Security update for the Linux Kernel

An update that solves nine vulnerabilities and has 112 security fixes can now be installed.

Description:

The SUSE Linux Enterprise 12 SP4 kernel was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-18595: A double free may be caused by the function allocate_trace_buffer in the file kernel/trace/trace.c (bnc#1149555).
• CVE-2019-14821: An out-of-bounds access issue was found in the way Linux kernel's KVM hypervisor implements the coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system (bnc#1151350).
• CVE-2019-15291: There was a NULL pointer dereference caused by a malicious USB device in the flexcop_usb_probe function in the drivers/media/usb/b2c2/flexcop-usb.c driver (bnc#1146540).
• CVE-2019-9506: The Bluetooth BR/EDR specification up to and including version 5.1 permitted sufficiently low encryption key length and did not prevent an attacker from influencing the key length negotiation. This allowed practical brute-force attacks (aka "KNOB") that could decrypt traffic and injected arbitrary ciphertext without the victim noticing (bnc#1137865 bnc#1146042).
• CVE-2019-16232: Fixed a NULL pointer dereference in drivers/net/wireless/marvell/libertas/if_sdio.c, which did not check the alloc_workqueue return value (bnc#1150465).
• CVE-2019-16234: Fixed a NULL pointer dereference in drivers/net/wireless/intel/iwlwifi/pcie/trans.c, which did not check the alloc_workqueue return value (bnc#1150452).
• CVE-2019-17056: Added enforcement of CAP_NET_RAW in llcp_sock_create in net/nfc/llcp_sock.c in the AF_NFC network module, the lack of which allowed unprivileged users to create a raw socket, aka CID-3a359798b176 (bnc#1152788).
• CVE-2019-17133: Fixed a buffer overflow in cfg80211_mgd_wext_giwessid in net/wireless/wext-sme.c caused by long SSID IEs (bsc#1153158).
• CVE-2019-17666: Added an upper-bound check in rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c, the lack of which could have led to a buffer overflow (bnc#1154372).

The following non-security bugs were fixed:

• 9p: avoid attaching writeback_fid on mmap with type PRIVATE (bsc#1051510).
• ACPI / CPPC: do not require the _PSD method (bsc#1051510).
• ACPI: CPPC: Set pcc_data[pcc_ss_id] to NULL in acpi_cppc_processor_exit() (bsc#1051510).
• ACPI: custom_method: fix memory leaks (bsc#1051510).
• ACPI / PCI: fix acpi_pci_irq_enable() memory leak (bsc#1051510).
• ACPI / processor: do not print errors for processorIDs == 0xff (bsc#1051510).
• ACPI / property: Fix acpi_graph_get_remote_endpoint() name in kerneldoc (bsc#1051510).
• act_mirred: Fix mirred_init_module error handling (bsc#1051510).
• Add kernel module compression support (bsc#1135854) For enabling the kernel module compress, add the item COMPRESS_MODULES="xz" in config.sh, then mkspec will pass it to the spec file.
• alarmtimer: Use EOPNOTSUPP instead of ENOTSUPP (bsc#1151680).
• ALSA: aoa: onyx: always initialize register read value (bsc#1051510).
• ALSA: firewire-tascam: check intermediate state of clock status and retry (bsc#1051510).
• ALSA: firewire-tascam: handle error code when getting current source of clock (bsc#1051510).
• ALSA: hda - Add laptop imic fixup for ASUS M9V laptop (bsc#1051510).
• ALSA: hda: Add support of Zhaoxin controller (bsc#1051510).
• ALSA: hda - Apply AMD controller workaround for Raven platform (bsc#1051510).
• ALSA: hda - Define a fallback_pin_fixup_tbl for alc269 family (bsc#1051510).
• ALSA: hda - Drop unsol event handler for Intel HDMI codecs (bsc#1051510).
• ALSA: hda - Expand pin_match function to match upcoming new tbls (bsc#1051510).
• ALSA: hda: Flush interrupts on disabling (bsc#1051510).
• ALSA: hda/hdmi: remove redundant assignment to variable pcm_idx (bsc#1051510).
