Security update for the Linux Kernel

An update that solves 11 vulnerabilities and has 94 security fixes can now be installed.

Description:

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-8834: KVM on Power8 processors had a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability to run code in kernel space of a guest VM can cause the host kernel to panic (bnc#1168276).
• CVE-2020-11494: An issue was discovered in slc_bump in drivers/net/can/slcan.c, which allowed attackers to read uninitialized can_frame data, potentially containing sensitive information from kernel stack memory, if the configuration lacks CONFIG_INIT_STACK_ALL (bnc#1168424).
• CVE-2020-10942: In get_raw_socket in drivers/vhost/net.c lacks validation of an sk_family field, which might allow attackers to trigger kernel stack corruption via crafted system calls (bnc#1167629).
• CVE-2019-9458: In the video driver there was a use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed (bnc#1168295).
• CVE-2019-3701: Fixed an issue in can_can_gw_rcv, which could cause a system crash (bnc#1120386).
• CVE-2019-19770: Fixed a use-after-free in the debugfs_remove function (bsc#1159198).
• CVE-2020-11669: Fixed an issue where arch/powerpc/kernel/idle_book3s.S did not have save/restore functionality for PNV_POWERSAVE_AMR, PNV_POWERSAVE_UAMOR, and PNV_POWERSAVE_AMOR (bnc#1169390).
• CVE-2020-8647: There was a use-after-free vulnerability in the vc_do_resize function in drivers/tty/vt/vt.c (bnc#1162929).
• CVE-2020-8649: There was a use-after-free vulnerability in the vgacon_invert_region function in drivers/video/console/vgacon.c (bnc#1162931).
• CVE-2020-9383: An issue was discovered set_fdc in drivers/block/floppy.c leads to a wait_til_ready out-of-bounds read because the FDC index is not checked for errors before assigning it (bnc#1165111).
• CVE-2019-19768: Fixed a use-after-free in the __blk_add_trace function in kernel/trace/blktrace.c (bnc#1159285).

The following non-security bugs were fixed:

• ACPICA: Introduce ACPI_ACCESS_BYTE_WIDTH() macro (bsc#1051510).
• ACPI: watchdog: Fix gas->access_width usage (bsc#1051510).
• ALSA: ali5451: remove redundant variable capture_flag (bsc#1051510).
• ALSA: core: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: emu10k1: Fix endianness annotations (bsc#1051510).
• ALSA: hda/ca0132 - Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda_codec: Replace zero-length array with flexible-array member (bsc#1051510).
• ALSA: hda: Fix potential access overflow in beep helper (bsc#1051510).
• ALSA: hda/realtek: Fix pop noise on ALC225 (git-fixes).
• ALSA: hda/realtek - Set principled PC Beep configuration for ALC256 (bsc#1051510).
• ALSA: hda: remove redundant assignment to variable timeout (bsc#1051510).
• ALSA: hda: Use scnprintf() for string truncation (bsc#1051510).
• ALSA: hdsp: remove redundant assignment to variable err (bsc#1051510).
• ALSA: ice1724: Fix invalid access for enumerated ctl items (bsc#1051510).
• ALSA: info: remove redundant assignment to variable c (bsc#1051510).
• ALSA: korg1212: fix if-statement empty body warnings (bsc#1051510).
• ALSA: line6: Fix endless MIDI read loop (git-fixes).
• ALSA: pcm: oss: Avoid plugin buffer overflow (git-fixes).
• ALSA: pcm: oss: Fix regression by buffer overflow fix (bsc#1051510).
• ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks (git-fixes).
• ALSA: seq: oss: Fix running status after receiving sysex (git-fixes).
• ALSA: seq: virmidi: Fix running status after receiving sysex (git-fixes).
• ALSA: usx2y: Adjust indentation in snd_usX2Y_hwdep_dsp_status (bsc#1051510).
• ALSA: via82xx: Fix endianness annotations (bsc#1051510).
• ASoC: dapm: Correct DAPM handling of active widgets during shutdown (bsc#1051510).
• ASoC: Intel: atom: Take the drv->lock mutex before calling sst_send_slot_map() (bsc#1051510).
