Security update for the Linux Kernel

An update that solves nine vulnerabilities and has 44 security fixes can now be installed.

Description:

The SUSE Linux Enterprise 12 SP2 Realtime kernel was updated to 4.4.114 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-5715: Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis (bnc#1068032).

The previous fix using CPU Microcode has been complemented by building the Linux Kernel with return trampolines aka "retpolines".

• CVE-2018-5333: In the Linux kernel the rds_cmsg_atomic function in net/rds/rdma.c mishandled cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL pointer dereference (bnc#1075617).
• CVE-2018-5332: In the Linux kernel the rds_message_alloc_sgs() function did not validate a value that is used during DMA page allocation, leading to a heap-based out-of-bounds write (related to the rds_rdma_extra_size function in net/rds/rdma.c) (bnc#1075621).
• CVE-2017-17862: kernel/bpf/verifier.c in the Linux kernel ignores unreachable code, even though it would still be processed by JIT compilers. This behavior, also considered an improper branch-pruning logic issue, could possibly be used by local users for denial of service (bnc#1073928).
• CVE-2017-17864: kernel/bpf/verifier.c in the Linux kernel mishandled states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allowed local users to obtain potentially sensitive address information, aka a "pointer leak (bnc#1073928).
• CVE-2017-17712: The raw_sendmsg() function in net/ipv4/raw.c in the Linux kernel has a race condition in inet->hdrincl that leads to uninitialized stack pointer usage; this allowed a local user to execute code and gain privileges (bnc#1073229 1073230).
• CVE-2017-15129: A use-after-free vulnerability was found in network namespaces code affecting the Linux kernel The function get_net_ns_by_id() in net/core/net_namespace.c did not check for the net::count value after it has found a peer network in netns_ids idr, which could lead to double free and memory corruption. This vulnerability could allow an unprivileged local user to induce kernel memory corruption on the system, leading to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is thought to be unlikely (bnc#1074839).
• CVE-2017-18017: The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel allowed remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action (bnc#1074488).
• CVE-2018-1000004: In the Linux kernel a race condition vulnerability exists in the sound system, this can lead to a deadlock and denial of service condition (bnc#1076017).

The following non-security bugs were fixed:

• 509: fix printing uninitialized stack memory when OID is empty (bsc#1075078).
• 8021q: fix a memory leak for VLAN 0 device (bnc#1012382).
• acpi / scan: Prefer devices without _HID/_CID for _ADR matching (bnc#1012382).
• af_key: fix buffer overread in parse_exthdrs() (bnc#1012382).
• af_key: fix buffer overread in verify_address_len() (bnc#1012382).
• afs: Adjust mode bits processing (bnc#1012382).
• afs: Connect up the CB.ProbeUuid (bnc#1012382).
• afs: Fix afs_kill_pages() (bnc#1012382).
• afs: Fix missing put_page() (bnc#1012382).
• afs: Fix page leak in afs_write_begin() (bnc#1012382).
• afs: Fix the maths in afs_fs_store_data() (bnc#1012382).
• afs: Flush outstanding writes when an fd is closed (bnc#1012382).
• afs: Migrate vlocation fields to 64-bit (bnc#1012382).
• afs: Populate and use client modification time (bnc#1012382).
• afs: Populate group ID from vnode status (bnc#1012382).
• afs: Prevent callback expiry timer overflow (bnc#1012382).
• alpha: fix build failures (bnc#1012382).
• alsa: aloop: Fix inconsistent format due to incomplete rule (bsc#1031717).
• alsa: aloop: Fix racy hw constraints adjustment (bsc#1031717).
• alsa: aloop: Release cable upon open error path (bsc#1031717).
• alsa: hda - Apply headphone noise quirk for another Dell XPS 13 variant (bsc#1031717).
• alsa: hda - Apply the existing quirk to iMac 14,1 (bsc#1031717).
• alsa: pcm: Abort properly at pending signal in OSS read/write loops (bsc#1031717).
• alsa: pcm: Add missing error checks in OSS emulation plugin builder (bsc#1031717).
• alsa: pcm: Allow aborting mutex lock at OSS read/write loops (bsc#1031717).
• alsa: pcm: Remove incorrect snd_BUG_ON() usages (bsc#1031717).
• alsa: pcm: Remove yet superfluous WARN_ON() (bsc#1031717).
• arc: uaccess: dont use "l" gcc inline asm constraint modifier (bnc#1012382).
• arm64: Add hypervisor safe helper for checking constant capabilities (bsc#1068032).
• arm64: Add macros to read/write system registers (bsc#1068032).
• arm64: add macro to extract ESR_ELx.EC (bsc#1068032).
• arm64: Add skeleton to harden the branch predictor against aliasing attacks (bsc#1068032).
• arm64: Add trace_hardirqs_off annotation in ret_to_user (bsc#1068032).
• arm64: alternative: add auto-nop infrastructure (bsc#1068032).
