SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________
Announcement ID: SUSE-SU-2018:1048-1
Rating: important
References: #1012382 #1019695 #1019699 #1022604 #1031717
#1046610 #1060799 #1064206 #1068032 #1073059
#1073069 #1075428 #1076033 #1077560 #1083574
#1083745 #1083836 #1084223 #1084310 #1084328
#1084353 #1084452 #1084610 #1084699 #1084829
#1084889 #1084898 #1084914 #1084918 #1084967
#1085042 #1085058 #1085224 #1085383 #1085402
#1085404 #1085487 #1085507 #1085511 #1085679
#1085981 #1086015 #1086162 #1086194 #1086357
#1086499 #1086518 #1086607 #1087088 #1087211
#1087231 #1087260 #1087274 #1087659 #1087845
#1087906 #1087999 #1088050 #1088087 #1088241
#1088267 #1088313 #1088324 #1088600 #1088684
#1088871 #802154
Cross-References: CVE-2017-18257 CVE-2018-1091 CVE-2018-7740
CVE-2018-8043 CVE-2018-8822
Affected Products:
SUSE Linux Enterprise Workstation Extension 12-SP3
SUSE Linux Enterprise Software Development Kit 12-SP3
SUSE Linux Enterprise Server 12-SP3
SUSE Linux Enterprise Live Patching 12-SP3
SUSE Linux Enterprise High Availability 12-SP3
SUSE Linux Enterprise Desktop 12-SP3
SUSE CaaS Platform ALL
______________________________________________________________________________
An update that solves 5 vulnerabilities and has 62 fixes is
now available.
Description:
The SUSE Linux Enterprise 12 SP3 kernel was updated to 4.4.126 to receive
various security and bugfixes.
The following security bugs were fixed:
- CVE-2018-1091: In the flush_tmregs_to_thread function in
arch/powerpc/kernel/ptrace.c, a guest kernel crash can be triggered from
unprivileged userspace during a core dump on a POWER host due to a
missing processor feature check and an erroneous use of transactional
memory (TM) instructions in the core dump path, leading to a denial of
service (bnc#1087231).
- CVE-2018-7740: The resv_map_release function in mm/hugetlb.c allowed
local users to cause a denial of service (BUG) via a crafted application
that made mmap system calls and has a large pgoff argument to the
remap_file_pages system call (bnc#1084353).
- CVE-2018-8043: The unimac_mdio_probe function in
drivers/net/phy/mdio-bcm-unimac.c did not validate certain resource
availability, which allowed local users to cause a denial of service
(NULL pointer dereference) (bnc#1084829).
- CVE-2017-18257: The __get_data_block function in fs/f2fs/data.c allowed
local users to cause a denial of service (integer overflow and loop) via
crafted use of the open and fallocate system calls with an FS_IOC_FIEMAP
ioctl. (bnc#1088241)
- CVE-2018-8822: Incorrect buffer length handling in the ncp_read_kernel
function in fs/ncpfs/ncplib_kernel.c could be exploited by malicious
NCPFS servers to crash the kernel or execute code (bnc#1086162).
The following non-security bugs were fixed:
- acpica: Add header support for TPM2 table changes (bsc#1084452).
- acpica: Add support for new SRAT subtable (bsc#1085981).
- acpica: iasl: Update to IORT SMMUv3 disassembling (bsc#1085981).
- acpi/iort: numa: Add numa node mapping for smmuv3 devices (bsc#1085981).
- acpi, numa: fix pxm to online numa node associations (bnc#1012382).
- acpi / pmic: xpower: Fix power_table addresses (bnc#1012382).
- acpi/processor: Fix error handling in __acpi_processor_start()
(bnc#1012382).
- acpi/processor: Replace racy task affinity logic (bnc#1012382).
- add mainline tag to various patches to be able to get further work done
- af_iucv: enable control sends in case of SEND_SHUTDOWN (bnc#1085507,
LTC#165135).
- agp/intel: Flush all chipset writes after updating the GGTT
(bnc#1012382).
- ahci: Add PCI-id for the Highpoint Rocketraid 644L card (bnc#1012382).
- alsa: aloop: Fix access to not-yet-ready substream via cable
(bnc#1012382).
- alsa: aloop: Sync stale timer before release (bnc#1012382).