• ASoC: Intel: mrfld: fix incorrect check on p->sink (bsc#1051510).
• ASoC: Intel: mrfld: return error codes when an error occurs (bsc#1051510).
• ASoC: jz4740-i2s: Fix divider written at incorrect offset in register (bsc#1051510).
• ASoC: pcm512x: Fix unbalanced regulator enable call in probe error path (bsc#1051510).
• ASoC: pcm: Fix possible buffer overflow in dpcm state sysfs output (bsc#1051510).
• ASoC: pcm: update FE/BE trigger order based on the command (bsc#1051510).
• ASoC: sun8i-codec: Remove unused dev from codec struct (bsc#1051510).
• ASoC: topology: Fix memleak in soc_tplg_link_elems_load() (bsc#1051510).
• ath9k: Handle txpower changes even when TPC is disabled (bsc#1051510).
• atm: zatm: Fix empty body Clang warnings (bsc#1051510).
• atomic: Add irqsave variant of atomic_dec_and_lock() (bsc#1166003).
• b43legacy: Fix -Wcast-function-type (bsc#1051510).
• batman-adv: Avoid spurious warnings from bat_v neigh_cmp implementation (bsc#1051510).
• batman-adv: Do not schedule OGM for disabled interface (bsc#1051510).
• batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs (bsc#1051510).
• blk: Fix kabi due to blk_trace_mutex addition (bsc#1159285).
• blk-mq: Allow blocking queue tag iter callbacks (bsc#1167316).
• blktrace: fix dereference after null check (bsc#1159285).
• blktrace: fix trace mutex deadlock (bsc#1159285).
• block: allow gendisk's request_queue registration to be (bsc#1104967,bsc#1159142).
• block, bfq: fix use-after-free in bfq_idle_slice_timer_body (bsc#1168760).
• block: keep bdi->io_pages in sync with max_sectors_kb for stacked devices (bsc#1168762).
• Bluetooth: RFCOMM: fix ODEBUG bug in rfcomm_dev_ioctl (bsc#1051510).
• bnxt_en: Fix TC queue mapping (networking-stable-20_02_05).
• bonding/alb: properly access headers in bond_alb_xmit() (networking-stable-20_02_09).
• bpf: Explicitly memset some bpf info structures declared on the stack (bsc#1083647).
• bpf: Explicitly memset the bpf_attr structure (bsc#1083647).
• bpf: fix ldx in ld_abs rewrite for large offsets (bsc#1154385).
• bpf: implement ld_abs/ld_ind in native bpf (bsc#1154385).
• bpf: make unknown opcode handling more robust (bsc#1154385).
• bpf: prefix cbpf internal helpers with bpf_ (bsc#1154385).
• bpf, x64: remove ld_abs/ld_ind (bsc#1154385).
• bpf, x64: save several bytes by using mov over movabsq when possible (bsc#1154385).
• btrfs: Account for trans_block_rsv in may_commit_transaction (bsc#1165949).
• btrfs: add a flush step for delayed iputs (bsc#1165949).
• btrfs: add assertions for releasing trans handle reservations (bsc#1165949).
• btrfs: add btrfs_delete_ref_head helper (bsc#1165949).
• btrfs: add enospc debug messages for ticket failure (bsc#1165949).
• btrfs: Add enospc_debug printing in metadata_reserve_bytes (bsc#1165949).
• btrfs: add new flushing states for the delayed refs rsv (bsc#1165949).
• btrfs: add space reservation tracepoint for reserved bytes (bsc#1165949).
• btrfs: allow us to use up to 90% of the global rsv for unlink (bsc#1165949).
• btrfs: always reserve our entire size for the global reserve (bsc#1165949).
• btrfs: assert on non-empty delayed iputs (bsc##1165949).
• btrfs: be more explicit about allowed flush states (bsc#1165949).
• btrfs: call btrfs_create_pending_block_groups unconditionally (bsc#1165949).
• btrfs: catch cow on deleting snapshots (bsc#1165949).
• btrfs: change the minimum global reserve size (bsc#1165949).
• btrfs: check if there are free block groups for commit (bsc#1165949).
• btrfs: clean up error handling in btrfs_truncate() (bsc#1165949).
