SUSE Security Update: Security update for the Linux Kernel
______________________________________________________________________________

Announcement ID:    SUSE-SU-2020:3230-1
Rating:             important
References:         #1065600 #1155798 #1168468 #1171675 #1175599 
                    #1175718 #1176019 #1176381 #1176588 #1176979 
                    #1177027 #1177121 #1177193 #1177194 #1177206 
                    #1177258 #1177283 #1177284 #1177285 #1177286 
                    #1177297 #1177384 #1177511 #954532 
Cross-References:   CVE-2020-25212 CVE-2020-25641 CVE-2020-25643
                    CVE-2020-25645
Affected Products:
                    SUSE Linux Enterprise Module for Realtime 15-SP2
______________________________________________________________________________

   An update that solves four vulnerabilities and has 20 fixes
   is now available.

Description:

   The SUSE Linux Enterprise 15 SP2 kernel RT was updated to receive various
   security and bugfixes.

   The following security bugs were fixed:

   - CVE-2020-25212: Fixed getxattr kernel panic and memory overflow
     (bsc#1176381).
   - CVE-2020-25643: Added range checks in ppp_cp_parse_cr() (bsc#1177206).
   - CVE-2020-25641: Allowed for_each_bvec to support zero len bvec
     (bsc#1177121).
   - CVE-2020-25645: Added transport ports in route lookup for geneve
     (bsc#1177511).

   The following non-security bugs were fixed:

   - 9p: Fix memory leak in v9fs_mount (git-fixes).
   - ACPI: EC: Reference count query handlers under lock (git-fixes).
   - airo: Fix read overflows sending packets (git-fixes).
   - ar5523: Add USB ID of SMCWUSBT-G2 wireless adapter (git-fixes).
   - ASoC: img-i2s-out: Fix runtime PM imbalance on error (git-fixes).
   - ASoC: Intel: bytcr_rt5640: Add quirk for MPMAN Converter9 2-in-1
     (git-fixes).
   - ASoC: kirkwood: fix IRQ error handling (git-fixes).
   - ASoC: wm8994: Ensure the device is resumed in wm89xx_mic_detect
     functions (git-fixes).
   - ASoC: wm8994: Skip setting of the WM8994_MICBIAS register for WM1811
     (git-fixes).
   - ath10k: fix array out-of-bounds access (git-fixes).
   - ath10k: fix memory leak for tpc_stats_final (git-fixes).
   - ath10k: use kzalloc to read for ath10k_sdio_hif_diag_read (git-fixes).
   - Bluetooth: Fix refcount use-after-free issue (git-fixes).
   - Bluetooth: guard against controllers sending zero'd events (git-fixes).
   - Bluetooth: Handle Inquiry Cancel error after Inquiry Complete
     (git-fixes).
   - Bluetooth: L2CAP: handle l2cap config request during open state
     (git-fixes).
   - Bluetooth: prefetch channel before killing sock (git-fixes).
   - brcmfmac: Fix double freeing in the fmac usb data path (git-fixes).
   - btrfs: block-group: do not set the wrong READA flag for
     btrfs_read_block_groups() (bsc#1176019).
   - btrfs: block-group: fix free-space bitmap threshold (bsc#1176019).
   - btrfs: block-group: refactor how we delete one block group item
     (bsc#1176019).
   - btrfs: block-group: refactor how we insert a block group item
     (bsc#1176019).
   - btrfs: block-group: refactor how we read one block group item
     (bsc#1176019).
   - btrfs: block-group: rename write_one_cache_group() (bsc#1176019).
   - btrfs: do not take an extra root ref at allocation time (bsc#1176019).
   - btrfs: drop logs when we've aborted a transaction (bsc#1176019).
   - btrfs: fix a race between scrub and block group removal/allocation
     (bsc#1176019).
   - btrfs: fix crash during unmount due to race with delayed inode workers     (bsc#1176019).
   - btrfs: free block groups after free'ing fs trees (bsc#1176019).
   - btrfs: hold a ref on the root on the dead roots list (bsc#1176019).
   - btrfs: kill the subvol_srcu (bsc#1176019).
   - btrfs: make btrfs_cleanup_fs_roots use the radix tree lock (bsc#1176019).
   - btrfs: make inodes hold a ref on their roots (bsc#1176019).
   - btrfs: make the extent buffer leak check per fs info (bsc#1176019).
   - btrfs: move ino_cache_inode dropping out of btrfs_free_fs_root
     (bsc#1176019).
   - btrfs: move the block group freeze/unfreeze helpers into block-group.c
     (bsc#1176019).
   - btrfs: move the root freeing stuff into btrfs_put_root (bsc#1176019).
   - btrfs: remove no longer necessary chunk mutex locking cases
     (bsc#1176019).
   - btrfs: rename member 'trimming' of block group to a more generic name
     (bsc#1176019).
   - btrfs: scrub, only lookup for csums if we are dealing with a data extent
     (bsc#1176019).
   - bus: hisi_lpc: Fixup IO ports addresses to avoid use-after-free in host
     removal (git-fixes).
   - clk: samsung: exynos4: mark 'chipid' clock as CLK_IGNORE_UNUSED
     (git-fixes).
   - clk: socfpga: stratix10: fix the divider for the emac_ptp_free_clk
     (git-fixes).
   - clk: tegra: Always program PLL_E when enabled (git-fixes).
   - clk/ti/adpll: allocate room for terminating null (git-fixes).
   - clocksource/drivers/h8300_timer8: Fix wrong return value in
     h8300_8timer_init() (git-fixes).
   - clocksource/drivers/timer-gx6605s: Fixup counter reload (git-fixes).
   - cpuidle: Poll for a minimum of 30ns and poll for a tick if lower
     c-states are disabled (bnc#1176588).
   - crypto: dh - check validity of Z before export (bsc#1175718).
   - crypto: dh - SP800-56A rev 3 local public key validation (bsc#1175718).
   - crypto: ecc - SP800-56A rev 3 local public key validation (bsc#1175718).
   - crypto: ecdh - check validity of Z before export (bsc#1175718).
   - dmaengine: mediatek: hsdma_probe: fixed a memory leak when
     devm_request_irq fails (git-fixes).
   - dmaengine: stm32-dma: use vchan_terminate_vdesc() in .terminate_all
     (git-fixes).
   - dmaengine: stm32-mdma: use vchan_terminate_vdesc() in .terminate_all
     (git-fixes).
   - dmaengine: tegra-apb: Prevent race conditions on channel's freeing
     (git-fixes).
   - dmaengine: zynqmp_dma: fix burst length configuration (git-fixes).
   - dma-fence: Serialise signal enabling (dma_fence_enable_sw_signaling)
     (git-fixes).
   - drivers: char: tlclk.c: Avoid data race between init and interrupt
     handler (git-fixes).
   - drm/amdgpu: restore proper ref count in amdgpu_display_crtc_set_config
     (git-fixes).
   - drm/radeon: revert "Prefer lower feedback dividers" (bsc#1177384).
   - e1000: Do not perform reset in reset_task if we are already down
     (git-fixes).
   - ftrace: Move RCU is watching check after recursion check (git-fixes).
   - fuse: do not ignore errors from fuse_writepages_fill() (bsc#1177193).
   - gpio: mockup: fix resource leak in error path (git-fixes).
   - gpio: rcar: Fix runtime PM imbalance on error (git-fixes).
   - gpio: siox: explicitly support only threaded irqs (git-fixes).
   - gpio: sprd: Clear interrupt when setting the type as edge (git-fixes).
   - gpio: tc35894: fix up tc35894 interrupt configuration (git-fixes).
   - hwmon: (applesmc) check status earlier (git-fixes).
   - i2c: aspeed: Mask IRQ status to relevant bits (git-fixes).
   - i2c: core: Call i2c_acpi_install_space_handler() before
     i2c_acpi_register_devices() (git-fixes).
   - i2c: i801: Exclude device from suspend direct complete optimization
     (git-fixes).
   - i2c: tegra: Prevent interrupt triggering after transfer timeout
     (git-fixes).
   - i2c: tegra: Restore pinmux on system resume (git-fixes).
   - ieee802154/adf7242: check status of adf7242_read_reg (git-fixes).