- alsa: firewire-digi00x: handle all MIDI messages on streaming packets
(bnc#1012382).
- alsa: hda: Add a power_save blacklist (bnc#1012382).
- alsa: hda: add dock and led support for HP EliteBook 820 G3
(bnc#1012382).
- alsa: hda: add dock and led support for HP ProBook 640 G2 (bnc#1012382).
- alsa: hda/realtek - Always immediately update mute LED with pin VREF
(bnc#1012382).
- alsa: hda/realtek - Fix dock line-out volume on Dell Precision 7520
(bnc#1012382).
- alsa: hda/realtek - Fix speaker no sound after system resume
(bsc#1031717).
- alsa: hda - Revert power_save option default value (git-fixes).
- alsa: pcm: Fix UAF in snd_pcm_oss_get_formats() (bnc#1012382).
- alsa: usb-audio: Add a quirck for B&W PX headphones (bnc#1012382).
- alsa: usb-audio: Fix parsing descriptor of UAC2 processing unit
(bnc#1012382).
- apparmor: Make path_max parameter readonly (bnc#1012382).
- arm64: Add ARM_SMCCC_ARCH_WORKAROUND_1 BP hardening support
(bsc#1068032).
- arm64: Add missing Falkor part number for branch predictor hardening
(bsc#1068032).
- arm64: capabilities: Handle duplicate entries for a capability
(bsc#1068032).
- arm64: cpufeature: __this_cpu_has_cap() shouldn't stop early
(bsc#1068032).
- arm64 / cpuidle: Use new cpuidle macro for entering retention state
(bsc#1084328).
- arm64: Enforce BBM for huge IO/VMAP mappings (bsc#1088313).
- arm64: fix smccc compilation (bsc#1068032).
- arm64: Kill PSCI_GET_VERSION as a variant-2 workaround (bsc#1068032).
- arm64: KVM: Add SMCCC_ARCH_WORKAROUND_1 fast handling (bsc#1068032).
- arm64: KVM: Increment PC after handling an SMC trap (bsc#1068032).
- arm64: KVM: Report SMCCC_ARCH_WORKAROUND_1 BP hardening support
(bsc#1068032).
- arm64: mm: do not write garbage into TTBR1_EL1 register (bsc#1085487).
- arm64: mm: fix thinko in non-global page table attribute check
(bsc#1088050).
- arm64: Relax ARM_SMCCC_ARCH_WORKAROUND_1 discovery (bsc#1068032).
- arm: 8668/1: ftrace: Fix dynamic ftrace with DEBUG_RODATA and
!FRAME_POINTER (bnc#1012382).
- arm/arm64: KVM: Add PSCI_VERSION helper (bsc#1068032).
- arm/arm64: KVM: Add smccc accessors to PSCI code (bsc#1068032).
- arm/arm64: KVM: Advertise SMCCC v1.1 (bsc#1068032).
- arm/arm64: KVM: Consolidate the PSCI include files (bsc#1068032).
- arm/arm64: KVM: Implement PSCI 1.0 support (bsc#1068032).
- arm/arm64: KVM: Turn kvm_psci_version into a static inline (bsc#1068032).
- arm/arm64: smccc: Implement SMCCC v1.1 inline primitive (bsc#1068032).
- arm/arm64: smccc: Make function identifiers an unsigned quantity
(bsc#1068032).
- arm: DRA7: clockdomain: Change the CLKTRCTRL of CM_PCIE_CLKSTCTRL to
SW_WKUP (bnc#1012382).
- arm: dts: Adjust moxart IRQ controller and flags (bnc#1012382).
- arm: dts: am335x-pepper: Fix the audio CODEC's reset pin (bnc#1012382).
- arm: dts: exynos: Correct Trats2 panel reset line (bnc#1012382).
- arm: dts: koelsch: Correct clock frequency of X2 DU clock input
(bnc#1012382).
- arm: dts: LogicPD Torpedo: Fix I2C1 pinmux (bnc#1012382).
- arm: dts: LogicPD Torpedo: Fix I2C1 pinmux (bnc#1012382).
- arm: dts: omap3-n900: Fix the audio CODEC's reset pin (bnc#1012382).
- arm: dts: r8a7790: Correct parent of SSI[0-9] clocks (bnc#1012382).
