Security update for the Linux Kernel

An update that solves 12 vulnerabilities and has 88 security fixes can now be installed.

Description:

The SUSE Linux Enterprise 15 azure kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-5391: A remote attacker even with relatively low bandwidth could have caused lots of CPU usage by triggering the worst case scenario during fragment reassembly (bsc#1103097)
• CVE-2018-3620, CVE-2018-3646: Local attackers in virtualized guest systems could use speculative code patterns on hyperthreaded processors to read data present in the L1 Datacache used by other hyperthreads on the same CPU core, potentially leaking sensitive data, even from other virtual machines or the host system. (bnc#1089343, bsc#1087081).
• CVE-2018-10882: A local user could have caused an out-of-bound write, leading to denial of service and a system crash by unmounting a crafted ext4 filesystem image (bsc#1099849).
• CVE-2018-10880: Prevent a stack-out-of-bounds write in the ext4 filesystem code when mounting and writing crafted ext4 images. An attacker could have used this to cause a system crash and a denial of service (bsc#1099845).
• CVE-2018-10881: A local user could have caused an out-of-bound access and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099864).
• CVE-2018-10877: Prevent an out-of-bound access in the ext4_ext_drop_refs() function when operating on a crafted ext4 filesystem image (bsc#1099846).
• CVE-2018-10876: Prevent use-after-free in ext4_ext_remove_space() function when mounting and operating a crafted ext4 image (bsc#1099811).
• CVE-2018-10878: A local user could have caused an out-of-bounds write and a denial of service by mounting and operating a crafted ext4 filesystem image (bsc#1099813).
• CVE-2018-10883: A local user could have caused an out-of-bounds write in jbd2_journal_dirty_metadata(), a denial of service, and a system crash by mounting and operating on a crafted ext4 filesystem image (bsc#1099863).
• CVE-2018-10879: A local user could have caused a use-after-free in ext4_xattr_set_entry function and a denial of service or unspecified other impact may occur by renaming a file in a crafted ext4 filesystem image (bsc#1099844).
• CVE-2018-10853: A flaw was found in Linux Kernel KVM. In which certain instructions such as sgdt/sidt call segmented_write_std doesn't propagate access correctly. As such, during userspace induced exception, the guest can incorrectly assume that the exception happened in the kernel and panic. (bnc#1097104).

The following non-security bugs were fixed:

• apci / lpss: Only call pwm_add_table() for Bay Trail PWM if PMIC HRV is 2 (bsc#1051510).
• acpi / pci: Bail early in acpi_pci_add_bus() if there is no ACPI handle (bsc#1051510).
• af_key: Always verify length of provided sadb_key (bsc#1051510).
• af_key: fix buffer overread in parse_exthdrs() (bsc#1051510).
• af_key: fix buffer overread in verify_address_len() (bsc#1051510).
• afs: Fix directory permissions check (bsc#1101828).
• agp: uninorth: make two functions static (bsc#1051510).
• alsa: emu10k1: add error handling for snd_ctl_add (bsc#1051510).
• alsa: emu10k1: Rate-limit error messages about page errors (bsc#1051510).
• alsa: fm801: add error handling for snd_ctl_add (bsc#1051510).
• alsa: snd-aoa: add of_node_put() in error path (bsc#1051510).
• alsa: usb-audio: Apply rate limit to warning messages in URB complete callback (bsc#1051510).
• arm64: Correct type for PUD macros (bsc#1103723).
• arm64: Disable unhandled signal log messages by default (bsc#1103724).
• arm64: KVM: fix VTTBR_BADDR_MASK BUG_ON off-by-one (bsc#1103725).
• arm64: mm: Fix set_memory_valid() declaration (bsc#1103726).
• arm64: perf: correct PMUVer probing (bsc#1103727).
• arm64: ptrace: Avoid setting compat FPR to garbage if get_user fails (bsc#1103728).
• arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics (bsc#1103729).
• arm64: vdso: fix clock_getres for 4GiB-aligned res (bsc#1103730).
• arm: 8715/1: add a private asm/unaligned.h (bsc#1051510).
