SUSE-SU-2018:0213-1

The SUSE Linux Enterprise 12 SP2 Realtime kernel was updated to 4.4.104 to receive various security and bugfixes.

This update adds mitigations for various side channel attacks against modern CPUs that could disclose content of otherwise unreadable memory (bnc#1068032).

• CVE-2017-5753: Local attackers on systems with modern CPUs featuring deep instruction pipelining could use attacker controllable speculative execution over code patterns in the Linux Kernel to leak content from otherwise not readable memory in the same address space, allowing retrieval of passwords, cryptographic keys and other secrets.

  This problem is mitigated by adding speculative fencing on affected code paths throughout the Linux kernel.

• CVE-2017-5715: Local attackers on systems with modern CPUs featuring branch prediction could use mispredicted branches to speculatively execute code patterns that in turn could be made to leak other non-readable content in the same address space, an attack similar to CVE-2017-5753.

  This problem is mitigated by disabling predictive branches, depending on CPU architecture either by firmware updates and/or fixes in the user-kernel privilege boundaries.

  This is done with help of Linux Kernel fixes on the Intel/AMD x8664 architectures. On x8664, this requires also updates of the CPU microcode packages, delivered in seperate updates.

  As this feature can have a performance impact, it can be disabled using the 'nospec' kernel commandline option.

• CVE-2017-5754: Local attackers on systems with modern CPUs featuring deep instruction pipelining could use code patterns in userspace to speculative executive code that would read otherwise read protected memory, an attack similar to CVE-2017-5753.

  This problem is mitigated by unmapping the Linux Kernel from the user address space during user code execution, following a approach called 'KAISER'. The terms used here are 'KAISER' / 'Kernel Address Isolation' and 'PTI' / 'Page Table Isolation'.

The following security bugs were fixed:

• CVE-2017-1000405: The Linux Kernel versions had a problematic use of pmdmkdirty() in the touchpmd() function inside the THP implementation. touchpmd() can be reached by getuserpages(). In such case, the pmd will become dirty. This scenario breaks the new canfollowwritepmd()'s logic - pmd can become dirty without going through a COW cycle. This bug is not as severe as the original 'Dirty cow' because an ext4 file (or any other regular file) cannot be mapped using THP. Nevertheless, it did allow us to overwrite read-only huge pages. For example, the zero huge page and sealed shmem files can be overwritten (since their mapping can be populated using THP). Note that after the first write page-fault to the zero page, it will be replaced with a new fresh (and zeroed) thp (bnc#1069496).
• CVE-2017-1000410: The Linux kernel was affected by a vulnerability that lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages. (bnc#1070535).
• CVE-2017-11600: net/xfrm/xfrmpolicy.c in the Linux kernel did not ensure that the dir value of xfrmuserpolicyid is XFRMPOLICYMAX or less, which allowed local users to cause a denial of service (out-of-bounds access) or possibly have unspecified other impact via an XFRMMSG_MIGRATE xfrm Netlink message (bnc#1050231).
• CVE-2017-12193: The assocarrayinsertintoterminalnode function in lib/assocarray.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (bnc#1066192).
• CVE-2017-15115: The sctpdopeeloff function in net/sctp/socket.c in the Linux kernel did not check whether the intended netns is used in a peel-off action, which allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via crafted system calls (bnc#1068671).
• CVE-2017-16528: sound/core/seqdevice.c in the Linux kernel allowed local users to cause a denial of service (sndrawmididevseq_free use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066629).
• CVE-2017-16536: The cx231xxusbprobe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606).
• CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573).
• CVE-2017-16645: The imspcugetcdcuniondesc function in drivers/input/misc/ims-pcu.c in the Linux kernel allowed local users to cause a denial of service (imspcuparsecdc_data out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067132).
• CVE-2017-16646: drivers/media/usb/dvb-usb/dib0700_devices.c in the Linux kernel allowed local users to cause a denial of service (BUG and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067105).
• CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrmuser.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SORCVBUF setsockopt system call in conjunction with XFRMMSGGETPOLICY Netlink messages (bnc#1069702).
• CVE-2017-16994: The walkhugetlbrange function in mm/pagewalk.c in the Linux kernel mishandled holes in hugetlb ranges, which allowed local users to obtain sensitive information from uninitialized kernel memory via crafted use of the mincore() system call (bnc#1069996).
• CVE-2017-17448: net/netfilter/nfnetlinkcthelper.c in the Linux kernel did not require the CAPNETADMIN capability for new, get, and del operations, which allowed local users to bypass intended access restrictions because the nfnlcthelper_list data structure is shared across all net namespaces (bnc#1071693).
• CVE-2017-17449: The _netlinkdelivertapskb function in net/netlink/afnetlink.c in the Linux kernel did not restrict observations of Netlink messages to a single net namespace, which allowed local users to obtain sensitive information by leveraging the CAPNET_ADMIN capability to sniff an nlmon interface for all Netlink activity on the system (bnc#1071694).
• CVE-2017-17450: net/netfilter/xtosf.c in the Linux kernel did not require the CAPNETADMIN capability for addcallback and removecallback operations, which allowed local users to bypass intended access restrictions because the xtosf_fingers data structure is shared across all net namespaces (bnc#1071695).
• CVE-2017-17805: The Salsa20 encryption algorithm in the Linux kernel did not correctly handle zero-length inputs, allowing a local attacker able to use the AFALG-based skcipher interface (CONFIGCRYPTOUSERAPISKCIPHER) to cause a denial of service (uninitialized-memory free and kernel crash) or have unspecified other impact by executing a crafted sequence of system calls that use the blkcipherwalk API. Both the generic implementation (crypto/salsa20generic.c) and x86 implementation (arch/x86/crypto/salsa20glue.c) of Salsa20 were vulnerable (bnc#1073792).
• CVE-2017-17806: The HMAC implementation (crypto/hmac.c) in the Linux kernel did not validate that the underlying cryptographic hash algorithm is unkeyed, allowing a local attacker able to use the AFALG-based hash interface (CONFIGCRYPTOUSERAPIHASH) and the SHA-3 hash algorithm (CONFIGCRYPTO_SHA3) to cause a kernel stack buffer overflow by executing a crafted sequence of system calls that encounter a missing SHA-3 initialization (bnc#1073874).
• CVE-2017-7482: Fixed an overflow when decoding a krb5 principal. (bnc#1046107).
• CVE-2017-8824: The dccpdisconnect function in net/dccp/proto.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via an AFUNSPEC connect system call during the DCCP_LISTEN state (bnc#1070771).

The following non-security bugs were fixed:

• Add undefine uniquebuild_ids (bsc#964063)
• adm80211: return an error if adm8211allocrings() fails (bsc#1031717).
• adv7604: Initialize drive strength to default when using DT (bnc#1012382).
• afnetlink: ensure that NLMSGDONE never fails in dumps (bnc#1012382).
• alsa: hda - Add HP ZBook 15u G3 Conexant CX20724 GPIO mute leds (bsc#1031717).
• alsa: hda - Add MICNOPRESENCE fixup for 2 HP machines (bsc#1031717).
• alsa: hda - Add mute led support for HP EliteBook 840 G3 (bsc#1031717).
• alsa: hda - Add mute led support for HP ProBook 440 G4 (bsc#1031717).
• alsa: hda: Add Raven PCI ID (bnc#1012382).
• alsa: hda - add support for docking station for HP 820 G2 (bsc#1031717).
• alsa: hda - add support for docking station for HP 840 G3 (bsc#1031717).
• alsa: hda - Apply ALC269FIXUPNOSHUTUP on HDAFIXUPACTPROBE (bnc#1012382).
• alsa: hda/ca0132 - Fix memory leak at error path (bsc#1031717).
• alsa: hda - change the location for one mic on a Lenovo machine (bsc#1031717).
• alsa: hda: Drop useless WARN_ON() (bsc#1031717).
• alsa: hda - Fix click noises on Samsung Ativ Book 8 (bsc#1031717).
• alsa: hda - fix headset mic detection issue on a Dell machine (bsc#1031717).
• alsa: hda - fix headset mic problem for Dell machines with alc236 (bnc#1012382).
• alsa: hda - fix headset mic problem for Dell machines with alc274 (bsc#1031717).
• alsa: hda - Fix headset microphone detection for ASUS N551 and N751 (bsc#1031717).
• alsa: hda - Fix mic regression by ASRock mobo fixup (bsc#1031717).
• alsa: hda - Fix missing COEF init for ALC225/295/299 (bsc#1031717).
• alsa: hda - Fix surround output pins for ASRock B150M mobo (bsc#1031717).
• alsa: hda - No loopback on ALC299 codec (git-fixes).
• alsa: hda - On-board speaker fixup on ACER Veriton (bsc#1031717).
• alsa: hda/realtek - Add ALC256 HP depop function (bsc#1031717).
• alsa: hda/realtek - Add default procedure for suspend and resume state (bsc#1031717).