• arm64: barriers: introduce nops and __nops macros for NOP sequences (bsc#1068032).
• arm64: cpu_errata: Allow an erratum to be match for all revisions of a core (bsc#1068032).
• arm64: cpufeature: Add scope for capability check (bsc#1068032).
• arm64/cpufeature: do not use mutex in bringup path (bsc#1068032).
• arm64: cpufeature: Pass capability structure to ->enable callback (bsc#1068032).
• arm64: debug: remove unused local_dbg_{enable, disable} macros (bsc#1068032).
• arm64: Disable kpti for non broadcast TLB HW (bsc#1068032).
• arm64: Disable TTBR0_EL1 during normal kernel execution (bsc#1068032).
• arm64: do not pull uaccess.h into *.S (bsc#1068032).
• arm64: Enable CONFIG_ARM64_SW_TTBR0_PAN (bsc#1068032).
• arm64: entry: Add exception trampoline page for exceptions from EL0 (bsc#1068032).
• arm64: entry: Add fake CPU feature for unmapping the kernel at EL0 (bsc#1068032).
• arm64: entry: Explicitly pass exception level to kernel_ventry macro (bsc#1068032).
• arm64: entry: Hook up entry trampoline to exception vectors (bsc#1068032).
• arm64: entry: remove pointless SPSR mode check (bsc#1068032).
• arm64: entry.S convert el0_sync (bsc#1068032).
• arm64: entry.S: convert el1_sync (bsc#1068032).
• arm64: entry.S: convert elX_irq (bsc#1068032).
• arm64: entry.S: move SError handling into a C function for future expansion (bsc#1068032).
• arm64: entry.S: Remove disable_dbg (bsc#1068032).
• arm64: explicitly mask all exceptions (bsc#1068032).
• arm64: factor out entry stack manipulation (bsc#1068032).
• arm64: factor out PAGE_ and CONT_ definitions (bsc#1068032).
• arm64: Factor out PAN enabling/disabling into separate uaccess_* macros (bsc#1068032).
• arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro (bsc#1068032).
• arm64: factor work_pending state machine to C (bsc#1068032).
• arm64: Fix circular include of asm/lse.h through linux/jump_label.h (bsc#1068032).
• arm64: Fix compilation (bsc#1068032).
• arm64: fpsimd: Prevent registers leaking from dead tasks (bnc#1012382).
• arm64: Handle el1 synchronous instruction aborts cleanly (bsc#1068032).
• arm64: head.S: get rid of x25 and x26 with 'global' scope (bsc#1068032).
• arm64: Implement branch predictor hardening for affected Cortex-A CPUs (bsc#1068032).
• arm64: Initialise high_memory global variable earlier (bnc#1012382).
• arm64: introduce an order for exceptions (bsc#1068032).
• arm64: introduce mov_q macro to move a constant into a 64-bit register (bsc#1068032).
• arm64: Introduce uaccess_{disable,enable} functionality based on TTBR0_EL1 (bsc#1068032).
• arm64: kaslr: Put kernel vectors address in separate data page (bsc#1068032).
• arm64: Kconfig: Add CONFIG_UNMAP_KERNEL_AT_EL0 (bsc#1068032).
• arm64: Kconfig: Reword UNMAP_KERNEL_AT_EL0 kconfig entry (bsc#1068032).
• arm64: kill ESR_LNX_EXEC (bsc#1068032).
• arm64: kpti: Fix the interaction between ASID switching and software PAN (bsc#1068032).
• arm64: kvm: Fix SMCCC handling of unimplemented SMC/HVC calls (bnc#1012382).
• arm64: kvm: fix VTTBR_BADDR_MASK BUG_ON off-by-one (bnc#1012382).
• arm64: kvm: Survive unknown traps from guests (bnc#1012382).
• arm64: kvm: Use per-CPU vector when BP hardening is enabled (bsc#1068032).
• arm64: Mask all exceptions during kernel_exit (bsc#1068032).
• arm64: mm: Add arm64_kernel_unmapped_at_el0 helper (bsc#1068032).
• arm64: mm: Allocate ASIDs in pairs (bsc#1068032).
• arm64: mm: Fix and re-enable ARM64_SW_TTBR0_PAN (bsc#1068032).
• arm64: mm: hardcode rodata=true (bsc#1068032).
• arm64: mm: Introduce TTBR_ASID_MASK for getting at the ASID in the TTBR (bsc#1068032).
• arm64: mm: Invalidate both kernel and user ASIDs when performing TLBI (bsc#1068032).
• arm64: mm: Map entry trampoline into trampoline and kernel page tables (bsc#1068032).
• arm64: mm: Move ASID from TTBR0 to TTBR1 (bsc#1068032).
• arm64: mm: Rename post_ttbr0_update_workaround (bsc#1068032).
• arm64: mm: Temporarily disable ARM64_SW_TTBR0_PAN (bsc#1068032).
