SUSE-SU-2019:1245-1

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.178 to receive various security and bugfixes.

Four new speculative execution issues have been identified in Intel CPUs. (bsc#1111331)

• CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS)
• CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS)
• CVE-2018-12130: Microarchitectural Load Port Data Samling (MLPDS)
• CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

This kernel update contains software mitigations, utilizing CPU microcode updates shipped in parallel.

For more information on this set of information leaks, check out https://www.suse.com/support/kb/doc/?id=7023736

The following security issues fixed:

• CVE-2018-5814: Multiple race condition errors when handling probe, disconnect, and rebind operations could be exploited to trigger a use-after-free condition or a NULL pointer dereference by sending multiple USB over IP packets (bnc#1096480).
• CVE-2018-1000204: Prevent infoleak caused by incorrect handling of the SG_IO ioctl (bsc#1096728)
• CVE-2018-10853: A flaw was found in the way the KVM hypervisor emulated instructions such as sgdt/sidt/fxsave/fxrstor. It did not check current privilege(CPL) level while emulating unprivileged instructions. An unprivileged guest user/process could use this flaw to potentially escalate privileges inside guest (bnc#1097104).
• CVE-2018-15594: arch/x86/kernel/paravirt.c mishandled certain indirect calls, which made it easier for attackers to conduct Spectre-v2 attacks against paravirtual guests (bnc#1105348).
• CVE-2019-9503: A brcmfmac frame validation bypass was fixed (bnc#1132828).
• CVE-2019-3882: A flaw was fixed in the vfio interface implementation that permitted violation of the user's locked memory limit. If a device is bound to a vfio driver, such as vfio-pci, and the local attacker is administratively granted ownership of the device, it may cause a system memory exhaustion and thus a denial of service (DoS). Versions 3.10, 4.14 and 4.18 are vulnerable (bnc#1131416 bnc#1131427).

The following non-security bugs were fixed:

• 9p/net: fix memory leak in p9clientcreate (bnc#1012382).
• 9p: use inode->ilock to protect isize_write() under 32-bit (bnc#1012382).
• acpi: acpipad: Do not launch acpipad threads on idle cpus (bsc#1113399).
• acpi / bus: Only call dmichecksystem() on X86 (git-fixes).
• acpi / button: make module loadable when booted in non-ACPI mode (bsc#1051510).
• acpi / device_sysfs: Avoid OF modalias creation for removed device (bnc#1012382).
• acpi: include ACPI button driver in base kernel (bsc#1062056).
• Add hlistaddtail_rcu() (Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net) (bnc#1012382).
• alsa: bebob: use more identical mod_alias for Saffire Pro 10 I/O against Liquid Saffire 56 (bnc#1012382).
• alsa: compress: add support for 32bit calls in a 64bit kernel (bnc#1012382).
• alsa: compress: prevent potential divide by zero bugs (bnc#1012382).
• alsa: hda - Enforces runtime_resume after S3 and S4 for each codec (bnc#1012382).
• alsa: hda - Record the current power state before suspend/resume calls (bnc#1012382).
• alsa: pcm: Do not suspend stream in unrecoverable PCM state (bnc#1012382).
• alsa: pcm: Fix possible OOB access in PCM oss plugins (bnc#1012382).
• alsa: rawmidi: Fix potential Spectre v1 vulnerability (bnc#1012382).
• alsa: seq: oss: Fix Spectre v1 vulnerability (bnc#1012382).
• applicom: Fix potential Spectre v1 vulnerabilities (bnc#1012382).
• arc: fix __ffs return value to avoid build warnings (bnc#1012382).
• arc: uacces: remove lpstart, lpend from clobber list (bnc#1012382).
• arcv2: Enable unaligned access in early ASM code (bnc#1012382).
• arm64: fix COMPAT_SHMLBA definition for large pages (bnc#1012382).
• arm64: Fix NUMA build error when !CONFIG_ACPI (fate#319981, git-fixes).
• arm64: Fix NUMA build error when !CONFIG_ACPI (git-fixes).
• arm64: hide _efistub aliases from kallsyms (bnc#1012382).
• arm64: kconfig: drop CONFIGRTCLIB dependency (bnc#1012382).
• arm64/kernel: fix incorrect EL0 check in inv_entry macro (bnc#1012382).
• arm64: mm: Add traceirqflags annotations to dodebug_exception() (bnc#1012382).
• arm64: Relax GIC version check during early boot (bnc#1012382).
• arm64: support keyctl() system call in 32-bit mode (bnc#1012382).
• arm64: traps: disable irq in die() (bnc#1012382).
• arm: 8458/1: bL_switcher: add GIC dependency (bnc#1012382).
• arm: 8494/1: mm: Enable PXN when running non-LPAE kernel on LPAE processor (bnc#1012382).
• arm: 8510/1: rework ARMCPUSUSPEND dependencies (bnc#1012382).
• arm: 8824/1: fix a migrating irq bug when hotplug cpu (bnc#1012382).
• arm: dts: exynos: Add minimal clkout parameters to Exynos3250 PMU (bnc#1012382).
• arm: dts: exynos: Do not ignore real-world fuse values for thermal zone 0 on Exynos5420 (bnc#1012382).
• arm: imx6q: cpuidle: fix bug that CPU might not wake up at expected time (bnc#1012382).
• arm: OMAP2+: Variable 'reg' in function omap4dsimux_pads() could be uninitialized (bnc#1012382).
• arm: pxa: ssp: unneeded to free devm_ allocated data (bnc#1012382).
• arm: s3c24xx: Fix boolean expressions in osirisdvsnotify (bnc#1012382).
• ASoC: dapm: change snprintf to scnprintf for possible overflow (bnc#1012382).
