Unbreakable Enterprise Kernel Bug Fix Update

Oracle Linux 6264 Published by

Oracle has released an updated enterprise kernel for both Oracle Linux 6 and 7:

ELBA-2018-4050 Oracle Linux 6 Unbreakable Enterprise kernel bug fix update
ELBA-2018-4050 Oracle Linux 7 Unbreakable Enterprise kernel bug fix update



ELBA-2018-4050 Oracle Linux 6 Unbreakable Enterprise kernel bug fix update

Oracle Linux Bug Fix Advisory ELBA-2018-4050

http://linux.oracle.com/errata/ELBA-2018-4050.html

The following updated rpms for Oracle Linux 6 have been uploaded to the
Unbreakable Linux Network:

x86_64:
kernel-uek-4.1.12-112.16.4.el6uek.x86_64.rpm
kernel-uek-doc-4.1.12-112.16.4.el6uek.noarch.rpm
kernel-uek-firmware-4.1.12-112.16.4.el6uek.noarch.rpm
kernel-uek-devel-4.1.12-112.16.4.el6uek.x86_64.rpm
kernel-uek-debug-4.1.12-112.16.4.el6uek.x86_64.rpm
kernel-uek-debug-devel-4.1.12-112.16.4.el6uek.x86_64.rpm


SRPMS:
http://oss.oracle.com/ol6/SRPMS-updates/kernel-uek-4.1.12-112.16.4.el6uek.src.rpm



Description of changes:

[4.1.12-112.16.4.el6uek]
- scsi: Make __scsi_remove_device go straight from BLOCKED to DEL (Bart
Van Assche) [Orabug: 27339736]
- scsi: Protect SCSI device state changes with a mutex (Bart Van Assche)
[Orabug: 27339736]
- scsi: Introduce scsi_start_queue() (Bart Van Assche) [Orabug: 27339736]
- scsi: avoid a permanent stop of the scsi device's request queue (Wei
Fang) [Orabug: 27339736]
- x86/spectre_v2: Fix cpu offlining with IPBP. (Konrad Rzeszutek Wilk)

[4.1.12-112.16.3.el6uek]
- retpoline: selectively disable IBRS in disable_ibrs_and_friends()
(Chuck Anderson) [Orabug: 27636063]

[4.1.12-112.16.2.el6uek]
- retpoline: move setting of sysctl_ibrs_enabled and sysctl_ibpb_enabled
to where SPEC_CTRL_IBRS_INUSE and SPEC_CTRL_IBPB_INUSE are set (Chuck
Anderson) [Orabug: 27556096]
- retpoline: set IBRS and IBPB in use only on the boot CPU call to
init_scattered_cpuid_features() (Chuck Anderson) [Orabug: 27556096]
- retpoline: display IBPB feature status along with IBRS status (Chuck
Anderson) [Orabug: 27556096]
- retpoline: move lock/unlock of spec_ctrl_mutex to check_modinfo()
(Chuck Anderson) [Orabug: 27556096]
- retpoline: call clear_retpoline_fallback() with boot parm
spectre_v2_heuristics=off (Chuck Anderson) [Orabug: 27556096]
- retpoline: add brackets to check_ibrs_inuse() and clear_ibpb_inuse()
(Chuck Anderson) [Orabug: 27556096]
- retpoline/module: do not enable IBRS/IPBP if
SPEC_CTRL_IBRS_ADMIN_DISABLED/SPEC_CTRL_IBPB_ADMIN_DISABLED is set
(Chuck Anderson) [Orabug: 27547729]
- retpoline: microcode incorrectly reported as broken during early boot
(Chuck Anderson) [Orabug: 27556096]
- retpoline: move lock/unlock of spec_ctrl_mutex into
init_scattered_cpuid_features() (Chuck Anderson) [Orabug: 27556096]
- KVM: Disable irq while unregistering user notifier (Ignacio Alvarado)
- x86/speculation: Use IBRS if available before calling into firmware
(David Woodhouse) [Orabug: 27516479]
- Revert "x86/spec_ctrl: Add 'nolfence' knob to disable fallback for
spectre_v2 mitigation" (Konrad Rzeszutek Wilk) [Orabug: 27601790]
- Revert "x86/spec: Add 'lfence_enabled' in sysfs" (Konrad Rzeszutek Wilk)
- x86/spectre_v2: Fix the documentation to say the right thing. (Konrad
Rzeszutek Wilk)
- x86/spectre_v2: Don't check bad microcode versions when running under
hypervisors. (Konrad Rzeszutek Wilk) [Orabug: 27601735]