• arm: 8720/1: ensure dump_instr() checks addr_limit (bsc#1051510).
• arm: 8721/1: mm: dump: check hardware RO bit for LPAE (bsc#1051510).
• arm: 8722/1: mm: make STRICT_KERNEL_RWX effective for LPAE (bsc#1051510).
• arm: 8731/1: Fix csum_partial_copy_from_user() stack mismatch (bsc#1051510).
• arm: 8743/1: bL_switcher: add MODULE_LICENSE tag (bsc#1051510).
• arm: 8746/1: vfp: Go back to clearing vfp_current_hw_state[] (bsc#1051510).
• arm: 8748/1: mm: Define vdso_start, vdso_end as array (bsc#1051510).
• arm: 8753/1: decompressor: add a missing parameter to the addruart macro (bsc#1051510).
• arm: 8758/1: decompressor: restore r1 and r2 just before jumping to the kernel (bsc#1051510).
• arm: 8764/1: kgdb: fix NUMREGBYTES so that gdb_regs[] is the correct size (bsc#1051510).
• arm: 8769/1: kprobes: Fix to use get_kprobe_ctlblk after irq-disabed (bsc#1051510).
• arm: 8770/1: kprobes: Prohibit probing on optimized_callback (bsc#1051510).
• arm: 8771/1: kprobes: Prohibit kprobes on do_undefinstr (bsc#1051510).
• arm: 8772/1: kprobes: Prohibit kprobes on get_user functions (bsc#1051510).
• arm: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function (bsc#1051510).
• arm: amba: Fix race condition with driver_override (bsc#1051510).
• arm: amba: Fix wrong indentation in driver_override_store() (bsc#1051510).
• arm: amba: Make driver_override output consistent with other buses (bsc#1051510).
• arm: at91: do not select CONFIG_ARM_CPU_SUSPEND for old platforms (bsc#1051510).
• arm: avoid faulting on qemu (bsc#1051510).
• arm: BUG if jumping to usermode address in kernel mode (bsc#1051510).
• arm-ccn: perf: Prevent module unload while PMU is in use (bsc#1051510).
• arm: davinci: Add dma_mask to dm365's eDMA device (bsc#1051510).
• arm: davinci: board-da830-evm: fix GPIO lookup for MMC/SD (bsc#1051510).
• arm: davinci: board-da850-evm: fix GPIO lookup for MMC/SD (bsc#1051510).
• arm: davinci: board-da850-evm: fix WP pin polarity for MMC/SD (bsc#1051510).
• arm: davinci: board-dm355-evm: fix broken networking (bsc#1051510).
• arm: davinci: board-dm646x-evm: pass correct I2C adapter id for VPIF (bsc#1051510).
• arm: davinci: board-dm646x-evm: set VPIF capture card name (bsc#1051510).
• arm: davinci: board-omapl138-hawk: fix GPIO numbers for MMC/SD lookup (bsc#1051510).
• arm: davinci: dm646x: fix timer interrupt generation (bsc#1051510).
• arm: davinci: fix mmc entries in dm365's dma_slave_map (bsc#1051510).
• arm: davinci: fix the GPIO lookup for omapl138-hawk (bsc#1051510).
• arm: davinci: Use platform_device_register_full() to create pdev for dm365's eDMA (bsc#1051510).
• arm: DRA722: remove redundant definition of 1.0 device (bsc#1051510).
• arm: fix return value of parse_cpu_capacity (bsc#1051510).
• arm: kexec: fix failure to boot crash kernel (bsc#1051510).
• arm: kexec: fix kdump register saving on panic() (bsc#1051510).
• arm: keystone: fix platform_domain_notifier array overrun (bsc#1051510).
• arm: kvm: fix building with gcc-8 (bsc#1051510).
• arm: multi_v7_defconfig: Replace DRM_RCAR_HDMI by generic bridge options (bsc#1051510).
• arm: multi_v7_defconfig: Replace SND_SOC_RSRC_CARD by SND_SIMPLE_SCU_CARD (bsc#1051510).
• arm: mvebu: Fix broken PL310_ERRATA_753970 selects (bsc#1051510).
