# changelog

author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-38.el9]
changelog:
  - x86/fpu/signal: Initialize sw_bytes in save_xstate_epilog() (David Arcari) [2004190]
  - iommu/vt-d: Remove unused PASID_DISABLED (David Arcari) [2004190]
  - Add CONFIG_STRICT_SIGALTSTACK_SIZE (David Arcari) [2004190]
  - selftests/x86/amx: Add context switch test (David Arcari) [2004190]
  - selftests/x86/amx: Add test cases for AMX state management (David Arcari) [2004190]
  - x86/signal: Use fpu::__state_user_size for sigalt stack validation (David Arcari) [2004190]
  - x86/signal: Implement sigaltstack size validation (David Arcari) [2004190]
  - signal: Add an optional check for altstack size (David Arcari) [2004190]
  - tools arch x86: Sync the msr-index.h copy with the kernel sources (David Arcari) [2004190]
  - tools headers cpufeatures: Sync with the kernel sources (David Arcari) [2004190]
  - tools headers UAPI: Sync arch prctl headers with the kernel sources (David Arcari) [2004190]
  - x86/fpu: Optimize out sigframe xfeatures when in init state (David Arcari) [2004190]
  - Documentation/x86: Add documentation for using dynamic XSTATE features (David Arcari) [2004190]
  - x86/fpu: Include vmalloc.h for vzalloc() (David Arcari) [2004190]
  - x86/fpu/amx: Enable the AMX feature in 64-bit mode (David Arcari) [2004190]
  - x86/msr-index: Add MSRs for XFD (David Arcari) [2004190]
  - x86/cpufeatures: Add eXtended Feature Disabling (XFD) feature bit (David Arcari) [2004190]
  - x86/fpu: Add XFD handling for dynamic states (David Arcari) [2004190]
  - x86/fpu: Calculate the default sizes independently (David Arcari) [2004190]
  - x86/fpu/amx: Define AMX state components and have it used for boot-time checks (David Arcari) [2004190]
  - x86/fpu/xstate: Prepare XSAVE feature table for gaps in state component numbers (David Arcari) [2004190]
  - x86/fpu/xstate: Add fpstate_realloc()/free() (David Arcari) [2004190]
  - x86/fpu/xstate: Add XFD #NM handler (David Arcari) [2004190]
  - x86/fpu: Update XFD state where required (David Arcari) [2004190]
  - x86/fpu: Add sanity checks for XFD (David Arcari) [2004190]
  - x86/fpu: Add XFD state to fpstate (David Arcari) [2004190]
  - x86/fpu: Reset permission and fpstate on exec() (David Arcari) [2004190]
  - x86/fpu: Prepare fpu_clone() for dynamically enabled features (David Arcari) [2004190]
  - x86/process: Clone FPU in copy_thread() (David Arcari) [2004190]
  - x86/fpu/signal: Prepare for variable sigframe length (David Arcari) [2004190]
  - x86/fpu: Add basic helpers for dynamically enabled features (David Arcari) [2004190]
  - x86/arch_prctl: Add controls for dynamic XSTATE components (David Arcari) [2004190]
  - x86/fpu: Add fpu_state_config::legacy_features (David Arcari) [2004190]
  - x86/fpu: Add members to struct fpu to cache permission information (David Arcari) [2004190]
  - x86/fpu/xstate: Provide xstate_calculate_size() (David Arcari) [2004190]
  - x86/fpu: Remove old KVM FPU interface (David Arcari) [2004190]
  - x86/kvm: Convert FPU handling to a single swap buffer (David Arcari) [2004190]
  - x86/fpu: Provide infrastructure for KVM FPU cleanup (David Arcari) [2004190]
  - x86/fpu: Prepare for sanitizing KVM FPU code (David Arcari) [2004190]
  - x86/fpu/xstate: Move remaining xfeature helpers to core (David Arcari) [2004190]
  - x86/fpu: Rework restore_regs_from_fpstate() (David Arcari) [2004190]
  - x86/fpu: Mop up xfeatures_mask_uabi() (David Arcari) [2004190]
  - x86/fpu: Move xstate feature masks to fpu_*_cfg (David Arcari) [2004190]
  - x86/fpu: Move xstate size to fpu_*_cfg (David Arcari) [2004190]
  - x86/fpu/xstate: Cleanup size calculations (David Arcari) [2004190]
  - x86/fpu: Cleanup fpu__init_system_xstate_size_legacy() (David Arcari) [2004190]
  - x86/fpu: Provide struct fpu_config (David Arcari) [2004190]
  - x86/fpu/signal: Use fpstate for size and features (David Arcari) [2004190]
  - x86/fpu/xstate: Use fpstate for copy_uabi_to_xstate() (David Arcari) [2004190]
  - x86/fpu: Use fpstate in __copy_xstate_to_uabi_buf() (David Arcari) [2004190]
  - x86/fpu: Use fpstate in fpu_copy_kvm_uabi_to_fpstate() (David Arcari) [2004190]
  - x86/fpu/xstate: Use fpstate for xsave_to_user_sigframe() (David Arcari) [2004190]
  - x86/fpu/xstate: Use fpstate for os_xsave() (David Arcari) [2004190]
  - x86/fpu: Use fpstate::size (David Arcari) [2004190]
  - x86/fpu: Add size and mask information to fpstate (David Arcari) [2004190]
  - x86/process: Move arch_thread_struct_whitelist() out of line (David Arcari) [2004190]
  - x86/fpu: Remove fpu::state (David Arcari) [2004190]
  - x86/KVM: Convert to fpstate (David Arcari) [2004190]
  - x86/math-emu: Convert to fpstate (David Arcari) [2004190]
  - x86/fpu/core: Convert to fpstate (David Arcari) [2004190]
  - x86/fpu/signal: Convert to fpstate (David Arcari) [2004190]
  - x86/fpu/regset: Convert to fpstate (David Arcari) [2004190]
  - x86/fpu: Convert tracing to fpstate (David Arcari) [2004190]
  - x86/fpu: Replace KVMs xstate component clearing (David Arcari) [2004190]
  - x86/fpu: Convert restore_fpregs_from_fpstate() to struct fpstate (David Arcari) [2004190]
  - x86/fpu: Convert fpstate_init() to struct fpstate (David Arcari) [2004190]
  - x86/fpu: Provide struct fpstate (David Arcari) [2004190]
  - x86/fpu: Replace KVMs home brewed FPU copy to user (David Arcari) [2004190]
  - x86/fpu: Provide a proper function for ex_handler_fprestore() (David Arcari) [2004190]
  - x86/fpu: Replace the includes of fpu/internal.h (David Arcari) [2004190]
  - x86/fpu: Mop up the internal.h leftovers (David Arcari) [2004190]
  - x86/fpu: Remove internal.h dependency from fpu/signal.h (David Arcari) [2004190]
  - x86/fpu: Move fpstate functions to api.h (David Arcari) [2004190]
  - x86/fpu: Move mxcsr related code to core (David Arcari) [2004190]
  - x86/sev: Include fpu/xcr.h (David Arcari) [2004190]
  - x86/fpu: Move fpregs_restore_userregs() to core (David Arcari) [2004190]
  - x86/fpu: Make WARN_ON_FPU() private (David Arcari) [2004190]
  - x86/fpu: Move legacy ASM wrappers to core (David Arcari) [2004190]
  - x86/fpu: Move os_xsave() and os_xrstor() to core (David Arcari) [2004190]
  - x86/fpu: Make os_xrstor_booting() private (David Arcari) [2004190]
  - x86/fpu: Clean up CPU feature tests (David Arcari) [2004190]
  - x86/fpu: Move context switch and exit to user inlines into sched.h (David Arcari) [2004190]
  - x86/fpu: Mark fpu__init_prepare_fx_sw_frame() as __init (David Arcari) [2004190]
  - x86/fpu: Rework copy_xstate_to_uabi_buf() (David Arcari) [2004190]
  - x86/fpu: Replace KVMs home brewed FPU copy from user (David Arcari) [2004190]
  - x86/fpu: Move KVMs FPU swapping to FPU core (David Arcari) [2004190]
  - x86/fpu/xstate: Mark all init only functions __init (David Arcari) [2004190]
  - x86/fpu/xstate: Provide and use for_each_xfeature() (David Arcari) [2004190]
  - x86/fpu: Cleanup xstate xcomp_bv initialization (David Arcari) [2004190]
  - x86/fpu: Do not inherit FPU context for kernel and IO worker threads (David Arcari) [2004190]
  - x86/fpu: Remove pointless memset in fpu_clone() (David Arcari) [2004190]
  - x86/fpu: Cleanup the on_boot_cpu clutter (David Arcari) [2004190]
  - x86/fpu: Restrict xsaves()/xrstors() to independent states (David Arcari) [2004190]
  - x86/fpu: Update stale comments (David Arcari) [2004190]
  - x86/fpu: Remove pointless argument from switch_fpu_finish() (David Arcari) [2004190]
  - iommu/vt-d: Clean up unused PASID updating functions (David Arcari) [2004190]
  - x86/fpu: Mask out the invalid MXCSR bits properly (David Arcari) [2004190]
  - x86/fpu: Restore the masking out of reserved MXCSR bits (David Arcari) [2004190]
  - x86/fpu/signal: Fix missed conversion to correct boolean retval in save_xstate_epilog() (David Arcari) [2004190]
  - x86/fpu/signal: Change return code of restore_fpregs_from_user() to boolean (David Arcari) [2004190]
  - x86/fpu/signal: Change return code of check_xstate_in_sigframe() to boolean (David Arcari) [2004190]
  - x86/fpu/signal: Change return type of __fpu_restore_sig() to boolean (David Arcari) [2004190]
  - x86/fpu/signal: Change return type of fpu__restore_sig() to boolean (David Arcari) [2004190]
  - x86/signal: Change return type of restore_sigcontext() to boolean (David Arcari) [2004190]
  - x86/fpu/signal: Change return type of copy_fpregs_to_sigframe() helpers to boolean (David Arcari) [2004190]
  - x86/fpu/signal: Change return type of copy_fpstate_to_sigframe() to boolean (David Arcari) [2004190]
  - x86/fpu/signal: Move xstate clearing out of copy_fpregs_to_sigframe() (David Arcari) [2004190]
  - x86/fpu/signal: Move header zeroing out of xsave_to_user_sigframe() (David Arcari) [2004190]
  - x86/fpu/signal: Clarify exception handling in restore_fpregs_from_user() (David Arcari) [2004190]
  - x86/fpu: Use EX_TYPE_FAULT_MCE_SAFE for exception fixups (David Arcari) [2004190]
  - x86/extable: Provide EX_TYPE_DEFAULT_MCE_SAFE and EX_TYPE_FAULT_MCE_SAFE (David Arcari) [2004190]
  - x86/extable: Rework the exception table mechanics (David Arcari) [2004190]
  - x86/mce: Deduplicate exception handling (David Arcari) [2004190]
  - x86/extable: Get rid of redundant macros (David Arcari) [2004190]
  - x86/extable: Tidy up redundant handler functions (David Arcari) [2004190]