• ALSA: hda - Inform too slow responses (bsc#1051510).
• ALSA: hda/realtek - Blacklist PC beep for Lenovo ThinkCentre M73/93 (bsc#1051510).
• ALSA: hda/realtek - Check beep whitelist before assigning in all codecs (bsc#1051510).
• ALSA: hda/realtek - Fix alienware headset mic (bsc#1051510).
• ALSA: hda/realtek: Reduce the Headphone static noise on XPS 9350/9360 (bsc#1051510).
• ALSA: hda: Set fifo_size for both playback and capture streams (bsc#1051510).
• ALSA: hda - Show the fatal CORB/RIRB error more clearly (bsc#1051510).
• ALSA: hda/sigmatel - remove unused variable 'stac9200_core_init' (bsc#1051510).
• ALSA: i2c: ak4xxx-adda: Fix a possible null pointer dereference in build_adc_controls() (bsc#1051510).
• ALSA: line6: sizeof (byte) is always 1, use that fact (bsc#1051510).
• ALSA: usb-audio: Add Pioneer DDJ-SX3 PCM quirck (bsc#1051510).
• ALSA: usb-audio: Disable quirks for BOSS Katana amplifiers (bsc#1051510).
• ALSA: usb-audio: Skip bSynchAddress endpoint check if it is invalid (bsc#1051510).
• appletalk: enforce CAP_NET_RAW for raw sockets (bsc#1051510).
• ASoC: Define a set of DAPM pre/post-up events (bsc#1051510).
• ASoC: dmaengine: Make the pcm->name equal to pcm->id if the name is not set (bsc#1051510).
• ASoC: es8328: Fix copy-paste error in es8328_right_line_controls (bsc#1051510).
• ASoC: Intel: Baytrail: Fix implicit fallthrough warning (bsc#1051510).
• ASoC: Intel: Fix use of potentially uninitialized variable (bsc#1051510).
• ASoC: Intel: NHLT: Fix debug print format (bsc#1051510).
• ASoC: sgtl5000: Fix charge pump source assignment (bsc#1051510).
• ASoC: sun4i-i2s: RX and TX counter registers are swapped (bsc#1051510).
• ASoC: wm8737: Fix copy-paste error in wm8737_snd_controls (bsc#1051510).
• ASoC: wm8988: fix typo in wm8988_right_line_controls (bsc#1051510).
• ath9k: dynack: fix possible deadlock in ath_dynack_node_{de}init (bsc#1051510).
• atm: iphase: Fix Spectre v1 vulnerability (networking-stable-19_08_08).
• auxdisplay: panel: need to delete scan_timer when misc_register fails in panel_attach (bsc#1051510).
• ax25: enforce CAP_NET_RAW for raw sockets (bsc#1051510).
• bcma: fix incorrect update of BCMA_CORE_PCI_MDIO_DATA (bsc#1051510).
• blk-flush: do not run queue for requests bypassing flush (bsc#1137959).
• blk-flush: use blk_mq_request_bypass_insert() (bsc#1137959).
• blk-mq: do not allocate driver tag upfront for flush rq (bsc#1137959).
• blk-mq: Fix memory leak in blk_mq_init_allocated_queue error handling (bsc#1151610).
• blk-mq: insert rq with DONTPREP to hctx dispatch list when requeue (bsc#1137959).
• blk-mq: kABI fixes for blk-mq.h (bsc#1137959).
• blk-mq: move blk_mq_put_driver_tag*() into blk-mq.h (bsc#1137959).
• blk-mq: punt failed direct issue to dispatch list (bsc#1137959).
• blk-mq: put the driver tag of nxt rq before first one is requeued (bsc#1137959).
• blk-mq-sched: decide how to handle flush rq via RQF_FLUSH_SEQ (bsc#1137959).
• blk-wbt: abstract out end IO completion handler (bsc#1135873).
• blk-wbt: fix has-sleeper queueing check (bsc#1135873).
• blk-wbt: improve waking of tasks (bsc#1135873).
• blk-wbt: move disable check into get_limit() (bsc#1135873).
• blk-wbt: use wq_has_sleeper() for wq active check (bsc#1135873).