• arm64: mm: Use non-global mappings for kernel space (bsc#1068032).
• arm64: Move BP hardening to check_and_switch_context (bsc#1068032).
• arm64: Move post_ttbr_update_workaround to C code (bsc#1068032).
• arm64: Move the async/fiq helpers to explicitly set process context flags (bsc#1068032).
• arm64: Store struct thread_info in sp_el0 (bsc#1068032).
• arm64: SW PAN: Point saved ttbr0 at the zero page when switching to init_mm (bsc#1068032).
• arm64: SW PAN: Update saved ttbr0 value on enter_lazy_tlb (bsc#1068032).
• arm64: swp emulation: bound LL/SC retries before rescheduling (bsc#1068032).
• arm64: sysreg: allow write_sysreg to use XZR (bsc#1068032).
• arm64: sysreg: Fix unprotected macro argmuent in write_sysreg (bsc#1068032).
• arm64: Take into account ID_AA64PFR0_EL1.CSV3 (bsc#1068032).
• arm64: tlbflush.h: add __tlbi() macro (bsc#1068032).
• arm64: tls: Avoid unconditional zeroing of tpidrro_el0 for native tasks (bsc#1068032).
• arm64: use alternative auto-nop (bsc#1068032).
• arm64: use RET instruction for exiting the trampoline (bsc#1068032).
• arm64: Use static keys for CPU features (bsc#1068032).
• arm64: xen: Enable user access before a privcmd hvc call (bsc#1068032).
• arm: avoid faulting on qemu (bnc#1012382).
• arm: BUG if jumping to usermode address in kernel mode (bnc#1012382).
• arm-ccn: perf: Prevent module unload while PMU is in use (bnc#1012382).
• arm: dma-mapping: disallow dma_get_sgtable() for non-kernel managed memory (bnc#1012382).
• arm: dts: am335x-evmsk: adjust mmc2 param to allow suspend (bnc#1012382).
• arm: dts: kirkwood: fix pin-muxing of MPP7 on OpenBlocks A7 (bnc#1012382).
• arm: dts: ti: fix pci bus dtc warnings (bnc#1012382).
• arm: kprobes: Align stack to 8-bytes in test code (bnc#1012382).
• arm: kprobes: Fix the return address of multiple kretprobes (bnc#1012382).
• arm: kvm: Fix VTTBR_BADDR_MASK BUG_ON off-by-one (bnc#1012382).
• arm: kvm: Survive unknown traps from guests (bnc#1012382).
• arm: OMAP1: DMA: Correct the number of logical channels (bnc#1012382).
• arm: OMAP2+: Fix device node reference counts (bnc#1012382).
• arm: OMAP2+: gpmc-onenand: propagate error on initialization failure (bnc#1012382).
• arm: OMAP2+: Release device node after it is no longer needed (bnc#1012382).
• asm-prototypes: Clear any CPP defines before declaring the functions (git-fixes).
• asn.1: check for error from ASN1_OP_END__ACT actions (bnc#1012382).
• asn.1: fix out-of-bounds read when parsing indefinite length item (bnc#1012382).
• ath9k: fix tx99 potential info leak (bnc#1012382).
• atm: horizon: Fix irq release error (bnc#1012382).
• audit: ensure that 'audit=1' actually enables audit for PID 1 (bnc#1012382).
• axonram: Fix gendisk handling (bnc#1012382).
• backlight: pwm_bl: Fix overflow condition (bnc#1012382).
• bcache: add a comment in journal bucket reading (bsc#1076110).
• bcache: Avoid nested function definition (bsc#1076110).
• bcache: check return value of register_shrinker (bsc#1076110).
• bcache: debug: avoid accessing .bi_io_vec directly (bsc#1076110).
• bcache: documentation formatting, edited for clarity, stripe alignment notes (bsc#1076110).
• bcache: documentation updates and corrections (bsc#1076110).
• bcache: Do not reinvent the wheel but use existing llist API (bsc#1076110).
• bcache: do not write back data if reading it failed (bsc#1076110).
• bcache: explicitly destroy mutex while exiting (bnc#1012382).
• bcache: fix a comments typo in bch_alloc_sectors() (bsc#1076110).
• bcache: fix sequential large write IO bypass (bsc#1076110).
• bcache: fix wrong cache_misses statistics (bnc#1012382).
• bcache: gc does not work when triggering by manual command (bsc#1076110, bsc#1038078).
• bcache: implement PI controller for writeback rate (bsc#1076110).
• bcache: increase the number of open buckets (bsc#1076110).
• bcache: only permit to recovery read error when cache device is clean (bnc#1012382 bsc#1043652).
• bcache: partition support: add 16 minors per bcacheN device (bsc#1076110).
• bcache: pr_err: more meaningful error message when nr_stripes is invalid (bsc#1076110).
• bcache: rearrange writeback main thread ratelimit (bsc#1076110).
• bcache: recover data from backing when data is clean (bnc#1012382 bsc#1043652).