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-39.el9]
changelog:
  - cpuidle: pseries: Do not cap the CEDE0 latency in fixup_cede0_latency() (Gustavo Walbon) [2029870]
  - cpuidle: pseries: Fixup CEDE0 latency only for POWER10 onwards (Gustavo Walbon) [2029870]
  - powerpc/mce: Fix access error in mce handler (Gustavo Walbon) [2027829]
  - powerpc/pseries/mobility: ignore ibm, platform-facilities updates (Gustavo Walbon) [2023438]
  - KVM: SVM: Do not terminate SEV-ES guests on GHCB validation failure (Vitaly Kuznetsov) [1961151]
  - KVM: SEV: Fall back to vmalloc for SEV-ES scratch area if necessary (Vitaly Kuznetsov) [1961151]
  - KVM: SEV: Return appropriate error codes if SEV-ES scratch setup fails (Vitaly Kuznetsov) [1961151]
  - KVM: SEV: Refactor out sev_es_state struct (Vitaly Kuznetsov) [1961151]
  - redhat/configs: enable DWARF5 feature if toolchain supports it (Lianbo Jiang) [2009205]
  - init: make unknown command line param message clearer (Andrew Halaney) [2004361]
  - Bluetooth: btusb: Add one more Bluetooth part for WCN6855 (Gopal Tiwari) [2020943]
  - Bluetooth: btusb: Add the new support IDs for WCN6855 (Gopal Tiwari) [2020943]
  - Bluetooth: btusb: re-definition for board_id in struct qca_version (Gopal Tiwari) [2020943]
  - Bluetooth: btusb: Add support using different nvm for variant WCN6855 controller (Gopal Tiwari) [2020943]
  - cgroup: Make rebind_subsystems() disable v2 controllers all at once (Waiman Long) [1986734]
  - bnxt_en: Event handler for PPS events (Ken Cox) [1990151]
  - bnxt_en: 1PPS functions to configure TSIO pins (Ken Cox) [1990151]
  - bnxt_en: 1PPS support for 5750X family chips (Ken Cox) [1990151]
  - bnxt_en: Do not read the PTP PHC during chip reset (Ken Cox) [1990151]
  - bnxt_en: Move bnxt_ptp_init() from bnxt_open() back to bnxt_init_one() (Ken Cox) [1990151]