• block: add io timeout to sysfs (bsc#1148410).
• block: do not show io_timeout if driver has no timeout handler (bsc#1148410).
• block: fix timeout changes for legacy request drivers (bsc#1149446).
• block: kABI fixes for BLK_EH_DONE renaming (bsc#1142076).
• block: rename BLK_EH_NOT_HANDLED to BLK_EH_DONE (bsc#1142076).
• Bluetooth: btrtl: Additional Realtek 8822CE Bluetooth devices (bsc#1051510).
• bnx2x: Disable multi-cos feature (networking-stable-19_08_08).
• bnx2x: Fix VF's VLAN reconfiguration in reload (bsc#1086323 ).
• bonding: Add vlan tx offload to hw_enc_features (networking-stable-19_08_21).
• bridge/mdb: remove wrong use of NLM_F_MULTI (networking-stable-19_09_15).
• btrfs: bail out gracefully rather than BUG_ON (bsc#1153646).
• btrfs: check for the full sync flag while holding the inode lock during fsync (bsc#1153713).
• btrfs: Ensure btrfs_init_dev_replace_tgtdev sees up to date values (bsc#1154651).
• btrfs: Ensure replaced device does not have pending chunk allocation (bsc#1154607).
• btrfs: fix use-after-free when using the tree modification log (bsc#1151891).
• btrfs: qgroup: Fix reserved data space leak if we have multiple reserve calls (bsc#1152975).
• btrfs: qgroup: Fix the wrong target io_tree when freeing reserved data space (bsc#1152974).
• btrfs: relocation: fix use-after-free on dead relocation roots (bsc#1152972).
• btrfs: remove wrong use of volume_mutex from btrfs_dev_replace_start (bsc#1154651).
• can: mcp251x: mcp251x_hw_reset(): allow more time after a reset (bsc#1051510).
• can: xilinx_can: xcan_probe(): skip error message on deferred probe (bsc#1051510).
• cdc_ether: fix rndis support for Mediatek based smartphones (networking-stable-19_09_15).
• cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize (bsc#1051510).
• ceph: fix directories inode i_blkbits initialization (bsc#1153717).
• ceph: reconnect connection if session hang in opening state (bsc#1153718).
• ceph: update the mtime when truncating up (bsc#1153719).
• ceph: use ceph_evict_inode to cleanup inode's resource (bsc#1148133).
• cfg80211: add and use strongly typed element iteration macros (bsc#1051510).
• cfg80211: Purge frame registrations on iftype change (bsc#1051510).
• clk: at91: fix update bit maps on CFG_MOR write (bsc#1051510).
• clk: at91: select parent if main oscillator or bypass is enabled (bsc#1051510).
• clk: qoriq: Fix -Wunused-const-variable (bsc#1051510).
• clk: sirf: Do not reference clk_init_data after registration (bsc#1051510).
• clk: sunxi-ng: v3s: add missing clock slices for MMC2 module clocks (bsc#1051510).
• clk: sunxi-ng: v3s: add the missing PLL_DDR1 (bsc#1051510).
• clk: zx296718: Do not reference clk_init_data after registration (bsc#1051510).
• crypto: caam - fix concurrency issue in givencrypt descriptor (bsc#1051510).
• crypto: caam - free resources in case caam_rng registration failed (bsc#1051510).
• crypto: cavium/zip - Add missing single_release() (bsc#1051510).
• crypto: ccp - Reduce maximum stack usage (bsc#1051510).
• crypto: qat - Silence smp_processor_id() warning (bsc#1051510).
• crypto: skcipher - Unmap pages after an external error (bsc#1051510).
• crypto: talitos - fix missing break in switch statement (bsc#1142635).
• cxgb4: fix endianness for vlan value in cxgb4_tc_flower (bsc#1064802 bsc#1066129).
• cxgb4: offload VLAN flows regardless of VLAN ethtype (bsc#1064802 bsc#1066129).
• cxgb4: reduce kernel stack usage in cudbg_collect_mem_region() (bsc#1073513).
• cxgb4: Signedness bug in init_one() (bsc#1097585 bsc#1097586 bsc#1097587 bsc#1097588 bsc#1097583 bsc#1097584).