• alsa: hda/realtek: Add headset mic support for Intel NUC Skull Canyon (bsc#1031717).
• alsa: hda/realtek - Add new codec ID ALC299 (bnc#1012382).
• alsa: hda/realtek - Add support for Acer Aspire E5-475 headset mic (bsc#1031717).
• alsa: hda/realtek - Add support for ALC1220 (bsc#1031717).
• alsa: hda/realtek - Add support for ALC236/ALC3204 (bnc#1012382).
• alsa: hda/realtek - Add support for headset MIC for ALC622 (bsc#1031717).
• alsa: hda/realtek - ALC891 headset mode for Dell (bsc#1031717).
• alsa: hda/realtek - change the location for one of two front microphones (bsc#1031717).
• alsa: hda/realtek - Enable jack detection function for Intel ALC700 (bsc#1031717).
• alsa: hda/realtek - Fix ALC275 no sound issue (bsc#1031717).
• alsa: hda/realtek - Fix ALC700 family no sound issue (bsc#1031717).
• alsa: hda/realtek - Fix Dell AIO LineOut issue (bsc#1031717).
• alsa: hda/realtek - Fix headset and mic on several Asus laptops with ALC256 (bsc#1031717).
• alsa: hda/realtek - Fix headset mic and speaker on Asus X441SA/X441UV (bsc#1031717).
• alsa: hda/realtek - fix headset mic detection for MSI MS-B120 (bsc#1031717).
• alsa: hda/realtek - Fix headset mic on several Asus laptops with ALC255 (bsc#1031717).
• alsa: hda/realtek - Fix pincfg for Dell XPS 13 9370 (bsc#1031717).
• alsa: hda/realtek - Fix speaker support for Asus AiO ZN270IE (bsc#1031717).
• alsa: hda/realtek - Fix typo of pincfg for Dell quirk (bsc#1031717).
• alsa: hda/realtek - New codec device ID for ALC1220 (bsc#1031717).
• alsa: hda/realtek - New codecs support for ALC215/ALC285/ALC289 (bsc#1031717).
• alsa: hda/realtek - New codec support for ALC257 (bsc#1031717).
• alsa: hda/realtek - New codec support of ALC1220 (bsc#1031717).
• alsa: hda/realtek - No loopback on ALC225/ALC295 codec (bsc#1031717).
• alsa: hda/realtek - Remove ALC285 device ID (bsc#1031717).
• alsa: hda/realtek - Support Dell headset mode for ALC3271 (bsc#1031717).
• alsa: hda/realtek - Support headset mode for ALC234/ALC274/ALC294 (bsc#1031717).
• alsa: hda/realtek - There is no loopback mixer in the ALC234/274/294 (bsc#1031717).
• alsa: hda/realtek - Update headset mode for ALC225 (bsc#1031717).
• alsa: hda/realtek - Update headset mode for ALC298 (bsc#1031717).
• alsa: hda - Skip Realtek SKU check for Lenovo machines (bsc#1031717).
• alsa: pcm: prevent UAF in sndpcminfo (bsc#1031717).
• alsa: pcm: update tstamp only if audio_tstamp changed (bsc#1031717).
• alsa: rawmidi: Avoid racy info ioctl via ctl device (bsc#1031717).
• alsa: seq: Avoid invalid lockdep class warning (bsc#1031717).
• alsa: seq: Fix nested rwsem annotation for lockdep splat (bnc#1012382).
• alsa: seq: Fix OSS sysex delivery in OSS emulation (bnc#1012382).
• alsa: seq: Remove spurious WARN_ON() at timer check (bsc#1031717).
• alsa: timer: Add missing mutex lock for compat ioctls (bnc#1012382).
• alsa: timer: Remove kernel warning at compat ioctl error paths (bsc#1031717).
• alsa: usb-audio: Add check return value for usb_string() (bsc#1031717).
• alsa: usb-audio: Add sanity checks in v2 clock parsers (bsc#1031717).
• alsa: usb-audio: Add sanity checks to FE parser (bsc#1031717).
• alsa: usb-audio: Fix out-of-bound error (bsc#1031717).
• alsa: usb-audio: Fix potential out-of-bound access at parsing SU (bsc#1031717).
• alsa: usb-audio: Fix the missing ctl name suffix at parsing SU (bsc#1031717).
• alsa: usb-audio: uac1: Invalidate ctl on interrupt (bsc#1031717).
• alsa: vx: Do not try to update capture stream before running (bnc#1012382).
• alsa: vx: Fix possible transfer overflow (bnc#1012382).
• Always sign validatenegotiateinfo reqs (bsc#1071009, fate#324404).
• apei / ERST: Fix missing error handling in erst_reader() (bsc#1072556).
• Apply generic ppc build fixes to vanilla (bsc#1070805)
• arm64: dts: NS2: reserve memory for Nitro firmware (bnc#1012382).
• arm64: ensure _dumpinstr() checks addr_limit (bnc#1012382).
• arm64: fix dump_instr when PAN and UAO are in use (bnc#1012382).
• arm: 8715/1: add a private asm/unaligned.h (bnc#1012382).
• arm: 8720/1: ensure dumpinstr() checks addrlimit (bnc#1012382).
• arm: 8721/1: mm: dump: check hardware RO bit for LPAE (bnc#1012382).
• arm: 8722/1: mm: make STRICTKERNELRWX effective for LPAE (bnc#1012382).
• arm: crypto: reduce priority of bit-sliced AES cipher (bnc#1012382).
• arm: dts: Fix am335x and dm814x scm syscon to probe children (bnc#1012382).
• arm: dts: Fix compatible for ti81xx uarts for 8250 (bnc#1012382).
• arm: dts: Fix omap3 off mode pull defines (bnc#1012382).
• arm: dts: mvebu: pl310-cache disable double-linefill (bnc#1012382).
• arm: dts: omap3: logicpd-torpedo-37xx-devkit: Fix MMC1 cd-gpio (bnc#1012382).
• arm: Hide finisharchpostlockswitch() from modules (bsc#1068032).
• arm: OMAP2+: Fix init for multiple quirks for the same SoC (bnc#1012382).
• arm: omap2plus_defconfig: Fix probe errors on UARTs 5 and 6 (bnc#1012382).
• arm: pxa: Do not rely on public mmc header to include leds.h (bnc#1012382).
• asm/sections: add helpers to check for section data (bsc#1063026).
• asoc: adau17x1: Workaround for noise bug in ADC (bnc#1012382).
• asoc: cs42l56: Fix reset GPIO name in example DT binding (bsc#1031717).
• asoc: davinci-mcasp: Fix an error handling path in 'davincimcaspprobe()' (bsc#1031717).
• asoc: fsl_ssi: AC'97 ops need regmap, clock and cleaning up on failure (bsc#1031717).
• asoc: rsnd: do not double free kctrl (bnc#1012382).
• asoc: samsung: Fix possible double iounmap on s3c24xx driver probe failure (bsc#1031717).
• asoc: twl4030: fix child-node lookup (bsc#1031717).
• asoc: wm_adsp: Do not overrun firmware file buffer when reading region data (bnc#1012382).
• asoc: wm_adsp: Fix validation of firmware and coeff lengths (bsc#1031717).
• ata: ATABMDMA should depend on HASDMA (bnc#1012382).
• ata: fixes kernel crash while tracing ataehlink_autopsy event (bnc#1012382).
• ata: SATAHIGHBANK should depend on HASDMA (bnc#1012382).
• ata: SATAMV should depend on HASDMA (bnc#1012382).
• ath10k: convert warning about non-existent OTP board id to debug message (git-fixes).
• ath10k: fix a warning during channel switch with multiple vaps (bsc#1031717).
• ath10k: fix board data fetch error message (bsc#1031717).
• ath10k: fix diag_read to collect data for larger memory (bsc#1031717).
• ath10k: fix incorrect txpower set by P2P_DEVICE interface (bnc#1012382).
• ath10k: fix potential memory leak in ath10kwmitlvoppullfwstats() (bnc#1012382).
• ath10k: free cached fw bin contents when get board id fails (bsc#1031717).
• ath10k: ignore configuring the incorrect board_id (bnc#1012382).
• ath10k: set CTS protection VDEV param only if VDEV is up (bnc#1012382).
• ath9khtc: check for underflow in ath9khtcrxmsg() (bsc#1031717).
• ath9k: off by one in ath9khwnvramreadarray() (bsc#1031717).
• autofs: do not fail mount for transient error (bsc#1065180).
• autofs: fix careless error in recent commit (bnc#1012382 bsc#1065180).
• backlight: adp5520: Fix error handling in adp5520blprobe() (bnc#1012382).
• backlight: lcd: Fix race condition during register (bnc#1012382).
• bcache: check ca->alloc_thread initialized before wake up it (bnc#1012382).
• bcache: Fix building error on MIPS (bnc#1012382).
