[LU-10845] kernel update [SLES12 SP3 4.4.120-94.17]

• Type: Bug
• Resolution: Fixed
• Priority: Minor
• Fix Version/s: Lustre 2.12.0, Lustre 2.10.4
• Severity: 3
• Assignee: Bob Glossman (Inactive)
• Reporter: Bob Glossman (Inactive)

Description

The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.120 to receive various security and bugfixes.

The following security bugs were fixed:

• CVE-2017-13166: An elevation of privilege vulnerability in the v4l2 video driver. (bnc#1072865).
• CVE-2017-15951: The KEYS subsystem did not correctly synchronize the actions of updating versus finding a key in the "negative" state to avoid a race condition, which allowed local users to cause a denial of service or possibly have unspecified other impact via crafted system calls (bnc#1062840 bnc#1065615).
• CVE-2017-16644: The hdpvr_probe function in drivers/media/usb/hdpvr/hdpvr-core.c allowed local users to cause a denial of service (improper error handling and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067118).
• CVE-2017-16912: The "get_pipe()" function (drivers/usb/usbip/stub_rx.c) allowed attackers to cause a denial of service (out-of-bounds read) via a specially crafted USB over IP packet (bnc#1078673).
• CVE-2017-16913: The "stub_recv_cmd_submit()" function (drivers/usb/usbip/stub_rx.c) when handling CMD_SUBMIT packets allowed attackers to cause a denial of service (arbitrary memory allocation) via a specially crafted USB over IP packet (bnc#1078672).
• CVE-2017-17975: Use-after-free in the usbtv_probe function in drivers/media/usb/usbtv/usbtv-core.c allowed attackers to cause a denial of service (system crash) or possibly have unspecified other impact by triggering failure of audio registration, because a kfree of the usbtv data structure occurs during a usbtv_video_free call, but the usbtv_video_fail label's code attempts to both access and free this data structure (bnc#1074426).
• CVE-2017-18174: The amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading to a double free (bnc#1080533).
• CVE-2017-18208: The madvise_willneed function in mm/madvise.c allowed local users to cause a denial of service (infinite loop) by triggering use of MADVISE_WILLNEED for a DAX mapping (bnc#1083494).
• CVE-2018-1000026: A insufficient input validation vulnerability in bnx2x network card driver could result in DoS: Network card firmware assertion takes card off-line. This attack appear to be exploitable via An attacker on a must pass a very large, specially crafted packet to the bnx2x card. This can be done from an untrusted guest VM. (bnc#1079384).
• CVE-2018-8087: Memory leak in the hwsim_new_radio_nl function in drivers/net/wireless/mac80211_hwsim.c allowed local users to cause a denial of service (memory consumption) by triggering an out-of-array error case (bnc#1085053).
• CVE-2018-1068: Insufficient user provided offset checking in the ebtables compat code allowed local attackers to overwrite kernel memory and potentially execute code. (bsc#1085107)

Issue Links

• is related to: LU-10944 kernel update [SLES12 SP3 4.4.126-94.22]
• is related to: LU-10731 kernel update [SLES12 SP3 4.4.114-94.14]

Comments

[Peter Jones]

Landed for 2.12

[Gerrit Updater]

Oleg Drokin ([e-mail]) merged in patch https://review.whamcloud.com/31762/
Subject: LU-10845 kernel: kernel update [SLES12 SP3 4.4.120-94.17]
Project: fs/lustre-release
Branch: master
Current Patch Set:
Commit: c2b788e7bfc387739a5f2e661920f0140cbc9eee

[Gerrit Updater]

John L. Hammond ([e-mail]) merged in patch https://review.whamcloud.com/31763/
Subject: LU-10845 kernel: kernel update [SLES12 SP3 4.4.120-94.17]
Project: fs/lustre-release
Branch: b2_10
Current Patch Set:
Commit: ffe4bc54485483a5e8784c1bdae16e854114fa1c

