ELBA-2018-4050

ELBA-2018-4050 - Unbreakable Enterprise kernel bug fix update

Type:	BUG
Severity:	NA
Release Date:	2018-03-14

Description

[4.1.12-112.16.4]
- scsi: Make __scsi_remove_device go straight from BLOCKED to DEL (Bart Van Assche) [Orabug: 27339736]
- scsi: Protect SCSI device state changes with a mutex (Bart Van Assche) [Orabug: 27339736]
- scsi: Introduce scsi_start_queue() (Bart Van Assche) [Orabug: 27339736]
- scsi: avoid a permanent stop of the scsi devices request queue (Wei Fang) [Orabug: 27339736]
- x86/spectre_v2: Fix cpu offlining with IPBP. (Konrad Rzeszutek Wilk)

[4.1.12-112.16.3]
- retpoline: selectively disable IBRS in disable_ibrs_and_friends() (Chuck Anderson) [Orabug: 27636063]

[4.1.12-112.16.2]
- retpoline: move setting of sysctl_ibrs_enabled and sysctl_ibpb_enabled to where SPEC_CTRL_IBRS_INUSE and SPEC_CTRL_IBPB_INUSE are set (Chuck Anderson) [Orabug: 27556096]
- retpoline: set IBRS and IBPB in use only on the boot CPU call to init_scattered_cpuid_features() (Chuck Anderson) [Orabug: 27556096]
- retpoline: display IBPB feature status along with IBRS status (Chuck Anderson) [Orabug: 27556096]
- retpoline: move lock/unlock of spec_ctrl_mutex to check_modinfo() (Chuck Anderson) [Orabug: 27556096]
- retpoline: call clear_retpoline_fallback() with boot parm spectre_v2_heuristics=off (Chuck Anderson) [Orabug: 27556096]
- retpoline: add brackets to check_ibrs_inuse() and clear_ibpb_inuse() (Chuck Anderson) [Orabug: 27556096]
- retpoline/module: do not enable IBRS/IPBP if SPEC_CTRL_IBRS_ADMIN_DISABLED/SPEC_CTRL_IBPB_ADMIN_DISABLED is set (Chuck Anderson) [Orabug: 27547729]
- retpoline: microcode incorrectly reported as broken during early boot (Chuck Anderson) [Orabug: 27556096]
- retpoline: move lock/unlock of spec_ctrl_mutex into init_scattered_cpuid_features() (Chuck Anderson) [Orabug: 27556096]
- KVM: Disable irq while unregistering user notifier (Ignacio Alvarado)
- x86/speculation: Use IBRS if available before calling into firmware (David Woodhouse) [Orabug: 27516479]
- Revert 'x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation' (Konrad Rzeszutek Wilk) [Orabug: 27601790]
- Revert 'x86/spec: Add 'lfence_enabled' in sysfs' (Konrad Rzeszutek Wilk)
- x86/spectre_v2: Fix the documentation to say the right thing. (Konrad Rzeszutek Wilk)
- x86/spectre_v2: Dont check bad microcode versions when running under hypervisors. (Konrad Rzeszutek Wilk) [Orabug: 27601735]

[4.1.12-112.16.1]
- firmware: dmi_scan: add SBMIOS entry and DMI tables (Ivan Khoronzhuk) [Orabug: 27045425]
- Btrfs: fix unexpected EEXIST from btrfs_get_extent (Liu Bo) [Orabug: 27033166]
- Btrfs: fix incorrect block_len in merge_extent_mapping (Liu Bo) [Orabug: 27033166]
- Btrfs: add WARN_ONCE to detect unexpected error from merge_extent_mapping (Liu Bo) [Orabug: 27033166]
- Btrfs: deal with existing encompassing extent map in btrfs_get_extent() (Omar Sandoval) [Orabug: 27033166]
- Btrfs: deal with duplciates during extent_map insertion in btrfs_get_extent (Chris Mason) [Orabug: 27033166]
- net: cdc_ether: fix divide by 0 on bad descriptors (Bjorn Mork) [Orabug: 27215191] {CVE-2017-16649}
- KVM: x86: pvclock: Handle first-time write to pvclock-page contains random junk (Liran Alon) [Orabug: 27221679]
- KVM: x86: always fill in vcpu->arch.hv_clock (Paolo Bonzini) [Orabug: 27221679]
- net/mlx4_core: allow QPs with enable_smi_admin enabled (Zhu Yanjun) [Orabug: 27256720]
- qlcnic: fix deadlock bug (Junxiao Bi) [Orabug: 27337130]
- x86/ia32/syscall: RESTORE_EXTRA_REGS when returning from syscall (Ankur Arora) [Orabug: 27534437] {CVE-2017-5715}
- x86/ia32/syscall: dont do RESTORE_EXTRA_REGS prematurely (Ankur Arora) [Orabug: 27534437] {CVE-2017-5715}
- trace: declare blk_add_trace_rq non-static on OL6 (Todd Vierling) [Orabug: 27578295]

