Security update for the Linux Kernel

An update that solves 14 vulnerabilities and has 90 security fixes can now be installed.

Description:

The SUSE Linux Enterprise 15 SP2 kernel Azure was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-25656: Fixed a concurrency use-after-free in vt_do_kdgkb_ioctl (bnc#1177766).
• CVE-2020-25285: Fixed a race condition between hugetlb sysctl handlers in mm/hugetlb.c (bnc#1176485).
• CVE-2020-14351: Fixed a race in the perf_mmap_close() function (bsc#1177086).
• CVE-2020-16120: Fixed a permissions issue in ovl_path_open() (bsc#1177470).
• CVE-2020-12351: Implemented a kABI workaround for bluetooth l2cap_ops filter addition (bsc#1177724).
• CVE-2020-12352: Fixed an information leak when processing certain AMP packets aka "BleedingTooth" (bsc#1177725).
• CVE-2020-25212: Fixed a TOCTOU mismatch in the NFS client code (bnc#1176381).
• CVE-2020-25645: Fixed an an issue in IPsec that caused traffic between two Geneve endpoints to be unencrypted (bnc#1177511).
• CVE-2020-24490: Fixed a heap buffer overflow when processing extended advertising report events aka "BleedingTooth" aka "BadVibes" (bsc#1177726).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-27673: Fixed an issue where rogue guests could have caused denial of service of Dom0 via high frequency events (XSA-332 bsc#1177411)
• CVE-2020-27675: Fixed a race condition in event handler which may crash dom0 (XSA-331 bsc#1177410).
• CVE-2020-25705: A ICMP global rate limiting side-channel was removed which could lead to e.g. the SADDNS attack (bsc#1175721)

The following non-security bugs were fixed:

• 9p: Fix memory leak in v9fs_mount (git-fixes).
• ACPI: Always build evged in (git-fixes).
• ACPI: button: fix handling lid state changes when input device closed (git-fixes).
• ACPI: configfs: Add missing config_item_put() to fix refcount leak (git-fixes).
• acpi-cpufreq: Honor _PSD table setting on new AMD CPUs (git-fixes).
• ACPI: debug: do not allow debugging when ACPI is disabled (git-fixes).
• ACPI: EC: Reference count query handlers under lock (git-fixes).
• act_ife: load meta modules before tcf_idr_check_alloc() (networking-stable-20_09_24).
• Add CONFIG_CHECK_CODESIGN_EKU
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: ac97: (cosmetic) align argument names (git-fixes).
• ALSA: aoa: i2sbus: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: asihpi: fix spellint typo in comments (git-fixes).
• ALSA: atmel: ac97: clarify operator precedence (git-fixes).
• ALSA: bebob: potential info leak in hwdep_read() (git-fixes).
• ALSA: compress_offload: remove redundant initialization (git-fixes).
• ALSA: core: init: use DECLARE_COMPLETION_ONSTACK() macro (git-fixes).
• ALSA: core: pcm: simplify locking for timers (git-fixes).
• ALSA: core: timer: clarify operator precedence (git-fixes).
• ALSA: core: timer: remove redundant assignment (git-fixes).
• ALSA: ctl: Workaround for lockdep warning wrt card->ctl_files_rwlock (git-fixes).
• ALSA: fireworks: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: hda: auto_parser: remove shadowed variable declaration (git-fixes).
• ALSA: hda: (cosmetic) align function parameters (git-fixes).
• ALSA: hda - Do not register a cb func if it is registered already (git-fixes).
• ALSA: hda - Fix the return value if cb func is already registered (git-fixes).
• ALSA: hda/hdmi: fix incorrect locking in hdmi_pcm_close (git-fixes).
• ALSA: hda/realtek - Add mute Led support for HP Elitebook 845 G7 (git-fixes).
• ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 (git-fixes).
• ALSA: hda/realtek - set mic to auto detect on a HP AIO machine (git-fixes).
• ALSA: hda/realtek - The front Mic on a HP machine does not work (git-fixes).