• blacklist.conf: Add ath10k, mmc and rtl8192u commits (bsc#1031717)
• blacklist.conf: Add drm/i915 blacklist (bsc#1031717)
• blacklist.conf: added misc commits (bsc#1031717)
• blacklist.conf: Add misc entries (bsc#1031717)
• blacklist.conf: blacklist not-applicable patch (bsc#1071231)
• blacklist.conf: Update blacklist (bsc#1031717)
• blacklist.conf: Update iwlwifi blacklist (bsc#1031717)
• blacklist.conf: yet another serial entry (bsc#1031717)
• block: Fix a race between blkcleanupqueue() and timeout handling (FATE#319965, bsc#964944).
• Bluetooth: btusb: fix QCA Rome suspend/resume (bnc#1012382).
• bnxt_en: Call firmware to approve the random VF MAC address (bsc#963575 FATE#320144).
• bnxten: Do not setup MAC address in bnxthwrmfuncqcaps() (bsc#963575 FATE#320144).
• bnxt_en: Fix possible corrupted NVRAM parameters from firmware response (bsc#963575 FATE#320144).
• bnxt_en: Fix VF PCIe link speed and width logic (bsc#963575 FATE#320144).
• bnxten: Re-arrange bnxthwrmfuncqcaps() (bsc#963575 FATE#320144).
• bnxten: use ethhwaddrrandom() (bsc#963575 FATE#320144).
• bonding: discard lowest hash bit for 802.3ad layer3+4 (bnc#1012382).
• bpf: prevent speculative execution in eBPF interpreter (bnc#1068032).
• brcmfmac: remove setting IBSS mode when stopping AP (bnc#1012382).
• bt8xx: fix memory leak (bnc#1012382).
• btrfs: clear space cache inode generation always (bnc#1012382).
• btrfs: Fix typo in maycommittransaction Rather than comparing the result of the percpu comparison I was comparing the value of the percpu counter against 0 or 1.
• btrfs: return the actual error value from from btrfsuuidtree_iterate (bnc#1012382).
• can: ccan: do not indicate triple sampling support for DCAN (bnc#1012382).
• can: kvaser_usb: Correct return value in printout (bnc#1012382).
• can: kvaserusb: Ignore CMDFLUSHQUEUEREPLY messages (bnc#1012382).
• can: sun4i: fix loopback mode (bnc#1012382).
• can: sun4i: handle overrun in RX FIFO (bnc#1012382).
• carl9170: prevent speculative execution (bnc#1068032).
• cdc_ncm: Set NTB format again after altsetting switch for Huawei devices (bnc#1012382).
• ceph: unlock dangling spinlock in tryflushcaps() (bsc#1065639).
• cgroup, net_cls: iterate the fds of only the tasks which are being migrated (bnc#1064926).
• Check cmdlinefindoption() retval properly and use bootcpuhas().
• cifs: add buildpathfromdentryoptional_prefix() (fate#323482)
• cifs: Add capability to decrypt big read responses (FATE#324404). Allow to decrypt transformed packets that are bigger than the big buffer size. In particular it is used for read responses that can only exceed the big buffer size.
• cifs: Add capability to transform requests before sending (FATE#324404). This will allow us to do protocol specific tranformations of packets before sending to the server. For SMB3 it can be used to support encryption.
• cifs: Add copy into pages callback for a read operation (FATE#324404). Since we have two different types of reads (pagecache and direct) we need to process such responses differently after decryption of a packet. The change allows to specify a callback that copies a read payload data into preallocated pages.
• cifs: Add mid handle callback (FATE#324404). We need to process read responses differently because the data should go directly into preallocated pages. This can be done by specifying a mid handle callback.
• cifs: Add soft dependencies (FATE#324404). List soft dependencies of cifs so that mkinitrd and dracut can include the required helper modules.
• cifs: Add transform header handling callbacks (FATE#324404). We need to recognize and parse transformed packets in demultiplex thread to find a corresponsing mid and process it further.
• cifs: add useipc flag to SMB2ioctl() (fate#323482)
• cifs: Allow to switch on encryption with seal mount option (FATE#324404). This allows users to inforce encryption for SMB3 shares if a server supports it.
• cifs: check MaxPathNameComponentLength != 0 before using it (bnc#1012382).
• cifs: Decrypt and process small encrypted packets (FATE#324404). Allow to decrypt transformed packets, find a corresponding mid and process as usual further.
• cifs: do not bother with kmap on readpages side (FATE#324404). just do ITERBVEC recvmsg
• cifs: Enable encryption during session setup phase (FATE#324404). In order to allow encryption on SMB connection we need to exchange a session key and generate encryption and decryption keys.
• cifs: Encrypt SMB3 requests before sending (FATE#324404). This change allows to encrypt packets if it is required by a server for SMB sessions or tree connections.
• cifs: Fix some return values in case of error in 'crypt_message' (fate#324404).
• cifs: Fix sparse warnings (fate#323482)
• cifs: implement getdfsrefer for SMB2+ (fate#323482)
• cifs: let ses->ipc_tid hold smb2 TreeIds (fate#323482)
• cifs: Make send_cancel take rqst as argument (FATE#324404).
• cifs: Make SendReceive2() takes resp iov (FATE#324404). Now SendReceive2 frees the first iov and returns a response buffer in it that increases a code complexity. Simplify this by making a caller responsible for freeing request buffer itself and returning a response buffer in a separate iov.
• cifs: move DFS response parsing out of SMB1 code (fate#323482)
• cifs: no need to wank with copying and advancing iovec on recvmsg side either (FATE#324404).
• cifs: Only select the required crypto modules (FATE#324404). The sha256 and cmac crypto modules are only needed for SMB2+, so move the select statements to config CIFSSMB2. Also select CRYPTOAES there as SMB2+ needs it.
• cifs: Prepare for encryption support (first part). Add decryption and encryption key generation. (FATE#324404).
• cifsreadvreceive: use cifsreadfrom_socket() (FATE#324404).
• cifs: remove any preceding delimiter from prefix_path (fate#323482)
• cifs: Send RFC1001 length in a separate iov (FATE#324404). In order to simplify further encryption support we need to separate RFC1001 length and SMB2 header when sending a request. Put the length field in iov[0] and the rest of the packet into following iovs.
• cifs: Separate RFC1001 length processing for SMB2 read (FATE#324404). Allocate and initialize SMB2 read request without RFC1001 length field to directly call cifssendrecv() rather than SendReceive2() in a read codepath.
• cifs: Separate SMB2 header structure (FATE#324404). In order to support compounding and encryption we need to separate RFC1001 length field and SMB2 header structure because the protocol treats them differently. This change will allow to simplify parsing of such complex SMB2 packets further.
• cifs: Separate SMB2 sync header processing (FATE#324404). Do not process RFC1001 length in smb2hdrassemble() because it is not a part of SMB2 header. This allows to cleanup the code and adds a possibility combine several SMB2 packets into one for compounding.
• cifs: set signing flag in SMB2+ TreeConnect if needed (fate#323482)
• cifs: Simplify SMB2 and SMB311 dependencies (FATE#324404). * CIFSSMB2 depends on CIFS, which depends on INET and selects NLS. So these dependencies do not need to be repeated for CIFSSMB2. * CIFSSMB311 depends on CIFSSMB2, which depends on INET. So this dependency does not need to be repeated for CIFS_SMB311.
• cifs: use DFS pathnames in SMB2+ Create requests (fate#323482)
• clk: ti: dra7-atl-clock: fix child-node lookups (bnc#1012382).
• clk: ti: dra7-atl-clock: Fix of_node reference counting (bnc#1012382).
• cma: fix calculation of aligned offset (VM Functionality, bsc#1050060).
• coda: fix 'kernel memory exposure attempt' in fsync (bnc#1012382).
• crypto: vmx - disable preemption to enable vsx in aes_ctr.c (bnc#1012382).
• crypto: x86/sha1-mb - fix panic due to unaligned access (bnc#1012382).
• cw1200: prevent speculative execution (bnc#1068032).
• cx231xx: Fix I2C on Internal Master 3 Bus (bnc#1012382).
• cxgb4: Fix error codes in c4iwcreatecq() (bsc#1021424).
• cxl: Fix DAR check & use REGION_ID instead of opencoding (bsc#1066223).
• cxl: Fix leaking pid refs in some error paths (bsc#1066223).
• cxl: Force context lock during EEH flow (bsc#1066223).
• cxl: Prevent adapter reset if an active context exists (bsc#1066223).
• cxl: Route eeh events to all drivers in cxlpcierror_detected() (bsc#1066223).
• Disable IPMI fix patches due to regression (bsc#1071833)
• dmaengine: dmatest: warn user when dma test times out (bnc#1012382).
• dmaengine: zx: set DMACYCLIC capmask bit (bnc#1012382).
• dm bufio: fix integer overflow when limiting maximum cache size (bnc#1012382).
• dm: fix race between dmgetfromkobject() and _dm_destroy() (bnc#1012382).
• drivers: dma-mapping: Do not leave an invalid area->pages pointer in dmacommoncontiguous_remap() (Git-fixes, bsc#1065692).
