# changelog

author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.8.1.el7]
changelog:
  - [fs] fs-cache: The retrieval remaining-pages counter needs to be atomic_t (David Howells) [1231809 1130457]
  - [net] libceph: tcp_nodelay support (Sage Weil) [1231803 1197952]
  - [powerpc] pseries: Simplify check for suspendability during suspend/migration (Gustavo Duarte) [1231638 1207295]
  - [powerpc] pseries: Introduce api_version to migration sysfs interface (Gustavo Duarte) [1231638 1207295]
  - [powerpc] pseries: Little endian fixes for post mobility device tree update (Gustavo Duarte) [1231638 1207295]
  - [fs] sunrpc: Add missing support for RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (Steve Dickson) [1227825 1111712]
  - [fs] nfs: Fixing lease renewal (Benjamin Coddington) [1226328 1205048]
  - [powerpc] iommu: ddw: Fix endianness (Steve Best) [1224406 1189040]
  - [usb] fix use-after-free bug in usb_hcd_unlink_urb() (Don Zickus) [1223239 1187256]
  - [net] ipv4: Missing sk_nulls_node_init() in ping_unhash() (Denys Vlasenko) [1218104 1218105] {CVE-2015-3636}
  - [net] nf_conntrack: reserve two bytes for nf_ct_ext->len (Marcelo Leitner) [1211096 1206164] {CVE-2014-9715}
  - [net] ipv6: Don't reduce hop limit for an interface (Denys Vlasenko) [1208494 1208496] {CVE-2015-2922}
  - [x86] kernel: execution in the early microcode loader (Jacob Tanenbaum) [1206829 1206830] {CVE-2015-2666}
  - [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Seth Jennings) [1202861 1198843] {CVE-2015-1805}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.9.1.el7]
changelog:
  - [crypto] krng: Remove krng (Herbert Xu) [1238210 1229738]
  - [crypto] drbg: Add stdrng alias and increase priority (Herbert Xu) [1238210 1229738]
  - [crypto] seqiv: Move IV seeding into init function (Herbert Xu) [1238210 1229738]
  - [crypto] eseqiv: Move IV seeding into init function (Herbert Xu) [1238210 1229738]
  - [crypto] chainiv: Move IV seeding into init function (Herbert Xu) [1238210 1229738]
  - [s390] crypto: ghash - Fix incorrect ghash icv buffer handling (Herbert Xu) [1238211 1207598]
  - [kernel] module: Call module notifier on failure after complete_formation() (Bandan Das) [1238937 1236273]
  - [net] ipv4: kABI fix for 0bbf87d backport (Aristeu Rozanski) [1238208 1184764]
  - [net] ipv4: Convert ipv4.ip_local_port_range to be per netns (Aristeu Rozanski) [1238208 1184764]
  - [of] Eliminate of_allnodes list (Gustavo Duarte) [1236983 1210533]
  - [scsi] ipr: Increase default adapter init stage change timeout (Steve Best) [1236139 1229217]
  - [fs] libceph: fix double __remove_osd() problem (Sage Weil) [1236462 1229488]
  - [fs] ext4: fix data corruption caused by unwritten and delayed extents (Lukas Czerner) [1235563 1213487]
  - [kernel] watchdog: update watchdog_thresh properly (Ulrich Obergfell) [1223924 1216074]
  - [kernel] watchdog: update watchdog attributes atomically (Ulrich Obergfell) [1223924 1216074]
  - [virt] kvm: ensure hard lockup detection is disabled by default (Andrew Jones) [1236461 1111262]
  - [watchdog] control hard lockup detection default (Andrew Jones) [1236461 1111262]
  - [watchdog] Fix print-once on enable (Andrew Jones) [1236461 1111262]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.10.1.el7]
changelog:
  - [redhat] spec: Update dracut dependency to pull in drbg module (Phillip Lougher) [1241571 1241344]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.11.1.el7]
changelog:
  - [fs] Fixing lease renewal (Steve Dickson) [1226328 1205048]
  - [fs] revert "nfs: Fixing lease renewal" (Carlos Maiolino) [1226328 1205048]
  - [redhat] spec: Update dracut dependency to 033-241.[el7|ael7b]_1.5 (Phillip Lougher) [1241571 1241344]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.12.1.el7]
changelog:
  - [ethernet] ixgbe: remove CIAA/D register reads from bad VF check (John Greene) [1245597 1205903]
  - [kernel] sched: Avoid throttle_cfs_rq() racing with period_timer stopping (Rik van Riel) [1241078 1236413]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.13.1.el7]
changelog:
  - [dma] ioat: fix tasklet tear down (Herton R. Krzesinski) [1251523 1210093]
  - [drm] radeon: Fix VGA switcheroo problem related to hotplug (missing hunk) (Rob Clark) [1207879 1223472]
  - [security] keys: Ensure we free the assoc array edit if edit is valid (David Howells) [1246039 1244171] {CVE-2015-1333}
  - [net] tcp: properly handle stretch acks in slow start (Florian Westphal) [1243903 1151756]
  - [net] tcp: fix no cwnd growth after timeout (Florian Westphal) [1243903 1151756]
  - [net] tcp: increase throughput when reordering is high (Florian Westphal) [1243903 1151756]
  - [of] Fix sysfs_dirent cache integrity issue (Gustavo Duarte) [1249120 1225539]
  - [tty] vt: don't set font mappings on vc not supporting this (Jarod Wilson) [1248384 1213538]
  - [scsi] fix regression in scsi_send_eh_cmnd() (Ewan Milne) [1243412 1167454]
  - [net] udp: fix behavior of wrong checksums (Denys Vlasenko) [1240760 1240761] {CVE-2015-5364 CVE-2015-5366}
  - [fs] Convert MessageID in smb2_hdr to LE (Sachin Prabhu) [1238693 1161441]
  - [x86] bpf_jit: fix compilation of large bpf programs (Denys Vlasenko) [1236938 1236939] {CVE-2015-4700}
  - [net] sctp: fix ASCONF list handling (Marcelo Leitner) [1227960 1206474] {CVE-2015-3212}
  - [fs] ext4: allocate entire range in zero range (Lukas Czerner) [1193909 1187071] {CVE-2015-0275}
  - [x86] ASLR bruteforce possible for vdso library (Jacob Tanenbaum) [1184898 1184899] {CVE-2014-9585}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.14.1.el7]
changelog:
  - [s390] zcrypt: Fixed reset and interrupt handling of AP queues (Hendrik Brueckner) [1248381 1238230]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.15.1.el7]
changelog:
  - [cpufreq] intel_pstate: Fix overflow in busy_scaled due to long delay (Prarit Bhargava) [1255496 1228346]
  - [netdrv] be2net: avoid vxlan offloading on multichannel configs (Ivan Vecera) [1256609 1232327]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.17.1.el7]
changelog:
  - [hv] vmbus: Cleanup vmbus_establish_gpadl() (Vitaly Kuznetsov) [1262096 1211914]
  - [scsi] iscsi: let session recovery_tmo sysfs writes persist across recovery (Chris Leech) [1261879 1139038]
  - [scsi] ipr: Fix invalid array indexing for HRRQ (Gustavo Duarte) [1260625 1251184]
  - [scsi] ipr: Fix incorrect trace indexing (Gustavo Duarte) [1260625 1251184]
  - [net] netfilter: synproxy: fix sending window update to client (Phil Sutter) [1257289 1257290 1251031 1242094]
  - [net] netfilter: ip6t_synproxy: fix NULL pointer dereference (Phil Sutter) [1257289 1257290 1251031 1242094]
  - [fs] nfsv4: Always drain the slot table before re-establishing the lease (Benjamin Coddington) [1256649 1240790]
  - [fs] Recover from stateid-type error on SETATTR (Benjamin Coddington) [1256639 1214410]
  - [netdrv] virtio-net: drop NETIF_F_FRAGLIST (Jason Wang) [1247839 1247840] {CVE-2015-5156}
  - [x86] mm: add memory tracking to native_pmdp_get_and_clear (David Bulkow) [1263525 1227357]
  - [fs] dcache: d_walk() might skip too much (Denys Vlasenko) [1173812 1173813] {CVE-2014-8559}
  - [fs] dcache: deal with deadlock in d_walk() (Denys Vlasenko) [1173812 1173813] {CVE-2014-8559}
  - [fs] dcache: move d_rcu from overlapping d_child to overlapping d_alias (Denys Vlasenko) [1173812 1173813] {CVE-2014-8559}
  - [fs] dcache: fold try_to_ascend() into the sole remaining caller (Denys Vlasenko) [1173812 1173813] {CVE-2014-8559}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.18.1.el7]
changelog:
  - [scsi] sd: split sd_init_command (Ewan Milne) [1264141 1109348]
  - [scsi] sd: retry discard commands (Ewan Milne) [1264141 1109348]
  - [scsi] sd: retry write same commands (Ewan Milne) [1264141 1109348]
  - [scsi] sd: don't use scsi_setup_blk_pc_cmnd for discard requests (Ewan Milne) [1264141 1109348]
  - [scsi] sd: don't use scsi_setup_blk_pc_cmnd for write same requests (Ewan Milne) [1264141 1109348]
  - [scsi] sd: don't use scsi_setup_blk_pc_cmnd for flush requests (Ewan Milne) [1264141 1109348]
  - [scsi] set sc_data_direction in common code (Ewan Milne) [1264141 1109348]
  - [scsi] restructure command initialization for TYPE_FS requests (Ewan Milne) [1264141 1109348]
  - [scsi] move the nr_phys_segments assert into scsi_init_io (Ewan Milne) [1264141 1109348]
  - [fs] xfs: remove bitfield based superblock updates (Brian Foster) [1261781 1225075]
  - [netdrv] ixgbe: fix X540 Completion timeout (John Greene) [1257633 1173786]
  - [lib] radix-tree: handle allocation failure in radix_tree_insert() (Seth Jennings) [1264142 1260613]
  - [crypto] nx - Fixing the limit number of bytes to be processed (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Fix SHA concurrence issue and sg limit bounds (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-XCBC to be processed logic (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-GCM to be processed logic (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-ECB to be processed logic (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving limit and bound logic in CTR and fix IV vector (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-CCM to be processed logic and sg_list bounds (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Moving NX-AES-CBC to be processed logic (Herbert Xu) [1247127 1190103]
  - [crypto] nx - Check for bogus firmware properties (Herbert Xu) [1247127 1190103]
  - [md] raid1: extend spinlock to protect raid1_end_read_request against inconsistencies (Jes Sorensen) [1263416 1255758]
  - [md] raid1: fix test for 'was read error from last working device' (Jes Sorensen) [1263416 1255758]
  - [fs] xfs: direct IO EOF zeroing needs to drain AIO (Brian Foster) [1258942 1213370]
  - [fs] xfs: DIO write completion size updates race (Brian Foster) [1258942 1213370]
  - [fs] pnfs: Fix a memory leak when attempted pnfs fails (Steve Dickson) [1256640 1234986]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.19.1.el7]
changelog:
  - Revert: [fs] xfs: DIO write completion size updates race (Phillip Lougher) [1258942 1213370]
  - Revert: [fs] xfs: direct IO EOF zeroing needs to drain AIO (Phillip Lougher) [1258942 1213370]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.20.1.el7]
changelog:
  - Revert: [crypto] nx - Check for bogus firmware properties (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-CBC to be processed logic (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-CCM to be processed logic and sg_list bounds (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving limit and bound logic in CTR and fix IV vector (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-ECB to be processed logic (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-GCM to be processed logic (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Moving NX-AES-XCBC to be processed logic (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Fix SHA concurrence issue and sg limit bounds (Phillip Lougher) [1247127 1190103]
  - Revert: [crypto] nx - Fixing the limit number of bytes to be processed (Phillip Lougher) [1247127 1190103]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.2.1.el7]
changelog:
  - [char] tpm: Added Little Endian support to vtpm module (Steve Best) [1207051 1189017]
  - [powerpc] pseries: Fix endian problems with LE migration (Steve Best) [1207050 1183198]
  - [iommu] vt-d: Work around broken RMRR firmware entries (Myron Stowe) [1205303 1195802]
  - [iommu] vt-d: Store bus information in RMRR PCI device path (Myron Stowe) [1205303 1195802]
  - [s390] zcrypt: enable s390 hwrng to seed kernel entropy (Hendrik Brueckner) [1205300 1196398]
  - [s390] zcrypt: improve device probing for zcrypt adapter cards (Hendrik Brueckner) [1205300 1196398]
  - [net] team: fix possible null pointer dereference in team_handle_frame (Jiri Pirko) [1202359 1188496]
  - [fs] fsnotify: fix handling of renames in audit (Paul Moore) [1202358 1191562]
  - [net] openvswitch: Fix net exit (Jiri Benc) [1202357 1200859]
  - [fs] gfs2: Move gfs2_file_splice_write outside of #ifdef (Robert S Peterson) [1201256 1193910]
  - [fs] gfs2: Allocate reservation during splice_write (Robert S Peterson) [1201256 1193910]
  - [crypto] aesni: fix "by8" variant for 128 bit keys (Herbert Xu) [1201254 1174971]
  - [crypto] aesni: remove unused defines in "by8" variant (Herbert Xu) [1201254 1174971]
  - [crypto] aesni: fix counter overflow handling in "by8" variant (Herbert Xu) [1201254 1174971]
  - [crypto] aes: AES CTR x86_64 "by8" AVX optimization (Herbert Xu) [1201254 1174971]
  - [kernel] audit: restore AUDIT_LOGINUID unset ABI (Richard Guy Briggs) [1197748 1120491]
  - [kernel] audit: replace getname()/putname() hacks with reference counters (Paul Moore) [1197746 1155208]
  - [kernel] audit: fix filename matching in __audit_inode() and __audit_inode_child() (Paul Moore) [1197746 1155208]
  - [kernel] audit: enable filename recording via getname_kernel() (Paul Moore) [1197746 1155208]
  - [fs] namei: simpler calling conventions for filename_mountpoint() (Paul Moore) [1197746 1155208]
  - [fs] namei: create proper filename objects using getname_kernel() (Paul Moore) [1197746 1155208]
  - [fs] namei: rework getname_kernel to handle up to PATH_MAX sized filenames (Paul Moore) [1197746 1155208]
  - [fs] namei: cut down the number of do_path_lookup() callers (Paul Moore) [1197746 1155208]
  - [fs] execve: use 'struct filename *' for executable name passing (Paul Moore) [1197746 1155208]
  - [infiniband] core: Prevent integer overflow in ib_umem_get address arithmetic (Doug Ledford) [1181177 1179347] {CVE-2014-8159}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.4.2.el7]
changelog:
  - [x86] crypto: aesni - fix memory usage in GCM decryption (Kurt Stutsman) [1213331 1212178] {CVE-2015-3331}


author: Phillip Lougher <plougher@redhat.com> [3.10.0-229.7.2.el7]
changelog:
  - [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Seth Jennings) [1202861 1198843] {CVE-2015-1805}


author: Jarod Wilson <jarod@redhat.com> [3.10.0-221.el7]
changelog:
  - [ethernet] enic: fix rx skb checksum (Stefan Assmann) [1154182]
  - [x86] uv: make kdump default action for 'power nmi' (George Beshers) [1175560]
  - [virt] powerpc/kvm: book3s_hv - Fix KSM memory corruption (David Gibson) [1170394]
  - [pci] Revert: Remove from bus_list and release resources in pci_release_dev() (Prarit Bhargava) [1172946]
  - [powercap] rapl: add support for CPU model 0x3f (Rui Wang) [1177579]
  - [kernel] audit: don't attempt to lookup PIDs when changing PID filtering audit rules (Paul Moore) [1172624]
  - [ethernet] ixgbe: avoid possible read_reg panic caused by late method binding (John Greene) [1145772]
  - [ethernet] ixgbe: bump version number (John Greene) [1145772]
  - [ethernet] ixgbe: Add X550 support function pointers (John Greene) [1145772]
  - [ethernet] ixgbe: Add new support for X550 MAC's (John Greene) [1145772]
  - [ethernet] ixgbe: Add x550 SW/FW semaphore support (John Greene) [1145772]
  - [ethernet] ixgbe: add methods for combined read and write operations (John Greene) [1145772]
  - [ethernet] ixgbe: cleanup checksum to allow error results (John Greene) [1145772]
  - [ethernet] ixgbe: Add timeout parameter to ixgbe_host_interface_command (John Greene) [1145772]
  - [ethernet] ixgbe: Fix spurious release of semaphore in EEPROM access (John Greene) [1145772]
  - [drm] i915: remove the IRQs enabled WARN from intel_disable_gt_powersave (Rob Clark) [1173317]
  - [drm] i915: tame the chattermouth (Rob Clark) [1173317]
  - [drm] ttm: Avoid memory allocation from shrinker functions (Rob Clark) [1173317]
  - [drm] ttm: Fix possible stack overflow by recursive shrinker calls (Rob Clark) [1173317]
  - [drm] ttm: Use mutex_trylock() to avoid deadlock inside shrinker functions (Rob Clark) [1173317]
  - [drm] video/fb: Propagate error code from failing to unregister conflicting fb (Rob Clark) [1173317]
  - [drm] i915: save/restore GMBUS freq across suspend/resume on gen4 (Rob Clark) [1173317]
  - [drm] i915: resume MST after reading back hw state (Rob Clark) [1173317]
  - [drm] dp-mst: Remove branches before dropping the reference (Rob Clark) [1173317]
  - [drm] fb_helper: move deferred fb checking into restore mode (Rob Clark) [1173317]
  - [drm] dp: retry AUX transactions 32 times (v1.1) (Rob Clark) [1173317]
  - [drm] i915: Ignore long hpds on eDP ports (Rob Clark) [1173317]
  - [drm] i915/dp: only use training pattern 3 on platforms that support it (Rob Clark) [1173317]
  - [drm] radeon: sync all BOs involved in a CS (Rob Clark) [1173317]
  - [drm] radeon: kernel panic in drm_calc_vbltimestamp_from_scanoutpos with 3.18.0-rc6 (Rob Clark) [1173317]
  - [drm] i915: Unlock panel even when LVDS is disabled (Rob Clark) [1173317]
  - [drm] i915: More cautious with pch fifo underruns (Rob Clark) [1173317]
  - [drm] i915: Ignore SURFLIVE and flip counter when the GPU gets reset (Rob Clark) [1173317]
  - [drm] i915: Kick fbdev before vgacon (Rob Clark) [1173317]
  - [drm] i915: Handle failure to kick out a conflicting fb driver (Rob Clark) [1173317]
  - [drm] i915: drop WaSetupGtModeTdRowDispatch:snb (Rob Clark) [1173317]
  - [drm] radeon: add locking around atombios scratch space usage (Rob Clark) [1173317]
  - [drm] radeon: add missing crtc unlock when setting up the MC (Rob Clark) [1173317]
  - [drm] i915: Disable caches for Global GTT (Rob Clark) [1173317]
  - [drm] i915: Do not leak pages when freeing userptr objects (Rob Clark) [1173317]
  - [drm] ast: Fix HW cursor image (Rob Clark) [1173317]
  - [drm] radeon: Use drm_malloc_ab instead of kmalloc_array (Rob Clark) [1173317]
  - [drm] radeon/dpm: disable ulv support on SI (Rob Clark) [1173317]
  - [drm] i915: Do a dummy DPCD read before the actual read (Rob Clark) [1173317]
  - [drm] nouveau/bios: memset dcb struct to zero before parsing (Rob Clark) [1173317]
  - [drm] nv50/disp: fix dpms regression on certain boards (Rob Clark) [1173317]
  - [drm] nouveau/ltc: fix cbc issues on certain boards (Rob Clark) [1173317]
  - [drm] nouveau/ltc: fix tag base address getting truncated if above 4GiB (Rob Clark) [1173317]
  - [drm] nvc0-/fb/ram: fix use of non-existant ram if partitions aren't uniform (Rob Clark) [1173317]
  - [drm] nouveau/bar: behave better if ioremap failed (Rob Clark) [1173317]
  - [drm] nouveau: make sure display hardware is reinitialised on runtime resume (Rob Clark) [1173317]
  - [drm] nouveau: punt fbcon resume out to a workqueue (Rob Clark) [1173317]
  - [drm] nouveau/kms: restore acceleration before fb_set_suspend() resumes (Rob Clark) [1173317]
  - [drm] nouveau/kms: take more care when pulling down accelerated fbcon (Rob Clark) [1173317]
  - [drm] i915: Flush the PTEs after updating them before suspend (Rob Clark) [1153301]
  - [drm] radeon/cik: use a separate counter for CP init timeout (Rob Clark) [1173317]
  - [drm] radeon/dpm: fix resume on mullins (Rob Clark) [1173317]
  - [drm] radeon: don't reset dma on r6xx-evergreen init (Rob Clark) [1173317]
  - [drm] radeon: don't reset sdma on CIK init (Rob Clark) [1173317]
  - [drm] radeon: don't reset dma on NI/SI init (Rob Clark) [1173317]
  - [drm] radeon: add connector quirk for fujitsu board (Rob Clark) [1173317]
  - [drm] radeon/dpm: set the thermal type properly for special configs (Rob Clark) [1173317]
  - [drm] radeon: fix semaphore value init (Rob Clark) [1173317]
  - [drm] radeon: handle broken disabled rb mask gracefully (6xx/7xx) (Rob Clark) [1173317]
  - [drm] radeon: fix active_cu mask on SI and CIK after re-init (v3) (Rob Clark) [1173317]
  - [drm] radeon: fix active cu count for SI and CIK (Rob Clark) [1173317]
  - [drm] radeon: fix pm handling in radeon_gpu_reset (Rob Clark) [1173317]
  - [drm] radeon: properly document reloc priority mask (Rob Clark) [1173317]
  - [drm] radeon/dpm: select the appropriate vce power state for KV/KB/ML (Rob Clark) [1173317]
  - [drm] radeon: Add missing lines to ci_set_thermal_temperature_range (Rob Clark) [1173317]
  - [drm] radeon: Add ability to get and change dpm state when radeon PX card is turned off (Rob Clark) [1173317]
  - [drm] vmwgfx: Fix a potential infinite spin waiting for fifo idle (Rob Clark) [1173317]
  - [drm] ast: AST2000 cannot be detected correctly (Rob Clark) [1173317]
  - [drm] ast: open key before detect chips (Rob Clark) [1173317]
  - [drm] i915: Don't leak command parser tables on suspend/resume (Rob Clark) [1153301]
  - [drm] i915/hdmi: fix hdmi audio state readout (Rob Clark) [1153301]
  - [drm] i915: Wait for vblank before enabling the TV encoder (Rob Clark) [1153301]
  - [drm] i915: Fix EIO/wedged handling in gem fault handler (Rob Clark) [1153301]
  - [drm] i915: Fix lock dropping in intel_tv_detect() (Rob Clark) [1153301]
  - [drm] i915: Remove bogus __init annotation from DMI callbacks (Rob Clark) [1153301]
  - [drm] i915: Ignore VBT backlight presence check on Acer C720 (4005U) (Rob Clark) [1153301]
  - [drm] i915: fix plane/cursor handling when runtime suspended (Rob Clark) [1153301]
  - [drm] i915: don't try to retrain a DP link on an inactive CRTC (Rob Clark) [1153301]
  - [drm] i915: Fix locking for intel_enable_pipe_a() (Rob Clark) [1153301]
  - [drm] i915: Skip load detect when intel_crtc->new_enable==true (Rob Clark) [1153301]
  - [drm] i915: Disable RCS flips on Ivybridge (Rob Clark) [1153301]
  - [drm] i915: read HEAD register back in init_ring_common() to enforce ordering (Rob Clark) [1153301]
  - [drm] i915: Fix crash when failing to parse MIPI VBT (Rob Clark) [1153301]
  - [drm] radeon: tweak ACCEL_WORKING2 query for hawaii (Rob Clark) [1173317]
  - [drm] radeon/atom: add new voltage fetch function for hawaii (Rob Clark) [1173317]
  - [drm] radeon: set VM base addr using the PFP (Rob Clark) [1173317]
  - [drm] radeon: load the lm63 driver for an lm64 thermal chip (Rob Clark) [1173317]
  - [drm] radeon: re-enable dpm by default on BTC (Rob Clark) [1173317]
  - [drm] radeon: re-enable dpm by default on cayman (Rob Clark) [1173317]
  - [drm] radeon/dpm: handle voltage info fetching on hawaii (Rob Clark) [1173317]
  - [drm] ttm: Choose a pool to shrink correctly in ttm_dma_pool_shrink_scan() (Rob Clark) [1173317]
  - [drm] ttm: Fix possible division by 0 in ttm_dma_pool_shrink_scan() (Rob Clark) [1173317]
  - [drm] ttm: fix handling of TTM_PL_FLAG_TOPDOWN (Rob Clark) [1173317]
  - [drm] nouveau: Bump version from 1.1.1 to 1.1.2 (Rob Clark) [1173317]
  - [drm] nouveau: Dis/Enable vblank irqs during suspend/resume (Rob Clark) [1173317]
  - [drm] radeon: add additional SI pci ids (Rob Clark) [1173317]
  - [drm] radeon: add new bonaire pci ids (Rob Clark) [1173317]
  - [drm] radeon: add new KV pci id (Rob Clark) [1173317]
  - [powerpc] add little endian flag to syscall_get_arch() (Richard Guy Briggs) [1169461]
  - [powerpc] simplify syscall_get_arch() (Richard Guy Briggs) [1169461]


author: Jarod Wilson <jarod@redhat.com> [3.10.0-222.el7]
changelog:
  - [scsi] qla2xxx: Update version number to 8.07.00.08.07.1-k2 (Chad Dupuis) [1085239]
  - [scsi] qla2xxx: Move mailbox failure messages to a default debug level (Chad Dupuis) [1085239]
  - [security] commoncap: don't alloc the credential unless needed in cap_task_prctl (Paul Moore) [1056347]
  - [iommu] vt-d: Fix dmar_domain leak in iommu_attach_device (Myron Stowe) [1109829]
  - [iommu] vt-d: Only remove domain when device is removed (Myron Stowe) [1109829]
  - [base] core: Add BUS_NOTIFY_REMOVED_DEVICE event (Myron Stowe) [1109829]
  - [powerpc] kdump: Ignore failure in enabling big endian exception during crash (Steve Best) [1170362]
  - [infiniband] srpt: convert printk's to pr_* functions (Doug Ledford) [1174910]
  - [infiniband] srpt: Handle GID change events (Doug Ledford) [1174910]
  - [input] alps: fix v4 button press recognition (Benjamin Tissoires) [1107819]
  - [input] alps: v7 - document the v7 touchpad packet protocol (Benjamin Tissoires) [1107819]
  - [input] alps: v7 - fix finger counting for > 2 fingers on clickpads (Benjamin Tissoires) [1107819]
  - [input] alps: v7 - sometimes a single touch is reported in mt[1] (Benjamin Tissoires) [1107819]
  - [input] alps: v7 - ignore new packets (Benjamin Tissoires) [1107819]
  - [powerpc] perf/hv-24x7: Use kmem_cache_free() instead of kfree (Gustavo Duarte) [1171795]
  - [powerpc] perf/hv-24x7: Use per-cpu page buffer (Gustavo Duarte) [1171795]
  - [powerpc] perf/hv-24x7: use kmem_cache instead of aligned stack allocations (Gustavo Duarte) [1171795]
  - [powerpc] perf/hv-24x7: Use kmem_cache_free (Gustavo Duarte) [1171795]
  - [powerpc] Fill in si_addr_lsb siginfo field (Gustavo Duarte) [1173267]
  - [powerpc] Add VM_FAULT_HWPOISON handling to powerpc page fault handler (Gustavo Duarte) [1173267]
  - [fs] dlm: fix missing endian conversion of rcom_status flags (Andrew Price) [1175900]
  - [scsi] add Intel Multi-Flex to scsi scan blacklist (Hannes Frederic Sowa) [1175862]
  - [scsi] do not issue SCSI RSOC command to Promise Vtrak E610f (Hannes Frederic Sowa) [1175862]
  - [scsi] scsi_lib: rate-limit the error message from failing commands (Tomas Henzl) [1175785]
  - [scsi] iscsi_ibft: Fix finding Broadcom specific ibft sign (Chris Leech) [1095169]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.2.1.el7]
changelog:
  - [netdrv] macvtap: unbreak receiving of gro skb with frag list (Jason Wang) [1279794 1273737]
  - [net] ipv6: drop frames with attached skb->sk in forwarding (Hannes Frederic Sowa) [1281701 1243966]
  - [net] ipv6: ip6_forward: perform skb->pkt_type check at the beginning (Hannes Frederic Sowa) [1281701 1243966]
  - [net] sctp: Fix race between OOTB responce and route removal (Jamie Bainbridge) [1281426 1277309]
  - [x86] mm: fix VM_FAULT_RETRY handling (Andrea Arcangeli) [1281427 1277226]
  - [x86] mm: consolidate VM_FAULT_RETRY handling (Andrea Arcangeli) [1281427 1277226]
  - [x86] mm: move mmap_sem unlock from mm_fault_error() to caller (Andrea Arcangeli) [1281427 1277226]
  - [mm] let mm_find_pmd fix buggy race with THP fault (Larry Woodman) [1281424 1273993]
  - [mm] ksm: unstable_tree_search_insert error checking cleanup (Andrea Arcangeli) [1281422 1274871]
  - [mm] ksm: use find_mergeable_vma in try_to_merge_with_ksm_page (Andrea Arcangeli) [1281422 1274871]
  - [mm] ksm: use the helper method to do the hlist_empty check (Andrea Arcangeli) [1281422 1274871]
  - [mm] ksm: don't fail stable tree lookups if walking over stale stable_nodes (Andrea Arcangeli) [1281422 1274871]
  - [mm] ksm: add cond_resched() to the rmap_walks (Andrea Arcangeli) [1281422 1274871]
  - [powerpc] kvm: book3s_hv: Synthesize segment fault if SLB lookup fails (Thomas Huth) [1281423 1269467]
  - [powerpc] kvm: book3s_hv: Create debugfs file for each guest's HPT (David Gibson) [1281420 1273692]
  - [powerpc] kvm: book3s_hv: Add helpers for lock/unlock hpte (David Gibson) [1281420 1273692]
  - [powerpc] pci: initialize hybrid_dma_data before use (Laurent Vivier) [1279793 1270717]
  - [md] raid10: don't clear bitmap bit when bad-block-list write fails (Jes Sorensen) [1279796 1267652]
  - [md] raid1: don't clear bitmap bit when bad-block-list write fails (Jes Sorensen) [1279796 1267652]
  - [md] raid10: submit_bio_wait() returns 0 on success (Jes Sorensen) [1279796 1267652]
  - [md] raid1: submit_bio_wait() returns 0 on success (Jes Sorensen) [1279796 1267652]
  - [md] crash in md-raid1 and md-raid10 due to incorrect list manipulation (Jes Sorensen) [1279796 1267652]
  - [md] raid10: ensure device failure recorded before write request returns (Jes Sorensen) [1279796 1267652]
  - [md] raid1: ensure device failure recorded before write request returns (Jes Sorensen) [1279796 1267652]
  - [block] nvme: Fix memory leak on retried commands (David Milburn) [1279792 1271860]
  - [cpufreq] intel_pstate: fix rounding error in max_freq_pct (Prarit Bhargava) [1281491 1263866]
  - [cpufreq] intel_pstate: fix PCT_TO_HWP macro (Prarit Bhargava) [1273926 1264990]
  - [cpufreq] revert "intel_pstate: add quirk to disable HWP on Skylake-S processors" (Prarit Bhargava) [1273926 1264990]
  - [cpufreq] revert "intel_pstate: disable Skylake processors" (Prarit Bhargava) [1273926 1264990]
  - [x86] kvm: svm: unconditionally intercept #DB (Paolo Bonzini) [1279469 1279470] {CVE-2015-8104}
  - [x86] virt: guest to host DoS by triggering an infinite loop in microcode (Paolo Bonzini) [1277560 1277561] {CVE-2015-5307}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.5.1.el7]
changelog:
  - [net] vsock: Fix lockdep issue (Dave Anderson) [1292372 1253971]
  - [net] vsock: sock_put wasn't safe to call in interrupt context (Dave Anderson) [1292372 1253971]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.7.1.el7]
changelog:
  - [scsi] scsi_sysfs: protect against double execution of __scsi_remove_device() (Vitaly Kuznetsov) [1292075 1273723]
  - [powerpc] mm: Recompute hash value after a failed update (Gustavo Duarte) [1289452 1264920]
  - [misc] genwqe: get rid of atomic allocations (Hendrik Brueckner) [1289450 1270244]
  - [mm] use only per-device readahead limit (Eric Sandeen) [1287550 1280355]
  - [net] ipv6: update ip6_rt_last_gc every time GC is run (Hannes Frederic Sowa) [1285370 1270092]
  - [kernel] tick: broadcast: Prevent livelock from event handler (Prarit Bhargava) [1284043 1265283]
  - [kernel] clockevents: Serialize calls to clockevents_update_freq() in the core (Prarit Bhargava) [1284043 1265283]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.8.1.el7]
changelog:
  - [md] dm: fix AB-BA deadlock in __dm_destroy() (Mike Snitzer) [1296566 1292481]
  - [md] revert "dm-mpath: fix stalls when handling invalid ioctls" (Mike Snitzer) [1287552 1277194]
  - [cpufreq] intel_pstate: Fix limits->max_perf rounding error (Prarit Bhargava) [1296276 1279617]
  - [cpufreq] intel_pstate: Fix limits->max_policy_pct rounding error (Prarit Bhargava) [1296276 1279617]
  - [cpufreq] revert "intel_pstate: fix rounding error in max_freq_pct" (Prarit Bhargava) [1296276 1279617]
  - [crypto] nx: 842 - Add CRC and validation support (Gustavo Duarte) [1289451 1264905]
  - [powerpc] eeh: More relaxed condition for enabled IO path (Steve Best) [1289101 1274731]
  - [security] keys: Don't permit request_key() to construct a new keyring (David Howells) [1275929 1273465] {CVE-2015-7872}
  - [security] keys: Fix crash when attempt to garbage collect an uninstantiated keyring (David Howells) [1275929 1273465] {CVE-2015-7872}
  - [security] keys: Fix race between key destruction and finding a keyring by name (David Howells) [1275929 1273465] {CVE-2015-7872}
  - [x86] paravirt: Replace the paravirt nop with a bona fide empty function (Mateusz Guzik) [1259582 1259583] {CVE-2015-5157}
  - [x86] nmi: Fix a paravirt stack-clobbering bug in the NMI code (Mateusz Guzik) [1259582 1259583] {CVE-2015-5157}
  - [x86] nmi: Use DF to avoid userspace RSP confusing nested NMI detection (Mateusz Guzik) [1259582 1259583] {CVE-2015-5157}
  - [x86] nmi: Reorder nested NMI checks (Mateusz Guzik) [1259582 1259583] {CVE-2015-5157}
  - [x86] nmi: Improve nested NMI comments (Mateusz Guzik) [1259582 1259583] {CVE-2015-5157}
  - [x86] nmi: Switch stacks on userspace NMI entry (Mateusz Guzik) [1259582 1259583] {CVE-2015-5157}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.9.1.el7]
changelog:
  - [security] keys: Fix keyring ref leak in join_session_keyring() (David Howells) [1298931 1298036] {CVE-2016-0728}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.10.1.el7]
changelog:
  - [of] return NUMA_NO_NODE from fallback of_node_to_nid() (Thadeu Lima de Souza Cascardo) [1300614 1294398]
  - [net] openvswitch: do not allocate memory from offline numa node (Thadeu Lima de Souza Cascardo) [1300614 1294398]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.11.1.el7]
changelog:
  - [fs] namespaces: Use task_lock and not rcu to protect nsproxy (Hannes Frederic Sowa) [1300618 1297032]
  - [fs] proc_namespace: simplify testing nsp and nsp->mnt_ns (Hannes Frederic Sowa) [1300618 1297032]
  - [net] possible use after free in dst_release (Hannes Frederic Sowa) [1300610 1296299]
  - [net] fix a race in dst_release() (Hannes Frederic Sowa) [1300610 1296299]
  - [net] ratelimit warnings about dst entry refcount underflow or overflow (Hannes Frederic Sowa) [1300610 1296299]
  - [net] fix IP early demux races (Hannes Frederic Sowa) [1300610 1296299]
  - [usb] xhci: init command timeout timer earlier to avoid deleting it uninitialized (Don Zickus) [1300605 1290202]
  - [scsi] be2iscsi: Fix updating the next pointer during WRB posting (Maurizio Lombardi) [1298981 1229330]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.12.1.el7]
changelog:
  - [md] dm-thin-metadata: fix bug in dm_thin_remove_range() (Mike Snitzer) [1310531 1284833]
  - [md] dm-thin: fix regression in advertised discard limits (Mike Snitzer) [1310531 1284833]
  - [scsi] hpsa: Update driver revision to RH2 (Joseph Szczypek) [1308923 1268073]
  - [scsi] hpsa: fix issues with multilun devices (Joseph Szczypek) [1308923 1268073]
  - [net] tcp: honour SO_BINDTODEVICE for TW_RST case too (Florian Westphal) [1308917 1295557]
  - [net] tcp: send_reset: test for non-NULL sk first (Florian Westphal) [1308917 1295557]
  - [net] add inet_sk_transparent() helper (Florian Westphal) [1308917 1295557]
  - [net] add sk_fullsock() helper (Florian Westphal) [1308917 1295557]
  - [net] ipv6: Fix regression in udp_v6_mcast_next() (Hannes Frederic Sowa) [1308921 1298790]
  - [netdrv] mlx4_en: Remove BUG_ON assert when checking if ring is full (Kamal Heib) [1310132 1258136]
  - [netdrv] cxgb4: changes for new firmware 1.14.4.0 (Sai Vemuri) [1309541 1275825]
  - [netdrv] iwlwifi: pci: add a few more PCI subvendor IDs for the 7265 series (Stanislaw Gruszka) [1304336 1287564]
  - [netdrv] iwlwifi: edit the 3165 series and 8000 series PCI IDs (Stanislaw Gruszka) [1301885 1279780]
  - [netdrv] iwlwifi: Add new PCI IDs for the 8260 series (Stanislaw Gruszka) [1301885 1279780]
  - [mm] memcg: oom_notify use-after-free fix (Rafael Aquini) [1298212 1294114]
  - [powerpc] kvm: Increase memslots to 512 (Thomas Huth) [1297758 1276254]
  - [powerpc] kvm: Implement extension to report number of memslots (Thomas Huth) [1297758 1276254]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.13.1.el7]
changelog:
  - [net] veth: don't modify ip_summed; doing so treats packets with bad checksums as good (Sabrina Dubroca) [1312430 1307099]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.14.1.el7]
changelog:
  - [kernel] sched: Move cpu_active() tests from stop_two_cpus() into migrate_swap_stop() (Oleg Nesterov) [1299338 1252281]
  - [kernel] stop_machine: Change cpu_stop_queue_two_works() to rely on stopper->enabled (Oleg Nesterov) [1299338 1252281]
  - [kernel] stop_machine: Introduce __cpu_stop_queue_work() and cpu_stop_queue_two_works() (Oleg Nesterov) [1299338 1252281]
  - [kernel] stop_machine: Ensure that a queued callback will be called before cpu_stop_park() (Oleg Nesterov) [1299338 1252281]
  - [kernel] stop_machine: Remove cpu_stop_work's from list in cpu_stop_park() (Oleg Nesterov) [1299338 1252281]
  - [kernel] stop_machine: Don't do for_each_cpu() twice in queue_stop_cpus_work() (Oleg Nesterov) [1299338 1252281]
  - [kernel] stop_machine: Move 'cpu_stopper_task' and 'stop_cpus_work' into 'struct cpu_stopper' (Oleg Nesterov) [1299338 1252281]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.15.1.el7]
changelog:
  - [netdrv] sfc: push partner queue for skb->xmit_more (Jarod Wilson) [1318323 1267167]
  - [netdrv] sfc: replace spinlocks with bit ops for busy poll locking (Jarod Wilson) [1318323 1267167]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.16.1.el7]
changelog:
  - [tty] pty: make sure super_block is still valid in final /dev/tty close (Herton R. Krzesinski) [1320297 1291313]
  - [tty] pty: fix possible use after free of tty->driver_data (Herton R. Krzesinski) [1320297 1291313]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.17.1.el7]
changelog:
  - [fs] ceph: make fsync() wait unsafe requests that created/modified inode (Zheng Yan) [1320033 1291193]
  - [fs] ceph: add request to i_unsafe_dirops when getting unsafe reply (Zheng Yan) [1320033 1291193]
  - [fs] ceph: don't invalidate page cache when inode is no longer used (Zheng Yan) [1320033 1291193]
  - [fs] ceph: fix message length computation (Zheng Yan) [1320033 1291193]
  - [fs] ceph: improve readahead for file holes (Zheng Yan) [1320033 1291193]
  - [fs] ceph: get inode size for each append write (Zheng Yan) [1320033 1291193]
  - [fs] ceph: cleanup use of ceph_msg_get (Zheng Yan) [1320033 1291193]
  - [fs] ceph: no need to get parent inode in ceph_open (Zheng Yan) [1320033 1291193]
  - [fs] ceph: remove the useless judgement (Zheng Yan) [1320033 1291193]
  - [fs] ceph: remove redundant test of head->safe and silence static analysis warnings (Zheng Yan) [1320033 1291193]
  - [fs] ceph: fix queuing inode to mdsdir's snaprealm (Zheng Yan) [1320033 1291193]
  - [fs] ceph: invalidate dirty pages after forced umount (Zheng Yan) [1320033 1291193]
  - [fs] ceph: EIO all operations after forced umount (Zheng Yan) [1320033 1291193]
  - [fs] ceph: always re-send cap flushes when MDS recovers (Zheng Yan) [1320033 1291193]
  - [fs] ceph: fix ceph_writepages_start() (Zheng Yan) [1320033 1291193]
  - [fs] ceph: switch some GFP_NOFS memory allocation to GFP_KERNEL (Zheng Yan) [1320033 1291193]
  - [fs] ceph: pre-allocate data structure that tracks caps flushing (Zheng Yan) [1320033 1291193]
  - [fs] ceph: re-send flushing caps (which are revoked) in reconnect stage (Zheng Yan) [1320033 1291193]
  - [fs] ceph: send TID of the oldest pending caps flush to MDS (Zheng Yan) [1320033 1291193]
  - [fs] ceph: track pending caps flushing globally (Zheng Yan) [1320033 1291193]
  - [fs] ceph: track pending caps flushing accurately (Zheng Yan) [1320033 1291193]
  - [fs] ceph: fix directory fsync (Zheng Yan) [1320033 1291193]
  - [fs] ceph: fix flushing caps (Zheng Yan) [1320033 1291193]
  - [fs] ceph: don't include used caps in cap_wanted (Zheng Yan) [1320033 1291193]
  - [fs] ceph: ratelimit warn messages for MDS closes session (Zheng Yan) [1320033 1291193]
  - [fs] ceph: simplify two mount_timeout sites (Zheng Yan) [1320033 1291193]
  - [fs] libceph: store timeouts in jiffies, verify user input (Zheng Yan) [1320033 1291193]
  - [fs] ceph: exclude setfilelock requests when calculating oldest tid (Zheng Yan) [1320033 1291193]
  - [fs] ceph: don't pre-allocate space for cap release messages (Zheng Yan) [1320033 1291193]
  - [fs] ceph: make sure syncfs flushes all cap snaps (Zheng Yan) [1320033 1291193]
  - [fs] ceph: don't trim auth cap when there are cap snaps (Zheng Yan) [1320033 1291193]
  - [fs] ceph: take snap_rwsem when accessing snap realm's cached_context (Zheng Yan) [1320033 1291193]
  - [fs] ceph: avoid sending unnessesary FLUSHSNAP message (Zheng Yan) [1320033 1291193]
  - [fs] ceph: set i_head_snapc when getting CEPH_CAP_FILE_WR reference (Zheng Yan) [1320033 1291193]
  - [fs] ceph: use empty snap context for uninline_data and get_pool_perm (Zheng Yan) [1320033 1291193]
  - [fs] ceph: check OSD caps before read/write (Zheng Yan) [1320033 1291193]
  - [fs] libceph: allow setting osd_req_op's flags (Zheng Yan) [1320033 1291193]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.18.1.el7]
changelog:
  - [scsi] bnx2fc: Fix FCP RSP residual parsing (Maurizio Lombardi) [1322279 1306342]
  - [mm] madvise: fix MADV_WILLNEED on shmem swapouts (Mitsuhiro Tanino) [1319845 1312729]
  - [scsi] bnx2fc: Remove explicit logouts (Maurizio Lombardi) [1317591 1303027]
  - [cpufreq] intel_pstate: decrease number of "HWP enabled" messages (David Arcari) [1316821 1310927]
  - [cpufreq] intel_pstate: enable HWP per CPU (David Arcari) [1316821 1310927]
  - [scsi] mpt3sas: Fix for Asynchronous completion of timedout IO and task abort of timedout IO (Tomas Henzl) [1316820 1259907]
  - [scsi] scsi_error: should not get sense for timeout IO in scsi error handler (Tomas Henzl) [1316820 1259907]
  - [scsi] Revert libiscsi: Reduce locking contention in fast path (Chris Leech) [1316812 1297876]
  - [powerpc] kvm: book3s_hv: Sanitize special-purpose register values on guest exit (Thomas Huth) [1316636 1313725]
  - [kernel] sched: Robustify topology setup (Gustavo Duarte) [1316158 1278875]
  - [kernel] sched: Don't set sd->child to NULL when it is already NULL (Gustavo Duarte) [1316158 1278875]
  - [ib] mlx5: Fix RC transport send queue overhead computation (Don Dutile) [1313814 1293336]
  - [block] nvme: default to 4k device page size (David Milburn) [1312399 1245140]
  - [powerpc] cxl: Fix unbalanced pci_dev_get in cxl_probe (Gustavo Duarte) [1312396 1288112]
  - [powerpc] eeh: Probe after unbalanced kref check (Gustavo Duarte) [1312396 1288112]
  - [fs] nfsd: fix clp->cl_revoked list deletion causing softlock in nfsd (J. Bruce Fields) [1311582 1300023]
  - [kernel] sched/fair: Disable tg load_avg/runnable_avg update for root_task_group (Jiri Olsa) [1306317 1289261]
  - [kernel] sched/fair: Move hot load_avg/runnable_avg into separate cacheline (Jiri Olsa) [1306317 1289261]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.18.2.el7]
changelog:
  - [lib] keys: Fix ASN.1 indefinite length object parsing (David Howells) [1308814 1308815] {CVE-2016-0758}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.19.1.el7]
changelog:
  - [net] tcp, dccp: warn user for preferred ip_local_port_range (Florian Westphal) [1323960 1305525]
  - [net] tcp, dccp: try to not exhaust ip_local_port_range in connect() (Florian Westphal) [1323960 1305525]
  - [net] tcp: improve REUSEADDR/NOREUSEADDR cohabitation (Florian Westphal) [1323960 1305525]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.20.1.el7]
changelog:
  - [kernel] audit: stop an old auditd being starved out by a new auditd (Richard Guy Briggs) [1328802 1253123]
  - [kernel] audit: try harder to send to auditd upon netlink failure (Richard Guy Briggs) [1328802 1253123]
  - [kernel] audit: remove stray newlines from audit_log_lost messages (Richard Guy Briggs) [1328802 1253123]
  - [kernel] audit: get rid of *NO* daemon at audit_pid=0 message (Richard Guy Briggs) [1328802 1253123]
  - [kernel] audit: prevent an older auditd shutdown from orphaning a newer auditd startup (Richard Guy Briggs) [1328802 1253123]
  - [net] netlink: don't hold mutex in rcu callback when releasing mmapd ring (Phil Sutter) [1328801 1238749]
  - [lib] rhashtable: Wait for RCU readers after final unzip work (Phil Sutter) [1328801 1238749]
  - [net] netlink: Lockless lookup with RCU grace period in socket release (Phil Sutter) [1328801 1238749]
  - [net] netlink: use jhash as hashfn for rhashtable (Phil Sutter) [1328801 1238749]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.21.1.el7]
changelog:
  - [lib] klist: fix starting point removed bug in klist iterators (Ewan Milne) [1333403 1309433]
  - [acpi] tables: test the correct variable (Prarit Bhargava) [1331681 1242556]
  - [x86] acpi: Handle apic/x2apic entries in MADT in correct order (Prarit Bhargava) [1331681 1242556]
  - [acpi] tables: Add acpi_subtable_proc to ACPI table parsers (Prarit Bhargava) [1331681 1242556]
  - [acpi] table: Always count matched and successfully parsed entries (Prarit Bhargava) [1331681 1242556]
  - [acpi] table: Add new function to get table entries (Prarit Bhargava) [1331681 1242556]
  - [netdrv] mlx4_en: Fix IRQ affinity on s390x (Kamal Heib) [1327583 1264148]
  - [usb] xhci: Workaround to get Intel xHCI reset working more reliably (Torez Smith) [1327581 1318570]
  - [block] Return EBUSY from BLKRRPART for mounted whole-dev fs (Eric Sandeen) [1324530 1285549]
  - [powerpc] eeh: Fix PE location code (Gustavo Duarte) [1324528 1302537]
  - [powerpc] eeh: Wrong place to call pci_get_slot() (Steve Best) [1327834 1273996]
  - [net] ipv6: Nonlocal bind (Sabrina Dubroca) [1324502 1315968]
  - [net] ipv4: bind ip_nonlocal_bind to current netns (Sabrina Dubroca) [1324502 1315968]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.22.1.el7]
changelog:
  - [mm] mmu_notifier: fix memory corruption (Jerome Glisse) [1335727 1307042]
  - [misc] cxl: Increase timeout for detection of AFU mmio hang (Steve Best) [1335419 1329682]
  - [misc] cxl: Configure the PSL for two CAPI ports on POWER8NVL (Steve Best) [1336389 1278793]
  - [powerpc] Define PVR value for POWER8NVL processor (Steve Best) [1336389 1278793]
  - [x86] Mark Intel Knights Landing-F processor as not supported (Steve Best) [1335407 1331516]
  - [netdrv] ixgbevf: fix spoofed packets with random MAC (Ken Cox) [1335406 1247345]
  - [netdrv] ixgbevf: use ether_addr_copy instead of memcpy (Ken Cox) [1335406 1247345]
  - [scsi] hpsa: update rev to 3.4.10-0-RH3 (Joseph Szczypek) [1334773 1296287]
  - [scsi] hpsa: check for a null phys_disk pointer in ioaccel2 path (Joseph Szczypek) [1334773 1296287]
  - [cpufreq] intel_pstate: Fix divide by zero on Knights Landing (Steve Best) [1334438 1273305]
  - [mm] hugetlbfs: optimize when NUMA=n (Rui Wang) [1334436 1274624]
  - [mm] hugetlb: use memory policy when available (Rui Wang) [1334436 1274624]
  - [mm] optimize put_mems_allowed() usage (Rui Wang) [1334436 1274624]
  - [x86] Mark Intel Knights Landing processor as supported (Steve Best) [1332991 1158238]
  - [block] virtio-blk: use VIRTIO_BLK_F_WCE and VIRTIO_BLK_F_CONFIG_WCE in virtio1 (Fam Zheng) [1327611 1266008]
  - [x86] mm: suitable memory should go to ZONE_MOVABLE (Igor Mammedov) [1327588 1265880]
  - [mm] memory-hotplug: add zone_for_memory() for selecting zone for new memory (Igor Mammedov) [1327588 1265880]
  - [s390] mm: Fix memory hotplug for unaligned standby memory (Igor Mammedov) [1327588 1265880]
  - [mm] memory-hotplug: Remove "weak" from memory_block_size_bytes() declaration (Igor Mammedov) [1327588 1265880]
  - [mm] Add prototype declaration to the header file (Igor Mammedov) [1327588 1265880]
  - [mm] hotplug: verify hotplug memory range (Igor Mammedov) [1327588 1265880]
  - [drm] vmwgfx: respect 'nomodeset' (Rob Clark) [1327587 1284936]
  - [net] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event (Xin Long) [1324748 1270586] {CVE-2015-8767}
  - [net] sctp: Whitespace fix (Xin Long) [1324748 1270586] {CVE-2015-8767}
  - [fs] xfs: fix splice/direct-IO deadlock (Bill O'Donnell) [1324098 824796]
  - [fs] vfs: split generic splice code from i_mutex locking (Bill O'Donnell) [1324098 824796]
  - [lib] keys: Fix ASN.1 indefinite length object parsing (David Howells) [1308814 1308815] {CVE-2016-0758}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.22.2.el7]
changelog:
  - [infiniband] security: Restrict use of the write() interface (Don Dutile) [1332553 1316685] {CVE-2016-4565}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.23.1.el7]
changelog:
  - [net] af_unix: Guard against other == sk in unix_dgram_sendmsg (Jakub Sitnicki) [1337513 1285792]
  - [net] unix: avoid use-after-free in ep_remove_wait_queue (Paolo Abeni) [1337513 1285792]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.26.1.el7]
changelog:
  - [block] blk-mq: fix race between timeout and freeing request (David Milburn) [1347743 1288601]
  - [x86] nmi: Fix use of unallocated cpumask_var_t (Jerry Snitselaar) [1346176 1069217]
  - [x86] nmi: Perform a safe NMI stack trace on all CPUs (Jerry Snitselaar) [1346176 1069217]
  - [kernel] printk: Add per_cpu printk func to allow printk to be diverted (Jerry Snitselaar) [1346176 1069217]
  - [lib] seq: Add minimal support for seq_buf (Jerry Snitselaar) [1346176 1069217]
  - [fs] ovl: use a minimal buffer in ovl_copy_xattr (Vivek Goyal) [1347235 1306358]
  - [fs] ovl: allow zero size xattr (Vivek Goyal) [1347235 1306358]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.27.1.el7]
changelog:
  - [md] raid5: check_reshape() shouldn't call mddev_suspend (Jes Sorensen) [1344313 1312828]
  - [net] sctp: Potentially-Failed state should not be reached from unconfirmed state (Xin Long) [1347809 1333696]
  - [net] sctp: fix the transports round robin issue when init is retransmitted (Xin Long) [1347809 1333696]
  - [net] sctp: fix suboptimal edge-case on non-active active/retrans path selection (Xin Long) [1347809 1333696]
  - [net] sctp: spare unnecessary comparison in sctp_trans_elect_best (Xin Long) [1347809 1333696]
  - [net] sctp: improve sctp_select_active_and_retran_path selection (Xin Long) [1347809 1333696]
  - [net] sctp: migrate most recently used transport to ktime (Xin Long) [1347809 1333696]
  - [net] sctp: refactor active path selection (Xin Long) [1347809 1333696]
  - [net] sctp: remove NULL check in sctp_assoc_update_retran_path (Xin Long) [1347809 1333696]
  - [net] sctp: rework multihoming retransmission path selection to rfc4960 (Xin Long) [1347809 1333696]
  - [net] sctp: retran_path not set properly after transports recovering (Xin Long) [1347809 1333696]
  - [mm] memcg: fix endless loop caused by mem_cgroup_iter (Herton R. Krzesinski) [1344750 1297381]
  - [scsi] qla2xxx: Set relogin flag when we fail to queue login requests (Chad Dupuis) [1347344 1273080]
  - [x86] perf/x86/intel/uncore: Add Broadwell-EP uncore support (Jiri Olsa) [1347374 1259976]
  - [x86] perf/x86/intel/uncore: Add Broadwell-DE uncore support (Jiri Olsa) [1348063 1306834]
  - [lib] rhashtable: Do hashing inside of rhashtable_lookup_compare() (Phil Sutter) [1343639 1238749]
  - [s390] mm: four page table levels vs. fork (Hendrik Brueckner) [1341547 1308879] {CVE-2016-2143}
  - [firmware] dmi_scan: Fix UUID endianness for SMBIOS >= 2.6 (Prarit Bhargava) [1340118 1294461]
  - [misc] cxl: Export AFU error buffer via sysfs (Gustavo Duarte) [1343537 1275968]
  - [misc] cxl: Poll for outstanding IRQs when detaching a context (Alexander Gordeev) [1338886 1332487]
  - [misc] cxl: Keep IRQ mappings on context teardown (Alexander Gordeev) [1338886 1332487]
  - [netdrv] mlx4_en: Fix endianness bug in IPV6 csum calculation (kamal heib) [1337431 1325358]
  - [acpi] srat: fix SRAT parsing order with both LAPIC and X2APIC present (Prarit Bhargava) [1336821 1331394]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.28.1.el7]
changelog:
  - [netdrv] e1000: Double Tx descriptors needed check for 82544 (Jarod Wilson) [1349448 1274170]
  - [netdrv] e1000: Do not overestimate descriptor counts in Tx pre-check (Jarod Wilson) [1349448 1274170]
  - [scsi] 3w-9xxx: version string touch (Tomas Henzl) [1348833 1322447]
  - [scsi] 3w-9xxx: don't unmap bounce buffered commands (Tomas Henzl) [1348833 1322447]
  - [scsi] 3w-9xxx: fix command completion race (Tomas Henzl) [1348833 1322447]
  - [fs] gfs2: don't set rgrp gl_object until it's inserted into rgrp tree (Robert S Peterson) [1348829 1344363]
  - [fs] fanotify: fix notification of groups with inode & mount marks (Miklos Szeredi) [1348828 1308393]
  - [fs] ovl: fix permission checking for setattr (Vivek Goyal) [1293980 1293981]
  - [security] keys: potential uninitialized variable (David Howells) [1345935 1341352] {CVE-2016-4470}
  - [tty] Invert tty_lock/ldisc_sem lock order (Herton R. Krzesinski) [1336823 1327403]
  - [tty] Don't hold tty_lock for ldisc release (Herton R. Krzesinski) [1336823 1327403]
  - [tty] Reset hupped state on open (Herton R. Krzesinski) [1336823 1327403]
  - [tty] Fix hangup race with TIOCSETD ioctl (Herton R. Krzesinski) [1336823 1327403]
  - [tty] Clarify ldisc variable (Herton R. Krzesinski) [1336823 1327403]
  - [infiniband] security: Restrict use of the write() interface (Don Dutile) [1332553 1316685] {CVE-2016-4565}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.28.2.el7]
changelog:
  - [net] bridge: include in6.h in if_bridge.h for struct in6_addr (Jiri Benc) [1331285 1268057]
  - [net] inet: defines IPPROTO_* needed for module alias generation (Jiri Benc) [1331285 1268057]
  - [net] sync some IP headers with glibc (Jiri Benc) [1331285 1268057]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.28.3.el7]
changelog:
  - [net] tcp: enable per-socket rate limiting of all 'challenge acks' (Florian Westphal) [1355603 1355605] {CVE-2016-5696}
  - [net] tcp: uninline tcp_oow_rate_limited() (Florian Westphal) [1355603 1355605] {CVE-2016-5696}
  - [net] tcp: make challenge acks less predictable (Florian Westphal) [1355603 1355605] {CVE-2016-5696}