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-40.el9]
changelog:
  - cpu/hotplug: Remove deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - livepatch: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - coresight: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - hwmon: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - tracing: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - padata: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - crypto: virtio - Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - platform/x86: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - powerpc: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - x86/mce/inject: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - x86/microcode: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - x86/mtrr: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - x86/mmiotrace: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - workqueue: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - net/iucv: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - s390/sclp: replace deprecated CPU-hotplug functions (Prarit Bhargava) [2023079]
  - s390: replace deprecated CPU-hotplug functions (Prarit Bhargava) [2023079]
  - net: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - virtio_net: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - ACPI: processor: Replace deprecated CPU-hotplug functions (Prarit Bhargava) [2023079]
  - PM: sleep: s2idle: Replace deprecated CPU-hotplug functions (Prarit Bhargava) [2023079]
  - cpufreq: Replace deprecated CPU-hotplug functions (Prarit Bhargava) [2023079]
  - powercap: intel_rapl: Replace deprecated CPU-hotplug functions (Prarit Bhargava) [2023079]
  - sgi-xpc: Replace deprecated CPU-hotplug functions. (Prarit Bhargava) [2023079]
  - Input: i8042 - Add quirk for Fujitsu Lifebook T725 (Neal Gompa) [2019937]
  - sctp: remove unreachable code from sctp_sf_violation_chunk() (Xin Long) [2024909]
  - sctp: return true only for pathmtu update in sctp_transport_pl_toobig (Xin Long) [2024909]
  - sctp: subtract sctphdr len in sctp_transport_pl_hlen (Xin Long) [2024909]
  - sctp: reset probe_timer in sctp_transport_pl_update (Xin Long) [2024909]
  - sctp: allow IP fragmentation when PLPMTUD enters Error state (Xin Long) [2024909]
  - sctp: fix transport encap_port update in sctp_vtag_verify (Xin Long) [2024909]
  - sctp: account stream padding length for reconf chunk (Xin Long) [2024909]
  - sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb (Xin Long) [2024909]
  - sctp: add vtag check in sctp_sf_ootb (Xin Long) [2003494] {CVE-2021-3772}
  - sctp: add vtag check in sctp_sf_do_8_5_1_E_sa (Xin Long) [2003494] {CVE-2021-3772}
  - sctp: add vtag check in sctp_sf_violation (Xin Long) [2003494] {CVE-2021-3772}
  - sctp: fix the processing for COOKIE_ECHO chunk (Xin Long) [2003494] {CVE-2021-3772}
  - sctp: fix the processing for INIT_ACK chunk (Xin Long) [2003494] {CVE-2021-3772}
  - sctp: fix the processing for INIT chunk (Xin Long) [2003494] {CVE-2021-3772}
  - sctp: use init_tag from inithdr for ABORT chunk (Xin Long) [2003494] {CVE-2021-3772}
  - drm/nouveau: clean up all clients on device removal (Karol Herbst) [1911185] {CVE-2020-27820}
  - drm/nouveau: Add a dedicated mutex for the clients list (Karol Herbst) [1911185] {CVE-2020-27820}
  - drm/nouveau: use drm_dev_unplug() during device removal (Karol Herbst) [1911185] {CVE-2020-27820}
  - redhat/configs: NFS: disable UDP, insecure enctypes (Benjamin Coddington) [1952863]


