# changelog

author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.21.1.el6]
changelog:
  - [fs] sunrpc: Revert "sunrpc: always treat the invalid cache as unexpired" (Thiago Becker) [1535938 1532786]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.22.1.el6]
changelog:
  - [mm] add cpu_relax() to "dont return 0 too early" patch (Ian Kent) [1527811 988988]
  - [mm] don't return 0 too early from find_get_pages() (Ian Kent) [1527811 988988]
  - [crypto] cryptd: Add cryptd_max_cpu_qlen module parameter (Jon Maxwell) [1527802 1503322]
  - [powerpc] spinlock: add gmb memory barrier (Mauricio Oliveira) [1531720 1538543]
  - [powerpc] Prevent Meltdown attack with L1-D$ flush (Mauricio Oliveira) [1531720 1538543]
  - [s390] vtime: turn BP on when going idle (Hendrik Brueckner) [1532733 1538542]
  - [s390] cpuinfo: show facilities as reported by stfle (Hendrik Brueckner) [1532733 1538542]
  - [s390] kconfigs: turn off SHARED_KERNEL support for s390 (Hendrik Brueckner) [1532733 1538542]
  - [s390] add ppa to system call and program check path (Hendrik Brueckner) [1532733 1538542]
  - [s390] spinlock: add gmb memory barrier (Hendrik Brueckner) [1532733 1538542]
  - [s390] introduce CPU alternatives (Hendrik Brueckner) [1532733 1538542]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.23.1.el6]
changelog:
  - [scsi] avoid a permanent stop of the scsi device's request queue (Ewan Milne) [1519857 1513455]
  - [x86] retpoline/hyperv: Convert assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Upgrade GCC retpoline warning to an error for brew builds (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Don't use kernel indirect thunks in vsyscalls (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Add a read-only retp_enabled debugfs knob (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: detect unretpolined modules (Waiman Long) [1543022 1535645]
  - [x86] retpoline/ACPI: Convert indirect jump in wakeup code (Waiman Long) [1543022 1535645]
  - [x86] retpoline/efi: Convert stub indirect calls & jumps (Waiman Long) [1543022 1535645]
  - [watchdog] hpwdt: remove indirect call in drivers/watchdog/hpwdt.c (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: cleanup __ptrace_may_access (Waiman Long) [1543022 1535645]
  - [x86] bugs: Drop one "mitigation" from dmesg (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: fix ptrace IBPB optimization (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Avoid returns in IBRS-disabled regions (Waiman Long) [1543022 1535645]
  - [x86] spectre/meltdown: avoid the vulnerability directory to weaken kernel security (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Update spec_ctrl.txt and kernel-parameters.txt (Waiman Long) [1543022 1535645]
  - [x86] Use IBRS for firmware update path (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: stuff RSB on context switch with SMEP enabled (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: use upstream RSB stuffing function (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: add ibrs_enabled=3 (ibrs_user) (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Integrate IBRS with retpoline (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: print features changed by microcode loading (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: refactor the init and microcode loading paths (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: move initialization of X86_FEATURE_IBPB_SUPPORT (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove SPEC_CTRL_PCP_IBPB bit (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove ibrs_enabled variable (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: add ibp_disabled variable (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: add X86_FEATURE_IBP_DISABLE (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove IBP disable for AMD model 0x16 (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove performance measurements from documentation (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: make ipbp_enabled read-only (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove ibpb_enabled=2 mode (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Enable spec_ctrl functions for x86-32 (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: move vmexit rmb in the last branch before IBRS (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: satisfy the barrier like semantics of IBRS (Waiman Long) [1543022 1535645]
  - [x86] spectre_v1: Mark it as mitigated (Waiman Long) [1543022 1535645]
  - [x86] pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (Waiman Long) [1543022 1535645]
  - [x86] mce: Make machine check speculation protected (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Add LFENCE to the retpoline/RSB filling RSB macros (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Fill return stack buffer on vmexit (Waiman Long) [1543022 1535645]
  - [x86] retpoline/irq32: Convert assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] retpoline/checksum32: Convert assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] retpoline/entry: Convert entry assembler indirect (Waiman Long) [1543022 1535645]
  - [x86] retpoline/crypto: Convert crypto assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] spectre: Add boot time option to select Spectre v2 mitigation (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Add initial retpoline support (Waiman Long) [1543022 1535645]
  - [x86] cpu: Implement CPU vulnerabilites sysfs functions (Waiman Long) [1543022 1535645]
  - [base] sysfs/cpu: Add vulnerability folder (Waiman Long) [1543022 1535645]
  - [x86] cpufeatures: Add X86_BUG_SPECTRE_V[12] (Waiman Long) [1543022 1535645]
  - [x86] pti: Add the pti= cmdline option and documentation (Waiman Long) [1543022 1535645]
  - [x86] cpufeatures: Add X86_BUG_CPU_MELTDOWN (Waiman Long) [1543022 1535645]
  - [x86] pti: Rename CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION (Waiman Long) [1543022 1535645]
  - [x86] cpu: Expand cpufeature facility to include cpu bugs (Waiman Long) [1543022 1535645]
  - [x86] cpu: Merge bugs.c and bugs_64.c (Waiman Long) [1543022 1535645]
  - [x86] cpu/intel: Introduce macros for Intel family numbers (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Add missing '\n' at end of ALTERNATIVE inline asm (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Fix alt_max_short macro to really be a max() (Waiman Long) [1543022 1535645]
  - [x86] asm: Make asm/alternative.h safe from assembly (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Document macros (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Fix ALTERNATIVE_2 padding generation properly (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Add instruction padding (Waiman Long) [1543022 1535645]
  - [x86] alternative: Add header guards to <asm/alternative-asm.h> (Waiman Long) [1543022 1535645]
  - [x86] alternative: Use .pushsection/.popsection (Waiman Long) [1543022 1535645]
  - [x86] copy_user_generic: Optimize copy_user_generic with CPU erms feature (Waiman Long) [1543022 1535645]
  - [x86] Make .altinstructions bit size neutral (Waiman Long) [1543022 1535645]
  - [x86] pti: Rework the trampoline stack switching code (Waiman Long) [1543022 1535645]
  - [x86] pti: Disable interrupt before trampoline stack switching (Waiman Long) [1543022 1535645]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.24.1.el6]
changelog:
  - [kernel] sched/core: Rework rq->clock update skips (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] sched: Remove useless code in yield_to() (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] sched: Set skip_clock_update in yield_task_fair() (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] sched, rt: Update rq clock when unthrottling of an otherwise idle CPU (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] lockdep: Fix lock_is_held() on recursion (Lauro Ramos Venancio) [1551475 1212959]
  - [net] bonding: discard lowest hash bit for 802.3ad layer3+4 (Hangbin Liu) [1550103 1532167]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.25.1.el6]
changelog:
  - [net] packet: Allow packets with only a header (but no payload) (Lorenzo Bianconi) [1557896 1535024]
  - [net] packet: make packet too small warning match condition (Lorenzo Bianconi) [1557896 1535024]
  - [net] packet: bail out of packet_snd() if L2 header creation fails (Lorenzo Bianconi) [1557896 1535024]
  - [net] packet: make packet_snd fail on len smaller than l2 header (Lorenzo Bianconi) [1557896 1535024]
  - [net] dccp: use-after-free in DCCP code (Stefano Brivio) [1520818 1520817] {CVE-2017-8824}
  - [fs] nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields) [1447640 1447641] {CVE-2017-7645}
  - [netdrv] be2net: Fix UE detection logic for BE3 (Ivan Vecera) [1552706 1437991]
  - [x86] skip check for spurious faults for non-present faults (Daniel Vacek) [1551471 1495167]
  - [x86] mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds() (Daniel Vacek) [1551471 1495167]
  - [scsi] lpfc: Null pointer dereference when log_verbose is set to 0xffffffff (Dick Kennedy) [1540481 1538340]
  - [mm] prevent concurrent unmap_mapping_range() on the same inode (Miklos Szeredi) [1538654 1408108]
  - [s390] fix transactional execution control register handling (Hendrik Brueckner) [1538591 1520862]
  - [netdrv] bnx2x: prevent crash when accessing PTP with interface down (Michal Schmidt) [1538586 1518669]
  - [v4l] media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548429 1548432] {CVE-2017-13166}
  - [v4l] media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic (Jarod Wilson) [1548429 1548432] {CVE-2017-13166}
  - [net] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Florian Westphal) [1543089 1543091] {CVE-2017-18017}
  - [net] netfilter: xt_TCPMSS: fix handling of malformed TCP header and options (Florian Westphal) [1543089 1543091] {CVE-2017-18017}
  - [net] netfilter: xt_TCPMSS: SYN packets are allowed to contain data (Florian Westphal) [1543089 1543091] {CVE-2017-18017}
  - [net] bluetooth: Prevent uninitialized data (Gopal Tiwari) [1519627 1519626] {CVE-2017-1000410}


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.26.1.el6]
changelog:
  - [s390] qeth: check not more than 16 SBALEs on the completion queue (Hendrik Brueckner) [1557477 1520860]
  - [x86] pti: Disable kaiser_add_mapping if X86_FEATURE_NOPTI (Waiman Long) [1561441 1557562] {CVE-2017-5754}
  - [x86] irq/ioapic: Check for valid irq_cfg pointer in smp_irq_move_cleanup_interrupt (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] kexec/64: Clear control page after PGD init (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] efi/64: Fix potential PTI data corruption problem (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti/mm: Fix machine check with PTI on old AMD CPUs (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti/mm: Enable PAGE_GLOBAL if not affected by Meltdown (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] retpoline: Avoid retpolines for built-in __init functions (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] kexec/32: Allocate 8k PGD for PTI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] spec_ctrl: Patch out lfence on old 32-bit CPUs (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] spec_ctrl/32: Enable IBRS processing on kernel entries & exits (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] spec_ctrl/32: Stuff RSB on kernel entry (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Allow CONFIG_PAGE_TABLE_ISOLATION for x86_32 (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti/32: Add a PAE specific version of __pti_set_user_pgd (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Support PAE page table dumping (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable/pae: Use separate kernel PMDs for user page-table (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] mm/pae: Populate valid user PGD entries (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Enable x86-32 for kaiser.c (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Disable PCID handling in x86-32 TLB flushing code (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable: Disable user PGD poisoning for PAE (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable: Move more PTI functions out of pgtable_64.h (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable: Move pgdp kernel/user conversion functions to pgtable.h (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable/32: Allocate 8k page-tables when PTI is enabled (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable/pae: Unshare kernel PMDs when PTI is enabled (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Handle debug exception similar to NMI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Add PTI cr3 switch to non-NMI entry/exit points (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Add PTI cr3 switches to NMI handler code (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Introduce SAVE_ALL_NMI and RESTORE_ALL_NMI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Enable the use of trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Change INT80 to be an interrupt gate (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Handle Entry from Kernel-Mode on Entry-Stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Leave the kernel via trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Enter the kernel via trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Restore segments before int registers (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Split off return-to-kernel path (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Unshare NMI return path (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Put ESPFIX code into a macro (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Load task stack from x86_tss.sp1 in SYSENTER handler (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Rename TSS_sysenter_sp0 to TSS_entry_stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Add X86_FEATURE_NOPTI to permanently disable PTI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Simplify and fix up the SYSENTER stack #DB/NMI fixup (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] doublefault: Set the right gs register for doublefault (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] syscall: int80 must not clobber r12-15 (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] syscall: change ia32_syscall() to create the full register frame in ia32_do_call() (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] cve: Make all Meltdown/Spectre percpu variables available to x86-32 (Waiman Long) [1553283 1550599] {CVE-2017-5754}


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.27.1.el6]
changelog:
  - [mm] account skipped entries to avoid looping in find_get_pages (Dave Wysochanski) [1565989 1559386]
  - [x86] pti/32: Don't use trampoline stack on Xen PV (Waiman Long) [1568327 1562725]
  - [x86] pti: Use boot_cpu_has(X86_FEATURE_PTI_SUPPORT) for early call sites (Waiman Long) [1568327 1562725]
  - [x86] pti: Set X86_FEATURE_PTI_SUPPORT early (Waiman Long) [1568327 1562725]
  - [x86] pti: Rename X86_FEATURE_NOPTI to X86_FEATURE_PTI_SUPPORT (Waiman Long) [1568327 1562725]
  - [x86] pti/32: Fix setup_trampoline_page_table() bug (Waiman Long) [1568327 1562725]
  - [x86] entry: Remove extra argument in call instruction (Waiman Long) [1568332 1562552]
  - [x86] syscall: Fix ia32_ptregs handling bug in 64-bit kernel (Waiman Long) [1568332 1562552]
  - [x86] efi/64: Align efi_pgd on even page boundary (Waiman Long) [1568535 1558845]
  - [x86] pgtable/pae: Revert "Use separate kernel PMDs for user page-table" (Waiman Long) [1568535 1558845]
  - [x86] pgtable/pae: Revert "Unshare kernel PMDs when PTI is enabled" (Waiman Long) [1568535 1558845]
  - [x86] mm: Dump both kernel & user page tables at fault (Waiman Long) [1568535 1558845]
  - [x86] entry/32: Fix typo in PARANOID_EXIT_TO_KERNEL_MODE (Waiman Long) [1568535 1558845]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.28.1.el6]
changelog:
  - [x86] entry/64: Don't use IST entry for #BP stack (Waiman Long) [1567078 1567079] {CVE-2018-8897}
  - [x86] xen: do not use xen_info on HVM, set pv_info name to "Xen HVM" (Vitaly Kuznetsov) [1569141 1568241]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.3.2.el6]
changelog:
  - [mm] enlarge stack guard gap (Larry Woodman) [1452729 1452730] {CVE-2017-1000364 CVE-2017-1000366}