[4.1.12-112.16.1.el6uek]
- firmware: dmi_scan: add SBMIOS entry and DMI tables (Ivan Khoronzhuk)
[Orabug: 27045425]
- Btrfs: fix unexpected EEXIST from btrfs_get_extent (Liu Bo) [Orabug:
27033166]
- Btrfs: fix incorrect block_len in merge_extent_mapping (Liu Bo)
[Orabug: 27033166]
- Btrfs: add WARN_ONCE to detect unexpected error from
merge_extent_mapping (Liu Bo) [Orabug: 27033166]
- Btrfs: deal with existing encompassing extent map in
btrfs_get_extent() (Omar Sandoval) [Orabug: 27033166]
- Btrfs: deal with duplciates during extent_map insertion in
btrfs_get_extent (Chris Mason) [Orabug: 27033166]
- net: cdc_ether: fix divide by 0 on bad descriptors (Bjørn Mork)
[Orabug: 27215191] {CVE-2017-16649}
- KVM: x86: pvclock: Handle first-time write to pvclock-page contains
random junk (Liran Alon) [Orabug: 27221679]
- KVM: x86: always fill in vcpu->arch.hv_clock (Paolo Bonzini) [Orabug:
27221679]
- net/mlx4_core: allow QPs with enable_smi_admin enabled (Zhu Yanjun)
[Orabug: 27256720]
- qlcnic: fix deadlock bug (Junxiao Bi) [Orabug: 27337130]
- x86/ia32/syscall: RESTORE_EXTRA_REGS when returning from syscall
(Ankur Arora) [Orabug: 27534437] {CVE-2017-5715}
- x86/ia32/syscall: don't do RESTORE_EXTRA_REGS prematurely (Ankur
Arora) [Orabug: 27534437] {CVE-2017-5715}
- trace: declare blk_add_trace_rq non-static on OL6 (Todd Vierling)
[Orabug: 27578295]

[4.1.12-112.15.1.el6uek]
- x86/spectre: move microcode check before kernel ibrs flags are set
(Daniel Jordan) [Orabug: 27534557] {CVE-2017-5715}
- bonding: attempt to better support longer hw addresses (Jarod Wilson)
[Orabug: 27535442]
- x86: make HAVE_FENTRY dependent on !SIMULATE_GCC44_KABI (Todd
Vierling) [Orabug: 27533590]
- Revert "uek-rpm: configs: remove __stack_chk_fail from kABI list"
(Todd Vierling) [Orabug: 27540429]

[4.1.12-112.14.17.el6uek]
- retpoline/module: fall back to another spectre mitigation when
disabling retpoline (Chuck Anderson) [Orabug: 27457402]
- retpoline/module: add bit defs for use_ibpb (Chuck Anderson) [Orabug:
27457402]
- x86/spectre_v2: Only use IBRS when ibrs_inuse tells us to (Konrad
Rzeszutek Wilk)
- kernel: on OL6 only, simulate the gcc 4.4 kABI for __stack_chk_fail()
(Todd Vierling) [Orabug: 27509404]
- uek-rpm: configs: Don't set HAVE_FENTRY on OL6 builds. (Todd Vierling)
[Orabug: 27509404]