• bcache: register_bcache(): call blkdev_put() when cache_alloc() fails (bsc#1076110).
• bcache: Remove deprecated create_workqueue (bsc#1076110).
• bcache: Remove redundant block_size assignment (bsc#1076110).
• bcache: Remove redundant parameter for cache_alloc() (bsc#1076110).
• bcache: Remove redundant set_capacity (bsc#1076110).
• bcache: remove unused parameter (bsc#1076110).
• bcache: rewrite multiple partitions support (bsc#1076110, bsc#1038085, bsc#1019784).
• bcache: safeguard a dangerous addressing in closure_queue (bsc#1076110).
• bcache: silence static checker warning (bsc#1076110).
• bcache: smooth writeback rate control (bsc#1076110).
• bcache: switch to using blk_queue_write_cache() (bsc#1076110).
• bcache.txt: standardize document format (bsc#1076110).
• bcache: update bio->bi_opf bypass/writeback REQ_ flag hints (bsc#1076110).
• bcache: update bucket_in_use in real time (bsc#1076110).
• bcache: Update continue_at() documentation (bsc#1076110).
• bcache: update document info (bsc#1076110).
• bcache: use kmalloc to allocate bio in bch_data_verify() (bsc#1076110).
• bcache: use llist_for_each_entry_safe() in __closure_wake_up() (bsc#1076110).
• bcache: writeback rate clamping: make 32 bit safe (bsc#1076110).
• bcache: writeback rate shouldn't artifically clamp (bsc#1076110).
• be2net: restore properly promisc mode after queues reconfiguration (bsc#963844 FATE#320192).
• block: export bio_free_pages to other modules (bsc#1076110).
• block: wake up all tasks blocked in get_request() (bnc#1012382).
• bluetooth: btusb: driver to enable the usb-wakeup feature (bnc#1012382).
• bnx2x: do not rollback VF MAC/VLAN filters we did not configure (bnc#1012382).
• bnx2x: fix possible overrun of VFPF multicast addresses array (bnc#1012382).
• bnx2x: prevent crash when accessing PTP with interface down (bnc#1012382).
• btrfs: account for pinned bytes in should_alloc_chunk (bsc#1066842).
• btrfs: add missing memset while reading compressed inline extents (bnc#1012382).
• can: af_can: canfd_rcv(): replace WARN_ONCE by pr_warn_once (bnc#1012382).
• can: af_can: can_rcv(): replace WARN_ONCE by pr_warn_once (bnc#1012382).
• can: ems_usb: cancel urb on -EPIPE and -EPROTO (bnc#1012382).
• can: esd_usb2: cancel urb on -EPIPE and -EPROTO (bnc#1012382).
• can: gs_usb: fix return value of the "set_bittiming" callback (bnc#1012382).
• can: kvaser_usb: cancel urb on -EPIPE and -EPROTO (bnc#1012382).
• can: kvaser_usb: Fix comparison bug in kvaser_usb_read_bulk_callback() (bnc#1012382).
• can: kvaser_usb: free buf in error paths (bnc#1012382).
• can: kvaser_usb: ratelimit errors if incomplete messages are received (bnc#1012382).
• can: peak: fix potential bug in packet fragmentation (bnc#1012382).
• can: ti_hecc: Fix napi poll return value for repoll (bnc#1012382).
• can: usb_8dev: cancel urb on -EPIPE and -EPROTO (bnc#1012382).
• cdc-acm: apply quirk for card reader (bsc#1060279).
• cdrom: factor out common open_for_* code (bsc#1048585).
• cdrom: wait for tray to close (bsc#1048585).
• ceph: drop negative child dentries before try pruning inode's alias (bnc#1012382).
• ceph: more accurate statfs (bsc#1077068).
• clk: imx6: refine hdmi_isfr's parent to make HDMI work on i.MX6 SoCs w/o VPU (bnc#1012382).
• clk: mediatek: add the option for determining PLL source clock (bnc#1012382).
• clk: tegra: Fix cclk_lp divisor register (bnc#1012382).
• cpuidle: fix broadcast control when broadcast can not be entered (bnc#1012382).
• cpuidle: powernv: Pass correct drv->cpumask for registration (bnc#1012382).
• cpuidle: Validate cpu_dev in cpuidle_add_sysfs() (bnc#1012382).
• crypto: algapi - fix NULL dereference in crypto_remove_spawns() (bnc#1012382).
• crypto: chacha20poly1305 - validate the digest size (bnc#1012382).
• crypto: crypto4xx - increase context and scatter ring buffer elements (bnc#1012382).
• crypto: deadlock between crypto_alg_sem/rtnl_mutex/genl_mutex (bnc#1012382).
• crypto: mcryptd - protect the per-CPU queue with a lock (bnc#1012382).
• crypto: n2 - cure use after free (bnc#1012382).
• crypto: pcrypt - fix freeing pcrypt instances (bnc#1012382).
