- 000release-packages:SUSE-Manager-Proxy-release
-
n/a
- aaa_base
-
- silence the output in the case of broken symlinks (bsc#1218232)
- fix git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
to actually apply
- replace git-47-04210f8df15da0ba4d741cfe1693af06f5978a1d.patch
by git-47-056fc66c699a8544c7692a03c905fca568f5390b.patch
* fix the issues from bsc#1107342 and bsc#1215434 and just
use the settings from update-alternatives to set JAVA_HOME
- bind
-
- Update to release 9.16.48
Feature Changes:
* The IP addresses for B.ROOT-SERVERS.NET have been updated to
170.247.170.2 and 2801:1b8:10::b.
Security Fixes:
* Validating DNS messages containing a lot of DNSSEC signatures
could cause excessive CPU load, leading to a denial-of-service
condition. This has been fixed. (CVE-2023-50387)
[bsc#1219823]
* Preparing an NSEC3 closest encloser proof could cause excessive
CPU load, leading to a denial-of-service condition. This has
been fixed. (CVE-2023-50868)
[bsc#1219826]
* Parsing DNS messages with many different names could cause
excessive CPU load. This has been fixed. (CVE-2023-4408)
[bsc#1219851]
* Specific queries could cause named to crash with an assertion
failure when nxdomain-redirect was enabled. This has been
fixed. (CVE-2023-5517)
[bsc#1219852]
* A bad interaction between DNS64 and serve-stale could cause
named to crash with an assertion failure, when both of these
features were enabled. This has been fixed. (CVE-2023-5679)
[bsc#1219853]
* Query patterns that continuously triggered cache database
maintenance could cause an excessive amount of memory to be
allocated, exceeding max-cache-size and potentially leading to
all available memory on the host running named being exhausted.
This has been fixed. (CVE-2023-6516)
[bsc#1219854]
Removed Features:
* Support for using AES as the DNS COOKIE algorithm
(cookie-algorithm aes;) has been deprecated and will be removed
in a future release. Please use the current default,
SipHash-2-4, instead.
- cloud-netconfig
-
- Update to version 1.12 (bsc#1221202)
+ If token access succeeds using IPv4 do not use the IPv6 endpoint
only use the IPv6 IMDS endpoint if IPv4 access fails.
- Add Provides/Obsoletes for dropped cloud-netconfig-nm
- Install dispatcher script into /etc/NetworkManager/dispatcher.d
on older distributions
- Add BuildReqires: NetworkManager to avoid owning dispatcher.d
parent directory
- Update to version 1.11:
+ Revert address metadata lookup in GCE to local lookup (bsc#1219454)
+ Fix hang on warning log messages
+ Check whether getting IPv4 addresses from metadata failed and abort
if true
+ Only delete policy rules if they exist
+ Skip adding/removing IPv4 ranges if metdata lookup failed
+ Improve error handling and logging in Azure
+ Set SCRIPTDIR when installing netconfig wrapper
- Update to version 1.10:
+ Drop cloud-netconfig-nm sub package and include NM dispatcher
script in main packages (bsc#1219007)
+ Spec file cleanup
- Update to version 1.9:
+ Drop package dependency on sysconfig-netconfig
+ Improve log level handling
+ Support IPv6 IMDS endpoint in EC2 (bsc#1218069)
- cloud-regionsrv-client
-
- Update to version 10.1.7 (bsc#1220164, bsc#1220165)
+ Fix the failover path to a new target update server. At present a new
server is not found since credential validation fails. We targeted
the server detected in down condition to verify the credentials instead
of the replacement server.
- Update EC2 plugin to 1.0.4 (bsc#1219156, bsc#1219159)
+ Fix the algorithm to determine the region from the availability zone
information retrieved from IMDS.
- Update to version 10.1.6
+ Support specifying an IPv6 address for a manually configured target
update server.
- Update to version 10.1.5 (bsc#1217583)
+ Fix fallback path when IPv6 network path is not usable
+ Enable an IPv6 fallback path in IMDS access if it cannot be accessed
over IPv4
+ Enable IMDS access over IPv6
- containerd
-
- Add patch for bsc#1217952:
+ 0002-shim-Create-pid-file-with-0644-permissions.patch
- Update to containerd v1.7.10. Upstream release notes:
<https://github.com/containerd/containerd/releases/tag/v1.7.10>
- Rebase patches:
* 0001-BUILD-SLE12-revert-btrfs-depend-on-kernel-UAPI-inste.patch
- cpio
-
- Fix cpio not working after the fix in bsc#1218571, fixes bsc#1219238
* fix-bsc1219238.patch
- Fix CVE-2023-7207, path traversal vulnerability (bsc#1218571)
* fix-CVE-2023-7207.patch
- gcc7
-
- Add gcc7-pr88345-min-func-alignment.diff to add support for
- fmin-function-alignment. [bsc#1214934]
- Use %{_target_cpu} to determine host and build.
- Add gcc7-pr87723.patch to avoid ICE when hitting a broken pattern
in the s390 backend.
- Add gcc7-bsc1216488.patch to avoid creating recursive DIE references
through DW_AT_abstract_origin when using LTO. [bsc#1216488]
- curl
-
- Fix: libssh: Implement SFTP packet size limit (bsc#1216987)
* Add curl-libssh_Implement_SFTP_packet_size_limit.patch
- lvm2
-
- Error creating linux volume on SAN device lvmlockd (bsc#1215229)
+ bug-1215229_lvmlockd-use-4K-sector-size-when-any-dev-is-4K.patch
- docker
-
- Vendor latest buildkit v0.11:
Add patch 0006-Vendor-in-latest-buildkit-v0.11-branch-including-CVE.patch that
vendors in the latest v0.11 buildkit branch including bugfixes for the following:
* bsc#1219438: CVE-2024-23653
* bsc#1219268: CVE-2024-23652
* bsc#1219267: CVE-2024-23651
- rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- switch from %patchN to %patch -PN syntax
- remove unused rpmlint filters and add filters to silence pointless bash & zsh
completion warnings
- Update to Docker 24.0.7-ce. See upstream changelong online at
<https://docs.docker.com/engine/release-notes/24.0/#2407>. bsc#1217513
* Deny containers access to /sys/devices/virtual/powercap by default.
- CVE-2020-8694 bsc#1170415
- CVE-2020-8695 bsc#1170446
- CVE-2020-12912 bsc#1178760
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
* cli-0001-docs-include-required-tools-in-source-tree.patch
- Add a patch to fix apparmor on SLE-12, reverting the upstream removal of
version-specific templating for the default apparmor profile. bsc#1213500
+ 0005-SLE12-revert-apparmor-remove-version-conditionals-fr.patch
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
- Update to Docker 24.0.6-ce. See upstream changelong online at
<https://docs.docker.com/engine/release-notes/24.0/#2406>. bsc#1215323
- Rebase patches:
* 0001-SECRETS-daemon-allow-directory-creation-in-run-secre.patch
* 0002-SECRETS-SUSE-implement-SUSE-container-secrets.patch
* 0003-BUILD-SLE12-revert-graphdriver-btrfs-use-kernel-UAPI.patch
* 0004-bsc1073877-apparmor-clobber-docker-default-profile-o.patch
* cli-0001-docs-include-required-tools-in-source-tree.patch
- Switch from disabledrun to manualrun in _service.
- Add a docker.socket unit file, but with socket activation effectively
disabled to ensure that Docker will always run even if you start the socket
individually. Users should probably just ignore this unit file. bsc#1210141
- glibc
-
- qsort-invalid-cmp.patch: qsort: handle degenerated compare function
(bsc#1218866)
- getaddrinfo-eai-memory.patch: getaddrinfo: translate ENOMEM to
EAI_MEMORY (bsc#1217589, BZ #31163)
- aarch64-rawmemchr-unwind.patch: aarch64: correct CFI in rawmemchr
(bsc#1217445, BZ #31113)
- google-guest-agent
-
- Add explicit versioned dependency on google-guest-oslogin (bsc#1219642)
- Update to version 20231031.01 (bsc#1216547, bsc#1216751)
* Add prefix to scheduler logs (#325)
- from version 20231030.00
* Test configuration files are loaded in the documented
order. Fix initial integration test. (#324)
* Enable mTLS by default (#323)
- from version 20231026.00
* Rotate MDS root certificate (#322)
- from version 20231020.00
* Update response struct, add tests (#315)
* Don't try to schedule mTLS job twice (#317)
- from version 20231019.00
* snapshot: Add context cancellation handling (#318)
- Bump the golang compiler version to 1.21 (bsc#1216546)
- Update to version 20231016.00
* instance setup: trust/rely on metadata package's retry (#316)
- from version 20231013.01
* Update known cert dirs for updaters (#314)
- from version 20231011.00
* Verify cert refresher is enabled before running (#312)
- from version 20231009.00
* Add support for the SSH key options (#296)
- from version 20231006.01
* Events interface improvement (#290)
- from version 20231006.00
* Refactor script runner to use common metadata package (#311)
* Schedule MTLS job before notifying systemd (#310)
* Refactor authorized keys to use metadata package (#300)
- from version 20231005.00
* docs update: add configuration and event manager's docs. (#309)
- from version 20231004.01
* Fix license header (#301)
* packaging(deb): add epoch to oslogin dep declaration (#308)
- from version 20231004.00
* packaging(deb): ignore suffix of version (#306)
* packaging: force epoch and ignore suffix of version (#305)
- from version 20231003.01
* oslogin: declare explicitly dependency (#304)
* oslogin: remove Unstable.pamless_auth_stack feature flag (#303)
- from version 20231003.00
* oslogin: resort ssh configuration keys (#299)
- from version 20230925.00
* oslogin: introduce a feature flag to cert auth (#298)
- from version 20230923.00
* gitignore: unify ignore in the root dir (#297)
- from version 20230921.01
* managers: we accidentally disabled addressMgr, bring it back (#295)
* cfg: fix typos (#294)
* cfg: config typos (#293)
* cfg: introduce a configuration management package (#288)
- from version 20230921.00
* mtls: bring it back (#292)
- from version 20230920.01
* Fix permissions on file created by SaferWriteFile() (#291)
- from version 20230920.00
* sshca: re-enable the event watcher & handler (#289)
- from version 20230919.01
* oslogin: add PAMless Authorization Stack configuration (#285)
- from version 20230919.00
* Preparing it for review (#287)
* sshca: make sure to restore SELinux context of the pipe (#286)
* remove deprecated usage, fix warnings (#282)
* Update system store (#278)
* Update workload certificate endpoints, use metadata package (#275)
* metadata: use url package to form metadata URLs (#284)
- from version 20230913.00
* release prep: disable ssh trusted ca module (#281)
- from version 20230912.00
* New Guest Agent Release (#280)
- from version 20230909.00
* Revert "service: remove the use of the service library (#273)" (#276)
* service: remove the use of the service library (#273)
- from version 20230906.01
* Store keys to machine keyset (#272)
- from version 20230905.00
* restorecon: first try to determine if it's installed (#271)
* run: change all commands to use CommandContext (#268)
* Notify systemd after scheduling required jobs (#270)
* Store certs in ProgramData instead of Program Files (#269)
* metadata watcher: remove local retry & implement unit tests (#267)
* run: split command running utilities into its own package (#265)
- Update to version 20230828.00
* snapshot: Use main context rather than create its own (#266)
- from version 20230825.01
* Verify if cert was successfully added to certpool (#264)
- from version 20230825.00
* Find previous cert for cleanup using one stored on disk (#263)
- from version 20230823.00
* Revert "sshtrustedca: configure selinux context
for sshtrustedca pipe (#256)" (#262)
* Update credentials directory on Linux (#260)
- from version 20230821.00
* Update owners (#261)
- from version 20230819.00
* Revert "guest-agent: prepare for public release (#258)" (#259)
- from version 20230817.00
* guest-agent: prepare for public release (#258)
- from version 20230816.01
* Enable telemetry collection by default (#253)
- from version 20230816.00
* Add pkcs12 license and update retry logic (#257)
* sshtrustedca: Configure selinux context for sshtrustedca pipe (#256)
* Store windows certs in certstore (#255)
* events: Multiplex event watchers (#250)
* Scheduler fixes (#254)
* Update license files (#251)
* Run telemetry every 24 hours, record pretty name on linux (#248)
- Update to version 20230811.00
* sshca: move the event handler to its own package (#247)
- from version 20230809.02
* Move scheduler package to google_guest_agent (#249)
- from version 20230809.01
* Add scheduler utility to run jobs at interval (#244)
- from version 20230809.00
* sshca: transform the format from json to openssh (#246)
- from version 20230803.00
* Add support for reading UEFI variables on windows (#243)
- from version 20230801.03
* sshtrustedca watcher: fix concurrency error (#242)
- from version 20230801.02
* metadata: add a delta between http client timeout and hang (#241)
- from version 20230801.00
* metadata: properly set request config (#240)
* main: bring back the mds client initialization (#239)
* metadata: don't try to use metadata before agentInit() is done (#238)
* Add (disabled) telemetry logic to GuestAgent (#219)
* metadata event handler: updates and bug fixes (#235)
* Verify client credentials are signed by root CA before writing on disk (#236)
* metadata: properly handle context cancelation (#234)
* metadata: fix context cancelation error check (#233)
* metadata: remove the sleep around metadata in instance setup (#232)
* metadata: implement backoff strategy (#231)
* Decrypt and store client credentials on disk (#230)
* Upgrade Go version 1.20 (#228)
* Fetch guest credentials and add MDS response proto (#226)
* metadata: pass main context to WriteGuestAttributes() (#227)
* Support for reading & writing Root CA cert from UEFI variable (#225)
* ssh_trusted_ca: enable the feature (#224)
* sshTrustedCA: add pipe event handler (#222)
* events: start using events layer (#223)
- from version 20230726.00
* events: introducing a events handling subsystem (#221)
- from version 20230725.00
* metadata: add metadata client interface (#220)
- from version 20230711.00
* metadata: moving to its own package (#218)
- from version 20230707.00
* snapshot: fix request handling error (#217)
- Bump Go API version to 1.20
- google-guest-oslogin
-
- Add explicit versioned dependency on google-guest-agent (bsc#1219642)
- Update to version 20231101.00 (bsc#1216548, bsc#1216750)
* Fix HTTP calls retry logic (#117)
- Update to version 20231004
* packaging: Make the dependency explicit (#120)
- update to 20230926.00:
* fix suse build
* selinux: fix selinux build (#114)
* test: align CXX Flags
* sshca: Make the implementation more C++ like
* sshca: Add a SysLog wrapper
* oslogin_utils: introduce AuthorizeUser() API
* sshca: move it out of pam dir
* pam: start disabling the use of oslogin_sshca
* sshca: consider sshca API to assume a cert only
* authorized principals: introduce the new command
* authorize keys: update to use new APIs
* pam modules: remove pam_*_admin and update pam_*_login
* cache_refresh: should be catching by reference.
