- gawk
-
- format-tree-positional-arg.patch: Validate index into argument list
(CVE-2023-4156, bsc#1214025)
- vim
-
- Updated to version 9.0 with patch level 1894, fixes the following security problems
* Fixing bsc#1214922 (CVE-2023-4738) - VUL-0: CVE-2023-4738: vim: heap-buffer-overflow in vim_regsub_both
* Fixing bsc#1214924 (CVE-2023-4735) - VUL-0: CVE-2023-4735: vim: OOB Write ops.c
* Fixing bsc#1214925 (CVE-2023-4734) - VUL-0: CVE-2023-4734: vim: segmentation fault in function f_fullcommand
* Fixing bsc#1215004 (CVE-2023-4733) - VUL-0: CVE-2023-4733: vim: use-after-free in function buflist_altfpos
* Fixing bsc#1215006 (CVE-2023-4752) - VUL-0: CVE-2023-4752: vim: Heap Use After Free in function ins_compl_get_exp
* Fixing bsc#1215033 (CVE-2023-4781) - VUL-0: CVE-2023-4781: vim: heap-buffer-overflow in function vim_regsub_both
- drop patches: disable-unreliable-tests.patch
ignore-flaky-test-failure.patch
vim-8.1.0297-dump3.patch
- droped %check - most of tests didn't work correctly in OBS
and maitenace burden of this was getting too big
- for the complete list of changes see
https://github.com/vim/vim/compare/v9.0.1632...v9.0.1894
- Fixing bsc#1210738 - L3: gvim rendering corruption with all 9.x versions
* Add: vim-8.2.3607-revert-gtk3-code-removal.patch
* This reverts commit 9459b8d461d6f8345bfa3fb9b3b4297a7950b0bc
- Fixing bsc#1211461 - L3: vim "eats" first character from prompt in xterm
* Add: reorder-exit-raw-mode.patch
* Swaps out_str_t_TE() and cursor_on() during exit to prevent missing characters in xterm prompt on exit.
- Use app icon generated from vimlogo.eps in source tarball; add
higher res icons of sizes 128, 256, and 512px as png sources.
Our current icons deviate from upstream flatpaks for example.
- Updated to version 9.0 with patch level 1632
- for the complete list of changes see
https://github.com/vim/vim/compare/v9.0.1572...v9.0.1632
- Updated to version 9.0 with patch level 1572, fixes the following security problems
* Fixing bsc#1210996 (CVE-2023-2426) - VUL-0: CVE-2023-2426: vim: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 9.0.1499.
* Fixing bsc#1211256 (CVE-2023-2609) - VUL-1: CVE-2023-2609: vim: NULL Pointer Dereference prior to 9.0.1531
* Fixing bsc#1211257 (CVE-2023-2610) - VUL-1: CVE-2023-2610: vim: Integer Overflow or Wraparound prior to 9.0.1532
* Fixing bsc#1209042 (CVE-2023-1264) - VUL-0: CVE-2023-1264: vim: NULL Pointer Dereference vim prior to 9.0.1392
* Fixing bsc#1209187 (CVE-2023-1355) - VUL-0: CVE-2023-1355: vim: NULL Pointer Dereference prior to 9.0.1402.
* Fixing bsc#1208828 (CVE-2023-1127) - VUL-1: CVE-2023-1127: vim: divide by zero in scrolldown()
- drop vim-8.0-ttytype-test.patch as it changes test_options.vim which we
remove during %prep anyway. And this breaks quilt setup.
- for the complete list of changes see
https://github.com/vim/vim/compare/v9.0.1386...v9.0.1572
- cups
-
- cups-1.7.5-CVE-2023-4504.patch fixes CVE-2023-4504
"CUPS PostScript Parsing Heap Overflow"
https://github.com/OpenPrinting/cups/security/advisories/GHSA-pf5r-86w9-678h
bsc#1215204
- cups-1.7.5-CVE-2023-32360.patch fixes CVE-2023-32360
"Information leak through Cups-Get-Document operation"
by requiring authentication for CUPS-Get-Document in cupsd.conf
https://github.com/OpenPrinting/cups/commit/a0c8b9c9556882f00c68b9727a95a1b6d1452913
https://github.com/OpenPrinting/cups/security/advisories/GHSA-7pv4-hx8c-gr4g
bsc#1214254
- cups-1.7.5-additional_policies.patch is an updated version
of cups-1.7-additional_policies.patch that replaces it
to add the 'allowallforanybody' policy to cupsd.conf
after cups-1.7.5-CVE-2023-32360.patch was applied
- cups-1.7.5-CVE-2023-34241.patch fixes CVE-2023-34241
"use-after-free in cupsdAcceptClient()"
https://github.com/OpenPrinting/cups/security/advisories/GHSA-qjgh-5hcq-5f25
bsc#1212230
- python-azure-mgmt-appconfiguration
-
- Downgrade to upstream version 0.6.0
- Update Requires from setup.py
- libxml2
-
- Security update:
* [CVE-2023-39615, bsc#1214768] Crafted xml can cause global
buffer overflow
- Added file libxml2-CVE-2023-39615.patch
- openssh
-
- Add openssh-CVE-2023-38408-PKCS11-execution.patch, Abort if
requested to load a PKCS#11 provider that isnt a PKCS#11
provider (bsc#1213504,CVE-2023-38408)
- python3-requests
-
- Add CVE-2023-32681.patch to fix unintended leak of
Proxy-Authorization header (CVE-2023-32681, bsc#1211674)
Upstream commit: gh#psf/requests@74ea7cf7a6a2
- azure-cli
-
- Drop python3-pytest dependency from Requires (bsc#1214728)
- Rewrite ac_avoid_isclose.patch to use a copy of isclose()
- Add missing python3-azure-mgmt-resource to Requires
- Add python3-python2-secrets to Requires
- Fix multiple compatibility issues with Python 3.4 (bsc#1203658)
+ Add patch to avoid f-strings in the Python code
* ac_avoid_f-strings.patch
+ Add patch to avoid http.HTTPStatus in the Python code
* ac_avoid_httpstatus.patch
+ Add patch to avoid isclose() in the Python code
* ac_avoid_isclose.patch
- Extend %check section to test individual az commands
+ Determine current list of available az commands
+ Ignore sub-commands for now
+ Iterate over all commands and run az --help
+ Print OK or FAIL depending on the result for each call
+ Make failures non-fatal for now
- curl
-
- Security fixes:
* [bsc#1215888, CVE-2023-38545] SOCKS5 heap buffer overflow
* [bsc#1215889, CVE-2023-38546] Cookie injection with none file
* Add curl-CVE-2023-38545.patch curl-CVE-2023-38546.patch
- Security fix: [bsc#1215026, CVE-2023-38039]
* http: return error when receiving too large header
* Add curl-CVE-2023-38039.patch
- Security fix: [bsc#1213237, CVE-2023-32001]
* fopen race condition: libcurl can be told to save cookie,
HSTS and/or alt-svc data to files. When doing this, it
called 'stat()' followed by 'fopen()' in a way that made
it vulnerable to a TOCTOU race condition problem.
* Add curl-CVE-2023-32001.patch
- binutils
-
- Update to version 2.41 [PED-5778]:
* The MIPS port now supports the Sony Interactive Entertainment Allegrex
processor, used with the PlayStation Portable, which implements the MIPS
II ISA along with a single-precision FPU and a few implementation-specific
integer instructions.
* Objdump's --private option can now be used on PE format files to display the
fields in the file header and section headers.
* New versioned release of libsframe: libsframe.so.1. This release introduces
versioned symbols with version node name LIBSFRAME_1.0. This release also
updates the ABI in an incompatible way: this includes removal of
sframe_get_funcdesc_with_addr API, change in the behavior of
sframe_fre_get_ra_offset and sframe_fre_get_fp_offset APIs.
* SFrame Version 2 is now the default (and only) format version supported by
gas, ld, readelf and objdump.
* Add command-line option, --strip-section-headers, to objcopy and strip to
remove ELF section header from ELF file.
* The RISC-V port now supports the following new standard extensions:
- Zicond (conditional zero instructions)
- Zfa (additional floating-point instructions)
- Zvbb, Zvbc, Zvkg, Zvkned, Zvknh[ab], Zvksed, Zvksh, Zvkn, Zvknc, Zvkng,
Zvks, Zvksc, Zvkg, Zvkt (vector crypto instructions)
* The RISC-V port now supports the following vendor-defined extensions:
- XVentanaCondOps
* Add support for Intel FRED, LKGS and AMX-COMPLEX instructions.
* A new .insn directive is recognized by x86 gas.
* Add SME2 support to the AArch64 port.
* The linker now accepts a command line option of --remap-inputs
<PATTERN>=<FILE> to relace any input file that matches <PATTERN> with
<FILE>. In addition the option --remap-inputs-file=<FILE> can be used to
specify a file containing any number of these remapping directives.
* The linker command line option --print-map-locals can be used to include
local symbols in a linker map. (ELF targets only).
* For most ELF based targets, if the --enable-linker-version option is used
then the version of the linker will be inserted as a string into the .comment
section.
* The linker script syntax has a new command for output sections: ASCIZ "string"
This will insert a zero-terminated string at the current location.
* Add command-line option, -z nosectionheader, to omit ELF section
header.
- Removed obsolete patches: binutils-2.40-branch.diff.gz,
riscv-dynamic-tls-reloc-pie.patch, riscv-pr22263-1.patch,
extensa-gcc-4_3-fix.diff .
- Add binutils-2.41-branch.diff.gz .
- Add binutils-old-makeinfo.diff for SLE-12 and older.
- Rebased aarch64-common-pagesize.patch and binutils-revert-rela.diff .
- Contains fixes for these non-CVEs (not security bugs per upstreams
SECURITY.md):
* bsc#1209642 aka CVE-2023-1579 aka PR29988
* bsc#1210297 aka CVE-2023-1972 aka PR30285
* bsc#1210733 aka CVE-2023-2222 aka PR29936
* bsc#1213458 aka CVE-2021-32256 aka PR105039 (gcc)
* bsc#1214565 aka CVE-2020-19726 aka PR26240
* bsc#1214567 aka CVE-2022-35206 aka PR29290
* bsc#1214579 aka CVE-2022-35205 aka PR29289
* bsc#1214580 aka CVE-2022-44840 aka PR29732
* bsc#1214604 aka CVE-2022-45703 aka PR29799
* bsc#1214611 aka CVE-2022-48065 aka PR29925
* bsc#1214619 aka CVE-2022-48064 aka PR29922
* bsc#1214620 aka CVE-2022-48063 aka PR29924
* bsc#1214623 aka CVE-2022-47696 aka PR29677
* bsc#1214624 aka CVE-2022-47695 aka PR29846
* bsc#1214625 aka CVE-2022-47673 aka PR29876
- Add binutils-disable-dt-relr.sh for an compatibility problem
caused by binutils-revert-rela.diff in SLE codestreams.
Needed for update of glibc as that would otherwise pick up
the broken relative relocs support. [bsc#1213282, PED-1435]
- This only existed only for a very short while in SLE-15, as the main
variant in devel:gcc subsumed this in binutils-revert-rela.diff.
Hence:
- Remove binutils-disable-dt-relr.sh as subsumed.
- riscv-dynamic-tls-reloc-pie.patch: Backport for PR ld/22263 and PR
ld/25694
- riscv-pr22263-1.patch: Backport for PR ld/22263
- Rebase branch patch (includes fix for PR30281).
- Document fixed CVEs:
* bnc#1208037 aka CVE-2023-25588 aka PR29677
* bnc#1208038 aka CVE-2023-25587 aka PR29846
* bnc#1208040 aka CVE-2023-25585 aka PR29892
* bnc#1208409 aka CVE-2023-0687 aka PR29444
- Enable bpf-none cross target and add bpf-none to the multitarget
set of supported targets.
- Disable packed-relative-relocs for old codestreams. They generate
buggy relocations when binutils-revert-rela.diff is active.
[bsc#1206556]
- Disable ZSTD debug section compress by default.
- Enable zstd compression algorithm (instead of zlib)
for debug info sections by default.
- Pack libgprofng only for supported platforms.
- Remove upstreamed patch binutils-maxpagesize.diff.
- Rebase binutils-2.40-branch.diff.gz as it includes fix for PR30043.
- Move libgprofng-related libraries to the proper locations (packages).
- Add --without=bootstrap for skipping of bootstrap (faster testing
of the package).
- Remove broken arm32-avoid-copyreloc.patch to fix [gcc#108515]
- Update to version 2.40:
* Objdump has a new command line option --show-all-symbols which will make it
display all symbols that match a given address when disassembling. (Normally
only the first symbol that matches an address is shown).
* Add --enable-colored-disassembly configure time option to enable colored
disassembly output by default, if the output device is a terminal. Note,
this configure option is disabled by default.
* DCO signed contributions are now accepted.
* objcopy --decompress-debug-sections now supports zstd compressed debug
sections. The new option --compress-debug-sections=zstd compresses debug
sections with zstd.
* addr2line and objdump --dwarf now support zstd compressed debug sections.
* The dlltool program now accepts --deterministic-libraries and
- -non-deterministic-libraries as command line options to control whether or
not it generates deterministic output libraries. If neither of these options
are used the default is whatever was set when the binutils were configured.
* readelf and objdump now have a newly added option --sframe which dumps the
SFrame section.
* Add support for Intel RAO-INT instructions.
* Add support for Intel AVX-NE-CONVERT instructions.
* Add support for Intel MSRLIST instructions.
* Add support for Intel WRMSRNS instructions.
* Add support for Intel CMPccXADD instructions.
* Add support for Intel AVX-VNNI-INT8 instructions.
* Add support for Intel AVX-IFMA instructions.
* Add support for Intel PREFETCHI instructions.
* Add support for Intel AMX-FP16 instructions.
* gas now supports --compress-debug-sections=zstd to compress
debug sections with zstd.
* Add --enable-default-compressed-debug-sections-algorithm={zlib,zstd}
that selects the default compression algorithm
for --enable-compressed-debug-sections.
