[LU-10164] kernel update [SLES12 SP3 4.4.92-6.18]

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.11.0, Lustre 2.10.2
• Severity: 3
• Assignee: Bob Glossman (Inactive)
• Reporter: Bob Glossman (Inactive)

Description

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.92 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-1000252: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service (assertion failure, and hypervisor hang or crash) via an out-of bounds guest_irq value, related to arch/x86/kvm/vmx.c and virt/kvm/eventfd.c (bnc#1058038).
• CVE-2017-11472: The acpi_ns_terminate() function in drivers/acpi/acpica/nsutils.c in the Linux kernel did not flush the operand cache and causes a kernel stack dump, which allowed local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism (in the kernel through 4.9) via a crafted ACPI table (bnc#1049580).
• CVE-2017-12134: The xen_biovec_phys_mergeable function in drivers/xen/biomerge.c in Xen might allow local OS guest users to corrupt block device data streams and consequently obtain sensitive memory information, cause a denial of service, or gain host OS privileges by leveraging incorrect block IO merge-ability calculation (bnc#1051790 bsc#1053919).
• CVE-2017-12153: A security flaw was discovered in the nl80211_set_rekey_data() function in net/wireless/nl80211.c in the Linux kernel This function did not check whether the required attributes are present in a Netlink request. This request can be issued by a user with the CAP_NET_ADMIN capability and may result in a NULL pointer dereference and system crash (bnc#1058410).
• CVE-2017-12154: The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel did not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allowed KVM L2 guest OS users to obtain read and write access to the hardware CR8 register (bnc#1058507).
• CVE-2017-13080: Wi-Fi Protected Access (WPA and WPA2) allowed reinstallation of the Group Temporal Key (GTK) during the group key handshake, allowing an attacker within radio range to replay frames from access points to clients (bnc#1056061 1063479 1063667 1063671).
• CVE-2017-14051: An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel allowed local users to cause a denial of service (memory corruption and system crash) by leveraging root access (bnc#1056588).
• CVE-2017-14106: The tcp_disconnect function in net/ipv4/tcp.c in the Linux kernel allowed local users to cause a denial of service (__tcp_select_window divide-by-zero error and system crash) by triggering a disconnect within a certain tcp_recvmsg code path (bnc#1056982).
• CVE-2017-14489: The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel allowed local users to cause a denial of service (panic) by leveraging incorrect length validation (bnc#1059051).
• CVE-2017-15265: Use-after-free vulnerability in the Linux kernel before 4.14-rc5 allowed local users to have unspecified impact via vectors related to /dev/snd/seq (bnc#1062520).
• CVE-2017-15649: net/packet/af_packet.c in the Linux kernel allowed local users to gain privileges via crafted system calls that trigger mishandling of packet_fanout data structures, because of a race condition (involving fanout_add and packet_do_bind) that leads to a use-after-free, a different vulnerability than CVE-2017-6346 (bnc#1064388).

Issue Links

• is related to: LU-9735 Sles12Sp2 and 2.9 getcwd() sometimes fails
• is related to: LU-10339 kernel update [SLES12 SP3 4.4.92-6.30]
• is related to: LU-10023 kernel update [SLES12 SP3 4.4.82-6.9]

Comments

[Peter Jones]

Landed for 2.11

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch https://review.whamcloud.com/29793/
Subject: LU-10164 kernel: kernel update [SLES12 SP3 4.4.92-6.18]
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: 88a6260068d4fd110c8f56018c2222fb4d245ea0

[Gerrit Updater]

John L. Hammond ([e-mail]) merged in patch https://review.whamcloud.com/29825/
Subject: LU-10164 kernel: kernel update [SLES12 SP3 4.4.92-6.18]
Project: fs/lustre-release
Branch: b2_10
Current Patch Set:
Commit: 5a3708e38f78d8f3bf853b24b1746891c771ae15

[Gerrit Updater]

Bob Glossman ([e-mail]) uploaded a new patch: https://review.whamcloud.com/29825
Subject: LU-10164 kernel: kernel update [SLES12 SP3 4.4.92-6.18]
Project: fs/lustre-release
Branch: b2_10
Current Patch Set: 1
Commit: 5b7e76d7748d274e3822728ce92f7261dc1edb44

[Gerrit Updater]

