SUSE-SU-2020:3326-1

The SUSE Linux Enterprise 12 SP5 kernel was updated to receive various security and bug fixes.

The following security bugs were fixed:

• CVE-2020-25656: Fixed a concurrency use-after-free in vtdokdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-0430: Fixed an OOB read in skb_headlen of /include/linux/skbuff.h (bnc#1176723).
• CVE-2020-14351: Fixed a race in the perfmmapclose() function (bsc#1177086).
• CVE-2020-16120: Fixed a permissions issue in ovlpathopen() (bsc#1177470).
• CVE-2020-8694: Restricted energy meter to root access (bsc#1170415).
• CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The following non-security bugs were fixed:

• ACPI: dock: fix enum-conversion warning (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARECOMPLETIONONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctlfilesrwlock (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: mixart: Correct comment wrt obsoleted tasklet usage (git-fixes).
• ALSA: rawmidi: (cosmetic) align function parameters (git-fixes).
• ALSA: seq: oss: Avoid mutex lock for a long-time ioctl (git-fixes).
• ALSA: usb-audio: Add mixer support for Pioneer DJ DJM-250MK2 (git-fixes).
• ALSA: usb-audio: endpoint.c: fix repeated word 'there' (git-fixes).
• ALSA: usb-audio: fix spelling mistake 'Frequence' -> 'Frequency' (git-fixes).
• ASoC: qcom: lpass-cpu: fix concurrency issue (git-fixes).
• ASoC: qcom: lpass-platform: fix memory leak (git-fixes).
• ath10k: check idx validity in _ath10khttrxringfilln() (git-fixes).
• ath10k: Fix the size used in a 'dmafreecoherent()' call in an error handling path (git-fixes).
• ath10k: provide survey info as accumulated data (git-fixes).
• ath6kl: prevent potential array overflow in ath6kladdnew_sta() (git-fixes).
• ath6kl: wmi: prevent a shift wrapping bug in ath6klwmideletepstreamcmd() (git-fixes).
• ath9k: Fix potential out of bounds in ath9khtctxcompletion_cb() (git-fixes).
• ath9k: hifusb: fix race condition between usbgeturb() and usbkillanchoredurbs() (git-fixes).
• blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART (bsc#1177750).
• block: ensure bdi->io_pages is always initialized (bsc#1177749).
• Bluetooth: MGMT: Fix not checking if BT_HS is enabled (git-fixes).
• Bluetooth: Only mark socket zapped after unlocking (git-fixes).
• bnxt: do not enable NAPI until rings are ready (networking-stable-200911).
• bnxten: Check for zero dir entries in NVRAM (networking-stable-2009_11).
• brcm80211: fix possible memleak in brcmfprotomsgbuf_attach (git-fixes).
• brcmfmac: check ndev pointer (git-fixes).
• brcmsmac: fix memory leak in wlcphyattach_lcnphy (git-fixes).
• btrfs: do not force read-only after error in drop snapshot (bsc#1176354).
• btrfs: qgroup: fix qgroup meta rsv leak for subvolume operations (bsc#1177856).
• btrfs: qgroup: fix wrong qgroup metadata reserve for delayed inode (bsc#1177855).
• btrfs: remove root usage from can_overcommit (bsc#1131277).
• btrfs: take overcommit into account in incblockgroup_ro (bsc#1176560).
• btrfs: tree-checker: fix false alert caused by legacy btrfs root item (bsc#1177861).
• can: ccan: regmap{c,d}can: mark as _maybeunused (git-fixes).
• can: flexcan: flexcanchipstop(): add error handling and propagate error value (git-fixes).
• can: softing: softingcardshutdown(): add braces around empty body in an 'if' statement (git-fixes).
• ceph: fix memory leak in cephcleanupsnapid_map() (bsc#1178234).
• ceph: map snapid to anonymous bdev ID (bsc#1178234).
• ceph: promote to unsigned long long before shifting (bsc#1178187).
• clk: at91: clk-main: update key before writing AT91CKGRMOR (git-fixes).