• arm: OMAP1: clock: Fix debugfs_create_*() usage (bsc#1051510).
• arm: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context (bsc#1051510).
• arm: omap2: hide omap3_save_secure_ram on non-OMAP3 builds (bsc#1051510).
• arm: OMAP2+: omap_device: drop broken RPM status update from suspend_noirq (bsc#1051510).
• arm: OMAP2+: powerdomain: use raw_smp_processor_id() for trace (bsc#1051510).
• arm: OMAP2+: timer: fix a kmemleak caused in omap_get_timer_dt (bsc#1051510).
• arm: OMAP3: Fix prm wake interrupt for resume (bsc#1051510).
• arm: OMAP3: hwmod_data: add missing module_offs for MMC3 (bsc#1051510).
• arm: OMAP3+: PRM: fix of_irq_get() result check (bsc#1051510).
• arm: OMAP4+: PRM: fix of_irq_get() result checks (bsc#1051510).
• arm: OMAP: Fix dmtimer init for omap1 (bsc#1051510).
• arm: OMAP: Fix SRAM W+X mapping (bsc#1051510).
• arm: orion5x: Revert commit 4904dbda41c8 (bsc#1051510).
• arm: orion: fix orion_ge00_switch_board_info initialization (bsc#1051510).
• arm: pxa: select both FB and FB_W100 for eseries (bsc#1051510).
• arm: pxa/tosa-bt: add MODULE_LICENSE tag (bsc#1051510).
• arm: remove wrong CONFIG_PROC_SYSCTL ifdef (bsc#1051510).
• arm: s3c24xx: Fix NAND ECC mode for mini2440 board (bsc#1051510).
• arm: shmobile: defconfig: Enable missing PCIE_RCAR dependency (bsc#1051510).
• arm: shmobile: defconfig: Replace DRM_RCAR_HDMI by generic bridge options (bsc#1051510).
• arm: shmobile: defconfig: Replace SND_SOC_RSRC_CARD by SND_SIMPLE_SCU_CARD (bsc#1051510).
• arm: shmobile: defconfig: Replace USB_XHCI_RCAR by USB_XHCI_PLATFORM (bsc#1051510).
• arm: shmobile: rcar-gen2: Fix deadlock in regulator quirk (bsc#1051510).
• arm: socfpga_defconfig: Remove QSPI Sector 4K size force (bsc#1051510).
• arm: spear13xx: Fix dmas cells (bsc#1051510).
• arm: sunxi_defconfig: Enable CMA (bsc#1051510).
• arm: sunxi: fix the core number of V3s in sunxi README (bsc#1051510).
• asoc: dpcm: do not merge format from invalid codec dai (bsc#1051510).
• ASoC: dpcm: fix BE dai not hw_free and shutdown (bsc#1051510).
• asoc: es7134: remove 64kHz rate from the supported rates (bsc#1051510).
• asoc: rsnd: cmd: Add missing newline to debug message (bsc#1051510).
• asoc: sirf: Fix potential NULL pointer dereference (bsc#1051510).
• asoc: topology: Add missing clock gating parameter when parsing hw_configs (bsc#1051510).
• asoc: topology: Fix bclk and fsync inversion in set_link_hw_format() (bsc#1051510).
• asoc: zte: Fix incorrect PCM format bit usages (bsc#1051510).
• ata: do not schedule hot plug if it is a sas host ().
• ath: Add regulatory mapping for APL13_WORLD (bsc#1051510).
• ath: Add regulatory mapping for APL2_FCCA (bsc#1051510).
• ath: Add regulatory mapping for Bahamas (bsc#1051510).
• ath: Add regulatory mapping for Bermuda (bsc#1051510).
• ath: Add regulatory mapping for ETSI8_WORLD (bsc#1051510).
• ath: Add regulatory mapping for FCC3_ETSIC (bsc#1051510).
• ath: Add regulatory mapping for Serbia (bsc#1051510).
• ath: Add regulatory mapping for Tanzania (bsc#1051510).
• ath: Add regulatory mapping for Uganda (bsc#1051510).