• ALSA: hda: use semicolons rather than commas to separate statements (git-fixes).
• ALSA: hdspm: Fix typo arbitary (git-fixes).
• ALSA: mixart: Correct comment wrt obsoleted tasklet usage (git-fixes).
• ALSA: portman2x4: fix repeated word 'if' (git-fixes).
• ALSA: rawmidi: (cosmetic) align function parameters (git-fixes).
• ALSA: seq: oss: Avoid mutex lock for a long-time ioctl (git-fixes).
• ALSA: sparc: dbri: fix repeated word 'the' (git-fixes).
• ALSA: usb-audio: Add mixer support for Pioneer DJ DJM-250MK2 (git-fixes).
• ALSA: usb-audio: endpoint.c: fix repeated word 'there' (git-fixes).
• ALSA: usb-audio: fix spelling mistake "Frequence" -> "Frequency" (git-fixes).
• ALSA: usb-audio: Line6 Pod Go interface requires static clock rate quirk (git-fixes).
• ALSA: usb: scarless_gen2: fix endianness issue (git-fixes).
• ALSA: vx: vx_core: clarify operator precedence (git-fixes).
• ALSA: vx: vx_pcm: remove redundant assignment (git-fixes).
• ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter (git-fixes).
• arm64: Enable PCI write-combine resources under sysfs (bsc#1175807).
• ASoC: fsl: imx-es8328: add missing put_device() call in imx_es8328_probe() (git-fixes).
• ASoC: fsl_sai: Instantiate snd_soc_dai_driver (git-fixes).
• ASoC: img-i2s-out: Fix runtime PM imbalance on error (git-fixes).
• ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1 (git-fixes).
• ASoC: kirkwood: fix IRQ error handling (git-fixes).
• ASoC: qcom: lpass-cpu: fix concurrency issue (git-fixes).
• ASoC: qcom: lpass-platform: fix memory leak (git-fixes).
• ASoC: sun50i-codec-analog: Fix duplicate use of ADC enable bits (git-fixes).
• ASoC: tlv320aic32x4: Fix bdiv clock rate derivation (git-fixes).
• ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect functions (git-fixes).
• ASoC: wm8994: Skip setting of the WM8994_MICBIAS register for WM1811 (git-fixes).
• ata: ahci: mvebu: Make SATA PHY optional for Armada 3720 (git-fixes).
• ata: sata_rcar: Fix DMA boundary mask (git-fixes).
• ath10k: check idx validity in __ath10k_htt_rx_ring_fill_n() (git-fixes).
• ath10k: fix array out-of-bounds access (git-fixes).
• ath10k: fix memory leak for tpc_stats_final (git-fixes).
• ath10k: Fix the size used in a 'dma_free_coherent()' call in an error handling path (git-fixes).
• ath10k: provide survey info as accumulated data (git-fixes).
• ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read (git-fixes).
• ath6kl: prevent potential array overflow in ath6kl_add_new_sta() (git-fixes).
• ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() (git-fixes).
• ath9k: hif_usb: fix race condition between usb_get_urb() and usb_kill_anchored_urbs() (git-fixes).
• ath9k_htc: Use appropriate rs_datalen type (git-fixes).
• backlight: sky81452-backlight: Fix refcount imbalance on error (git-fixes).
• blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART (bsc#1177750).
• block: ensure bdi->io_pages is always initialized (bsc#1177749).
• block: Fix page_is_mergeable() for compound pages (bsc#1177814).
• block: Set same_page to false in __bio_try_merge_page if ret is false (git-fixes).
• Bluetooth: btusb: Fix memleak in btusb_mtk_submit_wmt_recv_urb (git-fixes).
• Bluetooth: Fix refcount use-after-free issue (git-fixes).
• Bluetooth: guard against controllers sending zero'd events (git-fixes).
• Bluetooth: Handle Inquiry Cancel error after Inquiry Complete (git-fixes).
• Bluetooth: hci_uart: Cancel init work before unregistering (git-fixes).
• Bluetooth: L2CAP: handle l2cap config request during open state (git-fixes).