• crypto: s5p-sss - Fix completing crypto request in IRQ handler (bnc#1012382).
• crypto: tcrypt - fix buffer lengths in test_aead_speed() (bnc#1012382).
• cxl: Check if vphb exists before iterating over AFU devices (bsc#1066223).
• dax: Pass detailed error code from __dax_fault() (bsc#1072484).
• dccp: do not restart ccid2_hc_tx_rto_expire() if sk in closed state (bnc#1012382).
• delay: add poll_event_interruptible (bsc#1048585).
• dmaengine: dmatest: move callback wait queue to thread context (bnc#1012382).
• dmaengine: Fix array index out of bounds warning in __get_unmap_pool() (bnc#1012382).
• dmaengine: pl330: fix double lock (bnc#1012382).
• dmaengine: ti-dma-crossbar: Correct am335x/am43xx mux value type (bnc#1012382).
• dm btree: fix serious bug in btree_split_beneath() (bnc#1012382).
• dm bufio: fix shrinker scans when (nr_to_scan < retain_target) (bnc#1012382).
• dm thin metadata: THIN_MAX_CONCURRENT_LOCKS should be 6 (bnc#1012382).
• drivers: base: cacheinfo: fix boot error message when acpi is enabled (bnc#1012382).
• drivers: base: cacheinfo: fix x86 with CONFIG_OF enabled (bnc#1012382).
• drivers/firmware: Expose psci_get_version through psci_ops structure (bsc#1068032).
• drivers/md/bcache/util.h: remove duplicate inclusion of blkdev.h (bsc#1076110).
• drivers: net: xgene: Fix hardware checksum setting (bsc#1078526).
• drm/amd/amdgpu: fix console deadlock if late init failed (bnc#1012382).
• drm: extra printk() wrapper macros (bnc#1012382).
• drm/exynos/decon5433: set STANDALONE_UPDATE_F on output enablement (bnc#1012382).
• drm/exynos: gem: Drop NONCONTIG flag for buffers allocated without IOMMU (bnc#1012382).
• drm/omap: fix dmabuf mmap for dma_alloc'ed buffers (bnc#1012382).
• drm/radeon: reinstate oland workaround for sclk (bnc#1012382).
• drm/radeon/si: add dpm quirk for Oland (bnc#1012382).
• drm/vmwgfx: Potential off by one in vmw_view_add() (bnc#1012382).
• dynamic-debug-howto: fix optional/omitted ending line number to be LARGE instead of 0 (bnc#1012382).
• edac, i5000, i5400: Fix definition of NRECMEMB register (bnc#1012382).
• edac, i5000, i5400: Fix use of MTR_DRAM_WIDTH macro (bnc#1012382).
• edac, sb_edac: Fix missing break in switch (bnc#1012382).
• efi/esrt: Cleanup bad memory map log messages (bnc#1012382).
• efi: Move some sysfs files to be read-only by root (bnc#1012382).
• eventpoll.h: add missing epoll event masks (bnc#1012382).
• ext4: fix crash when a directory's i_size is too small (bnc#1012382).
• ext4: Fix ENOSPC handling in DAX page fault handle (bsc#1072484).
• ext4: fix fdatasync(2) after fallocate(2) operation (bnc#1012382).
• fbdev: controlfb: Add missing modes to fix out of bounds access (bnc#1012382).
• Fix build error in vma.c (bnc#1012382).
• fjes: Fix wrong netdevice feature flags (bnc#1012382).
• flow_dissector: properly cap thoff field (bnc#1012382).
• fm10k: ensure we process SM mbx when processing VF mbx (bnc#1012382).
• fork: clear thread stack upon allocation (bsc#1077560). Conflicts: series.conf
• fscache: Fix the default for fscache_maybe_release_page() (bnc#1012382).
• futex: Prevent overflow by strengthen input validation (bnc#1012382).
• gcov: disable for COMPILE_TEST (bnc#1012382).
• gfs2: Take inode off order_write list when setting jdata flag (bnc#1012382).
• gpio: altera: Use handle_level_irq when configured as a level_high (bnc#1012382).
• hid: chicony: Add support for another ASUS Zen AiO keyboard (bnc#1012382).
• hid: xinmo: fix for out of range for THT 2P arcade controller (bnc#1012382).
• hrtimer: Reset hrtimer cpu base proper on CPU hotplug (bnc#1012382).
• hv: kvp: Avoid reading past allocated blocks from KVP file (bnc#1012382).
• hwmon: (asus_atk0110) fix uninitialized data access (bnc#1012382).
• i40e: Do not enable NAPI on q_vectors that have no rings (bnc#1012382).
• ib/hfi1: Correct defered count after processing qp_wait_list (git-fixes).
• ib/hfi1: Fix rnr_timer addition (git-fixes).
• ib/hfi1: Handle kzalloc failure in init_pervl_scs (git-fixes).
• ib/hfi1: Move iowait_init() to priv allocate (git-fixes).