- Update to version 20230823.00
* selinux: Add sshd_key_t type enforcement to trusted user ca (#113)
- from version 20230822.00
* sshca: Add tests with fingerprint and multiple extensions (#111)
- from version 20230821.01
* sshca: Support method token and handle multi line (#109)
- from version 20230821.00
* Update owners (#110)
- Update to version 20230808.00
* byoid: extract and apply the ca fingerprint to policy call (#106)
- Update to version 20230502.00
* Improve the URL in 2fa prompt (#104)
- from version 20230406.02
* Check open files (#101)
- from version 20230406.01
* Initialize variables (#100)
* Fix formatting (#102)
- from version 20230406.00
* PAM cleanup: remove duplicates (#97)
- from version 20230405.00
* NSS cleanup (#98)
- from version 20230403.01
* Cleanup Makefiles (#95)
- from version 20230403.00
* Add anandadalton to the owners list (#96)
- Update to version 20230217.00
* Update OWNERS (#91)
- from version 20230202.00
* Update owners file (#89)
- hwdata
-
- update to 0.378:
* Update pci, usb and vendor ids
- update to 0.377:
* Fixed trailing spaces in pnp.ids
- update to 0.376:
* Update pci, usb and vendor ids
- update to 0.373:
* Update pci, usb and vendor ids
- update to 0.372:
* Update pci, usb and vendor ids
- kernel-default
-
- aoe: fix the potential use-after-free problem in aoecmd_cfg_pkts
(bsc#1218562 CVE-2023-6270).
- commit 57a4cd4
- efivarfs: force RO when remounting if SetVariable is not
supported (bsc#1220328 CVE-2023-52463).
- commit eed7fb0
- iommu/vt-d: Avoid memory allocation in iommu_suspend()
(CVE-2023-52559 bsc#1220933).
- commit c9b01ef
- Refresh patches.suse/0001-powerpc-pseries-memhp-Fix-access-beyond-end-of-drmem.patch.
- update to upstream version
- rename to same name as SLE15 SP5
- commit 1d2def1
- KVM: x86: Export RFDS_NO and RFDS_CLEAR to guests (bsc#1213456 CVE-2023-28746).
- commit 4aebf4f
- x86/rfds: Mitigate Register File Data Sampling (RFDS) (bsc#1213456 CVE-2023-28746).
- Update config files.
- commit 29c1c99
- Documentation/hw-vuln: Add documentation for RFDS (bsc#1213456 CVE-2023-28746).
- commit 81de603
- Update patches.suse/i2c-validate-user-data-in-compat-ioctl.patch
(git-fixes bsc#1220469 CVE-2021-46934).
Add bug and CVE references.
- commit 3a04060
- wifi: mac80211: fix potential key use-after-free (CVE-2023-52530
bsc#1220930).
- commit 3feca94
- Update patch reference for iwlwifi fix (CVE-2023-52531 bsc#1220931)
- commit bde87cf
- Update patch reference for pinctrl fix (CVE-2021-47083 bsc#1220917)
- commit b608623
- drm/bridge: sii902x: Fix probing race issue (bsc#1220736 CVE-2024-26607).
- commit 70198c4
- Update
patches.suse/vt-fix-memory-overlapping-when-deleting-chars-in-the.patch
(git-fixes bsc#1220845 CVE-2022-48627).
- Update
patches.suse/x86-srso-add-srso-mitigation-for-hygon-processors.patch
(git-fixes bsc#1220735 CVE-2023-52482).
Add CVE references.
- commit dcdac38
- mfd: syscon: Fix null pointer dereference in
of_syscon_register() (bsc#1220433 CVE-2023-52467).
- commit b0262b8
- bpf: Fix re-attachment branch in bpf_tracing_prog_attach
(bsc#1220254 CVE-2024-26591).
- commit fc948d3
- selftests/bpf: Add test for alu on PTR_TO_FLOW_KEYS (bsc#1220255
CVE-2024-26589).
- bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS (bsc#1220255
CVE-2024-26589).
- commit 8a833ce
- iommu/arm-smmu-v3: Fix soft lockup triggered by arm_smmu_mm_invalidate_range (CVE-2023-52484 bsc#1220797).
- commit 2229de3
- tls: fix race between tx work scheduling and socket close
(CVE-2024-26585 bsc#1220187).
- commit 1306bff
- kabi: restore return type of dst_ops::gc() callback
(CVE-2023-52340 bsc#1219295).
- ipv6: remove max_size check inline with ipv4 (CVE-2023-52340
bsc#1219295).
- commit b8eec42
- netfilter: nf_tables: fix 64-bit load issue in
nft_byteorder_eval() (CVE-2024-0607 bsc#1218915).
- netfilter: nf_tables: fix pointer math issue in
nft_byteorder_eval() (CVE-2024-0607 bsc#1218915).
- commit e095cd0
- netfilter: nft_set_pipapo: skip inactive elements during set
walk (CVE-2023-6817 bsc#1218195).
- commit 4032aa7
- tomoyo: fix UAF write bug in tomoyo_write_control() (bsc#1220825
CVE-2024-26622).
- commit c8e5b38
- btrfs: fix double free of anonymous device after snapshot
creation failure (bsc#1219126 CVE-2024-23850).
- commit 257a534
- btrfs: do not ASSERT() if the newly created subvolume already
got read (bsc#1219126 CVE-2024-23850).
- commit a2ac581
- bpf: Minor cleanup around stack bounds (bsc#1220257
CVE-2023-52452).
- bpf: Fix accesses to uninit stack slots (bsc#1220257
CVE-2023-52452).
- bpf: Guard stack limits against 32bit overflow (git-fixes).
- bpf: Fix verification of indirect var-off stack access
(git-fixes).
- commit 7d03125
- serial: 8250: omap: Don't skip resource freeing if
pm_runtime_resume_and_get() failed (bsc#1220350 CVE-2023-52457).
- commit c82f528
- serial: imx: fix tx statemachine deadlock (bsc#1220364
CVE-2023-52456).
- commit cd9f92c
- powerpc/pseries/memhp: Fix access beyond end of drmem array
(bsc#1220250,CVE-2023-52451).
- commit fdc7254
- Update patch reference for input fix (CVE-2021-46932 bsc#1220444)
- commit e44e0b1
- Update patches.suse/i2c-Fix-a-potential-use-after-free.patch
(git-fixes bsc#1220409 CVE-2019-25162).
Add bug and CVE references.
- commit 6df4ebd
- efivarfs: force RO when remounting if SetVariable is not
supported (bsc#1220328 CVE-2023-52463).
- commit 3cfef52
- btrfs: fix double free of anonymous device after snapshot
creation failure (bsc#1219126 CVE-2024-23850).
- commit f8ba729
- mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
(bsc#1220238 CVE-2023-52449).
- commit c132b67
- fs/mount_setattr: always cleanup mount_kattr (bsc#1220457
CVE-2021-46923).
- commit 89afe2f
- kABI: bpf: map_fd_put_ptr() signature kABI workaround
(bsc#1220251 CVE-2023-52447).
- kABI: bpf: struct bpf_map kABI workaround (bsc#1220251
CVE-2023-52447).
- kABI: bpf: map_fd_put_ptr() signature kABI workaround
(bsc#1220251 CVE-2023-52447).
- kABI: bpf: struct bpf_map kABI workaround (bsc#1220251
CVE-2023-52447).
- commit bec1c61
- selftests/bpf: Test outer map update operations in syscall
program (bsc#1220251 CVE-2023-52447).
- selftests/bpf: Add test cases for inner map (bsc#1220251
CVE-2023-52447).
- bpf: Defer the free of inner map when necessary (bsc#1220251
CVE-2023-52447).
- Refresh patches.suse/kABI-padding-for-bpf.patch
- bpf: Set need_defer as false when clearing fd array during
map free (bsc#1220251 CVE-2023-52447).
- bpf: Add map and need_defer parameters to .map_fd_put_ptr()
(bsc#1220251 CVE-2023-52447).
- bpf: Check rcu_read_lock_trace_held() before calling bpf map
helpers (bsc#1220251 CVE-2023-52447).
- rcu-tasks: Provide rcu_trace_implies_rcu_gp() (bsc#1220251
CVE-2023-52447).
- selftests/bpf: Test outer map update operations in syscall
program (bsc#1220251 CVE-2023-52447).
- selftests/bpf: Add test cases for inner map (bsc#1220251
CVE-2023-52447).
- bpf: Defer the free of inner map when necessary (bsc#1220251
CVE-2023-52447).
- Refresh patches.suse/kABI-padding-for-bpf.patch
- bpf: Set need_defer as false when clearing fd array during
map free (bsc#1220251 CVE-2023-52447).
- bpf: Add map and need_defer parameters to .map_fd_put_ptr()
(bsc#1220251 CVE-2023-52447).
- bpf: Check rcu_read_lock_trace_held() before calling bpf map
helpers (bsc#1220251 CVE-2023-52447).
- rcu-tasks: Provide rcu_trace_implies_rcu_gp() (bsc#1220251
CVE-2023-52447).
- commit aa6db76
- Update patch reference for HID fix (CVE-2023-52478 bsc#1220796)
- commit 4aec836
- Update patch reference for input fix (CVE-2023-52475 bsc#1220649)
- commit 00a87c8
- KVM: arm64: vgic-its: Avoid potential UAF in LPI translation
cache (bsc#1220326, CVE-2024-26598).
- commit 74fd0dd
- x86/fpu: Stop relying on userspace for info to fault in xsave buffer (bsc#1220335, CVE-2024-26603).
- commit 4cbbdbf
- Update patch reference for NFC fix (CVE-2021-46924 bsc#1220459)
- commit 8ac32a8
- media: pvrusb2: fix use after free on context disconnection
(CVE-2023-52445 bsc#1220241).
- commit e4643a5
- uio: Fix use-after-free in uio_open (bsc#1220140
CVE-2023-52439).
- commit fbf52b1
- apparmor: avoid crash when parsed profile name is empty
(CVE-2023-52443 bsc#1220240).
- commit 732bc93
- btrfs: do not ASSERT() if the newly created subvolume already
got read (bsc#1219126 CVE-2024-23850).
- commit 087f1fb
- sched/membarrier: reduce the ability to hammer on sys_membarrier
(git-fixes, bsc#1220398, CVE-2024-26602).
- commit 6f61ce3
- i2c: i801: Fix block process call transactions (bsc#1220009
CVE-2024-26593).
- commit 1b64da9
- mlxsw: spectrum_acl_tcam: Fix stack corruption (bsc#1220243
CVE-2024-26586).
- mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in
error path (bsc#1220344 CVE-2024-26595).
- commit 6e8b589
- EDAC/thunderx: Fix possible out-of-bounds string access (bsc#1220330, CVE-2023-52464)
- commit 369d1fd
- Drop 2 git-fixes patches which are suspicious to introduce regression
reported in bsc#1219073,
- patches.suse/md-Set-MD_BROKEN-for-RAID1-and-RAID10-9631.patch.
- patches.suse/md-raid1-free-the-r1bio-before-waiting-for-blocked-r-992d.patch.
- Refresh patches.suse/md-display-timeout-error.patch for the above
change.
- commit 4ecd26a
- gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
(bsc#1220253 CVE-2023-52448).
- commit 12cdab5
- nvme: remove nvme_alloc_request and nvme_alloc_request_qid
(bsc#1214064).
Refresh:
- patches.suse/nvme-tcp-delay-error-recovery-until-the-next-kato.patch
- commit 6fc2117
- rpm/check-for-config-changes: add GCC_ASM_GOTO_OUTPUT_WORKAROUND to IGNORED_CONFIGS_RE
Introduced by commit 68fb3ca0e408 ("update workarounds for gcc "asm
goto" issue").
- commit be1bdab
- net: openvswitch: limit the number of recursions from action
sets (bsc#1219835 CVE-2024-1151).
- commit ed2fd55
- README.BRANCH: use correct mail for Roy
- commit 6f3c32f
- compute-PATCHVERSION: Do not produce output when awk fails
compute-PATCHVERSION uses awk to produce a shell script that is
subsequently executed to update shell variables which are then printed
as the patchversion.
Some versions of awk, most notably bysybox-gawk do not understand the
awk program and fail to run. This results in no script generated as
output, and printing the initial values of the shell variables as
the patchversion.
When the awk program fails to run produce 'exit 1' as the shell script
to run instead. That prevents printing the stale values, generates no
output, and generates invalid rpm spec file down the line. Then the
problem is flagged early and should be easier to diagnose.
- commit 8ef8383
- nvme: move nvme_stop_keep_alive() back to original position
(bsc#1211515).
- commit b945fa0
- x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (git-fixes).
- commit 636fc4c
- KVM: VMX: Move VERW closer to VMentry for MDS mitigation (git-fixes).
- KVM: VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (git-fixes).
- x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (git-fixes).
Also add the removed mds_user_clear symbol to kABI severities as it is
exposed just for KVM module and is generally a core kernel component so
removing it is low risk.
- x86/entry_32: Add VERW just before userspace transition (git-fixes).
- x86/entry_64: Add VERW just before userspace transition (git-fixes).
- x86/bugs: Add asm helpers for executing VERW (git-fixes).
- commit 5b0be3c
- netfilter: nf_tables: disallow rule removal from chain binding
(bsc#1218216 CVE-2023-5197).
- commit d7a1a4d
- netfilter: nf_tables: skip bound chain in netns release path
(bsc#1218216 CVE-2023-5197).
- commit af879c8
- nvme: start keep-alive after admin queue setup (bsc#1211515).
- commit 13f904b
- net/rds: Fix UBSAN: array-index-out-of-bounds in rds_cmsg_recv
(bsc#1219127 CVE-2024-23849).
