suse-sles-15-sp3-chost-byos-v20220103-hvm-ssd-x86

aaa_base

- use autopatch
  - update first two patches from git originals to have the
    same apply depth as the rest:
  - git-01-61c106aac03930e03935172eaf94d92c02a343bd.patch
  - git-02-4e5fe2a6ec5690b51a369d2134a1119962438fd1.patch
  - fix get_kernel_version.c to work also for recent kernels
    on the s390/X platform (bsc#1191563)
  - git-37-dfc5b8af96bec249e44a83d573af1f95a661a85c.patch
  - support xz compressed kernel (bsc#1162581)
  - git-38-4c0060639f6fa854830a708a823976772afe7764.patch
  - Fixing possible resource leak
  - git-39-df622b89bc92fd882a6715c5743095528a643546.patch
  - excluding new kernel string in version search
- Add git-36-16d1cb895c2742e96a56af98111f8281bedd3188.patch:
  * Add $HOME/.local/bin to PATH, if it exists (bsc#1192248)
- Add patch git-34-9a1bc15517d6da56d75182338c0f1bc4518b2b75.patch
  * sysctl.d/50-default.conf:
    allow everybody to create IPPROTO_ICMP sockets (bsc#1174504)
- Add patch git-35-91f496b1f65af29832192bad949685a7bc25da0a.patch
  * sysctl.d/50-default.conf: fix ping_group_range syntax error

apparmor

- fixed requires of python3 module (bsc#1191690).

cpupower

- bsc#1193557 - fixes:
  turbostat(version 20.09.30) started then immediately exit on AMD Zen machines
  A tools-power-turbostat-Fix-turbostat-for-AMD-Zen-CPUs.patch

dracut

- Update to version 049.1+suse.218.gca24e614:
  * fix(iscsi): add iscsi-init.service requirements (bsc#1193512)

glibc

- 0001-s390x-Align-child-stack-while-clone.-BZ-27968.patch,
  0002-S390-Optimize-__memcpy_z196.patch,
  0003-S390-Optimize-__memset_z196.patch,
  0004-S390-Sync-HWCAP-names-with-kernel-by-adding-aliases-.patch,
  0005-S390-Add-new-hwcap-values.patch,
  0006-S390-Add-PCI_MIO-and-SIE-HWCAPs.patch: [15sp4 FEAT] GNU2007 -
  GLIBC: Support for new IBM Z Hardware (bsc#1191592, jsc#IBM-869)

gmp

- Add gmp-6.2.1-CVE-2021-43618.patch to fix buffer overflow on
  malformed input to mpz_inp_raw.  [bsc#1192717, CVE-2021-43618]

grub2

- Fix error lvmid disk cannot be found after second disk added to the root
  volume group (bsc#1189874) (bsc#1071559)
  * 0001-ieee1275-implement-FCP-methods-for-WWPN-and-LUNs.patch
- Fix error /boot/grub2/locale/POSIX.gmo not found (bsc#1189769)
  * 0001-grub-install-Fix-inverted-test-for-NLS-enabled-when-.patch
  * 0001-Filter-out-POSIX-locale-for-translation.patch
- Fix unknown TPM error on buggy uefi firmware (bsc#1191504)
  * 0001-tpm-Pass-unknown-error-as-non-fatal-but-debug-print-.patch
- Fix arm64 kernel image not aligned on 64k boundary (bsc#1192522)
  * 0001-arm64-Fix-EFI-loader-kernel-image-allocation.patch
  * 0002-Arm-check-for-the-PE-magic-for-the-compiled-arch.patch

