SUSE-SU-2019:2071-1

The SUSE Linux Enterprise 15 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-20855: An issue was discovered in the Linux kernel In createqpcommon in drivers/infiniband/hw/mlx5/qp.c, mlx5ibcreateqpresp was never initialized, resulting in a leak of stack memory to userspace(bsc#1143045).
• CVE-2019-1125: Exclude ATOMs from speculation through SWAPGS (bsc#1139358).
• CVE-2019-14283: In the Linux kernel, set_geometry in drivers/block/floppy.c did not validate the sect and head fields, as demonstrated by an integer overflow and out-of-bounds read. It could be triggered by an unprivileged local user when a floppy disk was inserted. NOTE: QEMU creates the floppy device by default. (bnc#1143191)
• CVE-2019-11810: An issue was discovered in the Linux kernel A NULL pointer dereference could occur when megasascreateframepool() failed in megasasalloccmds() in drivers/scsi/megaraid/megaraidsas_base.c. This caused a Denial of Service, related to a use-after-free (bnc#1134399).
• CVE-2019-13648: In the Linux kernel on the powerpc platform, when hardware transactional memory was disabled, a local user could cause a denial of service (TM Bad Thing exception and system crash) via a sigreturn() system call that sent a crafted signal frame. (bnc#1142254)
• CVE-2019-13631: In parsehidreport_descriptor in drivers/input/tablet/gtco.c in the Linux kernel, a malicious USB device could send an HID report that triggered an out-of-bounds write during generation of debugging messages. (bnc#1142023)

The following non-security bugs were fixed: - Correct the CVE and bug reference for a floppy security fix (CVE-2019-14284,bsc#1143189) A dedicated CVE was already assigned - acpi/nfit: Always dump DSM output payload (bsc#1142351). - Add back sibling paca poiter to paca (bsc#1055117). - Add support for crct10dif-vpmsum (). - afunix: remove redundant lockdep class (git-fixes). alsa: compress: Be more restrictive about when a drain is allowed (bsc#1051510). - alsa: compress: Do not allow paritial drain operations on capture streams (bsc#1051510). - alsa: compress: Fix regression on compressed capture streams (bsc#1051510). - alsa: compress: Prevent bypasses of setparams (bsc#1051510). - alsa: hda - Add a conexant codec entry to let mute led work (bsc#1051510). - alsa: hda/realtek: apply ALC891 headset fixup to one Dell machine (bsc#1051510). - alsa: hda/realtek - Fixed Headphone Mic can't record on Dell platform (bsc#1051510). - alsa: hda/realtek - Headphone Mic can't record after S3 (bsc#1051510). - alsa: line6: Fix a typo (bsc#1051510). - alsa: line6: Fix wrong altsetting for LINE6PODHD5001 (bsc#1051510). - alsa: seq: Break too long mutex context in the write loop (bsc#1051510). - alsa: usb-audio: Add quirk for Focusrite Scarlett Solo (bsc#1051510). - alsa: usb-audio: Add quirk for MOTU MicroBook II (bsc#1051510). - alsa: usb-audio: Cleanup DSD whitelist (bsc#1051510). - alsa: usb-audio: Enable .productname override for Emagic, Unitor 8 (bsc#1051510). - alsa: usb-audio: Sanity checks for each pipe and EP types (bsc#1051510). - asoc : cs4265 : readable register too low (bsc#1051510). - asoc: max98090: remove 24-bit format support if RJ is 0 (bsc#1051510). - asoc: soc-pcm: BE dai needs prepare when pause release after resume (bsc#1051510). - ath6kl: add some bounds checking (bsc#1051510). - batman-adv: fix for leaked TVLV handler (bsc#1051510). - bcache: acquire bchregisterlock later in cacheddevdetachfinish() (bsc#1140652). - bcache: acquire bchregisterlock later in cacheddevfree() (bsc#1140652). - bcache: add code comments for journalreadbucket() (bsc#1140652). - bcache: Add comments for blkdevput() in registration code path (bsc#1140652). - bcache: add comments for closurefn to be called in closurequeue() (bsc#1140652). - bcache: add comments for kobj release callback routine (bsc#1140652). - bcache: add comments for