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-41.el9]
changelog:
  - af_unix: Return errno instead of NULL in unix_create1(). (Balazs Nemeth) [2030037]
  - s390/ftrace: remove preempt_disable()/preempt_enable() pair (Wander Lairson Costa) [1938117]
  - ftrace: do CPU checking after preemption disabled (Wander Lairson Costa) [1938117]
  - ftrace: disable preemption when recursion locked (Wander Lairson Costa) [1938117]
  - redhat: build and include memfd to kernel-selftests-internal (Aristeu Rozanski) [2027506]
  - netfilter: flowtable: fix IPv6 tunnel addr match (Florian Westphal) [2028203]
  - netfilter: ipvs: Fix reuse connection if RS weight is 0 (Florian Westphal) [2028203]
  - netfilter: ctnetlink: do not erase error code with EINVAL (Florian Westphal) [2028203]
  - netfilter: ctnetlink: fix filtering with CTA_TUPLE_REPLY (Florian Westphal) [2028203]
  - netfilter: nfnetlink_queue: fix OOB when mac header was cleared (Florian Westphal) [2028203]
  - netfilter: core: Fix clang warnings about unused static inlines (Florian Westphal) [2028203]
  - netfilter: nft_dynset: relax superfluous check on set updates (Florian Westphal) [2028203]
  - netfilter: nf_tables: skip netdev events generated on netns removal (Florian Westphal) [2028203]
  - netfilter: Kconfig: use 'default y' instead of 'm' for bool config option (Florian Westphal) [2028203]
  - netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value (Florian Westphal) [2028203]
  - netfilter: nf_tables: honor NLM_F_CREATE and NLM_F_EXCL in event notification (Florian Westphal) [2028203]
  - netfilter: nf_tables: reverse order in rule replacement expansion (Florian Westphal) [2028203]
  - netfilter: nf_tables: add position handle in event notification (Florian Westphal) [2028203]
  - netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1 (Florian Westphal) [2028203]
  - netfilter: log: work around missing softdep backend module (Florian Westphal) [2028203]
  - netfilter: nf_tables: unlink table before deleting it (Florian Westphal) [2028203]
  - ipvs: check that ip_vs_conn_tab_bits is between 8 and 20 (Florian Westphal) [2028203]
  - netfilter: nft_ct: protect nft_ct_pcpu_template_refcnt with mutex (Florian Westphal) [2028203]
  - netfilter: ipvs: make global sysctl readonly in non-init netns (Antoine Tenart) [2008417]
  - net/sched: sch_ets: don't remove idle classes from the round-robin list (Davide Caratti) [2025552]
  - net/sched: store the last executed chain also for clsact egress (Davide Caratti) [2025552]
  - net: sched: act_mirred: drop dst for the direction from egress to ingress (Davide Caratti) [2025552]
  - net/sched: sch_ets: don't peek at classes beyond 'nbands' (Davide Caratti) [2025552]
  - net/sched: sch_ets: properly init all active DRR list handles (Davide Caratti) [2025552]
  - net: Fix offloading indirect devices dependency on qdisc order creation (Davide Caratti) [2025552]
  - net/core: Remove unused field from struct flow_indr_dev (Davide Caratti) [2025552]
  - net/sched: sch_taprio: fix undefined behavior in ktime_mono_to_any (Davide Caratti) [2025552]
  - net/sched: act_ct: Fix byte count on fragmented packets (Davide Caratti) [2025552]
  - mqprio: Correct stats in mqprio_dump_class_stats(). (Davide Caratti) [2025552]
  - net/sched: sch_taprio: properly cancel timer from taprio_destroy() (Davide Caratti) [2025552]
  - net_sched: fix NULL deref in fifo_set_limit() (Davide Caratti) [2025552]
  - net: sched: flower: protect fl_walk() with rcu (Davide Caratti) [2025552]
  - fq_codel: reject silly quantum parameters (Davide Caratti) [2025552]
  - net: sched: Fix qdisc_rate_table refcount leak when get tcf_block failed (Davide Caratti) [2025552]
  - sch_htb: Fix inconsistency when leaf qdisc creation fails (Davide Caratti) [2025552]
  - redhat/configs: Add two new CONFIGs (Prarit Bhargava) [2022993]
  - redhat/configs: Remove dead CONFIG files (Prarit Bhargava) [2022993]
  - redhat/configs/evaluate_configs: Add find dead configs option (Prarit Bhargava) [2022993]


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-42.el9]
changelog:
  - scsi: smartpqi: Update version to 2.1.12-055 (Don Brace) [1869853]
  - scsi: smartpqi: Add 3252-8i PCI id (Don Brace) [1869853]
  - scsi: smartpqi: Fix duplicate device nodes for tape changers (Don Brace) [1869853]
  - scsi: smartpqi: Fix boot failure during LUN rebuild (Don Brace) [1869853]
  - scsi: smartpqi: Add extended report physical LUNs (Don Brace) [1869853]
  - scsi: smartpqi: Avoid failing I/Os for offline devices (Don Brace) [1869853]
  - scsi: smartpqi: Add TEST UNIT READY check for SANITIZE operation (Don Brace) [1869853]
  - scsi: smartpqi: Update LUN reset handler (Don Brace) [1869853]
  - scsi: smartpqi: Capture controller reason codes (Don Brace) [1869853]
  - scsi: smartpqi: Add controller handshake during kdump (Don Brace) [1869853]
  - scsi: smartpqi: Update device removal management (Don Brace) [1869853]
  - scsi: smartpqi: Replace one-element array with flexible-array member (Don Brace) [1869853]
  - scsi: smartpqi: Fix an error code in pqi_get_raid_map() (Don Brace) [1869853]
  - scsi: smartpqi: Update version to 2.1.10-020 (Don Brace) [1869853]
  - scsi: smartpqi: Fix ISR accessing uninitialized data (Don Brace) [1869853]
  - scsi: smartpqi: Add PCI IDs for new ZTE controllers (Don Brace) [1869853]
  - scsi: smartpqi: Add PCI ID for new ntcom controller (Don Brace) [1869853]
  - scsi: smartpqi: Add SCSI cmd info for resets (Don Brace) [1869853]
  - scsi: smartpqi: Change Kconfig menu entry to Microchip (Don Brace) [1869853]
  - scsi: smartpqi: Change driver module macros to Microchip (Don Brace) [1869853]
  - scsi: smartpqi: Update copyright notices (Don Brace) [1869853]
  - scsi: smartpqi: Add PCI IDs for H3C P4408 controllers (Don Brace) [1869853]
  - powerpc/module_64: Fix livepatching for RO modules (Joe Lawrence) [2019205]
  - net-sysfs: try not to restart the syscall if it will fail eventually (Antoine Tenart) [2030634]
  - CI: Enable realtime checks for baselines (Veronika Kabatova)
  - CI: Cleanup residue from ARK (Veronika Kabatova)
  - redhat: ignore ksamples and kselftests on the badfuncs rpminspect test (Herton R. Krzesinski)
  - redhat: disable upstream check for rpminspect (Herton R. Krzesinski)
  - redhat/configs: Enable CONFIG_CRYPTO_BLAKE2B (Neal Gompa) [2031547]
  - selftests: netfilter: switch zone stress to socat (Florian Westphal) [2030759]
  - netfilter: conntrack: set on IPS_ASSURED if flows enters internal stream state (Florian Westphal) [2030759]
  - netfilter: conntrack: serialize hash resizes and cleanups (Florian Westphal) [2030759]
  - selftests: netfilter: add zone stress test with colliding tuples (Florian Westphal) [2030759]
  - selftests: netfilter: add selftest for directional zone support (Florian Westphal) [2030759]
  - netfilter: conntrack: include zone id in tuple hash again (Florian Westphal) [2030759]
  - netfilter: conntrack: make max chain length random (Florian Westphal) [2030759]
  - netfilter: refuse insertion if chain has grown too large (Florian Westphal) [2030759]
  - netfilter: conntrack: switch to siphash (Florian Westphal) [2030759]
  - netfilter: conntrack: sanitize table size default settings (Florian Westphal) [2030759]
  - redhat: configs: increase CONFIG_DEBUG_KMEMLEAK_MEM_POOL_SIZE (Rafael Aquini) [2008118]
  - iommu/dma: Fix incorrect error return on iommu deferred attach (Jerry Snitselaar) [2030394]
  - RDMA/siw: Mark Software iWARP Driver as tech-preview (Kamal Heib) [2023416]
  - genirq: Fix kernel doc indentation (Prarit Bhargava) [2023084]
  - genirq: Change force_irqthreads to a static key (Prarit Bhargava) [2023084]
  - genirq: Clarify documentation for request_threaded_irq() (Prarit Bhargava) [2023084]