• btrfs: cleanup extent_op handling (bsc#1165949).
• btrfs: cleanup root usage by btrfs_get_alloc_profile (bsc#1165949).
• btrfs: cleanup the target logic in __btrfs_block_rsv_release (bsc#1165949).
• btrfs: clear space cache inode generation always (bsc#1165949).
• btrfs: delayed-ref: pass delayed_refs directly to btrfs_delayed_ref_lock (bsc#1165949).
• btrfs: do not account global reserve in can_overcommit (bsc#1165949).
• btrfs: do not allow reservations if we have pending tickets (bsc#1165949).
• btrfs: do not call btrfs_start_delalloc_roots in flushoncommit (bsc#1165949).
• btrfs: do not end the transaction for delayed refs in throttle (bsc#1165949).
• btrfs: do not enospc all tickets on flush failure (bsc#1165949).
• btrfs: do not run delayed_iputs in commit (bsc##1165949).
• btrfs: do not run delayed refs in the end transaction logic (bsc#1165949).
• btrfs: do not use ctl->free_space for max_extent_size (bsc##1165949).
• btrfs: do not use global reserve for chunk allocation (bsc#1165949).
• btrfs: drop min_size from evict_refill_and_join (bsc##1165949).
• btrfs: drop unused space_info parameter from create_space_info (bsc#1165949).
• btrfs: dump block_rsv details when dumping space info (bsc#1165949).
• btrfs: export block group accounting helpers (bsc#1165949).
• btrfs: export block_rsv_use_bytes (bsc#1165949).
• btrfs: export btrfs_block_rsv_add_bytes (bsc#1165949).
• btrfs: export __btrfs_block_rsv_release (bsc#1165949).
• btrfs: export space_info_add_*_bytes (bsc#1165949).
• btrfs: export the block group caching helpers (bsc#1165949).
• btrfs: export the caching control helpers (bsc#1165949).
• btrfs: export the excluded extents helpers (bsc#1165949).
• btrfs: extent-tree: Add lockdep assert when updating space info (bsc#1165949).
• btrfs: extent-tree: Add trace events for space info numbers update (bsc#1165949).
• btrfs: extent-tree: Detect bytes_may_use underflow earlier (bsc#1165949).
• btrfs: extent-tree: Detect bytes_pinned underflow earlier (bsc#1165949).
• btrfs: factor out the ticket flush handling (bsc#1165949).
• btrfs: fix btrfs_wait_ordered_range() so that it waits for all ordered extents (bsc#1163508).
• btrfs: fix insert_reserved error handling (bsc##1165949).
• btrfs: fix may_commit_transaction to deal with no partial filling (bsc#1165949).
• btrfs: fix missing delayed iputs on unmount (bsc#1165949).
• btrfs: fix panic during relocation after ENOSPC before writeback happens (bsc#1163508).
• btrfs: fix qgroup double free after failure to reserve metadata for delalloc (bsc#1165949).
• btrfs: fix race leading to metadata space leak after task received signal (bsc#1165949).
• btrfs: fix truncate throttling (bsc#1165949).
• btrfs: force chunk allocation if our global rsv is larger than metadata (bsc#1165949).
• btrfs: Improve global reserve stealing logic (bsc#1165949).
• btrfs: introduce an evict flushing state (bsc#1165949).
• btrfs: introduce delayed_refs_rsv (bsc#1165949).
• btrfs: loop in inode_rsv_refill (bsc#1165949).
• btrfs: make btrfs_destroy_delayed_refs use btrfs_delayed_ref_lock (bsc#1165949).
• btrfs: make btrfs_destroy_delayed_refs use btrfs_delete_ref_head (bsc#1165949).
• btrfs: make caching_thread use btrfs_find_next_key (bsc#1165949).
• btrfs: migrate btrfs_trans_release_chunk_metadata (bsc#1165949).
• btrfs: migrate inc/dec_block_group_ro code (bsc#1165949).
• btrfs: migrate nocow and reservation helpers (bsc#1165949).
• btrfs: migrate the alloc_profile helpers (bsc#1165949).
• btrfs: migrate the block group caching code (bsc#1165949).