- commit 43577c1
- dm: limit the number of targets and parameter size area
(bsc#1219827, bsc#1219146, CVE-2023-52429, CVE-2024-23851).
- commit 26dc83e
- Fix unresolved hunks in README.BRANCH
- commit 99bb861
- NFS: avoid infinite loop in pnfs_update_layout (bsc#1219633).
- commit b6a1f9a
- vhost: use kzalloc() instead of kmalloc() followed by memset()
(CVE-2024-0340, bsc#1218689).
- commit 4c5a740
- README.BRANCH: Update cve/linux-5.14 maintainers
Add myself to match SLE15-SP5 consumer + fix typo in branch name.
- commit da26653
- Refresh patches.suse/nfsd-fix-RELEASE_LOCKOWNER.patch.
Accidentally removed nfs4_get_stateowner
- commit d77a474
- Bluetooth: Fix atomicity violation in {min,max}_key_size_set
(git-fixes bsc#1219608 CVE-2024-24860).
- commit a1186fd
- README.BRANCH: update branch name to cve/linux-5.14, update maintainers
as requested
- commit 8e34879
- rpm/kernel-binary.spec.in: install scripts/gdb when enabled in config
(bsc#1219653)
They are put into -devel subpackage. And a proper link to
/usr/share/gdb/auto-load/ is created.
- commit 1dccf2a
- netfilter: nf_tables: check if catch-all set element is active
in next generation (CVE-2024-1085 bsc#1219429).
- commit 7b3f4c4
- netfilter: nf_tables: reject QUEUE/DROP verdict parameters
(CVE-2024-1086 bsc#1219434).
- commit 5f917ff
- Update
patches.suse/drm-amdgpu-Fix-potential-fence-use-after-free-v2.patch
(bsc#1219128 CVE-2023-51042 git-fixes).
- commit 4b937fc
- rpm/mkspec: sort entries in _multibuild
Otherwise it creates unnecessary diffs when tar-up-ing. It's of course
due to readdir() using "random" order as served by the underlying
filesystem.
See for example:
https://build.opensuse.org/request/show/1144457/changes
- commit d1155de
- Revert "tracing: Increase trace array ref count on enable and
filter files" (bsc#1219490).
Deleted:
patches.suse/tracing-Increase-trace-array-ref-count-on-enable-and-filter-files.patch
patches.suse/tracing-Have-event-inject-files-inc-the-trace-array-ref-count.patch
Backported commit f5ca233e2e66 ("tracing: Increase trace array ref count
on enable and filter files") causes a kernel panic and its upstream
fix-up bb32500fb9b7 ("tracing: Have trace_event_file have ref counters")
cannot be easily backported because it affects kABI. Revert the commit
and its one related + dependent patch, at least for now.
- commit 90d885a
- README.BRANCH: SLE15-SP4 became LTSS, update maintainers
- commit 94325df
- atm: Fix Use-After-Free in do_vcc_ioctl (CVE-2023-51780
bsc#1218730).
- commit 658d424
- xen-netback: don't produce zero-size SKB frags (CVE-2023-46838,
XSA-448, bsc#1218836).
- commit 9a897ff
- Update
patches.suse/ext4-fix-kernel-BUG-in-ext4_write_inline_data_end.patch
(CVE-2021-33631 bsc#1219412 bsc#1206894).
- commit 96c942c
- kabi, vmstat: skip periodic vmstat update for isolated CPUs
(bsc#1217895).
- commit 8cb5798
- sched/isolation: add cpu_is_isolated() API (bsc#1217895).
- trace,smp: Add tracepoints around remotelly called functions
(bsc#1217895).
- vmstat: skip periodic vmstat update for isolated CPUs
(bsc#1217895).
- Refresh
patches.suse/0002-kernel-smp-make-csdlock-timeout-depend-on-boot-param.patch.
- commit 668c0e0
- kernel-source: Fix description typo
- commit 8abff35
- nvmet-tcp: Fix the H2C expected PDU len calculation
(bsc#1217987 bsc#1217988 bsc#1217989 CVE-2023-6535 CVE-2023-6536
CVE-2023-6356).
- nvmet-tcp: remove boilerplate code (bsc#1217987 bsc#1217988
bsc#1217989 CVE-2023-6535 CVE-2023-6536 CVE-2023-6356).
- nvmet-tcp: fix a crash in nvmet_req_complete() (bsc#1217987
bsc#1217988 bsc#1217989 CVE-2023-6535 CVE-2023-6536
CVE-2023-6356).
- nvmet-tcp: Fix a kernel panic when host sends an invalid H2C
PDU length (bsc#1217987 bsc#1217988 bsc#1217989 CVE-2023-6535
CVE-2023-6536 CVE-2023-6356).
- commit d968940
- clocksource: Skip watchdog check for large watchdog intervals
(bsc#1217217).
- commit 63b1d6d
- clocksource: disable watchdog checks on TSC when TSC is watchdog
(bsc#1215885).
- commit 2f92dd8
- nfsd4: add refcount for nfsd4_blocked_lock (bsc#1218968
bsc#1219349).
- commit d38f35d
- wifi: brcmfmac: Fix use-after-free bug in brcmf_cfg80211_detach
(CVE-2023-47233 bsc#1216702).
- commit 433859d
- rpm/constraints.in: set jobs for riscv to 8
The same workers are used for x86 and riscv and the riscv builds take
ages. So align the riscv jobs count to x86.
- commit b2c82b9
- net: sched: sch_qfq: Use non-work-conserving warning handler
(CVE-2023-4921 bsc#1215275).
- commit b50ba0e
- mkspec: Use variant in constraints template
Constraints are not applied consistently with kernel package variants.
Add variant to the constraints template as appropriate, and expand it
in mkspec.
- commit cc68ab9
- rpm/constraints.in: add static multibuild packages
Commit 841012b049a5 (rpm/mkspec: use kernel-source: prefix for
constraints on multibuild) added "kernel-source:" prefix to the
dynamically generated kernels. But there are also static ones like
kernel-docs. Those fail to build as the constraints are still not
applied.
So add the prefix also to the static ones.
Note kernel-docs-rt is given kernel-source-rt prefix. I am not sure it
will ever be multibuilt...
- commit c2e0681
- Update
patches.suse/drm-atomic-Fix-potential-use-after-free-in-nonblocki.patch
(bsc#1219120 CVE-2023-51043 git-fixes).
- commit d004027
- Revert "Limit kernel-source build to architectures for which the kernel binary"
This reverts commit 08a9e44c00758b5f3f3b641830ab6affff041132.
The fix for bsc#1108281 directly causes bsc#1218768, revert.
- commit 2943b8a
- mkspec: Include constraints for both multibuild and plain package always
There is no need to check for multibuild flag, the constraints can be
always generated for both cases.
- commit 308ea09
- rpm/mkspec: use kernel-source: prefix for constraints on multibuild
Otherwise the constraints are not applied with multibuild enabled.
- commit 841012b
- rpm/kernel-source.rpmlintrc: add action-ebpf
Upstream commit a79d8ba734bd (selftests: tc-testing: remove buildebpf
plugin) added this precompiled binary blob. Adapt rpmlintrc for
kernel-source.
- commit b5ccb33
- block: Fix kabi header include (bsc#1218929).
- commit 8f511ac
- scripts/tar-up.sh: don't add spurious entry from kernel-sources.changes.old
The previous change added the manual entry from kernel-sources.change.old
to old_changelog.txt unnecessarily. Let's fix it.
- commit fb033e8
- Update
patches.suse/ext4-improve-error-recovery-code-paths-in-__ext4_rem.patch
(bsc#1213017 bsc#1219053 CVE-2024-0775).
- commit 97ea702
- block: free the extended dev_t minor later (bsc#1218930).
- commit 0972f94
- rpm/kernel-docs.spec.in: fix build with 6.8
Since upstream commit f061c9f7d058 (Documentation: Document each netlink
family), the build needs python yaml.
- commit 6a7ece3
- hv_netvsc: rndis_filter needs to select NLS (git-fixes).
- commit 6f3116b
- nfsd: fix RELEASE_LOCKOWNER (bsc#1218968).
- commit 605df5b
- netfilter: nf_tables: Reject tables of unsupported family
(bsc#1218752 CVE-2023-6040).
- commit e03f1d3
- bcache: revert replacing IS_ERR_OR_NULL with IS_ERR (git-fixes).
- bcache: replace a mistaken IS_ERR() by IS_ERR_OR_NULL() in
btree_gc_coalesce() (git-fixes).
- rbd: take header_rwsem in rbd_dev_refresh() only when updating
(git-fixes).
- dm: don't lock fs when the map is NULL during suspend or resume
(git-fixes).
- commit fe9ee72
- tipc: fix a potential deadlock on &tx->lock (bsc#1218916
CVE-2024-0641).
- commit c872674
- Update metadata
- commit d121b79
- tipc: fix a potential deadlock on &tx->lock (bsc#1218916
CVE-2024-0641).
- commit 7953be2
- Update metadata
- commit c015ae2
- smb: client: fix OOB in receive_encrypted_standard()
(bsc#1218832 CVE-2024-0565).
- commit 3cac9c2
- ida: Fix crash in ida_free when the bitmap is empty (bsc#1218804
CVE-2023-6915).
- commit 7caa324
- dm-integrity: don't modify bio's immutable bio_vec in
integrity_metadata() (git-fixes).
- dm-verity: align struct dm_verity_fec_io properly (git-fixes).
- dm verity: don't perform FEC for failed readahead IO
(git-fixes).
- bcache: avoid NULL checking to c->root in run_cache_set()
(git-fixes).
- bcache: add code comments for bch_btree_node_get() and
__bch_btree_node_alloc() (git-fixes).
- bcache: fixup multi-threaded bch_sectors_dirty_init() wake-up
race (git-fixes).
- bcache: fixup lock c->root error (git-fixes).
- bcache: fixup init dirty data errors (git-fixes).
- bcache: prevent potential division by zero error (git-fixes).
- bcache: remove redundant assignment to variable cur_idx
(git-fixes).
- bcache: check return value from btree_node_alloc_replacement()
(git-fixes).
- bcache: avoid oversize memory allocation by small stripe_size
(git-fixes).
- dm-delay: fix a race between delay_presuspend and delay_bio
(git-fixes).
- dm zoned: free dmz->ddev array in dmz_put_zoned_devices
(git-fixes).
- rbd: decouple parent info read-in from updating rbd_dev
(git-fixes).
- rbd: decouple header read-in from updating rbd_dev->header
(git-fixes).
- rbd: move rbd_dev_refresh() definition (git-fixes).
- rbd: prevent busy loop when requesting exclusive lock
(git-fixes).
- rbd: retrieve and check lock owner twice before blocklisting
(git-fixes).
- rbd: harden get_lock_owner_info() a bit (git-fixes).
- rbd: make get_lock_owner_info() return a single locker or NULL
(git-fixes).
- dm cache policy smq: ensure IO doesn't prevent cleaner policy
progress (git-fixes).
- dm raid: clean up four equivalent goto tags in raid_ctr()
(git-fixes).
- dm raid: fix missing reconfig_mutex unlock in raid_ctr()
error paths (git-fixes).
- dm integrity: reduce vmalloc space footprint on 32-bit
architectures (git-fixes).
- dm thin metadata: Fix ABBA deadlock by resetting dm_bufio_client
(git-fixes).
- bcache: fixup btree_cache_wait list damage (git-fixes).
- bcache: Fix __bch_btree_node_alloc to make the failure behavior
consistent (git-fixes).
- bcache: Remove unnecessary NULL point check in node allocations
(git-fixes).
- dm thin metadata: check fail_io before using data_sm
(git-fixes).
- commit 7e800d7
- rbd: get snapshot context after exclusive lock is ensured to
be held (git-fixes).
- Refresh for the above change,
patches.suse/rbd-export-some-functions-used-by-lio-rbd-backend.patch.
patches.suse/target_core_rbd-fix-rbd_img_request.snap_id-assignme.patch.
- commit dcd100d
- rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting (git-fixes).
- Rebased for the above change,
patches.suse/rbd-add-support-for-COMPARE_AND_WRITE-CMPEXT.patch.
- commit b5f85f8
- nbd: Fix debugfs_create_dir error checking (git-fixes).
- dm: don't lock fs when the map is NULL in process of resume
(git-fixes).
- dm flakey: fix a crash with invalid table line (git-fixes).
- dm integrity: call kmem_cache_destroy() in dm_integrity_init()
error path (git-fixes).
- dm clone: call kmem_cache_destroy() in dm_clone_init() error
path (git-fixes).
- dm verity: fix error handling for check_at_most_once on FEC
(git-fixes).
- nbd: fix incomplete validation of ioctl arg (git-fixes).
- null_blk: Always check queue mode setting from configfs
(git-fixes).
- dm stats: check for and propagate alloc_percpu failure
(git-fixes).
- dm crypt: avoid accessing uninitialized tasklet (git-fixes).
- dm crypt: add cond_resched() to dmcrypt_write() (git-fixes).
- commit ad93a37
- dm thin: fix deadlock when swapping to thin device
(bsc#1177529).
- Delete the in-house patch by the above upstream patch,
patches.suse/Avoid-deadlock-for-recursive-I-O-on-dm-thin-when-used-as-swap-4905.patch.
- commit 13bcec1
- rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create()
fails (git-fixes).
- dm cache: add cond_resched() to various workqueue loops
(git-fixes).
- dm thin: add cond_resched() to various workqueue loops
(git-fixes).
- dm: add cond_resched() to dm_wq_work() (git-fixes).
- dm: remove flush_scheduled_work() during local_exit()
(git-fixes).
- dm: send just one event on resize, not two (git-fixes).
- dm flakey: fix logic when corrupting a bio (git-fixes).
- dm flakey: don't corrupt the zero page (git-fixes).
- dm init: add dm-mod.waitfor to wait for asynchronously probed
block devices (git-fixes).
- loop: suppress uevents while reconfiguring the device
(git-fixes).
- commit 2a9583d
- nbd: use the correct block_device in nbd_bdev_reset (git-fixes).
- Refresh for the above change,
patches.suse/0019-nbd-fix-io-hung-while-disconnecting-device.patch.
patches.suse/0031-nbd-Fix-hung-when-signal-interrupts-nbd_start_device_ioctl.patch.