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-43.el9]
changelog:
  - mm: COW: restore full accuracy in page reuse (Andrea Arcangeli) [1958742]
  - mm: thp: replace the page lock with the seqlock for the THP mapcount (Andrea Arcangeli) [1958742]
  - mm: COW: skip the page lock in the COW copy path (Andrea Arcangeli) [1958742]
  - mm: gup: gup_must_unshare() use can_read_pin_swap_page() (Andrea Arcangeli) [1958742]
  - mm: hugetlbfs: gup: gup_must_unshare(): enable hugetlbfs (Andrea Arcangeli) [1958742]
  - mm: hugetlbfs: FOLL_FAULT_UNSHARE (Andrea Arcangeli) [1958742]
  - mm: hugetlbfs: COR: copy-on-read fault (Andrea Arcangeli) [1958742]
  - mm: gup: FOLL_UNSHARE RHEL (Andrea Arcangeli) [1958742]
  - mm: gup: FOLL_NOUNSHARE: optimize follow_page (Andrea Arcangeli) [1958742]
  - mm: gup: FOLL_UNSHARE (Andrea Arcangeli) [1958742]
  - mm: gup: gup_must_unshare() (Andrea Arcangeli) [1958742]
  - mm: gup: COR: copy-on-read fault (Andrea Arcangeli) [1958742]
  - mm: thp: introduce page_trans_huge_anon_shared (Andrea Arcangeli) [1958742]
  - mm: thp: stabilize the THP mapcount in page_remove_anon_compound_rmap (Andrea Arcangeli) [1958742]
  - mm: thp: make the THP mapcount atomic with a seqlock (Andrea Arcangeli) [1958742]
  - mm: thp: consolidate mapcount logic on THP split (David Hildenbrand) [1958742]
  - powerpc/xive: Change IRQ domain to a tree domain (Daniel Henrique Barboza) [2008723]
  - tcp: fix page frag corruption on page fault (Paolo Abeni) [2028276]
  - sock: fix /proc/net/sockstat underflow in sk_clone_lock() (Paolo Abeni) [2028276]
  - net: add and use skb_unclone_keeptruesize() helper (Paolo Abeni) [2028276]
  - net: stream: don't purge sk_error_queue in sk_stream_kill_queues() (Paolo Abeni) [2028276]
  - net, neigh: Fix NTF_EXT_LEARNED in combination with NTF_USE (Paolo Abeni) [2028276]
  - net-sysfs: initialize uid and gid before calling net_ns_get_ownership (Paolo Abeni) [2028276]
  - net: Prevent infinite while loop in skb_tx_hash() (Paolo Abeni) [2028276]
  - napi: fix race inside napi_enable (Paolo Abeni) [2028276]
  - skb_expand_head() adjust skb->truesize incorrectly (Paolo Abeni) [2028276]
  - bpf: use skb_expand_head in bpf_out_neigh_v4/6 (Paolo Abeni) [2028276]
  - ax25: use skb_expand_head (Paolo Abeni) [2028276]
  - vrf: fix NULL dereference in vrf_finish_output() (Paolo Abeni) [2028276]
  - vrf: use skb_expand_head in vrf_finish_output (Paolo Abeni) [2028276]
  - ipv4: use skb_expand_head in ip_finish_output2 (Paolo Abeni) [2028276]
  - ipv6: use skb_expand_head in ip6_xmit (Paolo Abeni) [2028276]
  - ipv6: use skb_expand_head in ip6_finish_output2 (Paolo Abeni) [2028276]
  - skbuff: introduce skb_expand_head() (Paolo Abeni) [2028276]
  - net/af_unix: fix a data-race in unix_dgram_poll (Paolo Abeni) [2028276]
  - net: don't unconditionally copy_from_user a struct ifreq for socket ioctls (Paolo Abeni) [2028276]
  - devlink: Clear whole devlink_flash_notify struct (Paolo Abeni) [2028276]
  - devlink: Break parameter notification sequence to be before/after unload/load driver (Paolo Abeni) [2028276]
  - vhost_net: fix OoB on sendmsg() failure. (Paolo Abeni) [2026821]
  - printk: restore flushing of NMI buffers on remote CPUs after NMI backtraces (Prarit Bhargava) [2023082]
  - lib/nmi_backtrace: Serialize even messages about idle CPUs (Prarit Bhargava) [2023082]
  - printk: syslog: close window between wait and read (Prarit Bhargava) [2023082]
  - printk: convert @syslog_lock to mutex (Prarit Bhargava) [2023082]
  - printk: remove NMI tracking (Prarit Bhargava) [2023082]
  - printk: remove safe buffers (Prarit Bhargava) [2023082]
  - printk: track/limit recursion (Prarit Bhargava) [2023082]
  - lib/nmi_backtrace: explicitly serialize banner and regs (Prarit Bhargava) [2023082]