• Bluetooth: MGMT: Fix not checking if BT_HS is enabled (git-fixes).
• Bluetooth: Only mark socket zapped after unlocking (git-fixes).
• Bluetooth: prefetch channel before killing sock (git-fixes).
• bnxt_en: Protect bnxt_set_eee() and bnxt_set_pauseparam() with mutex (git-fixes).
• bonding: show saner speed for broadcast mode (networking-stable-20_08_24).
• brcm80211: fix possible memleak in brcmf_proto_msgbuf_attach (git-fixes).
• brcmfmac: check ndev pointer (git-fixes).
• brcmfmac: Fix double freeing in the fmac usb data path (git-fixes).
• brcmsmac: fix memory leak in wlc_phy_attach_lcnphy (git-fixes).
• btrfs: add owner and fs_info to alloc_state io_tree (bsc#1177854).
• btrfs: allocate scrub workqueues outside of locks (bsc#1178183).
• btrfs: block-group: do not set the wrong READA flag for btrfs_read_block_groups() (bsc#1176019).
• btrfs: block-group: fix free-space bitmap threshold (bsc#1176019).
• btrfs: block-group: refactor how we delete one block group item (bsc#1176019).
• btrfs: block-group: refactor how we insert a block group item (bsc#1176019).
• btrfs: block-group: refactor how we read one block group item (bsc#1176019).
• btrfs: block-group: rename write_one_cache_group() (bsc#1176019).
• btrfs: check the right error variable in btrfs_del_dir_entries_in_log (bsc#1177687).
• btrfs: do not force read-only after error in drop snapshot (bsc#1176354).
• btrfs: do not set the full sync flag on the inode during page release (bsc#1177687).
• btrfs: do not take an extra root ref at allocation time (bsc#1176019).
• btrfs: drop logs when we've aborted a transaction (bsc#1176019).
• btrfs: drop path before adding new uuid tree entry (bsc#1178176).
• btrfs: fix a race between scrub and block group removal/allocation (bsc#1176019).
• btrfs: fix crash during unmount due to race with delayed inode workers (bsc#1176019).
• btrfs: fix filesystem corruption after a device replace (bsc#1178395).
• btrfs: fix NULL pointer dereference after failure to create snapshot (bsc#1178190).
• btrfs: fix overflow when copying corrupt csums for a message (bsc#1178191).
• btrfs: fix race between page release and a fast fsync (bsc#1177687).
• btrfs: fix space cache memory leak after transaction abort (bsc#1178173).
• btrfs: free block groups after free'ing fs trees (bsc#1176019).
• btrfs: hold a ref on the root on the dead roots list (bsc#1176019).
• btrfs: kill the subvol_srcu (bsc#1176019).
• btrfs: make btrfs_cleanup_fs_roots use the radix tree lock (bsc#1176019).
• btrfs: make inodes hold a ref on their roots (bsc#1176019).
• btrfs: make the extent buffer leak check per fs info (bsc#1176019).
• btrfs: move btrfs_rm_dev_replace_free_srcdev outside of all locks (bsc#1178395).
• btrfs: move btrfs_scratch_superblocks into btrfs_dev_replace_finishing (bsc#1178395).
• btrfs: move ino_cache_inode dropping out of btrfs_free_fs_root (bsc#1176019).
• btrfs: move the block group freeze/unfreeze helpers into block-group.c (bsc#1176019).
• btrfs: move the root freeing stuff into btrfs_put_root (bsc#1176019).
• btrfs: only commit delayed items at fsync if we are logging a directory (bsc#1177687).
• btrfs: only commit the delayed inode when doing a full fsync (bsc#1177687).
• btrfs: qgroup: fix qgroup meta rsv leak for subvolume operations (bsc#1177856).
• btrfs: qgroup: fix wrong qgroup metadata reserve for delayed inode (bsc#1177855).
• btrfs: reduce contention on log trees when logging checksums (bsc#1177687).
• btrfs: release old extent maps during page release (bsc#1177687).