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.29.1.el6]
changelog:
  - [x86] x86/spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Rename _RDS to _SSBD (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [kernel] prctl: Add speculation control prctls (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/kvm: Expose the RDS bit to the guest (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs/AMD: Add support to disable RDS on Fam[15, 16, 17]h if requested (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Expose the /sys/../spec_store_bypass and X86_BUG_SPEC_STORE_BYPASS (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] cpu/intel: Knight Mill and Moorefield update to intel-family.h (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/speculation: Update Speculation Control microcode blacklist (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Clean up Spectre v2 related CPUID flags (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add AMD feature bits for Speculation Control (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add Intel feature bits for Speculation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add CPUID_7_EDX CPUID leaf (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] Extend RH cpuinfo to 10 extra words (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1573176 1572487]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.7.1.el6]
changelog:
  - [drm] ttm: fix regression introduced in dfb4a4250168008c5ac61e90ab2b86f074a83a6c (Dave Airlie) [646994 644896]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.9.1.el6]
changelog:
  - [fs] Do not mix FMODE_ and O_ flags with break_lease() and may_open() (Harshula Jayasuriya) [648408 642677]
  - [fs] aio: check for multiplication overflow in do_io_submit (Jeff Moyer) [629450 629451] {CVE-2010-3067}
  - [net] fix info leak from kernel in ethtool operation (Neil Horman) [646727 646728] {CVE-2010-3861}
  - [net] packet: fix information leak to userland (Jiri Pirko) [649899 649900] {CVE-2010-3876}
  - [net] clean up info leak in act_police (Neil Horman) [636393 636394] {CVE-2010-3477}
  - [kernel] sys_semctl: fix kernel stack leakage (Danny Feng) [648723 648724] {CVE-2010-4083}
  - [sound] sound/pci/rme9652: prevent reading uninitialized stack memory (Stanislaw Gruszka) [648710 648715 648711 648716] {CVE-2010-4080 CVE-2010-4081}
  - [mm] Prevent Out Of Memory when changing cpuset's mems on NUMA (Larry Woodman) [651996 597127]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.10.1.el6]
changelog:
  - [fs] xfs: prevent reading uninitialized stack memory (Dave Chinner) [630808 630809] {CVE-2010-3078}
  - [net] fix rds_iovec page count overflow (Jiri Pirko) [647423 647424] {CVE-2010-3865}
  - [scsi] Fix megaraid_sas driver SLAB memory leak detected with CONFIG_DEBUG_SLAB (Shyam Iyer) [649436 633836]
  - [usb] serial/mos*: prevent reading uninitialized stack memory (Don Zickus) [648697 648698] {CVE-2010-4074}
  - [kernel] ecryptfs_uid_hash() buffer overflow (Jerome Marchand) [626320 611388] {CVE-2010-2492}
  - [sound] seq/oss - Fix double-free at error path of snd_seq_oss_open() (Jaroslav Kysela) [630554 630555] {CVE-2010-3080}
  - [virt] virtio-net: init link state correctly (Jason Wang) [653340 646369]
  - [netdrv] prevent reading uninitialized memory in hso driver (Thomas Graf) [633143 633144] {CVE-2010-3298}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.11.1.el6]
changelog:
  - [kernel] posix-cpu-timers: workaround to suppress the problems with mt exec (Oleg Nesterov) [656267 656268] {CVE-2010-4248}
  - [fs] bio: take care not overflow page count when mapping/copying user data (Danny Feng) [652530 652531] {CVE-2010-4162}
  - [net] can-bcm: fix minor heap overflow (Danny Feng) [651846 651847] {CVE-2010-3874}
  - [net] filter: make sure filters dont read uninitialized memory (Jiri Pirko) [651704 651705] {CVE-2010-4158}
  - [net] inet_diag: Make sure we actually run the same bytecode we audited (Jiri Pirko) [651268 651269] {CVE-2010-3880}
  - [v4l] ivtvfb: prevent reading uninitialized stack memory (Mauro Carvalho Chehab) [648832 648833] {CVE-2010-4079}
  - [drm] via/ioctl.c: prevent reading uninitialized stack memory (Dave Airlie) [648718 648719] {CVE-2010-4082}
  - [char] nozomi: clear data before returning to userspace on TIOCGICOUNT (Mauro Carvalho Chehab) [648705 648706] {CVE-2010-4077}
  - [serial] clean data before filling it on TIOCGICOUNT (Mauro Carvalho Chehab) [648702 648703] {CVE-2010-4075}
  - [net] af_unix: limit unix_tot_inflight (Neil Horman) [656761 656762] {CVE-2010-4249}
  - [block] check for proper length of iov entries in blk_rq_map_user_iov() (Danny Feng) [652958 652959] {CVE-2010-4163}
  - [net] Limit sendto()/recvfrom()/iovec total length to INT_MAX (Jiri Pirko) [651894 651895] {CVE-2010-4160}
  - [netdrv] mlx4: Add OFED-1.5.2 patch to increase log_mtts_per_seg (Jay Fenlason) [643815 637284]
  - [kernel] kbuild: fix external module compiling (Aristeu Rozanski) [658879 655231]
  - [net] bluetooth: Fix missing NULL check (Jarod Wilson) [655667 655668] {CVE-2010-4242}
  - [kernel] ipc: initialize structure memory to zero for compat functions (Danny Feng) [648694 648695] {CVE-2010-4073}
  - [kernel] shm: fix information leak to userland (Danny Feng) [648688 648689] {CVE-2010-4072}
  - [md] dm: remove extra locking when changing device size (Mike Snitzer) [653900 644380]
  - [block] read i_size with i_size_read() (Mike Snitzer) [653900 644380]
  - [kbuild] don't sign out-of-tree modules (Aristeu Rozanski) [655122 653507]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.12.1.el6]
changelog:
  - [netdrv] igb: only use vlan_gro_receive if vlans are registered (Stefan Assmann) [652804 660192] {CVE-2010-4263}
  - [net] core: neighbour update Oops (Jiri Pirko) [660591 658518]
  - [scsi] lpfc: Set heartbeat timer off by default (Rob Evers) [660244 655935]
  - [scsi] lpfc: Fixed crashes for BUG_ONs hit in the lpfc_abort_handler (Rob Evers) [659611 645882]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.15.1.el6]
changelog:
  - [net] bonding: prevent oopsing on calling pskb_may_pull on shared skb (Andy Gospodarek) [671342 665110]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.16.1.el6]
changelog:
  - [net] ipsec: fragment locally generated tunnel-mode IPSec6 packets as needed (Herbert Xu) [670421 661113]
  - [net] tcp: Increase TCP_MAXSEG socket option minimum to TCP_MIN_MSS (Frantisek Hrbata) [652510 652511] {CVE-2010-4165}
  - [perf] perf_events: Fix perf_counter_mmap() hook in mprotect() (Oleg Nesterov) [651672 651673] {CVE-2010-4169}
  - [md] dm mpath: revert "dm: Call blk_abort_queue on failed paths" (Mike Snitzer) [658854 636771]
  - [x86] UV: Address interrupt/IO port operation conflict (George Beshers) [662921 659480]
  - [mm] guard page for stacks that grow upwards (Johannes Weiner) [666796 630562]
  - [scsi] enable state transistions from OFFLINE to RUNNING (Mike Christie) [660590 643237]
  - [scsi] set queue limits no_cluster for stacked devices (Mike Snitzer) [662050 658293]
  - [mm] Out-of-memory under memory cgroup can call both of oom-killer-for-memcg and oom-killer-for-page-fault (Larry Woodman) [661732 592879]
  - [scsi] libfc: possible race could panic system due to NULL fsp->cmd (Mike Christie) [662049 638297]
  - [kernel] exec: copy-and-paste the fixes into compat_do_execve() paths (Oleg Nesterov) [627811 625695] {CVE-2010-4243}
  - [kernel] exec: make argv/envp memory visible to oom-killer (Oleg Nesterov) [627811 625695] {CVE-2010-4243}
  - [virt] virtio: console: Send SIGIO in case of port unplug (Amit Shah) [652720 624628]
  - [virt] virtio: console: Send SIGIO on new data arrival on ports (Amit Shah) [652720 624628]
  - [virt] virtio: console: Send SIGIO to processes that request it for host events (Amit Shah) [652720 624628]
  - [virt] virtio: console: Reference counting portdev structs is not needed (Amit Shah) [662721 628805]
  - [virt] virtio: console: Add reference counting for port struct (Amit Shah) [662721 628805]
  - [virt] virtio: console: Use cdev_alloc() instead of cdev_init() (Amit Shah) [662721 628805]
  - [virt] virtio: console: Add a find_port_by_devt() function (Amit Shah) [662721 628805]
  - [virt] virtio: console: Add a list of portdevs that are active (Amit Shah) [662721 628805]
  - [virt] virtio: console: open: Use a common path for error handling (Amit Shah) [662721 628805]
  - [virt] virtio: console: remove_port() should return void (Amit Shah) [662721 628805]
  - [virt] virtio: console: Make write() return -ENODEV on hot-unplug (Amit Shah) [662721 628805]
  - [virt] virtio: console: Make read() return -ENODEV on hot-unplug (Amit Shah) [662721 628805]
  - [virt] virtio: console: Unblock poll on port hot-unplug (Amit Shah) [662721 628805]
  - [virt] virtio: console: Un-block reads on chardev close (Amit Shah) [662721 628805]
  - [virt] virtio: console: Check if portdev is valid in send_control_msg() (Amit Shah) [662721 628805]
  - [virt] virtio: console: Remove control vq data only if using multiport support (Amit Shah) [662721 628805]
  - [virt] virtio: console: Reset vdev before removing device (Amit Shah) [662721 628805]
  - [fs] Fix nfsv4 client lock reclaim behaviour (Sachin Prabhu) [661730 638269]
  - [scsi] scsi_dh_alua: Handle all states correctly (Mike Snitzer) [659610 636994]
  - [kernel] execve: improve interactivity and respond to SIGKILL with large arguments (Dave Anderson) [661731 629178]
  - [virt] xen: handle events as edge-triggered (Andrew Jones) [661737 550724]
  - [virt] xen: use percpu interrupts for IPIs and VIRQs (Andrew Jones) [661737 550724]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.17.1.el6]
changelog:
  - [s390x] kdump: allow zfcpdump to mount and write to ext4 file systems (Amerigo Wang) [661667 628676]
  - [scsi] qla2xxx: Properly set the return value in function qla2xxx_eh_abort (Chad Dupuis) [664398 635710]
  - [scsi] qla2xxx: Drop srb reference before waiting for completion (Chad Dupuis) [664398 635710]
  - [virt] KVM: VMX: Really clear cr0.ts when giving the guest ownership of the fpu (Avi Kivity) [658891 645898]
  - [virt] KVM: SVM: Initialize fpu_active in init_vmcb() (Avi Kivity) [658891 645898]
  - [virt] KVM: x86: Use unlazy_fpu() for host FPU (Avi Kivity) [658891 645898]
  - [virt] KVM: Set cr0.et when the guest writes cr0 (Avi Kivity) [658891 645898]
  - [virt] KVM: VMX: Give the guest ownership of cr0.ts when the fpu is active (Avi Kivity) [658891 645898]
  - [virt] KVM: Lazify fpu activation and deactivation (Avi Kivity) [658891 645898]
  - [virt] KVM: VMX: Allow the guest to own some cr0 bits (Avi Kivity) [658891 645898]
  - [virt] KVM: Replace read accesses of vcpu->arch.cr0 by an accessor (Avi Kivity) [658891 645898]
  - [virt] KVM: VMX: trace clts and lmsw instructions as cr accesses (Avi Kivity) [658891 645898]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.18.1.el6]
changelog:
  - [netdrv] ixgbe: make sure FCoE DDP user buffers are really released by the HW (Frantisek Hrbata) [674002 617193]
  - [netdrv] ixgbe: invalidate FCoE DDP context when no error status is available (Frantisek Hrbata) [674002 617193]
  - [netdrv] ixgbe: avoid doing FCoE DDP when adapter is DOWN or RESETTING (Frantisek Hrbata) [674002 617193]
  - [fcoe] libfc: remove tgt_flags from fc_fcp_pkt struct (Mike Christie) [666797 633915]
  - [fcoe] libfc: use rport timeout values for fcp recovery (Frantisek Hrbata) [666797 633915]
  - [fcoe] libfc: incorrect scsi host byte codes returned to scsi-ml (Mike Christie) [666797 633915]
  - [scsi] scsi_dh_alua: fix overflow in alua_rtpg port group id check (Mike Snitzer) [673978 670572]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.19.1.el6]
changelog:
  - [crypto] sha-s390: Reset index after processing partial block (Herbert Xu) [678996 626515]
  - [net] clear heap allocations for privileged ethtool actions (Jiri Pirko) [672434 672435] {CVE-2010-4655}
  - [usb] iowarrior: don't trust report_size for buffer size (Don Zickus) [672421 672422] {CVE-2010-4656}
  - [virt] virtio: console: Wake up outvq on host notifications (Amit Shah) [678558 643750]
  - [fs] inotify: stop kernel memory leak on file creation failure (Eric Paris) [656831 656832] {CVE-2010-4250}
  - [net] sctp: fix kernel panic resulting from mishandling of icmp dest unreachable msg (Neil Horman) [667028 667029] {CVE-2010-4526}
  - [mm] install_special_mapping skips security_file_mmap check (Frantisek Hrbata) [662198 662199] {CVE-2010-4346}
  - [kdump] vt-d: Handle previous faults after enabling fault handling (Takao Indoh) [678485 617137]
  - [kdump] Enable the intr-remap fault handling after local apic setup (Takao Indoh) [678485 617137]
  - [kdump] vt-d: Fix the vt-d fault handling irq migration in the x2apic mode (Takao Indoh) [678485 617137]
  - [kdump] vt-d: Quirk for masking vtd spec errors to platform error handling logic (Takao Indoh) [678485 617137]
  - [virt] virtio: console: Don't block entire guest if host doesn't read data (Amit Shah) [678562 643751]
  - [virt] virtio: console: Prevent userspace from submitting NULL buffers (Amit Shah) [678559 635535]
  - [virt] virtio: console: Fix poll blocking even though there is data to read (Amit Shah) [678561 634232]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.20.1.el6]
changelog:
  - [dvb] kernel: av7110 negative array offset (Mauro Carvalho Chehab) [672403 672404] {CVE-2011-0521}
  - [fs] sunrpc: Correct a misapplied patch (J. Bruce Fields) [678094 678146] {CVE-2011-0714}
  - [netdrv] orinoco: fix TKIP countermeasure behaviour (Stanislaw Gruszka) [667908 667909] {CVE-2010-4648}
  - [kernel] /proc/vmcore: speed up access to vmcore file (Neil Horman) [683442 672937]
  - [netdrv] cnic: Fix big endian bug (Steve Best) [678484 676640]
  - [scsi] fcoe: drop FCoE LOGO in FIP mode (Mike Christie) [683814 668114]
  - [s390x] remove task_show_regs (Danny Feng) [677854 677855] {CVE-2011-0710}
  - [ib] cm: Bump reference count on cm_id before invoking callback (Doug Ledford) [676190 676191] {CVE-2011-0695}
  - [rdma] cm: Fix crash in request handlers (Doug Ledford) [676190 676191] {CVE-2011-0695}
  - [net] bridge: Fix mglist corruption that leads to memory corruption (Herbert Xu) [678172 659421] {CVE-2011-0716}
  - [netdrv] r8169: use RxFIFO overflow workaround and prevent RxFIFO induced infinite loops (Ivan Vecera) [680080 630810]
  - [s390x] kernel: nohz vs cpu hotplug system hang (Hendrik Brueckner) [683815 668470]
  - [netdrv] cxgb3/cxgb3_main.c: prevent reading uninitialized stack memory (Doug Ledford) [633156 633157] {CVE-2010-3296}
  - [configs] redhat: added CONFIG_SECURITY_DMESG_RESTRICT option (Frantisek Hrbata) [683822 653245]
  - [kernel] restrict unprivileged access to kernel syslog (Frantisek Hrbata) [683822 653245]
  - [fs] cifs: allow matching of tcp sessions in CifsNew state (Jeff Layton) [683812 629085]
  - [fs] cifs: fix potential double put of TCP session reference (Jeff Layton) [683812 629085]
  - [fs] cifs: prevent possible memory corruption in cifs_demultiplex_thread (Jeff Layton) [683812 629085]
  - [fs] cifs: eliminate some more premature cifsd exits (Jeff Layton) [683812 629085]
  - [fs] cifs: prevent cifsd from exiting prematurely (Jeff Layton) [683812 629085]
  - [fs] CIFS: Make cifs_convert_address() take a const src pointer and a length (Jeff Layton) [683812 629085]
  - [kdump] kexec: accelerate vmcore copies by marking oldmem in /proc/vmcore as cached (Neil Horman) [683445 641315]
  - [virt] KVM: VMX: Disallow NMI while blocked by STI (Avi Kivity) [683783 616296]
  - [virt] kvm: write protect memory after slot swap (Michael S. Tsirkin) [683781 647367]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.21.1.el6]
changelog:
  - [netdrv] ixgbe: limit VF access to network traffic (Frantisek Hrbata) [684129 678717]
  - [netdrv] ixgbe: work around for DDP last buffer size (Frantisek Hrbata) [684129 678717]
  - [net] gro: reset dev and skb_iff on skb reuse (Andy Gospodarek) [688311 681970]
  - [x86] mtrr: Assume SYS_CFG[Tom2ForceMemTypeWB] exists on all future AMD CPUs (Frank Arnold) [683813 652208]
  - [virt] virtio_net: Add schedule check to napi_enable call (Michael S. Tsirkin) [684268 676579]
  - [s390x] mm: add devmem_is_allowed() for STRICT_DEVMEM checking (Hendrik Brueckner) [684267 647365]
  - [powerpc] Don't use kernel stack with translation off (Steve Best) [684266 628951]
  - [powerpc] Initialise paca->kstack before early_setup_secondary (Steve Best) [684266 628951]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.23.1.el6]
changelog:
  - [x86] Revert "[x86] mtrr: Assume SYS_CFG[Tom2ForceMemTypeWB] exists on all future AMD CPUs" (Frank Arnold) [683813 652208]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.24.1.el6]
changelog:
  - [fs] Revert "[fs] inotify: stop kernel memory leak on file creation failure" (Eric Paris) [656831 656832] {CVE-2010-4250}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.26.1.el6]
changelog:
  - [net] bnep: fix buffer overflow (Don Howard) [681315 681316] {CVE-2011-1079}
  - [scsi] aic94xx: world-writable sysfs update_bios file (Don Howard) [679306 679307]
  - [x86] tc1100-wmi: world-writable sysfs wireless and jogdial files (Don Howard) [679306 679307]
  - [x86] acer-wmi: world-writable sysfs threeg file (Don Howard) [679306 679307]
  - [mfd] ab3100: world-writable debugfs *_priv files (Don Howard) [679306 679307]
  - [v4l] sn9c102: world-wirtable sysfs files (Don Howard) [679306 679307]
  - [x86] Fix EFI pagetable to map whole memory (Takao Indoh) [670850 664364]
  - [kernel] CAP_SYS_MODULE bypass via CAP_NET_ADMIN (Phillip Lougher) [681772 681773] {CVE-2011-1019}
  - [kernel] failure to revert address limit override in OOPS error path (Dave Anderson) [659572 659573] {CVE-2010-4258}
  - [fs] xfs: zero proper structure size for geometry calls (Phillip Lougher) [677267 677268] {CVE-2011-0711}
  - [fs] xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 (Phillip Lougher) [677267 677268] {CVE-2011-0711}
  - [tty] tty_audit: fix tty_audit_add_data live lock on audit disabled (Danny Feng) [684275 680126]
  - [kernel] proc: protect mm start_code/end_code in /proc/pid/stat (Eugene Teo) [684572 684573] {CVE-2011-0726}
  - [net] dccp oops (Eugene Teo) [682957 682958] {CVE-2011-1093}
  - [firmware] dcdbas: force SMI to happen when expected (Shyam Iyer) [683440 664832]
  - [security] ima: fix add LSM rule bug (Eric Paris) [667914 667915] {CVE-2011-0006}
  - [sound] caiaq: Fix possible string buffer overflow (Jaroslav Kysela) [678475 678476] {CVE-2011-0712}
  - [net] ixgbe: add option to control interrupt mode (Andy Gospodarek) [670114 670110 622640 637332]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.27.1.el6]
changelog:
  - [scsi] megaraid: give FW more time to recover from reset (Tomas Henzl) [695322 692673]
  - [netdrv] ixgbe: fix for 82599 erratum on Header Splitting (Andy Gospodarek) [683820 669231]
  - [sound] ALSA: hda - nvhdmi: Add missing codec IDs, unify names (Jaroslav Kysela) [683817 636922]
  - [mm] pdpte registers are not flushed when PGD entry is changed in x86 PAE mode (Larry Woodman) [695256 691310]
  - [net] fix ebtables stack infoleak (Eugene Teo) [681322 681323] {CVE-2011-1080}
  - [drm] fix unsigned vs signed comparison issue in modeset ctl ioctl (Don Howard) [679927 679928] {CVE-2011-1013}
  - [pci] Enable ASPM state clearing regardless of policy (Alex Williamson) [694073 681017]
  - [pci] Disable ASPM if BIOS asks us to (Alex Williamson) [694073 681017]
  - [mm] do not keep kswapd awake for an unreclaimable zone (Johannes Weiner) [694186 633825]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.28.1.el6]
changelog:
  - [net] bonding: fix jiffy comparison issues (Andy Gospodarek) [698109 696337]
  - [drm] radeon/kms: check AA resolve registers on r300 + regression fix (Dave Airlie) [680001 680002] {CVE-2011-1016}
  - [infiniband] uverbs: Handle large number of entries in poll CQ (Eugene Teo) [688429 696137] {CVE-2011-1044 CVE-2010-4649}
  - [net] sctp: fix the INIT/INIT-ACK chunk length calculation (Thomas Graf) [695386 690743] {CVE-2011-1573}
  - [net] CAN: Use inode instead of kernel address for /proc file (Danny Feng) [664560 664561] {CVE-2010-4565}
  - [fs] inotify: fix double free/corruption of stuct user (Eric Paris) [656831 656832] {CVE-2010-4250}
  - [net] netfilter: ipt_CLUSTERIP: fix buffer overflow (Jiri Pirko) [689341 689342]
  - [net] bonding: change test for presence of VLANs (Jiri Pirko) [696487 683496]
  - [scsi] scsi_dh: fix reference counting in scsi_dh_activate error path (Mike Snitzer) [696889 680140]
  - [net] enable VLAN NULL tagging (Neil Horman) [683810 633571]
  - [scsi] scsi_dh: propagate SCSI device deletion (Mike Snitzer) [698114 669411]
  - [fs] inotify: stop kernel memory leak on file creation failure (Eric Paris) [656831 656832] {CVE-2010-4250}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-71.29.1.el6]
changelog:
  - [mm] Revert "[mm] pdpte registers are not flushed when PGD entry is changed in x86 PAE mode" (Larry Woodman) [695256 691310]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-62.el6]
changelog:
  - [drm] Revert matroxfb support for G200EV chip (Peter Bogdanovic) [604830]
  - [drm] i915: more DP/eDP backport fixes (Dave Airlie) [615058]
  - [drm] correctly update connector DPMS status in drm_fb_helper (Dave Airlie) [615058]
  - [x86] ACPI/PM: Move ACPI video resume to a PM notifier (Dave Airlie) [615058]
  - [virt] x86: preset lpj values when on VMware (Zachary Amsden) [617390]
  - [virt] Revert "vhost-net: utilize PUBLISH_USED_IDX feature" (Michael S. Tsirkin)
  - [virt] Revert "virtio: put last seen used index into ring itself" (Michael S. Tsirkin) [616503]
  - [virt] Revert "virtio: net: Remove net-specific advertising of PUBLISH_USED feature" (Michael S. Tsirkin) [616503]
  - [virt] vhost: max s/g to match qemu (Michael S. Tsirkin) [619002]
  - [kernel] sched: Fix set_cpu_active() in cpu_down() (Danny Feng) [620807]
  - [dm] separate device deletion from dm_put (Mike Snitzer) [619199]
  - [dm] prevent access to md being deleted (Mike Snitzer) [619199]
  - [dm] ioctl: release _hash_lock between devices in remove_all (Mike Snitzer) [619199]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-63.el6]
changelog:
  - [fs] ext4: protect io completion lists with locking (Eric Sandeen) [621660]
  - [trace] Packport new mm tracepoint Documentation to RHEL6 (Larry Woodman) [618305]
  - [virt] KVM: Trace exception injection (Gleb Natapov) [616427]
  - [s390x] qeth: Clear mac_bits field when switching between l2/l3 (Hendrik Brueckner) [621333]
  - [net] ethtool: Fix potential kernel buffer overflow in ETHTOOL_GRXCLSRLALL (Jiri Pirko) [608953] {CVE-2010-2478}
  - [infiniband] Update QLogic QIB InfiniBand driver to version OFED 1.5.2 (Jay Fenlason) [572401]
  - [fs] update RWA_MASK, READA and SWRITE to match the corresponding BIO_RW_ bits (Jeff Moyer) [621693]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-64.el6]
changelog:
  - [kernel] Revert "[kernel] sched: Fix a race between ttwu() and migrate_task()" (Matthew Garrett) [620883]
  - [fs] btrfs: fix checks in BTRFS_IOC_CLONE_RANGE (Eugene Teo) [617003] {CVE-2010-2537 CVE-2010-2538}
  - [kernel] Makefile.build: make KBUILD_SYMTYPES work again (Don Zickus) [617749]
  - [netdrv] iwlwifi: disable hardware scanning by default (Stanislaw Gruszka) [593566]
  - [scsi] Revert: qla2xxx: Propogate transport disrupted status for cable pull conditions for faster failover (Chad Dupuis) [622041]
  - [drm] radeon: Don't limit vram size to aperture size (Matthew Garrett) [622039]
  - [fs] xfs: don't walk AGs that can't hold inodes (Dave Chinner) [621044]
  - [mmc] add Ricoh e822 support (Stanislaw Gruszka) [619900]
  - [scsi] mvsas: fix hot plug handling and IO issues (David Milburn) [616178]
  - [dm] mpath: enable discard support (Mike Snitzer) [619196]
  - [block] update request stacking methods to support discards (Mike Snitzer) [619196]
  - [dm] stripe: enable discard support (Mike Snitzer) [619196]
  - [dm] stripe: optimize sector division (Mike Snitzer) [619196]
  - [dm] stripe: move sector translation to a function (Mike Snitzer) [619196]
  - [dm] error: return error for discards (Mike Snitzer) [619196]
  - [dm] delay: enable discard support (Mike Snitzer) [619196]
  - [dm] zero: silently drop discards (Mike Snitzer) [619196]
  - [dm] split discard requests on target boundaries (Mike Snitzer) [619196]
  - [dm] use dm_target_offset macro (Mike Snitzer) [619196]
  - [dm] factor out max_io_len_target_boundary (Mike Snitzer) [619196]
  - [dm] use common __issue_target_request for flush and discard support (Mike Snitzer) [619196]
  - [dm] rename map_info flush_request to target_request_nr (Mike Snitzer) [619196]
  - [dm] remove the DM_TARGET_SUPPORTS_DISCARDS feature flag (Mike Snitzer) [619196]
  - [dm] introduce num_discard_requests in dm_target structure (Mike Snitzer) [619196]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-65.el6]
changelog:
  - [fs] ext4: fix discard failure detection (Eric Sandeen) [608731]
  - [x86] Avoid potential NULL dereference in pcc-cpufreq (Matthew Garrett) [623768]
  - [scsi] bfa: vport create/delete fix (Rob Evers) [619226]
  - [net] tcp: fix crash in tcp_xmit_retransmit_queue (Jerome Marchand) [618386]
  - [build] Skip depmod when installing to non-standard INSTALL_MOD_PATH (Jon Masters) [609170]
  - [sound] disable NVIDIA HDMI PCI device for Lenovo T410 (Jaroslav Kysela) [605742]
  - [scsi] increase flush timeout (Mike Christie) [605322]
  - [x86] local_irq_save/restore when issuing IPI in early bootup (Prarit Bhargava) [602823]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-66.el6]
changelog:
  - [netdrv] be2net: maintain multicast packet count in driver (Ivan Vecera) [621287]
  - [scsi] hpsa: don't use doorbel reset (Tomas Henzl) [612486]
  - [x86] Fix the kdump kernel OOMs caused by passthrough mode setting (Bhavna Sarathy) [624059]
  - [acpi] Force "pci=noacpi" on HP xw9300 (Prarit Bhargava) [615276]
  - [mm] Revert mm-vmstat-Actively-update-vmstat-counters-in-low-memory-situations (Larry Woodman) [622328]
  - [x86] Run EFI in physical mode to enable kdump on EFI-booted system (Takao Indoh) [593111]
  - [fs] ext4: protect inode bitmap clearing w/ spinlock (Eric Sandeen) [623666]
  - [scsi] libfc: call fc_remote_port_chkready under the host lock (Mike Christie) [623786]
  - [x86] Ensure that we provide per-cpu ACPI support (Matthew Garrett) [623874]
  - [fs] ext4: consolidate in_range() definitions (Eric Sandeen) [621829]
  - [fs] ext4: fix NULL pointer dereference in tracing (Eric Sandeen) [619013]
  - [block] O_DIRECT: fix the splitting up of contiguous I/O (Jeff Moyer) [622504]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-67.el6]
changelog:
  - [x86] acpi: Update battery information on notification 0x81 (Matthew Garrett) [606388]
  - [mm] fix up some user-visible effects of the stack guard page (Mike Snitzer) [607859]
  - [mm] fix page table unmap for stack guard page properly (Mike Snitzer) [607859]
  - [x86] don't send SIGBUS for kernel page faults (Mike Snitzer) [607859]
  - [mm] fix missing page table unmap for stack guard page failure case (Mike Snitzer) [607859]
  - [mm] keep a guard page below a grow-down stack segment (Mike Snitzer) [607859]
  - [fs] xfs: fix untrusted inode number lookup (Dave Chinner) [624860]
  - [kernel] init, sched: Fix race between init and kthreadd (Gleb Natapov) [624329]
  - [net] Fix IGMP3 report parsing (Aristeu Rozanski) [621431]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-68.el6]
changelog:
  - [virt] xen pvhvm: don't start xenbus w/out pvhvm (Andrew Jones) [624665]
  - [virt] xen pvhvm: don't unplug emulated devs w/out pvhvm (Andrew Jones) [625460]
  - [virt] xen pvhvm: export xen_pv_hvm_enable (Andrew Jones) [625460]
  - [fs] ext4: fix one more tracing oops (Eric Sandeen) [619013]
  - [drm] Provide for HDMI output on NVIDIA GPUs (John Feeney) [619877]
  - [netdrv] iwlwifi: disable aspm by default (John Linville) [611075]
  - [x86] acpi: Update battery information on notification 0x81 (Matthew Garrett) [606388]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-69.el6]
changelog:
  - [mm] make stack guard page logic use vm_prev pointer (Mike Snitzer) [607859]
  - [mm] make the mlock() stack guard page checks stricter (Mike Snitzer) [607859]
  - [mm] make the vma list be doubly linked (Mike Snitzer) [607859]
  - [drm] nv50: insert a delay before fb change to prevent display engine hang (Ben Skeggs) [618225]
  - [mm] fix up some user-visible effects of the stack guard page (Mike Snitzer) [607859]
  - [net] sched: fix some kernel memory leaks (Jiri Pirko) [624637] {CVE-2010-2942}


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-70.el6]
changelog:
  - [x86] Disable AMD IOMMU by default (Matthew Garrett) [593787]
  - [netdrv] Revert "iwlwifi: disable hardware scanning by default" (Stanislaw Gruszka) [625981]
  - [s390x] kernel: fix tlb flushing vs. concurrent /proc accesses (Hendrik Brueckner) [587587]
  - [s390x] kernel: prepare mm_context_t for new tlb flush handling (Hendrik Brueckner) [587587]
  - [fs] NFS: Fix an Oops in the NFSv4 atomic open code (Jeff Layton) [625718]
  - [net] can: add limit for nframes and clean up signed/unsigned variables (Danny Feng) [625702] {CVE-2010-2959}
  - [fs] aio: bump i_count instead of using igrab (Jeff Moyer) [626595]
  - [fs] cifs: check for NULL session password (Jeff Layton) [625583]
  - [fs] cifs: fix NULL pointer dereference in cifs_find_smb_ses (Jeff Layton) [625583]