mutexlock(&b->writelock) (bsc#1140652). - bcache: add error check for calling registerbdev() (bsc#1140652). - bcache: add failure check to runcacheset() for journal replay (bsc#1140652). - bcache: add io error counting in writebdevsuperendio() (bsc#1140652). - bcache: add more error message in bchcacheddevattach() (bsc#1140652). - bcache: add pendingscleanup to stop pending bcache device (bsc#1140652). - bcache: add reclaimedjournalbuckets to struct cacheset (bsc#1140652). - bcache: add return value check to bchcacheddevrun() (bsc#1140652). - bcache: avoid a deadlock in bcachereboot() (bsc#1140652). - bcache: avoid clang -Wunintialized warning (bsc#1140652). - bcache: avoid flushing btree node in cachesetflush() if io disabled (bsc#1140652). - bcache: avoid potential memleak of list of journalreplay(s) in the CACHESYNC branch of runcacheset (bsc#1140652). - bcache: check CACHESETIODISABLE bit in bchjournal() (bsc#1140652). - bcache: check CACHESETIODISABLE in allocator code (bsc#1140652). - bcache: check c->gcthread by ISERRORNULL in cachesetflush() (bsc#1140652). - bcache: Clean up bchgetcongested() (bsc#1140652). - bcache: destroy dc->writebackwritewq if failed to create dc->writebackthread (bsc#1140652). - bcache: do not assign in if condition in bcachedeviceinit() (bsc#1140652). - bcache: do not set max writeback rate if gc is running (bsc#1140652). - bcache: fix a race between cache register and cacheset unregister (bsc#1140652). - bcache: fix crashes stopping bcache device before read miss done (bsc#1140652). - bcache: fix failure in journal relplay (bsc#1140652). - bcache: fix inaccurate result of unused buckets (bsc#1140652). - bcache: fix mistaken sysfs entry for ioerror counter (bsc#1140652). - bcache: fix potential deadlock in cacheddeffree() (bsc#1140652). - bcache: fix race in btreeflushwrite() (bsc#1140652). - bcache: fix return value error in bchjournalread() (bsc#1140652). - bcache: fix stack corruption by PRECEDINGKEY() (bsc#1140652). - bcache: fix wrong usage use-after-freed on keylist in outnocoalesce branch of btreegccoalesce (bsc#1140652). - bcache: ignore read-ahead request failure on backing device (bsc#1140652). - bcache: improve bcachereboot() (bsc#1140652). - bcache: improve error message in bchcacheddevrun() (bsc#1140652). - bcache: make bsetsearchtree() be more understandable (bsc#1140652). - bcache: make isdiscardenabled() static (bsc#1140652). - bcache: more detailed error message to bcachedevicelink() (bsc#1140652). - bcache: move definition of 'int ret' out of macro readbucket() (bsc#1140652). - bcache: never set KEYPTRS of journal key to 0 in journalreclaim() (bsc#1140652). - bcache: only clear BTREENODEdirty bit when it is set (bsc#1140652). - bcache: only set BCACHEDEVWBRUNNING when cached device attached (bsc#1140652). - bcache: performance improvement for btreeflushwrite() (bsc#1140652). - bcache: remove redundant LISTHEAD(journal) from runcacheset() (bsc#1140652). - bcache: remove retryflushwrite from struct cacheset (bsc#1140652). - bcache: remove unncessary code in bchbtreekeysinit() (bsc#1140652). - bcache: remove unnecessary prefetch() in bsetsearchtree() (bsc#1140652). - bcache: remove 'XXX:' comment line from runcacheset() (bsc#1140652). - bcache: return error immediately in bchjournalreplay() (bsc#1140652). - bcache: Revert 'bcache: fix high CPU occupancy during journal' (bsc#1140652). - bcache: Revert 'bcache: free heap cacheset->flushbtree in bchjournalfree' (bsc#1140652). - bcache: set largest seq to ja->seq[bucketindex] in journalreadbucket() (bsc#1140652). - bcache: shrink btree node cache after bchbtreecheck() (bsc#1140652). - bcache: stop writeback kthread and kworker when bchcacheddevrun() failed (bsc#1140652). - bcache: use sysfsmatchstring() instead of _sysfsmatchstring() (bsc#1140652). - be2net: Fix number of Rx queues used for flow hashing (networking-stable-190618). - be2net: Signal that the device cannot transmit during reconfiguration (bsc#1127315). - be2net: Synchronize beupdatequeues with devwatchdog (bsc#1127315). - block, bfq: NULL out the bic when it's no longer valid (bsc#1142359). - bnx2x: Prevent load reordering in tx completion processing (bsc#1142868). - bnxten: Fix aggregation buffer leak under OOM condition (networking-stable-190531). - bonding: fix arpvalidate toggling in active-backup mode (networking-stable-190514). - bonding: Force slave speed check after link state recovery for 802.3ad (bsc#1137584). - bpf, x64: fix stack layout of JITed bpf code (bsc#1083647). - bpf, x64: save 5 bytes in prologue when ebpf insns came from cbpf (bsc#1083647). - bridge: Fix error path for kobjectinitandadd() (networking-stable-190514). - btrfs: fix race between block group removal and block group allocation (bsc#1143003). - cgroup: Use csstryget() instead of csstrygetonline() in taskgetcss() (bsc#1141478). - clk: qcom: Fix -Wunused-const-variable (bsc#1051510). - clk: rockchip: Do not yell about bad mmc phases when getting (bsc#1051510). - clk: tegra210: fix PLLU and PLLUOUT1 (bsc#1051510). - cpufreq: acpi-cpufreq: Report if CPU does not support boost technologies (bsc#1051510). - cpufreq: brcmstb-avs-cpufreq: Fix initial command check (bsc#1051510). - cpufreq: brcmstb-avs-cpufreq: Fix types for voltage/frequency (bsc#1051510). - cpufreq: check if policy is inactive early in _cpufreqget() (bsc#1051510). - cpufreq: kirkwood: fix possible object reference leak (bsc#1051510). - cpufreq/pasemi: fix possible object reference leak (bsc#1051510). - cpufreq: pmac32: fix possible object reference leak (bsc#1051510). - cpufreq: ppccbe: fix possible object reference leak (bsc#1051510). - cpufreq: Use struct kobjattribute instead of struct globalattr (bsc#1051510). - crypto: arm64/sha1-ce - correct digest for empty data in finup (bsc#1051510). - crypto: arm64/sha2-ce - correct digest for empty data in finup (bsc#1051510). - crypto: ccp - Fix 3DES complaint from ccp-crypto module (bsc#1051510). - crypto: ccp - fix AES CFB error exposed by new test vectors (bsc#1051510). - crypto: ccp - Fix SEVVERSIONGREATEROREQUAL (bsc#1051510). - crypto: ccp/gcm - use const time tag comparison (bsc#1051510). - crypto: ccp - memset structure fields to zero before reuse (bsc#1051510). - crypto: ccp - Validate the the error value used to index error messages (bsc#1051510). - crypto: chacha20poly1305 - fix atomic sleep when using async algorithm (bsc#1051510). - crypto: crypto4xx - fix a potential double free in ppc4xxtrngprobe (bsc#1051510). - crypto: ghash - fix unaligned memory access in ghashsetkey() (bsc#1051510). - crypto: talitos - Align SEC1 accesses to 32 bits boundaries (bsc#1051510). - crypto: talitos - check data blocksize in ablkcipher (bsc#1051510). - crypto: talitos - fix CTR alg blocksize (bsc#1051510). - crypto: talitos - fix max key size for sha384 and sha512 (bsc#1051510). - crypto: talitos - HMAC SNOOP NO AFEU mode requires SW icv checking (bsc#1051510). - crypto: talitos - properly handle split ICV (bsc#1051510). - crypto: talitos - reduce max key size for SEC1 (bsc#1051510). - crypto: talitos - rename alternative AEAD algos (bsc#1051510). - dasdfba: Display '00000000' for zero page when dumping sense (bsc#1123080). - dmaengine: hsu: Revert 'set HSUCHMTSR to memory width' (bsc#1051510). - dpaaeth: fix SG frame cleanup (networking-stable-190514). - drm/meson: Add support for XBGR8888 & ABGR8888 formats (bsc#1051510). - drm/msm/a3xx: remove TPL1 regs from snapshot (bsc#1051510). - drm/nouveau/i2c: Enable i2c pads & busses during preinit (bsc#1051510). - drm/rockchip: Properly adjust to a true clock in adjustedmode (bsc#1051510). - e1000e: start network tx queue only when link is up (bsc#1051510). - ethtool: check the return value of getregslen (git-fixes). - ethtool: fix potential userspace