• audit: fix potential null dereference 'context->module.name' (bsc#1051510).
• backlight: pwm_bl: Do not use GPIOF_* with gpiod_get_direction (bsc#1051510).
• bdi: Move cgroup bdi_writeback to a dedicated low concurrency workqueue (bsc#1101867).
• be2net: gather debug info and reset adapter (only for Lancer) on a tx-timeout (bsc#1086288).
• be2net: Update the driver version to 12.0.0.0 (bsc#1086288 ).
• befs_lookup(): use d_splice_alias() (bsc#1101844).
• block: Fix transfer when chunk sectors exceeds max (bsc#1101874).
• Bluetooth: btusb: Add a new Realtek 8723DE ID 2ff8:b011 (bsc#1051510).
• Bluetooth: btusb: add ID for LiteOn 04ca:301a (bsc#1051510).
• Bluetooth: hci_qca: Fix "Sleep inside atomic section" warning (bsc#1051510).
• bpf, ppc64: fix unexpected r0=0 exit path inside bpf_xadd (bsc#1083647).
• branch-check: fix long->int truncation when profiling branches (bsc#1101116,).
• brcmfmac: Add support for bcm43364 wireless chipset (bsc#1051510).
• cachefiles: Fix missing clear of the CACHEFILES_OBJECT_ACTIVE flag (bsc#1099858).
• cachefiles: Fix refcounting bug in backing-file read monitoring (bsc#1099858).
• cachefiles: Wait rather than BUG'ing on "Unexpected object collision" (bsc#1099858).
• can: dev: increase bus-off message severity (bsc#1051510).
• can: ems_usb: Fix memory leak on ems_usb_disconnect() (bsc#1051510).
• can: m_can: change comparison to bitshift when dealing with a mask (bsc#1051510).
• cdrom: do not call check_disk_change() inside cdrom_open() (bsc#1101872).
• clk: at91: fix clk-generated compilation (bsc#1051510).
• clk: renesas: cpg-mssr: Stop using printk format %pCr (bsc#1051510).
• coccinelle: fix parallel build with CHECK=scripts/coccicheck (bsc#1051510).
• compiler.h: enable builtin overflow checkers and add fallback code (bsc#1101116,).
• cpufreq: intel_pstate: Limit the scope of HWP dynamic boost platforms (bsc#1066110).
• cpu/hotplug: Make bringup/teardown of smp threads symmetric (bsc#1089343).
• cpu/hotplug: Provide knobs to control SMT (bsc#1089343).
• cpu/hotplug: Split do_cpu_down() (bsc#1089343).
• crypto: authenc - do not leak pointers to authenc keys (bsc#1051510).
• crypto: authencesn - do not leak pointers to authenc keys (bsc#1051510).
• crypto: padlock-aes - Fix Nano workaround data corruption (bsc#1051510).
• delayacct: fix crash in delayacct_blkio_end() after delayacct init failure (bsc#1104066).
• Delete patches.suse/0201-dax-dm-allow-device-mapper-to-operate-without-dax-su.patch (bsc#1103917).
• disable PINCTRL_LEWISBURG
• dm: add writecache target (bsc#1101116,).
• dm: prevent DAX mounts if not supported (bsc#1103917).
• dm writecache: support optional offset for start of device (bsc#1101116,).
• dm writecache: use 2-factor allocator arguments (bsc#1101116,).
• doc: Add vendor prefix for Kieback and Peter GmbH (bsc#1051510).
• docs: zh_CN: fix location of oops-tracing.txt (bsc#1051510).
• drivers: soc: sunxi: fix error processing on base address when claiming (bsc#1051510).
• drm: Add DP PSR2 sink enable bit (bsc#1051510).
• drm/amdgpu: Remove VRAM from shared bo domains (bsc#1051510).
• drm/atomic: Check old_plane_state->crtc in drm_atomic_helper_async_check() (bsc#1051510).
• drm/atomic: Handling the case when setting old crtc for plane (bsc#1051510).
• drm/atomic-helper: Drop plane->fb references only for drm_atomic_helper_shutdown() (bsc#1051510).