kernel-default

- config: disable unprivileged BPF by default (jsc#SLE-22573)
  Backport of mainline commit 8a03e56b253e ("/bpf: Disallow unprivileged bpf
  by default"/) only changes kconfig default, used e.g. for "/make oldconfig"/
  when the config option is missing, but does not update our kernel configs
  used for build. Update also these to make sure unprivileged BPF is really
  disabled by default.
- commit 9a413cc
- Input: elantench - fix misreporting trackpoint coordinates
  (bsc#1192918).
- commit af3fd37
- mm/hugetlb: initialize hugetlb_usage in mm_init (bsc#1192906).
- commit 4bfee1a
- blacklist.conf: Add 04f8ef5643bc cgroup: Fix memory leak caused by missing cgroup_bpf_offline
- commit d046894
- fix patch metadata
- fix Patch-mainline:
  - patches.suse/btrfs-fix-memory-ordering-between-normal-and-ordered-work-functions.patch
- commit 7ca7de6
- fix patches metadata
- fix Patch-mainline:
  - patches.suse/scsi-core-Fix-spelling-in-a-source-code-comment
  - patches.suse/scsi-csiostor-Uninitialized-data-in-csio_ln_vnp_read_cbfn
  - patches.suse/scsi-dc395-Fix-error-case-unwinding
  - patches.suse/scsi-ufs-ufshcd-pltfrm-Fix-memory-leak-due-to-probe-defer
- commit 2c768e7
- btrfs: update comments for chunk allocation -ENOSPC cases
  (bsc#1192896).
- btrfs: fix deadlock between chunk allocation and chunk btree
  modifications (bsc#1192896).
- btrfs: block-group: Rework documentation of check_system_chunk
  function (bsc#1192896).
- commit 20b2047
- fix patches metadata
- fix Patch-mainline:
  - patches.suse/ipv4-make-exception-cache-less-predictible.patch
  - patches.suse/ipv6-make-exception-cache-less-predictible.patch
  - patches.suse/qtnfmac-fix-potential-spectre-vulnerabilities.patch
- commit 5c2e4e8
- fix patches metadata
- fix Patch-mainline:
  - patches.suse/edac-sb_edac-fix-top-of-high-memory-value-for-broadwell-haswell.patch
  - patches.suse/x86-sme-use-define-use_early_pgtable_l5-in-mem_encrypt_identity-c.patch
- commit fd7ddeb
- blacklist.conf: Add 8520e224f547 bpf, cgroups: Fix cgroup v2 fallback on v1/v2 mixed mode
- commit 04918fc
- btrfs: fix memory ordering between normal and ordered work functions (git-fixes).
- commit 2b13f6d
- blacklist.conf: 5c9d706f6133 ("/bpf: Fix BPF_LSM kconfig symbol dependency"/)
  Not needed since 30897832d8b9 ("/bpf: Allow local storage to be used from LSM
  programs"/) is not backported.
- commit 22dfc3c
- Eradicate Patch-mainline: No
  The pre-commit check can reject this deprecated tag then.
- Refresh patches.suse/acpi_thinkpad_introduce_acpi_root_table_boot_param.patch.
- Refresh patches.suse/btrfs-provide-super_operations-get_inode_dev.
- commit e877505
- ARM: socfpga: Fix crash with CONFIG_FORTIRY_SOURCE
  (bsc#1192473).
- commit b39e9ef
- Update
  patches.suse/bpf-Remove-MTU-check-in-__bpf_skb_max_len.patch
  (bsc#1155518 bsc#1192045 CVE-2021-0941).
- commit 5daf798
- Update
  patches.suse/bpf-Remove-MTU-check-in-__bpf_skb_max_len.patch
  (bsc#1155518 bsc#1192045 CVE-2021-0941).
- commit 33fb6b6
- drm: prevent spectre issue in vmw_execbuf_ioctl (bsc#1192802).
- qtnfmac: fix potential Spectre vulnerabilities (bsc#1192802).
- commit 5952a38
- drm/i915: Introduce intel_hpd_hotplug_irqs() (bsc#1192758).
- commit 29d7f7a
- Update config files: pull BPF configs together
- commit 86a3134
- bpf: Disallow unprivileged bpf by default (jsc#SLE-22573).
- bpf: Add kconfig knob for disabling unpriv bpf
  by default (jsc#SLE-22573)
- Update config files: Add
  CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set
- commit cb7628d
- dm ioctl: fix out of bounds array access when no devices
  (CVE-2021-31916 bsc#1192781).
- commit 49351dc
- bpf: Disallow unprivileged bpf by default (jsc#SLE-22574).
- commit 7b9dddf
- bpf: Fix BPF_JIT kconfig symbol dependency
  (git-fixes jsc#SLE-22574).
- bpf: Add kconfig knob for disabling unpriv bpf
  by default (jsc#SLE-22574)
- Update config files: Add
  CONFIG_BPF_UNPRIV_DEFAULT_OFF is not set
- bpf, kconfig: Add consolidated menu entry for bpf with core
  options (jsc#SLE-22574).
- commit 5bd323f
- patches.suse/zram-replace-fsync_bdev-with-sync_blockdev.patch: (bsc#1170269).
- commit 75a41c2
- patches.suse/zram-avoid-race-between-zram_remove-and-disksize_sto.patch: (bsc#1170269).
- commit 406dc3d
- patches.suse/zram-don-t-fail-to-remove-zram-during-unloading-modu.patch: (bsc#1170269).
- commit cb34e92
- patches.suse/zram-fix-race-between-zram_reset_device-and-disksize.patch: (bsc#1170269).