author: Rafael Aquini <aquini@redhat.com> [3.10.0-322.el7]
changelog:
  - [fs] nfs: fix v4.2 SEEK on files over 2 gigs ("J. Bruce Fields") [1262181]
  - [fs] nfs: verify open flags before allowing open (Benjamin Coddington) [1164431]
  - [fs] nfsv4.1: Fix pnfs_put_lseg races (Benjamin Coddington) [1263155]
  - [fs] nfsv4.1: pnfs_send_layoutreturn should use GFP_NOFS (Benjamin Coddington) [1263155]
  - [fs] nfsv4.1: Pin the inode and super block in asynchronous layoutreturns (Benjamin Coddington) [1263155]
  - [fs] nfsv4.1: Pin the inode and super block in asynchronous layoutcommit (Benjamin Coddington) [1263155]
  - [md] raid0: apply base queue limits *before* disk_stack_limits (Jes Sorensen) [1265182]
  - [net] revert "ipv6: Don't reduce hop limit for an interface" (Sabrina Dubroca) [1258324]
  - [x86] kvmclock: abolish PVCLOCK_COUNTS_FROM_ZERO (Radim Krcmar) [1263030]
  - [x86] revert "kvm: x86: zero kvmclock_offset when vcpu0 initializes kvmclock system MSR" (Radim Krcmar) [1263030]
  - [x86] kvm: svm: reset mmu on VCPU reset (Igor Mammedov) [1255217]
  - [edac] sb_edac: correctly fetch DIMM width on Ivy Bridge and Haswell (Aristeu Rozanski) [1112413]
  - [edac] sb_edac: look harder for DDRIO on Haswell systems (Aristeu Rozanski) [1112413]
  - [tools] perf-trace: Fix race condition at the end of started workloads (Jiri Olsa) [1250068]
  - [netdrv] cxgb4: Fix tx flit calculation (Sai Vemuri) [1266248]
  - [netdrv] igb: assume MSI-X interrupts during initialization (Stefan Assmann) [1263625]
  - [cpufreq] intel_pstate: disable Skylake processors (Prarit Bhargava) [1267343]
  - [infiniband] mlx4: Report checksum offload cap for RAW QP when query device (Doug Ledford) [1265795]
  - [infiniband] core: Add support of checksum capability reporting for RC and RAW (Doug Ledford) [1265795]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-323.el7]
changelog:
  - [scsi] report 'INQUIRY result too short' once (Vitaly Kuznetsov) [1254049]
  - [scsi] scsi_scan: don't dump trace when scsi_prep_async_scan() is called twice (Vitaly Kuznetsov) [1254049]
  - [fs] userfaultfd: add missing mmput() in error path (Andrea Arcangeli) [1263480]
  - [mm] check if section present during memory block registering (Jan Stancek) [1256723]
  - [mm] avoid setting up anonymous pages into file mapping (Larry Woodman) [1261582]
  - [mm] add p[te|md] revert "protnone helpers for use by NUMA balancing" (Thomas Huth) [1256718]
  - [powerpc] revert "mm: convert p[te|md]_numa users to p[te|md]_protnone_numa" (Thomas Huth) [1256718]
  - [powerpc] revert "mm: add paranoid warnings for unexpected DSISR_PROTFAULT" (Thomas Huth) [1256718]
  - [mm] revert "convert p[te|md]_mknonnuma and remaining page table manipulations" (Thomas Huth) [1256718]
  - [mm] revert "numa: Do not mark PTEs pte_numa when splitting huge pages" (Thomas Huth) [1256718]
  - [mm] revert "remove remaining references to NUMA hinting bits and helpers" (Thomas Huth) [1256718]
  - [mm] revert "numa: do not trap faults on the huge zero page" (Thomas Huth) [1256718]
  - [mm] revert "numa: add paranoid check around pte_protnone_numa" (Thomas Huth) [1256718]
  - [mm] revert "numa: avoid unnecessary TLB flushes when setting NUMA hinting entries" (Thomas Huth) [1256718]
  - [powerpc] mm: Change the swap encoding in pte (Thomas Huth) [1256718]
  - [x86] perf: Fix multi-segment problem of perf_event_intel_uncore (Jiri Olsa) [1257825]
  - [lib] partially revert "[lib] vsprintf: implement bitmap printing through '*pb[l]'" (Maurizio Lombardi) [1260118]
  - [drm] radeon: update no_64bit_msi flag for certain ASICs (Oded Gabbay) [1262429]
  - [drm] nouveau: fbcon: take runpm reference when userspace has an open fd (Ben Skeggs) [1176163]
  - [drm] qxl: validate monitors config modes (Dave Airlie) [1242847]
  - [drm] radeon: don't attempt WC mappings on powerpc (Dave Airlie) [1262429]
  - [drm] drm/qxl: recreate the primary surface when the bo is not primary (Dave Airlie) [1258301]
  - [drm] qxl: only report first monitor as connected if we have no state (Dave Airlie) [1258301]
  - [drm] dp_mst: drop cancel work sync in the mstb destroy path (Dave Airlie) [1251331]
  - [drm] dp_mst: split connector registration into two parts (Dave Airlie) [1251331]
  - [drm] dp_mst: update the link_address_sent before sending the link address (Dave Airlie) [1251331]
  - [drm] dp_mst: fixup handling hotplug on port removal (Dave Airlie) [1251331]
  - [drm] dp_mst: don't pass port into the path builder function (Dave Airlie) [1251331]
  - [drm] dp_mst: make functions that always return 0 return void (Dave Airlie) [1251331]
  - [kernel] uprobes: fix kABI broken by the exported return_instance (Oleg Nesterov) [1207373]
  - [kernel] uprobes: Make arch_uretprobe_is_alive(RP_CHECK_CALL) more clever (Oleg Nesterov) [1207373]
  - [kernel] uprobes: Add the "enum rp_check ctx" arg to arch_uretprobe_is_alive() (Oleg Nesterov) [1207373]
  - [kernel] uprobes: Change prepare_uretprobe() to (try to) flush the dead frames (Oleg Nesterov) [1207373]
  - [kernel] uprobes: Change handle_trampoline() to flush the frames invalidated by longjmp() (Oleg Nesterov) [1207373]
  - [kernel] uprobes: Reimplement arch_uretprobe_is_alive() (Oleg Nesterov) [1207373]
  - [kernel] uprobes: Export 'struct return_instance', introduce arch_uretprobe_is_alive() (Oleg Nesterov) [1207373]
  - [kernel] uprobes: Change handle_trampoline() to find the next chain beforehand (Oleg Nesterov) [1207373]
  - [kernel] uprobes: Change prepare_uretprobe() to use uprobe_warn() (Oleg Nesterov) [1207373]
  - [kernel] uprobes: Send SIGILL if handle_trampoline() fails (Oleg Nesterov) [1207373]
  - [kernel] uprobes: Introduce free_ret_instance() (Oleg Nesterov) [1207373]
  - [kernel] uprobes: Introduce get_uprobe() (Oleg Nesterov) [1207373]
  - [kernel] lockdep: Fix a race between /proc/lock_stat and module unload (Jerome Marchand) [1183891]
  - [kernel] lockdep: Fix the module unload key range freeing logic (Jerome Marchand) [1183891]
  - [kernel] module: Free lock-classes if parse_args failed (Jerome Marchand) [1183891]
  - [cpufreq] revert "intel_pstate: honor user space min_perf_pct override on resume" (Prarit Bhargava) [1269518]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-324.el7]
changelog:
  - [netdrv] i40e/i40evf: set AQ count after memory allocation (Neil Horman) [1267663]
  - [netdrv] i40e: fix offload of GRE tunnels (Neil Horman) [1267663]
  - [netdrv] i40evf: don't blow away MAC address (Neil Horman) [1267663]
  - [netdrv] i40e/i40evf: grab the AQ spinlocks before clearing registers (Neil Horman) [1267663]
  - [netdrv] i40e: Fix a memory leak in X722 rss config path (Neil Horman) [1267663]
  - [netdrv] i40evf: Use numa_mem_id() to better support memoryless node (Neil Horman) [1267663]
  - [netdrv] i40e: Use numa_mem_id() to better support memoryless node (Neil Horman) [1267663]
  - [netdrv] i40e: fix 32 bit build warnings (Neil Horman) [1267663]
  - [netdrv] i40e: fix kbuild warnings (Neil Horman) [1267663]
  - [netdrv] i40evf: tweak init timing (Neil Horman) [1267663]
  - [netdrv] i40e: warn on double free (Neil Horman) [1267663]
  - [netdrv] i40e: refactor interrupt enable (Neil Horman) [1267663]
  - [netdrv] i40e: Strip VEB stats if they are disabled in HW (Neil Horman) [1267663]
  - [netdrv] i40e/i40evf: add new device id 1588 (Neil Horman) [1267663]
  - [netdrv] i40e: Remove useless message (Neil Horman) [1267663]
  - [netdrv] i40e: limit debugfs io ops (Neil Horman) [1267663]
  - [netdrv] i40e: use QOS field consistently (Neil Horman) [1267663]
  - [netdrv] i40e: count drops in netstat interface (Neil Horman) [1267663]
  - [netdrv] i40e/i40evf: fix Tx hang workaround code (Neil Horman) [1267663]
  - [netdrv] i40e: fixup padding issue in get_cee_dcb_cfg_v1_resp (Neil Horman) [1267663]
  - [netdrv] i40e: Fix a port VLAN configuration bug (Neil Horman) [1267663]
  - [netdrv] i40e/i40evf: fix up type clash in i40e_aq_rc_to_posix conversion (Neil Horman) [1267663]
  - [netdrv] i40e: rtnl_lock called twice in i40e_pci_error_resume() (Neil Horman) [1267663]
  - [netdrv] i40evf: missing rtnl_unlock in i40evf_resume() (Neil Horman) [1267663]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-325.el7]
changelog:
  - [fs] nfsd: ensure that delegation stateid hash references are only put once ("J. Bruce Fields") [1233284]
  - [fs] nfsd: ensure that the ol stateid hash reference is only put once ("J. Bruce Fields") [1233284]
  - [fs] nfsv4: Fix a nograce recovery hang (Benjamin Coddington) [1264478]
  - [fs] vfs: Test for and handle paths that are unreachable from their mnt_root ("Eric W. Biederman") [1209371] {CVE-2015-2925}
  - [fs] dcache: Handle escaped paths in prepend_path ("Eric W. Biederman") [1209371] {CVE-2015-2925}
  - [fs] xfs: add an xfs_zero_eof() tracepoint (Brian Foster) [1260383]
  - [fs] xfs: always drain dio before extending aio write submission (Brian Foster) [1260383]
  - [md] dm-cache: fix NULL pointer when switching from cleaner policy (Mike Snitzer) [1269959]
  - [mm] Temporary fix for BUG_ON() triggered by THP vs. gup() race (David Gibson) [1268999]
  - [hid] usbhid: improve handling of Clear-Halt and reset (Don Zickus) [1260123]
  - [drm] qxl: fix framebuffer dirty rectangle tracking (Gerd Hoffmann) [1268293]
  - [s390] hmcdrv: fix interrupt registration (Hendrik Brueckner) [1262735]
  - [block] blk-mq: fix deadlock when reading cpu_list (Jeff Moyer) [1260615]
  - [block] blk-mq: avoid inserting requests before establishing new mapping (Jeff Moyer) [1260615]
  - [block] blk-mq: fix q->mq_usage_counter access race (Jeff Moyer) [1260615]
  - [block] blk-mq: Fix use after of free q->mq_map (Jeff Moyer) [1260615]
  - [block] blk-mq: fix sysfs registration/unregistration race (Jeff Moyer) [1260615]
  - [block] blk-mq: avoid setting hctx->tags->cpumask before allocation (Jeff Moyer) [1260615]
  - [netdrv] cxgb4: Enhance driver to update FW, when FW is too old (Sai Vemuri) [1077966]
  - [netdrv] cxgb4: Force uninitialized state if FW in adapter is unsupported (Sai Vemuri) [1077966]
  - [powerpc] revert "Use the POWER8 Micro Partition Prefetch Engine in KVM HV on POWER8" (Thomas Huth) [1269653]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-326.el7]
changelog:
  - [md] dm-cache: the CLEAN_SHUTDOWN flag was not being set (Mike Snitzer) [1274450]
  - [md] dm-btree: fix leak of bufio-backed block in btree_split_beneath error path (Mike Snitzer) [1274393]
  - [md] dm-btree-remove: fix a bug when rebalancing nodes after removal (Mike Snitzer) [1274396]
  - [fs] nfsd: fix duplicated destroy_delegation code introduced by backport ("J. Bruce Fields") [1273228]
  - [fs] xfs: validate transaction header length on log recovery (Brian Foster) [1164135]
  - [net] ipv6: don't use CHECKSUM_PARTIAL on MSG_MORE/UDP_CORK sockets (Hannes Frederic Sowa) [1271759]
  - [net] add length argument to skb_copy_and_csum_datagram_iovec (Sabrina Dubroca) [1269228]
  - [x86] kvm: fix edge EOI and IOAPIC reconfig race (Radim Krcmar) [1271333]
  - [x86] kvm: set KVM_REQ_EVENT when updating IRR (Radim Krcmar) [1271333]
  - [kernel] Initialize msg/shm IPC objects before doing ipc_addid() (Lennert Buytenhek) [1271507] {CVE-2015-7613}


author: Rafael Aquini <aquini@redhat.com> [3.10.0-327.el7]
changelog:
  - [mm] free compound page with correct order (Andrea Arcangeli) [1274867]
  - [netdrv] revert "ixgbe: Refactor busy poll socket code to address multiple issues" (John Greene) [1261275]
  - [powerpc] dma: dma_set_coherent_mask() should not be GPL only (Gustavo Duarte) [1275976]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.29.1.el7]
changelog:
  - [fs] fanotify: fix double free of pending permission events (Richard Guy Briggs) [1352939 1339092]
  - [fs] fsnotify: rename event handling functions (Richard Guy Briggs) [1352939 1339092]
  - [fs] fanotify: convert access_mutex to spinlock (Richard Guy Briggs) [1352939 1339092]
  - [fs] fanotify: use fanotify event structure for permission response processing (Richard Guy Briggs) [1352939 1339092]
  - [fs] fanotify: remove useless bypass_perm check (Richard Guy Briggs) [1352939 1339092]
  - [fs] fanotify: fix notification of groups with inode & mount marks (Miklos Szeredi) [1348828 1308393]
  - [fs] fsnotify: Allocate overflow events with proper type (Richard Guy Briggs) [1345774 1135562]
  - [fs] fanotify: Handle overflow in case of permission events (Richard Guy Briggs) [1345774 1135562]
  - [fs] fsnotify: Fix detection whether overflow event is queued (Richard Guy Briggs) [1345774 1135562]
  - [fs] inotify: Fix reporting of cookies for inotify events (Richard Guy Briggs) [1345774 1135562]
  - [fs] fanotify: Fix use after free for permission events (Richard Guy Briggs) [1345774 1135562]
  - [fs] fsnotify: Do not return merged event from fsnotify_add_notify_event() (Richard Guy Briggs) [1345774 1135562]
  - [fs] fanotify: Fix use after free in mask checking (Richard Guy Briggs) [1345774 1135562]
  - [fs] fsnotify: remove pointless NULL initializers (Richard Guy Briggs) [1345774 1135562]
  - [fs] fsnotify: remove .should_send_event callback (Richard Guy Briggs) [1345774 1135562]
  - [fs] fsnotify: do not share events between notification groups (Richard Guy Briggs) [1345774 1135562]
  - [fs] inotify: provide function for name length rounding (Richard Guy Briggs) [1345774 1135562]
  - [fs] revert "inotify: don't add consecutive overflow events to the queue" (Richard Guy Briggs) [1345774 1135562]
  - Revert: [fs] fanotify: fix notification of groups with inode & mount marks (Miklos Szeredi) [1348828 1308393]


author: Phillip Lougher <plougher@redhat.com> [3.10.0-327.30.1.el7]
changelog:
  - [net] netfilter: bridge: Use __in6_dev_get rather than in6_dev_get in br_validate_ipv6 (Paolo Abeni) [1343640 1265259]
  - [net] netfilter: bridge: don't leak skb in error paths (Paolo Abeni) [1343640 1265259]
  - [net] netfilter: bridge: forward IPv6 fragmented packets (Paolo Abeni) [1343640 1265259]
  - [net] netfilter: bridge: re-order check_hbh_len() (Paolo Abeni) [1343640 1265259]
  - [net] netfilter: bridge: refactor frag_max_size (Paolo Abeni) [1343640 1265259]
  - [net] netfilter: bridge: really save frag_max_size between PRE and POST_ROUTING (Paolo Abeni) [1343640 1265259]
  - [net] bridge: Save frag_max_size between PRE_ROUTING and POST_ROUTING (Paolo Abeni) [1343640 1265259]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.31.1.el7]
changelog:
  - [kernel] ptrace: task_clear_jobctl_trapping()->wake_up_bit() needs mb() (Daniel Bristot de Oliveira) [1354313 1350624]
  - [net] sctp: label accepted/peeled off sockets (Marcelo Leitner) [1354302 1247756]
  - [char] ipmi: Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg() (David Arcari) [1353947 1348013]
  - [netdrv] bnx2x: don't wait for Tx completion on recovery (Michal Schmidt) [1351972 1320748]
  - [pci] aer: Clear error status registers during enumeration and restore (Prarit Bhargava) [1350304 1347459]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.32.1.el7]
changelog:
  - [fs] xfs: give all workqueues rescuer threads (Brian Foster) [1359630 1298684]
  - [fs] xfs: cancel eofblocks background trimming on remount read-only (Brian Foster) [1358777 1339414]
  - [netdrv] bonding: Prevent IPv6 link local address on enslaved devices (Jarod Wilson) [1357868 1297931]
  - [kernel] ptrace: make wait_on_bit(JOBCTL_TRAPPING_BIT) in ptrace_attach() killable (Jiri Olsa) [1354285 1334503]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.33.1.el7]
changelog:
  - [powerpc] mm: don't do tlbie for updatepp request with NO HPTE fault (Gustavo Duarte) [1361462 1287289]
  - [mm] slub: do not drop slab_mutex for sysfs_slab_add (Larry Woodman) [1361019 1282934]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.34.1.el7]
changelog:
  - [x86] Use pte_none() to test for empty PTE (Larry Woodman) [1363860 1347159]
  - [x86] Disallow running with 32-bit PTEs to work around erratum (Larry Woodman) [1363860 1347159]
  - [x86] Ignore A/D bits in pte/pmd/pud_none() (Larry Woodman) [1363860 1347159]
  - [x86] Move swap offset/type up in PTE to work around erratum (Larry Woodman) [1363860 1347159]
  - [x86] cpu/intel: Introduce macros for Intel family numbers (Steve Best) [1364074 1273778]
  - [net] sctp: support ipv6 nonlocal bind (Xin Long) [1363847 1355769]
  - [fs] xfs: fix duplicate buffer flag bits (Brian Foster) [1363677 1358817]
  - [fs] sunrpc: Fix races between socket connection and destroy code (Steve Dickson) [1363617 1278540]
  - [fs] sunrpc: Add helpers to prevent socket create from racing (Steve Dickson) [1363617 1270038]
  - [acpi] battery: Accelerate battery resume callback (Jeremy McNicoll) [1363611 1270522]
  - [scsi] 3w-sas: fix command completion race (Tomas Henzl) [1362040 1294538]
  - [kernel] hrtimer: Prevent remote enqueue of leftmost timers (David Bulkow) [1361020 1323752]
  - [scsi] storvsc: Size the queue depth based on the ringbuffer size (Cathy Avery) [1360161 1287040]
  - [scsi] storvsc: Increase the ring buffer size (Cathy Avery) [1360161 1287040]
  - [scsi] vmbus: Support a vmbus API for efficiently sending page arrays (Cathy Avery) [1360161 1287040]
  - [fs] ovl: verify upper dentry in ovl_remove_and_whiteout() (Miklos Szeredi) [1364384 1359829]
  - [fs] ovl: verify upper dentry before unlink and rename (Miklos Szeredi) [1360155 1341795]
  - [fs] ovl: fix getcwd() failure after unsuccessful rmdir (Miklos Szeredi) [1360155 1341795]
  - [base] memory: fix kernel warning during memory hotplug on ppc64 (Laurent Vivier) [1357130 1276205]
  - [fs] sunrpc: increase UNX_MAXNODENAME from 32 to __NEW_UTS_LEN bytes (Benjamin Coddington) [1356880 1315390]
  - [net] tcp: enable per-socket rate limiting of all 'challenge acks' (Florian Westphal) [1355603 1355605] {CVE-2016-5696}
  - [net] tcp: uninline tcp_oow_rate_limited() (Florian Westphal) [1355603 1355605] {CVE-2016-5696}
  - [net] tcp: make challenge acks less predictable (Florian Westphal) [1355603 1355605] {CVE-2016-5696}
  - [net] netfilter: x_tables: speed up jump target validation (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: don't reject valid target size on some architectures (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: make sure e->next_offset covers remaining blob size (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: introduce and use xt_copy_counters_from_user (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: do compat validation via translate_table (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: xt_compat_match_from_user doesn't need a retval (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: arp_tables: simplify translate_compat_table args (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: ip6_tables: simplify translate_compat_table args (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: ip_tables: simplify translate_compat_table args (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: remove unused comefrom hookmask argument (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: validate all offsets and sizes in a rule (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: check for bogus target offset (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: check standard target size too (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: add compat version of xt_check_entry_offsets (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: assert minimum target size (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: kill check_entry helper (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: add and use xt_check_entry_offsets (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: validate targets of jumps (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: don't move to non-existent next rule (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: fix unconditional helper (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: validate e->target_offset early (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [net] netfilter: x_tables: check for size overflow (Florian Westphal) [1364809 1318693] {CVE-2016-3134}
  - [block] nvme: Add pci error handlers (David Milburn) [1350352 1288601]
  - [block] nvme: protect against simultaneous shutdown invocations (David Milburn) [1350352 1288601]
  - [block] nvme: Set affinity after allocating request queues (Frank Ramsay) [1350352 1288601]
  - [block] nvme: Fix device cleanup on initialization failure (David Milburn) [1350352 1288601]
  - [block] nvme: fix kernel memory corruption with short INQUIRY buffers (David Milburn) [1350352 1288601]
  - [net] bridge: include in6.h in if_bridge.h for struct in6_addr (Jiri Benc) [1331285 1268057]
  - [net] inet: defines IPPROTO_* needed for module alias generation (Jiri Benc) [1331285 1268057]
  - [net] sync some IP headers with glibc (Jiri Benc) [1331285 1268057]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.35.1.el7]
changelog:
  - Revert: [x86] cpu/intel: Introduce macros for Intel family numbers (Steve Best) [1364074 1273778]
  - Revert: [x86] Move swap offset/type up in PTE to work around erratum (Larry Woodman) [1363860 1347159]
  - Revert: [x86] Ignore A/D bits in pte/pmd/pud_none() (Larry Woodman) [1363860 1347159]
  - Revert: [x86] Disallow running with 32-bit PTEs to work around erratum (Larry Woodman) [1363860 1347159]
  - Revert: [x86] Use pte_none() to test for empty PTE (Larry Woodman) [1363860 1347159]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.36.1.el7]
changelog:
  - [x86] Use pte_none() to test for empty PTE (Larry Woodman) [1363860 1347159]
  - [x86] Disallow running with 32-bit PTEs to work around erratum (Larry Woodman) [1363860 1347159]
  - [x86] Ignore A/D bits in pte/pmd/pud_none() (Alexander Gordeev) [1363860 1347159]
  - [x86] Move swap offset/type up in PTE to work around erratum (Alexander Gordeev) [1363860 1347159]
  - [x86] cpu/intel: Introduce macros for Intel family numbers (Steve Best) [1364074 1273778]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-327.36.3.el7]
changelog:
  - [mm] remove gup_flags FOLL_WRITE games from __get_user_pages() (Alexander Gordeev) [1385123 1385124] {CVE-2016-5195}