author: Aristeu Rozanski <arozansk@redhat.com> [2.6.32-71.el6]
changelog:
  - [fs] nfsd: initialize nfsd versions before creating svc (J. Bruce Fields) [628084]
  - [fs] nfsd: fix startup/shutdown order bug (J. Bruce Fields) [628084]
  - [security] KEYS: Fix bug in keyctl_session_to_parent() if parent has no session keyring (David Howells) [627808] {CVE-2010-2960}
  - [security] KEYS: Fix RCU no-lock warning in keyctl_session_to_parent() (David Howells) [627808] {CVE-2010-2960}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.2.1.el6]
changelog:
  - [x86] entry/64: Don't use IST entry for #BP stack (Waiman Long) [1596113] {CVE-2018-10872}
  - [fs] gfs2: Flush delayed work earlier in gfs2_inode_lookup (Andreas Grunbacher) [1506281]
  - [mm] mempolicy: fix use after free when calling get_mempolicy (Augusto Caringi) [1576757] {CVE-2018-10675}
  - [mm] Fix NULL pointer dereference in dequeue_hwpoisoned_huge_page() (Larry Woodman) [1381653]
  - [fs] NFSv4.1: Fix up replays of interrupted requests (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Simplify struct nfs4_sequence_args too (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Label each entry in the session slot tables with its slot number (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Shrink struct nfs4_sequence_res by moving the session pointer (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: nfs4_alloc_slots doesn't need zeroing (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: clean up nfs4_recall_slot to use nfs4_alloc_slots (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Fix a NFSv4.1 session initialisation regression (Benjamin Coddington) [1553423]
  - [scsi] ipr: Fix sync scsi scan (Gustavo Duarte) [1572310]
  - [scsi] ipr: Wait to do async scan until scsi host is initialized (Gustavo Duarte) [1572310]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.1.el6]
changelog:
  - [infiniband] ib/iser: Rewrite bounce buffer code path (Don Dutile) [1585312]
  - [sound] alsa: pcm: prevent UAF in snd_pcm_info (CVE-2017-0861) (Jaroslav Kysela) [1565188] {CVE-2017-0861}
  - [sound] alsa: seq: Fix racy pool initializations (Jaroslav Kysela) [1550176] {CVE-2018-7566}
  - [sound] alsa: seq: Fix use-after-free at creating a port (Jaroslav Kysela) [1503383] {CVE-2017-15265}
  - [sound] alsa: seq: Make ioctls race-free (Jaroslav Kysela) [1537452] {CVE-2018-1000004}
  - [mm] reduce total RAM held in per-CPU pvecs by flushing them on compound/THP page arrival (Larry Woodman) [1575819]
  - [usb] acm: fix the computation of the number of data bits (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [misc] spectre: fix gadgets found by smatch scanner, part 2 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] kvm/vmx: Remove barrier_nospec() in slot_largepage_idx() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kvm] Remove memory alias support (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [misc] spectre: fix gadgets found by smatch scanner (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: rme9652: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: opl3: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: hda: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: seq: oss: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: seq: oss: Fix unbalanced use lock for synth MIDI device (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [net] atm: Fix potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] posix-timers: Protect posix clock array access against speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] sys.c: fix potential Spectre v1 issue (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] sched/autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[] (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [ipc] sysvipc/sem: mitigate semnum index against spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: control: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [media] dvb_ca_en50221: prevent using slot_info for Spectre attacs (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - media] dvb_ca_en50221: sanity check slot number from userspace (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [atm] zatm: Fix potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] perf: Fix possible Spectre-v1 indexing for x86_pmu::event_map() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] perf: Fix possible Spectre-v1 indexing for hw_perf_event cache_* (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [net] nl80211: Sanitize array index in parse_txq_params (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] vfs, fdtable: Prevent bounds-check bypass via speculative execution (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] syscall: Sanitize syscall table de-references under speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [powerpc] Use barrier_nospec in copy_from_user() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Introduce barrier_nospec for other arches (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Introduce barrier_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] spectre_v1: Disable compiler optimizations over array_index_mask_nospec() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Implement array_index_mask_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [documentation] Document array_index_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Include <asm/barrier.h> dependency (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Allow index argument to have const-qualified type (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Kill array_index_nospec_mask_check() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Move array_index_nospec() parameter checking into separate macro (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] array_index_nospec: Sanitize speculative array de-references (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] get_user: Use pointer masking to limit speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Introduce __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] reorganize SMAP handling in user space accesses (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] uaccess: Tell the compiler that uaccess is unlikely to fault (Josh Poimboeuf) [1589032] {CVE-2018-3693}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.4.1.el6]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Frantisek Hrbata) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Simplify p[g4um]d_page() macros (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Fix regression with huge pages on PAE (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Move PUD_PAGE macros to page_types.h (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rb_to_skb() and other rb tree helpers (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rbnode to struct sk_buff (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Florian Westphal) [1611376] {CVE-2018-5390}
  - [x86] syscall: Fix regression when using the last syscall (process_vm_writev) (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [x86] syscall: Fix regression on strace and stap (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301) (Paolo Bonzini) [1601851] {CVE-2018-10901}
  - [x86] Initialize __max_smt_threads to 1 (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: detect SMT disabled by BIOS (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Add topology_max_smt_threads() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix incorrect error return code in vm_insert_pfn() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Don't flush L1D cache if VMENTER_L1D_FLUSH_NEVER (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Take out the unused nosmt module parameter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm/dump_pagetables: Add a check_l1tf debugfs file (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries aganst L1TF for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Make flush_l1d visible in /proc/cpuinfo (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [Documentation] Add section about CPU vulnerabilities (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs, kvm: Introduce boot-time control of L1TF mitigations (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Expose SMT control init function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Online siblings when SMT control is turned on (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add find_msr() helper function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush logic (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Make indirect call speculation safe (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Enable acknowledge interupt on vmexit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D MSR based flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush algorithm (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add module argument for L1TF mitigation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] x86: Introducing kvm_x86_ops VM init/destroy hooks (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] Revert "x86/apic: Ignore secondary threads if nosmt=force" (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpufeatures: Add detection of L1D cache flush support. (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Limit swap file size to MAX_PA/2 (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Add sysfs reporting for l1tf (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PROT_NONE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries against L1TF (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Change order of offset/type in swap entry (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Fix incorrect vulnerabilities files function prototypes (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Export the internal __cpu_bugs variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] intel-family.h: Add GEMINI_LAKE SOC (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Move swap offset/type up in PTE to work around erratum (Waiman Long) [1593376] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.5.1.el6]
changelog:
  - [s390] dasd: fix IO error for newly defined devices (Hendrik Brueckner) [1574448]
  - [s390] dasd: fix failing path verification (Hendrik Brueckner) [1581684]
  - [s390] qeth: on channel error, reject further cmd requests (Hendrik Brueckner) [1562009]
  - [s390] qdio: fix access to uninitialized qdio_q fields (Hendrik Brueckner) [1581685]
  - [powerpc] stf-barrier: update (rfi_)enabled_flush_types as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update debugfs as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update handle_ssbd() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update stf_barrier_enable() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: add cpu_show_spec_store_bypass() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: add comment as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: move code from setup_64.c to security.c as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: move code from setup.h to security_features.h as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update fallback routine as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update entry barrier slot as in upstream (Gustavo Duarte) [1585299]
  - [x86] Add host_initiated check in reading MSR_AMD64_VIRT_SPEC_CTRL (Wei Huang) [1608576]
  - [x86] KVM: pass host_initiated to functions that read MSRs (Wei Huang) [1608576]
  - [fs] gfs2: Special-case rindex for gfs2_grow (Robert S Peterson) [1384184]
  - [fs] Revert "[fs] gfs2: Special case the rindex in gfs2_write_alloc_required()" (Robert S Peterson) [1384184]
  - [net] ip: process in-order fragments efficiently (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: add helpers to process in-order fragments faster. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ipv6: defrag: drop non-last frags smaller than min mtu (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: use rb trees for IP frag queue. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: discard IPv4 datagrams with overlapping segments. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] net: modify skb_rbtree_purge to return the truesize of all purged skbs. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] net: speed up skb_rbtree_purge() (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] skbuff: Rename RHEL6 version of skb_tree_purge() to skb_tree_purge_sk() (Stefano Brivio) [1613925] {CVE-2018-5391}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.6.1.el6]
changelog:
  - [x86] set __max_smt_threads for 1 core systems (Prarit Bhargava) [1623255]
  - [md] dm rq: fix a race condition in rq_completed() (Ming Lei) [1574568]
  - [scsi] scsi_transport_fc: Hold queue lock while calling blk_run_queue_async() (Ming Lei) [1574568]
  - [block] Avoid scheduling delayed work on a dead queue (Ming Lei) [1574568]
  - [block] Avoid that request_fn is invoked on a dead queue (Ming Lei) [1574568]
  - [block] Let blk_drain_queue() caller obtain the queue lock (Ming Lei) [1574568]
  - [block] Rename queue dead flag (Ming Lei) [1574568]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.7.1.el6]
changelog:
  - [s390] cio: update chpid descriptor after resource accessibility event (Hendrik Brueckner) [1574471]
  - [s390] af_iucv: enable control sends in case of SEND_SHUTDOWN (Hendrik Brueckner) [1559048]
  - [s390] qeth: repair SBAL elements calculation (Hendrik Brueckner) [1559021]
  - [kvm] VMX: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1628796]
  - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1628796]
  - [x86] KVM: VMX: skip L1TF flush on VM-entry if EPT is disabled (Marcelo Tosatti) [1616397]
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625976] {CVE-2018-14634}
  - [fs] exec.c: account for argv/envp pointers (Yauheni Kaliuta) [1625976] {CVE-2018-14634}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.8.1.el6]
changelog:
  - [block] fix warning on lockdep_assert_held(q->queue_lock) (Ming Lei) [1624747]
  - [kvm] vmx: fix vmwrite to invalid VMCS (Radim Krcmar) [1602011]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.10.1.el6]
changelog:
  - [net] sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close (Xin Long) [1646405]
  - [x86] kvm: Update cpuid properly when CR4.OSXAVE or CR4.PKE is changed (Wei Huang) [1425051]
  - [mm] mempolicy: migrate_to_node should only migrate to node (Rafael Aquini) [1577094]
  - [mm] vmscan: avoid possible deadlock caused by too_many_isolated() (Rafael Aquini) [1577094]
  - [fs] seqfile: always allow oom killer (Rodrigo Freire) [1632434]
  - [fs] seq_file: fallback to vmalloc instead of oom kill processes (Rodrigo Freire) [1632434]
  - [fs] seq_file: fallback to vmalloc allocation (Rodrigo Freire) [1632434]
  - [fs] proc/stat: convert to single_open_size() (Rodrigo Freire) [1632434]
  - [fs] seq_file: always clear m->count when we free m->buf (Rodrigo Freire) [1632434]
  - [fs] seq_file: single_open_size() new helper (Rodrigo Freire) [1632434]
  - [fs] stat: Use size_t for sizes instead of unsigned (Rodrigo Freire) [1632434]
  - [fs] proc: speed up /proc/stat handling (Rodrigo Freire) [1632434]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.11.1.el6]
changelog:
  - [x86] mm/fault: Allow stack access below rsp (Waiman Long) [1644401]
  - [sound] alsa: rawmidi: Change resized buffers atomically (Denys Vlasenko) [1593083] {CVE-2018-10902}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.12.1.el6]
changelog:
  - [x86] vDSO: Don't generate retpoline for indirect call (Waiman Long) [1638552]
  - [fs] cifs: fix reparse point/symlink breakage (Leif Sahlberg) [1636484]
  - [scsi] qla2xxx: Mask off Scope bits in retry delay (Himanshu Madhani) [1588133]
  - [net] tcp: make tcp_retransmit_timer a no-op on empty write queue (Paolo Abeni) [1585892]
  - [kernel] sched/sysctl: Check user input value of sysctl_sched_time_avg (Lauro Ramos Venancio) [1579128]
  - [fs] Fix up non-directory creation in SGID directories (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] hugetlbfs: switch to inode_init_owner() (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] udf: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ubifs: replace inode uid, gid, mode initialization with helper function (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ramfs: replace inode uid, gid, mode initialization with helper function (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ext4: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ext3: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ext2: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] btrfs: replace inode uid, gid, mode initialization with helper function (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] vfs: Add inode uid,gid,mode init helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [s390] kernel: adapt to changed CPU vulnerabilities function prototypes (Hendrik Brueckner) [1625381]
  - [s390] detect etoken facility (Hendrik Brueckner) [1625381]
  - [s390] Correct register corruption in critical section cleanup (Hendrik Brueckner) [1625381]
  - [s390] remove indirect branch from do_softirq_own_stack (Hendrik Brueckner) [1625381]
  - [s390] move spectre sysfs attribute code (Hendrik Brueckner) [1625381]
  - [s390] kernel: use expoline for indirect branches (Hendrik Brueckner) [1625381]
  - [s390] ftrace: use expoline for indirect branches (Hendrik Brueckner) [1625381]
  - [s390] move expoline assembler macros to a header (Hendrik Brueckner) [1625381]
  - [s390] correct module section names for expoline code revert (Hendrik Brueckner) [1625381]
  - [x86] speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit (Oleksandr Natalenko) [1670328]
  - [perf] Fix a race between ring_buffer_detach() and ring_buffer_attach() (Jiri Olsa) [1589340]
  - [perf] Fix mmap() accounting hole (Jiri Olsa) [1627672]
  - [perf] Fix perf mmap bugs (Jiri Olsa) [1627672]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.14.2.el6]
changelog:
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kernel] sched/smt: Provide sched_smt_active() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Provide arch_smt_update() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/mm: Fix compilation warning in pgtable_types.h (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.1.el6]
changelog:
  - [x86] x86/speculation: Don't print MDS_MSG_SMT message if mds_nosmt specified (Waiman Long) [1710081 1710517]
  - [x86] x86/spec_ctrl: Fix incorrect MDS handling in late microcode loading (Waiman Long) [1710081 1710517]
  - [x86] x86/speculation: Fix misuse of boot_cpu_has() with bug bits (Waiman Long) [1710121]
  - [x86] x86/speculation/mds: Fix documentation typo (Waiman Long) [1710517]
  - [documentation] Documentation: Correct the possible MDS sysfs values (Waiman Long) [1710517]
  - [x86] x86/mds: Add MDSUM variant to the MDS documentation (Waiman Long) [1710517]
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Waiman Long) [1710517]
  - [x86] x86/speculation/mds: Fix comment (Waiman Long) [1710517]
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kernel] sched/smt: Provide sched_smt_active() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Provide arch_smt_update() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/mm: Fix compilation warning in pgtable_types.h (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.2.el6]
changelog:
  - [lib] idr: free the top layer if idr tree has the maximum height (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix top layer handling (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix backtrack logic in idr_remove_all (Denys Vlasenko) [1698139] {CVE-2019-3896}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.3.el6]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719840] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719585] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719585] {CVE-2019-11477}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.16.1.el6]
changelog:
  - [virt] xenbus: Fix memory leak on release (Vitaly Kuznetsov) [1661666]
  - [fs] dcache: fix locking around setting DCACHE_SHRINKING flag (Miklos Szeredi) [1672269]
  - [x86] KVM: SVM: Selective cr0 intercept (Wei Huang) [1655873]
  - [x86] KVM: SVM: Restore unconditional cr0 intercept under npt (Wei Huang) [1655873]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.17.1.el6]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719840] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719585] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719585] {CVE-2019-11477}
  - [lib] idr: free the top layer if idr tree has the maximum height (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix top layer handling (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix backtrack logic in idr_remove_all (Denys Vlasenko) [1698139] {CVE-2019-3896}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.18.1.el6]
changelog:
  - [virt] xenbus: don't look up transaction IDs for ordinary writes (Vitaly Kuznetsov) [1663262]
  - [virt] xenbus: don't BUG() on user mode induced condition (Vitaly Kuznetsov) [1663262]
  - [virt] xenbus: Add proper handling of XS_ERROR from Xenbus for transactions (Vitaly Kuznetsov) [1663262]
  - [fs] proc: restrict kernel stack dumps to root (Denys Vlasenko) [1638193] {CVE-2018-17972}
  - [crypto] salsa20 - fix blkcipher_walk API usage (Bruno Eduardo de Oliveira Meneguele) [1543984]
  - [mm] vmscan: do not loop on too_many_isolated for ever (Rafael Aquini) [1658254]
  - [x86] spec_ctrl: Don't report the use of retpoline on Skylake as vulnerable (Waiman Long) [1666102]
  - [mm] try harder to allocate vmemmap blocks (Rafael Aquini) [1591394]
  - [v4l] dvb: revert spectre v1 mitigation (Josh Poimboeuf) [1647975]
  - [fs] binfmt_misc.c: do not allow offset overflow (Bill O'Donnell) [1710149]
  - [x86] pti: Don't use PCID and INVPCID in x86-32 (Waiman Long) [1702782]
  - [mm] mincore.c: make mincore() more conservative (Rafael Aquini) [1664197] {CVE-2019-5489}
  - [x86] spec: Move retp_compiler() inline function to bugs.c (Waiman Long) [1722185]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.18.2.el6]
changelog:
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-748.el6]
changelog:
  - [mm] fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE (Bhupesh Sharma) [1494380]
  - [mm] brk: fix min_brk lower bound computation for COMPAT_BRK (Bhupesh Sharma) [1494380]
  - [mm] split ET_DYN ASLR from mmap ASLR (Bhupesh Sharma) [1494380]
  - [s390] redefine randomize_et_dyn for ELF_ET_DYN_BASE (Bhupesh Sharma) [1494380]
  - [mm] expose arch_mmap_rnd when available (Bhupesh Sharma) [1494380]
  - [s390] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [s390] mmap: randomize mmap base for bottom up direction (Bhupesh Sharma) [1494380]
  - [powerpc] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [x86] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: create Kconfig variable for PIE randomization (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: PIE: make PF_RANDOMIZE check comment more accurate (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: fix PIE execution with randomization disabled (Bhupesh Sharma) [1494380]
  - [acpi] acpica: Support calling _REG methods within ACPI interpreter (Lenny Szubowicz) [1522849]
  - [acpi] acpica: Function to test if ACPI interpreter already entered (Lenny Szubowicz) [1522849]
  - [acpi] acpica: Function to test if ACPI mutex held by this thread (Lenny Szubowicz) [1522849]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-749.el6]
changelog:
  - [powerpc] pseries: Restore default security feature flags on setup (Mauricio Oliveira) [1561788]
  - [powerpc] Move default security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Fix clearing of security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Wire up cpu_show_spectre_v2() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Wire up cpu_show_spectre_v1() (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Use the security flags in pseries_setup_rfi_flush() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Enhance the information in cpu_show_meltdown() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Move cpu_show_meltdown() (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Set or clear security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] Add security feature flags for Spectre/Meltdown (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Add new H_GET_CPU_CHARACTERISTICS flags (Mauricio Oliveira) [1561788]
  - [lib] seq: Add seq_buf_printf() (Mauricio Oliveira) [1561788]
  - [powerpc] rfi-flush: Call setup_rfi_flush() after LPM migration (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Differentiate enabled and patched flush types (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Always enable fallback flush on pseries (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Make it possible to call setup_rfi_flush() again (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Move the logic to avoid a redo into the debugfs code (Mauricio Oliveira) [1561786]
  - [x86] pti/32: Don't use trampoline stack on Xen PV (Waiman Long) [1562725]
  - [x86] pti: Use boot_cpu_has(X86_FEATURE_PTI_SUPPORT) for early call sites (Waiman Long) [1562725]
  - [x86] pti: Set X86_FEATURE_PTI_SUPPORT early (Waiman Long) [1562725]
  - [x86] pti: Rename X86_FEATURE_NOPTI to X86_FEATURE_PTI_SUPPORT (Waiman Long) [1562725]
  - [x86] pti/32: Fix setup_trampoline_page_table() bug (Waiman Long) [1562725]
  - [x86] entry: Remove extra argument in call instruction (Waiman Long) [1562552]
  - [x86] syscall: Fix ia32_ptregs handling bug in 64-bit kernel (Waiman Long) [1557562 1562552]
  - [x86] efi/64: Align efi_pgd on even page boundary (Waiman Long) [1558845]
  - [x86] pgtable/pae: Revert "Use separate kernel PMDs for user page-table" (Waiman Long) [1558845]
  - [x86] pgtable/pae: Revert "Unshare kernel PMDs when PTI is enabled" (Waiman Long) [1558845]
  - [x86] mm: Dump both kernel & user page tables at fault (Waiman Long) [1558845]
  - [x86] entry/32: Fix typo in PARANOID_EXIT_TO_KERNEL_MODE (Waiman Long) [1558845]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-750.el6]
changelog:
  - [fs] fuse: fix punching hole with unaligned end (Miklos Szeredi) [1387473] {CVE-2017-15121}
  - [documentation] kdump: fix documentation about panic_on_warn to match rhel6 (Pingfan Liu) [1555196]
  - [fs] Provide sane values for nlink (Leif Sahlberg) [1554342]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-751.el6]
changelog:
  - [md] dm thin: fix regression that caused discards to be disabled if passdown was (Mike Snitzer) [1569377]
  - [s390] configs: enable auto expoline support (Hendrik Brueckner) [1554959]
  - [s390] correct nospec auto detection init order (Hendrik Brueckner) [1554959]
  - [s390] add sysfs attributes for spectre (Hendrik Brueckner) [1554959]
  - [s390] report spectre mitigation via syslog (Hendrik Brueckner) [1554959]
  - [s390] add automatic detection of the spectre defense (Hendrik Brueckner) [1554959]
  - [s390] move nobp parameter functions to nospec-branch.c (Hendrik Brueckner) [1554959]
  - [s390] do not bypass BPENTER for interrupt system calls (Hendrik Brueckner) [1554959]
  - [s390] Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) (Hendrik Brueckner) [1554959]
  - [s390] introduce execute-trampolines for branches (Hendrik Brueckner) [1554959]
  - [s390] run user space and KVM guests with modified branch prediction (Hendrik Brueckner) [1554959]
  - [s390] add optimized array_index_mask_nospec (Hendrik Brueckner) [1554959]
  - [s390] scrub registers on kernel entry and KVM exit (Hendrik Brueckner) [1554959]
  - [s390] align and prepare spectre mitigation for upstream commits (Hendrik Brueckner) [1554959]
  - [x86] xen: do not use xen_info on HVM, set pv_info name to "Xen HVM" (Vitaly Kuznetsov) [1568241]
  - [net] sctp: verify size of a new chunk in _sctp_make_chunk() (Stefano Brivio) [1551908] {CVE-2018-5803}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-752.el6]
changelog:
  - [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1572487]
  - [fs] fix WARNING in rmdir() (Miklos Szeredi) [1282117]
  - [net] sctp: label accepted/peeled off sockets (Marcelo Leitner) [1571357]
  - [net] security: export security_sk_clone (Marcelo Leitner) [1571357]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-753.el6]
changelog:
  - [x86] vm86-32: Properly set up vm86-32 stack for task switching (Waiman Long) [1572865]
  - [x86] spec_ctrl: Enable IBRS and RSB stuffing in 32-bit interrupts (Waiman Long) [1571362]
  - [x86] entry/32: Fix regressions in 32-bit debug exception (Waiman Long) [1571362]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.el6]
changelog:
  - [powerpc] 64s: Add support for a store forwarding barrier at kernel entry/exit (Mauricio Oliveira) [1581053] {CVE-2018-3639}
  - [x86] amd: Disable AMD SSBD mitigation in a VM (Waiman Long) [1580360]
  - [x86] spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Rename _RDS to _SSBD (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566899] {CVE-2018-3639}
  - [kernel] prctl: Add speculation control prctls (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] kvm: Expose the RDS bit to the guest (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs/AMD: Add support to disable RDS on Fam(15, 16, 17)h if requested (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Expose the /sys/../spec_store_bypass and X86_BUG_SPEC_STORE_BYPASS (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpu/intel: Knight Mill and Moorefield update to intel-family.h (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] speculation: Update Speculation Control microcode blacklist (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Clean up Spectre v2 related CPUID flags (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Add AMD feature bits for Speculation Control (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Add Intel feature bits for Speculation (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Add CPUID_7_EDX CPUID leaf (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] Extend RH cpuinfo to 10 extra words (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] invpcid: Enable 'noinvpcid' boot parameter for X86_32 (Waiman Long) [1560494]
  - [x86] dumpstack_32: Fix kernel panic in dump_trace (Waiman Long) [1577351]
  - [fs] gfs2: For fs_freeze, do a log flush and flush the ail1 list (Robert S Peterson) [1569148]
  - [net] dccp: check sk for closed state in dccp_sendmsg() (Stefano Brivio) [1576586] {CVE-2018-1130}
  - [net] ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped (Stefano Brivio) [1576586] {CVE-2018-1130}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.1.1.el6]
changelog:
  - [x86] microcode: Fix CPU synchronization routine (Prarit Bhargava) [1574592]
  - [x86] microcode: Synchronize late microcode loading (Prarit Bhargava) [1574592]
  - [x86] microcode: Request microcode on the BSP (Prarit Bhargava) [1574592]
  - [x86] microcode: Sanitize per-cpu microcode reloading interface (Prarit Bhargava) [1574592]
  - [x86] virt_spec_ctrl: Set correct host SSDB value for AMD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Eliminate TIF_SSBD checks in IBRS on/off functions (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Disable SSBD update from scheduler if not user settable (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Make ssbd_enabled writtable (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Remove thread_info check in __wrmsr_on_cpu() (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Write per-thread SSBD state to spec_ctrl_pcp (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Add a read-only ssbd_enabled debugfs file (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Switch the selection of mitigation from CPU vendor to CPU features (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Add AMD's SPEC_CTRL MSR usage (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Add AMD's variant of SSB_NO (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs/intel: Set proper CPU features and setup RDS (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Rework spec_ctrl base and mask logic (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Rework SPEC_CTRL update after late microcode loading (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Make sync_all_cpus_ibrs() write spec_ctrl_pcp value (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Unify x86_spec_ctrl_{set_guest, restore_host} (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Rework speculative_store_bypass_update() (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Add virtualized speculative store bypass disable support (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM: Rename KVM SPEC_CTRL MSR functions to match upstream (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Handle HT correctly on AMD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Add FEATURE_ZEN (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle SSBD enumeration (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Use synthetic bits for IBRS/IBPB/STIBP (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Fix missing void (Waiman Long) [1584356] {CVE-2018-3639}
  - [documentation] spec_ctrl: Do some minor cleanups (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Make "seccomp" the default mode for Speculative Store Bypass (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Move speculation migitation control to arch code (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Use PR_SPEC_FORCE_DISABLE (Waiman Long) [1584356] {CVE-2018-3639}
  - [uapi] prctl: Add force disable speculation (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Enable speculation flaw mitigations (Waiman Long) [1584356] {CVE-2018-3639}
  - [fs] proc: Provide details on speculation flaw mitigations (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] nospec: Allow getting/setting on non-current task (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Show IBPB in the Spectre_v2 sysfs file (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] pti: Check MSR_IA32_ARCH_CAPABILITIES for Meltdown vulnearability (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up naming of SPEC_CTRL MSR bits with upstream (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] pti: Fix kexec warning on debug kernel (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] kvm/fpu: Enable eager FPU restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] always enable eager FPU by default (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Load xsave pointer *after* initialization (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fix 32-bit signal frame handling (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Always restore_xinit_state() when use_eager_cpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Rename drop_init_fpu() to fpu_reset_state() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fix math_state_restore() race with kernel_fpu_begin() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fold __drop_fpu() into its sole user (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't abuse drop_init_fpu() in flush_thread() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Introduce restore_init_xstate() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Document user_fpu_begin() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Factor out memset(xstate, 0) in fpu_finit() paths (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Change xstateregs_get()/set() to use ->xsave.i387 rather than ->fxsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Always allow FPU in interrupt if use_eager_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't abuse has_fpu in __kernel_fpu_begin/end() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Introduce per-cpu in_kernel_fpu state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Check tsk_used_math() in kernel_fpu_end() for eager FPU (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Change math_error() to use unlazy_fpu(), kill (now) unused save_init_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Merge simd_math_error() into math_error() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't do __thread_fpu_end() if use_eager_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't reset thread.fpu_counter (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: shift drop_init_fpu() from save_xstate_sig() to handle_signal() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Allow FPU to be used at interrupt time even with eagerfpu (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387.c: Initialize thread xstate only on CPU0 only once (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] kvm: fix kvm's usage of kernel_fpu_begin/end() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] rhel: initialize scattered CPUID features early (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: make eagerfpu= boot param tri-state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: enable eagerfpu by default for xsaveopt (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: decouple non-lazy/eager fpu restore from xsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: use non-lazy fpu restore for processors supporting xsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: remove unnecessary user_fpu_end() in save_xstate_sig() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: drop_fpu() before restoring new state from sigframe (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Unify signal handling code paths for x86 and x86_64 kernels (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: drop the fpu state during thread exit (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] signals: ia32_signal.c: add __user casts to fix sparse warnings (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Consolidate inline asm routines for saving/restoring fpu state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] signal: Cleanup ifdefs and is_ia32, is_x32 (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu/xsave: Keep __user annotation in casts (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] debug: Add KERN_<LEVEL> to bare printks, convert printks to pr_<level> (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] extable: Remove open-coded exception table entries in arch/x86/include/asm/xsave.h (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: Split up <asm/i387.h> into exported and internal interfaces (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: Uninline the generic FP helpers that we expose to kernel modules (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: (DON'T ACTUALLY) support lazy restore of FPU state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: use 'restore_fpu_checking()' directly in task switching code (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: fix up some fpu_counter confusion (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: re-introduce FPU state preloading at context switch time (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move TS_USEDFPU flag from thread_info to task_struct (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move AMD K7/K8 fpu fxsave/fxrstor workaround from save to restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: do not preload FPU state at task switch time (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: don't ever touch TS_USEDFPU directly, use helper functions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move TS_USEDFPU clearing out of __save_init_fpu and into callers (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: fix x86-64 preemption-unsafe user stack save/restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: math_state_restore() isn't called from asm (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fix potentially dangerous trailing '; ' in #defined values/expressions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-32, fpu: Fix FPU exception handling on non-SSE systems (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Fix common misspellings (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] kvm: Initialize fpu state in preemptible context (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge fpu_save_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-32, fpu: Rewrite fpu_save_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Remove PSHUFB_XMM5_* macros (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Remove unnecessary ifdefs from i387 code. (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Simplify constraints for fxsave/fxtstor (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Fix cs value in convert_from_fxsr() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Disable preemption when using TS_USEDFPU (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge __save_init_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge tolerant_fwait() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge fpu_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Disable xsave in i387 emulation mode (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Make xstate_enable_boot_cpu() __init, protect on CPU 0 (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Add __init attribute to setup_xstate_features() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Make init_xstate_buf static (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Check cpuid level for XSTATE_CPUID (0x0d) (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Introduce xstate enable functions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Do not include asm/i387.h in asm/xsave.h (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Avoid unnecessary __clear_user() and xrstor in signal handling (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Cleanup return codes in check_for_xstate() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Separate fpu and xsave initialization (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Move boot cpu initialization to xsave_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Revert "[x86] fpu: change save_i387_xstate() to rely on unlazy_fpu()" (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Revert "[x86] fpu: shift clear_used_math() from save_i387_xstate() to handle_signal()" (Paolo Bonzini) [1589047] {CVE-2018-3665}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.19.1.el6]
changelog:
  - [net] tcp: be more careful in tcp_fragment() (Marcelo Leitner) [1732107]
  - [net] tcp: refine memory limit test in tcp_fragment() (Florian Westphal) [1728931]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.20.1.el6]
changelog:
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.21.1.el6]
changelog:
  - [scsi] scsi: megaraid_sas: return error when create DMA pool failed (Tomas Henzl) [1712858] {CVE-2019-11810}
  - [net] net: Set sk_prot_creator when copying sockets to the right proto (Andrea Claudi) [1657117] {CVE-2018-9568}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.24.1.el6]
changelog:
  - [net] ip: Don't leak head fragment on queue timeout (Stefano Brivio) [1752536]
  - [vhost] vhost_net: fix possible infinite loop (Eugenio Perez) [1702941]
  - [vhost] vhost: introduce vhost_exceeds_weight() (Eugenio Perez) [1702941]
  - [vhost] vhost_net: introduce vhost_exceeds_weight() (Eugenio Perez) [1702941]
  - [vhost] vhost_net: use packet weight for rx handler, too (Eugenio Perez) [1702941]
  - [vhost] vhost-net: set packet weight of tx polling to 2 * vq size (Eugenio Perez) [1702941]
  - [x86] x86/pti: Fix incorrect global bit setting with PTI on (Waiman Long) [1645724]
  - [x86] spec_ctrl: disable IBRS in idle, part 2 (Rafael Aquini) [1560787]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.24.2.el6]
changelog:
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [kvm] KVM: introduce no_huge_pages module parameter (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86/spec_ctrl/taa: Enable TAA status change after late microcode (Waiman Long) [1766531] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766531] {CVE-2019-11135}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Disable read-only support under GVT (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] erm/i915/gtt: Read-only pages for insert_entries on bdw+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Add read only pages to gen8_pte_encode (Dave Airlie) [1756891] {CVE-2019-0155}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.25.1.el6]
changelog:
  - [kvm] KVM: VMX: Set VMENTER_L1D_FLUSH_NOT_REQUIRED if !X86_BUG_L1TF (Waiman Long) [1733760]
  - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746799] {CVE-2019-14821}
  - [virt] KVM: MMIO: Lock coalesced device when checking for available entry (Bandan Das) [1746799] {CVE-2019-14821}
  - [scsi] scsi: bnx2fc: Handle scope bits when array returns BUSY or TSF (Nilesh Javali) [1749512]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'task', 'port', 'orig_task' (Nilesh Javali) [1749512]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'lport', 'host' (Nilesh Javali) [1749512]
  - [security] KEYS: prevent creating a different user's keyrings (David Howells) [1537371]
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [kvm] KVM: introduce no_huge_pages module parameter (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86/spec_ctrl/taa: Enable TAA status change after late microcode (Waiman Long) [1766531] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766531] {CVE-2019-11135}
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Denys Vlasenko) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Disable read-only support under GVT (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] erm/i915/gtt: Read-only pages for insert_entries on bdw+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Add read only pages to gen8_pte_encode (Dave Airlie) [1756891] {CVE-2019-0155}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.26.1.el6]
changelog:
  - [s390] scsi: zfcp: fix reaction on bit error threshold notification (Philipp Rudo) [1764544]
  - [drm] vmwgfx: refuse to hibernate if we have any resources v2 (Kenneth Yin) [1748195]
  - [fs] CIFS: avoid using MID 0xFFFF (Leif Sahlberg) [1739948]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.27.1.el6]
changelog:
  - [mm] mempolicy: fix a memory corruption by refcount imbalance in alloc_pages_vma() (Waiman Long) [1785321]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.28.1.el6]
changelog:
  - [netdrv] ixgbevf: Use cached link state instead of re-reading the value for ethtool (Ken Cox) [1795404]
  - [isdn] mISDN: enforce CAP_NET_RAW for raw sockets (Andrea Claudi) [1779473] {CVE-2019-17055}
  - [net] cfg80211: wext: avoid copying malformed SSIDs (Jarod Wilson) [1778625] {CVE-2019-17133}
  - [netdrv] bonding: speed/duplex update at NETDEV_UP event (Patrick Talbert) [1772779]
  - [netdrv] bonding: make speed, duplex setting consistent with link state (Patrick Talbert) [1772779]
  - [netdrv] bonding: simplify / unify event handling code for 3ad mode (Patrick Talbert) [1772779]
  - [netdrv] bonding: unify all places where actor-oper key needs to be updated (Patrick Talbert) [1772779]
  - [netdrv] bonding: simple code refactor (Patrick Talbert) [1772779]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.29.1.el6]
changelog:
  - [wireless] rtlwifi: Fix potential overflow on P2P code (Jarod Wilson) [1775226] {CVE-2019-17666}
  - [x86] mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes (Denys Vlasenko) [1485759]
  - [powerpc] powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB (Denys Vlasenko) [1485759]
  - binfmt_elf: use ELF_ET_DYN_BASE only for PIE (Denys Vlasenko) [1485759]
  - [powerpc] powerpc: Use generic PIE randomization (Denys Vlasenko) [1485759]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.2.el6]
changelog:
  - [kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301) (Paolo Bonzini) [1601851] {CVE-2018-10901}
  - [x86] Initialize __max_smt_threads to 1 (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: detect SMT disabled by BIOS (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Add topology_max_smt_threads() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix incorrect error return code in vm_insert_pfn() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Don't flush L1D cache if VMENTER_L1D_FLUSH_NEVER (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Take out the unused nosmt module parameter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm/dump_pagetables: Add a check_l1tf debugfs file (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries aganst L1TF for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Make flush_l1d visible in /proc/cpuinfo (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [Documentation] Add section about CPU vulnerabilities (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs, kvm: Introduce boot-time control of L1TF mitigations (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Expose SMT control init function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Online siblings when SMT control is turned on (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add find_msr() helper function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush logic (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Make indirect call speculation safe (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Enable acknowledge interupt on vmexit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D MSR based flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush algorithm (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add module argument for L1TF mitigation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] x86: Introducing kvm_x86_ops VM init/destroy hooks (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] Revert "x86/apic: Ignore secondary threads if nosmt=force" (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpufeatures: Add detection of L1D cache flush support. (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Limit swap file size to MAX_PA/2 (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Add sysfs reporting for l1tf (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PROT_NONE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries against L1TF (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Change order of offset/type in swap entry (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Fix incorrect vulnerabilities files function prototypes (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Export the internal __cpu_bugs variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] intel-family.h: Add GEMINI_LAKE SOC (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Move swap offset/type up in PTE to work around erratum (Waiman Long) [1593376] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.3.el6]
changelog:
  - [x86] syscall: Fix regression when using the last syscall (process_vm_writev) (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [x86] syscall: Fix regression on strace and stap (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.4.el6]
changelog:
  - [x86] x86/mm: Simplify p[g4um]d_page() macros (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Fix regression with huge pages on PAE (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Move PUD_PAGE macros to page_types.h (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rb_to_skb() and other rb tree helpers (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rbnode to struct sk_buff (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Florian Westphal) [1611376] {CVE-2018-5390}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.5.el6]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Frantisek Hrbata) [1593376] {CVE-2018-3620}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.30.1.el6]
changelog:
  - [net] netlabel: cope with NULL catmap (Paolo Abeni) [1827226] {CVE-2020-10711}
  - [netdrv] bonding: don't set slave->link in bond_update_speed_duplex() (Patrick Talbert) [1828604]
  - [security] KEYS: prevent KEYCTL_READ on negative key (Patrick Talbert) [1498368] {CVE-2017-12192}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.30.2.el6]
changelog:
  - x86/speculation: Provide SRBDS late microcode loading support (Waiman Long)
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu/bugs: Convert to new matching macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add consistent CPU match macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/devicetable: Move x86 specific macro out of generic code (Waiman Long) [1827185] {CVE-2020-0543}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.31.1.el6]
changelog:
  - [x86] x86/speculation: Provide SRBDS late microcode loading support (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu/bugs: Convert to new matching macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add consistent CPU match macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/devicetable: Move x86 specific macro out of generic code (Waiman Long) [1827185] {CVE-2020-0543}
  - [netdrv] bonding/802.3ad: fix link_failure_count tracking (Patrick Talbert) [1841819]
  - [mm] mm: migration: add migrate_entry_wait_huge() (Waiman Long) [1839653]
  - [powerpc] powerpc/book3s64: Fix link stack flush on context switch (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: support nospectre_v2 cmdline option (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/security: Fix spectre_v2 reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Update Spectre v2 reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Add nospectre_v2 command line argument (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Fix spectre_v2 mitigations reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/pseries: Query hypervisor for count cache flush settings (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add support for software count cache flush (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add new security feature flags for count cache flush (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/asm: Add a patch_site macro & helpers for patching instructions (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Make meltdown reporting Book3S 64 specific (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Call setup_barrier_nospec() from setup_arch() (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Make stf barrier PPC_BOOK3S_64 specific (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Gustavo Duarte) [1796810]
  - [powerpc] powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Enhance the information in cpu_show_spectre_v1() (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Use barrier_nospec in syscall entry (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Enable barrier_nospec based on firmware settings (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Patch barrier_nospec in modules (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add support for ori barrier_nospec patching (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add barrier_nospec (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Add helper to check if offset is within relative branch range (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Have patch_instruction detect faults (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Introduce asm-prototypes.h (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Move local setup.h declarations to arch includes (Gustavo Duarte) [1796810]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.32.1.el6]
changelog:
  - [wireless] libertas: make lbs_ibss_join_existing() return error code on rates overflow (Jarod Wilson) [1776569]
  - [wireless] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held (Jarod Wilson) [1776569]
  - [wireless] libertas: Fix two buffer overflows at parsing bss descriptor (Jarod Wilson) [1776569]
  - [security] keys: Protect request_key() against a type with no match function (Patrick Talbert) [1433220] {CVE-2017-2647}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.34.1.el6]
changelog:
  - [mm] mm: prevent get_user_pages() from overflowing page refcount (Aristeu Rozanski) [1705003]
  - [mm] mm/hugetlb.c: __get_user_pages ignores certain follow_hugetlb_page errors (Aristeu Rozanski) [1705003]