- commit 09f1f4d
- patches.suse/zram-replace-fsync_bdev-with-sync_blockdev.patch: (bsc#1170269).
- commit 6a0e897
- patches.suse/zram-avoid-race-between-zram_remove-and-disksize_sto.patch: (bsc#1170269).
- commit 2c18cb4
- patches.suse/zram-don-t-fail-to-remove-zram-during-unloading-modu.patch: (bsc#1170269).
- commit 913e901
- patches.suse/zram-fix-race-between-zram_reset_device-and-disksize.patch: (bsc#1170269).
- commit 173dc9b
- blacklist.conf: printk/workqueue: very hard to hit; works well with lockless
  ringuffer; but it might cause wrong timestamps or even lost messages
  on 5.3 where using par-CPU buffers (bsc#1192750)
- commit 63c8c7f
- printk/console: Allow to disable console output by using
  console="/"/ or console=null (bsc#1192753).
- commit 4f99186
- printk: handle blank console arguments passed in (bsc#1192753).
- commit db08758
- ALSA: hda: fix general protection fault in azx_runtime_idle
  (git-fixes).
- ALSA: hda: Free card instance properly at probe errors
  (git-fixes).
- commit 57f0538
- ALSA: usb-audio: Fix dB level of Bose Revolve+ SoundLink
  (bsc#1192375).
- ALSA: usb-audio: Add minimal-mute notion in dB mapping table
  (bsc#1192375).
- ALSA: usb-audio: Use int for dB map values (bsc#1192375).
- commit 561c434
- Move upstreamed sound fix into sorted section
- commit b52485e
- net: mscc: ocelot: warn when a PTP IRQ is raised for an unknown
  skb (git-fixes).
- gpio: mpc8xxx: Use 'devm_gpiochip_add_data()' to simplify the
  code and avoid a leak (git-fixes).
- stmmac: platform: Fix signedness bug in stmmac_probe_config_dt()
  (git-fixes).
- net: dsa: felix: re-enable TX flow control in
  ocelot_port_flush() (git-fixes).
- net: mscc: ocelot: fix hardware timestamp dequeue logic.
- commit 4fdc3dd
- tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and
  docker together (bsc#1192745).
- commit bc3e5c2
- blacklist.conf: add mscc driver fixes
- commit 109b7ec
- kernel-*-subpackage: Add dependency on kernel scriptlets (bsc#1192740).
- commit a133bf4
- random: fix crash on multiple early calls to add_bootloader_randomness() (bsc#1184924)
- commit d4705fe
- blacklist.conf: changes device names, kABI massacre
- commit 68b0003
- fuse: fix page stealing (bsc#1192718).
- commit 5c46aef
- ipv4: make exception cache less predictible (bsc#1191790,
  CVE-2021-20322).
- ipv6: make exception cache less predictible (bsc#1191790,
  CVE-2021-20322).
- ipv4: use siphash instead of Jenkins in fnhe_hashfun()
  (bsc#1191790, CVE-2021-20322).
- ipv6: use siphash in rt6_exception_hash() (bsc#1191790,
  CVE-2021-20322).
- commit 191e9b3
- Revert "/x86/kvm: fix vcpu-id indexed array sizes"/ (git-fixes).
- commit 918d1fd
- Delete patches.kabi/kabi-fix-after-kvm-vcpu-id-array-fix.patch, as
  the patch causing its introduction is being reverted.
- commit 2e03b9d
- x86/xen: Mark cpu_bringup_and_idle() as dead_end_function
  (git-fixes).
- commit bb35029
- xen-pciback: Fix return in pm_ctrl_init() (git-fixes).
- commit 94628c1
- xen: Fix implicit type conversion (git-fixes).
- commit 89e345e
- x86/sme: Use #define USE_EARLY_PGTABLE_L5 in
  mem_encrypt_identity.c (bsc#1152489).
- commit 60c8f9c
- scsi: ufs: ufshcd-pltfrm: Fix memory leak due to probe defer
  (git-fixes).
- scsi: csiostor: Uninitialized data in csio_ln_vnp_read_cbfn()
  (git-fixes).
- scsi: core: Fix spelling in a source code comment (git-fixes).
- scsi: dc395: Fix error case unwinding (git-fixes).
- scsi: qla2xxx: Fix a memory leak in an error path of
  qla2x00_process_els() (git-fixes).
- scsi: csiostor: Add module softdep on cxgb4 (git-fixes).
- scsi: qedf: Fix error codes in qedf_alloc_global_queues()
  (git-fixes).
- scsi: qedi: Fix error codes in qedi_alloc_global_queues()
  (git-fixes).
- scsi: smartpqi: Fix an error code in pqi_get_raid_map()
  (git-fixes).
- scsi: fdomain: Fix error return code in fdomain_probe()
  (git-fixes).
- scsi: BusLogic: Fix missing pr_cont() use (git-fixes).
- scsi: iscsi: Fix iface sysfs attr detection (git-fixes).
- scsi: be2iscsi: Fix an error handling path in
  beiscsi_dev_probe() (git-fixes).
- scsi: mpt3sas: Fix error return value in _scsih_expander_add()
  (git-fixes).
- scsi: FlashPoint: Rename si_flags field (git-fixes).
- scsi: snic: Fix an error message (git-fixes).
- scsi: libsas: Use _safe() loop in sas_resume_port() (git-fixes).
- scsi: qedf: Add pointer checks in qedf_update_link_speed()
  (git-fixes).
- Revert "/scsi: ufs: fix a missing check of