* Add support for various T-Head extensions (XTheadBa, XTheadBb, XTheadBs,
XTheadCmo, XTheadCondMov, XTheadFMemIdx, XTheadFmv, XTheadInt, XTheadMemIdx,
XTheadMemPair, XTheadMac, and XTheadSync) from version 2.0 of the T-Head
ISA manual, which are implemented in the Allwinner D1.
* Add support for the RISC-V Zawrs extension, version 1.0-rc4.
* Add support for Cortex-X1C for Arm.
* New command line option --gsframe to generate SFrame unwind information
on x86_64 and aarch64 targets.
* The linker has a new command line option to suppress the generation of any
warning or error messages. This can be useful when there is a need to create
a known non-working binary. The option is -w or --no-warnings.
* ld now supports zstd compressed debug sections. The new option
- -compress-debug-sections=zstd compresses debug sections with zstd.
* Add --enable-default-compressed-debug-sections-algorithm={zlib,zstd}
that selects the default compression algorithm
for --enable-compressed-debug-sections.
* Remove support for -z bndplt (MPX prefix instructions).
- Rebased patches: add-ulp-section.diff, ld-relro.diff, binutils-revert-plt32-in-branches.diff,
cross-avr-size.patch.
- Removed patch: binutils-pr29482.diff.
- New patch: extensa-gcc-4_3-fix.diff.
- Includes fixes for these CVEs:
* bnc#1206080 aka CVE-2022-4285 aka PR29699
- Enable by default: --enable-colored-disassembly.
- fix build on x86_64_vX platforms
- python3
-
- (bsc#1214691, CVE-2022-48566) Add
CVE-2022-48566-compare_digest-more-constant.patch to make
compare_digest more constant-time.
- (bsc#1214685, CVE-2022-48565) Add
CVE-2022-48565-plistlib-XML-vulns.patch (from
gh#python/cpython#86217) reject XML entity declarations in
plist files.
- (bsc#1214677, CVE-2022-48564) Add
CVE-2022-48564-DoS-read_ints-plistlib.patch fixing
gh#python/cpython#86269 (backport from 3.6), which prevents DoS
when processing malformed Apple Property List files in binary
format.
- Skip test_plistlib.test_identity test on aarch64.
- (bsc#1210638, CVE-2023-27043) Add
CVE-2023-27043-email-parsing-errors.patch, which detects email
address parsing errors and returns empty tuple to indicate the
parsing error (old API).
- Add 99366-patch.dict-can-decorate-async.patch fixing
gh#python/cpython#98086 (backport from Python 3.10 patch in
gh#python/cpython!99366), fixing bsc#1211158.
- Add stack_overflow_test_endless_recursion.patch to avoid
failing test.
- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
CVE-2007-4559 (bsc#1203750) by adding the filter for
tarfile.extractall (PEP 706).
CURRENTLY SWITCHED OFF, AS IT IS STILL WIP AND UNDEBUGGED
- Use python3 modules to build the documentation.
- util-linux-systemd
-
- Add upstream patch util-linux-bash-completion-shell-character-escape-CVE-2018-7738.patch
Fix shell code injection in umount bash-completions (bsc#1213865, CVE-2018-7738)
- util-linux-fix-tests-when-at-symbol-in-path.patch:
Add patch to util-linux-systemd and python3-libmount, as it was
previously only included in util-linux.
- python36
-
- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
gh#python/cpython#108310, backport from upstream patch
gh#python/cpython#108315
(bsc#1214692, CVE-2023-40217)
- dbus-1
-
- Sometimes unprivileged users were able to crash dbus-daemon
(CVE-2023-34969, bsc#1212126)
* fix-upstream-CVE-2023-34969.patch
- supportutils-plugin-suse-public-cloud
-
- Update to version 1.0.8 (bsc#1213951)
+ Capture CSP billing adapter config and log (issue#13)
+ Accept upper case Amazon string in DMI table (issue#12)
- azure-cli-core
-
- Fix multiple compatibility issues with Python 3.4 (bsc#1203658)
+ Add patch to avoid http.HTTPStatus in the Python code
* ac_avoid_httpstatus.patch
- apparmor
-
- Explicitly prefer apache2 instead of apache2-tls13; (bsc#1213941)
- Add samba-fix-log-plugin-denied.patch to fix apparmor profile
denied log messages for samba/winbind; (bsc#1208798).
- coreutils
-
- Add coreutils-chcon-skip-validation-if-selinux-disabled.patch to
avoid unnecessary failure in case SELinux is disabled.
(bsc#1212999)
- libX11
-
- U_0001-CVE-2023-43785-out-of-bounds-memory-access-in-_XkbRe.patch
U_0002-CVE-2023-43786-stack-exhaustion-from-infinite-recurs.patch
U_0003-XPutImage-clip-images-to-maximum-height-width-allowe.patch
U_0004-XCreatePixmap-trigger-BadValue-error-for-out-of-rang.patch
U_0005-CVE-2023-43787-Integer-overflow-in-XCreateImage-lead.patch
* CVE-2023-43785 libX11: out-of-bounds memory access in
_XkbReadKeySyms() (boo#1215683)
* CVE-2023-43786 libX11: stack exhaustion from infinite recursion
in PutSubImage() (boo#1215684)
* CVE-2023-43787 libX11: integer overflow in XCreateImage()
leading to a heap overflow (boo#1215685)
- python3-base
-
- (bsc#1214691, CVE-2022-48566) Add
CVE-2022-48566-compare_digest-more-constant.patch to make
compare_digest more constant-time.
- (bsc#1214685, CVE-2022-48565) Add
CVE-2022-48565-plistlib-XML-vulns.patch (from
gh#python/cpython#86217) reject XML entity declarations in
plist files.
- (bsc#1214677, CVE-2022-48564) Add
CVE-2022-48564-DoS-read_ints-plistlib.patch fixing
gh#python/cpython#86269 (backport from 3.6), which prevents DoS
when processing malformed Apple Property List files in binary
format.
- Skip test_plistlib.test_identity test on aarch64.
- (bsc#1210638, CVE-2023-27043) Add
CVE-2023-27043-email-parsing-errors.patch, which detects email
address parsing errors and returns empty tuple to indicate the
parsing error (old API).
- Add 99366-patch.dict-can-decorate-async.patch fixing
gh#python/cpython#98086 (backport from Python 3.10 patch in
gh#python/cpython!99366), fixing bsc#1211158.
- Add stack_overflow_test_endless_recursion.patch to avoid
failing test.
- Add CVE-2007-4559-filter-tarfile_extractall.patch to fix
CVE-2007-4559 (bsc#1203750) by adding the filter for
tarfile.extractall (PEP 706).
CURRENTLY SWITCHED OFF, AS IT IS STILL WIP AND UNDEBUGGED
- Use python3 modules to build the documentation.
- lvm2
-
- blkdeactivate calls wrong mountpoint cmd (bsc#1214071)
+ bug-1214071-blkdeactivate_calls_wrong_mountpoint.patch
- python-base
-
- (bsc#1214691, CVE-2022-48566) Add
CVE-2022-48566-compare_digest-more-constant.patch to make
compare_digest more constant-time.
- Allow nis.so for SLE-12.
- (bsc#1214685, CVE-2022-48565) Add
CVE-2022-48565-plistlib-XML-vulns.patch (from
gh#python/cpython#86217) reject XML entity declarations in
plist files.
- Remove BOTH CVE-2023-27043-email-parsing-errors.patch and
Revert-gh105127-left-tests.patch (as per discussion on
bsc#1210638).
- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
gh#python/cpython#108310, backport from upstream patch
gh#python/cpython#108315
(bsc#1214692, CVE-2023-40217)
- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
partially reverting CVE-2023-27043-email-parsing-errors.patch,
because of the regression in gh#python/cpython#106669.
- (bsc#1210638, CVE-2023-27043) Add
CVE-2023-27043-email-parsing-errors.patch, which detects email
address parsing errors and returns empty tuple to indicate the
parsing error (old API).
- perl-Bootloader
-
- merge gh#openSUSE/perl-bootloader#152
- use signed grub EFI binary when updating grub in default EFI
location (bsc#1210799)
- check whether grub2-install supports --suse-force-signed option
- 0.944
- merge gh#openSUSE/perl-bootloader#147
- UEFI: update also default location, if it is controlled by SUSE
(bsc#1210799, bsc#1201399)
- 0.943
- merge gh#openSUSE/perl-bootloader#142
- use fw_platform_size to distinguish between 32 bit and 64 bit
UEFI platforms (bsc#1208003)
- 0.942
- merge gh#openSUSE/perl-bootloader#141
- systemd-boot: easier initial setup
- 0.941
- merge gh#openSUSE/perl-bootloader#140
- add basic support for systemd-boot
- 0.940
- merge gh#openSUSE/perl-bootloader#139
- fix sysconfig parsing (bsc#1198828)
- 0.939
- merge gh#openSUSE/perl-bootloader#138
- grub2/install: reset error code when passing through recover code
(bsc#1198197)
- 0.938
- merge gh#openSUSE/perl-bootloader#137
- grub2 install: Support secure boot on powerpc (bsc#1192764
jsc#SLE-18271).
- 0.937
- merge gh#openSUSE/perl-bootloader#136
- report error if config file could not be updated (bsc#1188768)
- 0.936
- merge gh#openSUSE/perl-bootloader#135
- fix typo in update-bootloader
- 0.935
- merge gh#openSUSE/perl-bootloader#134
- install with --removable if efivars are not writable
(bsc#1182749, bsc#1174111, bsc#1184160)
- fix whitespace
- 0.934
- merge gh#openSUSE/perl-bootloader#133
- use shim on aarch64 (jsc#SLE-15823, jsc#SLE-15020)
- 0.933
- merge gh#openSUSE/perl-bootloader#131
- grub2 install: honor UPDATE_NVRAM in /etc/sysconfig/bootloader
(bsc#1157550 jsc#SLE-11500).
- 0.932
- merge gh#openSUSE/perl-bootloader#129
- Check tpm.mod in the new grub2 directory (bsc#1174320)
- 0.931
- merge gh#openSUSE/perl-bootloader#130
- Throw less warnings about fstab
- 0.930
- merge gh#openSUSE/perl-bootloader#128
- Do not warn about missing SECURE_BOOT sysconfig
- 0.929
- merge gh#openSUSE/perl-bootloader#127
- use correct target name on aarch64 (bsc#1172293)
- 0.928
- merge gh#openSUSE/perl-bootloader#126
- always install EFI fallback boot for aarch64 (bsc#1167015)
- 0.927
- merge gh#openSUSE/perl-bootloader#123
- Accept sysconfig values without quotes
- 0.926
- merge gh#openSUSE/perl-bootloader#122
- Replace --suse-signed-grub by --suse-force-signed to follow
update from boo#1136601
- 0.925
- merge gh#openSUSE/perl-bootloader#121
- Fix secureboot on aarch64 (boo#1136601)
- [RFC] Fix secureboot on aarch64 (boo#1136601)
- 0.924
- python-urllib3
-
- Add CVE-2023-43804.patch (bsc#1215968, CVE-2023-43804)
gh#urllib3/urllib3#3139
* Added the Cookie header to the list of headers to strip from
requests when redirecting to a different host. As before,
different headers can be set via Retry.remove_headers_on_redirect.
- procps
-
- Update legacy pmap to know about new ProtectionKey in smaps
- Add patch CVE-2023-4016.patch
* CVE-2023-4016: ps buffer overflow (bsc#1214290)
- dbus-1-x11
-
- Sometimes unprivileged users were able to crash dbus-daemon
(CVE-2023-34969, bsc#1212126)
* fix-upstream-CVE-2023-34969.patch
- python-configobj
-
- Add CVE-2023-26112.patch (bsc#1210070)
- wicked
-
- ifconfig: fix arp notify loop (boo#1212806) and burst sending
[+ 0001-fix_arp_notify_loop_and_burst_sending.patch]
- update to version 0.6.73
- spec: cleanup artefacts and fix some rpmlint warnings
- arp: allow verify/notify counter and interval configuration
- arp: handle ENOBUFS sending errors (bsc#1203300)
- extensions: improve environment variable handling
- firmware: refactor firmware extension definition
- firmware: enable, disable and revert cli commands
- code cleanup: fix memory leaks, add array/list utils
- wireless: Ignore WIRELESS_EAP_AUTH within TLS (bsc#1211026)
- cleanup /var/run leftovers in extension scripts (bsc#1194557)
- json: output formatting improvements and Unicode support
- bond: workaround 6.1 kernel enslave regression (boo#1206674)
- update to version 0.6.72
- client: add `wicked firmware extensions|interfaces|enable|disable`
command to improve `ibft`,`nbft`,`redfish` firmware extension and
interface handling.
- client: improve error handling in netif firmware discovery
extension execution and extension definition overrides in
the wicked-config.
- nanny: fix use-after-free in debug mode (bsc#1206447)
- spec: replace transitional `%usrmerged` macro with regular
version check (boo#1206798)
- client: improve to show `no-carrier` in ifstatus output
- linux: cleanup inclusions and update uapi header to 6.0
- ethtool: link mode nwords cleanup and new advertise mode names
- update to version 0.6.71
- dhcp: enable raw-ip support for wwan-qmi interfaces (jsc#PED-90)
- schema: fix the ip rule to-selector to handle network prefixes
- spec: Add /etc/sysconfig/network to file list, no longer in the
default list of a cleaned up filesystem package on tumbleweed
(https://github.com/openSUSE/wicked/pull/939).
- yast2-samba-client
-
- Use translation macro for range settings expert details text;
(bsc#1197936).
- 3.1.24
- python-pip
-
- Remove .exe files from package (bsc#1212015)
- glibc
-
- gai-merge-continue-actions.patch: Simplify allocations and fix merge and
continue actions (CVE-2023-4813, bsc#1215286, BZ #28931)
- s390-nl-current-lc-foo-used.patch: S390: Fix relocation of
_nl_current_LC_CATETORY_used in static build (bsc#1215504, BZ #19860)
- gb18030-2022.patch: add GB18030-2022 charmap (jsc#PED-4908, BZ #30243)
- parted
-
- fix dm sector size (bsc#1186371)
- add: libparted-dm-sector-size.patch
- nghttp2
-
- Fixes memory leak that happens when PUSH_PROMISE or HEADERS frame cannot be
sent, and nghttp2_on_stream_close_callback fails with a fatal error.