• drm/amdgpu: when dpm disabled, also need to stop/start vce (bnc#1012382).
• drm/amdkfd: NULL dereference involving create_process() (bsc#1031717).
• drm: Apply range restriction after color adjustment when allocation (bnc#1012382).
• drm/armada: Fix compile fail (bnc#1012382).
• drm: drmminorregister(): Clean up debugfs on failure (bnc#1012382).
• drm: gma500: fix logic error (bsc#1031717).
• drm/i915/bxt: set min brightness from VBT (bsc#1031717).
• drm/i915: Do not try indexed reads to alternate slave addresses (bsc#1031717).
• drm/i915: fix backlight invert for non-zero minimum brightness (bsc#1031717).
• drm/i915: Prevent zero length 'index' write (bsc#1031717).
• drm/i915: Read timings from the correct transcoder in intelcrtcmode_get() (bsc#1031717).
• drm/msm: fix an integer overflow test (bnc#1012382).
• drm/msm: Fix potential buffer overflow issue (bnc#1012382).
• drm/nouveau/gr: fallback to legacy paths during firmware lookup (bsc#1031717).
• drm/omap: Fix error handling path in 'omapdmmprobe()' (bsc#1031717).
• drm/panel: simple: Add missing panelsimpleunprepare() calls (bsc#1031717).
• drm/radeon: fix atombios on big endian (bnc#1012382).
• drm/sti: stivtg: Handle return NULL error from devmioremap_nocache (bnc#1012382).
• drm/vc4: Fix leak of HDMI EDID (bsc#1031717).
• drm/vmwgfx: Fix Ubuntu 17.10 Wayland black screen issue (bnc#1012382).
• e1000e: Avoid receiver overrun interrupt bursts (bsc#969470 FATE#319819).
• e1000e: Fix e1000checkforcopperlink_ich8lan return value (bsc#1073809).
• e1000e: Fix error path in link detection (bnc#1012382).
• e1000e: Fix return value test (bnc#1012382).
• e1000e: Separate signaling for link check/link up (bnc#1012382).
• ecryptfs: fix dereference of NULL userkeypayload (bnc#1012382).
• eCryptfs: use after free in ecryptfsreleasemessaging() (bsc#1012829).
• eeprom: at24: check at24_read/write arguments (bnc#1012382).
• epoll: avoid calling epcallnested() from eppollsafewake() (bsc#1056427).
• epoll: remove epcallnested() from epeventpollpoll() (bsc#1056427).
• ext4: cleanup goto next group (bsc#1066285).
• ext4: do not use stripe_width if it is not set (bnc#1012382).
• ext4: fix interaction between i_size, fallocate, and delalloc after a crash (bnc#1012382).
• ext4: fix stripe-unaligned allocations (bnc#1012382).
• ext4: reduce lock contention in _ext4new_inode (bsc#1066285).
• extcon: palmas: Check the parent instance to prevent the NULL (bnc#1012382).
• exynos4-is: fimc-is: Unmap region obtained by of_iomap() (bnc#1012382).
• fealnx: Fix building error on MIPS (bnc#1012382).
• fix a page leak in vhostscsiiovtosgl() error recovery (bnc#1012382).
• Fix leak of validatenegotiateinfo resp (bsc#1071009, fate#324404).
• Fix NULL pointer deref in SMB2_tcon() (bsc#1071009, fate#324404).
• Fix serial console on SNI RM400 machines (bsc#1031717).
• Fix tracing sample code warning (bnc#1012382).
• Fix validatenegotiateinfo uninitialized mem (bsc#1071009, fate#324404).
• fm10k: request reset when mbx->state changes (bnc#1012382).
• fm10k: Use smprmb rather than readbarrier_depends (bnc#1012382).
• fs/9p: Compare qid.path in v9fstestinode (bsc#1012829).
• fscrypt: lock mutex before checking for bounce page pool (bnc#1012382).
• fs: prevent speculative execution (bnc#1068032).
• fuse: fix READDIRPLUS skipping an entry (bnc#1012382).
• genwqe: Take R/W permissions into account when dealing with memory pages (bsc#1073090).
• gpu: drm: mgag200: mgag200main:- Handle error from pciiomap (bnc#1012382).
• hid: elo: clear BTN_LEFT mapping (bsc#1065866).
• hsi: ssiprotocol: double free in ssippn_xmit() (bsc#1031717).
• i2c: cadance: fix ctrl/addr reg write order (bsc#1031717).
• i2c: imx: Use correct function to write to register (bsc#1031717).
• i2c: riic: correctly finish transfers (bnc#1012382).
• i2c: riic: fix restart condition (git-fixes).
• i40e: Use smprmb rather than readbarrier_depends (bnc#1012382).
• i40evf: Use smprmb rather than readbarrier_depends (bnc#1012382).
• ib/core: Fix calculation of maximum RoCE MTU (bsc#1022595 FATE#322350).
• ib/core: Namespace is mandatory input for address resolution (bsc#1022595 FATE#322350).
• ib/ipoib: Change listdel to listdel_init in the tx object (bnc#1012382).
• ib/ipoib: Clean error paths in add port (bsc#1022595 FATE#322350).
• ib/ipoib: Prevent setting negative values to maxnonsrqconn_qp (bsc#1022595 FATE#322350).
• ib/ipoib: Remove double pointer assigning (bsc#1022595 FATE#322350).
• ib/ipoib: Set IPOIBNEIGHTBL_FLUSH after flushed completion initialization (bsc#1022595 FATE#322350).
• ib/mlx5: Fix RoCE Address Path fields (bsc#966170 FATE#320225 bsc#966172 FATE#320226).
• ibmvnic: Add netdev_dbg output for debugging (fate#323285).
• ibmvnic: Add vnic client data to login buffer (bsc#1069942).
• ibmvnic: Convert vnic server reported statistics to cpu endian (fate#323285).
• ibmvnic: Enable scatter-gather support (bsc#1066382).
• ibmvnic: Enable TSO support (bsc#1066382).
• ibmvnic: Feature implementation of Vital Product Data (VPD) for the ibmvnic driver (bsc#1069942).
• ibmvnic: Fix calculation of number of TX header descriptors (bsc#1066382).
• ibmvnic: fix dmamappingerror call (bsc#1069942).
• ibmvnic: Fix failover error path for non-fatal resets (bsc#1066382).
• ibmvnic: Implement .get_channels (fate#323285).
• ibmvnic: Implement .get_ringparam (fate#323285).
• ibmvnic: Implement per-queue statistics reporting (fate#323285).
• ibmvnic: Include header descriptor support for ARP packets (bsc#1073912).
• ibmvnic: Increase maximum number of RX/TX queues (bsc#1073912).
• ibmvnic: Let users change net device features (bsc#1066382).
• ibmvnic: Rename IBMVNICMAXTXQUEUES to IBMVNICMAX_QUEUES (bsc#1073912).
• ibmvnic: Update reset infrastructure to support tunable parameters (bsc#1066382).
• ib/srp: Avoid that a cable pull can trigger a kernel crash (bsc#1022595 FATE#322350).
• ib/srpt: Do not accept invalid initiator port names (bnc#1012382).
• ib/uverbs: Fix device cleanup (bsc#1022595 FATE#322350).
• ib/uverbs: Fix NULL pointer dereference during device removal (bsc#1022595 FATE#322350).
• igb: close/suspend race in netifdevicedetach (bnc#1012382).
• igb: Fix hwdbg logging in igbupdateflashi210 (bnc#1012382).
• igb: reset the PHY before reading the PHY ID (bnc#1012382).
• igb: Use smprmb rather than readbarrier_depends (bnc#1012382).
• igbvf: Use smprmb rather than readbarrier_depends (bnc#1012382).
• iio: dummy: events: Add missing break (bsc#1031717).
• iio: light: fix improper return value (bnc#1012382).
• iio: trigger: free trigger resource correctly (bnc#1012382).
• ima: do not update security.ima if appraisal status is not INTEGRITY_PASS (bnc#1012382).
• input: ar1021_i2c - fix too long name in driver's device table (bsc#1031717).
• input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree (bsc#1031717).
• input: elan_i2c - add ELAN060C to the ACPI table (bnc#1012382).
• input: elan_i2c - add ELAN0611 to the ACPI table (bnc#1012382).
• input: gtco - fix potential out-of-bound access (bnc#1012382).
• input: mpr121 - handle multiple bits change of status register (bnc#1012382).
• input: mpr121 - set missing event capability (bnc#1012382).
• input: tiam335xtsc - fix incorrect step config for 5 wire touchscreen (bsc#1031717).
• input: twl4030-pwrbutton - use correct device for irq request (bsc#1031717).
• input: ucb1400_ts - fix suspend and resume handling (bsc#1031717).
• input: uinput - avoid crash when sending FF request to device going away (bsc#1031717).
• iommu/arm-smmu-v3: Clear prior settings when updating STEs (bnc#1012382).