• ASoC: fslesai: fix register setting issue in RIGHTJ mode (bnc#1012382).
• ASoC: imx-audmux: change snprintf to scnprintf for possible overflow (bnc#1012382).
• ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field (bnc#1012382).
• ASoC: topology: free created components in tplg load error (bnc#1012382).
• assoc_array: Fix shortcut creation (bnc#1012382).
• ath10k: avoid possible string overflow (bnc#1012382).
• ath9khtc: Add a sanity check in ath9khtcampduaction() (bsc#1087092).
• atm: he: fix sign-extension overflow on large shift (bnc#1012382).
• autofs: drop dentry reference only when it is never used (bnc#1012382).
• autofs: fix error return in autofsfillsuper() (bnc#1012382).
• batman-adv: Avoid endless loop in bat-on-bat netdevice check (git-fixes).
• batman-adv: Fix lockdep annotation of batadvtlvcontainer_remove (git-fixes).
• batman-adv: fix uninit-value in batadvinterfacetx() (bnc#1012382).
• batman-adv: Only put gw_node list reference when removed (git-fixes).
• batman-adv: Only put orignodevlan list reference when removed (git-fixes).
• bluetooth: Check L2CAP option sizes returned from l2capgetconf_opt (bnc#1012382).
• bnxt_en: Drop oversize TX packets to prevent errors (bnc#1012382).
• btrfs: Avoid possible qgrouprsvsize overflow in btrfscalculateinodeblockrsv_size (git-fixes).
• btrfs: Fix bound checking in qgrouptracenewsubtreeblocks (pending fix for bsc#1063638).
• btrfs: fix corruption reading shared and compressed extents after hole punching (bnc#1012382).
• btrfs: qgroup: Cleanup old subtree swap code (bsc#1063638).
• btrfs: qgroup: Do not trace subtree if we're dropping reloc tree (bsc#1063638).
• btrfs: qgroup: Introduce function to find all new tree blocks of reloc tree (bsc#1063638).
• btrfs: qgroup: Introduce function to trace two swaped extents (bsc#1063638).
• btrfs: qgroup: Introduce per-root swapped blocks infrastructure (bsc#1063638).
• btrfs: qgroup: Introduce trace event to analyse the number of dirty extents accounted (bsc#1063638 dependency).
• btrfs: qgroup: Only trace data extents in leaves if we're relocating data block group (bsc#1063638).
• btrfs: qgroup: Refactor btrfsqgrouptracesubtreeswap (bsc#1063638).
• btrfs: qgroup: Search commit root for rescan to avoid missing extent (bsc#1129326).
• btrfs: qgroup: Use delayed subtree rescan for balance (bsc#1063638).
• btrfs: qgroup: Use generation-aware subtree swap to mark dirty extents (bsc#1063638).
• btrfs: raid56: properly unmap parity page in finishparityscrub() (bnc#1012382).
• btrfs: relocation: Delay reloc tree deletion after mergerelocroots (bsc#1063638).
• btrfs: remove WARNON in logdir_items (bnc#1012382).
• cdc-wdm: pass return value of recoverfromurb_loss (bsc#1129770).
• cfg80211: extend range deviation for DMG (bnc#1012382).
• cfg80211: size various nl80211 messages correctly (bnc#1012382).
• cifs: fix computation for MAXSMB2HDR_SIZE (bnc#1012382).
• cifs: fix POSIX lock leak and invalid ptr deref (bsc#1114542).
• cifs: Fix read after write for files with read caching (bnc#1012382).
• clk: ingenic: Fix round_rate misbehaving with non-integer dividers (bnc#1012382).
• clocksource/drivers/exynos_mct: Clear timer interrupt when shutdown (bnc#1012382).
• clocksource/drivers/exynos_mct: Move one-shot check from tick clear to ISR (bnc#1012382).
• cls_bpf: reset class and reuse major in da (git-fixes).
• coresight: coresight_unregister() function cleanup (bnc#1012382).
• coresight: 'DEVICEATTRRO' should defined as static (bnc#1012382).
• coresight: etm4x: Check every parameter used by dmaxxcoherent (bnc#1012382).
• coresight: fixing lockdep error (bnc#1012382).
• coresight: release reference taken by 'busfinddevice()' (bnc#1012382).
• coresight: remove csdev's link from topology (bnc#1012382).
• coresight: removing bind/unbind options from sysfs (bnc#1012382).
• cpufreq: pxa2xx: remove incorrect __init annotation (bnc#1012382).
• cpufreq: tegra124: add missing ofnodeput() (bnc#1012382).
• cpufreq: Use struct kobjattribute instead of struct globalattr (bnc#1012382).
• cpu/hotplug: Handle unbalanced hotplug enable/disable (bnc#1012382).
• cpu/speculation: Add 'mitigations=' cmdline option (bsc#1112178).
• crypto: ahash - fix another early termination in hash walk (bnc#1012382).
• crypto: arm64/aes-ccm - fix logical bug in AAD MAC handling (bnc#1012382).
• crypto: caam - fixed handling of sg list (bnc#1012382).
• crypto: pcbc - remove bogus memcpy()s with src == dest (bnc#1012382).
• crypto: qat - remove unused and redundant pointer vf_info (bsc#1085539).
• crypto: tgr192 - fix unaligned memory access (bsc#1129770).
• cw1200: fix missing unlock on error in cw1200hwscan() (bsc#1129770).
• dccp: do not use ipv6 header for ipv4 flow (bnc#1012382).
• disable kgdboc failed by echo space to /sys/module/kgdboc/parameters/kgdboc (bnc#1012382).
• dmaengine: at_xdmac: Fix wrongfull report of a channel as in use (bnc#1012382).