  devm_reset_control_get"/ (git-fixes).
- scsi: ufs-pci: Add quirk for broken auto-hibernate for Intel
  EHL (git-fixes).
- scsi: qla2xxx: Make sure that aborted commands are freed
  (git-fixes).
- commit c10ecb2
- EDAC/sb_edac: Fix top-of-high-memory value for Broadwell/Haswell
  (bsc#1152489).
- commit e920f56
- s390/qeth: fix deadlock during failing recovery (git-fixes).
- s390/qeth: Fix deadlock in remove_discipline (git-fixes).
- s390/qeth: fix NULL deref in qeth_clear_working_pool_list()
  (git-fixes).
- commit 8d9df1e
- s390/pci: fix zpci_zdev_put() on reserve (git-fixes).
- commit 5f2d7a4
- net/smc: fix 'workqueue leaked lock' in smc_conn_abort_work
  (git-fixes).
- s390/pci: fix use after free of zpci_dev (git-fixes).
- net/smc: Correct smc link connection counter in case of smc
  client (git-fixes).
- s390/dasd: fix use after free in dasd path handling (git-fixes).
- s390/topology: clear thread/group maps for offline cpus
  (git-fixes).
- commit 4287499
- Fix problem with missing installkernel on Tumbleweed.
- commit 2ed6686
- ibmvnic: Process crqs after enabling interrupts (bsc#1192273
  ltc#194629).
- ibmvnic: don't stop queue in xmit (bsc#1192273 ltc#194629).
- commit 99d6daa
- Revert "/ibmvnic: check failover_pending in login response"/
  (bsc#1190523 ltc#194510).
- ibmvnic: check failover_pending in login response (bsc#1190523
  ltc#194510).
- commit ac4c874
- Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails
  (bsc#1191961 CVE-2021-34981).
- commit a4ff591
- Revert "/r8152: adjust the settings about MAC clock speed down
  for RTL8153"/ (git-fixes).
- commit 541bc3e
- r8152: don't enable U1U2 with USB_SPEED_HIGH for RTL8153B
  (git-fixes).
- commit e20d73d
- r8152: Disable PLA MCU clock speed down (git-fixes).
- Refresh patches.suse/r8152-disable-test-IO-for-RTL8153B.patch.
- commit 9b878a2
- r8152: disable U2P3 for RTL8153B (git-fixes).
- commit d6c58f7
- r8152: reset flow control patch when linking on for RTL8153B
  (git-fixes).
- commit 7f46ee2
- r8152: fix runtime resume for linking change (git-fixes).
- commit 0ff2979
- r8152: Add macpassthru support for ThinkPad Thunderbolt 3 Dock
  Gen 2 (git-fixes).
- commit d73c455
- r8152: add a helper function about setting EEE (git-fixes).
- commit 5f95fd2
- r8152: divide the tx and rx bottom functions (git-fixes).
- Refresh
  patches.suse/r8152-Re-order-napi_disable-in-rtl8152_close.patch.
- Refresh
  patches.suse/r8152-avoid-to-call-napi_disable-twice.patch.
- commit 248b976
- r8152: saving the settings of EEE (git-fixes).
- commit 7c0dac3
- r8152: use alloc_pages for rx buffer (git-fixes).
- commit 3304002
- r8152: replace array with linking list for rx information
  (git-fixes).
- commit b5a7bd7
- r8152: separate the rx buffer size (git-fixes).
- commit 4176c6f
- rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM
  request (git-fixes).
- commit 3af49ca
- crypto: qat - disregard spurious PFVF interrupts (git-fixes).
- commit 11f64ca
- crypto: qat - detect PFVF collision after ACK (git-fixes).
- commit fa10b1f
- crypto: caam - disable pkc for non-E SoCs (git-fixes).
- commit 49a0bf8
- blacklist.conf: build warning only
- commit 389a467
- bpf: Fix potential race in tail call compatibility check
  (git-fixes).
- commit 6fdd9c7
- cgroup/cpuset: Change references of cpuset_mutex to cpuset_rwsem (git-fixes).
- commit c3f4c78
- exfat: handle wrong stream entry size in exfat_readdir()
  (git-fixes).
- exfat: fix erroneous discard when clear cluster bit
  (git-fixes).
- commit 366e900
- exfat: truncate atimes to 2s granularity  (bsc#1192328).
- Refresh
  patches.suse/exfat-fix-use-of-uninitialized-spinlock-on-error-path.patch.
- exfat: properly set s_time_gran  (bsc#1192328).
- commit 832525a
- Drop two USB patches that are reverted by stable 5.4.158
  Deleted:
  patches.suse/usb-core-hcd-Add-support-for-deferring-roothub-regis.patch
  patches.suse/xhci-Set-HCD-flag-to-defer-primary-roothub-registrat.patch
  blacklist.conf: updated
- commit 10f1374
- serial: xilinx_uartps: Fix race condition causing stuck TX
  (git-fixes).
- serial: 8250_dw: Drop wrong use of ACPI_PTR() (git-fixes).
- staging: rtl8192u: fix control-message timeouts (git-fixes).
- USB: serial: keyspan: fix memleak on probe errors (git-fixes).
- USB: iowarrior: fix control-message timeouts (git-fixes).
- usb: musb: Balance list entry in musb_gadget_queue (git-fixes).
- usb: max-3421: Use driver data instead of maintaining a list
  of bound devices (git-fixes).
