Security update for the Linux Kernel

An update that solves seven vulnerabilities and has 93 security fixes can now be installed.

Description:

The SUSE Linux Enterprise 12 SP3 RT kernel was updated to 4.4.128 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2018-10124: The kill_something_info function in kernel/signal.c might have allowed local users to cause a denial of service via an INT_MIN argument (bnc#1089752).
• CVE-2018-10087: The kernel_wait4 function in kernel/exit.c might have allowed local users to cause a denial of service by triggering an attempted use of the -INT_MIN value (bnc#1089608).
• CVE-2017-18257: The __get_data_block function in fs/f2fs/data.c allowed local users to cause a denial of service (integer overflow and loop) via crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP ioctl (bnc#1088241)
• CVE-2018-1091: In the flush_tmregs_to_thread function in arch/powerpc/kernel/ptrace.c, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service (bnc#1087231).
• CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel function could have been exploited by malicious NCPFS servers to crash the kernel or execute code (bnc#1086162).
• CVE-2018-8043: The unimac_mdio_probe function in drivers/net/phy/mdio-bcm-unimac.c did not validate certain resource availability, which allowed local users to cause a denial of service (NULL pointer dereference) (bnc#1084829).
• CVE-2018-7740: The resv_map_release function in mm/hugetlb.c allowed local users to cause a denial of service (BUG) via a crafted application that made mmap system calls and has a large pgoff argument to the remap_file_pages system call (bnc#1084353).

The following non-security bugs were fixed:

• Fix ltp might_sleep() splat BUG
• ACPI / PMIC: xpower: Fix power_table addresses (bnc#1012382).
• ACPI, PCI, irq: remove redundant check for null string pointer (bnc#1012382).
• ACPI/IORT: numa: Add numa node mapping for smmuv3 devices (bsc#1085981).
• ACPI/processor: Fix error handling in __acpi_processor_start() (bnc#1012382).
• ACPI/processor: Replace racy task affinity logic (bnc#1012382).
• ACPICA: Add header support for TPM2 table changes (bsc#1084452).
• ACPICA: Add support for new SRAT subtable (bsc#1085981).
• ACPICA: Disassembler: Abort on an invalid/unknown AML opcode (bnc#1012382).
• ACPICA: Events: Add runtime stub support for event APIs (bnc#1012382).
• ACPICA: iasl: Update to IORT SMMUv3 disassembling (bsc#1085981).
• ALSA: aloop: Fix access to not-yet-ready substream via cable (bnc#1012382).
• ALSA: aloop: Sync stale timer before release (bnc#1012382).
• ALSA: firewire-digi00x: handle all MIDI messages on streaming packets (bnc#1012382).
• ALSA: hda - Revert power_save option default value (git-fixes).
• ALSA: hda/realtek - Always immediately update mute LED with pin VREF (bnc#1012382).
• ALSA: hda/realtek - Fix dock line-out volume on Dell Precision 7520 (bnc#1012382).
• ALSA: hda/realtek - Fix speaker no sound after system resume (bsc#1031717).
• ALSA: hda: Add a power_save blacklist (bnc#1012382).
• ALSA: hda: add dock and led support for HP EliteBook 820 G3 (bnc#1012382).
• ALSA: hda: add dock and led support for HP ProBook 640 G2 (bnc#1012382).
• ALSA: pcm: Fix UAF in snd_pcm_oss_get_formats() (bnc#1012382).
• ALSA: pcm: Use dma_bytes as size parameter in dma_mmap_coherent() (bnc#1012382).
• ALSA: pcm: potential uninitialized return values (bnc#1012382).
• ALSA: usb-audio: Add a quirck for BW PX headphones (bnc#1012382).
• ALSA: usb-audio: Fix parsing descriptor of UAC2 processing unit (bnc#1012382).
• ARM64 / cpuidle: Use new cpuidle macro for entering retention state (bsc#1084328).
• ARM: 8668/1: ftrace: Fix dynamic ftrace with DEBUG_RODATA and !FRAME_POINTER (bnc#1012382).
• ARM: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to SW_WKUP (bnc#1012382).
• ARM: davinci: da8xx: Create DSP device only when assigned memory (bnc#1012382).
• ARM: dts: Adjust moxart IRQ controller and flags (bnc#1012382).
• ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux (bnc#1012382).
• ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux (bnc#1012382).
• ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin (bnc#1012382).
• ARM: dts: am57xx-beagle-x15-common: Add overide powerhold property (bnc#1012382).
• ARM: dts: dra7: Add power hold and power controller properties to palmas (bnc#1012382).
• ARM: dts: exynos: Correct Trats2 panel reset line (bnc#1012382).
• ARM: dts: imx53-qsrb: Pulldown PMIC IRQ pin (bnc#1012382).
• ARM: dts: imx6qdl-wandboard: Fix audio channel swap (bnc#1012382).
• ARM: dts: koelsch: Correct clock frequency of X2 DU clock input (bnc#1012382).
• ARM: dts: ls1021a: add "fsl,ls1021a-esdhc" compatible string to esdhc node (bnc#1012382).
• ARM: dts: omap3-n900: Fix the audio CODEC's reset pin (bnc#1012382).
• ARM: dts: r8a7790: Correct parent of SSI[0-9] clocks (bnc#1012382).
• ARM: dts: r8a7791: Correct parent of SSI[0-9] clocks (bnc#1012382).
• ARM: imx: Add MXC_CPU_IMX6ULL and cpu_is_imx6ull (bnc#1012382).
• ARM: mvebu: Fix broken PL310_ERRATA_753970 selects (bnc#1012382).
• ASoC: Intel: cht_bsw_rt5645: Analog Mic support (bnc#1012382).
• ASoC: rcar: ssi: do not set SSICR.CKDV = 000 with SSIWSR.CONT (bnc#1012382).
• ASoC: rsnd: SSI PIO adjust to 24bit mode (bnc#1012382).
• Bluetooth: Fix missing encryption refresh on Security Request (bnc#1012382).
• Bluetooth: Send HCI Set Event Mask Page 2 command only when needed (bnc#1012382).
• Bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174 (bnc#1012382).
• Bluetooth: hci_qca: Avoid setup failure on missing rampatch (bnc#1012382).
• Btrfs: incremental send, fix invalid memory access (git-fixes).
• Btrfs: send, fix file hole not being preserved due to inline extent (bnc#1012382).
• CIFS: silence lockdep splat in cifs_relock_file() (bnc#1012382).
• Documentation: pinctrl: palmas: Add ti,palmas-powerhold-override property definition (bnc#1012382).
• EDAC, mv64x60: Fix an error handling path (bnc#1012382).
• EDAC, sb_edac: Fix out of bound writes during DIMM configuration on KNL (git-fixes 3286d3eb906c).
• HID: clamp input to logical range if no null state (bnc#1012382).
• HID: reject input outside logical range only if null state is set (bnc#1012382).
• IB/core: Fix possible crash to access NULL netdev (bsc#966191 bsc#966186).
• IB/core: Generate GID change event regardless of RoCE GID table property (bsc#966191 bsc#966186).
• IB/ipoib: Avoid memory leak if the SA returns a different DGID (bnc#1012382).
• IB/ipoib: Update broadcast object if PKey value was changed in index 0 (bnc#1012382).
• IB/mlx4: Change vma from shared to private (bnc#1012382).
• IB/mlx4: Fix corruption of RoCEv2 IPv4 GIDs (bsc#966191 bsc#966186).
• IB/mlx4: Include GID type when deleting GIDs from HW table under RoCE (bsc#966191 bsc#966186).
• IB/mlx4: Take write semaphore when changing the vma struct (bnc#1012382).
• IB/mlx5: Avoid passing an invalid QP type to firmware (bsc#1015342 bsc#1015343).
• IB/mlx5: Fix an error code in __mlx5_ib_modify_qp() (bsc#966170 bsc#966172).
• IB/mlx5: Fix incorrect size of klms in the memory region (bsc#966170 bsc#966172).
• IB/mlx5: Fix out-of-bounds read in create_raw_packet_qp_rq (bsc#966170 bsc#966172).
• IB/mlx5: Set the default active rate and width to QDR and 4X (bsc#1015342 bsc#1015343).
• IB/mlx5: revisit -Wmaybe-uninitialized warning (bsc#1015342 bsc#1015343).
• IB/srpt: Fix abort handling (bnc#1012382).
• IB/srpt: Fix an out-of-bounds stack access in srpt_zerolength_write() (bnc#1024296).
• IB/umem: Fix use of npages/nmap fields (bnc#1012382).