- arm: dts: r8a7791: Correct parent of SSI[0-9] clocks (bnc#1012382).
- arm: mvebu: Fix broken PL310_ERRATA_753970 selects (bnc#1012382).
- asoc: rcar: ssi: do not set SSICR.CKDV = 000 with SSIWSR.CONT
(bnc#1012382).
- ath10k: disallow DFS simulation if DFS channel is not enabled
(bnc#1012382).
- ath10k: fix invalid STS_CAP_OFFSET_MASK (bnc#1012382).
- ath10k: update tdls teardown state to target (bnc#1012382).
- ath: Fix updating radar flags for coutry code India (bnc#1012382).
- batman-adv: handle race condition for claims between gateways
(bnc#1012382).
- bcache: do not attach backing with duplicate UUID (bnc#1012382).
- blkcg: fix double free of new_blkg in blkcg_init_queue (bnc#1012382).
- blk-throttle: make sure expire time isn't too big (bnc#1012382).
- block: do not assign cmd_flags in __blk_rq_prep_clone (bsc#1088087).
- block-mq: stop workqueue items in blk_mq_stop_hw_queue() (bsc#1084967).
- bluetooth: btusb: Fix quirk for Atheros 1525/QCA6174 (bnc#1012382).
- bluetooth: hci_qca: Avoid setup failure on missing rampatch
(bnc#1012382).
- bnx2x: Align RX buffers (bnc#1012382).
- bonding: refine bond_fold_stats() wrap detection (bnc#1012382).
- bpf: fix incorrect sign extension in check_alu_op() (bnc#1012382).
- bpf: skip unnecessary capability check (bnc#1012382).
- bpf, x64: implement retpoline for tail call (bnc#1012382).
- bpf, x64: increase number of passes (bnc#1012382).
- braille-console: Fix value returned by _braille_console_setup
(bnc#1012382).
- brcmfmac: fix P2P_DEVICE ethernet address generation (bnc#1012382).
- bridge: check brport attr show in brport_show (bnc#1012382).
- btrfs: alloc_chunk: fix DUP stripe size handling (bnc#1012382).
- btrfs: Fix use-after-free when cleaning up fs_devs with a single stale
device (bnc#1012382).
- btrfs: improve delayed refs iterations (bsc#1076033).
- btrfs: incremental send, fix invalid memory access (git-fixes).
- btrfs: preserve i_mode if __btrfs_set_acl() fails (bnc#1012382).
- btrfs: send, fix file hole not being preserved due to inline extent
(bnc#1012382).
- can: cc770: Fix queue stall & dropped RTR reply (bnc#1012382).
- can: cc770: Fix stalls on rt-linux, remove redundant IRQ ack
(bnc#1012382).
- can: cc770: Fix use after free in cc770_tx_interrupt() (bnc#1012382).
- ceph: only dirty ITER_IOVEC pages for direct read (bsc#1084898).
- ch9200: use skb_cow_head() to deal with cloned skbs (bsc#1088684).
- clk: bcm2835: Protect sections updating shared registers (bnc#1012382).
- clk: ns2: Correct SDIO bits (bnc#1012382).
- clk: qcom: msm8916: fix mnd_width for codec_digcodec (bnc#1012382).
- clk: si5351: Rename internal plls to avoid name collisions (bnc#1012382).
- coresight: Fix disabling of CoreSight TPIU (bnc#1012382).
- coresight: Fixes coresight DT parse to get correct output port ID
(bnc#1012382).
- cpufreq: Fix governor module removal race (bnc#1012382).
- cpufreq: s3c24xx: Fix broken s3c_cpufreq_init() (bnc#1012382).
- cpufreq/sh: Replace racy task affinity logic (bnc#1012382).
- cpuidle: Add new macro to enter a retention idle state (bsc#1084328).
- cros_ec: fix nul-termination for firmware build info (bnc#1012382).
- crypto: cavium - fix memory leak on info (bsc#1086518).
- dcache: Add cond_resched in shrink_dentry_list (bsc#1086194).
- dccp: check sk for closed state in dccp_sendmsg() (bnc#1012382).
- dmaengine: imx-sdma: add 1ms delay to ensure SDMA channel is stopped
(bnc#1012382).
- dmaengine: ti-dma-crossbar: Fix event mapping for TPCC_EVT_MUX_60_63
(bnc#1012382).
