Security update for the Linux Kernel

An update that solves 15 vulnerabilities and has 84 security fixes can now be installed.

Description:

The SUSE Linux Enterprise 12 SP5 kernel RT was updated to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2020-0404: Fixed a linked list corruption due to an unusual root cause (bsc#1176423).
• CVE-2020-0427: Fixed an out of bounds read due to a use after free (bsc#1176725).
• CVE-2020-0431: Fixed an out of bounds write due to a missing bounds check (bsc#1176722).
• CVE-2020-0432: Fixed an out of bounds write due to an integer overflow (bsc#1176721).
• CVE-2020-14381: Fixed requeue paths such that filp was valid when dropping the references (bsc#1176011).
• CVE-2020-14386: Fixed a memory corruption which could have been exploited to gain root privileges from unprivileged processes (bsc#1176069).
• CVE-2020-14390: Fixed an out-of-bounds memory write leading to memory corruption or a denial of service when changing screen size (bnc#1176235).
• CVE-2020-1749: Use ip6_dst_lookup_flow instead of ip6_dst_lookup (bsc#1165629).
• CVE-2020-25212: Fixed A TOCTOU mismatch in the NFS client code which could have been used by local attackers to corrupt memory (bsc#1176381).
• CVE-2020-2521: Fixed getxattr kernel panic and memory overflow (bsc#1176381).
• CVE-2020-25284: Fixed an incomplete permission checking for access to rbd devices, which could have been leveraged by local attackers to map or unmap rbd block devices (bsc#1176482).
• CVE-2020-25641: Fixed a zero-length biovec request issued by the block subsystem could have caused the kernel to enter an infinite loop, causing a denial of service (bsc#1177121).
• CVE-2020-25643: Fixed a memory corruption and a read overflow which could have caused by improper input validation in the ppp_cp_parse_cr function (bsc#1177206).
• CVE-2020-25645: Fixed an issue which traffic between two Geneve endpoints may be unencrypted when IPsec is configured to encrypt traffic for the specific UDP port used by the GENEVE tunnel allowing anyone between the two endpoints to read the traffic unencrypted (bsc#1177511).
• CVE-2020-26088: Fixed an improper CAP_NET_RAW check in NFC socket creation could have been used by local attackers to create raw sockets, bypassing security mechanisms (bsc#1176990).

The following non-security bugs were fixed:

• ACPI: EC: Reference count query handlers under lock (git-fixes).
• airo: Add missing CAP_NET_ADMIN check in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE (git-fixes).
• airo: Fix read overflows sending packets (git-fixes).
• ALSA: asihpi: fix iounmap in error handler (git-fixes).
• ALSA: firewire-digi00x: exclude Avid Adrenaline from detection (git-fixes).
• ALSA; firewire-tascam: exclude Tascam FE-8 from detection (git-fixes).
• ALSA: hda: Fix 2 channel swapping for Tegra (git-fixes).
• ALSA: hda: fix a runtime pm issue in SOF when integrated GPU is disabled (git-fixes).
• ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion NT950XCJ-X716A (git-fixes).
• ALSA: hda/realtek - Improved routing for Thinkpad X1 7th/8th Gen (git-fixes).
• altera-stapl: altera_get_note: prevent write beyond end of 'key' (git-fixes).
• amd-xgbe: Add a check for an skb in the timestamp path (git-fixes).
• amd-xgbe: Add additional dynamic debug messages (git-fixes).
• amd-xgbe: Add additional ethtool statistics (git-fixes).
• amd-xgbe: Add ethtool show/set channels support (git-fixes).
• amd-xgbe: Add ethtool show/set ring parameter support (git-fixes).
• amd-xgbe: Add ethtool support to retrieve SFP module info (git-fixes).
• amd-xgbe: Add hardware features debug output (git-fixes).
• amd-xgbe: Add NUMA affinity support for IRQ hints (git-fixes).
• amd-xgbe: Add NUMA affinity support for memory allocations (git-fixes).
• amd-xgbe: Add per queue Tx and Rx statistics (git-fixes).
• amd-xgbe: Advertise FEC support with the KR re-driver (git-fixes).