buffer overflow (networking-stable-190609). - Fix kABI for asus-wmi quirkentry field addition (bsc#1051510). - Fix memory leak in sctpprocessinit (networking-stable-190609). - fork, memcg: fix cachedstacks case (bsc#1134097). - fork, memcg: fix crash in freethreadstack on memcg charge fail (bsc#1134097). - hid: wacom: correct touch resolution x/y typo (bsc#1051510). - hid: wacom: generic: Correct pad syncing (bsc#1051510). - hid: wacom: generic: only switch the mode on devices with LEDs (bsc#1051510). - hid: wacom: generic: read HIDDGCONTACTMAX from any feature report (bsc#1051510). - input: elantech - enable middle button support on 2 ThinkPads (bsc#1051510). - input: imxkeypad - make sure keyboard can always wake up system (bsc#1051510). - input: psmouse - fix build error of multiple definition (bsc#1051510). - input: synaptics - enable SMBUS on T480 thinkpad trackpad (bsc#1051510). - input: tm2-touchkey - acknowledge that setting brightness is a blocking call (bsc#1129770). - intelth: msu: Fix single mode with disabled IOMMU (bsc#1051510). - ipv4: Fix raw socket lookup for local traffic (networking-stable-190514). - ipv4/igmp: fix another memory leak in igmpv3deldelrec() (networking-stable-190531). - ipv4/igmp: fix build error if !CONFIGIPMULTICAST (networking-stable-190531). - ipv4: Use return value of inetiif() for _rawv4lookup in the while loop (git-fixes). - ipv6: Consider skbounddevif when binding a raw socket to an address (networking-stable-190531). - ipv6: fix EFAULT on sendto with icmpv6 and hdrincl (networking-stable-190609). - ipv6: flowlabel: fl6socklookup() must use atomicincnotzero (networking-stable-190618). - ipv6: use READONCE() for inet->hdrincl as in ipv4 (networking-stable-190609). - kbuild: use -flive-patching when CONFIGLIVEPATCH is enabled (bsc#1071995). - kernel: jump label transformation performance (bsc#1137534 bsc#1137535 LTC#178058 LTC#178059). - kvm: arm/arm64: vgic-its: Take the srcu lock when parsing the memslots (bsc#1133021). - kvm: arm/arm64: vgic-its: Take the srcu lock when writing to guest memory (bsc#1133021). - kvm: mmu: Fix overflow on kvm mmu page limit calculation (bsc#1135335). - kvm/mmu: kABI fix for *mmupages changes in struct kvmarch (bsc#1135335). - kvm: polling: add architecture backend to disable polling (bsc#1119222). - kvm: s390: change default halt poll time to 50us (bsc#1119222). - kvm: s390: enable CONFIGHAVEKVMNOPOLL (bsc#1119222) We need to enable CONFIGHAVEKVMNOPOLL for bsc#1119222 - kvm: s390: fix typo in parameter description (bsc#1119222). - kvm: s390: kABI Workaround for 'kvmvcpustat' Add haltnopollsteal to kvmvcpustat. Hide it from the kABI checker. - kvm: s390: kABI Workaround for 'lowcore' (bsc#1119222). - kvm: s390: provide kvmarchnopoll function (bsc#1119222). - kvm: svm/avic: Do not send AVIC doorbell to self (bsc#1140133). - kvm: SVM: Fix detection of AMD Errata 1096 (bsc#1142354). - lapb: fixed leak of control-blocks (networking-stable-190618). - lib: fix stall in _bitmapparselist() (bsc#1051510). - libnvdimm/namespace: Fix label tracking error (bsc#1142350). - lib/bitmap.c: make bitmapparselist() thread-safe and much faster (bsc#1143507). - lib/scatterlist: Fix mapping iterator when sg->offset is greater than PAGESIZE (bsc#1051510). - livepatch: Remove duplicate warning about missing reliable stacktrace support (bsc#1071995). - livepatch: Use static buffer for debugging messages under rq lock (bsc#1071995). - llc: fix skb leak in llcbuildandsenduipkt() (networking-stable-190531). - media: cpia2usb: first wake up, then free in disconnect (bsc#1135642). - media: marvell-ccic: fix DMA s/g desc number calculation (bsc#1051510). - media: s5p-mfc: Make additional clocks optional (bsc#1051510). - media: v4l2: Test type instead of cfg->type in v4l2ctrlnewcustom() (bsc#1051510). - media: vivid: fix incorrect assignment operation when setting video mode (bsc#1051510). - mei: bus: need to unlink client before freeing (bsc#1051510). - mei: me: add denverton innovation engine device IDs (bsc#1051510). - mei: me: add gemini lake devices id (bsc#1051510). - memory: tegra: Fix integer overflow on tick value calculation (bsc#1051510). - memstick: Fix error cleanup path of memstickinit (bsc#1051510). - mfd: intel-lpss: Release IDA resources (bsc#1051510). - mmc: sdhci-pci: Try 'cd' for card-detect lookup before using NULL (bsc#1051510). - mm: migrate: Fix reference check race between _findgetblock() and migration (bnc#1137609). - mm/nvdimm: add isioremapaddr and use that to check ioremap address (bsc#1140322 LTC#176270). - mm, pagealloc: fix hasunmovablepages for HugePages (bsc#1127034). - mm: replace all open encodings for NUMANONODE (bsc#1140322 LTC#176270). - neigh: fix use-after-free read in pneighgetnext (networking-stable-190618). - net/afiucv: remove GFPDMA restriction for HiperTransport (bsc#1142112 bsc#1142221 LTC#179334 LTC#179332). - net: avoid weird emergency message (networking-stable-190521). - net: fec: fix the clk mismatch in failedreset path (networking-stable-190531). - netfilter: conntrack: fix calculation of next bucket number in earlydrop (git-fixes). - net-gro: fix use-after-free read in napigrofrags() (networking-stable-190531). - net/mlx4core: Change the error print to info print (networking-stable-190521). - net/mlx4en: ethtool, Remove unsupported SFP EEPROM high pages query (networking-stable-190609). - net/mlx5: Allocate root ns memory using kzalloc to match kfree (networking-stable-190531). - net/mlx5: Avoid double free in fs init error unwinding path (networking-stable-190531). - net: mvneta: Fix err code path of probe (networking-stable-190531). - net: mvpp2: fix bad MVPP2TXQSCHEDTOKENCNTRREG queue value (networking-stable-190531). - net: openvswitch: do not free vport if registernetdevice() is failed (networking-stable-190618). - net/packet: fix memory leak in packetsetring() (git-fixes). - net: rds: fix memory leak in rdsibflushmrpool (networking-stable-190609). - net: seeq: fix crash caused by not set dev.parent (networking-stable-190514). - net: stmmac: fix reset gpio free missing (networking-stable-190531). - net: usb: qmiwwan: add Telit 0x1260 and 0x1261 compositions (networking-stable-190521). - nvme: fix memory leak caused by incorrect subsystem free (bsc#1143185). - ocfs2: add first lock wait time in lockingstate (bsc#1134390). - ocfs2: add last unlock times in lockingstate (bsc#1134390). - ocfs2: add locking filter debugfs file (bsc#1134390). - packet: Fix error path in packetinit (networking-stable-190514). - packet: in recvmsg msgname return at least sizeof sockaddrll (git-fixes). - pci: Always allow probing with driveroverride (bsc#1051510). - pci: hv: Add hvpciremoveslots() when we unload the driver (bsc#1142701). - pci: hv: Add pcidestroyslot() in pcidevicespresentwork(), if necessary (bsc#1142701). - pci: hv: Fix a memory leak in hvejectdevicework() (bsc#1142701). - pci: hv: Fix a use-after-free bug in hvejectdevicework() (bsc#1142701). - pci: hv: Fix return value check in hvpciassignslots() (bsc#1142701). - pci: hv: Remove unused reason for refcount handler (bsc#1142701). - pci: hv: support reporting serial number as slot information (bsc#1142701). - pci: Return error if cannot probe VF (bsc#1051510). - pkey: Indicate old mkvp only if old and current mkvp are different (bsc#1137827 LTC#178090). - pktgen: do not sleep with the thread lock held (git-fixes). - platform/x86: asus-nb-wmi: Support ALS on the Zenbook UX430UQ (bsc#1051510). - platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asusnbwmi (bsc#1051510). - platform/x86: intelturbomax3: Remove restriction for HWP platforms (jsc#SLE-5439). - platform/x86: pmcatom: Add CB4063 Beckhoff Automation board to critclksystems DMI table (bsc#1051510). - powerpc/64s: Remove POWER9 DD1 