Bob Glossman ([e-mail]) uploaded a new patch: https://review.whamcloud.com/29793
Subject: LU-10164 kernel: kernel update [SLES12 SP3 4.4.92-6.18]
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 880dc5e117ba65b392f9d54d4ca53b90e76a1d89

[Bob Glossman (Inactive)]

• qeth: add network device features for VLAN devices (bnc#1053472, LTC#157385).
• qlge: avoid memcpy buffer overflow (bnc#1012382).
• r8169: Add support for restarting auto-negotiation (bsc#1050742).
• r8169:Correct the way of setting RTL8168DP ephy (bsc#1050742).
• r8169:fix system hange problem (bsc#1050742).
• r8169:Fix typo in setting RTL8168H PHY parameter (bsc#1050742).
• r8169:Fix typo in setting RTL8168H PHY PFM mode (bsc#1050742).
• r8169:Remove unnecessary phy reset for pcie nic when setting link spped (bsc#1050742).
• r8169:Update the way of reading RTL8168H PHY register "rg_saw_cnt" (bsc#1050742).
• rda=sRDMA: Fix the composite message user notification (bnc#1012382).
• rdma/bnxt_re: Allocate multiple notification queues (bsc#1037579).
• rdma/bnxt_re: Implement the alloc/get_hw_stats callback (bsc#1037579).
• rdma: Fix return value check for ib_get_eth_speed() (bsc#1056596).
• rdma/qedr: Parse VLAN ID correctly and ignore the value of zero (bsc#1019695 FATE#321703 bsc#1019699 FATE#321702 bsc#1022604 FATE#321747).
• rdma/qedr: Parse vlan priority as sl (bsc#1019695 FATE#321703 bsc#1019699 FATE#321702 bsc#1022604 FATE#321747).
• rds: ib: add error handle (bnc#1012382).
• Remove patch 0407-nvme_fc-change-failure-code-on-remoteport-connectivi.patch (bsc#1037838)
• Remove superfluous hunk in bigmem backport (bsc#1064436).
• Revert "ceph: SetPageError() for writeback pages if writepages fails" (bsc#1048228).
• Revert "ipv6: add rcu grace period before freeing fib6_node" (kabi).
• Revert "ipv6: fix sparse warning on rt6i_node" (kabi).
• Revert "net: fix percpu memory leaks" (bnc#1012382).
• Revert "net: phy: Correctly process PHY_HALTED in phy_stop_machine()" (bnc#1012382).
• Revert "net: use lib/percpu_counter API for fragmentation mem accounting" (bnc#1012382).
• Revert "Update patches.fixes/xfs-refactor-log-record-unpack-and-data-processing.patch (bsc#1043598, bsc#1036215)." This reverts commit 54e17b011580b532415d2aee5e875c8cf0460df4.
• Revert "x86/acpi: Enable MADT APIs to return disabled apicids" (bnc#1056230).
• Revert "x86/acpi: Set persistent cpuid <-> nodeid mapping when booting" (bnc#1056230).
• Revert "xfs: detect and handle invalid iclog size set by mkfs (bsc#1043598)." This reverts commit caf0b124b172568b3e39544cb9abfdaa7fb3d852.
• Revert "xfs: detect and trim torn writes during log recovery (bsc#1036215)." This reverts commit a7a591776e8628a33f0223ca9a3f46c1e79bd908.
• Revert "xfs: refactor and open code log record crc check (bsc#1036215)." This reverts commit 6aef5e1fee21246222618f2337c84d6093281561.
• Revert "xfs: refactor log record start detection into a new helper (bsc#1036215)." This reverts commit a424c875bdc05dcf3bb0d1af740b644773091cf0.
• Revert "xfs: return start block of first bad log record during recovery (bsc#1036215)." This reverts commit cb0ce8b2f1435d7ac9aaeb5d5709e73946d55bed.
• Revert "xfs: support a crc verification only log record pass (bsc#1036215)." This reverts commit f5c0c41b1f3626750f1f0d76b6d71fac673854d2.
• Rewrote KVM kABI fix patches for addressing regressions (bsc#1063570)
• rtnetlink: fix rtnl_vfinfo_size (bsc#1056261).
• s390/cpcmd,vmcp: avoid GFP_DMA allocations (bnc#1060249, LTC#159112).
• s390/diag: add diag26c support (bnc#1053472, LTC#156729).
• s390: export symbols for crash-kmp (bsc#1053915).
