable IBRS and stuff_RSB before calling NMI C code (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: skip CAP_SYS_PTRACE check to skip audit (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: disable ibrs while in intel_idle() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: skip IBRS/CR3 restore when paranoid exception returns to userland (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - Revert "x86/entry: Use retpoline for syscall's indirect calls" (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/dump_pagetables: Allow dumping current pagetables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Add a pgd argument to walk_pgd_level() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Add page table directory (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Remove unneeded nmi_userspace code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix nmi exit code with CONFIG_TRACE_IRQFLAGS (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Clear kdump pgd page to prevent incorrect behavior (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: consider the init_mm.pgd a kaiser pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: convert userland visible "kpti" name to "pti" (Waiman Long) [1519799 1519802] {CVE-2017-5754}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.19.1.el6]
changelog:
  - [scsi] bnx2fc: Fix hung task messages when a cleanup response is not received during abort (Chad Dupuis) [1523783 1504260]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.20.1.el6]
changelog:
  - [x86] kaiser/efi: unbreak tboot (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] pti/mm: Fix trampoline stack problem with XEN PV (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] pti/mm: Fix XEN PV boot failure (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Invoke TRACE_IRQS_IRETQ in paranoid_userspace_restore_all (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] spec_ctrl: show added cpuid flags in /proc/cpuinfo after late microcode update (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Eliminate redundnat FEATURE Not Present messages (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: enable IBRS and stuff_RSB before calling NMI C code (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: skip CAP_SYS_PTRACE check to skip audit (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: disable ibrs while in intel_idle() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: skip IBRS/CR3 restore when paranoid exception returns to userland (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - Revert "x86/entry: Use retpoline for syscall's indirect calls" (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/dump_pagetables: Allow dumping current pagetables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Add a pgd argument to walk_pgd_level() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Add page table directory (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Remove unneeded nmi_userspace code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix nmi exit code with CONFIG_TRACE_IRQFLAGS (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Clear kdump pgd page to prevent incorrect behavior (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: consider the init_mm.pgd a kaiser pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: convert userland visible "kpti" name to "pti" (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: __load_cr3 in resume from RAM after kernel %gs has been restored (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: Revert the __GFP_COMP flag change (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Add back STUFF_RSB to interrupt and error paths (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: make is_kaiser_pgd reliable (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] revert: mm/kaiser: Disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: fix pgd freeing in error path (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix 32-bit program crash with 64-bit kernel on AMD boxes (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] Remove __cpuinitdata from some data & function (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] KVM/spec_ctrl: allow IBRS to stay enabled in host userland (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Remove STUFF_RSB in error and interrupt code (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] [kvm] Pad RSB on VM transition (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [security] Add SPEC_CTRL Kconfig option (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpuid: Provide get_scattered_cpuid_leaf() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpuid: Cleanup cpuid_regs definitions (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] microcode: Share native MSR accessing variants (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] nop: Make the ASM_NOP* macros work from assembly (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpu: Clean up and unify the NOP selection infrastructure (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Further simplify the paranoid_exit code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Don't switch to trampoline stack in paranoid_exit (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [fs] prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [kernel] locking/barriers: introduce new memory barrier gmb() (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] Fix typo preventing msr_set/clear_bit from having an effect (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] Add another set of MSR accessor functions (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: fix RESTORE_CR3 crash in kaiser_stop_machine (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: use atomic ops to poison/unpoison user pagetables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: trampoline stack comments (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Check if PUD is large when validating a kernel address (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] Separate out entry text section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] linux/const.h: Add _BITUL() and _BITULL() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] linux/mmdebug.h: add VM_WARN_ON() and VM_WARN_ON_ONCE() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] stddef.h: Move offsetofend() from vfio.h to a generic kernel header (Waiman Long) [1519799 1519802] {CVE-2017-5754}


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.21.1.el6]
changelog:
  - [fs] sunrpc: Revert "sunrpc: always treat the invalid cache as unexpired" (Thiago Becker) [1535938 1532786]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.22.1.el6]
changelog:
  - [mm] add cpu_relax() to "dont return 0 too early" patch (Ian Kent) [1527811 988988]
  - [mm] don't return 0 too early from find_get_pages() (Ian Kent) [1527811 988988]
  - [crypto] cryptd: Add cryptd_max_cpu_qlen module parameter (Jon Maxwell) [1527802 1503322]
  - [powerpc] spinlock: add gmb memory barrier (Mauricio Oliveira) [1531720 1538543]
  - [powerpc] Prevent Meltdown attack with L1-D$ flush (Mauricio Oliveira) [1531720 1538543]
  - [s390] vtime: turn BP on when going idle (Hendrik Brueckner) [1532733 1538542]
  - [s390] cpuinfo: show facilities as reported by stfle (Hendrik Brueckner) [1532733 1538542]
  - [s390] kconfigs: turn off SHARED_KERNEL support for s390 (Hendrik Brueckner) [1532733 1538542]
  - [s390] add ppa to system call and program check path (Hendrik Brueckner) [1532733 1538542]
  - [s390] spinlock: add gmb memory barrier (Hendrik Brueckner) [1532733 1538542]
  - [s390] introduce CPU alternatives (Hendrik Brueckner) [1532733 1538542]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.23.1.el6]
changelog:
  - [scsi] avoid a permanent stop of the scsi device's request queue (Ewan Milne) [1519857 1513455]
  - [x86] retpoline/hyperv: Convert assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Upgrade GCC retpoline warning to an error for brew builds (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Don't use kernel indirect thunks in vsyscalls (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Add a read-only retp_enabled debugfs knob (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: detect unretpolined modules (Waiman Long) [1543022 1535645]
  - [x86] retpoline/ACPI: Convert indirect jump in wakeup code (Waiman Long) [1543022 1535645]
  - [x86] retpoline/efi: Convert stub indirect calls & jumps (Waiman Long) [1543022 1535645]
  - [watchdog] hpwdt: remove indirect call in drivers/watchdog/hpwdt.c (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: cleanup __ptrace_may_access (Waiman Long) [1543022 1535645]
  - [x86] bugs: Drop one "mitigation" from dmesg (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: fix ptrace IBPB optimization (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Avoid returns in IBRS-disabled regions (Waiman Long) [1543022 1535645]
  - [x86] spectre/meltdown: avoid the vulnerability directory to weaken kernel security (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Update spec_ctrl.txt and kernel-parameters.txt (Waiman Long) [1543022 1535645]
  - [x86] Use IBRS for firmware update path (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: stuff RSB on context switch with SMEP enabled (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: use upstream RSB stuffing function (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: add ibrs_enabled=3 (ibrs_user) (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Integrate IBRS with retpoline (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: print features changed by microcode loading (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: refactor the init and microcode loading paths (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: move initialization of X86_FEATURE_IBPB_SUPPORT (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove SPEC_CTRL_PCP_IBPB bit (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove ibrs_enabled variable (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: add ibp_disabled variable (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: add X86_FEATURE_IBP_DISABLE (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove IBP disable for AMD model 0x16 (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove performance measurements from documentation (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: make ipbp_enabled read-only (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove ibpb_enabled=2 mode (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Enable spec_ctrl functions for x86-32 (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: move vmexit rmb in the last branch before IBRS (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: satisfy the barrier like semantics of IBRS (Waiman Long) [1543022 1535645]
  - [x86] spectre_v1: Mark it as mitigated (Waiman Long) [1543022 1535645]
  - [x86] pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (Waiman Long) [1543022 1535645]
  - [x86] mce: Make machine check speculation protected (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Add LFENCE to the retpoline/RSB filling RSB macros (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Fill return stack buffer on vmexit (Waiman Long) [1543022 1535645]
  - [x86] retpoline/irq32: Convert assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] retpoline/checksum32: Convert assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] retpoline/entry: Convert entry assembler indirect (Waiman Long) [1543022 1535645]
  - [x86] retpoline/crypto: Convert crypto assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] spectre: Add boot time option to select Spectre v2 mitigation (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Add initial retpoline support (Waiman Long) [1543022 1535645]
  - [x86] cpu: Implement CPU vulnerabilites sysfs functions (Waiman Long) [1543022 1535645]
  - [base] sysfs/cpu: Add vulnerability folder (Waiman Long) [1543022 1535645]
  - [x86] cpufeatures: Add X86_BUG_SPECTRE_V[12] (Waiman Long) [1543022 1535645]
  - [x86] pti: Add the pti= cmdline option and documentation (Waiman Long) [1543022 1535645]
  - [x86] cpufeatures: Add X86_BUG_CPU_MELTDOWN (Waiman Long) [1543022 1535645]
  - [x86] pti: Rename CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION (Waiman Long) [1543022 1535645]
  - [x86] cpu: Expand cpufeature facility to include cpu bugs (Waiman Long) [1543022 1535645]
  - [x86] cpu: Merge bugs.c and bugs_64.c (Waiman Long) [1543022 1535645]
  - [x86] cpu/intel: Introduce macros for Intel family numbers (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Add missing '\n' at end of ALTERNATIVE inline asm (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Fix alt_max_short macro to really be a max() (Waiman Long) [1543022 1535645]
  - [x86] asm: Make asm/alternative.h safe from assembly (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Document macros (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Fix ALTERNATIVE_2 padding generation properly (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Add instruction padding (Waiman Long) [1543022 1535645]
  - [x86] alternative: Add header guards to <asm/alternative-asm.h> (Waiman Long) [1543022 1535645]
  - [x86] alternative: Use .pushsection/.popsection (Waiman Long) [1543022 1535645]
  - [x86] copy_user_generic: Optimize copy_user_generic with CPU erms feature (Waiman Long) [1543022 1535645]
  - [x86] Make .altinstructions bit size neutral (Waiman Long) [1543022 1535645]
  - [x86] pti: Rework the trampoline stack switching code (Waiman Long) [1543022 1535645]
  - [x86] pti: Disable interrupt before trampoline stack switching (Waiman Long) [1543022 1535645]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.24.1.el6]
changelog:
  - [kernel] sched/core: Rework rq->clock update skips (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] sched: Remove useless code in yield_to() (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] sched: Set skip_clock_update in yield_task_fair() (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] sched, rt: Update rq clock when unthrottling of an otherwise idle CPU (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] lockdep: Fix lock_is_held() on recursion (Lauro Ramos Venancio) [1551475 1212959]
  - [net] bonding: discard lowest hash bit for 802.3ad layer3+4 (Hangbin Liu) [1550103 1532167]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.25.1.el6]
changelog:
  - [net] packet: Allow packets with only a header (but no payload) (Lorenzo Bianconi) [1557896 1535024]
  - [net] packet: make packet too small warning match condition (Lorenzo Bianconi) [1557896 1535024]
  - [net] packet: bail out of packet_snd() if L2 header creation fails (Lorenzo Bianconi) [1557896 1535024]
  - [net] packet: make packet_snd fail on len smaller than l2 header (Lorenzo Bianconi) [1557896 1535024]
  - [net] dccp: use-after-free in DCCP code (Stefano Brivio) [1520818 1520817] {CVE-2017-8824}
  - [fs] nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields) [1447640 1447641] {CVE-2017-7645}
  - [netdrv] be2net: Fix UE detection logic for BE3 (Ivan Vecera) [1552706 1437991]
  - [x86] skip check for spurious faults for non-present faults (Daniel Vacek) [1551471 1495167]
  - [x86] mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds() (Daniel Vacek) [1551471 1495167]
  - [scsi] lpfc: Null pointer dereference when log_verbose is set to 0xffffffff (Dick Kennedy) [1540481 1538340]
  - [mm] prevent concurrent unmap_mapping_range() on the same inode (Miklos Szeredi) [1538654 1408108]
  - [s390] fix transactional execution control register handling (Hendrik Brueckner) [1538591 1520862]
  - [netdrv] bnx2x: prevent crash when accessing PTP with interface down (Michal Schmidt) [1538586 1518669]
  - [v4l] media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548429 1548432] {CVE-2017-13166}
  - [v4l] media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic (Jarod Wilson) [1548429 1548432] {CVE-2017-13166}
  - [net] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Florian Westphal) [1543089 1543091] {CVE-2017-18017}
  - [net] netfilter: xt_TCPMSS: fix handling of malformed TCP header and options (Florian Westphal) [1543089 1543091] {CVE-2017-18017}
  - [net] netfilter: xt_TCPMSS: SYN packets are allowed to contain data (Florian Westphal) [1543089 1543091] {CVE-2017-18017}
  - [net] bluetooth: Prevent uninitialized data (Gopal Tiwari) [1519627 1519626] {CVE-2017-1000410}