• iommu/vt-d: Do not register bus-notifier under dmargloballock (bsc#1069793).
• ip6gre: only increase errcount for some certain type icmpv6 in ip6gre_err (bnc#1012382).
• ipip: only increase errcount for some certain type icmp in ipiperr (bnc#1012382).
• ipmi: fix unsigned long underflow (bnc#1012382).
• ipmi: Pick up slave address from SMBIOS on an ACPI device (bsc#1070006).
• ipmi: Prefer ACPI system interfaces over SMBIOS ones (bsc#1070006).
• ipmi_si: Clean up printks (bsc#1070006).
• ipmisi: fix memory leak on newsmi (bsc#1070006).
• ipsec: do not ignore crypto err in ah4 input (bnc#1012382).
• ipv6: flowlabel: do not leave opt->tot_len with garbage (bnc#1012382).
• ipv6: only call ip6routedevnotify() once for NETDEVUNREGISTER (bnc#1012382).
• ipv6: prevent speculative execution (bnc#1068032).
• ipvs: make drop_entry protection effective for SIP-pe (bsc#1056365).
• isa: Prevent NULL dereference in isa_bus driver callbacks (bsc#1031717).
• iscsi-target: Fix non-immediate TMR reference leak (bnc#1012382).
• isofs: fix timestamps beyond 2027 (bnc#1012382).
• iwlwifi: mvm: fix the coex firmware API (bsc#1031717).
• iwlwifi: mvm: return -ENODATA when reading the temperature with the FW down (bsc#1031717).
• iwlwifi: mvm: set the RTSMIMOPROT bit in flag mask when sending sta to fw (bsc#1031717).
• iwlwifi: split the regulatory rules when the bandwidth flags require it (bsc#1031717).
• ixgbe: add mask for 64 RSS queues (bnc#1012382).
• ixgbe: do not disable FEC from the driver (bnc#1012382).
• ixgbe: fix AER error handling (bnc#1012382).
• ixgbe: Fix skb list corruption on Power systems (bnc#1012382).
• ixgbe: handle close/suspend race with netifdevicedetach/present (bnc#1012382).
• ixgbe: Reduce I2C retry count on X550 devices (bnc#1012382).
• ixgbevf: Use smprmb rather than readbarrier_depends (bnc#1012382).
• kabi fix for new hash_cred function (bsc#1012917).
• kABI: protect struct regulator_dev (kabi).
• kABI: protect structs rtrq+rootdomain (kabi).
• kABI: protect typedef rdsrdmacookie_t (kabi).
• kaiser: add 'nokaiser' boot option, using ALTERNATIVE.
• kaiser: align addition to x86/mm/Makefile.
• kaiser: asm/tlbflush.h handle noPGE at lower level.
• kaiser: cleanups while trying for gold link.
• kaiser: Disable on Xen PV.
• kaiser: do not set PAGENX on pgd_none.
• kaiser: drop isatomic arg to kaiserpagetable_walk().
• kaiser: enhanced by kernel and user PCIDs.
• kaiser: ENOMEM if kaiserpagetablewalk() NULL.
• kaiser: fix build and FIXME in allocldtstruct().
• kaiser: fix perf crashes.
• kaiser: fix regs to donmi() ifndef CONFIGKAISER.
• kaiser: fix unlikely error in allocldtstruct().
• kaiser: KAISER depends on SMP.
• kaiser: kaiserflushtlbonreturntouser() check PCID.
• kaiser: kaiserremovemapping() move along the pgd.
• kaiser: Kernel Address Isolation.
• kaiser: loadnewmmcr3() let SWITCHUSER_CR3 flush.
• kaiser: loadnewmmcr3() let SWITCHUSER_CR3 flush user.
• kaiser: name that 0x1000 KAISERSHADOWPGD_OFFSET.
• kaiser: paranoidentry pass cr3 need to paranoidexit.
• kaiser: PCID 0 for kernel and 128 for user.
• kaiser: pgdalloc() without _GFPREPEAT to avoid stalls.
• kaiser: stack map PAGESIZE at THREADSIZE-PAGE_SIZE.
• kaiser: tidied up asm/kaiser.h somewhat.
• kaiser: tidied up kaiseradd/removemapping slightly.
• kaiser: use ALTERNATIVE instead of x86cr3pcid_noflush.
• kaiser: vmstat show NRKAISERTABLE as nroverhead.
• kaiser: x86cr3pcidnoflush and x86cr3pciduser.
• kernel-docs: unpack the source instead of using kernel-source (bsc#1057199).
• kernel/sysctl.c: remove duplicate UINTMAX check on doprocdouintvecconv() (bsc#1066470).
• kernel/watchdog: Prevent false positives with turbo modes (bnc#1063516).
• keys: do not revoke uninstantiated key in requestkeyauth_new() (bsc#1031717).
• keys: fix cred refcount leak in requestkeyauth_new() (bsc#1031717).
• keys: fix key refcount leak in keyctlassumeauthority() (bsc#1031717).
• keys: fix key refcount leak in keyctlreadkey() (bsc#1031717).
• keys: fix NULL pointer dereference during ASN.1 parsing [ver #2] (bnc#1012382).
• keys: fix out-of-bounds read during ASN.1 parsing (bnc#1012382).
• keys: return full count in keyring_read() if buffer is too small (bnc#1012382).
• keys: trusted: fix writing past end of buffer in trusted_read() (bnc#1012382).
• keys: trusted: sanitize all key material (bnc#1012382).
• kvm: nVMX: set IDTR and GDTR limits when loading L1 host state (bnc#1012382).
• kvm: PPC: Book 3S: XICS: correct the real mode ICP rejecting counter (bnc#1012382).
• kvm: SVM: Do not intercept new speculative control MSRs (bsc#1068032).
• kvm: SVM: obey guest PAT (bnc#1012382).
• kvm: x86: Add speculative control CPUID support for guests (bsc#1068032).
• kvm: x86: Exit to user-mode on #UD intercept when emulator requires (bnc#1012382).
• kvm: x86: inject exceptions produced by x86decodeinsn (bnc#1012382).
• kvm: x86: pvclock: Handle first-time write to pvclock-page contains random junk (bnc#1012382).
• l2tp: check ps->sock before running pppol2tpsessionioctl() (bnc#1012382).
• libertas: Fix lbsprbrsplimitset() (bsc#1031717).
• lib/mpi: call condresched() from mpipowm() loop (bnc#1012382).
• libnvdimm, namespace: fix label initialization to use valid seq numbers (bnc#1012382).
• libnvdimm, namespace: make 'resource' attribute only readable by root (bnc#1012382).
• libnvdimm, pfn: make 'resource' attribute only readable by root (FATE#319858).
• lib/ratelimit.c: use deferred printk() version (bsc#979928).
• locking/barriers: introduce new memory barrier gmb() (bnc#1068032).
• mac80211: agg-tx: call drvwaketx_queue in proper context (bsc#1031717).
• mac80211: do not compare TKIP TX MIC key in reinstall prevention (bsc#1066472).
• mac80211: do not send SMPS action frame in AP mode when not needed (bsc#1031717).
• mac80211: Fix addition of mesh configuration element (git-fixes).
• mac80211: Fix BW upgrade for TDLS peers (bsc#1031717).
• mac80211: fix mgmt-tx abort cookie and leak (bsc#1031717).
• mac80211hwsim: Fix memory leak in hwsimnewradionl() (bsc#1031717).
• mac80211: Remove invalid flag operations in mesh TSF synchronization (bnc#1012382).
• mac80211: Remove unused 'beaconint_us' variable (bsc#1031717).
• mac80211: Remove unused 'i' variable (bsc#1031717).
• mac80211: Remove unused 'len' variable (bsc#1031717).
• mac80211: Remove unused 'rates_idx' variable (bsc#1031717).
• mac80211: Remove unused 'sband' and 'local' variables (bsc#1031717).
• mac80211: Remove unused 'struct ieee80211rxstatus' ptr (bsc#1031717).
• mac80211: Suppress NEWPEERCANDIDATE event if no room (bnc#1012382).
• mac80211: TDLS: always downgrade invalid chandefs (bsc#1031717).
• mac80211: TDLS: change BW calculation for WIDER_BW peers (bsc#1031717).
• mac80211: use constant time comparison with keys (bsc#1066471).
• media: au0828: fix RC_CORE dependency (bsc#1031717).
• media: Do not do DMA on stack for firmware upload in the AS102 driver (bnc#1012382).
• media: em28xx: calculate left volume level correctly (bsc#1031717).
• media: mceusb: fix memory leaks in error path (bsc#1031717).
• media: rc: check for integer overflow (bnc#1012382).
• media: v4l2-ctrl: Fix flags field on Control events (bnc#1012382).
• megaraidsas: Do not fire MRDCMDPDLIST_QUERY to controllers which do not support it (bsc#1027301).
• mei: return error on notification request to a disconnected client (bnc#1012382).