author: Rafael Aquini <aquini@redhat.com> [3.10.0-319.el7]
changelog:
  - [netdrv] cxgb4: Make necessary changes after reverting FCoE (Sai Vemuri) [1258657]
  - [netdrv] revert "cxgb4: add cxgb4_fcoe.c for FCoE" (Sai Vemuri) [1258657]
  - [infiniband] iw_cxgb4: Cleanup register defines/MACROS (Sai Vemuri) [1251611]
  - [infiniband] iw_cxgb4: 32b platform fixes (Sai Vemuri) [1251611]
  - [infiniband] iw_cxgb4: use BAR2 GTS register for T5 kernel mode CQs (Sai Vemuri) [1251611]
  - [infiniband] iw_cxgb4: enforce qp/cq id requirements (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Fix incorrect sequence numbers shown in devlog (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: remove unused fn to enable/disable db coalescing (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/cxgb4vf: function and argument name cleanup (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add debugfs facility to inject FL starvation (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add PHY firmware support for T420-BT cards (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Update T4/T5 adapter register ranges (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Optimize and cleanup setup memory window code (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: replace ntoh{s, l} and hton{s, l} calls with the generic byteorder (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Remove dead function t4_read_edc and t4_read_mc (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/cxgb4vf: Cleanup macros, add comments and add new MACROS (Sai Vemuri) [1251611]
  - [netdrv] cxgb3/4/4vf: Update drivers to use dma_rmb/wmb where appropriate (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: add cxgb4_fcoe.c for FCoE (Sai Vemuri) [1251611]
  - [infiniband] iw_cxgb4: Remove negative advice dmesg warnings (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Initialize RSS mode for all Ports (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Discard the packet if the length is greater than mtu (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Move SGE Ingress DMA state monitor code to a new routine (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add device node to ULD info (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Pass in a Congestion Channel Map to t4_sge_alloc_rxq() (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Enable congestion notification from SGE for IQs and FLs (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Make sure that Freelist size is larger than Egress Congestion Threshold (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: drop __GFP_NOFAIL allocation (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Fix MC1 memory offset calculation (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Don't call t4_slow_intr_handler when we're not the Master PF (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add comment for calculate tx flits and sge length code (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Use device node in page allocation (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Freelist starving threshold varies from adapter to adapter (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Increased the value of MAX_IMM_TX_PKT_LEN from 128 to 256 bytes (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Move ethtool related code to a separate file (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Fix to dump devlog, even if FW is crashed (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Firmware macro changes for fw verison 1.13.32.0 (Sai Vemuri) [1251611]
  - [infiniband] cxgb4: Serialize CQ event upcalls with CQ destruction (Sai Vemuri) [1251611]
  - [infiniband] cxgb4: Don't hang threads forever waiting on WR replies (Sai Vemuri) [1251611]
  - [netdrv] cxgb4vf: Fix sparse warnings (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Disable interrupts and napi before unregistering netdev (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Allocate dynamic mem. for egress and ingress queue maps (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Fix frame size warning for 32 bit arch (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/cxgb4vf/csiostor: Make PCI Device ID Tables be "const" (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add device ID for new adapter (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: fix coccinelle warnings (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Try and provide an RDMA CIQ per cpu (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Use pci_enable_msix_range() instead of pci_enable_msix() (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Move offload Rx queue allocation to separate function (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Fix PCI-E Memory window interface for big-endian systems (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add support in cxgb4 to get expansion rom version via ethtool (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Fix trace observed while dumping clip_tbl (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add support in debugfs to dump the congestion control table (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add support to dump mailbox content in debugfs (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add support for ULP RX logic analyzer output in debugfs (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Added support in debugfs to display TP logic analyzer output (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add support in debugfs to display sensor information (Sai Vemuri) [1251611]
  - [netdrv] chelsio: cxgb4: fix sparse warning (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Delete an unnecessary check before the function call "release_firmware" (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add low latency socket busy_poll support (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Improve IEEE DCBx support, other minor open-lldp fixes (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Remove preprocessor check for CONFIG_CXGB4_DCB (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Move firmware version MACRO to t4fw_version.h (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Added support in debugfs to dump different timer and clock values of the adapter (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Added support in debugfs to dump PM module stats (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Addded support in debugfs to dump CIM outbound queue content (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Added support in debugfs to dump cim ingress bound queue contents (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Added support in debugfs to dump sge_qinfo (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Fixes cxgb4_inet6addr_notifier unregister call (Sai Vemuri) [1251611]
  - [netdrv] mode_t whack-a-mole: chelsio (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add debugfs options to dump the rss key, config for PF, VF, etc (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add debugfs entry to dump the contents of the flash (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Update ipv6 address handling api (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Ripping out old hard-wired initialization code in driver (Sai Vemuri) [1251611]
  - [netdrv] iw_cxgb4/cxgb4/cxgb4vf/cxgb4i/csiostor: Cleanup register defines/macros related to all other cpl messages (Sai Vemuri) [1251611]
  - [netdrv] iw_cxgb4/cxgb4/cxgb4i: Cleanup register defines/MACROS related to CM CPL messages (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add support for mps_tcam debugfs (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add support for cim_qcfg entry in debugfs (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add support for cim_la entry in debugfs (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add support for devlog (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add PCI device ID for new T5 adapter (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/cxgb4vf/csiostor: Cleanup PL, XGMAC, SF and MC related register defines (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/csiostor: Cleanup TP, MPS and TCAM related register defines (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/cxg4vf/csiostor: Cleanup MC, MA and CIM related register defines (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/cxgb4vf/csiostor: Cleanup SGE and PCI related register defines (Sai Vemuri) [1251611]
  - [infiniband] cxgb4/cxgb4vf/csiostor: Cleanup SGE register defines (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Fix decoding QSA module for ethtool get settings (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add support for QSA modules (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/csiostor: Don't use MASTER_MUST for fw_hello call (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/cxgb4vf: global named must be unique (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Update firmware version after flashing it via ethtool (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/cxgb4vf: Use new interfaces to calculate BAR2 SGE Queue Register addresses (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/cxgb4vf: Add code to calculate T5 BAR2 Offsets for SGE Queue Registers (Sai Vemuri) [1251611]
  - [netdrv] cxgb4vf: Add and initialize some sge params for VF driver (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Update FW version string to match FW binary version 1.12.25.0 (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add a check for flashing FW using ethtool (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Fill in supported link mode for SFP modules (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/cxgb4vf/csiostor: Add T4/T5 PCI ID Table (Sai Vemuri) [1251611]
  - [infiniband] cxgb4/cxgb4vf/csiostor: Cleanup macros/register defines related to PCIE, RSS and FW (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/cxgb4vf/csiostor: Cleanup macros/register defines related to port and VI (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Disable recursive mailbox commands when enabling vi (Sai Vemuri) [1251611]
  - [netdrv] cxgb4/cxgb4vf/csiostor: Cleanup macros/register defines related to queues (Sai Vemuri) [1251611]
  - [infiniband] cxgb4/csiostor: Cleansup FW related macros/register defines for PF/VF and LDST (Sai Vemuri) [1251611]
  - [infiniband] cxgb4: Cleanup Filter related macros/register defines (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Fix DCB priority groups being returned in wrong order (Sai Vemuri) [1251611]
  - [netdrv] cxgb4i/cxgb4: Refactor macros to conform to uniform standards (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Fix static checker warning (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: dcb open-lldp interop fixes (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Fix bug in DCB app deletion (Sai Vemuri) [1251611]
  - [scsi] cxgb4: Cleanup macros so they follow the same style and look consistent, part 2 (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Cleanup macros so they follow the same style and look consistent (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add cxgb4_debugfs.c, move all debugfs code to new file (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Handle dcb enable correctly (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Improve handling of DCB negotiation or loss thereof (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: IEEE fixes for DCBx state machine (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Fix endian bug introduced in cxgb4 dcb patchset (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Update copyright year on all cxgb4 files (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Makefile & Kconfig changes for DCBx support (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Integrate DCBx support into cxgb4 module. Register dbcnl_ops to give access to DCBx functions (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Add DCBx support codebase and dcbnl_ops (Sai Vemuri) [1251611]
  - [netdrv] cxgb4: Update fw interface file for DCBx support. Adds all the required fields to fw interface to communicate DCBx info (Sai Vemuri) [1251611]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-320.el7]
changelog:
  - [md] raid1: Avoid raid1 resync getting stuck (Jes Sorensen) [1256954]
  - [fs] gfs2: fallocate: do not rely on file_update_time to mark the inode dirty (Andrew Price) [1264521]
  - [fs] gfs2: Update timestamps on fallocate (Andrew Price) [1264521]
  - [fs] gfs2: Update i_size properly on fallocate (Andrew Price) [1264521]
  - [fs] gfs2: Use inode_newsize_ok and get_write_access in fallocate (Andrew Price) [1264521]
  - [fs] revert "nfs: Make close(2) asynchronous when closing NFS O_DIRECT files" (Benjamin Coddington) [1263385]
  - [fs] gfs2: Average in only non-zero round-trip times for congestion stats (Robert S Peterson) [1162821]
  - [fs] lockd: fix rpcbind crash on lockd startup failure ("J. Bruce Fields") [1253782]
  - [fs] Failing to send a CLOSE if file is opened WRONLY and server reboots on a 4.x mount (Benjamin Coddington) [1263376]
  - [fs] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() (Lukas Czerner) [1247436]
  - [net] sctp: fix race on protocol/netns initialization (Marcelo Leitner) [1251807] {CVE-2015-5283}
  - [x86] Mark Broadwell-DE SoC Supported (Prarit Bhargava) [1131685]
  - [kernel] sched,numa: limit amount of virtual memory scanned in task_numa_work (Rik van Riel) [1261722]
  - [drivers] base: show nohz_full cpus in sysfs (Rik van Riel) [1212618]
  - [drivers] base: show isolated cpus in sysfs (Rik van Riel) [1212618]
  - [cpufreq] intel_pstate: add quirk to disable HWP on Skylake-S processors (Jerry Snitselaar) [1263069]
  - [drivers] core: Add symlink to device-tree from devices with an OF node (Gustavo Duarte) [1258828]
  - [powerpc] device: Add dev_of_node() accessor (Gustavo Duarte) [1258828]
  - [powerpc] iommu: Support "hybrid" iommu/direct DMA ops for coherent_mask < dma_mask (Gustavo Duarte) [1246880]
  - [powerpc] iommu: Cleanup setting of DMA base/offset (Gustavo Duarte) [1246880]
  - [powerpc] iommu: Remove dma_data union (Gustavo Duarte) [1246880]
  - [powerpc] kvm: book3s-hv: Fix handling of interrupted VCPUs (Thomas Huth) [1263568]
  - [powerpc] kvm: Take the kvm->srcu lock in kvmppc_h_logical_ci_load/store() (Thomas Huth) [1263577]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-321.el7]
changelog:
  - [netdrv] i40e/i40evf: check for stopped admin queue (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: refactor tx timeout logic (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Bump i40e to 1.3.21 and i40evf to 1.3.13 (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: add get AQ result command to nvmupdate utility (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: add exec_aq command to nvmupdate utility (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: add wait states to NVM state machine (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: add GetStatus command for nvmupdate (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: add handling of writeback descriptor (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: save aq writeback for future inspection (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Bump i40e to 1.3.9 and i40evf to 1.3.5 (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Cache the CEE TLV status returned from firmware (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: add VIRTCHNL_VF_OFFLOAD flag (Stefan Assmann) [1267255]
  - [netdrv] i40evf: Remove PF specific register definitions from the VF (Stefan Assmann) [1267255]
  - [netdrv] i40evf: Use the correct defines to match the VF registers (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Add capability to gather VEB per TC stats (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Add TX/RX outer UDP checksum support for X722 (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Add support for writeback on ITR feature for X722 (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: RSS changes for X722 (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Update register.h file for X722 (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Update FW API with X722 support (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Add flags for X722 capabilities (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Add device ids for X722 (Stefan Assmann) [1267255]
  - [netdrv] i40e: use BIT and BIT_ULL macros (Stefan Assmann) [1267255]
  - [netdrv] i40e: clean up error status messages (Stefan Assmann) [1267255]
  - [netdrv] i40evf: support virtual channel API version 1.1 (Stefan Assmann) [1267255]
  - [netdrv] i40evf: handle big resets (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: add macros for virtual channel API version and device capability (Stefan Assmann) [1267255]
  - [netdrv] i40e: add VF capabilities to virtual channel interface (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Fix and refactor dynamic ITR code (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Bump version to 1.3.6 for i40e and 1.3.2 for i40evf (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Add support for pre-allocated pages for PD (Stefan Assmann) [1267255]
  - [netdrv] i40evf: add MAC address filter in open, not init (Stefan Assmann) [1267255]
  - [netdrv] i40evf: don't delete all the filters (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Update the admin queue command header (Stefan Assmann) [1267255]
  - [netdrv] i40evf: Allow for an abundance of vectors (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: improve Tx performance with a small tweak (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Update Flex-10 related device/function capabilities (Stefan Assmann) [1267255]
  - [netdrv] i40e/i40evf: Add stats to track FD ATR and SB dynamic enable state (Stefan Assmann) [1267255]
  - [netdrv] i40e: Fix for recursive RTNL lock during PROMISC change (Stefan Assmann) [1267254]
  - [netdrv] i40e: Fix RS bit update in Tx path and disable force WB workaround (Stefan Assmann) [1267254]
  - [netdrv] i40e: add GRE tunnel type to csum encoding (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: refactor tx timeout logic (Stefan Assmann) [1267254]
  - [netdrv] i40e: Move i40e_get_head into header file (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: check for stopped admin queue (Stefan Assmann) [1267254]
  - [netdrv] i40e: fix VLAN inside VXLAN (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Bump i40e to 1.3.21 and i40evf to 1.3.13 (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: add get AQ result command to nvmupdate utility (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: add exec_aq command to nvmupdate utility (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: add wait states to NVM state machine (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: add GetStatus command for nvmupdate (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: add handling of writeback descriptor (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: save aq writeback for future inspection (Stefan Assmann) [1267254]
  - [netdrv] i40e: rename variable to prevent clash of understanding (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Bump i40e to 1.3.9 and i40evf to 1.3.5 (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Cache the CEE TLV status returned from firmware (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: add VIRTCHNL_VF_OFFLOAD flag (Stefan Assmann) [1267254]
  - [netdrv] i40e: Remove redundant and unneeded messages (Stefan Assmann) [1267254]
  - [netdrv] i40e: correct spelling error (Stefan Assmann) [1267254]
  - [netdrv] i40e: Fix comment for ethtool diagnostic link test (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Add capability to gather VEB per TC stats (Stefan Assmann) [1267254]
  - [netdrv] i40e: Fix ethtool offline diagnostic with netqueues (Stefan Assmann) [1267254]
  - [netdrv] i40e: Fix legacy interrupt mode in the driver (Stefan Assmann) [1267254]
  - [netdrv] i40e: Move function calls to i40e_shutdown instead of i40e_suspend (Stefan Assmann) [1267254]
  - [netdrv] i40e: add RX to port CRC errors label (Stefan Assmann) [1267254]
  - [netdrv] i40e: don't degrade __le16 (Stefan Assmann) [1267254]
  - [netdrv] i40e: Add AQ commands for NVM Update for X722 (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Add ATR HW eviction support for X722 (Stefan Assmann) [1267254]
  - [netdrv] i40e: Add IWARP support for X722 (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Add TX/RX outer UDP checksum support for X722 (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Add support for writeback on ITR feature for X722 (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: RSS changes for X722 (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Update register.h file for X722 (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Update FW API with X722 support (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Add flags for X722 capabilities (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Add device ids for X722 (Stefan Assmann) [1267254]
  - [netdrv] i40e: use BIT and BIT_ULL macros (Stefan Assmann) [1267254]
  - [netdrv] i40e: provide correct API version to older VF drivers (Stefan Assmann) [1267254]
  - [netdrv] i40e: support virtual channel API 1.1 (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: add macros for virtual channel API version and device capability (Stefan Assmann) [1267254]
  - [netdrv] i40e: add VF capabilities to virtual channel interface (Stefan Assmann) [1267254]
  - [netdrv] i40e: clean up unneeded gotos (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Fix and refactor dynamic ITR code (Stefan Assmann) [1267254]
  - [netdrv] i40e: only report generic filters in get_ts_info (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Bump version to 1.3.6 for i40e and 1.3.2 for i40evf (Stefan Assmann) [1267254]
  - [netdrv] i40e: Refine an error message to avoid confusion (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Add support for pre-allocated pages for PD (Stefan Assmann) [1267254]
  - [netdrv] i40e: un-disable VF after reset (Stefan Assmann) [1267254]
  - [netdrv] i40e: do a proper reset when disabling a VF (Stefan Assmann) [1267254]
  - [netdrv] i40e: correctly program filters for VFs (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Update the admin queue command header (Stefan Assmann) [1267254]
  - [netdrv] i40e: Remove incorrect #ifdef's (Stefan Assmann) [1267254]
  - [netdrv] i40e: ignore duplicate port VLAN requests (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: improve Tx performance with a small tweak (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Update Flex-10 related device/function capabilities (Stefan Assmann) [1267254]
  - [netdrv] i40e/i40evf: Add stats to track FD ATR and SB dynamic enable state (Stefan Assmann) [1267254]
  - [netdrv] i40e: Implement ndo_features_check() (Stefan Assmann) [1267254]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.3.1.el7]
changelog:
  - [net] team: Fixing a bug in team driver due to incorrect 'unsigned int' to 'int' conversion (Hangbin Liu) [1392023 1382098]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.4.1.el7]
changelog:
  - [net] rtnetlink: fix rtnl_vfinfo_size (Sabrina Dubroca) [1395811 1392128]
  - [netdrv] ixgbe: test for trust in macvlan adjustments for vf (Ken Cox) [1395572 1379787]
  - [kernel] timekeeping: Copy the shadow-timekeeper over the real timekeeper last (Prarit Bhargava) [1395577 1344747]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.5.1.el7]
changelog:
  - [fs] Fix regression which breaks DFS mounting (Sachin Prabhu) [1400055 1302329]
  - [fs] Move check for prefix path to within cifs_get_root() (Sachin Prabhu) [1400055 1302329]
  - [fs] Compare prepaths when comparing superblocks (Sachin Prabhu) [1400055 1302329]
  - [fs] Fix memory leaks in cifs_do_mount() (Sachin Prabhu) [1400055 1302329]
  - [fs] cifs: make share unaccessible at root level mountable (Sachin Prabhu) [1400055 1302329]
  - [kernel] sched: Fix possible divide by zero in avg_atom() calculation (Mateusz Guzik) [1398361 1392466]
  - [scsi] megaraid_sas: Do not set MPI2_TYPE_CUDA for JBOD FP path for FW which does not support JBOD sequence map (Tomas Henzl) [1398175 1380441]
  - [x86] smp: Fix __max_logical_packages value setup (Prarit Bhargava) [1398173 1394239]
  - [x86] revert "smp: Fix __max_logical_packages value setup" (Prarit Bhargava) [1398173 1394239]
  - [watchdog] hpwdt: add support for iLO5 (Linda Knippers) [1397747 1382798]
  - [x86] kexec: Fix kexec crash in syscall kexec_file_load() (Pingfan Liu) [1395573 1385109]
  - [powerpc] ppc64: Fix incorrect return value from __copy_tofrom_user (Steve Best) [1395565 1387244]
  - [scsi] megaraid-sas: request irqs later (Tomas Henzl) [1394711 1392978]
  - [netdrv] i40e: Fix errors resulted while turning off TSO (Stefan Assmann) [1394708 1378509]
  - [fs] ext4: pre-zero allocated blocks for DAX IO (Eric Sandeen) [1394707 1367989]
  - [powerpc] pseries: use pci_host_bridge.release_fn() to kfree(phb) (Steve Best) [1393724 1385635]
  - [misc] genwqe: Change default access rights for device node (Steve Best) [1393723 1325797]
  - [misc] hpilo: Changes to support new security states in iLO5 FW (Nigel Croxon) [1393720 1376576]
  - [kernel] sched/core: Fix a race between try_to_wake_up() and a woken up task (Lauro Ramos Venancio) [1393719 1379256]
  - [hid] i2c-hid: exit if the IRQ is not valid (David Arcari) [1393717 1376599]
  - [x86] Add support for missing Kabylake Sunrise Point PCH (David Arcari) [1392033 1379401]
  - [net] sctp: not return ENOMEM err back in sctp_packet_transmit (Xin Long) [1392025 1371362]
  - [net] sctp: make sctp_outq_flush/tail/uncork return void (Xin Long) [1392025 1371362]
  - [net] sctp: save transmit error to sk_err in sctp_outq_flush (Xin Long) [1392025 1371362]
  - [net] sctp: free msg->chunks when sctp_primitive_SEND return err (Xin Long) [1392025 1371362]
  - [net] sctp: do not return the transmit err back to sctp_sendmsg (Xin Long) [1392025 1371362]
  - [net] sctp: remove the unnecessary state check in sctp_outq_tail (Xin Long) [1392025 1371362]
  - [net] netdev, sched/wait: Fix sleeping inside wait event (Paolo Abeni) [1392024 1382175]
  - [net] Separate the close_list and the unreg_list (Paolo Abeni) [1392024 1382175]
  - [vfio] pci: Fix ordering of eventfd vs virqfd shutdown (Alex Williamson) [1391611 1322026]
  - [net] Fix use after free in the recvmmsg exit path (Davide Caratti) [1390806 1390047] {CVE-2016-7117}
  - [fs] nfsd: don't return an unhashed lock stateid after taking mutex ("J. Bruce Fields") [1390672 1368577]
  - [fs] nfsd: Fix race between FREE_STATEID and LOCK ("J. Bruce Fields") [1390672 1368577]
  - [fs] nfsd: Close race between nfsd4_release_lockowner and nfsd4_lock ("J. Bruce Fields") [1390672 1368577]
  - [fs] nfsd: Extend the mutex holding region around in nfsd4_process_open2() ("J. Bruce Fields") [1390672 1368577]
  - [fs] nfsd: Always lock state exclusively ("J. Bruce Fields") [1390672 1368577]
  - [infiniband] ib/ipoib: move back IB LL address into the hard header (Jonathan Toppins) [1390668 1378656]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.6.1.el7]
changelog:
  - [net] sctp: validate chunk len before actually using it (Hangbin Liu) [1399458 1399459] {CVE-2016-9555}
  - [net] sctp: rename WORD_TRUNC/ROUND macros (Hangbin Liu) [1399458 1399459] {CVE-2016-9555}
  - [net] sctp: keep fragmentation point aligned to word size (Hangbin Liu) [1399458 1399459] {CVE-2016-9555}
  - [x86] Mark Intel Purley supported (Steve Best) [1402824 1371748]
  - [acpi] sleep: Do not save NVS for new machines to accelerate S3 (Prarit Bhargava) [1402326 1385527]
  - [scsi] megaraid_sas: Send SYNCHRONIZE_CACHE for VD to firmware (Tomas Henzl) [1398179 1380447]
  - [scsi] megaraid_sas: Fix data integrity failure for JBOD (passthrough) devices (Tomas Henzl) [1398179 1380447]
  - [scsi] megaraid_sas: fix macro MEGASAS_IS_LOGICAL to avoid regression (Tomas Henzl) [1398179 1380447]
  - [netdrv] net/hyperv: avoid uninitialized variable (Vitaly Kuznetsov) [1395578 1392220]
  - [netdrv] netvsc: Remove mistaken udp.h inclusion (Vitaly Kuznetsov) [1395578 1392220]
  - [netdrv] netvsc: fix checksum on UDP IPV6 (Vitaly Kuznetsov) [1395578 1392220]
  - [netdrv] hv_netvsc: add ethtool statistics for tx packet issues (Vitaly Kuznetsov) [1395578 1392220]
  - [netdrv] hv_netvsc: rearrange start_xmit (Vitaly Kuznetsov) [1395578 1392220]
  - [fs] Retry operation on EREMOTEIO on an interrupted slot (Steve Dickson) [1394710 1378981]
  - [fs] rbd: don't retry watch reregistration if header object is gone (Ilya Dryomov) [1393485 1378186]
  - [fs] rbd: don't wait for the lock forever if blacklisted (Ilya Dryomov) [1393485 1378186]
  - [fs] rbd: lock_on_read map option (Ilya Dryomov) [1393485 1378186]
  - [hv] do not lose pending heartbeat vmbus packets (Vitaly Kuznetsov) [1392035 1378615]
  - [netdrv] netvsc: fix incorrect receive checksum offloading (Vitaly Kuznetsov) [1391617 1388702]
  - [x86] kvm: lapic: cap __delay at lapic_timer_advance_ns (Marcelo Tosatti) [1391614 1389431]
  - [x86] kvm: x86: move nsec_to_cycles from x86.c to x86.h (Marcelo Tosatti) [1391614 1389431]
  - [net] tcp: fix use after free in tcp_xmit_retransmit_queue() (Mateusz Guzik) [1379530 1379531] {CVE-2016-6828}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.7.1.el7]
changelog:
  - [kernel] printk: avoid livelock if another CPU printks continuously (Denys Vlasenko) [1402314 1294066]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.9.1.el7]
changelog:
  - [drm] i915/kbl: Remove preliminary_hw_support protection from KBL. (Rob Clark) [1413092 1305702]
  - [netdrv] slip: Fix deadlock in write_wakeup (Steve Best) [1412225 1403497]
  - [netdrv] slip: fix spinlock variant (Steve Best) [1412225 1403497]
  - [kernel] kmod: use system_unbound_wq instead of khelper (Luiz Capitulino) [1411816 1395860]
  - [nvme] switch abort to blk_execute_rq_nowait (David Milburn) [1411669 1392923]
  - [netdrv] ibmveth: calculate gso_segs for large packets (Gustavo Duarte) [1411382 1361958]
  - [netdrv] ibmveth: set correct gso_size and gso_type (Gustavo Duarte) [1411382 1361958]
  - [netdrv] allow macvlans to move to net namespace (Jarod Wilson) [1409829 1368830]
  - [pci] Set Read Completion Boundary to 128 iff Root Port supports it (_HPX) (Myron Stowe) [1406290 1387674]
  - [pci] Export pcie_find_root_port() (Myron Stowe) [1406290 1387674]
  - [rtc] cmos: Initialize hpet timer before irq is registered (Pratyush Anand) [1404184 1299001]
  - [x86] amd: Fix cpu_llc_id for AMD Fam17h systems (Suravee Suthikulpanit) [1402444 1395399]
  - [powerpc] powernv: Fix stale PE primary bus (Steve Best) [1402440 1395275]
  - [misc] cxl: Fix coredump generation when cxl_get_fd() is used (Gustavo Duarte) [1402439 1397943]
  - [pci] cxl: use pcibios_free_controller_deferred() when removing vPHBs (Gustavo Duarte) [1402438 1395323]
  - [scsi] qla2xxx: do not abort all commands in the adapter during EEH recovery (Gustavo Duarte) [1402436 1393254]
  - [scsi] qla2xxx: fix invalid DMA access after command aborts in PCI device remove (Gustavo Duarte) [1402436 1393254]
  - [scsi] qla2xxx: do not queue commands when unloading (Gustavo Duarte) [1402436 1393254]
  - [net] packet: fix race condition in packet_set_ring (Hangbin Liu) [1401852 1401853] {CVE-2016-8655}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.10.1.el7]
changelog:
  - [block] blk-mq: Fix NULL pointer updating nr_requests (David Milburn) [1416133 1384066]
  - [scsi] cxlflash: Fix crash in cxlflash_restore_luntable() (Gustavo Duarte) [1415146 1400524]
  - [scsi] cxlflash: Improve context_reset() logic (Gustavo Duarte) [1415146 1400524]
  - [scsi] cxlflash: Avoid command room violation (Gustavo Duarte) [1415146 1400524]
  - [x86] Mark Kaby Lake with Kaby Lake PCH as supported (David Arcari) [1415094 1391219]
  - [scsi] be2iscsi: Add checks to validate completions (Maurizio Lombardi) [1414687 1324918]
  - [scsi] be2iscsi: Fix bad WRB index error (Maurizio Lombardi) [1414687 1324918]
  - [scsi] be2iscsi: Add lock to protect WRB alloc and free (Maurizio Lombardi) [1414687 1324918]
  - [mm] meminit: initialise more memory for inode/dentry hash tables in early boot (Yasuaki Ishimatsu) [1413623 1404584]
  - [s390] mem_detect: Revert "add DAT sanity check" (Hendrik Brueckner) [1413600 1391540]
  - [cpufreq] intel_pstate: Fix code ordering in intel_pstate_set_policy() (Prarit Bhargava) [1411818 1398072]
  - [scsi] cxlflash: Improve EEH recovery time (Steve Best) [1402442 1397588]
  - [scsi] cxlflash: Fix to avoid EEH and host reset collisions (Steve Best) [1402442 1397588]
  - [scsi] cxlflash: Remove the device cleanly in the system shutdown path (Steve Best) [1402442 1397588]
  - [scsi] cxlflash: Scan host only after the port is ready for I/O (Steve Best) [1402442 1397588]
  - [x86] kvm: x86: Check memopp before dereference (Mateusz Guzik) [1395805 1395806] {CVE-2016-8630}
  - [vfio] pci: Fix integer overflows, bitmask check (Mateusz Guzik) [1394627 1394991 1394628 1394992] {CVE-2016-9083 CVE-2016-9084}
  - [acpi] acpi / scan: use platform bus type by default for _HID enumeration (Tony Camuso) [1393727 1383505]
  - [acpi] acpi / scan: introduce platform_id device PNP type flag (Tony Camuso) [1393727 1383505]
  - [char] ipmi: Convert the IPMI SI ACPI handling to a platform device (Tony Camuso) [1393727 1383505]
  - [acpi] acpi / ipmi: Cleanup coding styles (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Cleanup some inclusion codes (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Cleanup some initialization codes (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Cleanup several acpi_ipmi_device members (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Add reference counting for ACPI IPMI transfers (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Use global IPMI operation region handler (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Fix race caused by the unprotected ACPI IPMI user (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Fix race caused by the timed out ACPI IPMI transfers (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Fix race caused by the unprotected ACPI IPMI transfers (David Arcari) [1393725 1373703]
  - [acpi] acpi / ipmi: Fix potential response buffer overflow (David Arcari) [1393725 1373703]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.10.2.el7]
changelog:
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1423462 1423463]


author: Kevin Lyons <kevin.x.lyons@oracle.com> - [3.10.0-514.6.10.0.1.el7]
changelog:
  - [ipc] ipc/sem.c: bugfix for semctl(,,GETZCNT) (Manfred Spraul) [orabug 22552377]
  - Oracle Linux certificates (Alexey Petrenko)
  - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)
  - Update x509.genkey [bug 24817676]