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.26.1.el6]
changelog:
  - [s390] qeth: check not more than 16 SBALEs on the completion queue (Hendrik Brueckner) [1557477 1520860]
  - [x86] pti: Disable kaiser_add_mapping if X86_FEATURE_NOPTI (Waiman Long) [1561441 1557562] {CVE-2017-5754}
  - [x86] irq/ioapic: Check for valid irq_cfg pointer in smp_irq_move_cleanup_interrupt (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] kexec/64: Clear control page after PGD init (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] efi/64: Fix potential PTI data corruption problem (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti/mm: Fix machine check with PTI on old AMD CPUs (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti/mm: Enable PAGE_GLOBAL if not affected by Meltdown (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] retpoline: Avoid retpolines for built-in __init functions (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] kexec/32: Allocate 8k PGD for PTI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] spec_ctrl: Patch out lfence on old 32-bit CPUs (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] spec_ctrl/32: Enable IBRS processing on kernel entries & exits (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] spec_ctrl/32: Stuff RSB on kernel entry (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Allow CONFIG_PAGE_TABLE_ISOLATION for x86_32 (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti/32: Add a PAE specific version of __pti_set_user_pgd (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Support PAE page table dumping (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable/pae: Use separate kernel PMDs for user page-table (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] mm/pae: Populate valid user PGD entries (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Enable x86-32 for kaiser.c (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Disable PCID handling in x86-32 TLB flushing code (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable: Disable user PGD poisoning for PAE (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable: Move more PTI functions out of pgtable_64.h (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable: Move pgdp kernel/user conversion functions to pgtable.h (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable/32: Allocate 8k page-tables when PTI is enabled (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable/pae: Unshare kernel PMDs when PTI is enabled (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Handle debug exception similar to NMI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Add PTI cr3 switch to non-NMI entry/exit points (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Add PTI cr3 switches to NMI handler code (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Introduce SAVE_ALL_NMI and RESTORE_ALL_NMI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Enable the use of trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Change INT80 to be an interrupt gate (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Handle Entry from Kernel-Mode on Entry-Stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Leave the kernel via trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Enter the kernel via trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Restore segments before int registers (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Split off return-to-kernel path (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Unshare NMI return path (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Put ESPFIX code into a macro (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Load task stack from x86_tss.sp1 in SYSENTER handler (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Rename TSS_sysenter_sp0 to TSS_entry_stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Add X86_FEATURE_NOPTI to permanently disable PTI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Simplify and fix up the SYSENTER stack #DB/NMI fixup (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] doublefault: Set the right gs register for doublefault (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] syscall: int80 must not clobber r12-15 (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] syscall: change ia32_syscall() to create the full register frame in ia32_do_call() (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] cve: Make all Meltdown/Spectre percpu variables available to x86-32 (Waiman Long) [1553283 1550599] {CVE-2017-5754}


