# changelog

author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.203.0.el6uek]
changelog:
  - xen/netback: correctly calculate required slots of skb. (Annie Li) [Orabug: 16934362]  
  - RDS: Local address resolution may be delayed after IP has moved. RDS to update local ARP cache directly to speed it up. (Bang Nguyen) [Orabug: 16979994]  
  - mlx4: fix data corruption in hugetlb_user_mr (Chien Yen) [Orabug: 16772016]  
  - fix compilation blk-core.c with missing rate-limit header (Maxim Uvarov)   
  - block: rate-limit the error message from failing commands (Yi Zou) [Orabug: 15918663]  
  - Revert "xen-blkfront: use a different scatterlist for each request" (Konrad Rzeszutek Wilk)   
  - xen/pciback: Fix for backport compilation issues. (Konrad Rzeszutek Wilk)   
  - Revert "xen-blkfront: use a different scatterlist for each request" (Konrad Rzeszutek Wilk)   
  - xen-blkfront: use a different scatterlist for each request (Roger Pau Monne)   
  - xen-blkback: check the number of iovecs before allocating a bios (Roger Pau Monne)   
  - xen-blkfront: set blk_queue_max_hw_sectors correctly (Roger Pau Monne)   
  - xen-blkback: workaround compiler bug in gcc 4.1 (Roger Pau Monne)   
  - xen/blkback: Check for insane amounts of request on the ring (v6). (Konrad Rzeszutek Wilk)   
  - xen/io/ring.h: new macro to detect whether there are too many requests on the ring (Jan Beulich)   
  - xen/blkback: Check device permissions before allowing OP_DISCARD (Konrad Rzeszutek Wilk)  {CVE-2013-2140} 
  - xen/blkback: Fix backporting of printk_ratelimit. (Konrad Rzeszutek Wilk)   
  - xen/blkback: Check device permissions before allowing OP_DISCARD (Konrad Rzeszutek Wilk)  {CVE-2013-2140} 
  - xen/blkback: Use physical sector size for setup (Stefan Bader)   
  - xen-blkback/sysfs: Move the parameters for the persistent grant features (Konrad Rzeszutek Wilk)   
  - xen-blkfront: Introduce a 'max' module parameter to alter the amount of indirect segments. (Konrad Rzeszutek Wilk)   
  - xen-blkfront: use a different scatterlist for each request (Roger Pau Monne)   
  - xen-blkback: allocate list of pending reqs in small chunks (Roger Pau Monne)   
  - xen-block: implement indirect descriptors (Roger Pau Monne)   
  - xen-blkback: expand map/unmap functions (Roger Pau Monne)   
  - xen-blkback: make the queue of free requests per backend (Roger Pau Monne)   
  - xen-blkback: move pending handles list from blkbk to pending_req (Roger Pau Monne)   
  - xen-blkback: implement LRU mechanism for persistent grants (Roger Pau Monne)   
  - xen-blkback: use balloon pages for all mappings (Roger Pau Monne)   
  - xen-blkback: print stats about persistent grants (Roger Pau Monne)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.204.0.el6uek]
changelog:
  - be2net: enable interrupts in probe (Jerry Snitselaar) [Orabug: 17080364]  
  - xen-netfront: use skb_partial_csum_set() to simplify the codes (Li RongQing)   
  - xen-netfront: split event channels support for Xen frontend driver (Wei Liu)   
  - xen-netfront: avoid leaking resources when setup_netfront fails (Wei Liu)   
  - xen-netfront: reduce gso_max_size to account for max TCP header (Wei Liu)   
  - xen-netfront: frags -> slots in log message (Wei Liu)   
  - xen-netfront: frags -> slots in xennet_get_responses (Wei Liu)   
  - xen-netfront: remove unused variable `extra' (Wei Liu)   
  - xen/netfront: improve truesize tracking (Ian Campbell)   
  - xen-netfront: remove __dev* attributes (Bill Pemberton)   
  - xen/netfront: handle compound page fragments on transmit (Ian Campbell)   
  - xen-netfront: use __pskb_pull_tail to ensure linear area is big enough on RX (Ian Campbell)   
  - ocfs2: xattr: fix inlined xattr reflink (Junxiao Bi) [Orabug: 15914937]  
  - futex: Revert "futex: Mark get_robust_list as deprecated" (Thomas Gleixner) [Orabug: 16818441]  
  - xen: do not disable netfront in dom0 (Marek Marczykowski)   
  - xen-netfront: correct MAX_TX_TARGET calculation. (Wei Liu)   
  - xen-netback: xenbus.c: use more current logging styles (Wei Liu)   
  - xen: Use more current logging styles (Joe Perches)   
  - xen-netback: double free on unload (Dan Carpenter)   
  - xen-netback: don't de-reference vif pointer after having called xenvif_put() (Jan Beulich)   
  - xen-netback: split event channels support for Xen backend driver (Wei Liu)   
  - xen-netback: enable user to unload netback module (Wei Liu)   
  - xen-netback: remove dead code (Wei Liu)   
  - xen-netback: better names for thresholds (Wei Liu)   
  - xen-netback: avoid allocating variable size array on stack (Wei Liu)   
  - xen-netback: remove redundent parameter in netbk_count_requests (Wei Liu)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.205.0.el6uek]
changelog:
  - xen/time: remove blocked time accounting from xen "clockchip" (Laszlo Ersek) [Orabug: 17073675]  
  - unix: fix a race condition in unix_release() (Paul Moore) [Orabug: 17209195]  
  - ipv6: ip6_sk_dst_check() must not assume ipv6 dst (Eric Dumazet) [Orabug: 17215196] {CVE-2013-2232} 
  - block: do not pass disk names as format strings (Kees Cook) [Orabug: 17230067] {CVE-2013-2851} 
  - libceph: Fix NULL pointer dereference in auth client code (Tyler Hicks) [Orabug: 17230100] {CVE-2013-1059} 
  - config: add xsigo config options (Ajaykumar Hotchandani) [Orabug: 17248170]  
  - mpt2sas: update from 16.05.01.00 to 17.00.00.00 (Jerry Snitselaar) [Orabug: 17237402]  
  - qla4xxx: Updated driver version to 5.03.00.03.06.02-uek2 (Tej Parkash) [Orabug: 17220575]  
  - libiscsi: Add missing prints for session and connection sysfs attrs (Adheer Chandravanshi) [Orabug: 17220575]  
  - qla4xxx: Export more firmware info in sysfs (Adheer Chandravanshi) [Orabug: 17220575]  
  - qla4xxx: Only BIOS boot target entries should be at index 0 and 1. (Adheer Chandravanshi) [Orabug: 17220575]  
  - qla4xxx: discovery_parent_idx can be shown without any check. (Adheer Chandravanshi) [Orabug: 17220575]  
  - qla4xxx: Set IPv6 traffic class if device type is IPv6. (Adheer Chandravanshi) [Orabug: 17220575]  
  - qla4xxx: Use discovery_parent_idx instead of discovery_parent_type (Adheer Chandravanshi) [Orabug: 17220575]  
  - qla4xxx: Allow removal of failed session using logout. (Adheer Chandravanshi) [Orabug: 17220575]  
  - qla4xxx: Exporting new attrs for iscsi session and connection in sysfs (Adheer Chandravanshi) [Orabug: 17220575]  
  - libiscsi: Exporting new attrs for iscsi session and connection in sysfs (Adheer Chandravanshi) [Orabug: 17220575]  
  - scsi_transport_iscsi: Exporting new attrs for iscsi session and connection in sysfs (Adheer Chandravanshi) [Orabug: 17220575]  
  - libiscsi: Added new boot entries in the session sysfs (Eddie Wai) [Orabug: 17220575]  
  - iscsi class, qla4xxx: fix sess/conn refcounting when find fns are used (Mike Christie) [Orabug: 17220575]  
  - qla4xxx: Fix iocb_cnt calculation in qla4xxx_send_mbox_iocb() (Vikas Chaudhary) [Orabug: 17220575]  
  - scsi_transport_iscsi: fix error return code in iscsi_transport_init() (Wei Yongjun) [Orabug: 17220575]  
  - qla4xxx: Assign values using correct datatype (Adheer Chandravanshi) [Orabug: 17220575]  
  - qla4xxx: Fix smatch warnings (Adheer Chandravanshi) [Orabug: 17220575]  
  - qla4xxx: Fix sparse warning for qla4xxx_sysfs_ddb_tgt_create (Vikas Chaudhary) [Orabug: 17220575]  
  - RDS: (Bang Nguyen) [Orabug: 17206167]  
  - neighbour: fix a race in neigh_destroy() (Eric Dumazet) [Orabug: 17230315]  
  - be2net: Updating version number (Sarveshwar Bandi) [Orabug: 17219620]  
  - be2net: Fix to avoid hardware workaround when not needed (Sarveshwar Bandi) [Orabug: 17219620]  
  - net/trivial: replace numeric with standard PM state macros (Yijing Wang) [Orabug: 17219620]  
  - be2net: Fix 32-bit DMA Mask handling (Somnath Kotur) [Orabug: 17219620]  
  - be2net: Implement initiate FW dump feature for Lancer (Somnath Kotur) [Orabug: 17219620]  
  - be2net: Fix crash on 2nd invocation of PCI AER/EEH error_detected hook (Somnath Kotur) [Orabug: 17219620]  
  - be2net: Mark checksum fail for IP fragmented packets (Somnath Kotur) [Orabug: 17219620]  
  - be2net: Trim padded packets for Lancer (Somnath Kotur) [Orabug: 17219620]  
  - be2net: Pad skb to meet min Tx pkt size in lancer (Somnath Kotur) [Orabug: 17219620]  
  - be2net: cleanup be_get_drvinfo() (Somnath Kotur) [Orabug: 17219620]  
  - be2net: refactor HW workarounds in be_xmit() (Sathya Perla) [Orabug: 17219620]  
  - be2net: bug fix on returning an invalid nic descriptor (Wei Yang) [Orabug: 17219620]  
  - be2net: Avoid double insertion of vlan tags. (Sarveshwar Bandi) [Orabug: 17219620]  
  - be2net: disable TX in be_close() (Sathya Perla) [Orabug: 17219620]  
  - be2net: fix EQ from getting full while cleaning RX CQ (Sathya Perla) [Orabug: 17219620]  
  - be2net: fix payload_len value for GET_MAC_LIST cmd req (Sathya Perla) [Orabug: 17219620]  
  - be2net: provision VF resources before enabling SR-IOV (Sathya Perla) [Orabug: 17219620]  
  - be2net: Fix to fail probe if MSI-X enable fails for a VF (Somnath Kotur) [Orabug: 17219620]  
  - be2net: avoid napi_disable() when it has not been enabled (Somnath Kotur) [Orabug: 17219620]  
  - be2net: Fix firmware download for Lancer (Somnath Kotur) [Orabug: 17219620]  
  - be2net: Fix to receive Multicast Packets when Promiscuous mode is enabled on certain devices (Ajit Khaparde) [Orabug: 17219620]  
  - be2net: Fix to show tx priority pause counter in ethtool -S (Ajit Khaparde) [Orabug: 17219620]  
  - be2net: Fix to use 32-bit stats to report rx_drops_no_fragment (Ajit Khaparde) [Orabug: 17219620]  
  - be2net: Fix to use version 2 of cq_create for SkyHawk-R devices (Ajit Khaparde) [Orabug: 17219620]  
  - be2net: FLR must be first cmd issued to Lancer FW (Kalesh AP) [Orabug: 17219620]  
  - be2net: Use GET_FUNCTION_CONFIG V1 cmd (Kalesh AP) [Orabug: 17219620]  
  - be2net: Fix to show wol disabled/enabled state correctly. (Sarveshwar Bandi) [Orabug: 17219620]  
  - be2net: Fixed memory leak (Suresh Reddy) [Orabug: 17219620]  
  - be2net: Avoid diagnostic test in certain versions of firmware to avoid NIC freeze. (Suresh Reddy) [Orabug: 17219620]  
  - be2net: Renamed rx_address_mismatch_errors to rx_address_filtered (Suresh Reddy) [Orabug: 17219620]  
  - be2net: Add support for setting and getting rx flow hash options (Suresh Reddy) [Orabug: 17219620]  
  - be2net: Fix PVID tag offload for packets with inline VLAN tag. (Ajit Khaparde) [Orabug: 17219620]  
  - be2net: fix a Tx stall bug caused by a specific ipv6 packet (Ajit Khaparde) [Orabug: 17219620]  
  - be2net: Remove an incorrect pvid check in Tx (Ajit Khaparde) [Orabug: 17219620]  
  - be2net: enable IOMMU pass through for be2net (Craig Hada) [Orabug: 17219620]  
  - be2net: Use GET_PROFILE_CONFIG V1 cmd for BE3-R (Vasundhara Volam) [Orabug: 17219620]  
  - be2net: Avoid flashing BE3 UFI on BE3-R chip. (Vasundhara Volam) [Orabug: 17219620]  
  - be2net: Don't log "Out of MCCQ wrbs" error (Vasundhara Volam) [Orabug: 17219620]  
  - be2net: Use TXQ_CREATE_V2 cmd (Vasundhara Volam) [Orabug: 17219620]  
  - be2net: take care of __vlan_put_tag return value (Ivan Vecera) [Orabug: 17219620]  
  - be2net: remove unused variable 'sge' (Ivan Vecera) [Orabug: 17219620]  
  - megaraid: update from 6.505 to 6.600.18.00 (Jerry Snitselaar) [Orabug: 17187623]  
  - xsigo: Kconfig and Makefile updates (Ajaykumar Hotchandani) [Orabug: 17248170]  
  - xsigo: Integrate 7489 release in UEK2 (Ajaykumar Hotchandani) [Orabug: 17248170]  
  - fs writeback: fix race in mark inode dirty.patch (Srinivas Eeda) [Orabug: 17198525]  
  - sxge: Check link state before xmit (Joe Jin) [Orabug: 17201198]  
  - writeback: Fix periodic writeback after fs mount (Srinivas Eeda) [Orabug: 17185874]  
  - spec: use _target_cpu in suffix for devel dir (Jerry Snitselaar) [Orabug: 17181059]  
  - mm: leave hugepage pmd (Guru Anbalagane) [Orabug: 17186750]  
  - Disable THP config (Guru Anbalagane) [Orabug: 17186750]  
  - RDS: Fix a bug in QoS protocol negotiation (Bang Nguyen) [Orabug: 17079972]  
  - RDS: alias failover is not working properly (Bang Nguyen) [Orabug: 17177994]  
  - rdma_cm: CMA_QUERY_HANDLER: BAD STATUS -110 and -22 (Chien-Hua Yen) [Orabug: 16708786]  
  - [RDS] add NETFILTER suppport (Ahmed Abbas) [Orabug: 17082619]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.206.0.el6uek]
changelog:
  - ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size (Hannes Frederic Sowa) [Orabug: 17296421] {CVE-2013-4163} 
  - fib_trie: potential out of bounds access in trie_show_stats() (Jerry Snitselaar) [Orabug: 16840280]  
  - aacraid: update from 1.1-7 to 1.2-0 (Jerry Snitselaar) [Orabug: 17296044]  
  - qlcnic: update from 5.2.29.45 to 5.2.43 (Jerry Snitselaar) [Orabug: 17267102]  
  - net: init perm_addr in register_netdevice() (Jiri Pirko) [Orabug: 17280581]  
  - config: disable THP for OL6 builds (Jerry Snitselaar) [Orabug: 17279055]  
  - ACPI / memhotplug: Fix a stale pointer in error path (Toshi Kani) [Orabug: 17271787]  
  - xhci: Avoid NULL pointer deref when host dies. (Sarah Sharp) [Orabug: 17271780]  
  - xhci: fix null pointer dereference on ring_doorbell_for_active_rings (Oleksij Rempel) [Orabug: 17271777]  
  - SCSI: sd: fix crash when UA received on DIF enabled device (Ewan D. Milne) [Orabug: 17271761]  
  - hrtimers: Move SMP function call to thread context (Thomas Gleixner) [Orabug: 17237808]  
  - lockd: protect nlm_blocked access in nlmsvc_retry_blocked (David Jeffery) [Orabug: 17237800]  
  - SCSI: megaraid_sas: fix memory leak if SGL has zero length entries (Bjørn Mork) [Orabug: 17237796]  
  - vlan: fix a race in egress prio management (Eric Dumazet) [Orabug: 17237794]  
  - ifb: fix oops when loading the ifb failed (dingtianhong) [Orabug: 17237783]  
  - dummy: fix oops when loading the dummy failed (dingtianhong) [Orabug: 17237779]  
  - ifb: fix rcu_sched self-detected stalls (dingtianhong) [Orabug: 17237770]  
  - ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data (Hannes Frederic Sowa) [Orabug: 17237766]  
  - ipv6,mcast: always hold idev->lock before mca_lock (Amerigo Wang) [Orabug: 17237756]  
  - af_key: fix info leaks in notify messages (Mathias Krause) [Orabug: 17237752] {CVE-2013-2234} 
  - perf: Fix perf_lock_task_context() vs RCU (Peter Zijlstra) [Orabug: 17237744]  
  - perf: Remove WARN_ON_ONCE() check in __perf_event_enable() for valid scenario (Jiri Olsa) [Orabug: 17237744]  
  - perf: Clone child context from parent context pmu (Jiri Olsa) [Orabug: 17237744]  
  - tracing: Use current_uid() for critical time tracing (Steven Rostedt (Red Hat)) [Orabug: 17237735]  
  - ext4: fix overflow when counting used blocks on 32-bit architectures (Jan Kara) [Orabug: 17231269]  
  - ext4: fix data offset overflow in ext4_xattr_fiemap() on 32-bit archs (Jan Kara) [Orabug: 17231264]  
  - xhci: check for failed dma pool allocation (Mathias Nyman) [Orabug: 17231247]  
  - crypto: sanitize argument for format string (Kees Cook)   
  - drivers/cdrom/cdrom.c: use kzalloc() for failing hardware (Jonathan Salwan) [Orabug: 17230700] {CVE-2013-2164} 
  - pch_uart: fix a deadlock when pch_uart as console (Liang Li) [Orabug: 17061700]  
  - UBIFS: fix a horrid bug (Artem Bityutskiy) [Orabug: 17061699]  
  - UBIFS: prepare to fix a horrid bug (Artem Bityutskiy) [Orabug: 17061697]  
  - dlci: validate the net device in dlci_del() (Zefan Li) [Orabug: 17061696]  
  - dlci: acquire rtnl_lock before calling __dev_get_by_name() (Zefan Li) [Orabug: 17061695]  
  - Bluetooth: Fix crash in l2cap_build_cmd() with small MTU (Anderson Lizardo) [Orabug: 17061694]  
  - fnic driver update from 1.5.0.41 to 1.5.0.45 (Maxim Uvarov) [Orabug: 17187644]  
  - mpt3sas: update from v02.100.00.00 to v3.00.00.00 (Sreekanth Reddy) [Orabug: 17249188]  
  - mpt3sas: enable build of mpt3sas driver (Jerry Snitselaar) [Orabug: 17187698]  
  - mpt3sas: Updated driver code to have a compatibility with UEK r2 u5 kernel (Sreekanth Reddy) [Orabug: 17187698]  
  - mpt3sas: Bump driver version to v02.100.00.00 (Sreekanth Reddy) [Orabug: 17187698]  
  - mpt3sas: when async scanning is enabled then while scanning, devices are removed but their transport layer entries are not removed (Sreekanth Reddy) [Orabug: 17187698]  
  - mpt3sas: MPI2.5 Rev F v2.5.1.1 specification (Sreekanth Reddy) [Orabug: 17187698]  
  - mpt3sas: Infinite loops can occur if MPI2_IOCSTATUS_CONFIG_INVALID_PAGE is not returned (Sreekanth Reddy) [Orabug: 17187698]  
  - mpt3sas: fix for kernel panic when driver loads with HBA conected to non LUN 0 configured expander (Sreekanth Reddy) [Orabug: 17187698]  
  - mpt3sas: Updated the Hardware timing requirements (Sreekanth Reddy) [Orabug: 17187698]  
  - mpt3sas: 2013 source code copyright (Sreekanth Reddy) [Orabug: 17187698]  
  - mpt3sas: don't wank with fasync on ->release() (Al Viro) [Orabug: 17187698]  
  - mpt3sas: remove unused variables (Wei Yongjun) [Orabug: 17187698]  
  - mpt3sas: Remove unneeded version.h header inclusion (Sachin Kamat) [Orabug: 17187698]  
  - mpt3sas: cut and paste bug storing trigger mpi (Dan Carpenter) [Orabug: 17187698]  
  - mpt3sas: add new driver supporting 12GB SAS (Sreekanth Reddy) [Orabug: 17187698]  
  - scsi_transport_sas: add 12GB definitions for mpt3sas (Sreekanth Reddy) [Orabug: 17187698]  
  - miscdevice: Adding support for MPT3SAS_MINOR(222) (Sreekanth Reddy) [Orabug: 17187698]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.207.0.el6uek]
changelog:
  - Update lpfc version for 8.3.7.26.3p driver release (Gairy Grannum) [Orabug: 17340816]  
  - lpfc 8.3.36: Update DIF support for passthru/strip/insert (James Smart) [Orabug: 17340816]  
  - Update lpfc version for 8.3.7.26.1p driver release (Gairy Grannum) [Orabug: 17376967]  
  - lpfc: whitespace fix (Vaios Papadimitriou) [Orabug: 17376967]  
  - Update copyrights for 8.3.41 modifications (James Smart) [Orabug: 17376967]  
  - Add first burst support to driver (James Smart) [Orabug: 17376967]  
  - Fixed the format of some log message fields (James Smart) [Orabug: 17376967]  
  - Add first burst support to driver (James Smart) [Orabug: 17376967]  
  - Fixed not able to perform PCI function reset when board was not in online mode (James Smart) [Orabug: 17376967]  
  - Fixed failure in setting SLI3 board mode (James Smart) [Orabug: 17376967]  
  - Fixed SLI3 failing FCP write on check-condition no-sense with residual zero (James Smart) [Orabug: 17376967]  
  - Fixed support for 128 byte WQEs (James Smart) [Orabug: 17376967]  
  - Ensure driver properly zeros unused fields in SLI4 mailbox commands (James Smart) [Orabug: 17376967]  
  - Fixed max value of lpfc_lun_queue_depth (James Smart) [Orabug: 17376967]  
  - Fixed Receive Queue varied frame size handling (James Smart) [Orabug: 17376967]  
  - Fix mailbox byteswap issue on PPC (James Smart) [Orabug: 17376967]  
  - lpfc 8.3.40: Update Copyrights to 2013 for 8.3.38, 8.3.39, and 8.3.40 modifications (James Smart) [Orabug: 17376967]  
  - Fixed freeing of iocb when internal loopback times out (James Smart) [Orabug: 17376967]  
  - lpfc 8.3.40: Fixed a race condition between SLI host and port failed FCF rediscovery (James Smart) [Orabug: 17376967]  
  - lpfc 8.3.40: Fixed issue mailbox wait routine failed to issue dump memory mbox command (James Smart) [Orabug: 17376967]  
  - treewide: Fix typos in kernel messages (Masanari Iida) [Orabug: 17376967]  
  - lpfc 8.3.40: Fixed system panic due to unsafe walking and deleting linked list (James Smart) [Orabug: 17376967]  
  - lpfc 8.3.40: Fixed FCoE connection list vlan identifier and add FCF list debug (James Smart) [Orabug: 17376967]  
  - lpfc 8.3.40: Clarified the behavior of the lpfc_max_luns module parameter (James Smart) [Orabug: 17376967]  
  - lpfc 8.3.40: Fix to allow OCM to report FEC status (James Smart) [Orabug: 17376967]  
  - lpfc 8.3.40: Fixed a missing return code in a logging message (James Smart) [Orabug: 17376967]  
  - lpfc 8.3.40: Fixed some logging message fields (James Smart) [Orabug: 17376967]  
  - lpfc 8.3.40: Fixed list corruption when lpfc_drain_tx runs (James Smart) [Orabug: 17376967]  
  - lpfc 8.3.40: Fix inconsistent list removal causes crash (James Smart) [Orabug: 17376967]  
  - lpfc 8.3.40: Fixed system panic during handling unsolicited receive buffer error condition (James Smart) [Orabug: 17376967]  
  - lpfc 8.3.40: Fixed crash during FCoE failover testing. (James Smart) [Orabug: 17376967]  
  - lpfc 8.3.40: Fix lpfc_used_cpu to be more dynamic (James Smart) [Orabug: 17376967]  
  - sctp: deal with multiple COOKIE_ECHO chunks (Max Matveev) [Orabug: 17371930] {CVE-2013-2206} 
  - Bluetooth: L2CAP - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17371037] {CVE-2012-6544} 
  - Bluetooth: HCI - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17370887] {CVE-2012-6544} 
  - Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER) (Mathias Krause) [Orabug: 17371061] {CVE-2012-6544} 
  - sctp: Use correct sideffect command in duplicate cookie handling (Vlad Yasevich) [Orabug: 17371114] {CVE-2013-2206} 
  - af_key: initialize satype in key_notify_policy_flush() (Nicolas Dichtel) [Orabug: 17370761] {CVE-2013-2237} 
  - dm: allow error target to replace either bio-based and request-based targets (Joe Jin) [Orabug: 17357884]  
  - Btrfs: handle a bogus chunk tree nicely (Josef Bacik) [Orabug: 17361069]  
  - OFED: Move R2 field to bottom of mlx4_caps for backward compatibility (Yuval Shaia) [Orabug: 17303785]  
  - RDS: double free rdma_cm_id (Bang Nguyen) [Orabug: 17192816]  
  - xen: initialize xen panic handler for PVHVM (Vaughan Cao) [Orabug: 17200031]  
  - sg: push file descriptor list locking down to per-device locking (Vaughan Cao) [Orabug: 16835013]  
  - sg: checking sdp->detached isn't protected when open (Vaughan Cao) [Orabug: 16835013]  
  - sg: no need sg_open_exclusive_lock (Vaughan Cao) [Orabug: 16835013]  
  - sg: use rwsem to solve race during exclusive open (Vaughan Cao) [Orabug: 16835013]  
  - sg: remove sg_mutex (Jörn Engel) [Orabug: 16835013]  
  - sg: completely protect sfds (Jörn Engel) [Orabug: 16835013]  
  - sg: protect sdp->exclude (Jörn Engel) [Orabug: 16835013]  
  - sg: prevent unwoken sleep (Jörn Engel) [Orabug: 16835013]  
  - sg: remove closed flag (Jörn Engel) [Orabug: 16835013]  
  - sg: use wait_event_interruptible() (Jörn Engel) [Orabug: 16835013]  
  - sg: remove while (1) non-loop (Jörn Engel) [Orabug: 16835013]  
  - sg: remove unnecessary indentation (Jörn Engel) [Orabug: 16835013]  
  - RDS: ActiveBonding IP exclusion filter (Bang Nguyen) [Orabug: 17075950]  
  - RDS: Reconnect stalls for 15s (Bang Nguyen) [Orabug: 17277974]  
  - sk_buff: fix kabi broken for add new for union (Joe Jin) [Orabug: 14500568]  
  - tcp: fix skb_availroom() (Eric Dumazet) [Orabug: 14500568]  
  - tcp: avoid order-1 allocations on wifi and tx path (Eric Dumazet) [Orabug: 14500568]  
  - tcp: Reallocate headroom if it would overflow csum_start (Thomas Graf) [Orabug: 14500568]  
  - tcp: take care of misalignments (Eric Dumazet) [Orabug: 14500568]  
  - RDS: Reconnect causes panic at completion phase (Bang Nguyen) [Orabug: 17213597]  
  - RDS: added stats to track and display receive side memory usage (Venkat Venkatsubra) [Orabug: 17045536]  
  - RDS: RDS reconnect stalls (Bang Nguyen) [Orabug: 1731355]  
  - ext4: fix race between sync and completed io work (Jeff Moyer) [Orabug: 16908825]  
  - ext4: optimize locking for end_io extent conversion (Theodore Ts'o) [Orabug: 16908825]  
  - ext4: remove unnecessary call to waitqueue_active() (Theodore Ts'o) [Orabug: 16908825]  
  - ext4: Use correct locking for ext4_end_io_nolock() (Tao Ma) [Orabug: 16908825]  
  - xen/pci: Track PVHVM PIRQs. (Zhenzhong Duan) [Orabug: 16908825]  
  - ocfs2_prep_new_orphaned_file return ret (Xiaowei.Hu) [Orabug: 16823825]  
  - Revert "Btrfs: remove ->dirty_inode" (Guangyu Sun) [Orabug: 16841843]  
  - bonding: emit event when bonding changes MAC (Weiping Pan) [Orabug: 16750157]  
  - net: fix incorrect credentials passing (Linus Torvalds) [Orabug: 16836975] {CVE-2013-1979} 
  - tg3: fix length overflow in VPD firmware parsing (Kees Cook) [Orabug: 16836958] {CVE-2013-1929} 
  - USB: cdc-wdm: fix buffer overflow (Oliver Neukum) [Orabug: 16836943] {CVE-2013-1860} 
  - ext3: Fix format string issues (Lars-Peter Clausen) [Orabug: 16836934] {CVE-2013-1848} 
  - cnic: don't use weak dependencies for ipv6 (Jerry Snitselaar) [Orabug: 16780307]  
  - Revert "drm/i915: correctly order the ring init sequence" (Guangyu Sun) [Orabug: 16486689]  
  - x86/boot-image: Don't leak phdrs in arch/x86/boot/compressed/misc.c::Parse_elf() (Jesper Juhl) [Orabug: 16833437]  
  - spec: add /boot/vmlinuz*.hmac needed for fips mode (John Haxby) [Orabug: 16807114]  
  - perf: Treat attr.config as u64 in perf_swevent_init() (Tommi Rantala) [Orabug: 16808734] {CVE-2013-2094} 
  - spec: ol6 add multipath version deps (Maxim Uvarov) [Orabug: 16763586]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.208.1.el6uek]
changelog:
  - Btrfs: make the chunk allocator completely tree lockless (Josef Bacik) [Orabug: 17334251]  
  - mpt2sas: protect mpt2sas_ioc_list access with lock (Jerry Snitselaar) [Orabug: 17383579]  
  - mptsas: update to 4.28.20.02 (Jerry Snitselaar) [Orabug: 17294806]  
  - RDS: protocol negotiation fails during reconnect (Bang Nguyen) [Orabug: 17375389]  
  - config:remove LM80 modules to void blindly loading cause crash (ethan.zhao) [Orabug: 16976462]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.209.1.el6uek]
changelog:
  - Revert "stop mig handler when lockres in progress ,and return -EAGAIN" (Srinivas Eeda) [Orabug: 16924802]  
  - ocfs2/dlm: Fix list traversal in dlm_process_recovery_data (Srinivas Eeda) [Orabug: 17432400]  
  - ocfs2/dlm: ocfs2 dlm umount skip migrating lockres (Srinivas Eeda) [Orabug: 16859627]


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-400.18.1.el6uek]
changelog:
  - SPEC: fix doc build (Guru Anbalagane)
  - floppy: Fix a crash during rmmod (Vivek Goyal) [Orabug: 16040504]
  - x86: ignore changes to paravirt_lazy_mode while in an interrupt context
    (Chuck Anderson) [Orabug: 16417326]
  - x86/msr: Add capabilities check (Alan Cox) [Orabug: 16405007] {CVE-2013-0268}
  - spec: unique debuginfo (Maxim Uvarov) [Orabug: 16245366]
  - xfs: Use preallocation for inodes with extsz hints (Dave Chinner) [Orabug:
    16307993]
  - Add SIOCRDSGETTOS to get the current TOS for the socket (bang.nguyen)
    [Orabug: 16397197]
  - Changes to connect/TOS interface (bang.nguyen) [Orabug: 16397197]
  - floppy: Cleanup disk->queue before caling put_disk() if add_disk() was never
    called (Vivek Goyal) [Orabug: 16040504]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.19.1.el6uek]
changelog:
  - IB/core: Allow device-specific per-port sysfs files (Ralph Campbell)
  - RDMA/cma: Pass QP type into rdma_create_id() (Sean Hefty)
  - IB: Rename RAW_ETY to RAW_ETHERTYPE (Aleksey Senin)
  - IB: Warning Resolution. (Ajaykumar Hotchandani)
  - mlx4_core: fix FMR flags in free MTT range (Saeed Mahameed)
  - mlx4_core/ib: sriov fmr bug fixes (Saeed Mahameed)
  - mlx4_core: Change bitmap allocator to work in round-robin fashion (Saeed
    Mahameed)
  - mlx4_vnic: move host admin vnics to closed state when closing the vnic.
    (Saeed Mahameed)
  - mlx4_ib: make sure to flush clean_wq while closing sriov device (Saeed
    Mahameed)
  - ib_sdp: fix deadlock when sdp_cma_handler is called while socket is being
    closed (Saeed Mahameed)
  - ib_sdp: add unhandled events to rdma_cm_event_str (Saeed Mahameed)
  - mlx4_core: use dev->sriov instead of hardcoed 127 vfs when initializing FMR
    MPT tables (Saeed Mahameed)
  - mlx4_vnic: print vnic keep alive info in mlx4_vnic_info (Saeed Mahameed)
  - rds: Congestion flag does not get cleared causing the connection to hang
    (Bang Nguyen) [Orabug: 16424692]
  - dm table: set flush capability based on underlying devices (Mike Snitzer)
    [Orabug: 16392584]
  - wake_up_process() should be never used to wakeup a TASK_STOPPED/TRACED task
    (Oleg Nesterov) [Orabug: 16405869] {CVE-2013-0871}
  - ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL (Oleg
    Nesterov) [Orabug: 16405869] {CVE-2013-0871}
  - ptrace: introduce signal_wake_up_state() and ptrace_signal_wake_up() (Oleg
    Nesterov) [Orabug: 16405869] {CVE-2013-0871}
  - drm/i915: bounds check execbuffer relocation count (Kees Cook) [Orabug:
    16482650] {CVE-2013-0913}
  - NLS: improve UTF8 -> UTF16 string conversion routine (Alan Stern) [Orabug:
    16425571] {CVE-2013-1773}
  - ipmi: make kcs timeout parameters as module options (Pavel Bures) [Orabug:
    16470881]
  - drm/i915/lvds: ditch ->prepare special case (Daniel Vetter) [Orabug:
    14394113]
  - drm/i915: Leave LVDS registers unlocked (Keith Packard) [Orabug: 14394113]
  - drm/i915: don't clobber the pipe param in sanitize_modesetting (Daniel
    Vetter) [Orabug: 14394113]
  - drm/i915: Sanitize BIOS debugging bits from PIPECONF (Chris Wilson) [Orabug:
    14394113]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.20.1.el6uek]
changelog:
  - SPEC: v2.6.39-400.20.1 (Maxim Uvarov) 
  - PCI: Set device power state to PCI_D0 for device without native PM support (Ajaykumar Hotchandani) [Orabug: 16482495] 
  - sched: Fix cgroup movement of waking process (Daisuke Nishimura) [Orabug: 13740515] 
  - sched: Fix cgroup movement of newly created process (Daisuke Nishimura) [Orabug: 13740515] 
  - sched: Fix cgroup movement of forking process (Daisuke Nishimura) [Orabug: 13740515]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.21.1.el6uek]
changelog:
  - SPEC: v2.6.39-400.21.1 (Maxim Uvarov) 
  - xen/mmu: On early bootup, flush the TLB when changing RO->RW bits Xen provided pagetables. (Konrad Rzeszutek Wilk)


author: Andy Honig <ahonig@google.com> [2.6.39-400.21.2.el6uek]
changelog:
  - KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797) (Andy Honig) [Orabug: 16711660] {CVE-2013-1797} 
  - Bluetooth: Fix incorrect strncpy() in hidp_setup_hid() (Anderson Lizardo) [Orabug: 16711065] {CVE-2013-0349} 
  - USB: io_ti: Fix NULL dereference in chase_port() (Wolfgang Frisch) [Orabug: 16425358] {CVE-2013-1774} 
  - keys: fix race with concurrent install_user_keyrings() (David Howells) [Orabug: 16493354] {CVE-2013-1792} 
  - KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798) (Andy Honig) [Orabug: 16710951] {CVE-2013-1798} 
  - KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796) (Andy Honig) [Orabug: 16710806] {CVE-2013-1796} 
  - tmpfs: fix use-after-free of mempolicy object (Greg Thelen) [Orabug: 16515833] {CVE-2013-1767}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.210.1.el6uek]
changelog:
  - kdump: fix crash_kexec()/smp_send_stop() race in panic() (Michael Holzheu) [Orabug: 17547893]  
  - Audit: do not print error when LSMs disabled (Eric Paris) [Orabug: 17537775]  
  - bonding: If IP route look-up to send an ARP fails, mark in bonding structure as no ARP sent. (Rama Nichanamatlu) [Orabug: 17172660]  
  - dm: fix deadlock with request based dm and queue request_fn recursion (Jens Axboe) [Orabug: 17485617]  
  - ACPI: introduce "acpi_rsdp=" parameter for kdump (Takao Indoh) [Orabug: 17486995]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.211.1.el6uek]
changelog:
  - xen/smp: initialize IPI vectors before marking CPU online (Chuck Anderson) [Orabug: 13823853]  
  - ACPI: Add ACPI CPU hot-remove support (Toshi Kani) [Orabug: 13823853]  
  - ACPI / processor: prevent cpu from becoming online (Yasuaki Ishimatsu) [Orabug: 13823853]  
  - ACPI: Add _OST support for sysfs eject (Toshi Kani) [Orabug: 13823853]  
  - ACPI: Add _OST support for ACPI CPU hotplug (Toshi Kani) [Orabug: 13823853]  
  - ACPI: Add an interface to evaluate _OST (Toshi Kani) [Orabug: 13823853]  
  - ACPI: Add CPU hotplug support for processor device objects (Toshi Kani) [Orabug: 13823853]  
  - ACPI processor hotplug: Split up acpi_processor_add (Thomas Renninger) [Orabug: 13823853]  
  - ACPI processor: Remove unneeded variable passed by acpi_processor_hotadd_init V2 (Thomas Renninger) [Orabug: 13823853]  
  - cpu: make sure that cpu/online file created before KOBJ_ADD is emitted (Chuck Anderson) [Orabug: 13823853]  
  - cpu: fix "crash_notes" and "crash_notes_size" leaks in register_cpu() (Chuck Anderson) [Orabug: 13823853]  
  - sysfs: fix crash_notes_size build warning (Chuck Anderson) [Orabug: 13823853]  
  - sysfs: Add crash_notes_size to export percpu note size (Chuck Anderson) [Orabug: 13823853]  
  - PCI: Init NumVFs register to zero in sriov_init() (ethan.zhao) [Orabug: 17633658]  
  - PCI: Update NumVFs register when disabling SR-IOV (Yijing Wang) [Orabug: 17633658]  
  - xen/balloon: Set balloon's initial state to number of existing RAM pages (Boris Ostrovsky) [Orabug: 17782369]  
  - iser: turn off 'relaxed' option in iser fmr pool. (Shamir Rabinovitch) [Orabug: 17417401]  
  - OVN: fixing the modinfo parameters for OVN drivers (Ankit Darsi) [Orabug: 17442668]  
  - mlx4_core: Enable link auto sense (Yuval Shaia) [Orabug: 17080422]  
  - sched: Fix migration thread runtime bogosity (Zhenzhong Duan) [Orabug: 13740528]  
  - core/xen: Use _PAGE_IOMAP when mmaping PCI BARs. (Konrad Rzeszutek Wilk) [Orabug: 16816236]  
  - be2net: cancel be_worker during EEH recovery (Ravikumar Nelavelli) [Orabug: 17709198]  
  - be2net: pass if_id for v1 and V2 versions of TX_CREATE cmd (asundhara Volam) [Orabug: 17649434]  
  - ext4: remove messy logic from ext4_ext_rm_leaf (Dmitry Monakhov) [Orabug: 17509183]  
  - scsi: kill outstanding requests (Dave Kleikamp) [Orabug: 17550129]  
  - scsi: check for null sdev in scsi_prep_fn (Dave Kleikamp) [Orabug: 17416969]  
  - Revert "scsi_prep_fn() check for empty queue" (Jerry Snitselaar) [Orabug: 17416969]  
  - block: add timeout to io_schedule in get_request_wait (Dave Kleikamp) [Orabug: 17672130]  
  - Revert "put stricter guards on queue dead checks" (Dave Kleikamp) [Orabug: 17416969]  
  - Revert "Fix device removal NULL pointer dereference" (Dave Kleikamp) [Orabug: 17416969]  
  - scsi: enclosure: remove old device when add new (Joe Jin) [Orabug: 17672104]  
  - vfs: d_obtain_alias() needs to use "/" as default name. (NeilBrown) [Orabug: 17446562]  
  - RDMA CM: Add reason code for IB_CM_REJ_CONSUMER_DEFINED (Bang Nguyen) [Orabug: 17484682]  
  - dm snapshot: fix data corruption (Mikulas Patocka) [Orabug: 17618492] {CVE-2013-4299}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.211.2.el6uek]
changelog:
  - fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing error check (Kees Cook) [Orabug: 17842208] {CVE-2013-1928} 
  - Bluetooth: RFCOMM - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17842129] {CVE-2012-6545} 
  - Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST) (Mathias Krause) [Orabug: 17842105] {CVE-2012-6545} 
  - llc: Fix missing msg_namelen update in llc_ui_recvmsg() (Mathias Krause) [Orabug: 17842095] {CVE-2013-3231} 
  - HID: pantherlord: validate output report details (Kees Cook) [Orabug: 17842084] {CVE-2013-2892} 
  - HID: zeroplus: validate output report details (Kees Cook) [Orabug: 17842081] {CVE-2013-2889} 
  - HID: provide a helper for validating hid reports (Kees Cook) [Orabug: 17842081] {CVE-2013-2889} 
  - KVM: Fix iommu map/unmap to handle memory slot moves (Jerry Snitselaar) [Orabug: 17842075] {CVE-2013-4592} 
  - ansi_cprng: Fix off by one error in non-block size request (Jerry Snitselaar) [Orabug: 17842072] {CVE-2013-4345} 
  - HID: validate HID report id size (Kees Cook) [Orabug: 17842063] {CVE-2013-2888} 
  - ipv6: remove max_addresses check from ipv6_create_tempaddr (Hannes Frederic Sowa) [Orabug: 17842056] {CVE-2013-0343} 
  - ipv6: udp packets following an UFO enqueued packet need also be handled by UFO (Hannes Frederic Sowa) [Orabug: 17842050] {CVE-2013-4387}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.211.3.el6uek]
changelog:
  - ip6_output: do skb ufo init for peeked non ufo skb as well (Jiri Pirko) [Orabug: 17951806] {CVE-2013-4470} 
  - ip_output: do skb ufo init for peeked non ufo skb as well (Jiri Pirko) [Orabug: 17951818] {CVE-2013-4470} 
  - KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) (Andy Honig) [Orabug: 17951705] {CVE-2013-6367}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.212.1.el6uek]
changelog:
  - cpuidle: add checks to avoid NULL pointer dereference (Srivatsa S. Bhat) [Orabug: 17936264]  
  - acpi: only call acpi_processor_power_init() if cpuidle_driver is acpi_idle_driver (Jerry Snitselaar) [Orabug: 17936264]  
  - ip6_output: do skb ufo init for peeked non ufo skb as well (Jiri Pirko) [Orabug: 17951806] {CVE-2013-4470} 
  - ip_output: do skb ufo init for peeked non ufo skb as well (Jiri Pirko) [Orabug: 17951818] {CVE-2013-4470} 
  - KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) (Andy Honig) [Orabug: 17951705] {CVE-2013-6367} 
  - fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing error check (Kees Cook) [Orabug: 17842208] {CVE-2013-1928} 
  - Bluetooth: RFCOMM - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17842129] {CVE-2012-6545} 
  - Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST) (Mathias Krause) [Orabug: 17842105] {CVE-2012-6545} 
  - llc: Fix missing msg_namelen update in llc_ui_recvmsg() (Mathias Krause) [Orabug: 17842095] {CVE-2013-3231} 
  - HID: pantherlord: validate output report details (Kees Cook) [Orabug: 17842084] {CVE-2013-2892} 
  - HID: zeroplus: validate output report details (Kees Cook) [Orabug: 17842081] {CVE-2013-2889} 
  - HID: provide a helper for validating hid reports (Kees Cook) [Orabug: 17842081] {CVE-2013-2889} 
  - KVM: Fix iommu map/unmap to handle memory slot moves (Jerry Snitselaar) [Orabug: 17842075] {CVE-2013-4592} 
  - ansi_cprng: Fix off by one error in non-block size request (Jerry Snitselaar) [Orabug: 17842072] {CVE-2013-4345} 
  - HID: validate HID report id size (Kees Cook) [Orabug: 17842063] {CVE-2013-2888} 
  - ipv6: remove max_addresses check from ipv6_create_tempaddr (Hannes Frederic Sowa) [Orabug: 17842056] {CVE-2013-0343} 
  - ipv6: udp packets following an UFO enqueued packet need also be handled by UFO (Hannes Frederic Sowa) [Orabug: 17842050] {CVE-2013-4387}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.213.1.el6uek]
changelog:
  - xen-blkback: fix shutdown race (Roger Pau Monne) [Orabug: 18155530]  
  - xen-blkback: fix memory leaks (Roger Pau Monne) [Orabug: 18155530]  
  - xen-blkback: fix memory leak when persistent grants are used (Matt Rushton) [Orabug: 18155530]  
  - bonding: add some slack to arp monitoring time limits (Jiri Bohac) [Orabug: 18146570]  
  - sxge: add support for ovm auto-migration for 15 vms (Joyce Yu) [Orabug: 17478097]  
  - ocfs2: fix i_mutex deadlock between aio_write and sync_file (Darrick J. Wong) [Orabug: 18154507]  
  - ext4: Fix non-O_SYNC AIO DIO unwritten extent conversion after dio finishes (Joe Jin) [Orabug: 17649647]  
  - fix kabi breakage (Joe Jin) [Orabug: 17649647]  
  - direct-io: Handle O_(D)SYNC AIO (Joe Jin) [Orabug: 17649647]  
  - direct-io: Implement generic deferred AIO completions (Joe Jin) [Orabug: 17649647]  
  - xen: avoid deadlock between nfs and netback (Zheng Li) [Orabug: 17896838]  
  - blk-core: Fix memory corruption if blkcg_init_queue fails (Mikulas Patocka) [Orabug: 17931526]  
  - USB: EHCI: bugfix: urb->hcpriv should not be NULL (Alan Stern) [Orabug: 17865213]  
  - SUNRPC: Fix a data corruption issue when retransmitting RPC calls (Trond Myklebust) [Orabug: 17822698]  
  - rcu: Do not trigger false positive RCU stall detection (Dan Duval) [Orabug: 17557300]  
  - 8250: fix autoconfig to work with serial console (Flavio Leitner) [Orabug: 17511050]  
  - srp: disable fmr-pool cache to fix cpu lock-up. (Shamir Rabinovitch) [Orabug: 17445482]  
  - igb: set RSS default value to 0 for performance tuning (Ethan Zhao) [Orabug: 174395040]  
  - ocfs2: make 'buffered' as the default coherency option (Wengang Wang) [Orabug: 17231652]  
  - PCI: try to assign required+option size first (Yinghai Lu) [Orabug: 16973564]  
  - PCI: fix truncation of resource size to 32 bits (Nikhil P Rao) [Orabug: 16973564]  
  - ocfs2: ocfs2 punch hole retrun EINVAL if the length argument in ioctl is negative (Tariq Saeed) [Orabug: 17982871]  
  - ocfs2: update inode size after zeroed the hole (Junxiao Bi) [Orabug: 16134411]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.214.2.el6uek]
changelog:
  - inet: prevent leakage of uninitialized memory to user in recv syscalls (Hannes Frederic Sowa)  [18238382]  {CVE-2013-7263} {CVE-2013-7265} 
  - exec/ptrace: fix get_dumpable() incorrect tests (Kees Cook)  [18238353]  {CVE-2013-2929}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.214.3.el6uek]
changelog:
  - inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions (Hannes Frederic Sowa)  [18247289]  {CVE-2013-7263} {CVE-2013-7265}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.214.4.el6uek]
changelog:
  - netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages (Daniel Borkmann)  [Orabug: 18462070]  {CVE-2014-2523} 
  - net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable (Daniel Borkmann)  [Orabug: 18461090]  {CVE-2014-0101} 
  - vhost-net: insufficient handling of error conditions in get_rx_bufs() (Guangyu Sun)  [Orabug: 18461089]  {CVE-2014-0055}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.214.5.el6uek]
changelog:
  - net: ipv4: current group_info should be put after using. (Wang, Xiaoming)  [Orabug: 18603524]  {CVE-2014-2851}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.214.6.el6uek]
changelog:
  - aacraid: missing capable() check in compat ioctl (Dan Carpenter)  [Orabug: 18721962]  {CVE-2013-6383} 
  - vhost: fix total length when packets are too short (Michael S. Tsirkin)  [Orabug: 18721977]  {CVE-2014-0077}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.215.1.el6uek]
changelog:
  - mlx4_en: enable B0 Steering (Yuval Shaia)  [Orabug: 17960125]  
  - PCI: Drop "irq" param from *_restore_msi_irqs() (Zhenzhong Duan)  [Orabug: 18355766]  
  - PCI: Add x86_msi.msi_mask_irq() and msix_mask_irq() (Konrad Rzeszutek Wilk)  [Orabug: 18355756]  
  - ocfs2: revert to up_read on i_alloc_sem (Wengang Wang)   
  - RDS: bind hash table size increase, add per-bucket rw lock (Bang Nguyen)  [Orabug: 18071861]  
  - scsi_scan: Continue scan for LUNs in 'unavailable' ALUA state (Hannes Reinecke)  [Orabug: 18303338]  
  - sxge: update support for auto-migration of 15 VMs (Joyce Yu)  [Orabug: 18226689]  
  - Revert "sg: use rwsem to solve race during exclusive open" (Jerry Snitselaar)  [Orabug: 17712056]  
  - Revert "sg: no need sg_open_exclusive_lock" (Jerry Snitselaar)  [Orabug: 17712056]  
  - Revert "sg: checking sdp->detached isn't protected when open" (Jerry Snitselaar)  [Orabug: 17712056]  
  - Revert "sg: push file descriptor list locking down to per-device locking" (Jerry Snitselaar)  [Orabug: 17712056]  
  - aacraid: missing capable() check in compat ioctl (Dan Carpenter)  [Orabug: 18721962]  {CVE-2013-6383} 
  - vhost: fix total length when packets are too short (Michael S. Tsirkin)  [Orabug: 18721977]  {CVE-2014-0077} 
  - net: ipv4: current group_info should be put after using. (Wang, Xiaoming)  [Orabug: 18603524]  {CVE-2014-2851} 
  - netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages (Daniel Borkmann)  [Orabug: 18462070]  {CVE-2014-2523} 
  - net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable (Daniel Borkmann)  [Orabug: 18461090]  {CVE-2014-0101} 
  - vhost-net: insufficient handling of error conditions in get_rx_bufs() (Guangyu Sun)  [Orabug: 18461089]  {CVE-2014-0055} 
  - inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions (Hannes Frederic Sowa)  [Orabug: 18247289]  {CVE-2013-7263} {CVE-2013-7265} 
  - inet: prevent leakage of uninitialized memory to user in recv syscalls (Hannes Frederic Sowa)  [Orabug: 18238382]  {CVE-2013-7263} {CVE-2013-7265} 
  - exec/ptrace: fix get_dumpable() incorrect tests (Kees Cook)  [Orabug: 18238353]  {CVE-2013-2929}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.215.2.el6uek]
changelog:
  - futex: Make lookup_pi_state more robust (Thomas Gleixner)  [Orabug: 18918614]  {CVE-2014-3153} 
  - futex: Always cleanup owner tid in unlock_pi (Thomas Gleixner)  [Orabug: 18918614]  {CVE-2014-3153} 
  - futex: Validate atomic acquisition in futex_lock_pi_atomic() (Thomas Gleixner)  [Orabug: 18918614]  {CVE-2014-3153} 
  - futex: Forbid uaddr1 == uaddr2 in futex_requeue(..., requeue_pi=1) (Thomas Gleixner)  [Orabug: 18918614]  {CVE-2014-3153} {CVE-2014-3153}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.215.3.el6uek]
changelog:
  - SELinux: Fix kernel BUG on empty security contexts. (Stephen Smalley)  [Orabug: 19028380]  {CVE-2014-1874} 
  - floppy: don't write kernel-only members to FDRAWCMD ioctl output (Matthew Daley)  [Orabug: 19028444]  {CVE-2014-1738} 
  - floppy: ignore kernel-only members in FDRAWCMD ioctl input (Matthew Daley)  [Orabug: 19028438]  {CVE-2014-1737} 
  - libertas: potential oops in debugfs (Dan Carpenter)  [Orabug: 19028416]  {CVE-2013-6378}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.215.4.el6uek]
changelog:
  - l2tp: fix an unprivileged user to kernel privilege escalation (Sasha Levin)  [Orabug: 19229505]  {CVE-2014-4943} {CVE-2014-4943} 
  - ptrace,x86: force IRET path after a ptrace_stop() (Tejun Heo)  [Orabug: 19230690]  {CVE-2014-4699}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.215.5.el6uek]
changelog:
  - n_tty: Fix n_tty_write crash when echoing in raw mode (Peter Hurley)  [Orabug: 18756449]  {CVE-2014-0196} {CVE-2014-0196}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.215.6.el6uek]
changelog:
  - filter: prevent nla extensions to peek beyond the end of the message (Mathias Krause)  [Orabug: 19315782]  {CVE-2014-3144} {CVE-2014-3145}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.215.8.el6uek]
changelog:
  - ib_ipoib: CSUM support in connected mode (Yuval Shaia)  [Orabug: 18692878]  
  - net: Reduce high cpu usage in bonding driver by do_csum (Venkat Venkatsubra)  [Orabug: 18141731]  
  - [random] Partially revert 6d7c7e49: random: make 'add_interrupt_randomness() (John Sobecki)  [Orabug: 17740293]  
  - oracleasm: claim FMODE_EXCL access on disk during asm_open (Srinivas Eeda)  [Orabug: 19453460]  
  - notify block layer when using temporary change to cache_type (Vaughan Cao)  [Orabug: 19448451]  
  - sd: Fix parsing of 'temporary ' cache mode prefix (Ben Hutchings)  [Orabug: 19448451]  
  - sd: fix array cache flushing bug causing performance problems (James Bottomley)  [Orabug: 19448451]  
  - block: fix max discard sectors limit (James Bottomley)  [Orabug: 18961244]  
  - xen-netback: fix deadlock in high memory pressure (Junxiao Bi)  [Orabug: 18959416]  
  - sdp: fix keepalive functionality (shamir rabinovitch)  [Orabug: 18728784]  
  - SELinux: Fix possible NULL pointer dereference in selinux_inode_permission() (Steven Rostedt)  [Orabug: 18552029]  
  - refcount: take rw_lock in ocfs2_reflink (Wengang Wang)  [Orabug: 18406219]  
  - ipv6: check return value for dst_alloc (Madalin Bucur)  [Orabug: 17865160]  
  - cciss: bug fix to prevent cciss from loading in kdump crash kernel (Mike Miller)  [Orabug: 17740446]  
  - configfs: fix race between dentry put and lookup (Junxiao Bi)  [Orabug: 17627075]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.215.9.el6uek]
changelog:
  - oracleasm: Add support for new error return codes from block/SCSI (Martin K. Petersen)  [Orabug: 18438934]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.215.10.el6uek]
changelog:
  - auditsc: audit_krule mask accesses need bounds checking (Andy Lutomirski)  [Orabug: 19590597]  {CVE-2014-3917}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.215.11.el6uek]
changelog:
  - ALSA: control: Don't access controls outside of protected regions (Lars-Peter Clausen)  [Orabug: 19817786]  {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655} 
  - ALSA: control: Fix replacing user controls (Lars-Peter Clausen)  [Orabug: 19817748]  {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655} 
  - kvm: iommu: fix the third parameter of kvm_iommu_put_pages (CVE-2014-3601) (Michael S. Tsirkin)  [Orabug: 19817647]  {CVE-2014-3601} 
  - mm: try_to_unmap_cluster() should lock_page() before mlocking (Vlastimil Babka)  [Orabug: 19817323]  {CVE-2014-3122} 
  - vm: convert fb_mmap to vm_iomap_memory() helper (Linus Torvalds)  [Orabug: 19816563]  {CVE-2013-2596} 
  - vm: add vm_iomap_memory() helper function (Linus Torvalds)  [Orabug: 19816563]  {CVE-2013-2596} 
  - net: sctp: inherit auth_capable on INIT collisions (Daniel Borkmann)  [Orabug: 19816068]  {CVE-2014-5077}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.215.12.el6uek]
changelog:
  - USB: whiteheat: Added bounds checking for bulk command response (James Forshaw)  [Orabug: 19849335]  {CVE-2014-3185} 
  - HID: fix a couple of off-by-ones (Jiri Kosina)  [Orabug: 19849318]  {CVE-2014-3181} 
  - KVM: x86: Improve thread safety in pit (Andy Honig)  [Orabug: 19905687]  {CVE-2014-3611}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.215.13.el6uek]
changelog:
  - net: sctp: fix panic on duplicate ASCONF chunks (Daniel Borkmann)  [Orabug: 20010591]  {CVE-2014-3687} 
  - net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks (Daniel Borkmann)  [Orabug: 20010578]  {CVE-2014-3673}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.215.14.el6uek]
changelog:
  - HID: magicmouse: sanity check report size in raw_event() callback (Jiri Kosina)  [Orabug: 19849355]  {CVE-2014-3181} 
  - ALSA: control: Protect user controls against concurrent access (Lars-Peter Clausen)  [Orabug: 20192542]  {CVE-2014-4652} 
  - target/rd: Refactor rd_build_device_space + rd_release_device_space (Nicholas Bellinger)  [Orabug: 20192517]  {CVE-2014-4027} 
  - media-device: fix infoleak in ioctl media_enum_entities() (Salva Peiró)  [Orabug: 20192501]  {CVE-2014-1739} {CVE-2014-1739} 
  - udf: Avoid infinite loop when processing indirect ICBs (Jan Kara)  [Orabug: 20192449]  {CVE-2014-6410} 
  - ALSA: control: Make sure that id->index does not overflow (Lars-Peter Clausen)  [Orabug: 20192418]  {CVE-2014-4656} 
  - ALSA: control: Handle numid overflow (Lars-Peter Clausen)  [Orabug: 20192376]  {CVE-2014-465} 
  - HID: picolcd: sanity check report size in raw_event() callback (Jiri Kosina)  [Orabug: 20192205]  {CVE-2014-3186} 
  - net: sctp: fix remote memory pressure from excessive queueing (Daniel Borkmann)  [Orabug: 20192059]  {CVE-2014-3688}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.215.15.el6uek]
changelog:
  - isofs: Fix unbounded recursion when processing relocated directories (Jan Kara)  [Orabug: 20224060]  {CVE-2014-5471} {CVE-2014-5472} 
  - x86_64, traps: Stop using IST for #SS (Andy Lutomirski)  [Orabug: 20224028]  {CVE-2014-9090} {CVE-2014-9322}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.22.1.el6uek]
changelog:
  - block: default SCSI command filter does not accomodate commands overlap across device classes (Jamie Iles) [Orabug: 16387137] {CVE-2012-4542} 
  - Merge tag 'v2.6.39-400.21.1#bug16684527' of git://ca-git.us.oracle.com/linux-joejin-public into uek-2.6.39-400_errata (Maxim Uvarov) [Orabug: 16684527] 
  - KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797) (Andy Honig) [Orabug: 16711660] {CVE-2013-1797} 
  - Bluetooth: Fix incorrect strncpy() in hidp_setup_hid() (Anderson Lizardo) [Orabug: 16711065] {CVE-2013-0349} 
  - USB: io_ti: Fix NULL dereference in chase_port() (Wolfgang Frisch) [Orabug: 16425358] {CVE-2013-1774} 
  - keys: fix race with concurrent install_user_keyrings() (David Howells) [Orabug: 16493354] {CVE-2013-1792} 
  - KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798) (Andy Honig) [Orabug: 16710951] {CVE-2013-1798} 
  - KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796) (Andy Honig) [Orabug: 16710806] {CVE-2013-1796} 
  - tmpfs: fix use-after-free of mempolicy object (Greg Thelen) [Orabug: 16515833] {CVE-2013-1767} 
  - procfs: do not confuse jiffies with cputime64_t (Andreas Schwab) [Orabug: 16673925] 
  - procfs: do not overflow get_{idle,iowait}_time for nohz (Michal Hocko) [Orabug: 16673925] 
  - xen/evtchn: Handle VIRQ_TIMER before any other hardirq in event loop. (Keir Fraser) [Orabug: 16093126] 
  - Fix device removal NULL pointer dereference (Joe Jin) [Orabug: 16684527] 
  - put stricter guards on queue dead checks (James Bottomley) [Orabug: 16684527]


author: Zhenzhong Duan <zhenzhong.duan@oracle.com> [2.6.39-400.23.1.el6uek]
changelog:
  - Parallel mtrr init between cpus (Zhenzhong Duan) [Orabug: 16777774] 
  - Merge tag 'v2.6.39-400.21.1.16748891' of git://ca-git.us.oracle.com/linux-uek-2.6.39-ofed into uek-2.6.39-400 (Maxim Uvarov) [Orabug: 16748891] 
  - xen-blkfront: use a different scatterlist for each request (Roger Pau Monne) 
  - Fix EN driver to work with newer FWs based on latest mlx4_core (Yuval Shaia) [Orabug: 16748891]