author: Kevin Lyons <kevin.x.lyons@oracle.com> - [3.10.0-514.10.2.el7.OL7]
changelog:
  - Oracle Linux certificates (Alexey Petrenko)
  - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)
  - Update x509.genkey [bug 24817676]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.11.1.el7]
changelog:
  - [scsi] qla2xxx: Get mutex lock before checking optrom_state (Chad Dupuis) [1418317 1408387]
  - [mm] memcontrol: do not recurse in direct reclaim (Rik van Riel) [1417192 1397330]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.13.1.el7]
changelog:
  - [fs] gfs2: Reduce contention on gfs2_log_lock (Robert S Peterson) [1422380 1406850]
  - [fs] gfs2: Inline function meta_lo_add (Robert S Peterson) [1422380 1406850]
  - [fs] gfs2: Switch tr_touched to flag in transaction (Robert S Peterson) [1422380 1406850]
  - [fs] xfs: ioends require logically contiguous file offsets (Brian Foster) [1421203 1398005]
  - [fs] xfs: don't chain ioends during writepage submission (Brian Foster) [1421203 1398005]
  - [fs] xfs: factor mapping out of xfs_do_writepage (Brian Foster) [1421203 1398005]
  - [fs] xfs: xfs_cluster_write is redundant (Brian Foster) [1421203 1398005]
  - [fs] xfs: Introduce writeback context for writepages (Brian Foster) [1421203 1398005]
  - [fs] xfs: remove xfs_cancel_ioend (Brian Foster) [1421203 1398005]
  - [fs] xfs: remove nonblocking mode from xfs_vm_writepage (Brian Foster) [1421203 1398005]
  - [fs] mm/filemap.c: make global sync not clear error status of individual inodes (Brian Foster) [1421203 1398005]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.14.1.el7]
changelog:
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1423462 1423463] {CVE-2017-6074}
  - [net] sctp: check af before verify address in sctp_addr_id2transport (Xin Long) [1419837 1414389]
  - [net] sctp: sctp_addr_id2transport should verify the addr before looking up assoc (Xin Long) [1419837 1414389]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.15.1.el7]
changelog:
  - [net] vxlan: fix oops in dev_fill_metadata_dst (Paolo Abeni) [1427847 1423068]
  - [x86] perf/x86/intel/uncore: Fix hardcoded socket 0 assumption in the Haswell init code (Prarit Bhargava) [1426633 1373738]
  - [x86] revert "perf/uncore: Disable uncore on kdump kernel" (Prarit Bhargava) [1426633 1373738]
  - [x86] smpboot: Init apic mapping before usage (Prarit Bhargava) [1426633 1373738]
  - [x86] smp: Don't try to poke disabled/non-existent APIC (Prarit Bhargava) [1426633 1373738]
  - [x86] Handle non enumerated CPU after physical hotplug (Prarit Bhargava) [1426633 1373738]
  - [x86] perf/x86: Fix NMI measurements (Jiri Olsa) [1425804 1405101]
  - [x86] Warn when NMI handlers take large amounts of time (Jiri Olsa) [1425804 1405101]
  - [nvme] apply DELAY_BEFORE_CHK_RDY quirk at probe time too (Gustavo Duarte) [1423439 1409122]
  - [crypto] qat - zero esram only for DH85x devices (Neil Horman) [1422575 1382849]
  - [crypto] qat - fix bar discovery for c62x (Neil Horman) [1422575 1382849]
  - [fs] xfs: remove racy hasattr check from attr ops (Brian Foster) [1421202 1395538]
  - [fs] dlm: free workqueues after the connections (Marcelo Leitner) [1421197 1383710]
  - [netdrv] igb: re-assign hw address pointer on reset after PCI error (Gustavo Duarte) [1419459 1413043]
  - [kernel] timekeeping: Increment clock_was_set_seq in timekeeping_init() (Prarit Bhargava) [1418947 1409214]
  - [kernel] timekeeping: Use timekeeping_update() instead of memcpy() (Prarit Bhargava) [1418947 1409214]
  - [fs] libceph: no need to drop con->mutex for ->get_authorizer() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: drop len argument of *verify_authorizer_reply() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: verify authorize reply on connect (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: no need for GFP_NOFS in ceph_monc_init() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: stop allocating a new cipher on every crypto request (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: uninline ceph_crypto_key_destroy() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: remove now unused ceph_*{en, de}crypt*() functions (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: switch ceph_x_decrypt() to ceph_crypt() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: switch ceph_x_encrypt() to ceph_crypt() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: tweak calcu_signature() a little (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: rename and align ceph_x_authorizer::reply_buf (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: introduce ceph_crypt() for in-place en/decryption (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: introduce ceph_x_encrypt_offset() (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: old_key in process_one_ticket() is redundant (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: ceph_x_encrypt_buflen() takes in_len (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: Remove unnecessary ivsize variables (Ilya Dryomov) [1418316 1408170]
  - [fs] libceph: Use skcipher (Ilya Dryomov) [1418316 1408170]
  - [scsi] scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands (Ewan Milne) [1417923 1403849]
  - [netdrv] ibmvnic: Start completion queue negotiation at server-provided optimum values (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: Fix missing brackets in init_sub_crq_irqs (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: Fix releasing of sub-CRQ IRQs in interrupt context (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: Update MTU after device initialization (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: Fix GFP_KERNEL allocation in interrupt context (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: fix error return code in ibmvnic_probe() (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: convert to use simple_open() (Steve Best) [1415144 1403396]
  - [netdrv] ibmvnic: Handle backing device failover and reinitialization (Steve Best) [1418309 1403692]
  - [tools] perf ppc64le: Fix build failure when libelf is not present (Jiri Olsa) [1414710 1376534]
  - [tools] perf probe ppc64le: Fix probe location when using DWARF (Jiri Olsa) [1414710 1376534]
  - [tools] perf probe: Add function to post process kernel trace events (Jiri Olsa) [1414710 1376534]
  - [tools] perf symbols: Fix kallsyms perf test on ppc64le (Jiri Olsa) [1414710 1376534]
  - [tools] perf powerpc: Fix kprobe and kretprobe handling with kallsyms on ppc64le (Jiri Olsa) [1414710 1376534]
  - [netdrv] bnx2x: Use the correct divisor value for PHC clock readings (Michal Schmidt) [1413996 1175585]
  - [fs] seq_file: reset iterator to first record for zero offset (Miklos Szeredi) [1413681 1386642]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.16.1.el7]
changelog:
  - [tty] n_hdlc: get rid of racy n_hdlc.tbuf ("Herton R. Krzesinski") [1429919 1429920] {CVE-2017-2636}
  - [md] dm rq: cope with DM device destruction while in dm_old_request_fn() (Mike Snitzer) [1430334 1412854]
  - [fs] nfs: Fix inode corruption in nfs_prime_dcache() (Benjamin Coddington) [1429514 1416532]
  - [fs] nfs: Don't let readdirplus revalidate an inode that was marked as stale (Benjamin Coddington) [1429514 1416532]
  - [block] Copy a user iovec if it includes gaps (Jeff Moyer) [1429508 1421263]
  - [kernel] percpu-refcount: fix reference leak during percpu-atomic transition (Jeff Moyer) [1429507 1418333]
  - [powerpc] eeh: eeh_pci_enable(): fix checking of post-request state (Steve Best) [1425538 1383670]
  - [s390] mm: handle PTE-mapped tail pages in fast gup (Hendrik Brueckner) [1423438 1391532]
  - [net] skbuff: Fix skb checksum partial check (Lance Richardson) [1422964 1411480]
  - [net] skbuff: Fix skb checksum flag on skb pull (Lance Richardson) [1422964 1411480]
  - [security] selinux: fix off-by-one in setprocattr (Paul Moore) [1422368 1422369] {CVE-2017-2618}
  - [virtio] balloon: check the number of available pages in leak balloon (David Hildenbrand) [1417194 1401615]
  - [infiniband] ib/rdmavt: Only put mmap_info ref if it exists (Jonathan Toppins) [1417191 1391299]
  - [x86] kvm: x86: make lapic hrtimer pinned (Luiz Capitulino) [1416373 1392593]
  - [kernel] sched/nohz: Fix affine unpinned timers mess (Luiz Capitulino) [1416373 1392593]
  - [kernel] nohz: Affine unpinned timers to housekeepers (Luiz Capitulino) [1416373 1392593]
  - [kernel] tick-sched: add housekeeping_mask cpumask (Luiz Capitulino) [1416373 1392593]
  - [x86] platform/uv/bau: Add UV4-specific functions (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Fix payload queue setup on UV4 hardware (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Disable software timeout on UV4 hardware (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Populate ->uvhub_version with UV4 version information (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Use generic function pointers (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Add generic function pointers (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Convert uv_physnodeaddr() use to uv_gpa_to_offset() (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Clean up pq_init() (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Clean up and update printks (Frank Ramsay) [1414715 1386692]
  - [x86] platform/uv/bau: Clean up vertical alignment (Frank Ramsay) [1414715 1386692]
  - [virtio] virtio-pci: alloc only resources actually used (Laurent Vivier) [1413093 1375153]
  - [net] avoid signed overflows for SO_{SND|RCV}BUFFORCE (Sabrina Dubroca) [1412473 1412474] {CVE-2016-9793}
  - [netdrv] sfc: clear napi_hash state when copying channels (Jarod Wilson) [1401461 1394304]
  - [lib] mpi: Fix NULL ptr dereference in mpi_powm() (Mateusz Guzik) [1398457 1398458] {CVE-2016-8650}
  - [scsi] lpfc: Fix eh_deadline setting for sli3 adapters (Ewan Milne) [1430687 1366564]
  - [md] dm round robin: revert "use percpu 'repeat_count' and 'current_path'" (Mike Snitzer) [1430689 1422567]
  - [md] dm round robin: do not use this_cpu_ptr() without having preemption disabled (Mike Snitzer) [1430689 1422567]
  - Revert: [x86] Handle non enumerated CPU after physical hotplug (Prarit Bhargava) [1426633 1373738]
  - Revert: [x86] smp: Don't try to poke disabled/non-existent APIC (Prarit Bhargava) [1426633 1373738]
  - Revert: [x86] smpboot: Init apic mapping before usage (Prarit Bhargava) [1426633 1373738]
  - Revert: [x86] revert "perf/uncore: Disable uncore on kdump kernel" (Prarit Bhargava) [1426633 1373738]
  - Revert: [x86] perf/x86/intel/uncore: Fix hardcoded socket 0 assumption in the Haswell init code (Prarit Bhargava) [1426633 1373738]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-509.el7]
changelog:
  - [mm] sparse: use memblock apis for early memory allocations (Koki Sanagi) [1375453]
  - [mm] memblock: add memblock memory allocation apis (Koki Sanagi) [1375453]
  - [mm] thp: harden the debug kernel with a strict check for thp_mmu_gather (Andrea Arcangeli) [1369365]
  - [mm] thp: initialize thp_mmu_gather for newly allocated migrated pages (Andrea Arcangeli) [1369365]
  - [mm] thp: put_huge_zero_page() with MMU gather #2 (Andrea Arcangeli) [1369365]
  - [fs] nfs: fix BUG() crash in notify_change() with patch to chown_common() ("J. Bruce Fields") [1342695]
  - [net] ipv6: gro: fix forwarding of tunneled packets (Jiri Benc) [1375438]
  - [net] sctp: hold the transport before using it in sctp_hash_cmp (Xin Long) [1368884]
  - [net] sctp: identify chunks that need to be fragmented at IP level (Xin Long) [1371377]
  - [scsi] be2iscsi: revert: _bh for io_sgl_lock and mgmt_sgl_lock (Maurizio Lombardi) [1374223]
  - [block] blk-mq: Allow timeouts to run while queue is freezing (Gustavo Duarte) [1372483]
  - [block] defer timeouts to a workqueue (Gustavo Duarte) [1372483]
  - [netdrv] tg3: Fix for disallow tx coalescing time to be 0 (Ivan Vecera) [1368885]
  - [netdrv] tg3: Fix for diasllow rx coalescing time to be 0 (Ivan Vecera) [1368885]
  - [infiniband] rdma/ocrdma: Support user AH creation for RoCE-v2 (Don Dutile) [1376120]
  - [infiniband] rdma/ocrdma: Support RoCE-v2 in the RC path (Don Dutile) [1376120]
  - [infiniband] rdma/ocrdma: Support RoCE-v2 in the UD path (Don Dutile) [1376120]
  - [infiniband] rdma/ocrdma: Export udp encapsulation capability (Don Dutile) [1376120]
  - [infiniband] ib/mlx5: Fix wrong naming of port_rcv_data counter (Don Dutile) [1374862]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-510.el7]
changelog:
  - [kernel] audit: fix exe_file access in audit_exe_compare (Richard Guy Briggs) [1374478]
  - [kernel] mm: introduce get_task_exe_file (Richard Guy Briggs) [1374478]
  - [kernel] prctl: avoid using mmap_sem for exe_file serialization (Richard Guy Briggs) [1374478]
  - [kernel] mm: rcu-protected get_mm_exe_file() (Richard Guy Briggs) [1374478]
  - [dm] dm-raid: reverse validation of nosync+rebuild flags (Heinz Mauelshagen) [1371717]
  - [x86] kvm: correctly reset dest_map->vector when restoring LAPIC state (Paolo Bonzini) [1367716]
  - [s390] dasd: fix hanging device after clear subchannel (Gustavo Duarte) [1368068]
  - [netdrv] bna: fix crash in bnad_get_strings() (Ivan Vecera) [1376508]
  - [netdrv] bna: add missing per queue ethtool stat (Ivan Vecera) [1376508]
  - [powerpc] kvm: Implement kvm_arch_intc_initialized() for PPC (David Gibson) [1375778]
  - [powerpc] kvm: book3s: Don't crash if irqfd used with no in-kernel XICS emulation (David Gibson) [1375778]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-511.el7]
changelog:
  - [net] add recursion limit to GRO (Sabrina Dubroca) [1374191] {CVE-2016-7039}
  - [mm] cgroup: fix hugetlb_cgroup_read() (Jerome Marchand) [1378236]
  - [fs] nfs: change invalidatepage prototype to accept length (Benjamin Coddington) [1366131]
  - [fs] xfs: quiesce the filesystem after recovery on readonly mount (Eric Sandeen) [1375457]
  - [fs] xfs: rework buffer dispose list tracking (Brian Foster) [1349175]
  - [fs] ext4: pre-zero allocated blocks for DAX IO (Eric Sandeen) [1367989]
  - [fs] gfs2: Initialize atime of I_NEW inodes (Andreas Grunbacher) [1379447]
  - [fs] gfs2: Update file times after grabbing glock (Andreas Grunbacher) [1379447]
  - [x86] topology: Handle CPUID bogosity gracefully (Vitaly Kuznetsov) [1377988]
  - [netdrv] sfc: check async completer is !NULL before calling (Jarod Wilson) [1368201]
  - [infiniband] ib/mlx5: Fix iteration overrun in GSI qps (Don Dutile) [1376941]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-512.el7]
changelog:
  - [fs] revert "ext4: pre-zero allocated blocks for DAX IO" (Eric Sandeen) [1380571]
  - [fs] nfsd: fix corruption in notifier registration ("J. Bruce Fields") [1378363]
  - [fs] xfs: log recovery tracepoints to track current lsn and buffer submission (Brian Foster) [1362730]
  - [fs] xfs: update metadata LSN in buffers during log recovery (Brian Foster) [1362730]
  - [fs] xfs: don't warn on buffers not being recovered due to LSN (Brian Foster) [1362730]
  - [fs] xfs: pass current lsn to log recovery buffer validation (Brian Foster) [1362730]
  - [fs] xfs: rework log recovery to submit buffers on LSN boundaries (Brian Foster) [1362730]
  - [x86] perf/uncore: Disable uncore on kdump kernel (Jiri Olsa) [1379569]
  - [netdrv] mlx4_core: Fix to clean devlink resources (Kamal Heib) [1379504]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-514.el7]
changelog:
  - [mm] remove gup_flags FOLL_WRITE games from __get_user_pages() (Larry Woodman) [1385124] {CVE-2016-5195}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.1.1.el7]
changelog:
  - [netdrv] xen-netfront: avoid packet loss when ethernet header crosses page boundary (Vitaly Kuznetsov) [1390257 1348581]
  - [infiniband] ib/iser: Fix max_sectors calculation (Jonathan Toppins) [1389012 1380515]
  - [block] blk-mq: improve warning for running a queue on the wrong CPU (Gustavo Duarte) [1389011 1376948]
  - [block] blk-mq: don't overwrite rq->mq_ctx (Gustavo Duarte) [1389011 1376948]
  - [kernel] pm/sleep: Fix request_firmware() error at resume (Don Zickus) [1389009 1375203]
  - [vfio] vfio-pci: Disable INTx after MSI/X teardown (Alex Williamson) [1389004 1371495]
  - [vfio] vfio-pci: Virtualize PCIe & AF FLR (Alex Williamson) [1389004 1371495]
  - [nvme] Don't suspend admin queue that wasn't created (Gustavo Duarte) [1389001 1370507]
  - [nvme] Suspend all queues before deletion (Gustavo Duarte) [1389001 1370507]
  - [powerpc] kvm: ppc: book3s hv: Take out virtual core piggybacking code (Thomas Huth) [1388997 1350719]
  - [powerpc] kvm: ppc: book3s: Treat VTB as a per-subcore register, not per-thread (Thomas Huth) [1388997 1350719]
  - [powerpc] kvm: ppc: book3s hv: Move struct kvmppc_vcore from kvm_host.h to kvm_book3s.h (Thomas Huth) [1388997 1350719]
  - [scsi] cxgb4i: Increased the value of MAX_IMM_TX_PKT_LEN from 128 to 256 bytes (Sai Vemuri) [1388996 1379954]
  - [scsi] cxgb4i: fix credit check for tx_data_wr (Sai Vemuri) [1388996 1379954]
  - [x86] pci: vmd: Request userspace control of PCIe hotplug indicators (Myron Stowe) [1388881 1380181]
  - [pci] pciehp: Allow exclusive userspace control of indicators (Myron Stowe) [1388881 1380181]
  - [fs] sunrpc: move NO_CRKEY_TIMEOUT to the auth->au_flags (Dave Wysochanski) [1388604 1384666]
  - [x86] fix call location of smp_quirk_init_udelay() (Prarit Bhargava) [1388598 1377296]
  - [x86] hpet: Re-enable HPET on Purley 4S (Prarit Bhargava) [1388597 1372853]
  - [x86] hpet: Reduce HPET counter read contention (Prarit Bhargava) [1388597 1372853]
  - [net] openvswitch: avoid deferred execution of recirc actions (Lance Richardson) [1388592 1370643]
  - [net] ipv4: Use math to point per net sysctls into the appropriate struct net (Eric Garver) [1388591 1363661]
  - [md] dm raid: fix activation of existing raid4/10 devices (Mike Snitzer) [1388504 1385149]
  - [md] dm: free io_barrier after blk_cleanup_queue call (Mike Snitzer) [1388503 1385813]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.2.1.el7]
changelog:
  - [firmware] efi: Fix usage of illegal alignment on efi_low_alloc (Lenny Szubowicz) [1392044 1387689]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.2.2.el7]
changelog:
  - [kernel] timekeeping: Copy the shadow-timekeeper over the real timekeeper last (Prarit Bhargava) [1395577 1344747]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.17.1.el7]
changelog:
  - [netdrv] i40e: Be much more verbose about what we can and cannot offload (Stefan Assmann) [1433273 1383521]
  - [kernel] watchdog: prevent false hardlockup on overloaded system (Don Zickus) [1433267 1399881]
  - [net] dccp/tcp: fix routing redirect race (Eric Garver) [1433265 1387485]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.18.1.el7]
changelog:
  - [net] ipv6: don't increase size when refragmenting forwarded ipv6 skbs (Florian Westphal) [1434589 1430571]
  - [net] bridge: drop netfilter fake rtable unconditionally (Florian Westphal) [1434589 1430571]
  - [net] ipv6: avoid write to a possibly cloned skb (Florian Westphal) [1434589 1430571]
  - [net] netfilter: bridge: honor frag_max_size when refragmenting (Florian Westphal) [1434589 1430571]
  - [net] bridge: Add br_netif_receive_skb remove netif_receive_skb_sk (Ivan Vecera) [1434589 1352289]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.19.1.el7]
changelog:
  - [fs] gfs2: Wake up io waiters whenever a flush is done (Robert S Peterson) [1437126 1404301]
  - [fs] gfs2: Made logd daemon take into account log demand (Robert S Peterson) [1437126 1404301]
  - [fs] gfs2: Limit number of transaction blocks requested for truncates (Robert S Peterson) [1437126 1404301]
  - [net] ipv6: addrconf: fix dev refcont leak when DAD failed (Hangbin Liu) [1436588 1416105]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.20.1.el7]
changelog:
  - [powerpc] fadump: Fix the race in crash_fadump() (Steve Best) [1439810 1420077]
  - [kernel] locking/mutex: Explicitly mark task as running after wakeup (Gustavo Duarte) [1439803 1423397]
  - [netdrv] ixgbe: Force VLNCTRL.VFE to be set in all VMDq paths (Ken Cox) [1438421 1383524]
  - [fs] nfsv4.0: always send mode in SETATTR after EXCLUSIVE4 (Benjamin Coddington) [1437967 1415780]
  - [net] fix creation adjacent device symlinks (Adrian Reber) [1436646 1412898]
  - [net] prevent of emerging cross-namespace symlinks (Adrian Reber) [1436646 1412898]
  - [netdrv] macvlan: unregister net device when netdev_upper_dev_link() fails (Adrian Reber) [1436646 1412898]
  - [scsi] vmw_pvscsi: return SUCCESS for successful command aborts (Ewan Milne) [1435764 1394172]
  - [infiniband] ib/uverbs: Fix race between uverbs_close and remove_one (Don Dutile) [1435187 1417284]
  - [fs] gfs2: Prevent BUG from occurring when normal Withdraws occur (Robert S Peterson) [1433882 1404005]
  - [fs] jbd2: fix incorrect unlock on j_list_lock (Lukas Czerner) [1433881 1403346]
  - [fs] xfs: don't wrap ID in xfs_dq_get_next_id (Eric Sandeen) [1433415 1418182]
  - [net] tcp/dccp: avoid starving bh on connect (Paolo Abeni) [1433320 1401419]
  - [fs] xfs: fix up xfs_swap_extent_forks inline extent handling (Eric Sandeen) [1432154 1412945]
  - [x86] kvm: vmx: handle PML full VMEXIT that occurs during event delivery (Radim Krcmar) [1431666 1421296]
  - [virt] kvm: vmx: ensure VMCS is current while enabling PML (Radim Krcmar) [1431666 1421296]
  - [net] ip_tunnel: Create percpu gro_cell (Jiri Benc) [1431197 1424076]
  - [x86] kvm: x86: do not save guest-unsupported XSAVE state (Radim Krcmar) [1431150 1401767]
  - [scsi] mpt3sas: Force request partial completion alignment (Tomas Henzl) [1430809 1418286]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.21.1.el7]
changelog:
  - [kernel] sched/core: Fix an SMP ordering race in try_to_wake_up() vs. schedule() (Gustavo Duarte) [1441547 1423400]
  - [drivers] Set dev->device_rh to NULL after free (Prarit Bhargava) [1441544 1414064]
  - [security] keys: request_key() should reget expired keys rather than give EKEYEXPIRED (David Howells) [1441287 1408330]
  - [security] keys: Simplify KEYRING_SEARCH_{NO, DO}_STATE_CHECK flags (David Howells) [1441287 1408330]
  - [net] packet: fix overflow in check for tp_reserve (Hangbin Liu) [1441171 1441172] {CVE-2017-7308}
  - [net] packet: fix overflow in check for tp_frame_nr (Hangbin Liu) [1441171 1441172] {CVE-2017-7308}
  - [net] packet: fix overflow in check for priv area size (Hangbin Liu) [1441171 1441172] {CVE-2017-7308}
  - [powerpc] pseries: Use H_CLEAR_HPT to clear MMU hash table during kexec (Steve Best) [1439812 1423396]
  - [netdrv] fjes: Fix wrong netdevice feature flags (Yasuaki Ishimatsu) [1439802 1435603]
  - [kernel] mlx5e: Implement Fragmented Work Queue (WQ) (Don Dutile) [1439164 1368400]
  - [netdrv] mlx5e: Copy all L2 headers into inline segment (Don Dutile) [1439161 1383013]
  - [nvdimm] fix PHYS_PFN/PFN_PHYS mixup (Jeff Moyer) [1439160 1428115]
  - [s390] scsi: zfcp: fix rport unblock race with LUN recovery (Hendrik Brueckner) [1433413 1421750]
  - [fs] gfs2: Avoid alignment hole in struct lm_lockname (Robert S Peterson) [1432554 1425450]
  - [fs] gfs2: Add missing rcu locking for glock lookup (Robert S Peterson) [1432554 1425450]
  - [fs] ext4: fix fencepost in s_first_meta_bg validation (Lukas Czerner) [1430969 1332503] {CVE-2016-10208}
  - [fs] ext4: sanity check the block and cluster size at mount time (Lukas Czerner) [1430969 1332503] {CVE-2016-10208}
  - [fs] ext4: validate s_first_meta_bg at mount time (Lukas Czerner) [1430969 1332503] {CVE-2016-10208}
  - [net] sctp: deny peeloff operation on asocs with threads sleeping on it (Hangbin Liu) [1429496 1429497] {CVE-2017-5986 CVE-2017-6353}
  - [net] sctp: avoid BUG_ON on sctp_wait_for_sndbuf (Hangbin Liu) [1429496 1429497] {CVE-2017-5986 CVE-2017-6353}
  - [x86] perf/x86/intel/rapl: Make package handling more robust (Jiri Olsa) [1443902 1418688]
  - [x86] perf/x86/intel/rapl: Convert to hotplug state machine (Jiri Olsa) [1443902 1418688]
  - [x86] perf/x86: Set pmu->module in Intel PMU modules (Jiri Olsa) [1443902 1418688]
  - [kernel] sched/core, x86/topology: Fix NUMA in package topology bug (Jiri Olsa) [1441645 1369832]
  - [kernel] sched: Allow hotplug notifiers to be setup early (Jiri Olsa) [1441645 1369832]
  - [x86] x86/smpboot: Make logical package management more robust (Prarit Bhargava) [1441643 1414054]
  - [x86] x86/cpu: Deal with broken firmware (VMWare/XEN) (Prarit Bhargava) [1441643 1414054]
  - [x86] perf/x86/intel/uncore: Fix hardcoded socket 0 assumption in the Haswell init code (Prarit Bhargava) [1426633 1373738]
  - [x86] revert "perf/uncore: Disable uncore on kdump kernel" (Prarit Bhargava) [1426633 1373738]
  - [x86] smpboot: Init apic mapping before usage (Prarit Bhargava) [1426633 1373738]
  - [x86] smp: Don't try to poke disabled/non-existent APIC (Prarit Bhargava) [1426633 1373738]
  - [x86] Handle non enumerated CPU after physical hotplug (Prarit Bhargava) [1426633 1373738]
  - [block] fix use-after-free in seq file (Denys Vlasenko) [1418550 1418551] {CVE-2016-7910}
  - [crypto] algif_hash - Only export and import on sockets with data (Herbert Xu) [1394101 1387632] {CVE-2016-8646}
  - [char] hwrng: core - sleep interruptible in read (Amit Shah) [1443503 1376397]
  - [char] hwrng: core - correct error check of kthread_run call (Amit Shah) [1443503 1376397]
  - [char] hwrng: core - Move hwrng_init call into set_current_rng (Amit Shah) [1443503 1376397]
  - [char] hwrng: core - Drop current rng in set_current_rng (Amit Shah) [1443503 1376397]
  - [char] hwrng: core - Do not register device opportunistically (Amit Shah) [1443503 1376397]
  - [char] hwrng: core - Fix current_rng init/cleanup race yet again (Amit Shah) [1443503 1376397]
  - [char] hwrng: core - Use struct completion for cleanup_done (Amit Shah) [1443503 1376397]
  - [char] hwrng: don't init list element we're about to add to list (Amit Shah) [1443503 1376397]
  - [char] hwrng: don't double-check old_rng (Amit Shah) [1443503 1376397]
  - [char] hwrng: fix unregister race (Amit Shah) [1443503 1376397]
  - [char] hwrng: use reference counts on each struct hwrng (Amit Shah) [1443503 1376397]
  - [char] hwrng: move some code out mutex_lock for avoiding underlying deadlock (Amit Shah) [1443503 1376397]
  - [char] hwrng: place mutex around read functions and buffers (Amit Shah) [1443503 1376397]
  - [char] virtio-rng: skip reading when we start to remove the device (Amit Shah) [1443503 1376397]
  - [char] virtio-rng: fix stuck of hot-unplugging busy device (Amit Shah) [1443503 1376397]
  - [infiniband] ib/mlx5: Resolve soft lock on massive reg MRs (Don Dutile) [1444347 1417285]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.23.1.el7]
changelog:
  - [scsi] qla2xxx: Defer marking device lost when receiving an RSCN (Himanshu Madhani) [1446246 1436940]
  - [scsi] qla2xxx: Fix typo in driver (Himanshu Madhani) [1446246 1436940]
  - [scsi] qla2xxx: Fix crash in qla2xxx_eh_abort on bad ptr (Himanshu Madhani) [1446246 1436940]
  - [scsi] qla2xxx: Avoid that issuing a LIP triggers a kernel crash (Himanshu Madhani) [1446246 1436940]
  - [scsi] qla2xxx: Add fix to read correct register value for ISP82xx (Himanshu Madhani) [1446246 1436940]
  - [scsi] qla2xxx: Disable the adapter and skip error recovery in case of register disconnect (Himanshu Madhani) [1446246 1436940]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.24.1.el7]
changelog:
  - [scsi] lpfc: Fix panic on BFS configuration (Maurizio Lombardi) [1452044 1443116]
  - [vfio] type1: Reduce repetitive calls in vfio_pin_pages_remote() (Alex Williamson) [1450855 1438403]
  - [vfio] type1: Remove locked page accounting workqueue (Alex Williamson) [1450855 1438403]
  - [fs] nfs: Allow getattr to also report readdirplus cache hits (Dave Wysochanski) [1450851 1442068]
  - [fs] nfs: Be more targeted about readdirplus use when doing lookup/revalidation (Dave Wysochanski) [1450851 1442068]
  - [fs] nfs: Fix a performance regression in readdir (Dave Wysochanski) [1450851 1442068]
  - [x86] xen: do not re-use pirq number cached in pci device msi msg data (Vitaly Kuznetsov) [1450037 1433831]
  - [powerpc] mm: Add missing global TLB invalidate if cxl is active (Steve Best) [1449178 1440776]
  - [powerpc] boot: Fix zImage TOC alignment (Gustavo Duarte) [1444343 1395838]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.25.1.el7]
changelog:
  - [lib] kobject: grab an extra reference on kobject->sd to allow duplicate deletes (Aristeu Rozanski) [1454851 1427252]
  - [kernel] module: When modifying a module's text ignore modules which are going away too (Aaron Tomlin) [1454684 1386313]
  - [kernel] module: Ensure a module's state is set accordingly during module coming cleanup code (Aaron Tomlin) [1454684 1386313]
  - [net] vxlan: do not output confusing error message (Jiri Benc) [1454636 1445054]
  - [net] vxlan: correctly handle ipv6.disable module parameter (Jiri Benc) [1454636 1445054]
  - [iommu] vt-d: fix range computation when making room for large pages (Alex Williamson) [1450856 1435612]
  - [fs] nfsd: stricter decoding of write-like NFSv2/v3 ops ("J. Bruce Fields") [1449282 1443204] {CVE-2017-7895}
  - [fs] nfsd4: minor NFSv2/v3 write decoding cleanup ("J. Bruce Fields") [1449282 1443204] {CVE-2017-7895}
  - [md] dm mirror: use all available legs on multiple failures (Mike Snitzer) [1449176 1383444]
  - [fs] nfsd: check for oversized NFSv2/v3 arguments ("J. Bruce Fields") [1447642 1442407] {CVE-2017-7645}
  - [scsi] ses: don't get power status of SES device slot on probe (Gustavo Duarte) [1446650 1434768]
  - [scsi] ipr: do not set DID_PASSTHROUGH on CHECK CONDITION (Steve Best) [1446649 1441747]
  - [net] macsec: dynamically allocate space for sglist (Sabrina Dubroca) [1445546 1445545] {CVE-2017-7477}
  - [net] macsec: avoid heap overflow in skb_to_sgvec (Sabrina Dubroca) [1445546 1445545] {CVE-2017-7477}
  - [fs] gfs2: Allow glocks to be unlocked after withdraw (Robert S Peterson) [1433882 1404005]
  - [net] tcp: avoid infinite loop in tcp_splice_read() (Davide Caratti) [1430579 1430580] {CVE-2017-6214}
  - [mm] vma_merge: correct false positive from __vma_unlink->validate_mm_rb (Andrea Arcangeli) [1428840 1374548]
  - [mm] vma_merge: fix race vm_page_prot race condition against rmap_walk (Andrea Arcangeli) [1428840 1374548]
  - [mm] fix use-after-free if memory allocation failed in vma_adjust() (Andrea Arcangeli) [1428840 1374548]
  - [x86] kvm: x86: fix emulation of "MOV SS, null selector" (Radim Krcmar) [1414742 1414743] {CVE-2017-2583}
  - [powerpc] prom: Increase minimum RMA size to 512MB (Gustavo Duarte) [1450041 1411321]
  - [pci] pciehp: Prioritize data-link event over presence detect (Myron Stowe) [1450124 1435818]
  - [pci] pciehp: Don't re-read Slot Status when queuing hotplug event (Myron Stowe) [1450124 1435818]
  - [pci] pciehp: Process all hotplug events before looking for new ones (Myron Stowe) [1450124 1435818]
  - [pci] pciehp: Rename pcie_isr() locals for clarity (Myron Stowe) [1450124 1435818]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.26.1.el7]
changelog:
  - [mm] enlarge stack guard gap (Larry Woodman) [1452732 1452733] {CVE-2017-1000364}
  - Revert: [md] dm mirror: use all available legs on multiple failures (Mike Snitzer) [1449176 1383444]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-514.26.2.el7]
changelog:
  - [mm] fix new crash in unmapped_area_topdown() (Frantisek Hrbata) [1466138 1463241]
  - [mm] larger stack guard gap, between vmas (Frantisek Hrbata) [1466138 1463241]
  - [mm] Revert "enlarge stack guard gap" (Frantisek Hrbata) [1466138 1463241]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-506.el7]
changelog:
  - [kernel] timekeeping: Cap adjustments so they don't exceed the maxadj value (Marcelo Tosatti) [1246218]
  - [kernel] fork: allocate idle task for a CPU always on its local node (Oleg Nesterov) [1339635]
  - [kernel] sys: do_sysinfo() use get_monotonic_boottime() (Milos Vyletel) [1373224]
  - [fs] proc/uptime: uptime_proc_show() use get_monotonic_boottime() (Milos Vyletel) [1373224]
  - [fs] exec: de_thread: mt-exec should update ->real_start_time (Milos Vyletel) [1373224]
  - [fs] ovl: clear nlink on rmdir (Miklos Szeredi) [1373787]
  - [fs] ovl: share inode for hard link (Miklos Szeredi) [1373787]
  - [fs] ovl: use generic_delete_inode (Miklos Szeredi) [1373787]
  - [fs] ovl: handle umask and posix_acl_default correctly on creation (Miklos Szeredi) [1351863]
  - [fs] ovl: fix sgid on directory (Miklos Szeredi) [1351863]
  - [fs] ovl: copyattr after setting POSIX ACL (Miklos Szeredi) [1371638]
  - [fs] ovl: Switch to generic_removexattr (Miklos Szeredi) [1371651]
  - [fs] ovl: Get rid of ovl_xattr_noacl_handlers array (Miklos Szeredi) [1371651]
  - [fs] ext4: print ext4 mount option data_err=abort correctly (Lukas Czerner) [1342403]
  - [fs] nfs4: Avoid migration loops (Benjamin Coddington) [1355977]
  - [fs] nfs: don't create zero-length requests (Benjamin Coddington) [1324635]
  - [fs] xfs: don't assert fail on non-async buffers on ioacct decrement (Brian Foster) [1363822]
  - [fs] btrfs: set S_IOPS_WRAPPER consistently (Eric Sandeen) [1182456]
  - [fs] xfs: prevent dropping ioend completions during buftarg wait (Brian Foster) [1370177]
  - [fs] gfs2: Fix extended attribute readahead optimization (Robert S Peterson) [1256539]
  - [mm] page_alloc: don't re-init pageset in zone_pcp_update() (Yasuaki Ishimatsu) [1374114]
  - [mm] readahead: Move readahead limit outside of readahead, and advisory syscalls (Kyle Walker) [1351353]
  - [net] veth: sctp: add NETIF_F_SCTP_CRC to device features (Xin Long) [1367105]
  - [net] veth: Update features to include all tunnel GSO types (Xin Long) [1367105]
  - [tty] serial: 8250_dw: add ability to handle the peripheral clock (Prarit Bhargava) [1367476]
  - [x86] mm: Fix regression panic at boot time seen on some NUMA systems (Larry Woodman) [1372047]
  - [x86] mm: non-linear virtual memory fix for KNL4 erratum (Larry Woodman) [1372047]
  - [x86] tsc: Add rdtscll() merge helper (Mitsuhiro Tanino) [1372398]
  - [x86] kvm: Expose more Intel AVX512 feature to guest (Paolo Bonzini) [1369038]
  - [s390] pci: remove iomap sanity checks (Jason Wang) [1373503]
  - [nvme] Add device ID's with stripe quirk (David Milburn) [1371642]
  - [scsi] mpt3sas: Fix panic when aer correct error occurred (Frank Ramsay) [1374745]
  - [iommu] vt-d: Disable passthrough mode on Kexec kernel (Myron Stowe) [1367621]
  - [netdrv] ixgbe: Eliminate useless message and improve logic (Ken Cox) [1369519]
  - [netdrv] sfc: check MTU against minimum threshold (Jarod Wilson) [1363683]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-507.el7]
changelog:
  - [netdrv] ixgbe: fix spoofed packets with macvlans (Ken Cox) [1324631]
  - [tools] perf mem: Fix -t store option for record command (Jiri Olsa) [1357531 1357543]
  - [x86] clock: Fix kvm guest tsc initialization (Prarit Bhargava) [1372759]
  - [x86] tsc: Enumerate BXT tsc_khz via CPUID (Prarit Bhargava) [1372759]
  - [drm] i915: Enable polling when we don't have hpd (Lyude Paul) [1277863]
  - [drm] i915/vlv: Disable HPD in valleyview_crt_detect_hotplug() (Lyude Paul) [1277863]
  - [drm] i915/vlv: Reset the ADPA in vlv_display_power_well_init() (Lyude Paul) [1277863]
  - [drm] i915/vlv: Make intel_crt_reset() per-encoder (Lyude Paul) [1277863]
  - [fs] Fix NULL pointer dereference in bl_free_device() (Benjamin Coddington) [1356796]
  - [fs] nfs/blocklayout: support RH/Fedora dm-mpath device nodes (Benjamin Coddington) [1356796]
  - [fs] nfs/blocklayout: refactor open-by-wwn (Benjamin Coddington) [1356796]
  - [fs] nfs/blocklayout: use proper fmode for opening block devices (Benjamin Coddington) [1356796]
  - [fs] sunrpc: fix UDP memory accounting (Paolo Abeni) [1298899]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-508.el7]
changelog:
  - [drm] i915: Add GEN7_PCODE_MIN_FREQ_TABLE_GT_RATIO_OUT_OF_RANGE to SNB (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: implement missing case for SKL watermarks calculation (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: fix the watermark res_blocks value (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: fix plane_blocks_per_line on watermarks calculations (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: minimum scanlines for Y tile is not always 4 (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: fix the WaWmMemoryReadLatency implementation (Lyude Paul) [1341633 1355776]
  - [drm] i915/skl: Don't try to update plane watermarks if they haven't changed (Lyude Paul) [1341633 1355776]
  - [drm] i915/skl: Update DDB values atomically with wms/plane attrs (Lyude Paul) [1341633 1355776]
  - [drm] i915: Move CRTC updating in atomic_commit into it's own hook (Lyude Paul) [1341633 1355776]
  - [drm] i915/skl: Ensure pipes with changed wms get added to the state (Lyude Paul) [1341633 1355776]
  - [drm] i915/skl: Update plane watermarks atomically during plane updates (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: Only copy WM results for changed pipes to skl_hw (Lyude Paul) [1341633 1355776]
  - [drm] i915/skl: Add support for the SAGV, fix underrun hangs (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen6+: Interpret mailbox error flags (Lyude Paul) [1341633 1355776]
  - [drm] i915/gen9: Only copy WM results for changed pipes to skl_hw (Lyude Paul) [1341633 1355776]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-686.el7]
changelog:
  - [fs] nfsv4.1: Keep a reference on lock states while checking (Scott Mayhew) [1458721]
  - [fs] nfsv4.1: Handle NFS4ERR_OLD_STATEID in nfs4_reclaim_open_state (Scott Mayhew) [1458721]
  - [fs] nfsv4: Don't call close if the open stateid has already been cleared (Scott Mayhew) [1458721]
  - [fs] nfsv4: Fix CLOSE races with OPEN (Scott Mayhew) [1458721]
  - [fs] nfsv4.1: Fix a regression in DELEGRETURN (Scott Mayhew) [1458721]
  - [fs] nfs: nfs_rename() - revalidate directories on -ERESTARTSYS (Benjamin Coddington) [1459404]
  - [fs] revert "nfs: nfs_rename() handle -ERESTARTSYS dentry left behind" (Benjamin Coddington) [1459404]
  - [s390] pci: moving check and allocation of device_rh ahead (Wei Xu) [1455117]
  - [netdrv] cxgb4: handle serial flash interrupt (Sai Vemuri) [1462266]
  - [netdrv] cxgb4: fix to bring link down after adapter crash (Sai Vemuri) [1462266]
  - [netdrv] cxgb4: handle interrupt raised when FW crashes (Sai Vemuri) [1462266]
  - [security] keys: Change the name of the dead type to ".dead" to prevent user access (David Howells) [1439264] {CVE-2017-6951}
  - [security] keys: Protect request_key() against a type with no match function (David Howells) [1433216] {CVE-2017-2647}
  - [security] keys: Disallow keyrings beginning with '.' to be joined as session keyrings (David Howells) [1389309] {CVE-2016-9604}


author: Rafael Aquini <aquini@redhat.com> [3.10.0-687.el7]
changelog:
  - [fs] mntns: Remove incorrect put_mnt_ns ("Eric W. Biederman") [1463072]
  - [md] dm raid: fix oops on upgrading to extended superblock format (Mike Snitzer) [1464274]
  - [md] dm io: fix duplicate bio completion due to missing ref count (Mike Snitzer) [1461519]
  - [net] gro_cells: mark napi struct as not busy poll candidates (Eelco Chaudron) [1460078]
  - [x86] boot/kaslr: Skip kernel text relocation if no kaslr action is done (Baoquan He) [1458738]
  - [char] tpm/tpm_crb: enter the low power state upon device suspend (Jerry Snitselaar) [1463001]
  - [input] wacom: fix Wacom Cintiq 27QHD max pressure (Aristeu Rozanski) [1461910]
  - [kernel] nohz: Fix spurious warning when hrtimer and clockevent get out of sync (Frederic Weisbecker) [1366043]
  - [kernel] nohz: Fix buggy tick delay on IRQ storms (Frederic Weisbecker) [1366043]
  - [kernel] nohz: Reset next_tick cache even when the timer has no regs (Frederic Weisbecker) [1366043]
  - [kernel] nohz: Fix collision between tick and other hrtimers, again (Frederic Weisbecker) [1366043]
  - [kernel] nohz: Add hrtimer sanity check (Frederic Weisbecker) [1366043]
  - [kernel] revert "nohz: Fix collision between tick and other hrtimers" (Frederic Weisbecker) [1366043]
  - [powerpc] do not make the entire heap executable (Denys Vlasenko) [1330064]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-688.el7]
changelog:
  - [s390] move _text symbol to address higher than zero (Jiri Olsa) [1464800]
  - [netdrv] cxgb4: notify uP to route ctrlq compl to rdma rspq (Sai Vemuri) [1463324]
  - [powerpc] Add HAVE_PERF_USER_STACK_DUMP support (Jiri Olsa) [1449182]
  - [tools] perf report: Ensure the perf DSO mapping matches what libdw sees (Jiri Olsa) [1449182]
  - [tools] perf report: Include partial stacks unwound with libdw (Jiri Olsa) [1449182]
  - [tools] perf: libdw support for powerpc (Jiri Olsa) [1449182]
  - [firmware] efi/esrt: Cleanup bad memory map log messages (Prarit Bhargava) [1380812]
  - [firmware] efi/esrt: Fix typo in pr_err() message (Prarit Bhargava) [1380812]
  - [firmware] efi/esrt: Use memremap not ioremap to access ESRT table in memory (Prarit Bhargava) [1380812]
  - [firmware] efi: Work around ia64 build problem with ESRT driver (Prarit Bhargava) [1380812]
  - [firmware] efi/esrt: Don't preformat name (Prarit Bhargava) [1380812]
  - [firmware] efi: Make efi/esrt.c driver explicitly non-modular (Prarit Bhargava) [1380812]
  - [firmware] efi/esrt: Fix some compiler warnings (Prarit Bhargava) [1380812]
  - [firmware] efi: Add esrt support (Prarit Bhargava) [1380812]
  - [firmware] efi: Rename efi_guid_unparse to efi_guid_to_str (Prarit Bhargava) [1380812]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-690.el7]
changelog:
  - [mm] fix new crash in unmapped_area_topdown() (Larry Woodman) [1463241] {CVE-2017-1000364}
  - [mm] larger stack guard gap, between vmas (Larry Woodman) [1463241] {CVE-2017-1000364}
  - [mm] Revert "enlarge stack guard gap" (Larry Woodman) [1463241] {CVE-2017-1000364}
  - [crypto] testmgr - Reenable sha1/aes in FIPS mode (Herbert Xu) [1465234]
  - [crypto] testmgr - mark more algorithms as FIPS compliant (Herbert Xu) [1465234]
  - [target] tcmu: break up free_device callback (Mike Christie) [1430225]
  - [target] tcmu: perfom device add and del synchronously (Mike Christie) [1430225]
  - [target] tcmu: use idr for se_device dev index (Mike Christie) [1430225]
  - [target] tcmu: prep for sync add/rm device support (Mike Christie) [1430225]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-691.el7]
changelog:
  - [redhat] spec: Update dracut dependency to enable more algorithms as FIPS compliant (Rafael Aquini) [1466097]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-692.el7]
changelog:
  - [pci] Avoid FLR for Intel 82579 NICs (Jarod Wilson) [966840]
  - [net] netfilter: nf_ct_dccp/sctp: fix memory leak after netns cleanup (Davide Caratti) [1458687]
  - [net] netfilter: udplite: Remove duplicated udplite4/6 declaration (Davide Caratti) [1458687]
  - [net] netfilter: nat: merge udp and udplite helpers (Davide Caratti) [1458687]
  - [net] netfilter: merge udp and udplite conntrack helpers (Davide Caratti) [1458687]
  - [netdrv] mlx5: Tolerate irq_set_affinity_hint() failures (Kamal Heib) [1465830]
  - [netdrv] bonding: Restore old symlink names in sysfs to preserve ABI (Neil Horman) [1461892]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-693.el7]
changelog:
  - [x86] crypto: sha1-ssse3 - Disable avx2 (Benjamin Coddington) [1346106]
  - [net] geneve: fix hlist corruption (Jiri Benc) [1464292]
  - [net] vxlan: fix hlist corruption (Jiri Benc) [1464292]
  - [net] vxlan: fix use-after-free on deletion (Jiri Benc) [1464292]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.1.1.el7]
changelog:
  - [fs] dentry name snapshots (Miklos Szeredi) [1471131 1470403] {CVE-2017-7533}
  - [fs] fix the regression from "direct-io: Fix negative return from dio read beyond eof" (Eric Sandeen) [1475669 1473549]
  - [fs] direct-io: Fix negative return from dio read beyond eof (Eric Sandeen) [1475669 1473549]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.4.1.el7]
changelog:
  - [fs] nfsv4: Add missing nfs_put_lock_context() (Benjamin Coddington) [1487271 1476826]
  - [fs] nfs: discard nfs_lockowner structure (Benjamin Coddington) [1487271 1476826]
  - [fs] nfsv4: enhance nfs4_copy_lock_stateid to use a flock stateid if there is one (Benjamin Coddington) [1487271 1476826]
  - [fs] nfsv4: change nfs4_select_rw_stateid to take a lock_context inplace of lock_owner (Benjamin Coddington) [1487271 1476826]
  - [fs] nfsv4: change nfs4_do_setattr to take an open_context instead of a nfs4_state (Benjamin Coddington) [1487271 1476826]
  - [fs] nfsv4: add flock_owner to open context (Benjamin Coddington) [1487271 1476826]
  - [fs] nfs: remove l_pid field from nfs_lockowner (Benjamin Coddington) [1487271 1476826]
  - [x86] platform/uv/bau: Disable BAU on single hub configurations (Frank Ramsay) [1487159 1487160 1472455 1473353]
  - [x86] platform/uv/bau: Fix congested_response_us not taking effect (Frank Ramsay) [1487159 1472455]
  - [fs] cifs: Disable encryption capability for RHEL 7.4 kernel (Sachin Prabhu) [1485445 1485445]
  - [fs] sunrpc: Handle EADDRNOTAVAIL on connection failures (Dave Wysochanski) [1484269 1479043]
  - [fs] include/linux/printk.h: include pr_fmt in pr_debug_ratelimited (Sachin Prabhu) [1484267 1472823]
  - [fs] printk: pr_debug_ratelimited: check state first to reduce "callbacks suppressed" messages (Sachin Prabhu) [1484267 1472823]
  - [net] packet: fix tp_reserve race in packet_set_ring (Stefano Brivio) [1481938 1481940] {CVE-2017-1000111}
  - [fs] proc: revert /proc/<pid>/maps [stack:TID] annotation (Waiman Long) [1481724 1448534]
  - [net] ping: check minimum size on ICMP header length (Matteo Croce) [1481578 1481573] {CVE-2016-8399}
  - [ipc] mqueue: fix a use-after-free in sys_mq_notify() (Davide Caratti) [1476128 1476126] {CVE-2017-11176}
  - [netdrv] brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx() (Stanislaw Gruszka) [1474778 1474784] {CVE-2017-7541}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.5.1.el7]
changelog:
  - [netdrv] i40e: point wb_desc at the nvm_wb_desc during i40e_read_nvm_aq (Stefan Assmann) [1491972 1484232]
  - [netdrv] i40e: avoid NVM acquire deadlock during NVM update (Stefan Assmann) [1491972 1484232]
  - [mm] Fix Kernel bug during boot with memory cgroups enabled (Larry Woodman) [1491970 1483747]
  - [fs] nfsv4: Ensure we don't re-test revoked and freed stateids (Dave Wysochanski) [1491969 1459733]
  - [netdrv] bonding: commit link status change after propose (Jarod Wilson) [1491121 1469790]
  - [mm] page_alloc: ratelimit PFNs busy info message (Jonathan Toppins) [1491120 1383179]
  - [netdrv] cxgb4: avoid crash on PCI error recovery path (Gustavo Duarte) [1489872 1456990]
  - [scsi] Add STARGET_CREATED_REMOVE state to scsi_target_state (Ewan Milne) [1489814 1468727]
  - [net] tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Davide Caratti) [1488341 1487061] {CVE-2017-14106}
  - [net] tcp: fix 0 divide in __tcp_select_window() (Davide Caratti) [1488341 1487061] {CVE-2017-14106}
  - [net] sctp: Avoid out-of-bounds reads from address storage (Stefano Brivio) [1484356 1484355] {CVE-2017-7558}
  - [net] udp: consistently apply ufo or fragmentation (Davide Caratti) [1481530 1481535] {CVE-2017-1000112}
  - [net] udp: account for current skb length when deciding about UFO (Davide Caratti) [1481530 1481535] {CVE-2017-1000112}
  - [net] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output (Davide Caratti) [1481530 1481535] {CVE-2017-1000112}
  - [net] udp: avoid ufo handling on IP payload compression packets (Stefano Brivio) [1490263 1464161]
  - [pci] hv: Use vPCI protocol version 1.2 (Vitaly Kuznetsov) [1478256 1459202]
  - [pci] hv: Add vPCI version protocol negotiation (Vitaly Kuznetsov) [1478256 1459202]
  - [pci] hv: Use page allocation for hbus structure (Vitaly Kuznetsov) [1478256 1459202]
  - [pci] hv: Fix comment formatting and use proper integer fields (Vitaly Kuznetsov) [1478256 1459202]
  - [net] ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() (Stefano Brivio) [1477007 1477010] {CVE-2017-7542}
  - [net] ipv6: avoid overflow of offset in ip6_find_1stfragopt (Sabrina Dubroca) [1477007 1477010] {CVE-2017-7542}
  - [net] xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder (Hannes Frederic Sowa) [1435672 1435670] {CVE-2017-7184}
  - [net] xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window (Hannes Frederic Sowa) [1435672 1435670] {CVE-2017-7184}
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1489788 1489789] {CVE-2017-1000251}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.6.1.el7]
changelog:
  - [netdrv] mlx5: Avoid using pending command interface slots (Don Dutile) [1497604 1463367]
  - [x86] amd: Limit cpu_core_id fixup to families older than F17h (Suravee Suthikulpanit) [1497603 1477397]
  - [x86] cpu/amd: Fix Zen SMT topology (Suravee Suthikulpanit) [1497603 1477397]
  - [x86] cpu/amd: Bring back Compute Unit ID (Suravee Suthikulpanit) [1497603 1477397]
  - [x86] cpu/amd: Fix Bulldozer topology (Suravee Suthikulpanit) [1497603 1477397]
  - [x86] cpu/amd: Clean up cpu_llc_id assignment per topology feature (Suravee Suthikulpanit) [1497603 1477397]
  - [x86] cpu: Get rid of compute_unit_id (Suravee Suthikulpanit) [1497603 1477397]
  - [x86] amd: Derive L3 shared_cpu_map from cpu_llc_shared_mask (Suravee Suthikulpanit) [1497238 1477399]
  - [net] ipv6: only call ip6_route_dev_notify() once for NETDEV_UNREGISTER (Matteo Croce) [1497121 1468935]
  - [fs] gfs2: Fix debugfs glocks dump (Andreas Grunbacher) [1497078 1493067]
  - [fs] gfs2: Replace rhashtable_walk_init with rhashtable_walk_enter (Andreas Grunbacher) [1497078 1493067]
  - [fs] gfs2: Deduplicate gfs2_{glocks,glstats}_open (Andreas Grunbacher) [1497078 1493067]
  - [cpufreq] intel_pstate: Fix unsafe HWP MSR access (Steve Best) [1497058 1457552]
  - [s390] af_iucv: correctly copy SKB data (add missing hunk from 04d0ec) (Hendrik Brueckner) [1494354 1459782]
  - [sound] alsa: timer: Use common error handling code in alsa_timer_init() (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Adjust a condition check in snd_timer_resolution() (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Follow standard EXPORT_SYMBOL() declarations (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Wrap with spinlock for queue access (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Improve user queue reallocation (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Fix race between read and ioctl (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Info leak in snd_timer_user_tinterrupt() (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: remove some dead code (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}
  - [sound] alsa: timer: Reject user params with too small ticks (Jaroslav Kysela) [1465998 1465999] {CVE-2017-1000380}