• btrfs: migrate the block group cleanup code (bsc#1165949).
• btrfs: migrate the block group lookup code (bsc#1165949).
• btrfs: migrate the block group read/creation code (bsc#1165949).
• btrfs: migrate the block group ref counting stuff (bsc#1165949).
• btrfs: migrate the block group removal code (bsc#1165949).
• btrfs: migrate the block group space accounting helpers (bsc#1165949).
• btrfs: migrate the block-rsv code to block-rsv.c (bsc#1165949).
• btrfs: migrate the chunk allocation code (bsc#1165949).
• btrfs: migrate the delalloc space stuff to it's own home (bsc#1165949).
• btrfs: migrate the delayed refs rsv code (bsc#1165949).
• btrfs: migrate the dirty bg writeout code (bsc#1165949).
• btrfs: migrate the global_block_rsv helpers to block-rsv.c (bsc#1165949).
• btrfs: move and export can_overcommit (bsc#1165949).
• btrfs: move basic block_group definitions to their own header (bsc#1165949).
• btrfs: move btrfs_add_free_space out of a header file (bsc#1165949).
• btrfs: move btrfs_block_rsv definitions into it's own header (bsc#1165949).
• btrfs: move btrfs_raid_group values to btrfs_raid_attr table (bsc#1165949).
• btrfs: move btrfs_space_info_add_*_bytes to space-info.c (bsc#1165949).
• btrfs: move dump_space_info to space-info.c (bsc#1165949).
• btrfs: move reserve_metadata_bytes and supporting code to space-info.c (bsc#1165949).
• btrfs: move space_info to space-info.h (bsc#1165949).
• btrfs: move the space_info handling code to space-info.c (bsc#1165949).
• btrfs: move the space info update macro to space-info.h (bsc#1165949).
• btrfs: move the subvolume reservation stuff out of extent-tree.c (bsc#1165949).
• btrfs: only check delayed ref usage in should_end_transaction (bsc#1165949).
• btrfs: only check priority tickets for priority flushing (bsc#1165949).
• btrfs: only free reserved extent if we didn't insert it (bsc##1165949).
• btrfs: only reserve metadata_size for inodes (bsc#1165949).
• btrfs: only track ref_heads in delayed_ref_updates (bsc#1165949).
• btrfs: Output ENOSPC debug info in inc_block_group_ro (bsc#1165949).
• btrfs: pass root to various extent ref mod functions (bsc#1165949).
• btrfs: refactor block group replication factor calculation to a helper (bsc#1165949).
• btrfs: refactor priority_reclaim_metadata_space (bsc#1165949).
• btrfs: refactor the ticket wakeup code (bsc#1165949).
• btrfs: release metadata before running delayed refs (bsc##1165949).
• btrfs: Remove btrfs_inode::delayed_iput_count (bsc#1165949).
• btrfs: Remove fs_info from do_chunk_alloc (bsc#1165949).
• btrfs: remove orig_bytes from reserve_ticket (bsc#1165949).
• btrfs: Remove redundant argument of flush_space (bsc#1165949).
• btrfs: rename btrfs_space_info_add_old_bytes (bsc#1165949).
• btrfs: rename do_chunk_alloc to btrfs_chunk_alloc (bsc#1165949).
• btrfs: rename the btrfs_calc_*_metadata_size helpers (bsc#1165949).
• btrfs: replace cleaner_delayed_iput_mutex with a waitqueue (bsc#1165949).
• btrfs: reserve delalloc metadata differently (bsc#1165949).
• btrfs: reserve extra space during evict (bsc#1165949).
• btrfs: reset max_extent_size on clear in a bitmap (bsc##1165949).
• btrfs: reset max_extent_size properly (bsc##1165949).
• btrfs: rework btrfs_check_space_for_delayed_refs (bsc#1165949).
• btrfs: rework wake_all_tickets (bsc#1165949).
• btrfs: roll tracepoint into btrfs_space_info_update helper (bsc#1165949).
• btrfs: run btrfs_try_granting_tickets if a priority ticket fails (bsc#1165949).
• btrfs: run delayed iput at unlink time (bsc#1165949).
• btrfs: run delayed iputs before committing (bsc#1165949).