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-400.24.1.el6uek]
changelog:
  - perf: Treat attr.config as u64 in perf_swevent_init() (Tommi Rantala) [Orabug: 16808734] {CVE-2013-2094}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.236.0.el6uek]
changelog:
  - Simple fix to update related dst pmtu in routing table (Shirley Ma)  [Orabug: 19592021]  
  - ipv6: ip6_dst_check needs to check for expired dst_entries (Hannes Frederic Sowa)  [Orabug: 19033899]  
  - ipv6: fix race condition regarding dst->expires and dst->from. (YOSHIFUJI Hideaki / 吉藤英明)  [Orabug: 19033909]  
  - ipv6: recursive check rt->dst.from when call rt6_check_expired (Li RongQing)  [Orabug: 19033915]  
  - ipv6: fix problem with expired dst cache (Gao feng)  [Orabug: 19033921]  
  - ipv6: Kill rt6i_dev and rt6i_expires defines. (David S. Miller)  [Orabug: 19592073]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.237.0.el6uek]
changelog:
  - block: nvme: Let iostat show nvme device partitions (Santosh Shilimkar)  [Orabug: 19826058]  
  - reboot: rigrate shutdown/reboot to boot cpu (Robin Holt)  [Orabug: 18386007]  
  - CPU hotplug: provide a generic helper to disable/enable CPU hotplug (Srivatsa S. Bhat)  [Orabug: 18386007]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.239.0.el6uek]
changelog:
  - rds: fix list corruption and tx hang when netfilter is used (shamir rabinovitch)  [Orabug: 18963548]  
  - Revert "ib_cm: reduce latency when destroying large number of ids" (Ajaykumar Hotchandani)  [Orabug: 19959153]  
  - Revert "rds: avoid duplicate connection drops for active bonding" (Ajaykumar Hotchandani)  [Orabug: 19959153]  
  - mlx4_core: change default for mlx4_scale_profile (Chien-Hua Yen)  [Orabug: 19869294]  
  - mlx_core: Change log_num_mtt scaling range (Mukesh Kacker)  [Orabug: 19951718]  
  - mlx4_core: Fix integer overflow issues around MTT table (Yishai Hadas)  [Orabug: 19890202]  
  - mlx4_core: Clean up buddy bitmap allocation (Roland Dreier)  [Orabug: 19810605]  
  - mlx4_core: Allow large mlx4_buddy bitmaps (Yishai Hadas)  [Orabug: 19810605]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.240.0.el6uek]
changelog:
  - net: sctp: fix panic on duplicate ASCONF chunks (Daniel Borkmann)  [Orabug: 20010591]  {CVE-2014-3687} 
  - net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks (Daniel Borkmann)  [Orabug: 20010578]  {CVE-2014-3673} 
  - genhd: fix leftover might_sleep() in blk_free_devt() (Jens Axboe)  [Orabug: 19889185]  
  - xen/pciback: Restore configuration space when detaching from a guest. (Konrad Rzeszutek Wilk)  [Orabug: 19931428]  
  - x86: xen: Sync the CMOS RTC as well as the Xen wallclock (David Vrabel)  [Orabug: 19932271]  
  - x86: xen: Sync the wallclock when the system time is set (David Vrabel)  [Orabug: 19932271]  
  - timekeeping: Indicate that clock was set in the pvclock gtod notifier (David Vrabel)  [Orabug: 19932271]  
  - timekeeping: Pass flags instead of multiple bools to timekeeping_update() (David Vrabel)  [Orabug: 19932271]  
  - time: export time information for KVM pvclock (Marcelo Tosatti)  [Orabug: 19932271]  
  - xen: Remove clock_was_set() call in the resume path (David Vrabel)  [Orabug: 19932271]  
  - hrtimers: Support resuming with two or more CPUs online (but stopped) (David Vrabel)  [Orabug: 19932271]  
  - x86: Fix vrtc_get_time/set_mmss to use new timespec interface (John Stultz)  [Orabug: 19932271]  
  - x86: Increase precision of x86_platform.get/set_wallclock() (David Vrabel)  [Orabug: 19932271]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.241.0.el6uek]
changelog:
  - mpt2sas: setpci panic bug fix (Nagarajkumar Narayanan)  [Orabug: 19849933]  
  - o2dlm: fix NULL pointer dereference in o2dlm_blocking_ast_wrapper (Srinivas Eeda)  [Orabug: 19602075]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.242.0.el6uek]
changelog:
  - This patch only affects the system with Mellanox CX2/3 with SR-IOV enabled. (Chien-Hua Yen)  [Orabug: 19622192]  
  - NVMe: Fix the memory leak with BLKRRPART ioctls (Keith Busch)  [Orabug: 20071659]  
  - Revert "af_unix: Allow credentials to work across user and pid namespaces." (Dan Duval)  [Orabug: 16735268]  
  - Revert "scm: Capture the full credentials of the scm sender." (Dan Duval)  [Orabug: 16735268]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.243.1.el6uek]
changelog:
  - timekeeping: Indicate that clock was set in the pvclock gtod notifier (David Vrabel)  [Orabug: 20019459]  
  - Revert "timekeeping: Indicate that clock was set in the pvclock gtod notifier" (Jason Luan)  [Orabug: 20019459]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.246.1.el6uek]
changelog:
  - sched: Fix possible divide by zero in avg_atom() calculation (Mateusz Guzik)  [Orabug: 20148169]  
  - include/linux/math64.h: add div64_ul() (Alex Shi)   
  - deadlock when two nodes are converting same lock from PR to EX and idletimeout closes conn (Tariq Saeed)  [Orabug: 18639535]  
  - bonding: Bond master should reflect slave's features. (Ashish Samant)  [Orabug: 20231825]  
  - x86, fpu: remove the logic of non-eager fpu mem allocation at the first usage (Annie Li)  [Orabug: 20239143]  
  - x86, fpu: remove cpu_has_xmm check in the fx_finit() (Suresh Siddha)  [Orabug: 20239143]  
  - x86, fpu: make eagerfpu= boot param tri-state (Suresh Siddha)  [Orabug: 20239143]  
  - x86, fpu: enable eagerfpu by default for xsaveopt (Suresh Siddha)  [Orabug: 20239143]  
  - x86, fpu: decouple non-lazy/eager fpu restore from xsave (Suresh Siddha)  [Orabug: 20239143]  
  - x86, fpu: use non-lazy fpu restore for processors supporting xsave (Suresh Siddha)  [Orabug: 20239143]  
  - lguest, x86: handle guest TS bit for lazy/non-lazy fpu host models (Suresh Siddha)  [Orabug: 20239143]  
  - x86, fpu: always use kernel_fpu_begin/end() for in-kernel FPU usage (Suresh Siddha)  [Orabug: 20239143]  
  - x86, kvm: use kernel_fpu_begin/end() in kvm_load/put_guest_fpu() (Suresh Siddha)  [Orabug: 20239143]  
  - x86, fpu: remove unnecessary user_fpu_end() in save_xstate_sig() (Suresh Siddha)  [Orabug: 20239143]  
  - raid5: add AVX optimized RAID5 checksumming (Jim Kukunas)  [Orabug: 20239143]  
  - x86, fpu: drop the fpu state during thread exit (Suresh Siddha)  [Orabug: 20239143]  
  - x32: Add a thread flag for x32 processes (H. Peter Anvin)  [Orabug: 20239143]  
  - x86, fpu: Unify signal handling code paths for x86 and x86_64 kernels (Suresh Siddha)  [Orabug: 20239143]  
  - x86, fpu: Consolidate inline asm routines for saving/restoring fpu state (Suresh Siddha)  [Orabug: 20239143]  
  - x86, signal: Cleanup ifdefs and is_ia32, is_x32 (Suresh Siddha)  [Orabug: 20239143]  
  - i387: Split up <asm/i387.h> into exported and internal interfaces (Linus Torvalds)  [Orabug: 20239143]  
  - i387: Uninline the generic FP helpers that we expose to kernel modules (Linus Torvalds)  [Orabug: 20239143]  
  - i387: use 'restore_fpu_checking()' directly in task switching code (Linus Torvalds)  [Orabug: 20239143]  
  - i387: fix up some fpu_counter confusion (Linus Torvalds)  [Orabug: 20239143]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.246.2.el6uek]
changelog:
  - net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet (Daniel Borkmann)  [Orabug: 20425333]  {CVE-2014-7841}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.247.1.el6uek]
changelog:
  - ib/sdp: fix null dereference of sk->sk_wq in sdp_rx_irq() (Chuck Anderson)  [Orabug: 20070989]  
  - Ensure request structure is not modified after being reused. (Ashish Samant)  [Orabug: 19971490]  
  - ocfs2: quorum: add a log for node not fenced (Junxiao Bi)  [Orabug: 20472045]  
  - ocfs2: o2net: set tcp user timeout to max value (Junxiao Bi)  [Orabug: 20472045]  
  - ocfs2: o2net: don't shutdown connection when idle timeout (Junxiao Bi)  [Orabug: 20472045]  
  - ocfs2: o2dlm: fix a race between purge and master query (Srinivas Eeda)  [Orabug: 20472034]  
  - ocfs2: fix null handle in ocfs2_write_zero_page (Junxiao Bi)  [Orabug: 19632637]  
  - ocfs2: fix deadlock due to wrong locking order (Junxiao Bi)  [Orabug: 19632637]  
  - net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet (Daniel Borkmann)  [Orabug: 20425333]  {CVE-2014-7841}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.248.1.el6uek]
changelog:
  - NVMe: Disable pci before clearing queue (Keith Busch)  [Orabug: 20533100]  
  - x86, fpu: disable eagerfpu by default (Santosh Shilimkar)  [Orabug: 20521543]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.248.2.el6uek]
changelog:
  - netfilter: conntrack: disable generic tracking for known protocols (Florian Westphal)  [Orabug: 20679630]  {CVE-2014-8160} 
  - mac80211: fix fragmentation code, particularly for encryption (Johannes Berg)  [Orabug: 20673313]  {CVE-2014-8709} 
  - mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support (Kirill A. Shutemov)  [Orabug: 20673282]  {CVE-2014-8173} 
  - tracing/syscalls: Ignore numbers outside NR_syscalls' range (Rabin Vincent)  [Orabug: 20673164]  {CVE-2014-7825} {CVE-2014-7826} 
  - tracing/syscalls: Fix perf syscall tracing when syscall_nr == -1 (Will Deacon)  [Orabug: 20673164]  {CVE-2014-7825} {CVE-2014-7826}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.248.3.el6uek]
changelog:
  - kvm: fix excessive pages un-pinning in kvm_iommu_map error path. (Quentin Casasnovas)  [Orabug: 20687314]  {CVE-2014-3601} {CVE-2014-8369} {CVE-2014-3601} 
  - Revert "mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support" (Guangyu Sun)  [Orabug: 20673281]  {CVE-2014-8173}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.249.1.el6uek]
changelog:
  - pci: move reset-notify field to preserve pci_dev size and offsets (Dan Duval)  [Orabug: 20426076]  
  - ocfs2: fix journal commit deadlock (Junxiao Bi)  [Orabug: 19390111]  
  - loop: inherit queue limits from underlying device (Dave Kleikamp)  [Orabug: 19216610]  
  - block: Introduce blk_set_stacking_limits function (Martin K. Petersen)  [Orabug: 19216610]  
  - kvm: fix excessive pages un-pinning in kvm_iommu_map error path. (Quentin Casasnovas)  [Orabug: 20687314]  {CVE-2014-3601} {CVE-2014-8369} {CVE-2014-3601} 
  - Revert "mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support" (Guangyu Sun)  [Orabug: 20673281]  {CVE-2014-8173} 
  - netfilter: conntrack: disable generic tracking for known protocols (Florian Westphal)  [Orabug: 20679630]  {CVE-2014-8160} 
  - mac80211: fix fragmentation code, particularly for encryption (Johannes Berg)  [Orabug: 20673313]  {CVE-2014-8709} 
  - mm: Fix NULL pointer dereference in madvise(MADV_WILLNEED) support (Kirill A. Shutemov)  [Orabug: 20673282]  {CVE-2014-8173} 
  - tracing/syscalls: Ignore numbers outside NR_syscalls' range (Rabin Vincent)  [Orabug: 20673164]  {CVE-2014-7825} {CVE-2014-7826} 
  - tracing/syscalls: Fix perf syscall tracing when syscall_nr == -1 (Will Deacon)  [Orabug: 20673164]  {CVE-2014-7825} {CVE-2014-7826}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.249.2.el6uek]
changelog:
  - xen-pciback: limit guest control of command register (Jan Beulich)  [Orabug: 20704156]  {CVE-2015-2150} {CVE-2015-2150} 
  - net: sctp: fix slab corruption from use after free on INIT collisions (Daniel Borkmann)  [Orabug: 20780348]  {CVE-2015-1421}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.249.3.el6uek]
changelog:
  - IB/core: Prevent integer overflow in ib_umem_get address arithmetic (Shachar Raindel)  [Orabug: 20788393]  {CVE-2014-8159} {CVE-2014-8159}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.249.4.el6uek]
changelog:
  - isofs: Fix unchecked printing of ER records (Jan Kara)  [Orabug: 20930552]  {CVE-2014-9584} 
  - selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID. (Stephen Smalley)  [Orabug: 20930502]  {CVE-2014-3215} 
  - Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs (Andy Lutomirski)  [Orabug: 20930518]  {CVE-2014-3215}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.250.1.el6uek]
changelog:
  - xen/pciback: Don't disable PCI_COMMAND on PCI device reset. (Konrad Rzeszutek Wilk)  [Orabug: 20807440]  {CVE-2015-2150} 
  - xen-blkfront: fix accounting of reqs when migrating (Roger Pau Monne)  [Orabug: 20727114]  
  - Revert "qla2xxx: Ramp down queue depth for attached SCSI devices when driver resources are low." (Chad Dupuis)  [Orabug: 20657415]  
  - x86/xen: allow privcmd hypercalls to be preempted (David Vrabel)  [Orabug: 20618759]  
  - sched: Expose preempt_schedule_irq() (Thomas Gleixner)  [Orabug: 20618759]  
  - isofs: Fix unchecked printing of ER records (Jan Kara)  [Orabug: 20930552]  {CVE-2014-9584} 
  - selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID. (Stephen Smalley)  [Orabug: 20930502]  {CVE-2014-3215} 
  - Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs (Andy Lutomirski)  [Orabug: 20930518]  {CVE-2014-3215} 
  - IB/core: Prevent integer overflow in ib_umem_get address arithmetic (Shachar Raindel)  [Orabug: 20788393]  {CVE-2014-8159} {CVE-2014-8159} 
  - xen-pciback: limit guest control of command register (Jan Beulich)  [Orabug: 20704156]  {CVE-2015-2150} {CVE-2015-2150} 
  - net: sctp: fix slab corruption from use after free on INIT collisions (Daniel Borkmann)  [Orabug: 20780348]  {CVE-2015-1421}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.250.2.el6uek]
changelog:
  - crypto: aesni - fix memory usage in GCM decryption (Stephan Mueller)  [Orabug: 21077389]  {CVE-2015-3331}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.250.3.el6uek]
changelog:
  - af_unix: dont send SCM_CREDENTIALS by default (Eric Dumazet)  [Orabug: 20604916]  
  - scm: Capture the full credentials of the scm sender (Tim Chen)  [Orabug: 20604916]  
  - af_unix: limit recursion level (Eric Dumazet)  [Orabug: 20604916]  
  - af_unix: Allow credentials to work across user and pid namespaces. (Eric W. Biederman)  [Orabug: 20604916]  
  - scm: Capture the full credentials of the scm sender. (Eric W. Biederman)  [Orabug: 20604916]  
  - BUG_ON(lockres->l_level != DLM_LOCK_EX && !checkpointed) tripped in ocfs2_ci_checkpointed (Tariq Saeed)  [Orabug: 20189959]  
  - sched: Prevent divide by zero when cpu power calculation is 0 (Todd Vierling)  [Orabug: 17936435]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.250.5.el6uek]
changelog:
  - x86_64, vdso: Fix the vdso address randomization algorithm (Andy Lutomirski)  [Orabug: 21226730]  {CVE-2014-9585} 
  - isofs: Fix infinite looping over CE entries (Jan Kara)  [Orabug: 21225976]  {CVE-2014-9420} 
  - x86_64, switch_to(): Load TLS descriptors before switching DS and ES (Andy Lutomirski)  [Orabug: 21225938]  {CVE-2014-9419}


author: Santosh Shilimkar <santosh.shilimkar@oracle.com> [2.6.39-400.250.6.el6uek]
changelog:
  - x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Andy Lutomirski)  [Orabug: 21308308]  {CVE-2015-2830} 
  - x86, mm/ASLR: Fix stack randomization on 64-bit systems (Hector Marco-Gisbert)  [Orabug: 21307918]  {CVE-2015-1593} {CVE-2015-1593}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.250.7.el6uek]
changelog:
  - ipv6: Don't reduce hop limit for an interface (D.S. Ljungmark)  [Orabug: 21444791]  {CVE-2015-2922} 
  - ipv4: Missing sk_nulls_node_init() in ping_unhash(). (David S. Miller)  [Orabug: 21444688]  {CVE-2015-3636}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.250.8.el6uek]
changelog:
  - KVM: x86: SYSENTER emulation is broken (Nadav Amit)  [Orabug: 21502740]  {CVE-2015-0239} {CVE-2015-0239} 
  - x86/tls: Validate TLS entries to protect espfix (Andy Lutomirski)  [Orabug: 20223777]  {CVE-2014-8133} 
  - fs: take i_mutex during prepare_binprm for set[ug]id executables (Jann Horn)  [Orabug: 21502255]  {CVE-2015-3339} 
  - eCryptfs: Remove buggy and unnecessary write in file name decode routine (Michael Halcrow)  [Orabug: 21502066]  {CVE-2014-9683}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.250.9.el6uek]
changelog:
  - x86, tls: Interpret an all-zero struct user_desc as "no segment" (Andy Lutomirski)  [Orabug: 21514969]  
  - x86, tls, ldt: Stop checking lm in LDT_empty (Andy Lutomirski)  [Orabug: 21514969]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.250.10.el6uek]
changelog:
  - md: use kzalloc() when bitmap is disabled (Benjamin Randazzo)  [Orabug: 21563042]  {CVE-2015-5697} 
  - netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len (Andrey Vagin)  [Orabug: 21562780]  {CVE-2014-9715}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.250.11.el6uek]
changelog:
  - udp: fix behavior of wrong checksums (Eric Dumazet)  [Orabug: 21628851]  {CVE-2015-5364} {CVE-2015-5366}


author: Santosh Shilimkar <santosh.shilimkar@oracle.com> [2.6.39-400.256.0.el6uek]
changelog:
  - NFS hangs in __ocfs2_cluster_lock due to race with ocfs2_unblock_lock (Tariq Saeed)  [Orabug: 20933419]  
  - jbd2: fix hung processes in jbd2_journal_lock_updates() (Jan Kara)   
  - rds: make sure base connection is up on both sides (Ajaykumar Hotchandani)  [Orabug: 20011421]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.257.0.el6uek]
changelog:
  - ipv6: Don't reduce hop limit for an interface (D.S. Ljungmark)  [Orabug: 21444791]  {CVE-2015-2922} 
  - ipv4: Missing sk_nulls_node_init() in ping_unhash(). (David S. Miller)  [Orabug: 21444688]  {CVE-2015-3636} 
  - x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Andy Lutomirski)  [Orabug: 21308308]  {CVE-2015-2830} 
  - x86, mm/ASLR: Fix stack randomization on 64-bit systems (Hector Marco-Gisbert)  [Orabug: 21307918]  {CVE-2015-1593} {CVE-2015-1593}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.260.1.el6uek]
changelog:
  - block: remove artifical max_hw_sectors cap (Joe Jin)  [Orabug: 21455630]  
  - idr: fix unexpected ID-removal when idr_remove(unallocated_id) (Lai Jiangshan)  [Orabug: 21446790]  
  - idr: remove WARN_ON_ONCE() on negative IDs (Tejun Heo)  [Orabug: 21446790]  
  - ipc,shm: fix shm_file deletion races (Greg Thelen)  [Orabug: 21446790]  
  - rds: avoid call to flush_mrs() in specific condition (Ajaykumar Hotchandani)  [Orabug: 21379403]  
  - rds: print vendor error (Wengang Wang)  [Orabug: 21361643]  
  - Xen-netback: Fix issue caused by using gso_type wrongly (Annie Li)  [Orabug: 21358903]  
  - xen-netback: fix fragments error handling in checksum_setup_ip() (Wei Yongjun)  [Orabug: 21358903]  
  - xen-netback: make sure skb linear area covers checksum field (Paul Durrant)  [Orabug: 21358903]  
  - xen-netback: reset network header before passing skb to checksum funtion (Annie Li)  [Orabug: 21358903]  
  - xen-netback: fix fragment detection in checksum setup (Paul Durrant)  [Orabug: 21358903]  
  - xen-netback: fix gso_prefix check (Paul Durrant)  [Orabug: 21358903]  
  - xen-netback: include definition of csum_ipv6_magic (Andy Whitcroft)  [Orabug: 21358903]  
  - xen-netback: enable IPv6 TCP GSO to the guest (Paul Durrant)  [Orabug: 21358903]  
  - xen-netback: handle IPv6 TCP GSO packets from the guest (Paul Durrant)  [Orabug: 21358903]  
  - xen-netback: Unconditionally set NETIF_F_RXCSUM (Paul Durrant)  [Orabug: 21358903]  
  - xen-netback: add support for IPv6 checksum offload from guest (Paul Durrant)  [Orabug: 21358903]  
  - xen-netback: switch to use skb_partial_csum_set() (Jason Wang)  [Orabug: 21358903]  
  - xen-netback: add support for IPv6 checksum offload to guest (Paul Durrant)  [Orabug: 21358903]  
  - vfs: allow umount to handle mountpoints without revalidating them (Jeff Layton)  [Orabug: 21321002]  
  - rds: rds_ib_device.refcount overflow (Wengang Wang)  [Orabug: 21288594]  
  - sched: Optimize task_sched_runtime() (Peter Zijlstra)  [Orabug: 20739920]  
  - IPoIB: Fix ipoib_hard_header() return value (Doug Ledford)  [Orabug: 18223954]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.262.1.el6uek]
changelog:
  - udp: fix behavior of wrong checksums (Eric Dumazet)  [Orabug: 21628851]  {CVE-2015-5364} {CVE-2015-5366} 
  - scsi: don't add scsi_device if its already visible (Subhash Jadavani)  [Orabug: 21611207]  
  - NVMe: Don't write cq doorbell on suspended queues (Keith Busch)  [Orabug: 21591104]  
  - IB/ipoib: Potential false positive with peer support for ib-crc-as-csum (Yuval Shaia)  [Orabug: 21350399]  
  - mlx4: indicate memory resource exhaustion (Ajaykumar Hotchandani)  [Orabug: 21097014]  
  - rds: return EMSGSIZE for oversize requests before processing/queueing (Mukesh Kacker)  [Orabug: 21079258]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.263.1.el6uek]
changelog:
  - af_netlink: force credentials passing [CVE-2012-3520] (Eric Dumazet)  [Orabug: 21591166]  {CVE-2012-3520} 
  - xen/pciback: Don't print scary messages when unsupported by hypervisor. (Konrad Rzeszutek Wilk)  [Orabug: 20642069]  
  - rds_rdma: setup connection before rds_cmsg_send (Wengang Wang)  [Orabug: 20232581]  
  - megaraid_sas : Firmware crash dump feature support (Sumit.Saxena@avagotech.com)  [Orabug: 21620491]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.264.1.el6uek]
changelog:
  - mm/hugetlb: Add locking to region_{add,change,truncate,count} when using shared files with hugepages (Mike Kravetz)  [Orabug: 21561820]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.264.2.el6uek]
changelog:
  - xen-blkfront: introduce blkfront_gather_backend_features() (Bob Liu)  [Orabug: 21795426]  
  - chmod can cause hang in a cluster (Tariq Saeed)  [Orabug: 21496050]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.264.4.el6uek]
changelog:
  - xen/blkfront: remove redundant flush_op (Vitaly Kuznetsov)  [Orabug: 21862750]  
  - xen/blkfront: improve protection against issuing unsupported REQ_FUA (Vitaly Kuznetsov)  [Orabug: 21862750]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.264.6.el6uek]
changelog:
  - mlx4_core: Introduce restrictions for PD update (Ajaykumar Hotchandani)   
  - IPoIB: Drop priv->lock before calling ipoib_send() (Wengang Wang)   
  - IPoIB: serialize changing on tx_outstanding (Wengang Wang)  [Orabug: 21861366]  
  - IB/mlx4: Implement IB_QP_CREATE_USE_GFP_NOIO (Jiri Kosina)   
  - IB: Add a QP creation flag to use GFP_NOIO allocations (Or Gerlitz)   
  - IB: Return error for unsupported QP creation flags (Or Gerlitz)   
  - IB/ipoib: Calculate csum only when skb->ip_summed is CHECKSUM_PARTIAL (Yuval Shaia)  [Orabug: 20873175]


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.39-400.264.7.el6uek]
changelog:
  - KVM: svm: unconditionally intercept #DB (Paolo Bonzini)  [Orabug: 22333698]  {CVE-2015-8104} {CVE-2015-8104} 
  - KVM: x86: work around infinite loop in microcode when #AC is delivered (Eric Northup)  [Orabug: 22333689]  {CVE-2015-5307} {CVE-2015-5307}


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.39-400.264.8.el6uek]
changelog:
  - ipc/sem.c: fully initialize sem_array before making it visible (Manfred Spraul)  [Orabug: 22250044]  {CVE-2015-7613} 
  - Initialize msg/shm IPC objects before doing ipc_addid() (Linus Torvalds)  [Orabug: 22250044]  {CVE-2015-7613}


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.39-400.264.9.el6uek]
changelog:
  - msg_unlock() in wrong spot after applying "Initialize msg/shm IPC objects before doing ipc_addid()" (Chuck Anderson)  [Orabug: 22250044]  {CVE-2015-7613} {CVE-2015-7613}


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.39-400.264.11.el6uek]
changelog:
  - KVM: x86: Don't report guest userspace emulation error to userspace (Nadav Amit)  [Orabug: 22249615]  {CVE-2010-5313} {CVE-2014-7842}


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.39-400.264.12.el6uek]
changelog:
  - crypto: add missing crypto module aliases (Mathias Krause)  [Orabug: 22249656]  {CVE-2013-7421} {CVE-2014-9644} 
  - crypto: include crypto- module prefix in template (Kees Cook)  [Orabug: 22249656]  {CVE-2013-7421} {CVE-2014-9644} 
  - crypto: prefix module autoloading with "crypto-" (Kees Cook)  [Orabug: 22249656]  {CVE-2013-7421} {CVE-2014-9644}


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.39-400.264.13.el6uek]
changelog:
  - KEYS: Don't permit request_key() to construct a new keyring (David Howells)  [Orabug: 22373449]  {CVE-2015-7872}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.267.0.el6uek]
changelog:
  - x86/xen: properly retrieve NMI reason (Jan Beulich)  [Orabug: 21892076]  
  - x86/mrst: Avoid reporting wrong nmi status (Jacob Pan)  [Orabug: 21892076]  
  - xen: Support 64-bit PV guest receiving NMIs (Konrad Rzeszutek Wilk)  [Orabug: 21892076]  
  - nfsd: fix rare symlink decoding bug (J. Bruce Fields)  [Orabug: 18405506]  
  - ocfs2: __ocfs2_mknod_locked should return error when ocfs2_create_new_inode_locks() failed (Xue jiufei)  [Orabug: 21171285]  
  - NFSv4: Get rid of unnecessary BUG_ON()s (Trond Myklebust)  [Orabug: 21744595]  
  - IPoIB: serialize changing on tx_outstanding (Wengang Wang)  [Orabug: 21861366]  
  - x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when sanitizing map (Malcolm Crossley)   
  - IPoIB: Drop priv->lock before calling ipoib_send() (Wengang Wang)   
  - IB/mlx4: Use vmalloc for WR buffers when needed (Wengang Wang)  [Orabug: 22025569]  
  - mm: move kvfree to mm/util (Wengang Wang)  [Orabug: 22025569]  
  - mlx4_core: Introduce restrictions for PD update (Ajaykumar Hotchandani)   
  - mlx4: Increase SYNC_TPT command timeout (Mukesh Kacker)  [Orabug: 21692254]  
  - IB/ipoib: Calculate csum only when skb->ip_summed is CHECKSUM_PARTIAL (Yuval Shaia)  [Orabug: 20873175]  
  - virtio-net: drop NETIF_F_FRAGLIST (Jason Wang)  [Orabug: 22145599]  {CVE-2015-5156}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.268.0.el6uek]
changelog:
  - mm/swap.c: reorganize put_compound_page() (Andrew Morton)  [Orabug: 16823432]  
  - mm/hugetlb.c: simplify PageHeadHuge() and PageHuge() (Andrew Morton)  [Orabug: 16823432]  
  - mm: document PageHuge somewhat (Andrew Morton)  [Orabug: 16823432]  
  - mm: hugetlbfs: use __compound_tail_refcounted in __get_page_tail too (Andrea Arcangeli)  [Orabug: 16823432]  
  - mm: tail page refcounting optimization for slab and hugetlbfs (Andrea Arcangeli)  [Orabug: 16823432]  
  - mm: thp: optimize compound_trans_huge (Andrea Arcangeli)  [Orabug: 16823432]  
  - mm: hugetlbfs: move the put/get_page slab and hugetlbfs optimization in a faster path (Andrea Arcangeli)  [Orabug: 16823432]  
  - mm: hugetlb: use get_page_foll() in follow_hugetlb_page() (Andrea Arcangeli)  [Orabug: 16823432]  
  - mm: hugetlbfs: fix hugetlbfs optimization (Andrea Arcangeli)  [Orabug: 16823432]  
  - mm: fix aio performance regression for database caused by THP (Khalid Aziz)  [Orabug: 16823432]  
  - mm: fix slab->page flags corruption (Pravin B Shelar)  [Orabug: 16823432]  
  - IB/mlx4: Implement IB_QP_CREATE_USE_GFP_NOIO (Jiri Kosina)   
  - IB: Add a QP creation flag to use GFP_NOIO allocations (Or Gerlitz)   
  - IB: Return error for unsupported QP creation flags (Or Gerlitz)


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.39-400.272.0.el6uek]
changelog:
  - rds: print rdma_cm_id while establishing connection (Ajaykumar Hotchandani)  [Orabug: 22315028]  
  - rdma_cm: extend debug for remote mapping (Ajaykumar Hotchandani)  [Orabug: 22315028]  
  - OFED: indicate consistent vendor error (Ajaykumar Hotchandani)  [Orabug: 22308787]  
  - mlx4_core: print device details for PORT event (Ajaykumar Hotchandani)  [Orabug: 22113813]  
  - mlx4_core: enable print for device reset (Ajaykumar Hotchandani)  [Orabug: 22308637]  
  - mlx4_core: correct fmr_reserve() (Ajaykumar Hotchandani)  [Orabug: 22137952]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.276.1.el6uek]
changelog:
  - block: bump BLK_DEF_MAX_SECTORS to 2560 (Joe Jin)  [Orabug: 22521844]  
  - Revert "block: remove artifical max_hw_sectors cap" (Joe Jin)  [Orabug: 22521844]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.277.1.el6uek]
changelog:
  - Fix double free iocb->private with AIO DIO (Shirley Ma)  [Orabug: 18794638]  
  - xen/xenbus: Avoid synchronous wait on XenBus stalling shutdown/restart. (Konrad Rzeszutek Wilk)  [Orabug: 18932877]  
  - Increased maximum tape device limit to 1024 in UEK2 (Ritika Srivastava)  [Orabug: 22044668]  
  - qla2xxx: don't treat initial temperature read failure as an error (Dan Duval)  [Orabug: 22098738]  
  - Revert "qla2xxx: Display mailbox failure by default." (Dan Duval)  [Orabug: 22098738]  
  - RDS: Add interface for receive MSG latency trace (Santosh Shilimkar)  [Orabug: 22630078]  
  - RDS: Add support for per socket SO_TIMESTAMP for incoming messages (Santosh Shilimkar)  [Orabug: 22630078]  
  - rds: add infrastructure to find more details for reconnect failure (Ajaykumar Hotchandani)  [Orabug: 21799394]  
  - rds: find connection drop reason (Ajaykumar Hotchandani)  [Orabug: 21799394]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.278.1.el6uek]
changelog:
  - [SUNRPC]: avoid race between xs_reset_transport and xs_tcp_setup_socket (Wengang Wang)   
  - x86_64: expand kernel stack to 16K (Minchan Kim)  [Orabug: 20920074]  
  - qla2xxx: fix wrongly report "PCI EEH busy" when get_thermal_temp (Vaughan Cao)  [Orabug: 21108318]  
  - RDS/IB: VRPC DELAY / OSS RECONNECT CAUSES 5 MINUTE STALL ON PORT FAILURE (Venkat Venkatsubra)  [Orabug: 21465077]  
  - RDS: Fix the atomicity for congestion map update (Wengang Wang)  [Orabug: 22118109]  
  - RDS: introduce generic {clear,set}_bit_le() (Wengang Wang)  [Orabug: 22118109]  
  - cifs: allow socket to clear and app threads to set tcpStatus CifsNeedReconnect (John Sobecki)  [Orabug: 22203554]  
  - mlx4_vnic: Enable LRO for mlx4_vnic net devices. (Ashish Samant)  [Orabug: 22317936]  
  - mlx4_vnic: Add correct typecasting to pointers. (Ashish Samant)  [Orabug: 22317936]  
  - veth: don’t modify ip_summed; doing so treats packets with bad checksums as good. (Vijay Pandurangan)  [Orabug: 22804574]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.278.2.el6uek]
changelog:
  - sctp: Prevent soft lockup when sctp_accept() is called during a timeout event (Karl Heiss)  [Orabug: 23222773]  {CVE-2015-8767}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.278.3.el6uek]
changelog:
  - net: add validation for the socket syscall protocol argument (Hannes Frederic Sowa)  [Orabug: 23267976]  {CVE-2015-8543} {CVE-2015-8543} 
  - ipv6: addrconf: validate new MTU before applying it (Marcelo Leitner)  [Orabug: 23263251]  {CVE-2015-8215} 
  - ext4: avoid hang when mounting non-journal filesystems with orphan list (Theodore Ts'o)  [Orabug: 23262219]  {CVE-2015-7509} 
  - ext4: make orphan functions be no-op in no-journal mode (Anatol Pomozov)  [Orabug: 23262219]  {CVE-2015-7509} 
  - unix: properly account for FDs passed over unix sockets (willy tarreau)  [Orabug: 23262265]  {CVE-2013-4312} {CVE-2013-4312}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.279.1.el6uek]
changelog:
  - IPoIB: increase send queue size to 4 times (Ajaykumar Hotchandani)  [Orabug: 22287489]  
  - IB/ipoib: Change send workqueue size for CM mode (Ajaykumar Hotchandani)  [Orabug: 22287489]  
  - Avoid 60sec timeout when receiving rtpg sense code 06/00/00 (John Sobecki)  [Orabug: 22336257]  
  - stop recursive fault in print_context_stack after stack overflow (John Sobecki)  [Orabug: 23174777]  
  - IB/security: Restrict use of the write() interface (Jason Gunthorpe)  [Orabug: 23287131]  {CVE-2016-4565} 
  - net: add validation for the socket syscall protocol argument (Hannes Frederic Sowa)  [Orabug: 23267976]  {CVE-2015-8543} {CVE-2015-8543} 
  - ipv6: addrconf: validate new MTU before applying it (Marcelo Leitner)  [Orabug: 23263251]  {CVE-2015-8215} 
  - ext4: avoid hang when mounting non-journal filesystems with orphan list (Theodore Ts'o)  [Orabug: 23262219]  {CVE-2015-7509} 
  - ext4: make orphan functions be no-op in no-journal mode (Anatol Pomozov)  [Orabug: 23262219]  {CVE-2015-7509} 
  - unix: properly account for FDs passed over unix sockets (willy tarreau)  [Orabug: 23262265]  {CVE-2013-4312} {CVE-2013-4312} 
  - sctp: Prevent soft lockup when sctp_accept() is called during a timeout event (Karl Heiss)  [Orabug: 23222773]  {CVE-2015-8767}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.280.1.el6uek]
changelog:
  - Fix cpu bootup stall with large cpu count (Zhenzhong Duan)  [Orabug: 23481040]  
  - megaraid_sas : Update threshold based reply post host index register (Sumit.Saxena@avagotech.com)  [Orabug: 23536267]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.283.1.el6uek]
changelog:
  - atl2: Disable unimplemented scatter/gather feature (Ben Hutchings)  [Orabug: 23703990]  {CVE-2016-2117} 
  - mlx4_core: add module parameter to disable background init (Mukesh Kacker)  [Orabug: 23292107]  
  - NFSv4: Don't decode fs_locations if we didn't ask for them... (Trond Myklebust)  [Orabug: 23633714]  
  - mm/slab: Improve performance of slabinfo stats gathering (Aruna Ramakrishna)  [Orabug: 23050884]  
  - offload ib subnet manager port and node get info query handling. (Rama Nichanamatlu)  [Orabug: 22521735]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.284.1.el6uek]
changelog:
  - rds: schedule local connection activity in proper workqueue (Ajaykumar Hotchandani)  [Orabug: 22819661]  
  - ib_core: make wait_event uninterruptible in ib_flush_fmr_pool() (Avinash Repaka)  [Orabug: 24525022]  
  - net/mlx4: Support shutdown() interface (Ajaykumar Hotchandani)  [Orabug: 24616261]  
  - KEYS: potential uninitialized variable (Dan Carpenter)  [Orabug: 24393863]  {CVE-2016-4470}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.284.2.el6uek]
changelog:
  - Btrfs: fix truncation of compressed and inlined extents (Divya Indi)  [Orabug: 22307286]  {CVE-2015-8374} 
  - Btrfs: fix file corruption and data loss after cloning inline extents (Divya Indi)  [Orabug: 22307286]  {CVE-2015-8374} 
  - netfilter: x_tables: make sure e->next_offset covers remaining blob size (Florian Westphal)  [Orabug: 24682073]  {CVE-2016-4997} {CVE-2016-4998} 
  - netfilter: x_tables: validate e->target_offset early (Florian Westphal)  [Orabug: 24682071]  {CVE-2016-4997} {CVE-2016-4998}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.285.1.el6uek]
changelog:
  - netfilter: x_tables: speed up jump target validation (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES (Pablo Neira Ayuso)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: remove unused comefrom hookmask argument (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: introduce and use xt_copy_counters_from_user (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: do compat validation via translate_table (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: xt_compat_match_from_user doesn't need a retval (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: ip6_tables: simplify translate_compat_table args (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: ip_tables: simplify translate_compat_table args (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: arp_tables: simplify translate_compat_table args (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: don't reject valid target size on some architectures (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: validate all offsets and sizes in a rule (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: check for bogus target offset (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: check standard target size too (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: add compat version of xt_check_entry_offsets (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: assert minimum target size (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: kill check_entry helper (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: add and use xt_check_entry_offsets (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: validate targets of jumps (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: fix unconditional helper (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: validate targets of jumps (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: don't move to non-existent next rule (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: fix unconditional helper (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - netfilter: x_tables: check for size overflow (Florian Westphal)  [Orabug: 24690302]  {CVE-2016-3134} 
  - ocfs2: Fix double put of recount tree in ocfs2_lock_refcount_tree() (Ashish Samant)  [Orabug: 24587406]  
  - TTY: do not reset master's packet mode (Jiri Slaby)  [Orabug: 24569399]  
  - ocfs2: Fix start offset to ocfs2_zero_range_for_truncate() (Ashish Samant)  [Orabug: 24500401]  
  - rds: skip rx/tx work when destroying connection (Wengang Wang)  [Orabug: 24314773]  
  - Revert "IPoIB: serialize changing on tx_outstanding" (Wengang Wang)  [Orabug: 23745787]  
  - xen/events: document behaviour when scanning the start word for events (Dongli Zhang)  [Orabug: 23083945]  
  - xen/events: mask events when changing their VCPU binding (Dongli Zhang)  [Orabug: 23083945]  
  - xen/events: initialize local per-cpu mask for all possible events (Dongli Zhang)  [Orabug: 23083945]  
  - IB/mlx4: Replace kfree with kvfree in mlx4_ib_destroy_srq (Wengang Wang)  [Orabug: 22570922]  
  - NFS: Remove BUG_ON() calls from the generic writeback code (Trond Myklebust)  [Orabug: 22386565]  
  - ocfs2: return non-zero st_blocks for inline data (John Haxby)  [Orabug: 22218262]  
  - oracleasm: Classify device connectivity issues as global errors (Martin K. Petersen)  [Orabug: 21760143]  
  - Btrfs: fix truncation of compressed and inlined extents (Divya Indi)  [Orabug: 22307286]  {CVE-2015-8374} 
  - Btrfs: fix file corruption and data loss after cloning inline extents (Divya Indi)  [Orabug: 22307286]  {CVE-2015-8374} 
  - netfilter: x_tables: make sure e->next_offset covers remaining blob size (Florian Westphal)  [Orabug: 24682073]  {CVE-2016-4997} {CVE-2016-4998} 
  - netfilter: x_tables: validate e->target_offset early (Florian Westphal)  [Orabug: 24682071]  {CVE-2016-4997} {CVE-2016-4998}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.286.2.el6uek]
changelog:
  - HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Scott Bauer)  [Orabug: 24798694]  {CVE-2016-5829}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.287.1.el6uek]
changelog:
  - ecryptfs: forbid opening files without mmap handler (Jann Horn)  [Orabug: 24971919]  {CVE-2016-1583} 
  - RDS: IB: fix panic with handlers running post teardown (Santosh Shilimkar)  [Orabug: 24314773]  
  - ocfs2: improve recovery performance (Junxiao Bi)  [Orabug: 24589532]  
  - ocfs2: call ocfs2_journal_access_di() before  ocfs2_journal_dirty() in ocfs2_write_end_nolock() (Junxiao Bi)  [Orabug: 24606864]  
  - mm, gup: close FOLL MAP_PRIVATE race (Linus Torvalds)  [Orabug: 24928646]  {CVE-2016-5195} 
  - HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Scott Bauer)  [Orabug: 24798694]  {CVE-2016-5829}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.288.1.el6uek]
changelog:
  - Revert "ecryptfs: forbid opening files without mmap handler" (Brian Maly)  [Orabug: 24971918]  
  - ocfs2: o2hb: fix hb hung time (Junxiao Bi)   
  - ocfs2: o2hb: don't negotiate if last hb fail (Junxiao Bi)   
  - ocfs2: o2hb: add some user/debug log (Junxiao Bi)   
  - ocfs2: o2hb: add NEGOTIATE_APPROVE message (Junxiao Bi)   
  - ocfs2: o2hb: add NEGO_TIMEOUT message (Junxiao Bi)   
  - ocfs2: o2hb: add negotiate timer (Junxiao Bi)