[4.1.12-112.14.16.el6uek]
- x86/spectre_v2: Disable IBRS if spectre_v2=off (Konrad Rzeszutek Wilk)
- KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL (KarimAllah Ahmed)
[Orabug: 27525577]
- x86/spectre_v2: Remove 0xc2 from spectre_bad_microcodes (Darren Kenny)
[Orabug: 27523395]
- x86/speculation: Use Indirect Branch Prediction Barrier in context
switch (Tim Chen) [Orabug: 27524607]
- xenbus: track caller request id (Joao Martins) [Orabug: 27472583]
- uek-rpm: configs: remove __stack_chk_fail from kABI list (Todd Vierling)
- x86/entry: RESTORE_IBRS needs to be done under kernel CR3 (Ankur
Arora) [Orabug: 27501741]
- Fix typo IBRS_ATT, which should be IBRS_ALL (redux) (Konrad Rzeszutek
Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Add spectre_v2_heuristics= (Konrad Rzeszutek Wilk)
[Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Do not disable IBPB when disabling IBRS (Konrad
Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/scattered: Fix the order. (Konrad Rzeszutek Wilk) [Orabug:
27478139] {CVE-2017-5715}
- x86/spectre: Favor IBRS on Skylake over retpoline (Konrad Rzeszutek
Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL (Darren
Kenny) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: Now that we expose 'stbibp' make sure it is correct.
(Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/cpufeatures: Clean up Spectre v2 related CPUID flags (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier)
support (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/bugs: Drop one "mitigation" from dmesg (Borislav Petkov) [Orabug:
27478139] {CVE-2017-5715}
- x86/nospec: Fix header guards names (Borislav Petkov) [Orabug:
27478139] {CVE-2017-5715}
- x86/spectre_v2: Don't spam the console with these: (Konrad Rzeszutek
Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2
microcodes (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/cpu: Keep model defines sorted by model number (Andy Shevchenko)
[Orabug: 27478139] {CVE-2017-5715}
- x86/pti: Do not enable PTI on CPUs which are not vulnerable to
Meltdown (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/msr: Add definitions for new speculation control MSRs (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/cpufeatures: Add AMD feature bits for Speculation Control (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Print what options are available. (Konrad Rzeszutek
Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Add VMEXIT_FILL_RSB instead of RETPOLINE (Konrad
Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: If IBRS is enabled disable "Filling RSB on context
switch" (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- KVM: VMX: Allow direct access to MSR_IA32_SPEC_CTRL (Konrad Rzeszutek
Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Don't allow {ibrs,ipbp,lfence}_enabled to be toggled
if retpoline (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: Fix retpoline_enabled (Konrad Rzeszutek Wilk) [Orabug:
27478139] {CVE-2017-5715}
- x86/spectre: Update sysctl values if toggled only by
set_{ibrs,ibpb}_disabled (Konrad Rzeszutek Wilk) [Orabug: 27478139]
{CVE-2017-5715}
- retpoline/module: Taint kernel for missing retpoline in module (Andi
Kleen) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Fill RSB on context switch for affected CPUs (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Optimize inline assembler for vmexit_fill_RSB (Andi
Kleen) [Orabug: 27478139] {CVE-2017-5715}
- kprobes/x86: Disable optimizing on the function jumps to indirect
thunk (Masami Hiramatsu) [Orabug: 27478139] {CVE-2017-5715}
- kprobes/x86: Blacklist indirect thunk functions for kprobes (Masami
Hiramatsu) [Orabug: 27478139] {CVE-2017-5715}
- retpoline: Introduce start/end markers of indirect thunk (Masami
Hiramatsu) [Orabug: 27478139] {CVE-2017-5715}
- x86/mce: Make machine check speculation protected (Thomas Gleixner)
[Orabug: 27478139] {CVE-2017-5715}
- kbuild: modversions for EXPORT_SYMBOL() for asm (Nicholas Piggin)
[Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros (Tom
Lendacky) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Remove compile time warning (Thomas Gleixner) [Orabug:
27478139] {CVE-2017-5715}
- x86/retpoline: Fill return stack buffer on vmexit (David Woodhouse)
[Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/irq32: Convert assembler indirect jumps (Andi Kleen)
[Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/checksum32: Convert assembler indirect jumps (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/xen: Convert Xen hypercall indirect jumps (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/hyperv: Convert assembler indirect jumps (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/ftrace: Convert ftrace assembler indirect jumps (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/entry: Convert entry assembler indirect jumps (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/crypto: Convert crypto assembler indirect jumps (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Add disable_ibrs_and_friends (Konrad Rzeszutek Wilk)
[Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Figure out if STUFF_RSB macro needs to be used.
(Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Figure out when to use IBRS. (Konrad Rzeszutek Wilk)
[Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: Add IBRS option. (Konrad Rzeszutek Wilk) [Orabug:
27478139] {CVE-2017-5715}
- x86/spectre: Add boot time option to select Spectre v2 mitigation
(David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Add initial retpoline support (David Woodhouse)
[Orabug: 27478139] {CVE-2017-5715}
- kconfig.h: use __is_defined() to check if MODULE is defined (Masahiro
Yamada) [Orabug: 27478139] {CVE-2017-5715}
- EXPORT_SYMBOL() for asm (Al Viro) [Orabug: 27478139] {CVE-2017-5715}
- x86/asm: Make asm/alternative.h safe from assembly (Andy Lutomirski)
[Orabug: 27478139] {CVE-2017-5715}
- x86/kbuild: enable modversions for symbols exported from asm (Adam
Borowski) [Orabug: 27478139] {CVE-2017-5715}
- x86/asm: Use register variable to get stack pointer value (Andrey
Ryabinin) [Orabug: 27478139] {CVE-2017-5715}
- x86/mm/32: Move setup_clear_cpu_cap(X86_FEATURE_PCID) earlier (Andy
Lutomirski) [Orabug: 27478139] {CVE-2017-5715}
- x86/alternatives: Add missing '
' at end of ALTERNATIVE inline asm (David Woodhouse) [Orabug: 27478139]
{CVE-2017-5715}
- x86/alternatives: Fix optimize_nops() checking (Borislav Petkov)
[Orabug: 27478139] {CVE-2017-5715}
- x86/microcode/intel: Extend BDW late-loading with a revision check
(Jia Zhang) [Orabug: 27343573]
- x86/microcode/intel: Disable late loading on model 79 (Borislav
Petkov) [Orabug: 27343573]
- x86/spec: Fix spectre_v1 bug and mitigation indicators (John Haxby)
[Orabug: 27470707]
- x86: Fix compile issues if CONFIG_XEN not defined (Konrad Rzeszutek
Wilk)
- x86/mitigation/spectre_v2: Add reporting of 'lfence' (Konrad Rzeszutek
Wilk)
- x86/spec: Add 'lfence_enabled' in sysfs (Konrad Rzeszutek Wilk)
- x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2
mitigation (Konrad Rzeszutek Wilk)
- x86/IBRS/IBPB: Remove procfs interface to ibrs/ibpb_enable (Boris
Ostrovsky) [Orabug: 27415916]
- x86: Use PRED_CMD MSR when ibpb is enabled (Konrad Rzeszutek Wilk)