• ib/hfi1: Prevent kernel QP post send hard lockups (git-fixes).
• ib/hfi1: Reset QSFP on every run through channel tuning (git-fixes).
• ib/ipoib: Fix lockdep issue found on ipoib_ib_dev_heavy_flush (git-fixes).
• ib/ipoib: Grab rtnl lock on heavy flush when calling ndo_open/stop (bnc#1012382).
• ib/mlx4: Increase maximal message size under UD QP (bnc#1012382).
• ib/mlx5: Assign send CQ and recv CQ of UMR QP (bnc#1012382).
• ibmvnic: Allocate and request vpd in init_resources (bsc#1076872).
• ibmvnic: Do not handle RX interrupts when not up (bsc#1075066).
• ibmvnic: Fix IP offload control buffer (bsc#1076899).
• ibmvnic: Fix IPv6 packet descriptors (bsc#1076899).
• ibmvnic: Fix pending MAC address changes (bsc#1075627).
• ibmvnic: Modify buffer size and number of queues on failover (bsc#1076872).
• ibmvnic: Revert to previous mtu when unsupported value requested (bsc#1076872).
• ibmvnic: Wait for device response when changing MAC (bsc#1078681).
• ib/qib: Remove qpt_mask global (git-fixes).
• ib/rdmavt: restore IRQs on error path in rvt_create_ah() (git-fixes).
• ib/srpt: Disable RDMA access by the initiator (bnc#1012382).
• igb: check memory allocation failure (bnc#1012382).
• ima: fix hash algorithm initialization (bnc#1012382).
• inet: frag: release spinlock before calling icmp_send() (bnc#1012382).
• input: 88pm860x-ts - fix child-node lookup (bnc#1012382).
• input: elantech - add new icbody type 15 (bnc#1012382).
• input: i8042 - add TUXEDO BU1406 (N24_25BU) to the nomux list (bnc#1012382).
• input: trackpoint - force 3 buttons if 0 button is reported (bnc#1012382).
• input: twl4030-vibra - fix sibling-node lookup (bnc#1012382).
• input: twl6040-vibra - fix child-node lookup (bnc#1012382).
• input: twl6040-vibra - fix DT node memory management (bnc#1012382).
• intel_th: pci: Add Gemini Lake support (bnc#1012382).
• iommu/arm-smmu-v3: Do not free page table ops twice (bnc#1012382).
• iommu/vt-d: Fix scatterlist offset handling (bnc#1012382).
• ip6_tunnel: disable dst caching if tunnel is dual-stack (bnc#1012382).
• ipmi: Stop timers before cleaning up the module (bnc#1012382).
• ipv4: Fix use-after-free when flushing FIB tables (bnc#1012382).
• ipv4: igmp: guard against silly MTU values (bnc#1012382).
• ipv4: Make neigh lookup keys for loopback/point-to-point devices be INADDR_ANY (bnc#1012382).
• ipv6: Fix getsockopt() for sockets with default IPV6_AUTOFLOWLABEL (bnc#1012382).
• ipv6: fix possible mem leaks in ipv6_make_skb() (bnc#1012382).
• ipv6: fix udpv6 sendmsg crash caused by too small MTU (bnc#1012382).
• ipv6: ip6_make_skb() needs to clear cork.base.dst (git-fixes).
• ipv6: mcast: better catch silly mtu values (bnc#1012382).
• ipv6: reorder icmpv6_init() and ip6_mr_init() (bnc#1012382).
• ipvlan: fix ipv6 outbound device (bnc#1012382).
• ipvlan: remove excessive packet scrubbing (bsc#1070799).
• irda: vlsi_ir: fix check for DMA mapping errors (bnc#1012382).
• irqchip/crossbar: Fix incorrect type of register size (bnc#1012382).
• iscsi-target: fix memory leak in lio_target_tiqn_addtpg() (bnc#1012382).
• iscsi-target: Make TASK_REASSIGN use proper se_cmd->cmd_kref (bnc#1012382).
• isdn: kcapi: avoid uninitialized data (bnc#1012382).
• iw_cxgb4: Only validate the MSN for successful completions (bnc#1012382).
• ixgbe: fix use of uninitialized padding (bnc#1012382).
• jump_label: Invoke jump_label_test() via early_initcall() (bnc#1012382).
• jump_label: Make it possible for arches to invoke jump_label_init() earlier (bsc#1068032).
• jump_labels: Allow array initialisers (bsc#1068032).
• Kabi: Keep KVM stable after enable s390 wire up bpb feature (bsc#1076806).
• kABI: protect struct bpf_map (kabi).
• kABI: protect struct ipv6_pinfo (kabi).
• kABI: protect struct t10_alua_tg_pt_gp (kabi).
• kABI: protect struct usbip_device (kabi).
• kabi/severities: do not care about stuff_RSB
• kaiser: Set _PAGE_NX only if supported (bnc#1012382).