• drm/atomic: Initialize variables in drm_atomic_helper_async_check() to make gcc happy (bsc#1051510).
• drm/atomic: Make async plane update checks work as intended, v2 (bsc#1051510).
• drm/atomic: Make atomic helper track newly assigned planes correctly, v2 (bsc#1051510).
• drm/atomic: Make atomic iterators less surprising (bsc#1051510).
• drm/cirrus: Use drm_framebuffer_put to avoid kernel oops in clean-up (bsc#1101822).
• drm/dp/mst: Fix off-by-one typo when dump payload table (bsc#1051510).
• drm/gma500: fix psb_intel_lvds_mode_valid()'s return type (bsc#1051510).
• drm/nouveau/fifo/gk104-: poll for runlist update completion (bsc#1051510).
• drm/radeon: fix mode_valid's return type (bsc#1051510).
• drm: re-enable error handling (bsc#1051510).
• drm/vc4: Reset ->{x, y}_scaling[1] when dealing with uniplanar formats (bsc#1051510).
• edac: Add missing MEM_LRDDR4 entry in edac_mem_types[] (bsc#1103886).
• edac, altera: Fix ARM64 build warning (bsc#1051510).
• edac: Drop duplicated array of strings for memory type names (bsc#1103886).
• edac, mv64x60: Fix an error handling path (bsc#1051510).
• edac, octeon: Fix an uninitialized variable warning (bsc#1051510).
• edac, sb_edac: Fix missing break in switch (bsc#1051510).
• ext2: fix a block leak (bsc#1101875).
• ext4: add more mount time checks of the superblock (bsc#1101900).
• ext4: bubble errors from ext4_find_inline_data_nolock() up to ext4_iget() (bsc#1101896).
• ext4: check for allocation block validity with block group locked (bsc#1104495).
• ext4: check superblock mapped prior to committing (bsc#1101902).
• ext4: do not update s_last_mounted of a frozen fs (bsc#1101841).
• ext4: factor out helper ext4_sample_last_mounted() (bsc#1101841).
• ext4: fix check to prevent initializing reserved inodes (bsc#1104319).
• ext4: fix false negatives and false positives in ext4_check_descriptors() (bsc#1103445).
• ext4: fix fencepost error in check for inode count overflow during resize (bsc#1101853).
• ext4: fix inline data updates with checksums enabled (bsc#1104494).
• ext4: include the illegal physical block in the bad map ext4_error msg (bsc#1101903).
• ext4: report delalloc reserve as non-free in statfs for project quota (bsc#1101843).
• ext4: update mtime in ext4_punch_hole even if no blocks are released (bsc#1101895).
• f2fs: call unlock_new_inode() before d_instantiate() (bsc#1101837).
• fix io_destroy()/aio_complete() race (bsc#1101852).
• Force log to disk before reading the AGF during a fstrim (bsc#1101893).
• fs: allow per-device dax status checking for filesystems (bsc#1103917).
• fscache: Allow cancelled operations to be enqueued (bsc#1099858).
• fscache: Fix hanging wait on page discarded by writeback (bsc#1101885).
• fscache: Fix reference overput in fscache_attach_object() error handling (bsc#1099858).
• fs: clear writeback errors in inode_init_always (bsc#1101882).
• fs: do not scan the inode cache before SB_BORN is set (bsc#1101883).
• geneve: update skb dst pmtu on tx path (bsc#1051510).
• genirq: Check __free_irq() return value for NULL (bsc#1103517).
• genirq: Fix editing error in a comment (bsc#1051510).
• genirq: Make force irq threading setup more robust (bsc#1051510).
• gtp: Initialize 64-bit per-cpu stats correctly (bsc#1051510).
• HID: hid-plantronics: Re-resend Update to map button for PTT products (bsc#1051510).
• HID: i2c-hid: check if device is there before really probing (bsc#1051510).
• hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close (bsc#1051510).
• hns3: fix unused function warning (bsc#1104353).
• hns3pf: do not check handle during mqprio offload (bsc#1104353 ).
• hns3pf: fix hns3_del_tunnel_port() (bsc#1104353).