• cxgb4: smt: Add lock for atomic_dec_and_test (bsc#1064802 bsc#1066129).
• dasd_fba: Display '00000000' for zero page when dumping sense (bsc#1123080).
• /dev/mem: Bail out upon SIGKILL (git-fixes).
• dmaengine: dw: platform: Switch to acpi_dma_controller_register() (bsc#1051510).
• dmaengine: iop-adma.c: fix printk format warning (bsc#1051510).
• drivers: thermal: int340x_thermal: Fix sysfs race condition (bsc#1051510).
• drm/amdgpu: Check for valid number of registers to read (bsc#1051510).
• drm/amdgpu/si: fix ASIC tests (git-fixes).
• drm/amd/powerplay/smu7: enforce minimal VBITimeout (v2) (bsc#1051510).
• drm/ast: Fixed reboot test may cause system hanged (bsc#1051510).
• drm/bridge: tc358767: Increase AUX transfer length limit (bsc#1051510).
• drm: Flush output polling on shutdown (bsc#1051510).
• drm/i915: Fix various tracepoints for gen2 (bsc#1113722)
• drm/imx: Drop unused imx-ipuv3-crtc.o build (bsc#1113722)
• drm/msm/dsi: Implement reset correctly (bsc#1051510).
• drm/panel: simple: fix AUO g185han01 horizontal blanking (bsc#1051510).
• drm/radeon: Fix EEH during kexec (bsc#1051510).
• drm/tilcdc: Register cpufreq notifier after we have initialized crtc (bsc#1051510).
• drm/vmwgfx: Fix double free in vmw_recv_msg() (bsc#1051510).
• Drop multiversion(kernel) from the KMP template (bsc#1127155).
• e1000e: add workaround for possible stalled packet (bsc#1051510).
• EDAC/amd64: Decode syndrome before translating address (bsc#1114279).
• eeprom: at24: make spd world-readable again (git-fixes).
• ext4: fix warning inside ext4_convert_unwritten_extents_endio (bsc#1152025).
• ext4: set error return correctly when ext4_htree_store_dirent fails (bsc#1152024).
• firmware: dmi: Fix unlikely out-of-bounds read in save_mem_devices (git-fixes).
• Fix AMD IOMMU kABI (bsc#1154610).
• Fix kabi for: NFSv4: Fix OPEN / CLOSE race (git-fixes).
• Fix KVM kABI after x86 mmu backports (bsc#1117665).
• gpio: fix line flag validation in lineevent_create (bsc#1051510).
• gpio: fix line flag validation in linehandle_create (bsc#1051510).
• gpiolib: acpi: Add gpiolib_acpi_run_edge_events_on_boot option and blacklist (bsc#1051510).
• gpiolib: only check line handle flags once (bsc#1051510).
• gpio: Move gpiochip_lock/unlock_as_irq to gpio/driver.h (bsc#1051510).
• gpu: drm: radeon: Fix a possible null-pointer dereference in radeon_connector_set_property() (bsc#1051510).
• HID: apple: Fix stuck function keys when using FN (bsc#1051510).
• HID: hidraw: Fix invalid read in hidraw_ioctl (bsc#1051510).
• HID: logitech: Fix general protection fault caused by Logitech driver (bsc#1051510).
• HID: prodikeys: Fix general protection fault during probe (bsc#1051510).
• HID: sony: Fix memory corruption issue on cleanup (bsc#1051510).
• hwmon: (acpi_power_meter) Change log level for 'unsafe software power cap' (bsc#1051510).
• hwmon: (lm75) Fix write operations for negative temperatures (bsc#1051510).
• hwmon: (shtc1) fix shtc1 and shtw1 id mask (bsc#1051510).
• hwrng: core - do not wait on add_early_randomness() (git-fixes).
• i2c: riic: Clear NACK in tend isr (bsc#1051510).
• IB/core, ipoib: Do not overreact to SM LID change event (bsc#1154108)
• IB/hfi1: Remove overly conservative VM_EXEC flag check (bsc#1144449).