[CVE-2023-35945 bsc#1215713]
+ nghttp2-CVE-2023-35945.patch
- util-linux
-
- Add upstream patch util-linux-bash-completion-shell-character-escape-CVE-2018-7738.patch
Fix shell code injection in umount bash-completions (bsc#1213865, CVE-2018-7738)
- util-linux-fix-tests-when-at-symbol-in-path.patch:
Add patch to util-linux-systemd and python3-libmount, as it was
previously only included in util-linux.
- insserv-compat
-
- remove not needed named entry from insserv.conf (bsc#1052837,
bsc#1212955)
- ca-certificates-mozilla
-
- Updated to 2.62 state of Mozilla SSL root CAs (bsc#1214248)
Added:
- Atos TrustedRoot Root CA ECC G2 2020
- Atos TrustedRoot Root CA ECC TLS 2021
- Atos TrustedRoot Root CA RSA G2 2020
- Atos TrustedRoot Root CA RSA TLS 2021
- BJCA Global Root CA1
- BJCA Global Root CA2
- LAWtrust Root CA2 (4096)
- Sectigo Public Email Protection Root E46
- Sectigo Public Email Protection Root R46
- Sectigo Public Server Authentication Root E46
- Sectigo Public Server Authentication Root R46
- SSL.com Client ECC Root CA 2022
- SSL.com Client RSA Root CA 2022
- SSL.com TLS ECC Root CA 2022
- SSL.com TLS RSA Root CA 2022
Removed CAs:
- Chambers of Commerce Root
- E-Tugra Certification Authority
- E-Tugra Global Root CA ECC v3
- E-Tugra Global Root CA RSA v3
- Hongkong Post Root CA 1
- krb5
-
- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
(CVE-2023-36054);
- Added patches:
* 0127-Ensure-array-count-consistency-in-kadm5-RPC.patch
- openssl-1_1
-
- Security fix: (bsc#1213853, CVE-2023-3817)
* Fix excessive time spent checking DH q parameter value
(bsc#1213853, CVE-2023-3817). The function DH_check() performs
various checks on DH parameters. After fixing CVE-2023-3446 it
was discovered that a large q parameter value can also trigger
an overly long computation during some of these checks. A
correct q value, if present, cannot be larger than the modulus
p parameter, thus it is unnecessary to perform these checks if
q is larger than p. If DH_check() is called with such q parameter
value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
computationally intensive checks are skipped.
* Add openssl-1_1-CVE-2023-3817.patch
- Dont pass zero length input to EVP_Cipher because assembler
optimized AES cannot handle zero size. [bsc#1213517]
* Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch
- Security fix: [bsc#1213487, CVE-2023-3446]
* Fix DH_check() excessive time with over sized modulus.
* The function DH_check() performs various checks on DH parameters.
One of those checks confirms that the modulus ("p" parameter) is
not too large. Trying to use a very large modulus is slow and
OpenSSL will not normally use a modulus which is over 10,000 bits
in length.
However the DH_check() function checks numerous aspects of the
key or parameters that have been supplied. Some of those checks
use the supplied modulus value even if it has already been found
to be too large.
A new limit has been added to DH_check of 32,768 bits. Supplying
a key/parameters with a modulus over this size will simply cause
DH_check() to fail.
* Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch
- _product:sle-sdk-release
-
n/a
- grub2
-
- Fix CVE-2023-4692 (bsc#1215935)
- Fix CVE-2023-4693 (bsc#1215936)
* 0001-fs-ntfs-Fix-an-OOB-write-when-parsing-the-ATTRIBUTE_.patch
* 0002-fs-ntfs-Fix-an-OOB-read-when-reading-data-from-the-r.patch
* 0003-fs-ntfs-Fix-an-OOB-read-when-parsing-directory-entri.patch
* 0004-fs-ntfs-Fix-an-OOB-read-when-parsing-bitmaps-for-ind.patch
* 0005-fs-ntfs-Fix-an-OOB-read-when-parsing-a-volume-label.patch
* 0006-fs-ntfs-Make-code-more-readable.patch
- Bump upstream SBAT generation to 4
- grub2-once: Fix 'sh: terminal_output: command not found' error (bsc#1204563)
(bsc#1215382)
- libdb-4_8
-
- Fix incomplete license tag. [bsc#1099695]
- bind
-
- Security Fix:
* Previously, sending a specially crafted message over the
control channel could cause the packet-parsing code to run out
of available stack memory, causing named to terminate
unexpectedly. This has been fixed.
[bsc#1215472, CVE-2023-3341, bind-CVE-2023-3341.patch]
- wget
-
- Fixed Host name when CONNECT is used
[bsc#1213898, wget-http-specify-Host-when-CONNECT-is-used.patch]
- cloud-regionsrv-client
-
- Update to version 10.1.3 (bsc#1214801)
+ Add a warning if we detect a Python package cert bundle for certifi
This will help with debugging and point to potential issues when
using SUSE images in AWS, Azure, and GCE
- Update to version 10.1.2 (bsc#1211282)
+ Properly handle Ipv6 when checking update server responsiveness. If not
available fall back and use IPv4 information
+ Use systemd_ordered to allow use in a container without pulling systemd
into the container as a requirement
- Update to version 10.1.1 (bsc#1210020, bsc#1210021)
+ Clean up the system if baseproduct registraion fails to leave the
system in prestine state
+ Log when the registercloudguest command is invoked with --clean
- gpg2
-
- Security Fix: [bsc#1088255, CVE-2018-9234]
* Unenforced configuration allows for apparently valid certifications
actually signed by signing subkeys. GnuPG <= 2.2.5 does not enforce
a configuration in which key certification requires an offline master
Certify key, which results in apparently valid certifications that
occurred only with access to a signing subkey.
* Add gnupg-CVE-2018-9234.patch
- cloud-netconfig
-
- Update to version 1.8:
+ Fix Azure metadata check (bsc#1214715)
+ Fix cleanup on ifdown
- samba
-
- CVE-2023-4091: samba: Client can truncate file with read-only
permissions; (bsc#1215904); (bso#15439).
- secure channel faulty since Windows 10/11 update 07/2023;
(bso#15418); (bsc#1213384).
- CVE-2022-2127: lm_resp_len not checked properly in
winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174).
- CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite
Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173).
- CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type
Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172).
- CVE-2023-34968: Spotlight server-side Share Path Disclosure;
(bso#15388); (bsc#1213171).
- gcc12
-
- Add gcc12-aarch64-bsc1214052.patch to fix -fstack-protector issues
with variable length stack allocations on aarch64.
Fixes CVE-2023-4039. [bsc#1214052]
- kernel-azure
-
- Update
patches.suse/ipv6-sr-fix-out-of-bounds-read-when-setting-HMAC-dat.patch
(bsc#1211592 CVE-2023-2860).
- commit bb891c5
- s390: add z16 elf platform (LTC#203790 bsc#1215954).
- commit 2f5d3f2
- net: xfrm: Fix xfrm_address_filter OOB read (CVE-2023-39194
bsc#1215861).
- commit 30ab691
- netfilter: xt_sctp: validate the flag_info count (CVE-2023-39193
bsc#1215860).
- commit bc6f173
- netfilter: xt_u32: validate user space input (CVE-2023-39192
bsc#1215858).
- commit a35eb65
- ipv4: fix null-deref in ipv4_link_failure (CVE-2023-42754
bsc#1215467).
- commit 3bbdd91
- KVM: s390: vsie: fix the length of APCB bitmap (git-fixes
bsc#1215898).
- commit fe1e883
- KVM: s390: vsie: Fix the initialization of the epoch extension
(epdx) field (git-fixes bsc#1215897).
- commit 8cf6ae4
- tcp: Reduce chance of collisions in inet6_hashfn()
(CVE-2023-1206 bsc#1212703).
- commit a16b5ec
- blacklist.conf: workqueue: compiler warning on 32-bit systems with
Clang (bsc#1215877)
- commit cdf35f4
- blacklist.conf: printk: cosmetic problem
- commit ba43537
- tracing: Reverse the order of trace_types_lock and event_mutex
(git-fixes bsc#1215634).
- blacklist.conf: Remove the patch
- commit f4d2e9c
- blk-mq: Rerun dispatching in the case of budget contention
(bsc#1214586).
- commit 8383227
- blk-mq: Add blk_mq_delay_run_hw_queues() API call (bsc#1214586).
- commit 85f0c35
- blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason
to kick (bsc#1214586).
- commit c307c4a
- drm/client: Fix memory leak in drm_client_target_cloned (bsc#1152446)
Backporting changes:
* move changes to drm_fb_helper.c
* context changes
- commit 2728def
- drm/client: Send hotplug event after registering a client (bsc#1152446)
Backporting changes:
* send hotplug event from drm_client_add()
* remove drm_dbg_kms()
- commit 6137335
- drm/ast: Fix DRAM init on AST2200 (bsc#1152446)
- commit e2e4c86
- NFS/pNFS: Report EINVAL errors from connect() to the server
(git-fixes).
- nfsd: fix change_info in NFSv4 RENAME replies (git-fixes).
- NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
(git-fixes).
- commit fd7ddac
- blacklist.conf: cleanup, not fix
- commit 4145d1c
- blacklist.conf: kABI
- commit a0aa389
- blacklist.conf: kABI
- commit 8946486
- net/mlx5: Fix size field in bufferx_reg struct (git-fixes).
- commit fb53d8d
- blacklist.conf: cleanup, not a fix
- commit 17d3852
- blacklist.conf: irrelevant architectures
- commit 5686dcf
- net: sched: sch_qfq: Fix UAF in qfq_dequeue() (CVE-2023-4921
bsc#1215275).
- commit f1f032e
- USB: serial: option: add FOXCONN T99W368/T99W373 product
(git-fixes).
- commit 80d3da2
- USB: serial: option: add Quectel EM05G variant (0x030e)
(git-fixes).
- commit a512bd6
- net: usb: qmi_wwan: add Quectel EM05GV2 (git-fixes).
- commit 1b30310
- x86/srso: Fix srso_show_state() side effect (git-fixes).
- commit 0635685
- x86/srso: Fix SBPB enablement for spec_rstack_overflow=off (git-fixes).
- commit 73ce555
- x86/srso: Don't probe microcode in a guest (git-fixes).
- commit 3113dcd
- x86/srso: Set CPUID feature bits independently of bug or mitigation status (git-fixes).
- commit 353140c
- net: tap: NULL pointer derefence in dev_parse_header_protocol
when skb->dev is null (git-fixes).
- commit 58c21c4
- net: accept UFOv6 packages in virtio_net_hdr_to_skb (git-fixes).
- commit faf87ea
- net: ensure mac header is set in virtio_net_hdr_to_skb()
(git-fixes).
- commit 6a7c880
- remoteproc: Add missing '\n' in log messages (git-fixes).
- commit 0453dca
- virtio-net: set queues after driver_ok (git-fixes).
- commit d013d91
- virtio-net: fix race between set queues and probe (git-fixes).
- commit 667d4fc
- virtio_net: suppress cpu stall when free_unused_bufs
(git-fixes).
- commit da2e2b7
- virtio-net: execute xdp_do_flush() before napi_complete_done()
(git-fixes).
- commit 5d3f424
- tools/virtio: fix the vringh test for virtio ring changes
(git-fixes).
- commit 66910c1
- vhost/net: Clear the pending messages when the backend is
removed (git-fixes).
- commit 9b65419
- drm/virtio: Fix GEM handle creation UAF (git-fixes).
- commit 85fb064
- vhost: fix range used in translate_desc() (git-fixes).
- commit a845792
- vhost/vsock: Fix error handling in vhost_vsock_init()
(git-fixes).
- commit d808ad4
- virtio_net: fix memory leak inside XPD_TX with mergeable
(git-fixes).
- commit 0582e50
- virtio-gpu: fix a missing check to avoid NULL dereference
(git-fixes).
- commit f24aded
- virtio-net: fix the race between refill work and close
(git-fixes).
- commit fad1dae
- virtio_mmio: Restore guest page size on resume (git-fixes).
- commit d1884a1
- virtio_mmio: Add missing PM calls to freeze/restore (git-fixes).
- commit 72af40d
- virtio-net: fix race between ndo_open() and
virtio_device_ready() (git-fixes).
- commit 1d4eaa6
- vringh: Fix loop descriptors check in the indirect cases
(git-fixes).
- commit aa0f829
- virtio-rng: make device ready before making request (git-fixes).
- commit 9bd916a
- drm/virtio: fix NULL pointer dereference in
virtio_gpu_conn_get_modes (git-fixes).
- commit ab80da2
- vsock/virtio: enable VQs early on probe (git-fixes).
- commit eedc07b
- virtio: acknowledge all features before access (git-fixes).
- commit 3d0d2a3
- blacklist.conf: add "virtio: unexport virtio_finalize_features"
- commit 0ef3496
- virtio-gpu: fix possible memory allocation failure (git-fixes).
- commit dab0c56
- scsi: qla2xxx: Fix NULL vs IS_ERR() bug for debugfs_create_dir()
(git-fixes).
- scsi: qla2xxx: Use raw_smp_processor_id() instead of
smp_processor_id() (git-fixes).
- commit 42813d6
- virtio_pci: Support surprise removal of virtio pci device
(git-fixes).
- commit 8906f5b
- fuse: nlookup missing decrement in fuse_direntplus_link
(bsc#1215607).
- commit cca74d3
- series: refresh meta data on qla2xxx patches
Refresh:
- patches.suse/Revert-scsi-qla2xxx-Fix-buffer-overrun.patch
- patches.suse/scsi-qla2xxx-Add-logs-for-SFP-temperature-monitoring.patch
- patches.suse/scsi-qla2xxx-Allow-32-byte-CDBs.patch
- patches.suse/scsi-qla2xxx-Error-code-did-not-return-to-upper-laye.patch
- patches.suse/scsi-qla2xxx-Fix-firmware-resource-tracking.patch
- patches.suse/scsi-qla2xxx-Fix-smatch-warn-for-qla_init_iocb_limit.patch
- patches.suse/scsi-qla2xxx-Flush-mailbox-commands-on-chip-reset-6d0b6556.patch
- patches.suse/scsi-qla2xxx-Move-resource-to-allow-code-reuse.patch
- patches.suse/scsi-qla2xxx-Remove-unsupported-ql2xenabledif-option.patch
- patches.suse/scsi-qla2xxx-Remove-unused-variables-in-qla24xx_buil.patch
- patches.suse/scsi-qla2xxx-Update-version-to-10.02.09.100-k.patch
- commit 97d82a0
- vsock/virtio: avoid potential deadlock when vsock device remove
(git-fixes).