• clk: at91: remove the checking of parent_name (git-fixes).
• clk: bcm2835: add missing release if devmclkhw_register fails (git-fixes).
• clk: imx8mq: Fix usdhc parents order (git-fixes).
• coredump: fix crash when umh is disabled (bsc#1177753).
• crypto: algif_skcipher - EBUSY on aio should be an error (git-fixes).
• crypto: ccp - fix error handling (git-fixes).
• crypto: ixp4xx - Fix the size used in a 'dmafreecoherent()' call (git-fixes).
• crypto: mediatek - Fix wrong return value in mtkdescring_alloc() (git-fixes).
• crypto: omap-sham - fix digcnt register handling with export/import (git-fixes).
• cxl: Rework error message for incompatible slots (bsc#1055014 git-fixes).
• cypto: mediatek - fix leaks in mtkdescring_alloc (git-fixes).
• device property: Do not clear secondary pointer for shared primary firmware node (git-fixes).
• device property: Keep secondary firmware node secondary by type (git-fixes).
• Disable ipa-clones dump for KMP builds (bsc#1178330) The feature is not really useful for KMP, and rather confusing, so let's disable it at building out-of-tree codes
• dmaengine: dma-jz4780: Fix race in jz4780dmatx_status (git-fixes).
• drm/gma500: fix error check (git-fixes).
• drm/msm: Drop debug print in dpucrtcsetuplm_bounds() (git-fixes).
• EDAC/i5100: Fix error handling order in i5100initone() (bsc#1112178).
• eeprom: at25: set minimum read/write access stride to 1 (git-fixes).
• Fix use after free in getcapsetinfo callback (git-fixes).
• gre6: Fix reception with IP6TNLFRCVDSCPCOPY (networking-stable-2008_24).
• gtp: add GTPALINK info to msg sent to userspace (networking-stable-2009_11).
• HID: roccat: add bounds checking in konesysfswrite_settings() (git-fixes).
• HID: wacom: Avoid entering wacomwacpen_report for pad / battery (git-fixes).
• i2c: imx: Fix external abort on interrupt in exit paths (git-fixes).
• ibmveth: Identify ingress large send packets (bsc#1178185 ltc#188897).
• ibmveth: Switch order of ibmveth_helper calls (bsc#1061843 git-fixes).
• ibmvnic: fix ibmvnicsetmac (bsc#1066382 ltc#160943 git-fixes).
• ibmvnic: save changed mac address to adapter->mac_addr (bsc#1134760 ltc#177449 git-fixes).
• iio:accel:bma180: Fix use of true when should be iiosharedby enum (git-fixes).
• iio:adc:max1118 Fix alignment of timestamp and data leak issues (git-fixes).
• iio:adc:ti-adc0832 Fix alignment issue with timestamp (git-fixes).
• iio:adc:ti-adc12138 Fix alignment issue with timestamp (git-fixes).
• iio:dac:ad5592r: Fix use of true for IIOSHAREDBY_TYPE (git-fixes).
• iio:gyro:itg3200: Fix timestamp alignment and prevent data leak (git-fixes).
• iio:light:si1145: Fix timestamp alignment and prevent data leak (git-fixes).
• iio:magn:hmc5843: Fix passing true where iiosharedby enum required (git-fixes).
• ima: Remove semicolon at the end of imagetbinaryruntimesize() (git-fixes).
• Input: ep93xxkeypad - fix handling of platformget_irq() error (git-fixes).
• Input: imx6ultsc - clean up some errors in imx6ultsc_resume() (git-fixes).
• Input: omap4-keypad - fix handling of platformgetirq() error (git-fixes).
• Input: sun4i-ps2 - fix handling of platformgetirq() error (git-fixes).
• Input: twl4030keypad - fix handling of platformget_irq() error (git-fixes).
• iomap: Make sure iomapend is called after iomapbegin (bsc#1177754).
• ip: fix tos reflection in ack and reset packets (networking-stable-200924).