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.27.1.el6]
changelog:
  - [mm] account skipped entries to avoid looping in find_get_pages (Dave Wysochanski) [1565989 1559386]
  - [x86] pti/32: Don't use trampoline stack on Xen PV (Waiman Long) [1568327 1562725]
  - [x86] pti: Use boot_cpu_has(X86_FEATURE_PTI_SUPPORT) for early call sites (Waiman Long) [1568327 1562725]
  - [x86] pti: Set X86_FEATURE_PTI_SUPPORT early (Waiman Long) [1568327 1562725]
  - [x86] pti: Rename X86_FEATURE_NOPTI to X86_FEATURE_PTI_SUPPORT (Waiman Long) [1568327 1562725]
  - [x86] pti/32: Fix setup_trampoline_page_table() bug (Waiman Long) [1568327 1562725]
  - [x86] entry: Remove extra argument in call instruction (Waiman Long) [1568332 1562552]
  - [x86] syscall: Fix ia32_ptregs handling bug in 64-bit kernel (Waiman Long) [1568332 1562552]
  - [x86] efi/64: Align efi_pgd on even page boundary (Waiman Long) [1568535 1558845]
  - [x86] pgtable/pae: Revert "Use separate kernel PMDs for user page-table" (Waiman Long) [1568535 1558845]
  - [x86] pgtable/pae: Revert "Unshare kernel PMDs when PTI is enabled" (Waiman Long) [1568535 1558845]
  - [x86] mm: Dump both kernel & user page tables at fault (Waiman Long) [1568535 1558845]
  - [x86] entry/32: Fix typo in PARANOID_EXIT_TO_KERNEL_MODE (Waiman Long) [1568535 1558845]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.28.1.el6]
changelog:
  - [x86] entry/64: Don't use IST entry for #BP stack (Waiman Long) [1567078 1567079] {CVE-2018-8897}
  - [x86] xen: do not use xen_info on HVM, set pv_info name to "Xen HVM" (Vitaly Kuznetsov) [1569141 1568241]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.29.1.el6]
changelog:
  - [x86] x86/spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Rename _RDS to _SSBD (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [kernel] prctl: Add speculation control prctls (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/kvm: Expose the RDS bit to the guest (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs/AMD: Add support to disable RDS on Fam[15, 16, 17]h if requested (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Expose the /sys/../spec_store_bypass and X86_BUG_SPEC_STORE_BYPASS (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] cpu/intel: Knight Mill and Moorefield update to intel-family.h (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/speculation: Update Speculation Control microcode blacklist (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Clean up Spectre v2 related CPUID flags (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add AMD feature bits for Speculation Control (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add Intel feature bits for Speculation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add CPUID_7_EDX CPUID leaf (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] Extend RH cpuinfo to 10 extra words (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1573176 1572487]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-747.el6]
changelog:
  - [fs] gfs2: Check for the end of metadata in trunc_dealloc (Robert S Peterson) [1559928]
  - [fs] gfs2: clear journal live bit in gfs2_log_flush (Robert S Peterson) [1559928]
  - [netdrv] vmxnet3: fix tx data ring copy for variable size (Neil Horman) [1530378]
  - [mm] account skipped entries to avoid looping in find_get_pages (Dave Wysochanski) [1559386]
  - [powerpc] pseries: Support firmware disable of RFI flush (Mauricio Oliveira) [1554631]
  - [powerpc] pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper (Mauricio Oliveira) [1554631]
  - [powerpc] 64s: Allow control of RFI flush via debugfs (Mauricio Oliveira) [1554630]
  - [powerpc] 64s: Improve RFI L1-D cache flush fallback (Mauricio Oliveira) [1554630]
  - [powerpc] 64s: Wire up cpu_show_meltdown() (Mauricio Oliveira) [1554630]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-748.el6]
changelog:
  - [mm] fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE (Bhupesh Sharma) [1494380]
  - [mm] brk: fix min_brk lower bound computation for COMPAT_BRK (Bhupesh Sharma) [1494380]
  - [mm] split ET_DYN ASLR from mmap ASLR (Bhupesh Sharma) [1494380]
  - [s390] redefine randomize_et_dyn for ELF_ET_DYN_BASE (Bhupesh Sharma) [1494380]
  - [mm] expose arch_mmap_rnd when available (Bhupesh Sharma) [1494380]
  - [s390] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [s390] mmap: randomize mmap base for bottom up direction (Bhupesh Sharma) [1494380]
  - [powerpc] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [x86] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: create Kconfig variable for PIE randomization (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: PIE: make PF_RANDOMIZE check comment more accurate (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: fix PIE execution with randomization disabled (Bhupesh Sharma) [1494380]
  - [acpi] acpica: Support calling _REG methods within ACPI interpreter (Lenny Szubowicz) [1522849]
  - [acpi] acpica: Function to test if ACPI interpreter already entered (Lenny Szubowicz) [1522849]
  - [acpi] acpica: Function to test if ACPI mutex held by this thread (Lenny Szubowicz) [1522849]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-749.el6]
changelog:
  - [powerpc] pseries: Restore default security feature flags on setup (Mauricio Oliveira) [1561788]
  - [powerpc] Move default security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Fix clearing of security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Wire up cpu_show_spectre_v2() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Wire up cpu_show_spectre_v1() (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Use the security flags in pseries_setup_rfi_flush() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Enhance the information in cpu_show_meltdown() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Move cpu_show_meltdown() (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Set or clear security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] Add security feature flags for Spectre/Meltdown (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Add new H_GET_CPU_CHARACTERISTICS flags (Mauricio Oliveira) [1561788]
  - [lib] seq: Add seq_buf_printf() (Mauricio Oliveira) [1561788]
  - [powerpc] rfi-flush: Call setup_rfi_flush() after LPM migration (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Differentiate enabled and patched flush types (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Always enable fallback flush on pseries (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Make it possible to call setup_rfi_flush() again (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Move the logic to avoid a redo into the debugfs code (Mauricio Oliveira) [1561786]
  - [x86] pti/32: Don't use trampoline stack on Xen PV (Waiman Long) [1562725]
  - [x86] pti: Use boot_cpu_has(X86_FEATURE_PTI_SUPPORT) for early call sites (Waiman Long) [1562725]
  - [x86] pti: Set X86_FEATURE_PTI_SUPPORT early (Waiman Long) [1562725]
  - [x86] pti: Rename X86_FEATURE_NOPTI to X86_FEATURE_PTI_SUPPORT (Waiman Long) [1562725]
  - [x86] pti/32: Fix setup_trampoline_page_table() bug (Waiman Long) [1562725]
  - [x86] entry: Remove extra argument in call instruction (Waiman Long) [1562552]
  - [x86] syscall: Fix ia32_ptregs handling bug in 64-bit kernel (Waiman Long) [1557562 1562552]
  - [x86] efi/64: Align efi_pgd on even page boundary (Waiman Long) [1558845]
  - [x86] pgtable/pae: Revert "Use separate kernel PMDs for user page-table" (Waiman Long) [1558845]
  - [x86] pgtable/pae: Revert "Unshare kernel PMDs when PTI is enabled" (Waiman Long) [1558845]
  - [x86] mm: Dump both kernel & user page tables at fault (Waiman Long) [1558845]
  - [x86] entry/32: Fix typo in PARANOID_EXIT_TO_KERNEL_MODE (Waiman Long) [1558845]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-750.el6]
changelog:
  - [fs] fuse: fix punching hole with unaligned end (Miklos Szeredi) [1387473] {CVE-2017-15121}
  - [documentation] kdump: fix documentation about panic_on_warn to match rhel6 (Pingfan Liu) [1555196]
  - [fs] Provide sane values for nlink (Leif Sahlberg) [1554342]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-751.el6]
changelog:
  - [md] dm thin: fix regression that caused discards to be disabled if passdown was (Mike Snitzer) [1569377]
  - [s390] configs: enable auto expoline support (Hendrik Brueckner) [1554959]
  - [s390] correct nospec auto detection init order (Hendrik Brueckner) [1554959]
  - [s390] add sysfs attributes for spectre (Hendrik Brueckner) [1554959]
  - [s390] report spectre mitigation via syslog (Hendrik Brueckner) [1554959]
  - [s390] add automatic detection of the spectre defense (Hendrik Brueckner) [1554959]
  - [s390] move nobp parameter functions to nospec-branch.c (Hendrik Brueckner) [1554959]
  - [s390] do not bypass BPENTER for interrupt system calls (Hendrik Brueckner) [1554959]
  - [s390] Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) (Hendrik Brueckner) [1554959]
  - [s390] introduce execute-trampolines for branches (Hendrik Brueckner) [1554959]
  - [s390] run user space and KVM guests with modified branch prediction (Hendrik Brueckner) [1554959]
  - [s390] add optimized array_index_mask_nospec (Hendrik Brueckner) [1554959]
  - [s390] scrub registers on kernel entry and KVM exit (Hendrik Brueckner) [1554959]
  - [s390] align and prepare spectre mitigation for upstream commits (Hendrik Brueckner) [1554959]
  - [x86] xen: do not use xen_info on HVM, set pv_info name to "Xen HVM" (Vitaly Kuznetsov) [1568241]
  - [net] sctp: verify size of a new chunk in _sctp_make_chunk() (Stefano Brivio) [1551908] {CVE-2018-5803}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-752.el6]
changelog:
  - [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1572487]
  - [fs] fix WARNING in rmdir() (Miklos Szeredi) [1282117]
  - [net] sctp: label accepted/peeled off sockets (Marcelo Leitner) [1571357]
  - [net] security: export security_sk_clone (Marcelo Leitner) [1571357]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-753.el6]
changelog:
  - [x86] vm86-32: Properly set up vm86-32 stack for task switching (Waiman Long) [1572865]
  - [x86] spec_ctrl: Enable IBRS and RSB stuffing in 32-bit interrupts (Waiman Long) [1571362]
  - [x86] entry/32: Fix regressions in 32-bit debug exception (Waiman Long) [1571362]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.el6]
changelog:
  - [powerpc] 64s: Add support for a store forwarding barrier at kernel entry/exit (Mauricio Oliveira) [1581053] {CVE-2018-3639}
  - [x86] amd: Disable AMD SSBD mitigation in a VM (Waiman Long) [1580360]
  - [x86] spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Rename _RDS to _SSBD (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566899] {CVE-2018-3639}
  - [kernel] prctl: Add speculation control prctls (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] kvm: Expose the RDS bit to the guest (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs/AMD: Add support to disable RDS on Fam(15, 16, 17)h if requested (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Expose the /sys/../spec_store_bypass and X86_BUG_SPEC_STORE_BYPASS (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpu/intel: Knight Mill and Moorefield update to intel-family.h (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] speculation: Update Speculation Control microcode blacklist (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Clean up Spectre v2 related CPUID flags (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Add AMD feature bits for Speculation Control (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Add Intel feature bits for Speculation (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Add CPUID_7_EDX CPUID leaf (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] Extend RH cpuinfo to 10 extra words (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] invpcid: Enable 'noinvpcid' boot parameter for X86_32 (Waiman Long) [1560494]
  - [x86] dumpstack_32: Fix kernel panic in dump_trace (Waiman Long) [1577351]
  - [fs] gfs2: For fs_freeze, do a log flush and flush the ail1 list (Robert S Peterson) [1569148]
  - [net] dccp: check sk for closed state in dccp_sendmsg() (Stefano Brivio) [1576586] {CVE-2018-1130}
  - [net] ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped (Stefano Brivio) [1576586] {CVE-2018-1130}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.1.1.el6]
changelog:
  - [x86] microcode: Fix CPU synchronization routine (Prarit Bhargava) [1574592]
  - [x86] microcode: Synchronize late microcode loading (Prarit Bhargava) [1574592]
  - [x86] microcode: Request microcode on the BSP (Prarit Bhargava) [1574592]
  - [x86] microcode: Sanitize per-cpu microcode reloading interface (Prarit Bhargava) [1574592]