• s390: Include uapi/linux/if_ether.h instead of linux/if_ether.h (bsc#1053472).
• s390/pci: do not cleanup in arch_setup_msi_irqs (bnc#1053472, LTC#157731).
• s390/pci: fix handling of PEC 306 (bnc#1053472, LTC#157731).
• s390/pci: improve error handling during fmb (de)registration (bnc#1053472, LTC#157731).
• s390/pci: improve error handling during interrupt deregistration (bnc#1053472, LTC#157731).
• s390/pci: improve pci hotplug (bnc#1053472, LTC#157731).
• s390/pci: improve unreg_ioat error handling (bnc#1053472, LTC#157731).
• s390/pci: introduce clp_get_state (bnc#1053472, LTC#157731).
• s390/pci: provide more debug information (bnc#1053472, LTC#157731).
• s390/pci: recognize name clashes with uids (bnc#1053472, LTC#157731).
• s390/qdio: avoid reschedule of outbound tasklet once killed (bnc#1060249, LTC#159885).
• s390/qeth: no ETH header for outbound AF_IUCV (bnc#1053472, LTC#156276).
• s390/qeth: size calculation outbound buffers (bnc#1053472, LTC#156276).
• s390/qeth: use diag26c to get MAC address on L2 (bnc#1053472, LTC#156729).
• s390/topology: alternative topology for topology-less machines (bnc#1060249, LTC#159177).
• s390/topology: always use s390 specific sched_domain_topology_level (bnc#1060249, LTC#159177).
• s390/topology: enable / disable topology dynamically (bnc#1060249, LTC#159177).
• sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs (bnc#1012382).
• scsi: csiostor: add check for supported fw version (bsc#1005776).
• scsi: csiostor: add support for Chelsio T6 adapters (bsc#1005776).
• scsi: csiostor: fix use after free in csio_hw_use_fwconfig() (bsc#1005776).
• scsi: csiostor: switch to pci_alloc_irq_vectors (bsc#1005776).
• scsi: csiostor: update module version (bsc#1052093).
• scsi: cxgb4i: assign rxqs in round robin mode (bsc#1052094).
• scsi: fixup kernel warning during rmmod() (bsc#1052360).
• scsi: hisi_sas: add missing break in switch statement (bsc#1056849).
• scsi: ILLEGAL REQUEST + ASC==27 => target failure (bsc#1059465).
• scsi: libfc: fix a deadlock in fc_rport_work (bsc#1063695).
• scsi: lpfc: Ensure io aborts interlocked with the target (bsc#1056587).
• scsi: megaraid_sas: Check valid aen class range to avoid kernel panic (bnc#1012382).
• scsi: megaraid_sas: Return pended IOCTLs with cmd_status MFI_STAT_WRONG_STATE in case adapter is dead (bnc#1012382).
• scsi: qedf: Fix a potential NULL pointer dereference (bsc#1048912).
• scsi: qedf: Limit number of CQs (bsc#1040813).
• scsi: qedi: off by one in qedi_get_cmd_from_tid() (bsc#1004527, FATE#321744).
• scsi: qla2xxx: Fix uninitialized work element (bsc#1019675,FATE#321701).
• scsi: scsi_transport_fc: Also check for NOTPRESENT in fc_remote_port_add() (bsc#1037890).
• scsi: scsi_transport_fc: set scsi_target_id upon rescan (bsc#1058135).
• scsi: sd: Do not override max_sectors_kb sysfs setting (bsc#1025461).
• scsi: sd: Remove LBPRZ dependency for discards (bsc#1060985). This patch is originally part of a larger series which can't be easily backported to SLE-12. For a reasoning why we think it's safe to apply, see bsc#1060985, comment 20.
• scsi: sg: close race condition in sg_remove_sfp_usercontext() (bsc#1064206).
• scsi: sg: do not return bogus Sg_requests (bsc#1064206).
• scsi: sg: factor out sg_fill_request_table() (bnc#1012382).
• scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE (bnc#1012382).
• scsi: sg: off by one in sg_ioctl() (bnc#1012382).
• scsi: sg: only check for dxfer_len greater than 256M (bsc#1064206).
• scsi: sg: remove 'save_scat_len' (bnc#1012382).
• scsi: sg: use standard lists for sg_requests (bnc#1012382).