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.7.1.el7]
changelog:
  - [mm] page_cgroup: Fix Kernel bug during boot with memory cgroups enabled (Larry Woodman) [1491970 1483747]
  - Revert: [mm] Fix Kernel bug during boot with memory cgroups enabled (Larry Woodman) [1491970 1483747]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.8.1.el7]
changelog:
  - [x86] kvm: x86: Fix potential preemption when get the current kvmclock timestamp (Marcelo Tosatti) [1503459 1496522]
  - [x86] kvm: x86: remove irq disablement around KVM_SET_CLOCK/KVM_GET_CLOCK (Marcelo Tosatti) [1503459 1496522]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.9.1.el7]
changelog:
  - [fs] ext4: fix off-by-one on max nr_pages in ext4_find_unwritten_pgoff() (Bill O'Donnell) [1504115 1458728]
  - [fs] ext4: fix off-by-in loop termination in ext4_find_unwritten_pgoff() (Bill O'Donnell) [1501387 1469363]
  - [fs] ext4: fix SEEK_HOLE (Bill O'Donnell) [1501387 1469363]
  - [fs] xfs: Move handling of missing page into one place in xfs_find_get_desired_pgoff() (Bill O'Donnell) [1498736 1460446]
  - [fs] xfs: Fix off-by-in in loop termination in xfs_find_get_desired_pgoff() (Bill O'Donnell) [1498736 1460446]
  - [fs] xfs: Fix missed holes in SEEK_HOLE implementation (Bill O'Donnell) [1498736 1460446]
  - [fs] xfs: fix off-by-one on max nr_pages in xfs_find_get_desired_pgoff() (Eryu Guan) [1502731 1458997]
  - [nvme] Test unit Ready broken for nvme drvices (David Milburn) [1502733 1478457]
  - [hv] vmbus: Increase the time between retries in vmbus_post_msg() (Mohammed Gamal) [1495763 1491843]
  - [hv] vmbus: Fix error code returned by vmbus_post_msg() (Mohammed Gamal) [1495763 1467258]
  - [netdrv] netvsc: propagate MAC address change to VF slave (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: delay setup of VF device (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: make sure and unregister datapath (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: fix rtnl deadlock on unregister of vf (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: transparent VF management (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] hv_netvsc: Fix the carrier state error when data path is off (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] hv_netvsc: Fix the queue index computation in forwarding case (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: handle select_queue when device is being removed (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: report per-channel stats in ethtool statistics (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: account for packets/bytes transmitted after completion (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: group all per-channel state together (Vitaly Kuznetsov) [1500321 1477784]
  - [netdrv] netvsc: enhance transmit select_queue (Vitaly Kuznetsov) [1500321 1477784]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.10.1.el7]
changelog:
  - [mm] mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd() (Rafael Aquini) [1505164 1472460]
  - [mm] fix invalid node in alloc_migrate_target() (Rafael Aquini) [1505164 1472460]
  - [mm] add !pte_present() check on existing hugetlb_entry callbacks (Rafael Aquini) [1505164 1472460]
  - [fs] ceph: avoid accessing freeing inode in ceph_check_delayed_caps() (Ilya Dryomov) [1505163 1489426]
  - [fs] nfsd: Fix general protection fault in release_lock_stateid() (J. Bruce Fields) [1505160 1500815]
  - [fs] cifs: Reconnect expired SMB sessions (Leif Sahlberg) [1501526 1477052]
  - [fs] cifs: Separate SMB2 header structure (Leif Sahlberg) [1501526 1429710]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.11.3.el7]
changelog:
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] dumpstack: Remove raw stack dump (Josh Poimboeuf) [1519795 1519798]
  - [x86] spec_ctrl: remove SPEC_CTRL_DEBUG code (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup unnecessary ptregscall_common function (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall entrance (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] KVM/spec_ctrl: allow IBRS to stay enabled in host userland (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debug aid to test the entry code without microcode (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace current thread (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable on wakeup (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] kvm: pad RSB on VM transition (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [tools] objtool: Don't print 'call dest' warnings for ignored functions (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [fs] prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [kernel] userns: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [misc] locking/barriers: introduce new memory barrier gmb() (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: fix RESTORE_CR3 crash in kaiser_stop_machine (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use atomic ops to poison/unpoison user pagetables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/64: Fix reboot interaction with CR4.PCIDE (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: enable kaiser in build (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: handle call to xen_pv_domain() on PREEMPT_RT (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: trampoline stack comments (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove paravirt clock warning (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map debug IDT tables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [perf] x86/intel/uncore: Fix memory leaks on allocation failures (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] userfaultfd: hugetlbfs: prevent UFFDIO_COPY to fill beyond the end of i_size (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [fs] userfaultfd: non-cooperative: fix fork use after free (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] userfaultfd: hugetlbfs: remove superfluous page unlock in VM_SHARED case (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] fix bad rss-counter if remap_file_pages raced migration (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.11.4.el7]
changelog:
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: issue a __spec_ctrl_ibpb if a credential check isn't possible (Andrea Arcangeli) [1519795 1519798]
  - [x86] mm/kaiser: disable global pages by default with KAISER (Andrea Arcangeli) [1519795 1519798]
  - Revert "x86/mm/kaiser: Disable global pages by default with KAISER" (Andrea Arcangeli) [1519795 1519798]
  - ibpb: don't optimize spec_cntrl_ibpb on PREEMPT_RCU (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: clear registers after 32bit syscall stackframe is setup (Andrea Arcangeli) [1519800 1519801]
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Andrea Arcangeli) [1519800 1519801]
  - [x86] kaiser/mm: fix pgd freeing in error path (Andrea Arcangeli) [1519800 1519801]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.11.5.el7]
changelog:
  - [x86] kaiser/mm: convert userland visible "kpti" name to "pti" (Andrea Arcangeli) [1519795 1519798]
  - Revert "x86/entry: Use retpoline for syscall's indirect calls" (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Andrea Arcangeli) [1519795 1519798]
  - [x86] kaiser/mm: __load_cr3 in resume from RAM after kernel gs has been restored (Andrea Arcangeli) [1519795 1519798]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.11.6.el7]
changelog:
  - [x86] spec_ctrl: Eliminate redundant FEATURE Not Present messages (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: skip IBRS/CR3 restore when paranoid exception returns to userland (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: consider the init_mm.pgd a kaiser pgd (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}


author: Jacob Wang <jacob.wang@oracle.com> - [3.10.0-693.11.6.0.1.el7.OL7]
changelog:
  - x86/xen: don't copy bogus duplicate entries into kernel page tables (joe.jin) [orabug 27095041]
  - [ipc] ipc/sem.c: bugfix for semctl(,,GETZCNT) (Manfred Spraul) [orabug 22552377]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.12.1.el7]
changelog:
  - [net] netfilter: x_tables: don't use seqlock when fetching old counters (Florian Westphal) [1509176 1503702]
  - [net] netfilter: x_tables: make xt_replace_table wait until old rules are not used anymore (Florian Westphal) [1509176 1503702]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.14.1.el7]
changelog:
  - [fs] ext4: Don't clear SGID when inheriting ACLs (Lukas Czerner) [1517829 1473480]
  - [fs] ext4: preserve i_mode if __ext4_set_acl() fails (Lukas Czerner) [1517829 1473480]
  - [x86] x86/smpboot: Fix __max_logical_packages estimate (Prarit Bhargava) [1517803 1474709]
  - [x86] x86/topology: Avoid wasting 128k for package id array (Prarit Bhargava) [1517803 1474709]
  - [x86] perf/x86/intel/uncore: Cache logical pkg id in uncore driver (Prarit Bhargava) [1517803 1474709]
  - [netdrv] bonding: fix slave stuck in BOND_LINK_FAIL state (Jarod Wilson) [1516169 1496837]
  - [crypto] x86/sha1 - Fix reads beyond the number of blocks passed (Herbert Xu) [1515838 1469200]
  - [edac] skx_edac: Handle systems with segmented PCI busses (Yasuyuki Kobayashi) [1515111 1500572]
  - [scsi] virtio_scsi: let host do exception handling (Paolo Bonzini) [1515107 1501309]
  - [mm] Fix panic due to NULL pointer dereference in __memcg_kmem_get_cache() (Larry Woodman) [1515105 1490495]
  - [s390] mm: fix write access check in gup_huge_pmd() (Hendrik Brueckner) [1513316 1506126]
  - [fs] xfs: reinit btree pointer on attr tree inactivation walk (Carlos Maiolino) [1512812 1469296]
  - [s390] s390/3270: fix allocation of tty3270_screen structure (Daniel Vacek) [1508355 1495587]
  - [s390] s390/3270: fix use after free of tty3270_screen structure (Daniel Vacek) [1508355 1495587]
  - [s390] s390/3270: fix return value check in tty3270_resize_work() (Daniel Vacek) [1508355 1495587]
  - [scsi] sd: Implement blacklist option for WRITE SAME w/ UNMAP (Ewan Milne) [1507043 1462594]
  - [lib] assoc_array: Fix a buggy node-splitting case (David Howells) [1502624 1501286] {CVE-2017-12193}
  - [security] keys: prevent KEYCTL_READ on negative key (David Howells) [1498369 1498371] {CVE-2017-12192}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.15.1.el7]
changelog:
  - [net] udp: fix bcast packet reception (Paolo Abeni) [1506530 1493238]
  - [net] udp: perform source validation for mcast early demux (Paolo Abeni) [1506530 1493238]
  - [net] ipv4: early demux can return an error code (Paolo Abeni) [1506530 1493238]
  - [net] tcp: reset sk_rx_dst in tcp_disconnect() (Jamie Bainbridge) [1520296 1467770]
  - [md] dm cache: fix race condition in the writeback mode overwrite_bio optimisation (Mike Snitzer) [1517795 1512095]
  - [net] packet: in packet_do_bind, test fanout with bind_lock held (Hangbin Liu) [1505430 1505429] {CVE-2017-15649}
  - [net] packet: hold bind lock when rebinding to fanout hook (Hangbin Liu) [1505430 1505429] {CVE-2017-15649}
  - [net] packet: Do not call fanout_release from atomic contexts (Hangbin Liu) [1505430 1505429] {CVE-2017-15649}
  - [net] packet: fix races in fanout_add() (Hangbin Liu) [1505430 1505429] {CVE-2017-15649}
  - [security] keys: Fix handling of stored error in a negatively instantiated user key (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}
  - [security] keys: fix keyctl_set_reqkey_keyring() to not leak thread keyrings (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}
  - [security] keys: Differentiate uses of rcu_dereference_key() and user_key_payload() (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}
  - [security] keys: Use memzero_explicit() for secret data (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}
  - [security] keys: Fix an error code in request_master_key() (David Howells) [1411618 1479727 1411622 1450158] {CVE-2015-8539 CVE-2017-7472}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.11.6.el7]
changelog:
  - [x86] spec_ctrl: Eliminate redundant FEATURE Not Present messages (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: skip IBRS/CR3 restore when paranoid exception returns to userland (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: consider the init_mm.pgd a kaiser pgd (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/mm: convert userland visible "kpti" name to "pti" (Andrea Arcangeli) [1519795 1519798]
  - Revert "x86/entry: Use retpoline for syscall's indirect calls" (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Andrea Arcangeli) [1519795 1519798]
  - [x86] kaiser/mm: __load_cr3 in resume from RAM after kernel gs has been restored (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: issue a __spec_ctrl_ibpb if a credential check isn't possible (Andrea Arcangeli) [1519795 1519798]
  - [x86] mm/kaiser: disable global pages by default with KAISER (Andrea Arcangeli) [1519795 1519798]
  - Revert "x86/mm/kaiser: Disable global pages by default with KAISER" (Andrea Arcangeli) [1519795 1519798]
  - [x86] ibpb: don't optimize spec_cntrl_ibpb on PREEMPT_RCU (Andrea Arcangeli) [1519795 1519798]
  - [x86] spec_ctrl: clear registers after 32bit syscall stackframe is setup (Andrea Arcangeli) [1519800 1519801]
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Andrea Arcangeli) [1519800 1519801]
  - [x86] kaiser/mm: fix pgd freeing in error path (Andrea Arcangeli) [1519800 1519801]
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715 CVE-2017-5754}
  - [x86] dumpstack: Remove raw stack dump (Josh Poimboeuf) [1519795 1519798]
  - [x86] spec_ctrl: remove SPEC_CTRL_DEBUG code (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup unnecessary ptregscall_common function (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall entrance (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] KVM/spec_ctrl: allow IBRS to stay enabled in host userland (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: add debug aid to test the entry code without microcode (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace current thread (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable on wakeup (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] kvm: pad RSB on VM transition (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [tools] objtool: Don't print 'call dest' warnings for ignored functions (Josh Poimboeuf) [1519795 1519798] {CVE-2017-5715}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [fs] prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [kernel] userns: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [misc] locking/barriers: introduce new memory barrier gmb() (Josh Poimboeuf) [1519788 1519786] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: fix RESTORE_CR3 crash in kaiser_stop_machine (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use atomic ops to poison/unpoison user pagetables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/64: Fix reboot interaction with CR4.PCIDE (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: enable kaiser in build (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: handle call to xen_pv_domain() on PREEMPT_RT (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: trampoline stack comments (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove paravirt clock warning (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map debug IDT tables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [perf] x86/intel/uncore: Fix memory leaks on allocation failures (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] userfaultfd: hugetlbfs: prevent UFFDIO_COPY to fill beyond the end of i_size (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [fs] userfaultfd: non-cooperative: fix fork use after free (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] userfaultfd: hugetlbfs: remove superfluous page unlock in VM_SHARED case (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}
  - [mm] fix bad rss-counter if remap_file_pages raced migration (Josh Poimboeuf) [1519800 1519801] {CVE-2017-5754}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.16.1.el7]
changelog:
  - [x86] smpboot: Do not use smp_num_siblings in __max_logical_packages calculation (Prarit Bhargava) [1533022 1519503]
  - [x86] topology: Add topology_max_smt_threads() (Prarit Bhargava) [1533022 1519503]
  - [powerpc] spinlock: add gmb memory barrier (Jon Masters) [1519788 1519786] {CVE-2017-5753}
  - [powerpc] Prevent Meltdown attack with L1-D$ flush (Jon Masters) [1519800 1519801] {CVE-2017-5754}
  - [s390] add ppa to system call and program check path (Jon Masters) [1519795 1519798] {CVE-2017-5715}
  - [s390] spinlock: add gmb memory barrier (Jon Masters) [1519788 1519786] {CVE-2017-5753}
  - [s390] introduce CPU alternatives (Jon Masters) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: move vmexit rmb in the last branch before IBRS (Andrea Arcangeli) [1533373 1533250]
  - [x86] spec_ctrl: satisfy the barrier like semantics of IBRS (Andrea Arcangeli) [1533373 1533250]
  - [fs] userfaultfd: clear the vma->vm_userfaultfd_ctx if UFFD_EVENT_FORK fails (Andrea Arcangeli) [1533372 1531287]
  - [x86] kaiser/efi: unbreak tboot (Andrea Arcangeli) [1519795 1532989 1519798 1531559] {CVE-2017-5715}
  - [x86] spec_ctrl: don't call ptrace_has_cap in the IBPB ctx switch optimization (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] kaiser/efi: unbreak EFI old_memmap (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpuidle_idle_call: fix double local_irq_enable() (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] entry: Invoke TRACE_IRQS_IRETQ in paranoid_userspace_restore_all (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu: fix get_scattered_cpu_leaf sorting part #2 (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] spec_ctrl: show added cpuid flags in /proc/cpuinfo after late microcode update (Andrea Arcangeli) [1519795 1519798] {CVE-2017-5715}
  - [x86] cpu: fix get_scattered_cpu_leaf for IBPB feature (Paolo Bonzini) [1519795 1519798]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.2.1.el7]
changelog:
  - [nvme] nvmet-rdma: occasionally flush ongoing controller teardown (Slava Shwartsman) [1479850 1467998]
  - [nvme] Free bio_aux struct when done with bio (David Milburn) [1474679 1455553]
  - [mm] thp: respect MPOL_PREFERRED policy with non-local node (Larry Woodman) [1479763 1476709]
  - [char] ipmi: use rcu lock around call to intf->handlers->sender() (Tony Camuso) [1479761 1419765]
  - [x86] vmware: Use tsc_khz value for calibrate_cpu() (Prarit Bhargava) [1479246 1475716]
  - [netdrv] cxgb4: reduce resource allocation in kdump kernel (Sai Vemuri) [1478255 1379762]
  - [netdrv] cxgb4: fix a NULL dereference (Sai Vemuri) [1478255 1379762]
  - [netdrv] cxgb4: fix BUG() on interrupt deallocating path of ULD (Mauricio Oliveira) [1475671 1465554]
  - [netdrv] bonding: Fix transmit load balancing in balance-alb mode (Jarod Wilson) [1475670 1473481]
  - [fs] xfs: use ->b_state to fix buffer I/O accounting release race (Brian Foster) [1478254 1452228]
  - [net] dst: Fix an intermittent pr_emerg warning about lo becoming free (Xin Long) [1475675 1458111]
  - [powerpc] eeh: Fix partial hotplug criterion (Gustavo Duarte) [1475672 1458508]
  - [powerpc] eeh: Fix wrong argument passed to eeh_rmv_device() (Gustavo Duarte) [1475672 1458508]
  - [crypto] api - Move alg ref count init to crypto_check_alg (Herbert Xu) [1475668 1473593]


author: Alexander Gordeev <agordeev@redhat.com> [3.10.0-693.2.2.el7]
changelog:
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1489788 1489789] {CVE-2017-1000251}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.18.1.el7]
changelog:
  - [md] raid5: fix a race condition in stripe batch (Nigel Croxon) [1535883 1496836]
  - [security] selinux: fix double free in selinux_parse_opts_str() (Paul Moore) [1532288 1456843]
  - [fs] nfs: revert "nfs: Move the flock open mode check into nfs_flock()" (Benjamin Coddington) [1531095 1497225]


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.19.1.el7]
changelog:
  - [watchdog] hpwdt: remove indirect call in drivers/watchdog/hpwdt.c (Josh Poimboeuf) [1539649 1535644]
  - [kernel] x86/spec_ctrl: cleanup __ptrace_may_access (Josh Poimboeuf) [1539649 1535644]
  - [x86] bugs: Drop one "mitigation" from dmesg (Josh Poimboeuf) [1539649 1535644]
  - [x86] kvm: vmx: Make indirect call speculation safe (Josh Poimboeuf) [1539649 1535644]
  - [x86] kvm: x86: Make indirect calls in emulator speculation safe (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline: Optimize inline assembler for vmexit_fill_RSB (Josh Poimboeuf) [1539649 1535644]
  - [x86] mce: Make machine check speculation protected (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: fix ptrace IBPB optimization (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: Avoid returns in IBRS-disabled regions (Josh Poimboeuf) [1539649 1535644]
  - [x86] spectre/meltdown: avoid the vulnerability directory to weaken kernel security (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: Document retpolines and ibrs_enabled=3 (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: upgrade GCC retpoline warning to an error (Josh Poimboeuf) [1539649 1535644]
  - [x86] Use IBRS for firmware update path (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: stuff RSB on context switch with SMEP enabled (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: enforce sane combinations of IBRS and retpoline (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: use upstream RSB stuffing function (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: add ibrs_enabled=3 (ibrs_user) (Josh Poimboeuf) [1539649 1535644]
  - [kernel] x86/jump_label: warn on failed jump label patch (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: detect unretpolined modules (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline: Add LFENCE to the retpoline/RSB filling RSB macros (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline: Fill return stack buffer on vmexit (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/xen: Convert Xen hypercall indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/hyperv: Convert assembler indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/ftrace: Convert ftrace assembler indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/entry: Convert entry assembler indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline/crypto: Convert crypto assembler indirect jumps (Josh Poimboeuf) [1539649 1535644]
  - [x86] retpoline: Add initial retpoline support (Josh Poimboeuf) [1539649 1535644]
  - [x86] jump_label: add asm support for static keys (Josh Poimboeuf) [1539649 1535644]
  - [x86] asm: Make asm/alternative.h safe from assembly (Josh Poimboeuf) [1539649 1535644]
  - [tools] objtool: Support new GCC 6 switch jump table pattern (Josh Poimboeuf) [1539649 1535644]
  - [tools] objtool: Detect jumps to retpoline thunks (Josh Poimboeuf) [1539649 1535644]
  - [x86] spectre: Add boot time option to select Spectre v2 mitigation (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: print features changed by microcode loading (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: refactor the init and microcode loading paths (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: move initialization of X86_FEATURE_IBPB_SUPPORT (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove SPEC_CTRL_PCP_IBPB bit (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove ibrs_enabled variable (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: add ibp_disabled variable (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: add X86_FEATURE_IBP_DISABLE (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove IBP disable for AMD model 0x16 (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove performance measurements from documentation (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: make ipbp_enabled read-only (Josh Poimboeuf) [1539649 1535644]
  - [x86] spec_ctrl: remove ibpb_enabled=2 mode (Josh Poimboeuf) [1539649 1535644]
  - [x86] cpu: Implement CPU vulnerabilites sysfs functions (Josh Poimboeuf) [1539649 1535644]
  - [base] sysfs/cpu: Add vulnerability folder (Josh Poimboeuf) [1539649 1535644]
  - [x86] cpu: Merge bugs.c and bugs_64.c (Josh Poimboeuf) [1539649 1535644]
  - [x86] syscall: int80 must not clobber r12-15 (Josh Poimboeuf) [1539649 1535644]
  - [x86] syscall: change ia32_syscall() to create the full register frame in ia32_do_call() (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Add early cmdline parsing for options with arguments (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Pass in size to early cmdline parsing (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Simplify early command line parsing (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Fix early command-line parsing when partial word matches (Josh Poimboeuf) [1539649 1535644]
  - [x86] boot: Fix early command-line parsing when matching at end (Josh Poimboeuf) [1539649 1535644]
  - [scsi] storvsc: Fix scsi_cmd error assignments in storvsc_handle_error (Cathy Avery) [1536978 1502601]
  - [fs] nfs: RPC_MAX_AUTH_SIZE is in bytes ("J. Bruce Fields") [1533378 1495321]
  - [fs] nfsd: give out fewer session slots as limit approaches (Dave Wysochanski) [1533377 1492234]
  - [fs] nfsd: increase DRC cache limit (Dave Wysochanski) [1533377 1492234]
  - [x86] kvm: x86: fix RSM when PCID is non-zero (Paolo Bonzini) [1531662 1530711]
  - [x86] iommu/amd: Reduce delay waiting for command buffer space (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] iommu/amd: Reduce amount of MMIO when submitting commands (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] amd: Remove cmd_buf_size and evt_buf_size from struct amd_iommu (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] amd: Fix the left value check of cmd buffer (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] amd: Don't put completion-wait semaphore on stack (Suravee Suthikulpanit) [1531456 1508644]
  - [x86] kvm: svm: obey guest PAT (Suravee Suthikulpanit) [1530976 1478185]
  - [tty] serial: 8250_pci: Add Amazon PCI serial device ID (Vitaly Kuznetsov) [1530137 1527545]
  - [ata] libata: sata_down_spd_limit should return if driver has not recorded sstatus speed (David Milburn) [1530136 1457140]
  - [fs] nfs: fix a deadlock in nfs client initialization (Scott Mayhew) [1530135 1506382]
  - [fs] nfsv4.0: Fix a lock leak in nfs40_walk_client_list (Scott Mayhew) [1530135 1506382]
  - [fs] nfs: Create a common nfs4_match_client() function (Scott Mayhew) [1530135 1506382]
  - [fs] autofs - revert: take more care to not update last_used on path walk (Ian Kent) [1525994 1489542]
  - [vhost] vhost_net: correctly check tx avail during rx busy polling (Jason Wang) [1523784 1487551]
  - [crypto] shash - Fix has_key setting (Herbert Xu) [1522932 1505817]
  - [block] Fix a race between blk_cleanup_queue() and timeout handling (Ming Lei) [1522698 1513725]
  - [x86] tsc: Force TSC_ADJUST register to value >= zero (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Validate cpumask pointer before accessing it (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Try to adjust TSC if sync test fails (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Prepare warp test for TSC adjustment (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Move sync cleanup to a safe place (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Sync test only for the first cpu in a package (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Verify TSC_ADJUST from idle (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Store and check TSC ADJUST MSR (Prarit Bhargava) [1519850 1497055]
  - [x86] tsc: Detect random warps (Prarit Bhargava) [1519850 1497055]
  - [x86] kvm: mmu: always terminate page walks at level 1 (Paolo Bonzini) [1500382 1500381] {CVE-2017-12188}
  - [x86] kvm: nVMX: update last_nonleaf_level when initializing nested EPT (Denys Vlasenko) [1500382 1500381] {CVE-2017-12188}
  - [x86] kvm: fix singlestepping over syscall (Paolo Bonzini) [1464480 1464481] {CVE-2017-7518}


author: Denys Vlasenko <dvlasenk@redhat.com> [3.10.0-693.21.1.el7]
changelog:
  - [x86] platform/uv: Mark tsc_check_sync as an init function (Frank Ramsay) [1547870 1526066]
  - [x86] platform/uv: Add check of TSC state set by UV BIOS (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Provide a means to disable TSC ART (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Drastically reduce the number of firmware bug warnings (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Skip TSC test and error messages if already unstable (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Add option that TSC on Socket 0 being non-zero is valid (Frank Ramsay) [1547870 1526066]
  - [x86] tsc: Remove the TSC_ADJUST clamp (Frank Ramsay) [1547870 1526066]


author: Rafael Aquini <aquini@redhat.com> [3.10.0-685.el7]
changelog:
  - [mm] enlarge stack guard gap (Larry Woodman) [1452733] {CVE-2017-1000364}
  - [mm] userfaultfd: shmem: handle coredumping in handle_userfault() (Andrea Arcangeli) [1462267]
  - [fs] nfs: Don't send mode again in post-EXCLUSIVE4_1 SETATTR with umask (Benjamin Coddington) [1449466]
  - [hid] hid_wacom: temporaly disable power_supply usage from driver (Aristeu Rozanski) [1458348]
  - [drm] mgag200: Fix to always set HiPri for G200e4 V2 (Rob Clark) [1461985]
  - [nvme] submit nvme_admin_activate_fw to admin queue (David Milburn) [1456978]
  - [netdrv] i40e: set VFs to untrusted mode by default (Stefan Assmann) [1462105]
  - [netdrv] tun: use symmetric hash (Jason Wang) [1458645]
  - [crypto] qat: copy back iv on completion (Neil Horman) [1446394]
  - [crypto] chcr - Fix txq ids (Sai Vemuri) [1457392]
  - [crypto] chcr - fix itnull.cocci warnings (Sai Vemuri) [1426189]
  - [crypto] chcr - Change flow IDs (Sai Vemuri) [1426189]
  - [crypto] chcr - Check device is allocated before use (Sai Vemuri) [1426189]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-854.el7]
changelog:
  - [tools] perf: Fix swap for samples with raw data (Jiri Olsa) [1458228]
  - [alsa] hda/realtek: Enable Thinkpad Dock device for ALC298 platform (Jaroslav Kysela) [1469623]
  - [crypto] rng: prevent entry into drbg test path from algif_rng (Bruno Eduardo de Oliveira Meneguele) [1485815]
  - [net] macvtap: add namespace support to the sysfs device class (Davide Caratti) [1544499]
  - [net] sched: cls_u32: fix cls_u32 on filter replace (Ivan Vecera) [1542013]
  - [net] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Florian Westphal) [1543088] {CVE-2017-18017}


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-855.el7]
changelog:
  - [crypto] algif_skcipher: Remove custom release parent function (Bruno Eduardo de Oliveira Meneguele) [1529441]
  - [crypto] algif_hash: Remove custom release parent function (Bruno Eduardo de Oliveira Meneguele) [1537376]
  - [mailbox] pcc: Drop uninformative output during boot (Kazuhito Hagio) [1515571]
  - [edac] skx_edac: Fix detection of single-rank DIMMs (Aristeu Rozanski) [1482248]
  - [md] free unused memory after bitmap resize (Nigel Croxon) [1532767]
  - [fs] sunrpc: ensure correct error is reported by xs_tcp_setup_socket() (Steve Dickson) [1536582]
  - [fs] Revert "fixing infinite OPEN loop in 4.0 stateid recovery" (Steve Dickson) [1542191]
  - [scsi] use 'scsi_device_from_queue()' for scsi_dh (Mike Snitzer) [1546212]
  - [scsi] dh: add a common helper to get a scsi_device from a request_queue (Mike Snitzer) [1546212]
  - [scsi] qedi: Drop cqe response during connection recovery (Chad Dupuis) [1543503]
  - [scsi] qedi: Fix a possible sleep-in-atomic bug in qedi_process_tmf_resp (Chad Dupuis) [1543503]
  - [scsi] qla4xxx: skip error recovery in case of register disconnect (Himanshu Madhani) [1541766]
  - [x86] spectre: fix the kernel build without CONFIG_RETPOLINE (Josh Poimboeuf) [1543939]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-856.el7]
changelog:
  - [infiniband] ipoib: Add ipoib_enhanced module parameter (Slava Shwartsman) [1533013]
  - [netdrv] ibmvnic: Remove skb->protocol checks in ibmvnic_xmit (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] ibmvnic: Reset long term map ID counter (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] ibmvnic: queue reset when CRQ gets closed during reset (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] ibmvnic: Ensure that buffers are NULL after free (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] ibmvnic: Fix rx queue cleanup for non-fatal resets (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] ibmvnic: fix empty firmware version and errors cleanup (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] ibmvnic: fix firmware version when no firmware level has been provided by the VIOS server (Desnes Augusto Nunes do Rosario) [1544356]
  - [netdrv] mlx5e: Fix offloading of E-Switch TC pedit actions (Slava Shwartsman) [1545640]
  - [netdrv] qed: Correct setting the number of completion queues for FCoE functions (Chad Dupuis) [1542188]
  - [netdrv] ixgbe: fix crash in build_skb Rx code path (Ken Cox) [1520428]
  - [netdrv] tg3: APE heartbeat changes (Jonathan Toppins) [1546217]
  - [powerpc] pseries/vio: Dispose of virq mapping on vdevice unregister (Gustavo Duarte) [1544009]
  - [s390] qeth: fix underestimated count of buffer elements (Hendrik Brueckner) [1544698]
  - [x86] kvm: fix singlestepping over syscall (Paolo Bonzini) [1464481] {CVE-2017-7518}
  - [x86] paravirt: fix kabi breakage in pv_mmu_ops (Jeff Moyer) [1546027]
  - [x86] uaccess: introduce copy_from_iter_flushcache for pmem / cache-bypass operations (Jeff Moyer) [1471678]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-857.el7]
changelog:
  - [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic (Jarod Wilson) [1548430] {CVE-2017-13166}
  - [sound] alsa: seq: Fix use-after-free at creating a port (CVE-2017-15265) (Jaroslav Kysela) [1503381] {CVE-2017-15265}
  - [gpu] drm/radeon: insist on 32-bit DMA for Cedar on PPC64/PPC64LE (Rob Clark) [1546022]
  - [edac] disable only ghes_edac by default (Aristeu Rozanski) [1543078]
  - [edac] ghes: Model a single, logical memory controller (Aristeu Rozanski) [1543078]
  - [fs] cifs: release cifs root_cred after exit_cifs (Leif Sahlberg) [1525874]
  - [fs] gfs2: Fix fallocate chunk size (Andreas Grunbacher) [1545329]
  - [fs] gfs2: Fixes to "Implement iomap for block_map" (Andreas Grunbacher) [1542594]
  - [fs] gfs2: Clean up (lookup,fillup)_metapath (Andreas Grunbacher) [1542594]
  - [fs] iomap: warn on zero-length mappings (Andreas Grunbacher) [1542594]
  - [md] raid0: remove blank line printk from dump_zones() (John Pittman) [1534272]
  - [md] dm: use blkdev_get rather than bdgrab when issuing pass-through ioctl (Mike Snitzer) [1513037]
  - [mm] kvmalloc: stress the vmalloc path in the debugging kernel (Mikulas Patocka) [1523567]
  - [mm] fs: rework do_invalidatepage (Eric Sandeen) [1546079]
  - [net] netfilter: fix NULL ptr dereference in nf_send_reset() (Paolo Abeni) [1546148]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-858.el7]
changelog:
  - [tools] revert perf: Fix swap for samples with raw data (Jiri Olsa) [1458228]
  - [netdrv] ibmvnic: Fix early release of login buffer (Desnes Augusto Nunes do Rosario) [1545578]
  - [netdrv] ibmvnic: Clean RX pool buffers during device close (Desnes Augusto Nunes do Rosario) [1545578]
  - [netdrv] ibmvnic: Free RX socket buffer in case of adapter error (Desnes Augusto Nunes do Rosario) [1545578]
  - [netdrv] ibmvnic: Fix NAPI structures memory leak (Desnes Augusto Nunes do Rosario) [1545578]
  - [netdrv] ibmvnic: Fix login buffer memory leaks (Desnes Augusto Nunes do Rosario) [1545578]
  - [netdrv] ibmvnic: Wait until reset is complete to set carrier on (Desnes Augusto Nunes do Rosario) [1545578]
  - [block] disable runtime-pm for blk-mq (Ming Lei) [1548269]
  - [mm] revert memcontrol: fix cgroup creation failure after many small jobs (Aristeu Rozanski) [1548593 1517028]
  - [mm] revert cgroup: kill css_id (Aristeu Rozanski) [1548593 1517028]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-859.el7]
changelog:
  - [media] v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548430] {CVE-2017-13166}
  - [kernel] futex: Prevent overflow by strengthen input validation (Joe Lawrence) [1547585] {CVE-2018-6927}
  - [fs] Revert dcache_readdir back to ->readdir() ("Eric W. Biederman") [1525541]
  - [md] dm-raid: fix incorrect sync_ratio when degraded (Mike Snitzer) [1547979]
  - [mm] page_alloc: fix memmap_init_zone pageblock alignment (Daniel Vacek) [1525121]
  - [mm] revert kvmalloc: stress the vmalloc path in the debugging kernel (Jeff Moyer) [1550094]
  - [powerpc] 64s: Allow control of RFI flush via debugfs (Mauricio Oliveira) [1543067]
  - [powerpc] 64s: Improve RFI L1-D cache flush fallback (Mauricio Oliveira) [1543067]
  - [powerpc] 64s: Wire up cpu_show_meltdown() (Mauricio Oliveira) [1543067]
  - [x86] kvm: vmx: Cache IA32_DEBUGCTL in memory (Paolo Bonzini) [1537379]
  - [x86] spec_ctrl: avoid rmb() on full retpoline kernels (Paolo Bonzini) [1537379]
  - [x86] spec_ctrl: replace boot_cpu_has with a static key for IBRS checks (Paolo Bonzini) [1537379]
  - [x86] spec_ctrl: actually use static key for retpolines (Paolo Bonzini) [1537379]
  - [x86] kvm: vmx: optimize IBRS handling at vmenter/vmexit (Paolo Bonzini) [1537379]
  - [x86] kvm: vmx: mark RDMSR path as unlikely (Paolo Bonzini) [1537379]
  - [x86] kvm: use native_read_msr to read SPEC_CTRL (Paolo Bonzini) [1537379]
  - [x86] kvm/nvmx: Set the CPU_BASED_USE_MSR_BITMAPS if we have a valid L02 MSR bitmap (Paolo Bonzini) [1537379]
  - [x86] nvmx: Properly set spec_ctrl and pred_cmd before merging MSRs (Paolo Bonzini) [1537379]
  - [x86] kvm/vmx: Allow direct access to MSR_IA32_SPEC_CTRL (Paolo Bonzini) [1537379]
  - [x86] kvm: Add IBPB support (Paolo Bonzini) [1537379]
  - [x86] kvm: vmx: make MSR bitmaps per-VCPU (Paolo Bonzini) [1537379]
  - [x86] kvm: vmx: Do not disable intercepts for BNDCFGS (Paolo Bonzini) [1537379]
  - [x86] kvm: vmx: introduce alloc_loaded_vmcs (Paolo Bonzini) [1537379]
  - [x86] kvm: nvmx: Eliminate vmcs02 pool (Paolo Bonzini) [1537379]
  - [x86] kvm: nvmx: single function for switching between vmcs (Paolo Bonzini) [1537379]
  - [x86] kvm: Update the reverse_cpuid list to include CPUID_7_EDX (Paolo Bonzini) [1537379]
  - [x86] cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Paolo Bonzini) [1537379]
  - [x86] cpufeatures: Clean up Spectre v2 related CPUID flags (Paolo Bonzini) [1537379]
  - [x86] cpufeatures: Add Intel feature bits for Speculation Control (Paolo Bonzini) [1537379]
  - [x86] cpufeatures: Add AMD feature bits for Speculation Control (Paolo Bonzini) [1537379]
  - [x86] cpufeatures: Add CPUID_7_EDX CPUID leaf (Paolo Bonzini) [1537379]
  - [x86] cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Paolo Bonzini) [1537379]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-860.el7]
changelog:
  - [acpi] sbshc: remove raw pointer from printk() message (Baoquan He) [1547009] {CVE-2018-5750}
  - [fs] gfs2: fixes to "implement iomap for block_map" (Andreas Grunbacher) [1542594]
  - [x86] kvm: svm: disable virtual GIF and VMLOAD/VMSAVE (Paolo Bonzini) [1552090]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-861.el7]
changelog:
  - [netdrv] tg3: prevent scheduling while atomic splat (Jonathan Toppins) [1554590]
  - [nvme] validate admin queue before unquiesce (David Milburn) [1549733]


author: Bruno E. O. Meneguele <brdeoliv@redhat.com> [3.10.0-862.el7]
changelog:
  - [netdrv] i40e: Fix attach VF to VM issue (Stefan Assmann) [1528123]
  - [netdrv] ixgbevf: Add check for ixgbe_mbox_api_13 to ixgbevf_probe when setting max_mtu (Ken Cox) [1556696]
  - [md] dm btree: fix serious bug in btree_split_beneath() (Mike Snitzer) [1557849]
  - [x86] pti: Disable PTI user page table update in EFI virtual mode (Waiman Long) [1540061]