  - [x86] virt_spec_ctrl: Set correct host SSDB value for AMD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Eliminate TIF_SSBD checks in IBRS on/off functions (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Disable SSBD update from scheduler if not user settable (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Make ssbd_enabled writtable (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Remove thread_info check in __wrmsr_on_cpu() (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Write per-thread SSBD state to spec_ctrl_pcp (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Add a read-only ssbd_enabled debugfs file (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Switch the selection of mitigation from CPU vendor to CPU features (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Add AMD's SPEC_CTRL MSR usage (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Add AMD's variant of SSB_NO (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs/intel: Set proper CPU features and setup RDS (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Rework spec_ctrl base and mask logic (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Rework SPEC_CTRL update after late microcode loading (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Make sync_all_cpus_ibrs() write spec_ctrl_pcp value (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Unify x86_spec_ctrl_{set_guest, restore_host} (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Rework speculative_store_bypass_update() (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Add virtualized speculative store bypass disable support (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM: Rename KVM SPEC_CTRL MSR functions to match upstream (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Handle HT correctly on AMD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Add FEATURE_ZEN (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle SSBD enumeration (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Use synthetic bits for IBRS/IBPB/STIBP (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Fix missing void (Waiman Long) [1584356] {CVE-2018-3639}
  - [documentation] spec_ctrl: Do some minor cleanups (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Make "seccomp" the default mode for Speculative Store Bypass (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Move speculation migitation control to arch code (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Use PR_SPEC_FORCE_DISABLE (Waiman Long) [1584356] {CVE-2018-3639}
  - [uapi] prctl: Add force disable speculation (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Enable speculation flaw mitigations (Waiman Long) [1584356] {CVE-2018-3639}
  - [fs] proc: Provide details on speculation flaw mitigations (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] nospec: Allow getting/setting on non-current task (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Show IBPB in the Spectre_v2 sysfs file (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] pti: Check MSR_IA32_ARCH_CAPABILITIES for Meltdown vulnearability (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up naming of SPEC_CTRL MSR bits with upstream (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] pti: Fix kexec warning on debug kernel (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] kvm/fpu: Enable eager FPU restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] always enable eager FPU by default (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Load xsave pointer *after* initialization (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fix 32-bit signal frame handling (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Always restore_xinit_state() when use_eager_cpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Rename drop_init_fpu() to fpu_reset_state() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fix math_state_restore() race with kernel_fpu_begin() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fold __drop_fpu() into its sole user (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't abuse drop_init_fpu() in flush_thread() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Introduce restore_init_xstate() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Document user_fpu_begin() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Factor out memset(xstate, 0) in fpu_finit() paths (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Change xstateregs_get()/set() to use ->xsave.i387 rather than ->fxsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Always allow FPU in interrupt if use_eager_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't abuse has_fpu in __kernel_fpu_begin/end() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Introduce per-cpu in_kernel_fpu state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Check tsk_used_math() in kernel_fpu_end() for eager FPU (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Change math_error() to use unlazy_fpu(), kill (now) unused save_init_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Merge simd_math_error() into math_error() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't do __thread_fpu_end() if use_eager_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't reset thread.fpu_counter (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: shift drop_init_fpu() from save_xstate_sig() to handle_signal() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Allow FPU to be used at interrupt time even with eagerfpu (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387.c: Initialize thread xstate only on CPU0 only once (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] kvm: fix kvm's usage of kernel_fpu_begin/end() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] rhel: initialize scattered CPUID features early (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: make eagerfpu= boot param tri-state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: enable eagerfpu by default for xsaveopt (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: decouple non-lazy/eager fpu restore from xsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: use non-lazy fpu restore for processors supporting xsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: remove unnecessary user_fpu_end() in save_xstate_sig() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: drop_fpu() before restoring new state from sigframe (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Unify signal handling code paths for x86 and x86_64 kernels (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: drop the fpu state during thread exit (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] signals: ia32_signal.c: add __user casts to fix sparse warnings (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Consolidate inline asm routines for saving/restoring fpu state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] signal: Cleanup ifdefs and is_ia32, is_x32 (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu/xsave: Keep __user annotation in casts (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] debug: Add KERN_<LEVEL> to bare printks, convert printks to pr_<level> (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] extable: Remove open-coded exception table entries in arch/x86/include/asm/xsave.h (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: Split up <asm/i387.h> into exported and internal interfaces (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: Uninline the generic FP helpers that we expose to kernel modules (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: (DON'T ACTUALLY) support lazy restore of FPU state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: use 'restore_fpu_checking()' directly in task switching code (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: fix up some fpu_counter confusion (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: re-introduce FPU state preloading at context switch time (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move TS_USEDFPU flag from thread_info to task_struct (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move AMD K7/K8 fpu fxsave/fxrstor workaround from save to restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: do not preload FPU state at task switch time (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: don't ever touch TS_USEDFPU directly, use helper functions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move TS_USEDFPU clearing out of __save_init_fpu and into callers (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: fix x86-64 preemption-unsafe user stack save/restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: math_state_restore() isn't called from asm (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fix potentially dangerous trailing '; ' in #defined values/expressions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-32, fpu: Fix FPU exception handling on non-SSE systems (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Fix common misspellings (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] kvm: Initialize fpu state in preemptible context (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge fpu_save_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-32, fpu: Rewrite fpu_save_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Remove PSHUFB_XMM5_* macros (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Remove unnecessary ifdefs from i387 code. (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Simplify constraints for fxsave/fxtstor (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Fix cs value in convert_from_fxsr() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Disable preemption when using TS_USEDFPU (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge __save_init_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge tolerant_fwait() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge fpu_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Disable xsave in i387 emulation mode (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Make xstate_enable_boot_cpu() __init, protect on CPU 0 (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Add __init attribute to setup_xstate_features() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Make init_xstate_buf static (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Check cpuid level for XSTATE_CPUID (0x0d) (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Introduce xstate enable functions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Do not include asm/i387.h in asm/xsave.h (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Avoid unnecessary __clear_user() and xrstor in signal handling (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Cleanup return codes in check_for_xstate() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Separate fpu and xsave initialization (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Move boot cpu initialization to xsave_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Revert "[x86] fpu: change save_i387_xstate() to rely on unlazy_fpu()" (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Revert "[x86] fpu: shift clear_used_math() from save_i387_xstate() to handle_signal()" (Paolo Bonzini) [1589047] {CVE-2018-3665}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.2.1.el6]
changelog:
  - [x86] entry/64: Don't use IST entry for #BP stack (Waiman Long) [1596113] {CVE-2018-10872}
  - [fs] gfs2: Flush delayed work earlier in gfs2_inode_lookup (Andreas Grunbacher) [1506281]
  - [mm] mempolicy: fix use after free when calling get_mempolicy (Augusto Caringi) [1576757] {CVE-2018-10675}
  - [mm] Fix NULL pointer dereference in dequeue_hwpoisoned_huge_page() (Larry Woodman) [1381653]
  - [fs] NFSv4.1: Fix up replays of interrupted requests (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Simplify struct nfs4_sequence_args too (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Label each entry in the session slot tables with its slot number (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Shrink struct nfs4_sequence_res by moving the session pointer (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: nfs4_alloc_slots doesn't need zeroing (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: clean up nfs4_recall_slot to use nfs4_alloc_slots (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Fix a NFSv4.1 session initialisation regression (Benjamin Coddington) [1553423]
  - [scsi] ipr: Fix sync scsi scan (Gustavo Duarte) [1572310]
  - [scsi] ipr: Wait to do async scan until scsi host is initialized (Gustavo Duarte) [1572310]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.1.el6]
changelog:
  - [infiniband] ib/iser: Rewrite bounce buffer code path (Don Dutile) [1585312]
  - [sound] alsa: pcm: prevent UAF in snd_pcm_info (CVE-2017-0861) (Jaroslav Kysela) [1565188] {CVE-2017-0861}
  - [sound] alsa: seq: Fix racy pool initializations (Jaroslav Kysela) [1550176] {CVE-2018-7566}
  - [sound] alsa: seq: Fix use-after-free at creating a port (Jaroslav Kysela) [1503383] {CVE-2017-15265}
  - [sound] alsa: seq: Make ioctls race-free (Jaroslav Kysela) [1537452] {CVE-2018-1000004}
  - [mm] reduce total RAM held in per-CPU pvecs by flushing them on compound/THP page arrival (Larry Woodman) [1575819]