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-44.el9]
changelog:
  - dm btree remove: fix use after free in rebalance_children() (Benjamin Marzinski) [2031198]
  - dm table: log table creation error code (Benjamin Marzinski) [2031198]
  - dm: make workqueue names device-specific (Benjamin Marzinski) [2031198]
  - dm writecache: Make use of the helper macro kthread_run() (Benjamin Marzinski) [2031198]
  - dm crypt: Make use of the helper macro kthread_run() (Benjamin Marzinski) [2031198]
  - dm: Remove redundant flush_workqueue() calls (Benjamin Marzinski) [2031198]
  - dm crypt: log aead integrity violations to audit subsystem (Benjamin Marzinski) [2031198]
  - dm integrity: log audit events for dm-integrity target (Benjamin Marzinski) [2031198]
  - dm: introduce audit event module for device mapper (Benjamin Marzinski) [2031198]
  - dm: fix mempool NULL pointer race when completing IO (Benjamin Marzinski) [2031198]
  - dm rq: don't queue request to blk-mq during DM suspend (Benjamin Marzinski) [2031198]
  - dm clone: make array 'descs' static (Benjamin Marzinski) [2031198]
  - dm verity: skip redundant verity_handle_err() on I/O errors (Benjamin Marzinski) [2031198]
  - dm crypt: use in_hardirq() instead of deprecated in_irq() (Benjamin Marzinski) [2031198]
  - dm ima: update dm documentation for ima measurement support (Benjamin Marzinski) [2031198]
  - dm ima: update dm target attributes for ima measurements (Benjamin Marzinski) [2031198]
  - dm ima: add a warning in dm_init if duplicate ima events are not measured (Benjamin Marzinski) [2031198]
  - dm ima: prefix ima event name related to device mapper with dm_ (Benjamin Marzinski) [2031198]
  - dm ima: add version info to dm related events in ima log (Benjamin Marzinski) [2031198]
  - dm ima: prefix dm table hashes in ima log with hash algorithm (Benjamin Marzinski) [2031198]
  - dm crypt: Avoid percpu_counter spinlock contention in crypt_page_alloc() (Benjamin Marzinski) [2031198]
  - dm: add documentation for IMA measurement support (Benjamin Marzinski) [2031198]
  - dm: update target status functions to support IMA measurement (Benjamin Marzinski) [2031198]
  - dm ima: measure data on device rename (Benjamin Marzinski) [2031198]
  - dm ima: measure data on table clear (Benjamin Marzinski) [2031198]
  - dm ima: measure data on device remove (Benjamin Marzinski) [2031198]
  - dm ima: measure data on device resume (Benjamin Marzinski) [2031198]
  - dm ima: measure data on table load (Benjamin Marzinski) [2031198]
  - dm writecache: add event counters (Benjamin Marzinski) [2031198]
  - dm writecache: report invalid return from writecache_map helpers (Benjamin Marzinski) [2031198]
  - dm writecache: further writecache_map() cleanup (Benjamin Marzinski) [2031198]
  - dm writecache: factor out writecache_map_remap_origin() (Benjamin Marzinski) [2031198]
  - dm writecache: split up writecache_map() to improve code readability (Benjamin Marzinski) [2031198]
  - redhat: Pull in openssl-devel as a build dependency correctly (Neal Gompa) [2034670]
  - redhat/configs: Enable ThinkLMI support (Mark Pearson) [2030770]
  - platform/x86: think-lmi: Abort probe on analyze failure (Mark Pearson) [2030770]
  - platform/x86: think-lmi: add debug_cmd (Mark Pearson) [2030770]
  - include/linux/timer.h: Pad timer_list struct for KABI (Prarit Bhargava) [2034452]
  - kernel: Include RHEL Ecosystem message (Prarit Bhargava) [2033650]
  - include/linux/ioport.h: Pad resource struct for KABI (Prarit Bhargava) [2033475]
  - include/linux/hrtimer.h: Pad hrtimer struct for KABI (Prarit Bhargava) [2033473]
  - redhat/configs: Add explicit values for ZRAM_DEF_COMP_LZ4* configs (Neal Gompa) [2032758]
  - redhat/configs: Enable CONFIG_CRYPTO_ZSTD (Neal Gompa) [2032758]
  - redhat/configs: Migrate defaults for ZRAM from pending-common to common (Neal Gompa) [2032758]
  - Enable iSER on s390x (Stefan Schulze Frielinghaus) [1965279]