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-862.9.1.el7]
changelog:
  - [iscsi-target] Fix iscsi_np reset hung task during parallel delete (Maurizio Lombardi) [1583593 1579217]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.10.1.el7]
changelog:
  - [x86] add _TIF_UPROBE to _TIF_DO_NOTIFY_MASK (Oleg Nesterov) [1595155 1579521]
  - [x86] spec_ctrl: Always clear SPEC_CTRL MSRs when disabling IBRS (Radomir Vrbovsky) [1586150 1574730]
  - [sound] alsa: hda/realtek - Add headset mode support for Dell laptop (Jaroslav Kysela) [1588946 1528587]
  - [sound] alsa: hda/realtek - Support headset mode for ALC215/ALC285/ALC289 (Jaroslav Kysela) [1593586 1535427]
  - [mm] compaction: release zone irqlock in isolate_freepages_block (Andrea Arcangeli) [1596283 1582793]
  - [mm] compaction: change the timing to check to drop the spinlock (Andrea Arcangeli) [1596283 1582793]
  - [fs] dcache.c: add cond_resched() in shrink_dentry_list() (Aaron Tomlin) [1596184 1584693]
  - [misc] vmware balloon: Treat init like reset (Cathy Avery) [1595601 1540110]
  - [netdrv] qede: Fix ref-cnt usage count (Chad Dupuis) [1594700 1574847]
  - [x86] kvm: fix LAPIC timer drift when guest uses periodic mode ("Dr. David Alan Gilbert") [1594292 1584775]
  - [x86] kvm: remove APIC Timer periodic/oneshot spikes ("Dr. David Alan Gilbert") [1594292 1584775]
  - [netdrv] mlx4_en: Increase number of default RX rings (Erez Alfasi) [1594127 1520295]
  - [netdrv] mlx4_en: Limit the number of RX rings (Erez Alfasi) [1594127 1520295]
  - [netdrv] mlx4_en: Limit the number of TX rings (Erez Alfasi) [1594127 1520295]
  - [fs] ceph: don't set read_ahead_kb to 0 by default (Ilya Dryomov) [1590825 1579539]
  - [scsi] qla2xxx: Remove stale debug value for login_retry flag (Himanshu Madhani) [1588937 1578880]
  - [x86] topology: Update the 'cpu cores' field in /proc/cpuinfo correctly across CPU hotplug operations (Prarit Bhargava) [1588563 1582023]
  - [acpi] osi: Add OEM _OSI strings to disable NVidia RTD3 (Jaroslav Kysela) [1584685 1581391]
  - [hv] vmbus: Fix a rescind issue (Eduardo Otubo) [1582124 1518498]
  - [linux] libata: enable host-wide tags (Ewan Milne) [1581728 1491014]
  - [ata] libata: remove ATA_FLAG_LOWTAG (Ewan Milne) [1581728 1491014]
  - [ata] Add a new flag to destinguish sas controller (Ewan Milne) [1581728 1491014]
  - [ata] libata: make sata_sil24 use fifo tag allocator (Ewan Milne) [1581728 1491014]
  - [ata] libata: move sas ata tag allocation to libata-scsi.c (Ewan Milne) [1581728 1491014]
  - [ata] libata: use blk taging (Ewan Milne) [1581728 1491014]
  - [nvme] rdma: Use mr pool (David Milburn) [1581347 1547273]
  - [nvme] rdma: Check remotely invalidated rkey matches our expected rkey (David Milburn) [1581347 1547273]
  - [nvme] rdma: wait for local invalidation before completing a request (David Milburn) [1581347 1547273]
  - [nvme] rdma: don't complete requests before a send work request has completed (David Milburn) [1581347 1547273]
  - [nvme] rdma: don't suppress send completions (David Milburn) [1581347 1547273]
  - [x86] kvm: Fix loss of pending INIT due to race (Radim Krcmar) [1580467 1569473]
  - [mm] mempolicy: fix use after free when calling get_mempolicy (Augusto Caringi) [1576759 1576755] {CVE-2018-10675}
  - [sound] alsa: seq: Fix racy pool initializations (Jaroslav Kysela) [1550171 1593586 1550169 1535427] {CVE-2018-7566}
  - [crypto] algif_skcipher: Load TX SG list after waiting (Bruno Eduardo de Oliveira Meneguele) [1541870 1541875] {CVE-2017-13215}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.11.1.el7]
changelog:
  - [tcmu] allow userspace to reset ring (Xiubo Li) [1599669 1562587]
  - [tcmu] remove commands_lock (Xiubo Li) [1599669 1562587]
  - [tcmu] move expired command completion to unmap thread (Xiubo Li) [1599669 1562587]
  - [tcmu] add cmd timeout handling wq (Xiubo Li) [1599669 1562587]
  - [tcmu] don't block submitting context for block waits (Xiubo Li) [1599669 1562587]
  - [tcmu] fix double se_cmd completion (Xiubo Li) [1599669 1562587]
  - [tcmu] replace spin lock with mutex (Xiubo Li) [1599669 1562587]
  - [target] add SAM_STAT_BUSY sense reason (Xiubo Li) [1599669 1562587]
  - [target] core: add device action configfs files (Xiubo Li) [1599669 1562587]
  - [target] Avoid mappedlun symlink creation during lun shutdown (Xiubo Li) [1599656 1585081]
  - [spectre] update Spectre v1 mitigation string (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [spectre] fix hiddev nospec issues (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] syscall: clarify clobbered registers in entry code (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [powerpc] add missing barrier_nospec() in __get_user64_nocheck() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [spectre] fix gadgets found by smatch scanner (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] rme9652: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] hdspm: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] asihpi: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] opl3: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] hda: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] seq: oss: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] seq: oss: Fix unbalanced use lock for synth MIDI device (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [net] atm: Fix potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [kernel] time: Protect posix clock array access against speculation (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [kernel] sys.c: fix potential Spectre v1 issue (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [sched] autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[] (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [perf] core: Fix possible Spectre-v1 indexing for ->aux_pages[] (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [sysvipc] sem: mitigate semnum index against spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [alsa] control: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [usbip] vhci_sysfs: fix potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [media] dvb_ca_en50221: prevent using slot_info for Spectre attacs (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [media] dvb_ca_en50221: sanity check slot number from userspace (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [atm] zatm: Fix potential Spectre v1 (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] kvm: Update spectre-v1 mitigation (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] kvm: Add memory barrier on vmcs field lookup (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] perf/msr: Fix possible Spectre-v1 indexing in the MSR driver (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] perf: Fix possible Spectre-v1 indexing for x86_pmu::event_map() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] perf: Fix possible Spectre-v1 indexing for hw_perf_event cache_* (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [net] nl80211: Sanitize array index in parse_txq_params (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] vfs, fdtable: Prevent bounds-check bypass via speculative execution (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] syscall: Sanitize syscall table de-references under speculation (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [powerpc] Use barrier_nospec in copy_from_user() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] nospec: Introduce barrier_nospec for other arches (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] Introduce barrier_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] spectre_v1: Disable compiler optimizations over array_index_mask_nospec() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] Implement array_index_mask_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [documentation] Document array_index_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] nospec: Include <asm/barrier.h> dependency (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] nospec: Allow index argument to have const-qualified type (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] nospec: Kill array_index_nospec_mask_check() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] nospec: Move array_index_nospec() parameter checking into separate macro (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [include] array_index_nospec: Sanitize speculative array de-references (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] get_user: Use pointer masking to limit speculation (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] Introduce __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] usercopy: Replace open coded stac/clac with __uaccess_{begin, end} (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] reorganize SMAP handling in user space accesses (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] uaccess: Tell the compiler that uaccess is unlikely to fault (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}
  - [x86] uaccess: fix sparse errors (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3690}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.11.2.el7]
changelog:
  - [kernel] cpu: hotplug: detect SMT disabled by BIOS (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [documentation] l1tf: Fix typos (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Remove extra newline in vmentry_l1d_flush sysfs file (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Initialize the vmx_l1d_flush_pages' content (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation: l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [documentation] Add section about CPU vulnerabilities (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs, kvm: introduce boot-time control of L1TF mitigations (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Set CPU_SMT_NOT_SUPPORTED early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Expose SMT control init function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Add static key for flush always (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs: Make cpu_show_common() static (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs: Concentrate bug reporting into a separate function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Online siblings when SMT control is turned on (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Use MSR save list for IA32_FLUSH_CMD if required (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Separate the VMX AUTOLOAD guest/host number accounting (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Add find_msr() helper function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Split the VMX MSR LOAD structures to have an host/guest numbers (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 3 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Boot HT siblings at least once, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: fix typo in l1tf mitigation string (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - Revert "x86/apic: Ignore secondary threads if nosmt=force" (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PAE swap entries against L1TF (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread(), part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] CPU: Modify detect_extended_topology() to return result (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: fix build for CONFIG_NUMA_BALANCING=n (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: sync with latest L1TF patches (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_NUMA PTEs and PMDs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [mm] l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Report if too much memory for L1TF workaround (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Limit swap file size to MAX_PA/2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Add sysfs reporting for l1tf (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Make sure the first page is always reserved (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Protect PROT_NONE PTEs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Protect swap entries against L1TF (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Increase 32bit PAE __PHYSICAL_PAGE_MASK (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86]  add support for L1D flush MSR (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.11.3.el7]
changelog:
  - [net] tcp: add tcp_ooo_try_coalesce() helper (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: call tcp_drop() from tcp_data_queue_ofo() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] net: add rb_to_skb() and other rb tree helpers (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: increment sk_drops for dropped rx packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [x86] x86/syscall: Fix regression when using the last syscall (pkey_free) (Lauro Ramos Venancio) [1589033 1589035] {CVE-2018-3693}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.11.4.el7]
changelog:
  - [net] ipv6: fix nospec-related regression in ipv6_addr_prefix() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3693}


author: Frantisek Hrbata <fhrbata@hrbata.com> [3.10.0-862.11.5.el7]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.11.6.el7]
changelog:
  - [kernel] cpu/hotplug: Fix 'online' sysfs entry with 'nosmt' (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.8.1.el7]
changelog:
  - [x86] always enable eager FPU by default on non-AMD processors (Paolo Bonzini) [1589051 1589048] {CVE-2018-3665}
  - [net] nf_reset: also clear nfctinfo bits (Florian Westphal) [1588458 1572983]
  - [x86] bugs: Switch the selection of mitigation from CPU vendor to CPU features (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Add AMD's SPEC_CTRL MSR usage (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Add AMD's variant of SSB_NO (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Fix VM guest SSBD problems (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Eliminate TIF_SSBD checks in IBRS on/off functions (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Disable SSBD update from scheduler if not user settable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Make ssbd_enabled writtable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Remove thread_info check in __wrmsr_on_cpu() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Write per-thread SSBD state to spec_ctrl_pcp (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Add a read-only ssbd_enabled debugfs file (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs/intel: Set proper CPU features and setup RDS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] kvm: vmx: Emulate MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] kvm: svm: Implement VIRT_SPEC_CTRL support for SSBD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Rework spec_ctrl base and mask logic (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Rework SPEC_CTRL update after late microcode loading (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Make sync_all_cpus_ibrs() write spec_ctrl_pcp value (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Unify x86_spec_ctrl_{set_guest, restore_host} (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Rework speculative_store_bypass_update() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Add virtualized speculative store bypass disable support (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] KVM: Rename KVM SPEC_CTRL MSR functions to match upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Handle HT correctly on AMD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Add FEATURE_ZEN (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle SSBD enumeration (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Use synthetic bits for IBRS/IBPB/STIBP (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [documentation] spec_ctrl: Do some minor cleanups (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Make "seccomp" the default mode for Speculative Store Bypass (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] seccomp: Move speculation migitation control to arch code (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [kernel] seccomp: Add filter flag to opt-out of SSB mitigation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [kernel] seccomp: Use PR_SPEC_FORCE_DISABLE (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] prctl: Add force disable speculation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spectre_v2: No mitigation if CPU not affected and no command override (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bug: Add X86_BUG_CPU_MELTDOWN and X86_BUG_SPECTRE_V[12] (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] pti: Rename CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up naming of SPEC_CTRL MSR bits with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up SSBD changes with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.12.1.el7]
changelog:
  - [fs] CIFS: Fix NULL pointer deref on SMB2_tcon() failure (Leif Sahlberg) [1609159 1591092]
  - [net] multicast: do not restore deleted record source filter mode to new one (Hangbin Liu) [1610380 1586321]
  - [net] multicast: remove useless parameter for group add (Hangbin Liu) [1610380 1586321]
  - [net] ipv6/mcast: init as INCLUDE when join SSM INCLUDE group (Hangbin Liu) [1610380 1586321]
  - [net] ipv4/igmp: init group mode as INCLUDE when join source group (Hangbin Liu) [1610380 1586321]
  - [net] ipv6: mcast: fix unsolicited report interval after receiving querys (Hangbin Liu) [1610380 1586321]
  - [net] ipv6: refactor ipv6_dev_mc_inc() (Hangbin Liu) [1610380 1586321]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.13.1.el7]
changelog:
  - [infiniband] ib/ipoib: Fix race condition in neigh creation (Don Dutile) [1616164 1520300]
  - [gpu] qxl: hook monitors_config updates into crtc, not encoder (Gerd Hoffmann) [1614349 1544322]
  - [gpu] qxl: move qxl_send_monitors_config() (Gerd Hoffmann) [1614349 1544322]
  - [gpu] qxl: remove qxl_io_log() (Gerd Hoffmann) [1614349 1544322]
  - [kernel] locking: Introduce smp_mb__after_spinlock() (Steve Best) [1613814 1496574]
  - [scsi] ibmvfc: Avoid unnecessary port relogin (Steve Best) [1613202 1605080]
  - [powerpc] stf-barrier: update (rfi_)enabled_flush_types as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: update debugfs as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: update handle_ssbd() as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: update stf_barrier_enable() as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: add cpu_show_spec_store_bypass() as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: add comment as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: move code from setup_64.c to security.c as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: move code from setup.h to security_features.h as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: update fallback routine as in upstream (Gustavo Duarte) [1612353 1585297]
  - [powerpc] stf-barrier: update entry barrier slot as in upstream (Gustavo Duarte) [1612353 1585297]
  - [nvmet-fc] move tech preview warning to nvmet_fc_register_targetport call (Ewan Milne) [1610381 1608947]
  - [nvme-fc] move tech preview warning to nvme_fc_register_localport call (Ewan Milne) [1610381 1608947]
  - [block] blk-throttle: check stats_cpu before reading it from sysfs (Ming Lei) [1608228 1567748]
  - [powerpc] signals: Discard transaction state from signal frames (Steve Best) [1608227 1586153]
  - [ipc] shm.c: add split function to shm_vm_ops (Desnes Augusto Nunes do Rosario) [1608225 1586152]
  - [scsi] lpfc: Fix port initialization failure (Dick Kennedy) [1605235 1584377]
  - [vmbus] fix the missed signaling in hv_signal_on_read() (Vitaly Kuznetsov) [1605089 1591976]
  - [infiniband] ib/ipoib: Fix for potential no-carrier state (Donald Dutile) [1601935 1548474]
  - [vmwgfx] refuse to hibernate if we have any resources. (v2) (Dave Airlie) [1601516 1595136]
  - [netdrv] sfc: stop the TX queue before pushing new buffers (Xin Long) [1601353 1445576]
  - [lib] rhashtable: Fix rhlist duplicates insertion (Xin Long) [1601009 1559106]
  - [kernel] hrtimer: Allow concurrent hrtimer_start() for self restarting timers (Oleksandr Natalenko) [1600911 1574387]
  - [iommu] amd: Add NULL sanity check for struct irq_2_irte.ir_data (Suravee Suthikulpanit) [1600661 1542697]
  - [hid] wacom: Correct logical maximum Y for 2nd-gen Intuos Pro large (Benjamin Tissoires) [1600660 1591499]
  - [md] avoid NULL dereference to queue pointer (Ming Lei) [1600056 1581845]
  - [scsi] qla2xxx: Fix NULL pointer access for fcport structure (Himanshu Madhani) [1597546 1547714]
  - [scsi] csiostor: Add a soft dep on cxgb4 driver (Arjun Vynipadath) [1597529 1584003]
  - [mm] initialize pages on demand during boot (Masayoshi Mizuma) [1588366 1496330]
  - [mm] split deferred_init_range into initializing and freeing parts (Masayoshi Mizuma) [1588366 1496330]
  - [kernel] cpu/hotplug: Fix 'online' sysfs entry with 'nosmt' (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [net] ipv6: fix nospec-related regression in ipv6_addr_prefix() (Josh Poimboeuf) [1589033 1589035] {CVE-2018-3693}
  - [net] tcp: add tcp_ooo_try_coalesce() helper (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: call tcp_drop() from tcp_data_queue_ofo() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] add rb_to_skb() and other rb tree helpers (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [net] tcp: increment sk_drops for dropped rx packets (Paolo Abeni) [1611368 1611369] {CVE-2018-5390}
  - [x86] x86/syscall: Fix regression when using the last syscall (pkey_free) (Lauro Ramos Venancio) [1589033 1589035] {CVE-2018-3693}
  - [kernel] cpu: hotplug: detect SMT disabled by BIOS (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [documentation] l1tf: Fix typos (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Remove extra newline in vmentry_l1d_flush sysfs file (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Initialize the vmx_l1d_flush_pages' content (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation: l1tf: Unbreak !__HAVE_ARCH_PFN_MODIFY_ALLOWED architectures (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [documentation] Add section about CPU vulnerabilities (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs, kvm: introduce boot-time control of L1TF mitigations (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Set CPU_SMT_NOT_SUPPORTED early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Expose SMT control init function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Add static key for flush always (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs: Make cpu_show_common() static (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs: Concentrate bug reporting into a separate function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Online siblings when SMT control is turned on (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Use MSR save list for IA32_FLUSH_CMD if required (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Separate the VMX AUTOLOAD guest/host number accounting (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Add find_msr() helper function (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: vmx: Split the VMX MSR LOAD structures to have an host/guest numbers (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 3 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu: hotplug: Boot HT siblings at least once, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: fix typo in l1tf mitigation string (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - Revert "x86/apic: Ignore secondary threads if nosmt=force" (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PAE swap entries against L1TF (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT, part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread(), part 2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] CPU: Modify detect_extended_topology() to return result (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: fix build for CONFIG_NUMA_BALANCING=n (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: sync with latest L1TF patches (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_NUMA PTEs and PMDs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [mm] l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Report if too much memory for L1TF workaround (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Limit swap file size to MAX_PA/2 (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Add sysfs reporting for l1tf (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Make sure the first page is always reserved (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Protect PROT_NONE PTEs against speculation (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Protect swap entries against L1TF (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] l1tf: Increase 32bit PAE __PHYSICAL_PAGE_MASK (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86]  add support for L1D flush MSR (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}
  - [x86] kvm: mitigation for L1 cache terminal fault vulnerabilities (Josh Poimboeuf) [1593383 1593384] {CVE-2018-3620}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.14.1.el7]
changelog:
  - [x86] microcode: Allow late microcode loading with SMT disabled (Josh Poimboeuf) [1619622 1614515]
  - [infiniband] core: Fix nospec regression (Josh Poimboeuf) [1619624 1616346]
  - [x86] microcode/amd: Do not load when running on a hypervisor (Vitaly Kuznetsov) [1618390 1607899]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-862.14.2.el7]
changelog:
  - [uio] fix possible circular locking dependency (Xiubo Li) [1608677 1560418]
  - [scsi] tcmu: Don't pass KERN_ERR to pr_err (Xiubo Li) [1608677 1560418]
  - [scsi] tcmu: add module wide block/reset_netlink support (Xiubo Li) [1608677 1560418]
  - [scsi] tcmu: simplify nl interface (Xiubo Li) [1608677 1560418]
  - [scsi] tcmu: track nl commands (Xiubo Li) [1608677 1560418]
  - [scsi] tcmu: delete unused __wait (Xiubo Li) [1608677 1560418]
  - [uio] fix crash after the device is unregistered (Xiubo Li) [1608677 1560418]
  - [uio] change to use the mutex lock instead of the spin lock (Xiubo Li) [1608677 1560418]
  - [uio] Prevent device destruction while fds are open (Xiubo Li) [1608677 1560418]
  - [uio] Reduce return paths from uio_write() (Xiubo Li) [1608677 1560418]
  - [uio] fix incorrect memory leak cleanup (Xiubo Li) [1608677 1560418]
  - [uio] add missing error codes (Xiubo Li) [1608677 1560418]
  - [uio] fix false positive __might_sleep warning splat (Xiubo Li) [1608677 1560418]
  - [uio] Destroy uio_idr on module exit (Xiubo Li) [1608677 1560418]
  - [uio] don't free irq that was not requested (Xiubo Li) [1608677 1560418]
  - [uio] support memory sizes larger than 32 bits (Xiubo Li) [1608677 1560418]
  - [uio] we cannot mmap unaligned page contents (Xiubo Li) [1608677 1560418]
  - [uio] Pass pointers to virt_to_page(), not integers (Xiubo Li) [1608677 1560418]
  - [uio] fix memory leak (Xiubo Li) [1608677 1560418]
  - [uio] Request/free irq separate from dev lifecycle (Xiubo Li) [1608677 1560418]
  - [uio] Simplify uio error path by using devres functions (Xiubo Li) [1608677 1560418]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.14.3.el7]
changelog:
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625980 1625991] {CVE-2018-14634}
  - [fs] exec: account for argv/envp pointers (Yauheni Kaliuta) [1625980 1625991] {CVE-2018-14634}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.14.4.el7]
changelog:
  - [scsi] Revert: lpfc: Fix port initialization failure (Radomir Vrbovsky) [1605235 1584377]
  - [scsi] Revert: qla2xxx: Fix NULL pointer access for fcport structure (Radomir Vrbovsky) [1597546 1547714]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.1.1.el7]
changelog:
  - [x86] kexec/64: Clear control page after PGD init (Waiman Long) [1565700 1540061]
  - [x86] pti: Rework the UEFI data corruption fix (Waiman Long) [1565700 1540061]
  - [powerpc] tm: Flush TM only if CPU has TM feature (David Gibson) [1563773 1544676] {CVE-2018-1091}
  - [gpu] drm/i915/glk: IPC linetime watermark workaround for GLK (Lyude Paul) [1563711 1548651]
  - [x86] apic: Remove the (now) unused disable_IO_APIC() function (Baoquan He) [1563108 1521003]
  - [x86] apic: Fix restoring boot IRQ mode in reboot and kexec/kdump (Baoquan He) [1563108 1521003]
  - [x86] apic: Split disable_IO_APIC() into two functions to fix CONFIG_KEXEC_JUMP=y (Baoquan He) [1563108 1521003]
  - [x86] apic: Split out restore_boot_irq_mode() from disable_IO_APIC() (Baoquan He) [1563108 1521003]
  - [netdrv] i40e: Close client on suspend and restore client MSIx on resume (Stefan Assmann) [1563106 1538847]
  - [fs] nfs: Fix unstable write completion (Scott Mayhew) [1563103 1544647]
  - [x86] kvm: Fix device passthrough when SME is active (Suravee Suthikulpanit) [1563098 1557911]
  - [powerpc] powernv: Support firmware disable of RFI flush (Mauricio Oliveira) [1563096 1553927]
  - [powerpc] pseries: Support firmware disable of RFI flush (Mauricio Oliveira) [1563096 1553927]
  - [powerpc] pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper (Mauricio Oliveira) [1563096 1553927]
  - [nvme] fixup nvme_sysfs_delete() (David Milburn) [1563092 1543716]
  - [x86] smpboot: Fix uncore_pci_remove() indexing bug when hot-removing a physical CPU (Prarit Bhargava) [1563091 1527731]
  - [x86] tsc: Fix erroneous TSC rate on Skylake Xeon (Prarit Bhargava) [1563088 1466058]
  - [x86] tsc: Print tsc_khz, when it differs from cpu_khz (Prarit Bhargava) [1563088 1466058]
  - [x86] tsc: Future-proof native_calibrate_tsc() (Prarit Bhargava) [1563088 1466058]
  - [scsi] csiostor: add support for 32 bit port capabilities (Arjun Vynipadath) [1561906 1526163]
  - [netdrv] cxgb4/cxgbvf: Handle 32-bit fw port capabilities (Arjun Vynipadath) [1561906 1526163]
  - [netdrv] cxgb4vf: define get_fecparam ethtool callback (Arjun Vynipadath) [1561906 1526163]
  - [netdrv] cxgb4: ethtool forward error correction management support (Arjun Vynipadath) [1561906 1526163]
  - [netdrv] cxgb4: core hardware/firmware support for Forward Error Correction on a link (Arjun Vynipadath) [1561906 1526163]
  - [iscsi-target] Fix panic when adding second TCP connection to iSCSI session (Maurizio Lombardi) [1561900 1544670]
  - [crypto] chelsio: Fix src buffer dma length (Arjun Vynipadath) [1561899 1548047]
  - [crypto] chelsio: Move DMA un/mapping to chcr from lld cxgb4 driver (Arjun Vynipadath) [1561899 1548047]
  - [crypto] chelsio: Remove unused parameter (Arjun Vynipadath) [1561899 1548047]
  - [crypto] chelsio: Remove allocation of sg list to implement 2K limit of dsgl header (Arjun Vynipadath) [1561899 1548047]
  - [crypto] chelsio: introduce __skb_put_zero() (Arjun Vynipadath) [1561899 1548047]
  - [crypto] chelsio: make skb_put & friends return void pointers (Arjun Vynipadath) [1561899 1548047]
  - [gpu] drm/i915/cfl: Remove alpha support protection (Rob Clark) [1561897 1464911]
  - [gpu] drm/i915/cnl: Map VBT DDC Pin to BSpec DDC Pin (Rob Clark) [1561897 1464911]
  - [gpu] drm/i915: Add retries for LSPCON detection (Rob Clark) [1561897 1464911]
  - [gpu] drm/i915: Don't give up waiting on INVALID_MODE (Rob Clark) [1561897 1464911]
  - [nvme] pci: Fix EEH failure on ppc (Mauricio Oliveira) [1561894 1558499]
  - [net] netfilter: ebtables: fix erroneous reject of last rule (Florian Westphal) [1552366 1552370] {CVE-2018-1068}
  - [net] netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets (Florian Westphal) [1552366 1552370] {CVE-2018-1068}
  - [net] netfilter: bridge: ebt_among: add more missing match size checks (Florian Westphal) [1552366 1552370] {CVE-2018-1068}
  - [net] netfilter: bridge: ebt_among: add missing match size checks (Florian Westphal) [1552366 1552370] {CVE-2018-1068}
  - [net] ipsec: Fix aborted xfrm policy dump crash (Bruno Eduardo de Oliveira Meneguele) [1517292 1517290] {CVE-2017-16939}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.2.1.el7]
changelog:
  - [md] dm: fix dropped return code from dm_get_bdev_for_ioctl (Mike Snitzer) [1567746 1562962]
  - [crypto] aesni: Add support for 192 & 256 bit keys to AESNI RFC4106 (Bruno Eduardo de Oliveira Meneguele) [1570537 1568167]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.2.2.el7]
changelog:
  - [kernel] perf/hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569878 1569874] {CVE-2018-1000199}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.2.3.el7]
changelog:
  - [x86] kvm: fix icebp instruction handling (Paolo Bonzini) [1566849 1566845] {CVE-2018-1087}
  - [x86] entry/64: Don't use IST entry for #BP stack (Paolo Bonzini) [1567084 1567083] {CVE-2018-8897}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.1.el7]
changelog:
  - [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1573173 1571162]
  - [x86] kvm: fix icebp instruction handling (Paolo Bonzini) [1566849 1566845] {CVE-2018-1087}
  - [x86] entry/64: Don't use IST entry for #BP stack (Paolo Bonzini) [1567084 1567083] {CVE-2018-8897}
  - [kernel] perf/hwbp: Simplify the perf-hwbp code, fix documentation (Eugene Syromiatnikov) [1569878 1569874] {CVE-2018-1000199}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.2.el7]
changelog:
  - [x86] spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] entry: Add missing "$" in IBRS macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [fs] proc: Use CamelCase for SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Rename _RDS to _SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [kernel] seccomp: Enable speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [fs] proc: Provide details on speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] nospec: Allow getting/setting on non-current task (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [uapi] prctl: Add speculation control prctls (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] kvm/vmx: Expose SPEC_CTRL Bit(2) to the guest (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs/amd: Add support to disable RDS on Fam[15, 16, 17]h if requested (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Expose /sys/../spec_store_bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Read SPEC_CTRL MSR during boot and re-use (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Make CPU bugs sticky (Waiman Long) [1566904 1566905] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.3.3.el7]
changelog:
  - [x86] always enable eager FPU by default on non-AMD processors (Paolo Bonzini) [1589051 1589048] {CVE-2018-3665}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.4.1.el7]
changelog:
  - [powerpc] msi: Fix race condition in tearing down MSI interrupts (David Milburn) [1570511 1549680]


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.5.1.el7]
changelog:
  - [netdrv] vmxnet3: use correct flag to indicate LRO feature (Neil Horman) [1567771 1558685]
  - [netdrv] vmxnet3: avoid xmit reset due to a race in vmxnet3 (Neil Horman) [1567771 1558685]
  - [kernel] ib/mlx5: Respect new UMR capabilities (Alaa Hleihel) [1579847 1573661]
  - [infiniband] ib/mlx5: Enable ECN capable bits for UD RoCE v2 QPs (Alaa Hleihel) [1579847 1573661]
  - [scsi] cdrom: do not call check_disk_change() inside cdrom_open() (Maurizio Lombardi) [1579834 1538362]
  - [hid] wacom: Fix reporting of touch toggle (WACOM_HID_WD_MUTE_DEVICE) events (Benjamin Tissoires) [1579192 1551776]
  - [hid] wacom: generic: Recognize WACOM_HID_WD_PEN as a type of pen collection (Benjamin Tissoires) [1579192 1551776]
  - [hid] wacom: generic: Send BTN_STYLUS3 when both barrel switches are set (Benjamin Tissoires) [1579191 1551783]
  - [fs] eventpoll: fix uninitialized variable in epoll_ctl (Paul Moore) [1578734 1553256]
  - [fs] nfs41: do not return ENOMEM on LAYOUTUNAVAILABLE (Scott Mayhew) [1578458 1574002]
  - [net] sock_diag: request _diag module only when the family or proto has been registered (Xin Long) [1578272 1544898]
  - [target] Re-add missing SCF_ACK_KREF assignment in (Mike Christie) [1578048 1561851]
  - [gpu] drm/nouveau: Fix deadlock in nv50_mstm_register_connector() (Lyude Paul) [1577792 1571927]
  - [netdrv] vmxnet3: segCnt can be 1 for LRO packets (Neil Horman) [1577790 1426680]
  - [s390] correct nospec auto detection init order (Hendrik Brueckner) [1577767 1558325]
  - [s390] add sysfs attributes for spectre (Hendrik Brueckner) [1577767 1558325]
  - [s390] report spectre mitigation via syslog (Hendrik Brueckner) [1577767 1558325]
  - [s390] add automatic detection of the spectre defense (Hendrik Brueckner) [1577767 1558325]
  - [s390] move nobp parameter functions to nospec-branch.c (Hendrik Brueckner) [1577767 1558325]
  - [s390] do not bypass BPENTER for interrupt system calls (Hendrik Brueckner) [1577767 1558325]
  - [s390] Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) (Hendrik Brueckner) [1577767 1558325]
  - [s390] introduce execute-trampolines for branches (Hendrik Brueckner) [1577767 1558325]
  - [s390] run user space and KVM guests with modified branch prediction (Hendrik Brueckner) [1577767 1558325]
  - [s390] add optimized array_index_mask_nospec (Hendrik Brueckner) [1577767 1558325]
  - [s390] entry.s: fix spurious zeroing of r0 (Hendrik Brueckner) [1577767 1558325]
  - [s390] scrub registers on kernel entry and KVM exit (Hendrik Brueckner) [1577767 1558325]
  - [s390] align and prepare spectre mitigation for upstream commits (Hendrik Brueckner) [1577767 1558325]
  - [s390] alternative: use a copy of the facility bit mask (Hendrik Brueckner) [1577767 1558325]
  - [gpu] drm/amdgpu: Fix deadlock on runtime suspend (Lyude Paul) [1577760 1563957]
  - [gpu] drm/radeon: Fix deadlock on runtime suspend (Lyude Paul) [1577760 1563957]
  - [gpu] drm/nouveau: Fix deadlock on runtime suspend (Lyude Paul) [1577760 1563957]
  - [gpu] drm: Allow determining if current task is output poll worker (Lyude Paul) [1577760 1563957]
  - [gpu] workqueue: Allow retrieval of current task's work struct (1/5) (Lyude Paul) [1577760 1563957]
  - [md] dm: remove fmode_t argument from .prepare_ioctl hook (Mike Snitzer) [1576508 1562960]
  - [md] dm: hold DM table for duration of ioctl rather than use blkdev_get (Mike Snitzer) [1576508 1562960]
  - [scsi] iscsi: respond to netlink with unicast when appropriate (Chris Leech) [1576293 1330865]
  - [netdrv] i40e: fix incorrect UP-TC mapping (Stefan Assmann) [1574371 1558159]
  - [powerpc] System reset avoid interleaving oops using die synchronisation (Mauricio Oliveira) [1574366 1564126]
  - [powerpc] Do not send system reset request through the oops path (Mauricio Oliveira) [1574366 1564126]
  - [powerpc] crash: Remove the test for cpu_online in the IPI callback (Mauricio Oliveira) [1574366 1564126]
  - [sound] hda: Fix a wrong FIXUP for alc289 on Dell machines (Jaroslav Kysela) [1571581 1548969]
  - [sound] hda: Fix headset mic detection problem for two Dell machines (Jaroslav Kysela) [1571581 1548969]
  - [firmware] fw_cfg: write vmcoreinfo details (Marc-Andre Lureau) [1571369 1533367]
  - [kernel] crash: export paddr_vmcoreinfo_note() (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: add DMA register (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: add a public uapi header (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: handle fw_cfg_read_blob() error (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: remove inline from fw_cfg_read_blob() (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: fix sparse warnings around FW_CFG_FILE_DIR read (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: fix sparse warning reading FW_CFG_ID (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: fix sparse warnings with fw_cfg_file (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] fw_cfg: fix sparse warnings in fw_cfg_sel_endianness() (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] revert "fw_cfg: add DMA register" (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] revert "fw_cfg: do DMA read operation" (Marc-Andre Lureau) [1571369 1533367]
  - [firmware] revert "fw_cfg: write vmcoreinfo details" (Marc-Andre Lureau) [1571369 1533367]
  - [infiniband] mlx5: Set the default active rate and width to QDR and 4X (Honggang Li) [1570536 1554535]
  - [x86] spec_ctrl: disable IBRS in idle, part 2 (Josh Poimboeuf) [1570532 1558668]
  - [x86] platform/uv: Fix critical UV MMR address error (Frank Ramsay) [1570520 1562945]
  - [powerpc] pseries: Restore default security feature flags on setup (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] Move default security feature flags (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] pseries: Fix clearing of security feature flags (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] 64s: Wire up cpu_show_spectre_v2() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] 64s: Wire up cpu_show_spectre_v1() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] pseries: Use the security flags in pseries_setup_rfi_flush() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] powernv: Use the security flags in pnv_setup_rfi_flush() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] 64s: Enhance the information in cpu_show_meltdown() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] 64s: Move cpu_show_meltdown() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] powernv: Set or clear security feature flags (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] pseries: Set or clear security feature flags (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] Add security feature flags for Spectre/Meltdown (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] pseries: Add new H_GET_CPU_CHARACTERISTICS flags (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] lib: seq: Add seq_buf_printf() (Mauricio Oliveira) [1570518 1561787]
  - [powerpc] rfi-flush: Call setup_rfi_flush() after LPM migration (Mauricio Oliveira) [1570509 1561785]
  - [powerpc] rfi-flush: Differentiate enabled and patched flush types (Mauricio Oliveira) [1570509 1561785]
  - [powerpc] rfi-flush: Always enable fallback flush on pseries (Mauricio Oliveira) [1570509 1561785]
  - [powerpc] rfi-flush: Make it possible to call setup_rfi_flush() again (Mauricio Oliveira) [1570509 1561785]
  - [powerpc] rfi-flush: Move the logic to avoid a redo into the debugfs code (Mauricio Oliveira) [1570509 1561785]
  - [fs] vfs: Remove incorrect debugging WARN in prepend_path (Frank Sorenson) [1568322 1481732]
  - [fs] xfs: fix transaction allocation deadlock in IO path (Eric Sandeen) [1568320 1551111]
  - [md] support to split big bio (Ming Lei) [1568070 1557434]
  - [block] introduce bio_split2() and bio_pair2_release() (Ming Lei) [1568070 1557434]
  - [netdrv] qed: Free reserved MR tid (Harish Patil) [1568069 1554217]
  - [netdrv] qed: Free RoCE ILT Memory on rmmod qedr (Harish Patil) [1568069 1554217]
  - [net] sctp: use right member as the param of list_for_each_entry (Xin Long) [1565983 1483445]
  - [net] sctp: reset owner sk for data chunks on out queues when migrating a sock (Xin Long) [1565983 1483445]
  - [net] xfrm: policy: check policy direction value (Bruno Eduardo de Oliveira Meneguele) [1479419 1479421] {CVE-2017-11600}
  - [x86] spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] entry: Add missing "$" in IBRS macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [fs] proc: Use CamelCase for SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Rename _RDS to _SSBD (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [kernel] seccomp: Enable speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [fs] proc: Provide details on speculation flaw mitigations (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] nospec: Allow getting/setting on non-current task (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [uapi] prctl: Add speculation control prctls (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] kvm/vmx: Expose SPEC_CTRL Bit(2) to the guest (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs/amd: Add support to disable RDS on Fam[15, 16, 17]h if requested (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Expose /sys/../spec_store_bypass (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] bugs: Read SPEC_CTRL MSR during boot and re-use (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566904 1566905] {CVE-2018-3639}
  - [x86] cpufeatures: Make CPU bugs sticky (Waiman Long) [1566904 1566905] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.6.1.el7]
changelog:
  - [x86] microcode: Load microcode on all cpus (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Fix CPU synchronization routine (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Attempt late loading only when new microcode is present (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Synchronize late microcode loading (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Request microcode on the BSP (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Do not upload microcode if CPUs are offline (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/intel: Writeback and invalidate caches before updating microcode (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/intel: Check microcode revision before updating sibling threads (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Get rid of struct apply_microcode_ctx (Prarit Bhargava) [1578047 1568249]
  - [x86] cpu: Add a microcode loader callback (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode: Propagate return value from updating functions (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/amd: Change load_microcode_amd()'s param to bool to fix preemptibility bug (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/intel: Add a helper which gives the microcode revision (Prarit Bhargava) [1578047 1568249]
  - [x86] cpu: Add native CPUID variants returning a single datum (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/amd: Move private inlines to .c and mark local functions static (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/intel: Simplify generic_load_microcode() (Prarit Bhargava) [1578047 1568249]
  - [x86] microcode/intel: Do not issue microcode updates messages on each CPU (Prarit Bhargava) [1578047 1568249]
  - [kernel] pidns: Don't have unshare(CLONE_NEWPID) imply CLONE_THREAD (Oleg Nesterov) [1578997 1577745]
  - [powerpc] 64s: Add support for a store forwarding barrier at kernel entry/exit (Mauricio Oliveira) [1581045 1581036] {CVE-2018-3639}
  - [powerpc] 64s: Move the data access exception out-of-line (Mauricio Oliveira) [1581045 1581036] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.6.2.el7]
changelog:
  - [x86] spec_ctrl: Eliminate TIF_SSBD checks in IBRS on/off functions (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Disable SSBD update from scheduler if not user settable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Make ssbd_enabled writtable (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Remove thread_info check in __wrmsr_on_cpu() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Write per-thread SSBD state to spec_ctrl_pcp (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Add a read-only ssbd_enabled debugfs file (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs/intel: Set proper CPU features and setup RDS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] kvm: vmx: Emulate MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] kvm: svm: Implement VIRT_SPEC_CTRL support for SSBD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Rework spec_ctrl base and mask logic (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Rework SPEC_CTRL update after late microcode loading (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Make sync_all_cpus_ibrs() write spec_ctrl_pcp value (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Unify x86_spec_ctrl_{set_guest, restore_host} (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Rework speculative_store_bypass_update() (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Add virtualized speculative store bypass disable support (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] KVM: Rename KVM SPEC_CTRL MSR functions to match upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Handle HT correctly on AMD (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Add FEATURE_ZEN (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle SSBD enumeration (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Use synthetic bits for IBRS/IBPB/STIBP (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [documentation] spec_ctrl: Do some minor cleanups (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] speculation: Make "seccomp" the default mode for Speculative Store Bypass (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] seccomp: Move speculation migitation control to arch code (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [kernel] seccomp: Add filter flag to opt-out of SSB mitigation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [kernel] seccomp: Use PR_SPEC_FORCE_DISABLE (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] prctl: Add force disable speculation (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spectre_v2: No mitigation if CPU not affected and no command override (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bug: Add X86_BUG_CPU_MELTDOWN and X86_BUG_SPECTRE_V[12] (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] pti: Rename CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up naming of SPEC_CTRL MSR bits with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up SSBD changes with upstream (Waiman Long) [1584323 1584569] {CVE-2018-3639}


author: Rado Vrbovsky <rvrbovsk@redhat.com> [3.10.0-862.6.3.el7]
changelog:
  - [x86] always enable eager FPU by default on non-AMD processors (Paolo Bonzini) [1589051 1589048] {CVE-2018-3665}
  - [x86] bugs: Switch the selection of mitigation from CPU vendor to CPU features (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Add AMD's SPEC_CTRL MSR usage (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] bugs: Add AMD's variant of SSB_NO (Waiman Long) [1584323 1584569] {CVE-2018-3639}
  - [x86] spec_ctrl: Fix VM guest SSBD problems (Waiman Long) [1584323 1584569] {CVE-2018-3639}


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-950.el7]
changelog:
  - [kernel] posix-timer: Properly check sigevent->sigev_notify (Phil Auld) [1613711] {CVE-2017-18344}
  - [sound] alsa: rawmidi: Change resized buffers atomically (Denys Vlasenko) [1593087] {CVE-2018-10902}
  - [fs] Fix up non-directory creation in SGID directories (Miklos Szeredi) [1600953] {CVE-2018-13405}
  - [fs] pnfs: Layoutreturn must free the layout after the layout-private data (Scott Mayhew) [1625517]
  - [fs] sunrpc: Ensure we always close the socket after a connection shuts down (Steve Dickson) [1614950]
  - [fs] xfs: remove filestream item xfs_inode reference (Brian Foster) [1518623]
  - [mm] set IORESOURCE_SYSTEM_RAM to system RAM to fix memory hot-add failure (Larry Woodman) [1628349]
  - [firmware] efivars: Protect DataSize and Data in efivar_entry.var (Lenny Szubowicz) [1597868]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-951.el7]
changelog:
  - [fs] fanotify: fix logic of events on child (Miklos Szeredi) [1597738]
  - [fs] cifs: add a check for session expiry (Leif Sahlberg) [1626358]
  - [fs] xfs: completely disable per-inode DAX behavior (Eric Sandeen) [1623150]
  - [fs] fs: get_rock_ridge_filename(): handle malformed NM entries (Bill O'Donnell) [1340778] {CVE-2016-4913}
  - [md] fix 'allow faster resync only on non-rotational media' underneath dm (Nigel Croxon) [1561162]
  - [md] Revert "allow faster resync only on non-rotational media" (Nigel Croxon) [1561162]
  - [mm] madvise: fix madvise() infinite loop under special circumstances (Rafael Aquini) [1552982] {CVE-2017-18208}
  - [infiniband] srpt: Support HCAs with more than two ports (Don Dutile) [1616192]
  - [infiniband] overflow.h: Add allocation size calculation helpers (Don Dutile) [1616192]
  - [net] ip_tunnel: clean the GSO bits properly (Flavio Leitner) [1607907]
  - [kernel] revert cpuset: fix a warning when clearing configured masks in old hierarchy (Aristeu Rozanski) [1626943]
  - [s390] sclp: Change SCLP console default buffer-full behavior (Hendrik Brueckner) [1625350]
  - [x86] kvm: Take out __exit annotation in vmx_exit() (Waiman Long) [1626560]
  - [x86] mark coffeelake-s 8+2 as supported (David Arcari) [1575457]
  - [x86] kvm: vmx: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1619602]
  - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1619602]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-952.el7]
changelog:
  - [netdrv] mlx5e: IPoIB, Use priv stats in completion rx flow (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: IPoIB, Add ndo stats support for IPoIB child devices (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: IPoIB, Add ndo stats support for IPoIB netdevices (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: IPoIB, Initialize max_opened_tc in mlx5i_init flow (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: Present SW stats when state is not opened (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: Avoid reset netdev stats on configuration changes (Alaa Hleihel) [1618609]
  - [netdrv] mlx5e: Use bool as return type for mlx5e_xdp_handle (Alaa Hleihel) [1618609]
  - [netdrv] net: aquantia: memory corruption on jumbo frames (Igor Russkikh) [1628238]
  - [kernel] revert "platform/uv: Add adjustable set memory block size function" (Baoquan He) [1625143]
  - [x86] revert "mm: probe memory block size for generic x86 64bit" (Baoquan He) [1625143]
  - [x86] revert "mm: Use 2GB memory block size on large-memory x86-64 systems" (Baoquan He) [1625143]
  - [x86] revert "mm: Streamline and restore probe_memory_block_size()" (Baoquan He) [1625143]
  - [x86] revert "mm/memory_hotplug: determine block size based on the end of boot memory" (Baoquan He) [1625143]
  - [mm] revert "memory_hotplug: do not fail offlining too early" (Baoquan He) [1625143]
  - [mm] revert "memory_hotplug: remove timeout from __offline_memory" (Baoquan He) [1625143]
  - [kernel] revert "x86/platform/uv: Add adjustable set memory block size function" (Baoquan He) [1625143]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-953.el7]
changelog:
  - [cdrom] information leak in cdrom_ioctl_media_changed() (Sanskriti Sharma) [1578207] {CVE-2018-10940}
  - [mm] mlock: remove lru_add_drain_all() (Oleksandr Natalenko) [1624765]
  - [block] blk-mq: fix race between updating nr_hw_queues and switching io sched (Ming Lei) [1619988]
  - [block] blk-mq: avoid to map CPU into stale hw queue (Ming Lei) [1619988]
  - [block] blk-mq: fix sysfs inflight counter (Ming Lei) [1548261]
  - [block] blk-mq: count allocated but not started requests in iostats inflight (Ming Lei) [1548261]
  - [block] fix a crash caused by wrong API (Ming Lei) [1548261]
  - [block] blk-mq: enable checking two part inflight counts at the same time (Ming Lei) [1548261]
  - [block] blk-mq: provide internal in-flight variant (Ming Lei) [1548261]
  - [block] make part_in_flight() take an array of two ints (Ming Lei) [1548261]
  - [block] pass in queue to inflight accounting (Ming Lei) [1548261]
  - [x86] Mark Intel Cascade Lake supported (Steve Best) [1584343]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-954.el7]
changelog:
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625991] {CVE-2018-14634}
  - [fs] exec: account for argv/envp pointers (Yauheni Kaliuta) [1625991] {CVE-2018-14634}
  - [kernel] revert "sched/topology: Introduce NUMA identity node sched domain" (Gustavo Duarte) [1620031]
  - [powerpc] revert "powernv: Add a virtual irqchip for opal events" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv: Reorder OPAL subsystem initialisation" (Gustavo Duarte) [1617966]
  - [char] revert "ipmi/powernv: Convert to irq event interface" (Gustavo Duarte) [1617966]
  - [tty] revert "hvc: Convert to using interrupts instead of opal events" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv/eeh: Update the EEH code to use the opal irq domain" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv/opal: Convert opal message events to opal irq domain" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv/elog: Convert elog to opal irq domain" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv/opal-dump: Convert to irq domain" (Gustavo Duarte) [1617966]
  - [powerpc] revert "opal: Remove events notifier" (Gustavo Duarte) [1617966]
  - [powerpc] revert "powernv: Increase opal-irqchip initcall priority" (Gustavo Duarte) [1617966]
  - [powerpc] revert "opal-irqchip: Fix double endian conversion" (Gustavo Duarte) [1617966]
  - [powerpc] revert "opal-irqchip: Fix deadlock introduced by "Fix double endian conversion"" (Gustavo Duarte) [1617966]
  - [sound] alsa: hda/realtek - two more lenovo models need fixup of MIC_LOCATION (Jaroslav Kysela) [1611958]
  - [sound] alsa: hda/realtek - Fix the problem of two front mics on more machines (Jaroslav Kysela) [1611958]
  - [sound] alsa: hda/realtek - Enable mic-mute hotkey for several Lenovo AIOs (Jaroslav Kysela) [1611958]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-955.el7]
changelog:
  - [netdrv] net/mlx5e: IPoIB, Set the netdevice sw mtu in ipoib enhanced flow (Alaa Hleihel) [1633652]
  - [netdrv] net/mlx5e: Fix traffic between VF and representor (Alaa Hleihel) [1633652]
  - [mm] vmscan: do not loop on too_many_isolated for ever (Waiman Long) [1632050]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-956.el7]
changelog:
  - [block] blk-mq: fix hctx debugfs entry related race between update hw queues and cpu hotplug (Ming Lei) [1619988]
  - [nvme] nvme-pci: unquiesce dead controller queues (Ming Lei) [1632424]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-957.el7]
changelog:
  - [mm] mlock: avoid increase mm->locked_vm on mlock() when already mlock2(, MLOCK_ONFAULT) (Rafael Aquini) [1633059]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.1.1.el7]
changelog:
  - [x86] boot: Fix kexec booting failure in the SEV bit detection code (Kairui Song) [1644990 1628828]
  - [net] 8021q: create device with all possible features in wanted_features (Davide Caratti) [1644675 1640645]
  - [mm] memcontrol: fix high scheduling latency source in mem_cgroup_reparent_charges (Andrea Arcangeli) [1644673 1632898]
  - [kernel] cpuset: use trialcs->mems_allowed as a temp variable (Aristeu Rozanski) [1644236 1613248]
  - [kernel] cpuset: fix a warning when clearing configured masks in old hierarchy (Aristeu Rozanski) [1644236 1613248]
  - [kernel] cpuset: initialize effective masks when clone_children is enabled (Aristeu Rozanski) [1644236 1613248]
  - [x86] efi: Only load initrd above 4g on second try (Lenny Szubowicz) [1643359 1608955]
  - [x86] efi: Support initrd loaded above 4G (Lenny Szubowicz) [1643359 1608955]
  - [x86] efi: Generalize handle_ramdisks() and rename to handle_cmdline_files() (Lenny Szubowicz) [1643359 1608955]
  - [kernel] sched/fair: Fix throttle_list starvation with low CFS quota (Phil Auld) [1640675 1601153]
  - [target] scsi: iscsi: Use bin2hex instead of a re-implementation (Maurizio Lombardi) [1634711 1627034] {CVE-2018-14633}
  - [target] scsi: iscsi: Use hex2bin instead of a re-implementation (Maurizio Lombardi) [1634711 1627034] {CVE-2018-14633}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.1.2.el7]
changelog:
  - [net] rtnetlink: give a user socket to get_target_net() (Jiri Benc) [1639635 1630694] {CVE-2018-14646}
  - [net] Add variants of capable for use on on sockets (Jiri Benc) [1639635 1630694] {CVE-2018-14646}