• mfd: ab8500-sysctrl: Handle probe deferral (bnc#1012382).
• mfd: axp20x: Fix axp288 PEKDBR and PEKDBF irqs being swapped (bnc#1012382).
• misc: panel: properly restore atomic counter on error path (bnc#1012382).
• mmc: block: return error on failed mmcblkget() (bsc#1031717).
• mmc: core: Do not leave the block driver in a suspended state (bnc#1012382).
• mmc: core/mmci: restore pre/post_req behaviour (bsc#1031717).
• mmc: dw_mmc: rockchip: Set the drive phase properly (bsc#1031717).
• mm: check the return value of lookuppageext for all call sites (bnc#1068982).
• mmc: host: omap_hsmmc: avoid possible overflow of timeout value (bsc#1031717).
• mmc: host: omaphsmmc: checking for NULL instead of ISERR() (bsc#1031717).
• mmc: mediatek: Fixed size in dmafreecoherent (bsc#1031717).
• mmc: s3cmci: include linux/interrupt.h for tasklet_struct (bnc#1012382).
• mmc: sd: limit SD card power limit according to cards capabilities (bsc#1031717).
• mm, hwpoison: fixup 'mm: check the return value of lookuppageext for all call sites' (bnc#1012382).
• mm/madvise.c: fix madvise() infinite loop under special circumstances (bnc#1070964).
• mm/mmucontext, sched/core: Fix mmucontext.h assumption (bsc#1068032).
• mm/page_alloc.c: broken deferred calculation (bnc#1068980).
• mm, pagealloc: fix potential false positive in _zonewatermarkok (Git-fixes, bsc#1068978).
• mm/pageext.c: check if pageext is not prepared (bnc#1068982).
• mm/page_owner: avoid null pointer dereference (bnc#1068982).
• mm/pagewalk.c: report holes in hugetlb ranges (bnc#1012382).
• mtd: nand: Fix writing mtdoops to nand flash (bnc#1012382).
• net: 3com: typhoon: typhooninitone: fix incorrect return values (bnc#1012382).
• net: 3com: typhoon: typhooninitone: make return values more specific (bnc#1012382).
• net/9p: Switch to waiteventkillable() (bnc#1012382).
• net: Allow IPMULTICASTIF to set index to L3 slave (bnc#1012382).
• net: cdc_ether: fix divide by 0 on bad descriptors (bnc#1012382).
• net: cdc_ncm: GetNtbFormat endian fix (git-fixes).
• net: dsa: select NET_SWITCHDEV (bnc#1012382).
• netfilter/ipvs: clear ipvs_property flag when SKB net namespace changed (bnc#1012382).
• netfilter: nf_tables: fix oob access (bnc#1012382).
• netfilter: nftmeta: deal with PACKETLOOPBACK in netdev family (bnc#1012382).
• netfilter: nftqueue: use rawsmpprocessorid() (bnc#1012382).
• net: ibm: ibmvnic: constify viodeviceid (fate#323285).
• netlink: add a start callback for starting a netlink dump (bnc#1012382).
• net: mpls: prevent speculative execution (bnc#1068032).
• net: qmi_wwan: fix divide by 0 on bad descriptors (bnc#1012382).
• net/sctp: Always set scopeid in sctpinet6skbmsgname (bnc#1012382).
• net/unix: do not show information about sockets from other namespaces (bnc#1012382).
• nfc: fix device-allocation error return (bnc#1012382).
• nfsd: deal with revoked delegations appropriately (bnc#1012382).
• nfsd: Fix another OPEN stateid race (bnc#1012382).
• nfsd: Fix stateid races between OPEN and CLOSE (bnc#1012382).
• nfsd: Make initopenstateid() a bit more whole (bnc#1012382).
• nfs: Do not disconnect open-owner on NFS4ERRBADSEQID (bsc#989261).
• nfs: Fix typo in nomigration mount option (bnc#1012382).
• nfs: Fix ugly referral attributes (bnc#1012382).
• nfs: improve shinking of access cache (bsc#1012917).
• nfs: revalidate '.' etc correctly on 'open' (bsc#1068951).
• nfs: revalidate '.' etc correctly on 'open' (git-fixes). Fix References tag.
• nfsv4: always set NFSLOCKLOST when a lock is lost (bsc#1068951).
• nilfs2: fix race condition that causes file system corruption (bnc#1012382).
• nvme: Fix memory order on async queue deletion (bnc#1012382).
• ocfs2: fstrim: Fix start offset of first cluster group during fstrim (bnc#1012382).
• ocfs2: should wait dio before inode lock in ocfs2_setattr() (bnc#1012382).
• p54: prevent speculative execution (bnc#1068032).
• packet: avoid panic in packet_getsockopt() (bnc#1012382).
• parisc: Fix validity check of pointer size argument in new CAS implementation (bnc#1012382).
• pci: Apply _HPX settings only to relevant devices (bnc#1012382).
• pci: mvebu: Handle changes to the bridge windows while enabled (bnc#1012382).
• perf tools: Fix build failure on perl script context (bnc#1012382).
• perf tools: Only increase index if perfevselnewidx() succeeds (bnc#1012382).
• perf/x86/intel/bts: Fix exclusive event reference leak (git-fixes d2878d642a4ed).
• phy: increase size of MIIBUSIDSIZE and busid (bnc#1012382).
• pkcs#7: fix unitialized boolean 'want' (bnc#1012382).
• platform/x86: acer-wmi: setup accelerometer when ACPI device was found (bsc#1031717).
• platform/x86: hp-wmi: Do not shadow error values (bnc#1012382).
• platform/x86: hp-wmi: Fix detection for dock and tablet mode (bnc#1012382).
• platform/x86: hp-wmi: Fix error value for hpwmitablet_state (bnc#1012382).
• platform/x86: intelmidthermal: Fix module autoload (bnc#1012382).
• platform/x86: sony-laptop: Fix error handling in sonyncsetup_rfkill() (bsc#1031717).
• pm / OPP: Add missing ofnodeput(np) (bnc#1012382).
• power: bq27xxx_battery: Fix bq27541 AveragePower register address (bsc#1031717).
• power: bq27xxx: fix reading for bq27000 and bq27010 (bsc#1031717).
• powercap: Fix an error code in powercapregisterzone() (bsc#1031717).
• power: ipaq-micro-battery: freeing the wrong variable (bsc#1031717).
• powerpc/64: Fix race condition in setting lock bit in idle/wakeup code (bsc#1066223).
• powerpc/barrier: add gmb.
• powerpc/bpf/jit: Disable classic BPF JIT on ppc64le (bsc#1066223).
• powerpc/corenet: explicitly disable the SDHC controller on kmcoge4 (bnc#1012382).
• powerpc: Correct instruction code for xxlor instruction (bsc#1066223).
• powerpc: Fix VSX enabling/flushing to also test MSRFP and MSRVEC (bsc#1066223).
• powerpc/mm: Fix check of multiple 16G pages from device tree (bsc#1066223).
• powerpc/mm: Fix virtaddrvalid() etc. on 64-bit hash (bsc#1066223).
• powerpc/mm/hash64: Fix subpage protection with 4K HPTE config (bsc#1010201, bsc#1066223).
• powerpc/mm/hash: Free the subpageprottable correctly (bsc#1066223).
• powerpc/numa: Fix multiple bugs in memoryhotplugmax() (bsc#1066223).
• powerpc/numa: Fix whitespace in hotadddrconfmemorymax() (bsc#1066223).
• powerpc/opal: Fix EBUSY bug in acquiring tokens (bsc#1066223).
• powerpc/perf: Remove PPMUHASSSLOT flag for Power8 (bsc#1066223).
• powerpc/powernv/ioda: Fix endianness when reading TCEs (bsc#1066223).
• powerpc/powernv: Make opaleventshutdown() callable from IRQ context (bsc#1066223).
• powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister (bsc#1067888).
• powerpc/pseries/vio: Dispose of virq mapping on vdevice unregister (bsc#1067888).
• powerpc: Secure memory rfi flush (bsc#1068032).
• powerpc/signal: Properly handle return value from uprobedenysignal() (bsc#1066223).
• powerpc/sysrq: Fix oops whem ppmu is not registered (bsc#1066223).
• power: supply: bq27xxx_battery: Fix register map for BQ27510 and BQ27520 ('bsc#1069270').
• power: supply: isp1704: Fix unchecked return value of devm_kzalloc (bsc#1031717).
• power: supply: lp8788: prevent out of bounds array access (bsc#1031717).
• power_supply: tps65217-charger: Fix NULL deref during property export (bsc#1031717).
• ppp: fix race in ppp device destruction (bnc#1012382).
• Prevent timer value 0 for MWAITX (bsc#1065717).
• printk/console: Always disable boot consoles that use init memory before it is freed (bsc#1063026).
• printk/console: Enhance the check for consoles using init memory (bsc#1063026).
• printk: include <asm/sections.h> instead of <asm-generic/sections.h> (bsc#1063026).