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.290.2.el6uek]
changelog:
  - aacraid: Check size values after double-fetch from user (Dave Carroll)  [Orabug: 25060055]  {CVE-2016-6480} {CVE-2016-6480} 
  - audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore)  [Orabug: 25059962]  {CVE-2016-6136} 
  - ecryptfs: don't allow mmap when the lower fs doesn't support it (Jeff Mahoney)  [Orabug: 24971918]  {CVE-2016-1583} {CVE-2016-1583} 
  - ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt (Kangjie Lu)  [Orabug: 25059900]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in events via snd_timer_user_ccallback (Kangjie Lu)  [Orabug: 25059900]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (Kangjie Lu)  [Orabug: 25059755]  {CVE-2016-4569} 
  - Bluetooth: Fix potential NULL dereference in RFCOMM bind callback (Jaganath Kanakkassery)  [Orabug: 25058905]  {CVE-2015-8956} 
  - mm: migrate dirty page without clear_page_dirty_for_io etc (Hugh Dickins)  [Orabug: 25059195]  {CVE-2016-3070}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.291.1.el6uek]
changelog:
  - RDS: Drop the connection as part of cancel to avoid hangs (Avinash Repaka)  [Orabug: 24951873]  
  - aacraid: Check size values after double-fetch from user (Dave Carroll)  [Orabug: 25060055]  {CVE-2016-6480} {CVE-2016-6480} 
  - audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore)  [Orabug: 25059962]  {CVE-2016-6136} 
  - ecryptfs: don't allow mmap when the lower fs doesn't support it (Jeff Mahoney)  [Orabug: 24971918]  {CVE-2016-1583} {CVE-2016-1583} 
  - ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt (Kangjie Lu)  [Orabug: 25059900]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in events via snd_timer_user_ccallback (Kangjie Lu)  [Orabug: 25059900]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (Kangjie Lu)  [Orabug: 25059755]  {CVE-2016-4569} 
  - Bluetooth: Fix potential NULL dereference in RFCOMM bind callback (Jaganath Kanakkassery)  [Orabug: 25058905]  {CVE-2015-8956} 
  - mm: migrate dirty page without clear_page_dirty_for_io etc (Hugh Dickins)  [Orabug: 25059195]  {CVE-2016-3070}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.292.1.el6uek]
changelog:
  - NVMe: reduce queue depth as workaround for Samsung EPIC SQ errata (Ashok Vairavan)  [Orabug: 25138146]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.293.1.el6uek]
changelog:
  - logging errors that get masked to EIO inside drivers/block/loop.c (Manjunath Patil)  [Orabug: 21962821]  
  - sched/core: Clear the root_domain cpumasks in init_rootdomain() (Xunlei Pang)  [Orabug: 23518650]  
  - bio allocation failure due to bio_get_nr_vecs() (Darrick J. Wong)  [Orabug: 23852442]  
  - mlx4: avoid ABBA deadlock (Wengang Wang)  [Orabug: 23538548]  
  - mlx4: avoid multiple free on id_map_ent (Wengang Wang)  [Orabug: 25022815]  
  - sctp: validate chunk len before actually using it (Marcelo Ricardo Leitner)  [Orabug: 25142906]  {CVE-2016-9555}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.293.2.el6uek]
changelog:
  - x86/iopl/64: properly context-switch IOPL on Xen PV (Andy Lutomirski)  [Orabug: 25269184]  {CVE-2016-3157} 
  - net: Fix use after free in the recvmmsg exit path (Arnaldo Carvalho de Melo)  [Orabug: 25298618]  {CVE-2016-7117}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.294.1.el6uek]
changelog:
  - nvme: Limit command retries (Ashok Vairavan)  [Orabug: 25342947]  
  - tcp: fix use after free in tcp_xmit_retransmit_queue() (Eric Dumazet)  [Orabug: 25374376]  {CVE-2016-6828} 
  - ALSA: pcm : Call kill_fasync() in stream lock (Takashi Iwai)  [Orabug: 25231728]  {CVE-2016-9794} 
  - net: avoid signed overflows for SO_{SND|RCV}BUFFORCE (Eric Dumazet)  [Orabug: 25231758]  {CVE-2016-9793} 
  - KEYS: Fix short sprintf buffer in /proc/keys show function (David Howells)  [Orabug: 25306377]  {CVE-2016-7042} 
  - x86/iopl/64: properly context-switch IOPL on Xen PV (Andy Lutomirski)  [Orabug: 25269184]  {CVE-2016-3157} 
  - net: Fix use after free in the recvmmsg exit path (Arnaldo Carvalho de Melo)  [Orabug: 25298618]  {CVE-2016-7117}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.294.2.el6uek]
changelog:
  - vfs: read file_handle only once in handle_to_path (Sasha Levin)  [Orabug: 25388709]  {CVE-2015-1420} 
  - crypto: algif_hash - Only export and import on sockets with data (Herbert Xu)  [Orabug: 25417807]  
  - USB: usbfs: fix potential infoleak in devio (Kangjie Lu)  [Orabug: 25462763]  {CVE-2016-4482} 
  - net: fix infoleak in llc (Kangjie Lu)  [Orabug: 25462811]  {CVE-2016-4485} 
  - af_unix: Guard against other == sk in unix_dgram_sendmsg (Rainer Weikusat)  [Orabug: 25464000]  {CVE-2013-7446} 
  - unix: avoid use-after-free in ep_remove_wait_queue (Rainer Weikusat)  [Orabug: 25464000]  {CVE-2013-7446}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.294.3.el6uek]
changelog:
  - dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Andrey Konovalov)  [Orabug: 25598277]  {CVE-2017-6074}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.294.4.el6uek]
changelog:
  - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander Popov)  [Orabug: 25696689]  {CVE-2017-2636} 
  - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)  [Orabug: 25696689]  {CVE-2017-2636} 
  - drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc (Fabian Frederick)  [Orabug: 25696689]  {CVE-2017-2636} 
  - list: introduce list_first_entry_or_null (Jiri Pirko)  [Orabug: 25696689]  {CVE-2017-2636} 
  - firewire: net: guard against rx buffer overflows (Stefan Richter)  [Orabug: 25451538]  {CVE-2016-8633} 
  - x86/mm/32: Enable full randomization on i386 and X86_32 (Hector Marco-Gisbert)  [Orabug: 25463929]  {CVE-2016-3672} 
  - x86 get_unmapped_area: Access mmap_legacy_base through mm_struct member (Radu Caragea)  [Orabug: 25463929]  {CVE-2016-3672} 
  - sg_start_req(): make sure that there's not too many elements in iovec (Al Viro)  [Orabug: 25490377]  {CVE-2015-5707} 
  - tcp: take care of truncations done by sk_filter() (Eric Dumazet)  [Orabug: 25507232]  {CVE-2016-8645} 
  - rose: limit sk_filter trim to payload (Willem de Bruijn)  [Orabug: 25507232]  {CVE-2016-8645} 
  - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() (Dan Carpenter)  [Orabug: 25507330]  {CVE-2016-7425} 
  - x86: bpf_jit: fix compilation of large bpf programs (Alexei Starovoitov)  [Orabug: 25507375]  {CVE-2015-4700} 
  - net: fix a kernel infoleak in x25 module (Kangjie Lu)  [Orabug: 25512417]  {CVE-2016-4580} 
  - USB: digi_acceleport: do sanity checking for the number of ports (Oliver Neukum)  [Orabug: 25512472]  {CVE-2016-3140} 
  - net/llc: avoid BUG_ON() in skb_orphan() (Eric Dumazet)  [Orabug: 25682437]  {CVE-2017-6345}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.294.5.el6uek]
changelog:
  - net: ping: check minimum size on ICMP header length (Kees Cook)  [Orabug: 25766914]  {CVE-2016-8399} 
  - ipv6: stop sending PTB packets for MTU < 1280 (Hagen Paul Pfeifer)  [Orabug: 25765786]  {CVE-2016-10142} 
  - sg_write()/bsg_write() is not fit to be called under KERNEL_DS (Al Viro)  [Orabug: 25765448]  {CVE-2016-10088} 
  - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter chang)  [Orabug: 25752011]  {CVE-2017-7187}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.294.6.el6uek]
changelog:
  - RHEL: complement upstream workaround for CVE-2016-10142. (Quentin Casasnovas)  [Orabug: 25765786]  {CVE-2016-10142} {CVE-2016-10142}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.294.7.el6uek]
changelog:
  - udp: properly support MSG_PEEK with truncated buffers (Eric Dumazet)  [Orabug: 25874741]  {CVE-2016-10229} 
  - block: fix use-after-free in seq file (Vegard Nossum)  [Orabug: 25877531]  {CVE-2016-7910}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.295.1.el6uek]
changelog:
  - ocfs2/o2net: o2net_listen_data_ready should do nothing if socket state is not TCP_LISTEN (Tariq Saeed)  [Orabug: 25510857]  
  - IB/CORE: sync the resouce access in fmr_pool (Wengang Wang)  [Orabug: 23750748]  
  - ipv6: Skip XFRM lookup if dst_entry in socket cache is valid (Jakub Sitnicki)  [Orabug: 25534688]  
  - uek-rpm: enable CONFIG_KSPLICE. (Jamie Iles)  [Orabug: 25549845]  
  - ksplice: add sysctls for determining Ksplice features. (Jamie Iles)  [Orabug: 25549845]  
  - signal: protect SIGNAL_UNKILLABLE from unintentional clearing. (Jamie Iles)  [Orabug: 25549845]  
  - KVM: x86: fix emulation of "MOV SS, null selector" (Paolo Bonzini)  [Orabug: 25719676]  {CVE-2017-2583} {CVE-2017-2583} 
  - sctp: avoid BUG_ON on sctp_wait_for_sndbuf (Marcelo Ricardo Leitner)  [Orabug: 25719811]  {CVE-2017-5986} 
  - tcp: avoid infinite loop in tcp_splice_read() (Eric Dumazet)  [Orabug: 25720815]  {CVE-2017-6214} 
  - USB: visor: fix null-deref at probe (Johan Hovold)  [Orabug: 25796604]  {CVE-2016-2782} 
  - ipc/shm: Fix shmat mmap nil-page protection (Davidlohr Bueso)  [Orabug: 25797014]  {CVE-2017-5669} 
  - vhost: actually track log eventfd file (Marc-André Lureau)  [Orabug: 25797056]  {CVE-2015-6252} 
  - xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder (Andy Whitcroft)  [Orabug: 25814664]  {CVE-2017-7184} 
  - xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window (Andy Whitcroft)  [Orabug: 25814664]  {CVE-2017-7184} 
  - KEYS: Remove key_type::match in favour of overriding default by match_preparse (David Howells)  [Orabug: 25823965]  {CVE-2017-2647} {CVE-2017-2647} 
  - USB: whiteheat: fix potential null-deref at probe (Johan Hovold)  [Orabug: 25825107]  {CVE-2015-5257} 
  - RDS: fix race condition when sending a message on unbound socket (Quentin Casasnovas)  [Orabug: 25871048]  {CVE-2015-6937} {CVE-2015-6937} 
  - udf: Check path length when reading symlink (Jan Kara)  [Orabug: 25871104]  {CVE-2015-9731} 
  - udf: Treat symlink component of type 2 as / (Jan Kara)  [Orabug: 25871104]  {CVE-2015-9731} 
  - udp: properly support MSG_PEEK with truncated buffers (Eric Dumazet)  [Orabug: 25874741]  {CVE-2016-10229} 
  - block: fix use-after-free in seq file (Vegard Nossum)  [Orabug: 25877531]  {CVE-2016-7910} 
  - RHEL: complement upstream workaround for CVE-2016-10142. (Quentin Casasnovas)  [Orabug: 25765786]  {CVE-2016-10142} {CVE-2016-10142} 
  - net: ping: check minimum size on ICMP header length (Kees Cook)  [Orabug: 25766914]  {CVE-2016-8399} 
  - ipv6: stop sending PTB packets for MTU < 1280 (Hagen Paul Pfeifer)  [Orabug: 25765786]  {CVE-2016-10142} 
  - sg_write()/bsg_write() is not fit to be called under KERNEL_DS (Al Viro)  [Orabug: 25765448]  {CVE-2016-10088} 
  - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter chang)  [Orabug: 25752011]  {CVE-2017-7187} 
  - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander Popov)  [Orabug: 25696689]  {CVE-2017-2636} 
  - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)  [Orabug: 25696689]  {CVE-2017-2636} 
  - drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc (Fabian Frederick)  [Orabug: 25696689]  {CVE-2017-2636} 
  - list: introduce list_first_entry_or_null (Jiri Pirko)  [Orabug: 25696689]  {CVE-2017-2636} 
  - firewire: net: guard against rx buffer overflows (Stefan Richter)  [Orabug: 25451538]  {CVE-2016-8633} 
  - x86/mm/32: Enable full randomization on i386 and X86_32 (Hector Marco-Gisbert)  [Orabug: 25463929]  {CVE-2016-3672} 
  - x86 get_unmapped_area: Access mmap_legacy_base through mm_struct member (Radu Caragea)  [Orabug: 25463929]  {CVE-2016-3672} 
  - sg_start_req(): make sure that there's not too many elements in iovec (Al Viro)  [Orabug: 25490377]  {CVE-2015-5707} 
  - tcp: take care of truncations done by sk_filter() (Eric Dumazet)  [Orabug: 25507232]  {CVE-2016-8645} 
  - rose: limit sk_filter trim to payload (Willem de Bruijn)  [Orabug: 25507232]  {CVE-2016-8645} 
  - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() (Dan Carpenter)  [Orabug: 25507330]  {CVE-2016-7425} 
  - x86: bpf_jit: fix compilation of large bpf programs (Alexei Starovoitov)  [Orabug: 25507375]  {CVE-2015-4700} 
  - net: fix a kernel infoleak in x25 module (Kangjie Lu)  [Orabug: 25512417]  {CVE-2016-4580} 
  - USB: digi_acceleport: do sanity checking for the number of ports (Oliver Neukum)  [Orabug: 25512472]  {CVE-2016-3140} 
  - net/llc: avoid BUG_ON() in skb_orphan() (Eric Dumazet)  [Orabug: 25682437]  {CVE-2017-6345} 
  - dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Andrey Konovalov)  [Orabug: 25598277]  {CVE-2017-6074} 
  - vfs: read file_handle only once in handle_to_path (Sasha Levin)  [Orabug: 25388709]  {CVE-2015-1420} 
  - crypto: algif_hash - Only export and import on sockets with data (Herbert Xu)  [Orabug: 25417807]  
  - USB: usbfs: fix potential infoleak in devio (Kangjie Lu)  [Orabug: 25462763]  {CVE-2016-4482} 
  - net: fix infoleak in llc (Kangjie Lu)  [Orabug: 25462811]  {CVE-2016-4485} 
  - af_unix: Guard against other == sk in unix_dgram_sendmsg (Rainer Weikusat)  [Orabug: 25464000]  {CVE-2013-7446} 
  - unix: avoid use-after-free in ep_remove_wait_queue (Rainer Weikusat)  [Orabug: 25464000]  {CVE-2013-7446}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.295.2.el6uek]
changelog:
  - nfsd: stricter decoding of write-like NFSv2/v3 ops (J. Bruce Fields)  [Orabug: 25986995]  {CVE-2017-7895}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.296.1.el6uek]
changelog:
  - cifs: adjust sequence number downward after signing NT_CANCEL request (Albert Barbe)   
  - nfsd: stricter decoding of write-like NFSv2/v3 ops (J. Bruce Fields)  [Orabug: 25986995]  {CVE-2017-7895}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.297.2.el6uek]
changelog:
  - dm mpath: allow ioctls to trigger pg init (Mikulas Patocka)  [Orabug: 25645229]  
  - xen/manage: Always freeze/thaw processes when suspend/resuming (Ross Lagerwall)  [Orabug: 25795530]  
  - lpfc cannot establish connection with targets that send PRLI under P2P mode (Joe Jin)  [Orabug: 25955028]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.297.3.el6uek]
changelog:
  - nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields)  [Orabug: 26366024]  {CVE-2017-7645}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.297.5.el6uek]
changelog:
  - selinux: quiet the filesystem labeling behavior message (Paul Moore)  [Orabug: 25721485]  
  - RDS/IB: active bonding port state fix for intfs added late (Mukesh Kacker)  [Orabug: 25875426]  
  - HID: hid-cypress: validate length of report (Greg Kroah-Hartman)  [Orabug: 25891914]  {CVE-2017-7273} 
  - udf: Remove repeated loads blocksize (Jan Kara)  [Orabug: 25905722]  {CVE-2015-4167} 
  - udf: Check length of extended attributes and allocation descriptors (Jan Kara)  [Orabug: 25905722]  {CVE-2015-4167} 
  - udf: Verify i_size when loading inode (Jan Kara)  [Orabug: 25905722]  {CVE-2015-4167} 
  - btrfs: drop unused parameter from btrfs_item_nr (Ross Kirk)  [Orabug: 25948102]  {CVE-2014-9710} 
  - Btrfs: cleanup of function where fixup_low_keys() is called (Tsutomu Itoh)  [Orabug: 25948102]  {CVE-2014-9710} 
  - Btrfs: remove unused argument of fixup_low_keys() (Tsutomu Itoh)  [Orabug: 25948102]  {CVE-2014-9710} 
  - Btrfs: remove unused argument of btrfs_extend_item() (Tsutomu Itoh)  [Orabug: 25948102]  {CVE-2014-9710} 
  - Btrfs: add support for asserts (Josef Bacik)  [Orabug: 25948102]  {CVE-2014-9710} 
  - Btrfs: make xattr replace operations atomic (Filipe Manana)  [Orabug: 25948102]  {CVE-2014-9710} 
  - net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom (Al Viro)  [Orabug: 25948149]  {CVE-2015-2686} 
  - xsigo: Compute node crash on FC failover (Joe Jin)  [Orabug: 25965445]  
  - PCI: Prevent VPD access for QLogic ISP2722 (Ethan Zhao)  [Orabug: 25975513]  
  - PCI: Prevent VPD access for buggy devices (Babu Moger)  [Orabug: 25975513]  
  - ipv4: try to cache dst_entries which would cause a redirect (Hannes Frederic Sowa)  [Orabug: 26032377]  {CVE-2015-1465}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.297.6.el6uek]
changelog:
  - l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() (Guillaume Nault)  [Orabug: 26586050]  {CVE-2016-10200} 
  - xfs: fix two memory leaks in xfs_attr_list.c error paths (Mateusz Guzik)  [Orabug: 26586024]  {CVE-2016-9685} 
  - KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings (David Howells)  [Orabug: 26586002]  {CVE-2016-9604} 
  - ipv6: fix out of bound writes in __ip6_append_data() (Eric Dumazet)  [Orabug: 26578202]  {CVE-2017-9242}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.297.7.el6uek]
changelog:
  - xen: fix bio vec merging (Roger Pau Monne)  [Orabug: 26645562]  {CVE-2017-12134} 
  - fs/exec.c: account for argv/envp pointers (Kees Cook)  [Orabug: 26638926]  {CVE-2017-1000365} {CVE-2017-1000365}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.297.8.el6uek]
changelog:
  - Bluetooth: Properly check L2CAP config option output buffer length (Ben Seri)  [Orabug: 26796428]  {CVE-2017-1000251}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.297.9.el6uek]
changelog:
  - fs/binfmt_elf.c: fix bug in loading of PIE binaries (Michael Davidson)  [Orabug: 26870958]  {CVE-2017-1000253}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.297.10.el6uek]
changelog:
  - mlx4_core: calculate log_mtt based on total system memory (Wei Lin Guay)  [Orabug: 26867355]  
  - xen/x86: Add interface for querying amount of host memory (Boris Ostrovsky)  [Orabug: 26867355]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.297.11.el6uek]
changelog:
  - mqueue: fix a use-after-free in sys_mq_notify() (Cong Wang)  [Orabug: 26643562]  {CVE-2017-11176} 
  - ipv6: avoid overflow of offset in ip6_find_1stfragopt (Sabrina Dubroca)  [Orabug: 27011278]  {CVE-2017-7542} 
  - packet: fix tp_reserve race in packet_set_ring (Willem de Bruijn)  [Orabug: 27002453]  {CVE-2017-1000111}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.297.12.el6uek]
changelog:
  - xsigo: [backport] Fix race in freeing aged Forwarding tables (Pradeep Gopanapalli)  [Orabug: 24823234]  
  - ocfs2: fix deadlock issue when taking inode lock at vfs entry points (Eric Ren)  [Orabug: 25671723]  
  - ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock (Eric Ren)  [Orabug: 25671723]  
  - net/packet: fix overflow in check for tp_reserve (Andrey Konovalov)  [Orabug: 26143563]  {CVE-2017-7308} 
  - net/packet: fix overflow in check for tp_frame_nr (Andrey Konovalov)  [Orabug: 26143563]  {CVE-2017-7308} 
  - char: lp: fix possible integer overflow in lp_setup() (Willy Tarreau)  [Orabug: 26403941]  {CVE-2017-1000363} 
  - ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT (Takashi Iwai)  [Orabug: 26403958]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race between read and ioctl (Takashi Iwai)  [Orabug: 26403958]  {CVE-2017-1000380} 
  - ALSA: timer: fix NULL pointer dereference in read()/ioctl() race (Vegard Nossum)  [Orabug: 26403958]  {CVE-2017-1000380} 
  - ALSA: timer: Fix negative queue usage by racy accesses (Takashi Iwai)  [Orabug: 26403958]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race at concurrent reads (Takashi Iwai)  [Orabug: 26403958]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race among timer ioctls (Takashi Iwai)  [Orabug: 26403958]  {CVE-2017-1000380} 
  - ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() (Ben Hutchings)  [Orabug: 26403974]  {CVE-2017-9074} 
  - ipv6: Check ip6_find_1stfragopt() return value properly. (David S. Miller)  [Orabug: 26403974]  {CVE-2017-9074} 
  - ipv6: Prevent overrun when parsing v6 header options (Craig Gallek)  [Orabug: 26403974]  {CVE-2017-9074} 
  - ipv6/dccp: do not inherit ipv6_mc_list from parent (WANG Cong)  [Orabug: 26404007]  {CVE-2017-9077} 
  - aio: mark AIO pseudo-fs noexec (Jann Horn)  [Orabug: 26643601]  {CVE-2016-10044} 
  - vfs: Commit to never having exectuables on proc and sysfs. (Eric W. Biederman)  [Orabug: 26643601]  {CVE-2016-10044} 
  - vfs, writeback: replace FS_CGROUP_WRITEBACK with SB_I_CGROUPWB (Tejun Heo)  [Orabug: 26643601]  {CVE-2016-10044} 
  - x86/acpi: Prevent out of bound access caused by broken ACPI tables (Seunghun Han)  [Orabug: 26643652]  {CVE-2017-11473} 
  - sctp: do not inherit ipv6_{mc|ac|fl}_list from parent (Eric Dumazet)  [Orabug: 26650889]  {CVE-2017-9075} 
  - saa7164: fix double fetch PCIe access condition (Steven Toth)  [Orabug: 26675148]  {CVE-2017-8831} 
  - saa7164: fix sparse warnings (Hans Verkuil)  [Orabug: 26675148]  {CVE-2017-8831} 
  - saa7164: get rid of warning: no previous prototype (Mauro Carvalho Chehab)  [Orabug: 26675148]  {CVE-2017-8831} 
  - [scsi] lpfc 8.3.44: Fix kernel panics from corrupted ndlp (James Smart)  [Orabug: 26765341]  
  - timerfd: Protect the might cancel mechanism proper (Thomas Gleixner)  [Orabug: 26899791]  {CVE-2017-10661} 
  - scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly (Xin Long)  [Orabug: 26988628]  {CVE-2017-14489}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.297.1.el6uek]
changelog:
  - nvme: Handle PM1725 HIL reset (Martin K. Petersen)  [Orabug: 26277602]  
  - dccp/tcp: do not inherit mc_list from parent (Eric Dumazet)  [Orabug: 26108573]  {CVE-2017-8890}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.298.1.el6uek]
changelog:
  - ocfs2/dlm: ignore cleaning the migration mle that is inuse (xuejiufei)  [Orabug: 23320090]  
  - tty: Fix race in pty_write() leading to NULL deref (Todd Vierling)  [Orabug: 24337879]  
  - xen-netfront: cast grant table reference first to type int (Dongli Zhang)  [Orabug: 25102637]  
  - xen-netfront: do not cast grant table reference to signed short (Dongli Zhang)  [Orabug: 25102637]  
  - RDS: Print failed rdma op details if failure is remote access error (Rama Nichanamatlu)  [Orabug: 25440316]  
  - ping: implement proper locking (Eric Dumazet)  [Orabug: 26540288]  {CVE-2017-2671} 
  - KEYS: fix dereferencing NULL payload with nonzero length (Eric Biggers)  [Orabug: 26592013]  
  - oracleasm: Copy the integrity descriptor (Martin K. Petersen)  [Orabug: 26650039]  
  - mm: Tighten x86 /dev/mem with zeroing reads (Kees Cook)  [Orabug: 26675934]  {CVE-2017-7889} 
  - fs: __generic_file_splice_read retry lookup on AOP_TRUNCATED_PAGE (Abhi Das)  [Orabug: 26797307]  
  - xscore: add dma address check (Zhu Yanjun)  [Orabug: 27058559]  
  - more bio_map_user_iov() leak fixes (Al Viro)  [Orabug: 27069045]  {CVE-2017-12190} 
  - fix unbalanced page refcounting in bio_map_user_iov (Vitaly Mayatskikh)  [Orabug: 27069045]  {CVE-2017-12190} 
  - xsigo: [backport] Fix race in freeing aged Forwarding tables (Pradeep Gopanapalli)  [Orabug: 24823234]  
  - ocfs2: fix deadlock issue when taking inode lock at vfs entry points (Eric Ren)  [Orabug: 25671723]  
  - ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock (Eric Ren)  [Orabug: 25671723]  
  - net/packet: fix overflow in check for tp_reserve (Andrey Konovalov)  [Orabug: 26143563]  {CVE-2017-7308} 
  - net/packet: fix overflow in check for tp_frame_nr (Andrey Konovalov)  [Orabug: 26143563]  {CVE-2017-7308} 
  - char: lp: fix possible integer overflow in lp_setup() (Willy Tarreau)  [Orabug: 26403941]  {CVE-2017-1000363} 
  - ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT (Takashi Iwai)  [Orabug: 26403958]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race between read and ioctl (Takashi Iwai)  [Orabug: 26403958]  {CVE-2017-1000380} 
  - ALSA: timer: fix NULL pointer dereference in read()/ioctl() race (Vegard Nossum)  [Orabug: 26403958]  {CVE-2017-1000380} 
  - ALSA: timer: Fix negative queue usage by racy accesses (Takashi Iwai)  [Orabug: 26403958]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race at concurrent reads (Takashi Iwai)  [Orabug: 26403958]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race among timer ioctls (Takashi Iwai)  [Orabug: 26403958]  {CVE-2017-1000380} 
  - ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() (Ben Hutchings)  [Orabug: 26403974]  {CVE-2017-9074} 
  - ipv6: Check ip6_find_1stfragopt() return value properly. (David S. Miller)  [Orabug: 26403974]  {CVE-2017-9074} 
  - ipv6: Prevent overrun when parsing v6 header options (Craig Gallek)  [Orabug: 26403974]  {CVE-2017-9074} 
  - ipv6/dccp: do not inherit ipv6_mc_list from parent (WANG Cong)  [Orabug: 26404007]  {CVE-2017-9077} 
  - aio: mark AIO pseudo-fs noexec (Jann Horn)  [Orabug: 26643601]  {CVE-2016-10044} 
  - vfs: Commit to never having exectuables on proc and sysfs. (Eric W. Biederman)  [Orabug: 26643601]  {CVE-2016-10044} 
  - vfs, writeback: replace FS_CGROUP_WRITEBACK with SB_I_CGROUPWB (Tejun Heo)  [Orabug: 26643601]  {CVE-2016-10044} 
  - x86/acpi: Prevent out of bound access caused by broken ACPI tables (Seunghun Han)  [Orabug: 26643652]  {CVE-2017-11473} 
  - sctp: do not inherit ipv6_{mc|ac|fl}_list from parent (Eric Dumazet)  [Orabug: 26650889]  {CVE-2017-9075} 
  - saa7164: fix double fetch PCIe access condition (Steven Toth)  [Orabug: 26675148]  {CVE-2017-8831} 
  - saa7164: fix sparse warnings (Hans Verkuil)  [Orabug: 26675148]  {CVE-2017-8831} 
  - saa7164: get rid of warning: no previous prototype (Mauro Carvalho Chehab)  [Orabug: 26675148]  {CVE-2017-8831} 
  - [scsi] lpfc 8.3.44: Fix kernel panics from corrupted ndlp (James Smart)  [Orabug: 26765341]  
  - timerfd: Protect the might cancel mechanism proper (Thomas Gleixner)  [Orabug: 26899791]  {CVE-2017-10661} 
  - scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly (Xin Long)  [Orabug: 26988628]  {CVE-2017-14489} 
  - mqueue: fix a use-after-free in sys_mq_notify() (Cong Wang)  [Orabug: 26643562]  {CVE-2017-11176} 
  - ipv6: avoid overflow of offset in ip6_find_1stfragopt (Sabrina Dubroca)  [Orabug: 27011278]  {CVE-2017-7542} 
  - packet: fix tp_reserve race in packet_set_ring (Willem de Bruijn)  [Orabug: 27002453]  {CVE-2017-1000111} 
  - mlx4_core: calculate log_mtt based on total system memory (Wei Lin Guay)  [Orabug: 26867355]  
  - xen/x86: Add interface for querying amount of host memory (Boris Ostrovsky)  [Orabug: 26867355]  
  - fs/binfmt_elf.c: fix bug in loading of PIE binaries (Michael Davidson)  [Orabug: 26870958]  {CVE-2017-1000253} 
  - Bluetooth: Properly check L2CAP config option output buffer length (Ben Seri)  [Orabug: 26796428]  {CVE-2017-1000251} 
  - xen: fix bio vec merging (Roger Pau Monne)  [Orabug: 26645562]  {CVE-2017-12134} 
  - fs/exec.c: account for argv/envp pointers (Kees Cook)  [Orabug: 26638926]  {CVE-2017-1000365} {CVE-2017-1000365} 
  - l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() (Guillaume Nault)  [Orabug: 26586050]  {CVE-2016-10200} 
  - xfs: fix two memory leaks in xfs_attr_list.c error paths (Mateusz Guzik)  [Orabug: 26586024]  {CVE-2016-9685} 
  - KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings (David Howells)  [Orabug: 26586002]  {CVE-2016-9604} 
  - ipv6: fix out of bound writes in __ip6_append_data() (Eric Dumazet)  [Orabug: 26578202]  {CVE-2017-9242} 
  - selinux: quiet the filesystem labeling behavior message (Paul Moore)  [Orabug: 25721485]  
  - RDS/IB: active bonding port state fix for intfs added late (Mukesh Kacker)  [Orabug: 25875426]  
  - HID: hid-cypress: validate length of report (Greg Kroah-Hartman)  [Orabug: 25891914]  {CVE-2017-7273} 
  - udf: Remove repeated loads blocksize (Jan Kara)  [Orabug: 25905722]  {CVE-2015-4167} 
  - udf: Check length of extended attributes and allocation descriptors (Jan Kara)  [Orabug: 25905722]  {CVE-2015-4167} 
  - udf: Verify i_size when loading inode (Jan Kara)  [Orabug: 25905722]  {CVE-2015-4167} 
  - btrfs: drop unused parameter from btrfs_item_nr (Ross Kirk)  [Orabug: 25948102]  {CVE-2014-9710} 
  - Btrfs: cleanup of function where fixup_low_keys() is called (Tsutomu Itoh)  [Orabug: 25948102]  {CVE-2014-9710} 
  - Btrfs: remove unused argument of fixup_low_keys() (Tsutomu Itoh)  [Orabug: 25948102]  {CVE-2014-9710} 
  - Btrfs: remove unused argument of btrfs_extend_item() (Tsutomu Itoh)  [Orabug: 25948102]  {CVE-2014-9710} 
  - Btrfs: add support for asserts (Josef Bacik)  [Orabug: 25948102]  {CVE-2014-9710} 
  - Btrfs: make xattr replace operations atomic (Filipe Manana)  [Orabug: 25948102]  {CVE-2014-9710} 
  - net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom (Al Viro)  [Orabug: 25948149]  {CVE-2015-2686} 
  - xsigo: Compute node crash on FC failover (Joe Jin)  [Orabug: 25965445]  
  - PCI: Prevent VPD access for QLogic ISP2722 (Ethan Zhao)  [Orabug: 25975513]  
  - PCI: Prevent VPD access for buggy devices (Babu Moger)  [Orabug: 25975513]  
  - ipv4: try to cache dst_entries which would cause a redirect (Hannes Frederic Sowa)  [Orabug: 26032377]  {CVE-2015-1465} 
  - mm: larger stack guard gap, between vmas (Hugh Dickins)  [Orabug: 26326145]  {CVE-2017-1000364} 
  - nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields)  [Orabug: 26366024]  {CVE-2017-7645} 
  - dm mpath: allow ioctls to trigger pg init (Mikulas Patocka)  [Orabug: 25645229]  
  - xen/manage: Always freeze/thaw processes when suspend/resuming (Ross Lagerwall)  [Orabug: 25795530]  
  - lpfc cannot establish connection with targets that send PRLI under P2P mode (Joe Jin)  [Orabug: 25955028]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.298.2.el6uek]
changelog:
  - x86: Use PRED_CMD MSR when ibpb is enabled (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/spec: Don't print the Missing arguments for option spectre_v2 (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: Move ENABLE_IBRS in the interrupt macro (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - Add set_ibrs_disabled and set_ibpb_disabled (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/boot: Add early cmdline parsing for options with arguments (Tom Lendacky)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86, boot: Carve out early cmdline parsing function (Borislav Petkov)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: Fix kABI build breakage (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: Add command-line options 'spectre_v2' and 'nospectre_v2' (Kanth Ghatraju)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/mm: Set IBPB upon context switch (Brian Maly)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: Display correct settings for the SPECTRE_V2 bug (Kanth Ghatraju)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - Set CONFIG_GENERIC_CPU_VULNERABILITIES flag (Kanth Ghatraju)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/cpu: Implement CPU vulnerabilites sysfs functions (Thomas Gleixner)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - sysfs/cpu: Fix typos in vulnerability documentation (David Woodhouse)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - sysfs/cpu: Add vulnerability folder (Thomas Gleixner)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86, cpu: Expand cpufeature facility to include cpu bugs (Borislav Petkov)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] (David Woodhouse)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/cpufeatures: Add X86_BUG_CPU_MELTDOWN (Kanth Ghatraju)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/spec: STUFF_RSB _before_ ENABLE_IBRS (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: Move STUFF_RSB in to the idt macro (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/IBRS/IBPB: Set sysctl_ibrs/ibpb_enabled properly (Boris Ostrovsky)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/IBRS: Make sure we restore MSR_IA32_SPEC_CTRL to a valid value (Boris Ostrovsky)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/spec_ctrl: Add missing 'lfence' when IBRS is not supported (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/ia32: Move STUFF_RSB And ENABLE_IBRS (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: Use IBRS for firmware update path (David Woodhouse)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/spec_ctrl: Disable if running as Xen PV guest (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/microcode: Recheck IBRS features on microcode reload (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/idle: Disable IBRS entering idle and enable it on wakeup (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/enter: Use IBRS on syscall and interrupts (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/enter: MACROS to set/clear IBRS and set IBPB (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/feature: Detect the x86 IBRS feature to control Speculation (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: fix build breakage (Brian Maly)  [Orabug: 27346425]  {CVE-2017-5753} 
  - kaiser: rename X86_FEATURE_KAISER to X86_FEATURE_PTI to match upstream (Mike Kravetz)   {CVE-2017-5754} 
  - x86/kaiser: Check boottime cmdline params (Mike Kravetz)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling (Borislav Petkov)  [Orabug: 27333761]  {CVE-2017-5754} 
  - KPTI: Report when enabled (Mike Kravetz)  [Orabug: 27333761]  {CVE-2017-5754} 
  - PTI: unbreak EFI old_memmap (Jiri Kosina)  [Orabug: 27333761] [Orabug: 27333760]  {CVE-2017-5754} 
  - kaiser: Set _PAGE_NX only if supported (Guenter Roeck)  [Orabug: 27333761] [Orabug: 27333760]  {CVE-2017-5754} 
  - KPTI: Rename to PAGE_TABLE_ISOLATION (Kees Cook)  [Orabug: 27333761]  {CVE-2017-5754} 
  - kaiser: kaiser_flush_tlb_on_return_to_user() check PCID (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - kaiser: asm/tlbflush.h handle noPGE at lower level (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/alternatives: add asm ALTERNATIVE macro (Mike Kravetz)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/kaiser: Reenable PARAVIRT, dynamically disable KAISER if PARAVIRT (Borislav Petkov)  [Orabug: 27333761]  {CVE-2017-5754} 
  - kaiser: add "nokaiser" boot option, using ALTERNATIVE (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86-32: Fix boot with CONFIG_X86_INVD_BUG (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - kaiser: alloc_ldt_struct() use get_zeroed_page() (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - kaiser: user_map __kprobes_text too (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm/kaiser: re-enable vsyscalls (Andrea Arcangeli)  [Orabug: 27333761]  {CVE-2017-5754} 
  - KAISER: Kernel Address Isolation (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: fix bad backport to disable PCID on Xen (Borislav Petkov)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm/64: Fix reboot interaction with CR4.PCIDE (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Enable CR4.PCIDE on supported systems (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Add the 'nopcid' boot option to turn off PCID (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Disable PCID on 32-bit kernels (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off() (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm, sched/core: Turn off IRQs in switch_mm() (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm, sched/core: Uninline switch_mm() (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Build arch/x86/mm/tlb.c even on !SMP (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - sched/core: Add switch_mm_irqs_off() and use it in the scheduler (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - mm/mmu_context, sched/core: Fix mmu_context.h assumption (Ingo Molnar)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: If INVPCID is available, use it to flush global mappings (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Fix INVPCID asm constraint (Borislav Petkov)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Add INVPCID helpers (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86, cpufeature: Add CPU features from Intel document 319433-012A (H. Peter Anvin)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/paravirt: Dont patch flush_tlb_single (Thomas Gleixner)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86-64: Map the HPET NX (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/ldt: Make modify_ldt synchronous (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} {CVE-2015-5157} 
  - x86, cpu: Add cpufeature flag for PCIDs (Arun Thomas)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Disable preemption during CR3 read+write (Sebastian Andrzej Siewior)  [Orabug: 27333761]  {CVE-2017-5754} 
  - locking/barriers: fix compile issue (Brian Maly)  [Orabug: 27346425]  {CVE-2017-5753} 
  - x86: Add another set of MSR accessor functions (Borislav Petkov)  [Orabug: 27346425]  {CVE-2017-5753} 
  - udf: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - fs: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - qla2xxx: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - p54: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - carl9170: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - uvcvideo: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - locking/barriers: introduce new observable speculation barrier (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - x86/cpu/AMD: Make the LFENCE instruction serialized (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.298.3.el6uek]
changelog:
  - ext4: limit group search loop for non-extent files (Lachlan McIlroy)  [Orabug: 17488415]  
  - ext4: fixup 64-bit divides in 3.0-stable backport of upstream fix (Todd Poynor)  [Orabug: 17488415]  
  - ext4: use atomic64_t for the per-flexbg free_clusters count (Theodore Ts'o)  [Orabug: 17488415]  
  - ext4: init pagevec in ext4_da_block_invalidatepages (Eric Sandeen)  [Orabug: 17488415]  
  - ext4: do not try to write superblock on ro remount w/o journal (Michael Tokarev)  [Orabug: 17488415]  
  - xen-netback: fix grant_copy_op array size (Niranjan Patil)  [Orabug: 25653941]  
  - xen-netback: explicitly check max_slots_needed against meta_prod counter (Niranjan Patil)  [Orabug: 25653941]  
  - xen-netback: Fix handling of skbs requiring too many slots (Zoltan Kiss)  [Orabug: 25653941]  
  - xen-netback: worse-case estimate in xenvif_rx_action is underestimating (Paul Durrant)  [Orabug: 25653941]  
  - xen-netback: Add worse-case estimates of max_slots_needed in netbk_rx_action (Niranjan Patil)  [Orabug: 25653941]  
  - KEYS: Remove key_type::match in favour of overriding default by match_preparse (Tim Tianyang Chen)  [Orabug: 25757946]  {CVE-2017-6951} 
  - xen/mmu: Call xen_cleanhighmap() with 4MB aligned for page tables mapping (Zhenzhong Duan)  [Orabug: 26737475]  
  - tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Wei Wang)  [Orabug: 26813391]  {CVE-2017-14106} 
  - rxrpc: Fix several cases where a padded len isn't checked in ticket decode (David Howells)  [Orabug: 26880520]  {CVE-2017-7482} {CVE-2017-7482} 
  - ocfs2: fstrim: Fix start offset of first cluster group during fstrim (Ashish Samant)  [Orabug: 27099836]  
  - Check validity of cl_rpcclient in nfs_server_list_show (Malahal Naineni)  [Orabug: 27112186]  
  - USB: serial: console: fix use-after-free after failed setup (Johan Hovold)  [Orabug: 27206839]  {CVE-2017-16525} 
  - ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor (Takashi Iwai)  [Orabug: 27206934]  {CVE-2017-16529} 
  - USB: fix out-of-bounds in usb_set_configuration (Greg Kroah-Hartman)  [Orabug: 27207243]  {CVE-2017-16531} 
  - dccp: CVE-2017-8824: use-after-free in DCCP code (Mohamed Ghannam)  [Orabug: 27290308]  {CVE-2017-8824}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.298.4.el6uek]
changelog:
  - ALSA: usb-audio: Kill stray URB at exiting (Takashi Iwai)  [Orabug: 27148283]  {CVE-2017-16527} 
  - uwb: properly check kthread_run return value (Andrey Konovalov)  [Orabug: 27206900]  {CVE-2017-16526} 
  - HID: usbhid: fix out-of-bounds bug (Jaejoong Kim)  [Orabug: 27207935]  {CVE-2017-16533} 
  - cx231xx-cards: fix NULL-deref on missing association descriptor (Johan Hovold)  [Orabug: 27208080]  {CVE-2017-16536} 
  - net: cdc_ether: fix divide by 0 on bad descriptors (Bjørn Mork)  [Orabug: 27215206]  {CVE-2017-16649} 
  - Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket (Al Viro)  [Orabug: 27344787]  {CVE-2017-15868} 
  - Bluetooth: hidp: verify l2cap sockets (David Herrmann)  [Orabug: 27344787]  {CVE-2017-15868} 
  - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)  [Orabug: 27344840]  {CVE-2017-0861} {CVE-2017-0861} 
  - Addendum: x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (David Woodhouse)  [Orabug: 27516441]  
  - x86/cpufeature: Add X86_FEATURE_IA32_ARCH_CAPS and X86_FEATURE_IBRS_ATT (David Woodhouse)  [Orabug: 27649498]  {CVE-2017-5715} 
  - x86/cpufeatures: Clean up Spectre v2 related CPUID flags (David Woodhouse)  [Orabug: 27649510]  {CVE-2017-5715} 
  - x86/spectre: Now that we expose 'stbibp' make sure it is correct. (Konrad Rzeszutek Wilk)  [Orabug: 27649631]  {CVE-2017-5715} 
  - x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support (KarimAllah Ahmed)  [Orabug: 27649640]  {CVE-2017-5715} 
  - x86: Add STIBP feature enumeration (David Woodhouse)  [Orabug: 27649693]  {CVE-2017-5715} 
  - x86/cpu/AMD: Add speculative control support for AMD (Tom Lendacky)  [Orabug: 27649706]  {CVE-2017-5715} 
  - x86/spectre_v2: Don't spam the console with these: (Konrad Rzeszutek Wilk)  [Orabug: 27649723]  {CVE-2017-5715} 
  - x86/spectre_v2: Remove 0xc2 from spectre_bad_microcodes (Darren Kenny)  [Orabug: 27600848]  
  - Revert "x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation" (Konrad Rzeszutek Wilk)  [Orabug: 27601773]  
  - x86/syscall: run syscall exit code with extra registers cleared (Alexandre Chartre)  [Orabug: 27501176]  
  - x86/syscall: run syscall-specific code with extra registers cleared (Alexandre Chartre)  [Orabug: 27501176]  
  - x86/syscall: run syscall entry code with extra registers cleared (Alexandre Chartre)  [Orabug: 27501176]  
  - x86/spectre: Drop the warning about ibrs being obsolete (Konrad Rzeszutek Wilk)  [Orabug: 27518974]  
  - x86: Include linux/device.h in bugs_64.c (Boris Ostrovsky)  [Orabug: 27519044]  
  - x86: fix mitigation details of UEK2 spectre v1 (Konrad Rzeszutek Wilk)  [Orabug: 27509909]  
  - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (David Woodhouse)  [Orabug: 27516441]  {CVE-2017-5715} 
  - x86, intel: Output microcode revision in /proc/cpuinfo (Andi Kleen)  [Orabug: 27516441]  
  - x86: intel-family.h: Add GEMINI_LAKE SOC (Len Brown)  [Orabug: 27516441]  
  - x86/cpu/intel: Introduce macros for Intel family numbers (Dave Hansen)  [Orabug: 27516441]  
  - x86/mitigation/spectre_v2: Add reporting of 'lfence' (Konrad Rzeszutek Wilk)  [Orabug: 27525958]  
  - x86/spec: Add 'lfence_enabled' in sysfs (Konrad Rzeszutek Wilk)  [Orabug: 27525954]  
  - x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation (Konrad Rzeszutek Wilk)  [Orabug: 27525923]  
  - x86/spec: Also print IBRS if IBPB is disabled (Konrad Rzeszutek Wilk)  [Orabug: 27519083]  
  - x86: Use Indirect Branch Prediction Barrier in context switch (Tim Chen)  [Orabug: 27516378]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.298.5.el6uek]
changelog:
  - xen-netfront: fix rx stall when req_prod_pvt goes back to more than zero again (Dongli Zhang)  [Orabug: 25053376]  
  - x86/IBRS: Remove support for IBRS_ENABLED_USER mode (Boris Ostrovsky)  [Orabug: 27430615]  
  - x86/microcode/intel: Disable late loading on model 79 (Borislav Petkov)  [Orabug: 27343579]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.298.6.el6uek]
changelog:
  - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds)  [Orabug: 27947612]  {CVE-2018-100199}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.298.7.el6uek]
changelog:
  - net/rds: Fix endless RNR situation (Håkon Bugge)  [Orabug: 27645402]  
  - x86/entry/64: Dont use IST entry for #BP stack (Andy Lutomirski)   {CVE-2018-8897}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.299.1.el6uek]
changelog:
  - ext4/jbd2: don't wait (forever) for stale tid caused by wraparound (Theodore Ts'o)  [Orabug: 26424268]  
  - jbd2: don't wake kjournald unnecessarily (Eric Sandeen)  [Orabug: 26424268]  
  - ext4: fix data corruption in inodes with journalled data (Jan Kara)  [Orabug: 26424268]  
  - media: imon: Fix null-ptr-deref in imon_probe (Arvind Yadav)  [Orabug: 27208383]  {CVE-2017-16537} 
  - Input: gtco - fix potential out-of-bound access (Dmitry Torokhov)  [Orabug: 27215095]  {CVE-2017-16643} 
  - RDS: IB: Fix null pointer issue (Guanglei Li)  [Orabug: 27241654]  
  - usb: usbtest: fix NULL pointer dereference (Alan Stern)  [Orabug: 27602321]  {CVE-2017-16532} 
  - vfs,proc: guarantee unique inodes in /proc (Linus Torvalds)  [Orabug: 27637293]  
  - vfs: dont chain pipe/anon/socket on superblock s_inodes list (Eric Dumazet)  [Orabug: 27637293]  
  - fuse: fix deadlock caused by wrong locking order (Junxiao Bi)  [Orabug: 27719848]  
  - jbd: don't wait (forever) for stale tid caused by wraparound (Jan Kara)  [Orabug: 27734012]  
  - netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets (Florian Westphal)  [Orabug: 27774010]  {CVE-2018-1068} 
  - x86/spec: set_ibrs[ibpb]_disabled() should disable ibrs[ibpb]_admin_disabled (Krish Sadhukhan)  [Orabug: 27788624]  
  - x86/spec: Fix wrong output from sysfs (Krish Sadhukhan)  [Orabug: 27795350]  
  - x86/spec: Fix spectre_v1 bug and mitigation indicators (John Haxby)  [Orabug: 27811437]  
  - ext4: add validity checks for bitmap block numbers (Theodore Ts'o)  [Orabug: 27854370]  {CVE-2018-1093} {CVE-2018-1093} 
  - x86/microcode: probe CPU features on microcode update (Ankur Arora)  [Orabug: 27878228]  
  - x86/microcode: microcode_write() should not reference boot_cpu_data (Ankur Arora)  [Orabug: 27878228]  
  - x86/cpufeatures: use cpu_data in scan_spec_ctrl_features and rescan_spec_ctrl_features (Ankur Arora)  [Orabug: 27878228]  
  - USB: core: prevent malicious bNumInterfaces overflow (Alan Stern)  [Orabug: 27898064]  {CVE-2017-17558} 
  - retpoline: microcode incorrectly reported as broken during early boot (Chuck Anderson)  [Orabug: 27915293]  
  - x86/spec: scan_spec_ctrl_feature should be executed only for cpu_index 0 (Krish Sadhukhan)  [Orabug: 27915355]  
  - RDS: Heap OOB write in rds_message_alloc_sgs() (Mohamed Ghannam)  [Orabug: 27934081]  {CVE-2018-5332} 
  - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen)  [Orabug: 27989490]  {CVE-2018-10323} 
  - net/rds: Fix endless RNR situation (Håkon Bugge)  [Orabug: 27645402]  
  - x86/entry/64: Dont use IST entry for #BP stack (Andy Lutomirski)   {CVE-2018-8897} 
  - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds)  [Orabug: 27947612]  {CVE-2018-100199} 
  - xen-netfront: fix rx stall when req_prod_pvt goes back to more than zero again (Dongli Zhang)  [Orabug: 25053376]  
  - x86/IBRS: Remove support for IBRS_ENABLED_USER mode (Boris Ostrovsky)  [Orabug: 27430615]  
  - x86/microcode/intel: Disable late loading on model 79 (Borislav Petkov)  [Orabug: 27343579]  
  - ALSA: usb-audio: Kill stray URB at exiting (Takashi Iwai)  [Orabug: 27148283]  {CVE-2017-16527} 
  - uwb: properly check kthread_run return value (Andrey Konovalov)  [Orabug: 27206900]  {CVE-2017-16526} 
  - HID: usbhid: fix out-of-bounds bug (Jaejoong Kim)  [Orabug: 27207935]  {CVE-2017-16533} 
  - cx231xx-cards: fix NULL-deref on missing association descriptor (Johan Hovold)  [Orabug: 27208080]  {CVE-2017-16536} 
  - net: cdc_ether: fix divide by 0 on bad descriptors (Bjørn Mork)  [Orabug: 27215206]  {CVE-2017-16649} 
  - Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket (Al Viro)  [Orabug: 27344787]  {CVE-2017-15868} 
  - Bluetooth: hidp: verify l2cap sockets (David Herrmann)  [Orabug: 27344787]  {CVE-2017-15868} 
  - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)  [Orabug: 27344840]  {CVE-2017-0861} {CVE-2017-0861} 
  - Addendum: x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (David Woodhouse)  [Orabug: 27516441]  
  - x86/cpufeature: Add X86_FEATURE_IA32_ARCH_CAPS and X86_FEATURE_IBRS_ATT (David Woodhouse)  [Orabug: 27649498]  {CVE-2017-5715} 
  - x86/cpufeatures: Clean up Spectre v2 related CPUID flags (David Woodhouse)  [Orabug: 27649510]  {CVE-2017-5715} 
  - x86/spectre: Now that we expose 'stbibp' make sure it is correct. (Konrad Rzeszutek Wilk)  [Orabug: 27649631]  {CVE-2017-5715} 
  - x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support (KarimAllah Ahmed)  [Orabug: 27649640]  {CVE-2017-5715} 
  - x86: Add STIBP feature enumeration (David Woodhouse)  [Orabug: 27649693]  {CVE-2017-5715} 
  - x86/cpu/AMD: Add speculative control support for AMD (Tom Lendacky)  [Orabug: 27649706]  {CVE-2017-5715} 
  - x86/spectre_v2: Don't spam the console with these: (Konrad Rzeszutek Wilk)  [Orabug: 27649723]  {CVE-2017-5715} 
  - x86/spectre_v2: Remove 0xc2 from spectre_bad_microcodes (Darren Kenny)  [Orabug: 27600848]  
  - Revert "x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation" (Konrad Rzeszutek Wilk)  [Orabug: 27601773]  
  - x86/syscall: run syscall exit code with extra registers cleared (Alexandre Chartre)  [Orabug: 27501176]  
  - x86/syscall: run syscall-specific code with extra registers cleared (Alexandre Chartre)  [Orabug: 27501176]  
  - x86/syscall: run syscall entry code with extra registers cleared (Alexandre Chartre)  [Orabug: 27501176]  
  - x86/spectre: Drop the warning about ibrs being obsolete (Konrad Rzeszutek Wilk)  [Orabug: 27518974]  
  - x86: Include linux/device.h in bugs_64.c (Boris Ostrovsky)  [Orabug: 27519044]  
  - x86: fix mitigation details of UEK2 spectre v1 (Konrad Rzeszutek Wilk)  [Orabug: 27509909]  
  - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (David Woodhouse)  [Orabug: 27516441]  {CVE-2017-5715} 
  - x86, intel: Output microcode revision in /proc/cpuinfo (Andi Kleen)  [Orabug: 27516441]  
  - x86: intel-family.h: Add GEMINI_LAKE SOC (Len Brown)  [Orabug: 27516441]  
  - x86/cpu/intel: Introduce macros for Intel family numbers (Dave Hansen)  [Orabug: 27516441]  
  - x86/mitigation/spectre_v2: Add reporting of 'lfence' (Konrad Rzeszutek Wilk)  [Orabug: 27525958]  
  - x86/spec: Add 'lfence_enabled' in sysfs (Konrad Rzeszutek Wilk)  [Orabug: 27525954]  
  - x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation (Konrad Rzeszutek Wilk)  [Orabug: 27525923]  
  - x86/spec: Also print IBRS if IBPB is disabled (Konrad Rzeszutek Wilk)  [Orabug: 27519083]  
  - x86: Use Indirect Branch Prediction Barrier in context switch (Tim Chen)  [Orabug: 27516378]  
  - ext4: limit group search loop for non-extent files (Lachlan McIlroy)  [Orabug: 17488415]  
  - ext4: fixup 64-bit divides in 3.0-stable backport of upstream fix (Todd Poynor)  [Orabug: 17488415]  
  - ext4: use atomic64_t for the per-flexbg free_clusters count (Theodore Ts'o)  [Orabug: 17488415]  
  - ext4: init pagevec in ext4_da_block_invalidatepages (Eric Sandeen)  [Orabug: 17488415]  
  - ext4: do not try to write superblock on ro remount w/o journal (Michael Tokarev)  [Orabug: 17488415]  
  - xen-netback: fix grant_copy_op array size (Niranjan Patil)  [Orabug: 25653941]  
  - xen-netback: explicitly check max_slots_needed against meta_prod counter (Niranjan Patil)  [Orabug: 25653941]  
  - xen-netback: Fix handling of skbs requiring too many slots (Zoltan Kiss)  [Orabug: 25653941]  
  - xen-netback: worse-case estimate in xenvif_rx_action is underestimating (Paul Durrant)  [Orabug: 25653941]  
  - xen-netback: Add worse-case estimates of max_slots_needed in netbk_rx_action (Niranjan Patil)  [Orabug: 25653941]  
  - KEYS: Remove key_type::match in favour of overriding default by match_preparse (Tim Tianyang Chen)  [Orabug: 25757946]  {CVE-2017-6951} 
  - xen/mmu: Call xen_cleanhighmap() with 4MB aligned for page tables mapping (Zhenzhong Duan)  [Orabug: 26737475]  
  - tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Wei Wang)  [Orabug: 26813391]  {CVE-2017-14106} 
  - rxrpc: Fix several cases where a padded len isn't checked in ticket decode (David Howells)  [Orabug: 26880520]  {CVE-2017-7482} {CVE-2017-7482} 
  - ocfs2: fstrim: Fix start offset of first cluster group during fstrim (Ashish Samant)  [Orabug: 27099836]  
  - Check validity of cl_rpcclient in nfs_server_list_show (Malahal Naineni)  [Orabug: 27112186]  
  - USB: serial: console: fix use-after-free after failed setup (Johan Hovold)  [Orabug: 27206839]  {CVE-2017-16525} 
  - ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor (Takashi Iwai)  [Orabug: 27206934]  {CVE-2017-16529} 
  - USB: fix out-of-bounds in usb_set_configuration (Greg Kroah-Hartman)  [Orabug: 27207243]  {CVE-2017-16531} 
  - dccp: CVE-2017-8824: use-after-free in DCCP code (Mohamed Ghannam)  [Orabug: 27290308]  {CVE-2017-8824} 
  - x86: Use PRED_CMD MSR when ibpb is enabled (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/spec: Don't print the Missing arguments for option spectre_v2 (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: Move ENABLE_IBRS in the interrupt macro (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - Add set_ibrs_disabled and set_ibpb_disabled (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/boot: Add early cmdline parsing for options with arguments (Tom Lendacky)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86, boot: Carve out early cmdline parsing function (Borislav Petkov)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: Fix kABI build breakage (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: Add command-line options 'spectre_v2' and 'nospectre_v2' (Kanth Ghatraju)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/mm: Set IBPB upon context switch (Brian Maly)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: Display correct settings for the SPECTRE_V2 bug (Kanth Ghatraju)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - Set CONFIG_GENERIC_CPU_VULNERABILITIES flag (Kanth Ghatraju)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/cpu: Implement CPU vulnerabilites sysfs functions (Thomas Gleixner)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - sysfs/cpu: Fix typos in vulnerability documentation (David Woodhouse)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - sysfs/cpu: Add vulnerability folder (Thomas Gleixner)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86, cpu: Expand cpufeature facility to include cpu bugs (Borislav Petkov)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] (David Woodhouse)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/cpufeatures: Add X86_BUG_CPU_MELTDOWN (Kanth Ghatraju)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/spec: STUFF_RSB _before_ ENABLE_IBRS (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: Move STUFF_RSB in to the idt macro (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/IBRS/IBPB: Set sysctl_ibrs/ibpb_enabled properly (Boris Ostrovsky)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/IBRS: Make sure we restore MSR_IA32_SPEC_CTRL to a valid value (Boris Ostrovsky)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/spec_ctrl: Add missing 'lfence' when IBRS is not supported (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/ia32: Move STUFF_RSB And ENABLE_IBRS (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: Use IBRS for firmware update path (David Woodhouse)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/spec_ctrl: Disable if running as Xen PV guest (Konrad Rzeszutek Wilk)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/microcode: Recheck IBRS features on microcode reload (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/idle: Disable IBRS entering idle and enable it on wakeup (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/enter: Use IBRS on syscall and interrupts (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/enter: MACROS to set/clear IBRS and set IBPB (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/feature: Detect the x86 IBRS feature to control Speculation (Tim Chen)  [Orabug: 27369777]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86: fix build breakage (Brian Maly)  [Orabug: 27346425]  {CVE-2017-5753} 
  - kaiser: rename X86_FEATURE_KAISER to X86_FEATURE_PTI to match upstream (Mike Kravetz)   {CVE-2017-5754} 
  - x86/kaiser: Check boottime cmdline params (Mike Kravetz)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling (Borislav Petkov)  [Orabug: 27333761]  {CVE-2017-5754} 
  - KPTI: Report when enabled (Mike Kravetz)  [Orabug: 27333761]  {CVE-2017-5754} 
  - PTI: unbreak EFI old_memmap (Jiri Kosina)  [Orabug: 27333761] [Orabug: 27333760]  {CVE-2017-5754} 
  - kaiser: Set _PAGE_NX only if supported (Guenter Roeck)  [Orabug: 27333761] [Orabug: 27333760]  {CVE-2017-5754} 
  - KPTI: Rename to PAGE_TABLE_ISOLATION (Kees Cook)  [Orabug: 27333761]  {CVE-2017-5754} 
  - kaiser: kaiser_flush_tlb_on_return_to_user() check PCID (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - kaiser: asm/tlbflush.h handle noPGE at lower level (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/alternatives: add asm ALTERNATIVE macro (Mike Kravetz)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/kaiser: Reenable PARAVIRT, dynamically disable KAISER if PARAVIRT (Borislav Petkov)  [Orabug: 27333761]  {CVE-2017-5754} 
  - kaiser: add "nokaiser" boot option, using ALTERNATIVE (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86-32: Fix boot with CONFIG_X86_INVD_BUG (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - kaiser: alloc_ldt_struct() use get_zeroed_page() (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - kaiser: user_map __kprobes_text too (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm/kaiser: re-enable vsyscalls (Andrea Arcangeli)  [Orabug: 27333761]  {CVE-2017-5754} 
  - KAISER: Kernel Address Isolation (Hugh Dickins)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: fix bad backport to disable PCID on Xen (Borislav Petkov)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm/64: Fix reboot interaction with CR4.PCIDE (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Enable CR4.PCIDE on supported systems (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Add the 'nopcid' boot option to turn off PCID (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Disable PCID on 32-bit kernels (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off() (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm, sched/core: Turn off IRQs in switch_mm() (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm, sched/core: Uninline switch_mm() (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Build arch/x86/mm/tlb.c even on !SMP (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - sched/core: Add switch_mm_irqs_off() and use it in the scheduler (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - mm/mmu_context, sched/core: Fix mmu_context.h assumption (Ingo Molnar)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: If INVPCID is available, use it to flush global mappings (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Fix INVPCID asm constraint (Borislav Petkov)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Add INVPCID helpers (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86, cpufeature: Add CPU features from Intel document 319433-012A (H. Peter Anvin)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/paravirt: Dont patch flush_tlb_single (Thomas Gleixner)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86-64: Map the HPET NX (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/ldt: Make modify_ldt synchronous (Andy Lutomirski)  [Orabug: 27333761]  {CVE-2017-5754} {CVE-2015-5157} 
  - x86, cpu: Add cpufeature flag for PCIDs (Arun Thomas)  [Orabug: 27333761]  {CVE-2017-5754} 
  - x86/mm: Disable preemption during CR3 read+write (Sebastian Andrzej Siewior)  [Orabug: 27333761]  {CVE-2017-5754} 
  - locking/barriers: fix compile issue (Brian Maly)  [Orabug: 27346425]  {CVE-2017-5753} 
  - x86: Add another set of MSR accessor functions (Borislav Petkov)  [Orabug: 27346425]  {CVE-2017-5753} 
  - udf: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - fs: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - qla2xxx: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - p54: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - carl9170: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - uvcvideo: prevent speculative execution (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - locking/barriers: introduce new observable speculation barrier (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753} 
  - x86/cpu/AMD: Make the LFENCE instruction serialized (Elena Reshetova)  [Orabug: 27346425]  {CVE-2017-5753}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.299.2.el6uek]
changelog:
  - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds)  [Orabug: 27947612]  {CVE-2018-1000199} 
  - Revert "perf/hwbp: Simplify the perf-hwbp code, fix documentation" (Brian Maly)  [Orabug: 27947612]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.299.3.el6uek]
changelog:
  - x86/fpu: Make eager FPU default (Mihai Carabas)  [Orabug: 28156175]  {CVE-2018-3665} 
  - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai)  [Orabug: 22876528]  {CVE-2016-2549} 
  - ALSA: timer: Harden slave timer list handling (Takashi Iwai)  [Orabug: 22876528]  {CVE-2016-2547} {CVE-2016-2548} 
  - ALSA: timer: Fix double unlink of active_list (Takashi Iwai)  [Orabug: 22876528]  {CVE-2016-2545} 
  - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai)  [Orabug: 22876528]  {CVE-2016-2543} 
  - ALSA: seq: Fix race at timer setup and close (Takashi Iwai)  [Orabug: 22876528]  {CVE-2016-2544} 
  - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov)  [Orabug: 22876528]  {CVE-2016-2384} 
  - mlx4_ib: DREQ silently dropped by PF passive side (Venkat Venkatsubra)  [Orabug: 25090540]  
  - net: tcpdump fails with EFAULT (Venkat Venkatsubra)  [Orabug: 25209691]  
  - x86/spec: Remove rescan_spec_ctrl_feature as it's not needed anymore (Krish Sadhukhan)  [Orabug: 27934121]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.300.2.el6uek]
changelog:
  - Revert "RDS: don't commit to queue till transport connection is up" (Santosh Shilimkar)  [Orabug: 27619034]  
  - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li)  [Orabug: 27951293]  {CVE-2017-17741} {CVE-2017-17741} 
  - kernel/exit.c: avoid undefined behaviour when calling wait4() wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 (mridula shastry)  [Orabug: 28049790]  {CVE-2018-10087} 
  - kernel/signal.c: avoid undefined behaviour in kill_something_info When running kill(72057458746458112, 0) in userspace I hit the following issue. (mridula shastry)  [Orabug: 28082989]  {CVE-2018-10124} 
  - bluetooth: Validate socket address length in sco_sock_bind(). (mlevatic)  [Orabug: 28130291]  {CVE-2015-8575} 
  - x86/bug: Fix typo's from commit b2d2b5b2 (x86/fpu: Make eager FPU default) (Mihai Carabas)  [Orabug: 28194606]  
  - dccp: check sk for closed state in dccp_sendmsg() (Alexey Kodanev)  [Orabug: 28220512]  {CVE-2017-8824} {CVE-2018-1130} 
  - mm/mempolicy.c: fix error handling in set_mempolicy and mbind. (Chris Salls)  [Orabug: 28242479]  {CVE-2017-7616} 
  - xfrm: policy: check policy direction value (Vladis Dronov)  [Orabug: 28264531]  {CVE-2017-11600} {CVE-2017-11600}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.301.1.el6uek]
changelog:
  - x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit (Vlastimil Babka)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Exempt zeroed PTEs from inversion (Sean Christopherson)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect PAE swap entries against L1TF (Vlastimil Babka)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Extend 64bit swap file size limit (Vlastimil Babka)  [Orabug: 28505519]  {CVE-2018-3620} 
  - mm, fremap: mitigate L1TF in remap_file_pages (Daniel Jordan)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation: Don't mark cpu_no_l1tf __initconst (Boris Ostrovsky)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/mm/kmmio: Make the tracer robust against L1TF (Andi Kleen)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert (Andi Kleen)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Invert all not present mappings (Andi Kleen)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/bugs: Move the l1tf function and define pr_fmt properly (Konrad Rzeszutek Wilk)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Limit swap file size to MAX_PA/2 (Andi Kleen)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Andi Kleen)  [Orabug: 28505519]  {CVE-2018-3620} 
  - mm/pagewalk.c: prevent positive return value of walk_page_test() from being passed to callers (Naoya Horiguchi)  [Orabug: 28505519]  {CVE-2018-3620} 
  - mm: pagewalk: fix misbehavior of walk_page_range for vma(VM_PFNMAP) (Naoya Horiguchi)  [Orabug: 28505519]  {CVE-2018-3620} 
  - pagewalk: improve vma handling (Naoya Horiguchi)  [Orabug: 28505519]  {CVE-2018-3620} 
  - mm/pagewalk: remove pgd_entry() and pud_entry() (Naoya Horiguchi)  [Orabug: 28505519]  {CVE-2018-3620} 
  - mm/pagewalk.c: fix walk_page_range() access of wrong PTEs (Chen LinX)  [Orabug: 28505519]  {CVE-2018-3620} 
  - mm/pagewalk.c: walk_page_range should avoid VM_PFNMAP areas (Cliff Wickman)  [Orabug: 28505519]  {CVE-2018-3620} 
  - pagewalk: don't look up vma if walk->hugetlb_entry is unused (KOSAKI Motohiro)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Add sysfs reporting for l1tf (Andi Kleen)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/bugs: Concentrate bug reporting into a separate function (Konrad Rzeszutek Wilk)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/bugs: Concentrate bug detection into a separate function (Konrad Rzeszutek Wilk)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/cpufeature: Add X86_FEATURE_IA32_ARCH_CAPS and X86_FEATURE_IBRS_ATT (Konrad Rzeszutek Wilk)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Make sure the first page is always reserved (Andi Kleen)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Fix up pte->pfn conversion for PAE (Michal Hocko)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation (Andi Kleen)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect swap entries against L1TF (Linus Torvalds)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Change order of offset/type in swap entry (Linus Torvalds)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/mm: Fix swap entry comment and macro (Dave Hansen)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/mm: Move swap offset/type up in PTE to work around erratum (Dave Hansen)  [Orabug: 28505519]  {CVE-2018-3620} 
  - mm: x86 pgtable: drop unneeded preprocessor ifdef (Cyrill Gorcunov)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Andi Kleen)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/mm: Fix regression with huge pages on PAE (Kirill A. Shutemov)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Toshi Kani)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Toshi Kani)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/asm: Move PUD_PAGE macros to page_types.h (Toshi Kani)  [Orabug: 28505519]  {CVE-2018-3620} 
  - x86/cpufeature: uniquely define *IA32_ARCH_CAPS and *IBRS_ATT (Daniel Jordan)  [Orabug: 28505519]  {CVE-2018-3620} 
  - Disable kaiser if the cpu is not vulnerable to X86_BUG_CPU_MELTDOWN (Kanth Ghatraju)  [Orabug: 28001909]  
  - x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (David Woodhouse)  [Orabug: 28001909]  
  - x86/msr: Add definitions for IA32_ARCH_CAPABILITIES MSR (David Woodhouse)  [Orabug: 28001909]  
  - Add driver auto probing for x86 features v4 (Andi Kleen)  [Orabug: 28001909]  
  - mm/mempolicy: fix use after free when calling get_mempolicy (zhong jiang)  [Orabug: 28022110]  {CVE-2018-10675} 
  - xen-netback: do not requeue skb if xenvif is already disconnected (Dongli Zhang)  [Orabug: 28247698]  
  - posix-timer: Properly check sigevent->sigev_notify (Thomas Gleixner)  [Orabug: 28481397]  {CVE-2017-18344}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.301.2.el6uek]
changelog:
  - exec: Limit arg stack to at most 75% of _STK_LIM (Kees Cook)  [Orabug: 28710024]  {CVE-2018-14634}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.302.1.el6uek]
changelog:
  - Fix up non-directory creation in SGID directories (Linus Torvalds)  [Orabug: 28459479]  {CVE-2018-13405} 
  - ALSA: seq: Make ioctls race-free (Takashi Iwai)  [Orabug: 28459730]  {CVE-2018-7566} 
  - rds: CVE-2018-7492: Fix NULL pointer dereference in __rds_rdma_map (Håkon Bugge)  [Orabug: 28539910]  {CVE-2018-7492} 
  - cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status (Scott Bauer)  [Orabug: 28664549]  {CVE-2018-16658} 
  - ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c (Seunghun Han)  [Orabug: 28664580]  {CVE-2017-13695} 
  - exec: Limit arg stack to at most 75% of _STK_LIM (Kees Cook)  [Orabug: 28710024]  {CVE-2018-14634}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.303.1.el6uek]
changelog:
  - scsi: libsas: fix memory leak in sas_smp_get_phy_events() (Jason Yan)  [Orabug: 27927686]  {CVE-2018-7757}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.304.1.el6uek]
changelog:
  - mnt: Prevent pivot_root from creating a loop in the mount tree (Eric W. Biederman)  [Orabug: 26575709]  {CVE-2014-7970} {CVE-2014-7970} 
  - vfs: more mnt_parent cleanups (Al Viro)  [Orabug: 26575709]  {CVE-2014-7970} 
  - vfs: new internal helper: mnt_has_parent(mnt) (Al Viro)  [Orabug: 26575709]  {CVE-2014-7970} 
  - ALSA: seq: Fix racy pool initializations (Takashi Iwai)  [Orabug: 28459730]  {CVE-2018-7566} 
  - xen-netback: calculate full_coalesce before the pre-estimation of ring buffer slots to consume (Dongli Zhang)  [Orabug: 28818690]  
  - scsi: sg: allocate with __GFP_ZERO in sg_build_indirect() (Alexander Potapenko)  [Orabug: 28892695]  {CVE-2018-1000204} 
  - KVM: MTRR: remove MSR 0x2f8 (Andy Honig)  [Orabug: 28901711]  {CVE-2016-3713} {CVE-2016-3713} 
  - cdrom: fix improper type cast, which can leat to information leak. (Young_X)  [Orabug: 28929788]  {CVE-2018-16658} {CVE-2018-10940} {CVE-2018-18710} 
  - udf: Check component length before reading it (Jan Kara)  [Orabug: 28941923]  {CVE-2014-9728} 
  - udf: Verify symlink size before loading it (Shan Hai)  [Orabug: 28941923]  {CVE-2014-9728} 
  - udf: Verify i_size when loading inode (Shan Hai)  [Orabug: 28941923]  {CVE-2014-9728} 
  - floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl (Andy Whitcroft)  [Orabug: 28956549]  {CVE-2018-7755} {CVE-2018-7755} 
  - crypto: salsa20 - fix blkcipher_walk API usage (Eric Biggers)  [Orabug: 28976586]  {CVE-2017-17805} 
  - crypto: hmac - require that the underlying hash algorithm is unkeyed (Eric Biggers)  [Orabug: 28976655]  {CVE-2017-17806}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.305.1.el6uek]
changelog:
  - ipv6: tcp: add rcu locking in tcp_v6_send_synack() (Eric Dumazet)  [Orabug: 25059185]  {CVE-2016-3841} 
  - ipv6: add complete rcu protection around np->opt (Eric Dumazet)  [Orabug: 25059185]  {CVE-2016-3841} 
  - scsi: qla2xxx: Fix an integer overflow in sysfs code (Dan Carpenter)  [Orabug: 28220492]  {CVE-2017-14051} 
  - ext4: fail ext4_iget for root directory if unallocated (Theodore Ts'o)  [Orabug: 28220543]  {CVE-2018-1092} {CVE-2018-1092} 
  - ALSA: seq: Fix regression by incorrect ioctl_mutex usages (Takashi Iwai)  [Orabug: 29005191]  {CVE-2018-1000004} 
  - netfilter: xt_osf: Add missing permission checks (Kevin Cernekee)  [Orabug: 29037833]  {CVE-2017-17450} 
  - HID: debug: check length before copy_to_user() (Daniel Rosenberg)  [Orabug: 29128174]  {CVE-2018-9516} 
  - Input: i8042 - fix crash at boot time (Chen Hong)  [Orabug: 29152330]  {CVE-2017-18079}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.306.1.el6uek]
changelog:
  - ext4: validate that metadata blocks do not overlap superblock (Theodore Ts'o)  [Orabug: 28220576]  {CVE-2018-1094} 
  - Provide a NLM_F_* flag void dumping inet/inet6 stats in rtnl_if_info() (Manish Kumar Singh)  [Orabug: 28318718]  
  - btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized (Qu Wenruo)  [Orabug: 29301108]  {CVE-2018-14609}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.307.1.el6uek]
changelog:
  - proc: restrict kernel stack dumps to root (John Donnelly)  [Orabug: 29114880]  {CVE-2018-17972} 
  - alarmtimer: Prevent overflow for relative nanosleep (Thomas Gleixner)  [Orabug: 29269182]  {CVE-2018-13053} 
  - ext4: only look at the bg_flags field if it is valid (Theodore Ts'o)  [Orabug: 29409428]  {CVE-2018-10876} {CVE-2018-10876} 
  - vfs: Add sb_rdonly(sb) to query the MS_RDONLY flag on s_flags (David Howells)  [Orabug: 29409428]  {CVE-2018-10876} 
  - net: Set sk_prot_creator when cloning sockets to the right proto (Christoph Paasch)  [Orabug: 29422741]  {CVE-2018-9568}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.308.1.el6uek]
changelog:
  - x86/fpu: Fix 32-bit signal frame handling (Dave Hansen)  [Orabug: 28874707]  
  - x86/fpu: Factor out memset(xstate, 0) in fpu_finit() paths (Oleg Nesterov)  [Orabug: 28874707]  
  - x86/fpu: Always allow FPU in interrupt if use_eager_fpu() (Oleg Nesterov)  [Orabug: 28874707]  
  - x86/fpu: Don't do __thread_fpu_end() if use_eager_fpu() (Oleg Nesterov)  [Orabug: 28874707]  
  - x86/fpu: Don't reset thread.fpu_counter (Oleg Nesterov)  [Orabug: 28874707]  
  - x86, fpu: Fix math_state_restore() race with kernel_fpu_begin() (Oleg Nesterov)  [Orabug: 28874707]  
  - x86, fpu: Don't abuse has_fpu in __kernel_fpu_begin/end() (Oleg Nesterov)  [Orabug: 28874707]  
  - x86, fpu: Introduce per-cpu in_kernel_fpu state (Oleg Nesterov)  [Orabug: 28874707]  
  - x86, fpu: Check tsk_used_math() in kernel_fpu_end() for eager FPU (Suresh Siddha)  [Orabug: 28874707]  
  - x86: Allow FPU to be used at interrupt time even with eagerfpu (Pekka Riikonen)  [Orabug: 28874707]  
  - ext4: verify the depth of extent tree in ext4_find_extent() (Theodore Ts'o)  [Orabug: 29396714]  {CVE-2018-10877} {CVE-2018-10877} 
  - ext4: add more inode number paranoia checks (Theodore Ts'o)  [Orabug: 29545568]  {CVE-2018-10882} {CVE-2018-10882}