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-45.el9]
changelog:
  - workqueue, kasan: avoid alloc_pages() when recording stack (Phil Auld) [2022894]
  - kasan: generic: introduce kasan_record_aux_stack_noalloc() (Phil Auld) [2022894]
  - kasan: common: provide can_alloc in kasan_save_stack() (Phil Auld) [2022894]
  - lib/stackdepot: introduce __stack_depot_save() (Phil Auld) [2022894]
  - lib/stackdepot: remove unused function argument (Phil Auld) [2022894]
  - lib/stackdepot: include gfp.h (Phil Auld) [2022894]
  - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Phil Auld) [2022894]
  - workqueue: make sysfs of unbound kworker cpumask more clever (Phil Auld) [2022894]
  - workqueue: fix state-dump console deadlock (Phil Auld) [2022894]
  - workqueue: Remove unused WORK_NO_COLOR (Phil Auld) [2022894]
  - workqueue: Assign a color to barrier work items (Phil Auld) [2022894]
  - workqueue: Mark barrier work with WORK_STRUCT_INACTIVE (Phil Auld) [2022894]
  - workqueue: Change the code of calculating work_flags in insert_wq_barrier() (Phil Auld) [2022894]
  - workqueue: Change arguement of pwq_dec_nr_in_flight() (Phil Auld) [2022894]
  - workqueue: Rename "delayed" (delayed by active management) to "inactive" (Phil Auld) [2022894]
  - workqueue: Replace deprecated ida_simple_*() with ida_alloc()/ida_free() (Phil Auld) [2022894]
  - workqueue: Fix typo in comments (Phil Auld) [2022894]
  - workqueue: Fix possible memory leaks in wq_numa_init() (Phil Auld) [2022894]
  - nvme: avoid race in shutdown namespace removal (Ewan D. Milne) [2014529]
  - powerpc/xmon: Dump XIVE information for online-only processors. (Steve Best) [2037642]
  - ipv4: make exception cache less predictible (Antoine Tenart) [2015112] {CVE-2021-20322}
  - [s390] s390/cio: make ccw_device_dma_* more robust (Claudio Imbrenda) [1997541]
  - [s390] s390/pci: add s390_iommu_aperture kernel parameter (Claudio Imbrenda) [2034134]
  - [s390] s390/pci: fix zpci_zdev_put() on reserve (Claudio Imbrenda) [2034132]
  - [s390] s390/pci: cleanup resources only if necessary (Claudio Imbrenda) [2034132]
  - [s390] s390/sclp: fix Secure-IPL facility detection (Claudio Imbrenda) [2034116]
  - Revert "[redhat] Generate a crashkernel.default for each kernel build" (Coiby Xu) [2034490]
  - ibmvnic: Process crqs after enabling interrupts (Diego Domingos) [2020021]
  - ibmvnic: delay complete() (Diego Domingos) [2020021]
  - ibmvnic: don't stop queue in xmit (Diego Domingos) [2019988]
  - bpf/selftests: disable test failing on RHEL9 (Viktor Malik) [2006315]
  - bpf/selftests: disable a verifier test for powerpc (Viktor Malik) [2032734]
  - bpf/selftests: allow disabling tests (Viktor Malik) [2036656]
  - kernel/crash_core: suppress unknown crashkernel parameter warning (Philipp Rudo) [2026570]
  - mm/vmalloc: do not adjust the search size for alignment overhead (David Hildenbrand) [2029493]
  - Bluetooth: fix use-after-free error in lock_sock_nested() (Gopal Tiwari) [2005691]
  - lib: zstd: Don't add -O3 to cflags (Neal Gompa) [2034834]
  - lib: zstd: Don't inline functions in zstd_opt.c (Neal Gompa) [2034834]
  - lib: zstd: Fix unused variable warning (Neal Gompa) [2034834]
  - lib: zstd: Add cast to silence clang's -Wbitwise-instead-of-logical (Neal Gompa) [2034834]
  - MAINTAINERS: Add maintainer entry for zstd (Neal Gompa) [2034834]
  - lib: zstd: Upgrade to latest upstream zstd version 1.4.10 (Neal Gompa) [2034834]
  - lib: zstd: Add decompress_sources.h for decompress_unzstd (Neal Gompa) [2034834]
  - lib: zstd: Add kernel-specific API (Neal Gompa) [2034834]


author: Neal Gompa <ngompa@centosproject.org> [5.14.0-45.hs1.el9]
changelog:
  - redhat/configs: Disable fbdev drivers and use simpledrm instead (Javier Martinez Canillas) [1986223]
  - drm: simpledrm: fix wrong unit with pixel clock (Javier Martinez Canillas) [1986223]
  - drm: fb_helper: improve CONFIG_FB dependency (Javier Martinez Canillas) [1986223]
  - drm: fb_helper: fix CONFIG_FB dependency (Javier Martinez Canillas) [1986223]
  - drivers/firmware: fix SYSFB depends to prevent build failures (Javier Martinez Canillas) [1986223]
  - drivers/firmware: consolidate EFI framebuffer setup for all arches (Javier Martinez Canillas) [1986223]
  - drivers/firmware: move x86 Generic System Framebuffers support (Javier Martinez Canillas) [1986223]
  - redhat/configs: Enable the Btrfs file system (Neal Gompa)


author: Nicola Sella <nsella@redhat.com> - 0.16.2-1
changelog:
  - Update to 0.16.2
  - Add module metadata support to createrepo_c (RhBug:1795936)
  - Fix various memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.17.2-1
changelog:
  - Update to 0.17.2
  - Fix Python deprecation (PY_SSIZE_T_CLEAN) (RhBug:1891785)
  - Revert back to old c API for destination file of cr_compress_file_with_stat and cr_compress_file to prevent a memory leak
  - Disable drpm for RHEL >= 9 (RhBug:1914828)
  - Setting updated/issued_date to None doesn't produce garbage values (RhBug:1921715)
  - Allow taking __repr__ (__str__) of closed xmlfile and sqlite (RhBug:1913465)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.17.7-1
changelog:
  - Update to 0.17.7
  - Remove insecure hashes SHA-1 and MD5 from the default build (RhBug:1935486)
  - Fix error when updating repo with removed modules metadata
  - Exit with status code 1 when loading of repo's metadata fails
  - Fix memory leaks (RhBug:1998426)
  - Fix valgrind warnings caused by subprocess calls


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.17.7-4
changelog:
  - Switch default of --keep-all-metadata to TRUE and add --discard-additional-metadata (RhBug:1992209)


author: Nicola Sella <nsella@redhat.com> - 4.4.2-4
changelog:
  - `dnf history` operations that work with comps correctly
  - Remove sourcepackages from install/upgrade set
  - Fix documentation of globs not supporting curly brackets


author: Nicola Sella <nsella@redhat.com> - 4.4.2-7
changelog:
  - Make log rotated permissions match initial log permissions (RhBug:1894344)
  - Add new attribute for Package - from_repo
  - Change behaviour of Package().from_repo
  - Package: add a get_header() method


author: Nicola Sella <nsella@redhat.com> - 4.4.2-8
changelog:
  - Add api function: fill_sack_from_repos_in_cache (RhBug:1865803)
  - Add tests and docs for fill_sack_from_repos_in_cache (RhBug:1865803)
  - Run tests for fill_sack_from_repos_in_cache in installroot