• IB/mlx5: Consolidate use_umr checks into single function (bsc#1093205).
• IB/mlx5: Fix MR re-registration flow to use UMR properly (bsc#1093205).
• IB/mlx5: Report correctly tag matching rendezvous capability (bsc#1046305).
• ieee802154: atusb: fix use-after-free at disconnect (bsc#1051510).
• ieee802154: enforce CAP_NET_RAW for raw sockets (bsc#1051510).
• ife: error out when nla attributes are empty (networking-stable-19_08_08).
• iio: adc: ad799x: fix probe error handling (bsc#1051510).
• iio: dac: ad5380: fix incorrect assignment to val (bsc#1051510).
• iio: light: opt3001: fix mutex unlock race (bsc#1051510).
• ima: always return negative code for error (bsc#1051510).
• Input: da9063 - fix capability and drop KEY_SLEEP (bsc#1051510).
• Input: elan_i2c - remove Lenovo Legion Y7000 PnpID (bsc#1051510).
• iommu/amd: Apply the same IVRS IOAPIC workaround to Acer Aspire A315-41 (bsc#1137799).
• iommu/amd: Check PM_LEVEL_SIZE() condition in locked section (bsc#1154608).
• iommu/amd: Override wrong IVRS IOAPIC on Raven Ridge systems (bsc#1137799).
• iommu/amd: Remove domain->updated (bsc#1154610).
• iommu/amd: Wait for completion of IOTLB flush in attach_device (bsc#1154611).
• iommu/dma: Fix for dereferencing before null checking (bsc#1151667).
• iommu/iova: Avoid false sharing on fq_timer_on (bsc#1151671).
• ip6_tunnel: fix possible use-after-free on xmit (networking-stable-19_08_08).
• ipmi_si: Only schedule continuously in the thread in maintenance mode (bsc#1051510).
• ipv6/addrconf: allow adding multicast addr if IFA_F_MCAUTOJOIN is set (networking-stable-19_08_28).
• ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()' (networking-stable-19_09_15).
• isdn/capi: check message length in capi_write() (bsc#1051510).
• ixgbe: Prevent u8 wrapping of ITR value to something less than 10us (bsc#1101674).
• ixgbe: sync the first fragment unconditionally (bsc#1133140).
• kABI: media: em28xx: fix handler for vidioc_s_input() (bsc#1051510). fixes kABI
• kABI: media: em28xx: stop rewriting device's struct (bsc#1051510). fixes kABI
• kABI: net: sched: act_sample: fix psample group handling on overwrite (networking-stable-19_09_05).
• kABI/severities: Whitelist functions internal to radix mm. To call these functions you have to first detect if you are running in radix mm mode which can't be expected of OOT code.
• kABI workaround for snd_hda_pick_pin_fixup() changes (bsc#1051510).
• kernel-subpackage-build: create zero size ghost for uncompressed vmlinux (bsc#1154354). It is not strictly necessary to uncompress it so maybe the ghost file can be 0 size in this case.
• kernel/sysctl.c: do not override max_threads provided by userspace (bnc#1150875).
• KVM: Convert kvm_lock to a mutex (bsc#1117665).
• KVM: MMU: drop vcpu param in gpte_access (bsc#1117665).
• KVM: PPC: Book3S: Fix incorrect guest-to-user-translation error handling (bsc#1061840).
• KVM: PPC: Book3S HV: Check for MMU ready on piggybacked virtual cores (bsc#1061840).
• KVM: PPC: Book3S HV: Do not lose pending doorbell request on migration on P9 (bsc#1061840).
• KVM: PPC: Book3S HV: Do not push XIVE context when not using XIVE device (bsc#1061840).
• KVM: PPC: Book3S HV: Fix lockdep warning when entering the guest (bsc#1061840).
• KVM: PPC: Book3S HV: Fix race in re-enabling XIVE escalation interrupts (bsc#1061840).
• KVM: PPC: Book3S HV: Handle virtual mode in XIVE VCPU push code (bsc#1061840).
• KVM: PPC: Book3S HV: use smp_mb() when setting/clearing host_ipi flag (bsc#1061840).