- usb: gadget: hid: fix error code in do_config() (git-fixes).
- commit b954450
- power: supply: bq27xxx: Fix kernel crash on IRQ handler register
  error (git-fixes).
- power: supply: max17042_battery: Prevent int underflow in
  set_soc_threshold (git-fixes).
- =?UTF-8?q?power:=20supply:=20rt5033=5Fbattery:=20Change?=
  =?UTF-8?q?=20voltage=20values=20to=20=C2=B5V?= (git-fixes).
- power: supply: max17042_battery: use VFSOC for capacity when
  no rsns (git-fixes).
- iio: dac: ad5446: Fix ad5622_write() return value (git-fixes).
- staging: r8712u: fix control-message timeout (git-fixes).
- Revert "/platform/x86: i2c-multi-instantiate: Don't create
  platform device for INT3515 ACPI nodes"/ (git-fixes).
- commit 0f3a4f1
- PCI: uniphier: Serialize INTx masking/unmasking and fix the
  bit operation (git-fixes).
- PCI: aardvark: Read all 16-bits from PCIE_MSI_PAYLOAD_REG
  (git-fixes).
- PCI: aardvark: Fix return value of MSI domain .alloc() method
  (git-fixes).
- PCI: pci-bridge-emul: Fix emulation of W1C bits (git-fixes).
- HID: u2fzero: properly handle timeouts in usb_submit_urb
  (git-fixes).
- HID: u2fzero: clarify error check and length calculations
  (git-fixes).
- pinctrl: core: fix possible memory leak in pinctrl_enable()
  (git-fixes).
- video: fbdev: chipsfb: use memset_io() instead of memset()
  (git-fixes).
- ABI: sysfs-kernel-slab: Document some stats (git-fixes).
- commit 92991a1
- auxdisplay: ht16k33: Fix frame buffer device blanking
  (git-fixes).
- auxdisplay: ht16k33: Connect backlight to fbdev (git-fixes).
- auxdisplay: img-ascii-lcd: Fix lock-up when displaying empty
  string (git-fixes).
- PCI: aardvark: Fix reporting Data Link Layer Link Active
  (git-fixes).
- PCI: aardvark: Fix checking for link up via LTSSM state
  (git-fixes).
- PCI: aardvark: Do not unmask unused interrupts (git-fixes).
- PCI: aardvark: Do not clear status bits of masked interrupts
  (git-fixes).
- PCI: aardvark: Don't spam about PIO Response Status (git-fixes).
- commit 3e5c258
- ALSA: usb-audio: Add Audient iD14 to mixer map quirk table
  (git-fixes).
- ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table
  (git-fixes).
- commit b23c22d
- ocfs2: do not zero pages beyond i_size (bsc#1190795).
- commit 5f3b3d8
- ocfs2: fix data corruption on truncate (bsc#1190795).
- commit 4b0d91a
- PCI/ACPI: Check for _OSC support in acpi_pci_osc_control_set()
  (bsc#1169263).
- PCI/ACPI: Move _OSC query checks to separate function
  (bsc#1169263).
- PCI/ACPI: Move supported and control calculations to separate
  functions (bsc#1169263).
- PCI/ACPI: Remove OSC_PCI_SUPPORT_MASKS and OSC_PCI_CONTROL_MASKS
  (bsc#1169263).
- PCI/ACPI: Clarify message about _OSC failure (bsc#1169263).
- PCI/ACPI: Remove unnecessary osc_lock (bsc#1169263).
- commit a38114a
- gpio/rockchip: fetch deferred output settings on probe
  (bsc#1192217).
- pinctrl/rockchip: add a queue for deferred pin output settings
  on probe (bsc#1192217).
- gpio/rockchip: fix get_direction value handling (bsc#1192217).
- gpio/rockchip: extended debounce support is only available on v2
  (bsc#1192217).
- pinctrl/rockchip: drop the gpio related codes (bsc#1192217).
- gpio/rockchip: drop irq_gc_lock/irq_gc_unlock for irq set type
  (bsc#1192217).
- gpio/rockchip: support next version gpio controller
  (bsc#1192217).
- gpio/rockchip: use struct rockchip_gpio_regs for gpio controller
  (bsc#1192217).
- gpio/rockchip: add driver for rockchip gpio (bsc#1192217).
- pinctrl/rockchip: add pinctrl device to gpio bank struct
  (bsc#1192217).
- pinctrl/rockchip: separate struct rockchip_pin_bank to a head
  file (bsc#1192217).
- pinctrl/rockchip: always enable clock for gpio controller
  (bsc#1192217).
- pinctrl: rockchip: do coding style for mux route struct
  (bsc#1192217).
- pinctrl: rockchip: add support for rk3568 (bsc#1192217).
- pinctrl: rockchip: make driver be tristate module (bsc#1192217).
- pinctrl: rockchip: clear int status when driver probed
  (bsc#1192217).
- pinctrl: rockchip: create irq mapping in gpio_to_irq
  (bsc#1192217).
- pinctrl: rockchip: enable gpio pclk for rockchip_gpio_to_irq
  (bsc#1192217).
- pinctrl: rockchip: Replace HTTP links with HTTPS ones
  (bsc#1192217).
- pinctrl: pinctrl-rockchip: Fix a bunch of kerneldoc
  misdemeanours (bsc#1192217).
- pinctrl: rockchip: return ENOMEM instead of EINVAL if allocation
  fails (bsc#1192217).
- pinctrl: rockchip: add rk3308 SoC support (bsc#1192217).
- commit de4b584