- dm: Always copy cmd_flags when cloning a request (bsc#1088087).
- driver: (adm1275) set the m,b and R coefficients correctly for power
(bnc#1012382).
- drm: Allow determining if current task is output poll worker
(bnc#1012382).
- drm/amdgpu/dce: Do not turn off DP sink when disconnected (bnc#1012382).
- drm/amdgpu: Fail fb creation from imported dma-bufs. (v2) (bnc#1012382).
- drm/amdgpu: Fix deadlock on runtime suspend (bnc#1012382).
- drm/amdgpu: fix KV harvesting (bnc#1012382).
- drm/amdgpu: Notify sbios device ready before send request (bnc#1012382).
- drm/amdkfd: Fix memory leaks in kfd topology (bnc#1012382).
- drm: Defer disabling the vblank IRQ until the next interrupt (for
instant-off) (bnc#1012382).
- drm/edid: set ELD connector type in drm_edid_to_eld() (bnc#1012382).
- drm/i915/cmdparser: Do not check past the cmd length (bsc#1031717).
- drm/i915/psr: Check for the specific AUX_FRAME_SYNC cap bit
(bsc#1031717).
- drm/msm: fix leak in failed get_pages (bnc#1012382).
- drm/nouveau: Fix deadlock on runtime suspend (bnc#1012382).
- drm/nouveau/kms: Increase max retries in scanout position queries
(bnc#1012382).
- drm/omap: DMM: Check for DMM readiness after successful transaction
commit (bnc#1012382).
- drm: qxl: Do not alloc fbdev if emulation is not supported (bnc#1012382).
- drm/radeon: Do not turn off DP sink when disconnected (bnc#1012382).
- drm/radeon: Fail fb creation from imported dma-bufs (bnc#1012382).
- drm/radeon: Fix deadlock on runtime suspend (bnc#1012382).
- drm/radeon: fix KV harvesting (bnc#1012382).
- drm: udl: Properly check framebuffer mmap offsets (bnc#1012382).
- drm/vmwgfx: Fix a destoy-while-held mutex problem (bnc#1012382).
- drm/vmwgfx: Fixes to vmwgfx_fb (bnc#1012382).
- e1000e: Avoid missed interrupts following ICR read (bsc#1075428).
- e1000e: Avoid receiver overrun interrupt bursts (bsc#1075428).
- e1000e: Fix check_for_link return value with autoneg off (bsc#1075428).
- e1000e: Fix link check race condition (bsc#1075428).
- e1000e: Fix queue interrupt re-raising in Other interrupt (bsc#1075428).
- e1000e: fix timing for 82579 Gigabit Ethernet controller (bnc#1012382).
- e1000e: Remove Other from EIAC (bsc#1075428).
- edac, sb_edac: Fix out of bound writes during DIMM configuration on KNL
(git-fixes 3286d3eb906c).
- ext4: inplace xattr block update fails to deduplicate blocks
(bnc#1012382).
- f2fs: relax node version check for victim data in gc (bnc#1012382).
- fib_semantics: Do not match route with mismatching tclassid
(bnc#1012382).
- firmware/psci: Expose PSCI conduit (bsc#1068032).
- firmware/psci: Expose SMCCC version through psci_ops (bsc#1068032).
- fixup: sctp: verify size of a new chunk in _sctp_make_chunk()
(bnc#1012382).
- fs/aio: Add explicit RCU grace period when freeing kioctx (bnc#1012382).
- fs/aio: Use RCU accessors for kioctx_table->table[] (bnc#1012382).
- fs/hugetlbfs/inode.c: change put_page/unlock_page order in
hugetlbfs_fallocate() (git-fixes, bsc#1083745).
- fs: Teach path_connected to handle nfs filesystems with multiple roots
(bnc#1012382).
- genirq: Track whether the trigger type has been set (git-fixes).
- genirq: Use irqd_get_trigger_type to compare the trigger type for shared
IRQs (bnc#1012382).
- hdlc_ppp: carrier detect ok, do not turn off negotiation (bnc#1012382).
- hid: clamp input to logical range if no null state (bnc#1012382).
- hid: reject input outside logical range only if null state is set
(bnc#1012382).
- hugetlbfs: fix offset overflow in hugetlbfs mmap (bnc#1084353).