• hns3pf: Fix some harmless copy and paste bugs (bsc#1104353 ).
• hv_netvsc: Ensure correct teardown message sequence order ().
• hv/netvsc: fix handling of fallback to single queue mode ().
• hv_netvsc: Fix napi reschedule while receive completion is busy.
• hv_netvsc: Fix net device attach on older Windows hosts ().
• hv/netvsc: Fix NULL dereference at single queue mode fallback (bsc#1104708).
• hv_netvsc: set master device (bsc#1051979).
• hv_netvsc: Split netvsc_revoke_buf() and netvsc_teardown_gpadl() ().
• hv_netvsc: split sub-channel setup into async and sync ().
• hv_netvsc: Use Windows version instead of NVSP version on GPAD teardown ().
• hwmon: (asus_atk0110) Replace deprecated device register call (bsc#1103363).
• i2c: imx: Fix reinit_completion() use (bsc#1051510).
• IB/hns: Annotate iomem pointers correctly (bsc#1104427 ).
• IB/hns: Avoid compile test under non 64bit environments (bsc#1104427).
• IB/hns: Declare local functions 'static' (bsc#1104427 ).
• IB/hns: fix boolreturn.cocci warnings (bsc#1104427).
• IB/hns: Fix for checkpatch.pl comment style warnings (bsc#1104427).
• IB/hns: fix memory leak on ah on error return path (bsc#1104427 ).
• IB/hns: fix returnvar.cocci warnings (bsc#1104427).
• IB/hns: fix semicolon.cocci warnings (bsc#1104427).
• IB/hns: Fix the bug of polling cq failed for loopback Qps (bsc#1104427).
• IB/hns: Fix the bug with modifying the MAC address without removing the driver (bsc#1104427).
• IB/hns: Fix the bug with rdma operation (bsc#1104427 ).
• IB/hns: Fix the bug with wild pointer when destroy rc qp (bsc#1104427).
• IB/hns: include linux/interrupt.h (bsc#1104427).
• IB/hns: Support compile test for hns RoCE driver (bsc#1104427 ).
• IB/hns: Use zeroing memory allocator instead of allocator/memset (bsc#1104427).
• ibmasm: do not write out of bounds in read handler (bsc#1051510).
• ibmvnic: Remove code to request error information (bsc#1104174).
• ibmvnic: Revise RX/TX queue error messages (bsc#1101331).
• ibmvnic: Update firmware error reporting with cause string (bsc#1104174).
• init: rename and re-order boot_cpu_state_init() (bsc#1104365).
• Input: elan_i2c - add ACPI ID for lenovo ideapad 330 (bsc#1051510).
• Input: elan_i2c - add another ACPI ID for Lenovo Ideapad 330-15AST (bsc#1051510).
• Input: i8042 - add Lenovo LaVie Z to the i8042 reset list (bsc#1051510).
• irqchip: brcmstb-l2: Define an irq_pm_shutdown function (bsc#1051510).
• irqchip/gic: Take lock when updating irq type (bsc#1051510).
• irqchip/gic-v3: Change pr_debug message to pr_devel (bsc#1051510).
• irqchip/gic-v3: Fix the driver probe() fail due to disabled GICC entry (bsc#1051510).
• irqchip/gic-v3: Ignore disabled ITS nodes (bsc#1051510).
• irqchip/gic-v3: Use wmb() instead of smb_wmb() in gic_raise_softirq() (bsc#1051510).
• irqchip/qcom: Fix check for spurious interrupts (bsc#1051510).
• irqchip/qcom: Fix u32 comparison with value less than zero (bsc#1051510).
• isofs: fix potential memory leak in mount option parsing (bsc#1101887).
• iwlwifi: add more card IDs for 9000 series (bsc#1051510).
• iwlwifi: pcie: fix race in Rx buffer allocator (bsc#1051510).
• jump_label: Fix concurrent static_key_enable/disable() (bsc#1089343).
• jump_label: Provide hotplug context variants (bsc#1089343).
• jump_label: Reorder hotplug lock and jump_label_lock (bsc#1089343).
• kabi protect bdev_dax_supported (bsc