• printk: only unregister boot consoles when necessary (bsc#1063026).
• pti: unbreak EFI (bsc#1074709).
• ptrace: Add a new thread access check (bsc#1068032).
• qla2xxx: prevent speculative execution (bnc#1068032).
• quota: Check for register_shrinker() failure (bsc#1012829).
• r8169: Do not increment tx_dropped in TX ring cleaning (bsc#1031717).
• rbd: use GFP_NOIO for parent stat and data requests (bnc#1012382).
• rdma/uverbs: Prevent leak of reserved field (bsc#1022595 FATE#322350).
• rds: RDMA: return appropriate error on rdma map failures (bnc#1012382).
• Redo encryption backport to fix pkt signing (bsc#1071009, fate#324404).
• regulator: core: Limit propagation of parent voltage count and list (bsc#1070145).
• regulator: fan53555: fix I2C device ids (bnc#1012382).
• Revert 'crypto: xts - Add ECB dependency' (bnc#1012382).
• Revert 'drm: bridge: add DT bindings for TI ths8135' (bnc#1012382).
• Revert 'drm/radeon: dont switch vt on suspend' (bnc#1012382).
• Revert 'ipsec: Fix aborted xfrm policy dump crash' (kabi).
• Revert 'netlink: add a start callback for starting a netlink dump' (kabi).
• Revert 'phy: increase size of MIIBUSIDSIZE and busid' (kabi).
• Revert 'sctp: do not peel off an assoc from one netns to another one' (bnc#1012382).
• Revert 'uapi: fix linux/rds.h userspace compilation errors' (bnc#1012382).
• rpm/kernel-binary.spec.in: add the kernel-binary dependencies to kernel-binary-base (bsc#1060333).
• rpm/kernel-binary.spec.in: Correct supplements for recent SLE products (bsc#1067494)
• rpm/kernel-binary.spec.in: only rewrite modules.dep if non-zero in size (bsc#1056979).
• rtc: ds1307: Fix relying on reset value for weekday (bsc#1031717).
• rtc: ds1374: wdt: Fix issue with timeout scaling from secs to wdt ticks (bsc#1031717).
• rtc: ds1374: wdt: Fix stop/start ioctl always returning -EINVAL (bsc#1031717).
• rtc: rtc-nuc900: fix loop timeout test (bsc#1031717).
• rtc: sa1100: fix unbalanced clkprepareenable/clkdisableunprepare (bsc#1031717).
• rt/fs/dcache: Convert sanonlock to a raw spinlock for RT
• rtlwifi: fix uninitialized rtlhal->lastsuspendsec time (bnc#1012382).
• rtlwifi: rtl8192ee: Fix memory leak when loading firmware (bnc#1012382).
• rtlwifi: rtl8821ae: Fix HWVARNAV_UPPER operation (bsc#1031717).
• s390: add ppa to system call and program check path (bsc#1068032).
• s390/dasd: check for device error pointer within state change interrupts (bnc#1012382).
• s390/disassembler: add missing end marker for e7 table (bnc#1012382).
• s390/disassembler: correct disassembly lines alignment (bsc#1070825).
• s390/disassembler: increase show_code buffer size (bnc#1012382).
• s390: fix transactional execution control register handling (bnc#1012382).
• s390: introduce CPU alternatives.
• s390: introduce CPU alternatives (bsc#1068032).
• s390/kbuild: enable modversions for symbols exported from asm (bnc#1012382).
• s390/qeth: issue STARTLAN as first IPA command (bnc#1012382).
• s390/runtime instrumention: fix possible memory corruption (bnc#1012382).
• s390/spinlock: add gmb memory barrier
• s390/spinlock: add gmb memory barrier (bsc#1068032).
• s390/spinlock: add ppa to system call path Signoff the s390 patches.
• sched/core: Add switchmmirqs_off() and use it in the scheduler (bsc#1068032).
• sched/core: Idletaskexit() shouldn't use switchmmirqs_off() (bsc#1068032).
• sched: Make resched_cpu() unconditional (bnc#1012382).
• sched/rt: Do not pull from current CPU if only one CPU to pull (bnc#1022476).
• sched/rt: Simplify the IPI based RT balancing logic (bnc#1012382).
• scsi: aacraid: Process Error for response I/O (bnc#1012382).
• scsi_devinfo: cleanly zero-pad devinfo strings (bsc#1062941).
• scsidhalua: skip RTPG for devices only supporting active/optimized (bsc#1064311).
• scsi: ipr: Fix scsi-mq lockdep issue (bsc#1066213).
• scsi: ipr: Set noreportopcodes for RAID arrays (bsc#1066213).
• scsi: libiscsi: fix shifting of DID_REQUEUE host byte (bsc#1056003).
• scsi: lpfc: Add missing memory barrier (bnc#1012382).
• scsi: lpfc: Clear the VendorVersion in the PLOGI/PLOGI ACC payload (bnc#1012382).
• scsi: lpfc: Correct host name in symbolic_name field (bnc#1012382).
• scsi: lpfc: Correct issue leading to oops during link reset (bnc#1012382).
• scsi: lpfc: FCoE VPort enable-disable does not bring up the VPort (bnc#1012382).
• scsiscan: Exit loop if TUR to LUN0 fails with 0x05/0x25 (bsc#1063043). This is specific to FUJITSU ETERNUSDX* targets. They can return 'Illegal Request - Logical unit not supported' and processing should leave the timeout loop in this case.
• scsi: scsi_devinfo: fixup string compare (bsc#1062941).
• scsi: scsi_devinfo: handle non-terminated strings (bsc#1062941).
• scsi: ses: check return code from sesrecvdiag() (bsc#1039616).
• scsi: ses: Fixup error message 'failed to get diagnostic page 0xffffffea' (bsc#1039616).
• scsi: ses: Fix wrong page error (bsc#1039616).
• scsi: ses: make page2 support optional (bsc#1039616).
• scsi: sg: Re-fix off by one in sgfillrequest_table() (bnc#1012382).
• scsi: ufs: add capability to keep auto bkops always enabled (bnc#1012382).
• scsi: ufs-qcom: Fix module autoload (bnc#1012382).
• scsi: virtio_scsi: let host do exception handling (bsc#1060682).
• scsi: zfcp: fix erp_action use-before-initialize in REC action trace (bnc#1012382).
• sctp: add the missing sockownedbyuser check in sctpicmp_redirect (bnc#1012382).
• sctp: do not peel off an assoc from one netns to another one (bnc#1012382).
• sctp: do not peel off an assoc from one netns to another one (bnc#1012382).
• sctp: reset owner sk for data chunks on out queues when migrating a sock (bnc#1012382).
• security/keys: add CONFIGKEYSCOMPAT to Kconfig (bnc#1012382).
• selftests: firmware: add empty string and async tests (bnc#1012382).
• selftests: firmware: send expected errors to /dev/null (bnc#1012382).
• serial: 8250_fintek: Fix rs485 disablement on invalid ioctl() (bsc#1031717).
• serial: 8250_uniphier: fix serial port index in private data (bsc#1031717).
• serial: omap: Fix EFR write on RTS deassertion (bnc#1012382).
• serial: Remove unused port type (bsc#1066045).
• serial: sh-sci: Fix register offsets for the IRDA serial port (bnc#1012382).
• smb2: Fix share type handling (bnc#1074392).
• smb3: parsing for new snapshot timestamp mount parm (FATE#324404). New mount option 'snapshot=<time>' to allow mounting an earlier version of the remote volume (if such a snapshot exists on the server). Note that eventually specifying a snapshot time of 1 will allow the user to mount the oldest snapshot. A subsequent patch add the processing for that and another for actually specifying the 'time warp' create context on SMB2/SMB3 open. Check to make sure SMB2 negotiated, and ensure that we use a different tcon if mount same share twice but with different snaphshot times
• spi: SPIFSLDSPI should depend on HAS_DMA (bnc#1012382).
• spi: uapi: spidev: add missing ioctl header (bnc#1012382).
• staging: iio: cdc: fix improper return value (bnc#1012382).
• staging: lustre: hsm: stack overrun in haidumpdata_field (bnc#1012382).
• staging: lustre: llite: do not invoke direct_IO for the EOF case (bnc#1012382).
• staging: lustre: ptlrpc: skip lock if export failed (bnc#1012382).
• staging: r8712u: Fix Sparse warning in rtl871x_xmit.c (bnc#1012382).
• staging: rtl8188eu: fix incorrect ERROR tags from logs (bnc#1012382).
• staging: rtl8712: fixed little endian problem (bnc#1012382).
• staging: rtl8712u: Fix endian settings for structs describing network packets (bnc#1012382).
• sunrpc: add authunix hashcred() function (bsc#1012917).
• sunrpc: add genericauth hashcred() function (bsc#1012917).
• sunrpc: add hashcred() function to rpcauthops struct (bsc#1012917).
• sunrpc: add RPCSECGSS hashcred() function (bsc#1012917).