ELBA-2018-4050 Oracle Linux 7 Unbreakable Enterprise kernel bug fix update

Oracle Linux Bug Fix Advisory ELBA-2018-4050

http://linux.oracle.com/errata/ELBA-2018-4050.html

The following updated rpms for Oracle Linux 7 have been uploaded to the
Unbreakable Linux Network:

x86_64:
kernel-uek-doc-4.1.12-112.16.4.el7uek.noarch.rpm
kernel-uek-firmware-4.1.12-112.16.4.el7uek.noarch.rpm
kernel-uek-4.1.12-112.16.4.el7uek.x86_64.rpm
kernel-uek-devel-4.1.12-112.16.4.el7uek.x86_64.rpm
kernel-uek-debug-4.1.12-112.16.4.el7uek.x86_64.rpm
kernel-uek-debug-devel-4.1.12-112.16.4.el7uek.x86_64.rpm


SRPMS:
http://oss.oracle.com/ol7/SRPMS-updates/kernel-uek-4.1.12-112.16.4.el7uek.src.rpm



Description of changes:

[4.1.12-112.16.4.el7uek]
- scsi: Make __scsi_remove_device go straight from BLOCKED to DEL (Bart
Van Assche) [Orabug: 27339736]
- scsi: Protect SCSI device state changes with a mutex (Bart Van Assche)
[Orabug: 27339736]
- scsi: Introduce scsi_start_queue() (Bart Van Assche) [Orabug: 27339736]
- scsi: avoid a permanent stop of the scsi device's request queue (Wei
Fang) [Orabug: 27339736]
- x86/spectre_v2: Fix cpu offlining with IPBP. (Konrad Rzeszutek Wilk)

[4.1.12-112.16.3.el7uek]
- retpoline: selectively disable IBRS in disable_ibrs_and_friends()
(Chuck Anderson) [Orabug: 27636063]