- hv_balloon: fix bugs in num_pages_onlined accounting (fate#323887).
- hv_balloon: fix printk loglevel (fate#323887).
- hv_balloon: simplify hv_online_page()/hv_page_online_one() (fate#323887).
- i2c: i2c-scmi: add a MS HID (bnc#1012382).
- i2c: xlp9xx: Check for Bus state before every transfer (bsc#1084310).
- i2c: xlp9xx: Handle NACK on DATA properly (bsc#1084310).
- i2c: xlp9xx: Handle transactions with I2C_M_RECV_LEN properly
(bsc#1060799).
- i2c: xlp9xx: return ENXIO on slave address NACK (bsc#1060799).
- i40e: Acquire NVM lock before reads on all devices (bnc#1012382).
- i40e: avoid NVM acquire deadlock during NVM update (git-fixes).
- ia64: fix module loading for gcc-5.4 (bnc#1012382).
- ib/ipoib: Avoid memory leak if the SA returns a different DGID
(bnc#1012382).
- ib/ipoib: Update broadcast object if PKey value was changed in index 0
(bnc#1012382).
- ib/mlx4: Change vma from shared to private (bnc#1012382).
- ib/mlx4: Take write semaphore when changing the vma struct (bnc#1012382).
- ibmvfc: Avoid unnecessary port relogin (bsc#1085404).
- ibmvnic: Disable irqs before exiting reset from closed state
(bsc#1084610).
- ibmvnic: Do not reset CRQ for Mobility driver resets (bsc#1088600).
- ibmvnic: Fix DMA mapping mistakes (bsc#1088600).
- ibmvnic: Fix failover case for non-redundant configuration (bsc#1088600).
- ibmvnic: Fix reset return from closed state (bsc#1084610).
- ibmvnic: Fix reset scheduler error handling (bsc#1088600).
- ibmvnic: Potential NULL dereference in clean_one_tx_pool() (bsc#1085224,
git-fixes).
- ibmvnic: Remove unused TSO resources in TX pool structure (bsc#1085224).
- ibmvnic: Update TX pool cleaning routine (bsc#1085224).
- ibmvnic: Zero used TX descriptor counter on reset (bsc#1088600).
- ib/umem: Fix use of npages/nmap fields (bnc#1012382).
- ieee802154: 6lowpan: fix possible NULL deref in lowpan_device_event()
(bnc#1012382).
- iio: st_pressure: st_accel: Initialise sensor platform data properly
(bnc#1012382).
- iio: st_pressure: st_accel: pass correct platform data to init
(git-fixes).
- ima: relax requiring a file signature for new files with zero length
(bnc#1012382).
- infiniband/uverbs: Fix integer overflows (bnc#1012382).
- input: matrix_keypad - fix race when disabling interrupts (bnc#1012382).
- input: qt1070 - add OF device ID table (bnc#1012382).
- input: tsc2007 - check for presence and power down tsc2007 during probe
(bnc#1012382).
- iommu/omap: Register driver before setting IOMMU ops (bnc#1012382).
- iommu/vt-d: clean up pr_irq if request_threaded_irq fails (bnc#1012382).
- ip6_vti: adjust vti mtu according to mtu of lower device (bnc#1012382).
- ipmi: do not probe ACPI devices if si_tryacpi is unset (bsc#1060799).
- ipmi: Fix the I2C address extraction from SPMI tables (bsc#1060799).
- ipmi_ssif: Fix kernel panic at msg_done_handler (bsc#1088871).
- ipmi_ssif: Fix logic around alert handling (bsc#1060799).
- ipmi_ssif: remove redundant null check on array client->adapter->name
(bsc#1060799).
- ipmi_ssif: unlock on allocation failure (bsc#1060799).
- ipmi:ssif: Use i2c_adapter_id instead of adapter->nr (bsc#1060799).
- ipmi: Use the proper default value for register size in ACPI
(bsc#1060799).
- ipmi/watchdog: fix wdog hang on panic waiting for ipmi response
(bnc#1012382).
- ipv6: fix access to non-linear packet in
ndisc_fill_redirect_hdr_option() (bnc#1012382).
- ipv6 sit: work around bogus gcc-8 -Wrestrict warning (bnc#1012382).
- ipvlan: add L2 check for packets arriving via virtual devices
(bnc#1012382).