- commit bb25376
- VSOCK: handle VIRTIO_VSOCK_OP_CREDIT_REQUEST (git-fixes).
- commit 58985d9
- vsock/virtio: free queued packets when closing socket
(git-fixes).
- commit 364c76d
- vhost: Fix vhost_vq_reset() (git-fixes).
- commit 11c5c4d
- Update
patches.suse/ipv6-raw-Deduct-extension-header-length-in-rawv6_pus.patch
(bsc#1207168 CVE-2023-0394).
(empty commit to synthesize changelog reference)
- commit 5add4b1
- net: check if protocol extracted by virtio_net_hdr_set_proto
is correct (git-fixes).
- commit 2e28a62
- vsock/virtio: update credit only if socket is not closed
(git-fixes).
- commit 4db2ffd
- vhost_net: fix ubuf refcount incorrectly when sendmsg fails
(git-fixes).
- commit 1c25f6d
- vhost: Use vhost_get_used_size() in vhost_vring_set_addr()
(git-fixes).
- commit fc31d1b
- vhost: introduce helpers to get the size of metadata area
(git-fixes).
- Refresh
patches.kabi/kabi-mask-changes-to-vhost_dev_init-and-struct-vhost.patch.
- Refresh
patches.suse/vhost-Don-t-call-access_ok-when-using-IOTLB.patch.
- commit dff33f7
- virtio_ring: Avoid loop when vq is broken in virtqueue_poll
(git-fixes).
- commit 74b72cd
- vhost: missing __user tags (git-fixes).
- commit f5a5b81
- remoteproc: Fix NULL pointer dereference in rproc_virtio_notify
(git-fixes).
- commit 9a37a06
- virtio_balloon: prevent pfn array overflow (git-fixes).
- commit 55ea675
- vhost/test: stop device before reset (git-fixes).
- commit 5483efb
- net: virtio_vsock: Enhance connection semantics (git-fixes).
- commit 9ad5623
- net: do not allow gso_size to be set to GSO_BY_FRAGS
(git-fixes).
- commit 78c9d7f
- virtio_net: add checking sq is full inside xdp xmit (git-fixes).
- commit 689eec4
- virtio_net: separate the logic of checking whether sq is full
(git-fixes).
- commit 61503de
- virtio_net: reorder some funcs (git-fixes).
- commit f621ba2
- idr: fix param name in idr_alloc_cyclic() doc (bsc#1109837).
- commit 2f8b856
- virtio_net: Fix probe failed when modprobe virtio_net
(git-fixes).
- commit 3abdcae
- 9p/trans_virtio: Remove sysfs file on probe failure (git-fixes).
- commit 68a725b
- virtio_net: Remove BUG() to avoid machine dead (git-fixes).
- commit 55a074c
- vhost: Don't call access_ok() when using IOTLB (git-fixes).
- commit 25ceff0
- virtio_pci_modern: Fix the comment of
virtio_pci_find_capability() (git-fixes).
- commit cb1942b
- vhost: vsock: kick send_pkt worker once device is started
(git-fixes).
- commit a9baee2
- xen: remove a confusing comment on auto-translated guest I/O
(git-fixes).
- commit 8b1470e
- arm64: kgdb: Set PSTATE.SS to 1 to re-enable single-step (git-fixes)
- commit 2dc199b
- blacklist.conf: ("mm: defer kmemleak object creation of module_alloc()")
- commit bd408b1
- blacklist.conf: ("arm64/fpsimd: Only provide the length to cpufeature for xCR registers")
- commit fa8f4a7
- blacklist.conf: ("arm64: Add missing Set/Way CMO encodings")
- commit 1c6e245
- arm64: insn: Fix ldadd instruction encoding (git-fixes)
- commit 8cc18ed
- firmware: raspberrypi: fix possible memory leak in
rpi_firmware_probe() (git-fixes).
- commit c078a04
- firmware: raspberrypi: Keep count of all consumers (git-fixes).
- Refresh
patches.suse/firmware-raspberrypi-Introduce-devm_rpi_firmware_get.patch.
- commit 12c2932
- af_unix: Fix null-ptr-deref in unix_stream_sendpage()
(CVE-2023-4622 bsc#1215117).
- commit c96e367
- net/sched: sch_hfsc: Ensure inner classes have fsc curve
(CVE-2023-4623 bsc#1215115).
- commit 522fe97
- cec-api: prevent leaking memory through hole in structure
(CVE-2020-36766 bsc#1215299).
- commit 95fe4aa
- patches.suse/ext4-avoid-deadlock-in-fs-reclaim-with-page-writebac.patch:
Fix compiler warning due to unused 'sbi' variable
- commit f8d160b
- fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe (bsc#1154048)
- commit 1fa2e82
- fbdev: imxfb: warn about invalid left/right margin (bsc#1154048)
- commit 31becd0
- fbdev: omapfb: lcd_mipid: Fix an error handling path in (bsc#1154048)
Backporting changes:
* Refresh patch
- commit f0bd08e
- fbcon: Fix null-ptr-deref in soft_cursor (bsc#1154048)
Backporting changes:
* Move code from video/fbdev/core to video/consol
* Refresh patch
- commit a573af9
- fbdev: modedb: Add 1920x1080 at 60 Hz video mode (bsc#1154048)
- commit eb11fbc
- blacklist.conf: Append 'fbdev/ep93xx-fb: Do not assign to struct fb_info.dev'
- commit 7445a36
- blacklist.conf: Append 'backlight/lv5207lp: Compare against struct fb_info.device'
- commit deff103
- blacklist.conf: Append 'backlight/gpio_backlight: Compare against struct fb_info.device'
- commit 5ee6636
- blacklist.conf: Append 'backlight/bd6107: Compare against struct fb_info.device'
- commit 639511f
- blacklist.conf: Append 'fbdev: mmp: fix value check in mmphw_probe()'
- commit 170d70b
- blacklist.conf: Append 'fbdev: stifb: Fix info entry in sti_struct on error path'
- commit 1d87a9e
- blacklist.conf: Append 'fbdev: imsttfb: Release framebuffer and dealloc cmap on error path'
- commit 7e72c90
- blacklist.conf: Append 'fbdev: imsttfb: Fix use after free bug in imsttfb_probe'
- commit 702daba
- blacklist.conf: Append 'parisc/agp: Annotate parisc agp init functions with __init'
- commit c9c8dac
- 9p/xen : Fix use after free bug in xen_9pfs_front_remove due
to race condition (bsc#1215206, CVE-2023-1859).
- commit 4fa7183
- netfilter: nftables: exthdr: fix 4-byte stack OOB write
(CVE-2023-4881 bsc#1215221).
- commit b9ba6b9
- firmware: raspberrypi: Introduce devm_rpi_firmware_get()
(git-fixes).
- commit b0c6851
- Input: xpad - delete a Razer DeathAdder mouse VID/PID entry
(git-fixes).
- commit 2f7bf75
- Input: psmouse - fix OOB access in Elantech protocol
(git-fixes).
- commit c22661c
- Input: raspberrypi-ts - fix refcount leak in rpi_ts_probe
(git-fixes).
- Input: xpad - add constants for GIP interface numbers
(git-fixes).
- commit f16c0ae
- blacklist.conf: kABI
- commit ff64baf
- media: uvcvideo: Increase UVC_CTRL_CONTROL_TIMEOUT to 5 seconds
(git-fixes).
- commit 94ae184
- media: b2c2: Add missing check in flexcop_pci_isr: (git-fixes).
- commit 08d3143
- media: mceusb: return without resubmitting URB in case of
- EPROTO error (git-fixes).
- commit c8383de
- media: flexcop-usb: fix NULL-ptr deref in
flexcop_usb_transfer_init() (git-fixes).
- Refresh
patches.suse/0001-media-flexcop-usb-fix-endpoint-sanity-check.patch.
- commit bad0523
- media: cec: copy sequence field for the reply (git-fixes).
- commit 8765e23
- media: s5p_cec: decrement usage count if disabled (git-fixes).
- commit b1a4e64
- media: cec-notifier: clear cec_adap in cec_notifier_unregister
(git-fixes).
- commit ac5e011
- blacklist.conf: false positive
- commit 6890750
- media: cec: integrate cec_validate_phys_addr() in cec-api.c
(git-fixes).
- commit c1bf95d
- media: cec: make cec_get_edid_spa_location() an inline function
(git-fixes).
- commit 8148e38
- Delete patches.suse/genksyms-add-override-flag.diff.
The override flag is no longer used in kernel-binary.
- commit 3815406
- s390/dasd: fix hanging device after request requeue (LTC#203632
bsc#1215121).
- commit 313a92d
- jbd2: restore t_checkpoint_io_list to maintain kABI
(bsc#1214946).
- commit 9146c38
- rpm/kernel-binary.spec.in: Drop use of KBUILD_OVERRIDE=1
Genksyms has functionality to specify an override for each type in
a symtypes reference file. This override is then used instead of an
actual type and allows to preserve modversions (CRCs) of symbols that
reference the type. It is kind of an alternative to doing kABI fix-ups
with '#ifndef __GENKSYMS__'. The functionality is hidden behind the
genksyms --preserve option which primarily tells the tool to strictly
verify modversions against a given reference file or fail.
Downstream patch patches.suse/genksyms-add-override-flag.diff which is
present in various kernel-source branches separates the override logic.
It allows it to be enabled with a new --override flag and used without
specifying the --preserve option. Setting KBUILD_OVERRIDE=1 in the spec
file is then a way how the build is told that --override should be
passed to all invocations of genksyms. This was needed for SUSE kernels
because their build doesn't use --preserve but instead resulting CRCs
are later checked by scripts/kabi.pl.
However, this override functionality was not utilized much in practice
and the only use currently to be found is in SLE11-SP1-LTSS. It means
that no one should miss this option and KBUILD_OVERRIDE=1 together with
patches.suse/genksyms-add-override-flag.diff can be removed.
Notes for maintainers merging this commit to their branches:
* Downstream patch patches.suse/genksyms-add-override-flag.diff can be
dropped after merging this commit.
* Branch SLE11-SP1-LTSS uses the mentioned override functionality and
this commit should not be merged to it, or needs to be reverted
afterwards.
- commit 4aa02b8
- Update
patches.suse/s390-dasd-fix-hanging-device-after-quiesce-resume.patch
(git-fixes bsc#1214157 bsc#1215122).
- commit 07aca49
- blacklist.conf: Blacklist b98dba273a
- commit b92c4bc
- jbd2: simplify journal_clean_one_cp_list() (bsc#1215207).
- commit 6f4c470
- usb: typec: altmodes/displayport: Fix pin assignment calculation
(git-fixes).
- commit 4d0c2c0
- usb: typec: altmodes/displayport: Add pin assignment helper
(git-fixes).
- commit 9232606
- blacklist.conf: Blasklist e5cfefa97bccf
- commit 570bb0a
- blacklist.conf: Add ef73dcaa3121 ("powerpc: xmon: remove unused variables")
- commit 79b42a6
- powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
(bsc#1065729).
- powerpc/xics: Remove unnecessary endian conversion
(bsc#1065729).
- word-at-a-time: use the same return type for has_zero regardless
of endianness (bsc#1065729).
- powerpc/64s/exception: machine check use correct cfar for late
handler (bsc#1065729).
- commit 024bdb8
- blacklist.conf: Add eac030b22ea1 ("powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT")
- commit 7c10484
- Drivers: hv: vmbus: Don't dereference ACPI root object handle (git-fixes).
- x86/hyperv: Fix NULL deref in set_hv_tscchange_cb() if Hyper-V setup fails (git-fixes).
- hv_utils: Fix passing zero to 'PTR_ERR' warning (git-fixes).
- commit 1c1b9d9
- udf: Fix uninitialized array access for some pathnames
(bsc#1214967).
- commit c4327d4
- udf: Fix off-by-one error when discarding preallocation
(bsc#1214966).
- commit e960575
- udf: Fix file corruption when appending just after end of
preallocated extent (bsc#1214965).
- commit 9b4bb47
- udf: Fix extension of the last extent in the file (bsc#1214964).
- commit a800323
- quota: fix warning in dqgrab() (bsc#1214962).
- commit 1c703c8
- quota: Properly disable quotas when add_dquot_ref() fails
(bsc#1214961).
- commit a0acebf
- fs: avoid softlockups in s_inodes iterators (bsc#1215165).
- commit 64a5ec2
- direct-io: allow direct writes to empty inodes (bsc#1215164).
- commit 7c4d7c8
- blacklist.conf: Blacklist 69562eb0bd3e
- commit f13139d
- blacklist.conf: Blacklist 2112f5c1330a
- commit 7d5e43d
- jbd2: remove unused function '__cp_buffer_busy' (bsc#1215162).
- commit 20ed76a
- jbd2: check 'jh->b_transaction' before removing it from
checkpoint (bsc#1214953).
- commit d390fb5
- jbd2: fix checkpoint cleanup performance regression
(bsc#1214952).
- commit eebe7e1
- jbd2: fix a race when checking checkpoint buffer busy (bsc#1214949).
- commit 2a5ddb1
- jbd2: remove t_checkpoint_io_list (bsc#1214946).
- commit 83511a0
- jbd2: recheck chechpointing non-dirty buffer (bsc#1214945).
- commit d58daa9
- ext4: correct inline offset when handling xattrs in inode body
(bsc#1214950).
- commit 032825e
- jbd2: Fix wrongly judgement for buffer head removing while
doing checkpoint (bsc#1214948).
- commit 9167319
- ext4: fix wrong unit use in ext4_mb_clear_bb (bsc#1214943).
- commit bc0cd9a
- ext4: set goal start correctly in ext4_mb_normalize_request
(bsc#1214940).
- commit 8cc1d3d
- s390/zcrypt: don't leak memory if dev_set_name() fails
(git-fixes bsc#1215152).
