The SUSE Linux Enterprise 15 SP3 kernel was updated to receive various security and bugfixes. NOTE: This update was retracted due to a NFS regression. The following security bugs were fixed: - CVE-2021-3772: Fixed sctp vtag check in sctp_sf_ootb . - CVE-2021-3655: Fixed a missing size validations on inbound SCTP packets, which may have allowed the kernel to read uninitialized memory . - CVE-2021-43056: Fixed possible KVM host crash via malicious KVM guest on Power8 . - CVE-2021-43389: Fixed a array-index-out-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c . - CVE-2021-3760: Fixed a use-after-free vulnerability with the ndev-greater than or equal to rf_conn_info object . - CVE-2021-42739: The firewire subsystem had a buffer overflow related to drivers/media/firewire/firedtv-avc.c and drivers/media/firewire/firedtv-ci.c, because avc_ca_pmt mishandled bounds checking . - CVE-2021-33033: Fixed a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled . - CVE-2021-3715: Fixed a use-after-free in route4_change in net/sched/cls_route.c . - CVE-2021-34866: Fixed eBPF Type Confusion Privilege Escalation Vulnerability . - CVE-2021-42252: Fixed an issue inside aspeed_lpc_ctrl_mmap that could have allowed local attackers to access the Aspeed LPC control interface to overwrite memory in the kernel and potentially execute privileges . - CVE-2021-41864: Fixed prealloc_elems_and_freelist that allowed unprivileged users to trigger an eBPF multiplication integer overflow with a resultant out-of-bounds write . - CVE-2021-42008: Fixed a slab out-of-bounds write in the decode_data function in drivers/net/hamradio/6pack.c. Input from a process that had the CAP_NET_ADMIN capability could have lead to root access . The following non-security bugs were fixed: - ACPI: NFIT: Use fallback node id when numa info in NFIT table is incorrect . - ACPI: bgrt: Fix CFI violation . - ACPI: fix NULL pointer dereference . - ACPI: fix NULL pointer dereference . - ALSA: hda - Enable headphone mic on Dell Latitude laptops with ALC3254 . - ALSA: hda/realtek - ALC236 headset MIC recording issue . - ALSA: hda/realtek: Add quirk for Clevo PC50HS . - ALSA: hda/realtek: Add quirk for Clevo X170KM-G . - ALSA: hda/realtek: Add quirk for TongFang PHxTxX1 . - ALSA: hda/realtek: Complete partial device name to avoid ambiguity . - ALSA: hda/realtek: Enable 4-speaker output for Dell Precision 5560 laptop . - ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo 13s Gen2 . - ALSA: hda/realtek: Fix the mic type detection issue for ASUS G551JW . - ALSA: hda/realtek: Quirks to enable speaker output for Lenovo Legion 7i 15IMHG05, Yoga 7i 14ITL5/15ITL5, and 13s Gen2 laptops . - ALSA: hda: avoid write to STATESTS if controller is in reset . - ALSA: hda: intel: Allow repeatedly probing on codec configuration errors . - ALSA: pcm: Workaround for a wrong offset in SYNC_PTR compat ioctl . - ALSA: seq: Fix a potential UAF by wrong private_free call order . - ALSA: usb-audio: Add quirk for VF0770 . - ALSA: usb-audio: Provide quirk for Sennheiser GSP670 Headset . - ASoC: DAPM: Fix missing kctl change notifications . - ASoC: Intel: Skylake: Fix module configuration for KPB and MIXER . - ASoC: Intel: Skylake: Fix passing loadable flag for module . - ASoC: Intel: bytcr_rt5640: Move "Platform Clock" routes to the maps for the matching in-/output . - ASoC: Intel: sof_sdw: tag SoundWire BEs as non-atomic . - ASoC: SOF: imx: imx8: Bar index is only valid for IRAM and SRAM types . - ASoC: SOF: imx: imx8m: Bar index is only valid for IRAM and SRAM types . - ASoC: SOF: loader: release_firmware on