  - [usb] acm: fix the computation of the number of data bits (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [misc] spectre: fix gadgets found by smatch scanner, part 2 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] kvm/vmx: Remove barrier_nospec() in slot_largepage_idx() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kvm] Remove memory alias support (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [misc] spectre: fix gadgets found by smatch scanner (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: rme9652: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: opl3: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: hda: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: seq: oss: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: seq: oss: Fix unbalanced use lock for synth MIDI device (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [net] atm: Fix potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] posix-timers: Protect posix clock array access against speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] sys.c: fix potential Spectre v1 issue (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] sched/autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[] (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [ipc] sysvipc/sem: mitigate semnum index against spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: control: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [media] dvb_ca_en50221: prevent using slot_info for Spectre attacs (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - media] dvb_ca_en50221: sanity check slot number from userspace (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [atm] zatm: Fix potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] perf: Fix possible Spectre-v1 indexing for x86_pmu::event_map() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] perf: Fix possible Spectre-v1 indexing for hw_perf_event cache_* (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [net] nl80211: Sanitize array index in parse_txq_params (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] vfs, fdtable: Prevent bounds-check bypass via speculative execution (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] syscall: Sanitize syscall table de-references under speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [powerpc] Use barrier_nospec in copy_from_user() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Introduce barrier_nospec for other arches (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Introduce barrier_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] spectre_v1: Disable compiler optimizations over array_index_mask_nospec() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Implement array_index_mask_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [documentation] Document array_index_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Include <asm/barrier.h> dependency (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Allow index argument to have const-qualified type (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Kill array_index_nospec_mask_check() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Move array_index_nospec() parameter checking into separate macro (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] array_index_nospec: Sanitize speculative array de-references (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] get_user: Use pointer masking to limit speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Introduce __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] reorganize SMAP handling in user space accesses (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] uaccess: Tell the compiler that uaccess is unlikely to fault (Josh Poimboeuf) [1589032] {CVE-2018-3693}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.2.el6]
changelog:
  - [kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301) (Paolo Bonzini) [1601851] {CVE-2018-10901}
  - [x86] Initialize __max_smt_threads to 1 (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: detect SMT disabled by BIOS (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Add topology_max_smt_threads() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix incorrect error return code in vm_insert_pfn() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Don't flush L1D cache if VMENTER_L1D_FLUSH_NEVER (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Take out the unused nosmt module parameter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm/dump_pagetables: Add a check_l1tf debugfs file (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries aganst L1TF for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Make flush_l1d visible in /proc/cpuinfo (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [Documentation] Add section about CPU vulnerabilities (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs, kvm: Introduce boot-time control of L1TF mitigations (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Expose SMT control init function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Online siblings when SMT control is turned on (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add find_msr() helper function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush logic (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Make indirect call speculation safe (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Enable acknowledge interupt on vmexit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D MSR based flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush algorithm (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add module argument for L1TF mitigation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] x86: Introducing kvm_x86_ops VM init/destroy hooks (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] Revert "x86/apic: Ignore secondary threads if nosmt=force" (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpufeatures: Add detection of L1D cache flush support. (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Limit swap file size to MAX_PA/2 (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Add sysfs reporting for l1tf (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PROT_NONE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries against L1TF (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Change order of offset/type in swap entry (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Fix incorrect vulnerabilities files function prototypes (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Export the internal __cpu_bugs variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] intel-family.h: Add GEMINI_LAKE SOC (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Move swap offset/type up in PTE to work around erratum (Waiman Long) [1593376] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.3.el6]
changelog:
  - [x86] syscall: Fix regression when using the last syscall (process_vm_writev) (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [x86] syscall: Fix regression on strace and stap (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.4.el6]
changelog:
  - [x86] x86/mm: Simplify p[g4um]d_page() macros (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Fix regression with huge pages on PAE (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Move PUD_PAGE macros to page_types.h (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rb_to_skb() and other rb tree helpers (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rbnode to struct sk_buff (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Florian Westphal) [1611376] {CVE-2018-5390}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.5.el6]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Frantisek Hrbata) [1593376] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.4.1.el6]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Frantisek Hrbata) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Simplify p[g4um]d_page() macros (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Fix regression with huge pages on PAE (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Move PUD_PAGE macros to page_types.h (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rb_to_skb() and other rb tree helpers (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rbnode to struct sk_buff (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Florian Westphal) [1611376] {CVE-2018-5390}
  - [x86] syscall: Fix regression when using the last syscall (process_vm_writev) (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [x86] syscall: Fix regression on strace and stap (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301) (Paolo Bonzini) [1601851] {CVE-2018-10901}
  - [x86] Initialize __max_smt_threads to 1 (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: detect SMT disabled by BIOS (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Add topology_max_smt_threads() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix incorrect error return code in vm_insert_pfn() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Don't flush L1D cache if VMENTER_L1D_FLUSH_NEVER (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Take out the unused nosmt module parameter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm/dump_pagetables: Add a check_l1tf debugfs file (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries aganst L1TF for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Make flush_l1d visible in /proc/cpuinfo (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [Documentation] Add section about CPU vulnerabilities (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs, kvm: Introduce boot-time control of L1TF mitigations (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Expose SMT control init function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Online siblings when SMT control is turned on (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add find_msr() helper function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush logic (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Make indirect call speculation safe (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Enable acknowledge interupt on vmexit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D MSR based flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush algorithm (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add module argument for L1TF mitigation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] x86: Introducing kvm_x86_ops VM init/destroy hooks (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] Revert "x86/apic: Ignore secondary threads if nosmt=force" (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpufeatures: Add detection of L1D cache flush support. (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Limit swap file size to MAX_PA/2 (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Add sysfs reporting for l1tf (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PROT_NONE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries against L1TF (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Change order of offset/type in swap entry (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Fix incorrect vulnerabilities files function prototypes (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Export the internal __cpu_bugs variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] intel-family.h: Add GEMINI_LAKE SOC (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Move swap offset/type up in PTE to work around erratum (Waiman Long) [1593376] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.5.1.el6]
changelog:
  - [s390] dasd: fix IO error for newly defined devices (Hendrik Brueckner) [1574448]
  - [s390] dasd: fix failing path verification (Hendrik Brueckner) [1581684]
  - [s390] qeth: on channel error, reject further cmd requests (Hendrik Brueckner) [1562009]
  - [s390] qdio: fix access to uninitialized qdio_q fields (Hendrik Brueckner) [1581685]
  - [powerpc] stf-barrier: update (rfi_)enabled_flush_types as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update debugfs as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update handle_ssbd() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update stf_barrier_enable() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: add cpu_show_spec_store_bypass() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: add comment as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: move code from setup_64.c to security.c as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: move code from setup.h to security_features.h as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update fallback routine as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update entry barrier slot as in upstream (Gustavo Duarte) [1585299]
  - [x86] Add host_initiated check in reading MSR_AMD64_VIRT_SPEC_CTRL (Wei Huang) [1608576]
  - [x86] KVM: pass host_initiated to functions that read MSRs (Wei Huang) [1608576]
  - [fs] gfs2: Special-case rindex for gfs2_grow (Robert S Peterson) [1384184]
  - [fs] Revert "[fs] gfs2: Special case the rindex in gfs2_write_alloc_required()" (Robert S Peterson) [1384184]
  - [net] ip: process in-order fragments efficiently (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: add helpers to process in-order fragments faster. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ipv6: defrag: drop non-last frags smaller than min mtu (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: use rb trees for IP frag queue. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: discard IPv4 datagrams with overlapping segments. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] net: modify skb_rbtree_purge to return the truesize of all purged skbs. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] net: speed up skb_rbtree_purge() (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] skbuff: Rename RHEL6 version of skb_tree_purge() to skb_tree_purge_sk() (Stefano Brivio) [1613925] {CVE-2018-5391}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.6.1.el6]
changelog:
  - [x86] set __max_smt_threads for 1 core systems (Prarit Bhargava) [1623255]
  - [md] dm rq: fix a race condition in rq_completed() (Ming Lei) [1574568]
  - [scsi] scsi_transport_fc: Hold queue lock while calling blk_run_queue_async() (Ming Lei) [1574568]
  - [block] Avoid scheduling delayed work on a dead queue (Ming Lei) [1574568]
  - [block] Avoid that request_fn is invoked on a dead queue (Ming Lei) [1574568]
  - [block] Let blk_drain_queue() caller obtain the queue lock (Ming Lei) [1574568]
  - [block] Rename queue dead flag (Ming Lei) [1574568]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.6.2.el6]