- commit 6bbbd1c
- scsi: zfcp: reduce flood of fcrscn1 trace records on
multi-element RSCN (git-fixes bsc#1215149).
- commit a1a3484
- patches.suse/btrfs-output-extra-debug-info-if-we-failed-to-find-a.patch:
(bsc#1215136).
- commit edf562a
- blacklist.conf: kABI
- commit 57cf107
- blacklist.conf: cleanup, not fix
- commit 61144f9
- blacklist.conf: irrelevant in our configs
- commit e17de4e
- blacklist.conf: kABI
- commit e7ae590
- s390/cio: cio_ignore_proc_seq_next should increase position
index (git-fixes bsc#1215057).
- commit 128857d
- s390/dasd/cio: Interpret ccw_device_get_mdc return value
correctly (git-fixes bsc#1215049).
- commit a97aee2
- s390/zcrypt: handle new reply code FILTERED_BY_HYPERVISOR
(git-fixes bsc#1215046).
- commit 44d01f3
- s390/uaccess: avoid (false positive) compiler warnings
(git-fixes bsc#1215041).
- commit 59bf770
- s390/qdio: add sanity checks to the fast-requeue path (git-fixes
bsc#1215038).
- commit b52d0b2
- s390/kasan: fix strncpy_from_user kasan checks (git-fixes
bsc#1215037).
- commit 9a9cc75
- s390: zcrypt: initialize variables before_use (git-fixes
bsc#1215036).
- commit 4af7ade
- s390/pkey: add one more argument space for debug feature entry
(git-fixes bsc#1215035).
- commit 06b1fa0
- s390/dasd: Fix capacity calculation for large volumes (git-fixes
bsc#1215034).
- commit 3bac622
- s390/zcrypt: improve special ap message cmd handling (git-fixes
bsc#1215032).
- commit 13e8aa1
- s390/kdump: Fix memleak in nt_vmcoreinfo (git-fixes
bsc#1215028).
- commit b9151e6
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_ready_cb
(bsc#1214233 CVE-2023-40283).
- commit eabaa85
- drm/vmwgfx: Test shader type against SVGA3d_SHADERTYPE_MIN (bsc#1203517 CVE-2022-36402)
- commit 90f1895
- cifs: Fix UAF in cifs_demultiplex_thread() (bsc#1208995
CVE-2023-1192).
- commit f2c9320
- add upstream tags to a few pci-hyperv patches
- commit a255269
- sched/fair: Fix CFS bandwidth hrtimer expiry type (git fixes).
- sched/fair: Don't NUMA balance for kthreads (git fixes).
- sched/core: Check quota and period overflow at usec to nsec
conversion (git fixes).
- sched/core: Handle overflow in cpu_shares_write_u64 (git fixes).
- sched/cpufreq: Fix kobject memleak (git fixes).
- sched/topology: Fix off by one bug (git fixes).
- commit 1834f8f
- blacklist.conf: Cosmetic, not fix
- commit 59cf877
- blacklist.conf: Relatively high-risk given the lack of a customer bug
- commit b474f56
- scsi: storvsc: Fix handling of virtual Fibre Channel timeouts
(git-fixes).
- scsi: storvsc: Always set no_report_opcodes (git-fixes).
- commit 1d90748
- blacklist.conf: optimization
- commit 117c6b0
- blacklist.conf: obsoleted by later patch
- commit 260ff3e
- blacklist.conf: kABI
- commit e0a5839
- blacklist.conf: kABI
- commit 980539d
- blacklist.conf: optimization
- commit 2fe1477
- scsi: qla2xxx: Remove unused variables in
qla24xx_build_scsi_type_6_iocbs() (bsc#1214928).
- scsi: qla2xxx: Update version to 10.02.09.100-k (bsc#1214928).
- Revert "scsi: qla2xxx: Fix buffer overrun" (bsc#1214928).
- scsi: qla2xxx: Fix smatch warn for qla_init_iocb_limit()
(bsc#1214928).
- scsi: qla2xxx: Remove unsupported ql2xenabledif option
(bsc#1214928).
- scsi: qla2xxx: Error code did not return to upper layer
(bsc#1214928).
- scsi: qla2xxx: Add logs for SFP temperature monitoring
(bsc#1214928).
- scsi: qla2xxx: Fix firmware resource tracking (bsc#1214928).
- scsi: qla2xxx: Flush mailbox commands on chip reset
(bsc#1214928).
- scsi: qla2xxx: Allow 32-byte CDBs (bsc#1214928).
- scsi: qla2xxx: Move resource to allow code reuse (bsc#1214928).
- scsi: qla2xxx: Remove unused declarations (bsc#1214928).
- commit e3144fe
- series: update metadata qla2xxx
- Refresh
patches.suse/scsi-qla2xxx-Adjust-IOCB-resource-on-qpair-create.patch.
- Refresh patches.suse/scsi-qla2xxx-Fix-TMF-leak-through.patch.
- Refresh
patches.suse/scsi-qla2xxx-Fix-command-flush-during-TMF.patch.
- Refresh
patches.suse/scsi-qla2xxx-Fix-deletion-race-condition.patch.
- Refresh
patches.suse/scsi-qla2xxx-Fix-erroneous-link-up-failure.patch.
- Refresh patches.suse/scsi-qla2xxx-Fix-session-hang-in-gnl.patch.
- Refresh
patches.suse/scsi-qla2xxx-Limit-TMF-to-8-per-function.patch.
- Refresh
patches.suse/scsi-qla2xxx-Turn-off-noisy-message-log.patch.
- Refresh
patches.suse/scsi-qla2xxx-Update-version-to-10.02.08.500-k.patch.
- Refresh
patches.suse/scsi-qla2xxx-fix-inconsistent-TMF-timeout.patch.
- commit a78c0e0
- blacklist: add nvme-tcp/nvme-rdma path freeze patches
- commit bfd23fd
- module: avoid allocation if module is already present and ready
(bsc#1213921).
- commit ea88fa3
- module: move check_modinfo() early to early_mod_check()
(bsc#1213921).
- commit 4dd579c
- module: move early sanity checks into a helper (bsc#1213921).
- commit 2966d5d
- module: extract patient module check into helper (bsc#1213921).
- commit ee26ffe
- blacklist.conf: Drop invplg patch
- commit 6d986f2
- x86/crash: Disable virt in core NMI crash handler to avoid double shootdown (git-fixes).
- commit 3755873
- x86/virt: Force GIF=1 prior to disabling SVM (for reboot flows) (git-fixes).
- commit 4f2adfa
- x86/mm: Fix use of uninitialized buffer in sme_enable() (git-fixes).
- commit 059349a
- x86/reboot: Disable SVM, not just VMX, when stopping CPUs (git-fixes).
- commit ebd4ce9
- x86/mm: Do not shuffle CPU entry areas without KASLR (git-fixes).
- commit 2e7ba0d
- x86/bugs: Reset speculation control settings on init (git-fixes).
- commit ef1a64e
- x86/ioapic: Don't return 0 from arch_dynirq_lower_bound() (git-fixes).
- commit 819086a
- x86/speculation: Mark all Skylake CPUs as vulnerable to GDS (git-fixes).
- commit a399606
- x86/microcode/AMD: Load late on both threads too (git-fixes).
- commit 1a17c86
- x86/cpu/amd: Enable Zenbleed fix for AMD Custom APU 0405 (git-fixes).
- commit 80a2dc8
- x86/cpu: Fix amd_check_microcode() declaration (git-fixes).
- commit 2702ba0
- x86: Move gds_ucode_mitigated() declaration to header (git-fixes).
- commit 723e612
- x86/CPU/AMD: Disable XSAVES on AMD family 0x17 (git-fixes).
- commit ee9c9b3
- blacklist.conf: Ignore a bunch of useless patches
They primarily relate to the GDS mitigations but have some implicit
dependencies which aren't satisfied in SLE12-SP5 hence can't be
backported without breaking the boot flow.
- commit 8a7a083
- NFS: Guard against READDIR loop when entry names exceed
MAXNAMELEN (git-fixes).
- nfs/blocklayout: Use the passed in gfp flags (git-fixes).
- NFSD: da_addr_body field missing in some GETDEVICEINFO replies
(git-fixes).
- fs: lockd: avoid possible wrong NULL parameter (git-fixes).
- NFSD: add encoding of op_recall flag for write delegation
(git-fixes).
- commit 9627d5e
- ext4: avoid deadlock in fs reclaim with page writeback
(bsc#1213016).
- commit 9e76893
- blacklist.conf: optimization
- commit 0093119
- blacklist.conf: optimization
- commit 8d089ae
- rpm/mkspec-dtb: support for nested subdirs
Commit 724ba6751532 ("ARM: dts: Move .dts files to vendor
sub-directories") moved the dts to nested subdirs, add a support for
that. That is, generate a %dir entry in %files for them.
- commit 6484eda
- Bluetooth: nokia: fix value check in
nokia_bluetooth_serdev_probe() (git-fixes).
- commit 65ce64f
- SUNRPC: always clear XPRT_SOCK_CONNECTING before
xprt_clear_connecting on TCP xprt (bsc#1214453).
- commit 262ee00
- libceph: fix potential hang in ceph_osdc_notify() (bsc#1214752).
- commit bb71e26
- usb-storage: alauda: Fix uninit-value in alauda_check_media()
(git-fixes).
- commit 699a0f7
- USB: serial: simple: sort driver entries (git-fixes).
- commit cd31a2c
- USB: serial: simple: add Kaufmann RKS+CAN VCP (git-fixes).
- commit 01910f6
- blacklist.conf: Add 541676078b52 membarrier: Disable preemption when calling smp_call_function_many()
- commit abc325d
- blacklist.conf: Add 295d6d5e3736 sched/deadline: Fix switching to -deadline
- commit eabea96
- blacklist.conf: Add ad789f84c9a1 sched/debug: Fix cgroup_path[] serialization
- commit 668acbe
- blacklist.conf: Add a46d14eca7b7 sched/fair: Use rq_lock/unlock in online_fair_sched_group
- commit f2e125e
- USB: serial: option: add Quectel EC200A module support
(git-fixes).
- commit 6a79fcc
- USB: serial: option: support Quectel EM060K_128 (git-fixes).
- commit 08d37b2
- USB: serial: option: add Quectel EM061KGL series (git-fixes).
- commit 8761a7d
- USB: serial: option: add LARA-R6 01B PIDs (git-fixes).
- commit f1fab77
- USB: serial: option: add u-blox LARA-L6 modem (git-fixes).
- commit b920356
- net-sysfs: Call dev_hold always in rx_queue_add_kobject
(git-fixes).
- commit 90595e2
- net-sysfs: Call dev_hold always in netdev_queue_add_kobject
(git-fixes).
- commit 890c248
- net-sysfs: fix netdev_queue_add_kobject() breakage (git-fixes).
- commit 29ae172
- blacklist.conf: add drivers/net/arcnet/
- commit 49ea450
- blacklist.conf: add CAIF drivers
- commit e788b55
- blacklist.conf: add CONFIG_WAN and CONFIG_IEEE802154 drivers
- commit 26fa349
- blacklist.conf: add CONFIG_ROSE
- commit 9103b7d
- blacklist.conf: add CONFIG_DECNET
- commit ffa631c
- blacklist.conf: add CONFIG_PHONET
- commit bd0a4a9
- blacklist.conf: add CONFIG_NETROM
- commit f7b4f72
- blacklist.conf: add CONFIG_X25
- commit 482c65e
- blacklist.conf: add CONFIG_IEEE802154
- commit 3234431
- blacklist.conf: update blacklist
- commit 9ca64d4
- netfilter: ipset: Fix an error code in ip_set_sockfn_get()
(git-fixes).
- commit 9e5e119
- bridge: ebtables: don't crash when using dnat target in output
chains (git-fixes).
- commit 6755ab5
- net-sysfs: Fix reference count leak in rx|netdev_queue_add_kobject (git-fixes).
- commit ba3b4ef
- xfrm: release device reference for invalid state (git-fixes).
- commit edb4011
- net/fq_impl: Switch to kvmalloc() for memory allocation (git-fixes).
- commit fc2b65b
- blacklist.conf: add CONFIG_BATMAN_ADV
- commit 4a7aeb7
- net: mana: add support for XDP_QUERY_PROG (jsc#SLE-18779, bsc#1214209).
- commit 2072e0b
- Input: cyttsp4_core - change del_timer_sync() to
timer_shutdown_sync() (bsc#1213971 CVE-2023-4134).
- commit 3678dd9
- x86/CPU/AMD: Fix the DIV(0) initial fix attempt (bsc#1213927, CVE-2023-20588).
- commit 7b74a19
- x86/CPU/AMD: Do not leak quotient data after a division by 0 (bsc#1213927, CVE-2023-20588).
- commit c7be7bc
- old-flavors: Drop 2.6 kernels.
2.6 based kernels are EOL, upgrading from them is no longer suported.
- commit 7bb5087
- net: nfc: Fix use-after-free caused by nfc_llcp_find_local
(bsc#1213601 CVE-2023-3863).
- nfc: llcp: simplify llcp_sock_connect() error paths (bsc#1213601
CVE-2023-3863).
- nfc: llcp: nullify llcp_sock->dev on connect() error paths
(bsc#1213601 CVE-2023-3863).
- commit d4622dc
- nfc: Fix to check for kmemdup failure (bsc#1213601
CVE-2023-3863).
Refresh
patches.suse/nfc-fix-refcount-leak-in-llcp_sock_connect.patch.
patches.suse/nfc-fix-memory-leak-in-llcp_sock_connect.patch.
patches.suse/net-nfc-fix-use-after-free-llcp_sock_bind-connect.patch.
- commit 8e06144
- Refresh patches.suse/x86-srso-add-ibpb.patch.
CPU_IBPB_ENTRY is non-existant on our kernels and we effectively always
have it enabled, adjust patch accordingly.
- commit ef69893
- x86/vmware: Enable steal time accounting (bsc#1210327).
- commit af543f3
- x86/vmware: Add steal time clock support for VMware guests
(bsc#1210327).
- commit 7743a65
- x86/cpu/vmware: Fix platform detection VMWARE_PORT macro
(bsc#1210327).