author: Imran Khan <imran.f.khan@oracle.com> [2.6.32-754.35.1.0.2.el6.OL6]
changelog:
  - x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508) (Andy Lutomirski) [Orabug: 32148837]
  - x86_32, entry: Store badsys error code in %eax (Sven Wegener) [Orabug: 32148837]


author: Mridula Shastry <mridula.c.shastry@oracle.com> [2.6.32-754.35.1.0.4.el6.OL6]
changelog:
  - seq_file: disallow extremely large seq buffer allocations (CVE-2021-33909) (Eric Sandeen) [Orabug: 33137331]


author: Mridula Shastry <mridula.c.shastry@oracle.com> [2.6.32-754.35.1.0.5.el6.OL6]
changelog:
  - [kernel] futex: Use pi_state_update_owner() in put_pi_state() (Thomas Gleixner) [1922249] {CVE-2021-3347} [Orabug: 33150734]
  - [kernel] futex: Handle faults correctly for PI futexes (Thomas Gleixner) [1922249] {CVE-2021-3347} [Orabug: 33150734]
  - [kernel] futex: Provide and use pi_state_update_owner() (Thomas Gleixner) [1922249] {CVE-2021-3347}[Orabug: 33150734]
  - [kernel] futex: Replace pointless printk in fixup_owner() (Thomas Gleixner) [1922249] {CVE-2021-3347} [Orabug: 33150734]
  - [kernel] futex: Ensure the correct return value from futex_lock_pi() (Thomas Gleixner) [1922249] {CVE-2021-3347} [Orabug: 33150734]
  - [drm] drm/i915/guc: Disable firmware loading on i915 option (Dave Airlie) [1930246] {CVE-2020-12362} [Orabug: 33150734]


author: Mridula Shastry <mridula.c.shastry@oracle.com> [2.6.32-754.35.1.0.6.el6.OL6]
changelog:
  - do_epoll_ctl(): clean the failure exits up a bit (Marc Zyngier) {CVE-2020-0466} [Orabug: 34086960]
  - epoll: Keep a reference on files added to the check list (Al Viro) {CVE-2020-0466} [Orabug: 34086960]
  - fix regression in "epoll: Keep a reference on files added to the check list (Al Viro) {CVE-2021-1048} [Orabug: 34086960]
  - net: split out functions related to registering inflight socket files (Jens Axboe) [Orabug: 34086960]
  - af_unix: fix garbage collect vs MSG_PEEK (Miklos Szeredi) {CVE-2021-0920}  [Orabug: 34086960]
  - xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate (Darrick J. Wong) {CVE-2021-4155} [Orabug: 34086960]
  - cgroup-v1: Require capabilities to set release_agent (Waiman Long) {CVE-2022-0492} [Orabug: 34086960]


author: Mridula Shastry <mridula.c.shastry@oracle.com> [2.6.32-754.35.1.0.7.el6.OL6]
changelog:
  - bluetooth: eliminate the potential race condition when removing the HCI controller (Lin Ma) {CVE-2021-32399} [Orabug: 33763116]
  - RDMA/ucma: Put a lock around every call to the rdma_cm layer (Jason Gunthorpe) [Orabug: 33763116]
  - RDMA/cma: Add missing locking to rdma_accept() (Leon Romanovsky) [Orabug: 33763116]
  - RDMA/ucma: Fix the locking of ctx->file (Leon Romanovsky) [Orabug: 33763116]
  - RDMA/ucma: Rework ucma_migrate_id() to avoid races with destroy (Jason Gunthorpe) {CVE-2020-36385} [Orabug: 33763116]


author: Mridula Shastry <mridula.c.shastry@oracle.com> [2.6.32-754.35.1.0.8.el6.OL6]
changelog:
  - Fix epoll: Keep a reference on files added to the check list (Julian Pidancet) {CVE-2020-0466} [Orabug: 34625224]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.6.2.el6]
changelog:
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625976] {CVE-2018-14634}
  - [fs] exec.c: account for argv/envp pointers (Yauheni Kaliuta) [1625976] {CVE-2018-14634}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-754.6.3.el6]
changelog:
  - [kvm] VMX: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1628796]
  - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1628796]
  - [x86] KVM: VMX: skip L1TF flush on VM-entry if EPT is disabled (Marcelo Tosatti) [1616397]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-746.el6]
changelog:
  - [dm] fix race between dm_get_from_kobject() and __dm_destroy() (Mike Snitzer) [1551999] {CVE-2017-18203}
  - [x86] pti: Disable kaiser_add_mapping if X86_FEATURE_NOPTI (Waiman Long) [1557562]
  - [x86] irq/ioapic: Check for valid irq_cfg pointer in smp_irq_move_cleanup_interrupt (Waiman Long) [1550599] {CVE-2017-5754}
  - [x86] kexec/64: Clear control page after PGD init (Waiman Long) [1550599] {CVE-2017-5754}
  - [x86] efi/64: Fix potential PTI data corruption problem (Waiman Long) [1550599] {CVE-2017-5754}
  - [ipmi] pick up slave address from SMBIOS on an ACPI device (Tony Camuso) [1484525]
  - [ipmi] fix watchdog timeout set on reboot (Tony Camuso) [1484525]
  - [ipmi] fix watchdog hang on panic waiting for ipmi response (Tony Camuso) [1484525]
  - [ipmi] use smi_num for init_name (Tony Camuso) [1484525]
  - [ipmi] move platform device creation earlier in the initialization (Tony Camuso) [1484525]
  - [ipmi] clean up printks (Tony Camuso) [1484525]
  - [ipmi] cleanup error return (Tony Camuso) [1484525]
  - [md] raid0: apply base queue limits *before* disk_stack_limits (Xiao Ni) [1417294]
  - [md] raid0: update queue parameter in a safer location (Xiao Ni) [1417294]
  - [md] raid0: conditional mddev->queue access to suit dm-raid (Xiao Ni) [1417294]
  - [md] raid0: access mddev->queue (request queue member) conditionally because it is not set when accessed from dm-raid (Xiao Ni) [1417294]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-747.el6]
changelog:
  - [fs] gfs2: Check for the end of metadata in trunc_dealloc (Robert S Peterson) [1559928]
  - [fs] gfs2: clear journal live bit in gfs2_log_flush (Robert S Peterson) [1559928]
  - [netdrv] vmxnet3: fix tx data ring copy for variable size (Neil Horman) [1530378]
  - [mm] account skipped entries to avoid looping in find_get_pages (Dave Wysochanski) [1559386]
  - [powerpc] pseries: Support firmware disable of RFI flush (Mauricio Oliveira) [1554631]
  - [powerpc] pseries: Add H_GET_CPU_CHARACTERISTICS flags & wrapper (Mauricio Oliveira) [1554631]
  - [powerpc] 64s: Allow control of RFI flush via debugfs (Mauricio Oliveira) [1554630]
  - [powerpc] 64s: Improve RFI L1-D cache flush fallback (Mauricio Oliveira) [1554630]
  - [powerpc] 64s: Wire up cpu_show_meltdown() (Mauricio Oliveira) [1554630]


author: Chuck Anderson [2.6.32-100.28.8.el6]
changelog:
  - [block] check for proper length of iov entries earlier in blk_rq_map_user_iov
    (Xiaotian Feng) {CVE-2010-4668}
  - scm: lower SCM_MAX_FD (Eric Dumazet) {CVE-2010-4249}
  - perf_events: Fix perf_counter_mmap() hook in mprotect() (Pekka Enberg)
    {CVE-2010-4169}
  - tcp: Increase TCP_MAXSEG socket option minimum (David S. Miller)
    {CVE-2010-4165}
  - Enable module force load option [orabug 11782146]
  - Enable vmw balloon and pvscsi (Guru Anbalagane) [orabug 11697522]


author: Joe Jin [2.6.32-100.28.10.el6]
changelog:
  - Use cciss for some Smart Array controller for OL5 [orabug 11899706]
  - CVEs from RHSA-2011-0421
  - install_special_mapping skips security_file_mmap check {CVE-2010-4346}
  - orinoco: fix TKIP countermeasure behaviour {CVE-2010-4648}
  - net: clear heap allocation for ethtool_get_regs() {CVE-2010-4655}
  - usb: iowarrior: don't trust report_size for buffer size {CVE-2010-4656}
  - [media] [v3,media] av7110: check for negative array offset {CVE-2011-0521}
  - RDMA/cma: Fix crash in request handlers {CVE-2011-0695}
  - IB/cm: Bump reference count on cm_id before invoking callback {CVE-2011-0695}
  - gro: reset skb_iif on reuse {CVE-2011-1478}


author: Joe Jin [2.6.32-100.28.11.el6]
changelog:
  - fs/partitions: Validate map_count in Mac partition tables {CVE-2011-1010}
  - nfs4: Ensure that ACL pages sent over NFS were not allocated from 
    the slab (v3) {CVE-2011-1090}


author: Joe Jin [2.6.32-100.28.14.el6]
changelog:
  - IB/qib: fix qib compile warning.
  - IB/core: Allow device-specific per-port sysfs files.
  - dm crypt: add plain64 iv.
  - firmware: add firmware for qib.
  - Infiniband: Add QLogic PCIe QLE InfiniBand host channel adapters support.


author: Joe Jin [2.6.32-100.28.15.el6]
changelog:
  - sctp: fix to calc the INIT/INIT-ACK chunk length correctly is set {CVE-2011-1573}
  - dccp: fix oops on Reset after close {CVE-2011-1093}
  - bridge: netfilter: fix information leak {CVE-2011-1080}
  - Bluetooth: bnep: fix buffer overflow {CVE-2011-1079}
  - net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules {CVE-2011-1019}
  - ipip: add module alias for tunl0 tunnel device
  - gre: add module alias for gre0 tunnel device
  - drm/radeon/kms: check AA resolve registers on r300 {CVE-2011-1016}
  - drm/radeon: fix regression with AA resolve checking {CVE-2011-1016}
  - drm: fix unsigned vs signed comparison issue in modeset ctl ioctl {CVE-2011-1013}
  - proc: protect mm start_code/end_code in /proc/pid/stat {CVE-2011-0726}
  - ALSA: caiaq - Fix possible string-buffer overflow {CVE-2011-0712}
  - xfs: zero proper structure size for geometry calls {CVE-2011-0711}
  - xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 {CVE-2011-0711}
  - ima: fix add LSM rule bug {CVE-2011-0006}
  - IB/uverbs: Handle large number of entries in poll CQ {CVE-2010-4649, CVE-2011-1044}
  - CAN: Use inode instead of kernel address for /proc file {CVE-2010-4565}


author: Joe Jin [2.6.32-100.28.16.el6]
changelog:
  - kernel: Fix unlimited socket backlog DoS {CVE-2010-4251}
  - RDS: Fix congestion issues for loopback
  - rds: prevent BUG_ON triggering on congestion map updates {CVE-2011-1023}
  - epoll: prevent creating circular epoll structures {CVE-2011-1082}
  - fs: fix corrupted OSF partition table parsing {CVE-2011-1163}
  - fs: Increase OSF partition limit from 8 to 18 {CVE-2011-1163}
  - netfilter: arp_tables: fix infoleak to userspace {CVE-2011-1170}
  - netfilter: ip_tables: fix infoleak to userspace {CVE-2011-1171}
  - ipv6: netfilter: ip6_tables: fix infoleak to userspace {CVE-2011-1172}
  - [SCSI] mpt2sas: prevent heap overflows and unchecked reads {CVE-2011-1494, CVE-2011-1495}


author: Kevin Lyons [2.6.32-100.25.13.el6]
changelog:
  - Make sure call to weak-modules in post and preun sections works
    for debug package [bug 11676741]


author: Guru Anbalagane [2.6.32-100.25.16.el6]
changelog:
  - Add hpsa support 2.0.2-2
  - [kexec] premit reduction of the reserved memory size (Joe Jin) [orabug 11076466]