author: Jianchao Wang <jianchao.w.wang@oracle.com> [3.10.0-957.1.3.0.3.el7.OL7]
changelog:
  - [x86/apic/x2apic] avoid allocate multiple irq vectors for a single interrupt on multiple
    cpu, otherwise irq vectors would be used up when there are only 2 cpu online per node.
    [orabug28691156]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.2.1.el7]
changelog:
  - [md] Simplify ternary operations (Xiao Ni) [1655046 1627563]
  - [x86] Mark Intel Cascade Lake supported (Steve Best) [1650213 1639980]
  - [net] rtnetlink: give a user socket to get_target_net() (Jiri Benc) [1639635 1630694] {CVE-2018-14646}
  - [net] Add variants of capable for use on on sockets (Jiri Benc) [1639635 1630694] {CVE-2018-14646}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.3.1.el7]
changelog:
  - [mm] userfaultfd: allow get_mempolicy(MPOL_F_NODE|MPOL_F_ADDR) to trigger userfaults (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: shmem: uffdio_copy: set the page dirty if VM_WRITE is not set (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: shmem: add i_size checks (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd: disable irqs when taking the waitqueue lock (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd.c: remove redundant pointer uwq (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd: remove uffd flags from vma->vm_flags if UFFD_EVENT_FORK fails (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd: hugetlbfs: fix userfaultfd_huge_must_wait() pte access (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [mm] userfaultfd: prevent non-cooperative events vs mcopy_atomic races (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] userfaultfd: convert to use anon_inode_getfd() (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [fs] mm, userfaultfd, thp: avoid waiting when PMD under THP migration (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}
  - [net] packet: fix a race in packet_bind() and packet_notifier() (Andrea Claudi) [1643680 1643681] {CVE-2018-18559}
  - [x86] kvm: x86: ensure all MSRs can always be KVM_GET/SET_MSR'd (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: #GP when guest attempts to write MCi_STATUS register w/o 0 (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/hyper-v: inject #GP only when invalid SINTx vector is unmasked (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/hyper-v: remove stale entries from vec_bitmap/auto_eoi_bitmap on vector change (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: hyperv: avoid livelock in oneshot SynIC timers (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: hyperv: add KVM_CAP_HYPERV_SYNIC2 (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: Add kvm_vcpu_get_idx to get vcpu index in kvm->vcpus (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: fix NULL deref in vcpu_scan_ioapic (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: use delivery to self in hyperv synic (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: x86: hyperv: make function static to avoid compiling warning (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm: hyper-v: do not do hypercall userspace exits if SynIC is disabled (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V VMBus hypercall userspace exit (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Reject Hyper-V hypercall continuation (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V SynIC timers tracepoints (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V SynIC tracepoints (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Update SynIC timers on guest entry only (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Skip SynIC vector check for QEMU side (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V fix SynIC timer disabling condition (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Reorg stimer_expiration() to better control timer restart (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V unify stimer_start() and stimer_restart() (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Drop stimer_stop() function (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V timers fix incorrect logical operation (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Remove Hyper-V SynIC timer stopping (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V SynIC timers (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V SynIC message slot pending clearing at SINT ack (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Added Hyper-V vcpu_to_hv_vcpu()/hv_vcpu_to_vcpu() helpers (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Rearrange func's declarations inside Hyper-V header (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V kvm exit (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: Hyper-V synthetic interrupt controller (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/x86: split ioapic-handled and EOI exit bitmaps (Vitaly Kuznetsov) [1647097 1631439]
  - [x86] kvm/irqchip: kvm_arch_irq_routing_update renaming split (Vitaly Kuznetsov) [1647097 1631439]
  - [pinctrl] cannonlake: Fix HOSTSW_OWN register offset of H variant (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [pinctrl] cannonlake: Fix gpio base for GPP-E (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [pinctrl] cannonlake: Fix community ordering for H variant (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [pinctrl] intel: Do pin translation in other GPIO operations as well (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [pinctrl] intel: Implement intel_gpio_get_direction callback (Benjamin Tissoires) [1647720 1647717 1609926 1544041]
  - [platform] x86: dell-smbios-wmi: Correct a memory leak (Jarod Wilson) [1647706 1640399]
  - [scsi] qedi: Initialize the stats mutex lock (Chad Dupuis) [1646870 1633638]
  - [s390] facilites: use stfle_fac_list array size for MAX_FACILITY_BIT (Hendrik Brueckner) [1646868 1628088]
  - [netdrv] qed: Add missing device config for RoCE EDPM in UFP mode (Chad Dupuis) [1646866 1631593]
  - [netdrv] qed: Do not add VLAN 0 tag to untagged frames in multi-function mode (Chad Dupuis) [1646866 1631593]
  - [netdrv] qed: Fix populating the invalid stag value in multi function mode (Chad Dupuis) [1646866 1631593]
  - [netdrv] qed: Fix link flap issue due to mismatching EEE capabilities (Chad Dupuis) [1645150 1636398]
  - [netdrv] qed: Fix shmem structure inconsistency between driver and the mfw (Chad Dupuis) [1645149 1634156]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.4.1.el7]
changelog:
  - [net] macsec: let the administrator set UP state even if lowerdev is down (Sabrina Dubroca) [1658970 1626004]
  - [net] macsec: update operstate when lower device changes (Sabrina Dubroca) [1658970 1626004]
  - [fs] nfsv4.x: fix lock recovery during delegation recall (Steve Dickson) [1657840 1634086]
  - [fs] cifs: Fix autonegotiate security settings mismatch (Leif Sahlberg) [1657841 1650148]
  - [md] raid1: panic because of using freed memory (Xiao Ni) [1656500 1632575]
  - [pci] Match Root Port's MPS to endpoint's MPSS as necessary (Myron Stowe) [1656395 1524000]
  - [pci] Skip MPS logic for Virtual Functions (VFs) (Myron Stowe) [1656395 1524000]
  - [x86] kvm: vmx: re-add ple_gap module parameter (Gary Hook) [1656393 1652933]
  - [iommu] vt-d: Fix iotlb psi missing for mappings (Peter Xu) [1653592 1623856]
  - [iommu] vt-d: Introduce __mapping_notify_one() (Peter Xu) [1653592 1623856]
  - [scsi] libfc: retry PRLI if we cannot analyse the payload (Chris Leech) [1655045 1631130]
  - [scsi] libfc: Do not drop down to FLOGI for fc_rport_login() (Chris Leech) [1655044 1625721]
  - [scsi] libfc: Do not login if the port is already started (Chris Leech) [1655044 1625721]
  - [scsi] libfc: don't advance state machine for incoming FLOGI (Chris Leech) [1655044 1625721]
  - [gpu] drm/i915: Add short HPD IRQ storm detection for non-MST systems (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Clarify flow for disabling IRQs on storms (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Fix threshold check in intel_hpd_irq_storm_detect() (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Fix NULL deref when re-enabling HPD IRQs on systems with MST (Lyude Paul) [1654733 1608704]
  - [gpu] drm/i915: Fix possible race in intel_dp_add_mst_connector() (Lyude Paul) [1654733 1608704]
  - [iommu] amd: Clear memory encryption mask from physical address (Gary Hook) [1649025 1643293]
  - [security] Make [un]register_lsm_notifier() null ops if !selinux_enabled (Don Dutile) [1648811 1621072]
  - [netdrv] bonding/802.3ad: fix link_failure_count tracking (Jarod Wilson) [1648294 1641660]
  - [block] nvme: do not require GENERIC_HARDIRQ interfaces on s390 (Hendrik Brueckner) [1648239 1637637]
  - [nvme] nvme-pci: add a memory barrier to nvme_dbbuf_update_and_check_event (David Milburn) [1648240 1630481]
  - [x86] kprobes: Use 5-byte NOP when the code might be modified by ftrace (Josh Poimboeuf) [1647816 1577050]
  - [fs] userfaultfd: check VM_MAYWRITE was set after verifying the uffd is registered (Andrea Arcangeli) [1640518 1640519] {CVE-2018-18397}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.5.1.el7]
changelog:
  - [fs] revert "[fs] sunrpc: Ensure we always close the socket after a connection shuts down" (Dave Wysochanski) [1660784 1657399]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.7.1.el7]
changelog:
  - [scsi] lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt is invalid (Ewan Milne) [1664067 1657981]
  - [scsi] qla2xxx: Delete session for nport id change (Himanshu Madhani) [1663508 1628301]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.8.1.el7]
changelog:
  - [tty] add rwsem to close race between copy_from_read_buf calls and reset_buffer_flags (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Fix stall at n_tty_receive_char_special() (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] audit: Fix audit source (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Fix auditing support for cannonical mode (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Fix 4096-byte canonical reads (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Remove read_cnt (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Don't wrap input buffer indices at buffer size (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Get read_cnt through accessor (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] Deprecate ldisc .chars_in_buffer() method (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Split n_tty_chars_in_buffer() for reader-only interface (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Line copy to user buffer in canonical mode (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] n_tty: Factor canonical mode copy from n_tty_read() (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] Make ldisc input flow control concurrency-friendly (Christoph von Recklinghausen) [1660815 1649343]
  - [tty] Simplify tty buffer/ldisc interface with helper function (Christoph von Recklinghausen) [1660815 1649343]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.9.1.el7]
changelog:
  - [input] psmouse: fix button reporting for basic protocols (Benjamin Tissoires) [1662848 1658669]
  - [input] psmouse: add support for 2nd wheel on A4Tech Dual-Scroll wheel mice (Benjamin Tissoires) [1662848 1658669]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.10.1.el7]
changelog:
  - [fs] revert "[fs] nfs: Don't write back further requests if there is a pending write error" (Benjamin Coddington) [1672510 1656674]
  - [fs] cifs: connect to servername instead of IP for IPC$ share (Leif Sahlberg) [1672448 1647844]
  - [acpi] nfit: Fix command-supported detection (Charles Rose) [1671743 1665811]
  - [acpi] nfit: Block function zero DSMs (Charles Rose) [1671743 1665811]
  - [x86] efi-bgrt: Replace early_memremap() with memremap() (Lenny Szubowicz) [1671745 1481667]
  - [x86] efi-bgrt: Replace ioremap() with early_memremap() (Lenny Szubowicz) [1671745 1481667]
  - [scsi] libiscsi: Allow sd_shutdown on bad transport (Chris Leech) [1670680 1630979]
  - [block] blk-mq: punt failed direct issue to dispatch list (Ming Lei) [1670511 1656654]
  - [block] blk-mq: fix corruption with direct issue (Ming Lei) [1670511 1656654]
  - [powerpc] rtas: Fix a potential race between CPU-Offline & Migration (Steve Best) [1669044 1650249]
  - [powerpc] pseries: Disable CPU hotplug across migrations (Steve Best) [1669044 1650249]
  - [md] Add split counter for raid1 write request in the right place (Xiao Ni) [1668208 1659951]
  - [lib] string_helpers.c: fix infinite loop in string_get_size() (Ewan Milne) [1667989 1660565]
  - [kernel] stop_machine: Atomically queue and wake stopper threads (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine: Disable preemption after queueing stopper threads (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine: Disable preemption when waking two stopper threads (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine, sched: Fix migrate_swap() vs. active_balance() deadlock (Phil Auld) [1667328 1557061]
  - [kernel] stop_machine: Make cpu_stop_queue_work() and stop_one_cpu_nowait() return bool (Phil Auld) [1667328 1557061]
  - [fs] proc: restrict kernel stack dumps to root (Joe Lawrence) [1642401 1638194] {CVE-2018-17972}
  - [fs] proc: use "unsigned int" for /proc/*/stack (Joe Lawrence) [1642401 1638194] {CVE-2018-17972}
  - [fs] libceph: fall back to sendmsg for slab pages (Ilya Dryomov) [1665814 1647460]
  - [scsi] csiostor: remove flush_scheduled_work() (Arjun Vynipadath) [1665370 1660882]
  - [pci] shpchp: Separate existence of SHPC and permission to use it (Myron Stowe) [1663241 1633873]
  - [pci] shpchp: Manage SHPC unconditionally on non-ACPI systems (Myron Stowe) [1663241 1633873]
  - [pci] shpchp: Fix AMD POGO identification (Myron Stowe) [1663241 1633873]
  - [mm] memcontrol: factor out reclaim iterator loading and updating (Aristeu Rozanski) [1663114 1595932]
  - [net] xfrm: policy: init locks early (Herbert Xu) [1660887 1641866]
  - [kernel] mm: clear __GFP_FS when PF_MEMALLOC_NOIO is set (Rafael Aquini) [1660392 1657714]
  - [nvme] flush namespace scanning work just before removing namespaces (Ewan Milne) [1659937 1622487]
  - [fs] fuse: don't need GETATTR after every READ (Miklos Szeredi) [1657921 1648781]
  - [fs] fuse: don't invalidate attrs when not using atime (Miklos Szeredi) [1657921 1648781]
  - [net] Set sk_prot_creator when cloning sockets to the right proto (Andrea Claudi) [1657351 1657352] {CVE-2018-9568}
  - [kernel] bpf: 32-bit RSH verification must truncate input before the ALU op (Jiri Olsa) [1641387 1641388] {CVE-2018-18445}


author: John Mcwalters <john.mcwalters@oracle.com> [3.10.0-957.10.1.0.1.el7.OL7]
changelog:
  - [xen/balloon] Support xend-based toolstack (orabug 28663970)
  - [x86/apic/x2apic] avoid allocate multiple irq vectors for a single interrupt on multiple
    cpu, otherwise irq vectors would be used up when there are only 2 cpu online per node.
   [orabug28691156]
  - [bonding] avoid repeated display of same link status change. [orabug 28109857]
  - [ipc] ipc/sem.c: bugfix for semctl(,,GETZCNT) (Manfred Spraul) [orabug 22552377]
  - Oracle Linux certificates (Alexey Petrenko)
  - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)
  - Update x509.genkey [bug 24817676]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.11.1.el7]
changelog:
  - [net] netfilter: nf_nat: skip nat clash resolution for same-origin entries (Florian Westphal) [1686766 1648965]
  - [net] netfilter: nf_conntrack: resolve clash for matching conntracks (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: skip clash resolution if nat is in place (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: introduce clash resolution on insertion race (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: fix race between confirmation and flush (Florian Westphal) [1686766 1648965]
  - [net] netfilter: conntrack: introduce nf_ct_acct_update() (Florian Westphal) [1686766 1648965]
  - [netdrv] hv_netvsc: Fix a network regression after ifdown/ifup (Mohammed Gamal) [1679997 1661632]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.12.1.el7]
changelog:
  - [kernel] locking/rwsem: Fix (possible) missed wakeup (Waiman Long) [1690323 1547078]
  - [kernel] futex: Fix (possible) missed wakeup (Waiman Long) [1690323 1547078]
  - [kernel] futex: Use smp_store_release() in mark_wake_futex() (Waiman Long) [1690323 1547078]
  - [kernel] sched/wake_q: Fix wakeup ordering for wake_q (Waiman Long) [1690323 1547078]
  - [kernel] sched/wake_q: Document wake_q_add() (Waiman Long) [1690323 1547078]
  - [scsi] mpt3sas: As per MPI-spec, use combined reply queue for SAS3.5 controllers when HBA supports more than 16 MSI-x vectors (Tomas Henzl) [1689379 1649288]
  - [x86] cpu: avoid crash in get_cpu_cache_id() (David Arcari) [1689120 1626279]
  - [net] igmp: Allow user-space configuration of igmp unsolicited report interval (Hangbin Liu) [1686771 1663941]
  - [net] igmp: Don't flush routing cache when force_igmp_version is modified (Hangbin Liu) [1686771 1663941]
  - [net] igmp: fix incorrect unsolicit report count after link down and up (Hangbin Liu) [1688225 1623359]
  - [net] igmp: fix incorrect unsolicit report count when join group (Hangbin Liu) [1688225 1623359]
  - [net] igmp: make function __ip_mc_inc_group() static (Hangbin Liu) [1688225 1623359]
  - [net] igmp: Reduce Unsolicited report interval to 1s when using IGMPv3 (Hangbin Liu) [1688225 1623359]
  - [netdrv] cxgb4: Mask out interrupts that are not enabled (Arjun Vynipadath) [1687487 1678729]
  - [acpi] apci / watchdog: enable acpi_watchdog_uses_rtc (David Arcari) [1683078 1663637]
  - [watchdog] simplify getting .drvdata (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Prefer iTCO_wdt always when WDAT table uses RTC SRAM (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Prefer iTCO_wdt on Lenovo Z50-70 (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: properly initialize resources (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Fix init failure with overlapping register regions (David Arcari) [1683079 1666393]
  - [acpi] acpi / watchdog: Print out error number when device creation fails (David Arcari) [1683079 1666393]
  - [net] netfilter: nat: limit port clash resolution attempts (Florian Westphal) [1683093 1654777]
  - [net] netfilter: nat: remove l4 protocol port rovers (Florian Westphal) [1683093 1654777]
  - [net] netfilter: nat: cope with negative port range (Florian Westphal) [1683093 1654777]
  - [x86] mm/fault: Allow stack access below rsp (Waiman Long) [1678221 1651416]
  - [nvme] nvme-rdma: fix possible double free of controller async event buffer (David Milburn) [1678214 1659532]
  - [nvme] nvme-rdma: fix possible free of a non-allocated async event buffer (David Milburn) [1678214 1659532]
  - [nvme] nvme-rdma: stop admin queue before freeing it (David Milburn) [1678214 1659532]
  - [nvme] rdma: fix double freeing of async event data (David Milburn) [1678216 1655786]
  - [md] fix memleak for mempool (Nigel Croxon) [1678215 1599780]
  - [md] Memory leak when flush bio size is zero (Nigel Croxon) [1678215 1599780]
  - [md] fix lock contention for flush bios (Nigel Croxon) [1678215 1599780]
  - [net] ipv6: rate-limit probes for neighbourless routes (Sabrina Dubroca) [1677179 1637821]
  - [net] ipv6: Re-arrange code in rt6_probe() (Sabrina Dubroca) [1677179 1637821]
  - [netdrv] cxgb4: update supported DCB version (Arjun Vynipadath) [1673821 1668570]
  - [netdrv] cxgb4: when disabling dcb set txq dcb priority to 0 (Arjun Vynipadath) [1673821 1668570]
  - [kvm] kvm: fix kvm_ioctl_create_device() reference counting (Paolo Bonzini) [1671922 1671923] {CVE-2019-6974}
  - [kvm] KVM: nVMX: unconditionally cancel preemption timer in free_nested (Paolo Bonzini) [1671905 1671906] {CVE-2019-7221}
  - [mm] page-writeback.c: fix range_cyclic writeback vs writepages deadlock (Brian Foster) [1673281 1591574]
  - [fs] rbd: avoid corruption on partially completed bios (Ilya Dryomov) [1672514 1613493]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.12.2.el7]
changelog:
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] x86/speculation/mds: Add mds=full,nosmt cmdline option (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kernel] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Disable automatic enabling of STIBP with SMT on (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [base] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/msr-index: Cleanup bit defines (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Rework SMT state change (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [kernel] sched/smt: Expose sched_smt_present static key (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [kernel] sched/smt: Make sched_smt_present track topology (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Disable STIBP when enhanced IBRS is in use (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spectre_v2: Make spectre_v2_mitigation mode available (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add X86_FEATURE_USE_IBPB (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add casting to fix compilation error (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}
  - [x86] x86/cpufeatures: Add Intel PCONFIG cpufeature (Waiman Long) [1692597 1692598 1692599 1690335 1690348 1690358] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127}


author: Natalya Naumova <natalya.naumova@oracle.com> [3.10.0-957.12.2.0.1.el7.OL7]
changelog:
  - [xen/balloon] Support xend-based toolstack (orabug 28663970)
  - [x86/apic/x2apic] avoid allocate multiple irq vectors for a single interrupt on multiple
    cpu, otherwise irq vectors would be used up when there are only 2 cpu online per node.
    [orabug28691156]
  - [bonding] avoid repeated display of same link status change. [orabug 28109857]
  - [ipc] ipc/sem.c: bugfix for semctl(,,GETZCNT) (Manfred Spraul) [orabug 22552377]
  - Oracle Linux certificates (Alexey Petrenko)
  - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)
  - Update x509.genkey [bug 24817676]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.14.1.el7]
changelog:
  - [fs] move the call of __d_drop(anon) into __d_materialise_unique(dentry, anon) (Zheng Yan) [1692266 1627001]
  - [fs] dcache: d_splice_alias should ignore DCACHE_DISCONNECTED (Zheng Yan) [1692266 1627001]
  - [fs] dcache: d_splice_alias should detect loops (Zheng Yan) [1692266 1627001]
  - [fs] dcache: d_splice_alias mustn't create directory aliases (Zheng Yan) [1692266 1627001]
  - [fs] dcache: close d_move race in d_splice_alias (Zheng Yan) [1692266 1627001]
  - [fs] dcache: move d_splice_alias (Zheng Yan) [1692266 1627001]
  - [fs] dcache: don't clear DCACHE_DISCONNECTED too early (Zheng Yan) [1692266 1627001]
  - [fs] dcache: Don't set DISCONNECTED on "pseudo filesystem" dentries (Zheng Yan) [1692266 1627001]
  - [fs] dcache: use IS_ROOT to decide where dentry is hashed (Zheng Yan) [1692266 1627001]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.15.1.el7]
changelog:
  - [fs] ext4: Fix data corruption caused by unaligned direct AIO (Lukas Czerner) [1693561 1684780]
  - [net] sched: act_csum: Fix csum calc for tagged packets (Ivan Vecera) [1693110 1676462]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.16.1.el7]
changelog:
  - [netdrv] net/mlx5e: Properly set steering match levels for offloaded TC decap rules (Alaa Hleihel) [1686292 1618427]
  - [netdrv] net/mlx5e: Always use the match level enum when parsing TC rule match (Alaa Hleihel) [1686292 1618427]
  - [netdrv] net/mlx5e: Support offloaded TC flows with no matches on headers (Alaa Hleihel) [1686292 1618427]
  - [netdrv] net/mlx5e: Get the required HW match level while parsing TC flow matches (Alaa Hleihel) [1686292 1618427]
  - [netdrv] net/mlx5e: Properly order min inline mode setup while parsing TC matches (Alaa Hleihel) [1686292 1618427]
  - [netdrv] net/mlx5e: Avoid redundant zeroing of offloaded TC flow attributes (Alaa Hleihel) [1686292 1618427]
  - [netdrv] net/mlx5e: Err if asked to offload TC match on frag being first (Alaa Hleihel) [1686292 1618427]
  - [x86] hyperv: Stop suppressing X86_FEATURE_PCID (Vitaly Kuznetsov) [1697940 1691421]
  - [net] geneve: correctly handle ipv6.disable module parameter (Jiri Benc) [1694981 1677049]
  - [fs] ceph: Fix append mode for sync/direct write (Zheng Yan) [1696595 1691227]
  - [fs] ovl: fix return value from ovl_posix_acl_create() (Miklos Szeredi) [1696292 1677705]
  - [x86] mm: Unbreak modules that use the DMA API (Gary Hook) [1695511 1697241 1676613 1662887]
  - [sound] alsa/hda: add more quirks for HP Z2 G4 and HP Z240 (Jaroslav Kysela) [1693562 1680180]
  - [sound] alsa: hda/conexant - Add fixup for HP Z2 G4 workstation (Jaroslav Kysela) [1693562 1657855]
  - [block] mtip32xx: fix memory corruption by initializing internal command header (Ming Lei) [1689929 1660292]
  - [fs] nfsd: deal with revoked delegations appropriately (Dave Wysochanski) [1689811 1552203]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.19.1.el7]
changelog:
  - [security] selinux: always allow mounting submounts (Ondrej Mosnacek) [1702923 1077929]
  - [block] Make blk_queue_enter() reexamine the DYING flag (Ming Lei) [1702921 1701348]
  - [block] wakeup tasks blocked on q->mq_freeze_wq (Ming Lei) [1702921 1701348]
  - [fs] revert "[fs] xfs: use rhashtable to track buffer cache" (Brian Foster) [1702922 1658749]
  - [fs] xfs: hold xfs_buf locked between shortform->leaf conversion and the addition of an attribute (Brian Foster) [1701293 1613405]
  - [fs] xfs: add the ability to join a held buffer to a defer_ops (Brian Foster) [1701293 1613405]
  - [fs] xfs: refactor buffer logging into buffer dirtying helper (Brian Foster) [1701293 1613405]
  - [char] ipmi: ipmi_si_hardcode.c: init si_type array to fix a crash (Tony Camuso) [1701991 1692236]
  - [char] ipmi_si: Fix crash when using hard-coded device (Tony Camuso) [1701991 1692236]
  - [char] ipmi: Remove platform driver overrides and use the id_table (Tony Camuso) [1701991 1692236]
  - [security] xattr: Constify ->name member of "struct xattr" (Aaron Tomlin) [1702286 1607307]
  - [net] ipv6 Use get_hash_from_flowi6 for rt6 hash (Sabrina Dubroca) [1702282 1625454]
  - [s390] zcrypt: fix specification exception on z196 during ap probe (Hendrik Brueckner) [1700706 1669535]
  - [md] dm table: propagate BDI_CAP_STABLE_WRITES to fix sporadic checksum errors (Mike Snitzer) [1699722 1693466]
  - [fs] blockdev: Fix livelocks on loop device (Lukas Czerner) [1698110 1686149]
  - [fs] ext4: fix crash during online resizing (Lukas Czerner) [1698110 1686149]
  - [fs] ext4: fix overflow caused by missing cast in ext4_resize_fs() (Lukas Czerner) [1698110 1671293]
  - [powerpc] livepatch: return -ERRNO values in save_stack_trace_tsk_reliable() (Joe Lawrence) [1697867 1658435]
  - [powerpc] livepatch: small cleanups in save_stack_trace_tsk_reliable() (Joe Lawrence) [1697867 1658435]
  - [powerpc] livepatch: relax reliable stack tracer checks for first-frame (Joe Lawrence) [1697867 1658435]
  - [powerpc] 64s: Make reliable stacktrace dependency clearer (Joe Lawrence) [1697867 1658435]
  - [powerpc] 64s: Clear on-stack exception marker upon exception return (Joe Lawrence) [1697867 1658435]
  - [powerpc] livepatch: Fix build error with kprobes disabled (Joe Lawrence) [1697867 1658435]
  - [fs] xfs: don't screw up direct writes when freesp is fragmented (Brian Foster) [1693796 1667523]
  - [nvme] ensure forward progress during Admin passthru (David Milburn) [1690519 1672428]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.20.1.el7]
changelog:
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Fix comment (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [documentation] x86/speculation/mds: Add mds=full,nosmt cmdline option (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [kernel] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Disable automatic enabling of STIBP with SMT on (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [base] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/msr-index: Cleanup bit defines (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Rework SMT state change (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [kernel] sched/smt: Expose sched_smt_present static key (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [kernel] sched/smt: Make sched_smt_present track topology (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Disable STIBP when enhanced IBRS is in use (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common() (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/spectre_v2: Make spectre_v2_mitigation mode available (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Add X86_FEATURE_USE_IBPB (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091}
  - [x86] x86/spec_ctrl: Add casting to fix compilation error (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] x86/cpufeatures: Add Intel PCONFIG cpufeature (Waiman Long) [1692597 1692598 1692599 1705815 1690335 1690348 1690358 1709296] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.21.1.el7]
changelog:
  - [x86] spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1712998 1712993 1710501 1710498] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}
  - [x86] speculation/mds: Properly set/clear mds_idle_clear static key (Waiman Long) [1713004 1707292] {CVE-2018-12126 CVE-2018-12130 CVE-2018-12127 CVE-2019-11091}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.21.2.el7]
changelog:
  - [security] xattr: use RH_KABI_CONST to avoid security_inode_init_security checksum change (Cestmir Kalina) [1702286 1710633]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.21.3.el7]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719849 1719850] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719594 1719595] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719594 1719595] {CVE-2019-11477}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.22.1.el7]
changelog:
  - [md] raid: raid5 preserve the writeback action after the parity check (Nigel Croxon) [1698109 1701350]
  - [net] route: set the deleted fnhe fnhe_daddr to 0 in ip_del_fnhe to fix a race (Xin Long) [1709727 1630136]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.23.1.el7]
changelog:
  - [md] dm thin metadata: do not write metadata if no changes occurred (Mike Snitzer) [1713800 1710051]
  - [md] dm thin metadata: add wrappers for managing write locking of metadata (Mike Snitzer) [1713800 1710051]
  - [md] dm thin metadata: check __commit_transaction()'s return (Mike Snitzer) [1713800 1710051]
  - [md] dm space map common: zero entire ll_disk (Mike Snitzer) [1713800 1710051]
  - [scsi] smartpqi: correct lun reset issues (Don Brace) [1709469 1641112]
  - [net] openvswitch: Remove padding from packet before L3+ conntrack processing (Eelco Chaudron) [1713562 1684518]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.26.1.el7]
changelog:
  - [x86] kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs (Eduardo Habkost) [1716306 1593190]
  - [x86] kvm/mmu: reset MMU context when 32-bit guest switches PAE (Vitaly Kuznetsov) [1702172 1703797]
  - [x86] kvm: x86: fix handling of role.cr4_pae and rename it to 'gpte_size' (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Do not inherit quadrant and invalid for the root shadow EPT (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: fix switch between root and guest MMUs (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: NMI-window and interrupt-window exiting should wake L2 from HLT (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: nsvm: fix switch to guest mmu (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: Fix race in emulated page table writes (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx/nsvm: Fix bug which sets vcpu->arch.tsc_offset to L1 tsc_offset (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: reintroduce pte_list_remove, but including mmu_spte_clear_track_bits (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: rename pte_list_remove to __pte_list_remove (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: check if MMU reconfiguration is needed in init_kvm_nested_mmu() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: check if tdp/shadow MMU reconfiguration is needed (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/nvmx: introduce source data cache for kvm_init_shadow_ept_mmu() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: make space for source data caching in struct kvm_mmu (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: get rid of redundant kvm_mmu_setup() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: introduce guest_mmu (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu.c: add kvm_mmu parameter to kvm_mmu_free_roots() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu.c: set get_pdptr hook in kvm_init_shadow_ept_mmu() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: make vcpu->mmu a pointer to the current MMU (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: move vmcs12 EPTP consistency check to check_vmentry_prereqs() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: move host EFER consistency checks to VMFail path (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: return 0 in case kvm_mmu_memory_cache has min number of objects (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Clear reserved bits of #DB exit qualification (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: restore host state in nested_vmx_vmexit for VMFail (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: fix entry with pending interrupt if APICv is enabled (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: hide flexpriority from guest when disabled at the module level (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: check for existence of secondary exec controls before accessing (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Wake blocked vCPU in guest-mode if pending interrupt in virtual APICv (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: don't reset root in kvm_mmu_setup() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/lapic: always disable MMIO interface in x2APIC mode (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix loss of pending IRQ/NMI before entering L2 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Skip pae_root shadow allocation if tdp enabled (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/mmu: Combine flushing remote tlb in mmu_set_spte() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Add multi-entry LRU cache for previous CR3s (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Support selectively freeing either current or previous MMU root (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Add a root_hpa parameter to kvm_mmu->invlpg() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Add ability to skip TLB flush when switching CR3 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Use fast CR3 switch for nested VMX (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Support resetting the MMU context without resetting roots (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Add support for fast CR3 switch across different MMU modes (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Introduce KVM_REQ_LOAD_CR3 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Introduce kvm_mmu_calc_root_page_role() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Add fast CR3 switch code path (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Avoid taking MMU lock in kvm_mmu_sync_roots if no sync is needed (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Make sync_page() flush remote TLBs once only (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Restore exit qual for VM-entry failure due to MSR loading (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: Nested VM-entry prereqs for event inj (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: Don't expose private memslots to L2 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: Add guest_mode to kvm_mmu_page_role (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: Basic APIC virtualization controls have three settings (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Eliminate APIC access page sharing between L1 and L2 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: Introduce lapic_mode enumeration (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Refactor mmu_free_roots() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: move MSR_IA32_TSC handling to x86.c (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: Properly update 'tsc_offset' to represent the running guest (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] Add check for APIC access address for vmentry of L2 guests (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Do not load EOI-exitmap while running L2 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: don't configure EPT identity map for unrestricted guest (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Update the exit_qualification access bits while walking an address (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Enforce NMI controls on vmentry of L2 guests (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Don't halt vcpu when L1 is injecting events to L2 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: shadow more fields that are read/written on every vmexits (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix bug of injecting L2 exception into L1 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm mmu: check pending exception before injecting APF (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: svm: prepare for new bit definition in nested_ctl (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix vmx_check_nested_events() return value in case an event was reinjected to L2 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: ioapic: Preserve read-only values in the redirection table (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: ioapic: Clear Remote IRR when entry is switched to edge-triggered (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: ioapic: Remove redundant check for Remote IRR in ioapic_set_irq (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: ioapic: Don't fire level irq when Remote IRR set (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix mmu context after VMLAUNCH/VMRESUME failure (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Validate the IA32_BNDCFGS on nested VM-entry (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: extend usage of RET_MMIO_PF_* constants (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] arch/x86: remove redundant null checks before kmem_cache_destroy (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: cleanup init_rmode_identity_map() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: free_page can handle NULL (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix nested #PF intends to break L1's vmlauch/vmresume (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Handle deferred early VMLAUNCH/VMRESUME failure properly (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: Handle VMLAUNCH/VMRESUME failure properly (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Remove nested_vmx_succeed after successful VM-entry (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Validate the virtual-APIC address on nested VM-entry (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix trying to cancel vmlauch/vmresume (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: use kvm_event_needs_reinjection (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Fix loss of exception which has not yet been injected (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: fix use of L1 MMIO areas in nested guests (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Avoid guest page table walk when gpa_available is set (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: simplify ept_misconfig (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Disallow illegal IA32_APIC_BASE MSR values (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: Bail out immediately if there is no available mmu page (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: validate eptp pointer (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Add support for fast unprotection of nested guest page tables (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: svm: Limit PFERR_NESTED_GUEST_PAGE error_code check to L1 guest (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: fixes to nested virt interrupt injection (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: do not fill vm_exit_intr_error_code in prepare_vmcs12 (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Disallow VM-entry in MOV-SS shadow (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: async_pf: Force a nested vmexit if the injected #PF is async_pf (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: async_pf: Add L1 guest async_pf #PF vmexit handler (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: Simplify kvm_x86_ops->queue_exception parameter list (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fix nested_vmx_check_msr_bitmap_controls (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Validate the I/O bitmaps on nested VM-entry (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Don't set vmcs12 to "launched" when VMLAUNCH fails (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Validate CR3 target count on nested VM-entry (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: Flush TLB when the APIC-access address changes (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: VMCLEAR should not cause the vCPU to shut down (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: vmx: Use the hardware provided GPA instead of page walk (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: svm: Use the hardware provided GPA instead of page walk (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: svm: Add support for additional SVM NPF error codes (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: CPUID.01H:EDX.APIC[bit 9] should mirror IA32_APIC_BASE[11] (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: nvmx: Fetch VM_INSTRUCTION_ERROR from vmcs02 on vmx->fail (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm/x86: Replace smp_mb() with smp_store_mb/release() in the walk_shadow_page_lockless_begin/end() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: coalesce more page zapping in mmu_sync_children (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: move zap/flush to kvm_mmu_get_page (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: invert return value of mmu.sync_page and *kvm_sync_page* (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: cleanup __kvm_sync_page and its callers (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: use kvm_sync_page in kvm_sync_pages (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: move TLB flush out of __kvm_sync_page (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: introduce kvm_mmu_flush_or_zap (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: mmu: Fix ubsan warnings (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: Remove unused parameter parent_pte from kvm_mmu_get_page() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: Use for_each_rmap_spte macro instead of pte_list_walk() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: Move parent_pte handling from kvm_mmu_get_page() to link_shadow_page() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: Move initialization of parent_ptes out from kvm_mmu_alloc_page() (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: Make mmu_set_spte() return emulate value (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] kvm: x86: mmu: Add helper function to clear a bit in unsync child bitmap (Vitaly Kuznetsov) [1702172 1565739]
  - [x86] mce: Handle varying MCA bank counts (David Arcari) [1715868 1693352]
  - [drm] drm/i915/gvt: Fix mmap range check (Alex Williamson) [1713566 1713567] {CVE-2019-11085}
  - [nvme] cancel request synchronously (Ming Lei) [1715320 1688518]
  - [block] blk-mq: introduce blk_mq_complete_request_sync() (Ming Lei) [1715320 1688518]
  - [char] ipmi_si: fix use-after-free of resource->name (Tony Camuso) [1714407 1714408] {CVE-2019-11811}
  - [fs] sunrpc: make visible processing error in bc_svc_process() ("J. Bruce Fields") [1660818 1653675] {CVE-2018-16884}
  - [fs] sunrpc: remove unused xpo_prep_reply_hdr callback ("J. Bruce Fields") [1660818 1653675] {CVE-2018-16884}
  - [fs] sunrpc: remove svc_tcp_bc_class ("J. Bruce Fields") [1660818 1653675] {CVE-2018-16884}
  - [fs] sunrpc: replace svc_serv->sv_bc_xprt by boolean flag ("J. Bruce Fields") [1660818 1653675] {CVE-2018-16884}
  - [fs] sunrpc: use-after-free in svc_process_common() ("J. Bruce Fields") [1660818 1653675] {CVE-2018-16884}
  - [fs] svcauth_gss: Close connection when dropping an incoming message ("J. Bruce Fields") [1660818 1653675] {CVE-2018-16884}
  - [tty] Fix low_latency BUG (Aristeu Rozanski) [1715331 1710039]
  - [tty] n_tty: Fix termios_rwsem lockdep false positive (Artem Savkov) [1715328 1712744]
  - [tty] Fix lock order in tty_do_resize() (Aristeu Rozanski) [1708063 1684982]
  - [tty] n_tty: Access termios values safely (Aristeu Rozanski) [1708063 1684982]
  - [tty] Convert termios_mutex to termios_rwsem (Aristeu Rozanski) [1708063 1684982]
  - [md] batch flush requests. (Xiao Ni) [1713564 1576466]
  - [md] revert "md: fix lock contention for flush bios" (Xiao Ni) [1713564 1576466]
  - [mm] tlb: Remove tlb_remove_table() non-concurrent condition (Vitaly Kuznetsov) [1712766 1448188]
  - [kernel] sched/fair: Do not re-read ->h_load_next during hierarchical load calculation (Phil Auld) [1712764 1707397]
  - [x86] livepatch: apply alternatives and paravirt patches after relocations (Artem Savkov) [1712761 1706733]
  - [block] blk-mq: fix IO accounting in case of none io scheduler (Ming Lei) [1711013 1669684]
  - [net] netfilter: ipv6: Don't preserve original oif for loopback address (Florian Westphal) [1709186 1701496]
  - [net] netfilter: ipv6: Preserve link scope traffic original oif (Florian Westphal) [1709186 1701496]
  - [x86] mce/amd, edac/mce_amd: Add new error descriptions for some SMCA bank types (Gary Hook) [1703376 1685269]
  - [edac] x86/mce/amd, edac/mce_amd: Add new McaTypes for CS, PSP, and SMU units (Gary Hook) [1703376 1685269]
  - [edac] x86/mce/amd, edac/mce_amd: Add new MP5, NBIO, and PCIE SMCA bank types (Gary Hook) [1703376 1685269]
  - [x86] mce/amd: Fix the thresholding machinery initialization order (Gary Hook) [1703376 1685269]
  - [x86] mce/amd: Read MCx_MISC block addresses on any CPU (Gary Hook) [1703376 1685269]
  - [x86] mce/amd: Cache SMCA MISC block addresses (Gary Hook) [1703376 1685269]
  - [x86] mce/amd: Carve out SMCA get_block_address() code (Gary Hook) [1703376 1685269]
  - [x86] mce/amd: Get address from already initialized block (Gary Hook) [1703376 1685269]
  - [edac] x86/mce/amd, edac/mce_amd: Enumerate Reserved SMCA bank type (David Arcari) [1712763 1676301]
  - [x86] mce/amd: Pass the bank number to smca_get_bank_type() (David Arcari) [1712763 1676301]
  - [x86] mce/amd: Define a function to get SMCA bank type (David Arcari) [1712763 1676301]
  - [x86] mce/amd: Allow any CPU to initialize the smca_banks array (David Arcari) [1712763 1676301]
  - [x86] mce/amd: Carve out SMCA bank configuration (David Arcari) [1712763 1676301]
  - [x86] mce: Convert threshold_bank.cpus from atomic_t to refcount_t (David Arcari) [1712763 1676301]
  - [x86] ras/amd: Make sysfs names of banks more user-friendly (David Arcari) [1712763 1676301]
  - [x86] mce/amd: Make the init code more robust (David Arcari) [1712763 1676301]
  - [x86] ras: Hide SMCA bank names (David Arcari) [1712763 1676301]
  - [powerpc] security: Fix spectre_v2 reporting (Gustavo Duarte) [1708546 1694459]
  - [powerpc] fsl: Update Spectre v2 reporting (Gustavo Duarte) [1708546 1694459]
  - [powerpc] fsl: Add nospectre_v2 command line argument (Gustavo Duarte) [1708546 1694459]
  - [powerpc] fsl: Fix spectre_v2 mitigations reporting (Gustavo Duarte) [1708546 1694459]
  - [powerpc] powernv: Query firmware for count cache flush settings (Gustavo Duarte) [1708546 1694459]
  - [powerpc] pseries: Query hypervisor for count cache flush settings (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Add support for software count cache flush (Gustavo Duarte) [1708546 1694459]
  - [powerpc] Introduce asm-prototypes.h (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Add new security feature flags for count cache flush (Gustavo Duarte) [1708546 1694459]
  - [powerpc] asm: Add a patch_site macro & helpers for patching instructions (Gustavo Duarte) [1708546 1694459]
  - [powerpc] Add helper to check if offset is within relative branch range (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64: Make meltdown reporting Book3S 64 specific (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64: Call setup_barrier_nospec() from setup_arch() (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64: Add CONFIG_PPC_BARRIER_NOSPEC (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64: Make stf barrier PPC_BOOK3S_64 specific (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64: Disable the speculation barrier from the command line (Gustavo Duarte) [1708546 1694459]
  - [powerpc] powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Enhance the information in cpu_show_spectre_v1() (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64: Use barrier_nospec in syscall entry (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Enable barrier_nospec based on firmware settings (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Patch barrier_nospec in modules (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Add support for ori barrier_nospec patching (Gustavo Duarte) [1708546 1694459]
  - [powerpc] 64s: Add barrier_nospec (Gustavo Duarte) [1708546 1694459]
  - [powerpc] reuse asm-generic/barrier.h (Gustavo Duarte) [1708546 1694459]
  - [x86] locking/arch: Rename set_mb() to smp_store_mb() (Waiman Long) [1708546 1522387]
  - [kernel] locking/arch: Add WRITE_ONCE() to set_mb() (Waiman Long) [1708546 1522387]
  - [kernel] rcu: Don't wake rcuc/X kthreads on NOCB CPUs (Daniel Bristot de Oliveira) [1711325 1626129]
  - [x86] Update stepping values for coffee lake desktop (David Arcari) [1710803 1704812]
  - [security] selinux: overhaul sidtab to fix bug and improve performance (Ondrej Mosnacek) [1710468 1335986]
  - [security] selinux: use separate table for initial SID lookup (Ondrej Mosnacek) [1710468 1335986]
  - [security] selinux: refactor sidtab conversion (Ondrej Mosnacek) [1710468 1335986]
  - [nvme] nvme-pci: fix memory leak on probe failure (David Milburn) [1710799 1689008]
  - [nvme] nvme-pci: limit max IO size and segments to avoid high order allocations (David Milburn) [1710799 1689008]
  - [lib] locking/rwsem: Prevent decrement of reader count before increment (Waiman Long) [1709704 1708667]
  - [fs] nfsd: COPY and CLONE operations require the saved filehandle to be set (Scott Mayhew) [1672147 1645353] {CVE-2018-16871}
  - [iommu] amd: Set exclusion range correctly (Jerry Snitselaar) [1698338 1702763]
  - [iommu] amd: Reserve exclusion range in iova-domain (Jerry Snitselaar) [1698338 1691196]
  - [nvdimm] libnvdimm, pmem: Fix badblocks population for 'raw' namespaces (Frank Ramsay) [1708548 1672302]
  - [netdrv] mac80211_hwsim: Fix possible Spectre-v1 for hwsim_world_regdom_custom (Stanislaw Gruszka) [1706698 1639674]
  - [net] nl80211: Fix possible Spectre-v1 for NL80211_TXRATE_HT (Stanislaw Gruszka) [1706698 1639674]
  - [net] nl80211: Fix possible Spectre-v1 for CQM RSSI thresholds (Stanislaw Gruszka) [1706698 1639674]
  - [netdrv] mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl() (Stanislaw Gruszka) [1706698 1626463]
  - [md] dm cache metadata: Fix loading discard bitset (Mike Snitzer) [1703586 1701619]
  - [infiniband] hfi1: Close race condition on user context disable and close (Alex Estrin) [1705369 1680069]
  - [mm] thp: relocate flush_cache_range() in migrate_misplaced_transhuge_page() (Andrea Arcangeli) [1698108 1636066]
  - [mm] thp: fix mmu_notifier in migrate_misplaced_transhuge_page() (Andrea Arcangeli) [1698108 1636066]
  - [mm] thp: fix MADV_DONTNEED vs migrate_misplaced_transhuge_page race condition (Andrea Arcangeli) [1698108 1636066]
  - [mm] revert "mm: numa: defer TLB flush for THP migration as long as possible" (Andrea Arcangeli) [1698108 1636066]
  - [mm] thp/migration: switch from flush_tlb_range to flush_pmd_tlb_range (Andrea Arcangeli) [1698108 1636066]
  - [mm] migrate.c: stabilise page count when migrating transparent hugepages (Andrea Arcangeli) [1698108 1636066]
  - [mm] numa: add migrated transhuge pages to LRU the same way as base pages (Andrea Arcangeli) [1698108 1636066]
  - [mm] thp: fix MADV_DONTNEED vs. MADV_FREE race (Andrea Arcangeli) [1698108 1636066]
  - [mm] memcg, slab: simplify synchronization scheme (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, slab: do not schedule cache destruction when last page goes away (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, slab: separate memcg vs root cache creation paths (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, slab: cleanup memcg cache creation (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg: remove KMEM_ACCOUNTED_ACTIVATED flag (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, slab: RCU protect memcg_params for root caches (Aaron Tomlin) [1691428 1674401]
  - [mm] slab: do not panic if we fail to create memcg cache (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg: get rid of kmem_cache_dup() (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg: fix possible NULL deref while traversing memcg_slab_caches list (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, slab: fix barrier usage when accessing memcg_caches (Aaron Tomlin) [1691428 1674401]
  - [mm] slab: clean up kmem_cache_create_memcg() error handling (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, kmem: use cache_from_memcg_idx instead of hard code (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg, kmem: rename cache_from_memcg to cache_from_memcg_idx (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg: make memcg_update_cache_sizes() static (Aaron Tomlin) [1691428 1674401]
  - [mm] memcg: fix kmem_account_flags check in memcg_can_account_kmem() (Aaron Tomlin) [1691428 1674401]
  - [security] xattr: use RH_KABI_CONST to avoid security_inode_init_security checksum change (Cestmir Kalina) [1702286 1710633]