support (bsc#1055117, LTC#159753, git-fixes). - powerpc/crypto: Use cheaper random numbers for crc-vpmsum self-test (). - powerpc/mm: Change function prototype (bsc#1055117). - powerpc/mm: Consolidate numaenable check and mincommondepth check (bsc#1140322 LTC#176270). - powerpc/mm/drconf: Use NUMANONODE on failures instead of node 0 (bsc#1140322 LTC#176270). - powerpc/mm: Fix node look up with numa=off boot (bsc#1140322 LTC#176270). - powerpc/mm/hugetlb: Update hugeptepsetaccessflags to call _ptepsetaccessflags directly (bsc#1055117). - powerpc/mm/radix: Change pte relax sequence to handle nest MMU hang (bsc#1055117). - powerpc/mm/radix: Move function from radix.h to pgtable-radix.c (bsc#1055117). - powerpc/watchpoint: Restore NV GPRs while returning from exception (bsc#1140945 bsc#1141401 bsc#1141402 bsc#1141452 bsc#1141453 bsc#1141454 LTC#178983 LTC#179191 LTC#179192 LTC#179193 LTC#179194 LTC#179195). - ppp: deflate: Fix possible crash in deflateinit (networking-stable-190521). - rds: ib: fix 'passing zero to ERRPTR()' warning (git-fixes). - Revert 'bcache: set CACHESETIODISABLE in bchcacheddeverror()' (bsc#1140652). - Revert 'e1000e: fix cyclic resets at link up with active tx' (bsc#1051510). - Revert 'livepatch: Remove reliable stacktrace check in klptryswitchtask()' (bsc#1071995). - Revert 'serial: 8250: Do not service RX FIFO if interrupts are disabled' (bsc#1051510). - rtnetlink: always put IFLALINK for links with a link-netnsid (networking-stable-190521). - s390/qeth: be drop monitor friendly (bsc#1142220 LTC#179335). - s390/vtime: steal time exponential moving average (bsc#1119222). - scripts/gitsort/gitsort.py: Add mmots tree. - scsi: ibmvfc: fix WARNON during event pool release (bsc#1137458 LTC#178093). - sctp: Free cookie before we memdup a new one (networking-stable-190618). - sctp: silence warns on sctpstreaminit allocations (bsc#1083710). - serial: uartps: Do not add a trailing semicolon to macro (bsc#1051510). - serial: uartps: Fix long line over 80 chars (bsc#1051510). - serial: uartps: Fix multiple line dereference (bsc#1051510). - serial: uartps: Remove useless return from cdnsuartpollputchar (bsc#1051510). - staging: comedi: amplcpci230: fix null pointer deref on interrupt (bsc#1051510). - staging: comedi: dt282x: fix a null pointer deref on interrupt (bsc#1051510). - staging: rtl8712: reduce stack usage, again (bsc#1051510). - sunhv: Fix device naming inconsistency between sunhvconsole and sunhvreg (networking-stable-190618). - tcp: reduce tcpfastretransalert() verbosity (git-fixes). - team: Always enable vlan tx offload (bsc#1051510). - tty: rocket: fix incorrect forward declaration of 'rpinit()' (bsc#1051510). - tty: serialcore: Set port active bit in uartportactivate (bsc#1051510). - tty: serial: cpmuart - fix init when SMC is relocated (bsc#1051510). - tuntap: synchronize through tfiles array instead of tun->numqueues (networking-stable-190514). - usb: gadget: ether: Fix race between getherdisconnect and rxsubmit (bsc#1051510). - usb: gadget: fusb300udc: Fix memory leak of fusb300->ep[i] (bsc#1051510). - usb: gadget: udc: lpc32xx: allocate descriptor with GFPATOMIC (bsc#1051510). - usb: pci-quirks: Correct AMD PLL quirk detection (bsc#1051510). - usb: serial: ftdisio: add ID for isodebug v1 (bsc#1051510). - usb: serial: option: add support for GosunCn ME3630 RNDIS mode (bsc#1051510). - vmci: Fix integer overflow in VMCI handle arrays (bsc#1051510). - vsock/virtio: free packets during the socket release (networking-stable-190521). - vsock/virtio: set SOCKDONE on peer shutdown (networking-stable-190618). - wil6210: fix potential out-of-bounds read (bsc#1051510). - x86, mm: fix fast GUP with hyper-based TLB flushing (VM Functionality, bsc#1140903). - xen: let allocxenballooned_pages() fail if not enough memory free (bsc#1142450 XSA-300). - xfs: do not overflow xattr listent buffer (bsc#1143105).