• amd-xgbe: Always attempt link training in KR mode (git-fixes).
• amd-xgbe: Be sure driver shuts down cleanly on module removal (git-fixes).
• amd-xgbe: Convert to generic power management (git-fixes).
• amd-xgbe: Fix debug output of max channel counts (git-fixes).
• amd-xgbe: Fix error path in xgbe_mod_init() (git-fixes).
• amd-xgbe: Fixes for working with PHYs that support 2.5GbE (git-fixes).
• amd-xgbe: Fix SFP PHY supported/advertised settings (git-fixes).
• amd-xgbe: fix spelling mistake: "avialable" -> "available" (git-fixes).
• amd-xgbe: Handle return code from software reset function (git-fixes).
• amd-xgbe: Improve SFP 100Mbps auto-negotiation (git-fixes).
• amd-xgbe: Interrupt summary bits are h/w version dependent (git-fixes).
• amd-xgbe: Limit the I2C error messages that are output (git-fixes).
• amd-xgbe: Mark expected switch fall-throughs (git-fixes).
• amd-xgbe: Optimize DMA channel interrupt enablement (git-fixes).
• amd-xgbe: Prepare for ethtool set-channel support (git-fixes).
• amd-xgbe: Read and save the port property registers during probe (git-fixes).
• amd-xgbe: Remove field that indicates SFP diagnostic support (git-fixes).
• amd-xgbe: remove unnecessary conversion to bool (git-fixes).
• amd-xgbe: Remove use of comm_owned field (git-fixes).
• amd-xgbe: Set the MDIO mode for 10000Base-T configuration (git-fixes).
• amd-xgbe: Simplify the burst length settings (git-fixes).
• amd-xgbe: use devm_platform_ioremap_resource() to simplify code (git-fixes).
• amd-xgbe: use dma_mapping_error to check map errors (git-fixes).
• amd-xgbe: Use __napi_schedule() in BH context (git-fixes).
• amd-xgbe: Use the proper register during PTP initialization (git-fixes).
• ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter (git-fixes).
• arm64: KVM: Do not generate UNDEF when LORegion feature is present (jsc#SLE-4084).
• arm64: KVM: regmap: Fix unexpected switch fall-through (jsc#SLE-4084).
• asm-generic: fix -Wtype-limits compiler warnings (bsc#1112178).
• ASoC: intel: Fix memleak in sst_media_open (git-fixes).
• ASoC: kirkwood: fix IRQ error handling (git-fixes).
• ASoC: tegra: Fix reference count leaks (git-fixes).
• ath10k: fix array out-of-bounds access (git-fixes).
• ath10k: fix memory leak for tpc_stats_final (git-fixes).
• ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read (git-fixes).
• batman-adv: Add missing include for in_interrupt() (git-fixes).
• batman-adv: Avoid uninitialized chaddr when handling DHCP (git-fixes).
• batman-adv: bla: fix type misuse for backbone_gw hash indexing (git-fixes).
• batman-adv: bla: use netif_rx_ni when not in interrupt context (git-fixes).
• batman-adv: mcast: fix duplicate mcast packets in BLA backbone from mesh (git-fixes).
• batman-adv: mcast/TT: fix wrongly dropped or rerouted packets (git-fixes).
• bcache: allocate meta data pages as compound pages (bsc#1172873).
• bcache: allocate meta data pages as compound pages (bsc#1172873).
• bcache: Convert pr_<level> uses to a more typical style (git fixes (block drivers)).
• bcache: fix overflow in offset_to_stripe() (git fixes (block drivers)).
• bcm63xx_enet: correct clock usage (git-fixes).
• bcm63xx_enet: do not write to random DMA channel on BCM6345 (git-fixes).
• bitfield.h: do not compile-time validate _val in FIELD_FIT (git fixes (bitfield)).
• blktrace: fix debugfs use after free (git fixes (block drivers)).
• block: add docs for gendisk / request_queue refcount helpers (git fixes (block drivers)).
• block: check queue's limits.discard_granularity in __blkdev_issue_discard() (bsc#1152148).
• block: check queue's limits.discard_granularity in __blkdev_issue_discard() (bsc#1152148).