- commit 2cb1a83
- blacklist.conf: add non-backport git-fixes commit
- commit ab480ce
- dm verity: skip redundant verity_handle_err() on I/O errors
(git-fixes).
- commit 7d823a7
- Update
patches.kabi/NFS-Fix-another-fsync-issue-after-a-server-reboot.patch
(git-fixes, bsc#1217670).
- commit 69dfe32
- blacklist.conf: df1c357f25d8 netfs: Only call folio_start_fscache() one time for each folio
- commit 049ab09
- intel_idle: add Emerald Rapids Xeon support (bsc#1216016).
- commit 30bac4b
- Update patch reference for rose fix (CVE-2023-51782 bsc#1218757)
- commit da9f8e9
- blacklist.conf: c4d361f66ac9 fuse: share lookup state between submount and its parent
- commit 3180cfa
- powerpc/pseries/iommu: enable_ddw incorrectly returns direct
mapping for SR-IOV device (bsc#1212091 ltc#199106 git-fixes).
- commit f20e9a0
- Store the old kernel changelog entries in kernel-docs package (bsc#1218713)
The old entries are found in kernel-docs/old_changelog.txt in docdir.
rpm/old_changelog.txt can be an optional file that stores the similar
info like rpm/kernel-sources.changes.old. It can specify the commit
range that have been truncated. scripts/tar-up.sh expands from the
git log accordingly.
- commit c9a2566
- x86/entry/ia32: Ensure s32 is sign extended to s64 (bsc#1193285).
- commit 8afebed
- fuse: dax: set fc->dax to NULL in fuse_dax_conn_free()
(bsc#1218659).
- commit 4ee6819
- swiotlb-xen: provide the "max_mapping_size" method (git-fixes).
- commit a036bcf
- xen/events: fix delayed eoi list handling (git-fixes).
- commit eb0149c
- xen-pciback: Consider INTx disabled when MSI/MSI-X is enabled
(git-fixes).
- commit f6ed3e4
- swiotlb: fix a braino in the alignment check fix (bsc#1216559).
- swiotlb: fix slot alignment checks (bsc#1216559).
- commit a41e3fe
- vsock/virtio: Fix unsigned integer wrap around in
virtio_transport_has_space() (git-fixes).
- commit db5c328
- vhost: Allow null msg.size on VHOST_IOTLB_INVALIDATE
(git-fixes).
- commit ad9e29a
- virtio_balloon: Fix endless deflation and inflation on arm64
(git-fixes).
- commit 6583f74
- virtio-mmio: fix memory leak of vm_dev (git-fixes).
- commit d624528
- KVM: SVM: Update EFER software model on CR0 trap for SEV-ES
(git-fixes).
- commit 8696527
- KVM: x86: Mask LVTPC when handling a PMI (jsc#PED-7322).
- commit 146bca2
- io_uring/af_unix: disable sending io_uring over sockets
(bsc#1218447, CVE-2023-6531).
- commit fdc256b
- smb: client: fix potential OOB in smb2_dump_detail()
(bsc#1217946 CVE-2023-6610).
- commit cfca7f7
- x86/purgatory: Remove LTO flags (git-fixes).
- commit bbd4f84
- x86/fpu/xstate: Prevent false-positive warning in __copy_xstate_uabi_buf() (git-fixes).
- commit 46d60b3
- x86/fpu: Invalidate FPU state correctly on exec() (git-fixes).
- commit 7686df9
- x86/cpu: Fix amd_check_microcode() declaration (git-fixes).
- Refresh patches.suse/x86-srso-set-cpuid-feature-bits-independently-of-bug-or-mitigation-status.patch.
- commit c22f4b4
- x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 (git-fixes).
- commit d74349c
- vsprintf/kallsyms: Prevent invalid data when printing symbol
(bsc#1217602).
- commit 8dab9cc
- Limit kernel-source build to architectures for which the kernel binary
is built (bsc#1108281).
- commit 08a9e44
- x86/boot: Fix incorrect startup_gdt_descr.size (git-fixes).
- commit fdc98a7
- x86/boot/compressed: Reserve more memory for page tables (git-fixes).
- commit 6bf16e1
- gfs2: Silence "suspicious RCU usage in gfs2_permission" warning
(git-fixes).
- commit 3929c70
- x86/alternatives: Sync core before enabling interrupts (git-fixes).
- commit 4a0b72a
- x86/alternatives: Disable KASAN in apply_alternatives() (git-fixes).
- commit 7029135
- x86/smp: Use dedicated cache-line for mwait_play_dead() (git-fixes).
- commit 8087b92
- x86/srso: Add SRSO mitigation for Hygon processors (git-fixes).
- commit 7b8dfd1
- x86/srso: Fix SBPB enablement for (possible) future fixed HW (git-fixes).
- Refresh
patches.suse/x86-srso-fix-vulnerability-reporting-for-missing-microcode.patch.
- commit b121d1d
- x86/CPU/AMD: Check vendor in the AMD microcode callback (git-fixes).
- commit 43e31d9
- x86/srso: Fix vulnerability reporting for missing microcode (git-fixes).
- commit 98085ae
- x86/unwind/orc: Unwind ftrace trampolines with correct ORC entry (git-fixes).
- commit 270b9c8
- x86/alternatives: Disable interrupts and sync when optimizing NOPs in place (git-fixes).
- commit 1bd102b
- gfs2: fix an oops in gfs2_permission (git-fixes).
- commit 60a8e84
- iov_iter, x86: Be consistent about the __user tag on copy_mc_to_user() (git-fixes).
- commit a2dd84b
- gfs2: ignore negated quota changes (git-fixes).
- commit c2a4d43
- x86/resctrl: Fix kernel-doc warnings (git-fixes).
- commit 50de71c
- gfs2: Fix possible data races in gfs2_show_options()
(git-fixes).
- commit 7592b99
- gfs2: Fix inode height consistency check (git-fixes).
- commit 935054a
- gfs2: jdata writepage fix (git-fixes).
- commit e5f9516
- gfs2: Improve gfs2_make_fs_rw error handling (git-fixes).
- commit 86c44aa
- gfs2: Check sb_bsize_shift after reading superblock (git-fixes).
- commit 130df3d
- gfs2: Switch from strlcpy to strscpy (git-fixes).
- commit 3054547
- gfs2: use i_lock spin_lock for inode qadata (git-fixes).
- commit 4e4b75a
- gfs2: Fix filesystem block deallocation for short writes
(git-fixes).
- commit 87cd867
- gfs2: Make sure FITRIM minlen is rounded up to fs block size
(git-fixes).
- commit 62669a7
- gfs2: gfs2_setattr_size error path fix (git-fixes).
- commit d0e789c
- gfs2: Fix gfs2_release for non-writers regression (git-fixes).
- commit 1a34aa3
- gfs2: Fix length of holes reported at end-of-file (git-fixes).
- commit 09da26e
- gfs2: Clean up function may_grant (git-fixes).
- commit ce33b14
- gfs2: Add wrapper for iomap_file_buffered_write (git-fixes).
- commit e045f1b
- locks: fix KASAN: use-after-free in
trace_event_raw_event_filelock_lock (git-fixes).
- commit 4758492
- fs: avoid empty option when generating legacy mount string
(git-fixes).
- commit 00945db
- statfs: enforce statfs[64] structure initialization (git-fixes).
- commit d4a18c5
- orangefs: Fix kmemleak in orangefs_{kernel,client}_debug_init()
(git-fixes).
- commit b9e9b76
- orangefs: Fix kmemleak in orangefs_prepare_debugfs_help_string()
(git-fixes).
- commit 1d47e4a
- orangefs: Fix sysfs not cleanup when dev init failed
(git-fixes).
- commit f7a82d1
- fs/remap: constrain dedupe of EOF blocks (git-fixes).
- commit e861bd6
- fs: fix an infinite loop in iomap_fiemap (git-fixes).
- commit 41989d9
- orangefs: Fix the size of a memory allocation in
orangefs_bufmap_alloc() (git-fixes).
- commit 6623b23
- iomap: Fix iomap_dio_rw return value for user copies
(git-fixes).
- commit 2b65ea1
- ubifs: Fix memory leak of bud->log_hash (git-fixes).
- commit dfe9a1f
- ubifs: fix possible dereference after free (git-fixes).
- commit 971dae9
- fs: ocfs2: namei: check return value of ocfs2_add_entry()
(git-fixes).
- commit 63eae38
- jfs: fix array-index-out-of-bounds in diAlloc (git-fixes).
- commit 8906b9a
- jfs: fix array-index-out-of-bounds in dbFindLeaf (git-fixes).
- commit 28815ad
- fs/jfs: Add validity check for db_maxag and db_agpref
(git-fixes).
- commit 39d5b5e
- fs/jfs: Add check for negative db_l2nbperpage (git-fixes).
- commit f831778
- jfs: validate max amount of blocks before allocation
(git-fixes).
- commit 4be1419
- jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount
(git-fixes).
- commit 5b4b023
- fs/jfs: prevent double-free in dbUnmount() after failed
jfs_remount() (git-fixes).
- commit 51a993a
- reiserfs: Replace 1-element array with C99 style flex-array
(git-fixes).
- commit 6ad83f4
- reiserfs: Check the return value from __getblk() (git-fixes).
- commit 0e912c9
- afs: Fix use-after-free due to get/remove race in volume tree
(git-fixes).
- commit f4a57bf
- afs: Fix overwriting of result of DNS query (git-fixes).
- commit fe0f4c6
- afs: Fix dynamic root lookup DNS check (git-fixes).
- commit 1e86064
- afs: Fix the dynamic root's d_delete to always delete unused
dentries (git-fixes).
- commit 3d5b3d7
- afs: Fix refcount underflow from error handling race
(git-fixes).
- commit 0a9c8bb
- afs: Fix file locking on R/O volumes to operate in local mode
(git-fixes).
- commit 5431cb3
- afs: Return ENOENT if no cell DNS record can be found
(git-fixes).
- commit 863355b
- afs: Make error on cell lookup failure consistent with OpenAFS
(git-fixes).
- commit 5fcd2cf
- afs: Fix afs_server_list to be cleaned up with RCU (git-fixes).
- commit 8fc4f69
- remove unnecessary WARN_ON_ONCE() (bsc#1214823 bsc#1218569).
- commit 6bd8135
- Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
(CVE-2023-51779 bsc#1218559).
- commit b8b3309
- Delete doc/config-options.changes (jsc#PED-5021)
Following on adedbd2a5c6 ("kernel-source: Remove config-options.changes
(jsc#PED-5021)"), remove the now unused file from the tree.
- commit d1b9e97
- tracing: Fix blocked reader of snapshot buffer (git-fixes).
- commit f6f3907
- ring-buffer: Fix wake ups when buffer_percent is set to 100
(git-fixes).
- commit 21c1070
- tracing / synthetic: Disable events after testing in
synth_event_gen_test_init() (git-fixes).
- commit e21c29f
- tracing/synthetic: fix kernel-doc warnings (git-fixes).
- commit 62cdcf8
- Revert "PCI/ASPM: Remove pcie_aspm_pm_state_change()"
(git-fixes).
- commit 9be35d2
- mkspec: Add multibuild support (JSC-SLE#5501, boo#1211226, bsc#1218184)
When MULTIBUILD option in config.sh is enabled generate a _multibuild
file listing all spec files.
- commit f734347
- Build in the correct KOTD repository with multibuild
(JSC-SLE#5501, boo#1211226, bsc#1218184)
With multibuild setting repository flags is no longer supported for
individual spec files - see
https://github.com/openSUSE/open-build-service/issues/3574
Add ExclusiveArch conditional that depends on a macro set up by
bs-upload-kernel instead. With that each package should build only in
one repository - either standard or QA.
Note: bs-upload-kernel does not interpret rpm conditionals, and only
uses the first ExclusiveArch line to determine the architectures to
enable.
- commit aa5424d
- blacklist.conf: Add c98c18270be1 sched, cgroup: Restore meaning to hierarchical_quota
- commit 6115840
- mm: kmem: drop __GFP_NOFAIL when allocating objcg vectors
(bsc#1218515).
- commit 00f113e
- blacklist.conf: e63a57303599 blk-cgroup: bypass blkcg_deactivate_policy after destroying
- commit 895355e
- ring-buffer: Fix slowpath of interrupted event (git-fixes).
- commit dbe7edd
- ring-buffer: Remove useless update to write_stamp in
rb_try_to_discard() (git-fixes).
- commit 64ff947
- RDMA/hfi1: Workaround truncation compilation error (git-fixes)
- commit 2302fb3
- RDMA/hns: The UD mode can only be configured with DCQCN (git-fixes)
- commit ca9d38d
- RDMA/hns: Add check for SL (git-fixes)
- commit cf9e8e3
- RDMA/hns: Fix signed-unsigned mixed comparisons (git-fixes)
- commit 34178f4
- RDMA/hns: Fix uninitialized ucmd in hns_roce_create_qp_common() (git-fixes)
- commit 47c4074
- RDMA/hns: Fix printing level of asynchronous events (git-fixes)
- commit 892f8ec
- IB/mlx5: Fix rdma counter binding for RAW QP (git-fixes)
- commit ffaf04e
- RDMA/hfi1: Use FIELD_GET() to extract Link Width (git-fixes)
- commit 4b8aeed
- RDMA/core: Use size_{add,sub,mul}() in calls to struct_size() (git-fixes)
- commit 605983a
- uapi: propagate __struct_group() attributes to the container
union (jsc#SLE-18978).
- commit 3b553e2
- Update References
patches.suse/Bluetooth-Reject-connection-with-the-device-which-ha.patch
(git-fixes bsc#1215237 CVE-2020-26555).
- commit 0b8be40
- Update References
patches.suse/Bluetooth-hci_event-Ignore-NULL-link-key.patch
(git-fixes bsc#1215237 CVE-2020-26555).
- commit 3386934
- iio: adc: ti_am335x_adc: Fix return value check of
tiadc_request_dma() (git-fixes).
- iio: triggered-buffer: prevent possible freeing of wrong buffer
(git-fixes).
- iio: imu: inv_mpu6050: fix an error code problem in
inv_mpu6050_read_raw (git-fixes).
- iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion
time table (git-fixes).
- interconnect: Treat xlate() returning NULL node as an error
(git-fixes).
- Input: ipaq-micro-keys - add error handling for devm_kmemdup
(git-fixes).