[Gerrit Updater]

Bob Glossman ([e-mail]) uploaded a new patch: https://review.whamcloud.com/31763
Subject: LU-10845 kernel: kernel update [SLES12 SP3 4.4.120-94.17]
Project: fs/lustre-release
Branch: b2_10
Current Patch Set: 1
Commit: 2dddfd10e65f89c18b4853b87879b34d7f749204

[Gerrit Updater]

Bob Glossman ([e-mail]) uploaded a new patch: https://review.whamcloud.com/31762
Subject: LU-10845 kernel: kernel update [SLES12 SP3 4.4.120-94.17]
Project: fs/lustre-release
Branch: master
Current Patch Set: 1
Commit: 4ee320bf639c05ea067d7b17f121f34fbe6b419f

[Bob Glossman (Inactive)]

• sctp: make use of pre-calculated len (bnc#1012382).
• selinux: ensure the context is NUL terminated in security_context_to_sid_core() (bnc#1012382).
• selinux: general protection fault in sock_has_perm (bnc#1012382).
• selinux: skip bounded transition processing if the policy isn't loaded (bnc#1012382).
• serial: 8250_mid: fix broken DMA dependency (bnc#1012382).
• serial: 8250_uniphier: fix error return code in uniphier_uart_probe() (bsc#1031717).
• serial: imx: Only wakeup via RTSDEN bit if the system has RTS/CTS (bnc#1012382).
• series.conf: disable qla2xxx patches (bsc#1043725)
• sget(): handle failures of register_shrinker() (bnc#1012382).
• signal/openrisc: Fix do_unaligned_access to send the proper signal (bnc#1012382).
• signal/sh: Ensure si_signo is initialized in do_divide_error (bnc#1012382).
• SolutionEngine771x: fix Ether platform data (bnc#1012382).
• spi: atmel: fixed spin_lock usage inside atmel_spi_remove (bnc#1012382).
• spi: imx: do not access registers while clocks disabled (bnc#1012382).
• spi: sun4i: disable clocks in the remove function (bnc#1012382).
• ssb: mark ssb_bus_register as __maybe_unused (bnc#1012382).
• staging: android: ashmem: Fix a race condition in pin ioctls (bnc#1012382).
• staging: iio: adc: ad7192: fix external frequency setting (bnc#1012382).
• staging: rtl8188eu: Fix incorrect response to SIOCGIWESSID (bnc#1012382).
• staging: ste_rmi4: avoid unused function warnings (bnc#1012382).
• staging: unisys: visorinput depends on INPUT (bnc#1012382).
• staging: wilc1000: fix kbuild test robot error (bnc#1012382).
• sunrpc: Allow connect to return EHOSTUNREACH (bnc#1012382).
• target: Add support for TMR percpu reference counting (bsc#1043726,FATE#324770).
• target: Add TARGET_SCF_LOOKUP_LUN_FROM_TAG support for ABORT_TASK (bsc#1043726,FATE#324770).
• tc1100-wmi: fix build warning when CONFIG_PM not enabled (bnc#1012382).
• tc358743: fix register i2c_rd/wr function fix (git-fixes).
• tc358743: fix register i2c_rd/wr functions (bnc#1012382).
• tcp: do not set rtt_min to 1 (bsc#1042286).
• tcp: release sk_frag.page in tcp_disconnect (bnc#1012382).
• test_bpf: fix the dummy skb after dissector changes (bsc#1042286).
• tg3: Add workaround to restrict 5762 MRRS to 2048 (bnc#1012382).
• tg3: Enable PHY reset in MTU change path for 5720 (bnc#1012382).
• thermal: fix INTEL_SOC_DTS_IOSF_CORE dependencies (bnc#1012382).
• thermal: spear: use __maybe_unused for PM functions (bnc#1012382).
• tlan: avoid unused label with PCI=n (bnc#1012382).
• tools build: Add tools tree support for 'make -s' (bnc#1012382).
• tpm-dev-common: Reject too short writes (bsc#1020645, git-fixes).