   - ieee802154: fix one possible memleak in ca8210_dev_com_init (git-fixes).
   - iio: adc: qcom-spmi-adc5: fix driver name (git-fixes).
   - Input: i8042 - add nopnp quirk for Acer Aspire 5 A515 (bsc#954532).
   - Input: trackpoint - enable Synaptics trackpoints (git-fixes).
   - iommu/amd: Fix IOMMU AVIC not properly update the is_run bit in IRTE
     (bsc#1177297).
   - iommu/amd: Fix potential @entry null deref (bsc#1177283).
   - iommu/amd: Re-factor guest virtual APIC (de-)activation code
     (bsc#1177284).
   - iommu/amd: Restore IRTE.RemapEn bit for amd_iommu_activate_guest_mode
     (bsc#1177285).
   - iommu/exynos: add missing put_device() call in exynos_iommu_of_xlate()
     (bsc#1177286).
   - kABI: Fix kABI for 12856e7acde4 PCI/IOV: Mark VFs as not implementing
     PCI_COMMAND_MEMORY (bsc#1176979).
   - leds: mlxreg: Fix possible buffer overflow (git-fixes).
   - lib/mpi: Add mpi_sub_ui() (bsc#1175718).
   - locking/rwsem: Disable reader optimistic spinning (bnc#1176588).
   - mac80211: do not allow bigger VHT MPDUs than the hardware supports
     (git-fixes).
   - mac80211: skip mpath lookup also for control port tx (git-fixes).
   - mac802154: tx: fix use-after-free (git-fixes).
   - media: mc-device.c: fix memleak in media_device_register_entity
     (git-fixes).
   - media: smiapp: Fix error handling at NVM reading (git-fixes).
   - media: ti-vpe: cal: Restrict DMA to avoid memory corruption (git-fixes).
   - mfd: mfd-core: Protect against NULL call-back function pointer
     (git-fixes).
   - mmc: core: Rework wp-gpio handling (git-fixes).
   - mmc: sdhci: Workaround broken command queuing on Intel GLK based IRBIS
     models (git-fixes).
   - mt76: add missing locking around ampdu action (git-fixes).
   - mt76: clear skb pointers from rx aggregation reorder buffer during
     cleanup (git-fixes).
   - mt76: do not use devm API for led classdev (git-fixes).
   - mt76: fix handling full tx queues in mt76_dma_tx_queue_skb_raw
     (git-fixes).
   - mt76: fix LED link time failure (git-fixes).
   - mtd: cfi_cmdset_0002: do not free cfi->cfiq in error path of
     cfi_amdstd_setup() (git-fixes).
   - mtd: rawnand: gpmi: Fix runtime PM imbalance on error (git-fixes).
   - mtd: rawnand: omap_elm: Fix runtime PM imbalance on error (git-fixes).
   - net: phy: realtek: fix rtl8211e rx/tx delay config (git-fixes).
   - nfs: Fix security label length not being reset (bsc#1176381).
   - PCI: Avoid double hpmemsize MMIO window assignment (git-fixes).
   - PCI/IOV: Mark VFs as not implementing PCI_COMMAND_MEMORY (bsc#1176979).
   - PCI: tegra194: Fix runtime PM imbalance on error (git-fixes).
   - PCI: tegra: Fix runtime PM imbalance on error (git-fixes).
   - phy: ti: am654: Fix a leak in serdes_am654_probe() (git-fixes).
   - pinctrl: mvebu: Fix i2c sda definition for 98DX3236 (git-fixes).
   - Platform: OLPC: Fix memleak in olpc_ec_probe (git-fixes).
   - platform/x86: fix kconfig dependency warning for FUJITSU_LAPTOP
     (git-fixes).
   - platform/x86: fix kconfig dependency warning for LG_LAPTOP (git-fixes).
   - platform/x86: intel_pmc_core: do not create a static struct device
     (git-fixes).
   - platform/x86: intel-vbtn: Switch to an allow-list for SW_TABLET_MODE
     reporting (bsc#1175599).
   - platform/x86: thinkpad_acpi: initialize tp_nvram_state variable
     (git-fixes).
   - platform/x86: thinkpad_acpi: re-initialize ACPI buffer size when reuse
     (git-fixes).
   - power: supply: max17040: Correct voltage reading (git-fixes).
   - Refresh
     patches.suse/fnic-to-not-call-scsi_done-for-unhandled-commands.patch
     (bsc#1168468, bsc#1171675).
   - rtc: ds1374: fix possible race condition (git-fixes).
   - rtc: sa1100: fix possible race condition (git-fixes).
   - s390/pci: Mark all VFs as not implementing PCI_COMMAND_MEMORY
     (bsc#1176979).
   - sched/fair: Ignore cache hotness for SMT migration (bnc#1155798 (CPU
     scheduler functional and performance backports)).
   - sched/fair: Use dst group while checking imbalance for NUMA balancer
     (bnc#1155798 (CPU scheduler functional and performance backports)).
   - sched/numa: Avoid creating large imbalances at task creation time
     (bnc#1176588).
   - sched/numa: Check numa balancing information only when enabled
     (bnc#1176588).
   - sched/numa: Use runnable_avg to classify node (bnc#1155798 (CPU
     scheduler functional and performance backports)).
   - scsi: iscsi: iscsi_tcp: Avoid holding spinlock while calling
     getpeername() (bsc#1177258).
   - serial: 8250: 8250_omap: Terminate DMA before pushing data on RX timeout
     (git-fixes).
   - serial: 8250_omap: Fix sleeping function called from invalid context
     during probe (git-fixes).
   - serial: 8250_port: Do not service RX FIFO if throttled (git-fixes).
   - serial: uartps: Wait for tx_empty in console setup (git-fixes).
   - spi: fsl-espi: Only process interrupts for expected events (git-fixes).
   - staging:r8188eu: avoid skb_clone for amsdu to msdu conversion
     (git-fixes).
   - thermal: rcar_thermal: Handle probe error gracefully (git-fixes).
   - Update config files. Enable ACPI_PCI_SLOT and HOTPLUG_PCI_ACPI
     (bsc#1177194).
   - usb: dwc3: Increase timeout for CmdAct cleared by device controller
     (git-fixes).
   - USB: EHCI: ehci-mv: fix error handling in mv_ehci_probe() (git-fixes).
   - USB: EHCI: ehci-mv: fix less than zero comparison of an unsigned int
     (git-fixes).
   - USB: gadget: f_ncm: Fix NDP16 datagram validation (git-fixes).
   - vfio/pci: Decouple PCI_COMMAND_MEMORY bit checks from is_virtfn
     (bsc#1176979).
   - vmxnet3: fix cksum offload issues for non-udp tunnels (git-fixes).
   - wlcore: fix runtime pm imbalance in wl1271_tx_work (git-fixes).
   - wlcore: fix runtime pm imbalance in wlcore_regdomain_config (git-fixes).
   - xen/events: do not use chip_data for legacy IRQs (bsc#1065600).
   - yam: fix possible memory leak in yam_init_driver (git-fixes).