- irqchip/gic-v3-its: Add ACPI NUMA node mapping (bsc#1085981).
- irqchip/gic-v3-its: Allow GIC ITS number more than MAX_NUMNODES
(bsc#1085981).
- irqchip/gic-v3-its: Ensure nr_ites >= nr_lpis (bnc#1012382).
- irqchip/gic-v3-its: Remove ACPICA version check for ACPI NUMA
(bsc#1085981).
- kbuild: disable clang's default use of -fmerge-all-constants
(bnc#1012382).
- kbuild: Handle builtin dtb file names containing hyphens (bnc#1012382).
- kprobes/x86: Fix kprobe-booster not to boost far call instructions
(bnc#1012382).
- kprobes/x86: Fix to set RWX bits correctly before releasing trampoline
(git-fixes).
- kprobes/x86: Set kprobes pages read-only (bnc#1012382).
- kvm: arm/arm64: Handle CPU_PM_ENTER_FAILED (bsc#1086499).
- kvm: arm/arm64: vgic: Add missing irq_lock to vgic_mmio_read_pending
(bsc#1086499).
- kvm: arm/arm64: vgic: Do not populate multiple LRs with the same vintid
(bsc#1086499).
- kvm: arm/arm64: vgic-its: Check result of allocation before use (bsc#).
- kvm: arm/arm64: vgic-its: Preserve the revious read from the pending
table (bsc#1086499).
- kvm: arm/arm64: vgic-v3: Tighten synchronization for guests using v2 on
v3 (bsc#1086499).
- kvm: mmu: Fix overlap between public and private memslots (bnc#1012382).
- kvm: nVMX: fix nested tsc scaling (bsc1087999).
- kvm: PPC: Book3S PR: Exit KVM on failed mapping (bnc#1012382).
- kvm/x86: fix icebp instruction handling (bnc#1012382).
- l2tp: do not accept arbitrary sockets (bnc#1012382).
- libata: Apply NOLPM quirk to Crucial M500 480 and 960GB SSDs
(bnc#1012382).
- libata: Apply NOLPM quirk to Crucial MX100 512GB SSDs (bnc#1012382).
- libata: disable LPM for Crucial BX100 SSD 500GB drive (bnc#1012382).
- libata: Enable queued TRIM for Samsung SSD 860 (bnc#1012382).
- libata: fix length validation of ATAPI-relayed SCSI commands
(bnc#1012382).
- libata: Make Crucial BX100 500GB LPM quirk apply to all firmware
versions (bnc#1012382).
- libata: Modify quirks for MX100 to limit NCQ_TRIM quirk to MU01 version
(bnc#1012382).
- libata: remove WARN() for DMA or PIO command without data (bnc#1012382).
- lock_parent() needs to recheck if dentry got __dentry_kill'ed under it
(bnc#1012382).
- loop: Fix lost writes caused by missing flag (bnc#1012382).
- lpfc: update version to 11.4.0.7-1 (bsc#1085383).
- mac80211: do not parse encrypted management frames in
ieee80211_frame_acked (bnc#1012382).
- mac80211: do not WARN on bad WMM parameters from buggy APs (bsc#1031717).
- mac80211_hwsim: enforce PS_MANUAL_POLL to be set after PS_ENABLED
(bnc#1012382).
- mac80211: remove BUG() when interface type is invalid (bnc#1012382).
- md-cluster: fix wrong condition check in raid1_write_request
(bsc#1085402).
- md/raid10: skip spare disk as 'first' disk (bnc#1012382).
- md/raid10: wait up frozen array in handle_write_completed (bnc#1012382).
- md/raid6: Fix anomily when recovering a single device in RAID6
(bnc#1012382).
- media: au0828: fix VIDEO_V4L2 dependency (bsc#1031717).
- media: bt8xx: Fix err 'bt878_probe()' (bnc#1012382).
- media: c8sectpfe: fix potential NULL pointer dereference in
c8sectpfe_timer_interrupt (bnc#1012382).
- media: cpia2: Fix a couple off by one bugs (bnc#1012382).
- media: cx25821: prevent out-of-bounds read on array card (bsc#1031717).
- media/dvb-core: Race condition when writing to CAM (bnc#1012382).
- media: i2c/soc_camera: fix ov6650 sensor getting wrong clock
(bnc#1012382).