• dmaengine: dmatest: Abort test in case of mapping error (bnc#1012382).
• dmaengine: usb-dmac: Make DMAC system sleep callbacks explicit (bnc#1012382).
• dm: disable DISCARD if the underlying storage no longer supports it (bsc#1114638).
• dm: fix to_sector() for 32bit (bnc#1012382).
• drivers: hv: vmbus: Fix bugs in rescind handling (bsc#1130567).
• drivers: hv: vmbus: Fix ring buffer signaling (bsc#1118506).
• drivers: hv: vmbus: Fix the offerinprogress in vmbusprocessoffer() (bsc#1130567).
• drivers: hv: vmbus: Offload the handling of channels to two workqueues (bsc#1130567).
• drivers: hv: vmbus: Reset the channel callback in vmbusonofferrescind() (bsc#1130567).
• drm/msm: Unblock writer if reader closes file (bnc#1012382).
• drm/vmwgfx: Do not double-free the mode stored in par->set_mode (bsc#1106929)
• efi: stub: define DISABLEBRANCHPROFILING for all architectures (bnc#1012382).
• ext2: Fix underflow in ext2maxsize() (bnc#1012382).
• ext4: Avoid panic during forced reboot (bsc#1126356).
• ext4: brelse all indirect buffer in ext4indremove_space() (bnc#1012382).
• ext4: fix data corruption caused by unaligned direct AIO (bnc#1012382).
• ext4: fix NULL pointer dereference while journal is aborted (bnc#1012382).
• extcon: usb-gpio: Do not miss event during suspend/resume (bnc#1012382).
• firmware: dmi: Optimize dmi_matches (git-fixes).
• floppy: check_events callback should not return a negative number (git-fixes).
• flow_dissector: Check for IP fragmentation even if not using IPv4 address (git-fixes).
• fs/9p: use fscache mutex rather than spinlock (bnc#1012382).
• fs/nfs: Fix nfsparsedevname to not modify it's argument (git-fixes).
• fs/proc/procsysctl.c: fix NULL pointer dereference in putlinks (bnc#1012382).
• fuse: continue to send FUSERELEASEDIR when FUSEOPEN returns ENOSYS (git-fixes).
• fuse: fix possibly missed wake-up after abort (git-fixes).
• futex: Ensure that futex address is aligned in handlefutexdeath() (bnc#1012382).
• futex,rtmutex: Fix rtmutexcleanupproxy_lock() (git-fixes).
• futex,rtmutex: Restructure rtmutexfinishproxy_lock() (bnc#1012382).
• gpio: adnp: Fix testing wrong value in adnpgpiodirection_input (bnc#1012382).
• gpio: vf610: Mask all GPIO interrupts (bnc#1012382).
• grocells: make sure device is up in grocells_receive() (bnc#1012382).
• hid-sensor-hub.c: fix wrong do_div() usage (bnc#1012382).
• hpet: Fix missing '=' character in the _setup() code of hpetmmap_enable (bsc#1129770).
• hugetlbfs: fix races and page leaks during migration (bnc#1012382).
• hv_netvsc: Fix napi reschedule while receive completion is busy (bsc#1118506).
• hv_netvsc: fix race in napi poll when rescheduling (bsc#1118506).
• hv_netvsc: Fix the return status in RX path (bsc#1118506).
• hvnetvsc: use napischedule_irqoff (bsc#1118506).
• hv: v4.12 API for hyperv-iommu (bsc#1122822).
• hv: v4.12 API for hyperv-iommu (fate#327171, bsc#1122822).
• i2c: cadence: Fix the hold bit setting (bnc#1012382).
• i2c: tegra: fix maximum transfer size (bnc#1012382).
• ib/{hfi1, qib}: Fix WC.bytelen calculation for UDSENDWITHIMM (bnc#1012382).
• ibmvnic: Enable GRO (bsc#1132227).
• ibmvnic: Fix completion structure initialization (bsc#1131659).
• ibmvnic: Fix netdev feature clobbering during a reset (bsc#1132227).
• input: elan_i2c - add id for touchpad found in Lenovo s21e-20 (bnc#1012382).
• input: matrixkeypad - use flushdelayed_work() (bnc#1012382).
• input: st-keyscan - fix potential zalloc NULL dereference (bnc#1012382).
• input: wacom_serial4 - add support for Wacom ArtPad II tablet (bnc#1012382).
• intel_th: Do not reference unassigned outputs (bnc#1012382).
• intel_th: gth: Fix an off-by-one in output unassigning (git-fixes).
• iommu/amd: Fix NULL dereference bug in matchhiduid (bsc#1130345).
• iommu/amd: fix sg->dmaaddress for sg->offset bigger than PAGESIZE (bsc#1130346).
• iommu/amd: Reserve exclusion range in iova-domain (bsc#1130425).
• iommu/amd: Set exclusion range correctly (bsc#1130425).
• iommu: Do not print warning when IOMMU driver only supports unmanaged domains (bsc#1130130).
• iommu/hyper-v: Add Hyper-V stub IOMMU driver (bsc#1122822).
• iommu/hyper-v: Add Hyper-V stub IOMMU driver (fate#327171, bsc#1122822).
• iommu/vt-d: Check capability before disabling protected memory (bsc#1130347).
• ip6: fix PMTU discovery when using /127 subnets (git-fixes).
• ip6mr: Do not call _IP6INC_STATS() from preemptible context (bnc#1012382).
• iptunnel: fix ip tunnel lookup in collectmd mode (git-fixes).
• ipvlan: disallow userns capnetadmin to change global mode/flags (bnc#1012382).