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.39-400.309.1.el6uek]
changelog:
  - x86/mds: Add empty commit for CVE-2019-11091 (Patrick Colp)  [Orabug: 29721938]  {CVE-2019-11091} 
  - x86/speculation/mds: Fix comment (Boris Ostrovsky)  [Orabug: 29641786]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add mitigation mode VMWERV (Thomas Gleixner)  [Orabug: 29641786]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add sysfs reporting for MDS (Thomas Gleixner)  [Orabug: 29641786]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add mitigation control for MDS (Thomas Gleixner)  [Orabug: 29641786]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Allow runtime checking of CPU features (Patrick Colp)  [Orabug: 29641786]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Improve coverage for MDS vulnerability (Boris Ostrovsky)  [Orabug: 29641786]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Clear CPU buffers on exit to user (Thomas Gleixner)  [Orabug: 29641786]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add mds_clear_cpu_buffers() (Thomas Gleixner)  [Orabug: 29641786]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add BUG_MSBDS_ONLY (Thomas Gleixner)  [Orabug: 29641786]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add basic bug infrastructure for MDS (Andi Kleen)  [Orabug: 29641786]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation: Consolidate CPU whitelists (Thomas Gleixner)  [Orabug: 29641786]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127}


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.39-400.310.1.el6uek]
changelog:
  - x86/speculation/mds: Make cpu_matches() __cpuinit (Patrick Colp)  [Orabug: 29752091]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091} 
  - x86/speculation/mds: Only worry about firmware loaded microcode (Patrick Colp)  [Orabug: 29641786]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.311.1.el6uek]
changelog:
  - USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data (Hui Peng)   {CVE-2018-19985} {CVE-2018-19985} 
  - binfmt_elf: switch to new creds when switching to new mm (Linus Torvalds)  [Orabug: 29677235]  {CVE-2019-11190}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.312.1.el6uek]
changelog:
  - Bluetooth: hidp: fix buffer overflow (Young Xiao)  [Orabug: 29786788]  {CVE-2011-1079} {CVE-2019-11884} 
  - x86/speculation/mds: Fix verw usage to use memory operand (Patrick Colp)  [Orabug: 29791037]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091} 
  - x86/speculation/mds: Make cpu_vuln_whitelist __cpuinitconst (Patrick Colp)  [Orabug: 29792027]  
  - x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Thomas Gleixner)  [Orabug: 29792064]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091} 
  - x86/speculation/mds: Call VERW on NMI path when returning to user (Patrick Colp)  [Orabug: 29792097]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091} 
  - x86/speculation/mds: Fix incorrect check against MSR_IA32_ARCH_CAPABILITIES (Patrick Colp)  [Orabug: 29820653]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.312.2.el6uek]
changelog:
  - tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Eric Dumazet)  [Orabug: 29886601]  {CVE-2019-11477} 
  - tcp: add tcp_min_snd_mss sysctl (Eric Dumazet)  [Orabug: 29884308]  {CVE-2019-11479} 
  - tcp: tcp_fragment() should apply sane memory limits (Eric Dumazet)  [Orabug: 29884308]  {CVE-2019-11478} 
  - tcp: fix fack_count accounting on tcp_shift_skb_data() (Joao Martins)  [Orabug: 29890843]  {CVE-2019-11477} 
  - tcp: limit payload size of sacked skbs (Eric Dumazet)  [Orabug: 29884308]  {CVE-2019-11477}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.313.1.el6uek]
changelog:
  - ACPI: sbshc: remove raw pointer from printk() message (Greg Kroah-Hartman)  [Orabug: 27987133]  {CVE-2018-5750} 
  - dm: fix race between dm_get_from_kobject() and __dm_destroy() (Hou Tao)  [Orabug: 27987143]  {CVE-2017-18203}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.314.1.el6uek]
changelog:
  - x86/speculation: Exclude ATOMs from speculation through SWAPGS (Thomas Gleixner)  [Orabug: 30165287]  {CVE-2019-1125} 
  - x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf)  [Orabug: 30165287]  {CVE-2019-1125} 
  - x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf)  [Orabug: 30165287]  {CVE-2019-1125}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.315.1.el6uek]
changelog:
  - loopback: off by one in tcm_loop_make_naa_tpg() (Dan Carpenter)  [Orabug: 30254296]  {CVE-2011-5327} 
  - floppy: fix out-of-bounds read in copy_buffer (Denis Efremov)  [Orabug: 30318221]  {CVE-2019-14283}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.315.1.1.el6uek]
changelog:
  - x86/tsx: Add config options to set tsx=on|off|auto (Michal Hocko)  [Orabug: 30419231]  {CVE-2019-11135} 
  - x86/speculation/taa: Add documentation for TSX Async Abort (Pawan Gupta)  [Orabug: 30419231]  {CVE-2019-11135} 
  - x86/tsx: Add "auto" option to TSX cmdline parameter (Pawan Gupta)  [Orabug: 30419231]  {CVE-2019-11135} 
  - x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Pawan Gupta)  [Orabug: 30419231]  {CVE-2019-11135} 
  - x86/speculation/taa: Add mitigation for TSX Async Abort (Pawan Gupta)  [Orabug: 30419231]  {CVE-2019-11135} 
  - x86/tsx: Add TSX cmdline option with TSX disabled by default (Pawan Gupta)  [Orabug: 30419231]  {CVE-2019-11135} 
  - x86: Add helper function x86_read_arch_cap_msr() (Pawan Gupta)  [Orabug: 30419231]  {CVE-2019-11135} 
  - x86/tsx: Add enumeration support for IA32_TSX_CTRL MSR (Pawan Gupta)  [Orabug: 30419231]  {CVE-2019-11135}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.316.1.el6uek]
changelog:
  - ipv4: ipmr: various fixes and cleanups (Eric Dumazet)  [Orabug: 30183226]  {CVE-2017-18509} 
  - scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE (Hannes Reinecke)  [Orabug: 30393903]  {CVE-2017-14991} 
  - usb: misc: legousbtower: Fix NULL pointer deference (Greg Kroah-Hartman)  [Orabug: 30412152]  {CVE-2017-15102} 
  - floppy: fix div-by-zero in setup_format_params (Denis Efremov)  [Orabug: 30447845]  {CVE-2019-14284} 
  - i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA (Jeremy Compostella)  [Orabug: 30468843]  {CVE-2017-18551} 
  - USB: check usb_get_extra_descriptor for proper size (Mathias Payer)  [Orabug: 30057430]  {CVE-2018-20169}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.317.1.el6uek]
changelog:
  - ieee802154: enforce CAP_NET_RAW for raw sockets (Allen Pais)  [Orabug: 30444948]  {CVE-2019-17053} 
  - mISDN: enforce CAP_NET_RAW for raw sockets (Ori Nimron)  [Orabug: 30445161]  {CVE-2019-17055} 
  - net: sit: fix memory leak in sit_init_net() (Mao Wenan)  [Orabug: 30445309]  {CVE-2019-16994} 
  - media: dvb: usb: fix use after free in dvb_usb_device_exit (Oliver Neukum)  [Orabug: 30490493]  {CVE-2019-15213} 
  - media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap (Vandana BN)  [Orabug: 30532776]  {CVE-2019-15217} 
  - USB: sisusbvga: fix oops in error path of sisusb_probe (Oliver Neukum)  [Orabug: 30548567]  {CVE-2019-15219}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.318.1.el6uek]
changelog:
  - x86/speculation: Determine swapgs before alternative instructions are set (Patrick Colp)  [Orabug: 30379640]  
  - scsi: libsas: delete sas port if expander discover failed (Jason Yan)  [Orabug: 30580689]  {CVE-2019-15807}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.319.1.el6uek]
changelog:
  - net-sysfs: Fix mem leak in netdev_register_kobject (YueHaibing)  [Orabug: 30350265]  {CVE-2019-15916}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.320.1.el6uek]
changelog:
  - rds: Avoid flushing MRs in rds_rdma_drop_keys (aru kolappan)  [Orabug: 30650888]  
  - media: b2c2-flexcop-usb: add sanity checking (Oliver Neukum)  [Orabug: 30864535]  {CVE-2019-15291}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.321.1.el6uek]
changelog:
  - net: qlogic: Fix memory leak in ql_alloc_large_buffers (Navid Emamdoost)  [Orabug: 31055329]  {CVE-2019-18806}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.322.1.el6uek]
changelog:
  - ipvs: reset ipvs pointer in netns (Julian Anastasov)  [Orabug: 31027196]  
  - ipvs: prefer NETDEV_DOWN event to free cached dsts (Julian Anastasov)  [Orabug: 31027196]  
  - HID: hiddev: do cleanup in failure of opening a device (Hillf Danton)  [Orabug: 31206362]  {CVE-2019-19527} 
  - HID: hiddev: avoid opening a disconnected device (Hillf Danton)  [Orabug: 31206362]  {CVE-2019-19527} 
  - HID: Fix assumption that devices have inputs (Alan Stern)  [Orabug: 31208624]  {CVE-2019-19532}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.323.1.el6uek]
changelog:
  - USB: adutux: fix use-after-free on disconnect (Johan Hovold)  [Orabug: 31240297]  {CVE-2019-19523} 
  - USB: core: Fix races in character device registration and deregistraion (Alan Stern)  [Orabug: 31317669]  {CVE-2019-19537} 
  - USB: iowarrior: fix use-after-free on disconnect (Johan Hovold)  [Orabug: 31351064]  {CVE-2019-19528} 
  - usb: iowarrior: fix deadlock on disconnect (Oliver Neukum)  [Orabug: 31351064]  {CVE-2019-19528}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.324.1.el6uek]
changelog:
  - media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() (Tomas Bortoli)  [Orabug: 31351122]  {CVE-2019-19533} 
  - ALSA: core: Fix card races between register and disconnect (Takashi Iwai)  [Orabug: 31351895]  {CVE-2019-15214}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.325.1.el6uek]
changelog:
  - media: rc: prevent memory leak in cx23888_ir_probe (Navid Emamdoost)  [Orabug: 31351676]  {CVE-2019-19054} 
  - vgacon: Fix for missing check in scrollback handling (Yunhai Zhang)  [Orabug: 31705125]  {CVE-2020-14331} {CVE-2020-14331} 
  - rename kABI whitelists to lockedlists (Dan Duval)  [Orabug: 31783153]


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.326.1.el6uek]
changelog:
  - ath9k_htc: release allocated buffer if timed out (Navid Emamdoost)  [Orabug: 31351574]  {CVE-2019-19073} 
  - USB: serial: io_ti: fix information leak in completion handler (Johan Hovold)  [Orabug: 31352086]  {CVE-2017-8924} 
  - mm/hugetlb: fix a race between hugetlb sysctl handlers (Muchun Song)  [Orabug: 31884244]  {CVE-2020-25285} 
  - ext4: fix potential negative array index in do_split() (Eric Sandeen)  [Orabug: 31895333]  {CVE-2020-14314}


author: Brian Maly <brian.maly@oracle.com> [2.6.39-400.327.1.el6uek]
changelog:
  - USB: serial: omninet: fix reference leaks at open (Johan Hovold)  [Orabug: 30484765]  {CVE-2017-8925} 
  - x86_32, entry: Store badsys error code in %eax (Sven Wegener)  [Orabug: 30783266]  {CVE-2014-4508} {CVE-2014-4508} 
  - x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508) (Andy Lutomirski)  [Orabug: 30783266]  {CVE-2014-4508} {CVE-2014-4508}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [2.6.39-400.328.1.el6uek]
changelog:
  - crypto: authenc - fix parsing key with misaligned rta_len (Eric Biggers)  [Orabug: 31535531]  {CVE-2020-10769} 
  - crypto: authenc - Export key parsing helper function (Mathias Krause)  [Orabug: 31535531]  {CVE-2020-10769}