load failure to avoid batching . - ASoC: atmel: ATMEL drivers do not need HAS_DMA . - ASoC: dapm: use component prefix when checking widget names . - ASoC: fsl_spdif: register platform component before registering cpu dai . - ASoC: wm8960: Fix clock configuration on slave mode . - Add obsolete_rebuilds_subpackage . - Configure mpi3mr as currently unsupported - HID: apple: Fix logical maximum and usage maximum of Magic Keyboard JIS . - HID: betop: fix slab-out-of-bounds Write in betop_probe . - HID: u2fzero: ignore incomplete packets without data . - HID: usbhid: free raw_report buffers in usbhid_stop . - HID: wacom: Add new Intuos BT device IDs . - ICMPv6: Add ICMPv6 Parameter Problem, code 3 definition . - ICMPv6: Add ICMPv6 Parameter Problem, code 3 definition . - IPv6: reply ICMP error if the first fragment do not include all headers . - IPv6: reply ICMP error if the first fragment do not include all headers . - Input: snvs_pwrkey - add clk handling . - Input: xpad - add support for another USB ID of Nacon GC-100 . - KVM: PPC: Book3S HV Nested: Reflect guest PMU in-use to L0 when guest SPRs are live . - KVM: PPC: Book3S HV Nested: Sanitise H_ENTER_NESTED TM state . - KVM: PPC: Book3S HV: Fix copy_tofrom_guest routines . - KVM: PPC: Book3S HV: Save host FSCR in the P7/8 path . - KVM: PPC: Book3S HV: Tolerate treclaim. in fake-suspend mode changing registers . - KVM: PPC: Fix clearing never mapped TCEs in realmode . - KVM: PPC: Fix kvm_arch_vcpu_ioctl vcpu_load leak . - NFC: digital: fix possible memory leak in digital_in_send_sdd_req . - NFC: digital: fix possible memory leak in digital_tg_listen_mdaa . - NFS: Do uncached readdir when we"re seeking a cookie in an empty page cache . - PCI: Fix pci_host_bridge struct device release/free handling . - PM / devfreq: rk3399_dmc: Add missing of_node_put . - PM / devfreq: rk3399_dmc: Disable devfreq-event device when fails . - PM / devfreq: rk3399_dmc: Fix kernel oops when rockchip,pmu is absent . - PM / devfreq: rk3399_dmc: Fix spelling typo . - PM / devfreq: rk3399_dmc: Remove unneeded semicolon . - RDMA/cma: Do not change route.addr.src_addr.ss_family . - RDMA/cma: Fix listener leak in rdma_cma_listen_on_all failure . - USB: cdc-acm: clean up probe error labels . - USB: cdc-acm: fix minor-number release . - USB: serial: option: add Quectel EC200S-CN module support . - USB: serial: option: add Telit LE910Cx composition 0x1204 . - USB: serial: option: add prod. id for Quectel EG91 . - USB: serial: qcserial: add EM9191 QDL support . - USB: xhci: dbc: fix tty registration race . - acpi/arm64: fix next_platform_timer section mismatch error . - acpi/arm64: fix next_platform_timer section mismatch error . - ata: ahci_platform: fix null-ptr-deref in ahci_platform_enable_regulators . - ata: sata_dwc_460ex: No need to call phy_exit befre phy_init . - audit: fix possible null-pointer dereference in audit_filter_rules . - bfq: Remove merged request already in bfq_requests_merged . - blk: Fix lock inversion between ioc lock and bfqd lock . - blktrace: Fix uaf in blk_trace access after removing by sysfs . - block: bfq: fix bfq_set_next_ioprio_data . - bnxt_en: make bnxt_free_skbs safe to call after bnxt_free_mem . - bpf: Add bpf_patch_call_args prototype to include/linux/bpf.h . - bpf: Fix OOB read when printing XDP link fdinfo . - bpf: Fix a typo of reuseport map in bpf.h . - bpf: Fix up bpf_skb_adjust_room helper"s skb csum setting . - can: dev: can_restart: fix use after free bug . - can: peak_pci: peak_pci_remove: fix UAF . - can: peak_usb: fix use after free bugs . - can: peak_usb: pcan_usb_fd_decode_status: fix back to ERROR_ACTIVE state notification . - can: rcar_can: fix suspend/resume . - can: ti_hecc: ti_hecc_probe: add missed clk_disable_unprepare in error path . - can: xilinx_can: handle failure cases of pm_runtime_get_sync . - cb710: avoid NULL pointer subtraction . - ceph: fix handling of "meta" errors . - ceph: skip existing superblocks that are blocklisted or shut down when mounting . - cfg80211: correct bridge/4addr mode check . - cfg80211: fix management registrations locking . - cfg80211: scan: fix RCU in cfg80211_add_nontrans_list . - cpuidle: pseries: Mark pseries_idle_proble as __init . - drm/amd/display: Pass PCI deviceid into DC . - drm/amdgpu: correct initial cp_hqd_quantum for gfx9 . - drm/amdgpu: fix gart.bo pin_count leak . - drm/edid: In connector_bad_edid cap num_of_ext by num_blocks read . - drm/i915: Fix syncmap memory leak Backporting notes: * context changes in intel_timeline_fini - drm/msm/dsi: Fix an error code in msm_dsi_modeset_init . - drm/msm/dsi: fix off by one in dsi_bus_clk_enable error handling . - drm/msm: Avoid potential overflow in timeout_to_jiffies . - drm/msm: Fix null pointer dereference on pointer edp . - drm/nouveau/debugfs: fix file release memory leak . - drm/nouveau/kms/nv50-: fix file release memory leak . - drm/nouveau/kms/tu102-: delay enabling cursor until after assign_windows . - drm/nouveau: avoid a use-after-free when BO init fails - drm/panel: olimex-lcd-olinuxino: select CRC32 . - drm/panfrost: Make sure MMU context lifetime is not bound to - drm/sun4i: dw-hdmi: Fix HDMI PHY clock setup . - e1000e: Drop patch to avoid regressions until real fix is available . - e1000e: Fix packet loss on Tiger Lake and later . - e100: fix buffer overrun in e100_get_regs . - e100: fix length calculation in e100_get_regs_len . - e100: handle eeprom as little endian . - ext4: fix reserved space counter leakage . - ext4: report correct st_size for encrypted symlinks . - fs, mm: fix race in unlinking swapfile . - fscrypt: add fscrypt_symlink_getattr for computing st_size . - gpio: pca953x: Improve bias setting . - hso: fix bailout in error case of probe . - i2c: acpi: fix resource leak in reconfiguration device addition . - ice: fix getting UDP tunnel entry . - iio: adc128s052: Fix the error handling path of "adc128_probe" . - iio: adc: aspeed: set driver data when adc probe . - iio: dac: ti-dac5571: fix an error code in probe . - iio: light: opt3001: Fixed timeout error when 0 lux . - iio: mtk-auxadc: fix case IIO_CHAN_INFO_PROCESSED . - iio: ssp_sensors: add more range checking in ssp_parse_dataframe . - iio: ssp_sensors: fix error code in ssp_print_mcu_debug . - ipv6/netfilter: Discard first fragment not including all headers . - ipv6/netfilter: Discard first fragment not including all headers . - isdn: cpai: check ctr-greater than or equal to cnr to avoid array index out of bound . - isdn: mISDN: Fix sleeping function called from invalid context . - iwlwifi: pcie: add configuration of a Wi-Fi adapter on Dell XPS 15 . - ixgbe: Fix NULL pointer dereference in ixgbe_xdp_setup . - kABI workaround for HD-audio probe retry changes . - kABI workaround for cfg80211 mgmt_registration_lock changes . - kabi: block: Fix kabi of blk_mq_sched_try_insert_merge . - kernel-binary.spec: Do not sign kernel when no key provided . - kernel-binary.spec: Do not sign kernel when no key provided . - kernel-binary.spec: suse-kernel-rpm-scriptlets required for uninstall as well. Fixes: e98096d5cf85 - kernel-spec-macros: Since rpm 4.17 %verbose is unusable . - lan78xx: select CRC32 . - libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD . - mac80211: Drop frames from invalid MAC address in ad-hoc mode . - mac80211: check return value of rhashtable_init . - mei: me: add Ice Lake-N device id . - mmc: dw_mmc: exynos: fix the finding clock sample value . - mmc: meson-gx: do not use memcpy_to/fromio for dram-access-quirk . - mmc: vub300: fix control-message timeouts . - net/mlx5: E-Switch, Fix double allocation of acl flow counter . - net/mlx5e: IPSEC RX, enable checksum complete . - net/mlx5e: RX, Avoid possible data corruption when relaxed ordering and LRO combined . - net/sched: ets: fix crash when flipping from "strict" to "quantum" . - net: batman-adv: fix error handling . - net: can: ems_usb: fix use-after-free in ems_usb_disconnect . - net: cdc_eem: fix tx fixup skb leak . - net: cdc_ncm: correct overhead in delayed_ndp_size . - net: hns3: check queue id range before using . - net: hso: add failure handler for add_net_device . - net: hso: fix NULL-deref on disconnect regression . - net: hso: fix null-ptr-deref during tty device unregistration . - net: ipv6: Discard next-hop MTU less than minimum link MTU . - net: ipv6: Discard next-hop MTU less than minimum link MTU . - net: lan78xx: fix division by zero in send path . - net: mana: Fix error handling in mana_create_rxq . - net: usb: Fix uninit-was-stored issue in asix_read_phy_addr . - netfilter: Drop fragmented ndisc packets assembled in netfilter . - netfilter: conntrack: collect all entries in one cycle . - netfilter: xt_IDLETIMER: fix panic that occurs when timer_type has garbage value . - nfc: fix error handling of nfc_proto_register . - nfc: port100: fix using -ERRNO as command type mask . - nvme-fc: avoid race between time out and tear down . - nvme-fc: remove freeze/unfreeze around update_nr_hw_queues . - nvme-fc: update hardware queues before using them . - nvme-pci: Fix abort command id . - nvme-pci: fix error unwind in nvme_map_data . - nvme-pci: fix error unwind in nvme_map_data . - nvme-pci: refactor nvme_unmap_data . - nvme-pci: refactor nvme_unmap_data . - nvme: add command id quirk for apple controllers . - ocfs2: fix data corruption after conversion from inline format . - pata_legacy: fix a couple uninitialized variable bugs . - phy: mdio: fix memory leak . - platform/mellanox: mlxreg-io: Fix argument base in kstrtou32 call . - platform/mellanox: mlxreg-io: Fix read access of n-bytes size attributes . - platform/x86: dell-smbios-wmi: Add missing kfree in error-exit from run_smbios_call . - platform/x86: intel_scu_ipc: Fix busy loop expiry time . - powerpc/64s: Fix entry flush patching w/strict RWX hash . - powerpc/64s: Fix stf mitigation patching w/strict RWX hash . - powerpc/64s: Remove irq mask workaround in accumulate_stolen_time . - powerpc/bpf: Fix BPF_MOD when imm == 1 . - powerpc/bpf: Fix BPF_MOD when imm == 1 . - powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 . - powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 . - powerpc/bpf: Use bctrl for making function calls . - powerpc/bpf: Use bctrl for making function calls . - powerpc/lib/code-patching: Do not use struct "ppc_inst" for runnable code in tests . - powerpc/lib/code-patching: Make instr_is_branch_to_addr static . - powerpc/lib: Fix emulate_step std test . - powerpc/numa: Update cpu_cpu_map on CPU online/offline . - powerpc/pseries: Fix build error when NUMA=n . - powerpc/smp: Cache CPU to chip lookup . - powerpc/smp: Enable CACHE domain for shared processor . - powerpc/smp: Fix a crash while booting kvm guest with nr_cpus=2 . - powerpc/smp: Fold cpu_die into its only caller . - powerpc/smp: Set numa node before updating mask . - powerpc/smp: Update cpu_core_map on all PowerPc systems . - powerpc/uprobes: Validation for prefixed instruction . - powerpc/xive: Discard disabled interrupts in get_irqchip_state . - powerpc: Do not dereference code as "struct ppc_inst" . - powerpc: Do not use "struct ppc_inst" to reference instruction location . - powerpc: Move arch_cpu_idle_dead into smp.c . - pseries/eeh: Fix the kdump kernel crash during eeh_pseries_init . - ptp_pch: Load module automatically if ID matches . - ptp_pch: Restore dependency on PCI . - regmap: Fix possible double-free in regcache_rbtree_exit . - rpm: fix kmp install path - rpm: use _rpmmacrodir - scsi: ibmvfc: Fix up duplicate response detection . - scsi: iscsi: Fix deadlock on recovery path during GFP_IO reclaim . - scsi: lpfc: Allow PLOGI retry if previous PLOGI was aborted . - scsi: lpfc: Allow fabric node recovery if recovery is in progress before devloss . - scsi: lpfc: Correct sysfs reporting of loop support after SFP status change . - scsi: lpfc: Fix link down processing to address NULL pointer dereference . - scsi: lpfc: Fix memory overwrite during FC-GS I/O abort handling . - scsi: lpfc: Fix use-after-free in lpfc_unreg_rpi routine . - scsi: lpfc: Revert LOG_TRACE_EVENT back to LOG_INIT prior to driver_resource_setup . - scsi: lpfc: Update lpfc version to 14.0.0.3 . - scsi: lpfc: Wait for successful restart of SLI3 adapter during host sg_reset . - scsi: mpi3mr: Add EEDP DIF DIX support . - scsi: mpi3mr: Add bios_param SCSI host template hook . - scsi: mpi3mr: Add change queue depth support . - scsi: mpi3mr: Add event handling debug prints . - scsi: mpi3mr: Add mpi30 Rev-R headers and Kconfig . - scsi: mpi3mr: Add support for DSN secure firmware check . - scsi: mpi3mr: Add support for PCIe device event handling . - scsi: mpi3mr: Add support for PM suspend and resume . - scsi: mpi3mr: Add support for device add/remove event handling . - scsi: mpi3mr: Add support for internal watchdog thread . - scsi: mpi3mr: Add support for queue command processing . - scsi: mpi3mr: Add support for recovering controller . - scsi: mpi3mr: Add support for threaded ISR . - scsi: mpi3mr: Add support for timestamp sync with firmware . - scsi: mpi3mr: Additional event handling . - scsi: mpi3mr: Allow certain commands during pci-remove hook . - scsi: mpi3mr: Base driver code . - scsi: mpi3mr: Complete support for soft reset . - scsi: mpi3mr: Create operational request and reply queue pair . - scsi: mpi3mr: Fix error handling in mpi3mr_setup_isr . - scsi: mpi3mr: Fix missing unlock on error . - scsi: mpi3mr: Hardware workaround for UNMAP commands to NVMe drives . - scsi: mpi3mr: Implement SCSI error handler hooks . - scsi: mpi3mr: Print IOC info for debugging . - scsi: mpi3mr: Print pending host I/Os for debugging . - scsi: mpi3mr: Set up IRQs in resume path . - scsi: mpi3mr: Use scsi_cmd_to_rq instead of scsi_cmnd.request . - scsi: mpi3mr: Use the proper SCSI midlayer interfaces for PI . - scsi: mpi3mr: Wait for pending I/O completions upon detection of VD I/O timeout . - scsi: qla2xxx: Add debug print of 64G link speed . - scsi: qla2xxx: Add host attribute to trigger MPI hang . - scsi: qla2xxx: Add support for mailbox passthru . - scsi: qla2xxx: Adjust request/response queue size for 28xx . - scsi: qla2xxx: Call process_response_queue in Tx path . - scsi: qla2xxx: Changes to support FCP2 Target . - scsi: qla2xxx: Changes to support kdump kernel . - scsi: qla2xxx: Changes to support kdump kernel for NVMe BFS . - scsi: qla2xxx: Check for firmware capability