• Input: elan_i2c - check if device is there before really probing (bnc#1012382).
• Input: elan_i2c - clear INT before resetting controller (bnc#1012382).
• Input: elantech - force relative mode on a certain module (bnc#1012382).
• Input: i8042 - add Lenovo ThinkPad L460 to i8042 reset list (bnc#1012382).
• Input: i8042 - enable MUX on Sony VAIO VGN-CS series to fix touchpad (bnc#1012382).
• Input: matrix_keypad - fix race when disabling interrupts (bnc#1012382).
• Input: mousedev - fix implicit conversion warning (bnc#1012382).
• Input: qt1070 - add OF device ID table (bnc#1012382).
• Input: tsc2007 - check for presence and power down tsc2007 during probe (bnc#1012382).
• KVM: PPC: Book3S PR: Check copy_to/from_user return values (bnc#1012382).
• KVM: PPC: Book3S PR: Exit KVM on failed mapping (bnc#1012382).
• KVM: SVM: do not zero out segment attributes if segment is unusable or not present (bnc#1012382).
• KVM: arm/arm64: Handle CPU_PM_ENTER_FAILED (bsc#1086499).
• KVM: arm/arm64: vgic-its: Check result of allocation before use (bsc#).
• KVM: arm/arm64: vgic-its: Preserve the revious read from the pending table (bsc#1086499).
• KVM: arm/arm64: vgic: Add missing irq_lock to vgic_mmio_read_pending (bsc#1086499).
• KVM: arm/arm64: vgic: Do not populate multiple LRs with the same vintid (bsc#1086499).
• KVM: mmu: Fix overlap between public and private memslots (bnc#1012382).
• KVM: nVMX: Fix handling of lmsw instruction (bnc#1012382).
• Kbuild: provide a __UNIQUE_ID for clang (bnc#1012382).
• MIPS: BMIPS: Do not mask IPIs during suspend (bnc#1012382).
• MIPS: BPF: Fix multiple problems in JIT skb access helpers (bnc#1012382).
• MIPS: BPF: Quit clobbering callee saved registers in JIT code (bnc#1012382).
• MIPS: OCTEON: irq: Check for null return on kzalloc allocation (bnc#1012382).
• MIPS: ath25: Check for kzalloc allocation failure (bnc#1012382).
• MIPS: kprobes: flush_insn_slot should flush only if probe initialised (bnc#1012382).
• MIPS: mm: adjust PKMAP location (bnc#1012382).
• MIPS: mm: fixed mappings: correct initialisation (bnc#1012382).
• MIPS: r2-on-r6-emu: Clear BLTZALL and BGEZALL debugfs counters (bnc#1012382).
• MIPS: r2-on-r6-emu: Fix BLEZL and BGTZL identification (bnc#1012382).
• MIPS: ralink: Remove ralink_halt() (bnc#1012382).
• NFC: nfcmrvl: Include unaligned.h instead of access_ok.h (bnc#1012382).
• NFC: nfcmrvl: double free on error path (bnc#1012382).
• NFS: Fix an incorrect type in struct nfs_direct_req (bnc#1012382).
• NFSv4.1: RECLAIM_COMPLETE must handle NFS4ERR_CONN_NOT_BOUND_TO_SESSION (bnc#1012382).
• NFSv4.1: Work around a Linux server bug.. (bnc#1012382).
• PCI/ACPI: Fix bus range comparison in pci_mcfg_lookup() (bsc#1084699).
• PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown() (bnc#1012382).
• PCI/cxgb4: Extend T3 PCI quirk to T4+ devices (bsc#981348).
• PCI: Add function 1 DMA alias quirk for Highpoint RocketRAID 644L (bnc#1012382).
• PCI: Add pci_reset_function_locked() (bsc#1084889).
• PCI: Apply Cavium ACS quirk only to CN81xx/CN83xx/CN88xx devices (bsc#1084914).
• PCI: Avoid FLR for Intel 82579 NICs (bsc#1084889).
• PCI: Avoid slot reset if bridge itself is broken (bsc#1084918).
• PCI: Export pcie_flr() (bsc#1084889).
• PCI: Make PCI_ROM_ADDRESS_MASK a 32-bit constant (bnc#1012382).
• PCI: Mark Haswell Power Control Unit as having non-compliant BARs (bsc#1086015).
• PCI: Probe for device reset support during enumeration (bsc#1084889).