keyutils

- Add /etc/keys/ and /usr/etc/keys/ directory (bsc#1187654)
- update to 1.6.3:
  * Revert the change notifications that were using /dev/watch_queue.
  * Apply the change notifications that use pipe2(O_NOTIFICATION_PIPE).
  * Allow "/keyctl supports"/ to retrieve raw capability data.
  * Allow "/keyctl id"/ to turn a symbolic key ID into a numeric ID.
  * Allow "/keyctl new_session"/ to name the keyring.
  * Allow "/keyctl add/padd/etc."/ to take hex-encoded data.
  * Add "/keyctl watch*"/ to expose kernel change notifications on keys.
  * Add caps for namespacing and notifications.
  * Set a default TTL on keys that upcall for name resolution.
  * Explicitly clear memory after it's held sensitive information.
  * Various manual page fixes.
  * Fix C++-related errors.
  * Add support for keyctl_move().
  * Add support for keyctl_capabilities().
  * Make key=val list optional for various public-key ops.
  * Fix system call signature for KEYCTL_PKEY_QUERY.
  * Fix 'keyctl pkey_query' argument passing.
  * Use keyctl_read_alloc() in dump_key_tree_aux().
  * Various manual page fixes.
- spec-cleaner run (fixup failing homepage url)
- prepare usrmerge (boo#1029961)
- updated to 1.6
  - Apply various specfile cleanups from Fedora.
  - request-key: Provide a command line option to suppress helper execution.
  - request-key: Find least-wildcard match rather than first match.
  - Remove the dependency on MIT Kerberos.
  - Fix some error messages
  - keyctl_dh_compute.3: Suggest /proc/crypto for list of available hashes.
  - Fix doc and comment typos.
  - Add public key ops for encrypt, decrypt, sign and verify (needs linux-4.20).
  - Add pkg-config support for finding libkeyutils.
- upstream isn't offering PGP signatures for the source tarballs anymore
- Replace krb5-devel BuildRequires with pkgconfig(krb5): Allow OBS
  to shortcut the ring0 bootstrap cycle by also using krb5-mini.
- add upstream signing key and verify source signature
- updated to 1.5.11 (bsc#1113013)
  - Add keyring restriction support.
  - Add KDF support to the Diffie-Helman function.
  - DNS: Add support for AFS config files and SRV records

kmod

- Ensure that kmod and packages linking to libkmod provide same features
  (bsc#1193430).

libgcrypt

- FIPS: Fix gcry_mpi_sub_ui subtraction [bsc#1193480]
  * gcry_mpi_sub_ui: fix subtracting from negative value
  * Add libgcrypt-FIPS-fix-gcry_mpi_sub_ui.patch

lvm2

- starting with 12SP4 lvconvert no longer takes stripes option (bsc#1183905)
  + bug-1183905_lvconvert-allow-stripes-stripesize-in-mirror-convers.patch
- LVM vgimportclone on hardware snapshot does not work (bsc#1193181)
  + bug-1193181_vgimportclone_on_hardware_snapshot_does_not_work.patch

mozilla-nss

- Mozilla NSS 3.68.1
  MFSA 2021-51 (bsc#1193170)
  * CVE-2021-43527 (bmo#1737470)
    Memory corruption via DER-encoded DSA and RSA-PSS signatures
- Remove now obsolete patch nss-bsc1193170.patch
- Add patch to fix CVE-2021-43527 (bsc#1193170):
  nss-bsc1193170.patch

openssh

- Add openssh-CVE-2021-28041-agent-double-free.patch (bsc#1183137,
  CVE-2021-28041), from upstream.
- Add openssh-bsc1190975-CVE-2021-41617-authorizedkeyscommand.patch
  (bsc#1190975, CVE-2021-41617), backported from upstream by
  Ali Abdallah.

openssl-1_1

- Previously added patch interferes with FIPS validation.
  * Removed openssl-1.1.1-fips_list_ciphers.patch

p11-kit

- 0001-common-Use-reallocarray-instead-of-realloc-as-approp.patch
  0001-Check-for-arithmetic-overflows-before-allocating.patch
  0001-Follow-up-to-arithmetic-overflow-fix.patch:
  Fixed multiple integer overflows in rpc code (bsc#1180064
  CVE-2020-29361)
- Add support for CKA_NSS_{SERVER,EMAIL}_DISTRUST_AFTER (bsc#1187993,
  0001-trust-Support-CKA_NSS_-SERVER-EMAIL-_DISTRUST_AFTER.patch)
- add bcond to spec file to enable debug easily

permissions

  * drop ping capabilities in favor of ICMP_PROTO sockets (bsc#1174504)
- Update to version 20181225:

python-Babel

- Add CVE-2021-42771-rel-path-traversal.patch fixing
  CVE-2021-42771 by cleaning locale identifiers before loading
  from file (bsc#1185768).