• KVM: PPC: Book3S HV: XIVE: Free escalation interrupts before disabling the VP (bsc#1061840).
• KVM: x86: add tracepoints around __direct_map and FNAME(fetch) (bsc#1117665).
• KVM: x86: adjust kvm_mmu_page member to save 8 bytes (bsc#1117665).
• KVM: x86: change kvm_mmu_page_get_gfn BUG_ON to WARN_ON (bsc#1117665).
• KVM: x86: Do not release the page inside mmu_set_spte() (bsc#1117665).
• KVM: x86: make FNAME(fetch) and __direct_map more similar (bsc#1117665).
• KVM: x86, powerpc: do not allow clearing largepages debugfs entry (bsc#1117665).
• KVM: x86: remove now unneeded hugepage gfn adjustment (bsc#1117665).
• leds: leds-lp5562 allow firmware files up to the maximum length (bsc#1051510).
• leds: trigger: gpio: GPIO 0 is valid (bsc#1051510).
• libertas: Add missing sentinel at end of if_usb.c fw_table (bsc#1051510).
• libertas_tf: Use correct channel range in lbtf_geo_init (bsc#1051510).
• libiscsi: do not try to bypass SCSI EH (bsc#1142076).
• lib/mpi: Fix karactx leak in mpi_powm (bsc#1051510).
• livepatch: Nullify obj->mod in klp_module_coming()'s error path (bsc#1071995).
• mac80211: accept deauth frames in IBSS mode (bsc#1051510).
• mac80211: minstrel_ht: fix per-group max throughput rate initialization (bsc#1051510).
• macsec: drop skb sk before calling gro_cells_receive (bsc#1051510).
• md: do not report active array_state until after revalidate_disk() completes (git-fixes).
• md: only call set_in_sync() when it is expected to succeed (git-fixes).
• md/raid6: Set R5_ReadError when there is read failure on parity disk (git-fixes).
• media: atmel: atmel-isc: fix asd memory allocation (bsc#1135642).
• media: atmel: atmel-isi: fix timeout value for stop streaming (bsc#1051510).
• media: cpia2_usb: fix memory leaks (bsc#1051510).
• media: dib0700: fix link error for dibx000_i2c_set_speed (bsc#1051510).
• media: dvb-core: fix a memory leak bug (bsc#1051510).
• media: em28xx: fix handler for vidioc_s_input() (bsc#1051510).
• media: em28xx: stop rewriting device's struct (bsc#1051510).
• media: exynos4-is: fix leaked of_node references (bsc#1051510).
• media: fdp1: Reduce FCP not found message level to debug (bsc#1051510).
• media: gspca: zero usb_buf on error (bsc#1051510).
• media: hdpvr: Add device num check and handling (bsc#1051510).
• media: hdpvr: add terminating 0 at end of string (bsc#1051510).
• media: i2c: ov5645: Fix power sequence (bsc#1051510).
• media: iguanair: add sanity checks (bsc#1051510).
• media: marvell-ccic: do not generate EOF on parallel bus (bsc#1051510).
• media: mc-device.c: do not memset __user pointer contents (bsc#1051510).
• media: omap3isp: Do not set streaming state on random subdevs (bsc#1051510).
• media: omap3isp: Set device on omap3isp subdevs (bsc#1051510).
• media: ov6650: Fix sensor possibly not detected on probe (bsc#1051510).
• media: ov6650: Move v4l2_clk_get() to ov6650_video_probe() helper (bsc#1051510).
• media: ov9650: add a sanity check (bsc#1051510).
• media: radio/si470x: kill urb on error (bsc#1051510).
• media: replace strcpy() by strscpy() (bsc#1051510).
• media: Revert "[media] marvell-ccic: reset ccic phy when stop streaming for stability" (bsc#1051510).
• media: saa7134: fix terminology around saa7134_i2c_eeprom_md7134_gate() (bsc#1051510).
• media: saa7146: add cleanup in hexium_attach() (bsc#1051510).
• media: sn9c20x: Add MSI MS-1039 laptop to flip_dmi_table (bsc#1051510).
• media: stkwebcam: fix runtime PM after driver unbind (bsc#1051510