changelog:
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625976] {CVE-2018-14634}
  - [fs] exec.c: account for argv/envp pointers (Yauheni Kaliuta) [1625976] {CVE-2018-14634}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-754.6.3.el6]
changelog:
  - [kvm] VMX: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1628796]
  - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1628796]
  - [x86] KVM: VMX: skip L1TF flush on VM-entry if EPT is disabled (Marcelo Tosatti) [1616397]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.7.1.el6]
changelog:
  - [s390] cio: update chpid descriptor after resource accessibility event (Hendrik Brueckner) [1574471]
  - [s390] af_iucv: enable control sends in case of SEND_SHUTDOWN (Hendrik Brueckner) [1559048]
  - [s390] qeth: repair SBAL elements calculation (Hendrik Brueckner) [1559021]
  - [kvm] VMX: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1628796]
  - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1628796]
  - [x86] KVM: VMX: skip L1TF flush on VM-entry if EPT is disabled (Marcelo Tosatti) [1616397]
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625976] {CVE-2018-14634}
  - [fs] exec.c: account for argv/envp pointers (Yauheni Kaliuta) [1625976] {CVE-2018-14634}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.8.1.el6]
changelog:
  - [block] fix warning on lockdep_assert_held(q->queue_lock) (Ming Lei) [1624747]
  - [kvm] vmx: fix vmwrite to invalid VMCS (Radim Krcmar) [1602011]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.10.1.el6]
changelog:
  - [net] sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close (Xin Long) [1646405]
  - [x86] kvm: Update cpuid properly when CR4.OSXAVE or CR4.PKE is changed (Wei Huang) [1425051]
  - [mm] mempolicy: migrate_to_node should only migrate to node (Rafael Aquini) [1577094]
  - [mm] vmscan: avoid possible deadlock caused by too_many_isolated() (Rafael Aquini) [1577094]
  - [fs] seqfile: always allow oom killer (Rodrigo Freire) [1632434]
  - [fs] seq_file: fallback to vmalloc instead of oom kill processes (Rodrigo Freire) [1632434]
  - [fs] seq_file: fallback to vmalloc allocation (Rodrigo Freire) [1632434]
  - [fs] proc/stat: convert to single_open_size() (Rodrigo Freire) [1632434]
  - [fs] seq_file: always clear m->count when we free m->buf (Rodrigo Freire) [1632434]
  - [fs] seq_file: single_open_size() new helper (Rodrigo Freire) [1632434]
  - [fs] stat: Use size_t for sizes instead of unsigned (Rodrigo Freire) [1632434]
  - [fs] proc: speed up /proc/stat handling (Rodrigo Freire) [1632434]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.11.1.el6]
changelog:
  - [x86] mm/fault: Allow stack access below rsp (Waiman Long) [1644401]
  - [sound] alsa: rawmidi: Change resized buffers atomically (Denys Vlasenko) [1593083] {CVE-2018-10902}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.12.1.el6]
changelog:
  - [x86] vDSO: Don't generate retpoline for indirect call (Waiman Long) [1638552]
  - [fs] cifs: fix reparse point/symlink breakage (Leif Sahlberg) [1636484]
  - [scsi] qla2xxx: Mask off Scope bits in retry delay (Himanshu Madhani) [1588133]
  - [net] tcp: make tcp_retransmit_timer a no-op on empty write queue (Paolo Abeni) [1585892]
  - [kernel] sched/sysctl: Check user input value of sysctl_sched_time_avg (Lauro Ramos Venancio) [1579128]
  - [fs] Fix up non-directory creation in SGID directories (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] hugetlbfs: switch to inode_init_owner() (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] udf: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ubifs: replace inode uid, gid, mode initialization with helper function (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ramfs: replace inode uid, gid, mode initialization with helper function (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ext4: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ext3: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ext2: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] btrfs: replace inode uid, gid, mode initialization with helper function (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] vfs: Add inode uid,gid,mode init helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [s390] kernel: adapt to changed CPU vulnerabilities function prototypes (Hendrik Brueckner) [1625381]
  - [s390] detect etoken facility (Hendrik Brueckner) [1625381]
  - [s390] Correct register corruption in critical section cleanup (Hendrik Brueckner) [1625381]
  - [s390] remove indirect branch from do_softirq_own_stack (Hendrik Brueckner) [1625381]
  - [s390] move spectre sysfs attribute code (Hendrik Brueckner) [1625381]
  - [s390] kernel: use expoline for indirect branches (Hendrik Brueckner) [1625381]
  - [s390] ftrace: use expoline for indirect branches (Hendrik Brueckner) [1625381]
  - [s390] move expoline assembler macros to a header (Hendrik Brueckner) [1625381]
  - [s390] correct module section names for expoline code revert (Hendrik Brueckner) [1625381]
  - [x86] speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit (Oleksandr Natalenko) [1670328]
  - [perf] Fix a race between ring_buffer_detach() and ring_buffer_attach() (Jiri Olsa) [1589340]
  - [perf] Fix mmap() accounting hole (Jiri Olsa) [1627672]
  - [perf] Fix perf mmap bugs (Jiri Olsa) [1627672]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.14.2.el6]
changelog:
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kernel] sched/smt: Provide sched_smt_active() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Provide arch_smt_update() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/mm: Fix compilation warning in pgtable_types.h (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.1.el6]
changelog:
  - [x86] x86/speculation: Don't print MDS_MSG_SMT message if mds_nosmt specified (Waiman Long) [1710081 1710517]
  - [x86] x86/spec_ctrl: Fix incorrect MDS handling in late microcode loading (Waiman Long) [1710081 1710517]
  - [x86] x86/speculation: Fix misuse of boot_cpu_has() with bug bits (Waiman Long) [1710121]
  - [x86] x86/speculation/mds: Fix documentation typo (Waiman Long) [1710517]
  - [documentation] Documentation: Correct the possible MDS sysfs values (Waiman Long) [1710517]
  - [x86] x86/mds: Add MDSUM variant to the MDS documentation (Waiman Long) [1710517]
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Waiman Long) [1710517]
  - [x86] x86/speculation/mds: Fix comment (Waiman Long) [1710517]
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kernel] sched/smt: Provide sched_smt_active() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Provide arch_smt_update() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/mm: Fix compilation warning in pgtable_types.h (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.2.el6]
changelog:
  - [lib] idr: free the top layer if idr tree has the maximum height (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix top layer handling (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix backtrack logic in idr_remove_all (Denys Vlasenko) [1698139] {CVE-2019-3896}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.3.el6]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719840] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719585] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719585] {CVE-2019-11477}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.16.1.el6]
changelog:
  - [virt] xenbus: Fix memory leak on release (Vitaly Kuznetsov) [1661666]
  - [fs] dcache: fix locking around setting DCACHE_SHRINKING flag (Miklos Szeredi) [1672269]
  - [x86] KVM: SVM: Selective cr0 intercept (Wei Huang) [1655873]
  - [x86] KVM: SVM: Restore unconditional cr0 intercept under npt (Wei Huang) [1655873]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.17.1.el6]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719840] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719585] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719585] {CVE-2019-11477}
  - [lib] idr: free the top layer if idr tree has the maximum height (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix top layer handling (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix backtrack logic in idr_remove_all (Denys Vlasenko) [1698139] {CVE-2019-3896}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.18.1.el6]
changelog:
  - [virt] xenbus: don't look up transaction IDs for ordinary writes (Vitaly Kuznetsov) [1663262]
  - [virt] xenbus: don't BUG() on user mode induced condition (Vitaly Kuznetsov) [1663262]
  - [virt] xenbus: Add proper handling of XS_ERROR from Xenbus for transactions (Vitaly Kuznetsov) [1663262]
  - [fs] proc: restrict kernel stack dumps to root (Denys Vlasenko) [1638193] {CVE-2018-17972}
  - [crypto] salsa20 - fix blkcipher_walk API usage (Bruno Eduardo de Oliveira Meneguele) [1543984]
  - [mm] vmscan: do not loop on too_many_isolated for ever (Rafael Aquini) [1658254]
  - [x86] spec_ctrl: Don't report the use of retpoline on Skylake as vulnerable (Waiman Long) [1666102]
  - [mm] try harder to allocate vmemmap blocks (Rafael Aquini) [1591394]
  - [v4l] dvb: revert spectre v1 mitigation (Josh Poimboeuf) [1647975]
  - [fs] binfmt_misc.c: do not allow offset overflow (Bill O'Donnell) [1710149]
  - [x86] pti: Don't use PCID and INVPCID in x86-32 (Waiman Long) [1702782]
  - [mm] mincore.c: make mincore() more conservative (Rafael Aquini) [1664197] {CVE-2019-5489}
  - [x86] spec: Move retp_compiler() inline function to bugs.c (Waiman Long) [1722185]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.18.2.el6]
changelog:
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.19.1.el6]
changelog:
  - [net] tcp: be more careful in tcp_fragment() (Marcelo Leitner) [1732107]
  - [net] tcp: refine memory limit test in tcp_fragment() (Florian Westphal) [1728931]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.20.1.el6]
changelog:
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.21.1.el6]
changelog:
  - [scsi] scsi: megaraid_sas: return error when create DMA pool failed (Tomas Henzl) [1712858] {CVE-2019-11810}
  - [net] net: Set sk_prot_creator when copying sockets to the right proto (Andrea Claudi) [1657117] {CVE-2018-9568}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.24.1.el6]
changelog:
  - [net] ip: Don't leak head fragment on queue timeout (Stefano Brivio) [1752536]
  - [vhost] vhost_net: fix possible infinite loop (Eugenio Perez) [1702941]
  - [vhost] vhost: introduce vhost_exceeds_weight() (Eugenio Perez) [1702941]
  - [vhost] vhost_net: introduce vhost_exceeds_weight() (Eugenio Perez) [1702941]
  - [vhost] vhost_net: use packet weight for rx handler, too (Eugenio Perez) [1702941]
  - [vhost] vhost-net: set packet weight of tx polling to 2 * vq size (Eugenio Perez) [1702941]
  - [x86] x86/pti: Fix incorrect global bit setting with PTI on (Waiman Long) [1645724]
  - [x86] spec_ctrl: disable IBRS in idle, part 2 (Rafael Aquini) [1560787]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.24.2.el6]
changelog:
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [kvm] KVM: introduce no_huge_pages module parameter (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86/spec_ctrl/taa: Enable TAA status change after late microcode (Waiman Long) [1766531] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766531] {CVE-2019-11135}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Disable read-only support under GVT (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] erm/i915/gtt: Read-only pages for insert_entries on bdw+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Add read only pages to gen8_pte_encode (Dave Airlie) [1756891] {CVE-2019-0155}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.25.1.el6]
changelog:
  - [kvm] KVM: VMX: Set VMENTER_L1D_FLUSH_NOT_REQUIRED if !X86_BUG_L1TF (Waiman Long) [1733760]
  - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746799] {CVE-2019-14821}
  - [virt] KVM: MMIO: Lock coalesced device when checking for available entry (Bandan Das) [1746799] {CVE-2019-14821}
  - [scsi] scsi: bnx2fc: Handle scope bits when array returns BUSY or TSF (Nilesh Javali) [1749512]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'task', 'port', 'orig_task' (Nilesh Javali) [1749512]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'lport', 'host' (Nilesh Javali) [1749512]
  - [security] KEYS: prevent creating a different user's keyrings (David Howells) [1537371]
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [kvm] KVM: introduce no_huge_pages module parameter (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86/spec_ctrl/taa: Enable TAA status change after late microcode (Waiman Long) [1766531] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766531] {CVE-2019-11135}
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Denys Vlasenko) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Disable read-only support under GVT (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] erm/i915/gtt: Read-only pages for insert_entries on bdw+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Add read only pages to gen8_pte_encode (Dave Airlie) [1756891] {CVE-2019-0155}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.26.1.el6]
changelog:
  - [s390] scsi: zfcp: fix reaction on bit error threshold notification (Philipp Rudo) [1764544]
  - [drm] vmwgfx: refuse to hibernate if we have any resources v2 (Kenneth Yin) [1748195]
  - [fs] CIFS: avoid using MID 0xFFFF (Leif Sahlberg) [1739948]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.27.1.el6]
changelog:
  - [mm] mempolicy: fix a memory corruption by refcount imbalance in alloc_pages_vma() (Waiman Long) [1785321]