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.32-200.0.1.el6]
changelog:
  - scsi: Add some new functions for libfc and fcoe from upstream.
  - scsi: adjust call parameter in fnic for new libfc APIs.
  - [SCSI] bnx2fc: Broadcom FCoE offload driver
  - dm mpath: hold io until all pg_inits completed
  - dm mpath: disable blk_abort_queue
  - dm mpath: fail message ioctl if specified path is not valid
  - dm mpath: allow table load with no priority groups
  - Merge pvhvm backport to UEK
  - x86, mm: avoid possible bogus tlb entries by clearing prev mm_cpumask after sw
  - ixgbe: fix for 82599 erratum on Header Splitting
  - dm crypt: add plain64 iv [orabug 11697886]


author: Joe Jin <joe.jin@oracle.com> [2.6.32-200.0.2.el6]
changelog:
  - [SCSI] scsi_dh_rdac: Add TP9700 into device list
  - [SCSI] scsi_dh_rdac: Add ArrayStorage into device list
  - [SCSI] cciss: Add unresettable table for kdump.
  - [SCSI] hpsa: Add unresettable table for kdump.
  - [SCSI] isci: Move firmware file
  - [USB] usb: build ehci_hcd into kernel


author: Joe Jin <joe.jin@oracle.com> [2.6.32-200.0.4.el6]
changelog:
  - IB/core: Allow device-specific per-port sysfs files
  - IB/qib: fix qib compile warning.
  - RDMA/cxgb4: Add driver for Chelsio T4 RNIC.
  - net: Print num_rx_queues imbalance warning only when there are allocated queues


author: Joe Jin <joe.jin@oracle.com> [2.6.32-100.31.2.el6uek]
changelog:
  - [virt] xen-blkfront: add missing define for vdisk.
  - [virt] xen-blkfront: merge some fixes.
  - [firmware] bnx2x: remove useless firmware files
  - ALSA: caiaq - Fix possible string-buffer overflow
  - [input] wacom: update Wacom tablet driver.
  - [SCSI] mvsas: update to version 0.8.2.
  - [SCSI] fnic: update fcoe_libfc_config() to reflect fcoe update.
  - [SCSI] bnx2fc: updata fcoe_ctlr_recv_flogi to reflect fcoe update.
  - [SCSI] megaraid_sas: updata driver to version 00.00.05.34-rc1
  - [SCSI] mptsas: upgrade version to 08.101.00.00
  - [SCSI] isci: merge fixes for isci
  - x86: Introduce pci_map_biosrom()
  - [SCSI] lpfc: update version to 8.3.5.30.1p.
  - [SCSI] ipr: Fix a race on multiple configuration changes
  - [SCSI] libsas: merged some fixes
  - [SCSI] fcoe: merge some fixes for fcoe
  - lib/random32: export pseudo-random number generator for modules
  - [SCSI] libfc: merge some fixes from rhel6u1
  - [SCSI] hpsa: upgrade to version 2.0.2-3
  - [netdrv] bonding: update version to 3.6.0.
  - [netdrv] sfc: update to version 3.0
  - ethtool: Add ethtool_reset flags
  - net: Fix definition of netif_vdbg() when VERBOSE_DEBUG is not defined
  - qlcnic: limit skb frags for non tso packet
  - [netdrv] enic: update to version 2.1.1.13
  - [SCSI] bfa: add tech preview info for bfad.
  - [netdrv] bna: Avoid kernel panic in case of FW heartbeat failure
  - [netdrv] igb: upgrade igb to 3.0.6-k2
  - [netdrv] netxen: limit skb frags for non tso packet
  - [SCSI] be2scsi: Upgrade be2iscsi to 2.103.298.0
  - [netdrv] be2net: merge RHEL6U1 be2net fixes.
  - [netdrv] niu: Fix races between up/down and get_stats.
  - [netdrv] update bnx2, bnx2x firmware
  - [SCSI] bnx2fc: upgrade driver ot 1.0.2
  - [netdrv] cnic: upgrade driver to 2.2.14
  - [netdrv] bnx2: upgrade driver to 2.1.6.
  - [netdrv] bnx2x: upgrade to 1.62.00-6
  - [INFINIBAND] RDMA/cxgb4: driver upgrade!
  - [netdrv] Adding Chelsio Firmware for cxgb4.
  - [SCSI] export fc_exch_mgr_list_clone.
  - dcbnl: adding DCBX feature flags get-set
  - dcbnl: add appliction tlv handlers
  - dcbnl: adding DCBX engine capability
  - dcbnl: add __GENKSYMS__ trick for ieee8021Qaz ops
  - dcbnl: add support for ieee8021Qaz attributes
  - remove DCB_PROTO_VERSION as we don't do netlink versioning
  - kernel: Fix unlimited socket backlog DoS {CVE-2010-4251}
  - RDS: Fix congestion issues for loopback
  - rds: prevent BUG_ON triggering on congestion map updates {CVE-2011-1023}
  - epoll: prevent creating circular epoll structures {CVE-2011-1082}
  - fs: fix corrupted OSF partition table parsing {CVE-2011-1163}
  - fs: Increase OSF partition limit from 8 to 18 {CVE-2011-1163}
  - netfilter: arp_tables: fix infoleak to userspace {CVE-2011-1170}
  - netfilter: ip_tables: fix infoleak to userspace {CVE-2011-1171}
  - ipv6: netfilter: ip6_tables: fix infoleak to userspace {CVE-2011-1172}
  - [SCSI] mpt2sas: prevent heap overflows and unchecked reads {CVE-2011-1494, CVE-2011-1495}
  - sctp: fix to calc the INIT/INIT-ACK chunk length correctly is set {CVE-2011-1573}
  - dccp: fix oops on Reset after close {CVE-2011-1093}
  - bridge: netfilter: fix information leak {CVE-2011-1080}
  - Bluetooth: bnep: fix buffer overflow {CVE-2011-1079}
  - net: don't allow CAP_NET_ADMIN to load non-netdev kernel modules {CVE-2011-1019}
  - ipip: add module alias for tunl0 tunnel device
  - gre: add module alias for gre0 tunnel device
  - drm/radeon/kms: check AA resolve registers on r300 {CVE-2011-1016}
  - drm/radeon: fix regression with AA resolve checking {CVE-2011-1016}
  - drm: fix unsigned vs signed comparison issue in modeset ctl ioctl {CVE-2011-1013}
  - proc: protect mm start_code/end_code in /proc/pid/stat {CVE-2011-0726}
  - ALSA: caiaq - Fix possible string-buffer overflow {CVE-2011-0712}
  - xfs: zero proper structure size for geometry calls {CVE-2011-0711}
  - xfs: prevent leaking uninitialized stack memory in FSGEOMETRY_V1 {CVE-2011-0711}
  - ima: fix add LSM rule bug {CVE-2011-0006}
  - IB/uverbs: Handle large number of entries in poll CQ {CVE-2010-4649, CVE-2011-1044}
  - CAN: Use inode instead of kernel address for /proc file {CVE-2010-4565}
  - IB/qib: fix qib compile warning.
  - IB/core: Allow device-specific per-port sysfs files.
  - dm crypt: add plain64 iv.
  - firmware: add firmware for qib.
  - Infiniband: Add QLogic PCIe QLE InfiniBand host channel adapters support.


author: Joe Jin [2.6.32-100.32.1.el6uek]
changelog:
  - [x86] mce: Add HW_ERR printk prefix for hardware error logging
  - [86] mce: Drop the default decoding notifier
  - [86] MCE: Do not taint when handling correctable errors
  - [mce] edac: Use an atomic notifier for MCEs decoding
  - [netdrv] mlx4: merged some fixes for mlx4
  - [kernel]: add pr_*_once, pr_*_ratelimited family


author: Joe Jin [2.6.32-100.35.1.el6uek]
changelog:
  - [net] dccp: handle invalid feature options length {CVE-2011-1770}
  - [net] can: add missing socket check in can/raw release {CVE-2011-1748}
  - [net] can: Add missing socket check in can/bcm release {CVE-2011-1598}


author: Joe Jin [2.6.32-100.37.1.el6uek]
changelog:
  - [net] gre: fix netns vs proto registration ordering {CVE-2011-1767}
  - [net] tunnels: fix netns vs proto registration ordering {CVE-2011-1768}


author: Guru Anbalagane [2.6.32-200.10.6.el6uek]
changelog:
  - Add entropy generation to nics (John Sobecki) [10622900]
  - [SCSI] compat_ioct: fix bsg SG_IO [orabug 12732464]
  - ipc/sem.c: error path in try_atomic_semop() left spinlock locked


author: Guru Anbalagane [2.6.32-200.10.7.el6uek]
changelog:
  - [net] gre: fix netns vs proto registration ordering {CVE-2011-1767}
  - [net] tunnels: fix netns vs proto registration ordering {CVE-2011-1768}
  - [rps] don't free rx_queue until netdevice is freed (Dave Kleikamp) [orabug 11071685]


author: Guru Anbalagane [2.6.32-200.10.8.el6uek]
changelog:
  - block: export blk_{get,put}_queue() (Jens Axboe)
  - [SCSI] Fix oops caused by queue refcounting failure (James Bottomley)
  - [dm-mpath] maintain reference count for underlying devices (Martin K. Petersen)


author: Joe Jin [2.6.32-200.17.1.el6uek]
changelog:
  - net: Fix memory leak/corruption on VLAN GRO_DROP {CVE-2011-1576}
  - iommu-api: Extension to check for interrupt remapping {CVE-2011-1898}
  - KVM: IOMMU: Disable device assignment without interrupt remapping {CVE-2011-1898}
  - ext4: Fix max file size and logical block counting of extent format file {CVE-2011-2695}
  - nl80211: fix overflow in ssid_len {CVE-2011-2517}
  - Bluetooth: Prevent buffer overflow in l2cap config request {CVE-2011-2497}
  - proc: fix a race in do_io_accounting() {CVE-2011-2495}
  - proc: restrict access to /proc/PID/io {CVE-2011-2495}
  - Bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace {CVE-2011-2492}
  - NLM: Don't hang forever on NLM unlock requests {CVE-2011-2491}
  - ksm: fix NULL pointer dereference in scan_get_next_rmap_item() {CVE-2011-2183}


author: Maxim Uvarov [2.6.32-200.20.1.el6uek]
changelog:
  - af_packet: prevent information leak {CVE-2011-2898}
  - gro: Only reset frag0 when skb can be pulled {CVE-2011-2723}
  - vm: fix vm_pgoff wrap in stack expansion {CVE-2011-2496}
  - vm: fix vm_pgoff wrap in upward expansion {CVE-2011-2496}
  - taskstats: don't allow duplicate entries in listener mode {CVE-2011-2484}
  - Ecryptfs: Add mount option to check uid of device being mounted {CVE-2011-1833}


author: Guru Anbalagane [2.6.32-200.21.1.el6uek]
changelog:
  - PCI: Set device power state to PCI_D0 for device without native PM support 
    (Ajaykumar Hotchandani) [orabug 13033435]


author: Joe Jin [2.6.32-200.22.1.el6uek]
changelog:
  - ipv6: make fragment identifications less predictable (Joe Jin) {CVE-2011-2699}
  - vlan: fix panic when handling priority tagged frames (Joe Jin) {CVE-2011-3593}
  - ipv6: udp: fix the wrong headroom check (Maxim Uvarov) {CVE-2011-4326}
  - b43: allocate receive buffers big enough for max frame len + offset (Maxim Uvarov) {CVE-2011-3359}
  - fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message (Maxim Uvarov) {CVE-2011-3353}
  - cifs: fix possible memory corruption in CIFSFindNext (Maxim Uvarov) {CVE-2011-3191}
  - crypto: md5 - Add export support (Maxim Uvarov) {CVE-2011-2699}
  - fs/partitions/efi.c: corrupted GUID partition tables can cause kernel oops (Maxim Uvarov) {CVE-2011-1577}
  - block: use struct parsed_partitions *state universally in partition check code (Maxim Uvarov)
  - net: Compute protocol sequence numbers and fragment IDs using MD5. (Maxim Uvarov) {CVE-2011-3188}
  - crypto: Move md5_transform to lib/md5.c (Maxim Uvarov) {CVE-2011-3188}
  - perf tools: do not look at ./config for configuration (Maxim Uvarov) {CVE-2011-2905}
  - Make TASKSTATS require root access (Maxim Uvarov) {CVE-2011-2494}
  - TPM: Zero buffer after copying to userspace (Maxim Uvarov) {CVE-2011-1162}
  - TPM: Call tpm_transmit with correct size (Maxim Uvarov){CVE-2011-1161}
  - fnic: fix panic while booting in fnic(Xiaowei Hu)
  - Revert "PCI hotplug: acpiphp: set current_state to D0 in register_slot" (Guru Anbalagane)
  - xen: drop xen_sched_clock in favour of using plain wallclock time (Jeremy Fitzhardinge)


author: Joe Jin [2.6.32-200.23.1.el6uek]
changelog:
  - net: Remove atmclip.h to prevent break kabi check.
  - KConfig: add CONFIG_UEK5=n to ol6/config-generic


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.32-300.3.1.el6uek]
changelog:
  - proc: fix oops on invalid /proc/<pid>/maps access (Linux Torvalds)
  - Revert "capabilities: do not grant full privs for setuid w/ file caps + no
    effective caps" (Joe Jin)
  - [mm]: Use MMF_COMPAT instead ia32_compat to prevent kabi be broken (Joe Jin)
  - proc: enable writing to /proc/pid/mem (Stephen Wilson)
  - proc: make check_mem_permission() return an mm_struct on success (Stephen Wilson)
  - proc: hold cred_guard_mutex in check_mem_permission() (Joe Jin)
  - proc: disable mem_write after exec (Stephen Wilson)
  - mm: implement access_remote_vm (Stephen Wilson)
  - mm: factor out main logic of access_process_vm (Stephen Wilson)
  - mm: use mm_struct to resolve gate vma's in __get_user_pages (Stephen Wilson)
  - mm: arch: rename in_gate_area_no_task to in_gate_area_no_mm (Stephen Wilson)
  - mm: arch: make in_gate_area take an mm_struct instead of a task_struct
    (Stephen Wilson)
  - mm: arch: make get_gate_vma take an mm_struct instead of a task_struct
    (Stephen Wilson)
  - x86: mark associated mm when running a task in 32 bit compatibility mode
    (Stephen Wilson)
  - x86: add context tag to mark mm when running a task in 32-bit compatibility
    mode (Stephen Wilson)
  - auxv: require the target to be tracable (or yourself) (Al Viro)
  - close race in /proc/*/environ (Al Viro)
  - report errors in /proc/*/*map* sanely (Al Viro)
  - pagemap: close races with suid execve (Al Viro)
  - make sessionid permissions in /proc/*/task/* match those in /proc/* (Al Viro)
  - Revert "report errors in /proc/*/*map* sanely" (Joe Jin)
  - Revert "proc: fix oops on invalid /proc/<pid>/maps access" (Joe Jin)


author: Joe Jin <joe.jin@oracle.com> [2.6.32-300.4.1.el6uek]
changelog:
  - [pci] intel-iommu: Default to non-coherent for domains unattached to iommus (Joe Jin)
  - [dm] do not forward ioctls from logical volumes to the underlying device (Joe Jin) {CVE-2011-4127}
  - [block] fail SCSI passthrough ioctls on partition devices (Joe Jin) {CVE-2011-4127}
  - [block] add and use scsi_blk_cmd_ioctl (Joe Jin) {CVE-2011-4127}
  - [net] gro: reset vlan_tci on reuse (Dan Carpenter) {CVE-2011-1576}
  - [net] rose: Add length checks to CALL_REQUEST parsing (Ben Hutchings) {CVE-2011-1493}
  - [net] rose_loopback_timer sets VC number <= ROSE_DEFAULT_MAXVC (Bernard Pidoux F6BVP) {CVE-2011-1493}


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.32-300.5.1.el6uek]
changelog:
  - sched, x86: Avoid unnecessary overflow in sched_clock (Salman Qazi) [orabug 13604567]
  - [x86]: Don't resume/restore cpu if not of the expected cpu (Joe Jin) [orabug 13492670]
  - drm/i915: Rephrase pwrite bounds checking to avoid any potential overflow (Chris Wilson) [CVE-2010-296]
  - x2apic: Enable the bios request for x2apic optout (Suresh Siddha) [orabug 13565303]
  - fuse: split queues to scale I/O throughput (Srinivas Eeda) [orabug 10004611]
  - fuse: break fc spinlock (Srinivas Eeda) [orabug 10004611]


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.32-300.7.1.el6uek]
changelog:
  - Revert "proc: enable writing to /proc/pid/mem" [orabug 13619701] {CVE-2012-0056}
  - [PATCH] x86, tsc: Skip TSC synchronization checks for tsc=reliable (Suresh Siddha)


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.32-300.8.1.el6uek]
changelog:
  - SPEC: fix dependency on firmware/mkinitrd (Guru Anbalagane) [orabug 13637902]
  - xfs: fix acl count validation in xfs_acl_from_disk() (Dan Carpenter)
  - [SCSI] scsi_dh: check queuedata pointer before proceeding further (Moger Babu)
   [orabug 13615419]


author: Joe Jin <joe.jin@oracle.com> [2.6.32-300.9.1.el6uek]
changelog:
  - [netdrv] fnic: return zero on fnic_reset() success (Joe Jin)
  - [e1000e] Add entropy generation back for network interrupts (John Sobecki)
  - [nfs4] LINUX CLIENT TREATS NFS4ERR_GRACE AS A PERMANENT ERROR [orabug 13476821] (John Sobecki)
  - [nfs] NFS CLIENT CONNECTS TO SERVER THEN DISCONNECTS [orabug 13516759] (John Sobecki)
  - [sunrpc] Add patch for a mount crash in __rpc_create_common [orabug 13322773] (John Sobecki)


author: Joe Jin <joe.jin@oracle.com> [2.6.32-300.11.1.el6uek]
changelog:
  - [fs] xfs: Fix possible memory corruption in xfs_readlink (Carlos Maiolino) {CVE-2011-4077}
  - [scsi] increase qla2xxx firmware ready time-out (Joe Jin)
  - [scsi] qla2xxx: Module parameter to control use of async or sync port login (Joe Jin)
  - [net] tg3: Fix single-vector MSI-X code (Joe Jin)
  - [net] qlge: fix size of external list for TX address descriptors (Joe Jin)
  - [net] e1000e: Avoid wrong check on TX hang (Joe Jin)
  - crypto: ghash - Avoid null pointer dereference if no key is set (Nick Bowler) {CVE-2011-4081}
  - jbd/jbd2: validate sb->s_first in journal_get_superblock() (Eryu Guan) {CVE-2011-4132}
  - KVM: Device assignment permission checks (Joe Jin) {CVE-2011-4347}
  - KVM: x86: Prevent starting PIT timers in the absence of irqchip support (Jan Kiszka) {CVE-2011-4622}
  - xfs: validate acl count (Joe Jin) {CVE-2012-0038}
  - KVM: x86: fix missing checks in syscall emulation (Joe Jin) {CVE-2012-0045}
  - KVM: x86: extend "struct x86_emulate_ops" with "get_cpuid" (Joe Jin) {CVE-2012-0045}
  - igmp: Avoid zero delay when receiving odd mixture of IGMP queries (Ben Hutchings) {CVE-2012-0207}
  - ipv4: correct IGMP behavior on v3 query during v2-compatibility mode (David Stevens)
  - fuse: fix fuse request unique id (Srinivas Eeda) [orabug 13816349]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.12.1.el6uek]
changelog:
  - Revert "fuse: break fc spinlock" (Maxim Uvarov) [Orabug: 13847680] 
  - Revert "fuse: split queues to scale I/O throughput" (Maxim Uvarov) [Orabug: 13847680]
  - Revert "fuse: fix fuse request unique id" (Maxim Uvarov) [Orabug: 13847680]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.13.1.el6uek]
changelog:
  - [SCSI] update mpt2sas to 12.105.06.00 (Maxim Uvarov) [Orabug: 13459691]
  - [SCSI] update mptsas to 4.24.20.03 (Maxim Uvarov) [Orabug: 13459691]
  - [SCSI] update megaraid to 00.00.06.12 (Maxim Uvarov) [Orabug: 13459691]
  - lpfc: fix null pointer lpfc_sli4_fp_intr_handler (Maxim Uvarov) [Orabug: 13856103]


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.32-300.14.1.el6uek]
changelog:
  - [DM] lvconvert: merge permitted despite no snapshot-merge support (Mikulas Patocka, Mike Snitzer) [Orabug: 13797085]
    The following commits were actually introduced in v2.6.32-300.12.1 but not
    included in the changelog:
    dm snapshot: use merge origin if snapshot invalid bug13797085
    dm snapshot: report merge failure in status
    dm snapshot: merge consecutive chunks together
    dm snapshot: trigger exceptions in remaining snapshots...
    dm snapshot: delay merging a chunk until writes to...
    dm snapshot: queue writes to chunks being merged
    dm snapshot: add merging
    dm snapshot: permit only one merge at once
    dm snapshot: support barriers in snapshot merge target
    dm snapshot: avoid allocating exceptions in merge
    dm snapshot: rework writing to origin
    dm snapshot: add merge target
    dm exception store: add merge specific methods
    dm snapshot: create function for chunk_is_tracked wait
    dm snapshot: make bio optional in __origin_write
    dm snapshot: allow live exception store handover betwee...
    dm snapshot: track suspended state in target
    dm snapshot: move cow ref from exception store to snap...
    dm snapshot: add allocated metadata to snapshot status
    dm snapshot: rename exception functions
    dm snapshot: rename exception_table to dm_exception_table
    dm snapshot: rename dm_snap_exception to dm_exception
    dm snapshot: consolidate insert exception functions
    dm snapshot: abstract minimum_chunk_size fn
    dm snapshot: avoid else clause in persistent_read_metadata


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.15.1.el6uek]
changelog:
  - x86, kdump: Change copy_oldmem_page() to use cached addressing (Cliff Wickman) [Orabug 13729957]
  - Silencing 'killing requests for dead queue' (Hannes Reinecke) [Orabug 13957059]


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.32-300.17.1.el6uek]
changelog:
  - NFSv4: Save the owner/group name string when doing open [Orabug 13459986] (Trond Myklebust)
  - x86-64, fpu: Fix %cs value in convert_from_fxsr [Orabug 12659098] (Brian Gerst)
  - cfq-iosched: fix cfq_cic_link() race confition [Orabug 13928285] (Yasuaki Ishimatsu)
  - cfq-iosched: don't regard requests with long distance as close [Orabug 13928285] (Shaohua Li)
  - svcrpc: fix double-free on shutdown of nfsd after changing pool mode [Orabug 13928285] (J. Bruce Fields)
  - svcrpc: avoid memory-corruption on pool shutdown [Orabug 13928285] (J. Bruce Fields)
  - svcrpc: destroy server sockets all at once [Orabug 13928285] (J. Bruce Fields)
  - svcrpc: simplify svc_close_all [Orabug 13928285] (J. Bruce Fields)
  - Improve TSC calibration using a delayed workqueue [Orabug 13928285] (John Stultz)
  - clocksource: Add clocksource_register_hz/khz interface [Orabug 13928285] (John Stultz)
  - clocksource: Provide a generic mult/shift factor calculation [Orabug 13928285] (Thomas Gleixner)
  - [nfs] fall back on normal lookup [Orabug 13928285] (Jeff Layton)
  - [changelog]: Add Chuck Lever and John Haxby for nfs fixes [Orabug 13928285] (Joe Jin)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.19.1.el6uek]
changelog:
  - mpt2sas: Do not check DIF for unwritten blocks (Martin K. Petersen) [Orabug 13928720]
  - mpt2sas: Return the correct sense key for DIF errors (Martin K. Petersen) [Orabug 13928720]
  - mpt2sas: Add a module parameter that permits overriding protection capabilities (Martin K. Petersen) [Orabug 13928720]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.21.1.el6uek]
changelog:
  - regset: Return -EFAULT, not -EIO, on host-side memory fault (H. Peter Anvin)
    CVE-2012-1097
  - regset: Prevent null pointer reference on readonly regsets (H. Peter Anvin)
    CVE-2012-1097
  - cifs: fix dentry refcount leak when opening a FIFO on lookup (Jeff Layton)
    CVE-2012-1090
  - block: Fix io_context leak after failure of clone with CLONE_IO (Louis
    Rilling)  CVE-2012-0879


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.22.1.el6uek]
changelog:
  - KVM: Ensure all vcpus are consistent with in-kernel irqchip settings (Dan
    Carpenter) {CVE-2012-1601}
  - KVM: x86: disallow multiple KVM_CREATE_IRQCHIP (Marcelo Tosatti) {CVE-2012-1601}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.23.1.el6uek]
changelog:
  - scsi_prep_fn() check for empty queue (Maxim Uvarov) [Orabug: 13962432]
  - mm, x86: Saving vmcore with non-lazy freeing of vmas (Cliff Wickman) [Orabug: 13729957]
  - fs/proc/vmcore.c: add hook to read_from_oldmem() to check for non-ram pages 
    (Olaf Hering) [Orabug: 13729957]
  - /proc/vmcore: fix seeking (Arnd Bergmann) [Orabug: 13729957]
  - procfs: Use generic_file_llseek in /proc/vmcore (Frederic Weisbecker) [Orabug: 13729957]
  - dm mpath: wait for pg_init completion when suspending (Kiyoshi Ueda) [Orabug: 13962432]
  - dm mpath: prevent io from work queue while suspended (Mike Anderson) [Orabug: 13962432]
  - dm mpath: add mutex to synchronize adding and flushing work (Mike Anderson) [Orabug: 13962432]
  - dm mpath: flush workqueues before suspend completes (Kiyoshi Ueda) [Orabug: 13962432]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.24.1.el6uek]
changelog:
  - [scsi] hpsa: Remove some PCI IDs if for OL5. (Joe Jin)
  - [block] cciss: fix incorrect PCI IDs and add two new ones (Joe Jin)
  - [scsi] hpsa: add some older controllers to the kdump blacklist (Joe Jin)
  - [block] cciss: Add IRQF_SHARED back in for the non-MSI(X) interrupt handler
    (Joe Jin)
  - [block] cciss: add some older controllers to the kdump blacklist (Joe Jin)
  - cciss: add small delay when using PCI Power Management to reset for kump
    (Mike Miller)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.25.1.el6uek]
changelog:
  - jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer (Eric Sandeen)
    [Bugdb: 13871] {CVE-2011-4086}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.26.1.el6uek]
changelog:
  - mptsas: do not call __mptsas_probe in kthread (Maxim Uvarov) [Orabug:
    14175509]
  - mm: check if any page in a pageblock is reserved before marking it
    MIGRATE_RESERVE (Maxim Uvarov) [Orabug: 14073214]
  - mm: reduce the amount of work done when updating min_free_kbytes (Mel Gorman)
    [Orabug: 14073214]
  - vmxnet3: Updated to el6-u2 (Guangyu Sun) [Orabug: 14027961]
  - xen: expose host uuid via sysfs. (Zhigang Wang)
  - sched: Fix cgroup movement of waking process (Daisuke Nishimura) [Orabug:
    13946210]
  - sched: Fix cgroup movement of newly created process (Daisuke Nishimura)
    [Orabug: 13946210]
  - sched: Fix cgroup movement of forking process (Daisuke Nishimura) [Orabug:
    13946210]
  - x86, boot: Wait for boot cpu to show up if nr_cpus limit is about to hit
    (Zhenzhong Duan) [Orabug: 13629087]
  - smp: Use nr_cpus= to set nr_cpu_ids early (Zhenzhong Duan) [Orabug: 13629087]
  - net: ipv4: relax AF_INET check in bind() (Maxim Uvarov) [Orabug: 14054411]