- lib/vsprintf: Fix %pfwf when current node refcount == 0
(git-fixes).
- ASoC: hdmi-codec: fix missing report for jack initial status
(git-fixes).
- i2c: aspeed: Handle the coalesced stop conditions with the
start conditions (git-fixes).
- pinctrl: at91-pio4: use dedicated lock class for IRQ
(git-fixes).
- wifi: mac80211: mesh_plink: fix matches_local logic (git-fixes).
- net: rfkill: gpio: set GPIO direction (git-fixes).
- wifi: iwlwifi: pcie: add another missing bh-disable for
rxq->lock (git-fixes).
- ARM: OMAP2+: Fix null pointer dereference and memory leak in
omap_soc_device_init (git-fixes).
- spi: atmel: Fix clock issue when using devices with different
polarities (git-fixes).
- soundwire: stream: fix NULL pointer dereference for multi_link
(git-fixes).
- Revert "PCI: acpiphp: Reassign resources on bridge if necessary"
(git-fixes).
- PCI: loongson: Limit MRRS to 256 (git-fixes).
- ALSA: hda/realtek: Apply mute LED quirk for HP15-db (git-fixes).
- ALSA: hda/hdmi: add force-connect quirks for ASUSTeK Z170
variants (git-fixes).
- ALSA: hda/hdmi: add force-connect quirk for NUC5CPYB
(git-fixes).
- net/rose: Fix Use-After-Free in rose_ioctl (git-fixes).
- net: usb: qmi_wwan: claim interface 4 for ZTE MF290 (git-fixes).
- usb: aqc111: check packet for fixup for true limit (git-fixes).
- commit ed00079
- Drop PCI AER patch that has been reverted on stable trees
Deleted:
patches.suse/PCI-portdrv-Don-t-disable-AER-reporting-in-get_port_.patch
- commit 43c7676
- Drop drm/bridge lt9611uxc patches that have been reverted on stable trees
- commit b9351c7
- smb: client: fix OOB in smbCalcSize() (bsc#1217947
CVE-2023-6606).
- commit 97b24d1
- Update References
patches.suse/tty-n_gsm-fix-the-UAF-caused-by-race-condition-in-gs.patch
(git-fixes bsc#1218335 CVE-2023-6546).
- commit ad12641
- perf: Fix perf_event_validate_size() lockdep splat
(CVE-2023-6931 bsc#1218258).
- perf: Fix perf_event_validate_size() (CVE-2023-6931
bsc#1218258).
- commit 00427a6
- nvme-pci: always return an ERR_PTR from nvme_pci_alloc_dev
(git-fixes).
- commit 6c500e1
- s390/vx: fix save/restore of fpu kernel context (git-fixes
bsc#1218357).
- commit 4f47f85
- blacklist.conf: add nvme entries
- commit 9216151
- nvme-pci: Add sleep quirk for Kingston drives (git-fixes).
- nvmet-auth: complete a request only after freeing the dhchap
pointers (git-fixes).
- nvme: sanitize metadata bounce buffer for reads (git-fixes).
- nvme-rdma: do not try to stop unallocated queues (git-fixes).
- nvme-pci: do not set the NUMA node of device if it has none
(git-fixes).
- nvme-pci: factor out a nvme_pci_alloc_dev helper (git-fixes).
- nvme-pci: factor the iod mempool creation into a helper
(git-fixes).
Refresh:
- patches.suse/nvme-pci-fix-page-size-checks.patch
- commit 19bc755
- Rename to
patches.suse/nvme-auth-use-chap-s2-to-indicate-bidirectional-auth.patch.
and move the patch into the sorted section
- commit 633cfe2
- net/smc: Fix pos miscalculation in statistics (bsc#1218139).
- commit 513a67c
- bus: ti-sysc: Flush posted write only after srst_udelay
(git-fixes).
- commit c942b7c
- reset: Fix crash when freeing non-existent optional resets
(git-fixes).
- commit 6de5ad5
- HID: multitouch: Add quirk for HONOR GLO-GXXX touchpad
(git-fixes).
- commit 60dd723
- HID: hid-asus: reset the backlight brightness level on resume
(git-fixes).
- commit 79eff80
- HID: hid-asus: add const to read-only outgoing usb buffer
(git-fixes).
- commit 1c939ed
- HID: add ALWAYS_POLL quirk for Apple kb (git-fixes).
- commit d088123
- restore renamed device IDs for USB HID devices (git-fixes).
- commit 5519e39
- HID: glorious: fix Glorious Model I HID report (git-fixes).
- commit ad69d7e
- scsi: lpfc: use unsigned type for num_sge (bsc#1214747).
- commit 513fc35
- r8152: Add RTL8152_INACCESSIBLE to r8153_aldps_en() (git-fixes).
- commit 3ae518f
- r8152: Add RTL8152_INACCESSIBLE to r8153_pre_firmware_1()
(git-fixes).
- commit d714a95
- r8152: Add RTL8152_INACCESSIBLE to r8156b_wait_loading_flash()
(git-fixes).
- commit ad9ad0d
- bpf: Adjust insufficient default bpf_jit_limit (bsc#1218234 git-fixes).
- commit 697b74c
- ipv4: igmp: fix refcnt uaf issue when receiving igmp query
packet (bsc#1218253 CVE-2023-6932).
- commit 87dfb84
- Refresh patches.suse/gve-Tx-path-for-DQO-QPL.patch.
Fix backport.
- commit f5531ee
- Input: xpad - add HyperX Clutch Gladiate Support (git-fixes).
- commit 6d0690b
- Input: i8042 - add quirk for TUXEDO Gemini 17 Gen1/Clevo PD70PN
(git-fixes).
- commit 8fa7ef8
- ring-buffer: Fix a race in rb_time_cmpxchg() for 32 bit archs
(git-fixes).
- commit a4fe241
- ring-buffer: Do not try to put back write_stamp (git-fixes).
- commit df9fac1
- ring-buffer: Have saved event hold the entire event (git-fixes).
- commit 5347597
- ring-buffer: Do not update before stamp when switching
sub-buffers (git-fixes).
- commit 9c594ba
- tracing: Update snapshot buffer on resize if it is allocated
(git-fixes).
- commit d5996f1
- ring-buffer: Fix memory leak of free page (git-fixes).
- commit ee5f869
- ring-buffer: Fix writing to the buffer with max_data_size
(git-fixes).
- commit bb90d48
- blacklist.conf: cleanup
- commit 16dcb62
- usb: hub: Guard against accesses to uninitialized BOS
descriptors (git-fixes).
- commit 573da1a
- kABI: restore void return to typec_altmode_attention
(git-fixes).
- commit 9821aa3
- usb: typec: bus: verify partner exists in
typec_altmode_attention (git-fixes).
- commit 5fea3d2
- blacklist.conf: it changes only logging
- commit 3cbbd08
- r8152: Add RTL8152_INACCESSIBLE checks to more loops
(git-fixes).
- commit f62163f
- r8152: Rename RTL8152_UNPLUG to RTL8152_INACCESSIBLE
(git-fixes).
- commit 064cc95
- Documentation: drop more IDE boot options and ide-cd.rst
(git-fixes).
- commit 7993dcc
- Update patches.suse/spi-tegra210-quad-Fix-duplicate-resource-error.patch (git-fixes, jsc#PED-3459
Add reference to PED-3459
- commit c4a5ea6
- Update patches.suse/spi-tegra210-quad-Multi-cs-support.patch (bsc#1212584, jsc#PED-3459
Add reference to PED-3459.
- commit fc374a4
- Update patches.suse/spi-tegra210-quad-Fix-combined-sequence.patch (bsc#1212584, jsc#PED-3459)
Add reference to PED-3459.
- commit bff7fca
- Drop Documentation/ide/ (git-fixes).
- commit d3eb72d
- padata: Fix refcnt handling in padata_free_shell() (git-fixes).
- commit 5219779
- tracing: Set actual size after ring buffer resize (git-fixes).
- commit b915dbf
- tracing/perf: Add interrupt_context_level() helper (git-fixes).
- commit 9da609b
- tracing: Reuse logic from perf's get_recursion_context()
(git-fixes).
- commit adc2c65
- tracing: relax trace_event_eval_update() execution with
cond_resched() (git-fixes).
- commit 017c09c
- ring-buffer: Force absolute timestamp on discard of event
(git-fixes).
- commit 703d47b
- tracing: Disable snapshot buffer when stopping instance tracers
(git-fixes).
- commit ea1804c
- tracing: Stop current tracer when resizing buffer (git-fixes).
- commit 416045c
- tracing: Always update snapshot buffer size (git-fixes).
- commit ab3ac02
- kprobes: consistent rcu api usage for kretprobe holder
(git-fixes).
- commit bd133f6
- tracing/kprobes: Fix the order of argument descriptions
(git-fixes).
- commit 4822ad0
- tracing: Have the user copy of synthetic event address use
correct context (git-fixes).
- commit ee4a2b2
- KVM: s390/mm: Properly reset no-dat (git-fixes bsc#1218056).
- commit 5b3fa66
- kabi/severities: ignore kABI for asus-wmi drivers
Tolerate the kABI changes, as used only locally for asus-wmi stuff
- commit 42dad1e
- platform/x86: asus-wmi: Add support for ROG X13 tablet mode
(git-fixes).
- commit 1640ab2
- serial: sc16is7xx: address RX timeout interrupt errata
(git-fixes).
- parport: Add support for Brainboxes IX/UC/PX parallel cards
(git-fixes).
- hwmon: (nzxt-kraken2) Fix error handling path in kraken2_probe()
(git-fixes).
- hwmon: (acpi_power_meter) Fix 4.29 MW bug (git-fixes).
- ALSA: pcm: fix out-of-bounds in snd_pcm_state_names (git-fixes).
- ALSA: hda/realtek: Enable headset on Lenovo M90 Gen5
(git-fixes).
- ALSA: usb-audio: Add Pioneer DJM-450 mixer controls (git-fixes).
- nilfs2: prevent WARNING in nilfs_sufile_set_segment_usage()
(git-fixes).
- nilfs2: fix missing error check for sb_set_blocksize call
(git-fixes).
- platform/x86: wmi: Skip blocks with zero instances (git-fixes).
- platform/x86: asus-wmi: Move i8042 filter install to shared
asus-wmi code (git-fixes).
- drm/amdgpu: correct the amdgpu runtime dereference usage count
(git-fixes).
- kconfig: fix memory leak from range properties (git-fixes).
- i2c: designware: Fix corrupted memory seen in the ISR
(git-fixes).
- drm/amdgpu: correct chunk_ptr to a pointer to chunk (git-fixes).
- drm/amd/amdgpu: Fix warnings in amdgpu/amdgpu_display.c
(git-fixes).
- platform/x86: asus-wmi: Fix kbd_dock_devid tablet-switch
reporting (git-fixes).
- platform/x86: wmi: Allow duplicate GUIDs for drivers that use
struct wmi_driver (git-fixes).
- platform/x86: asus-wmi: Simplify tablet-mode-switch handling
(git-fixes).
- platform/x86: asus-wmi: Simplify tablet-mode-switch probing
(git-fixes).
- platform/x86: asus-wmi: Adjust tablet/lidflip handling to use
enum (git-fixes).
- commit e47d99c
- tracing/kprobes: Fix the description of variable length
arguments (git-fixes).
- commit ee78d8b
- neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section
(git-fixes).
- commit 946e077
- netfilter: nf_tables: bail out on mismatching dynset and set
expressions (bsc#1217938 CVE-2023-6622).
- commit de1dd10
- HID: lenovo: Restrict detection of patched firmware only to
USB cptkbd (git-fixes).
- commit 1bd99d4
- ASoC: wm_adsp: fix memleak in wm_adsp_buffer_populate
(git-fixes).
- Bluetooth: hci_qca: Fix the teardown problem for real
(git-fixes).
- Documentation: qat: Use code block for qat sysfs example
(git-fixes).
- commit c75f6d8
- ALSA: hda/realtek: Add supported ALC257 for ChromeOS
(git-fixes).
- ALSA: hda/realtek: Headset Mic VREF to 100% (git-fixes).
- ALSA: hda: intel-dsp-cfg: add LunarLake support (git-fixes).
- ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects
(git-fixes).
- ACPI: video: Add backlight=native DMI quirk for Lenovo Ideapad
Z470 (git-fixes).
- ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer (git-fixes).
- ALSA: seq: oss: Fix racy open/close of MIDI devices (git-fixes).
- commit 200c0a2
- blacklist.conf: add two ceph commits
- commit d8d4641
- ceph: fix type promotion bug on 32bit systems (bsc#1217982).
- libceph: use kernel_connect() (bsc#1217981).
- ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
(bsc#1217980).
- commit e3e482f
- arm64: mm: Fix "rodata=on" when CONFIG_RODATA_FULL_DEFAULT_ENABLED=y (git-fixes)
- commit 794f0e7
- arm64: dts: imx8mn: Add sound-dai-cells to micfil node (git-fixes)
- commit 4dcfded
- arm64: dts: imx8mm: Add sound-dai-cells to micfil node (git-fixes)
- commit 0fd1b8d
- arm64: dts: arm: add missing cache properties (git-fixes)
- commit 710ea40
- blacklist.conf: ("arm64: dts: broadcom: bcmbca: bcm4908: fix LED nodenames")
- commit 37fe1b1
- arm64: dts: imx8mq-librem5: Remove dis_u3_susphy_quirk from (git-fixes)
- commit 8cd5213
- net/tg3: fix race condition in tg3_reset_task() (bsc#1217801).
- commit 68db0d6
- tracing: Fix a possible race when disabling buffered events
(bsc#1217036).
- commit 26540da
- tracing: Fix a warning when allocating buffered events fails
(bsc#1217036).
- commit ec57b73
- tracing: Fix incomplete locking when disabling buffered events
(bsc#1217036).
- commit 2d81a3a
- tracing: Disable preemption when using the filter buffer
(bsc#1217036).
- commit 0ade134
- tracing: Use __this_cpu_read() in
trace_event_buffer_lock_reserver() (bsc#1217036).
- commit 8aa5d9a
- tracing: Fix warning in trace_buffered_event_disable()
(git-fixes, bsc#1217036).
- commit b71b6ff
- usb: typec: ucsi: acpi: add quirk for ASUS Zenbook UM325
(git-fixes).