- commit ea2bc47
- x86/cpu/vmware: Use the full form of INL in VMWARE_HYPERCALL,
for clang/llvm (bsc#1210327).
- commit 1575f32
- x86/cpu/vmware: Use the full form of INL in VMWARE_PORT
(bsc#1210327).
- commit 2a67cd9
- net: vmxnet3: fix possible NULL pointer dereference in
vmxnet3_rq_cleanup() (bsc#1214451 CVE-2023-4459).
- commit 070c8ea
- kabi/severities: Ignore newly added SRSO mitigation functions
- commit 8a99b91
- blacklist.conf: add drivers/net/ethernet/lantiq_etop.c
- commit 26afac4
- net: bnx2x: fix variable dereferenced before check (git-fixes).
- commit bda0298
- tun: fix bonding active backup with arp monitoring (git-fixes).
- commit 60e162e
- bonding: Fix a use-after-free problem when
bond_sysfs_slave_add() failed (git-fixes).
- commit 7b40920
- USB: serial: option: add support for VW/Skoda "Carstick LTE"
(git-fixes).
- commit 7c6d92a
- USB: serial: option: add Quectel EM05CN modem (git-fixes).
- commit 6429943
- USB: serial: option: add Quectel EM05CN (SG) modem (git-fixes).
- commit e6e99a8
- net: tun: fix bugs for oversize packet when napi frags enabled
(bsc#1213543 CVE-2023-3812).
- commit 6b178d4
- USB: serial: cp210x: add SCALANCE LPE-9000 device id
(git-fixes).
- commit 533d12f
- USB: serial: option: add Quectel EC200U modem (git-fixes).
- commit dc34ec6
- USB: serial: cp210x: add Kamstrup RF sniffer PIDs (git-fixes).
- commit b8ed016
- Refresh
patches.suse/USB-serial-option-add-Quectel-EM05-G-modem.patch.
- commit df40afb
- Refresh
patches.suse/USB-serial-option-add-support-for-u-blox-LARA-R6-fam.patch.
- commit 13f6793
- USB: zaurus: Add ID for A-300/B-500/C-700 (git-fixes).
- commit 7f1436c
- x86/srso: Correct the mitigation status when SMT is disabled (git-fixes).
- commit e345bea
- x86/srso: Explain the untraining sequences a bit more (git-fixes).
- commit 71144e1
- x86/cpu/kvm: Provide UNTRAIN_RET_VM (git-fixes).
- commit bf1a2fa
- x86/cpu: Cleanup the untrain mess (git-fixes).
- commit a6086d7
- xfrm: add NULL check in xfrm_update_ae_params (bsc#1213666
CVE-2023-3772).
- commit fa1caab
- x86/cpu: Rename srso_(.*)_alias to srso_alias_\1 (git-fixes).
- commit 2cfb3ab
- x86/cpu: Rename original retbleed methods (git-fixes).
- commit 1310fe3
- x86/cpu: Fix up srso_safe_ret() and __x86_return_thunk() (git-fixes).
- commit e7d0cb6
- x86/cpu: Fix __x86_return_thunk symbol type (git-fixes).
- commit ddb54e9
- x86/retpoline,kprobes: Skip optprobe check for indirect jumps with retpolines and IBT (git-fixes).
- commit 19c2705
- x86/retpoline,kprobes: Fix position of thunk sections with CONFIG_LTO_CLANG (git-fixes).
- commit 9b3cb5f
- x86/srso: Disable the mitigation on unaffected configurations (git-fixes).
- commit 3c5d037
- x86/retpoline: Don't clobber RFLAGS during srso_safe_ret() (git-fixes).
- commit ee484fd
- x86/srso: Fix build breakage with the LLVM linker (git-fixes).
- commit 87ffd8d
- Update config files. Drop the dpt_i2o kernel module.
For: jsc#PED-4579, CVE-2023-2007
- commit 55a7a29
- fs: jfs: fix possible NULL pointer dereference in dbFree() (bsc#1214348 CVE-2023-4385).
- commit 47225b2
- mkspec: Allow unsupported KMPs (bsc#1214386)
- commit 55d8b82
- check-for-config-changes: ignore BUILTIN_RETURN_ADDRESS_STRIPS_PAC (bsc#1214380).
gcc7 on SLE 15 does not support this while later gcc does.
- commit 5b41c27
- blacklist.conf: add drivers/net/ethernet/fujitsu/
- commit 3029931
- net: vmxnet3: fix possible use-after-free bugs in
vmxnet3_rq_alloc_rx_buf() (bsc#1214350 CVE-2023-4387).
- commit a117715
- blacklist.conf: kABI
- commit d3731cb
- patches.suse/btrfs-allow-use-of-global-block-reserve-for-balance-.patch:
(bsc#1214335).
- commit 22c271f
- kernel-binary: Common dependencies cleanup
Common dependencies are copied to a subpackage, there is no need for
copying defines or build dependencies there.
- commit 254b03c
- kernel-binary: Drop code for kerntypes support
Kerntypes was a SUSE-specific feature dropped before SLE 12.
- commit 2c37773
- blacklist.conf: too risky
- commit 711552b
- usb: xhci-mtk: set the dma max_seg_size (git-fixes).
- commit 96d510e
- usb: xhci: Check endpoint is valid before dereferencing it
(git-fixes).
- commit 759ec87
- xhci-pci: set the dma max_seg_size (git-fixes).
- commit fed4fe1
- xhci: Remove device endpoints from bandwidth list when freeing
the device (git-fixes).
- commit 841d8bb
- usb: host: xhci: Fix potential memory leak in
xhci_alloc_stream_info() (git-fixes).
- commit c04f324
- powerpc/mm/altmap: Fix altmap boundary check (bsc#1120059
git-fixes).
- commit 4b78272
- bnx2x: fix page fault following EEH recovery (bsc#1214299).
- commit 04ecd0c
- net/af_unix: fix a data-race in unix_dgram_poll (git-fixes).
- commit c65eb1d
- udp6: Fix race condition in udp6_sendmsg & connect (git-fixes).
- commit 8bfe338
- af_unix: Fix a data race of sk->sk_receive_queue->qlen
(git-fixes).
- commit fa2c287
- af_key: Fix send_acquire race with pfkey_register (git-fixes).
- commit f3afa57
- af_packet: fix data-race in packet_setsockopt /
packet_setsockopt (git-fixes).
- commit 67256be
- blacklist.conf: Add a07db5c08657 sched/core: Fix CPU controller for !RT_GROUP_SCHED
- commit dd8fafd
- blacklist.conf: Add 354d77930706 sched/autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[]
- commit 9062495
- net/af_unix: fix a data-race in unix_dgram_sendmsg /
unix_release_sock (git-fixes).
- commit 210495b
- udp: fix race between close() and udp_abort() (git-fixes).
- commit a5be337
- skbuff: fix a data race in skb_queue_len() (git-fixes).
- commit 5ea9284
- packet: fix data-race in fanout_flow_is_huge() (git-fixes).
- commit 4e14632
- net: icmp: fix data-race in cmp_global_allow() (git-fixes).
- Refresh
patches.suse/icmp-randomize-the-global-rate-limiter.patch.
- commit ac95ea3
- inetpeer: fix data-race in inet_putpeer / inet_putpeer
(git-fixes).
- commit 80a2ee8
- packet: unconditionally free po->rollover (git-fixes).
- commit b37ed03
- media: usb: siano: Fix warning due to null work_func_t function
pointer (bsc#1213969 CVE-2023-4132).
- commit 75a6a97
- media: usb: siano: Fix use after free bugs caused by
do_submit_urb (bsc#1213969 CVE-2023-4132).
- commit 4613c3a
- netfilter: nf_conntrack: Fix possible possible crash on module
loading (git-fixes).
- commit 6f6cadf
- blacklist.conf: update blacklist
- commit f72ef52
- x86/speculation: Add cpu_show_gds() prototype (git-fixes).
- commit 9cd20c4
- fs/sysv: Null check to prevent null-ptr-deref bug (git-fixes).
- commit f41c2a0
- net/sched: cls_route: No longer copy tcf_result on update to
avoid use-after-free (bsc#1214149 CVE-2023-4128).
- net/sched: cls_fw: No longer copy tcf_result on update to
avoid use-after-free (bsc#1214149 CVE-2023-4128).
- net/sched: cls_u32: No longer copy tcf_result on update to
avoid use-after-free (bsc#1214149 CVE-2023-4128).
- commit c462108
- Sort latest foray of security patches
- Refresh patches.suse/kvm-add-gds_no-support-to-kvm.patch.
- Refresh
patches.suse/x86-speculation-add-gather-data-sampling-mitigation.patch.
- Refresh
patches.suse/x86-srso-add-a-speculative-ras-overflow-mitigation.patch.
- Refresh patches.suse/x86-srso-add-srso_no-support.patch.
- commit 6e04a2d
- s390/dasd: fix hanging device after quiesce/resume (git-fixes
bsc#1214157).
- commit a759906
- cxgb4: fix use after free bugs caused by circular dependency
problem (bsc#1213970 CVE-2023-4133).
- timers: Provide timer_shutdown[_sync]() (bsc#1213970).
- timers: Add shutdown mechanism to the internal functions
(bsc#1213970).
- timers: Split [try_to_]del_timer[_sync]() to prepare for
shutdown mode (bsc#1213970).
- timers: Silently ignore timers with a NULL function
(bsc#1213970).
- timers: Rename del_timer() to timer_delete() (bsc#1213970).
- timers: Rename del_timer_sync() to timer_delete_sync()
(bsc#1213970).
- timers: Use del_timer_sync() even on UP (bsc#1213970).
- timers: Update kernel-doc for various functions (bsc#1213970).
- timers: Replace BUG_ON()s (bsc#1213970).
- clocksource/drivers/sp804: Do not use timer namespace for
timer_shutdown() function (bsc#1213970).
- clocksource/drivers/arm_arch_timer: Do not use timer namespace
for timer_shutdown() function (bsc#1213970).
- ARM: spear: Do not use timer namespace for timer_shutdown()
function (bsc#1213970).
- commit 7812c75
- xen/netback: Fix buffer overrun triggered by unusual packet
(CVE-2023-34319, XSA-432, bsc#1213546).
- commit 3798a75
- Refresh patches.kabi/cpufeatures-kabi-fix.patch.
- commit c9296b1
- x86/srso: Tie SBPB bit setting to microcode patch detection (bsc#1213287, CVE-2023-20569).
- commit 18888c5
- blacklist.conf: ("arm64: Use correct ll/sc atomic constraints")
- commit fe276b3
- blacklist.conf: ("arm64: Avoid redundant type conversions in xchg() and cmpxchg()")
- commit bd2ee86
- bpf, arm64: use more scalable stadd over ldxr / stxr loop in xadd (git-fixes)
- commit 17e6299
- bpf, arm64: remove prefetch insn in xadd mapping (git-fixes)
- commit 07a4057
- arm64: vdso: Fix clock_getres() for CLOCK_REALTIME (git-fixes)
- commit ebeacd1
- arm64: Re-enable support for contiguous hugepages (git-fixes)
- commit ebd168a
- ubifs: fix snprintf() checking (git-fixes).
- commit 43c222a
- net: tap_open(): set sk_uid from current_fsuid() (CVE-2023-4194
bsc#1214019).
- net: tun_chr_open(): set sk_uid from current_fsuid()
(CVE-2023-4194 bsc#1214019).
- commit 82ba5a9
- tracing: Fix warning in trace_buffered_event_disable()
(git-fixes).
- commit d93f525
- ring-buffer: Fix wrong stat of cpu_buffer->read (git-fixes).
- commit 0dc7589
- fs: hfsplus: remove WARN_ON() from
hfsplus_cat_{read,write}_inode() (git-fixes).
- commit 90060d8
- nfsd: Remove incorrect check in nfsd4_validate_stateid
(git-fixes).
- commit 8542ece
- Update config files. - Refresh patches.suse/x86-srso-add-srso_no-support.patch.
Ensure SRSO is always built and also ensure that msr interception works
correctly when writing to PRED_CMD msr with the SRSO_NO capability
present.
- commit c88c60d
- patches.kabi/cpufeatures-kabi-fix.patch: (bsc#1213287, CVE-2023-20569).
x86 bug bits alias into cap bits. However with the introduction of the
kABI fix for CPUID bits bug and cap ints need to be handled separately.
- commit 335c50e
- s390/ftrace: fix endless recursion in function_graph tracer
(git-fixes bsc#1213912).
- commit dee4f50
- s390/time: ensure get_clock_monotonic() returns monotonic values
(git-fixes bsc#1213911).
- commit 5c3c506
- s390/cpum_sf: Check for SDBT and SDB consistency (git-fixes
bsc#1213910).
- commit b02a979
- s390/cpum_sf: Avoid SBD overflow condition in irq handler
(git-fixes bsc#1213908).
- commit a9dbd12
- s390/smp: __smp_rescan_cpus() - move cpumask away from stack
(git-fixes bsc#1213906).
- commit c4dc11f
- s390/smp: fix physical to logical CPU map for SMT (git-fixes
bsc#1213904).
- commit 8c91a3b
- blacklist.conf: cleanup commit
- commit 4d18b38
- net: usb: qmi_wwan: add support for Compal RXM-G1 (git-fixes).
- commit d1428d0
- blacklist.conf: This is a feature
- commit 99bb16b
- s390/jump_label: print real address in a case of a jump label
bug (git-fixes bsc#1213899).
- commit c684264
- kabi fix test
- commit 87ce69f
- bpf: add missing header file include (bsc#1211738
CVE-2023-0459).
- commit ca4ea63
- s390/cpum_sf: Adjust sampling interval to avoid hitting sample
limits (git-fixes bsc#1213827).
- commit 8ee8817
- s390/maccess: add no DAT mode to kernel_write (git-fixes
bsc#1213825).
- commit bab3d2c
- vfio-ccw: Release any channel program when releasing/removing
vfio-ccw mdev (git-fixes bsc#1213823).
- commit 60eb99d
- vfio-ccw: Prevent quiesce function going into an infinite loop
(git-fixes bsc#1213819).
- commit 123e763
- Update
patches.suse/scsi-zfcp-Fix-missing-auto-port-scan-and-thus-missing-target-ports
(git-fixes bsc#1202670).