• kaiser: Set _PAGE_NX only if supported (bnc#1012382).
• kbuild: add '-fno-stack-check' to kernel build options (bnc#1012382).
• kbuild: modversions for EXPORT_SYMBOL() for asm (bsc#1074621 bsc#1068032).
• kbuild: pkg: use --transform option to prefix paths in tar (bnc#1012382).
• kdb: Fix handling of kallsyms_symbol_next() return value (bnc#1012382).
• kernel/acct.c: fix the acct->needcheck check in check_free_space() (bnc#1012382).
• kernel: make groups_sort calling a responsibility group_info allocators (bnc#1012382).
• kernel/signal.c: protect the SIGNAL_UNKILLABLE tasks from !sig_kernel_only() signals (bnc#1012382).
• kernel/signal.c: protect the traced SIGNAL_UNKILLABLE tasks from SIGKILL (bnc#1012382).
• kernel/signal.c: remove the no longer needed SIGNAL_UNKILLABLE check in complete_signal() (bnc#1012382).
• keys: add missing permission check for request_key() destination (bnc#1012382).
• kprobes/x86: Disable preemption in ftrace-based jprobes (bnc#1012382).
• kpti: Rename to PAGE_TABLE_ISOLATION (bnc#1012382).
• kpti: Report when enabled (bnc#1012382).
• kvm: arm/arm64: Fix occasional warning from the timer work function (bnc#1012382 bsc#988524).
• kvm: Fix stack-out-of-bounds read in write_mmio (bnc#1012382).
• kvm: nVMX: reset nested_run_pending if the vCPU is going to be reset (bnc#1012382).
• kvm: nVMX: VMCLEAR should not cause the vCPU to shut down (bnc#1012382).
• kvm: pci-assign: do not map smm memory slot pages in vt-d page tables (bnc#1012382).
• kvm: s390: Enable all facility bits that are known good for passthrough (bsc#1076806).
• kvm: s390: wire up bpb feature (bsc#1076806).
• kvm: VMX: Fix enable VPID conditions (bnc#1012382).
• kvm: VMX: remove I/O port 0x80 bypass on Intel hosts (bnc#1012382).
• kvm: vmx: Scrub hardware GPRs at VM-exit (bnc#1012382).
• kvm: x86: Add memory barrier on vmcs field lookup (bnc#1012382).
• kvm: x86: correct async page present tracepoint (bnc#1012382).
• kvm: X86: Fix load RFLAGS w/o the fixed bit (bnc#1012382).
• kvm: x86: fix RSM when pciD is non-zero (bnc#1012382).
• l2tp: cleanup l2tp_tunnel_delete calls (bnc#1012382).
• lan78xx: Fix failure in USB Full Speed (bnc#1012382).
• libata: apply MAX_SEC_1024 to all LITEON EP1 series devices (bnc#1012382).
• libata: drop WARN from protocol error in ata_sff_qc_issue() (bnc#1012382).
• lib/genalloc.c: make the avail variable an atomic_long_t (bnc#1012382).
• macvlan: Only deliver one copy of the frame to the macvlan interface (bnc#1012382).
• md-cluster: free md_cluster_info if node leave cluster (bnc#1012382).
• media: dvb: i2c transfers over usb cannot be done from stack (bnc#1012382).
• mfd: cros ec: spi: Do not send first message too soon (bnc#1012382).
• mfd: twl4030-audio: Fix sibling-node lookup (bnc#1012382).
• mfd: twl6040: Fix child-node lookup (bnc#1012382).
• MIPS: Also verify sizeof `elf_fpreg_t' with PTRACE_SETREGSET (bnc#1012382).
• MIPS: AR7: ensure the port type's FCR value is used (bnc#1012382).
• MIPS: Consistently handle buffer counter with PTRACE_SETREGSET (bnc#1012382).
• MIPS: Disallow outsized PTRACE_SETREGSET NT_PRFPREG regset accesses (bnc#1012382).
• MIPS: Factor out NT_PRFPREG regset access helpers (bnc#1012382).
• MIPS: Fix an FCSR access API regression with NT_PRFPREG and MSA (bnc#1012382).
• MIPS: Guard against any partial write attempt with PTRACE_SETREGSET (bnc#1012382).
• MIPS: math-emu: Fix final emulation phase for certain instructions (bnc#1012382).
• MIPS: Validate PR_SET_FP_MODE prctl(2) requests against the ABI of the task (bnc#1012382).
• mlxsw: reg: Fix SPVMLR max record count (bnc#1012382).
• mlxsw: reg: Fix SPVM max record count (bnc#1012382).
• mm: avoid returning VM_FAULT_RETRY from ->page_mkwrite handlers (bnc#1012382).
• mmc: mediatek: Fixed bug where clock frequency could be set wrong (bnc#1012382).
• mm: drop unused pmdp_huge_get_and_clear_notify() (bnc#1012382).