• tpm: fix potential buffer overruns caused by bit glitches on the bus (bsc#1020645, git-fixes).
• tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus (bsc#1020645, git-fixes).
• tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus (bsc#1020645, git-fixes).
• tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus (bsc#1020645, git-fixes).
• tpm_tis: fix potential buffer overruns caused by bit glitches on the bus (bsc#1020645, git-fixes).
• tty: cyclades: cyz_interrupt is only used for PCI (bnc#1012382).
• tty: hvc_xen: hide xen_console_remove when unused (bnc#1012382).
• tty: mxser: Remove ASYNC_CLOSING (bnc#1072363).
• ubi: block: Fix locking for idr_alloc/idr_remove (bnc#1012382).
• udp: restore UDPlite many-cast delivery (bsc#1042286).
• usb: build drivers/usb/common/ when USB_SUPPORT is set (bnc#1012382).
• usb: cdc-acm: Do not log urb submission errors on disconnect (bnc#1012382).
• usb: cdc_subset: only build when one driver is enabled (bnc#1012382).
• usb: dwc3: gadget: Set maxpacket size for ep0 IN (bnc#1012382).
• usb: f_fs: Prevent gadget unbind if it is already unbound (bnc#1012382).
• usb: gadget: do not dereference g until after it has been null checked (bnc#1012382).
• usb: gadget: f_fs: Process all descriptors during bind (bnc#1012382).
• usb: gadget: uvc: Missing files for configfs interface (bnc#1012382).
• usbip: fix 3eee23c3ec14 tcp_socket address still in the status file (bnc#1012382).
• usbip: keep usbip_device sockfd state in sync with tcp_socket (bnc#1012382).
• usbip: list: do not list devices attached to vhci_hcd (bnc#1012382).
• usbip: prevent bind loops on devices attached to vhci_hcd (bnc#1012382).
• usbip: vhci_hcd: clear just the USB_PORT_STAT_POWER bit (bnc#1012382).
• usb: ldusb: add PIDs for new CASSY devices supported by this driver (bnc#1012382).
• usb: musb/ux500: remove duplicate check for dma_is_compatible (bnc#1012382).
• usb: ohci: Proper handling of ed_rm_list to handle race condition between usb_kill_urb() and finish_unlinks() (bnc#1012382).
• usb: option: Add support for FS040U modem (bnc#1012382).
• usb: phy: msm add regulator dependency (bnc#1012382).
• usb: renesas_usbhs: missed the "running" flag in usb_dmac with rx path (bnc#1012382).
• usb: serial: io_edgeport: fix possible sleep-in-atomic (bnc#1012382).
• usb: serial: pl2303: new device id for Chilitag (bnc#1012382).
• usb: serial: simple: add Motorola Tetra driver (bnc#1012382).
• usb: uas: unconditionally bring back host after reset (bnc#1012382).
• v4l: remove MEDIA_TUNER dependency for VIDEO_TUNER (bnc#1012382).
• vb2: V4L2_BUF_FLAG_DONE is set after DQBUF (bnc#1012382).
• vfs: do not do RCU lookup of empty pathnames (bnc#1012382).
• vhost_net: stop device during reset owner (bnc#1012382).
• video: fbdev: atmel_lcdfb: fix display-timings lookup (bnc#1012382).
• video: fbdev/mmp: add MODULE_LICENSE (bnc#1012382).
• video: fbdev: sis: remove unused variable (bnc#1012382).
• video: fbdev: via: remove possibly unused variables (bnc#1012382).
• video: Use bool instead int pointer for get_opt_bool() argument (bnc#1012382).
• virtio_balloon: prevent uninitialized variable use (bnc#1012382).
• vmbus: add per-channel sysfs info (fate#315887, bsc#1082632).