- media: m88ds3103: do not call a non-initalized function (bnc#1012382).
- media: [RESEND] media: dvb-frontends: Add delay to Si2168 restart
(bnc#1012382).
- media: s3c-camif: fix out-of-bounds array access (bsc#1031717).
- mfd: palmas: Reset the POWERHOLD mux during power off (bnc#1012382).
- mmc: avoid removing non-removable hosts during suspend (bnc#1012382).
- mmc: dw_mmc: fix falling from idmac to PIO mode when dw_mci_reset occurs
(bnc#1012382).
- mmc: dw_mmc: Fix the DTO/CTO timeout overflow calculation for 32-bit
systems (bsc#1088267).
- mmc: sdhci-of-esdhc: limit SD clock for ls1012a/ls1046a (bnc#1012382).
- mm: Fix false-positive VM_BUG_ON() in page_cache_{get,add}_speculative()
(bnc#1012382).
- mm/hugetlb.c: do not call region_abort if region_chg fails (bnc#1084353).
- mm/vmalloc: add interfaces to free unmapped page table (bnc#1012382).
- mpls, nospec: Sanitize array index in mpls_label_ok() (bnc#1012382).
- mt7601u: check return value of alloc_skb (bnc#1012382).
- mtd: nand: fix interpretation of NAND_CMD_NONE in nand_command[_lp]()
(bnc#1012382).
- mtd: nand: fsl_ifc: Fix nand waitfunc return value (bnc#1012382).
- mtip32xx: use runtime tag to initialize command header (bnc#1012382).
- net/8021q: create device with all possible features in wanted_features
(bnc#1012382).
- net: ethernet: arc: Fix a potential memory leak if an optional regulator
is deferred (bnc#1012382).
- net: ethernet: ti: cpsw: add check for in-band mode setting with RGMII
PHY interface (bnc#1012382).
- net/faraday: Add missing include of of.h (bnc#1012382).
- net: fec: Fix unbalanced PM runtime calls (bnc#1012382).
- netfilter: add back stackpointer size checks (bnc#1012382).
- netfilter: bridge: ebt_among: add missing match size checks
(bnc#1012382).
- netfilter: IDLETIMER: be syzkaller friendly (bnc#1012382).
- netfilter: ipv6: fix use-after-free Write in nf_nat_ipv6_manip_pkt
(bnc#1012382).
- netfilter: nat: cope with negative port range (bnc#1012382).
- netfilter: use skb_to_full_sk in ip_route_me_harder (bnc#1012382).
- netfilter: x_tables: fix missing timer initialization in xt_LED
(bnc#1012382).
- netfilter: xt_CT: fix refcnt leak on error path (bnc#1012382).
- net: Fix hlist corruptions in inet_evict_bucket() (bnc#1012382).
- net: fix race on decreasing number of TX queues (bnc#1012382).
- net: hns: Fix ethtool private flags (bsc#1085511).
- net: ipv4: avoid unused variable warning for sysctl (git-fixes).
- net: ipv4: do not allow setting net.ipv4.route.min_pmtu below 68
(bnc#1012382).
- net: ipv6: send unsolicited NA after DAD (git-fixes).
- net: ipv6: send unsolicited NA on admin up (bnc#1012382).
- net/iucv: Free memory obtained by kzalloc (bnc#1012382).
- netlink: avoid a double skb free in genlmsg_mcast() (bnc#1012382).
- netlink: ensure to loop over all netns in genlmsg_multicast_allns()
(bnc#1012382).
- net: mpls: Pull common label check into helper (bnc#1012382).
- net: Only honor ifindex in IP_PKTINFO if non-0 (bnc#1012382).
- net: systemport: Rewrite __bcm_sysport_tx_reclaim() (bnc#1012382).
- net: xfrm: allow clearing socket xfrm policies (bnc#1012382).
- nfc: nfcmrvl: double free on error path (bnc#1012382).
- nfc: nfcmrvl: Include unaligned.h instead of access_ok.h (bnc#1012382).
- nfsd4: permit layoutget of executable-only files (bnc#1012382).
- nfs: Fix an incorrect type in struct nfs_direct_req (bnc#1012382).
- nospec: Allow index argument to have const-qualified type (bnc#1012382).
- nospec: Include