• btrfs: remove no longer necessary chunk mutex locking cases (bsc#1176019).
• btrfs: remove no longer needed use of log_writers for the log root tree (bsc#1177687).
• btrfs: rename member 'trimming' of block group to a more generic name (bsc#1176019).
• btrfs: scrub, only lookup for csums if we are dealing with a data extent (bsc#1176019).
• btrfs: set the correct lockdep class for new nodes (bsc#1178184).
• btrfs: set the lockdep class for log tree extent buffers (bsc#1178186).
• btrfs: stop incremening log_batch for the log root tree when syncing log (bsc#1177687).
• btrfs: tree-checker: fix false alert caused by legacy btrfs root item (bsc#1177861).
• bus: hisi_lpc: Fixup IO ports addresses to avoid use-after-free in host removal (git-fixes).
• can: c_can: reg_map_{c,d}_can: mark as __maybe_unused (git-fixes).
• can: flexcan: flexcan_chip_stop(): add error handling and propagate error value (git-fixes).
• can: flexcan: remove ack_grp and ack_bit handling from driver (git-fixes).
• can: softing: softing_card_shutdown(): add braces around empty body in an 'if' statement (git-fixes).
• ceph: promote to unsigned long long before shifting (bsc#1178175).
• clk: at91: remove the checking of parent_name (git-fixes).
• clk: bcm2835: add missing release if devm_clk_hw_register fails (git-fixes).
• clk: imx8mq: Fix usdhc parents order (git-fixes).
• clk: keystone: sci-clk: fix parsing assigned-clock data during probe (git-fixes).
• clk: meson: g12a: mark fclk_div2 as critical (git-fixes).
• clk: qcom: gcc-sdm660: Fix wrong parent_map (git-fixes).
• clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED (git-fixes).
• clk: socfpga: stratix10: fix the divider for the emac_ptp_free_clk (git-fixes).
• clk: tegra: Always program PLL_E when enabled (git-fixes).
• clk/ti/adpll: allocate room for terminating null (git-fixes).
• clocksource/drivers/h8300_timer8: Fix wrong return value in h8300_8timer_init() (git-fixes).
• clocksource/drivers/timer-gx6605s: Fixup counter reload (git-fixes).
• cpuidle: Poll for a minimum of 30ns and poll for a tick if lower c-states are disabled (bnc#1176588).
• create Storage / NVMe subsection
• crypto: algif_aead - Do not set MAY_BACKLOG on the async path (git-fixes).
• crypto: algif_skcipher - EBUSY on aio should be an error (git-fixes).
• crypto: bcm - Verify GCM/CCM key length in setkey (git-fixes).
• crypto: ccp - fix error handling (git-fixes).
• crypto: dh - check validity of Z before export (bsc#1175718).
• crypto: dh - SP800-56A rev 3 local public key validation (bsc#1175718).
• crypto: ecc - SP800-56A rev 3 local public key validation (bsc#1175718).
• crypto: ecdh - check validity of Z before export (bsc#1175718).
• crypto: ixp4xx - Fix the size used in a 'dma_free_coherent()' call (git-fixes).
• crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc() (git-fixes).
• crypto: omap-sham - fix digcnt register handling with export/import (git-fixes).
• crypto: picoxcell - Fix potential race condition bug (git-fixes).
• crypto: qat - check cipher length for aead AES-CBC-HMAC-SHA (git-fixes).
• cxgb4: fix memory leak during module unload (networking-stable-20_09_24).
• cxgb4: Fix offset when clearing filter byte counters (networking-stable-20_09_24).
• cxl: Rework error message for incompatible slots (bsc#1055014 git-fixes).
• cypto: mediatek - fix leaks in mtk_desc_ring_alloc (git-fixes).
• dax: Fix compilation for CONFIG_DAX && !CONFIG_FS_DAX (bsc#1177817).
• Disable ipa-clones dump for KMP builds (bsc#1178330) The feature is not really useful for KMP, and rather confusing, so let's disable it at building out-of-tree codes
• Disable module compression on SLE15 SP2 (bsc#1178307)
• dma-direct: add missing set_memory_decrypted() for coherent mapping (bsc#1175898, ECO-2743).