author: Pavla Kratochvilova <pkratoch@redhat.com> - 4.7.0-1
changelog:
  - Update to 4.7.0
  - New optional parameter for filter_modules enables following modular obsoletes based on a config option module_obsoletes
  - Fix module remove --all when no match spec (RhBug:1904490)
  - Make an error message more informative (RhBug:1814831)
  - Expand history to full term size when output is redirected (RhBug:1852577) (RhBug:1852577,1906970)
  - Print additional information when verifying GPG key using DNS
  - Enhanced detection of plugins removed in transaction (RhBug:1929163)
  - Improve repo config path ordering to fix a comps merging issue (RhBug:1928181)
  - Keep reason when package is removed (RhBug:1921063)
  - Improve mechanism for application of security filters (RhBug:1918475)
  - [API] Add new method for reset of security filters
  - Remove hardcoded logfile permissions (RhBug:1910084)
  - Preserve file mode during log rotation (RhBug:1910084)
  - Increase loglevel in case of invalid config options
  - Prevent traceback (catch ValueError) if pkg is from cmdline
  - Check for specific key string when verifing signatures (RhBug:1915990)
  - Use rpmkeys binary to verify package signature (RhBug:1915990)
  - [doc] Improve description of modular filtering
  - [doc] deprecated alias for dnf repoquery --deplist <deplist_option-label>
  - [doc] Describe install with just a name and obsoletes (RhBug:1902279)
  - [doc] Fix: "sslcacert" contains path to the file
  - [doc] Added proxy ssl configuration options, increase libdnf require
  - [doc] Update documentation for module_obsoletes and module_stream_switch
  - [doc] Improve documentation for Hotfix repositories
  - [doc] fix: "makecache" command downloads only enabled repositories
  - [doc] Add info that maximum parallel downloads is 20
  - [doc] installonly_limit documentation follows behavior
  - [doc] Add documentation for config option sslverifystatus (RhBug:1814383)
  - The noroot plugin no longer exists, remove mention


author: Pavla Kratochvilova <pkratoch@redhat.com> - 4.7.0-4
changelog:
  - Add fail_fast parameter to _download_remote_payloads() method
  - Throw CompsError when a group or environment is not found for the install methods
  - Respect cacheonly in python dnf API (RhBug:1862970)
  - [doc] Improve description of multilib_policy=all (RhBug:1996681,1995630)
  - [doc] Document default colors


author: Lukas Hrazky <lhrazky@redhat.com> - 4.7.0-8
changelog:
  - Add documentation for query api flags
  - Fix processing of download errors
  - Fix history undo on a Reason Change
  - Fix remove when no repos are enabled
  - Improve "proxy" configuration option documentation


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.0-1
changelog:
  - Update to 0.62.0
  - Hardening: add signature check with rpmcliVerifySignatures (RhBug:1932079)
  - Support allow_vendor_change setting in dnf context API
  - Add a new option module_obsoletes
  - Add new API applyObsoletes() function to apply modular obsoletes
  - Do not allow 1 as installonly_limit value (RhBug:1926261)
  - Add a config option to check TLS certificate revocation status (using OCSP stapling), defaults to false (RhBug:1814383)
  - Swdb: Add a method to get the current transaction
  - [context,API] Functions for accessing main/global configuration options
  - [context,API] Function for adding setopt
  - Add getter for modular obsoletes from ModuleMetadata
  - Add ModulePackage.getStaticContext() and getRequires()
  - Fix modular queries with the new solver
  - Fix: Fully set ssl in newHandle function
  - [conf] Add options for working with certificates used with proxy
  - Modify module NSVCA parsing - context definition (RhBug:1926771)
  - [context] Fix: dnf_package_is_installonly (RhBug:1928056)
  - Add getApplicablePackages to advisory and isApplicable to advisorymodule
  - Keep isAdvisoryApplicable to preserve API
  - [context] Support config file option "proxy_auth_method", defaults "any"
  - Support main config file options "installonlypkgs" and "protected_packages". Changes behaviour of microdnf and PackageKit.
  - Properly handle multiple collections in updateinfo.xml (RhBug:1804234)
  - Fix a crash when [media] section in .treeinfo is missing for bootable media (RhBug:1946024)
  - Add new dnf_context_module_install() C API


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.0-2
changelog:
  - Fix: dnf_context_module_install: memory leaks
  - covscan: remove unused vars, mark private func static, return values
  - DNF does not fail on non UTF-8 file names in a package


author: Matthew Almond <malmond@fb.com> 0.0.1-3
changelog:
  - Separated package into top level "dnf-plugin-cow" concept with implementation
    "python3-dnf-plugin-cow". This allows for "libdnf-plugin-cow" later without
    renaming this package.


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-15
changelog:
  - Add out-of-bounds checks to hdrblobInit() (#1929445)
  - Fixes CVE-2021-20266
  - Fix regression in brp-strip causing kmods to lose SecureBoot sig (#1967291)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-16
changelog:
  - Add support for read-only sqlite rpmdb (#1938928)
  - Drop compat .decode() method from returned Py3 strings (#1840142)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-20
changelog:
  - Add --path query option (#1940895)
  - Macroize find-debuginfo script location (#2019540)
  - Validate and require subkey binding sigs on PGP pubkeys (#1958480)
  - Fixes CVE-2021-3521


author: Manu Bretelle <chantra@fb.com> - 4.14.3-21.2
changelog:
  - Include PR1534
  - Rebase PR1470 on top of PR1534
  - Include support to validate signature while transcoding file


author: Manu Bretelle <chantra@fb.com> - 4.14.3-21.6
changelog:
  - Make `rpm -i` work without `--nodigest`
  - Remove need of executable stack for reflink plugin
  - Split RPM CoW diffs in individual patches


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-22
changelog:
  - Fix spurious %transfiletriggerpostun execution (#2023693)
  - Skip recorded symlinks in --setperms (#1900662)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-12
changelog:
  - Bump up the limit of signature header to 64MB (#1918777)
  - Add fapolicyd plugin (#1923167)
  - Unblock signals in forked scriptlets (#1913765)
  - Fix ambiguous diagnostics output on file triggers (#1883338)
  - Ensure ELF files get stripped when debuginfo is disabled (#1634084)


author: Michal Domonkos <mdomonko@redhat.com> - 4.14.3-13
changelog:
  - Fix minor issues found by COVSCAN in fapolicyd plugin
  - Actually honor libarchive bcond at configure time (#1902887)