author: Guru Anbalagane <guru.anbalagane@oracle.com> [3.8.13-118.2.1.el6uek]
changelog:
  - ipc/sem.c: fully initialize sem_array before making it visible (Manfred Spraul)  [Orabug: 22277382]  {CVE-2015-7613} 
  - ipc: fix msg newqueue add (Guru Anbalagane)  [Orabug: 22277382]  {CVE-2015-7613}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.3.1.el6uek]
changelog:
  - Revert "xen-netfront: set max_queue default to 8" (Brian Maly)  [Orabug: 22096098]  
  - net/sunrpc: xpt_auth_cache should be ignored when expired. (NeilBrown)  [Orabug: 21287382]  
  - Prevent syncing frozen file system -- part 2 (Tariq Saeed)  [Orabug: 21807344]  
  - Prevent syncing frozen file system (Tariq Saeed)  [Orabug: 21807344]  
  - KEYS: Fix UID check in keyctl_get_persistent() (David Howells)   
  - mlx4_vnic: Release lock when flush is not needed (Yuval Shaia)  [Orabug: 22173261]  
  - IPoIB: restore uniqueness check for child interfaces (Santosh Shilimkar)  [Orabug: 22257430]  
  - block: bump BLK_DEF_MAX_SECTORS to 2560 (Jeff Moyer)  [Orabug: 22488554]  
  - Revert "block: remove artifical max_hw_sectors cap" (Jeff Moyer)  [Orabug: 22488554]  
  - KEYS: Fix keyring ref leak in join_session_keyring() (Yevgeny Pats)  [Orabug: 22563965]  {CVE-2016-0728} 
  - KEYS: Don't permit request_key() to construct a new keyring (David Howells)  [Orabug: 22373442]  {CVE-2015-7872} 
  - dcache: Handle escaped paths in prepend_path (Eric W. Biederman)  [Orabug: 22373283]  
  - vfs: Test for and handle paths that are unreachable from their mnt_root (Eric W. Biederman)  [Orabug: 22249875]  
  - KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring (David Howells)  [Orabug: 22373442]  {CVE-2015-7872} 
  - KEYS: Fix race between key destruction and finding a keyring by name (David Howells)  [Orabug: 22373442]  
  - KVM: svm: unconditionally intercept #DB (Paolo Bonzini)  [Orabug: 22333698]  {CVE-2015-8104} 
  - KVM: x86: work around infinite loop in microcode when #AC is delivered (Eric Northup)  [Orabug: 22333689]  {CVE-2015-5307} {CVE-2015-5307} 
  - KVM: x86: Defining missing x86 vectors (Nadav Amit)  [Orabug: 22333689]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.4.1.el6uek]
changelog:
  - xen-blkback: replace work_pending with work_busy in purge_persistent_gnt() (Bob Liu)  [Orabug: 22463905]  
  - coredump: add new %PATCH variable in core_pattern (Herbert van den Bergh)  [Orabug: 22666980]  
  - veth: don’t modify ip_summed; doing so treats packets with bad checksums as good. (Vijay Pandurangan)  [Orabug: 22725572]  
  - libiscsi: Fix host busy blocking during connection teardown (John Soni Jose)  [Orabug: 22735756]  
  - RDS: Add interface for receive MSG latency trace (Santosh Shilimkar)  [Orabug: 22868366]  
  - RDS: Add support for per socket SO_TIMESTAMP for incoming messages (Santosh Shilimkar)  [Orabug: 22868366]  
  - x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/nmi/64: Reorder nested NMI checks (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/nmi/64: Improve nested NMI comments (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/nmi/64: Switch stacks on userspace NMI entry (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/paravirt: Replace the paravirt nop with a bona fide empty function (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.5.1.el6uek]
changelog:
  - x86_64: expand kernel stack to 16K (Minchan Kim)  [Orabug: 21140371]  
  - iommu/vt-d: add quirk for broken interrupt remapping on 55XX chipsets (Neil Horman)  [Orabug: 22534160]  
  - xen: remove unneeded variables and one constant (Daniel Kiper)  [Orabug: 22288700]  
  - Revert "x86/xen: delay construction of mfn_list_list" (Daniel Kiper)  [Orabug: 22288700]  
  - ocfs2/dlm: fix misuse of list_move_tail() in dlm_run_purge_list() (Tariq Saeed)  [Orabug: 22898384]  
  - ocfs2/dlm: do not purge lockres that is queued for assert master (Xue jiufei)  [Orabug: 22898384]  
  - pipe: Fix buffer offset after partially failed read (Ben Hutchings)  [Orabug: 22985903]  {CVE-2016-0774} {CVE-2015-1805} {CVE-2016-0774}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.6.1.el6uek]
changelog:
  - skbuff: skb_segment: orphan frags before copying (Dongli Zhang)  [Orabug: 23018911]  
  - RDS/IB: VRPC DELAY / OSS RECONNECT CAUSES 5 MINUTE STALL ON PORT FAILURE (Venkat Venkatsubra)  [Orabug: 22888920]  
  - mlx4_core: Introduce restrictions for PD update (Ajaykumar Hotchandani)   
  - filename should be destroyed via final_putname() instead of __putname() (John Sobecki)  [Orabug: 22346320]  
  - RDS: Fix the atomicity for congestion map update (Wengang Wang)  [Orabug: 23141554]  
  - sctp: Prevent soft lockup when sctp_accept() is called during a timeout event (Karl Heiss)  [Orabug: 23222753]  {CVE-2015-8767}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.7.1.el6uek]
changelog:
  - megaraid_sas : Update threshold based reply post host index register (Sumit.Saxena@avagotech.com)  [Orabug: 23562756]  
  - xen/events: Don't move disabled irqs (Ross Lagerwall)  [Orabug: 23055234]  
  - xen/events: Mask a moving irq (Boris Ostrovsky)  [Orabug: 23055234]  
  - xen/pciback: Save the number of MSI-X entries to be copied later. (Dongli Zhang)  [Orabug: 23202410]  
  - xen/pciback: Save xen_pci_op commands before processing it (Dongli Zhang)  [Orabug: 23202410]  
  - xen-blkback: read from indirect descriptors only once (Dongli Zhang)  [Orabug: 23202410]  
  - xen-blkback: only read request operation from shared ring once (Dongli Zhang)  [Orabug: 23202410]  
  - xen-netback: use RING_COPY_REQUEST() throughout (Dongli Zhang)  [Orabug: 23202410]  
  - xen-netback: don't use last request to determine minimum Tx credit (Dongli Zhang)  [Orabug: 23202410]  
  - xen: Add RING_COPY_REQUEST() (Dongli Zhang)  [Orabug: 23202410]  
  - IB/security: Restrict use of the write() interface (Jason Gunthorpe)  [Orabug: 23283925]  {CVE-2016-4565} 
  - KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. (David Howells)  [Orabug: 23279020]  {CVE-2016-0758} 
  - net: add validation for the socket syscall protocol argument (Hannes Frederic Sowa)  [Orabug: 23267997]  {CVE-2015-8543} {CVE-2015-8543} 
  - ipv6: addrconf: validate new MTU before applying it (Marcelo Leitner)  [Orabug: 23263252]  {CVE-2015-8215} 
  - unix: properly account for FDs passed over unix sockets (willy tarreau)  [Orabug: 23262276]  {CVE-2013-4312} {CVE-2013-4312}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.9.1.el6uek]
changelog:
  - mlx4: Increase SYNC_TPT command timeout (Mukesh Kacker)  [Orabug: 22895790]  
  - neigh: do not modify unlinked entries (Julian Anastasov)  [Orabug: 23072705]  
  - mm/slab: Improve performance of slabinfo stats gathering (Aruna Ramakrishna)  [Orabug: 23720437]  
  - atl2: Disable unimplemented scatter/gather feature (Ben Hutchings)  [Orabug: 23703901]  {CVE-2016-2117} {CVE-2016-2117}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.10.1.el6uek]
changelog:
  - ocfs2: call ocfs2_journal_access_di() before ocfs2_journal_dirty() in ocfs2_write_end_nolock() (yangwenfang)  [Orabug: 19601200]  
  - ocfs2: improve recovery performance (Junxiao Bi)  [Orabug: 24395691]  
  - KEYS: potential uninitialized variable (Dan Carpenter)  [Orabug: 24393864]  {CVE-2016-4470}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.10.2.el6uek]
changelog:
  - tcp: make challenge acks less predictable (Eric Dumazet)  [Orabug: 24010012] [Orabug: 2401010]  {CVE-2016-5696}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.11.1.el6uek]
changelog:
  - rds: schedule local connection activity in proper workqueue (Ajaykumar Hotchandani)  [Orabug: 24624195]  
  - ib_core: make wait_event uninterruptible in ib_flush_fmr_pool() (Avinash Repaka)  [Orabug: 24655952]  
  - net/mlx4: Support shutdown() interface (Gavin Shan)  [Orabug: 24624181]  
  - tcp: make challenge acks less predictable (Eric Dumazet)  [Orabug: 24010012] [Orabug: 2401010]  {CVE-2016-5696}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.11.2.el6uek]
changelog:
  - Btrfs: fix truncation of compressed and inlined extents (Ashish Samant)  [Orabug: 22307285]  {CVE-2015-8374} 
  - Btrfs: fix file corruption and data loss after cloning inline extents (Divya Indi)  [Orabug: 22307285]  {CVE-2015-8374} 
  - netfilter: x_tables: make sure e->next_offset covers remaining blob size (Florian Westphal)  [Orabug: 24682074]  {CVE-2016-4997} {CVE-2016-4998} 
  - netfilter: x_tables: validate e->target_offset early (Florian Westphal)  [Orabug: 24682074]  {CVE-2016-4997} {CVE-2016-4998}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.12.1.el6uek]
changelog:
  - scsi_sysfs: protect against double execution of __scsi_remove_device() (Vitaly Kuznetsov)  [Orabug: 23720563]  
  - ocfs2: Fix double put of recount tree in ocfs2_lock_refcount_tree() (Ashish Samant)  [Orabug: 24691666]  
  - netfilter: x_tables: speed up jump target validation (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: enforce nul-terminated table name from getsockopt GET_ENTRIES (Pablo Neira Ayuso)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: remove unused comefrom hookmask argument (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: introduce and use xt_copy_counters_from_user (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: do compat validation via translate_table (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: xt_compat_match_from_user doesn't need a retval (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: ip6_tables: simplify translate_compat_table args (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: ip_tables: simplify translate_compat_table args (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: arp_tables: simplify translate_compat_table args (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: don't reject valid target size on some architectures (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: validate all offsets and sizes in a rule (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: check for bogus target offset (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: check standard target size too (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: add compat version of xt_check_entry_offsets (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: assert minimum target size (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: kill check_entry helper (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: add and use xt_check_entry_offsets (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: validate targets of jumps (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: fix unconditional helper (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: validate targets of jumps (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: don't move to non-existent next rule (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: fix unconditional helper (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - netfilter: x_tables: check for size overflow (Florian Westphal)  [Orabug: 24690304]  {CVE-2016-3134} 
  - NFSv4: Fail I/O if the state recovery fails irrevocably (Trond Myklebust)  [Orabug: 24681407]  
  - rds: skip rx/tx work when destroying connection (Wengang Wang)  [Orabug: 24395795]  
  - ocfs2: Fix start offset to ocfs2_zero_range_for_truncate() (Ashish Samant)  [Orabug: 23747627]  
  - sched/core: Clear the root_domain cpumasks in init_rootdomain() (Xunlei Pang)  [Orabug: 23518545]  
  - ocfs2: move dquot_initialize() in ocfs2_delete_inode() somewhat later (Jan Kara)  [Orabug: 23097098]  
  - fuse: fix typo while displaying fuse numa mount option (Ashish Samant)   
  - IB/mlx4: Replace kfree with kvfree in mlx4_ib_destroy_srq (Wengang Wang)  [Orabug: 22570521]  
  - ocfs2: return non-zero st_blocks for inline data (John Haxby)  [Orabug: 22218260]  
  - watchdog: update watchdog_thresh properly (Michal Hocko)  [Orabug: 21868337]  
  - Btrfs: fix truncation of compressed and inlined extents (Ashish Samant)  [Orabug: 22307285]  {CVE-2015-8374} 
  - Btrfs: fix file corruption and data loss after cloning inline extents (Divya Indi)  [Orabug: 22307285]  {CVE-2015-8374} 
  - netfilter: x_tables: make sure e->next_offset covers remaining blob size (Florian Westphal)  [Orabug: 24682074]  {CVE-2016-4997} {CVE-2016-4998} 
  - netfilter: x_tables: validate e->target_offset early (Florian Westphal)  [Orabug: 24682074]  {CVE-2016-4997} {CVE-2016-4998}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.13.2.el6uek]
changelog:
  - HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Scott Bauer)  [Orabug: 24798695]  {CVE-2016-5829}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.14.1.el6uek]
changelog:
  - ecryptfs: forbid opening files without mmap handler (Jann Horn)  [Orabug: 24971919]  {CVE-2016-1583} 
  - RDS: IB: fix panic with handlers running post teardown (Santosh Shilimkar)  [Orabug: 24395795]  
  - mm, gup: close FOLL MAP_PRIVATE race (Linus Torvalds)  [Orabug: 24928591]  {CVE-2016-5195} 
  - HID: hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Scott Bauer)  [Orabug: 24798695]  {CVE-2016-5829}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.14.2.el6uek]
changelog:
  - aacraid: Check size values after double-fetch from user (Dave Carroll)  [Orabug: 25060050]  {CVE-2016-6480} {CVE-2016-6480} 
  - IB/srpt: Simplify srpt_handle_tsk_mgmt() (Bart Van Assche)  [Orabug: 25060011]  {CVE-2016-6327} 
  - audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore)  [Orabug: 25059945]  {CVE-2016-6136} 
  - ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt (Kangjie Lu)  [Orabug: 25059899]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in events via snd_timer_user_ccallback (Kangjie Lu)  [Orabug: 25059899]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (Kangjie Lu)  [Orabug: 25059753]  {CVE-2016-4569} 
  - acpi: Disable ACPI table override if securelevel is set (Linn Crosetto)  [Orabug: 25058991]  {CVE-2016-3699} 
  - Bluetooth: Fix potential NULL dereference in RFCOMM bind callback (Jaganath Kanakkassery)  [Orabug: 25058903]  {CVE-2015-8956} 
  - ASN.1: Fix non-match detection failure on data overrun (David Howells)  [Orabug: 25059046]  {CVE-2016-2053} 
  - mm: migrate dirty page without clear_page_dirty_for_io etc (Hugh Dickins)  [Orabug: 25059194]  {CVE-2016-3070}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.15.1.el6uek]
changelog:
  - Revert "i40e: Set defport behavior for the Main VSI when in promiscuous mode" (Jack Vogel)  [Orabug: 22683573]  
  - mlx4: avoid multiple free on id_map_ent (Wengang Wang)   
  - xen-netfront: cast grant table reference first to type int (Dongli Zhang)   
  - xen-netfront: do not cast grant table reference to signed short (Dongli Zhang)   
  - RDS: Drop the connection as part of cancel to avoid hangs (Avinash Repaka)  [Orabug: 25045360]  
  - sctp: validate chunk len before actually using it (Marcelo Ricardo Leitner)  [Orabug: 25142879]  {CVE-2016-9555} 
  - mpi: Fix NULL ptr dereference in mpi_powm() [ver #3] (Andrey Ryabinin)  [Orabug: 25154098]  {CVE-2016-8650} {CVE-2016-8650} 
  - aacraid: Check size values after double-fetch from user (Dave Carroll)  [Orabug: 25060050]  {CVE-2016-6480} {CVE-2016-6480} 
  - IB/srpt: Simplify srpt_handle_tsk_mgmt() (Bart Van Assche)  [Orabug: 25060011]  {CVE-2016-6327} 
  - audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore)  [Orabug: 25059945]  {CVE-2016-6136} 
  - ALSA: timer: Fix leak in events via snd_timer_user_tinterrupt (Kangjie Lu)  [Orabug: 25059899]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in events via snd_timer_user_ccallback (Kangjie Lu)  [Orabug: 25059899]  {CVE-2016-4578} 
  - ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (Kangjie Lu)  [Orabug: 25059753]  {CVE-2016-4569} 
  - acpi: Disable ACPI table override if securelevel is set (Linn Crosetto)  [Orabug: 25058991]  {CVE-2016-3699} 
  - Bluetooth: Fix potential NULL dereference in RFCOMM bind callback (Jaganath Kanakkassery)  [Orabug: 25058903]  {CVE-2015-8956} 
  - ASN.1: Fix non-match detection failure on data overrun (David Howells)  [Orabug: 25059046]  {CVE-2016-2053} 
  - mm: migrate dirty page without clear_page_dirty_for_io etc (Hugh Dickins)  [Orabug: 25059194]  {CVE-2016-3070}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.15.2.el6uek]
changelog:
  - x86/iopl/64: properly context-switch IOPL on Xen PV (Andy Lutomirski)  [Orabug: 25269176]  {CVE-2016-3157} {CVE-2016-3157} 
  - net: Fix use after free in the recvmmsg exit path (Arnaldo Carvalho de Melo)  [Orabug: 25298611]  {CVE-2016-7117}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.16.1.el6uek]
changelog:
  - nvme: Limit command retries (Ashok Vairavan)  [Orabug: 25374794]  
  - tcp: fix use after free in tcp_xmit_retransmit_queue() (Eric Dumazet)  [Orabug: 25374371]  {CVE-2016-6828} 
  - logging errors that get masked to EIO inside drivers/block/loop.c (Manjunath Patil)  [Orabug: 22505535]  
  - ALSA: pcm : Call kill_fasync() in stream lock (Takashi Iwai)  [Orabug: 25203963]  {CVE-2016-9794} 
  - packet: fix race condition in packet_set_ring (Philip Pettersson)  [Orabug: 25217756]  {CVE-2016-8655} 
  - x86: kvmclock: zero initialize pvclock shared memory area (Igor Mammedov)  [Orabug: 25218431]  
  - KEYS: Fix short sprintf buffer in /proc/keys show function (David Howells)  [Orabug: 25306373]  {CVE-2016-7042} 
  - uek-rpm ol7: change uek-rpm/ol7/update-el release value from 7.1 to 7.3 (Brian Maly)  [Orabug: 25348336]  
  - x86/iopl/64: properly context-switch IOPL on Xen PV (Andy Lutomirski)  [Orabug: 25269176]  {CVE-2016-3157} {CVE-2016-3157} 
  - net: Fix use after free in the recvmmsg exit path (Arnaldo Carvalho de Melo)  [Orabug: 25298611]  {CVE-2016-7117}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.16.2.el6uek]
changelog:
  - net: avoid signed overflows for SO_{SND|RCV}BUFFORCE (Eric Dumazet)  [Orabug: 25203623]  {CVE-2016-9793}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.16.3.el6uek]
changelog:
  - crypto: algif_hash - Only export and import on sockets with data (Herbert Xu)  [Orabug: 25417805]  {CVE-2016-8646} 
  - USB: usbfs: fix potential infoleak in devio (Kangjie Lu)  [Orabug: 25462760]  {CVE-2016-4482} 
  - net: fix infoleak in llc (Kangjie Lu)  [Orabug: 25462807]  {CVE-2016-4485} 
  - af_unix: Guard against other == sk in unix_dgram_sendmsg (Rainer Weikusat)  [Orabug: 25463996]  {CVE-2013-7446} 
  - unix: avoid use-after-free in ep_remove_wait_queue (Rainer Weikusat)  [Orabug: 25463996]  {CVE-2013-7446}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.17.1.el6uek]
changelog:
  - tty: n_hdlc: get rid of racy n_hdlc.tbuf (Alexander Popov)  [Orabug: 25696686]  {CVE-2017-2636} 
  - TTY: n_hdlc, fix lockdep false positive (Jiri Slaby)  [Orabug: 25696686]  {CVE-2017-2636} 
  - drivers/tty/n_hdlc.c: replace kmalloc/memset by kzalloc (Fabian Frederick)  [Orabug: 25696686]  {CVE-2017-2636} 
  - x86: bpf_jit: fix compilation of large bpf programs (Alexei Starovoitov)  [Orabug: 21305080]  {CVE-2015-4700} 
  - net: filter: return -EINVAL if BPF_S_ANC* operation is not supported (Daniel Borkmann)  [Orabug: 22187148]  
  - KEYS: request_key() should reget expired keys rather than give EKEYEXPIRED (David Howells)   
  - KEYS: Increase root_maxkeys and root_maxbytes sizes (Steve Dickson)   
  - firewire: net: guard against rx buffer overflows (Stefan Richter)  [Orabug: 25451530]  {CVE-2016-8633} 
  - x86/mm/32: Enable full randomization on i386 and X86_32 (Hector Marco-Gisbert)  [Orabug: 25463927]  {CVE-2016-3672} 
  - x86 get_unmapped_area: Access mmap_legacy_base through mm_struct member (Radu Caragea)  [Orabug: 25463927]  {CVE-2016-3672} 
  - pptp: verify sockaddr_len in pptp_bind() and pptp_connect() (WANG Cong)  [Orabug: 25490335]  {CVE-2015-8569} 
  - sg_start_req(): make sure that there's not too many elements in iovec (Al Viro)  [Orabug: 25490372]  {CVE-2015-5707} 
  - kvm: nVMX: Allow L1 to intercept software exceptions (#BP and #OF) (Jim Mattson)  [Orabug: 25507195]  {CVE-2016-9588} 
  - tcp: take care of truncations done by sk_filter() (Eric Dumazet)  [Orabug: 25507230]  {CVE-2016-8645} 
  - rose: limit sk_filter trim to payload (Willem de Bruijn)  [Orabug: 25507230]  {CVE-2016-8645} 
  - fix minor infoleak in get_user_ex() (Al Viro)  [Orabug: 25507281]  {CVE-2016-9178} 
  - scsi: arcmsr: Simplify user_len checking (Borislav Petkov)  [Orabug: 25507328]  {CVE-2016-7425} 
  - scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer() (Dan Carpenter)  [Orabug: 25507328]  {CVE-2016-7425} 
  - net: fix a kernel infoleak in x25 module (Kangjie Lu)  [Orabug: 25512413]  {CVE-2016-4580} 
  - USB: digi_acceleport: do sanity checking for the number of ports (Oliver Neukum)  [Orabug: 25512471]  {CVE-2016-3140} 
  - ipv4: keep skb->dst around in presence of IP options (Eric Dumazet)  [Orabug: 25543892]  {CVE-2017-5970} 
  - net/llc: avoid BUG_ON() in skb_orphan() (Eric Dumazet)  [Orabug: 25682430]  {CVE-2017-6345} 
  - dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Andrey Konovalov)   {CVE-2017-6074} 
  - crypto: algif_hash - Only export and import on sockets with data (Herbert Xu)  [Orabug: 25417805]  {CVE-2016-8646} 
  - USB: usbfs: fix potential infoleak in devio (Kangjie Lu)  [Orabug: 25462760]  {CVE-2016-4482} 
  - net: fix infoleak in llc (Kangjie Lu)  [Orabug: 25462807]  {CVE-2016-4485} 
  - af_unix: Guard against other == sk in unix_dgram_sendmsg (Rainer Weikusat)  [Orabug: 25463996]  {CVE-2013-7446} 
  - unix: avoid use-after-free in ep_remove_wait_queue (Rainer Weikusat)  [Orabug: 25463996]  {CVE-2013-7446} 
  - net: avoid signed overflows for SO_{SND|RCV}BUFFORCE (Eric Dumazet)  [Orabug: 25203623]  {CVE-2016-9793}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.17.2.el6uek]
changelog:
  - ipv6: stop sending PTB packets for MTU < 1280 (Hagen Paul Pfeifer)  [Orabug: 25765776]  {CVE-2016-10142} 
  - sg_write()/bsg_write() is not fit to be called under KERNEL_DS (Al Viro)  [Orabug: 25765445]  {CVE-2016-10088} 
  - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter chang)  [Orabug: 25751996]  {CVE-2017-7187}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.17.3.el6uek]
changelog:
  - net: ping: check minimum size on ICMP header length (Kees Cook)  [Orabug: 25766911]  {CVE-2016-8399}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.18.1.el6uek]
changelog:
  - fnic: Update fnic driver version to 1.6.0.24 (John Sobecki)  [Orabug: 24448585]  
  - xen-netfront: Rework the fix for Rx stall during OOM and network stress (Dongli Zhang)  [Orabug: 25450703]  
  - xen-netfront: Fix Rx stall during network stress and OOM (Dongli Zhang)  [Orabug: 25450703]  
  - ipv6: Skip XFRM lookup if dst_entry in socket cache is valid (Jakub Sitnicki)   
  - uek-rpm: enable CONFIG_KSPLICE. (Jamie Iles)  [Orabug: 25549809]  
  - ksplice: add sysctls for determining Ksplice features. (Jamie Iles)  [Orabug: 25549809]  
  - signal: protect SIGNAL_UNKILLABLE from unintentional clearing. (Jamie Iles)  [Orabug: 25549809]  
  - VSOCK: Fix lockdep issue. (Dongli Zhang)  [Orabug: 25559937]  
  - VSOCK: sock_put wasn't safe to call in interrupt context (Dongli Zhang)  [Orabug: 25559937]  
  - IB/CORE: sync the resouce access in fmr_pool (Wengang Wang)  [Orabug: 25677469]  
  - KVM: x86: fix emulation of "MOV SS, null selector" (Paolo Bonzini)  [Orabug: 25719675]  {CVE-2017-2583} {CVE-2017-2583} 
  - ext4: validate s_first_meta_bg at mount time (Eryu Guan)  [Orabug: 25719738]  {CVE-2016-10208} 
  - sctp: avoid BUG_ON on sctp_wait_for_sndbuf (Marcelo Ricardo Leitner)  [Orabug: 25719810]  {CVE-2017-5986} 
  - tcp: avoid infinite loop in tcp_splice_read() (Eric Dumazet)  [Orabug: 25720813]  {CVE-2017-6214} 
  - lpfc cannot establish connection with targets that send PRLI under P2P mode (Joe Jin)  [Orabug: 25759083]  
  - USB: visor: fix null-deref at probe (Johan Hovold)  [Orabug: 25796594]  {CVE-2016-2782} 
  - ipc/shm: Fix shmat mmap nil-page protection (Davidlohr Bueso)  [Orabug: 25797012]  {CVE-2017-5669} 
  - vhost: actually track log eventfd file (Marc-André Lureau)  [Orabug: 25797052]  {CVE-2015-6252} 
  - xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder (Andy Whitcroft)  [Orabug: 25814663]  {CVE-2017-7184} 
  - xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window (Andy Whitcroft)  [Orabug: 25814663]  {CVE-2017-7184} 
  - KEYS: Remove key_type::match in favour of overriding default by match_preparse (Aniket Alshi)  [Orabug: 25823962]  {CVE-2017-2647} {CVE-2017-2647} 
  - USB: whiteheat: fix potential null-deref at probe (Johan Hovold)  [Orabug: 25825105]  {CVE-2015-5257} {CVE-2015-5257} 
  - udf: Check path length when reading symlink (Jan Kara)  [Orabug: 25871102]  {CVE-2015-9731} 
  - udp: properly support MSG_PEEK with truncated buffers (Eric Dumazet)  [Orabug: 25876655]  {CVE-2016-10229} 
  - block: fix use-after-free in seq file (Vegard Nossum)  [Orabug: 25877530]  {CVE-2016-7910} 
  - Revert "fix minor infoleak in get_user_ex()" (Brian Maly)  [Orabug: 25790392]  {CVE-2016-9644} 
  - net: ping: check minimum size on ICMP header length (Kees Cook)  [Orabug: 25766911]  {CVE-2016-8399} 
  - ipv6: stop sending PTB packets for MTU < 1280 (Hagen Paul Pfeifer)  [Orabug: 25765776]  {CVE-2016-10142} 
  - sg_write()/bsg_write() is not fit to be called under KERNEL_DS (Al Viro)  [Orabug: 25765445]  {CVE-2016-10088} 
  - scsi: sg: check length passed to SG_NEXT_CMD_LEN (peter chang)  [Orabug: 25751996]  {CVE-2017-7187}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.18.2.el6uek]
changelog:
  - nfsd: stricter decoding of write-like NFSv2/v3 ops (J. Bruce Fields)  [Orabug: 25986990]  {CVE-2017-7895}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.18.4.el6uek]
changelog:
  - net/packet: fix overflow in check for tp_reserve (Andrey Konovalov)  [Orabug: 26143552]  {CVE-2017-7308} 
  - net/packet: fix overflow in check for tp_frame_nr (Andrey Konovalov)  [Orabug: 26143552]  {CVE-2017-7308} 
  - net/packet: fix overflow in check for priv area size (Andrey Konovalov)  [Orabug: 26143552]  {CVE-2017-7308}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.1.el6uek]
changelog:
  - selinux: quiet the filesystem labeling behavior message (Paul Moore)  [Orabug: 25290650]  
  - HID: hid-cypress: validate length of report (Greg Kroah-Hartman)  [Orabug: 25891907]  {CVE-2017-7273} 
  - udf: Remove repeated loads blocksize (Jan Kara)  [Orabug: 25905721]  {CVE-2015-4167} 
  - udf: Check length of extended attributes and allocation descriptors (Jan Kara)  [Orabug: 25905721]  {CVE-2015-4167} 
  - udf: Verify i_size when loading inode (Jan Kara)  [Orabug: 25905721]  {CVE-2015-4167} 
  - btrfs: drop unused parameter from btrfs_item_nr (Ross Kirk)  [Orabug: 25948098]  {CVE-2014-9710} 
  - Btrfs: cleanup of function where fixup_low_keys() is called (Tsutomu Itoh)  [Orabug: 25948098]  {CVE-2014-9710} 
  - Btrfs: remove unused argument of fixup_low_keys() (Tsutomu Itoh)  [Orabug: 25948098]  {CVE-2014-9710} 
  - Btrfs: remove unused argument of btrfs_extend_item() (Tsutomu Itoh)  [Orabug: 25948098]  {CVE-2014-9710} 
  - Btrfs: add support for asserts (Josef Bacik)  [Orabug: 25948098]  {CVE-2014-9710} 
  - Btrfs: make xattr replace operations atomic (Filipe Manana)  [Orabug: 25948098]  {CVE-2014-9710} 
  - net: validate the range we feed to iov_iter_init() in sys_sendto/sys_recvfrom (Al Viro)  [Orabug: 25948145]  {CVE-2015-2686} 
  - PCI: Prevent VPD access for QLogic ISP2722 (Ethan Zhao)  [Orabug: 25975506]  
  - PCI: Prevent VPD access for buggy devices (Babu Moger)  [Orabug: 25975506]  
  - xsigo: [backport](UEK3)-Compute node crash on FC failover (Pradeep Gopanapalli)  [Orabug: 26007560]  
  - ipv4: try to cache dst_entries which would cause a redirect (Hannes Frederic Sowa)  [Orabug: 26032372]  {CVE-2015-1465} 
  - RDS/IB: active bonding port state fix for intfs added late (Mukesh Kacker)  [Orabug: 26139385]  
  - net/packet: fix overflow in check for tp_reserve (Andrey Konovalov)  [Orabug: 26143552]  {CVE-2017-7308} 
  - net/packet: fix overflow in check for tp_frame_nr (Andrey Konovalov)  [Orabug: 26143552]  {CVE-2017-7308} 
  - net/packet: fix overflow in check for priv area size (Andrey Konovalov)  [Orabug: 26143552]  {CVE-2017-7308} 
  - dccp/tcp: do not inherit mc_list from parent (Eric Dumazet)  [Orabug: 26108571]  {CVE-2017-8890} 
  - nfsd: stricter decoding of write-like NFSv2/v3 ops (J. Bruce Fields)  [Orabug: 25986990]  {CVE-2017-7895}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.2.el6uek]
changelog:
  - nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields)  [Orabug: 26366022]  {CVE-2017-7645}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.3.el6uek]
changelog:
  - posix_acl: Clear SGID bit when setting file permissions (Jan Kara)  [Orabug: 25507344]  {CVE-2016-7097} {CVE-2016-7097}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.4.el6uek]
changelog:
  - l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() (Guillaume Nault)  [Orabug: 26586047]  {CVE-2016-10200} 
  - xfs: fix two memory leaks in xfs_attr_list.c error paths (Mateusz Guzik)  [Orabug: 26586022]  {CVE-2016-9685} 
  - KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings (David Howells)  [Orabug: 26585994]  {CVE-2016-9604} 
  - ipv6: fix out of bound writes in __ip6_append_data() (Eric Dumazet)  [Orabug: 26578198]  {CVE-2017-9242}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.5.el6uek]
changelog:
  - fs/exec.c: account for argv/envp pointers (Kees Cook)  [Orabug: 26638921]  {CVE-2017-1000365} {CVE-2017-1000365}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.7.el6uek]
changelog:
  - Bluetooth: Properly check L2CAP config option output buffer length (Ben Seri)  [Orabug: 26796364]  {CVE-2017-1000251}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.8.el6uek]
changelog:
  - mlx4_core: calculate log_num_mtt based on total system memory (Wei Lin Guay)  [Orabug: 26883934]  
  - xen/x86: Add interface for querying amount of host memory (Boris Ostrovsky)  [Orabug: 26883934]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.9.el6uek]
changelog:
  - ipv6: avoid overflow of offset in ip6_find_1stfragopt (Sabrina Dubroca)  [Orabug: 27011273]  {CVE-2017-7542} 
  - packet: fix tp_reserve race in packet_set_ring (Willem de Bruijn)  [Orabug: 27002450]  {CVE-2017-1000111}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.11.el6uek]
changelog:
  - nvme: Handle PM1725 HIL reset (Martin K. Petersen)  [Orabug: 26277600]  
  - char: lp: fix possible integer overflow in lp_setup() (Willy Tarreau)  [Orabug: 26403940]  {CVE-2017-1000363} 
  - ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race between read and ioctl (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: fix NULL pointer dereference in read()/ioctl() race (Vegard Nossum)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix negative queue usage by racy accesses (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race at concurrent reads (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race among timer ioctls (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ipv6/dccp: do not inherit ipv6_mc_list from parent (WANG Cong)  [Orabug: 26404005]  {CVE-2017-9077} 
  - ocfs2: fix deadlock issue when taking inode lock at vfs entry points (Eric Ren)  [Orabug: 26427126]  
  - ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock (Eric Ren)  [Orabug: 26427126]  
  - ping: implement proper locking (Eric Dumazet)  [Orabug: 26540286]  {CVE-2017-2671} 
  - aio: mark AIO pseudo-fs noexec (Jann Horn)  [Orabug: 26643598]  {CVE-2016-10044} 
  - vfs: Commit to never having exectuables on proc and sysfs. (Eric W. Biederman)  [Orabug: 26643598]  {CVE-2016-10044} 
  - vfs, writeback: replace FS_CGROUP_WRITEBACK with SB_I_CGROUPWB (Tejun Heo)  [Orabug: 26643598]  {CVE-2016-10044} 
  - x86/acpi: Prevent out of bound access caused by broken ACPI tables (Seunghun Han)  [Orabug: 26643645]  {CVE-2017-11473} 
  - sctp: do not inherit ipv6_{mc|ac|fl}_list from parent (Eric Dumazet)  [Orabug: 26650883]  {CVE-2017-9075} 
  - [media] saa7164: fix double fetch PCIe access condition (Steven Toth)  [Orabug: 26675142]  {CVE-2017-8831} 
  - [media] saa7164: fix sparse warnings (Hans Verkuil)  [Orabug: 26675142]  {CVE-2017-8831} 
  - fs: __generic_file_splice_read retry lookup on AOP_TRUNCATED_PAGE (Abhi Das)  [Orabug: 26797306]  
  - timerfd: Protect the might cancel mechanism proper (Thomas Gleixner)  [Orabug: 26899787]  {CVE-2017-10661} 
  - scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly (Xin Long)  [Orabug: 26988627]  {CVE-2017-14489}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.19.12.el6uek]
changelog:
  - nvme: Drop nvmeq->q_lock before dma_pool_alloc(), so as to prevent hard lockups (Aruna Ramakrishna)  [Orabug: 25409587]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-111.el6uek]
changelog:
  - qla2xxx: Update driver version to 8.07.00.26.39.0-k. (Sawan Chandak)  [Orabug: 21946579]  
  - qla2xxx: Add pci device id 0x2261. (Sawan Chandak)  [Orabug: 21946579]  
  - qla2xxx: Fix missing device login retries. (Arun Easi)  [Orabug: 21946579]  
  - qla2xxx: do not clear slot in outstanding cmd array (Himanshu Madhani)  [Orabug: 21946579]  
  - qla2xxx: Remove decrement of sp reference count in abort handler. (Chad Dupuis)  [Orabug: 21946579]  
  - qla2xxx: Add support to show MPI and PEP FW version for ISP27xx. (Sawan Chandak)  [Orabug: 21946579]  
  - qla2xxx: Do not reset ISP for error entry with an out of range handle. (Chad Dupuis)  [Orabug: 21946579]  
  - qla2xxx: Do not reset adapter if SRB handle is in range. (Chad Dupuis)  [Orabug: 21946579]  
  - qla2xxx: Do not crash system for sp ref count zero (Hiral Patel)  [Orabug: 21946579]  
  - qla2xxx: Pause risc before manipulating risc semaphore. (Joe Carnuccio)  [Orabug: 21946579]  
  - qla2xxx: Use ssdid to gate semaphore manipulation. (Joe Carnuccio)  [Orabug: 21946579]  
  - qla2xxx: Handle AEN8014 incoming port logout. (Joe Carnuccio)  [Orabug: 21946579]  
  - qla2xxx: Add serdes register read/write support for ISP25xx. (Joe Carnuccio)  [Orabug: 21946579]  
  - qla2xxx: Remove dead code (Bart Van Assche)  [Orabug: 21946579]  
  - qla2xxx: Remove a superfluous test (Bart Van Assche)  [Orabug: 21946579]  
  - qla2xxx: Avoid that sparse complains about duplicate [noderef] attributes (Bart Van Assche)  [Orabug: 21946579]  
  - qla2xxx: Remove __constant_ prefix (Bart Van Assche)  [Orabug: 21946579]  
  - qla2xxx: Replace two macros with an inline function (Bart Van Assche)  [Orabug: 21946579]  
  - qla2xxx: Remove set-but-not-used variables (Bart Van Assche)  [Orabug: 21946579]  
  - qla2xxx: Declare local functions static (Bart Van Assche)  [Orabug: 21946579]  
  - bnx2i: rebase 2.11.2.0 (Brian Maly)  [Orabug: 21955132]  
  - bnx2fc: update to 2.9.6 (Brian Maly)  [Orabug: 21955132]  
  - bnx2x: update to 1.713.01 (Brian Maly)  [Orabug: 21955132]  
  - bnx2: update to 2.2.5p (Brian Maly)  [Orabug: 21955132]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-112.el6uek]
changelog:
  - i40e/i40evf: Bump i40e to 1.3.21 and i40evf to 1.3.13 (Catherine Sullivan)  [Orabug: 21539654]  
  - i40e/i40evf: add get AQ result command to nvmupdate utility (Shannon Nelson)  [Orabug: 21539654]  
  - i40e/i40evf: add exec_aq command to nvmupdate utility (Shannon Nelson)  [Orabug: 21539654]  
  - i40e/i40evf: add wait states to NVM state machine (Shannon Nelson)  [Orabug: 21539654]  
  - i40e/i40evf: add GetStatus command for nvmupdate (Shannon Nelson)  [Orabug: 21539654]  
  - i40e/i40evf: add handling of writeback descriptor (Shannon Nelson)  [Orabug: 21539654]  
  - i40e/i40evf: save aq writeback for future inspection (Shannon Nelson)  [Orabug: 21539654]  
  - i40e: rename variable to prevent clash of understanding (Shannon Nelson)  [Orabug: 21539654]  
  - i40e: Set defport behavior for the Main VSI when in promiscuous mode (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e/i40evf: Bump i40e to 1.3.9 and i40evf to 1.3.5 (Catherine Sullivan)  [Orabug: 21539654]  
  - i40e/i40evf: Cache the CEE TLV status returned from firmware (Neerav Parikh)  [Orabug: 21539654]  
  - i40e/i40evf: add VIRTCHNL_VF_OFFLOAD flag (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e: Remove redundant and unneeded messages (Greg Rose)  [Orabug: 21539654]  
  - i40evf: Remove PF specific register definitions from the VF (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40evf: Use the correct defines to match the VF registers (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e: Fix comment for ethtool diagnostic link test (Greg Rose)  [Orabug: 21539654]  
  - i40e/i40evf: Add capability to gather VEB per TC stats (Neerav Parikh)  [Orabug: 21539654]  
  - i40e: Fix ethtool offline diagnostic with netqueues (Greg Rose)  [Orabug: 21539654]  
  - i40e: Fix legacy interrupt mode in the driver (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e: Move function calls to i40e_shutdown instead of i40e_suspend (Catherine Sullivan)  [Orabug: 21539654]  
  - i40e: add RX to port CRC errors label (Shannon Nelson)  [Orabug: 21539654]  
  - i40e: don't degrade __le16 (Mitch Williams)  [Orabug: 21539654]  
  - i40e: Add AQ commands for NVM Update for X722 (Shannon Nelson)  [Orabug: 21539654]  
  - i40e/i40evf: Add ATR HW eviction support for X722 (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e: Add IWARP support for X722 (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e/i40evf: Add TX/RX outer UDP checksum support for X722 (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e/i40evf: Add support for writeback on ITR feature for X722 (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e/i40evf: Update register.h file for X722 (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e/i40evf: Update FW API with X722 support (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e/i40evf: Add flags for X722 capabilities (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e/i40evf: Add device ids for X722 (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e: use BIT and BIT_ULL macros (Jesse Brandeburg)  [Orabug: 21539654]  
  - i40e: clean up error status messages (Shannon Nelson)  [Orabug: 21539654]  
  - i40e: clean up error status messages (Shannon Nelson)  [Orabug: 21539654]  
  - i40e: provide correct API version to older VF drivers (Mitch Williams)  [Orabug: 21539654]  
  - i40evf: support virtual channel API version 1.1 (Mitch Williams)  [Orabug: 21539654]  
  - i40evf: handle big resets (Mitch Williams)  [Orabug: 21539654]  
  - i40e: support virtual channel API 1.1 (Mitch Williams)  [Orabug: 21539654]  
  - i40e/i40evf: add macros for virtual channel API version and device capability (Mitch Williams)  [Orabug: 21539654]  
  - i40e: add VF capabilities to virtual channel interface (Mitch Williams)  [Orabug: 21539654]  
  - i40e: clean up unneeded gotos (Shannon Nelson)  [Orabug: 21539654]  
  - i40e/i40evf: Fix and refactor dynamic ITR code (Carolyn Wyborny)  [Orabug: 21539654]  
  - i40e: only report generic filters in get_ts_info (Jacob Keller)  [Orabug: 21539654]  
  - i40e/i40evf: Bump version to 1.3.6 for i40e and 1.3.2 for i40evf (Catherine Sullivan)  [Orabug: 21539654]  
  - i40e: Refine an error message to avoid confusion (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e/i40evf: Add support for pre-allocated pages for PD (Faisal Latif)  [Orabug: 21539654]  
  - i40evf: add MAC address filter in open, not init (Mitch Williams)  [Orabug: 21539654]  
  - i40evf: don't delete all the filters (Mitch Williams)  [Orabug: 21539654]  
  - i40e: un-disable VF after reset (Mitch Williams)  [Orabug: 21539654]  
  - i40e: do a proper reset when disabling a VF (Mitch Williams)  [Orabug: 21539654]  
  - i40e: correctly program filters for VFs (Mitch Williams)  [Orabug: 21539654]  
  - i40e/i40evf: Update the admin queue command header (Greg Rose)  [Orabug: 21539654]  
  - i40e: ignore duplicate port VLAN requests (Mitch Williams)  [Orabug: 21539654]  
  - i40evf: Allow for an abundance of vectors (Mitch Williams)  [Orabug: 21539654]  
  - i40e/i40evf: Update Flex-10 related device/function capabilities (Pawel Orlowski)  [Orabug: 21539654]  
  - i40e/i40evf: Add stats to track FD ATR and SB dynamic enable state (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40evf: don't configure unused RSS queues (Mitch Williams)  [Orabug: 21539654]  
  - i40evf: fix panic during MTU change (Mitch Williams)  [Orabug: 21539654]  
  - i40e: Bump version to 1.3.4 (Catherine Sullivan)  [Orabug: 21539654]  
  - i40e/i40evf: remove time_stamp member (Jesse Brandeburg)  [Orabug: 21539654]  
  - i40e/i40evf: force inline transmit functions (Jesse Brandeburg)  [Orabug: 21539654]  
  - i40e: Move the FD ATR/SB messages to a higher debug level (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e: fix unrecognized FCOE EOF case (Vasu Dev)  [Orabug: 21539654]  
  - i40e: Remove unnecessary pf members (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e/i40evf: Add stats to count Tunnel ATR hits (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e/i40evf: Add ATR support for tunneled TCP/IPv4/IPv6 packets. (Anjali Singhai Jain)  [Orabug: 21539654]  
  - i40e: Disable offline diagnostics if VFs are enabled (Greg Rose)  [Orabug: 21539654]  
  - i40e: Collect PFC XOFF RX stats even in single TC case (Neerav Parikh)  [Orabug: 21539654]  
  - i40e/i40evf: Fix mixed size frags and linearization (Anjali Singhai Jain)  [Orabug: 21539654]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-113.el6uek]
changelog:
  - mlx4_core: Release counters while releasing slave resources (Wengang Wang)  [Orabug: 21116780]  
  - IB/ipoib: Disable TSO in connected mode (Yuval Shaia)  [Orabug: 21684386]  
  - Revert "IB/ipoib: Disable TSO in connected mode" (Yuval Shaia)  [Orabug: 21968983]  
  - Revert "IB/ipoib: Disable TSO in connected mode" (Yuval Shaia)  [Orabug: 21968983]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-114.el6uek]
changelog:
  - rds: revert commit 4348013 (Rama Nichanamatlu)  [Orabug: 22039425]  
  - qlcnic: Fix mailbox completion handling in spurious interrupt (Rajesh Borundia)   
  - xen-netfront: set max_queue default to 8 (Joe Jin)  [Orabug: 21981690]  
  - xen-netfront: update num_queues to real created (Joe Jin)  [Orabug: 21981690]  
  - lpfc: Update version to 11.0.0.1 for patch set (James Smart)  [Orabug: 21860804]  
  - lpfc: Fix default RA_TOV and ED_TOV in the FC/FCoE driver  for all topologies (James Smart)  [Orabug: 21860804]  
  - lpfc: The linux driver does not reinitiate discovery after a failed FLOGI (James Smart)  [Orabug: 21860804]  
  - lpfc: Fix for discovery failure in PT2PT when FLOGI's ELS  ACC response gets aborted (James Smart)  [Orabug: 21860804]  
  - lpfc: Add support for Lancer G6 and 32G FC links (James Smart)  [Orabug: 21860804]  
  - fix: lpfc_send_rscn_event sends bigger buffer size (James Smart)  [Orabug: 21860804]  
  - lpfc: Fix possible use-after-free and double free (James Smart)  [Orabug: 21860804]  
  - lpfc: remove set but not used variables (James Smart)  [Orabug: 21860804]  
  - lpfc: Make the function lpfc_sli4_mbox_completions_pending static (James Smart)  [Orabug: 21860804]  
  - Fix kmalloc overflow in LPFC driver at large core count (James Smart)  [Orabug: 21860804]  
  - lpfc: Destroy lpfc_hba_index IDR on module exit (James Smart)  [Orabug: 21860804]  
  - lpfc: in sli3 use configured sg_seg_cnt for sg_tablesize (James Smart)  [Orabug: 21860804]  
  - lpfc: Remove unnessary cast (James Smart)  [Orabug: 21860804]  
  - lpfc: fix model description (James Smart)  [Orabug: 21860804]  
  - lpfc: Fix to drop PLOGIs from fabric node till LOGO proce ssing completes (James Smart)  [Orabug: 21860804]  
  - lpfc: Fix scsi task management error message. (James Smart)  [Orabug: 21860804]  
  - lpfc: Fix cq_id masking problem. (James Smart)  [Orabug: 21860804]  
  - lpfc: Fix scsi prep dma buf error. (James Smart)  [Orabug: 21860804]  
  - lpfc: Add support for using block multi-queue (James Smart)  [Orabug: 21860804]  
  - lpfc: Devices are not discovered during takeaway/giveback  testing. (James Smart)  [Orabug: 21860804]  
  - lpfc: Fix vport deletion failure. (James Smart)  [Orabug: 21860804]  
  - lpfc: Check for active portpeerbeacon. (James Smart)  [Orabug: 21860804]  
  - RDS: fix race condition when sending a message on unbound socket. (Quentin Casasnovas)  [Orabug: 21882586]  {CVE-2015-6937} 
  - RDS: make send_batch_count tunable effective (Santosh Shilimkar)  [Orabug: 21882586]  
  - RDS: make use of kfree_rcu() and avoid the call_rcu() chain (Santosh Shilimkar)  [Orabug: 21882586]  
  - RDS: verify the underlying transport exists before creating a connection (Sasha Levin)  [Orabug: 21882586]  
  - RDS: Disable broken APM feature code (Santosh Shilimkar)  [Orabug: 22045256]  
  - RDS: return EMSGSIZE for oversize requests before processing/queueing (Mukesh Kacker)  [Orabug: 21882586]  
  - RDS: Make active bonding parameters names consistent (Santosh Shilimkar)  [Orabug: 21882586]  
  - IB/mlx4: Use vmalloc for WR buffers when needed (Wengang Wang)  [Orabug: 21835374]  
  - mm: move kvfree to mm/util (Wengang Wang)  [Orabug: 21835374]  
  - x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when sanitizing map (Malcolm Crossley)   
  - netdev: fix NETIF_F_GSO_UDP_TUNNEL_BIT enum shift in i40e driver import (Todd Vierling)  [Orabug: 21958024]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-115.el6uek]
changelog:
  - Disable VLAN 0 tagging for none VLAN traffic (Joe Jin)  [Orabug: 20832922]  
  - x86/efi: Make efi virtual runtime map passing more robust (Borislav Petkov)  [Orabug: 22020990]  
  - IB/rds_rdma: unloading of ofed stack causes page fault panic (Rama Nichanamatlu)  [Orabug: 22039748]  
  - xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing) (Cathy Avery)  [Orabug: 21924428]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-116.el6uek]
changelog:
  - team: check return value of team_get_port_by_index_rcu() for NULL (Jiri Pirko)  [Orabug: 21944235]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-117.el6uek]
changelog:
  - virtio-net: drop NETIF_F_FRAGLIST (Jason Wang)  [Orabug: 22145600]  {CVE-2015-5156} 
  - team: check return value of team_get_port_by_index_rcu() for NULL (Jiri Pirko)  [Orabug: 21944235]  
  - team: check return value of team_get_port_by_index_rcu() for NULL (Jiri Pirko)  [Orabug: 21944235]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.el6uek]
changelog:
  - Update ql2400/ql2500 firmware version to 8.02.00 (Dan Duval)  [Orabug: 22159505]  
  - update qla2400/ql2500 firmware version to 8.02.00 (Dan Duval)  [Orabug: 22159505]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.1.1.el6uek]
changelog:
  - sctp: fix race on protocol/netns initialization (Marcelo Ricardo Leitner)  [Orabug: 22249981]  {CVE-2015-5283} 
  - Initialize msg/shm IPC objects before doing ipc_addid() (Linus Torvalds)  [Orabug: 22250045]  {CVE-2015-7613} 
  - ixgbe: reset copper phy power mode (Ethan Zhao)  [Orabug: 22271769]


author: Chuck Anderson <chuck.anderson@oracle.com> [3.8.13-118.2.2.el6uek]
changelog:
  - KVM: svm: unconditionally intercept #DB (Paolo Bonzini)  [Orabug: 22333698]  {CVE-2015-8104} 
  - KVM: x86: work around infinite loop in microcode when #AC is delivered (Eric Northup)  [Orabug: 22333689]  {CVE-2015-5307} {CVE-2015-5307} 
  - KVM: x86: Defining missing x86 vectors (Nadav Amit)  [Orabug: 22333689]


author: Chuck Anderson <chuck.anderson@oracle.com> [3.8.13-118.2.3.el6uek]
changelog:
  - dcache: Handle escaped paths in prepend_path (Eric W. Biederman)  [Orabug: 22373283]  
  - vfs: Test for and handle paths that are unreachable from their mnt_root (Eric W. Biederman)  [Orabug: 22249875]  
  - KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring (David Howells)  [Orabug: 22373442]  {CVE-2015-7872} 
  - KEYS: Fix race between key destruction and finding a keyring by name (David Howells)  [Orabug: 22373442]


author: Chuck Anderson <chuck.anderson@oracle.com> [3.8.13-118.2.4.el6uek]
changelog:
  - KEYS: Don't permit request_key() to construct a new keyring (David Howells)  [Orabug: 22373442]  {CVE-2015-7872}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.2.5.el6uek]
changelog:
  - KEYS: Fix keyring ref leak in join_session_keyring() (Yevgeny Pats)  [Orabug: 22563965]  {CVE-2016-0728}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.20.1.el6uek]
changelog:
  - tty: Fix race in pty_write() leading to NULL deref (Todd Vierling)  [Orabug: 25392692]  
  - ocfs2/dlm: ignore cleaning the migration mle that is inuse (xuejiufei)  [Orabug: 26479780]  
  - KEYS: fix dereferencing NULL payload with nonzero length (Eric Biggers)  [Orabug: 26592025]  
  - oracleasm: Copy the integrity descriptor (Martin K. Petersen)  [Orabug: 26649818]  
  - mm: Tighten x86 /dev/mem with zeroing reads (Kees Cook)  [Orabug: 26675925]  {CVE-2017-7889} 
  - xscore: add dma address check (Zhu Yanjun)  [Orabug: 27058468]  
  - more bio_map_user_iov() leak fixes (Al Viro)  [Orabug: 27069042]  {CVE-2017-12190} 
  - fix unbalanced page refcounting in bio_map_user_iov (Vitaly Mayatskikh)  [Orabug: 27069042]  {CVE-2017-12190} 
  - nvme: Drop nvmeq->q_lock before dma_pool_alloc(), so as to prevent hard lockups (Aruna Ramakrishna)  [Orabug: 25409587]  
  - nvme: Handle PM1725 HIL reset (Martin K. Petersen)  [Orabug: 26277600]  
  - char: lp: fix possible integer overflow in lp_setup() (Willy Tarreau)  [Orabug: 26403940]  {CVE-2017-1000363} 
  - ALSA: timer: Fix missing queue indices reset at SNDRV_TIMER_IOCTL_SELECT (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race between read and ioctl (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: fix NULL pointer dereference in read()/ioctl() race (Vegard Nossum)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix negative queue usage by racy accesses (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race at concurrent reads (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ALSA: timer: Fix race among timer ioctls (Takashi Iwai)  [Orabug: 26403956]  {CVE-2017-1000380} 
  - ipv6/dccp: do not inherit ipv6_mc_list from parent (WANG Cong)  [Orabug: 26404005]  {CVE-2017-9077} 
  - ocfs2: fix deadlock issue when taking inode lock at vfs entry points (Eric Ren)  [Orabug: 26427126]  
  - ocfs2/dlmglue: prepare tracking logic to avoid recursive cluster lock (Eric Ren)  [Orabug: 26427126]  
  - ping: implement proper locking (Eric Dumazet)  [Orabug: 26540286]  {CVE-2017-2671} 
  - aio: mark AIO pseudo-fs noexec (Jann Horn)  [Orabug: 26643598]  {CVE-2016-10044} 
  - vfs: Commit to never having exectuables on proc and sysfs. (Eric W. Biederman)  [Orabug: 26643598]  {CVE-2016-10044} 
  - vfs, writeback: replace FS_CGROUP_WRITEBACK with SB_I_CGROUPWB (Tejun Heo)  [Orabug: 26643598]  {CVE-2016-10044} 
  - x86/acpi: Prevent out of bound access caused by broken ACPI tables (Seunghun Han)  [Orabug: 26643645]  {CVE-2017-11473} 
  - sctp: do not inherit ipv6_{mc|ac|fl}_list from parent (Eric Dumazet)  [Orabug: 26650883]  {CVE-2017-9075} 
  - [media] saa7164: fix double fetch PCIe access condition (Steven Toth)  [Orabug: 26675142]  {CVE-2017-8831} 
  - [media] saa7164: fix sparse warnings (Hans Verkuil)  [Orabug: 26675142]  {CVE-2017-8831} 
  - fs: __generic_file_splice_read retry lookup on AOP_TRUNCATED_PAGE (Abhi Das)  [Orabug: 26797306]  
  - timerfd: Protect the might cancel mechanism proper (Thomas Gleixner)  [Orabug: 26899787]  {CVE-2017-10661} 
  - scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly (Xin Long)  [Orabug: 26988627]  {CVE-2017-14489} 
  - mqueue: fix a use-after-free in sys_mq_notify() (Cong Wang)  [Orabug: 26643556]  {CVE-2017-11176} 
  - ipv6: avoid overflow of offset in ip6_find_1stfragopt (Sabrina Dubroca)  [Orabug: 27011273]  {CVE-2017-7542} 
  - packet: fix tp_reserve race in packet_set_ring (Willem de Bruijn)  [Orabug: 27002450]  {CVE-2017-1000111} 
  - mlx4_core: calculate log_num_mtt based on total system memory (Wei Lin Guay)  [Orabug: 26883934]  
  - xen/x86: Add interface for querying amount of host memory (Boris Ostrovsky)  [Orabug: 26883934]  
  - Bluetooth: Properly check L2CAP config option output buffer length (Ben Seri)  [Orabug: 26796364]  {CVE-2017-1000251} 
  - xen: fix bio vec merging (Roger Pau Monne)  [Orabug: 26645550]  {CVE-2017-12134} 
  - fs/exec.c: account for argv/envp pointers (Kees Cook)  [Orabug: 26638921]  {CVE-2017-1000365} {CVE-2017-1000365} 
  - l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind() (Guillaume Nault)  [Orabug: 26586047]  {CVE-2016-10200} 
  - xfs: fix two memory leaks in xfs_attr_list.c error paths (Mateusz Guzik)  [Orabug: 26586022]  {CVE-2016-9685} 
  - KEYS: Disallow keyrings beginning with '.' to be joined as session keyrings (David Howells)  [Orabug: 26585994]  {CVE-2016-9604} 
  - ipv6: fix out of bound writes in __ip6_append_data() (Eric Dumazet)  [Orabug: 26578198]  {CVE-2017-9242} 
  - posix_acl: Clear SGID bit when setting file permissions (Jan Kara)  [Orabug: 25507344]  {CVE-2016-7097} {CVE-2016-7097} 
  - nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields)  [Orabug: 26366022]  {CVE-2017-7645}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.20.2.el6uek]
changelog:
  - x86: Add another set of MSR accessor functions (Borislav Petkov)  [Orabug: 27444923]  {CVE-2017-5753} 
  - userns: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - udf: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - fs: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - qla2xxx: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - p54: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - carl9170: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - uvcvideo: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - locking/barriers: introduce new observable speculation barrier (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - x86/cpu/AMD: Make the LFENCE instruction serialized (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - x86/rsb: add comment specifying why we skip STUFF_RSB (Ankur Arora)  [Orabug: 27451658]  {CVE-2017-5715} 
  - x86/rsb: make STUFF_RSB jmp labels more robust (Ankur Arora)  [Orabug: 27451658]  {CVE-2017-5715} 
  - x86/spec: Also print IBRS if IBPB is disabled. (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - x86/spectre: Drop the warning about ibrs being obsolete. (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - Add set_ibrs_disabled and set_ibpb_disabled (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/spec: Don't print the Missing arguments for option spectre_v2 (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/boot: Add early cmdline parsing for options with arguments (Tom Lendacky)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86, boot: Carve out early cmdline parsing function (Borislav Petkov)  [Orabug: 27376697]  
  - x86: Add command-line options 'spectre_v2' and 'nospectre_v2' (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Fix kABI build breakage (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/mm: Only set IBPB when the new thread cannot ptrace current thread (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Use PRED_CMD MSR when ibpb is enabled (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/mm: Set IBPB upon context switch (Brian Maly)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Display correct settings for the SPECTRE_V[12] bug (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/cpu: Implement CPU vulnerabilites sysfs functions (Thomas Gleixner)  [Orabug: 27376697]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/IBRS/IBPB: Set sysctl_ibrs/ibpb_enabled properly (Boris Ostrovsky)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/spec_ctrl: Disable if running as Xen PV guest (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - sysfs/cpu: Add vulnerability folder (Thomas Gleixner)  [Orabug: 27376697]  {CVE-2017-5715} {CVE-2017-5754} 
  - x86, cpu: Expand cpufeature facility to include cpu bugs (Borislav Petkov)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/cpufeatures: Add X86_BUG_CPU_MELTDOWN (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5754} 
  - x86/entry: STUFF_RSB only after switching to kernel CR3 (Ankur Arora)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/IBRS: Make sure we restore MSR_IA32_SPEC_CTRL to a valid value (Boris Ostrovsky)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Use IBRS for firmware update path (David Woodhouse)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/microcode: Recheck IBRS features on microcode reload (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/idle: Disable IBRS entering idle and enable it on wakeup (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/enter: Use IBRS on syscall and interrupts (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/enter: MACROS to set/clear IBRS (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/feature: Detect the x86 IBRS feature to control Speculation (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/pti/efi: broken conversion from efi to kernel page table (Pavel Tatashin)  [Orabug: 27333764]  {CVE-2017-5754} 
  - PTI: unbreak EFI old_memmap (Jiri Kosina)  [Orabug: 27333764] [Orabug: 27333760]  {CVE-2017-5754} {CVE-2017-5754} 
  - kaiser: Set _PAGE_NX only if supported (Lepton Wu)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: rename X86_FEATURE_KAISER to X86_FEATURE_PTI (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - KPTI: Rename to PAGE_TABLE_ISOLATION (Kees Cook)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/kaiser: Check boottime cmdline params (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: x86: Fix NMI handling (Jiri Kosina)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: move paravirt clock vsyscall mapping out of kaiser_init (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: disable if xen PARAVIRT (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/kaiser: Reenable PARAVIRT (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: kaiser_flush_tlb_on_return_to_user() check PCID (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: asm/tlbflush.h handle noPGE at lower level (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: add "nokaiser" boot option, using ALTERNATIVE (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/alternatives: add asm ALTERNATIVE macro (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: alloc_ldt_struct() use get_zeroed_page() (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86: kvmclock: Disable use from vDSO if KPTI is enabled (Ben Hutchings)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: Fix build with CONFIG_FUNCTION_GRAPH_TRACER (Kees Cook)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm/kaiser: re-enable vsyscalls (Andrea Arcangeli)  [Orabug: 27333764]  {CVE-2017-5754} 
  - KAISER: Kernel Address Isolation (Richard Fellner)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kprobes: Prohibit probing on .entry.text code (Masami Hiramatsu)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm/64: Fix reboot interaction with CR4.PCIDE (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Enable CR4.PCIDE on supported systems (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Add the 'nopcid' boot option to turn off PCID (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Disable PCID on 32-bit kernels (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Fix flush_tlb_page() on Xen (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Disable preemption during CR3 read+write (Sebastian Andrzej Siewior)  [Orabug: 27333764]  {CVE-2017-5754} 
  - sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm, sched/core: Turn off IRQs in switch_mm() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm, sched/core: Uninline switch_mm() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Build arch/x86/mm/tlb.c even on !SMP (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - sched/core: Add switch_mm_irqs_off() and use it in the scheduler (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - mm/mmu_context, sched/core: Fix mmu_context.h assumption (Ingo Molnar)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: If INVPCID is available, use it to flush global mappings (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Fix INVPCID asm constraint (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Add INVPCID helpers (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86: Clean up cr4 manipulation (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/paravirt: Dont patch flush_tlb_single (Thomas Gleixner)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/ldt: Make modify_ldt synchronous (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} {CVE-2015-5157}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.20.3.el6uek]
changelog:
  - gre: fix a possible skb leak (Eric Dumazet)  [Orabug: 26403972]  {CVE-2017-9074} 
  - ipv6: Fix leak in ipv6_gso_segment(). (David S. Miller)  [Orabug: 26403972]  {CVE-2017-9074} 
  - ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() (Ben Hutchings)  [Orabug: 26403972]  {CVE-2017-9074} 
  - ipv6: Check ip6_find_1stfragopt() return value properly. (David S. Miller)  [Orabug: 26403972]  {CVE-2017-9074} 
  - ipv6: Prevent overrun when parsing v6 header options (Craig Gallek)  [Orabug: 26403972]  {CVE-2017-9074} 
  - tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Wei Wang)  [Orabug: 26813390]  {CVE-2017-14106} 
  - rxrpc: Fix several cases where a padded len isn't checked in ticket decode (David Howells)  [Orabug: 26880517]  {CVE-2017-7482} {CVE-2017-7482} 
  - xen/mmu: Call xen_cleanhighmap() with 4MB aligned for page tables mapping (Zhenzhong Duan)  [Orabug: 26883322]  
  - KVM: x86: fix deadlock in clock-in-progress request handling (Marcelo Tosatti)  [Orabug: 27065995]  
  - ocfs2: fstrim: Fix start offset of first cluster group during fstrim (Ashish Samant)  [Orabug: 27099835]  
  - USB: serial: console: fix use-after-free after failed setup (Johan Hovold)  [Orabug: 27206837]  {CVE-2017-16525} 
  - uwb: properly check kthread_run return value (Andrey Konovalov)  [Orabug: 27206897]  {CVE-2017-16526} 
  - ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor (Takashi Iwai)  [Orabug: 27206928]  {CVE-2017-16529} 
  - USB: fix out-of-bounds in usb_set_configuration (Greg Kroah-Hartman)  [Orabug: 27207240]  {CVE-2017-16531} 
  - USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor() (Alan Stern)  [Orabug: 27207983]  {CVE-2017-16535} 
  - dccp: CVE-2017-8824: use-after-free in DCCP code (Mohamed Ghannam)  [Orabug: 27290301]  {CVE-2017-8824}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.20.4.el6uek]
changelog:
  - Drivers: hv: fcopy: set .owner reference for file operations (Joe Jin)  [Orabug: 21191022]  
  - ALSA: usb-audio: Kill stray URB at exiting (Takashi Iwai)  [Orabug: 27148281]  {CVE-2017-16527} 
  - HID: usbhid: fix out-of-bounds bug (Jaejoong Kim)  [Orabug: 27207929]  {CVE-2017-16533} 
  - [media] cx231xx-cards: fix NULL-deref on missing association descriptor (Johan Hovold)  [Orabug: 27208072]  {CVE-2017-16536} 
  - net: cdc_ether: fix divide by 0 on bad descriptors (Bjørn Mork)  [Orabug: 27215201]  {CVE-2017-16649} 
  - x86/microcode/intel: Extend BDW late-loading with a revision check (Jia Zhang)  [Orabug: 27343577]  
  - x86/microcode/intel: Disable late loading on model 79 (Borislav Petkov)  [Orabug: 27343577]  
  - Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket (Al Viro)  [Orabug: 27344793]  {CVE-2017-15868} 
  - Bluetooth: hidp: verify l2cap sockets (David Herrmann)  [Orabug: 27344793]  {CVE-2017-15868} 
  - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)  [Orabug: 27344843]  {CVE-2017-0861} {CVE-2017-0861} 
  - ptrace: use fsuid, fsgid, effective creds for fs access checks (Jann Horn)  [Orabug: 27364691]  {CVE-2017-14140} 
  - sctp: do not peel off an assoc from one netns to another one (Xin Long)  [Orabug: 27387001]  {CVE-2017-15115} 
  - Revert "x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation" (Ankur Arora)  [Orabug: 27601787]  {CVE-2017-5715} 
  - Revert "x86/spec: Add 'lfence_enabled' in sysfs" (Ankur Arora)  [Orabug: 27601787]  {CVE-2017-5715} 
  - Revert "x86/mitigation/spectre_v2: Add reporting of 'lfence'" (Ankur Arora)  [Orabug: 27601787]  {CVE-2017-5715} 
  - x86/mitigation/spectre_v2: Add reporting of 'lfence' (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - x86/spec: Add 'lfence_enabled' in sysfs (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - x86/spectre: bring spec_ctrl management logic closer to UEK4 (Ankur Arora)  [Orabug: 27516512]  {CVE-2017-5715} 
  - x86/cpufeatures: Clean up Spectre v2 related CPUID flags (David Woodhouse)  [Orabug: 27516357]  {CVE-2017-5715} 
  - x86/spectre_v2: Remove 0xc2 from spectre_bad_microcodes (Darren Kenny)  [Orabug: 27516419]  {CVE-2017-5715} 
  - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (David Woodhouse)  [Orabug: 27516419]  {CVE-2017-5715} 
  - x86: intel-family.h: Add GEMINI_LAKE SOC (Len Brown)  [Orabug: 27516419]  
  - x86/cpu/intel: Introduce macros for Intel family numbers (Dave Hansen)  [Orabug: 27516419]  
  - x86/spectre: expose 'stibp' (Konrad Rzeszutek Wilk)  [Orabug: 27516419]  {CVE-2017-5715} 
  - x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support (David Woodhouse)  [Orabug: 27516379]  {CVE-2017-5715} 
  - x86/speculation: Use Indirect Branch Prediction Barrier in context switch (Tim Chen)  [Orabug: 27516379]  {CVE-2017-5715} 
  - x86/spectre: fix spectre_v1 mitigation indicators (Ankur Arora)  [Orabug: 27509932]  {CVE-2017-5715} 
  - x86/ia32/syscall: Clear extended registers %r8-%r15 (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - x86/ia32/syscall: Save full stack frame throughout the entry code (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - x86/ia32/syscall: cleanup trailing whitespace (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - x86/syscall: Clear callee saved registers (%r12-%r15, %rbp, %rbx) (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - x86/syscall: Save callee saved registers on syscall entrance (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.20.5.el6uek]
changelog:
  - x86/microcode: probe CPU features on microcode update (Ankur Arora)  [Orabug: 27806667]  
  - x86/microcode: microcode_write() should not reference boot_cpu_data (Ankur Arora)  [Orabug: 27806667]  
  - x86/cpufeatures: use cpu_data in init_scattered_cpuid_flags() (Ankur Arora)  [Orabug: 27806667]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.20.6.el6uek]
changelog:
  - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds)  [Orabug: 27947608]  {CVE-2018-100199}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.21.1.el6uek]
changelog:
  - media: imon: Fix null-ptr-deref in imon_probe (Arvind Yadav)  [Orabug: 27208380]  {CVE-2017-16537} 
  - Input: gtco - fix potential out-of-bound access (Dmitry Torokhov)  [Orabug: 27215090]  {CVE-2017-16643} 
  - usb: usbtest: fix NULL pointer dereference (Alan Stern)  [Orabug: 27602324]  {CVE-2017-16532} 
  - x86/spectre_v2: Fix cpu offlining with IPBP. (Konrad Rzeszutek Wilk)   
  - fuse: fix deadlock caused by wrong locking order (Junxiao Bi)  [Orabug: 27760268]  
  - jbd: don't wait (forever) for stale tid caused by wraparound (Jan Kara)  [Orabug: 27842289]  
  - netfilter: ebtables: CONFIG_COMPAT: don't trust userland offsets (Florian Westphal)  [Orabug: 27774015]  {CVE-2018-1068} 
  - RDS: IB: Fix null pointer issue (hui.han)  [Orabug: 27843171]  
  - ext4: add validity checks for bitmap block numbers (Theodore Ts'o)  [Orabug: 27854376]  {CVE-2018-1093} {CVE-2018-1093} 
  - USB: core: prevent malicious bNumInterfaces overflow (Alan Stern)  [Orabug: 27898074]  {CVE-2017-17558} 
  - netfilter: nfnetlink_cthelper: Add missing permission checks (Kevin Cernekee)  [Orabug: 27898167]  {CVE-2017-17448} 
  - KEYS: don't let add_key() update an uninstantiated key (David Howells)  [Orabug: 27913332]  {CVE-2017-15299} 
  - RDS: Heap OOB write in rds_message_alloc_sgs() (Mohamed Ghannam)  [Orabug: 27934073]  {CVE-2018-5332} 
  - x86/entry/64: Dont use IST entry for #BP stack (Andy Lutomirski)   {CVE-2018-8897} 
  - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds)  [Orabug: 27947608]  {CVE-2018-100199} 
  - x86/microcode: probe CPU features on microcode update (Ankur Arora)  [Orabug: 27806667]  
  - x86/microcode: microcode_write() should not reference boot_cpu_data (Ankur Arora)  [Orabug: 27806667]  
  - x86/cpufeatures: use cpu_data in init_scattered_cpuid_flags() (Ankur Arora)  [Orabug: 27806667]  
  - Drivers: hv: fcopy: set .owner reference for file operations (Joe Jin)  [Orabug: 21191022]  
  - ALSA: usb-audio: Kill stray URB at exiting (Takashi Iwai)  [Orabug: 27148281]  {CVE-2017-16527} 
  - HID: usbhid: fix out-of-bounds bug (Jaejoong Kim)  [Orabug: 27207929]  {CVE-2017-16533} 
  - [media] cx231xx-cards: fix NULL-deref on missing association descriptor (Johan Hovold)  [Orabug: 27208072]  {CVE-2017-16536} 
  - net: cdc_ether: fix divide by 0 on bad descriptors (Bjørn Mork)  [Orabug: 27215201]  {CVE-2017-16649} 
  - x86/microcode/intel: Extend BDW late-loading with a revision check (Jia Zhang)  [Orabug: 27343577]  
  - x86/microcode/intel: Disable late loading on model 79 (Borislav Petkov)  [Orabug: 27343577]  
  - Bluetooth: bnep: bnep_add_connection() should verify that it's dealing with l2cap socket (Al Viro)  [Orabug: 27344793]  {CVE-2017-15868} 
  - Bluetooth: hidp: verify l2cap sockets (David Herrmann)  [Orabug: 27344793]  {CVE-2017-15868} 
  - ALSA: pcm: prevent UAF in snd_pcm_info (Robb Glasser)  [Orabug: 27344843]  {CVE-2017-0861} {CVE-2017-0861} 
  - ptrace: use fsuid, fsgid, effective creds for fs access checks (Jann Horn)  [Orabug: 27364691]  {CVE-2017-14140} 
  - sctp: do not peel off an assoc from one netns to another one (Xin Long)  [Orabug: 27387001]  {CVE-2017-15115} 
  - Revert "x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation" (Ankur Arora)  [Orabug: 27601787]  {CVE-2017-5715} 
  - Revert "x86/spec: Add 'lfence_enabled' in sysfs" (Ankur Arora)  [Orabug: 27601787]  {CVE-2017-5715} 
  - Revert "x86/mitigation/spectre_v2: Add reporting of 'lfence'" (Ankur Arora)  [Orabug: 27601787]  {CVE-2017-5715} 
  - x86/mitigation/spectre_v2: Add reporting of 'lfence' (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - x86/spec: Add 'lfence_enabled' in sysfs (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - x86/spec_ctrl: Add 'nolfence' knob to disable fallback for spectre_v2 mitigation (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - x86/spectre: bring spec_ctrl management logic closer to UEK4 (Ankur Arora)  [Orabug: 27516512]  {CVE-2017-5715} 
  - x86/cpufeatures: Clean up Spectre v2 related CPUID flags (David Woodhouse)  [Orabug: 27516357]  {CVE-2017-5715} 
  - x86/spectre_v2: Remove 0xc2 from spectre_bad_microcodes (Darren Kenny)  [Orabug: 27516419]  {CVE-2017-5715} 
  - x86/cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (David Woodhouse)  [Orabug: 27516419]  {CVE-2017-5715} 
  - x86: intel-family.h: Add GEMINI_LAKE SOC (Len Brown)  [Orabug: 27516419]  
  - x86/cpu/intel: Introduce macros for Intel family numbers (Dave Hansen)  [Orabug: 27516419]  
  - x86/spectre: expose 'stibp' (Konrad Rzeszutek Wilk)  [Orabug: 27516419]  {CVE-2017-5715} 
  - x86/speculation: Add basic IBPB (Indirect Branch Prediction Barrier) support (David Woodhouse)  [Orabug: 27516379]  {CVE-2017-5715} 
  - x86/speculation: Use Indirect Branch Prediction Barrier in context switch (Tim Chen)  [Orabug: 27516379]  {CVE-2017-5715} 
  - x86/spectre: fix spectre_v1 mitigation indicators (Ankur Arora)  [Orabug: 27509932]  {CVE-2017-5715} 
  - x86/ia32/syscall: Clear extended registers %r8-%r15 (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - x86/ia32/syscall: Save full stack frame throughout the entry code (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - x86/ia32/syscall: cleanup trailing whitespace (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - x86/syscall: Clear callee saved registers (%r12-%r15, %rbp, %rbx) (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - x86/syscall: Save callee saved registers on syscall entrance (Ankur Arora)  [Orabug: 27452028]  {CVE-2017-5715} 
  - gre: fix a possible skb leak (Eric Dumazet)  [Orabug: 26403972]  {CVE-2017-9074} 
  - ipv6: Fix leak in ipv6_gso_segment(). (David S. Miller)  [Orabug: 26403972]  {CVE-2017-9074} 
  - ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() (Ben Hutchings)  [Orabug: 26403972]  {CVE-2017-9074} 
  - ipv6: Check ip6_find_1stfragopt() return value properly. (David S. Miller)  [Orabug: 26403972]  {CVE-2017-9074} 
  - ipv6: Prevent overrun when parsing v6 header options (Craig Gallek)  [Orabug: 26403972]  {CVE-2017-9074} 
  - tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Wei Wang)  [Orabug: 26813390]  {CVE-2017-14106} 
  - rxrpc: Fix several cases where a padded len isn't checked in ticket decode (David Howells)  [Orabug: 26880517]  {CVE-2017-7482} {CVE-2017-7482} 
  - xen/mmu: Call xen_cleanhighmap() with 4MB aligned for page tables mapping (Zhenzhong Duan)  [Orabug: 26883322]  
  - KVM: x86: fix deadlock in clock-in-progress request handling (Marcelo Tosatti)  [Orabug: 27065995]  
  - ocfs2: fstrim: Fix start offset of first cluster group during fstrim (Ashish Samant)  [Orabug: 27099835]  
  - USB: serial: console: fix use-after-free after failed setup (Johan Hovold)  [Orabug: 27206837]  {CVE-2017-16525} 
  - uwb: properly check kthread_run return value (Andrey Konovalov)  [Orabug: 27206897]  {CVE-2017-16526} 
  - ALSA: usb-audio: Check out-of-bounds access by corrupted buffer descriptor (Takashi Iwai)  [Orabug: 27206928]  {CVE-2017-16529} 
  - USB: fix out-of-bounds in usb_set_configuration (Greg Kroah-Hartman)  [Orabug: 27207240]  {CVE-2017-16531} 
  - USB: core: fix out-of-bounds access bug in usb_get_bos_descriptor() (Alan Stern)  [Orabug: 27207983]  {CVE-2017-16535} 
  - dccp: CVE-2017-8824: use-after-free in DCCP code (Mohamed Ghannam)  [Orabug: 27290301]  {CVE-2017-8824} 
  - x86: Add another set of MSR accessor functions (Borislav Petkov)  [Orabug: 27444923]  {CVE-2017-5753} 
  - userns: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - udf: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - fs: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - qla2xxx: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - p54: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - carl9170: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - uvcvideo: prevent speculative execution (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - locking/barriers: introduce new observable speculation barrier (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - x86/cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - x86/cpu/AMD: Make the LFENCE instruction serialized (Elena Reshetova)  [Orabug: 27444923]  {CVE-2017-5753} 
  - x86/rsb: add comment specifying why we skip STUFF_RSB (Ankur Arora)  [Orabug: 27451658]  {CVE-2017-5715} 
  - x86/rsb: make STUFF_RSB jmp labels more robust (Ankur Arora)  [Orabug: 27451658]  {CVE-2017-5715} 
  - x86/spec: Also print IBRS if IBPB is disabled. (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - x86/spectre: Drop the warning about ibrs being obsolete. (Konrad Rzeszutek Wilk)   {CVE-2017-5715} 
  - Add set_ibrs_disabled and set_ibpb_disabled (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/spec: Don't print the Missing arguments for option spectre_v2 (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/boot: Add early cmdline parsing for options with arguments (Tom Lendacky)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86, boot: Carve out early cmdline parsing function (Borislav Petkov)  [Orabug: 27376697]  
  - x86: Add command-line options 'spectre_v2' and 'nospectre_v2' (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Fix kABI build breakage (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/mm: Only set IBPB when the new thread cannot ptrace current thread (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Use PRED_CMD MSR when ibpb is enabled (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/mm: Set IBPB upon context switch (Brian Maly)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Display correct settings for the SPECTRE_V[12] bug (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/cpu: Implement CPU vulnerabilites sysfs functions (Thomas Gleixner)  [Orabug: 27376697]  {CVE-2017-5715} {CVE-2017-5753} 
  - x86/IBRS/IBPB: Set sysctl_ibrs/ibpb_enabled properly (Boris Ostrovsky)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/spec_ctrl: Disable if running as Xen PV guest (Konrad Rzeszutek Wilk)  [Orabug: 27376697]  {CVE-2017-5715} 
  - sysfs/cpu: Add vulnerability folder (Thomas Gleixner)  [Orabug: 27376697]  {CVE-2017-5715} {CVE-2017-5754} 
  - x86, cpu: Expand cpufeature facility to include cpu bugs (Borislav Petkov)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/cpufeatures: Add X86_BUG_SPECTRE_V[12] (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/cpufeatures: Add X86_BUG_CPU_MELTDOWN (Kanth Ghatraju)  [Orabug: 27376697]  {CVE-2017-5754} 
  - x86/entry: STUFF_RSB only after switching to kernel CR3 (Ankur Arora)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/entry: Stuff RSB for entry to kernel for non-SMEP platform (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/IBRS: Make sure we restore MSR_IA32_SPEC_CTRL to a valid value (Boris Ostrovsky)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86: Use IBRS for firmware update path (David Woodhouse)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/microcode: Recheck IBRS features on microcode reload (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/idle: Disable IBRS entering idle and enable it on wakeup (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/spec_ctrl: Add sysctl knobs to enable/disable SPEC_CTRL feature (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/enter: Use IBRS on syscall and interrupts (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/enter: MACROS to set/clear IBRS (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/feature: Detect the x86 IBRS feature to control Speculation (Tim Chen)  [Orabug: 27376697]  {CVE-2017-5715} 
  - x86/pti/efi: broken conversion from efi to kernel page table (Pavel Tatashin)  [Orabug: 27333764]  {CVE-2017-5754} 
  - PTI: unbreak EFI old_memmap (Jiri Kosina)  [Orabug: 27333764] [Orabug: 27333760]  {CVE-2017-5754} {CVE-2017-5754} 
  - kaiser: Set _PAGE_NX only if supported (Lepton Wu)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: rename X86_FEATURE_KAISER to X86_FEATURE_PTI (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - KPTI: Rename to PAGE_TABLE_ISOLATION (Kees Cook)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/kaiser: Check boottime cmdline params (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: x86: Fix NMI handling (Jiri Kosina)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: move paravirt clock vsyscall mapping out of kaiser_init (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: disable if xen PARAVIRT (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/kaiser: Reenable PARAVIRT (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: kaiser_flush_tlb_on_return_to_user() check PCID (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: asm/tlbflush.h handle noPGE at lower level (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: use ALTERNATIVE instead of x86_cr3_pcid_noflush (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/kaiser: Rename and simplify X86_FEATURE_KAISER handling (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: add "nokaiser" boot option, using ALTERNATIVE (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/alternatives: add asm ALTERNATIVE macro (Mike Kravetz)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: alloc_ldt_struct() use get_zeroed_page() (Hugh Dickins)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86: kvmclock: Disable use from vDSO if KPTI is enabled (Ben Hutchings)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kaiser: Fix build with CONFIG_FUNCTION_GRAPH_TRACER (Kees Cook)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm/kaiser: re-enable vsyscalls (Andrea Arcangeli)  [Orabug: 27333764]  {CVE-2017-5754} 
  - KAISER: Kernel Address Isolation (Richard Fellner)  [Orabug: 27333764]  {CVE-2017-5754} 
  - kprobes: Prohibit probing on .entry.text code (Masami Hiramatsu)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm/64: Fix reboot interaction with CR4.PCIDE (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Enable CR4.PCIDE on supported systems (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Add the 'nopcid' boot option to turn off PCID (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Disable PCID on 32-bit kernels (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Remove the UP asm/tlbflush.h code, always use the (formerly) SMP code (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Fix flush_tlb_page() on Xen (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Disable preemption during CR3 read+write (Sebastian Andrzej Siewior)  [Orabug: 27333764]  {CVE-2017-5754} 
  - sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm, sched/core: Turn off IRQs in switch_mm() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm, sched/core: Uninline switch_mm() (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Build arch/x86/mm/tlb.c even on !SMP (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - sched/core: Add switch_mm_irqs_off() and use it in the scheduler (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - mm/mmu_context, sched/core: Fix mmu_context.h assumption (Ingo Molnar)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: If INVPCID is available, use it to flush global mappings (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Add a 'noinvpcid' boot option to turn off INVPCID (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Fix INVPCID asm constraint (Borislav Petkov)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/mm: Add INVPCID helpers (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86: Clean up cr4 manipulation (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/paravirt: Dont patch flush_tlb_single (Thomas Gleixner)  [Orabug: 27333764]  {CVE-2017-5754} 
  - x86/ldt: Make modify_ldt synchronous (Andy Lutomirski)  [Orabug: 27333764]  {CVE-2017-5754} {CVE-2015-5157}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.21.2.el6uek]
changelog:
  - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds)  [Orabug: 27947608]  {CVE-2018-1000199} 
  - Revert "perf/hwbp: Simplify the perf-hwbp code, fix documentation" (Brian Maly)  [Orabug: 27947608]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.21.3.el6uek]
changelog:
  - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li)  [Orabug: 27951287]  {CVE-2017-17741} {CVE-2017-17741} 
  - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen)  [Orabug: 27989498]  {CVE-2018-10323} 
  - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri)  [Orabug: 28030520]  {CVE-2017-1000410} {CVE-2017-1000410} 
  - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2549} 
  - ALSA: timer: Harden slave timer list handling (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2547} {CVE-2016-2548} 
  - ALSA: timer: Fix double unlink of active_list (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2545} 
  - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2543} 
  - ALSA: seq: Fix race at timer setup and close (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2544} 
  - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov)  [Orabug: 28058229]  {CVE-2016-2384}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.22.1.el6uek]
changelog:
  - dm: fix race between dm_get_from_kobject() and __dm_destroy() (Hou Tao)   {CVE-2017-18203} 
  - drm: udl: Properly check framebuffer mmap offsets (Greg Kroah-Hartman)  [Orabug: 27986407]  {CVE-2018-8781} 
  - kernel/exit.c: avoid undefined behaviour when calling wait4() wait4(-2147483648, 0x20, 0, 0xdd0000) triggers: UBSAN: Undefined behaviour in kernel/exit.c:1651:9 (mridula shastry)  [Orabug: 27875488]  {CVE-2018-10087} 
  - kernel/signal.c: avoid undefined behaviour in kill_something_info When running kill(72057458746458112, 0) in userspace I hit the following issue. (mridula shastry)   {CVE-2018-10124} 
  - bluetooth: Validate socket address length in sco_sock_bind(). (mlevatic)  [Orabug: 28130293]  {CVE-2015-8575} 
  - dccp: check sk for closed state in dccp_sendmsg() (Alexey Kodanev)  [Orabug: 28220402]  {CVE-2017-8824} {CVE-2018-1130} 
  - sctp: verify size of a new chunk in _sctp_make_chunk() (Alexey Kodanev)  [Orabug: 28240075]  {CVE-2018-5803} 
  - mm/mempolicy.c: fix error handling in set_mempolicy and mbind. (Chris Salls)  [Orabug: 28242478]  {CVE-2017-7616} 
  - xfrm: policy: check policy direction value (Vladis Dronov)  [Orabug: 28264121]  {CVE-2017-11600} {CVE-2017-11600} 
  - x86/fpu: Make eager FPU default (Mihai Carabas)  [Orabug: 28156176]  {CVE-2018-3665} 
  - KVM: Fix stack-out-of-bounds read in write_mmio (Wanpeng Li)  [Orabug: 27951287]  {CVE-2017-17741} {CVE-2017-17741} 
  - xfs: set format back to extents if xfs_bmap_extents_to_btree (Eric Sandeen)  [Orabug: 27989498]  {CVE-2018-10323} 
  - Bluetooth: Prevent stack info leak from the EFS element. (Ben Seri)  [Orabug: 28030520]  {CVE-2017-1000410} {CVE-2017-1000410} 
  - ALSA: hrtimer: Fix stall by hrtimer_cancel() (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2549} 
  - ALSA: timer: Harden slave timer list handling (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2547} {CVE-2016-2548} 
  - ALSA: timer: Fix double unlink of active_list (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2545} 
  - ALSA: seq: Fix missing NULL check at remove_events ioctl (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2543} 
  - ALSA: seq: Fix race at timer setup and close (Takashi Iwai)  [Orabug: 28058229]  {CVE-2016-2544} 
  - ALSA: usb-audio: avoid freeing umidi object twice (Andrey Konovalov)  [Orabug: 28058229]  {CVE-2016-2384} 
  - perf/hwbp: Simplify the perf-hwbp code, fix documentation (Linus Torvalds)  [Orabug: 27947608]  {CVE-2018-1000199} 
  - Revert "perf/hwbp: Simplify the perf-hwbp code, fix documentation" (Brian Maly)  [Orabug: 27947608]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.23.1.el6uek]
changelog:
  - xen/blkback: free requests on disconnection (Dongli Zhang)  [Orabug: 22111941]  
  - RDS: null pointer dereference in rds_atomic_free_op (Mohamed Ghannam)  [Orabug: 27986376]  {CVE-2018-5333} 
  - ACPI: sbshc: remove raw pointer from printk() message (Greg Kroah-Hartman)  [Orabug: 27986392]  {CVE-2018-5750} 
  - futex: Prevent overflow by strengthen input validation (Li Jinyue)  [Orabug: 27986395]  {CVE-2018-6927}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.24.1.el6uek]
changelog:
  - mm/mempolicy: fix use after free when calling get_mempolicy (zhong jiang)  [Orabug: 28022108]  {CVE-2018-10675} 
  - Fix up non-directory creation in SGID directories (Linus Torvalds)  [Orabug: 28459478]  {CVE-2018-13405} 
  - ALSA: seq: Make ioctls race-free (Takashi Iwai)  [Orabug: 28459729]  {CVE-2018-7566} 
  - ALSA: seq: Fix racy pool initializations (Takashi Iwai)  [Orabug: 28459729]  {CVE-2018-7566} 
  - posix-timer: Properly check sigevent->sigev_notify (Thomas Gleixner)  [Orabug: 28481409]  {CVE-2017-18344}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.24.2.el6uek]
changelog:
  - x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit (Vlastimil Babka)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect PAE swap entries against L1TF (Vlastimil Babka)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Extend 64bit swap file size limit (Vlastimil Babka)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm, fremap: mitigate L1TF in remap_file_pages (Daniel Jordan)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation: Don't mark cpu_no_l1tf __initconst (Boris Ostrovsky)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm/kmmio: Make the tracer robust against L1TF (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm/pat: Make set_memory_np() L1TF safe (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm/pat: Ensure cpa->pfn only contains page frame numbers (Matt Fleming)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Exempt zeroed PTEs from inversion (Sean Christopherson)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Invert all not present mappings (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/bugs: Move the l1tf function and define pr_fmt properly (Konrad Rzeszutek Wilk)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Limit swap file size to MAX_PA/2 (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm/pagewalk.c: prevent positive return value of walk_page_test() from being passed to callers (Naoya Horiguchi)  [Orabug: 28505476]  {CVE-2018-3620} 
  - pagewalk: improve vma handling (Naoya Horiguchi)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm/pagewalk: remove pgd_entry() and pud_entry() (Naoya Horiguchi)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm/pagewalk.c: fix walk_page_range() access of wrong PTEs (Chen LinX)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Add sysfs reporting for l1tf (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/cpu/intel: Add Knights Mill to Intel family (Piotr Luc)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/bugs: Concentrate bug reporting into a separate function (Konrad Rzeszutek Wilk)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/bugs: Concentrate bug detection into a separate function (Konrad Rzeszutek Wilk)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/cpufeature: Add X86_FEATURE_IA32_ARCH_CAPS and X86_FEATURE_IBRS_ATT (Konrad Rzeszutek Wilk)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Make sure the first page is always reserved (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Fix up pte->pfn conversion for PAE (Michal Hocko)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect swap entries against L1TF (Linus Torvalds)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Change order of offset/type in swap entry (Linus Torvalds)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm: Fix swap entry comment and macro (Dave Hansen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm: Move swap offset/type up in PTE to work around erratum (Dave Hansen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm: x86 pgtable: drop unneeded preprocessor ifdef (Cyrill Gorcunov)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm: Fix regression with huge pages on PAE (Kirill A. Shutemov)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Toshi Kani)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Toshi Kani)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/asm: Move PUD_PAGE macros to page_types.h (Toshi Kani)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation: sort X86_BUG_* with X86_FEATURE_* (Daniel Jordan)  [Orabug: 28505476]  {CVE-2018-3620} 
  - Disable kaiser if the cpu is not vulnerable to X86_BUG_CPU_MELTDOWN (Kanth Ghatraju)  [Orabug: 27958074]  
  - x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (David Woodhouse)  [Orabug: 27958074]  
  - x86/msr: Add definitions for IA32_ARCH_CAPABILITIES MSR (Kanth Ghatraju)  [Orabug: 27958074]  
  - x86/cpufeatures: Add Intel feature bit for IA32_ARCH_CAPABILITIES supported (Kanth Ghatraju)  [Orabug: 27958074]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.24.3.el6uek]
changelog:
  - exec: Limit arg stack to at most 75% of _STK_LIM (Kees Cook)  [Orabug: 28710010]  {CVE-2018-14634}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.25.1.el6uek]
changelog:
  - x86/spectre_v2: Don't check microcode versions when running under hypervisors (Konrad Rzeszutek Wilk)  [Orabug: 27959785]  
  - rds: CVE-2018-7492: Fix NULL pointer dereference in __rds_rdma_map (Håkon Bugge)  [Orabug: 28552792]  {CVE-2018-7492} 
  - cdrom: Fix info leak/OOB read in cdrom_ioctl_drive_status (Scott Bauer)  [Orabug: 28664530]  {CVE-2018-16658} 
  - ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c (Seunghun Han)  [Orabug: 28664579]  {CVE-2017-13695} 
  - uek-rpm: Disable deprecated CONFIG_ACPI_PROCFS_POWER (Victor Erminpour)  [Orabug: 28680238]  
  - exec: Limit arg stack to at most 75% of _STK_LIM (Kees Cook)  [Orabug: 28710010]  {CVE-2018-14634} 
  - x86/speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit (Vlastimil Babka)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect PAE swap entries against L1TF (Vlastimil Babka)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Extend 64bit swap file size limit (Vlastimil Babka)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm, fremap: mitigate L1TF in remap_file_pages (Daniel Jordan)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation: Don't mark cpu_no_l1tf __initconst (Boris Ostrovsky)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm/kmmio: Make the tracer robust against L1TF (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm/pat: Make set_memory_np() L1TF safe (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm/pat: Ensure cpa->pfn only contains page frame numbers (Matt Fleming)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Make pmd/pud_mknotpresent() invert (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Exempt zeroed PTEs from inversion (Sean Christopherson)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Invert all not present mappings (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/bugs: Move the l1tf function and define pr_fmt properly (Konrad Rzeszutek Wilk)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Limit swap file size to MAX_PA/2 (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm/pagewalk.c: prevent positive return value of walk_page_test() from being passed to callers (Naoya Horiguchi)  [Orabug: 28505476]  {CVE-2018-3620} 
  - pagewalk: improve vma handling (Naoya Horiguchi)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm/pagewalk: remove pgd_entry() and pud_entry() (Naoya Horiguchi)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm/pagewalk.c: fix walk_page_range() access of wrong PTEs (Chen LinX)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Add sysfs reporting for l1tf (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/cpu/intel: Add Knights Mill to Intel family (Piotr Luc)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/bugs: Concentrate bug reporting into a separate function (Konrad Rzeszutek Wilk)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/bugs: Concentrate bug detection into a separate function (Konrad Rzeszutek Wilk)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/cpufeature: Add X86_FEATURE_IA32_ARCH_CAPS and X86_FEATURE_IBRS_ATT (Konrad Rzeszutek Wilk)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Make sure the first page is always reserved (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Fix up pte->pfn conversion for PAE (Michal Hocko)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect PROT_NONE PTEs against speculation (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Protect swap entries against L1TF (Linus Torvalds)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Change order of offset/type in swap entry (Linus Torvalds)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm: Fix swap entry comment and macro (Dave Hansen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm: Move swap offset/type up in PTE to work around erratum (Dave Hansen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - mm: x86 pgtable: drop unneeded preprocessor ifdef (Cyrill Gorcunov)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Andi Kleen)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/mm: Fix regression with huge pages on PAE (Kirill A. Shutemov)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Toshi Kani)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Toshi Kani)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/asm: Move PUD_PAGE macros to page_types.h (Toshi Kani)  [Orabug: 28505476]  {CVE-2018-3620} 
  - x86/speculation: sort X86_BUG_* with X86_FEATURE_* (Daniel Jordan)  [Orabug: 28505476]  {CVE-2018-3620} 
  - Disable kaiser if the cpu is not vulnerable to X86_BUG_CPU_MELTDOWN (Kanth Ghatraju)  [Orabug: 27958074]  
  - x86/pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (David Woodhouse)  [Orabug: 27958074]  
  - x86/msr: Add definitions for IA32_ARCH_CAPABILITIES MSR (Kanth Ghatraju)  [Orabug: 27958074]  
  - x86/cpufeatures: Add Intel feature bit for IA32_ARCH_CAPABILITIES supported (Kanth Ghatraju)  [Orabug: 27958074]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.26.1.el6uek]
changelog:
  - netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Eric Dumazet)  [Orabug: 27896807]  {CVE-2017-18017} 
  - scsi: libsas: fix memory leak in sas_smp_get_phy_events() (Jason Yan)  [Orabug: 27927692]  {CVE-2018-7757}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.28.1.el6uek]
changelog:
  - udf: Check component length before reading it (Jan Kara)  [Orabug: 21193696]  {CVE-2014-9728} 
  - udf: Verify i_size when loading inode (Shan Hai)  [Orabug: 21193696]  {CVE-2014-9728} 
  - intel_pstate: Fix overflow in busy_scaled due to long delay (mridula shastry)  [Orabug: 28005134]  
  - scsi: libsas: defer ata device eh commands to libata (Jason Yan)  [Orabug: 28459689]  {CVE-2018-10021} 
  - nfsd: silence sparse warning about accessing credentials (Jeff Layton)  [Orabug: 28824742]  {CVE-2017-13168} 
  - scsi: sg: mitigate read/write abuse (Jann Horn)  [Orabug: 28824742]  {CVE-2017-13168} 
  - scsi: sg: allocate with __GFP_ZERO in sg_build_indirect() (Alexander Potapenko)  [Orabug: 28892683]  {CVE-2018-1000204} 
  - ALSA: rawmidi: Change resized buffers atomically (Takashi Iwai)  [Orabug: 28898650]  {CVE-2018-10902} 
  - KVM: MTRR: remove MSR 0x2f8 (Andy Honig)  [Orabug: 28901657]  {CVE-2016-3713} {CVE-2016-3713} 
  - cdrom: fix improper type cast, which can leat to information leak. (Young_X)  [Orabug: 28929777]  {CVE-2018-16658} {CVE-2018-10940} {CVE-2018-18710} 
  - floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl (Andy Whitcroft)   {CVE-2018-7755} {CVE-2018-7755} 
  - crypto: salsa20 - fix blkcipher_walk API usage (Eric Biggers)  [Orabug: 28976585]  {CVE-2017-17805} 
  - crypto: hmac - require that the underlying hash algorithm is unkeyed (Eric Biggers)  [Orabug: 28976654]  {CVE-2017-17806}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.29.1.el6uek]
changelog:
  - Copy secure_boot flag in boot params across kexec reboot (Dave Young)  [Orabug: 22066352]  {CVE-2015-7837} 
  - ipv6: tcp: add rcu locking in tcp_v6_send_synack() (Eric Dumazet)  [Orabug: 25059183]  {CVE-2016-3841} 
  - ipv6: add complete rcu protection around np->opt (Eric Dumazet)  [Orabug: 25059183]  {CVE-2016-3841} 
  - scsi: qla2xxx: Fix an integer overflow in sysfs code (Dan Carpenter)  [Orabug: 28220420]  {CVE-2017-14051} 
  - ext4: fail ext4_iget for root directory if unallocated (Theodore Ts'o)  [Orabug: 28220433]  {CVE-2018-1092} {CVE-2018-1092} 
  - certs: Add Oracle's new X509 cert into the kernel keyring (Eric Snowberg)  [Orabug: 28926205]  
  - ALSA: seq: Fix regression by incorrect ioctl_mutex usages (Takashi Iwai)  [Orabug: 29005190]  {CVE-2018-1000004} 
  - netfilter: xt_osf: Add missing permission checks (Kevin Cernekee)  [Orabug: 29037832]  {CVE-2017-17450} 
  - wil6210: missing length check in wmi_set_ie (Lior David)  [Orabug: 29060697]  {CVE-2018-5848} 
  - HID: debug: check length before copy_to_user() (Daniel Rosenberg)  [Orabug: 29128167]  {CVE-2018-9516} 
  - x86/MCE: Serialize sysfs changes (Seunghun Han)  [Orabug: 29152249]  {CVE-2018-7995} 
  - Input: i8042 - fix crash at boot time (Chen Hong)  [Orabug: 29152329]  {CVE-2017-18079}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.3.2.el6uek]
changelog:
  - x86/nmi/64: Use DF to avoid userspace RSP confusing nested NMI detection (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/nmi/64: Reorder nested NMI checks (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/nmi/64: Improve nested NMI comments (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/nmi/64: Switch stacks on userspace NMI entry (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157} 
  - x86/paravirt: Replace the paravirt nop with a bona fide empty function (Andy Lutomirski)  [Orabug: 22742507]  {CVE-2015-5157}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.30.1.el6uek]
changelog:
  - ext4: validate that metadata blocks do not overlap superblock (Theodore Ts'o)  [Orabug: 28220451]  {CVE-2018-1094} 
  - ext4: always initialize the crc32c checksum driver (Theodore Ts'o)  [Orabug: 28220451]  {CVE-2018-1094} {CVE-2018-1094} 
  - vfs: Add sb_rdonly(sb) to query the MS_RDONLY flag on s_flags (David Howells)  [Orabug: 28220451]  {CVE-2018-1094} 
  - ocfs2: should wait dio before inode lock in ocfs2_setattr() (alex chen)  [Orabug: 28852830]  {CVE-2017-18204} 
  - Make file credentials available to the seqfile interfaces (Linus Torvalds)  [Orabug: 29114878]  {CVE-2018-17972} 
  - proc: restrict kernel stack dumps to root (Jann Horn)  [Orabug: 29114878]  {CVE-2018-17972} 
  - btrfs: relocation: Only remove reloc rb_trees if reloc control has been initialized (Qu Wenruo)  [Orabug: 29301105]  {CVE-2018-14609}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.31.1.el6uek]
changelog:
  - alarmtimer: Prevent overflow for relative nanosleep (Thomas Gleixner)  [Orabug: 29269167]  {CVE-2018-13053} 
  - KEYS: Don't permit request_key() to construct a new keyring (David Howells)  [Orabug: 29304552]  {CVE-2017-17807} 
  - KEYS: add missing permission check for request_key() destination (Eric Biggers)  [Orabug: 29304552]  {CVE-2017-17807} 
  - ext4: only look at the bg_flags field if it is valid (Theodore Ts'o)  [Orabug: 29409425]  {CVE-2018-10876} {CVE-2018-10876} 
  - net: Set sk_prot_creator when cloning sockets to the right proto (Christoph Paasch)  [Orabug: 29422740]  {CVE-2018-9568} 
  - ext4: make sure bitmaps and the inode table don't overlap with bg descriptors (Theodore Ts'o)  [Orabug: 29428608]  {CVE-2018-10878} 
  - ext4: always check block group bounds in ext4_init_block_bitmap() (Theodore Ts'o)  [Orabug: 29428608]  {CVE-2018-10878}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.32.1.el6uek]
changelog:
  - x86/fpu: Factor out memset(xstate, 0) in fpu_finit() paths (Oleg Nesterov)  [Orabug: 29012034]  
  - x86/fpu: Always allow FPU in interrupt if use_eager_fpu() (Oleg Nesterov)  [Orabug: 29012034]  
  - x86/fpu: Fix 32-bit signal frame handling (Dave Hansen)  [Orabug: 29012034]  
  - x86/fpu: Don't do __thread_fpu_end() if use_eager_fpu() (Oleg Nesterov)  [Orabug: 29012034]  
  - x86/fpu: Don't reset fpu_counter (Oleg Nesterov)  [Orabug: 29012034]  
  - x86, fpu: Fix math_state_restore() race with kernel_fpu_begin() (Oleg Nesterov)  [Orabug: 29012034]  
  - x86, fpu: Introduce per-cpu in_kernel_fpu state (Oleg Nesterov)  [Orabug: 29012034]  
  - x86, fpu: Don't abuse has_fpu in __kernel_fpu_begin/end() (Oleg Nesterov)  [Orabug: 29012034]  
  - x86: Allow FPU to be used at interrupt time even with eagerfpu (Pekka Riikonen)  [Orabug: 29012034]  
  - can: gw: ensure DLC boundaries after CAN frame modification (Oliver Hartkopp)  [Orabug: 29215300]  {CVE-2019-3701} {CVE-2019-3701} 
  - ext4: verify the depth of extent tree in ext4_find_extent() (Theodore Ts'o)  [Orabug: 29396713]  {CVE-2018-10877} {CVE-2018-10877} 
  - ext4: always verify the magic number in xattr blocks (Theodore Ts'o)  [Orabug: 29437128]  {CVE-2018-10879} {CVE-2018-10879} 
  - ext4: add corruption check in ext4_xattr_set_entry() (Theodore Ts'o)  [Orabug: 29437128]  {CVE-2018-10879} {CVE-2018-10879} 
  - ext4: clear i_data in ext4_inode_info when removing inline data (Theodore Ts'o)  [Orabug: 29540710]  {CVE-2018-10881} {CVE-2018-10881} 
  - ext4: add more inode number paranoia checks (Theodore Ts'o)  [Orabug: 29545567]  {CVE-2018-10882} {CVE-2018-10882}