• PCI: Protect pci_error_handlers->reset_notify() usage with device_lock() (bsc#1084889).
• PCI: Protect restore with device lock to be consistent (bsc#1084889).
• PCI: Remove __pci_dev_reset() and pci_dev_reset() (bsc#1084889).
• PCI: Remove redundant probes for device reset support (bsc#1084889).
• PCI: Wait for up to 1000ms after FLR reset (bsc#1084889).
• PCI: hv: Fix 2 hang issues in hv_compose_msi_msg() (bsc#1087659, bsc#1087906).
• PCI: hv: Fix a comment typo in _hv_pcifront_read_config() (bsc#1087659).
• PCI: hv: Only queue new work items in hv_pci_devices_present() if necessary (bsc#1087659).
• PCI: hv: Remove the bogus test in hv_eject_device_work() (bsc#1087659).
• PCI: hv: Serialize the present and eject work items (bsc#1087659).
• Partial revert "e1000e: Avoid receiver overrun interrupt bursts" (bsc#1075428).
• RDMA/cma: Use correct size when writing netlink stats (bnc#1012382).
• RDMA/core: Avoid that ib_drain_qp() triggers an out-of-bounds stack access
• RDMA/core: Do not use invalid destination in determining port reuse
• RDMA/iwpm: Fix uninitialized error code in iwpm_send_mapinfo() (bnc#1012382).
• RDMA/mlx5: Fix integer overflow while resizing CQ (bnc#1012382).
• RDMA/mlx5: Protect from NULL pointer derefence (bsc#1015342 bsc#1015343).
• RDMA/ocrdma: Fix permissions for OCRDMA_RESET_STATS (bnc#1012382).
• RDMA/qedr: Fix QP state initialization race (bsc#1022604).
• RDMA/qedr: Fix rc initialization on CNQ allocation failure (bsc#1022604).
• RDMA/qedr: fix QP's ack timeout configuration (bsc#1022604).
• RDMA/rxe: Fix an out-of-bounds read
• RDMA/ucma: Check AF family prior resolving address (bnc#1012382).
• RDMA/ucma: Check that device exists prior to accessing it (bnc#1012382).
• RDMA/ucma: Check that device is connected prior to access it (bnc#1012382).
• RDMA/ucma: Check that user does not overflow QP state (bnc#1012382).
• RDMA/ucma: Do not allow join attempts for unsupported AF family (bnc#1012382).
• RDMA/ucma: Ensure that CM_ID exists prior to access it (bnc#1012382).
• RDMA/ucma: Fix access to non-initialized CM_ID object (bnc#1012382).
• RDMA/ucma: Fix use-after-free access in ucma_close (bnc#1012382).
• RDMA/ucma: Introduce safer rdma_addr_size() variants (bnc#1012382).
• RDMA/ucma: Limit possible option size (bnc#1012382).
• Revert "ARM: dts: LogicPD Torpedo: Fix I2C1 pinmux" (bnc#1012382).
• Revert "ARM: dts: am335x-pepper: Fix the audio CODEC's reset pin" (bnc#1012382).
• Revert "ARM: dts: omap3-n900: Fix the audio CODEC's reset pin" (bnc#1012382).
• Revert "PCI/MSI: Stop disabling MSI/MSI-X in pci_device_shutdown()" (bnc#1012382).
• Revert "cpufreq: Fix governor module removal race" (bnc#1012382).
• Revert "e1000e: Separate signaling for link check/link up" (bsc#1075428).
• Revert "genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs" (bnc#1012382).
• Revert "ip6_vti: adjust vti mtu according to mtu of lower device" (bnc#1012382).
• Revert "ipvlan: add L2 check for packets arriving via virtual devices" (reverted in upstream).
• Revert "led: core: Fix brightness setting when setting delay_off=0" (bnc#1012382).
• Revert "mtip32xx: use runtime tag to initialize command header" (bnc#1012382).
• Revert "xhci: plat: Register shutdown for xhci_plat" (bnc#1012382).
• Subject: af_iucv: enable control sends in case of SEND_SHUTDOWN (bnc#1085507, LTC#165135).
• USB: ene_usb6250: fix SCSI residue overwriting (bnc#1012382).
• USB: ene_usb6250: fix first command execution (bnc#1012382).
• USB: gadget: udc: Add missing platform_device_put() on error in bdc_pci_probe() (bnc#1012382).
