SUSE-SU-2016:1102-1

The SUSE Linux Enterprise 11 SP4 RT kernel was updated to receive various security and bugfixes.

Following feature was added to kernel-xen: - A improved XEN blkfront module was added, which allows more I/O bandwidth. (FATE#320200) It is called xen-blkfront in PV, and xen-vbd-upstream in HVM mode.

The following security bugs were fixed: - CVE-2013-7446: Use-after-free vulnerability in net/unix/afunix.c in the Linux kernel allowed local users to bypass intended AFUNIX socket permissions or cause a denial of service (panic) via crafted epollctl calls (bnc#955654). - CVE-2015-7515: An out of bounds memory access in the aiptek USB driver could be used by physical local attackers to crash the kernel (bnc#956708). - CVE-2015-7550: The keyctlreadkey function in security/keys/keyctl.c in the Linux kernel did not properly use a semaphore, which allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctlrevoke and keyctlread calls (bnc#958951). - CVE-2015-8539: The KEYS subsystem in the Linux kernel allowed local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/userdefined.c (bnc#958463). - CVE-2015-8543: The networking implementation in the Linux kernel did not validate protocol identifiers for certain protocol families, which allowed local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONENEWUSER support to execute a crafted SOCKRAW application (bnc#958886). - CVE-2015-8550: Compiler optimizations in the XEN PV backend drivers could have lead to double fetch vulnerabilities, causing denial of service or arbitrary code execution (depending on the configuration) (bsc#957988). - CVE-2015-8551, CVE-2015-8552: xen/pciback: For XENPCIOPdisablemsi[|x] only disable if device has MSI(X) enabled (bsc#957990). - CVE-2015-8569: The (1) pptpbind and (2) pptpconnect functions in drivers/net/ppp/pptp.c in the Linux kernel did not verify an address length, which allowed local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application (bnc#959190). - CVE-2015-8575: The scosockbind function in net/bluetooth/sco.c in the Linux kernel did not verify an address length, which allowed local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application (bnc#959190 bnc#959399). - CVE-2015-8767: net/sctp/smsideeffect.c in the Linux kernel did not properly manage the relationship between a lock and a socket, which allowed local users to cause a denial of service (deadlock) via a crafted sctpaccept call (bnc#961509). - CVE-2015-8785: The fusefillwritepages function in fs/fuse/file.c in the Linux kernel allowed local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov (bnc#963765). - CVE-2015-8812: A use-after-free flaw was found in the CXGB3 kernel driver when the network was considered to be congested. This could be used by local attackers to cause machine crashes or potentially code execution (bsc#966437). - CVE-2016-0723: Race condition in the ttyioctl function in drivers/tty/ttyio.c in the Linux kernel allowed local users to obtain sensitive information from kernel memory or cause a denial of service (use-after-free and system crash) by making a TIOCGETD ioctl call during processing of a TIOCSETD ioctl call (bnc#961500). - CVE-2016-2069: Race conditions in TLB syncing was fixed which could leak to information leaks (bnc#963767). - CVE-2016-2384: Removed a double free in the ALSA usb-audio driver in the umidi object which could lead to crashes (bsc#966693). - CVE-2016-2543: Added a missing NULL check at removeevents ioctl in ALSA that could lead to crashes. (bsc#967972). - CVE-2016-2544, CVE-2016-2545, CVE-2016-2546, CVE-2016-2547, CVE-2016-2548, CVE-2016-2549: Various race conditions in ALSAs timer handling were fixed. (bsc#967975, bsc#967974, bsc#967973, bsc#968011, bsc#968012, bsc#968013).