author: Dmitry Mishin <dim-at-openvz.org> 3.0.9-1
changelog:
  - added README and NEWS files
  - deleted debian directory (requested by debian package maintainers)
  - fixed compilation on ppc64 platform.


author: Andy Shevchenko <andriy@asplinux.com.ua> - 3.0.9-1
changelog:
  - fixed according to Fedora Packaging Guidelines:
    - use dist tag
    - removed Vendor tag
    - added URL tag
    - use full url for source
    - changed BuildRoot tag


author: Kir Kolyshkin <kir@openvz.org> - 3.1-1
changelog:
  - New functionality:
  - * vzdqdump, vzdqload: add -F to dump/load first level quotas
  - Fixes:
  - * Make ext4 delalloc work with vzquota (#2035)
  - * fix quota init fail then run from deleted directory
  - * fix building with fresh toolchain (#1357 etc.)
  - * skip quota file locking on 'vzquota show' action
  - * fix to work with more than 1 TB quotas
  - * correct exit code in case quota file does not exist
  - * minor code style fixes
  - * whitespace cleanups
  - Improvements:
  - * quota on: more info on failed quota on with EEXIST
  - * quota off: enable detailed info on fail by default
  - * quota off: add processing EIO
  - * man/*: assorted fixes and formatting improvements
  - * man/vzquota: minor improvements (#2310)
  - * vzdqdump, vzdqload: fix typo in usage
  - * Makefile: Don't strip executable, respect LDFLAGS (#1191)