• USB: serial: cp210x: add ELDAT Easywave RX09 id (bnc#1012382).
• USB: serial: ftdi_sio: add RT Systems VX-8 cable (bnc#1012382).
• USB: serial: ftdi_sio: add support for Harman FirmwareHubEmulator (bnc#1012382).
• USB: storage: Add JMicron bridge 152d:2567 to unusual_devs.h (bnc#1012382).
• USB: usbmon: remove assignment from IS_ERR argument (bnc#1012382).
• Update patches.arch/s390-sles12sp3-08-03-KVM-s390-instruction-execution-protection-support.patch (LTC#162428, bsc#1073069).
• Update patches.arch/s390-sles12sp3-08-06-01-s390-mem_detect-use-unsigned-longs.patch (LTC#158956, bsc#1073059).
• Update patches.arch/s390-sles12sp3-08-06-02-kvm-s390-enable-all-facility-bits-that-are-known-goo.patch (LTC#158956, bsc#1073059).
• Update patches.arch/s390-sles12sp3-08-06-03-s390-sclp-add-hmfai-field.patch (LTC#158956, bsc#1073059).
• Update patches.arch/s390-sles12sp3-08-06-04-kvm-s390-populate-mask-of-non-hypervisor-managed-fac.patch (LTC#158956, bsc#1073059).
• Update patches.suse/x86-nospectre_v2-means-nospec-too.patch (bsc#1075994 bsc#1075091 bnc#1085958).
• acpi, numa: fix pxm to online numa node associations (bnc#1012382).
• agp/intel: Flush all chipset writes after updating the GGTT (bnc#1012382).
• ahci: Add PCI-id for the Highpoint Rocketraid 644L card (bnc#1012382).
• apparmor: Make path_max parameter readonly (bnc#1012382).
• arm/arm64: KVM: Add PSCI_VERSION helper (bsc#1068032).
• arm/arm64: KVM: Add smccc accessors to PSCI code (bsc#1068032).
• arm/arm64: KVM: Advertise SMCCC v1.1 (bsc#1068032).
• arm/arm64: KVM: Consolidate the PSCI include files (bsc#1068032).
• arm/arm64: KVM: Implement PSCI 1.0 support (bsc#1068032).
• arm/arm64: KVM: Turn kvm_psci_version into a static inline (bsc#1068032).
• arm/arm64: smccc: Implement SMCCC v1.1 inline primitive (bsc#1068032).
• arm/arm64: smccc: Make function identifiers an unsigned quantity (bsc#1068032).
• arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support (bsc#1068032).
• arm64: Add missing Falkor part number for branch predictor hardening (bsc#1068032).
• arm64: Enforce BBM for huge IO/VMAP mappings (bsc#1088313).
• arm64: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling (bsc#1068032).
• arm64: KVM: Increment PC after handling an SMC trap (bsc#1068032).
• arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support (bsc#1068032).
• arm64: Kill PSCI_GET_VERSION as a variant-2 workaround (bsc#1068032).
• arm64: Relax ARM_SMCCC_ARCH_WORKAROUND_1 discovery (bsc#1068032).
• arm64: avoid overflow in VA_START and PAGE_OFFSET (bnc#1012382).
• arm64: capabilities: Handle duplicate entries for a capability (bsc#1068032).
• arm64: cpufeature: __this_cpu_has_cap() shouldn't stop early (bsc#1068032).
• arm64: fix smccc compilation (bsc#1068032).
• arm64: futex: Fix undefined behaviour with FUTEX_OP_OPARG_SHIFT usage (bnc#1012382).
• arm64: mm: do not write garbage into TTBR1_EL1 register (bsc#1085487).
• arm64: mm: fix thinko in non-global page table attribute check (bsc#1088050).
• arp: fix arp_filter on l3slave devices (bnc#1012382).
• arp: honour gratuitous ARP replies (bnc#1012382).
• async_tx: Fix DMA_PREP_FENCE usage in do_async_gen_syndrome() (bnc#1012382).
• ata: libahci: properly propagate return value of platform_get_irq() (bnc#1012382).
• ath10k: disallow DFS simulation if DFS channel is not enabled (bnc#1012382).
• ath10k: fix invalid STS_CAP_OFFSET_MASK (bnc#1012382).
• ath10k: update tdls teardown state to target (bnc#1012382).