• ipvs: Fix signed integer overflow when setsockopt timeout (bnc#1012382).
• irqchip/mmp: Only touch the PJ4 IRQ & FIQ bits on enable/disable (bnc#1012382).
• iscsi_ibft: Fix missing break in switch statement (bnc#1012382).
• isdn: avm: Fix string plus integer warning from Clang (bnc#1012382).
• isdn: i4l: isdn_tty: Fix some concurrency double-free bugs (bnc#1012382).
• isdn: isdn_tty: fix build warning of strncpy (bnc#1012382).
• iwlwifi: dbg: do not crash if the firmware crashes in the middle of a debug dump (bsc#1119086).
• jbd2: clear dirty flag when revoking a buffer from an older transaction (bnc#1012382).
• jbd2: fix compile warning when using JBUFFER_TRACE (bnc#1012382).
• kabi fixup gendisk disk_devt revert (bsc#1020989).
• kbuild: setlocalversion: print error to STDERR (bnc#1012382).
• kernel/sysctl.c: add missing range check in doprocdointvecminmaxconv (bnc#1012382).
• keys: allow reaching the keys quotas exactly (bnc#1012382).
• keys: always initialize keyringindexkey::desc_len (bnc#1012382).
• keys: restrict /proc/keys by credentials at open time (bnc#1012382).
• keys: user: Align the payload buffer (bnc#1012382).
• kvm: Call kvmarchmemslots_updated() before updating memslots (bsc#1132634).
• kvm: nSVM: clear events pending from svmcompleteinterrupts() when exiting to L1 (bnc#1012382).
• kvm: nVMX: Apply addr size mask to effective address for VMX instructions (bsc#1132635).
• kvm: nVMX: Ignore limit checks on VMX instructions using flat segments (bnc#1012382).
• kvm: nVMX: Sign extend displacements of VMX instr's mem operands (bnc#1012382).
• kvm: Reject device ioctls from processes other than the VM's creator (bnc#1012382).
• kvm: VMX: Compare only a single byte for VMCS' 'launched' in vCPU-run (bsc#1132636).
• kvm: VMX: Zero out all general purpose registers after VM-Exit (bsc#1132637).
• kvm: x86: Emulate MSRIA32ARCH_CAPABILITIES on AMD hosts (bsc#1132534).
• kvm: X86: Fix residual mmio emulation request to userspace (bnc#1012382).
• kvm: x86/mmu: Do not cache MMIO accesses while memslots are in flux (bsc#1132638).
• l2tp: fix infoleak in l2tpip6recvmsg() (git-fixes).
• leds: lp5523: fix a missing check of return value of lp55xx_read (bnc#1012382).
• libertas: call into generic suspend code before turning off power (bsc#1106110).
• libertas: fix suspend and resume for SDIO connected cards (bsc#1106110).
• lib/int_sqrt: optimize small argument (bnc#1012382).
• libnvdimm/pmem: Honor force_raw for legacy pmem regions (bsc#1131857).
• locking/lockdep: Add debuglocks check in _lock_downgrade() (bnc#1012382).
• locking/static_keys: Improve uninitialized key warning (bsc#1106913).
• m68k: Add -ffreestanding to CFLAGS (bnc#1012382).
• mac80211: do not initiate TDLS connection if station is not associated to AP (bnc#1012382).
• mac80211: fix miscounting of ttl-dropped frames (bnc#1012382).
• mac80211: fix 'warning: target metric may be used uninitialized' (bnc#1012382).
• mac80211hwsim: propagate genlmsgreply return code (bnc#1012382).
• mac8390: Fix mmio access size probe (bnc#1012382).
• md: Fix failed allocation of mdregisterthread (bnc#1012382).
• mdiobus: Fix use-after-free on deviceregister fails (bnc#1012382 git-fixes).
• md/raid1: do not clear bitmap bits on interrupted recovery (git-fixes).
• media: cx88: Get rid of spurious call to cx8800startvbi_dma() (bsc#1100132).
• media: uvcvideo: Avoid NULL pointer dereference at the end of streaming (bnc#1012382).
• media: uvcvideo: Fix 'type' check leading to overflow (bnc#1012382).
• media: uvcvideo: Fix uvcallocentity() allocation alignment (bsc#1119086).
• media: v4l2-ctrls.c/uvc: zero v4l2_event (bnc#1012382).
• media: videobuf2-v4l2: drop WARNON in vb2warnzerobytesused() (bnc#1012382).
• media: vivid: potential integer overflow in vidiocgedid() (bsc#11001132).
• mfd: ab8500-core: Return zero in getregisterinterruptible() (bnc#1012382).
• mfd: db8500-prcmu: Fix some section annotations (bnc#1012382).
• mfd: mc13xxx: Fix a missing check of a register-read failure (bnc#1012382).
• mfd: qcomrpm: write fwversion to CTRL_REG (bnc#1012382).
• mfd: tiam335xtscadc: Use PLATFORMDEVIDAUTO while registering mfd cells (bnc#1012382).
• mfd: twl-core: Fix section annotations on {,un}protectpmmaster (bnc#1012382).
• mfd: wm5110: Add missing ASRC rate register (bnc#1012382).
• mips: loongson64: lemote-2f: Add IRQFNOSUSPEND to 'cascade' irqaction (bnc#1012382).
• mISDN: hfcpci: Test both vendor & device ID for Digium HFC4S (bnc#1012382).
• missing barriers in some of unix_sock ->addr and ->path accesses (bnc#1012382).
• mmc: bcm2835: reset host on timeout (bsc#1070872).
• mmc: block: Allow more than 8 partitions per card (bnc#1012382).
• mmc: core: fix using wrong io voltage if mmcselecths200 fails (bnc#1012382).