[4.1.12-112.16.2.el7uek]
- retpoline: move setting of sysctl_ibrs_enabled and sysctl_ibpb_enabled
to where SPEC_CTRL_IBRS_INUSE and SPEC_CTRL_IBPB_INUSE are set (Chuck
Anderson) [Orabug: 27556096]
- retpoline: set IBRS and IBPB in use only on the boot CPU call to
init_scattered_cpuid_features() (Chuck Anderson) [Orabug: 27556096]
- retpoline: display IBPB feature status along with IBRS status (Chuck
Anderson) [Orabug: 27556096]
- retpoline: move lock/unlock of spec_ctrl_mutex to check_modinfo()
(Chuck Anderson) [Orabug: 27556096]
- retpoline: call clear_retpoline_fallback() with boot parm
spectre_v2_heuristics=off (Chuck Anderson) [Orabug: 27556096]
- retpoline: add brackets to check_ibrs_inuse() and clear_ibpb_inuse()
(Chuck Anderson) [Orabug: 27556096]
- retpoline/module: do not enable IBRS/IPBP if
SPEC_CTRL_IBRS_ADMIN_DISABLED/SPEC_CTRL_IBPB_ADMIN_DISABLED is set
(Chuck Anderson) [Orabug: 27547729]
- retpoline: microcode incorrectly reported as broken during early boot
(Chuck Anderson) [Orabug: 27556096]
- retpoline: move lock/unlock of spec_ctrl_mutex into
init_scattered_cpuid_features() (Chuck Anderson) [Orabug: 27556096]
- KVM: Disable irq while unregistering user notifier (Ignacio Alvarado)
- x86/speculation: Use IBRS if available before calling into firmware
(David Woodhouse) [Orabug: 27516479]
- Revert "x86/spec_ctrl: Add 'nolfence' knob to disable fallback for
spectre_v2 mitigation" (Konrad Rzeszutek Wilk) [Orabug: 27601790]
- Revert "x86/spec: Add 'lfence_enabled' in sysfs" (Konrad Rzeszutek Wilk)
- x86/spectre_v2: Fix the documentation to say the right thing. (Konrad
Rzeszutek Wilk)
- x86/spectre_v2: Don't check bad microcode versions when running under
hypervisors. (Konrad Rzeszutek Wilk) [Orabug: 27601735]

[4.1.12-112.16.1.el7uek]
- firmware: dmi_scan: add SBMIOS entry and DMI tables (Ivan Khoronzhuk)
[Orabug: 27045425]
- Btrfs: fix unexpected EEXIST from btrfs_get_extent (Liu Bo) [Orabug:
27033166]
- Btrfs: fix incorrect block_len in merge_extent_mapping (Liu Bo)
[Orabug: 27033166]
- Btrfs: add WARN_ONCE to detect unexpected error from
merge_extent_mapping (Liu Bo) [Orabug: 27033166]
- Btrfs: deal with existing encompassing extent map in
btrfs_get_extent() (Omar Sandoval) [Orabug: 27033166]
- Btrfs: deal with duplciates during extent_map insertion in
btrfs_get_extent (Chris Mason) [Orabug: 27033166]
- net: cdc_ether: fix divide by 0 on bad descriptors (Bjørn Mork)
[Orabug: 27215191] {CVE-2017-16649}
- KVM: x86: pvclock: Handle first-time write to pvclock-page contains
random junk (Liran Alon) [Orabug: 27221679]
- KVM: x86: always fill in vcpu->arch.hv_clock (Paolo Bonzini) [Orabug:
27221679]
- net/mlx4_core: allow QPs with enable_smi_admin enabled (Zhu Yanjun)
[Orabug: 27256720]
- qlcnic: fix deadlock bug (Junxiao Bi) [Orabug: 27337130]
- x86/ia32/syscall: RESTORE_EXTRA_REGS when returning from syscall
(Ankur Arora) [Orabug: 27534437] {CVE-2017-5715}
- x86/ia32/syscall: don't do RESTORE_EXTRA_REGS prematurely (Ankur
Arora) [Orabug: 27534437] {CVE-2017-5715}
- trace: declare blk_add_trace_rq non-static on OL6 (Todd Vierling)
[Orabug: 27578295]

[4.1.12-112.15.1.el7uek]
- x86/spectre: move microcode check before kernel ibrs flags are set
(Daniel Jordan) [Orabug: 27534557] {CVE-2017-5715}
- bonding: attempt to better support longer hw addresses (Jarod Wilson)
[Orabug: 27535442]
- x86: make HAVE_FENTRY dependent on !SIMULATE_GCC44_KABI (Todd
Vierling) [Orabug: 27533590]
- Revert "uek-rpm: configs: remove __stack_chk_fail from kABI list"
(Todd Vierling) [Orabug: 27540429]