• ath5k: fix memory leak on buf on failed eeprom read (bnc#1012382).
• ath: Fix updating radar flags for coutry code India (bnc#1012382).
• audit: add tty field to LOGIN event (bnc#1012382).
• batman-adv: handle race condition for claims between gateways (bnc#1012382).
• bcache: do not attach backing with duplicate UUID (bnc#1012382).
• bcache: segregate flash only volume write streams (bnc#1012382).
• bcache: stop writeback thread after detaching (bnc#1012382).
• blk-mq: fix bad clear of RQF_MQ_INFLIGHT in blk_mq_ct_ctx_init() (bsc#1085058).
• blk-mq: fix kernel oops in blk_mq_tag_idle() (bnc#1012382).
• blk-throttle: make sure expire time isn't too big (bnc#1012382).
• blkcg: fix double free of new_blkg in blkcg_init_queue (bnc#1012382).
• block-mq: stop workqueue items in blk_mq_stop_hw_queue() (bsc#1084967).
• block: correctly mask out flags in blk_rq_append_bio() (bsc#1085058).
• block: do not assign cmd_flags in __blk_rq_prep_clone (bsc#1088087).
• bna: Avoid reading past end of buffer (bnc#1012382).
• bnx2x: Align RX buffers (bnc#1012382).
• bnx2x: Allow vfs to disable txvlan offload (bnc#1012382).
• bonding: Do not update slave->link until ready to commit (bnc#1012382).
• bonding: fix the err path for dev hwaddr sync in bond_enslave (bnc#1012382).
• bonding: move dev_mc_sync after master_upper_dev_link in bond_enslave (bnc#1012382).
• bonding: process the err returned by dev_set_allmulti properly in bond_enslave (bnc#1012382).
• bonding: refine bond_fold_stats() wrap detection (bnc#1012382).
• bpf, x64: implement retpoline for tail call (bnc#1012382).
• bpf, x64: increase number of passes (bnc#1012382).
• bpf: fix incorrect sign extension in check_alu_op() (bnc#1012382).
• bpf: skip unnecessary capability check (bnc#1012382).
• braille-console: Fix value returned by _braille_console_setup (bnc#1012382).
• brcmfmac: fix P2P_DEVICE ethernet address generation (bnc#1012382).
• bridge: check brport attr show in brport_show (bnc#1012382).
• btrfs: Fix use-after-free when cleaning up fs_devs with a single stale device (bnc#1012382).
• btrfs: Only check first key for committed tree blocks (bsc#1084721).
• btrfs: Validate child tree block's level and first key (bsc#1084721).
• btrfs: alloc_chunk: fix DUP stripe size handling (bnc#1012382).
• btrfs: fix incorrect error return ret being passed to mapping_set_error (bnc#1012382).
• btrfs: improve delayed refs iterations (bsc#1076033).
• btrfs: preserve i_mode if __btrfs_set_acl() fails (bnc#1012382).
• bus: brcmstb_gisb: Use register offsets with writes too (bnc#1012382).
• bus: brcmstb_gisb: correct support for 64-bit address output (bnc#1012382).
• can: cc770: Fix queue stall and dropped RTR reply (bnc#1012382).
• can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack (bnc#1012382).
• can: cc770: Fix use after free in cc770_tx_interrupt() (bnc#1012382).
• ceph: only dirty ITER_IOVEC pages for direct read (bsc#1084898).
• cfg80211: make RATE_INFO_BW_20 the default (bnc#1012382).
• ch9200: use skb_cow_head() to deal with cloned skbs (bsc#1088684).
• clk: Fix __set_clk_rates error print-string (bnc#1012382).
• clk: bcm2835: Protect sections updating shared registers (bnc#1012382).
• clk: ns2: Correct SDIO bits (bnc#1012382).
• clk: qcom: msm8916: fix mnd_width for codec_digcodec (bnc#1012382).
• clk: scpi: fix return type of __scpi_dvfs_round_rate (bnc#1012382).
• clk: si5351: Rename internal plls to avoid name collisions (bnc#1012382).
• coresight: Fix disabling of CoreSight TPIU (bnc#1012382).
• coresight: Fixes coresight DT parse to get correct output port ID (bnc#1012382).
• cpufreq/sh: Replace racy task affinity logic (bnc#1012382).
• cpufreq: Fix governor module removal race (bnc#1012382).