before creating QPair . - scsi: qla2xxx: Display 16G only as supported speeds for 3830c card . - scsi: qla2xxx: Do not call fc_block_scsi_eh during bus reset . - scsi: qla2xxx: Fix NPIV create erroneous error . - scsi: qla2xxx: Fix NVMe retry . - scsi: qla2xxx: Fix NVMe session down detection . - scsi: qla2xxx: Fix NVMe | FCP personality change . - scsi: qla2xxx: Fix crash in NVMe abort path . - scsi: qla2xxx: Fix excessive messages during device logout . - scsi: qla2xxx: Fix hang during NVMe session tear down . - scsi: qla2xxx: Fix hang on NVMe command timeouts . - scsi: qla2xxx: Fix kernel crash when accessing port_speed sysfs file . - scsi: qla2xxx: Fix port type info . - scsi: qla2xxx: Fix unsafe removal from linked list . - scsi: qla2xxx: Fix use after free in eh_abort path . - scsi: qla2xxx: Move heartbeat handling from DPC thread to workqueue . - scsi: qla2xxx: Open-code qla2xxx_eh_device_reset . - scsi: qla2xxx: Open-code qla2xxx_eh_target_reset . - scsi: qla2xxx: Remove redundant initialization of pointer req . - scsi: qla2xxx: Restore initiator in dual mode . - scsi: qla2xxx: Show OS name and version in FDMI-1 . - scsi: qla2xxx: Suppress unnecessary log messages during login . - scsi: qla2xxx: Sync queue idx with queue_pair_map idx . - scsi: qla2xxx: Update version to 10.02.06.100-k . - scsi: qla2xxx: Update version to 10.02.06.200-k . - scsi: qla2xxx: Update version to 10.02.07.100-k . - scsi: qla2xxx: Use scsi_cmd_to_rq instead of scsi_cmnd.request . - scsi: qla2xxx: edif: Add N2N support for EDIF . - scsi: qla2xxx: edif: Do secure PLOGI when auth app is present . - scsi: qla2xxx: edif: Fix EDIF enable flag . - scsi: qla2xxx: edif: Fix returnvar.cocci warnings . - scsi: qla2xxx: edif: Fix stale session . - scsi: qla2xxx: edif: Reject AUTH ELS on session down . - scsi: qla2xxx: edif: Use link event to wake up app . - scsi: target: Fix the pgr/alua_support_store functions . - sctp: check asoc peer.asconf_capable before processing asconf . - soc: qcom: mdt_loader: Drop PT_LOAD check on hash segment . - spi: spi-nxp-fspi: do not depend on a specific node name erratum workaround . - tpm: ibmvtpm: Avoid error message when process gets signal while waiting . - usb: chipidea: ci_hdrc_imx: Also search for "phys" phandle . - usb: hso: fix error handling code of hso_create_net_device . - usb: hso: remove the bailout parameter . - usb: musb: dsps: Fix the probe error path . - video: fbdev: gbefb: Only instantiate device when built for IP32 . - virtio: write back F_VERSION_1 before validate . - watchdog: orion: use 0 for unset heartbeat . - x86/pat: Pass valid address to sanitize_phys . - x86/resctrl: Free the ctrlval arrays when domain_setup_mon_state fails . - x86/sev: Return an error on a returned non-zero SW_EXITINFO1[31:0] . - xen: fix setting of max_pfn in shared_info . - xen: reset legacy rtc flag for PV domU . - xfs: Fixed non-directory creation in SGID directories introduced by CVE-2018-13405 patch . - xfs: ensure that the inode uid/gid match values match the icdinode ones . - xfs: fix I_DONTCACHE . - xfs: fix log intent recovery ENOSPC shutdowns when inactivating inodes . - xfs: merge the projid fields in struct xfs_icdinode . - xfs: remove the icdinode di_uid/di_gid members . - xhci: Enable trust tx length quirk for Fresco FL11 USB controller . - xhci: Fix command ring pointer corruption while aborting a command . - xhci: guard accesses to ep_state in xhci_endpoint_reset . - xhci: guard accesses to ep_state in xhci_endpoint_reset . Special Instructions and Notes: Please reboot the system after installing this update.