• mmc: core: shut up 'voltage-ranges unspecified' pr_info() (bnc#1012382).
• mmc: debugfs: Add a restriction to mmc debugfs clock setting (bnc#1012382).
• mmc: make MANBKOPSEN message a debug (bnc#1012382).
• mmc: mmc: fix switch timeout issue caused by jiffies precision (bnc#1012382).
• mmc: pwrseq_simple: Make reset-gpios optional to match doc (bnc#1012382).
• mmc: pxamci: fix enum type confusion (bnc#1012382).
• mmc: sanitize 'bus width' in debug output (bnc#1012382).
• mmc: spi: Fix card detection during probe (bnc#1012382).
• mmc: tmiommccore: do not claim spurious interrupts (bnc#1012382).
• mm/debug.c: fix _dumppage when mapping->host is not set (bsc#1131934).
• mm, memoryhotplug: fix off-by-one in ispageblock_removable (git-fixes).
• mm, memoryhotplug: ismemsectionremovable do not pass the end of a zone (bnc#1012382).
• mm, memoryhotplug: testpagesina_zone do not pass the end of zone (bnc#1012382).
• mm: move ispageblockremovablenolock() to mm/memoryhotplug.c (git-fixes prerequisity).
• mm/pageisolation.c: fix a wrong flag in setmigratetype_isolate() (bsc#1131935)
• mm/rmap: replace BUGON(anonvma->degree) with VMWARNON (bnc#1012382).
• mm/vmalloc: fix size check for remapvmallocrange_partial() (bnc#1012382).
• move powerupon_resume flag to end of structure for kABI (bsc#1106110).
• mwifiex: pcie: tighten a check in mwifiexpcieprocesseventready() (bsc#1100132).
• ncpfs: fix build warning of strncpy (bnc#1012382).
• net: add description for len argument of devgetphysportname (git-fixes).
• net: Add _icmpsend helper (bnc#1012382).
• net: alteratse: fix connectlocal_phy error path (bnc#1012382).
• net: alteratse: fix msgdmatxcompletion on non-zero filllevel case (bnc#1012382).
• net: avoid use IPCB in cipsov4error (bnc#1012382).
• net: diag: support v4mapped sockets in inetdiagfindoneicsk() (bnc#1012382).
• net: do not decrement kobj reference count on init failure (git-fixes).
• net: dsa: mv88e6xxx: Fix u64 statistics (bnc#1012382).
• net: ena: fix race between link up and device initalization (bsc#1129278).
• net: ena: update driver version from 2.0.2 to 2.0.3 (bsc#1129278).
• netfilter: ipt_CLUSTERIP: fix use-after-free of proc entry (git-fixes).
• netfilter: nfconntracktcp: Fix stack out of bounds when parsing TCP options (bnc#1012382).
• netfilter: nfnetlinkacct: validate NFACCTFILTER parameters (bnc#1012382).
• netfilter: nfnetlink_log: just returns error for unknown command (bnc#1012382).
• netfilter: nfnetlink: use original skbuff when acking batches (git-fixes).
• netfilter: xtables: enforce nul-terminated table name from getsockopt GETENTRIES (bnc#1012382).
• net: hns: Fix use after free identified by SLUB debug (bnc#1012382).
• net: hns: Fix wrong read accesses via Clause 45 MDIO protocol (bnc#1012382).
• net: hsr: fix memory leak in hsrdevfinalize() (bnc#1012382).
• net/hsr: fix possible crash in add_timer() (bnc#1012382).
• netlabel: fix out-of-bounds memory accesses (bnc#1012382).
• net/mlx4en: Force CHECKSUMNONE for short ethernet frames (bnc#1012382).
• net: mv643xxeth: disable clk on error path in mv643xxethsharedprobe() (bnc#1012382).
• net: nfc: Fix NULL dereference on nfcllcpbuild_tlv fails (bnc#1012382).
• net/packet: fix 4gb buffer limit due to overflow check (bnc#1012382).
• net/packet: Set _GFPNOWARN upon allocation in allocpgvec (bnc#1012382).
• net: phy: Micrel KSZ8061: link failure after cable connect (bnc#1012382).
• net: rose: fix a possible stack overflow (bnc#1012382).
• net: Set rtmtable to RTTABLE_COMPAT for ipv6 for tables > 255 (bnc#1012382).
• net: set static variable an initial value in atl2_probe() (bnc#1012382).
• net: sit: fix UBSAN Undefined behaviour in check_6rd (bnc#1012382).
• net: stmmac: dwmac-rk: fix error handling in rkgmacpowerup() (bnc#1012382).
• net-sysfs: call devhold if kobjectinitandadd success (git-fixes).
• net-sysfs: Fix mem leak in netdevregisterkobject (bnc#1012382).
• net: systemport: Fix reception of BPDUs (bnc#1012382).
• net: tcp_memcontrol: properly detect ancestor socket pressure (git-fixes).
• net/x25: fix a race in x25_bind() (bnc#1012382).
• net/x25: fix use-after-free in x25deviceevent() (bnc#1012382).
• net/x25: reset state in x25_connect() (bnc#1012382).
• nfc: nci: memory leak in ncicoreconn_create() (git-fixes).
• nfs41: pop some layoutget errors to application (bnc#1012382).
• nfsd: fix memory corruption caused by readdir (bsc#1127445).
• nfsd: fix wrong check in writev4end_grace() (git-fixes).
• nfs: Do not recoalesce on error in nfspageiocomplete_mirror() (git-fixes).
• nfs: Fix an I/O request leakage in nfsdorecoalesce (git-fixes).
• nfs: Fix dentry revalidation on NFSv4 lookup (bsc#1132618).