• btrfs: set max_extent_size properly (bsc##1165949).
• btrfs: stop partially refilling tickets when releasing space (bsc#1165949).
• btrfs: stop using block_rsv_release_bytes everywhere (bsc#1165949).
• btrfs: temporarily export btrfs_get_restripe_target (bsc#1165949).
• btrfs: temporarily export fragment_free_space (bsc#1165949).
• btrfs: temporarily export inc_block_group_ro (bsc#1165949).
• btrfs: track DIO bytes in flight (bsc#1165949).
• btrfs: unexport can_overcommit (bsc#1165949).
• btrfs: unexport the temporary exported functions (bsc#1165949).
• btrfs: unify error handling for ticket flushing (bsc#1165949).
• btrfs: update may_commit_transaction to use the delayed refs rsv (bsc#1165949).
• btrfs: use btrfs_try_granting_tickets in update_global_rsv (bsc#1165949).
• btrfs: wait on caching when putting the bg cache (bsc#1165949).
• btrfs: wait on ordered extents on abort cleanup (bsc#1165949).
• btrfs: wakeup cleaner thread when adding delayed iput (bsc#1165949).
• ceph: canonicalize server path in place (bsc#1168443).
• ceph: remove the extra slashes in the server path (bsc#1168443).
• cfg80211: check reg_rule for NULL in handle_channel_custom() (bsc#1051510).
• cfg80211: check wiphy driver existence for drvinfo report (bsc#1051510).
• cgroup: memcg: net: do not associate sock with unrelated cgroup (bsc#1167290).
• cifs: add a debug macro that prints \server\share for errors (bsc#1144333).
• cifs: add missing mount option to /proc/mounts (bsc#1144333).
• cifs: add new debugging macro cifs_server_dbg (bsc#1144333).
• cifs: add passthrough for smb2 setinfo (bsc#1144333).
• cifs: add SMB2_open() arg to return POSIX data (bsc#1144333).
• cifs: add smb2 POSIX info level (bsc#1144333).
• cifs: add SMB3 change notification support (bsc#1144333).
• cifs: add support for fallocate mode 0 for non-sparse files (bsc#1144333).
• cifs: Add support for setting owner info, dos attributes, and create time (bsc#1144333).
• cifs: Add tracepoints for errors on flush or fsync (bsc#1144333).
• cifs: Adjust indentation in smb2_open_file (bsc#1144333).
• cifs: allow chmod to set mode bits using special sid (bsc#1144333).
• cifs: Avoid doing network I/O while holding cache lock (bsc#1144333).
• cifs: call wake_up(&server->response_q) inside of cifs_reconnect() (bsc#1144333).
• cifs: Clean up DFS referral cache (bsc#1144333).
• cifs: create a helper function to parse the query-directory response buffer (bsc#1144333).
• cifs: do d_move in rename (bsc#1144333).
• cifs: Do not display RDMA transport on reconnect (bsc#1144333).
• cifs: do not ignore the SYNC flags in getattr (bsc#1144333).
• cifs: do not leak -EAGAIN for stat() during reconnect (bsc#1144333).
• cifs: do not use 'pre:' for MODULE_SOFTDEP (bsc#1144333).
• cifs: enable change notification for SMB2.1 dialect (bsc#1144333).
• cifs: fail i/o on soft mounts if sessionsetup errors out (bsc#1144333).
• cifs: fix a comment for the timeouts when sending echos (bsc#1144333).
• cifs: fix a white space issue in cifs_get_inode_info() (bsc#1144333).
• cifs: fix dereference on ses before it is null checked (bsc#1144333).
• cifs: Fix memory allocation in __smb2_handle_cancelled_cmd() (bsc#1144333).
• cifs: fix mode bits from dir listing when mounted with modefromsid (bsc#1144333).
• cifs: Fix mode output in debugging statements (bsc#1144333).
• cifs: Fix mount options set in automount (bsc#1144333).
• cifs: fix NULL dereference in match_prepath (bsc#1144333).
• cifs: Fix potential deadlock when updating vol in cifs_reconnect() (bsc#1144333).
• cifs: fix potential mismatch of UNC paths (bsc#1144333).