author: Chuck Anderson <chuck.anderson@oracle.com> [3.8.13-118.33.1.el6uek]
changelog:
  - x86/mds: Add empty commit for CVE-2019-11091 (Patrick Colp)  [Orabug: 29721936]  {CVE-2019-11091} 
  - x86/speculation/mds: Fix comment (Boris Ostrovsky)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add mitigation mode VMWERV (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add sysfs reporting for MDS (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add mitigation control for MDS (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Allow runtime checking of CPU features (Patrick Colp)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Improve coverage for MDS vulnerability (Boris Ostrovsky)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Clear CPU buffers on exit to user (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add mds_clear_cpu_buffers() (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add BUG_MSBDS_ONLY (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation/mds: Add basic bug infrastructure for MDS (Andi Kleen)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} 
  - x86/speculation: Consolidate CPU whitelists (Thomas Gleixner)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127}


author: Chuck Anderson <chuck.anderson@oracle.com> [3.8.13-118.33.2.el6uek]
changelog:
  - x86/speculation/mds: Make cpu_matches() __cpuinit (Patrick Colp)  [Orabug: 29751729]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091} 
  - x86/speculation/mds: Only worry about firmware loaded microcode (Patrick Colp)  [Orabug: 29641784]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.34.1.el6uek]
changelog:
  - Input: wacom - move the USB (now hid) Wacom driver in drivers/hid (Benjamin Tissoires)  [Orabug: 25512494]  {CVE-2016-3139} 
  - net: qmi_wwan: fix divide by 0 on bad descriptors (Bjørn Mork)  [Orabug: 27215229]  {CVE-2017-16650} 
  - USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data (Hui Peng)  [Orabug: 29605987]  {CVE-2018-19985} {CVE-2018-19985} 
  - KEYS: encrypted: fix buffer overread in valid_master_desc() (Eric Biggers)  [Orabug: 29605993]  {CVE-2017-13305} 
  - ecryptfs: don't allow mmap when the lower fs doesn't support it (Jeff Mahoney)  [Orabug: 29666607]  {CVE-2016-1583} {CVE-2016-1583} 
  - Revert "ecryptfs: forbid opening files without mmap handler" (Brian Maly)  [Orabug: 29666607]  {CVE-2016-1583} 
  - binfmt_elf: switch to new creds when switching to new mm (Linus Torvalds)  [Orabug: 29677234]  {CVE-2019-11190}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.35.1.el6uek]
changelog:
  - Bluetooth: hidp: fix buffer overflow (Young Xiao)  [Orabug: 29786787]  {CVE-2011-1079} {CVE-2019-11884} 
  - x86/speculation/mds: Fix verw usage to use memory operand (Patrick Colp)  [Orabug: 29791038]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091} 
  - x86/speculation/mds: Make cpu_vuln_whitelist __cpuinitconst (Patrick Colp)  [Orabug: 29792023]  
  - x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Thomas Gleixner)  [Orabug: 29792061]  {CVE-2018-12126} {CVE-2018-12130} {CVE-2018-12127} {CVE-2019-11091}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.35.2.el6uek]
changelog:
  - tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Eric Dumazet)  [Orabug: 29886600]  {CVE-2019-11477} 
  - tcp: add tcp_min_snd_mss sysctl (Eric Dumazet)  [Orabug: 29884307]  {CVE-2019-11479} 
  - tcp: tcp_fragment() should apply sane memory limits (Eric Dumazet)  [Orabug: 29884307]  {CVE-2019-11478} 
  - tcp: fix fack_count accounting on tcp_shift_skb_data() (Joao Martins)  [Orabug: 29890831]  {CVE-2019-11477} 
  - tcp: limit payload size of sacked skbs (Eric Dumazet)  [Orabug: 29884307]  {CVE-2019-11477}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.36.1.el6uek]
changelog:
  - tun: call dev_get_valid_name() before register_netdevice() (Cong Wang)  [Orabug: 29925557]  {CVE-2018-7191}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.37.1.el6uek]
changelog:
  - Input: gtco - bounds check collection indent level (Grant Hernandez)  [Orabug: 30074414]  {CVE-2019-13631}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.38.1.el6uek]
changelog:
  - x86/speculation: Exclude ATOMs from speculation through SWAPGS (Thomas Gleixner)  [Orabug: 30165288]  {CVE-2019-1125} 
  - x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf)  [Orabug: 30165288]  {CVE-2019-1125} 
  - x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf)  [Orabug: 30165288]  {CVE-2019-1125}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.39.1.el6uek]
changelog:
  - tcp: purge write queue in tcp_connect_init() (Eric Dumazet)  [Orabug: 30240134]  {CVE-2019-15239} 
  - cx24116: fix a buffer overflow when checking userspace params (Mauro Carvalho Chehab)  [Orabug: 30254282]  {CVE-2015-9289} 
  - floppy: fix out-of-bounds read in copy_buffer (Denis Efremov)  [Orabug: 30318220]  {CVE-2019-14283} 
  - ext4: fix data corruption caused by unaligned direct AIO (Lukas Czerner)  [Orabug: 30324140]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.39.1.1.el6uek]
changelog:
  - x86/tsx: Add config options to set tsx=on|off|auto (Michal Hocko)  [Orabug: 30419232]  {CVE-2019-11135} 
  - x86/speculation/taa: Add documentation for TSX Async Abort (Pawan Gupta)  [Orabug: 30419232]  {CVE-2019-11135} 
  - x86/tsx: Add "auto" option to TSX cmdline parameter (Pawan Gupta)  [Orabug: 30419232]  {CVE-2019-11135} 
  - x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Pawan Gupta)  [Orabug: 30419232]  {CVE-2019-11135} 
  - x86/speculation/taa: Add mitigation for TSX Async Abort (Pawan Gupta)  [Orabug: 30419232]  {CVE-2019-11135} 
  - x86/tsx: Add TSX cmdline option with TSX disabled by default (Pawan Gupta)  [Orabug: 30419232]  {CVE-2019-11135} 
  - x86: Add helper function x86_read_arch_cap_msr() (Pawan Gupta)  [Orabug: 30419232]  {CVE-2019-11135} 
  - x86/tsx: Add enumeration support for IA32_TSX_CTRL MSR (Pawan Gupta)  [Orabug: 30419232]  {CVE-2019-11135}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.4.2.el6uek]
changelog:
  - pipe: Fix buffer offset after partially failed read (Ben Hutchings)  [Orabug: 22985903]  {CVE-2016-0774} {CVE-2015-1805} {CVE-2016-0774}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.40.1.el6uek]
changelog:
  - USB: check usb_get_extra_descriptor for proper size (Mathias Payer)  [Orabug: 30045797]  {CVE-2018-20169} 
  - scsi: sg: fixup infoleak when using SG_GET_REQUEST_TABLE (Hannes Reinecke)  [Orabug: 30393902]  {CVE-2017-14991} 
  - usb: misc: legousbtower: Fix NULL pointer deference (Greg Kroah-Hartman)  [Orabug: 30412151]  {CVE-2017-15102} 
  - floppy: fix div-by-zero in setup_format_params (Denis Efremov)  [Orabug: 30447844]  {CVE-2019-14284} 
  - i2c: core-smbus: prevent stack corruption on read I2C_BLOCK_DATA (Jeremy Compostella)  [Orabug: 30468842]  {CVE-2017-18551}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.41.1.el6uek]
changelog:
  - x86/speculation: Determine swapgs before alternative instructions are set (Patrick Colp)  [Orabug: 30379626]  
  - ieee802154: enforce CAP_NET_RAW for raw sockets (Allen Pais)  [Orabug: 30444947]  {CVE-2019-17053} 
  - mISDN: enforce CAP_NET_RAW for raw sockets (Ori Nimron)  [Orabug: 30445159]  {CVE-2019-17055} 
  - net: sit: fix memory leak in sit_init_net() (Mao Wenan)  [Orabug: 30445307]  {CVE-2019-16994} 
  - media: dvb: usb: fix use after free in dvb_usb_device_exit (Oliver Neukum)  [Orabug: 30490492]  {CVE-2019-15213} 
  - media: cpia2_usb: first wake up, then free in disconnect (Oliver Neukum)  [Orabug: 30511742]  {CVE-2019-15215} 
  - media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap (Vandana BN)  [Orabug: 30532775]  {CVE-2019-15217} 
  - USB: sisusbvga: fix oops in error path of sisusb_probe (Oliver Neukum)  [Orabug: 30548566]  {CVE-2019-15219}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.42.1.el6uek]
changelog:
  - scsi: libsas: delete sas port if expander discover failed (Jason Yan)  [Orabug: 30580688]  {CVE-2019-15807}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.43.1.el6uek]
changelog:
  - media: b2c2-flexcop-usb: add sanity checking (Oliver Neukum)  [Orabug: 30864534]  {CVE-2019-15291}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.44.1.el6uek]
changelog:
  - net: qlogic: Fix memory leak in ql_alloc_large_buffers (Navid Emamdoost)  [Orabug: 31055328]  {CVE-2019-18806} 
  - swiotlb: clean up reporting (Kees Cook)  [Orabug: 31085018]  {CVE-2018-5953}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.45.1.el6uek]
changelog:
  - HID: hiddev: do cleanup in failure of opening a device (Hillf Danton)  [Orabug: 31206361]  {CVE-2019-19527} 
  - HID: hiddev: avoid opening a disconnected device (Hillf Danton)  [Orabug: 31206361]  {CVE-2019-19527} 
  - HID: Fix assumption that devices have inputs (Alan Stern)  [Orabug: 31208623]  {CVE-2019-19532} 
  - drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl() (Murray McAllister)  [Orabug: 31224360]  {CVE-2017-7261} 
  - brcmfmac: add subtype check for event handling in data path (John Donnelly)  [Orabug: 31234676]  {CVE-2019-9503}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.46.1.el6uek]
changelog:
  - ipv6: only static routes qualify for equal cost multipathing (Hannes Frederic Sowa)  [Orabug: 30977687]  {CVE-2013-4125} 
  - USB: adutux: fix use-after-free on disconnect (Johan Hovold)  [Orabug: 31240296]  {CVE-2019-19523} 
  - USB: core: Fix races in character device registration and deregistraion (Alan Stern)  [Orabug: 31317668]  {CVE-2019-19537} 
  - USB: iowarrior: fix use-after-free on disconnect (Johan Hovold)  [Orabug: 31351063]  {CVE-2019-19528} 
  - usb: iowarrior: fix deadlock on disconnect (Oliver Neukum)  [Orabug: 31351063]  {CVE-2019-19528} 
  - mremap: properly flush TLB before releasing the page (Linus Torvalds)  [Orabug: 31352012]  {CVE-2018-18281}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.47.1.el6uek]
changelog:
  - media: ttusb-dec: Fix info-leak in ttusb_dec_send_command() (Tomas Bortoli)  [Orabug: 31351121]  {CVE-2019-19533} 
  - can: peak_usb: fix slab info leak (Johan Hovold)  [Orabug: 31351143]  {CVE-2019-19534} 
  - ALSA: core: Fix card races between register and disconnect (Takashi Iwai)  [Orabug: 31351893]  {CVE-2019-15214}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.47.2.el6uek]
changelog:
  - Revert "certs: Add Oracle's new X509 cert into the kernel keyring" (Eric Snowberg)  [Orabug: 31602633]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.48.1.el6uek]
changelog:
  - crypto: user - fix memory leak in crypto_report (Navid Emamdoost)  [Orabug: 31351641]  {CVE-2019-19062} 
  - media: rc: prevent memory leak in cx23888_ir_probe (Navid Emamdoost)  [Orabug: 31351673]  {CVE-2019-19054}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.49.1.el6uek]
changelog:
  - sunrpc: use SVC_NET() in svcauth_gss_* functions (Vasily Averin)  [Orabug: 31351996]  {CVE-2018-16884} 
  - sunrpc: use-after-free in svc_process_common() (Vasily Averin)  [Orabug: 31351996]  {CVE-2018-16884} 
  - af_packet: set defaule value for tmo (Mao Wenan)  [Orabug: 31439108]  {CVE-2019-20812} 
  - vgacon: Fix for missing check in scrollback handling (Yunhai Zhang)  [Orabug: 31705122]  {CVE-2020-14331} {CVE-2020-14331} 
  - rename kABI whitelists to lockedlists (Dan Duval)  [Orabug: 31783152]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.50.1.el6uek]
changelog:
  - USB: serial: omninet: fix reference leaks at open (Mark Nicholson)  [Orabug: 30484762]  {CVE-2017-8925} 
  - GFS2: don't set rgrp gl_object until it's inserted into rgrp tree (Bob Peterson)  [Orabug: 30254252]  {CVE-2016-10905} 
  - GFS2: Fix rgrp end rounding problem for bsize < page size (Bob Peterson)  [Orabug: 30254252]  {CVE-2016-10905} 
  - GFS2: Use range based functions for rgrp sync/invalidation (Steven Whitehouse)  [Orabug: 30254252]  {CVE-2016-10905} 
  - fs/proc/proc_sysctl.c: Fix a NULL pointer dereference (YueHaibing)  [Orabug: 30732940]  {CVE-2019-20054} 
  - fs/proc/proc_sysctl.c: fix NULL pointer dereference in put_links (YueHaibing)  [Orabug: 30732940]  {CVE-2019-20054} 
  - scsi: libsas: stop discovering if oob mode is disconnected (Jason Yan)  [Orabug: 30770914]  {CVE-2019-19965} 
  - ath9k_htc: release allocated buffer if timed out (Navid Emamdoost)  [Orabug: 31351573]  {CVE-2019-19073} 
  - USB: serial: io_ti: fix information leak in completion handler (Johan Hovold)  [Orabug: 31352085]  {CVE-2017-8924} 
  - mm/hugetlb: fix a race between hugetlb sysctl handlers (Muchun Song)  [Orabug: 31884241]  {CVE-2020-25285} 
  - ext4: fix potential negative array index in do_split() (Eric Sandeen)  [Orabug: 31895332]  {CVE-2020-14314}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [3.8.13-118.51.1.el6uek]
changelog:
  - usb: cdc-acm: make sure a refcount is taken early enough (Oliver Neukum)  [Orabug: 31351090]  {CVE-2019-19530} 
  - kexec: Validate pe files against the system_lacklist_keyring (Eric Snowberg)  [Orabug: 31961121]  {CVE-2020-26541} 
  - uek-rpm: Update secure boot UEK signing certificates (Brian Maly)  [Orabug: 31974695]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.51.2.el6uek]
changelog:
  - Revert "kexec: Validate pe files against the system_lacklist_keyring" (John Donnelly)  [Orabug: 32171714]  {CVE-2020-26541} {CVE-2020-26541}


author: Vijayendra Suman <vijayendra.suman@oracle.com> [3.8.13-118.52.1.el6uek]
changelog:
  - crypto: authenc - fix parsing key with misaligned rta_len (Eric Biggers)  [Orabug: 31535530]  {CVE-2020-10769} 
  - crypto: authenc - Export key parsing helper function (Mathias Krause)  [Orabug: 31535530]  {CVE-2020-10769}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-118.6.2.el6uek]
changelog:
  - KEYS: Fix ASN.1 indefinite length object parsing This fixes CVE-2016-0758. (David Howells)  [Orabug: 23279020]  {CVE-2016-0758} 
  - net: add validation for the socket syscall protocol argument (Hannes Frederic Sowa)  [Orabug: 23267997]  {CVE-2015-8543} {CVE-2015-8543} 
  - ipv6: addrconf: validate new MTU before applying it (Marcelo Leitner)  [Orabug: 23263252]  {CVE-2015-8215} 
  - unix: properly account for FDs passed over unix sockets (willy tarreau)  [Orabug: 23262276]  {CVE-2013-4312} {CVE-2013-4312}


author: Brian Maly <brian.maly@oracle.com> [3.8.13-109.el6uek]
changelog:
  - mm: check if section present during memory block registering (Yinghai Lu)  [Orabug: 20382859]  
  - be2net: post buffers before destroying RXQs in Lancer (Kalesh AP)   
  - be2net: enable IFACE filters only after creating RXQs (Kalesh AP)   
  - be2net: bump up the driver version to 10.6.0.3 (Sathya Perla)   
  - be2net: make SET_LOOPBACK_MODE cmd asynchrounous (Suresh Reddy)   
  - be2net: return error status from be_mcc_notify() (Suresh Reddy)   
  - ipoib/ib: fix merge of Orabug 19468224 fix from uek2 into uek3 resulting in ipoib not functioning. (Rama Nichanamatlu)  [Orabug: 21897912]  
  - mlx4: indicate memory resource exhaustion (Ajaykumar Hotchandani)  [Orabug: 21549766]  
  - be2iscsi: Bump the driver version (Jitendra Bhivare)  [Orabug: 21903294]  
  - be2iscsi: Fix updating the next pointer during WRB posting (Jitendra Bhivare)  [Orabug: 21903294]  
  - be2iscsi: add obsolete warning messages (Jitendra Bhivare)  [Orabug: 21903294]  
  - be2iscsi: ownership change (Jitendra Bhivare)  [Orabug: 21903294]  
  - be2iscsi: update MAINTAINERS list (Jitendra Bhivare)  [Orabug: 21903294]  
  - be2iscsi : Logout of FW Boot Session (Jitendra Bhivare)  [Orabug: 21903294]  
  - be2iscsi : Fix memory check before unmapping. (Jitendra Bhivare)  [Orabug: 21903294]