• dma-direct: always align allocation size in dma_direct_alloc_pages() (bsc#1175898, ECO-2743).
• dma-direct: atomic allocations must come from atomic coherent pools (bsc#1175898, ECO-2743).
• dma-direct: check return value when encrypting or decrypting memory (bsc#1175898, ECO-2743).
• dma-direct: consolidate the error handling in dma_direct_alloc_pages (bsc#1175898, ECO-2743).
• dma-direct: make uncached_kernel_address more general (bsc#1175898, ECO-2743).
• dma-direct: provide function to check physical memory area validity (bsc#1175898, ECO-2743).
• dma-direct: provide mmap and get_sgtable method overrides (bsc#1175898, ECO-2743).
• dma-direct: re-encrypt memory if dma_direct_alloc_pages() fails (bsc#1175898, ECO-2743).
• dma-direct: remove __dma_direct_free_pages (bsc#1175898, ECO-2743).
• dma-direct: remove the dma_handle argument to __dma_direct_alloc_pages (bsc#1175898, ECO-2743).
• dmaengine: dma-jz4780: Fix race in jz4780_dma_tx_status (git-fixes).
• dmaengine: dmatest: Check list for emptiness before access its last entry (git-fixes).
• dmaengine: dw: Activate FIFO-mode for memory peripherals only (git-fixes).
• dmaengine: mediatek: hsdma_probe: fixed a memory leak when devm_request_irq fails (git-fixes).
• dmaengine: stm32-dma: use vchan_terminate_vdesc() in .terminate_all (git-fixes).
• dmaengine: stm32-mdma: use vchan_terminate_vdesc() in .terminate_all (git-fixes).
• dmaengine: tegra-apb: Prevent race conditions on channel's freeing (git-fixes).
• dmaengine: zynqmp_dma: fix burst length configuration (git-fixes).
• dma-fence: Serialise signal enabling (dma_fence_enable_sw_signaling) (git-fixes).
• dma-mapping: add a dma_can_mmap helper (bsc#1175898, ECO-2743).
• dma-mapping: always use VM_DMA_COHERENT for generic DMA remap (bsc#1175898, ECO-2743).
• dma-mapping: DMA_COHERENT_POOL should select GENERIC_ALLOCATOR (bsc#1175898, ECO-2743).
• dma-mapping: make dma_atomic_pool_init self-contained (bsc#1175898, ECO-2743).
• dma-mapping: merge the generic remapping helpers into dma-direct (bsc#1175898, ECO-2743).
• dma-mapping: remove arch_dma_mmap_pgprot (bsc#1175898, ECO-2743).
• dma-mapping: warn when coherent pool is depleted (bsc#1175898, ECO-2743).
• dma-pool: add additional coherent pools to map to gfp mask (bsc#1175898, ECO-2743).
• dma-pool: add pool sizes to debugfs (bsc#1175898, ECO-2743).
• dma-pool: decouple DMA_REMAP from DMA_COHERENT_POOL (bsc#1175898, ECO-2743).
• dma-pool: do not allocate pool memory from CMA (bsc#1175898, ECO-2743).
• dma-pool: dynamically expanding atomic pools (bsc#1175898, ECO-2743).
• dma-pool: Fix an uninitialized variable bug in atomic_pool_expand() (bsc#1175898, ECO-2743).
• dma-pool: fix coherent pool allocations for IOMMU mappings (bsc#1175898, ECO-2743).
• dma-pool: fix too large DMA pools on medium memory size systems (bsc#1175898, ECO-2743).
• dma-pool: get rid of dma_in_atomic_pool() (bsc#1175898, ECO-2743).
• dma-pool: introduce dma_guess_pool() (bsc#1175898, ECO-2743).
• dma-pool: make sure atomic pool suits device (bsc#1175898, ECO-2743).
• dma-pool: Only allocate from CMA when in same memory zone (bsc#1175898, ECO-2743).