• block: improve discard bio alignment in __blkdev_issue_discard() (bsc#1152148).
• block: improve discard bio alignment in __blkdev_issue_discard() (bsc#1152148).
• block: revert back to synchronous request_queue removal (git fixes (block drivers)).
• block: Use non _rcu version of list functions for tag_set_list (git-fixes).
• Bluetooth: Fix refcount use-after-free issue (git-fixes).
• Bluetooth: guard against controllers sending zero'd events (git-fixes).
• Bluetooth: Handle Inquiry Cancel error after Inquiry Complete (git-fixes).
• Bluetooth: L2CAP: handle l2cap config request during open state (git-fixes).
• Bluetooth: prefetch channel before killing sock (git-fixes).
• bnxt_en: Fix completion ring sizing with TPA enabled (networking-stable-20_07_29).
• bonding: check error value of register_netdevice() immediately (git-fixes).
• bonding: check return value of register_netdevice() in bond_newlink() (git-fixes).
• bonding: use nla_get_u64 to extract the value for IFLA_BOND_AD_ACTOR_SYSTEM (git-fixes).
• btrfs: avoid possible signal interruption of btrfs_drop_snapshot() on relocation tree (bsc#1174354).
• btrfs: balance: print to system log when balance ends or is paused (bsc#1174354).
• btrfs: relocation: allow signal to cancel balance (bsc#1174354).
• btrfs: relocation: review the call sites which can be interrupted by signal (bsc#1174354).
• btrfs: require only sector size alignment for parent eb bytenr (bsc#1176789).
• btrfs: take overcommit into account in inc_block_group_ro (bsc#1174354).
• btrfs: tree-checker: fix the error message for transid error (bsc#1176788).
• ceph: do not allow setlease on cephfs (bsc#1177041).
• ceph: fix potential mdsc use-after-free crash (bsc#1177042).
• ceph: fix use-after-free for fsc->mdsc (bsc#1177043).
• ceph: handle zero-length feature mask in session messages (bsc#1177044).
• cfg80211: regulatory: reject invalid hints (bsc#1176699).
• char: virtio: Select VIRTIO from VIRTIO_CONSOLE (bsc#1175667).
• cifs: Fix leak when handling lease break for cached root fid (bsc#1176242).
• cifs/smb3: Fix data inconsistent when punch hole (bsc#1176544).
• cifs/smb3: Fix data inconsistent when zero file range (bsc#1176536).
• clk: Add (devm_)clk_get_optional() functions (git-fixes).
• clk: rockchip: Fix initialization of mux_pll_src_4plls_p (git-fixes).
• clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED (git-fixes).
• clk/ti/adpll: allocate room for terminating null (git-fixes).
• clocksource/drivers/h8300_timer8: Fix wrong return value in h8300_8timer_init() (git-fixes).
• constrants: fix malformed XML Closing tag of an element is "</foo>", not "<foo/>". Fixes: 8b37de2eb835 ("rpm/constraints.in: Increase memory for kernel-docs")
• cpufreq: intel_pstate: Fix EPP setting via sysfs in active mode (bsc#1176966).
• Created new preempt kernel flavor (jsc#SLE-11309) Configs are cloned from the respective $arch/default configs. All changed configs appart from CONFIG_PREEMPT->y are a result of dependencies, namely many lock/unlock primitives are no longer inlined in the preempt kernel. TREE_RCU has been also changed to PREEMPT_RCU which is the default implementation for PREEMPT kernel.
• crypto: dh - check validity of Z before export (bsc#1175716).
• crypto: dh - SP800-56A rev 3 local public key validation (bsc#1175716).
• crypto: ecc - SP800-56A rev 3 local public key validation (bsc#1175716).
• crypto: ecdh - check validity of Z before export (bsc#1175716).
• device property: Fix the secondary firmware node handling in set_primary_fwnode() (git-fixes).
• Disable CONFIG_LIVEPATCH_IPA_CLONES where not needed Explicitly disable CONFIG_LIVEPATCH_IPA_CLONES in configs where it is not needed to avoid confusion and unwanted values due to fragment config files.