• nfs: fix mount/umount race in nlmclnt (git-fixes).
• nfs: Fix NULL pointer dereference of dev_name (bnc#1012382).
• nfsv4.x: always serialize open/close operations (bsc#1114893).
• numa: change getmempolicy() to use nrnodeids instead of MAXNUMNODES (bnc#1012382).
• packets: Always register packet sk in the same order (bnc#1012382).
• parportpc: fix findsuperio io compare code, should use equal test (bnc#1012382).
• pci-hyperv: increase HVVPSETBANKCOUNT_MAX to handle 1792 vcpus (bsc#1122822).
• pci-hyperv: increase HVVPSETBANKCOUNT_MAX to handle 1792 vcpus (fate#327171, bsc#1122822).
• perf auxtrace: Define auxtrace record alignment (bnc#1012382).
• perf bench: Copy kernel files needed to build mem{cpy,set} x86_64 benchmarks (bnc#1012382).
• perf intel-pt: Fix CYC timestamp calculation after OVF (bnc#1012382).
• perf intel-pt: Fix overlap calculation for padding (bnc#1012382).
• perf intel-pt: Fix TSC slip (bnc#1012382).
• perf/ringbuffer: Refuse to begin AUX transaction after rb->auxmmap_count drops (bnc#1012382).
• perf symbols: Filter out hidden symbols from labels (bnc#1012382).
• perf: Synchronously free aux pages in case of allocation failure (bnc#1012382).
• perf tools: Handle TOPOLOGY headers with no CPU (bnc#1012382).
• perf/x86/amd: Add event map for AMD Family 17h (bsc#1114648).
• phonet: fix building with clang (bnc#1012382).
• pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins (bnc#1012382).
• platform/x86: Fix unmet dependency warning for SAMSUNG_Q10 (bnc#1012382).
• pm / Hibernate: Call flushicacherange() on pages restored in-place (bnc#1012382).
• pm / wakeup: Rework wakeup source timer cancellation (bnc#1012382).
• powerpc/32: Clear on-stack exception marker upon exception return (bnc#1012382).
• powerpc/64: Call setupbarriernospec() from setup_arch() (bsc#1131107).
• powerpc/64: Disable the speculation barrier from the command line (bsc#1131107).
• powerpc/64: Make stf barrier PPCBOOK3S64 specific (bsc#1131107).
• powerpc/64s: Add new security feature flags for count cache flush (bsc#1131107).
• powerpc/64s: Add support for software count cache flush (bsc#1131107).
• powerpc/83xx: Also save/restore SPRG4-7 during suspend (bnc#1012382).
• powerpc: Always initialize input array when calling epapr_hypercall() (bnc#1012382).
• powerpc/asm: Add a patch_site macro & helpers for patching instructions (bsc#1131107).
• powerpc/fsl: Fix spectre_v2 mitigations reporting (bsc#1131107).
• powerpc/mm/hash: Handle mmapminaddr correctly in getunmappedarea topdown search (bsc#1131900).
• powerpc/numa: document topologyupdatesenabled, disable by default (bsc#1133584).
• powerpc/numa: improve control of topology updates (bsc#1133584).
• powerpc/perf: Fix unitsel/cachesel checks (bsc#1053043).
• powerpc/perf: Remove l2 bus events from HW cache event array (bsc#1053043).
• powerpc/perf: Update raw-event code encoding comment for power8 (bsc#1053043, git-fixes).
• powerpc/powernv/cpuidle: Init all present cpus for deep states (bsc#1066223).
• powerpc/powernv: Make opal log only readable by root (bnc#1012382).
• powerpc/powernv: Query firmware for count cache flush settings (bsc#1131107).
• powerpc/pseries/mce: Fix misleading print for TLB mutlihit (bsc#1094244, git-fixes).
• powerpc/pseries: Query hypervisor for count cache flush settings (bsc#1131107).
• powerpc/security: Fix spectre_v2 reporting (bsc#1131107).
• powerpc/speculation: Support 'mitigations=' cmdline option (bsc#1112178).
• powerpc/tm: Add commandline option to disable hardware transactional memory (bsc#1118338).
• powerpc/tm: Add TM Unavailable Exception (bsc#1118338).
• powerpc/tm: Flip the HTM switch default to disabled (bsc#1125580).
• powerpc/vdso32: fix CLOCK_MONOTONIC on PPC64 (bsc#1131587).
• powerpc/vdso64: Fix CLOCK_MONOTONIC inconsistencies across Y2038 (bsc#1131587).
• powerpc/wii: properly disable use of BATs when requested (bnc#1012382).
• raid10: It's wrong to add len to sector_nr in raid10 reshape twice (bnc#1012382).
• ravb: Decrease TxFIFO depth of Q3 and Q2 to one (bnc#1012382).
• rcu: Do RCU GP kthread self-wakeup from softirq and interrupt (bnc#1012382).
• rdma/core: Do not expose unsupported counters (bsc#994770).
• rdma/srp: Rework SCSI device reset handling (bnc#1012382).
• Refresh patches.fixes/0001-net-mlx4-Fix-endianness-issue-in-qp-context-params.patch. (bsc#1132619)
• regulator: s2mpa01: Fix step values for some LDOs (bnc#1012382).
• regulator: s2mps11: Fix steps for buck7, buck8 and LDO35 (bnc#1012382).
• Revert 'bridge: do not add port to router list when receives query with source 0.0.0.0' (bnc#1012382).
• Revert 'mmc: block: do not use parameter prefix if built as module' (bnc#1012382).
• Revert 'scsi, block: fix duplicate bdi name registration crashes' (bsc#1020989).
• Revert 'USB: core: only clean up what we allocated' (bnc#1012382).