• ipv4: Restore flowi4oif update before call to xfrmlookup_route (git-fixes).
• iwlwifi: mvm: split a print to avoid a WARNING in ROC (git-fixes).
• kbuild: enforce -Werror=return-type (bsc#1177281).
• libceph: clear con->outmsg on Policy::statefulserver faults (bsc#1178188).
• lib/crc32.c: fix trivial typo in preprocessor condition (git-fixes).
• livepatch: Test if -fdump-ipa-clones is really available As of now we add -fdump-ipa-clones unconditionally. It does not cause a trouble if the kernel is build with the supported toolchain. Otherwise it could fail easily. Do the correct thing and test for the availability.
• mac80211: handle lack of sband->bitrates in rates (git-fixes).
• mailbox: avoid timer start from callback (git-fixes).
• media: ati_remote: sanity check for both endpoints (git-fixes).
• media: bdisp: Fix runtime PM imbalance on error (git-fixes).
• media: exynos4-is: Fix a reference count leak due to pmruntimeget_sync (git-fixes).
• media: exynos4-is: Fix a reference count leak (git-fixes).
• media: exynos4-is: Fix several reference count leaks due to pmruntimeget_sync (git-fixes).
• media: firewire: fix memory leak (git-fixes).
• media: m5mols: Check function pointer in m5molssensorpower (git-fixes).
• media: media/pci: prevent memory leak in bttv_probe (git-fixes).
• media: omap3isp: Fix memleak in isp_probe (git-fixes).
• media: platform: fcp: Fix a reference count leak (git-fixes).
• media: platform: s3c-camif: Fix runtime PM imbalance on error (git-fixes).
• media: platform: sti: hva: Fix runtime PM imbalance on error (git-fixes).
• media: Revert 'media: exynos4-is: Add missed check for pinctrllookupstate()' (git-fixes).
• media: s5p-mfc: Fix a reference count leak (git-fixes).
• media: saa7134: avoid a shift overflow (git-fixes).
• media: st-delta: Fix reference count leak in deltarunwork (git-fixes).
• media: sti: Fix reference count leaks (git-fixes).
• media: tc358743: initialize variable (git-fixes).
• media: ti-vpe: Fix a missing check and reference count leak (git-fixes).
• media: tuner-simple: fix regression in simplesetradio_freq (git-fixes).
• media: usbtv: Fix refcounting mixup (git-fixes).
• media: uvcvideo: Ensure all probed info is returned to v4l2 (git-fixes).
• media: vsp1: Fix runtime PM imbalance on error (git-fixes).
• memory: fsl-corenet-cf: Fix handling of platformgetirq() error (git-fixes).
• memory: omap-gpmc: Fix a couple off by ones (git-fixes).
• mic: vop: copy data to kernel space then write to io memory (git-fixes).
• misc: mic: scif: Fix error handling path (git-fixes).
• misc: rtsx: Fix memory leak in rtsxpciprobe (git-fixes).
• misc: vop: add roundup(x,4) for vringsize to avoid kernel panic (git-fixes).
• mlx5 PPC ringsize workaround (bsc#1173432).
• mlx5: remove support for ibgetvector_affinity (bsc#1174748).
• mmc: sdhci-of-esdhc: set timeout to max before tuning (git-fixes).
• mmc: sdio: Check for CISTPLVERS1 buffer size (git-fixes).
• mtd: lpddr: fix excessive stack usage with clang (git-fixes).
• mtd: mtdoops: Do not write panic data twice (git-fixes).
• mwifiex: do not call deltimersync() on uninitialized timer (git-fixes).
• mwifiex: Do not use GFP_KERNEL in atomic context (git-fixes).
• mwifiex: fix double free (git-fixes).
• mwifiex: remove function pointer check (git-fixes).
• mwifiex: Remove unnecessary braces from HostCmdSETSEQNOBSS_INFO (git-fixes).
• net: disable netpoll on fresh napis (networking-stable-200911).
• net: fec: Fix phydevice lookup for phyresetafterclk_enable() (git-fixes).