python3

- The previous construct works only on the current Factory, not
  in SLE.
- BuildRequire rpm-build-python: The provider to inject python(abi)
  has been moved there. rpm-build pulls rpm-build-python
  automatically in when building anything against python3-base, but
  this implies that the initial build of python3-base does not
  trigger the automatic installation.
- Due to conflicting demands of bsc#1183858 and platforms where
  Python 3.6 is only in interpreter+pip set we have to make
  complicated ugly construct about Sphinx BR.
- Make python36 primary interpreter on SLE-15
- Make build working even on older SLEs.
- Update to 3.6.15:
  - bpo-43124: Made the internal putcmd function in smtplib
    sanitize input for presence of r and n characters to avoid
    (unlikely) command injection. Library
  - bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header. Patch
    by Wouter Bolsterlee. Tests
  - bpo-38965: Fix test_faulthandler on GCC 10. Use the
    “volatile” keyword in faulthandler._stack_overflow() to
    prevent tail call optimization on any compiler, rather than
    relying on compiler specific pragma.
- Remove upstreamed patches:
  - faulthandler_stack_overflow_on_GCC10.patch
- test_faulthandler is still problematic under qemu linux-user emulation,
  disable it there
- Update to 3.6.14:
  * Security
  - bpo-44022 (bsc#1189241, CVE-2021-3737): mod:http.client now
    avoids infinitely reading potential HTTP headers after
    a 100 Continue status response from the server.
  - bpo-43882: The presence of newline or tab characters in parts
    of a URL could allow some forms of attacks.
    Following the controlling specification for URLs defined by
    WHATWG urllib.parse() now removes ASCII newlines and tabs
    from URLs, preventing such attacks.
  - bpo-42988 (CVE-2021-3426, bsc#1183374): Remove the getfile feature
    of the pydoc module which could be abused to read arbitrary files
    on the disk (directory traversal vulnerability). Moreover, even
    source code of Python modules can contain sensitive data like
    passwords. Vulnerability reported by David Schwörer.
  - bpo-43285: ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    Code that requires the former vulnerable behavior may set a
    trust_server_pasv_ipv4_address attribute on their ftplib.FTP
    instances to True to re-enable it.
  - bpo-43075 (CVE-2021-3733, bsc#1189287): Fix Regular Expression
    Denial of Service (ReDoS) vulnerability in
    urllib.request.AbstractBasicAuthHandler. The ReDoS-vulnerable
    regex has quadratic worst-case complexity and it allows cause
    a denial of service when identifying crafted invalid RFCs. This
    ReDoS issue is on the client side and needs remote attackers to
    control the HTTP server.
- Upstreamed patches were removed:
  - CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Refreshed patches:
  - python3-sorted_tar.patch
  - riscv64-ctypes.patch
- Use versioned python-Sphinx to avoid dependency on other
  version of Python (bsc#1183858).
- Modify Lib/ensurepip/__init__.py to contain the same version
  numbers as are in reality the ones in the bundled wheels
  (bsc#1187668).
- add 22198.patch to build with Sphinx 4
- Stop providing "/python"/ symbol (bsc#1185588), which means
  python2 currently.
- (bsc#1180125) We really don't Require python-rpm-macros package.
  Unnecessary dependency.

runc

- Update to runc v1.0.3. Upstream changelog is available from
  https://github.com/opencontainers/runc/releases/tag/v1.0.3. CVE-2021-43784
  (bsc#1193436)
  * A potential vulnerability was discovered in runc (related to an internal
    usage of netlink), however upon further investigation we discovered that
    while this bug was exploitable on the master branch of runc, no released
    version of runc could be exploited using this bug. The exploit required
    being able to create a netlink attribute with a length that would overflow a
    uint16 but this was not possible in any released version of runc. For more
    information see GHSA-v95c-p5hm-xq8f and CVE-2021-43784.
    Due to an abundance of caution we decided to do an emergency release with
    this fix, but to reiterate we do not believe this vulnerability was
    possible to exploit. Thanks to Felix Wilhelm from Google Project Zero for
    discovering and reporting this vulnerability so quickly.
  * Fixed inability to start a container with read-write bind mount of a
    read-only fuse host mount.
  * Fixed inability to start when read-only /dev in set in spec.
  * Fixed not removing sub-cgroups upon container delete, when rootless cgroup
    v2 is used with older systemd.
  * Fixed returning error from GetStats when hugetlb is unsupported (which
    causes excessive logging for kubernetes).

samba

- The username map [script] advice from CVE-2020-25717 advisory
  note has undesired side effects for the local nt token. Fallback
  to a SID/UID based mapping if the name based lookup fails;
  (bsc#1192849); (bso#14901).

suse-module-tools

- Update to version 15.3.15:
  * blacklist isst_if_mbox_msr (bsc#1187196)

system-users

- system-user-tss.conf: Remove group entry, not needed and did
  contain syntax errors (bsc#1190401).

systemd

* 60-io-scheduler.rules: add rules for virtual devices
    (boo#1193759)
  * 60-io-scheduler.rules: enforce "/none"/ for loop devices
    (boo#1193759)
- Import commit 34eba0c28cb02d15fdbf55ce28bdfa56142ae4d1
  0a8cb60af6 Bump the max number of inodes for /dev to a million (bsc#1192858)
  848c9207cb Bump the max number of inodes for /dev to 128k (bsc#1192858)
  ea44eb34f2 sleep: don't skip resume device with low priority/available space (bsc#1192423)
  9325a68316 test: use kbd-mode-map we ship in one more test case
  8ff379e11d test-keymap-util: always use kbd-model-map we ship

timezone

- timezone update 2021e (bsc#1177460):
  * Palestine will fall back 10-29 (not 10-30) at 01:00
- timezone update 2021d:
  * Fiji suspends DST for the 2021/2022 season
  * 'zic -r' marks unspecified timestamps with "/-00"/
- timezone update 2021c:
  * Revert almost all of 2021b's changes to the 'backward' file
  * Fix a bug in 'zic -b fat' that caused old timestamps to be
    mishandled in 32-bit-only readers
- timezone update 2021b:
  * Jordan now starts DST on February's last Thursday.
  * Samoa no longer observes DST.
  * Move some backward-compatibility links to 'backward'.
  * Rename Pacific/Enderbury to Pacific/Kanton.
  * Correct many pre-1993 transitions in Malawi, Portugal, etc.
  * zic now creates each output file or link atomically.
  * zic -L no longer omits the POSIX TZ string in its output.
  * zic fixes for truncation and leap second table expiration.
  * zic now follows POSIX for TZ strings using all-year DST.
  * Fix some localtime crashes and bugs in obscure cases.
  * zdump -v now outputs more-useful boundary cases.
  * tzfile.5 better matches a draft successor to RFC 8536.
- Refresh tzdata-china.patch