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.32-300.27.1.el6uek]
changelog:
  - net: sock: validate data_len before allocating skb (Jason Wang) [Bugdb: 13966]{CVE-2012-2136}
  - fcaps: clear the same personality flags as suid when fcaps are used (Eric Paris) [Bugdb: 13966] {CVE-2012-2123}
  - Revert "nfs: when attempting to open a directory, fall back on normal lookup (Todd Vierling) [Orabug 14141154]


author: Joe Jin <joe.jin@oracle.com> [2.6.32-300.27.2.el6uek]
changelog:
  - Fix leapsecond triggered hrtimer/futex load spike issue(John Stultz)
  - Fix clock_was_set so it is safe to call from atomic(John Stultz)


author: Joe Jin <joe.jin@oracle.com> [2.6.32-300.27.4.el6uek]
changelog:
  - 2.6.32.x: hrtimer: Update hrtimer base offsets each hrtimer_interrupt
  - 2.6.32.x: time: Fix leapsecond triggered hrtimer/futex load spike issue
  - 2.6.32.x: hrtimer: Fix clock_was_set so it is safe to call from irq context
  - Revert "Fix clock_was_set so it is safe to call from atomic"
  - Revert "Fix leapsecond triggered hrtimer/futex load spike issue"
  - Revert "2.6.32.x: hrtimer: Update hrtimer base offsets each hrtimer_interrupt"


author: Joe Jin <joe.jin@oracle.com> [2.6.32-300.29.2.el6uek]
changelog:
  - epoll: epoll_wait() should not use timespec_add_ns() (Eric Dumazet)
  - epoll: clear the tfile_check_list on -ELOOP (Joe Jin)  {CVE-2012-3375}
  - Don't limit non-nested epoll paths (Jason Baron)
  - epoll: kabi fixups for epoll limit wakeup paths (Joe Jin) {CVE-2011-1083}
  - epoll: limit paths (Jason Baron)  {CVE-2011-1083}
  - eventpoll: fix comment typo 'evenpoll' (Paul Bolle)
  - epoll: fix compiler warning and optimize the non-blocking path (Shawn Bohrer)
  - epoll: move ready event check into proper inline (Davide Libenzi)
  - epoll: make epoll_wait() use the hrtimer range feature (Shawn Bohrer)
  - select: rename estimate_accuracy() to select_estimate_accuracy() (Andrew Morton)
  - cred: copy_process() should clear child->replacement_session_keyring (Oleg
    Nesterov)  {CVE-2012-2745}


author: Joe Jin <joe.jin@oracle.com> [2.6.32-300.0.7.el6uek]
changelog:
  - Add entropy generation to NIC drivers
  - [netdrv] bnx2x: replace pci_find_capability to pci_pcie_cap
  - [pci] dma-mapping: dma-mapping.h: add dma_set_coherent_mask
  - PCI: introduce pci_is_pcie()
  - PCI: introduce pci_pcie_cap()
  - PCI: cache PCIe capability offset
  - [scsi] add lockless to improve queuecommand performance


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.32-300.0.8.el6uek]
changelog:
  -  ipv6: add a missing unregister_pernet_subsys call (Neil Horman)
  -  SPEC: hwcap set to 1 for nosegneg (Guru Anbalagane) [orabug 13321811]
  -  put firmware to kernel version specific location (Maxim Uvarov) [orabug 13254457]
  -  xen: drop xen_sched_clock in favour of using plain wallclock time (Jeremy Fitzhardinge)
  -  Revert "[scsi] add lockless to improve queuecommand performance"
  -  fix fnic init panic and san disks are not visible (Xiaowei Hu) 
  -  SPEC: Add debug to the list of kernels that kernel-uek should replace in
     /etc/sysconfig/kernel (Kevin Lyons) [bug 13260459,13339700] 
  -  bfa: cleanup Makefile. (Joe Jin)
  -  fc class: add fc host default default dev loss setting (Mike Christie)
  -  fc class: add fc host dev loss sysfs file (Mike Christie)
  -  add dev_loss_tmo support for lpfc, fnic and ibmvfc (Joe Jin)
  -  scsi_transport_fc: Protect against overflow in dev_loss_tmo (Hannes Reinecke)
  -  [netdrv] bna: cleanup Makefile. (Joe Jin)
  -  PCI/e1000e: Add and use pci_disable_link_state_locked() (Yinghai Lu)
  -  tracepoint: Move signal sending tracepoint to events/signal.h (Masami Hiramatsu)
  -  perf_event, x86, mce: Use TRACE_EVENT() for MCE logging (Hidetoshi Seto)
  -  xen: Add support for hugepages on Xen pv domains, including support for hugepages 
     in the balloon driver. (Dave Mccracken)


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.32-300.0.9.el6uek]
changelog:
  - [firmware] bnx2x 7.0.20 (Maxim Uvarov) [orabug 13354737]
  - Revert "qla2xxx: Double check for command completion if abort mailbox [orabug 13339986]
  - SPEC: fixes for spec file [orabugs 13359985, 13339700, 13348381]
  - kabi: Modify Kabi and enable kabicheck


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.0.10.el6uek]
changelog:
  - compat_ioct: move initialization before use in sg_ioctl_trans() (Dan Carpenter)
  - genirq: Add IRQF_RESUME_EARLY and resume such IRQs earlier (Dan Carpenter)
  - xen/timer: Missing IRQF_NO_SUSPEND in timer code broke suspend [orabug 13359907]
  - pids: fix a race in pid generation that causes pids to be reused immediately (Salman) [orabug 13370594]
  - Revert "mlx4: Updated the driver version from 1.5.1.6 August 2010 to 1.5.4.1 March 2011 update" (Maxim Uvarov) [orabug 13322248]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.0.12.el6uek]
changelog:
  - Install include/drm headers (Maxim Uvarov) [orabug 13260234]
  - qla2xxx: Double check for command completion if abort mailbox command fails (Chad Dupuis)
  - Ensure full IOC buffer can be mapped (Martin K. Petersen)
  - Fix incorrect timeout handling (Martin K. Petersen)


author: Joe Jin <joe.jin@oracle.com> [2.6.32-300.1.1.el6uek]
changelog:
  - [SCSI] qla4xxx: fix build error for OL6 (Joe Jin)
  - Ecryptfs: Add mount option to check uid of device being mounted = expect uid (Maxim Uvarov)
  - proc: fix oops on invalid /proc/<pid>/maps access (Linus Torvalds)
  - x86/mm: Fix pgd_lock deadlock (Joe Jin)
  - x86, mm: Hold mm->page_table_lock while doing vmalloc_sync (Joe Jin)
  - proc: restrict access to /proc/PID/io (Vasiliy Kulikov)
  - futex: Fix regression with read only mappings (Shawn Bohrer)
  - x86-32, vdso: On system call restart after SYSENTER, use int $0x80 (H. Peter Anvin)
  - x86, UV: Remove UV delay in starting slave cpus (Jack Steiner)
  - Include several Xen pv hugepage fixes. (Dave McCracken)
  - GRO: fix merging a paged skb after non-paged skbs (Michal Schmidt)
  - md/linear: avoid corrupting structure while waiting for rcu_free to complete. (NeilBrown)
  - xen: x86_32: do not enable iterrupts when returning from exception in interrupt context (Igor Mammedov)
  - xen/smp: Warn user why they keel over - nosmp or noapic and what to use instead. (Konrad Rzeszutek Wilk)
  - hvc_console: Improve tty/console put_chars handling (Hendrik Brueckner)
  - 3w-9xxx: fix iommu_iova leak (James Bottomley)
  - aacraid: reset should disable MSI interrupt (Vasily Averin)
  - libsas: fix failure to revalidate domain for anything but the first expander child. (Mark Salyzyn)
  - splice: direct_splice_actor() should not use pos in sd (Changli Gao)
  - libsas: fix panic when single phy is disabled on a wide port (Mark Salyzyn)
  - epoll: fix spurious lockdep warnings (Nelson Elhage)
  - kobj_uevent: Ignore if some listeners cannot handle message (Milan Broz)
  - kmod: prevent kmod_loop_msg overflow in __request_module() (Jiri Kosina)
  - nfsd4: ignore WANT bits in open downgrade (J. Bruce Fields)
  - nfsd4: Remove check for a 32-bit cookie in nfsd4_readdir() (Bernd Schubert)
  - iommu/amd: Fix wrong shift direction (Joerg Roedel)
  - cfq: Don't allow queue merges for queues that have no process references (Jeff Moyer)
  - cfq-iosched: get rid of the coop_preempt flag (Jens Axboe)
  - cfq: break apart merged cfqqs if they stop cooperating (Jeff Moyer)
  - cfq: change the meaning of the cfqq_coop flag (Jeff Moyer)
  - cfq: merge cooperating cfq_queues (Jeff Moyer)
  - cfq: calculate the seek_mean per cfq_queue not per cfq_io_context (Jeff Moyer)
  - kcore: fix test for end of list (Dan Carpenter)
  - deal with races in /proc/*/{syscall,stack,personality} (Al Viro)
  - NLM: Don't hang forever on NLM unlock requests (Maxim Uvarov)
  - vm: fix vm_pgoff wrap in upward expansion (Hugh Dickins)
  - vm: fix vm_pgoff wrap in stack expansion (Linus Torvalds)
  - net_sched: Fix qdisc_notify() (Eric Dumazet)
  - drivers/net/rionet.c: fix ethernet address macros for LE platforms (Alexandre Bounine)
  - ext2,ext3,ext4: don't inherit APPEND_FL or IMMUTABLE_FL for new inodes (Theodore Ts'o)
  - st: fix race in st_scsi_execute_end (Petr Uzel)
  - Make scsi_free_queue() kill pending SCSI commands (Bart Van Assche)
  - NFS/sunrpc: don't use a credential with extra groups. (NeilBrown)
  - netlink: validate NLA_MSECS length (Johannes Berg)
  - mtd: mtdchar: add missing initializer on raw write (Peter Wippich)
  - PM / Suspend: Off by one in pm_suspend() (Dan Carpenter)
  - hfs: add sanity check for file name length (Dan Carpenter)
  - md/raid5: abort any pending parity operations when array fails. (NeilBrown)
  - mm: avoid null pointer access in vm_struct via /proc/vmallocinfo (Mitsuo Hayasaka)
  - USB: Fix Corruption issue in USB ftdi driver ftdi_sio.c (Andrew Worsley)
  - usb-storage: Accept 8020i-protocol commands longer than 12 bytes (Alan Stern)
  - [SCSI] ql4xxx: upgrade to 5.02.14.00.32.01-c0 (Joe Jin)
  - [netdrv] be2net: Merge fixes for CVE-2011-3347 (Joe Jin)
  - ext4: fix BUG_ON() in ext4_ext_insert_extent() (Zheng Liu)
  - proc: fix a race in do_io_accounting() (Vasiliy Kulikov)
  - capabilities: do not grant full privs for setuid w/ file caps + no effective caps (Zhi Li)
  - KEYS: Fix a NULL pointer deref in the user-defined key type (Maxim Uvarov)
  - igb: Fix for Alt MAC Address feature on 82580 and later devices (Joe Jin)
  - [netdrv] enic: fix accidental GRO off by default (Joe Jin)
  - Fixing use of netif_set_real_num_tx_queues in cxgb4_main.c (Joe Jin)
  - firmware: Update cxgb4 NIC driver firmware (Joe Jin)
  - firmware Add latest cxgb3 firmware (Joe Jin)
  - [netdrv] cxgb3: misc fixes. (Joe Jin)
  - bnx2x: upgrade bnx2x (Joe Jin)
  - dcb: add DCBX mode to event notifier attributes (John Fastabend)
  - dcb: Use ifindex instead of ifname (Mark Rustad)
  - dcbnl: unlock on an error path in dcbnl_cee_fill() (Dan Carpenter)
  - dcbnl: Add CEE notification (Shmulik Ravid)
  - dcbnl: Aggregated CEE GET operation (Shmulik Ravid)
  - dcb: use nlmsg_free() instead of kfree() (Dan Carpenter)
  - dcb: Add missing error check in dcb_ieee_set() (John Fastabend)
  - dcb: fix return type on dcb_setapp() (John Fastabend)
  - dcb: Add dcb_ieee_getapp_mask() for drivers to query APP settings (John Fastabend)
  - dcb: Add ieee_dcb_delapp() and dcb op to delete app entry (John Fastabend)
  - dcb: Add ieee_dcb_setapp() to be used for IEEE 802.1Qaz APP data (John Fastabend)
  - net: dcbnl, add multicast group for DCB (John Fastabend)
  - dcb: Add DCBX capabilities bitmask to the get_ieee response (John Fastabend)
  - dcbnl: add support for retrieving peer configuration - cee (Shmulik Ravid)
  - dcbnl: add support for retrieving peer configuration - ieee (Shmulik Ravid)
  - net: dcbnl: check correct ops in dcbnl_ieee_set() (John Fastabend)
  - Don't potentially dereference NULL in net/dcb/dcbnl.c:dcbnl_getapp() (Jesper Juhl)
  - net: dcb: application priority is per net_device (John Fastabend)
  - dcbnl: make get_app handling symmetric for IEEE and CEE DCBx (John Fastabend)
  - dcb: use after free in dcb_flushapp() (Dan Carpenter)
  - dcb: unlock on error in dcbnl_ieee_get() (Dan Carpenter)
  - dcbnl: more informed return values for new dcbnl routines (Shmulik Ravid)
  - dcbnl: cleanup (Shmulik Ravid)
  - net_dcb: add application notifiers (John Fastabend)
  - [netdrv] firmware: add bnx2x FW 7.0.23 (Joe Jin)
  - [netdrv] Fixing use of netif_set_real_num_tx_queues in bnx2.c (Joe Jin)
  - [netdrv] tg3: drver update. (Joe Jin)
  - tg3: negate USE_PHYLIB flag check (Jiri Pirko)
  - [netdrv] e1000e: fix WoL on 82578DM and 82567V3 (Joe Jin)
  - e1000: don't enable dma receives until after dma address has been setup (Dean Nelson)
  - [SCSI] bnx2i: Fixed the endian on TTT for NOP out transmission (Eddie Wai)
  - [SCSI] bnx2fc: upgrade to 1.0.8 (Joe Jin)
  - [scsi] hpsa: add heartbeat sysfs host attribute (Joe Jin)
  - [SCSI] move PCI_DEVICE_ID_HP_CISSE to include/linux/pci_ids.h (Joe Jin)
  - [SCSI] lpfc: update to 8.3.5.45.4p (Joe Jin)
  - [SCSI] be2iscsi: upgrade to 4.1.239.0 (Joe Jin)
  - fcoe/libfcoe: Move common code for fcoe_get_lesb to fcoe_transport (Joe Jin)
  - libfc: Prevent race that causes panic during FCoE port destroy via sysfs (Joe Jin)
  - [SCSI] isci: dynamic interrupt coalescing (Dan Williams)
  - megaraid_sas: trim the space and tab. (Joe Jin)
  - megaraid_sas: Add driver workaround for PERC5/1068 kdump kernel panic (Joe Jin)
  - scsi_transport_fc: Fix deadlock during fc_remove_host (Joe Jin)
  - [SCSI] libfc: improve flogi retries to avoid lport stuck (Vasu Dev)
  - [SCSI] libfc: avoid exchanges collision during lport reset (Vasu Dev)
  - [SCSI] libfc: fix checking FC_TYPE_BLS (Vasu Dev)
  - [SCSI] libsas: fix warnings when checking sata/stp protocol (Dan Williams)
  - [SCSI] libsas: disable scanning lun > 0 on ata devices (Dan Williams)
  - [SCSI] libsas: Allow expander T-T attachments (Luben Tuikov)
  - [SCSI] isci: atapi support (Dan Williams)
  - isci: export phy events via ->lldd_control_phy() (Dan Williams)
  - [SCSI] isci: The port state should be set to stopping on the last phy. (Jeff Skirvin)
  - [SCSI] isci: fix decode of DONE_CRC_ERR TC completion status (Jeff Skirvin)
  - [SCSI] isci: SATA/STP I/O is only returned in the normal path to libsas (Jeff Skirvin)
  - [SCSI] isci: fix support for large smp requests (Dan Williams)
  - [SCSI] isci: fix missed unlock in apc_agent_timeout() (Jeff Skirvin)
  - [SCSI] isci: fix event-get pointer increment (Dan Williams)
  - [SCSI] isci: add version number (Dan Williams)
  - [SCSI] isci: fix sata response handling (Dan Williams)
  - [SCSI] isci: Leave requests alone if already terminating. (Jeff Skirvin)
  - [SCSI] isci: initial sgpio write support (Dan Williams)
  - [SCSI] isci: fix sgpio register definitions (Dan Williams)
  - [SCSI] libsas: sgpio write support (Dan Williams)
  - [SCSI] scsi scan: don't fail scans when host is in recovery (Mike Christie)
  - net: Remove atmclip.h to prevent break kabi check (Joe Jin)
  - SPEC: ol6 req dracut-kernel-004-242.0.3 (Maxim Uvarov)
  - SPEC: req udev-095-14.27.0.1.el5_7.1 or more (Maxim Uvarov)
  - SPEC: el5 mkinird more then 5.1.19.6-71.0.10 (Maxim Uvarov)
  - ipv6: make fragment identifications less predictable (Joe Jin)
  - vlan: fix panic when handling priority tagged frames (Joe Jin)
  - ipv6: udp: fix the wrong headroom check (Shan Wei)
  - b43: allocate receive buffers big enough for max frame len + offset (Maxim Uvarov)
  - fuse: check size of FUSE_NOTIFY_INVAL_ENTRY message (Miklos Szeredi)
  - cifs: fix possible memory corruption in CIFSFindNext (Jeff Layton)
  - crypto: md5 - Add export support (Maxim Uvarov)
  - fs/partitions/efi.c: corrupted GUID partition tables can cause kernel oops (Timo Warns)
  - block: use struct parsed_partitions *state universally in partition check code (Maxim Uvarov)
  - net: Compute protocol sequence numbers and fragment IDs using MD5 (Maxim Uvarov)
  - perf tools: do not look at ./config for configuration (Jonathan Nieder)
  - Make TASKSTATS require root access (Linus Torvalds)
  - TPM: Zero buffer after copying to userspace (Peter Huewe)
  - TPM: Call tpm_transmit with correct size (Peter Huewe)
  - PCI: Set device power state to PCI_D0 for device without native PM support (Ajaykumar Hotchandani)


author: Joe Jin <joe.jin@oracle.com> [2.6.32-300.30.1.el6uek]
changelog:
  - epoll: epoll_wait() should not use timespec_add_ns(Eric Dumazet)
  - epoll: clear the tfile_check_list on -ELOOP (Joe Jin) {CVE-2012-3375}
  - Don't limit non-nested epoll paths (Jason Baron)
  - epoll: kabi fixups for epoll limit wakeup paths {CVE-2011-1083}
  - epoll: limit paths (Jason Baron) {CVE-2011-1083}
  - eventpoll: fix comment typo 'evenpoll' (Paul Bolle)
  - epoll: fix compiler warning and optimize the non-blocking path (Shawn Bohrer)
  - epoll: move ready event check into proper inline (Davide Libenzi)
  - epoll: make epoll_wait() use the hrtimer range feature (Shawn Bohrer)
  - select: rename estimate_accuracy() to select_estimate_accuracy() (Andrew Morton)
  - [megaraid] fix sysfs_max_sectors_read (Maxim Uvarov)[Orabug 14263088]
  - [SCSI] libfc: fcoe_transport_create fails in single-CPU environment (Steven Clark) [Orabug 14239242]
  - [libata] Add " 2GB ATA Flash Disk"/"ADMA428M" to DMA blacklist (Prarit Bhargava)
  - ext4: Fix overflow caused by missing cast in ext4_fallocate() (Utako Kusaka)
  - NFS: Map minor mismatch error to protocol not support error. (Steve Dickson)
  - NFSv4: Map NFS4ERR_SHARE_DENIED into an EACCES error instead of EIO (Trond Myklebust)
  - NFSv4: Propagate the error NFS4ERR_BADOWNER to nfs4_do_setattr (Trond Myklebust)
  - cred: copy_process() should clear child->replacement_session_keyring (Oleg Nesterov) {CVE-2012-2745}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.31.1.el6uek]
changelog:
  - export devinet_ioctl (Maxim Uvarov) [Orabug: 14306942]
  - vmxnet3: Updated to el6-u2 (Guangyu Sun) [Orabug: 14027961]


author: Joe Jin <joe.jin@oracle.com> [2.6.32-300.32.1.el6uek]
changelog:
  - futex: Fix uninterruptible loop due to gate_area (Hugh Dickins)
  - thp: update futex compound knowledge (Andrea Arcangeli)


author: Joe Jin <joe.jin@oracle.com> [2.6.32-300.32.2.el6uek]
changelog:
  - htrimer: fix kabi breakage (Joe Jin)
  - 2.6.32.x: timekeeping: Add missing update call in timekeeping_resume()
    (Thomas Gleixner)
  - 2.6.32.x: hrtimer: Update hrtimer base offsets each hrtimer_interrupt (John
    Stultz)
  - 2.6.32.x: timekeeping: Provide hrtimer update function (Thomas Gleixner)
  - 2.6.32.x: hrtimers: Move lock held region in hrtimer_interrupt() (Thomas
    Gleixner)
  - 2.6.32.x: timekeeping: Maintain ktime_t based offsets for hrtimers (Thomas
    Gleixner)
  - 2.6.32.x: timekeeping: Fix leapsecond triggered load spike issue (John
    Stultz)
  - 2.6.32.x: hrtimer: Provide clock_was_set_delayed() (John Stultz)
  - 2.6.32.x: time: Move common updates to a function (Thomas Gleixner)
  - 2.6.32.x: timekeeping: Fix CLOCK_MONOTONIC inconsistency during leapsecond
    (John Stultz)
  - 2.6.32.x: ntp: Correct TAI offset during leap second (Richard Cochran)
  - 2.6.32.x: ntp: Fix leap-second hrtimer livelock (John Stultz)
  - Revert "2.6.32.x: hrtimer: Fix clock_was_set so it is safe to call from irq
    context" (Joe Jin)
  - Revert "2.6.32.x: time: Fix leapsecond triggered hrtimer/futex load spike
    issue" (Joe Jin)
  - Revert "2.6.32.x: hrtimer: Update hrtimer base offsets each
    hrtimer_interrupt" (Joe Jin)


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.32-300.32.3.el6uek]
changelog:
  - dl2k: Clean up rio_ioctl (Stephan Mueller) [Orabug: 14675306] {CVE-2012-2313}
  - hugetlb: fix resv_map leak in error path (Christoph Lameter) [Orabug: 14676403] {CVE-2012-2390}
  - rds: set correct msg_namelen (Jay Fenlason) [Orabug: 14676504] {CVE-2012-3430}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.33.1.el6uek]
changelog:
  - mpt2sas: Update mpt2sas to 120.105.11.00 (Guru Anbalagane) [Orabug: 14376481]
  - Revert "mpt2sas: update to 12.105.11.00" (Maxim Uvarov)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.35.1.el6uek]
changelog:
  - oracleasm: Bring driver in sync with UEK2 (Martin K. Petersen)
  - Fix system hang due to bad protection module parameters (CR 130769) (Martin
    K. Petersen)
  - sd: Avoid remapping bad reference tags (Martin K. Petersen)
  - block: Fix bad range check in bio_sector_offset (Martin K. Petersen)


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.32-300.37.1.el6uek]
changelog:
  - sfc: Replace some literal constants with EFX_PAGE_SIZE/EFX_BUF_SIZE (Ben Hutchings) [Orabug: 14769994]
  - CVE-2012-3412 sfc: Fix maximum number of TSO segments and minimum TX queue size (Ben Hutchings) [Orabug: 14769994] {CVE-2012-3412}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-300.38.1.el6uek]
changelog:
  - [net/sfc] limit number of segments per skb on tx (Maxim Uvarov) [Orabug:
    14769994] {CVE-2012-3412}


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.32-300.39.1.el6uek]
changelog:
  - hugepages: fix use after free bug in "quota" handling [15842385] {CVE-2012-2133}
  - mm: Hold a file reference in madvise_remove [15842884] {CVE-2012-3511}
  - udf: Fortify loading of sparing table [15843730] {CVE-2012-3400}
  - udf: Avoid run away loop when partition table length is corrupt [15843730] {CVE-2012-3400}


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.32-300.39.2.el6uek]
changelog:
  - ext4: fix undefined behavior in ext4_fill_flex_info() (Xi Wang) [orabug 16020245] {CVE-2012-2100}
  - Divide by zero in TCP congestion control Algorithm (Jesper Dangaard Brouer) [orabug 16020447] {CVE-2012-4565}
  - ipv6: discard overlapping fragment (Luis Henriques) [orabug 16021354] {CVE-2012-4444}