[4.1.12-112.15.1]
- x86/spectre: move microcode check before kernel ibrs flags are set (Daniel Jordan) [Orabug: 27534557] {CVE-2017-5715}
- bonding: attempt to better support longer hw addresses (Jarod Wilson) [Orabug: 27535442]
- x86: make HAVE_FENTRY dependent on !SIMULATE_GCC44_KABI (Todd Vierling) [Orabug: 27533590]
- Revert 'uek-rpm: configs: remove __stack_chk_fail from kABI list' (Todd Vierling) [Orabug: 27540429]

[4.1.12-112.14.17]
- retpoline/module: fall back to another spectre mitigation when disabling retpoline (Chuck Anderson) [Orabug: 27457402]
- retpoline/module: add bit defs for use_ibpb (Chuck Anderson) [Orabug: 27457402]
- x86/spectre_v2: Only use IBRS when ibrs_inuse tells us to (Konrad Rzeszutek Wilk)
- kernel: on OL6 only, simulate the gcc 4.4 kABI for __stack_chk_fail() (Todd Vierling) [Orabug: 27509404]
- uek-rpm: configs: Dont set HAVE_FENTRY on OL6 builds. (Todd Vierling) [Orabug: 27509404]

[4.1.12-112.14.16]
- x86/spectre_v2: Disable IBRS if spectre_v2=off (Konrad Rzeszutek Wilk)
- KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL (KarimAllah Ahmed) [Orabug: 27525577]
- x86/spectre_v2: Remove 0xc2 from spectre_bad_microcodes (Darren Kenny) [Orabug: 27523395]
- x86/speculation: Use Indirect Branch Prediction Barrier in context switch (Tim Chen) [Orabug: 27524607]
- xenbus: track caller request id (Joao Martins) [Orabug: 27472583]
- uek-rpm: configs: remove __stack_chk_fail from kABI list (Todd Vierling)
- x86/entry: RESTORE_IBRS needs to be done under kernel CR3 (Ankur Arora) [Orabug: 27501741]
- Fix typo IBRS_ATT, which should be IBRS_ALL (redux) (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Add spectre_v2_heuristics= (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Do not disable IBPB when disabling IBRS (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/scattered: Fix the order. (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: Favor IBRS on Skylake over retpoline (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL (Darren Kenny) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: Now that we expose 'stbibp' make sure it is correct. (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/cpufeatures: Clean up Spectre v2 related CPUID flags (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/bugs: Drop one 'mitigation' from dmesg (Borislav Petkov) [Orabug: 27478139] {CVE-2017-5715}
- x86/nospec: Fix header guards names (Borislav Petkov) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Dont spam the console with these: (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/cpu: Keep model defines sorted by model number (Andy Shevchenko) [Orabug: 27478139] {CVE-2017-5715}
- x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/msr: Add definitions for new speculation control MSRs (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/cpufeatures: Add AMD feature bits for Speculation Control (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Print what options are available. (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Add VMEXIT_FILL_RSB instead of RETPOLINE (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: If IBRS is enabled disable 'Filling RSB on context switch' (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- KVM: VMX: Allow direct access to MSR_IA32_SPEC_CTRL (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Dont allow {ibrs,ipbp,lfence}_enabled to be toggled if retpoline (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: Fix retpoline_enabled (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: Update sysctl values if toggled only by set_{ibrs,ibpb}_disabled (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- retpoline/module: Taint kernel for missing retpoline in module (Andi Kleen) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Fill RSB on context switch for affected CPUs (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Optimize inline assembler for vmexit_fill_RSB (Andi Kleen) [Orabug: 27478139] {CVE-2017-5715}