• route: set the deleted fnhe fnhedaddr to 0 in ipdel_fnhe to fix a race (bnc#1012382).
• rsi: fix a dereference on adapter before it has been null checked (bsc#1085539).
• rtc: Fix overflow when converting time64t to rtctime (bnc#1012382).
• rtl8xxxu: Fix missing break in switch (bsc#1120902).
• s390/dasd: fix panic for failed online processing (bsc#1132589).
• s390/dasd: fix using offset into zero size array error (bnc#1012382).
• s390: Prevent hotplug rwsem recursion (bsc#1131980).
• s390/qeth: fix use-after-free in error path (bnc#1012382).
• s390/speculation: Support 'mitigations=' cmdline option (bsc#1112178).
• s390/virtio: handle find on invalid queue gracefully (bnc#1012382).
• sched/core: Fix cpu.max vs. cpuhotplug deadlock (bsc#1106913).
• sched/smt: Expose schedsmtpresent static key (bsc#1106913).
• sched/smt: Make schedsmtpresent track topology (bsc#1106913).
• scripts/gitsort/gitsort.py: Add fixes branch from mkp/scsi.git.
• scsi: csiostor: fix NULL pointer dereference in csiovportset_state() (bnc#1012382).
• scsi: isci: initialize shost fully before calling scsiaddhost() (bnc#1012382).
• scsi: libfc: free skb when receiving invalid flogi resp (bnc#1012382).
• scsi: libiscsi: Fix race between iscsixmittask and iscsicompletetask (bnc#1012382).
• scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached (bnc#1012382).
• scsi: qla4xxx: check return code of qla4xxxcopyfromfwddbparam (bnc#1012382).
• scsi: sd: Fix a race between closing an sd device and sd I/O (bnc#1012382).
• scsi: storvsc: Fix a race in sub-channel creation that can cause panic ().
• scsi: storvsc: Fix a race in sub-channel creation that can cause panic (fate#323887).
• scsi: storvsc: Reduce default ring buffer size to 128 Kbytes ().
• scsi: storvsc: Reduce default ring buffer size to 128 Kbytes (fate#323887).
• scsi: target/iscsi: Avoid iscsitreleasecommandsfromconn() deadlock (bnc#1012382).
• scsi: virtio_scsi: do not send sc payload with tmfs (bnc#1012382).
• scsi: zfcp: fix rport unblock if deleted SCSI devices on Scsi_Host (bnc#1012382).
• scsi: zfcp: fix scsieh host reset with portforced ERP for non-NPIV FCP devices (bnc#1012382).
• sctp: fix the transports round robin issue when init is retransmitted (git-fixes).
• sctp: get sctphdr by offset in sctpcomputecksum (bnc#1012382).
• serial: 8250_pci: Fix number of ports for ACCES serial cards (bnc#1012382).
• serial: 8250pci: Have ACCES cards that use the four port Pericom PI7C9X7954 chip use the pcipericom_setup() (bnc#1012382).
• serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling (bnc#1012382).
• serial: max310x: Fix to avoid potential NULL pointer dereference (bnc#1012382).
• serial: sh-sci: Fix setting SCSCR_TIE while transferring data (bnc#1012382).
• serial: sprd: adjust TIMEOUT to a big value (bnc#1012382).
• serial: sprd: clear timeout interrupt only rather than all interrupts (bnc#1012382).
• sit: check if IPv6 enabled before calling ip6errgenicmpv6unreach() (bnc#1012382).
• sky2: Disable MSI on Dell Inspiron 1545 and Gateway P-79 (bnc#1012382).
• sockfs: getxattr: Fail with -EOPNOTSUPP for invalid attribute names (bnc#1012382).
• staging: ashmem: Add missing include (bnc#1012382).
• staging: ashmem: Avoid deadlock with mmap/shrink (bnc#1012382).
• staging: goldfish: audio: fix compiliation on arm (bnc#1012382).
• staging: ion: Set minimum carveout heap allocation order to PAGE_SHIFT (bnc#1012382).
• staging: lustre: fix buffer overflow of string buffer (bnc#1012382).
• staging: rtl8188eu: avoid a null dereference on pmlmepriv (bsc#1085539).
• staging: vt6655: Fix interrupt race condition on device start up (bnc#1012382).
• staging: vt6655: Remove vif check from vnt_interrupt (bnc#1012382).
• stm class: Do not leak the chrdev in error path (bnc#1012382).
• stm class: Fix an endless loop in channel allocation (bnc#1012382).
• stm class: Fix a race in unlinking (bnc#1012382).
• stm class: Fix link list locking (bnc#1012382).
• stm class: Fix locking in unbinding policy path (bnc#1012382).
• stm class: Fix stm device initialization order (bnc#1012382).
• stm class: Fix unbalanced module/device refcounting (bnc#1012382).
• stm class: Fix unlocking braino in the error path (bnc#1012382).
• stm class: Guard output assignment against concurrency (bnc#1012382).
• stm class: Hide STM-specific options if STM is disabled (bnc#1012382).
• stm class: Prevent division by zero (bnc#1012382).
• stm class: Prevent user-controllable allocations (bnc#1012382).
• stm class: Support devices with multiple instances (bnc#1012382).
• stmmac: copy unicast mac address to MAC registers (bnc#1012382).
• stopmachine: Provide stopmachine_cpuslocked() (bsc#1131980).
• sunrpc: do not mark uninitialised items as VALID (bsc#1130737).
• sunrpc: init xdrstream for zero iovlen, page_len (bsc#11303356).
• svm/avic: Fix invalidate logical APIC id entry (bsc#1132727).
• svm: Fix AVIC DFR and LDR handling (bsc#1130343).