• sunrpc: Fix tracepoint storage issues with svcrecv and svcrqst_status (bnc#1012382).
• sunrpc: replace generic auth_cred hash with auth-specific function (bsc#1012917).
• sunrpc: use supplimental groups in auth hash (bsc#1012917).
• target: fix ALUA state file path truncation (bsc#1071231).
• target: Fix node_acl demo-mode + uncached dynamic shutdown regression (bnc#1012382).
• target: fix PR state file path truncation (bsc#1071231).
• target: Fix QUEUE_FULL + SCSI task attribute handling (bnc#1012382).
• target/iscsi: Fix iSCSI task reassignment handling (bnc#1012382).
• tcp/dccp: fix ireq->opt races (bnc#1012382).
• tcp/dccp: fix lockdep splat in inetcskroute_req() (bnc#1012382).
• tcp/dccp: fix other lockdep splats accessing ireq_opt (bnc#1012382).
• tcp: do not mangle skb->cb[] in tcpmakesynack() (bnc#1012382).
• tcp: fix tcpmtuprobe() vs highest_sack (bnc#1012382).
• test: firmware_class: report errors properly on failure (bnc#1012382).
• thermal/int340x: prevent speculative execution (bnc#1068032).
• tipc: fix link attribute propagation bug (bnc#1012382).
• tools: firmware: check for distro fallback udev cancel rule (bnc#1012382).
• tracing/samples: Fix creation and deletion of simplethreadfn creation (bnc#1012382).
• tun: allow positive return values on devgetvalid_name() call (bnc#1012382).
• tun: call devgetvalidname() before registernetdevice() (bnc#1012382).
• tun/tap: sanitize TUNSETSNDBUF input (bnc#1012382).
• uapi: fix linux/rds.h userspace compilation error (bnc#1012382).
• uapi: fix linux/rds.h userspace compilation errors (bnc#1012382).
• udf: prevent speculative execution (bnc#1068032).
• usb: Add delay-init quirk for Corsair K70 LUX keyboards (bnc#1012382).
• usb: hcd: initialize hcd->flags to 0 when rm hcd (bnc#1012382).
• usb: host: fix incorrect updating of offset (bsc#1047487).
• usb: serial: garmin_gps: fix I/O after failed probe and remove (bnc#1012382).
• usb: serial: garmin_gps: fix memory leak on probe errors (bnc#1012382).
• usb: serial: qcserial: add pid/vid for Sierra Wireless EM7355 fw update (bnc#1012382).
• usb: usbfs: compute urb->actual_length for isochronous (bnc#1012382).
• usb: usbtest: fix NULL pointer dereference (bnc#1012382).
• usb: xhci: Handle error condition in xhcistopdevice() (bnc#1012382).
• userns: prevent speculative execution (bnc#1068032).
• uvcvideo: prevent speculative execution (bnc#1068032).
• vfs: expedite unmount (bsc#1024412).
• video: fbdev: pmag-ba-fb: Remove bad `__init' annotation (bnc#1012382).
• video: udlfb: Fix read EDID timeout (bsc#1031717).
• vlan: fix a use-after-free in vlandeviceevent() (bnc#1012382).
• vsock: use new wait API for vsockstreamsendmsg() (bnc#1012382).
• vxlan: correctly handle ipv6.disable module parameter (bsc#1072962).
• workqueue: Fix NULL pointer dereference (bnc#1012382).
• workqueue: replace pool->manager_arb mutex with a flag (bnc#1012382).
• x86/boot: Add early cmdline parsing for options with arguments.
• x86/CPU/AMD: Add speculative control support for AMD (bsc#1068032).
• x86/CPU/AMD: Make the LFENCE instruction serialized (bsc#1068032).
• x86/CPU/AMD: Remove now unused definition of MFENCE_RDTSC feature (bsc#1068032).
• x86/CPU: Check speculation control CPUID bit (bsc#1068032).
• x86/decoder: Add new TEST instruction pattern (bnc#1012382).
• x86/efi-bgrt: Fix kernel panic when mapping BGRT data (bnc#1012382).
• x86/efi-bgrt: Replace early_memremap() with memremap() (bnc#1012382).
• x86/efi: Build our own page table structures (bnc#1012382).
• x86/efi: Hoist page table switching code into eficallvirt() (bnc#1012382).
• x86/enter: Add macros to set/clear IBRS and set IBPB (bsc#1068032).
• x86/entry: Add a function to overwrite the RSB (bsc#1068032).
• x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (bsc#1068032).
• x86/entry: Use IBRS on entry to kernel space (bsc#1068032).
• x86/feature: Enable the x86 feature to control Speculation (bsc#1068032).
• x86/idle: Disable IBRS when offlining a CPU and re-enable on wakeup (bsc#1068032).
• x86/idle: Toggle IBRS when going idle (bsc#1068032).
• x86/kaiser: Check boottime cmdline params.
• x86/kaiser: Move feature detection up (bsc#1068032).
• x86/kaiser: Reenable PARAVIRT.
• x86/kaiser: Rename and simplify X86FEATUREKAISER handling.
• x86/kvm: Add MSRIA32SPECCTRL and MSRIA32PREDCMD to kvm (bsc#1068032).
• x86/kvm: Flush IBP when switching VMs (bsc#1068032).
• x86/kvm: Pad RSB on VM transition (bsc#1068032).
• x86/kvm: Toggle IBRS on VM entry and exit (bsc#1068032).
• x86/MCE/AMD: Always give panic severity for UC errors in kernel context (git-fixes bf80bbd7dcf5).
• x86/microcode/AMD: Add support for fam17h microcode loading (bsc#1068032).
• x86/microcode/intel: Disable late loading on model 79 (bnc#1012382).
• x86/mm/64: Fix reboot interaction with CR4.PCIDE (bsc#1068032).
• x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID (bsc#1068032).
• x86/mm: Add INVPCID helpers (bsc#1068032).
• x86/mm: Add the 'nopcid' boot option to turn off PCID (bsc#1068032).
• x86/mm: Build arch/x86/mm/tlb.c even on !SMP (bsc#1068032).
• x86/mm: Enable CR4.PCIDE on supported systems (bsc#1068032).
• x86/mm: Fix INVPCID asm constraint (bsc#1068032).
• x86/mm: If INVPCID is available, use it to flush global mappings (bsc#1068032).
• x86/mm: Make flushtlbmm_range() more predictable (bsc#1068032).
• x86/mm: Only set IBPB when the new thread cannot ptrace current thread (bsc#1068032).
• x86/mm/pat: Ensure cpa->pfn only contains page frame numbers (bnc#1012382).
• x86/mm: Reimplement flushtlbpage() using flushtlbmm_range() (bsc#1068032).
• x86/mm: Remove flushtlb() and flushtlbcurrenttask() (bsc#1068032).
• x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code (bsc#1068032).
• x86/mm, sched/core: Turn off IRQs in switch_mm() (bsc#1068032).
• x86/mm, sched/core: Uninline switch_mm() (bsc#1068032).
• x86/mm: Set IBPB upon context switch (bsc#1068032).
• x86/MSR: Move native_*msr(.. u64) to msr.h (bsc#1068032).
• x86/oprofile/ppro: Do not use _thiscpu*() in preemptible context (bnc#1012382).
• x86/paravirt: Dont patch flushtlbsingle (bsc#1068032).
• x86/spec: Add IBRS control functions (bsc#1068032).
• x86/spec: Add 'nospec' chicken bit (bsc#1068032).
• x86/spec: Check CPUID direclty post microcode reload to support IBPB feature (bsc#1068032).
• x86/spec_ctrl: Add an Indirect Branch Predictor barrier (bsc#1068032).
• x86/spec_ctrl: Check whether IBPB is enabled before using it (bsc#1068032).
• x86/spec_ctrl: Check whether IBRS is enabled before using it (bsc#1068032).
• x86/svm: Add code to clear registers on VM exit (bsc#1068032).
• x86/svm: Clobber the RSB on VM exit (bsc#1068032).
• x86/svm: Set IBPB when running a different VCPU (bsc#1068032).
• x86/svm: Set IBRS value on VM entry and exit (bsc#1068032).
• x86/uaccess, sched/preempt: Verify access_ok() context (bnc#1012382).
• xen: do not print error message in case of missing Xenstore entry (bnc#1012382).
• xen/events: eventsfifo: Do not use {get,put}cpu() in xenevtchnfifo_init() (bnc#1065600).
• xen: fix booting ballooned down hvm guest (bnc#1065600).
• xen/gntdev: avoid out of bounds access in case of partial gntdev_mmap() (bnc#1012382).
• xen/manage: correct return value check on xenbus_scanf() (bnc#1012382).
• xen-netback: fix error handling output (bnc#1065600).
• xen: x86: mark xenfindptbase as _init (bnc#1065600).
• xen: xenbus driver must not accept invalid transaction ids (bnc#1012382).
• zd1211rw: fix NULL-deref at probe (bsc#1031717).