- commit 19f2446
- nvmet: nul-terminate the NQNs passed in the connect command
(bsc#1217250 CVE-2023-6121).
- commit e359ed1
- KVM: s390: vsie: fix wrong VIR 37 when MSO is used (git-fixes
bsc#1217933).
- commit e39e7a6
- gpiolib: sysfs: Fix error handling on failed export (git-fixes).
- Revert "xhci: Loosen RPM as default policy to cover for AMD
xHC 1.1" (git-fixes).
- usb: typec: class: fix typec_altmode_put_partner to put plugs
(git-fixes).
- ARM: PL011: Fix DMA support (git-fixes).
- serial: 8250: 8250_omap: Clear UART_HAS_RHR_IT_DIS bit
(git-fixes).
- serial: 8250: 8250_omap: Do not start RX DMA on THRI interrupt
(git-fixes).
- misc: mei: client.c: fix problem of return '-EOVERFLOW' in
mei_cl_write (git-fixes).
- misc: mei: client.c: return negative error code in mei_cl_write
(git-fixes).
- commit 09a57bf
- md/raid1: fix error: ISO C90 forbids mixed declarations
(git-fixes).
- md: raid0: account for split bio in iostat accounting
(git-fixes).
- md/raid1: hold the barrier until handle_read_error() finishes
(git-fixes).
- md/raid1: free the r1bio before waiting for blocked rdev
(git-fixes).
- md: raid1: fix potential OOB in raid1_remove_disk() (git-fixes).
- md/md-bitmap: hold 'reconfig_mutex' in backlog_store()
(git-fixes).
- md/md-bitmap: remove unnecessary local variable in
backlog_store() (git-fixes).
- md/raid10: use dereference_rdev_and_rrdev() to get devices
(git-fixes).
- md/raid10: factor out dereference_rdev_and_rrdev() (git-fixes).
- md: restore 'noio_flag' for the last mddev_resume() (git-fixes).
- Revert "md: unlock mddev before reap sync_thread in
action_store" (git-fixes).
- md/raid0: add discard support for the 'original' layout
(git-fixes).
- md/raid10: fix the condition to call bio_end_io_acct()
(git-fixes).
- md/raid10: prevent soft lockup while flush writes (git-fixes).
- md/raid10: fix io loss while replacement replace rdev
(git-fixes).
- md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request
(git-fixes).
- md/raid10: fix wrong setting of max_corr_read_errors
(git-fixes).
- md/raid10: fix overflow of md/safe_mode_delay (git-fixes).
- md/raid5: fix miscalculation of 'end_sector' in
raid5_read_one_chunk() (git-fixes).
- md/raid10: don't call bio_start_io_acct twice for bio which
experienced read error (git-fixes).
- md/raid10: fix memleak of md thread (git-fixes).
- md/raid10: fix memleak for 'conf->bio_split' (git-fixes).
- md/raid10: fix leak of 'r10bio->remaining' for recovery
(git-fixes).
- md/raid10: fix null-ptr-deref in raid10_sync_request
(git-fixes).
- commit 75c9e76
- md/raid10: fix task hung in raid10d (git-fixes).
- Refresh patches.suse/md-display-timeout-error.patch for the above change.
- commit 90d12ef
- md: avoid signed overflow in slot_store() (git-fixes).
- md/raid10: factor out code from wait_barrier() to
stop_waiting_barrier() (git-fixes).
- commit c35659b
- md: Set MD_BROKEN for RAID1 and RAID10 (git-fixes).
- Update patches.suse/md-display-timeout-error.patch for the above change.
- commit 77abf5c
- md: raid10 add nowait support (git-fixes).
- md: drop queue limitation for RAID1 and RAID10 (git-fixes).
- md/bitmap: don't set max_write_behind if there is no write
mostly device (git-fixes).
- commit 44a1c08
- blacklist.conf: add non-backport commits
- commit 731fcaa
- kernel-source: Remove config-options.changes (jsc#PED-5021)
The file doc/config-options.changes was used in the past to document
kernel config changes. It was introduced in 2010 but haven't received
any updates on any branch since 2015. The file is renamed by tar-up.sh
to config-options.changes.txt and shipped in the kernel-source RPM
package under /usr/share/doc. As its content now only contains outdated
information, retaining it can lead to confusion for users encountering
this file.
Config changes are nowadays described in associated Git commit messages,
which get automatically collected and are incorporated into changelogs
of kernel RPM packages.
Drop then this obsolete file, starting with its packaging logic.
For branch maintainers: Upon merging this commit on your branch, please
correspondingly delete the file doc/config-options.changes.
- commit adedbd2
- doc/README.SUSE: Simplify the list of references (jsc#PED-5021)
Reduce indentation in the list of references, make the style consistent
with README.md.
- commit 70e3c33
- regmap: fix bogus error on regcache_sync success (git-fixes).
- platform/surface: aggregator: fix recv_buf() return value
(git-fixes).
- commit e5d6930
- doc/README.SUSE: Add how to update the config for module signing
(jsc#PED-5021)
Configuration files for SUSE kernels include settings to integrate with
signing support provided by the Open Build Service. This creates
problems if someone tries to use such a configuration file to build
a "standalone" kernel as described in doc/README.SUSE:
* Default configuration files available in the kernel-source repository
unset CONFIG_MODULE_SIG_ALL to leave module signing to
pesign-obs-integration. In case of a "standalone" build, this
integration is not available and the modules don't get signed.
* The kernel spec file overrides CONFIG_MODULE_SIG_KEY to
".kernel_signing_key.pem" which is a file populated by certificates
provided by OBS but otherwise not available. The value ends up in
/boot/config-$VERSION-$RELEASE-$FLAVOR and /proc/config.gz. If someone
decides to use one of these files as their base configuration then the
build fails with an error because the specified module signing key is
missing.
Add information on how to enable module signing and where to find the
relevant upstream documentation.
- commit a699dc3
- doc/README.SUSE: Remove how to build modules using kernel-source
(jsc#PED-5021)
Remove the first method how to build kernel modules from the readme. It
describes a process consisting of the kernel-source installation,
configuring this kernel and then performing an ad-hoc module build.
This method is not ideal as no modversion data is involved in the
process. It results in a module with no symbol CRCs which can be wrongly
loaded on an incompatible kernel.
Removing the method also simplifies the readme because only two main
methods how to build the modules are then described, either doing an
ad-hoc build using kernel-devel, or creating a proper Kernel Module
Package.
- commit 9285bb8
- blacklist.conf: just in case fix for a corner case
- commit a3fc582
- xhci: Clear EHB bit only at end of interrupt handler
(git-fixes).
- commit d5adf2a
- usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
(git-fixes).
- commit 5cdcb2d
- usb: host: xhci-plat: fix possible kernel oops while resuming
(git-fixes).
- commit b0504f4
- NFS: More fixes for nfs_direct_write_reschedule_io()
(bsc#1211162).
- NFS: Use the correct commit info in nfs_join_page_group()
(bsc#1211162).
- NFS: More O_DIRECT accounting fixes for error paths
(bsc#1211162).
- NFS: Fix O_DIRECT locking issues (bsc#1211162).
- NFS: Fix error handling for O_DIRECT write scheduling
(bsc#1211162).
- NFS: Fix a potential data corruption (bsc#1211162).
- NFS: Fix a use after free in nfs_direct_join_group()
(bsc#1211162).
- nfs: only issue commit in DIO codepath if we have uncommitted
data (bsc#1211162).
- NFS: Fix a few more clear_bit() instances that need release
semantics (bsc#1211162).
- commit e61bcf9
- xfs: make sure maxlen is still congruent with prod when rounding
down (git-fixes).
- commit 2b9fc44
- xfs: fix units conversion error in xfs_bmap_del_extent_delay
(git-fixes).
- commit 95e2620
- xfs: fix agf_fllast when repairing an empty AGFL (git-fixes).
- commit bfb62b0
- xfs: return EINTR when a fatal signal terminates scrub
(git-fixes).
- commit e6f4fe7
- xfs: fix a bug in the online fsck directory leaf1 bestcount
check (git-fixes).
- commit e328537
- xfs: fix incorrect unit conversion in scrub tracepoint
(git-fixes).
- Refresh
patches.suse/xfs-standardize-AG-block-number-formatting-in-ftrace-output.patch.
- Refresh
patches.suse/xfs-standardize-AG-number-formatting-in-ftrace-output.patch.
- commit e256630
- xfs: decode scrub flags in ftrace output (git-fixes).
- commit d1fe7f7
- xfs: remove the xfs_dsb_t typedef (git-fixes).
- commit 4e9f379
- xfs: fix uninit warning in xfs_growfs_data (git-fixes).
- commit e9c4821
- xfs: convert flex-array declarations in struct xfs_attrlist*
(git-fixes).
- commit e33e297
- xfs: remove the xfs_dinode_t typedef (git-fixes).
- commit c807e19
- xfs: convert flex-array declarations in xfs attr shortform
objects (git-fixes).
- commit 757cbc7
- xfs: convert flex-array declarations in xfs attr leaf blocks
(git-fixes).
- commit 1823624
- xfs: use swap() to make dabtree code cleaner (git-fixes).
- commit d160cc2
- xfs: fix silly whitespace problems with kernel libxfs
(git-fixes).
- commit d822e52
- xfs: rename xfs_has_attr() (git-fixes).
- commit fe8702c
- xfs: Rename __xfs_attr_rmtval_remove (git-fixes).
- commit 6ea2cef
- xfs: sysfs: use default_groups in kobj_type (git-fixes).
- commit 74d9b5c
- xfs: replace snprintf in show functions with sysfs_emit
(git-fixes).
- commit 84db35d
- xfs: simplify two-level sysctl registration for xfs_table
(git-fixes).
- commit 0321d28
- xfs: add selinux labels to whiteout inodes (git-fixes).
- commit 8dc479c
- xfs: Use kvcalloc() instead of kvzalloc() (git-fixes).
- Refresh
patches.suse/xfs-reject-crazy-array-sizes-being-fed-to-XFS_IOC_GE.patch.
- commit 89900e3
- xfs: clean up "%Ld/%Lu" which doesn't meet C standard
(git-fixes).
- commit dbcc289
- xfs: aborting inodes on shutdown may need buffer lock
(git-fixes).
- commit 8b202be
- xfs: remove the xfs_dqblk_t typedef (git-fixes).
- commit 4747a77
- xfs: dump log intent items that cannot be recovered due to
corruption (git-fixes).
- commit 6f8c678
- xfs: sb verifier doesn't handle uncached sb buffer (git-fixes).
- commit c0c7079
- xfs: remove kmem_alloc_io() (git-fixes).
- commit 831b642
- x86/platform/uv: Use alternate source for socket to node data
(bsc#1215696 bsc#1217790).
- commit ec7f699
- avahi
-
- Add avahi-CVE-2023-38472.patch: Fix reachable assertion in
avahi_rdata_parse (bsc#1216853, CVE-2023-38472).
- util-linux
-
- Add upstream patch
more-exit-if-POLLERR-and-POLLHUP-on-stdin-is-received.patch
bsc#1220117 - L3-Question: Processes not cleaned up after failed SSH session are using up 100% CPU
- Add upstream patch
util-linux-libuuid-avoid-truncate-clocks.txt-to-improve-perform.patch
bsc#1207987 gh#util-linux/util-linux@1d98827edde4
- libxcrypt
-
- fix variable name for datamember in 'struct crypt_data' [bsc#1215496]
- added patches
fix https://github.com/besser82/libxcrypt/commit/b212d601549a0fc84cbbcaf21b931f903787d7e2
+ libxcrypt-man-fix-variable-name.patch
- mozilla-nss
-
- update to NSS 3.90.2
* bmo#1780432 - (CVE-2023-5388) Timing attack against RSA
decryption in TLS. (bsc#1216198)
* bmo#1867408 - add a defensive check for large ssl_DefSend
return values.
- update to NSS 3.90.1
* bmo#1813401 - regenerate NameConstraints test certificates.
* bmo#1854795 - add OSXSAVE and XCR0 tests to AVX2 detection.
- Remove nss-fix-bmo1813401.patch which is now upstream.
- Add nss-fix-bmo1813401.patch to fix bsc#1214980
- gnutls
-
- Security fix: [bsc#1218862, CVE-2024-0567]
* gnutls: rejects certificate chain with distributed trust
* Cockpit (which uses gnuTLS) rejects certificate chain with
distributed trust.
* Add gnutls-CVE-2024-0567.patch
- Security fix: [bsc#1218865, CVE-2024-0553]
* Incomplete fix for CVE-2023-5981.
* The response times to malformed ciphertexts in RSA-PSK
ClientKeyExchange differ from response times of ciphertexts
with correct PKCS#1 v1.5 padding.
* Add gnutls-CVE-2024-0553.patch
- Security fix: [bsc#1217277, CVE-2023-5981]
* Fix timing side-channel inside RSA-PSK key exchange.
* auth/rsa_psk: side-step potential side-channel
* Add curl-CVE-2023-5981.patch
- ncurses
-
- Add patch bsc1218014-cve-2023-50495.patch
* Fix CVE-2023-50495: segmentation fault via _nc_wrap_entry()
- Add patch boo1201384.patch
* Do not fully reset serial lines
- nftables
-
- port python-single-spec logic from Factory package to allow shipment of
python311 modules as well (bsc#1219253).
- openssl-1_1
-
- Security fix: [bsc#1219243, CVE-2024-0727]
* Add NULL checks where ContentInfo data can be NULL
* Add openssl-CVE-2024-0727.patch
- polkit
-
- Change permissions for rules folders (bsc#1209282)
- procps
-
- Submit latest procps 3.3.17 to SLE-15 tree for jira#PED-3244
and jira#PED-6369
- The patches now upstream had been dropped meanwhile
* procps-vmstat-1b9ea611.patch (bsc#1185417)
- For support up to 2048 CPU as well
* bsc1209122-a6c0795d.patch (bnc#1209122)
- allow `-´ as leading character to ignore possible errors
on systctl entries
* patch procps-ng-3.3.9-bsc1121753-Cpus.patch (bsc#1121753)
- was a backport of an upstream fix to get the first CPU
summary correct
- Enable pidof for SLE-15 as this is provided by sysvinit-tools
- Use a check on syscall __NR_pidfd_open to decide if
the pwait tool and its manual page will be build
- Modify patches
* procps-ng-3.3.9-w-notruncate.diff
* procps-ng-3.3.17-logind.patch
to real to not truncate output of w with option -n
- procps-ng-3.3.17-logind.patch: Backport from 4.x git, prefer
logind over utmp (jsc#PED-3144)
- python3
-
- (bsc#1219666, CVE-2023-6597) Add
CVE-2023-6597-TempDir-cleaning-symlink.patch (patch from
gh#python/cpython!99930) fixing symlink bug in cleanup of
tempfile.TemporaryDirectory.