[4.1.12-112.14.17.el7uek]
- retpoline/module: fall back to another spectre mitigation when
disabling retpoline (Chuck Anderson) [Orabug: 27457402]
- retpoline/module: add bit defs for use_ibpb (Chuck Anderson) [Orabug:
27457402]
- x86/spectre_v2: Only use IBRS when ibrs_inuse tells us to (Konrad
Rzeszutek Wilk)
- kernel: on OL6 only, simulate the gcc 4.4 kABI for __stack_chk_fail()
(Todd Vierling) [Orabug: 27509404]
- uek-rpm: configs: Don't set HAVE_FENTRY on OL6 builds. (Todd Vierling)
[Orabug: 27509404]

[4.1.12-112.14.16.el7uek]
- x86/spectre_v2: Disable IBRS if spectre_v2=off (Konrad Rzeszutek Wilk)
- KVM/VMX: Allow direct access to MSR_IA32_SPEC_CTRL (KarimAllah Ahmed)
[Orabug: 27525577]
- x86/spectre_v2: Remove 0xc2 from spectre_bad_microcodes (Darren Kenny)
[Orabug: 27523395]
- x86/speculation: Use Indirect Branch Prediction Barrier in context
switch (Tim Chen) [Orabug: 27524607]
- xenbus: track caller request id (Joao Martins) [Orabug: 27472583]
- uek-rpm: configs: remove __stack_chk_fail from kABI list (Todd Vierling)
- x86/entry: RESTORE_IBRS needs to be done under kernel CR3 (Ankur
Arora) [Orabug: 27501741]
- Fix typo IBRS_ATT, which should be IBRS_ALL (redux) (Konrad Rzeszutek
Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Add spectre_v2_heuristics= (Konrad Rzeszutek Wilk)
[Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Do not disable IBPB when disabling IBRS (Konrad
Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/scattered: Fix the order. (Konrad Rzeszutek Wilk) [Orabug:
27478139] {CVE-2017-5715}
- x86/spectre: Favor IBRS on Skylake over retpoline (Konrad Rzeszutek
Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL (Darren
Kenny) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: Now that we expose 'stbibp' make sure it is correct.
(Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/cpufeatures: Clean up Spectre v2 related CPUID flags (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier)
support (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/bugs: Drop one "mitigation" from dmesg (Borislav Petkov) [Orabug:
27478139] {CVE-2017-5715}
- x86/nospec: Fix header guards names (Borislav Petkov) [Orabug:
27478139] {CVE-2017-5715}
- x86/spectre_v2: Don't spam the console with these: (Konrad Rzeszutek
Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2
microcodes (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/cpu: Keep model defines sorted by model number (Andy Shevchenko)
[Orabug: 27478139] {CVE-2017-5715}
- x86/pti: Do not enable PTI on CPUs which are not vulnerable to
Meltdown (David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/msr: Add definitions for new speculation control MSRs (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/cpufeatures: Add AMD feature bits for Speculation Control (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Print what options are available. (Konrad Rzeszutek
Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Add VMEXIT_FILL_RSB instead of RETPOLINE (Konrad
Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: If IBRS is enabled disable "Filling RSB on context
switch" (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- KVM: VMX: Allow direct access to MSR_IA32_SPEC_CTRL (Konrad Rzeszutek
Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Don't allow {ibrs,ipbp,lfence}_enabled to be toggled
if retpoline (Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: Fix retpoline_enabled (Konrad Rzeszutek Wilk) [Orabug:
27478139] {CVE-2017-5715}
- x86/spectre: Update sysctl values if toggled only by
set_{ibrs,ibpb}_disabled (Konrad Rzeszutek Wilk) [Orabug: 27478139]
{CVE-2017-5715}
- retpoline/module: Taint kernel for missing retpoline in module (Andi
Kleen) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Fill RSB on context switch for affected CPUs (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Optimize inline assembler for vmexit_fill_RSB (Andi
Kleen) [Orabug: 27478139] {CVE-2017-5715}
- kprobes/x86: Disable optimizing on the function jumps to indirect
thunk (Masami Hiramatsu) [Orabug: 27478139] {CVE-2017-5715}