- commit dacbbc4
- Update
patches.suse/s390-dasd-fix-no-record-found-for-raw_track_access.patch
(git-fixes bsc#1212266 bsc#1207528).
- commit ae7fc88
- blacklist.conf: build warnings only
- commit 6609aaf
- media: videodev2.h: Fix struct v4l2_input tuner index comment
(git-fixes).
- commit 5a43e28
- block: Fix a source code comment in
include/uapi/linux/blkzoned.h (git-fixes).
- commit d8748d6
- blacklist.conf: kABI
- commit 2515e35
- blacklist.conf: kABI
- commit ec2e2d5
- blacklist.conf: kABI
- commit d01b20b
- blacklist.conf: irrelevant because you are not to do upstream
development with a SLE12 kernel
- commit 1dcedba
- blacklist.conf: irrelevant build fix
- commit db201cc
- blacklist.conf: irrelevant build fix
- commit ef696c2
- blacklist.conf: irrelevant build fix
- commit e324526
- blacklist.conf: irrelevant build fix
- commit 280f872
- livepatch: check kzalloc return values (git-fixes).
- commit c090f07
- virtio_net: bugfix overflow inside xdp_linearize_page()
(git-fixes).
- commit b6531dc
- virtio-net: Keep stop() to follow mirror sequence of open()
(git-fixes).
- commit 6c6da5a
- vhost/vsock: Use kvmalloc/kvfree for larger packets (git-fixes).
- commit 95a2d87
- virtio_net: fix xdp_rxq_info bug after suspend/resume
(git-fixes).
- commit cededae
- virtio-mmio: fix missing put_device() when vm_cmdline_parent
registration failed (git-fixes).
- commit cc5a462
- s390/numa: move initial setup of node_to_cpumask_map (git-fixes
bsc#1213766).
- commit 44aa432
- net/sched: cls_u32: Fix reference counter leak leading to
overflow (CVE-2023-3609 bsc#1213586).
- commit a166dc2
- virtio-pci: Remove wrong address verification in vp_del_vqs()
(git-fixes).
- commit fb88881
- blacklist.conf: triggers kABI check (bsc#1213350)
- commit c36a4a3
- blacklist.conf: just a cleanup that doesn't fix anything
- commit bef0bce
- blacklist.conf: a fix for never packported patch
- commit e2e42cd
- Fix double fget() in vhost_net_set_backend() (git-fixes).
- commit e283c32
- vhost/vsock: don't check owner in vhost_vsock_stop() while
releasing (git-fixes).
- commit 6e93d45
- net/sched: cls_fw: Fix improper refcount update leads to
use-after-free (CVE-2023-3776 bsc#1213588).
- commit 0349f73
- net/sched: sch_qfq: account for stab overhead in qfq_enqueue
(CVE-2023-3611 bsc#1213585).
- net/sched: sch_qfq: refactor parsing of netlink parameters
(bsc#1213585).
- blacklist follow-up commit 158810b261d0 ("net/sched: sch_qfq: reintroduce
lmax bound check for MTU") as unlike the original upstream commit, our
backport does not remove the check
- commit 5488c28
- net: skip virtio_net_hdr_set_proto if protocol already set
(git-fixes).
- commit 8780cf7
- virtio_ring: Fix querying of maximum DMA mapping size for
virtio device (git-fixes).
- commit 8dacd2d
- vhost/vsock: fix incorrect used length reported to the guest
(git-fixes).
- commit 2a64a7c
- net: virtio_net_hdr_to_skb: count transport header in UFO
(git-fixes).
- commit 9757e32
- vhost_net: fix OoB on sendmsg() failure (git-fixes).
- commit 88459d6
- x86/srso: Add IBPB on VMEXIT (bsc#1213287, CVE-2023-20569).
- commit 14120fa
- vringh: Use wiov->used to check for read/write desc order
(git-fixes).
- commit 6df31aa
- x86/srso: Add IBPB (bsc#1213287, CVE-2023-20569).
- commit 373f015
- x86/srso: Add SRSO_NO support (bsc#1213287, CVE-2023-20569).
- commit 447a133
- x86/cpu, kvm: Add support for CPUID_80000021_EAX (bsc#1213287, CVE-2023-20569).
- commit 8553516
- vhost: Fix the calculation in vhost_overflow() (git-fixes).
- commit 53b92b7
- Delete patches.suse/memcg-drop-kmem-limit_in_bytes.patch.
Remove the patch due to causing bsc#1213705.
- commit 3f5780d
- x86/srso: Add IBPB_BRTYPE support (bsc#1213287, CVE-2023-20569).
- commit 52998d3
- virtio: Improve vq->broken access to avoid any compiler
optimization (git-fixes).
- commit e78eee9
- virtio_net: Fix error handling in virtnet_restore() (git-fixes).
- commit 6e0d3eb
- x86: Sanitize linker script (bsc#1213287, CVE-2023-20569).
- commit 631311e
- x86/retbleed: Add __x86_return_thunk alignment checks (bsc#1213287, CVE-2023-20569).
- commit 00b523c
- vringh: fix __vringh_iov() when riov and wiov are different
(git-fixes).
- commit fc76995
- x86/srso: Add a Speculative RAS Overflow mitigation (bsc#1213287, CVE-2023-20569).
- commit ef43cae
- vhost/vsock: fix packet delivery order to monitoring devices
(git-fixes).
- commit 23364e7
- scsi: qla2xxx: Update version to 10.02.08.500-k (bsc#1213747).
- scsi: qla2xxx: fix inconsistent TMF timeout (bsc#1213747).
- scsi: qla2xxx: Fix TMF leak through (bsc#1213747).
- scsi: qla2xxx: Turn off noisy message log (bsc#1213747).
- scsi: qla2xxx: Fix session hang in gnl (bsc#1213747).
- scsi: qla2xxx: Fix erroneous link up failure (bsc#1213747).
- scsi: qla2xxx: Fix command flush during TMF (bsc#1213747).
- scsi: qla2xxx: Limit TMF to 8 per function (bsc#1213747).
- scsi: qla2xxx: Adjust IOCB resource on qpair create
(bsc#1213747).
- scsi: qla2xxx: Fix deletion race condition (bsc#1213747).
- commit ccb6c62
- scsi: qla2xxx: Fix error code in qla2x00_start_sp()
(bsc#1213747).
- scsi: qla2xxx: Silence a static checker warning (bsc#1213747).
- scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue
(bsc#1213747).
- scsi: qla2xxx: Update version to 10.02.08.400-k (bsc#1213747).
- scsi: qla2xxx: Correct the index of array (bsc#1213747).
- scsi: qla2xxx: Pointer may be dereferenced (bsc#1213747).
- scsi: qla2xxx: Fix buffer overrun (bsc#1213747).
- scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport()
(bsc#1213747).
- scsi: qla2xxx: Avoid fcport pointer dereference (bsc#1213747).
- scsi: qla2xxx: Fix potential NULL pointer dereference
(bsc#1213747).
- scsi: qla2xxx: Array index may go out of bound (bsc#1213747).
- scsi: qla2xxx: Drop useless LIST_HEAD (bsc#1213747).
- scsi: qla2xxx: Fix end of loop test (bsc#1213747).
- scsi: qla2xxx: Fix NULL pointer dereference in target mode
(bsc#1213747).
- commit f23fa07
- virtio-balloon: fix managed page counts when migrating pages
between zones (git-fixes).
- commit 5ada11d
- vhost/vsock: split packets to send using multiple buffers
(git-fixes).
- commit e3832ce
- vhost/test: fix build for vhost test (git-fixes).
- commit 1e9d49e
- vsock/virtio: stop workers during the .remove() (git-fixes).
- commit 1f19f2b
- vsock/virtio: use RCU to avoid use-after-free on
the_virtio_vsock (git-fixes).
- commit a525dd1
- kernel-binary.spec.in: Remove superfluous %% in Supplements
Fixes: 02b7735e0caf ("rpm/kernel-binary.spec.in: Add Enhances and Supplements tags to in-tree KMPs")
- commit 264db74
- vhost_net: disable zerocopy by default (git-fixes).
- commit 05e0782
- xen/blkfront: Only check REQ_FUA for writes (git-fixes).
- commit 2f31c71
- s390/cio: check the subchannel validity for dev_busid
(bsc#1207526).
- commit 512a26a
- s390/cio: add dev_busid sysfs entry for each subchannel
(bsc#1207526).
- commit ff8d9d4
- s390/cio: introduce io_subchannel_type (bsc#1207526).
- Refresh
patches.suse/s390-cio-generate-delayed-uevent-for-vfio-ccw-subchannels.
- commit c7d1471
- vc_screen: don't clobber return value in vcs_read (bsc#1213167
CVE-2023-3567).
- vc_screen: modify vcs_size() handling in vcs_read() (bsc#1213167
CVE-2023-3567).
- vc_screen: move load of struct vc_data pointer in vcs_read()
to avoid UAF (bsc#1213167 CVE-2023-3567).
- commit d1352c9
- x86/microcode/AMD: Make stub function static inline (bsc#1213286, CVE-2023-20593)
Refresh patches.suse/x86-cpu-amd-add-a-zenbleed-fix.patch.
- commit 78a62d1
- svcrdma: Prevent page release when nothing was received
(git-fixes).
- SUNRPC: Fix UAF in svc_tcp_listen_data_ready() (git-fixes).
- nfsd: fix double fget() bug in __write_ports_addfd()
(git-fixes).
- SUNRPC: remove the maximum number of retries in call_bind_status
(git-fixes).
- NFSv4.1: Always send a RECLAIM_COMPLETE after establishing lease
(git-fixes).
- commit 2c4e751
- blacklist.conf: added drbd git-fix to ignore
- commit c682535
- blacklist.conf: Add a not-relevant ftrace fix
- commit 95f476b
- ring-buffer: Fix deadloop issue on reading trace_pipe
(git-fixes).
- commit 2ca6140
- README.BRANCH: Add myself as co-maintainer
- commit 432c0e5
- KVM: Add GDS_NO support to KVM (bsc#1206418, CVE-2022-40982).
- commit 363876a
- x86/speculation: Add Gather Data Sampling mitigation (bsc#1206418, CVE-2022-40982).
- commit 89ac44a
- netfilter: nf_tables: prevent OOB access in nft_byteorder_eval
(CVE-2023-35001 bsc#1213059).
- commit 846f417
- fuse: revalidate: don't invalidate if interrupted (bsc#1213525).
- commit d6449dc
- uaccess: Add speculation barrier to copy_from_user()
(bsc#1211738 CVE-2023-0459).
- commit 8370997
- ocfs2: fix use-after-free when unmounting read-only filesystem
(git-fixes).
- commit 2b3e0de
- ocfs2: check new file size on fallocate call (git-fixes).
- commit 39f6614
- x86/cpu/amd: Add a Zenbleed fix (bsc#1213286, CVE-2023-20593).
- commit 9c7bbf1
- x86/cpu/amd: Move the errata checking functionality up (bsc#1213286, CVE-2023-20593).
- commit 06feaef
- USB: serial: option: add u-blox LARA-R6 00B modem (git-fixes).
- commit 722987b
- blacklist.conf: risk of regression
- commit 77e520e
- USB: serial: option: add Fibocom FM160 0x0111 composition
(git-fixes).
- commit 5e781fe
- USB: serial: option: add Sierra Wireless EM9191 (git-fixes).
- commit a5c215c
- blacklist.conf: kABI
- commit 272efb8
- USB: serial: option: add Quectel EM05-G (RS) modem (git-fixes).
- commit a3f4bd9
- USB: serial: option: add Quectel EM05-G (GR) modem (git-fixes).
- commit 0683869
- powerpc/security: Fix Speculation_Store_Bypass reporting on
Power10 (bsc#1188885 ltc#193722 git-fixes).
- powerpc/64: Update Speculation_Store_Bypass in
/proc/<pid>/status (bsc#1188885 ltc#193722 git-fixes).
- commit c14b3fc
- Refresh
patches.suse/keys-Fix-linking-a-duplicate-key-to-a-keyring-s-asso.patch.
- commit ed0f049
- Refresh
patches.suse/cifs-split-out-ses-and-tcon-retrieval-from-mount_get_conns-.patch.
- Refresh
patches.suse/cifs-support-nested-dfs-links-over-reconnect.patch.
Fix backport of
patches.suse/cifs-support-nested-dfs-links-over-reconnect.patch
(bsc#1212871)
- commit 3f2dafd
- blacklist.conf: fix for patch that is not included
- commit 8426871
- s390/perf: Return error when debug_register fails (git-fixes
bsc#1212657).
- commit 0fcfe58
- Update patches.suse/08-x86-bugs-provide-boot-parameters-for-the-spec_store_bypass_disable-mitigation.patch
(bsc#1087082 CVE-2018-3639 bsc#1207561).
- commit cdd6858
- Update patches.suse/08-x86-bugs-provide-boot-parameters-for-the-spec_store_bypass_disable-mitigation.patch
(bsc#1087082 CVE-2018-3639 bsc#1207561).
- commit 35a0609
- rpm: Update dependency to match current kmod.
- commit d687dc3
- usb: core: add quirk for Alcor Link AK9563 smartcard reader
(git-fixes).
- commit 8095fd4
- usb: add NO_LPM quirk for Realforce 87U Keyboard (git-fixes).
- commit 6c36377
- uas: ignore UAS for Thinkplus chips (git-fixes).
- commit 6536763
- usb-storage: Add Hiksemi USB3-FW to IGNORE_UAS (git-fixes).
- commit 454dfcf
- uas: add no-uas quirk for Hiksemi usb_disk (git-fixes).
- commit 49cc350
- USB: hcd-pci: Fully suspend across freeze/thaw cycle
(git-fixes).
- commit 9d12426
- usb: hub: Add delay for SuperSpeed hub resume to let links
transit to U0 (git-fixes).
- commit ec30965
- usb: core: hub: Disable autosuspend for Cypress CY7C65632
(git-fixes).
- Refresh
patches.suse/usb-core-hub-disable-autosuspend-for-TI-TUSB8041.patch.
- commit 3ec99e4
- x86/speculation/mmio: Print SMT warning (git-fixes).
- commit 304caaa
- x86: Fix return value of __setup handlers (git-fixes).