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.27.1.el7]
changelog:
  - [x86] Update stepping values for Whiskey Lake U/Y (David Arcari) [1718690 1704810]
  - [x86] perf/amd: Resolve NMI latency issues for active PMCs (David Arcari) [1721611 1696764]
  - [x86] perf/amd: Resolve race condition when disabling PMC (David Arcari) [1721611 1696764]
  - [edac] amd64: Set maximum channel layer size depending on family (Gary Hook) [1720266 1705210]
  - [edac] amd64: Adjust printed chip select sizes when interleaved (Gary Hook) [1720266 1705210]
  - [edac] amd64: Recognize x16 symbol size (Gary Hook) [1720266 1705210]
  - [edac] amd64: Support more than two Unified Memory Controllers (Gary Hook) [1720266 1705210]
  - [edac] amd64: Use a macro for iterating over Unified Memory Controllers (Gary Hook) [1720266 1705210]
  - [edac] amd64: Add Family 17h, models 10h-2fh support (Gary Hook) [1720266 1705210]
  - [edac] amd64: Add Family 17h, models 10h-2fh support (Gary Hook) [1720266 1670608]
  - [x86] mark AMD Rome processors supported (David Arcari) [1721604 1543509]
  - [x86] Mark AMD EPYC guests as supported (David Arcari) [1721604 1664507]
  - [x86] mark amd rome as unsupported (David Arcari) [1721604 1638504]
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719914 1719915] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719849 1719850] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719594 1719595] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719594 1719595] {CVE-2019-11477}


author: Jan Stancek <jstancek@redhat.com> [3.10.0-957.27.2.el7]
changelog:
  - [x86] hyper-v: fix hyperv.h UAPI header (Vitaly Kuznetsov) [1727109 1692492]
  - [iommu] hyper-v: Add Hyper-V stub IOMMU driver (Vitaly Kuznetsov) [1727109 1661654]
  - [x86] hyper-v: Set x2apic destination mode to physical when x2apic is available (Vitaly Kuznetsov) [1727109 1661654]
  - [x86] hyper-v: Consolidate code for converting cpumask to vpset (Vitaly Kuznetsov) [1727109 1661654]
  - [x86] hyper-v: Fix the circular dependency in IPI enlightenment (Vitaly Kuznetsov) [1727109 1661654]
  - [pci] hv: Refactor hv_irq_unmask() to use cpumask_to_vpset() (Vitaly Kuznetsov) [1727109 1661654]
  - [pci] hv: Replace hv_vp_set with hv_vpset (Vitaly Kuznetsov) [1727109 1661654]
  - [pci] hv: Add __aligned(8) to struct retarget_msi_interrupt (Vitaly Kuznetsov) [1727109 1661654]
  - [hwmon] k10temp: Add support for AMD family 17h, model 30h CPUs (Gary Hook) [1728000 1643292]
  - [x86] amd_nb: Add PCI device IDs for family 17h, model 30h (Gary Hook) [1728000 1643292]
  - [x86] amd_nb: Add support for newer PCI topologies (Gary Hook) [1728000 1643292]
  - [hwmon] k10temp, x86/amd_nb: Consolidate shared device IDs (Gary Hook) [1728000 1643292]
  - [hwmon] (k10temp) Use API function to access System Management Network (Gary Hook) [1728000 1643292]
  - [x86] amd_nb: Add support for Raven Ridge CPUs (Gary Hook) [1728000 1643292]
  - [hwmon] (k10temp) Add support for AMD Ryzen w/ Vega graphics (Gary Hook) [1728000 1643292]
  - [hwmon] (k10temp) Add temperature offset for Ryzen 2700X (Gary Hook) [1728000 1643292]
  - [x86] cpu/amd: Apply the Erratum 688 fix when the BIOS doesn't (Gary Hook) [1728000 1643292]


author: Kevin Lyons <kevin.x.lyons@oracle.com> [3.10.0-957.5.1.0.1.el7.OL7]
changelog:
  - [x86/apic/x2apic] avoid allocate multiple irq vectors for a single interrupt on multiple
    cpu, otherwise irq vectors would be used up when there are only 2 cpu online per node.
    [orabug28691156]
  - [bonding] avoid repeated display of same link status change. [orabug 28109857]
  - [ipc] ipc/sem.c: bugfix for semctl(,,GETZCNT) (Manfred Spraul) [orabug 22552377]
  - Oracle Linux certificates (Alexey Petrenko)
  - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)
  - Update x509.genkey [bug 24817676]


author: Bruno E. O. Meneguele <bmeneg@redhat.com> [3.10.0-949.el7]
changelog:
  - [scsi] libsas: fix memory leak in sas_smp_get_phy_events() (Tomas Henzl) [1558582] {CVE-2018-7757}
  - [vhost] fix info leak due to uninitialized memory (Jason Wang) [1573705] {CVE-2018-1118}
  - [pci] Fix calculation of bridge window's size and alignment (Myron Stowe) [1623800]
  - [md] dm thin metadata: try to avoid ever aborting transactions (Mike Snitzer) [1614151]
  - [crypto] api: fix finding algorithm currently being tested (Herbert Xu) [1618701]
  - [sound] alsa: hda/realtek: Fix HP Headset Mic can't record (Jaroslav Kysela) [1622721]
  - [sound] alsa: hda/realtek - Fixup for HP x360 laptops with B&O speakers (Jaroslav Kysela) [1622721]
  - [sound] alsa: hda/realtek - Fixup mute led on HP Spectre x360 (Jaroslav Kysela) [1622721]
  - [target] scsi: tcmu: use u64 for dev_size (Xiubo Li) [1603363]
  - [target] scsi: tcmu: use match_int for dev params (Xiubo Li) [1603363]
  - [target] scsi: tcmu: do not set max_blocks if data_bitmap has been setup (Xiubo Li) [1603363]
  - [target] scsi: tcmu: unmap if dev is configured (Xiubo Li) [1603363]
  - [target] scsi: tcmu: check if dev is configured before block/reset (Xiubo Li) [1603363]
  - [target] scsi: tcmu: use lio core se_device configuration helper (Xiubo Li) [1603363]
  - [target] scsi: target: add helper to check if dev is configured (Xiubo Li) [1603363]
  - [target] scsi: tcmu: initialize list head (Xiubo Li) [1603363]
  - [target] scsi: target_core_user: fix double unlock (Xiubo Li) [1603363]
  - [s390] arch: Set IORESOURCE_SYSTEM_RAM flag for resources (Gary Hook) [1627889]
  - [x86] efi-bgrt: Switch all pr_err() to pr_notice() for invalid BGRT (Lenny Szubowicz) [1464241]
  - [x86] efi/bgrt: Don't ignore the BGRT if the 'valid' bit is 0 (Lenny Szubowicz) [1464241]
  - [x86] efi: Preface all print statements with efi* tag (Lenny Szubowicz) [1464241]
  - [x86] efi-bgrt: Switch pr_err() to pr_debug() for invalid BGRT (Lenny Szubowicz) [1464241]
  - [x86] efi-bgrt: Add error handling; inform the user when ignoring the BGRT (Lenny Szubowicz) [1464241]
  - [x86] efi: Check status field to validate BGRT header (Lenny Szubowicz) [1464241]


author: Guru Anbalagane <guru.anbalagane@oracle.com> [3.8.13-118.2.1.el7uek]
changelog:
  - ipc/sem.c: fully initialize sem_array before making it visible (Manfred Spraul)  [Orabug: 22277382]  {CVE-2015-7613} 
  - ipc: fix msg newqueue add (Guru Anbalagane)  [Orabug: 22277382]  {CVE-2015-7613}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.3.1.el7uek]
changelog:
  - Revert "xen-netfront: set max_queue default to 8" (Brian Maly)  [Orabug: 22096098]  
  - net/sunrpc: xpt_auth_cache should be ignored when expired. (NeilBrown)  [Orabug: 21287382]  
  - Prevent syncing frozen file system -- part 2 (Tariq Saeed)  [Orabug: 21807344]  
  - Prevent syncing frozen file system (Tariq Saeed)  [Orabug: 21807344]  
  - KEYS: Fix UID check in keyctl_get_persistent() (David Howells)   
  - mlx4_vnic: Release lock when flush is not needed (Yuval Shaia)  [Orabug: 22173261]  
  - IPoIB: restore uniqueness check for child interfaces (Santosh Shilimkar)  [Orabug: 22257430]  
  - block: bump BLK_DEF_MAX_SECTORS to 2560 (Jeff Moyer)  [Orabug: 22488554]  
  - Revert "block: remove artifical max_hw_sectors cap" (Jeff Moyer)  [Orabug: 22488554]  
  - KEYS: Fix keyring ref leak in join_session_keyring() (Yevgeny Pats)  [Orabug: 22563965]  {CVE-2016-0728} 
  - KEYS: Don't permit request_key() to construct a new keyring (David Howells)  [Orabug: 22373442]  {CVE-2015-7872} 
  - dcache: Handle escaped paths in prepend_path (Eric W. Biederman)  [Orabug: 22373283]  
  - vfs: Test for and handle paths that are unreachable from their mnt_root (Eric W. Biederman)  [Orabug: 22249875]  
  - KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring (David Howells)  [Orabug: 22373442]  {CVE-2015-7872} 
  - KEYS: Fix race between key destruction and finding a keyring by name (David Howells)  [Orabug: 22373442]  
  - KVM: svm: unconditionally intercept #DB (Paolo Bonzini)  [Orabug: 22333698]  {CVE-2015-8104} 
  - KVM: x86: work around infinite loop in microcode when #AC is delivered (Eric Northup)  [Orabug: 22333689]  {CVE-2015-5307} {CVE-2015-5307} 
  - KVM: x86: Defining missing x86 vectors (Nadav Amit)  [Orabug: 22333689]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.4.1.el7uek]
changelog:
  - xen-blkback: replace work_pending with work_busy in purge_persistent_gnt() (Bob Liu)  [Orabug: 22463905]  
  - coredump: add new %PATCH variable in core_pattern (Herbert van den Bergh)  [Orabug: 22666980]  
  - veth: don’t modify ip_summed; doing so treats packets with bad checksums as good. (Vijay Pandurangan)  [Orabug: 22725572]  
  - libiscsi: Fix host busy blocking during connection teardown (John Soni Jose)  [Orabug: 22735756]  
  - RDS: Add interface for receive MSG latency trace (Santosh Shilimkar)  [Orabug: 22868366]  
  - RDS: Add support for per socket SO_TIMESTAMP for incoming messages (Santosh Shilimkar)  [Orabug: 22868366]  
  - x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/nmi/64: Reorder nested NMI checks (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/nmi/64: Improve nested NMI comments (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/nmi/64: Switch stacks on userspace NMI entry (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/paravirt: Replace the paravirt nop with a bona fide empty function (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.5.1.el7uek]
changelog:
  - x86_64: expand kernel stack to 16K (Minchan Kim)  [Orabug: 21140371]  
  - iommu/vt-d: add quirk for broken interrupt remapping on 55XX chipsets (Neil Horman)  [Orabug: 22534160]  
  - xen: remove unneeded variables and one constant (Daniel Kiper)  [Orabug: 22288700]  
  - Revert "x86/xen: delay construction of mfn_list_list" (Daniel Kiper)  [Orabug: 22288700]  
  - ocfs2/dlm: fix misuse of list_move_tail() in dlm_run_purge_list() (Tariq Saeed)  [Orabug: 22898384]  
  - ocfs2/dlm: do not purge lockres that is queued for assert master (Xue jiufei)  [Orabug: 22898384]  
  - pipe: Fix buffer offset after partially failed read (Ben Hutchings)  [Orabug: 22985903]  {CVE-2016-0774} {CVE-2015-1805} {CVE-2016-0774}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.6.1.el7uek]
changelog:
  - skbuff: skb_segment: orphan frags before copying (Dongli Zhang)  [Orabug: 23018911]  
  - RDS/IB: VRPC DELAY / OSS RECONNECT CAUSES 5 MINUTE STALL ON PORT FAILURE (Venkat Venkatsubra)  [Orabug: 22888920]  
  - mlx4_core: Introduce restrictions for PD update (Ajaykumar Hotchandani)   
  - filename should be destroyed via final_putname() instead of __putname() (John Sobecki)  [Orabug: 22346320]  
  - RDS: Fix the atomicity for congestion map update (Wengang Wang)  [Orabug: 23141554]  
  - sctp: Prevent soft lockup when sctp_accept() is called during a timeout event (Karl Heiss)  [Orabug: 23222753]  {CVE-2015-8767}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.7.1.el7uek]
changelog:
  - megaraid_sas : Update threshold based reply post host index register (Sumit.Saxena@avagotech.com)  [Orabug: 23562756]  
  - xen/events: Don't move disabled irqs (Ross Lagerwall)  [Orabug: 23055234]  
  - xen/events: Mask a moving irq (Boris Ostrovsky)  [Orabug: 23055234]  
  - xen/pciback: Save the number of MSI-X entries to be copied later. (Dongli Zhang)  [Orabug: 23202410]  
  - xen/pciback: Save xen_pci_op commands before processing it (Dongli Zhang)  [Orabug: 23202410]  
  - xen-blkback: read from indirect descriptors only once (Dongli Zhang)  [Orabug: 23202410]  
  - xen-blkback: only read request operation from shared ring once (Dongli Zhang)  [Orabug: 23202410]  
  - xen-netback: use RING_COPY_REQUEST() throughout (Dongli Zhang)  [Orabug: 23202410]  
  - xen-netback: don't use last request to determine minimum Tx credit (Dongli Zhang)  [Orabug: 23202410]  
  - xen: Add RING_COPY_REQUEST() (Dongli Zhang)  [Orabug: 23202410]  
  - IB/security: Restrict use of the write() interface (Jason Gunthorpe)  [Orabug: 23283925]  {CVE-2016-4565} 
  - KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. (David Howells)  [Orabug: 23279020]  {CVE-2016-0758} 
  - net: add validation for the socket syscall protocol argument (Hannes Frederic Sowa)  [Orabug: 23267997]  {CVE-2015-8543} {CVE-2015-8543} 
  - ipv6: addrconf: validate new MTU before applying it (Marcelo Leitner)  [Orabug: 23263252]  {CVE-2015-8215} 
  - unix: properly account for FDs passed over unix sockets (willy tarreau)  [Orabug: 23262276]  {CVE-2013-4312} {CVE-2013-4312}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.9.1.el7uek]
changelog:
  - mlx4: Increase SYNC_TPT command timeout (Mukesh Kacker)  [Orabug: 22895790]  
  - neigh: do not modify unlinked entries (Julian Anastasov)  [Orabug: 23072705]  
  - mm/slab: Improve performance of slabinfo stats gathering (Aruna Ramakrishna)  [Orabug: 23720437]  
  - atl2: Disable unimplemented scatter/gather feature (Ben Hutchings)  [Orabug: 23703901]  {CVE-2016-2117} {CVE-2016-2117}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.10.1.el7uek]
changelog:
  - ocfs2: call ocfs2_journal_access_di() before ocfs2_journal_dirty() in ocfs2_write_end_nolock() (yangwenfang)  [Orabug: 19601200]  
  - ocfs2: improve recovery performance (Junxiao Bi)  [Orabug: 24395691]  
  - KEYS: potential uninitialized variable (Dan Carpenter)  [Orabug: 24393864]  {CVE-2016-4470}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.10.2.el7uek]
changelog:
  - tcp: make challenge acks less predictable (Eric Dumazet)  [Orabug: 24010012] [Orabug: 2401010]  {CVE-2016-5696}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.11.1.el7uek]
changelog:
  - rds: schedule local connection activity in proper workqueue (Ajaykumar Hotchandani)  [Orabug: 24624195]  
  - ib_core: make wait_event uninterruptible in ib_flush_fmr_pool() (Avinash Repaka)  [Orabug: 24655952]  
  - net/mlx4: Support shutdown() interface (Gavin Shan)  [Orabug: 24624181]  
  - tcp: make challenge acks less predictable (Eric Dumazet)  [Orabug: 24010012] [Orabug: 2401010]  {CVE-2016-5696}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.11.2.el7uek]
changelog:
  - Btrfs: fix truncation of compressed and inlined extents (Ashish Samant)  [Orabug: 22307285]  {CVE-2015-8374} 
  - Btrfs: fix file corruption and data loss after cloning inline extents (Divya Indi)  [Orabug: 22307285]  {CVE-2015-8374} 
  - netfilter: x_tables: make sure e->next_offset covers remaining blob size (Florian Westphal)  [Orabug: 24682074]  {CVE-2016-4997} {CVE-2016-4998} 
  - netfilter: x_tables: validate e->target_offset early (Florian Westphal)  [Orabug: 24682074]  {CVE-2016-4997} {CVE-2016-4998}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.12.1.el7uek]
changelog:
  - scsi_sysfs: protect against double execution of __scsi_remove_device() (Vitaly Kuznetsov)  [Orabug: 23720563]  
  - ocfs2: Fix double put of recount tree in ocfs2_lock_refcount_tree() (Ashish Samant)  [Orabug: 24691666]  
  - netfilter: x_tables: speed up jump target validation (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES (Pablo Neira Ayuso)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: remove unused comefrom hookmask argument (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: introduce and use xt_copy_counters_from_user (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: do compat validation via translate_table (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: xt_compat_match_from_user doesn't need a retval (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: ip6_tables: simplify translate_compat_table args (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: ip_tables: simplify translate_compat_table args (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: arp_tables: simplify translate_compat_table args (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: don't reject valid target size on some architectures (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: validate all offsets and sizes in a rule (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: check for bogus target offset (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: check standard target size too (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: add compat version of xt_check_entry_offsets (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: assert minimum target size (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: kill check_entry helper (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: add and use xt_check_entry_offsets (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: validate targets of jumps (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: fix unconditional helper (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: validate targets of jumps (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: don't move to non-existent next rule (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: fix unconditional helper (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: check for size overflow (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - NFSv4: Fail I/O if the state recovery fails irrevocably (Trond Myklebust)  [Orabug: 24681407]  
  - rds: skip rx/tx work when destroying connection (Wengang Wang)  [Orabug: 24395795]  
  - ocfs2: Fix start offset to ocfs2_zero_range_for_truncate() (Ashish Samant)  [Orabug: 23747627]  
  - sched/core: Clear the root_domain cpumasks in init_rootdomain() (Xunlei Pang)  [Orabug: 23518545]  
  - ocfs2: move dquot_initialize() in ocfs2_delete_inode() somewhat later (Jan Kara)  [Orabug: 23097098]  
  - fuse: fix typo while displaying fuse numa mount option (Ashish Samant)   
  - IB/mlx4: Replace kfree with kvfree in mlx4_ib_destroy_srq (Wengang Wang)  [Orabug: 22570521]  
  - ocfs2: return non-zero st_blocks for inline data (John Haxby)  [Orabug: 22218260]  
  - watchdog: update watchdog_thresh properly (Michal Hocko)  [Orabug: 21868337]  
  - Btrfs: fix truncation of compressed and inlined extents (Ashish Samant)  [Orabug: 22307285]  {CVE-2015-8374} 
  - Btrfs: fix file corruption and data loss after cloning inline extents (Divya Indi)  [Orabug: 22307285]  {CVE-2015-8374} 
  - netfilter: x_tables: make sure e->next_offset covers remaining blob size (Florian Westphal)  [Orabug: 24682074]  {CVE-2016-4997} {CVE-2016-4998} 
  - netfilter: x_tables: validate e->target_offset early (Florian Westphal)  [Orabug: 24682074]  {CVE-2016-4997} {CVE-2016-4998}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.13.2.el7uek]
changelog:
  - HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Scott Bauer)  [Orabug: 24798695]  {CVE-2016-5829}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.14.1.el7uek]
changelog:
  - ecryptfs: forbid opening files without mmap handler (Jann Horn)  [Orabug: 24971919]  {CVE-2016-1583} 
  - RDS: IB: fix panic with handlers running post teardown (Santosh Shilimkar)  [Orabug: 24395795]  
  - mm, gup: close FOLL MAP_PRIVATE race (Linus Torvalds)  [Orabug: 24928591]  {CVE-2016-5195} 
  - HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Scott Bauer)  [Orabug: 24798695]  {CVE-2016-5829}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.14.2.el7uek]
changelog:
  - aacraid: Check size values after double-fetch from user (Dave Carroll)  [Orabug: 25060050]  {CVE-2016-6480} {CVE-2016-6480} 
  - IB/srpt: Simplify srpt_handle_tsk_mgmt() (Bart Van Assche)  [Orabug: 25060011]  {CVE-2016-6327} 
  - audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore)  [Orabug: 25059945]  {CVE-2016-6136} 
  - ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt (Kangjie Lu)  [Orabug: 25059899]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in events via snd_timer_user_ccallback (Kangjie Lu)  [Orabug: 25059899]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (Kangjie Lu)  [Orabug: 25059753]  {CVE-2016-4569} 
  - acpi: Disable ACPI table override if securelevel is set (Linn Crosetto)  [Orabug: 25058991]  {CVE-2016-3699} 
  - Bluetooth: Fix potential NULL dereference in RFCOMM bind callback (Jaganath Kanakkassery)  [Orabug: 25058903]  {CVE-2015-8956} 
  - ASN.1: Fix non-match detection failure on data overrun (David Howells)  [Orabug: 25059046]  {CVE-2016-2053} 
  - mm: migrate dirty page without clear_page_dirty_for_io etc (Hugh Dickins)  [Orabug: 25059194]  {CVE-2016-3070}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.15.1.el7uek]
changelog:
  - Revert "i40e: Set defport behavior for the Main VSI when in promiscuous mode" (Jack Vogel)  [Orabug: 22683573]  
  - mlx4: avoid multiple free on id_map_ent (Wengang Wang)   
  - xen-netfront: cast grant table reference first to type int (Dongli Zhang)   
  - xen-netfront: do not cast grant table reference to signed short (Dongli Zhang)   
  - RDS: Drop the connection as part of cancel to avoid hangs (Avinash Repaka)  [Orabug: 25045360]  
  - sctp: validate chunk len before actually using it (Marcelo Ricardo Leitner)  [Orabug: 25142879]  {CVE-2016-9555} 
  - mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] (Andrey Ryabinin)  [Orabug: 25154098]  {CVE-2016-8650} {CVE-2016-8650} 
  - aacraid: Check size values after double-fetch from user (Dave Carroll)  [Orabug: 25060050]  {CVE-2016-6480} {CVE-2016-6480} 
  - IB/srpt: Simplify srpt_handle_tsk_mgmt() (Bart Van Assche)  [Orabug: 25060011]  {CVE-2016-6327} 
  - audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore)  [Orabug: 25059945]  {CVE-2016-6136} 
  - ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt (Kangjie Lu)  [Orabug: 25059899]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in events via snd_timer_user_ccallback (Kangjie Lu)  [Orabug: 25059899]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (Kangjie Lu)  [Orabug: 25059753]  {CVE-2016-4569} 
  - acpi: Disable ACPI table override if securelevel is set (Linn Crosetto)  [Orabug: 25058991]  {CVE-2016-3699} 
  - Bluetooth: Fix potential NULL dereference in RFCOMM bind callback (Jaganath Kanakkassery)  [Orabug: 25058903]  {CVE-2015-8956} 
  - ASN.1: Fix non-match detection failure on data overrun (David Howells)  [Orabug: 25059046]  {CVE-2016-2053} 
  - mm: migrate dirty page without clear_page_dirty_for_io etc (Hugh Dickins)  [Orabug: 25059194]  {CVE-2016-3070}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.15.2.el7uek]
changelog:
  - x86/iopl/64: properly context-switch IOPL on Xen PV (Andy Lutomirski)  [Orabug: 25269176]  {CVE-2016-3157} {CVE-2016-3157} 
  - net: Fix use after free in the recvmmsg exit path (Arnaldo Carvalho de Melo)  [Orabug: 25298611]  {CVE-2016-7117}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.15.3.el7uek]
changelog:
  - uek-rpm ol7: change uek-rpm/ol7/update-el release value from 7.1 to 7.3 (Brian Maly)  [Orabug: 25348336]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.16.1.el7uek]
changelog:
  - nvme: Limit command retries (Ashok Vairavan)  [Orabug: 25374794]  
  - tcp: fix use after free in tcp_xmit_retransmit_queue() (Eric Dumazet)  [Orabug: 25374371]  {CVE-2016-6828} 
  - logging errors that get masked to EIO inside drivers/block/loop.c (Manjunath Patil)  [Orabug: 22505535]  
  - ALSA: pcm : Call kill_fasync() in stream lock (Takashi Iwai)  [Orabug: 25203963]  {CVE-2016-9794} 
  - packet: fix race condition in packet_set_ring (Philip Pettersson)  [Orabug: 25217756]  {CVE-2016-8655} 
  - x86: kvmclock: zero initialize pvclock shared memory area (Igor Mammedov)  [Orabug: 25218431]  
  - KEYS: Fix short sprintf buffer in /proc/keys show function (David Howells)  [Orabug: 25306373]  {CVE-2016-7042} 
  - uek-rpm ol7: change uek-rpm/ol7/update-el release value from 7.1 to 7.3 (Brian Maly)  [Orabug: 25348336]  
  - x86/iopl/64: properly context-switch IOPL on Xen PV (Andy Lutomirski)  [Orabug: 25269176]  {CVE-2016-3157} {CVE-2016-3157} 
  - net: Fix use after free in the recvmmsg exit path (Arnaldo Carvalho de Melo)  [Orabug: 25298611]  {CVE-2016-7117}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.16.2.el7uek]
changelog:
  - net: avoid signed overflows for SO_{SND|RCV}BUFFORCE (Eric Dumazet)  [Orabug: 25203623]  {CVE-2016-9793}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.16.3.el7uek]
changelog:
  - crypto: algif_hash - Only export and import on sockets with data (Herbert Xu)  [Orabug: 25417805]  {CVE-2016-8646} 
  - USB: usbfs: fix potential infoleak in devio (Kangjie Lu)  [Orabug: 25462760]  {CVE-2016-4482} 
  - net: fix infoleak in llc (Kangjie Lu)  [Orabug: 25462807]  {CVE-2016-4485} 
  - af_unix: Guard against other == sk in unix_dgram_sendmsg (Rainer Weikusat)  [Orabug: 25463996]  {CVE-2013-7446} 
  - unix: avoid use-after-free in ep_remove_wait_queue (Rainer Weikusat)  [Orabug: 25463996]  {CVE-2013-7446}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.17.1.el7uek]
changelog:
  - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander Popov)  [Orabug: 25696686]  {CVE-2017-2636} 
  - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)  [Orabug: 25696686]  {CVE-2017-2636} 
  - drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc (Fabian Frederick)  [Orabug: 25696686]  {CVE-2017-2636} 
  - x86: bpf_jit: fix compilation of large bpf programs (Alexei Starovoitov)  [Orabug: 21305080]  {CVE-2015-4700} 
  - net: filter: return -EINVAL if BPF_S_ANC* operation is not supported (Daniel Borkmann)  [Orabug: 22187148]  
  - KEYS: request_key() should reget expired keys rather than give EKEYEXPIRED (David Howells)   
  - KEYS: Increase root_maxkeys and root_maxbytes sizes (Steve Dickson)   
  - firewire: net: guard against rx buffer overflows (Stefan Richter)  [Orabug: 25451530]  {CVE-2016-8633} 
  - x86/mm/32: Enable full randomization on i386 and X86_32 (Hector Marco-Gisbert)  [Orabug: 25463927]  {CVE-2016-3672} 
  - x86 get_unmapped_area: Access mmap_legacy_base through mm_struct member (Radu Caragea)  [Orabug: 25463927]  {CVE-2016-3672} 
  - pptp: verify sockaddr_len in pptp_bind() and pptp_connect() (WANG Cong)  [Orabug: 25490335]  {CVE-2015-8569} 
  - sg_start_req(): make sure that there's not too many elements in iovec (Al Viro)  [Orabug: 25490372]  {CVE-2015-5707} 
  - kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) (Jim Mattson)  [Orabug: 25507195]  {CVE-2016-9588} 
  - tcp: take care of truncations done by sk_filter() (Eric Dumazet)  [Orabug: 25507230]  {CVE-2016-8645} 
  - rose: limit sk_filter trim to payload (Willem de Bruijn)  [Orabug: 25507230]  {CVE-2016-8645} 
  - fix minor infoleak in get_user_ex() (Al Viro)  [Orabug: 25507281]  {CVE-2016-9178} 
  - scsi: arcmsr: Simplify user_len checking (Borislav Petkov)  [Orabug: 25507328]  {CVE-2016-7425} 
  - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() (Dan Carpenter)  [Orabug: 25507328]  {CVE-2016-7425} 
  - net: fix a kernel infoleak in x25 module (Kangjie Lu)  [Orabug: 25512413]  {CVE-2016-4580} 
  - USB: digi_acceleport: do sanity checking for the number of ports (Oliver Neukum)  [Orabug: 25512471]  {CVE-2016-3140} 
  - ipv4: keep skb->dst around in presence of IP options (Eric Dumazet)  [Orabug: 25543892]  {CVE-2017-5970} 
  - net/llc: avoid BUG_ON() in skb_orphan() (Eric Dumazet)  [Orabug: 25682430]  {CVE-2017-6345} 
  - dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Andrey Konovalov)   {CVE-2017-6074} 
  - crypto: algif_hash - Only export and import on sockets with data (Herbert Xu)  [Orabug: 25417805]  {CVE-2016-8646} 
  - USB: usbfs: fix potential infoleak in devio (Kangjie Lu)  [Orabug: 25462760]  {CVE-2016-4482} 
  - net: fix infoleak in llc (Kangjie Lu)  [Orabug: 25462807]  {CVE-2016-4485} 
  - af_unix: Guard against other == sk in unix_dgram_sendmsg (Rainer Weikusat)  [Orabug: 25463996]  {CVE-2013-7446} 
  - unix: avoid use-after-free in ep_remove_wait_queue (Rainer Weikusat)  [Orabug: 25463996]  {CVE-2013-7446} 
  - net: avoid signed overflows for SO_{SND|RCV}BUFFORCE (Eric Dumazet)  [Orabug: 25203623]  {CVE-2016-9793}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.17.2.el7uek]
changelog:
  - ipv6: stop sending PTB packets for MTU < 1280 (Hagen Paul Pfeifer)  [Orabug: 25765776]  {CVE-2016-10142} 
  - sg_write()/bsg_write() is not fit to be called under KERNEL_DS (Al Viro)  [Orabug: 25765445]  {CVE-2016-10088} 
  - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter chang)  [Orabug: 25751996]  {CVE-2017-7187}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.17.3.el7uek]
changelog:
  - net: ping: check minimum size on ICMP header length (Kees Cook)  [Orabug: 25766911]  {CVE-2016-8399}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.18.1.el7uek]
changelog:
  - fnic: Update fnic driver version to 1.6.0.24 (John Sobecki)  [Orabug: 24448585]  
  - xen-netfront: Rework the fix for Rx stall during OOM and network stress (Dongli Zhang)  [Orabug: 25450703]  
  - xen-netfront: Fix Rx stall during network stress and OOM (Dongli Zhang)  [Orabug: 25450703]  
  - ipv6: Skip XFRM lookup if dst_entry in socket cache is valid (Jakub Sitnicki)   
  - uek-rpm: enable CONFIG_KSPLICE. (Jamie Iles)  [Orabug: 25549809]  
  - ksplice: add sysctls for determining Ksplice features. (Jamie Iles)  [Orabug: 25549809]  
  - signal: protect SIGNAL_UNKILLABLE from unintentional clearing. (Jamie Iles)  [Orabug: 25549809]  
  - VSOCK: Fix lockdep issue. (Dongli Zhang)  [Orabug: 25559937]  
  - VSOCK: sock_put wasn't safe to call in interrupt context (Dongli Zhang)  [Orabug: 25559937]  
  - IB/CORE: sync the resouce access in fmr_pool (Wengang Wang)  [Orabug: 25677469]  
  - KVM: x86: fix emulation of "MOV SS, null selector" (Paolo Bonzini)  [Orabug: 25719675]  {CVE-2017-2583} {CVE-2017-2583} 
  - ext4: validate s_first_meta_bg at mount time (Eryu Guan)  [Orabug: 25719738]  {CVE-2016-10208} 
  - sctp: avoid BUG_ON on sctp_wait_for_sndbuf (Marcelo Ricardo Leitner)  [Orabug: 25719810]  {CVE-2017-5986} 
  - tcp: avoid infinite loop in tcp_splice_read() (Eric Dumazet)  [Orabug: 25720813]  {CVE-2017-6214} 
  - lpfc cannot establish connection with targets that send PRLI under P2P mode (Joe Jin)  [Orabug: 25759083]  
  - USB: visor: fix null-deref at probe (Johan Hovold)  [Orabug: 25796594]  {CVE-2016-2782} 
  - ipc/shm: Fix shmat mmap nil-page protection (Davidlohr Bueso)  [Orabug: 25797012]  {CVE-2017-5669} 
  - vhost: actually track log eventfd file (Marc-André Lureau)  [Orabug: 25797052]  {CVE-2015-6252} 
  - xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder (Andy Whitcroft)  [Orabug: 25814663]  {CVE-2017-7184} 
  - xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window (Andy Whitcroft)  [Orabug: 25814663]  {CVE-2017-7184} 
  - KEYS: Remove key_type::match in favour of overriding default by match_preparse (Aniket Alshi)  [Orabug: 25823962]  {CVE-2017-2647} {CVE-2017-2647} 
  - USB: whiteheat: fix potential null-deref at probe (Johan Hovold)  [Orabug: 25825105]  {CVE-2015-5257} {CVE-2015-5257} 
  - udf: Check path length when reading symlink (Jan Kara)  [Orabug: 25871102]  {CVE-2015-9731} 
  - udp: properly support MSG_PEEK with truncated buffers (Eric Dumazet)  [Orabug: 25876655]  {CVE-2016-10229} 
  - block: fix use-after-free in seq file (Vegard Nossum)  [Orabug: 25877530]  {CVE-2016-7910} 
  - Revert "fix minor infoleak in get_user_ex()" (Brian Maly)  [Orabug: 25790392]  {CVE-2016-9644} 
  - net: ping: check minimum size on ICMP header length (Kees Cook)  [Orabug: 25766911]  {CVE-2016-8399} 
  - ipv6: stop sending PTB packets for MTU < 1280 (Hagen Paul Pfeifer)  [Orabug: 25765776]  {CVE-2016-10142} 
  - sg_write()/bsg_write() is not fit to be called under KERNEL_DS (Al Viro)  [Orabug: 25765445]  {CVE-2016-10088} 
  - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter chang)  [Orabug: 25751996]  {CVE-2017-7187}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.18.2.el7uek]
changelog:
  - nfsd: stricter decoding of write-like NFSv2/v3 ops (J. Bruce Fields)  [Orabug: 25986990]  {CVE-2017-7895}