• net: fec: Fix PHY init after phyresetafterclkenable() (git-fixes).
• net: Fix potential wrong skb->protocol in skbvlanuntag() (networking-stable-200824).
• net: hns: Fix memleak in hnsnicdevprobe (networking-stable-2009_11).
• net: ipv6: fix kconfig dependency warning for IPV6SEG6HMAC (networking-stable-200924).
• netlabel: fix problems with mapping removal (networking-stable-200911).
• net/mlx5e: Take common TIR context settings into a function (bsc#1177740).
• net/mlx5e: Turn on HW tunnel offload in all TIRs (bsc#1177740).
• net: phy: Avoid NPD upon phydetach() when driver is unbound (networking-stable-2009_24).
• net: qrtr: fix usage of idr in port assignment to socket (networking-stable-200824).
• net: systemport: Fix memleak in bcmsysportprobe (networking-stable-200911).
• net: usb: dm9601: Add USB ID of Keenetic Plus DSL (networking-stable-200911).
• net: usb: qmi_wwan: add Cellient MPL200 card (git-fixes).
• net: usb: rtl8150: set random MAC address when setethernetaddr() fails (git-fixes).
• nfc: Ensure presence of NFCATTRFIRMWARENAME attribute in nfcgenlfwdownload() (git-fixes).
• nl80211: fix non-split wiphy information (git-fixes).
• NTB: hw: amd: fix an issue about leak system resources (git-fixes).
• nvme: do not update disk info for multipathed device (bsc#1171558).
• nvme-rdma: fix crash due to incorrect cqe (bsc#1174748).
• nvme-rdma: fix crash when connect rejected (bsc#1174748).
• perf/x86/amd: Fix sampling Large Increment per Cycle events (bsc#1114648).
• perf/x86: Fix n_pair for cancelled txn (bsc#1114648).
• powerpc: Fix undetected data corruption with P9N DD2.1 VSX CI load emulation (bsc#1065729).
• powerpc/hwirq: Remove stale forward irq_chip declaration (bsc#1065729).
• powerpc/icp-hv: Fix missing ofnodeput() in success path (bsc#1065729).
• powerpc/irq: Drop forward declaration of struct irqaction (bsc#1065729).
• powerpc/perf/hv-gpci: Fix starting index value (bsc#1065729).
• powerpc/powernv/dump: Fix race while processing OPAL dump (bsc#1065729).
• powerpc/powernv/elog: Fix race while processing OPAL error log event (bsc#1065729).
• powerpc/pseries: explicitly reschedule during drmem_lmb list traversal (bsc#1077428 ltc#163882 git-fixes).
• powerpc/pseries: Fix missing ofnodeput() in rng_init() (bsc#1065729).
• pwm: lpss: Add range limit check for the base_unit register value (git-fixes).
• pwm: lpss: Fix off by one error in baseunit math in pwmlpss_prepare() (git-fixes).
• ring-buffer: Return 0 on success from ringbufferresize() (git-fixes).
• rtl8xxxu: prevent potential memory leak (git-fixes).
• scsi: ibmvfc: Fix error return in ibmvfc_probe() (bsc#1065729).
• scsi: ibmvscsi: Fix potential race after loss of transport (bsc#1178166 ltc#188226).
• sctp: not disable bh in the whole sctpgetportlocal() (networking-stable-2009_11).
• tg3: Fix soft lockup when tg3resettask() fails (networking-stable-200911).
• tipc: fix memory leak caused by tipcbufappend() (git-fixes).
• tipc: fix shutdown() of connectionless socket (networking-stable-200911).
• tipc: fix shutdown() of connection oriented socket (networking-stable-200924).
• tipc: fix the skbunshare() in tipcbuf_append() (git-fixes).
• tipc: fix uninit skb->data in tipcnlcompatdumpit() (networking-stable-2008_24).
• tipc: use skbunshare() instead in tipcbufappend() (networking-stable-2009_24).
• tty: ipwireless: fix error handling (git-fixes).