• vmbus: add prefetch to ring buffer iterator (fate#315887, bsc#1082632).
• vmbus: do not acquire the mutex in vmbus_hvsock_device_unregister() (fate#315887, bsc#1082632).
• vmbus: drop unused ring_buffer_info elements (fate#315887, bsc#1082632).
• vmbus: eliminate duplicate cached index (fate#315887, bsc#1082632).
• vmbus: hvsock: add proper sync for vmbus_hvsock_device_unregister() (fate#315887, bsc#1082632).
• vmbus: initialize reserved fields in messages (fate#315887, bsc#1082632).
• vmbus: make channel_message table constant (fate#315887, bsc#1082632).
• vmbus: more host signalling avoidance (fate#315887, bsc#1082632).
• vmbus: refactor hv_signal_on_read (fate#315887, bsc#1082632).
• vmbus: remove unused vmbus_sendpacket_ctl (fate#315887, bsc#1082632).
• vmbus: remove unused vmbus_sendpacket_multipagebuffer (fate#315887, bsc#1082632).
• vmbus: remove unused vmubs_sendpacket_pagebuffer_ctl (fate#315887, bsc#1082632).
• vmbus: Reuse uuid_le_to_bin() helper (fate#315887, bsc#1082632).
• vmbus: simplify hv_ringbuffer_read (fate#315887, bsc#1082632).
• vmbus: unregister device_obj->channels_kset (fate#315887, bsc#1082632).
• vmxnet3: prevent building with 64K pages (bnc#1012382).
• vxlan: consolidate csum flag handling (bsc#1042286).
• vxlan: consolidate output route calculation (bsc#1042286).
• vxlan: consolidate vxlan_xmit_skb and vxlan6_xmit_skb (bsc#1042286).
• vxlan: do not allow overwrite of config src addr (bsc#1042286).
• watchdog: imx2_wdt: restore previous timeout after suspend+resume (bnc#1012382).
• wireless: cw1200: use _maybe_unused to hide pm functions (bnc#1012382).
• x86: add MULTIUSER dependency for KVM (bnc#1012382).
• x86/asm: Fix inline asm call constraints for GCC 4.4 (bnc#1012382).
• x86/boot: Avoid warning for zero-filling .bss (bnc#1012382).
• x86: bpf_jit: small optimization in emit_bpf_tail_call() (bnc#1012382).
• x86/bugs: Drop one "mitigation" from dmesg (bnc#1012382).
• x86/build: Silence the build with "make -s" (bnc#1012382).
• x86/cpu/bugs: Make retpoline module warning conditional (bnc#1012382).
• x86/cpu: Change type of x86_cache_size variable to unsigned int (bnc#1012382).
• x86/entry/64: Separate cpu_current_top_of_stack from TSS.sp0 (bsc#1077560).
• x86/entry/64: Use a per-CPU trampoline stack for IDT entries (bsc#1077560).
• x86: fix build warnign with 32-bit PAE (bnc#1012382).
• x86/fpu/math-emu: Fix possible uninitialized variable use (bnc#1012382).
• x86/hyperv: Implement hv_get_tsc_page() (fate#315887, bsc#1082632).
• x86/hyper-v: include hyperv/ only when CONFIG_HYPERV is set (fate#315887, bsc#1082632).
• x86/hyper-v: Introduce fast hypercall implementation (fate#315887, bsc#1082632).
• x86/hyper-v: Make hv_do_hypercall() inline (fate#315887, bsc#1082632).
• x86/hyperv: Move TSC reading method to asm/mshyperv.h (fate#315887, bsc#1082632).
• x86/kaiser: fix build error with KASAN && !FUNCTION_GRAPH_TRACER (bnc#1012382).
• x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when running nested (bsc#1081431).
• x86/mce: Pin the timer when modifying (bsc#1080851,1076282).
• x86/microcode/AMD: Change load_microcode_amd()'s param to bool to fix preemptibility bug (bnc#1012382).
• x86/microcode/AMD: Do not load when running on a hypervisor (bsc#1081436 bsc#1081437).