• svm: Fix improper check when deactivate AVIC (bsc#1130344).
• tcp/dccp: drop SYN packets if accept queue is full (bnc#1012382).
• tcp/dccp: remove reqskput() from inetchild_forget() (git-fixes).
• tcp: do not use ipv6 header for ipv4 flow (bnc#1012382).
• tcp: handle inetcskreqskqueueadd() failures (git-fixes).
• thermal: int340xthermal: Fix a NULL vs ISERR() check (bnc#1012382).
• time: Introduce jiffies64tonsecs() (bsc#1113399).
• tmpfs: fix link accounting when a tmpfile is linked in (bnc#1012382).
• tmpfs: fix uninitialized return value in shmem_link (bnc#1012382).
• tpm: fix kdoc for tpm2flushcontext_cmd() (bsc#1020645).
• tpm: Fix the type of the return value in calctpm2event_size() (bsc#1020645, git-fixes).
• tpm: tpm-interface.c drop unused macros (bsc#1020645).
• tty: atmel_serial: fix a potential NULL pointer dereference (bnc#1012382).
• udf: Fix crash on IO error during truncate (bnc#1012382).
• Update patches.fixes/SUNRPC-init-xdrstream-for-zero-iovlen-page_len.patch (bsc#1130356).
• usb: core: only clean up what we allocated (bnc#1012382).
• usb: dwc2: Fix DMA alignment to start at allocated boundary (bsc#1100132).
• usb: dwc2: fix the incorrect bitmaps for the ports of multi_tt hub (bsc#1100132).
• usb: dwc3: gadget: Fix suspend/resume during device mode (bnc#1012382).
• usb: dwc3: gadget: Fix the uninitialized link_state when udc starts (bnc#1012382).
• usb: gadget: Add the gserial port checking in gsstarttx() (bnc#1012382).
• usb: gadget: composite: fix dereference after null check coverify warning (bnc#1012382).
• usb: gadget: configfs: add mutex lock before unregister gadget (bnc#1012382).
• usb: gadget: Potential NULL dereference on allocation error (bnc#1012382).
• usb: gadget: rndis: free response queue during REMOTENDISRESET_MSG (bnc#1012382).
• usb: renesas_usbhs: gadget: fix unused-but-set-variable warning (bnc#1012382).
• usb: serial: cp210x: add ID for Ingenico 3070 (bnc#1012382).
• usb: serial: cp210x: add new device id (bnc#1012382).
• usb: serial: cypress_m8: fix interrupt-out transfer length (bsc#1119086).
• usb: serial: ftdi_sio: add additional NovaTech products (bnc#1012382).
• usb: serial: ftdi_sio: add ID for Hjelmslund Electronics USB485 (bnc#1012382).
• usb: serial: mos7720: fix mos_parport refcount imbalance on error path (bsc#1129770).
• usb: serial: option: add Olicard 600 (bnc#1012382).
• usb: serial: option: add Telit ME910 ECM composition (bnc#1012382).
• usb: serial: option: set driver_info for SIM5218 and compatibles (bsc#1129770).
• video: fbdev: Set pixclock = 0 in goldfishfb (bnc#1012382).
• vti4: Fix a ipip packet processing bug in 'IPCOMP' virtual tunnel (bnc#1012382).
• vxlan: Do not call grocellsdestroy() before device is unregistered (bnc#1012382).
• vxlan: Fix GRO cells race condition between receive and link delete (bnc#1012382).
• vxlan: test dev->flags & IFFUP before calling grocells_receive() (bnc#1012382).
• wlcore: Fix the return value in case of error in 'wlcorevendorcmdsmartconfig_start()' (bsc#1120902).
• x8664: increase stack size for KASANEXTRA (bnc#1012382).
• x86/apic: Provide apicackirq() (bsc#1122822).
• x86/apic: Provide apicackirq() (fate#327171, bsc#1122822).
• x86/CPU/AMD: Set the CPB bit unconditionally on F17h (bnc#1012382).
• x86/Hyper-V: Set x2apic destination mode to physical when x2apic is available (bsc#1122822).
• x86/Hyper-V: Set x2apic destination mode to physical when x2apic is available (fate#327171, bsc#1122822).
• x86/kexec: Do not setup EFI info if EFI runtime is not enabled (bnc#1012382).
• x86/mce: Improve error message when kernel cannot recover, p2 (bsc#1114648).
• x86/smp: Enforce CONFIGHOTPLUGCPU when SMP=y (bnc#1012382).
• x86/speculation: Remove redundant archsmtupdate() invocation (bsc#1111331).
• x86/speculation: Support 'mitigations=' cmdline option (bsc#1112178).
• x86/uaccess: Do not leak the AC flag into _putuser() value evaluation (bsc#1114648).
• x86/vdso: Add VCLOCK_HVCLOCK vDSO clock read method (bsc#1133308).
• xen-netback: fix occasional leak of grant ref mappings under memory pressure (bnc#1012382).
• xfrmuser: fix info leak in buildaevent() (git-fixes).
• xfrmuser: fix info leak in xfrmnotify_sa() (git-fixes).
• xhci: Do not let USB3 ports stuck in polling state prevent suspend (bsc#1047487).
• xhci: Fix port resume done detection for SS ports with LPM enabled (bnc#1012382).
• xtensa: SMP: fix ccounttimershutdown (bnc#1012382).
• xtensa: SMP: fix secondary CPU initialization (bnc#1012382).
• xtensa: SMP: limit number of possible CPUs by NR_CPUS (bnc#1012382).
• xtensa: smplx200defconfig: fix vectors clash (bnc#1012382).
• xtensa: SMP: mark each possible CPU as present (bnc#1012382).