• cpufreq: s3c24xx: Fix broken s3c_cpufreq_init() (bnc#1012382).
• cpuidle: Add new macro to enter a retention idle state (bsc#1084328).
• cpumask: Add helper cpumask_available() (bnc#1012382).
• cros_ec: fix nul-termination for firmware build info (bnc#1012382).
• crypto: ahash - Fix early termination in hash walk (bnc#1012382).
• crypto: cavium - fix memory leak on info (bsc#1086518).
• crypto: x86/cast5-avx - fix ECB encryption when long sg follows short one (bnc#1012382).
• cx25840: fix unchecked return values (bnc#1012382).
• cxgb4: FW upgrade fixes (bnc#1012382).
• cxgb4: Fix queue free path of ULD drivers (bsc#1022743).
• cxgb4: fix incorrect cim_la output for T6 (bnc#1012382).
• cxgb4vf: Fix SGE FL buffer initialization logic for 64K pages (bnc#1012382).
• dcache: Add cond_resched in shrink_dentry_list (bsc#1086194).
• dccp: check sk for closed state in dccp_sendmsg() (bnc#1012382).
• dm ioctl: remove double parentheses (bnc#1012382).
• dm: Always copy cmd_flags when cloning a request (bsc#1088087).
• dmaengine: imx-sdma: Handle return value of clk_prepare_enable (bnc#1012382).
• dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped (bnc#1012382).
• dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63 (bnc#1012382).
• driver: (adm1275) set the m,b and R coefficients correctly for power (bnc#1012382).
• drivers/infiniband/core/verbs.c: fix build with gcc-4.4.4
• drivers/infiniband/ulp/srpt/ib_srpt.c: fix build with gcc-4.4.4 (bnc#1024296).
• drivers/misc/vmw_vmci/vmci_queue_pair.c: fix a couple integer overflow tests (bnc#1012382).
• drm/amdgpu/dce: Do not turn off DP sink when disconnected (bnc#1012382).
• drm/amdgpu: Fail fb creation from imported dma-bufs. (v2) (bnc#1012382).
• drm/amdgpu: Fix deadlock on runtime suspend (bnc#1012382).
• drm/amdgpu: Notify sbios device ready before send request (bnc#1012382).
• drm/amdgpu: fix KV harvesting (bnc#1012382).
• drm/amdkfd: Fix memory leaks in kfd topology (bnc#1012382).
• drm/edid: set ELD connector type in drm_edid_to_eld() (bnc#1012382).
• drm/i915/cmdparser: Do not check past the cmd length (bsc#1031717).
• drm/i915/psr: Check for the specific AUX_FRAME_SYNC cap bit (bsc#1031717).
• drm/msm: fix leak in failed get_pages (bnc#1012382).
• drm/nouveau/kms: Increase max retries in scanout position queries (bnc#1012382).
• drm/nouveau: Fix deadlock on runtime suspend (bnc#1012382).
• drm/omap: DMM: Check for DMM readiness after successful transaction commit (bnc#1012382).
• drm/omap: fix tiled buffer stride calculations (bnc#1012382).
• drm/radeon: Do not turn off DP sink when disconnected (bnc#1012382).
• drm/radeon: Fail fb creation from imported dma-bufs (bnc#1012382).
• drm/radeon: Fix deadlock on runtime suspend (bnc#1012382).
• drm/radeon: fix KV harvesting (bnc#1012382).
• drm/vmwgfx: Fix a destoy-while-held mutex problem (bnc#1012382).
• drm/vmwgfx: Fixes to vmwgfx_fb (bnc#1012382).
• drm: Allow determining if current task is output poll worker (bnc#1012382).
• drm: Defer disabling the vblank IRQ until the next interrupt (for instant-off) (bnc#1012382).
• drm: qxl: Do not alloc fbdev if emulation is not supported (bnc#1012382).
• drm: udl: Properly check framebuffer mmap offsets (bnc#1012382).
• e1000e: Avoid missed interrupts following ICR read (bsc#1075428).
• e1000e: Avoid receiver overrun interrupt bursts (bsc#1075428).
• e1000e: Fix check_for_link return value with autoneg off (bsc#1075428).
• e1000e: Fix link check race condition (bsc#1075428).
• e1000e: Fix queue interrupt re-raising in Other interrupt (bsc#1075428).