• tty: serial: fsllpuart: fix lpuart32pollgetchar (git-fixes).
• usb: cdc-acm: add quirk to blacklist ETAS ES58X devices (git-fixes).
• usb: cdc-acm: handle broken union descriptors (git-fixes).
• usb: cdc-wdm: Make wdmflush() interruptible and add wdmfsync() (git-fixes).
• usb: core: Solve race condition in anchor cleanup functions (git-fixes).
• usb: dwc2: Fix INTR OUT transfers in DDMA mode (git-fixes).
• usb: dwc2: Fix parameter type in function pointer prototype (git-fixes).
• usb: dwc3: core: add phy cleanup for probe error handling (git-fixes).
• usb: dwc3: core: do not trigger runtime pm when remove driver (git-fixes).
• usb: dwc3: ep0: Fix ZLP for OUT ep0 requests (git-fixes).
• usb: gadget: f_ncm: allow using NCM in SuperSpeed Plus gadgets (git-fixes).
• usb: gadget: fncm: fix ncmbitrate for SuperSpeed and above (git-fixes).
• usb: gadget: function: printer: fix use-after-free in _lockacquire (git-fixes).
• usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well (git-fixes).
• usb: host: fsl-mph-dr-of: check return of dmasetmask() (git-fixes).
• usb: ohci: Default to per-port over-current protection (git-fixes).
• usb: serial: qcserial: fix altsetting probing (git-fixes).
• vfs: fix FIGETBSZ ioctl on an overlayfs file (bsc#1178202).
• video: fbdev: sis: fix null ptr dereference (git-fixes).
• video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error (git-fixes).
• VMCI: check return value of getuserpages_fast() for errors (git-fixes).
• w1: mxc_w1: Fix timeout resolution problem leading to bus error (git-fixes).
• watchdog: iTCO_wdt: Export vendorsupport (bsc#1177101).
• watchdog: iTCOwdt: Make ICHRESIOSMI optional (bsc#1177101).
• wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 (git-fixes).
• writeback: Avoid skipping inode writeback (bsc#1177755).
• writeback: Fix sync livelock due to bdirtytime processing (bsc#1177755).
• writeback: Protect inode->iiolist with inode->i_lock (bsc#1177755).
• x86/apic: Unify duplicated local apic timer clockevent initialization (bsc#1112178).
• x86/fpu: Allow multiple bits in clearcpuid= parameter (bsc#1112178).
• xen/blkback: use lateeoi irq binding (XSA-332 bsc#1177411).
• xen/events: add a new 'late EOI' evtchn framework (XSA-332 bsc#1177411).
• xen/events: add a proper barrier to 2-level uevent unmasking (XSA-332 bsc#1177411).
• xen/events: avoid removing an event channel while handling it (XSA-331 bsc#1177410).
• xen/events: block rogue events for some time (XSA-332 bsc#1177411).
• xen/events: defer eoi in case of excessive number of events (XSA-332 bsc#1177411).
• xen/events: do not use chip_data for legacy IRQs (XSA-332 bsc#1065600).
• xen/events: fix race in evtchnfifounmask() (XSA-332 bsc#1177411).
• xen/events: switch user event channels to lateeoi model (XSA-332 bsc#1177411).
• xen/events: use a common cpu hotplug hook for event channels (XSA-332 bsc#1177411).
• xen/gntdev.c: Mark pages as dirty (bsc#1065600).
• xen/netback: use lateeoi irq binding (XSA-332 bsc#1177411).
• xen/pciback: use lateeoi irq binding (XSA-332 bsc#1177411).
• xen/scsiback: use lateeoi irq binding (XSA-332 bsc#1177411).
• xen: XEN uses irqdesc::irqdatacommon::handler_data to store a per interrupt XEN data pointer which contains XEN specific information (XSA-332 bsc#1065600).
• xfs: avoid infinite loop when cancelling CoW blocks after writeback failure (bsc#1178027).
• xfs: don't update mtime on COW faults (bsc#1167030).
• xfs: limit entries returned when counting fsmap records (git-fixes).