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.32-300.39.3.el6uek]
changelog:
  - Xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests.
    (Frediano Ziglio) [Orabug: 16274192] {CVE-2013-0190}


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.32-300.39.4.el6uek]
changelog:
  - exec: do not leave bprm->interp on stack (Kees Cook) [Orabug: 16286741]
    {CVE-2012-4530}
  - exec: use -ELOOP for max recursion depth (Kees Cook) [Orabug: 16286741]
    {CVE-2012-4530}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-400.17.1.el6uek]
changelog:
  - nfs: skip commit in releasepage if we're freeing memory for fs-related
    reasons (Jeff Layton) [Orabug: 16173012]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-400.18.1.el6uek]
changelog:
  - exec: do not leave bprm->interp on stack (Kees Cook) [Orabug: 16286741]
    {CVE-2012-4530}
  - exec: use -ELOOP for max recursion depth (Kees Cook) [Orabug: 16286741]
    {CVE-2012-4530}
  - Xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests.
    (Frediano Ziglio) [Orabug: 16274192] {CVE-2013-0190}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-400.19.1.el6uek]
changelog:
  - sched: fix divide by zero at {thread_group,task}_times (Zhenzhong Duan)
    [Orabug:15956690]
  - [virt] xen-netfront: fix MTU reset after migration (Todd Vierling) [Orabug:
    16299827]
  - block: Fix queue_flag update when rq_affinity goes from 2 to 1 (Eric
    Seppanen) [Orabug: 14608013]
  - block: strict rq_affinity (Dan Williams) [Orabug: 14608013]
  - Revert "block: improve queue_should_plug() by looking at IO depths" (Jens
    Axboe) [Orabug: 14608013]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-400.21.1.el6uek]
changelog:
  - This is a fix on dlm_clean_master_list() (Xiaowei.Hu) [Orabug: 12798517]
  - Remove incorrect do_vfs_lock message (Fabio Olive Leite) [Orabug: 14027893]
  - x86/xen: don't assume %ds is usable in xen_iret for 32-bit PVOPS. (Chuck
    Anderson)  {CVE-2013-0228 XSA-42 CVE-2013-0190}
  - NFSv4.1: Fix the slotid initialisation in nfs_async_rename() (Trond
    Myklebust) [Orabug: 16023392]
  - NFS: Fix a use-after-free case in nfs_async_rename() (Trond Myklebust)
    [Orabug: 16023392]
  - nfs: make sillyrename an async operation (Jeff Layton) [Orabug: 16023392]
  - nfs: nfs4_sequence_done() return int. (Joe Jin) [Orabug: 16023392]
  - nfs: add nfs_restart_rpc() helper (Joe Jin) [Orabug: 16023392]
  - SUNRPC: The function rpc_restart_call() should return success/failure (Trond
    Myklebust) [Orabug: 16023392]
  - nfs: move nfs_sillyrename to unlink.c (Jeff Layton) [Orabug: 16023392]
  - nfs: standardize the rename response container (Jeff Layton) [Orabug:
    16023392]
  - nfs: standardize the rename args container (Jeff Layton) [Orabug: 16023392]
  - NFS: Reduce stack footprint of nfs3_proc_rename() and nfs4_proc_rename()
    (Trond Myklebust) [Orabug: 16023392]
  - NFS: Add helper functions for allocating filehandles and fattr structs (Trond
    Myklebust) [Orabug: 16023392]
  - nfs: handle NFSv2 -EKEYEXPIRED returns from RPC layer appropriately (Jeff
    Layton) [Orabug: 16023392]
  - nfs: handle NFSv3 -EKEYEXPIRED errors as we would -EJUKEBOX (Jeff Layton)
    [Orabug: 16023392]
  - nfs4: handle -EKEYEXPIRED errors from RPC layer (Jeff Layton) [Orabug:
    16023392]
  - nfs: change nfs4_do_setlk params to identify recovery type (Alexandros
    Batsakis) [Orabug: 16023392]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.32-400.22.1.el6uek]
changelog:
  - NFSv4: Fix buffer overflow checking in __nfs4_get_acl_uncached (Trond
    Myklebust) [Orabug: 16021274]
  - NFSv4: Fix the acl cache size calculation (Trond Myklebust) [Orabug:
    16021274]
  - NFSv4: Fix range checking in __nfs4_get_acl_uncached and __nfs4_proc_set_acl
    (Trond Myklebust) [Orabug: 16021274]
  - NFS: nfs_getaclargs.acl_len is a size_t (Chuck Lever) [Orabug: 16021274]
  - NFSv4: Don't use private xdr_stream fields in decode_getacl (Trond Myklebust)
    [Orabug: 16021274]
  - NFSv4: Fix pointer arithmetic in decode_getacl (Trond Myklebust) [Orabug:
    16021274]
  - NFSv4: Simplify the GETATTR attribute length calculation (Trond Myklebust)
    [Orabug: 16021274]
  - SUNRPC: Add the helper xdr_stream_pos (Trond Myklebust) [Orabug: 16021274]
  - SUNRPC: Don't decode beyond the end of the RPC reply message (Guangyu Sun)
    [Orabug: 16021274]
  - SUNRPC: add sanity checking of 'p' inside xdr_init_decode (Guangyu Sun)
    [Orabug: 16021274]
  - Avoid beyond bounds copy while caching ACL (Sachin Prabhu) [Orabug:16021274]
    {CVE-2012-2375}
  - Avoid reading past buffer when calling GETACL (Sachin Prabhu) [Orabug:
    16021274] {CVE-2012-2375}
  - Fix length of buffer copied in __nfs4_get_acl_uncached (Sachin Prabhu)
    [Orabug: 16021274] {CVE-2012-2375}
  - NFSv4: include bitmap in nfsv4 get acl data (Andy Adamson) [Orabug: 16021274]
    {CVE-2011-4131}
  - ocfs2: unlock super lock if lockres refresh failed (Junxiao Bi) [Orabug:
    16356893]
  - [SCSI] Shorten the path length of scsi_cmd_to_driver() (Li Zhong) [Orabug:
    16391082]
  - [SCSI] Fix NULL dereferences in scsi_cmd_to_driver (Mark Rustad) [Orabug:
    16391082]


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.32-400.23.1.el6uek]
changelog:
  - kabi: enable kabi (Guru Anbalagane)
  - pci: hotplug: fix null dereference in pci_set_payload() (Yuval Shaia)
    [Orabug: 15835542]
  - Revert "PCI: Set PCI-E Max Payload Size on fabric" (Guru Anbalagane)
  - Revert "Fix pointer dereference before call to pcie_bus_configure_settings"
    (Guru Anbalagane)
  - kabifix: cgroup: implement eventfd-based generic API for notifications (Maxim
    Uvarov)


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.24.1.el6uek]
changelog:
  - UBUNTU: SAUCE: sched: Prevent divide by zero when cpu_power is 0 (Andrew
    Dickinson) [Orabug: 16483310]
  - Revert "sched: Work around sched_group::cpu_power = 0" (Todd Vierling)
  - cipso: don't follow a NULL pointer when setsockopt() is called (Paul Moore)
    [Orabug: 16387012] {CVE-2013-0310}
  - mm: thp: fix pmd_present for split_huge_page and PROT_NONE with THP (Andrea
    Arcangeli) [Orabug: 16386911] {CVE-2013-0309}
  - ext4: race-condition protection for ext4_convert_unwritten_extents_endio
    (Chuck Anderson) [Orabug: 16386674] {CVE-2012-4508}
  - NLS: improve UTF8 -> UTF16 string conversion routine (Alan Stern) [Orabug:
    16425581] {CVE-2013-1773}
  - fat: Fix stat->f_namelen (Kevin Dankwardt) [Orabug: 16425581] {CVE-2013-1773}
  - [SCSI] hpsa: Use LUN reset instead of target reset (Stephen M. Cameron)
    [Orabug: 16483895]
  - [SCSI] hpsa: retry driver initiated commands on busy status (Matt Bondurant)
    [Orabug: 16483895]
  - [SCSI] hpsa: disable doorbell reset on reset_devices (Stephen M. Cameron)
    [Orabug: 16483895]
  - [SCSI] dm mpath: propagate target errors immediately (John Sobecki) [Orabug:
    14693090]
  - [SCSI] Add detailed SCSI I/O error (John Sobecki) [Orabug: 14693090]
  - dm mpath: add retain_attached_hw_handler feature (Mike Snitzer) [Orabug:
    16458686]
  - [SCSI] scsi_dh: add scsi_dh_attached_handler_name (Mike Snitzer) [Orabug:
    16458686]
  - sunrpc: assign the correct value to nwords in xdr_init_decode() (Guangyu Sun)
    [Orabug: 16457813]
  - x86/msr: Add capabilities check (Alan Cox) [Orabug: 16481233] {CVE-2013-0268}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.25.1.el6uek]
changelog:
  - SPEC: v2.6.32-400.25.1 (Jerry Snitselaar) 
  - xen: resetup vcpu placement for each vcpu at restore stage for hvm (Zhenzhong Duan) [Orabug: 16558021] 
  - tmpfs: fix use-after-free of mempolicy object (Greg Thelen) [Orabug: 16516286] {CVE-2013-1767}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.26.1.el6uek]
changelog:
  - Merge tag 'v2.6.32-400.24.1#bug16558021.v11' (Jerry Snitselaar) 
  - Revert "xen: resetup vcpu placement for each vcpu at restore stage for hvm" (Jerry Snitselaar) 
  - Add missing sysdev_suspend() and sysdev_resume() calls (Zhenzhong Duan)


author: Jiang Liu <jiang.liu@huawei.com> [2.6.32-400.26.2.el6uek]
changelog:
  - mm/hotplug: correctly add new zone to all other nodes' zone lists (Jiang Liu) [Orabug: 16603569] {CVE-2012-5517} 
  - ptrace: ptrace_resume() shouldn't wake up !TASK_TRACED thread (Oleg Nesterov) [Orabug: 16405868] {CVE-2013-0871} 
  - ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL (Oleg Nesterov) [Orabug: 16405868] {CVE-2013-0871} 
  - ptrace: introduce signal_wake_up_state() and ptrace_signal_wake_up() (Oleg Nesterov) [Orabug: 16405868] {CVE-2013-0871} 
  - Bluetooth: Fix incorrect strncpy() in hidp_setup_hid() (Anderson Lizardo) [Orabug: 16711062] {CVE-2013-0349} 
  - dccp: check ccid before dereferencing (Mathias Krause) [Orabug: 16711040] {CVE-2013-1827} 
  - USB: io_ti: Fix NULL dereference in chase_port() (Wolfgang Frisch) [Orabug: 16425435] {CVE-2013-1774} 
  - keys: fix race with concurrent install_user_keyrings() (David Howells) [Orabug: 16493369] {CVE-2013-1792} 
  - KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798) (Andy Honig) [Orabug: 16710937] {CVE-2013-1798} 
  - KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796) (Jerry Snitselaar) [Orabug: 16710794] {CVE-2013-1796} 
  - net/tun: fix ioctl() based info leaks (Mathias Krause) [Orabug: 16675501] {CVE-2012-6547} 
  - atm: fix info leak via getsockname() (Mathias Krause) [Orabug: 16675501] {CVE-2012-6546} 
  - atm: fix info leak in getsockopt(SO_ATMPVC) (Mathias Krause) [Orabug: 16675501] {CVE-2012-6546} 
  - xfrm_user: fix info leak in copy_to_user_tmpl() (Mathias Krause) [Orabug: 16675501] {CVE-2012-6537} 
  - xfrm_user: fix info leak in copy_to_user_policy() (Mathias Krause) [Orabug: 16675501] {CVE-2012-6537} 
  - xfrm_user: fix info leak in copy_to_user_state() (Mathias Krause) [Orabug: 16675501] {CVE-2013-6537} 
  - xfrm_user: return error pointer instead of NULL #2 (Mathias Krause) [Orabug: 16675501] {CVE-2013-1826} 
  - xfrm_user: return error pointer instead of NULL (Mathias Krause) [Orabug: 16675501] {CVE-2013-1826}