• e1000e: Remove Other from EIAC (bsc#1075428).
• e1000e: Undo e1000e_pm_freeze if __e1000_shutdown fails (bnc#1012382).
• e1000e: fix race condition around skb_tstamp_tx() (bnc#1012382).
• e1000e: fix timing for 82579 Gigabit Ethernet controller (bnc#1012382).
• esp: Fix memleaks on error paths (git-fixes).
• ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() (bnc#1012382).
• ext4: inplace xattr block update fails to deduplicate blocks (bnc#1012382).
• f2fs: relax node version check for victim data in gc (bnc#1012382).
• fib_semantics: Do not match route with mismatching tclassid (bnc#1012382).
• firmware/psci: Expose PSCI conduit (bsc#1068032).
• firmware/psci: Expose SMCCC version through psci_ops (bsc#1068032).
• fix race in drivers/char/random.c:get_reg() (bnc#1012382).
• fixup: sctp: verify size of a new chunk in _sctp_make_chunk() (bnc#1012382).
• frv: declare jiffies to be located in the .data section (bnc#1012382).
• fs/aio: Add explicit RCU grace period when freeing kioctx (bnc#1012382).
• fs/aio: Use RCU accessors for kioctx_table->table[] (bnc#1012382).
• fs/hugetlbfs/inode.c: change put_page/unlock_page order in hugetlbfs_fallocate() (git-fixes, bsc#1083745).
• fs/proc: Stop trying to report thread stacks (bnc#1012382).
• fs: Teach path_connected to handle nfs filesystems with multiple roots (bnc#1012382).
• fs: compat: Remove warning from COMPATIBLE_IOCTL (bnc#1012382).
• genirq: Track whether the trigger type has been set (git-fixes).
• genirq: Use cpumask_available() for check of cpumask variable (bnc#1012382).
• genirq: Use irqd_get_trigger_type to compare the trigger type for shared IRQs (bnc#1012382).
• gpio: label descriptors using the device name (bnc#1012382).
• hdlc_ppp: carrier detect ok, do not turn off negotiation (bnc#1012382).
• hdlcdrv: Fix divide by zero in hdlcdrv_ioctl (bnc#1012382).
• hugetlbfs: fix offset overflow in hugetlbfs mmap (bnc#1084353).
• hv_balloon: fix bugs in num_pages_onlined accounting
• hv_balloon: fix printk loglevel
• hv_balloon: simplify hv_online_page()/hv_page_online_one()
• hwmon: (ina2xx) Fix access to uninitialized mutex (git-fixes).
• hwmon: (ina2xx) Make calibration register value fixed (bnc#1012382).
• i2c: i2c-scmi: add a MS HID (bnc#1012382).
• i2c: xlp9xx: Check for Bus state before every transfer (bsc#1084310).
• i2c: xlp9xx: Handle NACK on DATA properly (bsc#1084310).
• i2c: xlp9xx: Handle transactions with I2C_M_RECV_LEN properly (bsc#1060799).
• i2c: xlp9xx: return ENXIO on slave address NACK (bsc#1060799).
• i40e: Acquire NVM lock before reads on all devices (bnc#1012382).
• i40iw: Free IEQ resources (bsc#969476 bsc#969477).
• ia64: fix module loading for gcc-5.4 (bnc#1012382).
• ibmvfc: Avoid unnecessary port relogin (bsc#1085404).
• ibmvnic: Clear pending interrupt after device reset (bsc#1089644).
• ibmvnic: Define vnic_login_client_data name field as unsized array (bsc#1089198).
• ibmvnic: Disable irqs before exiting reset from closed state (bsc#1084610).
• ibmvnic: Do not notify peers on parameter change resets (bsc#1089198).
• ibmvnic: Do not reset CRQ for Mobility driver resets (bsc#1088600).
• ibmvnic: Fix DMA mapping mistakes (bsc#1088600).
• ibmvnic: Fix failover case for non-redundant configuration (bsc#1088600).
• ibmvnic: Fix reset return from closed state (bsc#1084610).
• ibmvnic: Fix reset scheduler error handling (bsc#1088600).
• ibmvnic: Handle all login error conditions (bsc#1089198).
• ibmvnic: Potential NULL dereference in clean_one_tx_pool() (bsc#1085224, git-fixes).
• ibmvnic: Remove unused TSO resources in TX pool structure (bsc#1085224).
• ibmvnic