author: Brian Maly <brian.maly@oracle.com> [3.8.13-110.el6uek]
changelog:
  - xen-netfront: respect user provided max_queues (Wei Liu)  [Orabug: 21976319]  
  - net/xen-netfront: only napi_synchronize() if running (Chas Williams)  [Orabug: 21976319]  
  - net/xen-netfront: only clean up queues if present (Chas Williams)  [Orabug: 21976319]  
  - xen-netfront: Remove the meaningless code (Li, Liang Z)  [Orabug: 21976319]  
  - net/xen-netfront: Correct printf format in xennet_get_responses (Julien Grall)  [Orabug: 21976319]  
  - xen-netfront: properly destroy queues when removing device (David Vrabel)  [Orabug: 21976319]  
  - xen-netfront: Use setup_timer (Vaishali Thakkar)  [Orabug: 21976319]  
  - xen-netfront: transmit fully GSO-sized packets (Jonathan Davies)  [Orabug: 21976319]  
  - xen-netfront: Use static attribute groups for sysfs entries (Takashi Iwai)  [Orabug: 21976319]  
  - xen-netfront: use different locks for Rx and Tx stats (David Vrabel)  [Orabug: 21976319]  
  - xen-netfront: refactor making Tx requests (David Vrabel)  [Orabug: 21976319]  
  - xen-netfront: refactor skb slot counting (David Vrabel)  [Orabug: 21976319]  
  - drivers: net: xen-netfront: remove residual dead code (Vincenzo Maffione)  [Orabug: 21976319]  
  - xen-netfront: use napi_complete() correctly to prevent Rx stalling (David Vrabel)  [Orabug: 21976319]  
  - xen-netfront: always keep the Rx ring full of requests (David Vrabel)  [Orabug: 21976319]  
  - xen-netback: respect user provided max_queues (Wei Liu)  [Orabug: 21976319]  
  - xen-netback: require fewer guest Rx slots when not using GSO (David Vrabel)  [Orabug: 21976319]  
  - xen/netback: Wake dealloc thread after completing zerocopy work (Ross Lagerwall)  [Orabug: 21976319]  
  - xen-netback: Allocate fraglist early to avoid complex rollback (Ross Lagerwall)  [Orabug: 21976319]  
  - net/xen-netback: off by one in BUG_ON() condition (Dan Carpenter)  [Orabug: 21976319]  
  - xen-netback: remove duplicated function definition (Li, Liang Z)  [Orabug: 21976319]  
  - xen-netback: fix a BUG() during initialization (Palik, Imre)  [Orabug: 21976319]  
  - net/xen-netback: Don't mix hexa and decimal with 0x in the printf format (Julien Grall)  [Orabug: 21976319]  
  - net/xen-netback: Remove unused code in xenvif_rx_action (Julien Grall)  [Orabug: 21976319]  
  - xen: netback: read hotplug script once at start of day. (Ian Campbell)  [Orabug: 21976319]  
  - xen: netback: fix printf format string warning (Ian Campbell)  [Orabug: 21976319]  
  - xen/netback: Properly initialize credit_bytes (Ross Lagerwall)  [Orabug: 21976319]  
  - net:xen-netback - Change 1 to true for bool type variable. (Shailendra Verma)  [Orabug: 21976319]  
  - xen-netback: notify immediately after pushing Tx response. (David Vrabel)  [Orabug: 21976319]  
  - xen-netback: making the bandwidth limiter runtime settable (Palik, Imre)  [Orabug: 21976319]  
  - xen-netback: refactor xenvif_handle_frag_list() (David Vrabel)  [Orabug: 21976319]  
  - xen-netback: return correct ethtool stats (David Vrabel)  [Orabug: 21976319]  
  - xen-netback: release pending index before pushing Tx responses (David Vrabel)  [Orabug: 21976319]  
  - xen-netback: fix sparse warning (Lad, Prabhakar)  [Orabug: 21976319]  
  - xen-netback: always fully coalesce guest Rx packets (David Vrabel)  [Orabug: 21976319]  
  - xen-netback: stop the guest rx thread after a fatal error (David Vrabel)  [Orabug: 21976319]  
  - xen-netback: fixing the propagation of the transmit shaper timeout (Palik, Imre)  [Orabug: 21976319]  
  - xen-netback: support frontends without feature-rx-notify again (David Vrabel)  [Orabug: 21976319]  
  - netback: don't store invalid vif pointer (Jan Beulich)  [Orabug: 21976319]  
  - xen-netback: do not report success if backend_create_xenvif() fails (Alexey Khoroshilov)  [Orabug: 21976319]  
  - xen-netback: remove unconditional __pskb_pull_tail() in guest Tx path (Malcolm Crossley)  [Orabug: 21976319]  
  - xen-netback: reintroduce guest Rx stall detection (David Vrabel)  [Orabug: 21976319]  
  - xen-netback: fix unlimited guest Rx internal queue and carrier flapping (David Vrabel)  [Orabug: 21976319]  
  - xen-netback: make feature-rx-notify mandatory (David Vrabel)  [Orabug: 21976319]  
  - xen-netback: Remove __GFP_COLD (Zoltan Kiss)  [Orabug: 21976319]  
  - xen-netback: Disable NAPI after disabling interrupts (Zoltan Kiss)  [Orabug: 21976319]  
  - xen-netback: move netif_napi_add before binding interrupt (Wei Liu)  [Orabug: 21976319]  
  - xen-netback: remove loop waiting function (Wei Liu)  [Orabug: 21976319]  
  - xen-netback: don't stop dealloc kthread too early (Wei Liu)  [Orabug: 21976319]  
  - xen-netback: move NAPI add/remove calls (Wei Liu)  [Orabug: 21976319]  
  - xen-netback: fix debugfs entry creation (Wei Liu)  [Orabug: 21976319]  
  - xen-netback: fix debugfs write length check (Wei Liu)  [Orabug: 21976319]  
  - xen-netback: Don't deschedule NAPI when carrier off (Zoltan Kiss)  [Orabug: 21976319]  
  - xen-netback: Fix vif->disable handling (Zoltan Kiss)  [Orabug: 21976319]  
  - xen-netback: Turn off the carrier if the guest is not able to receive (Zoltan Kiss)  [Orabug: 21976319]  
  - xen-netback: Using a new state bit instead of carrier (Zoltan Kiss)  [Orabug: 21976319]  
  - xen-netback: Fix pointer incrementation to avoid incorrect logging (Zoltan Kiss)  [Orabug: 21976319]  
  - xen-netback: Fix releasing header slot on error path (Zoltan Kiss)  [Orabug: 21976319]  
  - xen-netback: Fix releasing frag_list skbs in error path (Zoltan Kiss)  [Orabug: 21976319]  
  - xen-netback: Fix handling frag_list on grant op error path (Zoltan Kiss)  [Orabug: 21976319]  
  - xen-netback: Adding debugfs "io_ring_qX" files (Zoltan Kiss)  [Orabug: 21976319]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [3.8.13-8.el6uek]
changelog:
  - ipoib fix compilation if rcu debug enabled (Maxim Uvarov)   
  - qlge: update from v1.00.00.31 to v1.00.00.32 (Jerry Snitselaar) [Orabug: 17267206]  
  - qla2xxx: update from mainline 8.04.00.08-k to qlogic version 8.05.00.03.39.0-k (Saurav Kashyap) [Orabug: 17277380]  
  - config file change for eIPoIB (Ajaykumar Hotchandani)   
  - bnx2i: update from mainline version 2.7.2.2 to broadcom version 2.7.6.1d (Jerry Snitselaar) [Orabug: 17024889]  
  - bnx2fc: update from mainline version 1.0.12 to broadcom version 2.3.4 (Jerry Snitselaar) [Orabug: 17024889]  
  - bnx2x: update from mainline version 1.78.00-0 to broadcom version 1.76.54 (Jerry Snitselaar) [Orabug: 17024889]  
  - cnic: update from mainline version 2.5.16 to broadcom version 2.5.16g (Jerry Snitselaar) [Orabug: 17024889]  
  - bnx2: update from mainline version 2.2.3 to broadcom version 2.2.3n (Jerry Snitselaar) [Orabug: 17024889]  
  - tg3: update from mainline version 3.128 to broadcom version 3.131d (Jerry Snitselaar) [Orabug: 17024889]  
  - tmpfs: add support for read_iter and write_iter (Hugh Dickins) [Orabug: 16371286]
  - ubifs: convert file ops from aio_read/write to read/write_iter (Dave Kleikamp) [Orabug: 16371286]
  - ecrpytfs: Convert aio_read/write ops to read/write_iter (Dave Kleikamp) [Orabug: 16371286]
  - afs: add support for read_iter and write_iter (Dave Kleikamp) [Orabug: 16371286]
  - udf: convert file ops from aio_read/write to read/write_iter (Dave Kleikamp) [Orabug: 16371286]
  - gfs2: Convert aio_read/write ops to read/write_iter (Dave Kleikamp) [Orabug: 16371286]
  - xfs: add support for read_iter and write_iter (Dave Kleikamp) [Orabug: 16371286]
  - block_dev: add support for read_iter, write_iter (Asias He) [Orabug: 16371286]
  - btrfs: add support for read_iter and write_iter (Dave Kleikamp) [Orabug: 16371286]
  - nfs: simplify swap (Dave Kleikamp) [Orabug: 16371286]
  - nfs: add support for read_iter, write_iter (Dave Kleikamp) [Orabug: 16371286]
  - ext4: add support for read_iter and write_iter (Dave Kleikamp) [Orabug: 16371286]
  - ocfs2: add support for read_iter, write_iter, and direct_IO_bvec (Zach Brown) [Orabug: 16371286]
  - fs: add read_iter and write_iter to several file systems (Dave Kleikamp) [Orabug: 16371286]
  - fs: use read_iter and write_iter rather than aio_read and aio_write (Dave Kleikamp) [Orabug: 16371286]
  - fs: create file_readable() and file_writable() functions (Dave Kleikamp) [Orabug: 16371286]
  - loop: use aio to perform io on the underlying file (Zach Brown) [Orabug: 16371286]
  - bio: add bvec_length(), like iov_length() (Zach Brown) [Orabug: 16371286]
  - aio: add aio support for iov_iter arguments (Zach Brown) [Orabug: 16371286]
  - aio: add aio_kernel_() interface (Zach Brown) [Orabug: 16371286]
  - fs: pull iov_iter use higher up the stack (Zach Brown) [Orabug: 16371286]
  - dio: add bio_vec support to __blockdev_direct_IO() (Dave Kleikamp) [Orabug: 16371286]
  - dio: Convert direct_IO to use iov_iter (Dave Kleikamp) [Orabug: 16371286]
  - iov_iter: let callers extract iovecs and bio_vecs (Zach Brown) [Orabug: 16371286]
  - iov_iter: add a shorten call (Zach Brown) [Orabug: 16371286]
  - iov_iter: add bvec support (Zach Brown) [Orabug: 16371286]
  - iov_iter: ii_iovec_copy_to_user should pre-fault user pages (Dave Kleikamp) [Orabug: 16371286]
  - iov_iter: hide iovec details behind ops function pointers (Zach Brown) [Orabug: 16371286]
  - fuse: convert fuse to use iov_iter_copy_[to|from]_user (Dave Kleikamp) [Orabug: 16371286]
  - iov_iter: add __iovec_copy_to_user() (Dave Kleikamp) [Orabug: 16371286]
  - iov_iter: add copy_to_user support (Zach Brown) [Orabug: 16371286]
  - iov_iter: iov_iter_copy_from_user() should use non-atomic copy (Dave Kleikamp) [Orabug: 16371286]
  - iov_iter: move into its own file (Zach Brown) [Orabug: 16371286]
  - sparc64 - color correction (bob picco)   
  - [ixgbe] hold rcu_read_lock() when derefencing rcu (Maxim Uvarov) [Orabug: 17213023]  
  - mutex: Back out architecture specific check for negative mutex count (Waiman Long) [Orabug: 17237224]  
  - mutex: Queue mutex spinners with MCS lock to reduce cacheline contention (Waiman Long) [Orabug: 17237224]  
  - mutex: Make more scalable by doing less atomic operations (Waiman Long) [Orabug: 17237224]  
  - mutex: Move mutex spinning code from sched/core.c back to mutex.c (Waiman Long) [Orabug: 17237224]  
  - ipc/sem.c: Fix missing wakeups in do_smart_update_queue() (Manfred Spraul) [Orabug: 17237239]  
  - ipc,sem: fix semctl(..., GETNCNT) (Rik van Riel) [Orabug: 17237239]  
  - ipc,sem: fix semctl(..., GETZCNT) (Rik van Riel) [Orabug: 17237239]  
  - ipc: simplify rcu_read_lock() in semctl_nolock() (Linus Torvalds) [Orabug: 17237239]  
  - ipc: simplify semtimedop/semctl_main() common error path handling (Linus Torvalds) [Orabug: 17237239]  
  - ipc: move sem_obtain_lock() rcu locking into the only caller (Linus Torvalds) [Orabug: 17237239]  
  - ipc: fix double sem unlock in semctl error path (Linus Torvalds) [Orabug: 17237239]  
  - ipc: move the rcu_read_lock() from sem_lock_and_putref() into callers (Linus Torvalds) [Orabug: 17237239]  
  - ipc: sem_putref() does not need the semaphore lock any more (Linus Torvalds) [Orabug: 17237239]  
  - ipc: move rcu_read_unlock() out of sem_unlock() and into callers (Linus Torvalds) [Orabug: 17237239]  
  - ipc: fix GETALL/IPC_RM race for sysv semaphores (Al Viro) [Orabug: 17237239]  
  - ipc/msg.c: use list_for_each_entry_[safe] for list traversing (Nikola Pajkovsky) [Orabug: 17237239]  
  - ipc,sem: fine grained locking for semtimedop (Rik van Riel) [Orabug: 17237239]  
  - ipc,sem: have only one list in struct sem_queue (Rik van Riel) [Orabug: 17237239]  
  - ipc,sem: open code and rename sem_lock (Rik van Riel) [Orabug: 17237239]  
  - ipc,sem: do not hold ipc lock more than necessary (Davidlohr Bueso) [Orabug: 17237239]  
  - ipc: introduce lockless pre_down ipcctl (Davidlohr Bueso) [Orabug: 17237239]  
  - ipc: introduce obtaining a lockless ipc object (Davidlohr Bueso) [Orabug: 17237239]  
  - ipc: remove bogus lock comment for ipc_checkid (Davidlohr Bueso) [Orabug: 17237239]  
  - ipc/msgutil.c: use linux/uaccess.h (HoSung Jung) [Orabug: 17237239]  
  - ipc: refactor msg list search into separate function (Peter Hurley) [Orabug: 17237239]  
  - ipc: simplify msg list search (Peter Hurley) [Orabug: 17237239]  
  - ipc: implement MSG_COPY as a new receive mode (Peter Hurley) [Orabug: 17237239]  
  - ipc: remove msg handling from queue scan (Peter Hurley) [Orabug: 17237239]  
  - ipc: set EFAULT as default error in load_msg() (Peter Hurley) [Orabug: 17237239]  
  - ipc: tighten msg copy loops (Peter Hurley) [Orabug: 17237239]  
  - ipc: separate msg allocation from userspace copy (Peter Hurley) [Orabug: 17237239]  
  - ipc: clamp with min() (Peter Hurley) [Orabug: 17237239]  
  - rwsem: check counter to avoid cmpxchg calls (Davidlohr Bueso) [Orabug: 17237186]  
  - rwsem: no need for explicit signed longs (Davidlohr Bueso) [Orabug: 17237186]  
  - x86 rwsem: avoid taking slow path when stealing write lock (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: do not block readers at head of queue if other readers are active (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: implement support for write lock stealing on the fastpath (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: simplify __rwsem_do_wake (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: skip initial trylock in rwsem_down_write_failed (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: avoid taking wait_lock in rwsem_down_write_failed (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: use cmpxchg for trying to steal write lock (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: more agressive lock stealing in rwsem_down_write_failed (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: simplify rwsem_down_write_failed (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: simplify rwsem_down_read_failed (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: move rwsem_down_failed_common code into rwsem_down_{read,write}_failed (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: shorter spinlocked section in rwsem_down_failed_common() (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: make the waiter type an enumeration rather than a bitmask (Michel Lespinasse) [Orabug: 17237186]  
  - rwsem: Implement writer lock-stealing for better scalability (Alex Shi) [Orabug: 17237186]  
  - rwsem-spinlock: Implement writer lock-stealing for better scalability (Yuanhan Liu) [Orabug: 17237186]  
  - mpt3sas: update from v02.100.00.00 to v3.00.00.00 (Sreekanth Reddy) [Orabug: 17249239]  
  - sched: Change position of resched_cpu() in load_balance() (Joonsoo Kim) [Orabug: 16988083]  
  - sched: Move up affinity check to mitigate useless redoing overhead (Joonsoo Kim) [Orabug: 16988083]  
  - sched: Prevent to re-select dst-cpu in load_balance() (Joonsoo Kim) [Orabug: 16988083]  
  - sched: Explicitly cpu_idle_type checking in rebalance_domains() (Joonsoo Kim) [Orabug: 16988083]  
  - sched: Rename load_balance_tmpmask to load_balance_mask (Joonsoo Kim) [Orabug: 16988083]  
  - sched: Don't consider other cpus in our group in case of NEWLY_IDLE (Joonsoo Kim) [Orabug: 16988083]  
  - sched: Fix init NOHZ_IDLE flag (Vincent Guittot) [Orabug: 16988083]  
  - sched: Fix select_idle_sibling() bouncing cow syndrome (Mike Galbraith) [Orabug: 16988083]  
  - disable mlx5 compilation (Ajaykumar Hotchandani)   
  - xfs: Fix the logic check for all quotas being turned off (Chandra Seetharaman)   
  - xfs: return FIEMAP_EXTENT_UNKNOWN for delayed allocation extent (Jie Liu)   
  - xfs: Don't keep silent if sunit/swidth can not be changed via mount (Jie Liu)   
  - xfs: fix rounding in xfs_free_file_space (Dave Chinner)   
  - FSX on 512 byte block size filesystems has been failing for some time with corrupted data. The fault dates back to the change in the writeback data integrity algorithm that uses a mark-and-sweep approach to avoid data writeback livelocks. (Dave Chinner)   
  - xfs: don't free EFIs before the EFDs are committed (Dave Chinner)   
  - xfs: Fix WARN_ON(delalloc) in xfs_vm_releasepage() (Jan Kara)   
  - xfs: fix potential infinite loop in xfs_iomap_prealloc_size() (Brian Foster)   
  - hxge: add support for Oracle 10Gb Ethernet adapter (James Puthukattukaran) [Orabug: 16443155]  
  - rds: complete port of RDS from UEK2 (2.6.39-400.107.0.el5uek) (Venkat Venkatsubra)   
  - rds: RDS files of UEK2 (2.6.39-400.107.0.el5uek) as is (Venkat Venkatsubra)   
  - rds: Add rds.h file (Ajaykumar Hotchandani)   
  - Enable SDP build in config file. (Ajaykumar Hotchandani)   
  - remove drivers/infiniband/debug (Ajaykumar Hotchandani)   
  - Removed srp_1.5.3 (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: use __cancel_delayed_work in IRQ context" (Ajaykumar Hotchandani)   
  - sdp: fix cpu lock-up when sdp call ib_fmr_pool_map_phys (Shamir Rabinovitch)   
  - sdp: IB_CQ_VECTOR_LEAST_ATTACHED will not be supported in ofed-2.0 (Shamir Rabinovitch)   
  - sdp: port sdp to latest devel branch (Shamir Rabinovitch)   
  - sdp: copy sdp from uek-2.0 to ofed-2.0 (Shamir Rabinovitch)   
  - iser: panic on iser login/logout (Shamir Rabinovitch) [Orabug: 16313854]  
  - mlx4_en: Align timestamping support with upstream kernel (Saeed Mahameed)   
  - mlx4_ib: clear comp mask bit of deleted GUID entries after deletion (Saeed Mahameed)   
  - ib_core: fixed resource leak in case of error (Saeed Mahameed)   
  - IB: Introduce Shared PD support (Saeed Mahameed)   
  - ib_core: IB providers/ULPs Relaxed (User) FMR set to NULL (Saeed Mahameed)   
  - mlx4_ib: Enable usermode FMR (Saeed Mahameed)   
  - ib_core: Enable usermode FMR (Saeed Mahameed)   
  - rdma_cm: add ability to control the QP timeout value (Saeed Mahameed)   
  - rdma_cm: adding the RDMA_CM_EVENT_ALT_PATH_LOADED event (Dotan Barak)   
  - mlx4_ib: 6305 bugfix: set the counter sets of the alternate path in the QP (Dotan Barak)   
  - mlx4_ib: Fix the attribute sq_sig_type value in query qp (Saeed Mahameed)   
  - rdma_cm: rdma_create_qp not setting up client context correctly (Saeed Mahameed)   
  - rmda_cm: add APM support to rdma_cm. (rdma_enable_apm) (Saeed Mahameed)   
  - mlx5: Update CMD_IF_REV to 4 (Moshe Lazer)   
  - mlx4_core: resource tracker fix error flow in add_res_range (Saeed Mahameed)   
  - mlx5: Implement new intialization sequeuenc (Moshe Lazer)   
  - ib/ipoib: change mode only when interface is down. (Erez Shitrit)   
  - ib/ipoib: avoid pkey value 0 in child interface. (Erez Shitrit)   
  - ib/ipoib: Fix index 0 pkey value in ipoib sriov env. (Erez Shitrit)   
  - ib/ipoib: limit the max number of receive/transmit queues to 16 (Tal Alon)   
  - mlx4_en: reuse mapped memory in RX flow (v2) (Eugenia Emantayev)   
  - mlx5: Fix check of number of entries in create CQ (Eli Cohen)   
  - mlx5: fix uninitialized var warning (Eli Cohen)   
  - mlx5: fix send work queue size calculation (Eli Cohen)   
  - ib/core: Fix cleanup of user resources (Eli Cohen)   
  - mlx5_ib: fix compilation issues in ubuntu 12.4 The driver uses 2 different enum types in 'switch' and in 'if' statements. This is causing compilation warnings. This patch resolves the issues by replacing the enum with int. (Moshe Lazer)   
  - eth_ipoib: fix hw update in sr-iov interfaces. (Erez Shitrit)   
  - ib/ipoib: handle failure on ipoib_cm_dev_init() for init flow (Tal Alon)   
  - mlx4_core: resolvs kernel panic when connectx_port_config fail to set ports (Moshe Lazer)   
  - mlx5: modify mr cache sizes (Eli Cohen)   
  - Update driver release date (Eli Cohen)   
  - mlx5: fix manipulation of device in healt list (Eli Cohen)   
  - mlx5: fix failure to load on 32 bit archs (Eli Cohen)   
  - mlx5: Add DC support (Eli Cohen)   
  - ib/core: Add support for DC (Eli Cohen)   
  - mlx4_core: implement loopback prevention for ETH qps (Jack Morgenstein)   
  - ib_umad: keep devnum of port cdev and sm_cdev until they are freed (Moshe Lazer)   
  - mlx5: Use UMR based registration directly on mlx5 (Eli Cohen)   
  - mlx5: allow to clear commands stats (Eli Cohen)   
  - ib/ipoib: change skb memory allocation for init process from GFP_ATOMIC to GFP_KERNEL (Tal Alon)   
  - net/mlx4_en: LLS statistics (Amir Vadai)   
  - net/mlx4_en: Add Low Latency Socket (LLS) support (Amir Vadai)   
  - mlx4_core: Free memory only if UNMAP succeeded. (Majd Dibbiny)   
  - eth_ipoib: fix bug in add new vif. (Erez Shitrit)   
  - eth_ipoib: remove unneeded tag (Erez Shitrit)   
  - IB/mlx4: Fetch XRC SRQ in the CQ polling code (Shlomo Pongratz)   
  - mlx4_core: Implement SRQ object lookup from srqn (Shlomo Pongratz)   
  - IB/core: Verify that QP handler is valid before dispatching events (Shlomo Pongratz)   
  - net/mlx4: Add sysFS for vf link state support (Rony Efraim)   
  - net/mlx4: Add vf link state support (Rony Efraim)   
  - Revert "mlx4_en: reuse mapped memory in RX flow" (Vladimir Sokolovsky)   
  - mlx5: improve mr caches (Eli Cohen)   
  - mlx4_core: Dynamic VST to VST vlan/qos changes (Jack Morgenstein)   
  - mlx4_en: reuse mapped memory in RX flow (Eugenia Emantayev)   
  - mlx4: add pci domain to module params that use bdf-to-value format (Moshe Lazer)   
  - mlx5: Add support to measure average command time (Eli Cohen)   
  - ib/core: add means to measure average time of a command (Eli Cohen)   
  - net/mlx4_core eSwitch - add support VST with priority tag+ remove debug prints (Rony Efraim)   
  - mlx4_en: Use state_lock to protect ethtool rules database (Hadar Hen Zion)   
  - IB/core: Remove DMFS rules from uobject rule_list when ib_destroy_flow() fails (Hadar Hen Zion)   
  - IB/core: Do not access flow_id after destroy_flow() is called (Hadar Hen Zion)   
  - mlx4_ib: Free mailbox after create flow is done (Hadar Hen Zion)   
  - mlx4_ib: Check index before access the array in create/destroy flow (Hadar Hen Zion)   
  - mlx4_core : implemented a function ib_rate_to_mlx4 that checks if the 	    static_rate is a valid value before assigning it to the 	    ah_attr in mlx4_set_path. (majd@mellanox.com)   
  - mlx4: add means to measure command execution time (Eli Cohen)   
  - mlx5: Add health plugin support (Eli Cohen)   
  - mlx4_en: fix skb leakage (Eugenia Emantayev)   
  - ib/ipoib: add call to dev_set_mtu when setting mode to connect (Tal Alon)   
  - ib/ipoib: update broadcast record according to the new bcast from the sm. (Erez Shitrit)   
  - ib/ipoib: fix hard_header return value (Erez Shitrit)   
  - Fix broken previous commit (Eli Cohen)   
  - mlx5: fix query of max rd atomic (Eli Cohen)   
  - mlx5: Fix offsets in query hca cap (Eli Cohen)   
  - mlx5: Add descriptive strings to health bufer reports (Eli Cohen)   
  - mlx5: Add fast registraton support (Eli Cohen)   
  - eth_ipoib: fix neigh hash in each slave (Erez Shitrit)   
  - ib/ipoib: add parameters range description to driver info validates received parameters (Tal Alon)   
  - mlx5: Fix fast path configuration (Eli Cohen)   
  - ib_core: xrc cleanup (Yishai Hadas)   
  - kernel-uek.spec: Remove pesign >= 0.10-4 as build requirement (Ajaykumar Hotchandani)   
  - config file change (Ajaykumar Hotchandani)   
  - Kconfig and Makefile specific changes (Ajaykumar Hotchandani)   
  - mlx4_vnic: Fix reference path to hw/mlx4 header files (Ajaykumar Hotchandani)   
  - mlx4: Fix compilation error for mlx4_get_vf_config (Ajaykumar Hotchandani)   
  - Fix IPoIB compilation issue. (Ajaykumar Hotchandani)   
  - mlx5: remove __dev* attributes (Ajaykumar Hotchandani)   
  - mlx4_core: remove __dev* attributes (Bill Pemberton)   
  - IB/srp: Fail I/O requests if the transport is offline (Bart Van Assche)   
  - IB/srp: Avoid endless SCSI error handling loop (Bart Van Assche)   
  - IB/srp: Avoid sending a task management function needlessly (Bart Van Assche)   
  - IB/srp: Track connection state properly (Bart Van Assche)   
  - IB/srp: send disconnect request without waiting for CM timewait exit (Vu Pham)   
  - IB/srp: destroy and recreate QP and CQs when reconnecting (Ishai Rabinovitz)   
  - IB/srp: Eliminate state SRP_TARGET_DEAD (Bart Van Assche)   
  - IB/srp: Allow SRP disconnect through sysfs (Bart Van Assche)   
  - IB/srp: Suppress superfluous error messages (Bart Van Assche)   
  - IB/srp: Introduce the helper function srp_remove_target() (Bart Van Assche)   
  - IB/srp: Process all error completions (Bart Van Assche)   
  - IB/srp: Introduce srp_handle_qp_err() (Bart Van Assche)   
  - IB/srp: Simplify SCSI error handling (Bart Van Assche)   
  - IB/srp: Keep processing commands during host removal (Bart Van Assche)   
  - IB/srp: Eliminate state SRP_TARGET_CONNECTING (Bart Van Assche)   
  - IB/srp: Increase block layer timeout (Bart Van Assche)   
  - net/mlx4_core: Disallow releasing QPs before steering rules are detached (Hadar Hen Zion)   
  - mlx4_core: Fix error flow in the flow steering wrapper (Hadar Hen Zion)   
  - mlx4_core: Fix potential deadlock in mlx4_eq_int() (Jack Morgenstein)   
  - mlx4_core: Add QPN enforcement for flow steering rules set by VFs (Hadar Hen Zion)   
  - Revert "net/mlx4_core: Disallow releasing QPs before steering rules are detached" (Ajaykumar Hotchandani)   
  - mlx4_en: update driver version to 2.1.3 (Eugenia Emantayev)   
  - mlx4_core: Fix advertisement of wrong PF context behaviour (Or Gerlitz)   
  - net/mlx4_en: Use generic etherdevice.h functions. (Yan Burman)   
  - net/mlx4_en: Can set maxrate only for TC0 (Amir Vadai)   
  - IB/mlx4: Fix spinlock order to avoid lockdep warnings (Jack Morgenstein)   
  - Revert "mlx4_en: fix QoS in old kernels" (Ajaykumar Hotchandani)   
  - mlx4_core: use __cancel_delayed_work in IRQ context (Saeed Mahameed)   
  - eth_ipoib:  use hash for managing the neighs in each slave. (Erez Shitrit)   
  - IB/iser: fix device removal flow (Roi Dayan)   
  - Fix compliation issue on 32 bit systems (Eli Cohen)   
  - mlx5: move UMR completions to event driven (Eli Cohen)   
  - eth_ipoib: add bh lock in order to avoid soft-lockups (Erez Shitrit)   
  - mlx4_vnic: align with OFED2 upstream 3.7 kernel (Saeed Mahameed)   
  - mlx4_vnic: adapt vnic to ofed2 mlx4 implementation (Saeed Mahameed)   
  - mlx4_vnic: add mlx4_vnic (Saeed Mahameed)   
  - ib/ipoib: add sysfs for tss/rss over child interface (Saeed Mahameed)   
  - ib/ipoib: fix memory leak in error flow (Saeed Mahameed)   
  - mlx4_ib: Fix connection of UD QPs in rdmacm for SRIOV/RoCE (Shani Michaelli)   
  - mlx4_core: fix error introduced in a merge from upstream (Jack Morgenstein)   
  - Fix compliation issue on 32 bit systems (Eli Cohen)   
  - mlx4_en: fix statistics view in SRIOV mode (Eugenia Emantayev)   
  - mlx5: change SRQ limit event msg to debug (Eli Cohen)   
  - mlx5: dump selected error CQEs (Eli Cohen)   
  - mlx5: move UMR completions to event driven (Eli Cohen)   
  - mlx4_core: Avoid setting ports for auto when only one port type is supported (Moshe Lazer)   
  - mlx4_core: cleared the mailbox->buf (memset 0) before using it.            mlx4_set_port_general_context struct is smaller than the mailbox->buf            therefore clearing only it was not enough and we had to clear the whole            mailbox->buf in order to ensure garbage-free buffer. (majd@mellanox.com)   
  - mlx4_en: setting number of rings resulted in deadlock (Matan Barak)   
  - mlx5: fix query of max rdma/atomics (Eli Cohen)   
  - mlx4_en: update driver version to 2.1.2 (Eugenia Emantayev)   
  - mlx4_en: update driver version to 2.1.1 (Eugenia Emantayev)   
  - IB/iser: Fix coverity errors (Roi Dayan)   
  - mlx5: update modinfo string for mlx5_ib (Eli Cohen)   
  - ib/ipoib: fix panic at cm tx creation. (Erez Shitrit)   
  - mlx5: fix opt param mlx5 translation table (Eli Cohen)   
  - mlx4_core: sysfs, fix usage of log_num_mtt module parameter (Yishai Hadas)   
  - ib/ipoib: in additional to commit 2bf6943f4f9ea9f1f69b4ef5acb4ece11bf50bc0 (Erez Shitrit)   
  - mlx5: fix opt parameters usage (Eli Cohen)   
  - ib/ipoib: fix kernel panic after mode changing. (Erez Shitrit)   
  - mlx5: add missing spare EQEs in create EQ (Eli Cohen)   
  - Revert "ib/ipoib: enhance interop between TSS device to non-TSS device." (Erez Shitrit)   
  - mlx5: mark mlx5_ib QPs how they were created (Eli Cohen)   
  - mlx5: Fix alignement of data buffers for umr registration (Eli Cohen)   
  - ib/ipoib: fix for missing ping reply issue. (Erez Shitrit)   
  - ib/ipoib: Call skb_dst_drop() once skb is enqueued for sending (Erez Shitrit)   
  - net/mlx4_core : update enforce QP param in VST (Rony Efraim)   
  - net/mlx4_core: Always use __mlx4_un/register_vlan for VST (Rony Efraim)   
  - mlx4_ib: set link type for the primary path (Eli Cohen)   
  - mlx4_core: Fix mem leak in SRIOV mlx4_init_one error flow (Jack Morgenstein)   
  - mlx4_core: Add wrapper for mlx4_DIAG_RPRT command to return BAD_OP (Jack Morgenstein)   
  - mlx4_en: do not allow certain ethtool options when alloc resources failed (Eugenia Emantayev)   
  - mlx4_en: restore ring inflight atomic variable (Eugenia Emantayev)   
  - ib/ipoib: move (one more) message to be at debug level instead of warn (Erez Shitrit)   
  - ib/ipoib: move message to be at debug level instead of warn (Erez Shitrit)   
  - mlx5: change message from warn to debug (Eli Cohen)   
  - mlx4_en: No_wqes counter should only be reported via Ethtool (Yevgeny Petrilin)   
  - mlx4_en: inline threshold must be unsigned (Eugenia Emantayev)   
  - mlx4_en: make receive flow more readable (Eugenia Emantayev)   
  - ib/ipoib: fix skb true size (Erez Shitrit)   
  - mlx5: fix offset to health buffer (Eli Cohen)   
  - mlx4_en: fix kernel panic on XenServer hypervisor (Eugenia Emantayev)   
  - mlx4_core: Ignore bf flag in mlx4_qp_reserve_range when count is too large (Jack Morgenstein)   
  - mlx4_core: use kernel to allocate and release umad cdevs (Moshe Lazer)   
  - mlx4_ib: used uninitialized compilation warning (Moshe Lazer)   
  - mlx4_en: change driver version to 2.1 and add date (Eugenia Emantayev)   
  - mlx4_en: remove TX shifting (Eugenia Emantayev)   
  - memtrack: handle umem put page (Yishai Hadas)   
  - mlx4_en: fix wrong MAC address (Eugenia Emantayev)   
  - ib_srp: update module version to 1.2 (Alex Tabachnik)   
  - mlx4_core: fix ib_uverbs_get_context flow (Yishai Hadas)   
  - IB/core: Fix memory leaks in ib_uverbs_create_flow (Hadar Hen Zion)   
  - mlx4_core: Fix Coverity issue (Hadar Hen Zion)   
  - IB/core: Fix Coverity issue (Hadar Hen Zion)   
  - ib/ipoib: remove compilation warning (Erez Shitrit)   
  - mlx4_en: get timestamp request from correct packet info (Eugenia Emantayev)   
  - mlx4_en: make alignment generic (Eugenia Emantayev)   
  - Revert "DEBUG PATCH" (Moshe Lazer)   
  - Revert "DEBUG PATCH update" (Moshe Lazer)   
  - ib/ipoib: allocate always one linear buffer at the RX flow (Erez Shitrit)   
  - ib/ipoib: enhance interop between TSS device to non-TSS device. (Erez Shitrit)   
  - mlx4_en: fix DCB_ENABLE flag (Eugenia Emantayev)   
  - IB/iser: Move important debug prints to debug level 1 (Roi Dayan)   
  - mlx4_en: add check for DMA mapping error (Eugenia Emantayev)   
  - mlx4_en: align dma to 64 (Eugenia Emantayev)   
  - ib_mad: Avoid looking into mad struct before finding it in list (Moshe Lazer)   
  - net/mlx4_core: Translate guest B0 steering rules to DMFS (Hadar Hen Zion)   
  - net/mlx4_core: Add helper function to translate B0 steering to DMFS (Hadar Hen Zion)   
  - net/mlx4_core: Disallow releasing QPs before steering rules are detached (Hadar Hen Zion)   
  - net/mlx4_core: Use 64 bit resource ID when doing lookup (Hadar Hen Zion)   
  - net/mlx4_en: Remove ethtool flow steering rules before releasing QPs (Hadar Hen Zion)   
  - ib_uverbs: added ref_cnt to sysfs (Marcel Apfelbaum)   
  - ib/ipoib: disable reinit at the middle of driver down. (Erez Shitrit)   
  - mlx4_core: change warn msg to dbg msg (Moshe Lazer)   
  - mlx4_core: Fix Coverity issues. (Hadar Hen Zion)   
  - IB/mlx4: Fix Coverity issues (Hadar Hen Zion)   
  - IB/core: Fix Coverity issues (Hadar Hen Zion)   
  - mlx4_en, mlx4_ib: show VSD string through sysfs (Hadar Hen Zion)   
  - mlx4_core: Enhance flow steering validation checks (Hadar Hen Zion)   
  - IB/mlx4: use ARRAY_SIZE kernel macro (Hadar Hen Zion)   
  - net/mlx4_core: Fix wrong order of flow steering resources removal (Hadar Hen Zion)   
  - mlx4_core: map eq inconsistency with prm (Moshe Lazer)   
  - net/mlx4_core: Preparation + workaround for the UPDATE_QP FW cmd (Rony Efraim)   
  - mlx4_ib: assign all dev numbers in low-level driver when dev_assign_str param is active (Jack Morgenstein)   
  - mlx4_core: fix the method to get phys func from its virt func (Moshe Lazer)   
  - ib_iser: move some error prints to debug prints (Roi Dayan)   
  - ib_iser Fix kernel crash on ib_iser module unload immediately after initiator logout (Alex Tabachnik)   
  - ib_srp: simplifying handle port down, cm dreq, scsi error recovery (Alex Tabachnik)   
  - ib_srp: check for error return to avoid garbage gid in initiator_id (Alex Tabachnik)   
  - ib_srp: bail out when scsi command in req is NULL (Alex Tabachnik)   
  - mlx4: Allow RAW PACKET QPs on mlx4 (Eli Cohen)   
  - ib/ipoib: fix for ib_unregister_event_handler (Erez Shitrit)   
  - mlx4_en: fix memory leak in mlx4_en_activate_rx_rings (Eugenia Emantayev)   
  - mlx4_en: verify mlx4_en module parameters (Eugenia Emantayev)   
  - mlx4_en: change ethtool specifications for 1G, 10G, 40G support in advertising and supported fields (Rana Shahout)   
  - IB/core: Fix raw Ethernet qp bug (Hadar Hen Zion)   
  - IB/core: add module parameter check to allow a non-root user to attach DMFS rules (Hadar Hen Zion)   
  - IB/mlx4: Add support for Flow Steering (Hadar Hen Zion)   
  - IB/core: Export ib_create/destroy_flow through uverbs (Hadar Hen Zion)   
  - IB/core: Implement ib_create/destroy_flow (Hadar Hen Zion)   
  - net/mlx4_core: Add flow steering support to be used by mlx4_ib (Hadar Hen Zion)   
  - mlx4_core: Directly expose fields of HW flow steering rule control segment (Hadar Hen Zion)   
  - mlx4_core: Replace flow steering fields names to match the PRM (Hadar Hen Zion)   
  - mlx4_core: Expose flow steering HW structs to be used by mlx4_ib module (Hadar Hen Zion)   
  - mlx4_ib: Remove attach/detach flow API implementation (Hadar Hen Zion)   
  - ib_uverbs: Remove ib_uverbs_attach/detach_flow leftovers (Hadar Hen Zion)   
  - Revert "ib_core: Implement ib_attach_flow ib_detach_flow" (Hadar Hen Zion)   
  - Revert "mlx4_ib: Add support for ib_attach_flow and ib_detach_flow." (Hadar Hen Zion)   
  - Revert "ib_uverbs: Export ib_attach_flow and ib_detach_flow to userspace." (Hadar Hen Zion)   
  - Revert "rdma_cm: Implement rdma_get_l2" (Hadar Hen Zion)   
  - mlx4_en: add port state test before operate mlx4_en_set_cq_moder in mlx4_en_set_ringparam function. (Rana Shahout)   
  - mlx4_en: avoid loosing statistics (Eugenia Emantayev)   
  - ib_iser: add module version (Roi Dayan)   
  - mlx5: fix health counter read (Eli Cohen)   
  - mlx4_en: set correct MTU in SRIOV (Eugenia Emantayev)   
  - Release Date is updated to __DATE__ instead of a static string (Alex Markuze)   
  - mlx4_core: use msi_x module param to limit num of MSI-X irqs (Moshe Lazer)   
  - Seting ring size to default when module param set incorrectly (Alex Markuze)   
  - eth_ipoib: move task from rx flow to workqueue (Erez Shitrit)   
  - mlx5: fix health polling race (Eli Cohen)   
  - DEBUG PATCH update To provide more info on kernel panic in mad layer. (Moshe Lazer)   
  - memtrack: add tracking for kfree_rcu (Eugenia Emantayev)   
  - mlx4_en: Set number of rx/tx channels using ethtool (Amir Vadai)   
  - mlx4_en: fix incorrect timestamp (Eugenia Emantayev)   
  - mlx4_en: remove explicit call to skb_reset_mac_header (Eugenia Emantayev)   
  - ib/ipoib: move global client_data_lock spin_lock init to module_init (Erez Shitrit)   
  - mlx5: use MPI profile as default (Eli Cohen)   
  - ib/ipoib: protect client data with spin-lock. (Erez Shitrit)   
  - ib/ipoib: disable lro over pv interface. (Erez Shitrit)   
  - eth_ipoib: change lock over bh, use regular lock. (Erez Shitrit)   
  - mlx4_core: CQE/EQE by default is 64B (Yishai Hadas)   
  - mlx5: change fw health polling to new definition (Eli Cohen)   
  - mlx5: fix missing symbols in 32 bit platforms (Eli Cohen)   
  - mlx5: use separate EQ of command interface (Eli Cohen)   
  - mlx5: change scatter to cqe to new PRM (Eli Cohen)   
  - net/mlx4: Update FW DEV CAP bits of VST and FSM (Yan Burman)   
  - net/mlx4: Add support to get VF config (Yan Burman)   
  - net/mlx4: Fix the VF numbering from 0 (instead of 1) (Yan Burman)   
  - mlx4_en: fix no vlan traffic on vlan interface (Eugenia Emantayev)   
  - DEBUG PATCH To provide info on kernel panic in mad layer. (Moshe Lazer)   
  - mlx5: fix warning on out of array bounds (Eli Cohen)   
  - mlx5: DEBUG PATCH (Eli Cohen)   
  - mlx4_en: reset mac_header (Eugenia Emantayev)   
  - mlx4_core: fix counters leak as part of slave down (Yishai Hadas)   
  - mlx4_ib, ib_core: UP setting for Raw Eth QP (Amir Vadai)   
  - mlx4_en: help disperse interrupts workload in TX flow (Eugenia Emantayev)   
  - mlx4_en: help disperse interrupts workload in RX flow (Eugenia Emantayev)   
  - mlx4_en: optimize inline logic in TX flow (Eugenia Emantayev)   
  - mlx4_en: remove atomic from transmit flow (Eugenia Emantayev)   
  - mlx4_en: use unlikely when checking for bounce in en_xmit (Eugenia Emantayev)   
  - mlx4_en: code cleanup (Eugenia Emantayev)   
  - Issue: 170150 mlx4: Allow to set CQ Ignore Overrun under capability check (Igor Ivanov)   
  - Issue: 170150 IB/mlx4: Add Cross-channel functionality (Igor Ivanov)   
  - Issue: 170150 IB/core: Add ib_uverbs_modify_cq_ex (Igor Ivanov)   
  - Issue: 170150 IB/core: Add ib_uverbs_create_qp_ex (Igor Ivanov)   
  - Issue: 170150 IB/core: Add Infrastructure to support verbs extensions through uverbs (Igor Ivanov)   
  - Issue: 170150 IB/core: Add support for Cross Channel operations (Igor Ivanov)   
  - Issue: 170150 IB/mlx5: Change CQ modify to have attributes/mask and flags param (Igor Ivanov)   
  - Issue: 170150 IB: Change CQ modify to have attributes/mask and flags param (Igor Ivanov)   
  - ib/core: change error prints in cm module to debug prints. (Jack Morgenstein)   
  - mlx4: bf_qp parameter added to mlx4_qp_reserve_range should be a flags param. (Jack Morgenstein)   
  - mlx4_en: use linear skbs in receive flow (Eugenia Emantayev)   
  - mlx5: debug patch - freeze on too long completions (Eli Cohen)   
  - mlx5: debug patch for umr problem (Eli Cohen)   
  - mlx4_core: Add support for different value formats in BDF-Val params (Moshe Lazer)   
  - mlx4_core: Add more info to mlx4_cmd_post failure error messages (Jack Morgenstein)   
  - mlx4_en: ignore init and shutdown hypervisor events (Eugenia Emantayev)   
  - mlx5: fix false compilation error in qp.c (Eli Cohen)   
  - Fix format specifier for printk (Eli Cohen)   
  - mlx4_ib: in SRIOV, should not reserve QP range for IPoIB use when DMFS is enabled. (Jack Morgenstein)   
  - mlx4_core: use symbolic name for FW commands in warnings (Jack Morgenstein)   
  - mlx5: fix race in destroy CQ (Eli Cohen)   
  - mlx5: fix error flow in destroy SRQ (Eli Cohen)   
  - mlx4_core: Support setting a different port_type_array for each HCA (Moshe Lazer)   
  - mlx4_en: use div_u64 for division (Eugenia Emantayev)   
  - mlx4_core: disable mlx4_QP_ATTACH calls from guests if master is doing flow steering. (Jack Morgenstein)   
  - Adding parametre validation to ipoib_printk (Alex Markuze)   
  - eth_ipoib: enable GRO on the pv interface (Erez Shitrit)   
  - mlx4_en: release QP when destroying TX ring (Eugenia Emantayev)   
  - mlx5: add profie selection of mr cache sizes (Eli Cohen)   
  - memtrack: fix broken memtrack on vzalloc (Eli Cohen)   
  - Add mlx5 driver support (Eli Cohen)   
  - ib/core: add UMR support for verbs (Eli Cohen)   
  - ib/core: Add means to measure command execution times (Eli Cohen)   
  - mlx4_core: Don't fail reg/unreg vlan for upstream guests to 3.8 (Jack Morgenstein)   
  - mlx4_core: Turn off device-managed FS bit in dev-cap wrapper if DMFS is not enabled (Jack Morgenstein)   
  - mlx4_core: change resource quotas to enable supporting upstream-kernel guests (Jack Morgenstein)   
  - mlx4_core: Support setting a different num_vfs and probe_vf for each HCA (Moshe Lazer)   
  - ib/ipoib: fix ipoib_neigh index calculation (Shlomo Pongratz)   
  - mlx4_en: split outgoing traffic to two different rings (Eugenia Emantayev)   
  - Flsu WQ should come after flush_paths in CM mode (Alex Markuze)   
  - net/mlx4_en: Synchronize unicast MAC filter implementation with upstream (Yan Burman)   
  - ib/iser: add BullseyeCoverage pragma lines around ilog2 calls (Roi Dayan)   
  - ib_srp: fix oops during module unload on OEL 6.2 (Alex Tabachnik)   
  - Moved the tx ethtoll counters to ipoib_send (Alex Markuze)   
  - ib/ipoib: fix deadlock between dev_change_flags to __ipoib_dev_flush (Erez Shitrit)   
  - Adding flush WQ for ipoib_ib_dev_cleanup to avoid cm_create_tx_qp handling bad pointers Issue: 111256, 168923 (Alex Markuze)   
  - mlx4: change QP allocation scheme (Eugenia Emantayev)   
  - ib/ipoib: avoid loading the kernel when rtnl is locked. (Erez Shitrit)   
  - ib/ipoib: fix deadlock between ipoib_mcast_dev_flush to ipoib_mcast_join_finish (Erez Shitrit)   
  - mlx4_ib: use correct device for XRC (Yishai Hadas)   
  - net/mlx4_en: Fix resource leak on module unload (Yan Burman)   
  - net/mlx4_en: Fix race in set_mac_address regression (Yan Burman)   
  - ib/ipoib: fix panic on ipoib_get_stats (Erez Shitrit)   
  - mlx4_core: device revision support (Yishai Hadas)   
  - mlx4_core: print more info when command times out (Jack Morgenstein)   
  - ib/ipoib: Fix ipoib_neigh hashing to use the correct daddr octets (Shlomo Pongratz)   
  - ib/ipoib: : Fix race condition in neigh creation under MQ (Shlomo Pongratz)   
  - ib/ipoib: rtnl_unlock cannot come after free_netdev (Erez Shitrit)   
  - ib/ipoib: fix deadlock over vlan_mutex. (Erez Shitrit)   
  - 	This is a partial fix for bad flow when ipoib_reinit fails to ipoib_dev_init. 	This fix enables the driver to call ib_unregister_event_handler in ipoib_remove_one, without crushing, 	though ib_register_event_handler was not called. (Alex Markuze)   
  - eth_ipoib: fix compilation over xen-server. (Erez Shitrit)   
  - ib/ipoib: remove netlink code till further support. (Erez Shitrit)   
  - mlx4_core: move out label to the right place (Eugenia Emantayev)   
  - IB/mlx4: Do reg/unreg vlan for RoCE (Jack Morgenstein)   
  - {IB,EN}/mlx4: In RoCE allow guests to have multiple GIDS (Jack Morgenstein)   
  - IB/mlx4: prepare update_gids flow for multiple gids (Jack Morgenstein)   
  - mlx4_en: add check for QoS capability bit (Eugenia Emantayev)   
  - EN/mlx4: use vlan id in mlx4_unregister_vlan instead of vlan index (Jack Morgenstein)   
  - mlx4_core: fix reg/unreg vlan and reg/unreg mac to conform to the PRM (Jack Morgenstein)   
  - memtrack: alloc/free pages handle size inconsistency (Yishai Hadas)   
  - mlx4_en: use num_possible_cpus instead of num_default_rss_queues (Eugenia Emantayev)   
  - mlx4_en: memory leak in loading driver (Matan Barak)   
  - net/mlx4_en: Add support for destination MAC in steering rules (Yan Burman)   
  - net/mlx4_en: Implement fdb ndo_fdb_{add,del,dump} (Yan Burman)   
  - net/mlx4_en: Add unicast MAC filtering (Yan Burman)   
  - net/mlx4_en: Manage hash of MAC addresses per port (Yan Burman)   
  - net/mlx4_en: Save old MAC address of the port so we can replace it later (Yan Burman)   
  - net/mlx4_en: Re-arrange ndo_set_rx_mode related code (Yan Burman)   
  - net/mlx4: Move ethernet related functionality to mlx4_en out of mlx4_core (Yan Burman)   
  - net/mlx4_en: Cleanup multiline strings (Yan Burman)   
  - net/mlx4_en: Optimize loopback related checks in data path (Yan Burman)   
  - net/mlx4_core: Set number of msix vectors under SRIOV mode to firmware defaults (Or Gerlitz)   
  - ib/ipoib: fix possible deadlock on pkey_poll task. (Erez Shitrit)   
  - mlx4_en: fix BlueFlame race (Eugenia Emantayev)   
  - ib_mad: Add SA MADs congestion control (Moshe Lazer)   
  - ib/ipoib: add robust to ipoib_mcast_join_finish (Erez Shitrit)   
  - ib/ipoib: fix deadlock between ipoib_mcast_dev_flush and ipoib_mcast_join_finish (Erez Shitrit)   
  - IB/iser: Enable iser to work when FMRs are not supported (Or Gerlitz)   
  - mlx4_en: ethtool should return error on turning on autoneg (Matan Barak)   
  - IB/mlx4: deprecate "failed to alloc bf reg" message from err to debug (Jack Morgenstein)   
  - mlx4_en: fix bad english in modprobe and ethtool (Amir Vadai)   
  - mlx4_en: Move initalizations to beginning of init_netdev (Amir Vadai)   
  - mlx4_en: pad ethernet packets smaller than 17 bytes (Amir Vadai)   
  - mlx4_en: print error message on cqe error (Amir Vadai)   
  - mlx4_en: fix set port ratelimit. (Sagi Grimberg)   
  - mlx4_en: fix MLX4_RATELIMIT_DEFAULT define include (Sagi Grimberg)   
  - mlx4_en: report number of rings in RSS as a power of 2 (Amir Vadai)   
  - mlx4_en: fix UP limit in ieee_ets->prio_tc (Amir Vadai)   
  - mlx4_core: Do not allow mlx4_bitmap_init to reserve more slots than available (Amir Vadai)   
  - mlx4_en: fix open-lldp DCB support (Sagi Grimberg)   
  - remove dead code - mlx4_en_can_lro (Sagi Grimberg)   
  - mlx4_en: add support for debugfs (Shani Michaelli)   
  - mlx4_en: TX ring size default to 1024 (Yevgeny Petrilin)   
  - ib/ipoib: Fix deadlock between rmmod and set_mode (Erez Shitrit)   
  - ib/ipoib: fine tune commit aee8f48642fb83820463d042ca80fd5372947cb5 (Erez Shitrit)   
  - In 4K mtu Rx, adding 128 bytes to linear part (Alex Markuze)   
  - ib/ipoib: getout whenever failed to load port. (Erez Shitrit)   
  - ib_ipoib: Fixing issue with delayed work running after child is killed. (Erez Shitrit)   
  - mlx4_en: extract changes to compat from backport (Amir Vadai)   
  - IB/mlx4: in RoCE, report network-view of number of GIDS in query_port. (Jack Morgenstein)   
  - srp: Create additioal tree with srp code from mofed 1.5.3, separated to two parts one for all the distributions and one for sles11sp2 and kernels bigger then 3.0. Original srp code remaine as is and when will be needed will be used for developement (Alex Tabachnik)   
  - mlx4_en: fix QoS in old kernels (Amir Vadai)   
  - ib_core: contig allocation use NOWARN flag (Yishai Hadas)   
  - ib_core: fix memory leak in contig error flow (Yishai Hadas)   
  - mlx4_core: Fixed IPoIB flow steering (Hadar Hen Zion)   
  - ib/ipoib: Add print log for debug. (Erez Shitrit)   
  - ib/ipoib: Fix mess in the select queue in TSS flow. (Erez Shitrit)   
  - ipoib: fix mcast dead-lock (Yishai Hadas)   
  - Fixing RHL6.2 memtrack backports for alloc_worqueue (Alex Markuze)   
  - mlx4_core: additional fix for qp_detach_common (Eugenia Emantayev)   
  - mlx4_core: fix broken logic when removing promisc qp (Eugenia Emantayev)   
  - ib/ipoib: doesn't allow num of tx channel to be 2. (Erez Shitrit)   
  - net/eipoib: sys/fs show of "served" should give the new member as it does with the valid members (Erez Shitrit)   
  - mlx4_en: counters init to non-index (Yishai Hadas)   
  - mlx4_core: Do not guarantee counter availability in SRIOV (Jack Morgenstein)   
  - mlx4_en: counters fine-tuned (Yishai Hadas)   
  - mlx4_core: max counters support (Yishai Hadas)   
  - mlx4_core: change code to endian safe (Hadar Hen Zion)   
  - mlx4_ib: allow FS rules attachments with missing headers (Hadar Hen Zion)   
  - mlx4_en/mlx4_ib: move BE_SHORT/WORD_MASK macro from private to common place (Hadar Hen Zion)   
  - mlx4_core: configure flow steering hash to L4 mode (Hadar Hen Zion)   
  - mlx4_en: Fixed ethtool rules leftovers after mlx4_en unload (Hadar Hen Zion)   
  - mlx4_en: block insertion of FS ethtool rules while port is down (Hadar Hen Zion)   
  - mlx4_en: Remove FS promisc rules removal from mlx4_en_start_port (Hadar Hen Zion)   
  - mlx4_en: fix ethtool vlan range validation (Hadar Hen Zion)   
  - mlx4_ib: Add VLAN support to RawEth QP flow steering (Hadar Hen Zion)   
  - mlx4_en: fixed ip/tcp/udp multicast mac rules when inserted via ethtool (Hadar Hen Zion)   
  - mlx4_en: counters moderation support (Yishai Hadas)   
  - memtrack: add missing untrackable functions for EN under RH6.3 (Yishai Hadas)   
  - mlx4_core: Resource wrapper for reg/unreg vlans (Jack Morgenstein)   
  - mlx4_core: fix register/unreg vlan flow (Jack Morgenstein)   
  - mlx4_core: fix call to __mlx4_unregister_mac (Jack Morgenstein)   
  - mlx4_core: Implement resource quota enforcement when allocating various resources (Jack Morgenstein)   
  - {IB,EN}/mlx4: structures and init/teardown for VF resource quotas (Jack Morgenstein)   
  - memtrack: fix report (Yishai Hadas)   
  - net/mlx4: Add support for MAC spoof checking (Rony Efraim)   
  - net/mlx4: Add support to set default vlan id and priority for VF NIC (Rony Efraim)   
  - net/mlx4: Add support the set mac address for VF NIC (Rony Efraim)   
  - {IB,EN}/mlx4: Replace mlx4_en_mac_to_u64() with mlx4_mac_to_u64() (Rony Efraim)   
  - net/mlx4: Add admin and oper DB (Rony Efraim)   
  - mlx4_en: fix some dead-locks as of flow steering mode (Yishai Hadas)   
  - mlx4_en: Do not query ethernet stats when a device port is down. (Jack Morgenstein)   
  - extended counters use correct reserved bytes (Yishai Hadas)   
  - mlx4_core: fix endianness bug in set_param_l (Jack Morgenstein)   
  - ib/ipoib: fix the failure to delete  clone child interface. (Erez Shitrit)   
  - net/mlx4_core: Fix racy flow in the driver CQ completion handler (Jack Morgenstein)   
  - net/eipoib: Support bonding (active-passive mode) for eIPoIB driver. (Erez Shitrit)   
  - ib/ipoib: Changes in ipoib in order to support the latest version of eIPoIB. (Erez Shitrit)   
  - net/eipoib: Add ethtool file support (Erez Shitrit)   
  - net/eipoib: Add sysfs support (Erez Shitrit)   
  - net/eipoib: Add main driver functionality (Erez Shitrit)   
  - net/eipoib: Add private header file (Erez Shitrit)   
  - mlx4_en: report extra rx counters for SRIOV (Yishai Hadas)   
  - mlx4_ib: add extended counters support (Yishai Hadas)   
  - mlx4_en: support extended counters (Yishai Hadas)   
  - mlx4_core: set device to use extended counters (Yishai Hadas)   
  - fix NULL pointer assignment in the disconnection flow (Alex Tabachnik)   
  - mlx4_ib: mlx4_set_path() wrote the port number into the MAC address field under RoCE (Jack Morgenstein)   
  - mlx4_ib: Called rdma_port_get_link_layer with wrong port number. (Jack Morgenstein)   
  - add support for CQ moderation (Alex Tabachnik)   
  - mlx4_en: fix IPv6 traffic (Eugenia Emantayev)   
  - ipoib: move set_skb_oob_cb_data body to ipoib.h (Vladimir Sokolovsky)   
  - ib/ipoib: Fix deadlock at the release of child_interfaces. (Erez Shitrit)   
  - mlx4: verify port number in __mlx4_unregister_mac (Eli Cohen)   
  - ipoib: improve poll mechanism for better performance (Yishai Hadas)   
  - ipoib: Replace write_lock with rw semaphore (Jack Morgenstein)   
  - mlx4_core: Do not enable flow steering by default (Jack Morgenstein)   
  - mlx4_core: Adjustments to Flow Steering activation logic for SRIOV (Jack Morgenstein)   
  - ipoib: adapt code to netlink changes (Yishai Hadas)   
  - ib/ipoib: debug prints instead of warn in tx_wc function (Erez Shitrit)   
  - ib/ipoib: fix possible race between  ipoib_cm_skb_too_long call to skb free. (Erez Shitrit)   
  - ib/ipoib: Fix race in the TX flow at CM mode. (Erez Shitrit)   
  - ib/ipoib: change list_del to list_del_init in the tx object. (Erez Shitrit)   
  - ib/ipoib: repalce list_del of the neigh->list with  list_del_init (Erez Shitrit)   
  - ib/ipoib: add detailed error message on  dev_queue_xmit (Erez Shitrit)   
  - ib/ipoib: adding completion to ipoib_mc (Erez Shitrit)   
  - ib/ipoib: start mcast_join process only on port active. (Erez Shitrit)   
  - ib/ipoib: Move QP to ERROR only when the QP is not at REST state (Erez Shitrit)   
  - ib_ipoib: always mark QP as NETIF_QP (Amir Vadai)   
  - ib/ipoib: fix ipoib lock is not freed issue (Shlomo Pongratz)   
  - ipoib: fix a deadlock at "carrier on task" (Yishai Hadasa)   
  - ib/ipoib: fix kernel panic when restarting with vma  flag (Shlomo Pongratz)   
  - ib/ipoib: force cleaning of ah's in driver unloading (Erez Shitrit)   
  - IB/ipoib: Remove datagram mode check for ipoib flow steering (Hadar Hen Zion)   
  - ipoib: adaptive moderation fine tuned (Yishai Hadas)   
  - ib/ipoib: fix access to stale cm rx context (Shlomo Pongratz)   
  - ib/ipoib: Change the comparison of tx_outstanding and the timeout function. (Yishai Hadas)   
  - ipoib/ib: don't release resources if the add_one failed (Dotan Barak)   
  - ib/ipoib: Fix removing call for update_pmtu from  spin-lock context. (Erez Shitrit)   
  - ipoib: start_xmit - RSS/TSS adaptations (Yishai Hadas)   
  - ib/ipoib: attach multicast address after RSS/TSS qp num change. (Shlomo Pongratz)   
  - ipoib: flow steering with TSS/RSS support (Hadar Hen Zion)   
  - ipoib: adaptive moderation adaptations to RSS (Yishai Hadas)   
  - ib/ipoib: Added adaptive moderation algorithm for  better latency. (Yishai Hadas)   
  - ipoib: arp snooping for gid cache sync. (Erez Shitrit)   
  - ipoib: add inline/blue flame support (Yishai Hadas)   
  - IB/IPoIB: fix cm tx path index and strenght locking (Shlomo Pongratz)   
  - ipoib: fixed NULL dereferencing in case of error flow (Dotan Barak)   
  - IB/ipoib: add support for ethtool set/get_channels (Shlomo Pongratz)   
  - IB/ipoib: Add RSS and TSS support for datagram mode (Shlomo Pongratz)   
  - IB/ipoib: Implement vectorization restructure as  pre-step for TSS/RSS (Shlomo Pongratz)   
  - eipoib: addon flags (Yishai Hadas)   
  - ib/ipoib: Add support in IPoIB instance (netdevice) functions as a VIF (Erez Shitrit)   
  - ib/ipoib: add support for clones / multiple childs  on the same partitions (Or Gerlitz)   
  - mlx4_core: Fix flow steering backword compatability to old FW's (Amir Vadai)   
  - RDMA/ucm: disable tuning the max listen backlog in debug kernel (Dotan Barak)   
  - mlx4_core: fix memtrack algoritm to identify non trackable mem allocation (Moshe Lazer)   
  - core, srp, mlx4_en: Adjustments to patch set which rebased to kernel 3.7 (Jack Morgenstein)   
  - mlx4_core, mlx4_ib, mlx4_en: match fs promisc enums to new PRM names (Hadar Hen Zion)   
  - RDMA/ib_core: add support for iWarp multicast acceleration over IB_QPT_RAW_PACKET QP type (Solves RM #100087) (Marcel Apfelbaum)   
  - mlx4_core, mlx4_ib: Adding flow steering ibdump support (Hadar Hen Zion)   
  - mlx4_core: Update minimum size for log_num_qp to 18 (Moshe Lazer)   
  - mlx4_en: fix race in join/leave multicast flow (Eugenia Emantayev)   
  - mlx4_ib: allow_loopback flag shouldn't set hardcoded (Hadar Hen Zion)   
  - mlx4_ib:Add ipoib qpn for IB unicast flow steering (Hadar Hen Zion)   
  - net/mlx4: remove BUG_ON in case of an error (Dotan Barak)   
  - mlx4_core: allow_loopback flag is corrupted (Amir Vadai)   
  - mlx4_ib : add module parameter that maps IB device index to device function number (Eli Cohen)   
  - sys_tune: enable sys_tune only if APM MODULE configured (Eugenia Emantayev)   
  - mlx4_en: add defines for supported link speed (Eugenia Emantayev)   
  - mlx4_en: fill truesize field in skb (Eugenia Emantayev)   
  - sys_tune: add sys_tune for cpu tuning for better performance (Eugenia Emantayev)   
  - net/mlx4: fix memory leaks in guest OS in case of error flow (Dotan Barak)   
  - mlx4_core, mlx4_ib: Have enough room in steering range for pkey interfaces (Amir Vadai)   
  - mlx4_ib: fix kernel crash when steering QPN's range is big (Amir Vadai)   
  - mlx4_en: remove all queues empty condition for loopback test (Eugenia Emantayev)   
  - mlx4_en: correct calculation of mtu size (Yishai Hadas)   
  - mlx4_en: merge adaptive moderation logic/values from 1.5.9 (Eugenia Emantayev)   
  - mlx4_ib: Adapt driver to changes in steering range API changes in firmware (Eitan Rabin)   
  - mlx4_en, mlx4_ib: make QP steering range hardcoded (Amir Vadai)   
  - net/mlx4: return bad error status to caller function in case of error (Dotan Barak)   
  - mlx4_en: avoid cache miss in GRO flow (Eugenia Emantayev)   
  - mlx4_en: no IP_ALIGN for scatter entries (Eugenia Emantayev)   
  - mlx4_en: selecting neighbour core for TX interrupts (Eugenia Emantayev)   
  - mlx4_en: NAPI on TX side (Eugenia Emantayev)   
  - mlx4_en: fix kernel panic when accessing uninitialized mutex (Eugenia Emantayev)   
  - IB/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - IB/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - IB/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - net/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - IB/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - IB/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - IB/mlx4: replace printk() with suitable logging function (Dotan Barak)   
  - net/mlx4: print return values in-case of called function failures (Dotan Barak)   
  - net/mlx4: add explicit message if user ask too few QPs (Dotan Barak)   
  - ib_core: fix contig overflow over 2GB (Yishai Hadas)   
  - mlx4/IB: disables user mode RAW QP VLAN stripping in the RX (Dotan Barak)   
  - mlx4_en: fix kernel panic caused by null pointer dereference (Eugenia Emantayev)   
  - ib/core: Remove annoying message. (Erez Shitrit)   
  - mlx4_core: Fixing leackage of SW multicast entries. (Yevgeny Petrilin)   
  - mlx4_en: set netif_carrier off when port stopped (Eugenia Emantayev)   
  - mlx4_en: Adding info when TX timeout ocures (Yevgeny Petrilin)   
  - mlx4_en: Fixing race when closing TX queue (Eugenia Emantayev)   
  - mlx4_en: fix timestamping for gro flow (Eugenia Emantayev)   
  - mlx4_en: fix a race between napi poll function and RX ring cleanup (Eugenia Emantayev)   
  - mlx4_en: Removed failed adding vlan and not found vlan prints. (Eugenia Emantayev)   
  - mlx4_en: move register_netdev() to the end of mlx4_en_init_netdev() (Eugenia Emantayev)   
  - mlx4_en: Fixed no traffic bug when disable port during promisc mode in a loop. (Aviad Yehezkel)   
  - mlx4_en: Do not disable vlan filter during promisc. (Eugenia Emantayev)   
  - mlx4_core: open 4 msi-x vectors for multifunction (Eugenia Emantayev)   
  - et/mlx4_core: make sure that err is non-zero in __mlx4_add_one error flow. (Jack Morgenstein)   
  - mlx4_core: check that number of QP per MCG entry was not exceeded when adding to the default MCG entry (Alexander Guller)   
  - mlx4_core: Expose mlx4_net_trans_rule_hw_ctrl structure fields (Hadar Hen Zion)   
  - net/mlx4_core: fix memory leak in error flow of flow_spec_to_net_rule() (Dotan Barak)   
  - net/mlx4_core: If memory allocation failed, return error to upper function (Dotan Barak)   
  - mlx4_ib: fix memory leak if QP creation failed (Dotan Barak)   
  - mlx4_ib: Fix IPoIB flow steering after broken by the TSS/RSS support commit (Hadar Hen Zion)   
  - mlx4_ib: Bug fix - allow attaching L2 and L3 rules using ibv_attach_flow (Hadar Hen Zion)   
  - net/mlx4_core: reduce the stack usage of the function mlx4_init_hca() (Dotan Barak)   
  - ib/core: add prints to the cm module. (Erez Shitrit)   
  - rds: fix error flow handling (Dotan Barak)   
  - mlx4/IB: add a message print when the logical link goes up/down (Dotan Barak)   
  - mlx4/ib: clean memory for EQs in case of error flow (Dotan Barak)   
  - mlx4/IB: remove proc entries in case of bad flow (Dotan Barak)   
  - net/mlx4_core: set used number of MTTs when using auto-detection (Dotan Barak)   
  - net/mlx4_core: the number of MTTs should consider log_mtts_per_seg (Dotan Barak)   
  - mlx4/IB: remove RD diagnostics counters (Dotan Barak)   
  - ib_core: check that DMA mapping was successful (Dotan Barak)   
  - mlx4_en: remove an unnecessary test if maxrate is NULL (Dotan Barak)   
  - ib: cmem rlimit support (Yishai Hadas)   
  - net/mlx4_core: limit to 4TB of memory registration (Yishai Hadas)   
  - net/mlx4_core: enable 8TB of memory registration (Yishai Hadas)   
  - net/mlx4_core: num mtt issues (Yishai Hadas)   
  - mlx4_en: do dump eth statistics under mutex (Eugenia Emantayev)   
  - net/mlx4_core: make sure that negative array index isn't used (Dotan Barak)   
  - mlx4_en: fixing the condition before releasing resources (Dotan Barak)   
  - IB/mlx4: fix compilation warning (Dotan Barak)   
  - IB/mlx4: Prevent from all of the users in the system to clear the diag counters (Dotan Barak)   
  - IB/core: Fix compilation warning in kernel 3.5+ (Dotan Barak)   
  - mlx4_ib: Partial fix for ipoib SRIOV (Hadar Hen Zion)   
  - mlx4_ib: prevent mixing enum mlx4_ib_qp_flags type with enum ib_qp_create_flags type (Saeed Mahameed)   
  - IB/core: add module parameter to allow a non-root user to open a RAW QP (Dotan Barak)   
  - mlx4_en: returning NETIF_F_GRO flag to dev->features (Yevgeny Petrilin)   
  - mlx4_ib: add blue flame support for kernel consumers (Eli Cohen)   
  - net/mlx4_core: add sanity check when creating bitmap structure (Dotan Barak)   
  - mlx4_core: supporting 64b counters (Vu Pham)   
  - ib_core: supporting 64b counters using PMA_COUNTERS_EXT mad (Vu Pham)   
  - mlx4_core: fix error flow in case mlx4_reset failed (Dotan Barak)   
  - net/mlx4_core: unmap clear register in case of error flow (Dotan Barak)   
  - mlx4_core: support suspend/resume events (Eli Cohen)   
  - srp: don't release resources if the add_one failed (Dotan Barak)   
  - mlx4_en: Fixed memory leak in case of error flow (Dotan Barak)   
  - ib_core: fix NULL pointer dereference (Dotan Barak)   
  - mlx4_en: queue stop/start counters per ring (Yevgeny Petrilin)   
  - mlx4_en: Using atomic counter to decide when queue is full. (Yevgeny Petrilin)   
  - IB/mlx4: Add support for RSS and TSS QP groups (Shlomo Pongratz)   
  - IB/core: Add RSS and TSS QP groups (Shlomo Pongratz)   
  - mlx4_en: Data path structures are allocated per numa node. (Yevgeny Petrilin)   
  - mlx4_core: ICM pages are allocated on device NUMA node (Yevgeny Petrilin)   
  - mlx4_en: Datapath resources allocated separately (Yevgeny Petrilin)   
  - mlx4_en: fix compilation error on 3.5 (Eugenia Emantayev)   
  - mlx4_en: add timestamp support (Eugenia Emantayev)   
  - mlx4_core: read hca frequency and map internal clock (Eugenia Emantayev)   
  - mlx4_core: add timestamp device capability (Eugenia Emantayev)   
  - mlx4_core: For flow steering unicast ipoib support added new flag to IB header check (Hadar Hen Zion)   
  - mlx4_ib: contig support for control objects (Yishai Hadas)   
  - mlx4: Setting Ethernet port even if interface is not being brought up (Yevgeny Petrilin)   
  - mlx4: Enable fast_drop option (Yevgeny Petrilin)   
  - mlx4_en: suppress page allocation failure warnings (Yevgeny Petrilin)   
  - mlx4_en: Allocation order is 0 on 32 bit systems to avoid allocation failures (Yevgeny Petrilin)   
  - mlx4: Allow high_rate_steer (A0 mode) (Yevgeny Petrilin)   
  - mlx4: Respond to operation request by FW. (Yevgeny Petrilin)   
  - mlx4_core: fix wrong comment about the reason of subtract one from the max_cqes (Dotan Barak)   
  - ib/core: change module_param to module_param_named call. (Erez Shitrit)   
  - ib_core: Use weak ordering for data registered memory (Eli Cohen)   
  - IB/core - Don't modify outgoing DR SMP if first part is LID routed (Ralph Campbell)   
  - mlx4_core: remove use_prio module parameter (Eugenia Emantayev)   
  - net/mlx4: adjust initial value of vl_cap in mlx4_SET_PORT (Or Gerlitz)   
  - mlx4_core: Error message on mtt allocation failure (Marcel Apfelbaum)   
  - mlx4_core: fail device init if num_vfs is negative. (Jack Morgenstein)   
  - IB/core: Control number of retries for SA to leave an MCG (Dotan Barak)   
  - mlx4: More mverbs support (Dotan Barak)   
  - mlx4: add warning prints in case of command timeouts (Dotan Barak)   
  - mlx4_core: Increased Command Timeout for NOP operation (Yevgeny Petrilin)   
  - mlx4: Disable BF on PPC (Dotan Barak)   
  - mlx4: reducing wait during SW reset for 500 msecs (Dotan Barak)   
  - mlx4_ib: check for FW version which properly supports resize_cq. (Dotan Barak)   
  - mlx4_ib: Do not enable blueflame sends if write combining is not available (Jack Morgenstein)   
  - IB/core: Fix create_qp issue relates to qp group type (Yishai Hadas)   
  - mlx4_core: log_num_mtt handling (Yishai Hadas)   
  - mlx4_core: adding 'set_4k_mtu' module parameter as an obsolete one (Yishai Hadas)   
  - mlx4_ib: Fix the SQ size of an RC QP to support masked atomic operation (Dotan Barak)   
  - {NET,IB}/mlx4: 64 byte CQE/EQE support (Or Gerlitz)   
  - ib_core: cmem handling to prevent redundant WARN (Yishai Hadas)   
  - ib_core: rlimit fix when cmem alloc has failed (Yishai Hadas)   
  - IB/mlx4_ib: use 8 bits in mlx4_ib_mmap for command ID instead of 3 (Yishai Hadas)   
  - IB: enable shared mr functionality (Yishai Hadas)   
  - IB/mlx4_ib: shared mr initial handling (Yishai Hadas)   
  - IB/core: infrastructure extensions to be used for shared mr functionality (Yishai Hadas)   
  - IB/mlx4_ib: 'proc' handling (Yishai Hadas)   
  - IB: reg_user_mr changes to include a new field named mr_id (Yishai Hadas)   
  - IB/core: ib_uverbs_reg_mr flow change (Yishai Hadas)   
  - ib_core: symmetric issues with user space. (Yishai Hadas)   
  - mlx4_ib: Use optimal numbers of MTT entries. (Yishai Hadas)   
  - mlx4_ib: implement get_unmapped_area (Yishai Hadas)   
  - ib_core: Exporting capability to control the alignment of the virtual address returned by mmap. (Yishai Hadas)   
  - mlx4_ib: Exporting to user space the contiguous allocation capability by mmap extension (Yishai Hadas)   
  - ib_core: Extending umem to support contiguous memory operations. (Yishai Hadas)   
  - mlx4: make firmware diagnostic counters available via sysfs (Dotan Barak)   
  - mlx4: enable discarding/passing multicast loopback packets by FW/HW. (Dotan Barak)   
  - mlx4_ib: set write-combining flag for userspace blueflame pages (Dotan Barak)   
  - mlx4_core: limit min profile numbers (Dotan Barak)   
  - mlx4_core: allow to use 0 in log_mtts_per_seg (Dotan Barak)   
  - mlx4_core: enable changing default max HCA resource limits. (Dotan Barak)   
  - cma: add module parameter to the response timeout (Arlin Davis)   
  - mlx4: Add mverbs support (Dotan Barak)   
  - mlx4_core: replace sscanf() with simple_strtol() (Dotan Barak)   
  - mlx4: increase the command timeout to 60 seconds (Dotan Barak)   
  - mlx4_core, mlx4_ib, cma, ipoib: Add IB UC flow steering for datagram QP's. (Amir Vadai)   
  - mlx4_ib: add support to flow steering attach with rdmacm applications. (Hadar Hen Zion)   
  - rdma_cm: Implement rdma_get_l2 (Nir Muchtar)   
  - ib_uverbs: Export ib_attach_flow and ib_detach_flow to userspace. (Nir Muchtar)   
  - mlx4_ib: Add support for ib_attach_flow and ib_detach_flow. (Nir Muchtar)   
  - ib_core: Implement ib_attach_flow ib_detach_flow (Nir Muchtar)   
  - mlx4_core: enable RoCE under SRIOV (Jack Morgenstein)   
  - mlx4_core: Adjust update-gids task for RoCE running under SRIOV (Jack Morgenstein)   
  - mlx4_ib: In sysfs, do not allow changing the paravirtualization mapping for pkeys (Jack Morgenstein)   
  - {IB,ETH}/mlx4: Adjust QP1 multiplexing and QP creation for RoCE/SRIOV (Jack Morgenstein)   
  - en/mlx4_core: For RoCE, allow slaves to set the GID entry at that slave's index (Jack Morgenstein)   
  - {IB,ETH}/mlx4: Add ref counting to port MAC table for RoCE (Jack Morgenstein)   
  - mlx4_core: Add mechanism for non trackable mem free (Moshe Lazer)   
  - memtrack: fix get_page/put_page tracking (Jack Morgenstein)   
  - Added memtrack (Vladimir Sokolovsky)   
  - Revert "mlx4_en: fix allocation of CPU affinity reverse-map" (Ajaykumar Hotchandani)   
  - Revert "IPoIB: Call skb_dst_drop() once skb is enqueued for sending" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Increase block layer timeout" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Eliminate state SRP_TARGET_CONNECTING" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Keep processing commands during host removal" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Simplify SCSI error handling" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Introduce srp_handle_qp_err()" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Process all error completions" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Introduce the helper function srp_remove_target()" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Suppress superfluous error messages" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Eliminate state SRP_TARGET_DEAD" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: destroy and recreate QP and CQs when reconnecting" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: send disconnect request without waiting for CM timewait exit" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Allow SRP disconnect through sysfs" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Track connection state properly" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Avoid sending a task management function needlessly" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Avoid endless SCSI error handling loop" (Ajaykumar Hotchandani)   
  - Revert "IB/srp: Fail I/O requests if the transport is offline" (Ajaykumar Hotchandani)   
  - Revert "rds: limit the size allocated by rds_message_alloc()" (Ajaykumar Hotchandani)   
  - Revert "net: rds: use this_cpu_* per-cpu helper" (Ajaykumar Hotchandani)   
  - Revert "IB/rds: Correct ib_api use with gs_dma_address/sg_dma_len" (Ajaykumar Hotchandani)   
  - Revert "IB/rds: suppress incompatible protocol when version is known" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: remove __dev* attributes" (Ajaykumar Hotchandani)   
  - Revert "mlx4: change TX coalescing defaults" (Ajaykumar Hotchandani)   
  - Revert "IPoIB: Fix send lockup due to missed TX completion" (Ajaykumar Hotchandani)   
  - Revert "mlx4: 64-byte CQE/EQE support" (Ajaykumar Hotchandani)   
  - Revert "mlx4_en: Remove remnants of LRO support" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Can set maxrate only for TC0" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Set number of rx/tx channels using ethtool" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Use generic etherdevice.h functions." (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Add support for destination MAC in steering rules" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: Add QPN enforcement for flow steering rules set by VFs" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: Fix error flow in the flow steering wrapper" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: Adjustments to Flow Steering activation logic for SR-IOV" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: Allow choosing flow steering mode" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_core: Set number of msix vectors under SRIOV mode to firmware defaults" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: Fix advertisement of wrong PF context behaviour" (Ajaykumar Hotchandani)   
  - Revert "mlx4_en: fix allocation of device tx_cq" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Initialize RFS filters lock and list in init_netdev" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Disable RFS when running in SRIOV mode" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Fix bridged vSwitch configuration for non SRIOV mode" (Ajaykumar Hotchandani)   
  - Revert "net/mlx4_en: Fix TX moderation info loss after set_ringparam is called" (Ajaykumar Hotchandani)   
  - Revert "mlx4_core: Fix potential deadlock in mlx4_eq_int()" (Ajaykumar Hotchandani)   
  - Revert "IPoIB: Fix crash due to skb double destruct" (Ajaykumar Hotchandani)   
  - Revert "IB/mlx4: Fix spinlock order to avoid lockdep warnings" (Ajaykumar Hotchandani)   
  - Revert "RDMA/cm: Change return value from find_gid_port()" (Ajaykumar Hotchandani)