- Merge together bpo-36576-skip_tests_for_OpenSSL-111.patch into
skip_SSL_tests.patch, and make them include all conditionals.
- Refresh CVE-2023-27043-email-parsing-errors.patch to
gh#python/cpython!111116, fixing bsc#1210638 (CVE-2023-27043).
- libsolv
-
- build for multiple python versions [jsc#PED-6218]
- bump version to 0.7.28
- add zstd support for the installcheck tool
- add putinowndirpool cache to make file list handling in
repo_write much faster
- bump version to 0.7.27
- fix evr roundtrip in testcases
- do not use deprecated headerUnload with newer rpm versions
- bump version to 0.7.26
- support complex deps in SOLVABLE_PREREQ_IGNOREINST
- fix minimization not prefering installed packages in some cases
- reduce memory usage in repo_updateinfoxml
- fix lock-step interfering with architecture selection
- fix choice rule handing for package downgrades
- fix complex dependencies with an "else" part sometimes leading
to unsolved dependencies
- bump version to 0.7.25
- libssh
-
- Fix regression parsing IPv6 addresses provided as hostname (bsc#1220385)
* Added libssh-fix-ipv6-hostname-regression.patch
- Update to version 0.9.8
* Fix CVE-2023-6004: Command injection using proxycommand (bsc#1218209)
* Fix CVE-2023-48795: Potential downgrade attack using strict kex (bsc#1218126)
* Fix CVE-2023-6918: Missing checks for return values of MD functions (bsc#1218186)
* Allow @ in usernames when parsing from URI composes
- Update to version 0.9.7
* Fix CVE-2023-1667: a NULL dereference during rekeying with algorithm
guessing (bsc#1211188)
* Fix CVE-2023-2283: a possible authorization bypass in
pki_verify_data_signature under low-memory conditions (bsc#1211190)
* Fix several memory leaks in GSSAPI handling code
- suseconnect-ng
-
- Update to version 1.7.0~git0.5338270
* Allow SUSEConnect on read write transactional systems (bsc#1219425)
- Update to version 1.6.0
* Disable EULA display for addons (bsc#1218649 and bsc#1217961)
- Update to version 1.5.0
* Configure docker credentials for registry authentication
* Feature: Support usage from Agama + Cockpit for ALP Micro system registration (bsc#1218364)
* Add --json output option
- systemd
-
- Import commit 2cb4d40f1c6a388706af8a83d5344fc0de3c6f4d (merge of v249.17)
c8578cef7f resolved: actually check authenticated flag of SOA transaction
- Import commit 86f0670d3a01c1a2d4df17f1c68d03f1586195e3
ba7f1df7a5 vconsole-setup: simplify error handling
94f4eaea77 Introduce RET_GATHER and use it in src/shared/
e02406fcc1 mount: replace UNIT_DEPENDENCY_MOUNTINFO_OR_FILE with UNIT_DEPENDENCY_MOUNTINFO/UNIT_DEPENDENCY_MOUNT_FILE
0b8db54511 mount: drop UNIT_DEPENDENCY_MOUNTINFO_IMPLICIT and UNIT_DEPENDENCY_MOUNTINFO_DEFAULT
98ba536bd1 mount: always use UNIT_DEPENDENCY_FILE in mount_add_quota_dependencies()
73c7b2bb48 core/mount: make device deps from /proc/self/mountinfo and .mount unit file exclusive
ba585a28d7 core: Add trace logging to mount_add_device_dependencies()
36e0a4f80f core/mount: also remove default deps from /proc/self/mountinfo when it is updated (bsc#1217460)
bc107c86c3 core/mount: set Mount.from_proc_self_mountinfo flag before adding default dependencies
ce4907c7c3 core: wrap some long comment
- Import commit e677079182c975ecdad88a76f657fecb4de523d9
7692c5bda8 utmp-wtmp: handle EINTR gracefully when waiting to write to tty
29c3eb4681 utmp-wtmp: fix error in case isatty() fails
98970eb90b homed: handle EINTR gracefully when waiting for device node
0305809edd resolved: handle -EINTR returned from fd_wait_for_event() better
40db4d6abe sd-netlink: handle EINTR from poll() gracefully, as success
5e681711c6 varlink: also handle EINTR gracefully when waiting for EIO via ppoll()
6bbd70f092 stdio-bridge: don't be bothered with EINTR
f978feb591 sd-bus: handle -EINTR return from bus_poll() (bsc#1215241)
746962ff40 core: replace slice dependencies as they get added (bsc#1214668)
- systemd.spec: add missing `%tmpfiles_create systemd-resolve.conf`
- Rename 0001-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch into
1013-strip-the-domain-part-from-etc-hostname-when-setting.patch
- Rename 0003-strip-the-domain-part-from-etc-hostname-when-setting.patch into
1014-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch
- Rename 0005-udev-create-default-symlinks-for-primary-cd_dvd-driv.patch into
1015-networkd-make-network.service-an-alias-of-systemd-ne.patch
- Rename 0007-networkd-make-network.service-an-alias-of-systemd-ne.patch into
1016-core-disable-session-keyring-per-system-sevice-entir.patch
- Rename 0011-core-disable-session-keyring-per-system-sevice-entir.patch into
1017-restore-var-run-and-var-lock-bind-mount-if-they-aren.patch
Hence these patch files can be easily identified as SLE specific ones.
- libxml2
-
- Security fix (CVE-2024-25062, bsc#1219576) use-after-free in XMLReader
* Added libxml2-CVE-2024-25062.patch
- libzypp
-
- tui: allow to access the underlying ostream of out::Info.
- Add MLSep: Helper to produce not-NL-terminated multi line
output.
- version 17.31.31 (22)
- applydeltaprm: Create target directory if it does not exist
(bsc#1219442)
- Add ProblemSolution::skipsPatchesOnly (for openSUSE/zypper#514)
- Fix problems with EINTR in ExternalDataSource::getline (fixes
bsc#1215698)
- version 17.31.30 (22)
- CheckAccessDeleted: fix running_in_container detection
(bsc#1218782)
- Detect CURLOPT_REDIR_PROTOCOLS_STR availability at runtime
(bsc#1218831)
- Make Wakeup class EINTR safe.
- Add a way to cancel media operations on shutdown
(openSUSE/zypper#522)
This patch adds a mechanism to signal libzypp that a shutdown was
requested, usually when CTRL+C was pressed by the user. Currently
only the media backend will utilize this, but can be extended to
all code paths that use g_poll() to wait for events.
- Manually poll fds for curl in MediaCurl.
Using curl_easy_perform does not give us the required control on
when we want to cancel a download. Switching to the MultiCurl
implementation with a external poll() event loop will give us
much more freedom and helps us to improve our Ctrl+C handling.
- Move reusable curl poll code to curlhelper.h.
- version 17.31.29 (22)
- Fix to build with libxml 2.12.x (fixes #505)
- version 17.31.28 (22)
- CheckAccessDeleted: fix 'running in container' filter
(bsc#1218291)
- version 17.31.27 (22)
- Call zypp commit plugins during transactional update (fixes #506)
- Add support for loongarch64 (fixes #504)
- Teach MediaMultiCurl to download HTTP Multibyte ranges.
- Teach zsync downloads to MultiCurl.
- Expand RepoVars in URLs downloading a .repo file (bsc#1212160)
Convenient and helps documentation as it may refer to a single
command for a bunch of distributions. Like e.g. "zypper ar
'https://server.my/$releasever/my.repo'".
- version 17.31.26 (22)
- Fix build issue with zchunk build flags (fixes #500)
- version 17.31.25 (22)
- Open rpmdb just once during execution of %posttrans scripts
(bsc#1216412)
- Avoid using select() since it does not support fd numbers >
1024 (fixes #447)
- tools/DownloadFiles: use standard zypp progress bar (fixes #489)
- Revert "Color download progress bar" (fixes #475)
Cyan is already used for the output of RPM scriptlets. Avoid this
colorific collision between download progress bar and scriptlet
output.
- Fix ProgressBar's calculation of the printed tag position (fixes #494)
- Switch zypp::Digest to Openssl 3.0 Provider API (fixes #144)
- Fix usage of deprecated CURL features (fixes #486)
- version 17.31.24 (22)
- Stop using boost version 1 timer library (fixes #489,
bsc#1215294)
- version 17.31.23 (22)
- netcfg
-
- Add krb-prop entry, fix for bsc#1211886.
- openssh
-
- Added openssh-cve-2023-51385.patch (bsc#1218215, CVE-2023-51385).
This limits the use of shell metacharacters in host- and
user names.
- Added openssh-cve-2023-48795.patch (bsc#1217950, CVE-2023-48795).
This mitigates a prefix truncation attack that could be used to
undermine channel security.
- Enhanced SELinux functionality. Added
* openssh-7.8p1-role-mls.patch
Proper handling of MLS systems and basis for other SELinux
improvements
* openssh-6.6p1-privsep-selinux.patch
Properly set contexts during privilege separation
* openssh-6.6p1-keycat.patch
Add ssh-keycat command to allow retrival of authorized_keys
on MLS setups with polyinstantiation
* openssh-6.6.1p1-selinux-contexts.patch
Additional changes to set the proper context during privilege
separation
* openssh-7.6p1-cleanup-selinux.patch
Various changes and putting the pieces together
For now we don't ship the ssh-keycat command, but we need the patch
for the other SELinux infrastructure
This change fixes issues like bsc#1214788, where the ssh daemon
needs to act on behalf of a user and needs a proper context for this
- pam
-
- Add missing O_DIRECTORY flag in `protect_dir()` for pam_namespace module.
[bsc#1218475, pam-bsc1218475-pam_namespace-O_DIRECTORY-flag.patch]
- pam_lastlog: check localtime_r() return value (bsc#1217000)
* Added: pam-bsc1217000-pam_lastlog-check-localtime_r-return-value.patch
- patterns-suse-manager
-
- Add liberate-formula to the required packages for the server
to get it installed by default
- python-instance-billing-flavor-check
-
- Version 0.0.6 (bsc#1218561)
Support proxy setup on the client to access the update infrastructure
API
- Version 0.0.5
Add IPv6 support (bsc#1218739)
- python3-M2Crypto
-
- Disable broken tests with openssl 3.2, bsc#1217782
- add timeout_300hz.patch to accept a small deviation from time
in the testsuite (bsc#1212757)
- Adapt tests for OpenSSL v3.1.0
* Add openssl-adapt-tests-for-3.1.0.patch
- add openssl-stop-parsing-header.patch (bsc#1205042)
- add m2crypto-0.38-ossl3-tests.patch
- python-chardet
-
- Fix update-alternative in %postun, bsc#1218765
- python3-cryptography
-
- Add CVE-2023-49083.patch to fix A null-pointer-dereference and
segfault could occur when loading certificates from a PKCS#7 bundle.
bsc#1217592
- salt
-
- Prevent directory traversal when creating syndic cache directory
on the master (CVE-2024-22231, bsc#1219430)
- Prevent directory traversal attacks in the master's serve_file
method (CVE-2024-22232, bsc#1219431)
- Added:
* fix-cve-2024-22231-and-cve-2024-22232-bsc-1219430-bs.patch
- Ensure that pillar refresh loads beacons from pillar without restart
- Fix the aptpkg.py unit test failure
- Prefer unittest.mock to python-mock in test suite
- Enable "KeepAlive" probes for Salt SSH executions (bsc#1211649)
- Revert changes to set Salt configured user early in the stack (bsc#1216284)
- Align behavior of some modules when using salt-call via symlink (bsc#1215963)
- Fix gitfs "__env__" and improve cache cleaning (bsc#1193948)
- Remove python-boto dependency for the python3-salt-testsuite package for Tumbleweed
- Added:
* fix-the-aptpkg.py-unit-test-failure.patch
* enable-keepalive-probes-for-salt-ssh-executions-bsc-.patch
* prefer-unittest.mock-for-python-versions-that-are-su.patch
* update-__pillar__-during-pillar_refresh.patch
* revert-make-sure-configured-user-is-properly-set-by-.patch
* fix-gitfs-__env__-and-improve-cache-cleaning-bsc-119.patch
* dereference-symlinks-to-set-proper-__cli-opt-bsc-121.patch
- spacewalk-certs-tools
-
- version 4.3.22-1
* Skip deploying the CA into the Salt directory on proxies (bsc#1219850)
- version 4.3.21-1
* Deploy the CA certificate also into the Salt filesystem (bsc#1219577)
- version 4.3.20-1
* Handle server keys in PKCS8 format in mgr-ssl-cert-setup (bsc#1218615)
* Include reboot info beacon in the bootstrap script for transactional systems (bsc#1217588)
- spacewalk-client-tools
-
- version 4.3.18-1
* Update translation strings
- release-notes-sles
-
- 15.4.20240119 (tracked in bsc#933411)
- Added sysctl_net_core_bpf_jit_limit to kernel parameter changes
(jsc#DOCTEAM-1245)
- Added note about sched parameter deprecation (bsc#1216929)
- Added note about set-hostname deprecation (bsc#1215156)
- Changed wording of bsc#1201266
- Added note about Xen Dom0 suspend/resume (bsc#1210490)
- release-notes-susemanager-proxy
-
- Update to SUSE Manager 4.3.11
* Bugs mentioned:
bsc#1213738, bsc#1216657, bsc#1216781, bsc#1217209, bsc#1217588
bsc#1218615, bsc#1218849, bsc#1219577, bsc#1219850
- rpm
-
- backport lua support for rpm.execute to ease migrating [bnc#1216752]
* new patch: luaexecute.diff
- rsyslog
-
- suppress installation errors when systemd is not running
(bsc#1218799)
- restart daemon after modules packages have been updated
(bsc#1217292)
- runc
-
- Update to runc v1.1.12. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.1.12>. bsc#1218894
* This release fixes a container breakout vulnerability (CVE-2024-21626). For
more details, see the upstream security advisory:
<https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv>
* Remove upstreamed patches:
- CVE-2024-21626.patch
* Update runc.keyring to match upstream changes.