• mm: Handle 0 flags in _calc_vm_trans() macro (bnc#1012382).
• mm: Introduce lm_alias (bsc#1068032).
• mm/mmap.c: do not blow on PROT_NONE MAP_FIXED holes in the stack (bnc#1012382).
• mm/mprotect: add a cond_resched() inside change_pmd_range() (bnc#1077871).
• mm/vmstat: Make NR_TLB_REMOTE_FLUSH_RECEIVED available even on UP (bnc#1012382).
• module: set __jump_table alignment to 8 (bnc#1012382).
• more bio_map_user_iov() leak fixes (bnc#1012382).
• net: Allow neigh contructor functions ability to modify the primary_key (bnc#1012382).
• net/appletalk: Fix kernel memory disclosure (bnc#1012382).
• net: bcmgenet: correct MIB access of UniMAC RUNT counters (bnc#1012382).
• net: bcmgenet: correct the RBUF_OVFL_CNT and RBUF_ERR_CNT MIB values (bnc#1012382).
• net: bcmgenet: power down internal phy if open or resume fails (bnc#1012382).
• net: bcmgenet: Power up the internal PHY before probing the MII (bnc#1012382).
• net: bcmgenet: reserved phy revisions must be checked first (bnc#1012382).
• net: bridge: fix early call to br_stp_change_bridge_id and plug newlink leaks (bnc#1012382).
• net: core: fix module type in sock_diag_bind (bnc#1012382).
• net: Do not allow negative values for busy_read and busy_poll sysctl interfaces (bnc#1012382).
• net: fec: fix multicast filtering hardware setup (bnc#1012382).
• netfilter: bridge: honor frag_max_size when refragmenting (bnc#1012382).
• netfilter: do not track fragmented packets (bnc#1012382).
• netfilter: ipvs: Fix inappropriate output of procfs (bnc#1012382).
• netfilter: nfnetlink_queue: fix secctx memory leak (bnc#1012382).
• netfilter: nfnetlink_queue: fix timestamp attribute (bsc#1074134).
• netfilter: nfnl_cthelper: fix a race when walk the nf_ct_helper_hash table (bnc#1012382).
• netfilter: nfnl_cthelper: Fix memory leak (bnc#1012382).
• netfilter: nfnl_cthelper: fix runtime expectation policy updates (bnc#1012382).
• net: Fix double free and memory corruption in get_net_ns_by_id() (bnc#1012382).
• net: igmp: fix source address check for IGMPv3 reports (bnc#1012382).
• net: igmp: Use correct source address on IGMPv3 reports (bnc#1012382).
• net: initialize msg.msg_flags in recvfrom (bnc#1012382).
• net: ipv4: fix for a race condition in raw_sendmsg (bnc#1012382).
• net/mac80211/debugfs.c: prevent build failure with CONFIG_UBSAN=y (bnc#1012382).
• net: mvmdio: disable/unprepare clocks in EPROBE_DEFER case (bnc#1012382).
• net: mvneta: clear interface link status on port disable (bnc#1012382).
• net/packet: fix a race in packet_bind() and packet_notifier() (bnc#1012382).
• net: phy: at803x: Change error to EINVAL for invalid MAC (bnc#1012382).
• net: phy: micrel: ksz9031: reconfigure autoneg after phy autoneg workaround (bnc#1012382).
• net: qdisc_pkt_len_init() should be more robust (bnc#1012382).
• net: qmi_wwan: add Sierra EM7565 1199:9091 (bnc#1012382).
• net: qmi_wwan: Add USB IDs for MDM6600 modem on Motorola Droid 4 (bnc#1012382).
• net: reevalulate autoflowlabel setting after sysctl setting (bnc#1012382).
• net: Resend IGMP memberships upon peer notification (bnc#1012382).
• net: sctp: fix array overrun read on sctp_timer_tbl (bnc#1012382).
• net: stmmac: enable EEE in MII, GMII or RGMII only (bnc#1012382).
• net: systemport: Pad packet before inserting TSB (bnc#1012382).
• net: systemport: Utilize skb_put_padto() (bnc#1012382).
• net: tcp: close sock if net namespace is exiting (bnc#1012382).
• net: wimax/i2400m: fix NULL-deref at probe (bnc#1012382).
• nfsd: auth: Fix gid sorting when rootsquash enabled (bnc#1012382).
• nfsd: fix nfsd_minorversion(.., NFSD_AVAIL) (bnc#1012382).
• nfsd: fix nfsd_reset_versions for NFSv4 (bnc#1012382).
• nfs: Do not take a reference on fl->fl_file for LOCK operation (bnc#1012382).
• nfs: Fix a typo in nfs_rename() (bnc#1012382).
• nfsv4.1 respect server's max size in CREATE_SESSION (bnc#1012382).
• nfsv4: Fix client recovery when server reboots multiple times (bnc#1012382).
• nohz: Prevent a timer interrupt storm in tick_nohz_stop_sched_tick() (bnc#10