- kprobes/x86: Blacklist indirect thunk functions for kprobes (Masami
Hiramatsu) [Orabug: 27478139] {CVE-2017-5715}
- retpoline: Introduce start/end markers of indirect thunk (Masami
Hiramatsu) [Orabug: 27478139] {CVE-2017-5715}
- x86/mce: Make machine check speculation protected (Thomas Gleixner)
[Orabug: 27478139] {CVE-2017-5715}
- kbuild: modversions for EXPORT_SYMBOL() for asm (Nicholas Piggin)
[Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Add LFENCE to the retpoline/RSB filling RSB macros (Tom
Lendacky) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Remove compile time warning (Thomas Gleixner) [Orabug:
27478139] {CVE-2017-5715}
- x86/retpoline: Fill return stack buffer on vmexit (David Woodhouse)
[Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/irq32: Convert assembler indirect jumps (Andi Kleen)
[Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/checksum32: Convert assembler indirect jumps (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/xen: Convert Xen hypercall indirect jumps (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/hyperv: Convert assembler indirect jumps (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/ftrace: Convert ftrace assembler indirect jumps (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/entry: Convert entry assembler indirect jumps (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline/crypto: Convert crypto assembler indirect jumps (David
Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Add disable_ibrs_and_friends (Konrad Rzeszutek Wilk)
[Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Figure out if STUFF_RSB macro needs to be used.
(Konrad Rzeszutek Wilk) [Orabug: 27478139] {CVE-2017-5715}
- x86/spectre_v2: Figure out when to use IBRS. (Konrad Rzeszutek Wilk)
[Orabug: 27478139] {CVE-2017-5715}
- x86/spectre: Add IBRS option. (Konrad Rzeszutek Wilk) [Orabug:
27478139] {CVE-2017-5715}
- x86/spectre: Add boot time option to select Spectre v2 mitigation
(David Woodhouse) [Orabug: 27478139] {CVE-2017-5715}
- x86/retpoline: Add initial retpoline support (David Woodhouse)
[Orabug: 27478139] {CVE-2017-5715}
- kconfig.h: use __is_defined() to check if MODULE is defined (Masahiro
Yamada) [Orabug: 27478139] {CVE-2017-5715}
- EXPORT_SYMBOL() for asm (Al Viro) [Orabug: 27478139] {CVE-2017-5715}
- x86/asm: Make asm/alternative.h safe from assembly (Andy Lutomirski)
[Orabug: 27478139] {CVE-2017-5715}
- x86/kbuild: enable modversions for symbols exported from asm (Adam
Borowski) [Orabug: 27478139] {CVE-2017-5715}
- x86/asm: Use register variable to get stack pointer value (Andrey
Ryabinin) [Orabug: 27478139] {CVE-2017-5715}
- x86/mm/32: Move setup_clear_cpu_cap(X86_FEATURE_PCID) earlier (Andy
Lutomirski) [Orabug: 27478139] {CVE-2017-5715}
- x86/alternatives: Add missing '
' at end of ALTERNATIVE inline asm (David Woodhouse) [Orabug: 27478139]
{CVE-2017-5715}
- x86/alternatives: Fix optimize_nops() checking (Borislav Petkov)
[Orabug: 27478139] {CVE-2017-5715}
- x86/microcode/intel: Extend BDW late-loading with a revision check
(Jia Zhang) [Orabug: 27343573]
- x86/microcode/intel: Disable late loading on model 79 (Borislav
Petkov) [Orabug: 27343573]
- x86/spec: Fix spectre_v1 bug and mitigation indicators (John Haxby)
[Orabug: 27470707]
- x86: Fix compile issues if CONFIG_XEN not defined (Konrad Rzeszutek
Wilk)
- x86/mitigation/spectre_v2: Add reporting of 'lfence' (Konrad Rzeszutek
Wilk)
- x86/spec: Add 'lfence_enabled' in sysfs (Konrad Rzeszutek Wilk)
- x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2
mitigation (Konrad Rzeszutek Wilk)
- x86/IBRS/IBPB: Remove procfs interface to ibrs/ibpb_enable (Boris
Ostrovsky) [Orabug: 27415916]
- x86: Use PRED_CMD MSR when ibpb is enabled (Konrad Rzeszutek Wilk)

SSSD, Ksh, Mailman and more updates for CentOS 6

Curl/Libvirt Updates for Debian

Windows

Linux

macOS

Community

  • dhamu
    Hello Phil, I have a Linux Tutorial website that curre ...
  • StephanX
    Hi friends, i am new in the Linux universe but i try to ...
  • Philipp
    I would try the XanMod kernel: https://xanmod.org  I ...