The following non-security bugs were fixed: - Add /etc/modprobe.d/50-xen.conf selecting Xen frontend driver implementation (bsc#957986, bsc#956084, bsc#961658). - alsa: hda - Add one more node in the EAPD supporting candidate list (bsc#963561). - alsa: hda - Apply clock gate workaround to Skylake, too (bsc#966137). - alsa: hda - disable dynamic clock gating on Broxton before reset (bsc#966137). - alsa: hda - Fix playback noise with 24/32 bit sample size on BXT (bsc#966137). - blktap: also call blkifdisconnect() when frontend switched to closed (bsc#952976). - blktap: refine mm tracking (bsc#952976). - block: Always check queue limits for cloned requests (bsc#933782). - block: xen-blkfront: Fix possible NULL ptr dereference (bsc#961658 fate#320200). - bnx2x: Add new device ids under the Qlogic vendor (bsc#964818). - bnx2x: Alloc 4k fragment for each rx ring buffer element (bsc#953369). - bnx2x: fix DMA API usage (bsc#953369). - driver core: Add BUSNOTIFYREMOVEDDEVICE event (bnc#962965). - drivers: xen-blkfront: only talktoblkback() when in XenbusStateInitialising (bsc#961658 fate#320200). - driver: xen-blkfront: move talktoblkback to a more suitable place (bsc#961658 fate#320200). - drm/i915: Change semantics of hwcontextsdisabled (bsc#963276). - drm/i915: Evict CS TLBs between batches (bsc#758040). - drm/i915: Fix SRCCOPY width on 830/845g (bsc#758040). - e1000e: Do not read ICR in Other interrupt (bsc#924919). - e1000e: Do not write lsc to ics in msi-x mode (bsc#924919). - e1000e: Fix msi-x interrupt automask (bsc#924919). - e1000e: Remove unreachable code (bsc#924919). - ec2: Update kabi files and start tracking ec2 - ext3: fix data=journal fast mount/umount hang (bsc#942082). - ext3: NULL dereference in ext3evictinode() (bsc#942082). - firmware: Create directories for external firmware (bsc#959312). - firmware: Simplify directory creation (bsc#959312). - Fix handling of re-write-before-commit for mmapped NFS pages (bsc#964201). - ftdisio: private backport of TIOCMIWAIT (bnc#956375). - iommu/vt-d: Do not change dma domain on dma-mask change (bsc#955925). - jbd: Fix unreclaimed pages after truncate in data=journal mode (bsc#961516). - kabi/severities: Add exception for bnx2xschedulesprtnl() There is no external, 3rd party modules use the symbol and the bnx2xschedulesprtnl symbol is only used in the bnx2x driver. (bsc#953369) - kbuild: create directory for dir/file.o (bsc#959312). - llist/xen-blkfront: implement safe version of llistforeachentry (bsc#961658 fate#320200). - lpfc: Fix null ndlp dereference in targetresethandler (bsc#951392). - memcg: do not hang on OOM when killed by userspace OOM access to memory reserves (bnc#969571). - mm-memcg-print-statistics-from-live-counters-fix (bnc#969307). - nfsv4: Recovery of recalled read delegations is broken (bsc#956514). - nvme: Clear BIOSEGVALID flag in nvmebiosplit() (bsc#954992). - nvme: default to 4k device page size (bsc#967042). - pci: leave MEM and IO decoding disabled during 64-bit BAR sizing, too (bsc#951815). - pci: Update VPD size with correct length (bsc#958906). - pl2303: fix TIOCMIWAIT (bnc#959649). - pl2303: introduce private disconnect method (bnc#959649). - qeth: initialize netdevice with carrier off (bnc#958000, LTC#136514). - Refresh patches.xen/xen3-08-x86-ldt-make-modifyldt-synchronous.patch (bsc#959705). - Refresh patches.xen/xen-vscsi-large-requests (refine fix and also address bsc#966094). - rt: v3.0-rt relevant @stable-rt patches from v3.2-rt rt111 update - s390/cio: collect format 1 channel-path description data (bnc#958000, LTC#136434). - s390/cio: ensure consistent measurement state (bnc#958000, LTC#136434). - s390/cio: fix measurement characteristics memleak (bnc#958000, LTC#136434). - s390/cio: update measurement characteristics (bnc#958000, LTC#136434). - s390/dasd: fix failfast for disconnected devices (bnc#958000, LTC#135138). - s390/sclp: Determine HSA size dynamically for zfcpdump (bnc#958000, LTC#136143). - s390/sclp: Move declarations for sclpsdias into separate header file (bnc#958000, LTC#136143). - scsidhrdac: always retry MODE SELECT on command lock violation (bsc#956949). - sunrpc: restore fair scheduling to priority queues (bsc#955308). - supported.conf: Add xen-blkfront. - tg3: 5715 does not link up when autoneg off (bsc#904035). - Update patches.fixes/mm-exclude-reserved-pages-from-dirtyable-memory-fix.patch (bnc#940017, bnc#949298, bnc#947128). - usb: ftdisio: fix race condition in TIOCMIWAIT, and abort of TIOCMIWAIT when the device is removed (bnc#956375). - usb: ftdisio: fix status line