- commit 53fc9a6
- x86/delay: Fix the wrong asm constraint in delay_loop() (git-fixes).
- commit 873671b
- x86/cpu: Load microcode during restore_processor_state() (git-fixes).
- commit e7bd394
- x86/bugs: Remove apostrophe typo (git-fixes).
- commit 972a8b3
- x86/bugs: Enable STIBP for JMP2RET (git-fixes).
- Refresh patches.suse/x86-bugs-enable-stibp-for-ibpb-mitigated-retbleed.patch.
- commit c8acef1
- x86/bugs: Warn when "ibrs" mitigation is selected on Enhanced IBRS parts (git-fixes).
- commit ba92ee5
- blacklist.conf: cosmetic change
- commit 4490310
- s390: limit brk randomization to 32MB (git-fixes bsc#1213346).
- commit 99a7771
- s390/perf: Change CPUM_CF return code in event init function
(git-fixes bsc#1213344).
- commit 8991783
- blacklist.conf: cleanup designed to break kABI
- commit 9af40cb
- net: mana: Add support for vlan tagging (bsc#1212301).
- commit 9f17643
- s390/dasd: fix memleak in path handling error case (git-fixes
bsc#1213221).
- commit d16f3d6
- vfio-ccw: Do not call flush_workqueue while holding the spinlock
(git-fixes bsc#1213218).
- commit 99ea851
- vfio-ccw: fence off transport mode (git-fixes bsc#1213215).
- commit 09eec4a
- blacklist.conf: license change
- commit 092eb89
- btrfs: fix resolving backrefs for inline extent followed by
prealloc (bsc#1213133).
- commit 9143ce4
- fs: hfsplus: fix UAF issue in hfsplus_put_super (bsc#1211867, CVE-2023-2985).
- commit 0939c1b
- memcg: drop kmem.limit_in_bytes (bsc#1208788, bsc#1212905).
- commit 3699a6e
- Update metadata
- commit 4f06ed0
- rpm/check-for-config-changes: ignore also RISCV_ISA_* and DYNAMIC_SIGFRAME
They depend on CONFIG_TOOLCHAIN_HAS_*.
- commit 1007103
- powerpc/mm/dax: Fix the condition when checking if altmap
vmemap can cross-boundary (bsc#1150305 ltc#176097 git-fixes).
- commit 49e2ec1
- ubi: Fix failure attaching when vid_hdr offset equals to
(sub)page size (bsc#1210584).
- ubi: ensure that VID header offset + VID header size <= alloc,
size (bsc#1210584).
- commit 4331e8e
- blacklist.conf: Blacklist a408f33e895e4
- commit 6fc7467
- include/trace/events/writeback.h: fix -Wstringop-truncation
warnings (bsc#1213023).
- blacklist.conf: Remove commit d1a445d3b8 from blacklist
- patches.suse/writeback-Fix-sync-livelock-due-to-b_dirty_time-proc.patch:
Refresh
- commit 4c9bb20
- lib/string: Add strscpy_pad() function (bsc#1213023).
- commit 3c00676
- fs: fix guard_bio_eod to check for real EOD errors
(bsc#1213042).
- commit a1e013d
- udf: Check consistency of Space Bitmap Descriptor (bsc#1210771).
- commit 7ebedbc
- udf: Do not update file length for failed writes to inline files
(bsc#1213041).
- commit 18b4c06
- udf: Do not bother merging very long extents (bsc#1213040).
- commit b8138fe
- udf: Truncate added extents on failed expansion (bsc#1213039).
- commit edadd0d
- udf: Define EFSCORRUPTED error code (bsc#1213038).
- commit b1ce7bf
- udf: Fix extending file within last block (bsc#1213037).
- commit 43eaf71
- udf: Discard preallocation before extending file with a hole
(bsc#1213036).
- commit d6c23d6
- udf: Do not bother looking for prealloc extents if i_lenExtents
matches i_size (bsc#1213035).
- commit 4ee0c8f
- udf: Fix preallocation discarding at indirect extent boundary
(bsc#1213034).
- commit 4ad4e85
- udf: Drop unused arguments of udf_delete_aext() (bsc#1213033).
- commit 1a487a5
- udf: Avoid double brelse() in udf_rename() (bsc#1213032).
- commit c1551d1
- inotify: Avoid reporting event with invalid wd (bsc#1213025).
- commit 1b40fc6
- writeback: fix call of incorrect macro (bsc#1213024).
- commit be6c80a
- memcg: fix a crash in wb_workfn when a device disappears
(bsc#1213023).
Refresh patches.suse/writeback-Fix-sync-livelock-due-to-b_dirty_time-proc.patch
- commit ab66f3a
- blkcg, writeback: dead memcgs shouldn't contribute to writeback
ownership arbitration (bsc#1213022).
- commit deeb8e8
- blacklist.conf: Blacklist 12e0613715e1
- commit 0f8099a
- ext4: fix to check return value of freeze_bdev() in
ext4_shutdown() (bsc#1213021).
- commit e4bb61c
- ext4: Fix reusing stale buffer heads from last failed mounting
(bsc#1213020).
- commit 39e60c2
- ext4: only update i_reserved_data_blocks on successful block
allocation (bsc#1213019).
- commit 9a3a64e
- blacklist.conf: Blacklist dea9d8f7643f
- commit 2a0b76b
- ext4: bail out of ext4_xattr_ibody_get() fails for any reason
(bsc#1213018).
- commit e0aebad
- blacklist.conf: Blacklist 2220eaf90992
- commit 0a7a059
- ext4: improve error recovery code paths in __ext4_remount()
(bsc#1213017).
- commit 0d0eede
- blacklist.conf: Blacklist aff3bea95388
- commit 4c5264c
- blacklist.conf: Blacklist 4f04351888a8
- commit 15cda77
- blacklist.conf: Blacklist b87c7cdf2bed
- commit 2eafae9
- blacklist.conf: Blacklist 463808f237cf
- commit 6d6f5a5
- ext4: fix i_disksize exceeding i_size problem in paritally
written case (bsc#1213015).
- commit 7b579a0
- jdb2: Don't refuse invalidation of already invalidated buffers
(bsc#1213014).
- commit 0c38716
- blacklist.conf: Blacklist 93cdf49f6eca
- commit 725de91
- ext4: zero i_disksize when initializing the bootloader inode
(bsc#1213013).
- commit 1c940cb
- ext4: fix WARNING in ext4_update_inline_data (bsc#1213012).
- commit c52c259
- ext4: move where set the MAY_INLINE_DATA flag is set
(bsc#1213011).
- commit 5819fe4
- ext4: fix RENAME_WHITEOUT handling for inline directories
(bsc#1210766).
- commit c039f47
- ext4: fix cgroup writeback accounting with fs-layer encryption
(bsc#1210765).
- commit dd448da
- blacklist.conf: Blacklist 0813299c586b
- commit bd6a717
- blacklist.conf: Blacklist 0f7bfd6f8164
- commit 2a94ded
- ext4: fail ext4_iget if special inode unallocated (bsc#1213010).
- commit 630fe8f
- blacklist.conf: Blacklist e4db04f7d3db, 1e9d62d25281, f31173c19901
- commit 77a2527
- blacklist.conf: Blacklist cc12a6f25e07
- commit 3c8b58f
- ext4: avoid unaccounted block allocation when expanding inode
(bsc#1207634).
- commit 9e6d432
- ext4: initialize quota before expanding inode in setproject
ioctl (bsc#1207633).
- commit b8cc1a5
- ext4: fix deadlock due to mbcache entry corruption
(bsc#1207653).
- commit cb6b593
- igb: revert rtnl_lock() that causes deadlock (git-fixes).
- Refresh patches.suse/igb-Enable-SR-IOV-after-reinit.patch.
- commit e174406
- fs: dlm: handle -EBUSY first in lock arg validation (git-fixes).
- commit ba06019
- fs: dlm: fix race between test_bit() and queue_work()
(git-fixes).
- commit af66625
- dlm: fix missing lkb refcount handling (git-fixes).
- commit 1fdc07a
- dlm: fix plock invalid read (git-fixes).
- commit 5846a6b
- fs: dlm: filter user dlm messages for kernel locks (git-fixes).
- commit 70cf60c
- fs: dlm: fix memory leak when fenced (git-fixes).
- commit d603d38
- fs: dlm: cancel work sync othercon (git-fixes).
- commit ae6c300
- fs: dlm: fix debugfs dump (git-fixes).
- commit 93164bc
- fs: dlm: fix configfs memory leak (git-fixes).
- commit afdd8b1
- dlm: fix invalid cluster name warning (git-fixes).
- commit a02356b
- dlm: NULL check before kmem_cache_destroy is not needed
(git-fixes).
- commit 7f3aa73
- dlm: fix missing idr_destroy for recover_idr (git-fixes).
- commit 5d97801
- dlm: fix possible call to kfree() for non-initialized pointer
(git-fixes).
- commit 52d34af
- dlm: Delete an unnecessary variable initialisation in
dlm_ls_start() (git-fixes).
- commit 8663a16
- ext4: avoid BUG_ON when creating xattrs (bsc#1205496).
- commit 349d51a
- ext4: fix error code return to user-space in ext4_get_branch()
(bsc#1207630).
- commit f7cb6ba
- ext4: init quota for 'old.inode' in 'ext4_rename' (bsc#1207629).
- commit ffba993
- ext4: fix bug_on in __es_tree_search caused by bad boot loader
inode (bsc#1207620).
- commit cccc3e5
- ext4: add inode table check in __ext4_get_inode_loc to aovid
possible infinite loop (bsc#1207617).
- commit 859359e
- jbd2: fix assertion 'jh->b_frozen_data == NULL' failure when
journal aborted (bsc#1202716).
- commit e85fc79
- blacklist.conf: Blacklist 310c097c2bdb
- commit 522a9c3
- fs: prevent BUG_ON in submit_bh_wbc() (bsc#1212990).
Refresh patches.suse/ext4-fix-error-code-in-ext4_commit_super.patch
- commit daeb235
- jbd2: abort journal if free a async write error metadata buffer
(bsc#1212989).
- commit 5f2b1c4
- jbd2: fix data races at struct journal_head (bsc#1173438).
- commit 7c8dc88
- blacklist.conf: Blacklist 24dc9864914e
- commit b656355
- jbd2: Fix statistics for the number of logged blocks
(bsc#1212988).
- commit 9de4b16
- jbd2: fix invalid descriptor block checksum (bsc#1212987).
- commit 8705ef8
- jbd2: fix race when writing superblock (bsc#1212986).
- commit 6256642
- blacklist.conf: Add 6f363f5aa845 cgroup: Do not corrupt task iteration when rebinding subsystem
- commit e6c7d2e
- patches.suse/btrfs-unset-reloc-control-if-transaction-commit-fail.patch:
(bsc#1212051).
- commit f5c0b6d
- openssl-1_0_0
-
- Security fix: (bsc#1213853, CVE-2023-3817)
* Fix excessive time spent checking DH q parameter value
(bsc#1213853, CVE-2023-3817). The function DH_check() performs
various checks on DH parameters. After fixing CVE-2023-3446 it
was discovered that a large q parameter value can also trigger
an overly long computation during some of these checks. A
correct q value, if present, cannot be larger than the modulus
p parameter, thus it is unnecessary to perform these checks if
q is larger than p. If DH_check() is called with such q parameter
value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
computationally intensive checks are skipped.
* Add openssl-1_0-CVE-2023-3817.patch
- Security fix: [bsc#1213487, CVE-2023-3446]
* Fix DH_check() excessive time with over sized modulus.
* The function DH_check() performs various checks on DH parameters.
One of those checks confirms that the modulus ("p" parameter) is
not too large. Trying to use a very large modulus is slow and
OpenSSL will not normally use a modulus which is over 10,000 bits
in length.
However the DH_check() function checks numerous aspects of the
key or parameters that have been supplied. Some of those checks
use the supplied modulus value even if it has already been found
to be too large.
A new limit has been added to DH_check of 32,768 bits. Supplying
a key/parameters with a modulus over this size will simply cause
DH_check() to fail.
* Add openssl-CVE-2023-3446.patch
- python
-
- (bsc#1214691, CVE-2022-48566) Add
CVE-2022-48566-compare_digest-more-constant.patch to make
compare_digest more constant-time.
- Allow nis.so for SLE-12.
- (bsc#1214685, CVE-2022-48565) Add
CVE-2022-48565-plistlib-XML-vulns.patch (from
gh#python/cpython#86217) reject XML entity declarations in
plist files.
- Remove BOTH CVE-2023-27043-email-parsing-errors.patch and
Revert-gh105127-left-tests.patch (as per discussion on
bsc#1210638).
- Add CVE-2023-40217-avoid-ssl-pre-close.patch fixing
gh#python/cpython#108310, backport from upstream patch
gh#python/cpython#108315
(bsc#1214692, CVE-2023-40217)
- IT MEANS THAT bsc#1210638 STILL HAS NOT BEEN FIXED!
- Add Revert-gh105127-left-tests.patch (gh#python/cpython!106941)
partially reverting CVE-2023-27043-email-parsing-errors.patch,
because of the regression in gh#python/cpython#106669.
- (bsc#1210638, CVE-2023-27043) Add
CVE-2023-27043-email-parsing-errors.patch, which detects email
address parsing errors and returns empty tuple to indicate the
parsing error (old API).
- shadow
-
- bsc#1214806 (CVE-2023-4641):
Fix potential password leak
- Add shadow-CVE-2023-4641.patch
- cryptsetup
-
- luksFormat: Handle system with low memory and no swap space [bsc#1211079]
* Check for physical memory available also in PBKDF benchmark.
* Try to avoid OOM killer on low-memory systems without swap.
* Use only half of detected free memory on systems without swap.
* Add patches:
- cryptsetup-Check-for-physical-memory-available-also-in-PBKDF-be.patch
- cryptsetup-Try-to-avoid-OOM-killer-on-low-memory-systems-withou.patch
- cryptsetup-Use-only-half-of-detected-free-memory-on-systems-wit.patch
- perl
-
- enable TLS cert verification in CPAN [bnc#1210999] [CVE-2023-31484]
new patch: perl-cpan_verify_cert.diff