• scsi: storvsc: fix memory leak on ring buffer busy (bnc#1012382).
• scsi_transport_fc: Also check for NOTPRESENT in fc_remote_port_add() (bsc#1037890).
• scsi: zfcp: add handling for FCP_RESID_OVER to the fcp ingress path (bnc#1012382).
• scsi: zfcp: fix capping of unsuccessful GPN_FT SAN response trace records (bnc#1012382).
• scsi: zfcp: fix missing trace records for early returns in TMF eh handlers (bnc#1012382).
• scsi: zfcp: fix passing fsf_req to SCSI trace on TMF to correlate with HBA (bnc#1012382).
• scsi: zfcp: fix payload with full FCP_RSP IU in SCSI trace records (bnc#1012382).
• scsi: zfcp: fix queuecommand for scsi_eh commands when DIX enabled (bnc#1012382).
• scsi: zfcp: trace HBA FSF response by default on dismiss or timedout late response (bnc#1012382).
• scsi: zfcp: trace high part of "new" 64 bit SCSI LUN (bnc#1012382).
• seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter() (bnc#1012382).
• sh_eth: use correct name for ECMR_MPDE bit (bnc#1012382).
• skd: Avoid that module unloading triggers a use-after-free (bnc#1012382).
• skd: Submit requests to firmware before triggering the doorbell (bnc#1012382).
• SMB3: Do not ignore O_SYNC/O_DSYNC and O_DIRECT flags (bnc#1012382).
• SMB: Validate negotiate (to protect against downgrade) even if signing off (bnc#1012382).
• staging: iio: ad7192: Fix - use the dedicated reset function avoiding dma from stack (bnc#1012382).
• stm class: Fix a use-after-free (bnc#1012382).
• supported.conf: clear mistaken external support flag for cifs.ko (bsc#1053802).
• supported.conf: enable dw_mmc-rockchip driver References: bsc#1064064
• swiotlb-xen: implement xen_swiotlb_dma_mmap callback (bnc#1012382).
• sysctl: fix lax sysctl_check_table() sanity check (bsc#1048893).
• sysctl: fold sysctl_writes_strict checks into helper (bsc#1048893).
• sysctl: kdoc'ify sysctl_writes_strict (bsc#1048893).
• sysctl: simplify unsigned int support (bsc#1048893).
• team: call netdev_change_features out of team lock (bsc#1055567).
• team: fix memory leaks (bnc#1012382).
• timer/sysclt: Restrict timer migration sysctl values to 0 and 1 (bnc#1012382).
• tpm: fix: return rc when devm_add_action() fails (bsc#1020645, fate#321435, fate#321507, fate#321600, bsc#1034048, git-fixes 8e0ee3c9faed).
• tpm: read burstcount from TPM_STS in one 32-bit transaction (bsc#1020645, fate#321435, fate#321507, fate#321600, bsc#1034048, git-fixes 27084efee0c3).
• tpm_tis_core: Choose appropriate timeout for reading burstcount (bsc#1020645, fate#321435, fate#321507, fate#321600, bsc#1034048, git-fixes aec04cbdf723).
• tpm_tis_core: convert max timeouts from msec to jiffies (bsc#1020645, fate#321435, fate#321507, fate#321600, bsc#1034048, git-fixes aec04cbdf723).
• tracing: Apply trace_clock changes to instance max buffer (bnc#1012382).
• tracing: Erase irqsoff trace with empty write (bnc#1012382).
• tracing: Fix trace_pipe behavior for instance traces (bnc#1012382).
• ttpci: address stringop overflow warning (bnc#1012382).
• tty: fix __tty_insert_flip_char regression (bnc#1012382).
• tty: goldfish: Fix a parameter of a call to free_irq (bnc#1012382).
• tty: improve tty_insert_flip_char() fast path (bnc#1012382).
• tty: improve tty_insert_flip_char() slow path (bnc#1012382).
• tty: pl011: fix initialization order of QDF2400 E44 (bsc#1054082).
• tty: serial: msm: Support more bauds (git-fixes).
• ubifs: Correctly evict xattr inodes (bsc#1012829).
• ubifs: Do not leak kernel memory to the MTD (bsc#1012829).
• Update patches.drivers/0029-perf-xgene-Remove-bogus-IS_ERR-check.patch (bsc#1036737).