author: Kir Kolyshkin <kir@openvz.org> - 0.2.1-1
changelog:
  - fixed compatibility with older (as of RHEL5/4) userspace
  - stricter checks for scripts permission and ownership


author: Kir Kolyshkin <kir@openvz.org> - 0.3.1-1
changelog:
  - add options --help, --view, --enable, --disable and --status
  - add vzstats(8) man page
  - add lsbrelease script
  - improve vzlist script to work with older vzctl releases
  - add proxy discovery code
  - add bash_completion script


author: Kir Kolyshkin <kir@openvz.org> - 0.4-1
changelog:
  - added top-ps script
  - fix vzversion-arch for openvz kernel names (#2596)
  - make sure sbin paths are in PATH before running scripts
  - exit with error if run inside CT
  - increased curl timeout from 3s to 10s
  - vzstats.spec: run trigger in background
  - Makefile: support for configurable paths (see Makefile.paths)
  - Makefile: substitute version from spec to script
  - Makefile: add install-all target, use it from spec


author: Kir Kolyshkin <kir@openvz.org> - 0.5-1
changelog:
  - enabled SSL when sending reports to stats.openvz.org
  - removed lspci script
  - bin/top-ps: add --quiet to vzctl exec
  - increased curl timeout to 30s


author: Kir Kolyshkin <kir@openvz.org> - 0.5.3-1
changelog:
  - vzstats.conf should not be executable (#2758)
  - Scripts shall start with hash-bang (#2757)
  - added pstorage packages


author: Jethro Carr <jethro.carr@amberdms.com> 4.6.2-git20100325-1
changelog:
  - Created custom package for wkhtmltopdf customised version of wkhtmltopdf based on SPEC written by RedHat for RHEL 5


author: Jethro Carr <jethro.carr@amberdms.com> 4.6.3-git2010820-1
changelog:
  - Upgraded to QT 4.6.3
  - Added further customisations from wkhtmltopdf project to support release 0.9.9 of wkhtmltopdf


author: Sérgio Basto <sergio@serjux.com> - 0.140-1.20140122gitde0bc36
changelog:
  - Update to 0.140 git de0bc36 (stable branch)
  - drop visualize options, ./configure doesn't have --enable-visualize or --disable-visualize, 
  anymore


author: Sérgio Basto <sergio@serjux.com> - 0.140-2.20140122gitde0bc36
changelog:
  - bootstrap x264 to avoid: 
    /usr/bin/ld: warning: libx264.so.138, needed by
    /usr/lib/gcc/x86_64-redhat-linux/4.8.2/../../../../lib64/libavcodec.so, may conflict with
    libx264.so.140


author: Matt Wringe <mwringe@redhat.com> 1:1.2-0.1.20060226svn.0jpp.ep1.1
changelog:
  - Update to xml-commons-resolver12
  - Due to potential incompatibility issues between resolver 1.1 and
    1.2 this package will not replacing xml-commons-resolver for RHEL5.
    Since the RHEL4 and RHEL5 EAP packages will be the same, this package
    will also be called resolver12 in EAP.


author: Dominik Mierzejewski <rpm at greysector.net> - 1.2.0-1
changelog:
  - 1.2.0
  - drop upstreamed noexec stack patch
  - BR recent nasm instead of yasm
  - licence seems to be just GPLv2+
  - move TODO from main to -devel doc
  - update summary and description
  - small spec file fixes


author: jeffrey.ness@rackspace.com - 0.2.5-1.ius
changelog:
  - Attempt to auto resolve when multiple provides are found
    https://github.com/iuscommunity/yum-plugin-replace/issues/2


author: Ben Harper <ben.harper@rackspace.com> - 0.2.6-1.ius
changelog:
  - pulling in https://github.com/iuscommunity/yum-plugin-replace/pull/4
  - pulling in https://github.com/iuscommunity/yum-plugin-replace/pull/5


author: Kodai Terashima <kodai.terashima@zabbix.com> - 2.4.3-1
changelog:
  - update to 2.4.3
  - fix proxy configuration file name for systemd service file
  - Compile with Jave 6 for RHEL 6
  - fix status parameter of init scripts


author: Kodai Terashima <kodai.terashima@zabbix.com> - 2.4.6-1
changelog:
  - update to 2.4.6
  - remove carriage return for pidfile
  - fix insecure permission error of logrotate for rhel7


author: Kodai Terashima <kodai.terashima@zabbix.com> - 3.0.1-2
changelog:
  - fix proxy packges doesn't have schema.sql.gz
  - add server and web packages for RHEL6
  - add ZBX-10459.patch


author: Kodai Terashima <kodai.terashima@zabbix.com> - 3.0.5-1
changelog:
  - update to 3.0.5
  - use zabbix user and group for Java Gateway
  - add SuccessExitStatus=143 for Java Gateway servie file


author: Vladimir Levijev <vladimir.levijev@zabbix.com> - 3.2.10-1
changelog:
  - update to 3.2.10
  - fix issue with new line character in pid file that resulted in failure when shutting down daemons on RHEL 5


author: Kodai Terashima <kodai.terashima@zabbix.com> - 3.2.1-1
changelog:
  - update to 3.2.1
  - use zabbix user and group for Java Gateway
  - add SuccessExitStatus=143 for Java Gateway servie file


author: Kodai Terashima <kodai.terashima@zabbix.com> - 3.2.1-1
changelog:
  - update to 3.2.1
  - use zabbix user and group for Java Gateway
  - add SuccessExitStatus=143 for Java Gateway service file


author: Vladimir Levijev <vladimir.levijev@zabbix.com> - 3.4.4-1
changelog:
  - update to 3.4.4
  - fix issue with new line character in pid file that resulted in failure when shutting down daemons on RHEL 5


author: Zabbix Packager <info@zabbix.com> - 6.0.38-release3
changelog:
  - added java-gateway patch for amnz2023
  - added java-gateway-openjdk* packages on el8 (ZBX-25947)
  - replaced java-gateway dependency with java-11-openjdk on el8


author: Zabbix Packager <info@zabbix.com> - 4.4.0-0.1alpha1
changelog:
  - update to 4.4.0alpha1
  - removed apache config from zabbix-web package
  - added dedicated zabbix-apache-conf and zabbix-nginx-conf packages


author: Zabbix Packager <info@zabbix.com> - 4.4.0-0.2alpha2
changelog:
  - update to 4.4.0alpha2
  - using google-noto-sans-cjk-ttc-fonts for graphfont in web-japanese package on rhel-8
  - added php-fpm as dependency of zabbix-web packages on rhel-8


author: Zabbix Packager <info@zabbix.com> - 4.4.5-1
changelog:
  - update to 4.4.5
  - added zabbix-js package
  - moved /etc/zabbix/zabbix_agentd.d/userparameter_mysql.conf file to /usr/share/doc/zabbix-agent-<vers>/ (ZBX-14399)
  - using zabbix-agent2.service instead of zabbix-agent.service in agent2 preun
  - setting user for zabbix agent in /etc/sysconfig/zabbix-agent file on rhel <= 6


author: Zabbix Packager <info@zabbix.com> - 4.4.5-2
changelog:
  - added posttrans script that preserves /etc/zabbix/zabbix_agentd.d/userparameter_mysql.conf file
  - added config(noreplace) to /etc/sysconfig/zabbix-agent


author: Zabbix Packager <info@zabbix.com> - 4.4.6-1
changelog:
  - update to 4.4.6
  - using libssh instead of libssh2 on rhel/centos 8
  - fixed font configuration in pre/post scriptlets on rhel-8


author: Zabbix Packager <info@zabbix.com> - 4.4.9-1
changelog:
  - update to 4.4.9
  - changed mysql build dependency on rhel/centos-8 from mysql-devel to mariadb-connector-c-devel (ZBX-17738)
  - added patch that fixes (ZBX-17801)