xen

- bsc#1192554 - VUL-0: CVE-2021-28706: xen: guests may exceed their
  designated memory limit (XSA-385)
  xsa385.patch
- bsc#1192557 - VUL-0: CVE-2021-28704,CVE-2021-28707,CVE-2021-28708:
  xen: PoD operations on misaligned GFNs (XSA-388)
  xsa388-1.patch
  xsa388-2.patch
- bsc#1192559 - VUL-0: CVE-2021-28705,CVE-2021-28709: xen: issues
  with partially successful P2M updates on x86 (XSA-389)
  xsa389.patch
- Upstream bug fixes (bsc#1027519)
  6138b7a1-x86-spec-ctrl-split-diagnostics-line.patch
  6138b7a2-x86-AMD-enum-speculative-hints.patch
  6138b7a3-x86-AMD-use-newer-SSBD.patch
  6139f1b1-x86-spec-ctrl-print-AMD-features.patch
  6148453b-VT-d-hidden-devices-unmap.patch
  6148455f-VT-d-PCI-segment-numbers-16-bits.patch
  61532102-PCI-bridge-with-subord-bus-0xFF.patch
- bsc#1191363 - VUL-0: CVE-2021-28702: xen: PCI devices with RMRRs
  not deassigned correctly (XSA-386)
  615c9fd0-VT-d-fix-deassign-of-device-with-RMRR.patch
- Update to Xen 4.14.3 bug fix release (bsc#1027519)
  xen-4.14.3-testing-src.tar.bz2
- Drop patches contained in new tarball
  608676f2-VT-d-register-based-invalidation-optional.patch
  60a27288-x86emul-gas-2-36-test-harness-build.patch
  60af933d-x86-gcc11-hypervisor-build.patch
  60afe616-x86-CPUID-rework-HLE-and-RTM-handling.patch
  60afe617-x86-TSX-minor-cleanup-and-improvements.patch
  60afe618-x86-TSX-deprecate-vpmu=rtm-abort.patch
  60be0e24-credit2-pick-runnable-unit.patch
  60be0e42-credit2-per-entity-load-tracking-when-continuing.patch
  60be3097-x86-CPUID-fix-HLE-and-RTM-handling-again.patch
  60bf9e19-Arm-create-dom0less-domUs-earlier.patch
  60bf9e1a-Arm-boot-modules-scrubbing.patch
  60bf9e1b-VT-d-size-qinval-queue-dynamically.patch
  60bf9e1c-AMD-IOMMU-size-command-buffer-dynamically.patch
  60bf9e1d-VT-d-eliminate-flush-related-timeouts.patch
  60bf9e1e-x86-spec-ctrl-protect-against-SCSB.patch
  60bf9e1f-x86-spec-ctrl-mitigate-TAA-after-S3.patch
  60bfa904-AMD-IOMMU-wait-for-command-slot.patch
  60bfa906-AMD-IOMMU-drop-command-completion-timeout.patch
  60c0bf86-x86-TSX-cope-with-deprecation.patch
  60c8a7ac-x86-vpt-fully-init-timers-before-enlisting.patch
  60c8de6e-osdep_xenforeignmemory_map-prototype.patch
  60d49689-VT-d-undo-device-mappings-upon-error.patch
  60d496b9-VT-d-adjust-domid-map-updating-on-unmap.patch
  60d496d6-VT-d-clear_fault_bits-should-clear-all.patch
  60d496ee-VT-d-dont-lose-errors-on-multi-IOMMU-flush.patch
  60d5c6df-IOMMU-PCI-dont-let-domain-cleanup-continue.patch
  61001231-x86-work-around-GNU-ld-2-37-issue.patch
  61122ac6-credit2-avoid-spuriously-picking-idle.patch
  611a7e38-x86-CET-shstk-WARN-manipulation.patch
  611cba4e-VT-d-Tylersburg-errata-more-steppings.patch
  611f844b-AMD-IOMMU-dont-leave-pt-mapped.patch
  6126339d-AMD-IOMMU-global-ER-extending.patch
  6126344f-AMD-IOMMU-unity-map-handling.patch
  61263464-IOMMU-pass-access-to-p2m_get_iommu_flags.patch
  6126347d-IOMMU-generalize-VT-d-mapped-RMRR-tracking.patch
  6126349a-AMD-IOMMU-rearrange-reassignment.patch
  612634ae-AMD-IOMMU-rearrange-ER-UM-recording.patch
  612634c3-x86-p2m-introduce-p2m_is_special.patch
  612634dc-x86-p2m-guard-identity-mappings.patch
  612634f4-x86-mm-widen-locked-region-in-xatp1.patch
  6126350a-gnttab-release-mappings-preemption.patch
  6126351f-gnttab-replace-mapkind.patch
  6126353d-gnttab-get-status-frames-array-capacity.patch
  61263553-Arm-restrict-maxmem-for-dom0less.patch
  6128a856-gnttab-radix-tree-node-init.patch
  xsa384.patch

zlib

- Update 410.patch to include new fixes from upstream,
  fixes bsc#1192688
- Refresh bsc1174736-DFLTCC_LEVEL_MASK-set-to-0x1ff.patch
  to match upstream commit
- Drop patches which changes have been merged in 410.patch:
  * zlib-compression-switching.patch
  * zlib-390x-z15-fix-hw-compression.patch
  * bsc1174551-fxi-imcomplete-raw-streams.patch