- kprobes/x86: Disable optimizing on the function jumps to indirect thunk (Masami Hiramatsu) [Orabug: 27478139] {CVE-2017-5715}
- kprobes/x86: Blacklist indirect thunk functions for kprobes (Masami Hiramatsu) [Orabug: 27478139] {CVE-2017-5715}
- retpoline: Introduce start/end markers of indirect thunk (Masami Hiramatsu) [Orabug: 27478139] {CVE-2017-5715}
- x86/mce: Make machine check speculation protected (Thomas Gleixner) [Orabug: 27478139] {CVE-2017-5715}
- kbuild: modversions for EXPORT_SYMBOL() for asm (Nicholas Piggin) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros (Tom Lendacky) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Remove compile time warning (Thomas Gleixner) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Fill return stack buffer on vmexit (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/irq32: Convert assembler indirect jumps (Andi Kleen) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/checksum32: Convert assembler indirect jumps (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/xen: Convert Xen hypercall indirect jumps (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/hyperv: Convert assembler indirect jumps (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/ftrace: Convert ftrace assembler indirect jumps (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/entry: Convert entry assembler indirect jumps (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/crypto: Convert crypto assembler indirect jumps (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Add disable_ibrs_and_friends (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Figure out if STUFF_RSB macro needs to be used. (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Figure out when to use IBRS. (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: Add IBRS option. (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: Add boot time option to select Spectre v2 mitigation (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Add initial retpoline support (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- kconfig.h: use __is_defined() to check if MODULE is defined (Masahiro Yamada) [Orabug: 27478139] {CVE-2017-5715}
- EXPORT_SYMBOL() for asm (Al Viro) [Orabug: 27478139] {CVE-2017-5715}
- x86/asm: Make asm/alternative.h safe from assembly (Andy Lutomirski) [Orabug: 27478139] {CVE-2017-5715}
- x86/kbuild: enable modversions for symbols exported from asm (Adam Borowski) [Orabug: 27478139] {CVE-2017-5715}
- x86/asm: Use register variable to get stack pointer value (Andrey Ryabinin) [Orabug: 27478139] {CVE-2017-5715}
- x86/mm/32: Move setup_clear_cpu_cap(X86_FEATURE_PCID) earlier (Andy Lutomirski) [Orabug: 27478139] {CVE-2017-5715}
- x86/alternatives: Add missing '
' at end of ALTERNATIVE inline asm (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/alternatives: Fix optimize_nops() checking (Borislav Petkov) [Orabug: 27478139] {CVE-2017-5715}
- x86/microcode/intel: Extend BDW late-loading with a revision check (Jia Zhang) [Orabug: 27343573]
- x86/microcode/intel: Disable late loading on model 79 (Borislav Petkov) [Orabug: 27343573]
- x86/spec: Fix spectre_v1 bug and mitigation indicators (John Haxby) [Orabug: 27470707]
- x86: Fix compile issues if CONFIG_XEN not defined (Konrad Rzeszutek Wilk)
- x86/mitigation/spectre_v2: Add reporting of 'lfence' (Konrad Rzeszutek Wilk)
- x86/spec: Add 'lfence_enabled' in sysfs (Konrad Rzeszutek Wilk)
- x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation (Konrad Rzeszutek Wilk)
- x86/IBRS/IBPB: Remove procfs interface to ibrs/ibpb_enable (Boris Ostrovsky) [Orabug: 27415916]
- x86: Use PRED_CMD MSR when ibpb is enabled (Konrad Rzeszutek Wilk)

Updated Packages

Release/Architecture

Filename

MD5sum

Superseded By Advisory

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team