change handling for TIOCMIWAIT and TIOCGICOUNT (bnc#956375). - usb: ftdisio: fix tiocmget and tiocmset return values (bnc#956375). - usb: ftdisio: fix tiocmget indentation (bnc#956375). - usb: ftdisio: optimise charsinbuffer (bnc#956375). - usb: ftdisio: refactor modem-control status retrieval (bnc#956375). - usb: ftdisio: remove unnecessary memset (bnc#956375). - usb: ftdisio: use ftdigetmodemstatus in charsinbuffer (bnc#956375). - usb: ftdisio: use generic charsinbuffer (bnc#956375). - usb: pl2303: clean up line-status handling (bnc#959649). - usb: pl2303: only wake up MSR queue on changes (bnc#959649). - usb: pl2303: remove bogus deltamsrwait wake up (bnc#959649). - usb: serial: export usbserialgenericcharsinbuffer (bnc#956375). - usb: serial: ftdisio: Add missing charsinbuffer function (bnc#956375). - vmxnet3: fix building without CONFIGPCIMSI (bsc#958912). - vmxnet3: fix netpoll race condition (bsc#958912). - xen/blkback: Persistent grant maps for xen blk drivers (bsc#961658 fate#320200). - xen/blkback: persistent-grants fixes (bsc#961658 fate#320200). - xen-blkfront: allow building in our Xen environment (bsc#961658 fate#320200). - xen/blk[front|back]: Enhance discard support with secure erasing support (bsc#961658 fate#320200). - xen/blk[front|back]: Squash blkifrequestrw and blkifrequestdiscard together (bsc#961658 fate#320200). - xen-blkfront: check for null drvdata in blkbackchanged (XenbusStateClosing) (bsc#961658 fate#320200). - xen-blkfront: do not add indirect pages to list when !featurepersistent (bsc#961658 fate#320200). - xen/blkfront: do not put bdev right after getting it (bsc#961658 fate#320200). - xen-blkfront: drop the use of llistforeachentrysafe (bsc#961658 fate#320200). - xen, blkfront: factor out flush-related checks from doblkifrequest() (bsc#961658 fate#320200). - xen-blkfront: fix accounting of reqs when migrating (bsc#961658 fate#320200). - xen-blkfront: fix a deadlock while handling discard response (bsc#961658 fate#320200). - xen/blkfront: Fix crash if backend does not follow the right states (bsc#961658 fate#320200). - xen-blkfront: free allocated page (bsc#961658 fate#320200). - xen-blkfront: handle backend CLOSED without CLOSING (bsc#961658 fate#320200). - xen-blkfront: handle bvecs with partial data (bsc#961658 fate#320200). - xen-blkfront: Handle discard requests (bsc#961658 fate#320200). - xen-blkfront: If no barrier or flush is supported, use invalid operation (bsc#961658 fate#320200). - xen-blkfront: improve aproximation of required grants per request (bsc#961658 fate#320200). - xen/blkfront: improve protection against issuing unsupported REQFUA (bsc#961658 fate#320200). - xen-blkfront: Introduce a 'max' module parameter to alter the amount of indirect segments (bsc#961658 fate#320200). - xen-blkfront: make blkifiolock spinlock per-device (bsc#961658 fate#320200). - xen-blkfront: plug device number leak in xlblkinit() error path (bsc#961658 fate#320200). - xen-blkfront: pre-allocate pages for requests (bsc#961658 fate#320200). - xen-blkfront: remove frame list from blkshadow (bsc#961658 fate#320200). - xen/blkfront: remove redundant flushop (bsc#961658 fate#320200). - xen-blkfront: remove type check from blkfrontsetupdiscard (bsc#961658 fate#320200). - xen-blkfront: restore the non-persistent data path (bsc#961658 fate#320200). - xen-blkfront: revoke foreign access for grants not mapped by the backend (bsc#961658 fate#320200). - xen-blkfront: set blkqueuemaxhwsectors correctly (bsc#961658 fate#320200). - xen-blkfront: Silence pfn maybe-uninitialized warning (bsc#961658 fate#320200). - xen-blkfront: switch from llist to list (bsc#961658 fate#320200). - xen-blkfront: use a different scatterlist for each request (bsc#961658 fate#320200). - xen-block: implement indirect descriptors (bsc#961658 fate#320200). - xen: consolidate and simplify struct xenbusdriver instantiation (bsc#961658 fate#320200). - xen/panic/x86: Allow cpus to save registers even if they (bnc#940946). - xen/panic/x86: Fix re-entrance problem due to panic on (bnc#937444). - xen/pvhvm: If xenplatformpci=0 is set do not blow up (v4) (bsc#961658 fate#320200). - xen: Update Xen config files (enable upstream block frontend). - xen/x86/mm: Add barriers and document switchmm()-vs-flush synchronization (bnc#963767). - xen: x86: mm: drop TLB flush from ptepsetaccessflags (bsc#948330). - xen: x86: mm: only do a local tlb flush in ptepsetaccessflags() (bsc#948330). - xfs: Skip dirty pages in ->releasepage (bnc#912738, bnc#915183). - zfcp: fix fchost porttype with NPIV (bnc#958000, LTC#132479).