Special Instructions and Notes:

   Please reboot the system after installing this update.

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Realtime 15-SP2:

      zypper in -t patch SUSE-SLE-Module-RT-15-SP2-2020-3230=1



Package List:

   - SUSE Linux Enterprise Module for Realtime 15-SP2 (x86_64):

      cluster-md-kmp-rt-5.3.18-13.1
      cluster-md-kmp-rt-debuginfo-5.3.18-13.1
      dlm-kmp-rt-5.3.18-13.1
      dlm-kmp-rt-debuginfo-5.3.18-13.1
      gfs2-kmp-rt-5.3.18-13.1
      gfs2-kmp-rt-debuginfo-5.3.18-13.1
      kernel-rt-5.3.18-13.1
      kernel-rt-debuginfo-5.3.18-13.1
      kernel-rt-debugsource-5.3.18-13.1
      kernel-rt-devel-5.3.18-13.1
      kernel-rt-devel-debuginfo-5.3.18-13.1
      kernel-rt_debug-debuginfo-5.3.18-13.1
      kernel-rt_debug-debugsource-5.3.18-13.1
      kernel-rt_debug-devel-5.3.18-13.1
      kernel-rt_debug-devel-debuginfo-5.3.18-13.1
      kernel-syms-rt-5.3.18-13.1
      ocfs2-kmp-rt-5.3.18-13.1
      ocfs2-kmp-rt-debuginfo-5.3.18-13.1

   - SUSE Linux Enterprise Module for Realtime 15-SP2 (noarch):

      kernel-devel-rt-5.3.18-13.1
      kernel-source-rt-5.3.18-13.1


References:

   https://www.suse.com/security/cve/CVE-2020-25212.html
   https://www.suse.com/security/cve/CVE-2020-25641.html
   https://www.suse.com/security/cve/CVE-2020-25643.html
   https://www.suse.com/security/cve/CVE-2020-25645.html
   https://bugzilla.suse.com/1065600
   https://bugzilla.suse.com/1155798
   https://bugzilla.suse.com/1168468
   https://bugzilla.suse.com/1171675
   https://bugzilla.suse.com/1175599
   https://bugzilla.suse.com/1175718
   https://bugzilla.suse.com/1176019
   https://bugzilla.suse.com/1176381
   https://bugzilla.suse.com/1176588
   https://bugzilla.suse.com/1176979
   https://bugzilla.suse.com/1177027
   https://bugzilla.suse.com/1177121
   https://bugzilla.suse.com/1177193
   https://bugzilla.suse.com/1177194
   https://bugzilla.suse.com/1177206
   https://bugzilla.suse.com/1177258
   https://bugzilla.suse.com/1177283
   https://bugzilla.suse.com/1177284
   https://bugzilla.suse.com/1177285
   https://bugzilla.suse.com/1177286
   https://bugzilla.suse.com/1177297
   https://bugzilla.suse.com/1177384
   https://bugzilla.suse.com/1177511
   https://bugzilla.suse.com/954532