• Update patches.drivers/tpm-141-fix-RC-value-check-in-tpm2_seal_trusted.patch (bsc#1020645, fate#321435, fate#321507, fate#321600, bsc#1034048, git-fixes 5ca4c20cfd37).
• usb: chipidea: vbus event may exist before starting gadget (bnc#1012382).
• usb: core: fix device node leak (bsc#1047487).
• usb: core: harden cdc_parse_cdc_header (bnc#1012382).
• usb: devio: Do not corrupt user memory (bnc#1012382).
• usb: dummy-hcd: fix connection failures (wrong speed) (bnc#1012382).
• usb: dummy-hcd: Fix erroneous synchronization change (bnc#1012382).
• usb: dummy-hcd: fix infinite-loop resubmission bug (bnc#1012382).
• usb: fix out-of-bounds in usb_set_configuration (bnc#1012382).
• usb: gadgetfs: fix copy_to_user while holding spinlock (bnc#1012382).
• usb: gadgetfs: Fix crash caused by inadequate synchronization (bnc#1012382).
• usb: gadget: inode.c: fix unbalanced spin_lock in ep0_write (bnc#1012382).
• usb: gadget: mass_storage: set msg_registered after msg registered (bnc#1012382).
• usb: gadget: udc: atmel: set vbus irqflags explicitly (bnc#1012382).
• usb: g_mass_storage: Fix deadlock when driver is unbound (bnc#1012382).
• usb: Increase quirk delay for USB devices (bnc#1012382).
• usb: pci-quirks.c: Corrected timeout values used in handshake (bnc#1012382).
• usb: plusb: Add support for PL-27A1 (bnc#1012382).
• usb: renesas_usbhs: fix the BCLR setting condition for non-DCP pipe (bnc#1012382).
• usb: renesas_usbhs: fix usbhsf_fifo_clear() for RX direction (bnc#1012382).
• usb: serial: mos7720: fix control-message error handling (bnc#1012382).
• usb: serial: mos7840: fix control-message error handling (bnc#1012382).
• usb-storage: unusual_devs entry to fix write-access regression for Seagate external drives (bnc#1012382).
• usb: uas: fix bug in handling of alternate settings (bnc#1012382).
• uwb: ensure that endpoint is interrupt (bnc#1012382).
• uwb: properly check kthread_run return value (bnc#1012382).
• vfs: Return -ENXIO for negative SEEK_HOLE / SEEK_DATA offsets (bnc#1012382).
• video: fbdev: aty: do not leak uninitialized padding in clk to userspace (bnc#1012382).
• Workaround for kABI compatibility with DP-MST patches (bsc#1055493).
• x86/acpi: Restore the order of CPU IDs (bnc#1056230).
• x86/cpu/amd: Hide unused legacy_fixup_core_id() function (bsc#1060229).
• x86/cpu/amd: Limit cpu_core_id fixup to families older than F17h (bsc#1060229).
• x86/cpu: Remove unused and undefined __generic_processor_info() declaration (bnc#1056230).
• x86 edac, sb_edac.c: Take account of channel hashing when needed (bsc#1061721).
• x86/fpu: Do not let userspace set bogus xcomp_bv (bnc#1012382).
• x86/fsgsbase/64: Report FSBASE and GSBASE correctly in core dumps (bnc#1012382).
• x86/ldt: Fix off by one in get_segment_base() (bsc#1061872).
• x86/mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds() (bsc#1058512).
• x86/mm: Fix fault error path using unsafe vma pointer (fate#321300).
• x86/mm: Fix use-after-free of ldt_struct (bsc#1055963).
• x86/mshyperv: Remove excess #includes from mshyperv.h (fate#320485).
• xfs/dmapi: fix incorrect file->f_path.dentry->d_inode usage (bsc#1055896).
• xfs: fix inobt inode allocation search optimization (bsc#1012829).
• xfs: handle error if xfs_btree_get_bufs fails (bsc#1059863).
• xfs: nowait aio support (FATE#321994).
• xfs: remove kmem_zalloc_greedy (bnc#1012382).
• xgene: Always get clk source, but ignore if it's missing for SGMII ports (bsc#1048501).
• xgene: Do not fail probe, if there is no clk resource for SGMII interfaces (bsc#1048501).
• xhci: fix finding correct bus_state structure for USB 3.1 hosts (bnc#1012382).