[ This was only ever released for SLES. ]
- Add upstream patch to fix embargoed issue CVE-2024-21626. bsc#1218894
<https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv>
+ CVE-2024-21626.patch
- Update to runc v1.1.11. Upstream changelog is available from
<https://github.com/opencontainers/runc/releases/tag/v1.1.11>.
- samba
-
- Add "net offlinejoin composeodj" command; (bsc#1214076);
- 000release-packages:sle-module-basesystem-release
-
n/a
- 000release-packages:sle-module-containers-release
-
n/a
- 000release-packages:sle-module-public-cloud-release
-
n/a
- 000release-packages:sle-module-server-applications-release
-
n/a
- 000product:sle-module-suse-manager-proxy-release
-
n/a
- spacewalk-backend
-
- version 4.3.27-1
* Fix issue in "spacewalk-repo-sync" when RPM packages contains files with
size greater than 4GB (bsc#1219151)
- version 4.3.26-1
* Fix decompressing and renaming bzip2 comps files in reposync
* Update query to the new credentials structure
* Remove normalize_orphan_vendor_packages and move it to taskomatic (bsc#1216781)
* Skip syncing packages with incorrect metadata (bsc#1213738)
* Update translation strings
- spacewalk-web
-
- version 4.3.37-1
* Fix the use of page size preference in systems and packages lists (bsc#1217209)
* Fix issue displaying Ansible playbook name (bsc#1216657)
* Add support for `PaygNotCompliantWarning` notification
* Bump web.version to 4.3.11
- squid
-
- SQUID-2023_11.patch: fix Denial of Service attack against
Cache Manager error responses (bsc#1219131, CVE-2024-23638)
- sudo
-
- Fix NOPASSWD issue introduced by patches for CVE-2023-42465
[bsc#1221151, bsc#1221134]
* Update sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch
* Enable running regression selftests during build time.
- Security fix: [bsc#1219026, bsc#1220389, CVE-2023-42465]
* Try to make sudo less vulnerable to ROWHAMMER attacks.
* Add sudo-CVE-2023-42465-1of2.patch sudo-CVE-2023-42465-2of2.patch
- supportutils-plugin-suse-public-cloud
-
- Update to version 1.0.9 (bsc#1218762, bsc#1218763)
+ Remove duplicate data collection for the plugin itself
+ Collect archive metering data when available
+ Query billing flavor status
- supportutils
-
- Additional changes in version 3.1.28
+ ipset - List entries for all sets
+ ipvsadm - Inspect the virtual server table (pr#185)
+ Correctly detects Xen Dom0 (bsc#1218201)
+ Fixed smart disk error (bsc#1218282)
- Changes in version 3.1.28
+ Inhibit the conversion of port numbers to port names for network files (cherry picked from commit 55f5f716638fb15e3eb1315443949ed98723d250)
+ powerpc: collect rtas_errd.log and lp_diag.log files (pr#175)
+ Get list of pam.d file (cherry picked from commit eaf35c77fd4bc039fd7e3d779ec1c2c6521283e2)
+ Remove supportutils requires for util-linux-systemd and kmod (bsc#1193173)
+ Added missing klp information to kernel-livepatch.txt (bsc#1216390)
+ Fixed plugins creating empty files when using supportconfig.rc (bsc#1216388)
+ Provides long listing for /etc/sssd/sssd.conf (bsc#1211547)
+ Optimize lsof usage (bsc#1183663)
+ Added mokutil commands for secureboot (pr#179)
+ Collects chrony or ntp as needed (bsc#1196293)
- Changes in version 3.1.27
+ Fixed podman display issue (bsc#1217287)
+ Added nvme-stas configuration to nvme.txt (bsc#1216049)
+ Added timed command to fs-files.txt (bsc#1216827)
+ Collects zypp history file issue#166 (bsc#1216522)
+ Changed -x OPTION to really be exclude only (issue#146)
+ Collect HA related rpm package versions in ha.txt (pr#169)
- suse-build-key
-
- Switch container key to be default RSA 4096bit. (jsc#PED-2777)
- run rpm commands in import script only when libzypp is not
active. bsc#1219189 bsc#1219123
- run import script also in %posttrans section, but only when
libzypp is not active. bsc#1219189 bsc#1219123
- suse-module-tools
-
- Update to version 15.4.19:
* rpm-script: add symlink /boot/.vmlinuz.hmac (bsc#1217775)
- susemanager-build-keys
-
- Version 15.4.10
* Add new Almalinux 8 GPG Key (bsc#1218849)
- Added:
* RPM-GPG-KEY-AlmaLinux-8
- Refresh extended Uyuni GPG public key
* Modified: gpg-pubkey-0d20833e.asc
- tar
-
- Fix CVE-2023-39804, Incorrectly handled extension attributes in
PAX archives can lead to a crash, bsc#1217969
* fix-CVE-2023-39804.patch
- timezone
-
- update to 2024a:
* Kazakhstan unifies on UTC+5. This affects Asia/Almaty and
Asia/Qostanay which together represent the eastern portion of the
country that will transition from UTC+6 on 2024-03-01 at 00:00 to
join the western portion. (Thanks to Zhanbolat Raimbekov.)
* Palestine springs forward a week later than previously predicted
in 2024 and 2025. (Thanks to Heba Hamad.) Change spring-forward
predictions to the second Saturday after Ramadan, not the first;
this also affects other predictions starting in 2039.
* Asia/Ho_Chi_Minh's 1955-07-01 transition occurred at 01:00
not 00:00. (Thanks to Đoàn Trần Công Danh.)
* From 1947 through 1949, Toronto's transitions occurred at 02:00
not 00:00. (Thanks to Chris Walton.)
* In 1911 Miquelon adopted standard time on June 15, not May 15.
* The FROM and TO columns of Rule lines can no longer be "minimum"
or an abbreviation of "minimum", because TZif files do not support
DST rules that extend into the indefinite past - although these
rules were supported when TZif files had only 32-bit data, this
stopped working when 64-bit TZif files were introduced in 1995.
This should not be a problem for realistic data, since DST was
first used in the 20th century. As a transition aid, FROM columns
like "minimum" are now diagnosed and then treated as if they were
the year 1900; this should suffice for TZif files on old systems
with only 32-bit time_t, and it is more compatible with bugs in
2023c-and-earlier localtime.c. (Problem reported by Yoshito
Umaoka.)
* localtime and related functions no longer mishandle some
timestamps that occur about 400 years after a switch to a time
zone with a DST schedule. In 2023d data this problem was visible
for some timestamps in November 2422, November 2822, etc. in
America/Ciudad_Juarez. (Problem reported by Gilmore Davidson.)
* strftime %s now uses tm_gmtoff if available. (Problem and draft
patch reported by Dag-Erling Smørgrav.)
* The strftime man page documents which struct tm members affect
which conversion specs, and that tzset is called. (Problems
reported by Robert Elz and Steve Summit.)
- update to 2023d:
* Ittoqqortoormiit, Greenland changes time zones on
2024-03-31.
* Vostok, Antarctica changed time zones on 2023-12-18.
* Casey, Antarctica changed time zones five times since
2020.
* Code and data fixes for Palestine timestamps starting in
2072.
* A new data file zonenow.tab for timestamps starting now.
* Fix predictions for DST transitions in Palestine in
2072-2075, correcting a typo introduced in 2023a.
* Vostok, Antarctica changed to +05 on 2023-12-18. It had
been at +07 (not +06) for years.
* Change data for Casey, Antarctica to agree with
timeanddate.com, by adding five time zone changes since 2020.
Casey is now at +08 instead of +11.
* Much of Greenland, represented by America/Nuuk, changed
its standard time from -03 to -02 on 2023-03-25, not on
2023-10-28.
* localtime.c no longer mishandles TZif files that contain
a single transition into a DST regime. Previously,
it incorrectly assumed DST was in effect before the transition
too.
* tzselect no longer creates temporary files.
* tzselect no longer mishandles the following:
* Spaces and most other special characters in BUGEMAIL,
PACKAGE, TZDIR, and VERSION.
* TZ strings when using mawk 1.4.3, which mishandles
regular expressions of the form /X{2,}/.
* ISO 6709 coordinates when using an awk that lacks the
GNU extension of newlines in -v option-arguments.
* Non UTF-8 locales when using an iconv command that
lacks the GNU //TRANSLIT extension.
* zic no longer mishandles data for Palestine after the
year 2075.
- Refresh tzdata-china.diff
- vim
-
- Updated to version 9.1 with patch level 0111, fixes the following security problems
* Fixing bsc#1217316 (CVE-2023-48231) - VUL-0: CVE-2023-48231: vim: Use-After-Free in win_close()
* Fixing bsc#1217320 (CVE-2023-48232) - VUL-0: CVE-2023-48232: vim: Floating point Exception in adjust_plines_for_skipcol()
* Fixing bsc#1217321 (CVE-2023-48233) - VUL-0: CVE-2023-48233: vim: overflow with count for :s command
* Fixing bsc#1217324 (CVE-2023-48234) - VUL-0: CVE-2023-48234: vim: overflow in nv_z_get_count
* Fixing bsc#1217326 (CVE-2023-48235) - VUL-0: CVE-2023-48235: vim: overflow in ex address parsing
* Fixing bsc#1217329 (CVE-2023-48236) - VUL-0: CVE-2023-48236: vim: overflow in get_number
* Fixing bsc#1217330 (CVE-2023-48237) - VUL-0: CVE-2023-48237: vim: overflow in shift_line
* Fixing bsc#1217432 (CVE-2023-48706) - VUL-0: CVE-2023-48706: vim: heap-use-after-free in ex_substitute
* Fixing bsc#1219581 (CVE-2024-22667) - VUL-0: CVE-2024-22667: vim: stack-based buffer overflow in did_set_langmap function in map.c
* Fixing bsc#1215005 (CVE-2023-4750) - VUL-0: CVE-2023-4750: vim: Heap use-after-free in function bt_quickfix
- for the complete list of changes see
https://github.com/vim/vim/compare/v9.0.2103...v9.1.0111
- wicked
-
- update to version 0.6.74
+ team: add new options like link_watch_policy (jsc#PED-7183)
+ Fix memory leaks in dbus variant destroy and fsm free (gh#openSUSE/wicked#1001)
+ xpath: allow underscore in node identifier (gh#openSUSE/wicked#999)
+ vxlan: don't format unknown rtnl attrs (bsc#1219751)
- removed patches included in the source archive:
[- 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch]
[- 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch]
[- 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch]
[- 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch]
[- 0005-duid-fix-comment-for-v6time.patch]
[- 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch]
[- 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch]
[- 0002-system-updater-Parse-updater-format-from-XML-configu.patch]
[- 0001-fix_arp_notify_loop_and_burst_sending.patch]
- ifreload: VLAN changes require device deletion (bsc#1218927)
[+ 0009-ifreload-VLAN-changes-require-device-deletion-bsc-12.patch]
- ifcheck: fix config changed check (bsc#1218926)
[+ 0008-ifcheck-fix-config-changed-check-bsc-1218926.patch]
- client: fix exit code for no-carrier status (bsc#1219265)
[+ 0007-Fix-ifstatus-exit-code-for-NI_WICKED_ST_NO_CARRIER-s.patch]
- dhcp6: omit the SO_REUSEPORT option (bsc#1215692)
[+ 0006-dhcp6-omit-the-SO_REUSEPORT-option-bsc-1215692.patch]
- duid: fix comment for v6time
(https://github.com/openSUSE/wicked/pull/989)
[+ 0005-duid-fix-comment-for-v6time.patch]
- rtnl: fix peer address parsing for non ptp-interfaces
(https://github.com/openSUSE/wicked/pull/987,
https://github.com/openSUSE/wicked/pull/988)
[+ 0003-rtnl-pass-ifname-in-newaddr-parsing-and-logging.patch]
[+ 0004-rtnl-parse-peer-address-on-non-ptp-interfaces.patch]
- system-updater: Parse updater format from XML configuration to
ensure install calls can run.
(https://github.com/openSUSE/wicked/pull/985)
[+ 0002-system-updater-Parse-updater-format-from-XML-configu.patch]
- xen
-
- bsc#1218851 - VUL-0: CVE-2023-46839: xen: phantom functions
assigned to incorrect contexts (XSA-449)
xsa449.patch
- Upstream bug fixes (bsc#1027519)
62ab2ed9-x86-more-MSR_ARCH_CAPS.patch
64763137-x86-AutoIBRS-definitions.patch
652fef4f-x86-AMD-erratum-1485.patch
6532858d-x86-DOITM.patch
65437103-x86-i8259-dont-assume-IRQs-always-target-CPU0.patch
65536847-AMD-IOMMU-correct-level-for-quarantine-pt.patch
65536848-x86-spec-ctrl-remove-conditional-IRQs-on-ness.patch
655b2ba9-fix-sched_move_domain.patch
6566fef3-x86-vLAPIC-x2APIC-derive-LDR-from-APIC-ID.patch
6569ad03-libxg-mem-leak-in-cpu-policy-get-set.patch
656ee5e1-x86emul-avoid-triggering-event-assertions.patch
656ee602-cpupool-adding-offline-CPU.patch
656ee6c3-domain_create-error-path.patch
- Patches dropped / replaced by newer upstream versions
xsa445.patch
xsa446.patch
- yast2-http-server
-
- bsc#1218943
- followup of previous fix - fixed internal issue which caused
Server modules not to be displayed at all.
- 4.4.3
- yast2-pkg-bindings
-
- Fixed repository and service probing with libzypp 7.31.26
and newer, fixes broken repository handling (bsc#1218977,
bsc#1218399)
- 4.4.7
- yast2-samba-client
-
- Use translation macro for range settings expert details text;
(bsc#1197936).
- 4.4.4
- zypper
-
- Fix search/info commands ignoring --ignore-unknown (bsc#1217593)
The switch makes search commands return 0 rather than 104 for
empty search results.
- version 1.14.68
- patch: Make sure reboot-needed is remembered until next boot
(bsc#1217873)
- version 1.14.67