• x86/microcode: Do the family check first (bnc#1012382).
• x86/microcode: Do the family check first (bsc#1081436 bsc#1081437).
• x86/mm/kmmio: Fix mmiotrace for page unaligned addresses (bnc#1012382).
• x86/mm/pkeys: Fix fill_sig_info_pkey (fate#321300).
• x86/nospec: Fix header guards names (bnc#1012382).
• x86/oprofile: Fix bogus GCC-8 warning in nmi_setup() (bnc#1012382).
• x86/paravirt: Remove 'noreplace-paravirt' cmdline option (bnc#1012382).
• x86/platform: Add PCI dependency for PUNIT_ATOM_DEBUG (bnc#1012382).
• x86/platform/olpc: Fix resume handler build warning (bnc#1012382).
• x86/pti: Make unpoison of pgd for trusted boot work for real (bnc#1012382).
• x86/ras/inject: Make it depend on X86_LOCAL_APIC=y (bnc#1012382).
• x86/retpoline: Avoid retpolines for built-in __init functions (bnc#1012382).
• x86/retpoline/hyperv: Convert assembler indirect jumps (fate#315887, bsc#1082632).
• x86/retpoline: Remove the esp/rsp thunk (bnc#1012382).
• x86/spectre: Check CONFIG_RETPOLINE in command line parser (bnc#1012382).
• x86/spectre: Fix an error message (git-fixes).
• x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable" (bnc#1012382).
• x86/spectre: Remove the out-of-tree RSB stuffing
• x86/spectre: Simplify spectre_v2 command line parsing (bnc#1012382).
• x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL (bnc#1012382).
• x86/xen: Zero MSR_IA32_SPEC_CTRL before suspend (bnc#1065600).
• xen/gntdev: Fix off-by-one error when unmapping with holes (bnc#1012382).
• xen/gntdev: Fix partial gntdev_mmap() cleanup (bnc#1012382).
• xen-netfront: enable device after manual module load (bnc#1012382).
• xen-netfront: remove warning when unloading module (bnc#1012382).
• xen: XEN_ACPI_PROCESSOR is Dom0-only (bnc#1012382).
• xfrm: check id proto in validate_tmpl() (bnc#1012382).
• xfrm: Fix stack-out-of-bounds read on socket policy lookup (bnc#1012382).
• xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies (bnc#1012382).
• xfrm_user: propagate sec ctx allocation errors (bsc#1042286).
• xfs: do not chain ioends during writepage submission (bsc#1077285 bsc#1043441).
• xfs: factor mapping out of xfs_do_writepage (bsc#1077285 bsc#1043441).
• xfs: Introduce writeback context for writepages (bsc#1077285 bsc#1043441).
• xfs: ioends require logically contiguous file offsets (bsc#1077285 bsc#1043441).
• xfs: quota: check result of register_shrinker() (bnc#1012382).
• xfs: quota: fix missed destroy of qi_tree_lock (bnc#1012382).
• xfs: reinit btree pointer on attr tree inactivation walk (bsc#1078787).
• xfs: remove nonblocking mode from xfs_vm_writepage (bsc#1077285 bsc#1043441).
• xfs: remove xfs_cancel_ioend (bsc#1077285 bsc#1043441).
• xfs: stop searching for free slots in an inode chunk when there are none (bsc#1072739).
• xfs: toggle readonly state around xfs_log_mount_finish (bsc#1073401).
• xfs: ubsan fixes (bnc#1012382).
• xfs: validate sb_logsunit is a multiple of the fs blocksize (bsc#1077513).
• xfs: write unmount record for ro mounts (bsc#1073401).
• xfs: xfs_cluster_write is redundant (bsc#1077285 bsc#1043441).
• xtensa: fix futex_atomic_cmpxchg_inatomic (bnc#1012382).
• zram: fix operator precedence to get offset (bsc#1082979).