• cifs: fix rename() by ensuring source handle opened with DELETE bit (bsc#1144333).
• cifs: Fix return value in __update_cache_entry (bsc#1144333).
• cifs: fix soft mounts hanging in the reconnect code (bsc#1144333).
• cifs: fix soft mounts hanging in the reconnect code (bsc#1144333).
• cifs: Fix task struct use-after-free on reconnect (bsc#1144333).
• cifs: fix unitialized variable poential problem with network I/O cache lock patch (bsc#1144333).
• cifs: get mode bits from special sid on stat (bsc#1144333).
• cifs: Get rid of kstrdup_const()'d paths (bsc#1144333).
• cifs: handle prefix paths in reconnect (bsc#1144333).
• cifs: ignore cached share root handle closing errors (bsc#1166780).
• cifs: Introduce helpers for finding TCP connection (bsc#1144333).
• cifs: log warning message (once) if out of disk space (bsc#1144333).
• cifs: make sure we do not overflow the max EA buffer size (bsc#1144333).
• cifs: make use of cap_unix(ses) in cifs_reconnect_tcon() (bsc#1144333).
• cifs: Merge is_path_valid() into get_normalized_path() (bsc#1144333).
• cifs: modefromsid: make room for 4 ACE (bsc#1144333).
• cifs: modefromsid: write mode ACE first (bsc#1144333).
• cifs: Optimize readdir on reparse points (bsc#1144333).
• cifs: plumb smb2 POSIX dir enumeration (bsc#1144333).
• cifs: potential unintitliazed error code in cifs_getattr() (bsc#1144333).
• cifs: prepare SMB2_query_directory to be used with compounding (bsc#1144333).
• cifs: print warning once if mounting with vers=1.0 (bsc#1144333).
• cifs: refactor cifs_get_inode_info() (bsc#1144333).
• cifs: remove redundant assignment to pointer pneg_ctxt (bsc#1144333).
• cifs: remove redundant assignment to variable rc (bsc#1144333).
• cifs: remove set but not used variables (bsc#1144333).
• cifs: remove set but not used variable 'server' (bsc#1144333).
• cifs: remove unused variable (bsc#1144333).
• cifs: remove unused variable 'sid_user' (bsc#1144333).
• cifs: rename a variable in SendReceive() (bsc#1144333).
• cifs: rename posix create rsp (bsc#1144333).
• cifs: replace various strncpy with strscpy and similar (bsc#1144333).
• cifs: Return directly after a failed build_path_from_dentry() in cifs_do_create() (bsc#1144333).
• cifs: set correct max-buffer-size for smb2_ioctl_init() (bsc#1144333).
• cifs: smbd: Add messages on RDMA session destroy and reconnection (bsc#1144333).
• cifs: smbd: Invalidate and deregister memory registration on re-send for direct I/O (bsc#1144333).
• cifs: smbd: Only queue work for error recovery on memory registration (bsc#1144333).
• cifs: smbd: Return -EAGAIN when transport is reconnecting (bsc#1144333).
• cifs: smbd: Return -ECONNABORTED when trasnport is not in connected state (bsc#1144333).
• cifs: smbd: Return -EINVAL when the number of iovs exceeds SMBDIRECT_MAX_SGE (bsc#1144333).
• cifs: Use common error handling code in smb2_ioctl_query_info() (bsc#1144333).
• cifs: use compounding for open and first query-dir for readdir() (bsc#1144333).
• cifs: Use #define in cifs_dbg (bsc#1144333).
• cifs: Use memdup_user() rather than duplicating its implementation (bsc#1144333).
• cifs: use mod_delayed_work() for &server->reconnect if already queued (bsc#1144333).
• cifs: use PTR_ERR_OR_ZERO() to simplify code (bsc#1144333).
• clk: qcom: rcg: Return failure for RCG update (bsc#1051510).
• cls_rsvp: fix rsvp_policy (networking-stable-20_02_05).
• configfs: Fix bool initialization/comparison (bsc#1051510).
• cpufreq: powernv: Fix unsafe notifiers (bsc#1065729).
• cpufreq: powernv: Fix use-after-free (bsc#1065729).
• cpufreq: Register drive