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [3.8.13-9.el6uek]
changelog:
  - dtrace: only do kallsyms build on x86_64 (Jerry Snitselaar) [Orabug: 17308256]  
  - kabi: Update Module.kabi_x86_64 (Jerry Snitselaar) [Orabug: 17302224]  
  - Update lpfc version for 8.3.7.26.2p driver release (Gairy Grannum)   
  - Enable BlockGuard Support (Vaios Papadimitriou)   
  - Removed obsolete fcp_eq_count and fcp_wq_count driver attributes (James Smart)   
  - Update copyrights for 8.3.41 modifications (James Smart)   
  - Removed obsolete fcp_eq_count and fcp_wq_count driver attributes (James Smart)   
  - Add first burst support to driver (James Smart)   
  - Fixed the format of some log message fields (James Smart)   
  - Add first burst support to driver (James Smart)   
  - Fixed not able to perform PCI function reset when board was not in online mode (James Smart)   
  - Fixed failure in setting SLI3 board mode (James Smart)   
  - Fixed SLI3 failing FCP write on check-condition no-sense with residual zero (James Smart)   
  - Fixed support for 128 byte WQEs (James Smart)   
  - Ensure driver properly zeros unused fields in SLI4 mailbox commands (James Smart)   
  - Fixed max value of lpfc_lun_queue_depth (James Smart)   
  - Fixed Receive Queue varied frame size handling (James Smart)   
  - Fix mailbox byteswap issue on PPC (James Smart)   
  - Fixed freeing of iocb when internal loopback times out (James Smart)   
  - lpfc 8.3.40: Update Copyrights to 2013 for 8.3.38, 8.3.39, and 8.3.40 modifications (James Smart)   
  - lpfc 8.3.40: Fixed a race condition between SLI host and port failed FCF rediscovery (James Smart)   
  - lpfc 8.3.40: Fixed issue mailbox wait routine failed to issue dump memory mbox command (James Smart)   
  - treewide: Fix typos in kernel messages (Masanari Iida)   
  - lpfc 8.3.40: Fixed system panic due to unsafe walking and deleting linked list (James Smart)   
  - lpfc 8.3.40: Fixed FCoE connection list vlan identifier and add FCF list debug (James Smart)   
  - lpfc 8.3.40: Clarified the behavior of the lpfc_max_luns module parameter (James Smart)   
  - lpfc 8.3.40: Fix to allow OCM to report FEC status (James Smart)   
  - lpfc 8.3.40: Fixed a missing return code in a logging message (James Smart)   
  - lpfc 8.3.40: Fixed some logging message fields (James Smart)   
  - lpfc 8.3.40: Fixed list corruption when lpfc_drain_tx runs (James Smart)   
  - lpfc 8.3.40: Fix starting reference tag when calculating BG error (James Smart)   
  - lpfc 8.3.40: Fix inconsistent list removal causes crash (James Smart)   
  - lpfc 8.3.40: Fixed system panic during handling unsolicited receive buffer error condition (James Smart)   
  - lpfc 8.3.40: Fix BlockGuard error checking (James Smart)   
  - lpfc 8.3.40: Fixed crash during FCoE failover testing. (James Smart)   
  - lpfc 8.3.40: Fix lpfc_used_cpu to be more dynamic (James Smart)   
  - lpfc 8.3.39: Fixed driver handling of CLEAR_LA with NPIV enabled causing SID=0 frames out (James Smart)   
  - scsi: fix lpfc build when wmb() is defined as mb() (Randy Dunlap)   
  - lpfc 8.3.39: Reduced tmo value set to FLOGI WQE for quick recovery from FLOGI sequence timeout (James Smart)   
  - lpfc 8.3.39: Add log message when completes with clean address bit set to zero (James Smart)   
  - lpfc 8.3.39: Fixed driver vector mapping to CPU affinity (James Smart)   
  - lpfc 8.3.39: Fixed driver vector mapping to CPU affinity (James Smart)   
  - lpfc 8.3.39: Fixed iocb flags not being reset for scsi commands (James Smart)   
  - lpfc 8.3.39: Fixed system panic during EEH recovery due to midlayer acting on outstanding I/O (James Smart)   
  - lpfc 8.3.39: Fixed system panic during EEH recovery due to midlayer acting on outstanding I/O (James Smart)   
  - lpfc 8.3.39: Fixed not returning FAILED status when SCSI invoking host reset handler failed (James Smart)   
  - lpfc 8.3.39: Fixed bad book keeping in posting els sgls to port (James Smart)   
  - lpfc 8.3.39: Fixed deadlock between hbalock and nlp_lock use (James Smart)   
  - [SCSI] lpfc 8.3.39: Fixed BlockGuard to take advantage of rdprotect/wrprotect info when available (James Smart)   
  - lpfc 8.3.39: Reduced spinlock contention on SCSI buffer list (James Smart)   
  - lpfc 8.3.39: Fixed crash when processing bsg's sg list with high memory pages (James Smart)   
  - lpfc 8.3.39: Remove lpfc_fcp_look_ahead module parameter (James Smart)   
  - lpfc 8.3.39: Fix driver issues with SCSI Host reset (James Smart)   
  - lpfc 8.3.39: Doorbell formation information logged in dual-chute mode WQ and RQ setup (James Smart)   
  - lpfc 8.3.39: Fix driver issues with large s/g lists for BlockGuard (James Smart)   
  - lpfc 8.3.39: Fix driver issues with large lpfc_sg_seg_cnt values (James Smart)   
  - lpfc 8.3.39: Fixed pt2pt and loop discovery problems on topology changes. (James Smart)   
  - lpfc 8.3.39: Remove driver dependency on HZ (James Smart)   
  - lpfc 8.3.38: Fixed async FCF modified event to in-use FCF failure to trigger recovery (James Smart)   
  - lpfc 8.3.39: Fixed BlockGuard error reporting (James Smart)   
  - lpfc 8.3.39: Fixed VPI allocation issues after firmware dump is performed (James Smart)   
  - lpfc 8.3.38: Fixed potential mis-interpretation of READ_TOPOLOGY reserved fields (James Smart)   
  - lpfc 8.3.38: Fix default value for lpfc_enable_rrq. (James Smart)   
  - lpfc 8.3.38: Fixed circular locking dependency and inconsistent lock state issues (James Smart)   
  - lpfc 8.3.38: Fixed PT2PT bring up problem for FC SLI4. (James Smart)   
  - lpfc 8.3.38: Fixed OXID reuse issue. (James Smart)   
  - lpfc 8.3.38: Fixed async FCF modified event to in-use FCF failure to trigger recovery (James Smart)   
  - lpfc 8.3.38: Fixed deadlock condition in FCF round robin handling (James Smart)   
  - scsilpfc 8.3.38: Fixed bsg timeout handling issues that would result in crashes (James Smart)   
  - lpfc 8.3.38: Fixed NMI watch dog panic's when resetting the hba. (James Smart)   
  - lpfc 8.3.38: Fixed degraded performance after cable pulls (James Smart)   
  - lpfc 8.3.37: Provide support for change_queue_type (James Smart)   
  - lpfc: fix potential NULL pointer dereference in lpfc_sli4_rq_put() (Wei Yongjun)   
  - lpfc 8.3.37: Fixed infinite loop in lpfc_sli4_fcf_rr_next_index_get. (James Smart)   
  - lpfc 8.3.37: Fixed crash due to SLI Port invalid resource count (James Smart)   
  - lpfc 8.3.37: Provide support for FCoE protocol dual-chute (ULP) operation (James Smart)   
  - lpfc 8.3.37: Fixed stale ndlp state when the node is marked for deferred removal. (James Smart)   
  - lpfc 8.3.37: Fix potential memory corruption bug (James Smart)   
  - lpfc 8.3.37: Fixed no-context ABTS failed with BA_RJT (James Smart)   
  - lpfc 8.3.37: Removed use of NOP mailboxes for interrupt verification (James Smart)   
  - lpfc 8.3.37: Fixed exhausted retry for plogi to nameserver. (James Smart)   
  - lpfc 8.3.37: Fixed ELS_REC received on the unsolicited receive queue (James Smart)   
  - mptfusion: update to LSI version 4.28.20.03 (Jerry Snitselaar) [Orabug: 17307187]  
  - turn on kabi check for x86 (Maxim Uvarov)   
  - config: CONFIG_X86_INTERNODE_CACHE_SHIFT=7 (Maxim Uvarov)   
  - kabi_whitelist_x86_64 (Maxim Uvarov)   
  - Ensure memory allocation results are checked throughout the code. (Kris Van Hees)   
  - net: sctp: fix NULL pointer dereference in socket destruction (Daniel Borkmann) [Orabug: 17071059]  
  - mm: leave pmd_huge_pte when CONFIG_TRANSPARENT_HUGEPAGE disabled (Jerry Snitselaar) [Orabug: 17301856]  
  - sparc64 - read_persistent_clock (bob picco)   
  - ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data (Hannes Frederic Sowa) [Orabug: 17296551] {CVE-2013-4162} 
  - ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size (Hannes Frederic Sowa) [Orabug: 17296420] {CVE-2013-4163} 
  - dm mpath: fix ioctl deadlock when no paths (Hannes Reinecke)   
  - dm mpath: enable WRITE SAME support (Mike Snitzer)   
  - dm table: fix write same support (Mike Snitzer)   
  - dm: rename request variables to bios (Alasdair G Kergon)   
  - dm: clean up clone_bio (Alasdair G Kergon)   
  - NVMe: Add MSI support (Ramachandra Rao Gajula)   
  - NVMe: Use dma_set_mask() correctly (Matthew Wilcox)   
  - Return the result from user admin command IOCTL even in case of failure (Chayan Biswas)   
  - NVMe: Do not cancel command multiple times (Keith Busch)   
  - NVMe: fix error return code in nvme_submit_bio_queue() (Wei Yongjun)   
  - NVMe: check for integer overflow in nvme_map_user_pages() (Dan Carpenter)   
  - NVMe: Fix a signedness bug in nvme_trans_modesel_get_mp (Vishal Verma)   
  - NVMe: Remove redundant version.h header include (Sachin Kamat)   
  - NVMe: Use user defined admin ioctl timeout (Keith Busch)   
  - NVMe: Simplify Firmware Activate code slightly (Matthew Wilcox)   
  - NVMe: Only clear the enable bit when disabling controller (Matthew Wilcox)   
  - NVMe: Wait for device to acknowledge shutdown (Matthew Wilcox)   
  - NVMe: Schedule timeout for sync commands (Keith Busch)   
  - NVMe: Meta-data support in NVME_IOCTL_SUBMIT_IO (Keith Busch)   
  - NVMe: Device specific stripe size handling (Keith Busch)   
  - NVMe: Split non-mergeable bio requests (Keith Busch)   
  - NVMe: Remove dead code in nvme_dev_add (Keith Busch)   
  - NVMe: Check for NULL memory in nvme_dev_add (Keith Busch)   
  - NVMe: Fix error clean-up on nvme_alloc_queue (Keith Busch)   
  - NVMe: Free admin queue on request_irq error (Keith Busch)   
  - NVMe: Add scsi unmap to SG_IO (Keith Busch)   
  - NVMe: queue usage fixes in nvme-scsi (Keith Busch)   
  - NVMe: Set TASK_INTERRUPTIBLE before processing queues (Arjan van de Ven)   
  - NVMe: Add a character device for each nvme device (Keith Busch)   
  - NVMe: Fix endian-related problems in user I/O submission path (Matthew Wilcox)   
  - NVMe: Fix I/O cancellation status on big-endian machines (Matthew Wilcox)   
  - NVMe: Fix sparse warnings in scsi emulation (Vishal Verma)   
  - NVMe: Don't fail initialisation unnecessarily (Matthew Wilcox)   
  - NVMe: Abstract out sector to block number conversion (Matthew Wilcox)   
  - NVMe: Use round_jiffies_relative() for the periodic, once-per-second timer (Arjan van de Ven)   
  - NVMe: Add nvme-scsi.c (Vishal Verma)   
  - NVMe: Add definitions for format command (Vishal Verma)   
  - NVMe: Move structures & definitions to header file (Vishal Verma)   
  - NVMe: Rename nvme.c to nvme-core.c (Vishal Verma)   
  - NVMe: Add discard support for capable devices (Keith Busch)   
  - NVMe: Add namespaces with no LBA range feature (Keith Busch)   
  - NVMe: Initialize iod nents to 0 (Keith Busch)   
  - NVMe: Define SMART log (Keith Busch)   
  - NVMe: Add result to nvme_get_features (Keith Busch)   
  - NVMe: Set result from user admin command (Keith Busch)   
  - NVMe: End queued bio requests when freeing queue (Keith Busch)   
  - NVMe: Free cmdid on nvme_submit_bio error (Keith Busch)   
  - oracleasm: Compat changes for 3.8 (Martin K. Petersen)   
  - oracleasm: Introduce module parameter for block size selection (Martin K. Petersen) [Orabug: 15924773]  
  - oracleasm: Data integrity support (Martin K. Petersen)   
  - oracleasm: Fix two merge errors (Martin K. Petersen)   
  - Oracle ASM Kernel Driver (Martin K. Petersen)   
  - megaraid_sas: Big endian support (Martin K. Petersen)   
  - megaraid: fix BUG_ON() from incorrect use of delayed work (Xiaotian Feng)   
  - aerdrv: Enhanced AER logging (Lance Ortiz) [Orabug: 17293976]  
  - aerdrv: Trace Event for PCI Express Advanced Error Reporting (Lance Ortiz) [Orabug: 17293976]  
  - [SCSI] scsi_dh_alua: Add module parameter to allow failover to non preferred path without STPG (Stewart, Sean)   
  - [SCSI] Don't attempt to send extended INQUIRY command if skip_vpd_pages is set (Martin K. Petersen)   
  - [SCSI] sd: Update WRITE SAME heuristics (Martin K. Petersen)   
  - [SCSI] 3w-xxxx: Create sense buffer for unsupported commands (Martin K. Petersen)   
  - [SCSI] Workaround for disks that report bad optimal transfer length (Martin K. Petersen)   
  - [SCSI] Allow error handling timeout to be specified (Martin K. Petersen)   
  - [SCSI] scsi_dh_alua: fix stpg sense handling (Mike Christie)   
  - [SCSI] sd_dif: problem with verify of type 1 protection information (PI) (Jeremy Higdon)   
  - [SCSI] sd: avoid deadlocks when running under multipath (Hannes Reinecke)   
  - x86/mce: Rework cmci_rediscover() to play well with CPU hotplug (Srivatsa S. Bhat) [Orabug: 17293976]  
  - ACPI / APEI: fix error return code in ghes_probe() (Wei Yongjun) [Orabug: 17293976]  
  - hwmon: (adm1021) Strengthen chip detection for ADM1021, LM84 and MAX1617 (Guenter Roeck) [Orabug: 17293976]  
  - fnic: update from mainline 1.5.0.2 to cisco 1.5.0.45 (Jerry Snitselaar) [Orabug: 17293525]  
  - cgroup: fix bogus kernel warnings when cgroup_create() failed (Li Zefan) [Orabug: 16448051]  
  - cgroup: remove a NULL check in cgroup_exit() (Li Zefan) [Orabug: 16448051]  
  - cgroup: fix cgroup_path() vs rename() race (Li Zefan) [Orabug: 16448051]  
  - cgroup: fix cgroup_rmdir() vs close(eventfd) race (Li Zefan) [Orabug: 16448051]  
  - cgroup: fail if monitored file and event_control are in different cgroup (Li Zefan) [Orabug: 16448051]  
  - cgroup: fix a subtle bug in descendant pre-order walk (Tejun Heo) [Orabug: 16448051]  
  - memcg: do not create memsw files if swap accounting is disabled (Michal Hocko) [Orabug: 16448051]  
  - memcg: initialize kmem-cache destroying work earlier (Konstantin Khlebnikov) [Orabug: 16448051]  
  - mm: memcg: remove incorrect VM_BUG_ON for swap cache pages in uncharge (Johannes Weiner) [Orabug: 16448051]  
  - memcg: fix memcg_cache_name() to use cgroup_name() (Michal Hocko) [Orabug: 16448051]  
  - blkcg: fix "scheduling while atomic" in blk_queue_bypass_start (Jun'ichi Nomura) [Orabug: 16448051]  
  - device_cgroup: don't grab mutex in rcu callback (Jerry Snitselaar) [Orabug: 16448051]  
  - l2tp: prevent tunnel creation on netns mismatch (Tom Parkin) [Orabug: 16448051]  
  - netns: fdb: allow unprivileged users to add/del fdb entries (Gao feng) [Orabug: 16448051]  
  - netns: ebtable: allow unprivileged users to operate ebtables (Gao feng) [Orabug: 16448051]  
  - netns: bridge: allow unprivileged users add/delete mdb entry (Gao feng) [Orabug: 16448051]  
  - netns: bond: allow unprivileged users to control bond device (Gao feng) [Orabug: 16448051]  
  - netfilter: nf_ct_reasm: fix per-netns sysctl initialization (Michal Kubeček) [Orabug: 16448051]  
  - config: enable CONFIG_XFS_WARN for debug builds (Jerry Snitselaar) [Orabug: 17271899]  
  - xfs: introduce CONFIG_XFS_WARN (Dave Chinner) [Orabug: 17271899]  
  - xfs: recheck buffer pinned status after push trylock failure (Brian Foster) [Orabug: 17271899]  
  - xfs: remove log force from xfs_buf_trylock() (Brian Foster) [Orabug: 17271899]  
  - xfs: ensure we capture IO errors correctly (Dave Chinner) [Orabug: 17271899]  
  - xfs: fallback to vmalloc for large buffers in xfs_attrlist_by_handle (Eric Sandeen) [Orabug: 17271899]  
  - xfs: fallback to vmalloc for large buffers in xfs_compat_attrlist_by_handle (Eric Sandeen) [Orabug: 17271899]  
  - ext4: fix corruption when online resizing a fs with 1K block size (Maarten ter Huurne) [Orabug: 17279036]  
  - ext4: fix data integrity for ext4_sync_fs (Jerry Snitselaar) [Orabug: 17279036]  
  - ext4: fix overflow when counting used blocks on 32-bit architectures (Jan Kara) [Orabug: 17279036]  
  - ext4: fix data offset overflow in ext4_xattr_fiemap() on 32-bit archs (Jan Kara) [Orabug: 17279036]  
  - ext4: fix overflows in SEEK_HOLE, SEEK_DATA implementations (Jerry Snitselaar) [Orabug: 17279036]  
  - ext4: fix data offset overflow on 32-bit archs in ext4_inline_data_fiemap() (Jan Kara) [Orabug: 17279036]  
  - ext4: fix type-widening bug in inode table readahead code (Theodore Ts'o) [Orabug: 17279036]  
  - ext4: mext_insert_extents should update extent block checksum (Darrick J. Wong) [Orabug: 17279036]  
  - ext4: fix deadlock with quota feature (Jan Kara) [Orabug: 17279036]  
  - qlcnic: update from 5.0.30 to 5.2.43 (Jerry Snitselaar) [Orabug: 17267160]  
  - Remove pre-alpha features for release. (Kris Van Hees) [Orabug: 17076008]  
  - CONFIG_UPROBES is needed by CONFIG_DT_FASTTRAP, not CONFIG_DTRACE. (Nick Alcock) [Orabug: 17076008]  
  - CONFIG_DTRACE should depend on CONFIG_UPROBES. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: Include all sources regardless of arch. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: Changes for UEK merge. (Nick Alcock) [Orabug: 17076008]  
  - Fix loss of error code from waitid() when info is provided. (Nick Alcock) [Orabug: 17076008]  
  - Make old_rsp available to kernel modules. (Kris Van Hees) [Orabug: 17076008]  
  - waitfd selftest: dike out some dead code. (Nick Alcock) [Orabug: 17076008]  
  - Introduce poll_wait_fixed(), and use it in waitfds. (Nick Alcock) [Orabug: 17076008]  
  - No longer reference 'ctf.ko.unsigned' in CTF debuginfo stripping machinery. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: Do not sign modules, pro tem. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: Fix the -g1 debuginfo hack. (Nick Alcock) [Orabug: 17076008]  
  - Add waitfd(), and a testcase for it. (Nick Alcock) [Orabug: 17076008]  
  - Ensure that arg6 through arg9 get retrieved correctly for USDT probes. (Kris Van Hees) [Orabug: 17076008]  
  - Finish the implementation of is-enabled USDT probes. (Kris Van Hees) [Orabug: 17076008]  
  - Fixes for tracepoint cleanup. (Kris Van Hees) [Orabug: 17076008]  
  - Remove unnecessary debugging output. (Kris Van Hees) [Orabug: 17076008]  
  - Update syscall tracing in view of Linux 3.8 changes. (Kris Van Hees) [Orabug: 17076008]  
  - USDT implementation (phase 2). (Kris Van Hees) [Orabug: 17076008]  
  - Revamp and split up DTrace headers.  Add ioctl() debugging machinery. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: blacklist certain structure members entirely. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Repair faulty indentation. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Split the absolute-file-name caching machinery out of type_id(). (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: sentinelize str_appendn(). (Nick Alcock) [Orabug: 17076008]  
  - ptrace: Add PTRACE_GETMAPFD. (Nick Alcock) [Orabug: 17076008]  
  - Update execve() syscall probe support. (Kris Van Hees) [Orabug: 17076008]  
  - Add support for an SDT probe getting called from multiple functions. (Kris Van Hees) [Orabug: 17076008]  
  - Move SDT call location for surrender probe. (Kris Van Hees) [Orabug: 17076008]  
  - USDT implementation (Phase 1). (Kris Van Hees) [Orabug: 17076008]  
  - Remove incorrect FBT support code. (Kris Van Hees) [Orabug: 17076008]  
  - Move psinfo to its own header file. (Kris Van Hees) [Orabug: 17076008]  
  - Update copyright statements. (Kris Van Hees) [Orabug: 17076008]  
  - dwarf2ctf: Update the shared CTF file right after initialization. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Improve debugging and indentation fixes. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf doc revisions. (Nick Alcock) [Orabug: 17076008]  
  - Internal performance measurement support code. (Kris Van Hees) [Orabug: 17076008]  
  - Disable KVM steal-time accounting when DTrace is in use. (Nick Alcock) [Orabug: 17076008]  
  - Cosmetic improvements to CTF linking. (Nick Alcock) [Orabug: 17076008]  
  - Remove a few obsolete probes. (Kris Van Hees) [Orabug: 17076008]  
  - Cater for changes in the way the kernel is linked. (Kris Van Hees) [Orabug: 17076008]  
  - Miscellaneous 3.6 porting work. (Kris Van Hees) [Orabug: 17076008]  
  - Fix up rq.dtrace_cpu_info member. (Kris Van Hees) [Orabug: 17076008]  
  - gitignore: Ignore objects.builtin and dwarf2ctf. (Nick Alcock) [Orabug: 17076008]  
  - Fix outright typos in the 3.6 forward-port. (Nick Alcock) [Orabug: 17076008]  
  - Remove obsolete static probe documentation. (Kris Van Hees) [Orabug: 17076008]  
  - DTrace-independent CTF. (Nick Alcock) [Orabug: 17076008]  
  - Do not build in CTF data for no-longer-built-in modules. (Nick Alcock) [Orabug: 17076008]  
  - Document dwarf2ctf. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Extend the deduplication blacklist. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Improve error message on internal deduplication error. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Note a future enhancement. (Nick Alcock) [Orabug: 17076008]  
  - Document parameters to die_to_ctf(). (Nick Alcock) [Orabug: 17076008]  
  - Do not construct objects.builtin if CTF is not being built. (Nick Alcock) [Orabug: 17076008]  
  - Do not build dwarf2ctf nor attempt to use it if !CONFIG_DTRACE. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: Rename the DTrace kernel to kernel-uek-dtrace-. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: strip kernel modules using objcopy, not eu-strip (Nick Alcock) [Orabug: 17076008]  
  - SPEC: do not strip non-debugging sections from kernel modules. (Nick Alcock) [Orabug: 17076008]  
  - SPEC: build firmware. (Nick Alcock) [Orabug: 17076008]  
  - Additional action support (and bug fixes). (Kris Van Hees) [Orabug: 17076008]  
  - Get rid of debugging code. (Kris Van Hees) [Orabug: 17076008]  
  - Add psinfo/cpuinfo OS level support. (Kris Van Hees) [Orabug: 17076008]  
  - Removed debugging output (1 line). (Kris Van Hees) [Orabug: 17076008]  
  - Change the DTrace startup handling (at boot time) for SDT. (Kris Van Hees) [Orabug: 17076008]  
  - Cleanup (and adding) of SDT probe points. (Kris Van Hees) [Orabug: 17076008]  
  - Write the CTF files for standalone modules to a subdir of the module directory. (Nick Alcock) [Orabug: 17076008]  
  - Adapt to the libdtrace-ctf devel package split. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: unnamed structure/union support. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: recurse_ctf() -> die_to_ctf(). (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: fix the signed-modules case. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: correctly propagate IDs for array types. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: fix off-by-one in emitted array bounds. (Nick Alcock) [Orabug: 17076008]  
  - Fix tiny comment typo. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: blacklist certain modules from deduplication. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: include enumeration types inside functions. (Nick Alcock) [Orabug: 17076008]  
  - New IO provider probes: start, done, wait-start, wait-done New sched provides probes: enqueue, dequeue, wakeup, preempt, remain-cpu, change-pri, surrender (Note that the preempt probe currently passes a debugging argument that will be removed in the future to match the argument-less version in the documentation.) (Kris Van Hees) [Orabug: 17076008]  
  - Fix to handle multiple SDT-based probes in a single function. (Kris Van Hees) [Orabug: 17076008]  
  - DTrace: require assembler symbol stripping and debug info. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: Fix array dimensions. (Nick Alcock) [Orabug: 17076008]  
  - Change the name of the CTF section in kernel modules. (Nick Alcock) [Orabug: 17076008]  
  - Fix a bug in the SDT probe location generator, where it could accidentally add the address of a non-function identifier to the SDT list (e.g. watchdog occurs both in the uninitialised data section (BSS) and the text section). (Kris Van Hees) [Orabug: 17076008]  
  - dwarf2ctf: major duplicate detection fixes. (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: optimize type_id() and fix array dimension lookup. (Nick Alcock) [Orabug: 17076008]  
  - Changed the logic for determining SDT probe point locations because the previous version did not account for probes that might be placed in non-.text segments.  New code also avoids extra passes that were not necessary. (Kris Van Hees) [Orabug: 17076008]  
  - dwarf2ctf: store away the types and names of non-static global variables. (Nick Alcock) [Orabug: 17076008]  
  - Set the name of the parent of child modules to "dtrace_ctf". (Nick Alcock) [Orabug: 17076008]  
  - dwarf2ctf: clarify comments, improve a type name. (Nick Alcock) [Orabug: 17076008]  
  - Force dtrace_ctf.ko to be loaded whenever dtrace.ko is. (Nick Alcock) [Orabug: 17076008]  
  - Generate CTF information for the kernel. (Nick Alcock) [Orabug: 17076008]  
  - Drop rogue debugging statements. (Nick Alcock) [Orabug: 17076008]  
  - Provide symbol sizes in /proc/kallmodsyms. (Nick Alcock) [Orabug: 17076008]  
  - Add a dummy dtrace_ctf.ko module. (Nick Alcock) [Orabug: 17076008]  
  - Fix /proc/kallmodsyms population bugs. (Nick Alcock) [Orabug: 17076008]  
  - kallsyms: work in a clean tree, and a non-modular tree. (Nick Alcock) [Orabug: 17076008]  
  - kallsyms: work with older glibc. (Nick Alcock) [Orabug: 17076008]  
  - Don't depend on dtrace-user. (Nick Alcock) [Orabug: 17076008]  
  - Add /proc/kallmodsyms. (Nick Alcock) [Orabug: 17076008]  
  - - sched-tick SDT probe. - FBT probe point discovery and probe creation. - Moving code around for the kernel pseudo-module handling since it gets used   by both the SDT code and the FBT code. (Kris Van Hees) [Orabug: 17076008]  
  - Delete an obsolete release script. (Nick Alcock) [Orabug: 17076008]  
  - Changed from using mutex_is_locked() to a new mutex_owned(), in support of the Solaris MUTEX_HELD() macro.  The former was merely testing whether the mutex was locked, whereas the real test needed here is whether the mutex is held by the current thread. (Kris Van Hees) [Orabug: 17076008]  
  - Fix signed division and modulo operations in DIF. Ensure that SDT probe points are patched with a NOP sequence at boot time. Remove debugging output during SDT registration. (Kris Van Hees) [Orabug: 17076008]  
  - Make sure the insn length is initialized in the right branch of the die notifier. (Nick Alcock) [Orabug: 17076008]  
  - Ensure that the trap handler is regisstered only once. Register with first use, (Kris Van Hees) [Orabug: 17076008]  
  - Ensure that the die notifier hook is installed whenever DTrace is enabled, since page fault and general protection fault handling depends on it, and that is needed for safe memory access support in DTrace. (Kris Van Hees) [Orabug: 17076008]  
  - Adding missing files for PF/GPF support. (Kris Van Hees) [Orabug: 17076008]  
  - Support for page fault and general protection fault detection for DTrace, to ensure that DTrace memory access faults are non-fatal. (Kris Van Hees) [Orabug: 17076008]  
  - Fix incorrect probe point name. (Kris Van Hees) [Orabug: 17076008]  
  - Added lwp-exit and lwp-create SDT probe points. Change the DRELOC tag in make output to DT-SDT. (Kris Van Hees) [Orabug: 17076008]  
  - SDT implementation (core kernel support for providing a list of static probe points for the kernel pseudo-module, dtrace SDT meta-provider support, ...). Also, new script (dtrace_sdt.sh) to extract locations of SDT probe points in the core kernel. (Kris Van Hees) [Orabug: 17076008]  
  - Enable processing the SDT probe point info at boot time (before SMP is actually enabled), if DTrace SDT support has been enabled (built-in or as module).  For now, provide some verbose info on the probe points getting resolved. (Kris Van Hees) [Orabug: 17076008]  
  - Fix resolving addresses of relocation records for SDT probe points.  The addresses were being calculated based on the wrong starting point (_stext whereas it ought to be _text), and the base was not taken into account. Fixed the writing of NOPs in the location of the probe point calls, since the existing case was causing kernel paging faults.  Made the add_nops() function in alternative.c non-static so it can be used in sdt_register. Use add_nops() to select the most appropriate NOP sequence for replacing the probe point call, and write the NOPs using text_poke(). (Kris Van Hees) [Orabug: 17076008]  
  - Fixed the allocation of cyclics that was the cuase for some obscure crashes during the testsuite execution.  Problem was that cyclics were being allocated in chunks, with a new array being allocated as (prev-size + chink-size), and then the old entries being copied over.  However, because the hrtimer struct is embedded in the cyclic struct, this meant that hrtimer structs were being moved outside the hrtimer code. (Kris Van Hees) [Orabug: 17076008]  
  - Removed dead code (was #if 0 ... #endif).  Cleaned up ;; -> ;. (Kris Van Hees) [Orabug: 17076008]  
  - Implementation for tracing stub-based system calls.  Due to the need for specialized code handling (mainly passing in a pt_regs structure as one of the arguments), some syscalls are called through a stub in assembly code. We duplicate the stub cdode in dtrace_stubs_x86_64.S, but instead of calling the actual syscall implementation code call our own syscall-specific handler, which ensures that entry and return probes are called as enabled, and then call the underlying implementation directly for handling the syscall. (Kris Van Hees) [Orabug: 17076008]  
  - Allow for pushes of multiple branches and pushes of merged-back branches. (Nick Alcock) [Orabug: 17076008]  
  - Remove some debugging that crept in. (Nick Alcock) [Orabug: 17076008]  
  - Fix git commit URL. (Nick Alcock) [Orabug: 17076008]  
  - push-dtrace-release: Fix argument checking. (Nick Alcock) [Orabug: 17076008]  
  - Do not rely on 'git clone --branch'. (Nick Alcock) [Orabug: 17076008]  
  - Release-pushing script. (Nick Alcock) [Orabug: 17076008]  
  - Stacktrace dumping has been moved to the GPL-licensed dtrace_os.c because it depends on a symbol that is exported as GPL-only.  Functionality in dtrace_isa that requires stacktrace dumping can now use dtrace_stacktrace(). (Kris Van Hees) [Orabug: 17076008]  
  - Fix porting issues from 2.6.32 to 2.6.39. Disable stub_* based syscalls (for now). (Kris Van Hees) [Orabug: 17076008]  
  - Move cyclic.h into include/linux. (Nick Alcock) [Orabug: 17076008]  
  - Finish GPL/CDDL splitting work. (Nick Alcock) [Orabug: 17076008]  
  - CDDL copyrights for everything needing it. (Nick Alcock) [Orabug: 17076008]  
  - Migrate dtrace to a standalone module, situated at the top level of the tree. (Nick Alcock) [Orabug: 17076008]  
  - Fix walltimestamp. (Nick Alcock) [Orabug: 17076008]  
  - Changes in how we collect the names o system calls.  Used to use the ftrace syscall meta info and the nr-to-meta functionality.  Now populates the systrace info structure statically at kernel compile time.  This means that the DTrace code no longer depends on ftrace. (Kris Van Hees) [Orabug: 17076008]  
  - No more use for ktime_get_nongpl().  We an now use dtrace_gethrtime(). (Kris Van Hees) [Orabug: 17076008]  
  - Implementation for syscall entry/return probes.  Makes the sys call table writable, and replaces the function pointer for select syscalls with the address of a wrapper function to enable entry and return probe firing. (Kris Van Hees) [Orabug: 17076008]  
  - Conflict with CONFIG_DEBUG_LOCK_ALLOC. (Nick Alcock) [Orabug: 17076008]  
  - Dependency fixes for dtrace. (Nick Alcock) [Orabug: 17076008]  
  - Added CONFIG_DT_DEBUG_MUTEX option to enable printing all locations where a mutex is locked and unlocked. Implemented aggregations using the idr mechanism rather than the Solaris-based 1-byte allocation technique to get unique IDs. Various cleanup and small changes. (Kris Van Hees) [Orabug: 17076008]  
  - Update sdt provider (sdt_mod.c) with lots of functions. NOTES: - module loadcnt may need more work. - kernel_searchsym() is incomplete (see FIXMEs). Add sdt_subr.c and build it in Makefile. Add str_impl.h for internal sdt use. Add more fields to linux/module.h for static probe bookkeeping. (Randy Dunlap) [Orabug: 17076008]  
  - Add dtrace_module_loaded() and dtrace_module_unloaded(). Give the static probes in the kernel image a module name of   "kernel_builtins" and a module state of LIVE. Fix an extra-paren typo in dtrace_dev.c. NOTE:  This is incomplete.  There are a few TBDs and FIXMEs   in this patch. (Randy Dunlap) [Orabug: 17076008]  
  - Turn on gcov profiliing for the RPM builds by default. (Nick Alcock) [Orabug: 17076008]  
  - Turn on gcov profiling in the kernel/dtrace directory by default. (Nick Alcock) [Orabug: 17076008]  
  - Adding framework for a test provider that fires a specific probe on request. Adding previously missing (and unused) exported functions: (Kris Van Hees) [Orabug: 17076008]  
  - File needed for rpm builds to ensure DTrace is enabled as modules. (Kris Van Hees) [Orabug: 17076008]  
  - add Documentation/dtrace_static_probes.txt, which is a directory of all static probes in the kernel tree. (Randy Dunlap) [Orabug: 17076008]  
  - Remove license and add copyright. (Randy Dunlap) [Orabug: 17076008]  
  - Build sdt_register.c into the kernel. (Nick Alcock) [Orabug: 17076008]  
  - Add missing include needed for DTrace probes. (Nick Alcock) [Orabug: 17076008]  
  - - convert relative probepoint relocation addresses to absolute:   this should have been done by the top-level Makefile, but it must   have a dependency problem since the generated vmlinux_info.S has   the correct info in it but the vmlinux_info.o file does not AND   the .S file was created AFTER the .o file. - convert calls to dtrace stub RETs to NOPs; (Randy Dunlap) [Orabug: 17076008]  
  - Add some dtrace static probes that are easy to trigger. See the static probes directory listing for a summary of all dtrace static probes. (Randy Dunlap) [Orabug: 17076008]  
  - Added dependency for FTRACE and FTRACE_SYSCALLS for the SYSTRACE provider. (Kris Van Hees) [Orabug: 17076008]  
  - Remove debugging statements. (Kris Van Hees) [Orabug: 17076008]  
  - Reduce the unintended ordering dependency (_text before _stext) when scanning the relocs info file. (Randy Dunlap) [Orabug: 17076008]  
  - Adding debug code to track probe processing through BEGIN probe enabling. Adding minimal implementation of cyclic functionality (based on hrtimer) as an additional to the core kernel, linked in when dtrace is enabled (be it as module, or compiled in).  Exports cyclic_add() and cyclic_remove(). Removed former cyclic stub implementation (cyclic.c). (Kris Van Hees) [Orabug: 17076008]  
  - The systrace provider depends on the FTRACE_SYSCALLS kernel feature. The systrace provider is actually called syscall on Solaris, so it has been renamed on the Linux side (i.e. it registers itself as syscall). Added some debug statements to track probe searches better. The probes/probematch ioctl handling should return -ESRCH when the last hit has been returned already. (Kris Van Hees) [Orabug: 17076008]  
  - Reading the dtrace relocation info table could fail on a boundary condition. Fix by counting the string terminator (null) byte.  Now works for my 4 test cases. (Randy Dunlap) [Orabug: 17076008]  
  - Read and use the _stext value for adding to relative relocation info to make it absolute. This works for my 4 test cases.  It was derived by examination and discovery.  There could be cases where it does not work, e.g. in other text sections. (Randy Dunlap) [Orabug: 17076008]  
  - Removed || CONFIG_DT_SDT_MODULE from conditional surrounding call to dtrace_register_builtins() because that function does not exist in the kernel proper when DTrace is compiled as kernel modules. (Kris Van Hees) [Orabug: 17076008]  
  - Add missing files (present in the CVS repo but not in git). (Kris Van Hees) [Orabug: 17076008]  
  - systrace uses syscall_nr_to_meta, which is only available when FTRACE_SYSCALLS is enabled, so make systrace depend on FTRACE_SYSCALLS. (Randy Dunlap) [Orabug: 17076008]  
  - Test push. (Kris Van Hees) [Orabug: 17076008]  
  - Test commit (reverting previous test commit). (Kris Van Hees) [Orabug: 17076008]  
  - Just a very small change to check whether git push will work fine by someone other than Nix. (Kris Van Hees) [Orabug: 17076008]  
  - Initial import of DTrace kernelspace code. (Nick Alcock) [Orabug: 17076008]