• dmaengine: at_hdmac: check return value of of_find_device_by_node() in at_dma_xlate() (git-fixes).
• dmaengine: of-dma: Fix of_dma_router_xlate's of_dma_xlate handling (git-fixes).
• dmaengine: pl330: Fix burst length if burst size is smaller than bus width (git-fixes).
• dmaengine: tegra-apb: Prevent race conditions on channel's freeing (git-fixes).
• dmaengine: zynqmp_dma: fix burst length configuration (git-fixes).
• dm crypt: avoid truncating the logical block size (git fixes (block drivers)).
• dm: fix redundant IO accounting for bios that need splitting (git fixes (block drivers)).
• dm integrity: fix a deadlock due to offloading to an incorrect workqueue (git fixes (block drivers)).
• dm integrity: fix integrity recalculation that is improperly skipped (git fixes (block drivers)).
• dm: report suspended device during destroy (git fixes (block drivers)).
• dm rq: do not call blk_mq_queue_stopped() in dm_stop_queue() (git fixes (block drivers)).
• dm: use noio when sending kobject event (git fixes (block drivers)).
• dm writecache: add cond_resched to loop in persistent_memory_claim() (git fixes (block drivers)).
• dm writecache: correct uncommitted_block when discarding uncommitted entry (git fixes (block drivers)).
• dm zoned: assign max_io_len correctly (git fixes (block drivers)).
• Drivers: char: tlclk.c: Avoid data race between init and interrupt handler (git-fixes).
• Drivers: hv: balloon: Remove dependencies on guest page size (git-fixes).
• Drivers: hv: Specify receive buffer size using Hyper-V page size (bsc#1176877).
• Drivers: hv: vmbus: Add timeout to vmbus_wait_for_unload (git-fixes).
• Drivers: hv: vmbus: Remove the undesired put_cpu_ptr() in hv_synic_cleanup() (git-fixes).
• Drivers: net: add missing interrupt.h include (git-fixes).
• Drivers/net/ethernet/marvell/mvmdio.c: Fix non OF case (git-fixes).
• drivers/net/wan/x25_asy: Fix to make it work (networking-stable-20_07_29).
• drm/amd/display: dal_ddc_i2c_payloads_create can fail causing panic (git-fixes).
• drm/amd/display: fix pow() crashing when given base 0 (git-fixes).
• drm/amd/display: fix ref count leak in amdgpu_drm_ioctl (git-fixes).
• drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails (git-fixes).
• drm/amdgpu: Fix buffer overflow in INFO ioctl (git-fixes).
• drm/amdgpu: Fix bug in reporting voltage for CIK (git-fixes).
• drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms (git-fixes).
• drm/amdgpu: increase atombios cmd timeout (git-fixes).
• drm/amdgpu/powerplay: fix AVFS handling with custom powerplay table (git-fixes).
• drm/amdgpu/powerplay/smu7: fix AVFS handling with custom powerplay table (git-fixes).
• drm/amdkfd: fix a memory leak issue (git-fixes).
• drm/amdkfd: Fix reference count leaks (git-fixes).
• drm/amd/pm: correct Vega10 swctf limit setting (git-fixes).
• drm/amd/pm: correct Vega12 swctf limit setting (git-fixes).
• drm/ast: Initialize DRAM type before posting GPU (bsc#1113956) * context changes
• drm/mediatek: Add exception handing in mtk_drm_probe() if component init fail (git-fixes).
• drm/mediatek: Add missing put_device() call in mtk_hdmi_dt_parse_pdata() (git-fixes).
• drm/msm/a5xx: Always set an OPP supported hardware value (git-fixes).
• drm/msm: add shutdown support for display platform_driver (git-fixes).
• drm/msm/adreno: fix updating ring fence (git-fixes).
• drm/msm: Disable preemption on all 5xx targets (git-fixes).
• drm/msm: fix leaks if initialization fails (git-fixes).
• drm/msm/gpu: make ringbuffer readonly (bsc#1112178) * context changes
• drm/nouveau/debugfs: fix runtime pm imbalance on error (git-fixes).
• drm/nouveau/dispnv50: fix runtime pm imbalance on error (git-fixes).
• drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open (git-fixes).
• drm/nouveau: Fix reference count leak in nouveau_connector_detect (git-fixes).
• drm/nouveau: fix reference count leak in nv50_disp_atomic_commit (git-fixes).
• drm/nouveau: fix runtime pm imbalance on error (git-fixes).
• drm/omap: fix possible object reference leak (git-fixes).
• drm/radeon: fix multiple reference count leak (git-fixes).
• drm/radeon: Prefer lower feedback dividers (git-fixes).
• drm/radeon: revert "Prefer lower feedback dividers" (git-fixes).
• drm/sun4i: Fix dsi dcs long write function (git-fixes).
• drm/sun4i: mixer: Extend regmap max_register (git-fixes).
• drm/sun4i: sun8i-csc: Secondary CSC register correction (git-fixes).
• drm/tve200: Stabilize enable/disable (git-fixes).
• drm/vc4/vc4_hdmi: fill ASoC card owner (git-fixes).
• drm/xen-front: Fix misused IS_ERR_OR_NULL checks (bsc#1065600).
• Drop wrongly inserted end-of-sorted marker
• e1000: Do not perform reset in reset_task if we are already down (git-fixes).
• EDAC: Fix reference count leaks (bsc#1112178).
• fbcon: prevent user font height or width change from causing (bsc#1112178)
• Fix error in kabi fix for: NFSv4: Fix OPEN / CLOSE race (bsc#1176950).
• fsl/fman: check dereferencing null pointer (git-fixes).
• fsl/fman: fix dereference null return value (git-fixes).
• fsl/fman: fix eth hash table allocation (git-fixes).
• fsl/fman: fix unreachable code (git-fixes).
• fsl/fman: use 32-bit unsigned integer (git-fixes).
• ftrace: Move RCU is watching check after recursion check (git-fixes).
• ftrace: Setup correct FTRACE_FL_REGS flags for module (git-fixes).
• gma/gma500: fix a memory disclosure bug due to uninitialized bytes (git-fixes).
• gpio: tc35894: fix up tc35894 interrupt configuration (git-fixes).
• gtp: add missing gtp_encap_disable_sock() in gtp_encap_enable() (git-fixes).
• gtp: fix Illegal context switch in RCU read-side critical section (git-fixes).
• gtp: fix use-after-free in gtp_newlink() (git-fixes).
• Hide e21a4f3a930c as of its duplication
• HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() (git-fixes).
• hippi: Fix a size used in a 'pci_free_consistent()' in an error handling path (git-fixes).
• hsr: use netdev_err() instead of WARN_ONCE() (bsc#1176659).
• hv_balloon: Balloon up according to request page number (git-fixes).
• hv_balloon: Use a static page for the balloon_up send buffer (git-fixes).
• hv_netvsc: Allow scatter-gather feature to be tunable (git-fixes).
• hv_netvsc: do not use VF device if link is down (git-fixes).
• hv_netvsc: Fix a warning of suspicious RCU usage (git-fixes).
• hv_netvsc: Fix extra rcu_read_unlock in netvsc_recv_callback() (git-fixes).
• hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit() (git-fixes).
• hv_netvsc: flag software created hash value (git-fixes).
• hv_netvsc: Remove "unlikely" from netvsc_select_queue (git-fixes).
• hv_utils: drain the timesync packets on onchannelcallback (bsc#1176877).
• hv_utils: return error if host timesysnc update is stale (bsc#1176877).
• hwmon: (applesmc) check status earlier (git-fixes).
• i2c: core: Do not fail PRP0001 enumeration when no ID table exist (git-fixes).
• i2c: cpm: Fix i2c_ram structure (git-fixes).
• i2c: meson: fix clock setting overwrite (git-fixes).
• i2c: rcar: in slave mode, clear NACK earlier (git-fixes).
• ibmvnic: add missing parenthesis in do_reset() (bsc#1176700 ltc#188140).
• ibmvnic fix NULL tx_pools and rx_tools issue at do_reset (bsc#1175873 ltc#187922).
• ieee802154/adf7242: check status of adf7242_read_reg (git-fixes).
• ieee802154: fix one possible memle