author: Mathias Krause <minipli@googlemail.com> [2.6.32-400.27.1.el6uek]
changelog:
  - net/tun: fix ioctl() based info leaks (Mathias Krause) [Orabug: 16675501] {CVE-2012-6547} 
  - atm: fix info leak via getsockname() (Mathias Krause) [Orabug: 16675501] {CVE-2012-6546} 
  - atm: fix info leak in getsockopt(SO_ATMPVC) (Mathias Krause) [Orabug: 16675501] {CVE-2012-6546} 
  - xfrm_user: fix info leak in copy_to_user_tmpl() (Mathias Krause) [Orabug: 16675501] {CVE-2012-6537} 
  - xfrm_user: fix info leak in copy_to_user_policy() (Mathias Krause) [Orabug: 16675501] {CVE-2012-6537} 
  - xfrm_user: fix info leak in copy_to_user_state() (Mathias Krause) [Orabug: 16675501] {CVE-2013-6537} 
  - xfrm_user: return error pointer instead of NULL #2 (Mathias Krause) [Orabug: 16675501] {CVE-2013-1826} 
  - xfrm_user: return error pointer instead of NULL (Mathias Krause) [Orabug: 16675501] {CVE-2013-1826} 
  - llc: fix info leak via getsockname() (Mathias Krause) [Orabug: 16675501] {CVE-2012-6542} 
  - x86/mm: Check if PUD is large when validating a kernel address (Mel Gorman) [Orabug: 14251997]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.28.1.el6uek]
changelog:
  - do_add_mount()/umount -l races (Jerry Snitselaar) [Orabug: 16311974] 
  - tg3: fix length overflow in VPD firmware parsing (Kees Cook) [Orabug: 16837019] {CVE-2013-1929} 
  - USB: cdc-wdm: fix buffer overflow (Oliver Neukum) [Orabug: 16837003] {CVE-2013-1860} 
  - bonding: emit event when bonding changes MAC (Weiping Pan) [Orabug: 16579025] 
  - sched: Fix ancient race in do_exit() (Joe Jin) 
  - open debug in page_move_anon_rmap by default. (Xiaowei.Hu) [Orabug: 14046035] 
  - block: default SCSI command filter does not accomodate commands overlap across device classes (Jamie Iles) [Orabug: 16387136] {CVE-2012-4542} 
  - vma_adjust: fix the copying of anon_vma chains (Linus Torvalds) [Orabug: 14046035] 
  - xen-netfront: delay gARP until backend switches to Connected (Laszlo Ersek) [Orabug: 16182568] 
  - svcrpc: don't hold sv_lock over svc_xprt_put() (J. Bruce Fields) [Orabug: 16032824] 
  - mm/hotplug: correctly add new zone to all other nodes' zone lists (Jiang Liu) [Orabug: 16603569] {CVE-2012-5517} 
  - ptrace: ptrace_resume() shouldn't wake up !TASK_TRACED thread (Oleg Nesterov) [Orabug: 16405868] {CVE-2013-0871} 
  - ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL (Oleg Nesterov) [Orabug: 16405868] {CVE-2013-0871} 
  - ptrace: introduce signal_wake_up_state() and ptrace_signal_wake_up() (Oleg Nesterov) [Orabug: 16405868] {CVE-2013-0871} 
  - Bluetooth: Fix incorrect strncpy() in hidp_setup_hid() (Anderson Lizardo) [Orabug: 16711062] {CVE-2013-0349} 
  - dccp: check ccid before dereferencing (Mathias Krause) [Orabug: 16711040] {CVE-2013-1827} 
  - USB: io_ti: Fix NULL dereference in chase_port() (Wolfgang Frisch) [Orabug: 16425435] {CVE-2013-1774} 
  - keys: fix race with concurrent install_user_keyrings() (David Howells) [Orabug: 16493369] {CVE-2013-1792} 
  - KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798) (Andy Honig) [Orabug: 16710937] {CVE-2013-1798} 
  - KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796) (Jerry Snitselaar) [Orabug: 16710794] {CVE-2013-1796}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.29.1.el6uek]
changelog:
  - KVM: add missing void __user COPYING CREDITS Documentation Kbuild MAINTAINERS Makefile README REPORTING-BUGS arch block crypto drivers firmware fs include init ipc kernel lib mm net samples scripts security sound tools uek-rpm usr virt cast to access_ok() call (Heiko Carstens) [Orabug: 16941620] {CVE-2013-1943} 
  - KVM: Validate userspace_addr of memslot when registered (Takuya Yoshikawa) [Orabug: 16941620] {CVE-2013-1943}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.29.1.el6uek]
changelog:
  - KVM: add missing void __user * cast to access_ok() call (Heiko Carstens) [Orabug: 16941620] {CVE-2013-1943} 
  - KVM: Validate userspace_addr of memslot when registered (Takuya Yoshikawa) [Orabug: 16941620] {CVE-2013-1943}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.29.2.el6uek]
changelog:
  - Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg() (Mathias Krause) [Orabug: 17173824] {CVE-2013-3225} 
  - Bluetooth: fix possible info leak in bt_sock_recvmsg() (Mathias Krause) [Orabug: 17173824] {CVE-2013-3224} 
  - atm: update msg_namelen in vcc_recvmsg() (Mathias Krause) [Orabug: 17173824] {CVE-2013-3222} 
  - dcbnl: fix various netlink info leaks (Mathias Krause) [Orabug: 17173824] {CVE-2013-2634} 
  - udf: avoid info leak on export (Mathias Krause) [Orabug: 17173824] {CVE-2012-6548} 
  - b43: stop format string leaking into error msgs (Kees Cook) [Orabug: 17173824] {CVE-2013-2852} 
  - signal: always clear sa_restorer on execve (Kees Cook) [Orabug: 17173824] {CVE-2013-0914}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.29.3.el6uek]
changelog:
  - block: do not pass disk names as format strings (Jerry Snitselaar) [Orabug: 17230124] {CVE-2013-2851} 
  - af_key: initialize satype in key_notify_policy_flush() (Nicolas Dichtel) [Orabug: 17370765] {CVE-2013-2237} 
  - Bluetooth: L2CAP - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17371054] {CVE-2012-6544} 
  - Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER) (Mathias Krause) [Orabug: 17371072] {CVE-2012-6544} 
  - ipv6: ip6_sk_dst_check() must not assume ipv6 dst (Eric Dumazet) [Orabug: 17371079] {CVE-2013-2232} 
  - sctp: Use correct sideffect command in duplicate cookie handling (Vlad Yasevich) [Orabug: 17371121] {CVE-2013-2206} 
  - sctp: deal with multiple COOKIE_ECHO chunks (Max Matveev) [Orabug: 17372129] {CVE-2013-2206}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.30.1.el6uek]
changelog:
  - xen: improve test for sharing hugepage page tables (Dave McCracken) [Orabug: 16810299]  
  - [SCSI] bnx2i: Fixed NULL ptr deference for 1G bnx2 Linux iSCSI offload (Eddie Wai) [Orabug: 16929192]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.32.1.el6uek]
changelog:
  - Remove BUG_ON from n_tty_read() (Stanislav Kozina) [Orabug: 17179175]  
  - Audit: do not print error when LSMs disabled (Eric Paris) [Orabug: 16962472]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.33.1.el6uek]
changelog:
  - NFS: Fix a hang/infinite loop in nfs_wb_page() (Trond Myklebust) [Orabug: 16467926]  
  - NFS: Ensure that we mark the inode as dirty if we exit early from commit (Trond Myklebust) [Orabug: 16467926]  
  - NFS: Fix an unstable write data integrity race (Trond Myklebust) [Orabug: 16467926]  
  - NFS: Make nfs_commitdata_release static (H Hartley Sweeten) [Orabug: 16467926]  
  - nfs: remove extraneous and problematic calls to nfs_clear_request (Trond Myklebust) [Orabug: 17302426]  
  - xen: initialize xen panic handler for PVM (Vaughan Cao) [Orabug: 17384877]  
  - xen/time: remove blocked time accounting from xen "clockchip" (Laszlo Ersek) [Orabug: 12695738]  
  - nfs: handle lock context allocation failures in nfs_create_request (Jeff Layton) [Orabug: 17383201]  
  - block: do not pass disk names as format strings (Jerry Snitselaar) [Orabug: 17230124] {CVE-2013-2851} 
  - af_key: initialize satype in key_notify_policy_flush() (Nicolas Dichtel) [Orabug: 17370765] {CVE-2013-2237} 
  - Bluetooth: L2CAP - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17371054] {CVE-2012-6544} 
  - Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER) (Mathias Krause) [Orabug: 17371072] {CVE-2012-6544} 
  - ipv6: ip6_sk_dst_check() must not assume ipv6 dst (Eric Dumazet) [Orabug: 17371079] {CVE-2013-2232} 
  - sctp: Use correct sideffect command in duplicate cookie handling (Vlad Yasevich) [Orabug: 17371121] {CVE-2013-2206} 
  - sctp: deal with multiple COOKIE_ECHO chunks (Max Matveev) [Orabug: 17372129] {CVE-2013-2206}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.33.2.el6uek]
changelog:
  - dm snapshot: fix data corruption (Mikulas Patocka) [Orabug: 17618900] {CVE-2013-4299} 
  - ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data (Hannes Frederic Sowa) [Orabug: 17618897] {CVE-2013-4162}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.33.3.el6uek]
changelog:
  - af_key: fix info leaks in notify messages (Mathias Krause) [Orabug: 17837974] {CVE-2013-2234} 
  - drivers/cdrom/cdrom.c: use kzalloc() for failing hardware (Jonathan Salwan) [Orabug: 17837971] {CVE-2013-2164} 
  - fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing error check (Kees Cook) [Orabug: 17837966] {CVE-2013-1928} 
  - Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST) (Mathias Krause) [Orabug: 17837959] {CVE-2012-6545} 
  - Bluetooth: RFCOMM - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17838023] {CVE-2012-6545} 
  - llc: Fix missing msg_namelen update in llc_ui_recvmsg() (Mathias Krause) [Orabug: 17837945] {CVE-2013-3231} 
  - HID: pantherlord: validate output report details (Kees Cook) [Orabug: 17837942] {CVE-2013-2892} 
  - HID: zeroplus: validate output report details (Kees Cook) [Orabug: 17837936] {CVE-2013-2889} 
  - HID: provide a helper for validating hid reports (Kees Cook) [Orabug: 17837936]  
  - NFSv4: Check for buffer length in __nfs4_get_acl_uncached (Sven Wegener) [Orabug: 17837931] {CVE-2013-4591} 
  - ansi_cprng: Fix off by one error in non-block size request (Neil Horman) [Orabug: 17837999] {CVE-2013-4345} 
  - HID: validate HID report id size (Kees Cook) [Orabug: 17837925] {CVE-2013-2888} 
  - ipv6: remove max_addresses check from ipv6_create_tempaddr (Hannes Frederic Sowa) [Orabug: 17837923] {CVE-2013-0343}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.33.4.el6uek]
changelog:
  - kernel/signal.c: stop info leak via the tkill and the tgkill syscalls (Emese Revfy) [Orabug: 17951083] {CVE-2013-2141} 
  - ip_output: do skb ufo init for peeked non ufo skb as well (Jiri Pirko) [Orabug: 17951078] {CVE-2013-4470} 
  - KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) (Andy Honig) [Orabug: 17951073] {CVE-2013-6367}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.34.1.el6uek]
changelog:
  - x86, tsc: Fix SMI induced variation in quick_pit_calibrate() (Suresh Siddha) [Orabug: 17569550]  
  - security/ima: disable IMA by default (Guru Anbalagane) [Orabug: 16622999]  
  - sched/x86: Fix overflow in cyc2ns_offset (Salman Qazi) [Orabug: 17974576]  
  - Extend "sched: Prevent divide by zero when cpu_power is 0" (Todd Vierling) [Orabug: 17815560]  
  - kernel/signal.c: stop info leak via the tkill and the tgkill syscalls (Emese Revfy) [Orabug: 17951083] {CVE-2013-2141} 
  - ip_output: do skb ufo init for peeked non ufo skb as well (Jiri Pirko) [Orabug: 17951078] {CVE-2013-4470} 
  - KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) (Andy Honig) [Orabug: 17951073] {CVE-2013-6367} 
  - af_key: fix info leaks in notify messages (Mathias Krause) [Orabug: 17837974] {CVE-2013-2234} 
  - drivers/cdrom/cdrom.c: use kzalloc() for failing hardware (Jonathan Salwan) [Orabug: 17837971] {CVE-2013-2164} 
  - fs/compat_ioctl.c: VIDEO_SET_SPU_PALETTE missing error check (Kees Cook) [Orabug: 17837966] {CVE-2013-1928} 
  - Bluetooth: RFCOMM - Fix info leak in ioctl(RFCOMMGETDEVLIST) (Mathias Krause) [Orabug: 17837959] {CVE-2012-6545} 
  - Bluetooth: RFCOMM - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17838023] {CVE-2012-6545} 
  - llc: Fix missing msg_namelen update in llc_ui_recvmsg() (Mathias Krause) [Orabug: 17837945] {CVE-2013-3231} 
  - HID: pantherlord: validate output report details (Kees Cook) [Orabug: 17837942] {CVE-2013-2892} 
  - HID: zeroplus: validate output report details (Kees Cook) [Orabug: 17837936] {CVE-2013-2889} 
  - HID: provide a helper for validating hid reports (Kees Cook) [Orabug: 17837936]  
  - NFSv4: Check for buffer length in __nfs4_get_acl_uncached (Sven Wegener) [Orabug: 17837931] {CVE-2013-4591} 
  - ansi_cprng: Fix off by one error in non-block size request (Neil Horman) [Orabug: 17837999] {CVE-2013-4345} 
  - HID: validate HID report id size (Kees Cook) [Orabug: 17837925] {CVE-2013-2888} 
  - ipv6: remove max_addresses check from ipv6_create_tempaddr (Hannes Frederic Sowa) [Orabug: 17837923] {CVE-2013-0343} 
  - dm snapshot: fix data corruption (Mikulas Patocka) [Orabug: 17618900] {CVE-2013-4299} 
  - ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET pending data (Hannes Frederic Sowa) [Orabug: 17618897] {CVE-2013-4162}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.34.2.el6uek]
changelog:
  - exec/ptrace: fix get_dumpable() incorrect tests (Kees Cook)  [18239033]  {CVE-2013-2929} {CVE-2013-2929} 
  - inet: prevent leakage of uninitialized memory to user in recv syscalls (Hannes Frederic Sowa)  [18239036]  {CVE-2013-7263} {CVE-2013-7265}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.34.3.el6uek]
changelog:
  - inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions (Hannes Frederic Sowa)  [18247290]  {CVE-2013-7263} {CVE-2013-7265}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.34.4.el6uek]
changelog:
  - netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages (Daniel Borkmann)  [Orabug: 18462076]  {CVE-2014-2523} 
  - net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable (Daniel Borkmann)  [Orabug: 18461091]  {CVE-2014-0101}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.34.5.el6uek]
changelog:
  - aacraid: missing capable() check in compat ioctl (Dan Carpenter)  [Orabug: 18723276]  {CVE-2013-6383}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.35.1.el6uek]
changelog:
  - scsi: kill outstanding requests (Dave Kleikamp)  [18037163]  
  - exec/ptrace: fix get_dumpable() incorrect tests (Kees Cook)  [18239033]  {CVE-2013-2929} {CVE-2013-2929} 
  - inet: prevent leakage of uninitialized memory to user in recv syscalls (Hannes Frederic Sowa)  [18239036]  {CVE-2013-7263} {CVE-2013-7265}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.36.1.el6uek]
changelog:
  - scsi_scan: Continue scan for LUNs in 'unavailable' ALUA state (Hannes Reinecke)  [Orabug: 17500570]  
  - xen/events: use locked set|clear_bit() for cpu_evtchn_mask (Jeremy Fitzhardinge)  [Orabug: 15869802]  
  - Replace tasklet with direct process (Jason Luan)  [Orabug: 15869802]  
  - xen: do not clear and mask evtchns in __xen_evtchn_do_upcall (Stefano Stabellini)  [Orabug: 15869802]  
  - aacraid: missing capable() check in compat ioctl (Dan Carpenter)  [Orabug: 18721964]  {CVE-2013-6383} 
  - netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages (Daniel Borkmann)  [Orabug: 18462076]  {CVE-2014-2523} 
  - net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable (Daniel Borkmann)  [Orabug: 18461091]  {CVE-2014-0101} 
  - inet: fix addr_len/msg->msg_namelen assignment in recv_error and rxpmtu functions (Hannes Frederic Sowa)  [Orabug: 18247290]  {CVE-2013-7263} {CVE-2013-7265}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.36.2.el6uek]
changelog:
  - futex: Make lookup_pi_state more robust (Thomas Gleixner)  [Orabug: 18918736]  {CVE-2014-3153} 
  - futex: Always cleanup owner tid in unlock_pi (Thomas Gleixner)  [Orabug: 18918736]  {CVE-2014-3153} 
  - futex: Validate atomic acquisition in futex_lock_pi_atomic() (Thomas Gleixner)  [Orabug: 18918736]  {CVE-2014-3153} 
  - futex: Forbid uaddr1 == uaddr2 in futex_requeue(..., requeue_pi=1) (Thomas Gleixner)  [Orabug: 18918736]  {CVE-2014-3153} {CVE-2014-3153}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.32-400.36.3.el6uek]
changelog:
  - fix autofs/afs/etc. magic mountpoint breakage (Al Viro)  [Orabug: 19028505]  {CVE-2014-0203} 
  - SELinux:  Fix kernel BUG on empty security contexts. (Stephen Smalley)  [Orabug: 19028381]  {CVE-2014-1874} 
  - floppy: don't write kernel-only members to FDRAWCMD ioctl output (Matthew Daley)  [Orabug: 19028446]  {CVE-2014-1738} 
  - floppy: ignore kernel-only members in FDRAWCMD ioctl input (Matthew Daley)  [Orabug: 19028439]  {CVE-2014-1737} 
  - libertas: potential oops in debugfs (Dan Carpenter)  [Orabug: 19028417]  {CVE-2013-6378}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.36.4.el6uek]
changelog:
  - l2tp: fix an unprivileged user to kernel privilege escalation (Sasha Levin)  [Orabug: 19229529]  {CVE-2014-4943} {CVE-2014-4943} 
  - ptrace,x86: force IRET path after a ptrace_stop() (Tejun Heo)  [Orabug: 19230692]  {CVE-2014-4699}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.36.5.el6uek]
changelog:
  - n_tty: Fix n_tty_write crash when echoing in raw mode (Peter Hurley)  [Orabug: 18756450]  {CVE-2014-0196} {CVE-2014-0196}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.36.6.el6uek]
changelog:
  - filter: prevent nla extensions to peek beyond the end of the message (Mathias Krause)  [Orabug: 19315783]  {CVE-2014-3144} {CVE-2014-3145} 
  - futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi() (Darren Hart)  [Orabug: 19315318]  {CVE-2012-6647}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.36.8.el6uek]
changelog:
  - auditsc: audit_krule mask accesses need bounds checking (Andy Lutomirski)  [Orabug: 19590638]  {CVE-2014-3917} 
  - futex: Fix errors in nested key ref-counting (Darren Hart)  [Orabug: 19590443]  {CVE-2014-0205}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.36.9.el6uek]
changelog:
  - ALSA: control: Don't access controls outside of protected regions (Lars-Peter Clausen)  [Orabug: 19817787]  {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655} 
  - ALSA: control: Fix replacing user controls (Lars-Peter Clausen)  [Orabug: 19817749]  {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655} 
  - mm: try_to_unmap_cluster() should lock_page() before mlocking (Vlastimil Babka)  [Orabug: 19817324]  {CVE-2014-3122} 
  - vm: convert fb_mmap to vm_iomap_memory() helper (Linus Torvalds)  [Orabug: 19816564]  {CVE-2013-2596} 
  - vm: add vm_iomap_memory() helper function (Linus Torvalds)  [Orabug: 19816564]  {CVE-2013-2596} 
  - net: sctp: inherit auth_capable on INIT collisions (Daniel Borkmann)  [Orabug: 19816069]  {CVE-2014-5077}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.36.10.el6uek]
changelog:
  - USB: whiteheat: Added bounds checking for bulk command response (James Forshaw)  [Orabug: 19849336]  {CVE-2014-3185} 
  - HID: fix a couple of off-by-ones (Jiri Kosina)  [Orabug: 19849320]  {CVE-2014-3181} 
  - netdevice.h net/core/dev.c: Convert netdev_<level> logging macros to functions (Joe Perches)  [Orabug: 19847630]  {CVE-2014-3535} 
  - device.h drivers/base/core.c Convert dev_<level> logging macros to functions (Joe Perches)  [Orabug: 19847630]  
  - vsprintf: Recursive vsnprintf: Add "%pV", struct va_format (Joe Perches)  [Orabug: 19847630]  
  - KVM: x86: Improve thread safety in pit (Andy Honig)  [Orabug: 19905688]  {CVE-2014-3611}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.36.11.el6uek]
changelog:
  - net: sctp: fix panic on duplicate ASCONF chunks (Daniel Borkmann)  [Orabug: 20010592]  {CVE-2014-3687} 
  - net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks (Daniel Borkmann)  [Orabug: 20010579]  {CVE-2014-3673}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.36.12.el6uek]
changelog:
  - HID: fix a couple of off-by-ones (Jiri Kosina)  [Orabug: 19849320]  {CVE-2014-3184} 
  - ALSA: control: Protect user controls against concurrent access (Lars-Peter Clausen)  [Orabug: 20192545]  {CVE-2014-4652} 
  - udf: Avoid infinite loop when processing indirect ICBs (Jan Kara)  [Orabug: 20192451]  {CVE-2014-6410} 
  - ALSA: control: Make sure that id->index does not overflow (Lars-Peter Clausen)  [Orabug: 20192420]  {CVE-2014-4656} 
  - ALSA: control: Handle numid overflow (Lars-Peter Clausen)  [Orabug: 20192379]  {CVE-2014-4656} 
  - net: sctp: fix remote memory pressure from excessive queueing (Daniel Borkmann)  [Orabug: 20192060]  {CVE-2014-3688}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.36.13.el6uek]
changelog:
  - net: guard tcp_set_keepalive() to tcp sockets (Eric Dumazet)  [Orabug: 20224099]  {CVE-2012-6657} 
  - isofs: Fix unbounded recursion when processing relocated directories (Jan Kara)  [Orabug: 20224061]  {CVE-2014-5471} {CVE-2014-5472} 
  - x86_64, traps: Stop using IST for #SS (Andy Lutomirski)  [Orabug: 20224029]  {CVE-2014-9090} {CVE-2014-9322}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.36.14.el6uek]
changelog:
  - net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet (Daniel Borkmann)  [Orabug: 20425334]  {CVE-2014-7841}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.37.1.el6uek]
changelog:
  - ipc/sem.c: semtimedop needs to use write lock (Guangyu Sun)  [Orabug: 19917710]  
  - net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet (Daniel Borkmann)  [Orabug: 20425334]  {CVE-2014-7841} 
  - net: guard tcp_set_keepalive() to tcp sockets (Eric Dumazet)  [Orabug: 20224099]  {CVE-2012-6657} 
  - isofs: Fix unbounded recursion when processing relocated directories (Jan Kara)  [Orabug: 20224061]  {CVE-2014-5471} {CVE-2014-5472} 
  - x86_64, traps: Stop using IST for #SS (Andy Lutomirski)  [Orabug: 20224029]  {CVE-2014-9090} {CVE-2014-9322} 
  - HID: fix a couple of off-by-ones (Jiri Kosina)  [Orabug: 19849320]  {CVE-2014-3184} 
  - ALSA: control: Protect user controls against concurrent access (Lars-Peter Clausen)  [Orabug: 20192545]  {CVE-2014-4652} 
  - udf: Avoid infinite loop when processing indirect ICBs (Jan Kara)  [Orabug: 20192451]  {CVE-2014-6410} 
  - ALSA: control: Make sure that id->index does not overflow (Lars-Peter Clausen)  [Orabug: 20192420]  {CVE-2014-4656} 
  - ALSA: control: Handle numid overflow (Lars-Peter Clausen)  [Orabug: 20192379]  {CVE-2014-4656} 
  - net: sctp: fix remote memory pressure from excessive queueing (Daniel Borkmann)  [Orabug: 20192060]  {CVE-2014-3688} 
  - net: sctp: fix panic on duplicate ASCONF chunks (Daniel Borkmann)  [Orabug: 20010592]  {CVE-2014-3687} 
  - net: sctp: fix skb_over_panic when receiving malformed ASCONF chunks (Daniel Borkmann)  [Orabug: 20010579]  {CVE-2014-3673} 
  - USB: whiteheat: Added bounds checking for bulk command response (James Forshaw)  [Orabug: 19849336]  {CVE-2014-3185} 
  - HID: fix a couple of off-by-ones (Jiri Kosina)  [Orabug: 19849320]  {CVE-2014-3181} 
  - netdevice.h net/core/dev.c: Convert netdev_<level> logging macros to functions (Joe Perches)  [Orabug: 19847630]  {CVE-2014-3535} 
  - device.h drivers/base/core.c Convert dev_<level> logging macros to functions (Joe Perches)  [Orabug: 19847630]  
  - vsprintf: Recursive vsnprintf: Add "%pV", struct va_format (Joe Perches)  [Orabug: 19847630]  
  - KVM: x86: Improve thread safety in pit (Andy Honig)  [Orabug: 19905688]  {CVE-2014-3611} 
  - ALSA: control: Don't access controls outside of protected regions (Lars-Peter Clausen)  [Orabug: 19817787]  {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655} 
  - ALSA: control: Fix replacing user controls (Lars-Peter Clausen)  [Orabug: 19817749]  {CVE-2014-4653} {CVE-2014-4654} {CVE-2014-4655} 
  - mm: try_to_unmap_cluster() should lock_page() before mlocking (Vlastimil Babka)  [Orabug: 19817324]  {CVE-2014-3122} 
  - vm: convert fb_mmap to vm_iomap_memory() helper (Linus Torvalds)  [Orabug: 19816564]  {CVE-2013-2596} 
  - vm: add vm_iomap_memory() helper function (Linus Torvalds)  [Orabug: 19816564]  {CVE-2013-2596} 
  - net: sctp: inherit auth_capable on INIT collisions (Daniel Borkmann)  [Orabug: 19816069]  {CVE-2014-5077} 
  - auditsc: audit_krule mask accesses need bounds checking (Andy Lutomirski)  [Orabug: 19590638]  {CVE-2014-3917} 
  - futex: Fix errors in nested key ref-counting (Darren Hart)  [Orabug: 19590443]  {CVE-2014-0205} 
  - sctp: Fix sk_ack_backlog wrap-around problem (Xufeng Zhang)  [Orabug: 19404246]  {CVE-2014-4667} 
  - filter: prevent nla extensions to peek beyond the end of the message (Mathias Krause)  [Orabug: 19315783]  {CVE-2014-3144} {CVE-2014-3145} 
  - futex: Forbid uaddr == uaddr2 in futex_wait_requeue_pi() (Darren Hart)  [Orabug: 19315318]  {CVE-2012-6647} 
  - n_tty: Fix n_tty_write crash when echoing in raw mode (Peter Hurley)  [Orabug: 18756450]  {CVE-2014-0196} {CVE-2014-0196} 
  - l2tp: fix an unprivileged user to kernel privilege escalation (Sasha Levin)  [Orabug: 19229529]  {CVE-2014-4943} {CVE-2014-4943} 
  - ptrace,x86: force IRET path after a ptrace_stop() (Tejun Heo)  [Orabug: 19230692]  {CVE-2014-4699} 
  - fix autofs/afs/etc. magic mountpoint breakage (Al Viro)  [Orabug: 19028505]  {CVE-2014-0203} 
  - SELinux:  Fix kernel BUG on empty security contexts. (Stephen Smalley)  [Orabug: 19028381]  {CVE-2014-1874} 
  - floppy: don't write kernel-only members to FDRAWCMD ioctl output (Matthew Daley)  [Orabug: 19028446]  {CVE-2014-1738} 
  - floppy: ignore kernel-only members in FDRAWCMD ioctl input (Matthew Daley)  [Orabug: 19028439]  {CVE-2014-1737} 
  - libertas: potential oops in debugfs (Dan Carpenter)  [Orabug: 19028417]  {CVE-2013-6378} 
  - futex: Make lookup_pi_state more robust (Thomas Gleixner)  [Orabug: 18918736]  {CVE-2014-3153} 
  - futex: Always cleanup owner tid in unlock_pi (Thomas Gleixner)  [Orabug: 18918736]  {CVE-2014-3153} 
  - futex: Validate atomic acquisition in futex_lock_pi_atomic() (Thomas Gleixner)  [Orabug: 18918736]  {CVE-2014-3153} 
  - futex: Forbid uaddr1 == uaddr2 in futex_requeue(..., requeue_pi=1) (Thomas Gleixner)  [Orabug: 18918736]  {CVE-2014-3153} {CVE-2014-3153}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.37.2.el6uek]
changelog:
  - netfilter: conntrack: disable generic tracking for known protocols (Florian Westphal)  [Orabug: 20679631]  {CVE-2014-8160} 
  - mac80211: fix fragmentation code, particularly for encryption (Johannes Berg)  [Orabug: 20673314]  {CVE-2014-8709} 
  - tracing/syscalls: Ignore numbers outside NR_syscalls' range (Rabin Vincent)  [Orabug: 20673165]  {CVE-2014-7825} {CVE-2014-7826} 
  - tracing/syscalls: Fix perf syscall tracing when syscall_nr == -1 (Will Deacon)  [Orabug: 20673165]  {CVE-2014-7825} {CVE-2014-7826}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.37.3.el6uek]
changelog:
  - net: sctp: fix slab corruption from use after free on INIT collisions (Daniel Borkmann)  [Orabug: 20780349]  {CVE-2015-1421}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.37.4.el6uek]
changelog:
  - isofs: Fix unchecked printing of ER records (Jan Kara)  [Orabug: 20930553]  {CVE-2014-9584} 
  - selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID. (Stephen Smalley)  [Orabug: 20930502]  {CVE-2014-3215} 
  - Add PR_{GET,SET}_NO_NEW_PRIVS to prevent execve from granting privs (Andy Lutomirski)  [Orabug: 20930519]  {CVE-2014-3215}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.37.5.el6uek]
changelog:
  - x86_64, vdso: Fix the vdso address randomization algorithm (Andy Lutomirski)  [Orabug: 21226731]  {CVE-2014-9585} 
  - isofs: Fix infinite looping over CE entries (Jan Kara)  [Orabug: 21225977]  {CVE-2014-9420} 
  - x86_64, switch_to(): Load TLS descriptors before switching DS and ES (Andy Lutomirski)  [Orabug: 21225939]  {CVE-2014-9419}


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.32-400.37.6.el6uek]
changelog:
  - x86/asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Andy Lutomirski)  [Orabug: 21308307]  {CVE-2015-2830} 
  - x86, mm/ASLR: Fix stack randomization on 64-bit systems (Hector Marco-Gisbert)  [Orabug: 21307917]  {CVE-2015-1593} {CVE-2015-1593}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.37.7.el6uek]
changelog:
  - ipv6: Don't reduce hop limit for an interface (D.S. Ljungmark)  [Orabug: 21444792]  {CVE-2015-2922}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.37.8.el6uek]
changelog:
  - KVM: x86: SYSENTER emulation is broken (Nadav Amit)  [Orabug: 21502741]  {CVE-2015-0239} {CVE-2015-0239} 
  - x86/tls: Validate TLS entries to protect espfix (Andy Lutomirski)  [Orabug: 20223778]  {CVE-2014-8133} 
  - fs: take i_mutex during prepare_binprm for set[ug]id executables (Jann Horn)  [Orabug: 21502256]  {CVE-2015-3339} 
  - eCryptfs: Remove buggy and unnecessary write in file name decode routine (Michael Halcrow)  [Orabug: 21502067]  {CVE-2014-9683}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.37.9.el6uek]
changelog:
  - x86, tls: Interpret an all-zero struct user_desc as "no segment" (Andy Lutomirski)  [Orabug: 21518750]  
  - x86, tls, ldt: Stop checking lm in LDT_empty (Andy Lutomirski)  [Orabug: 21518750]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.37.10.el6uek]
changelog:
  - md: use kzalloc() when bitmap is disabled (Benjamin Randazzo)  [Orabug: 21563043]  {CVE-2015-5697} 
  - netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len (Andrey Vagin)  [Orabug: 21562781]  {CVE-2014-9715}


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.32-400.37.11.el6uek]
changelog:
  - udp: fix behavior of wrong checksums (Eric Dumazet)  [Orabug: 21628852]  {CVE-2015-5364} {CVE-2015-5366}


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.32-400.37.13.el6uek]
changelog:
  - KVM: svm: unconditionally intercept #DB (Paolo Bonzini)  [Orabug: 22336518]  {CVE-2015-8104} {CVE-2015-8104} 
  - KVM: x86: work around infinite loop in microcode when #AC is delivered (Eric Northup)  [Orabug: 22336493]  {CVE-2015-5307} {CVE-2015-5307}


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.32-400.37.14.el6uek]
changelog:
  - KVM: add arg to ac_interception() missing from "KVM: x86: work around infinite loop in microcode when #AC is delivered" (Chuck Anderson)  [Orabug: 22336493]  {CVE-2015-5307}


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.32-400.37.15.el6uek]
changelog:
  - ipc/sem.c: fully initialize sem_array before making it visible (Manfred Spraul)  [Orabug: 22250043]  {CVE-2015-7613} 
  - Initialize msg/shm IPC objects before doing ipc_addid() (Linus Torvalds)  [Orabug: 22250043]  {CVE-2015-7613} 
  - crypto: add missing crypto module aliases (Mathias Krause)  [Orabug: 22249655]  {CVE-2013-7421} {CVE-2014-9644} 
  - crypto: include crypto- module prefix in template (Kees Cook)  [Orabug: 22249655]  {CVE-2013-7421} {CVE-2014-9644} 
  - crypto: prefix module autoloading with "crypto-" (Kees Cook)  [Orabug: 22249655]  {CVE-2013-7421} {CVE-2014-9644}


author: Brian Maly <brian.maly@oracle.com> [2.6.32-400.37.16.el6uek]
changelog:
  - sctp: Prevent soft lockup when sctp_accept() is called during a timeout event (Karl Heiss)  [Orabug: 23222781]  {CVE-2015-8767}


author: Brian Maly <brian.maly@oracle.com> [2.6.32-400.37.17.el6uek]
changelog:
  - net: add validation for the socket syscall protocol argument (Hannes Frederic Sowa)  [Orabug: 23267965]  {CVE-2015-8543} {CVE-2015-8543} 
  - ext4: Fix null dereference in ext4_fill_super() (Ben Hutchings)  [Orabug: 23263398]  {CVE-2015-8324} {CVE-2015-8324} 
  - ipv6: addrconf: validate new MTU before applying it (Marcelo Leitner)  [Orabug: 23263242]  {CVE-2015-8215} 
  - ext4: avoid hang when mounting non-journal filesystems with orphan list (Theodore Ts'o)  [Orabug: 23262201]  {CVE-2015-7509} 
  - ext4: make orphan functions be no-op in no-journal mode (Anatol Pomozov)  [Orabug: 23262201]  {CVE-2015-7509} 
  - unix: properly account for FDs passed over unix sockets (willy tarreau)  [Orabug: 23262258]  {CVE-2013-4312} {CVE-2013-4312}


author: Brian Maly <brian.maly@oracle.com> [2.6.32-400.37.18.el6uek]
changelog:
  - IB/security: Restrict use of the write() interface (Jason Gunthorpe)  [Orabug: 23641666]  {CVE-2016-4565}


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-100.1.1.el6uek]
changelog:
  - mm: compaction: check pfn_valid when entering a new MAX_ORDER_NR_PAGES block
    during isolation for migration (Mel Gorman)
  - block: Disable autoprotect (Martin K. Petersen)
  - enic: do vlan cleanup (Jiri Pirko)
  - enic: Add support to configure hardware interrupt coalesce timers in a
    platform independent way (Vasanthy Kolluri)
  - enic: Partial: Bug Fix: Fix hardware transmit queue indexing in
    enic_poll_controller (Vasanthy Kolluri)
  - enic: Get/Set interrupt resource index for transmit and receive queues
    (Vasanthy Kolluri)
  - enic: Log device configuration in detail during driver load (Vasanthy
    Kolluri)
  - enic: Pass 802.1p bits for packets tagged with vlan zero (Vasanthy Kolluri)
  - enic: update to support 64 bit stats (stephen hemminger)
  - enic: Add support for MTU change via port profile on a dynamic vnic (Roopa
    Prabhu)
  - drivers/net: Remove unnecessary semicolons (Joe Perches)
  - [SCSI] megaraid_sas Version to 5.40-rc1 and Changelog update (Adam Radford)
  - [SCSI] megaraid_sas: Add .change_queue_depth support (Adam Radford)
  - [SCSI] megaraid_sas: Fix FastPath I/O to work on degraded raid 1 (Adam
    Radford)
  - bnx2x: add missing break in bnx2x_dcbnl_get_cap (Shmulik Ravid)
  - bnx2x: fix hw attention handling (Dmitry Kravkov)
  - bnx2x: prevent flooded warnning kernel info (Joe Jin)
  - Btrfs: don't reserve data with extents locked in btrfs_fallocate (Chris
    Mason)
  - watchdog: hpwdt: prevent multiple "NMI occurred" messages (Naga Chumbalkar)
  - watchdog: hpwdt: add next gen HP servers (Thomas Mingarelli)
  - bnx2fc: Update copyright and bump version to 1.0.4 (Bhanu Prakash Gollapudi)
  - bnx2fc: Tx BDs cache in write tasks (Bhanu Prakash Gollapudi)
  - bnx2fc: Do not arm CQ when there are no CQEs (Bhanu Prakash Gollapudi)
  - bnx2fc: hold tgt lock when calling cmd_release (Bhanu Prakash Gollapudi)
  - bnx2fc: Enable support for sequence level error recovery (Bhanu Prakash
    Gollapudi)
  - bnx2fc: HSI changes for tape (Bhanu Prakash Gollapudi)
  - bnx2fc: Handle REC_TOV error code from firmware (Bhanu Prakash Gollapudi)
  - bnx2fc: REC/SRR link service request and response handling (Bhanu Prakash
    Gollapudi)
  - bnx2fc: Support 'sequence cleanup' task (Bhanu Prakash Gollapudi)
  - bnx2fc: Enable REC & CONF support for the session (Bhanu Prakash Gollapudi)
  - bnx2fc: Introduce interface structure for each vlan interface (Bhanu Prakash
    Gollapudi)
  - bnx2fc: Replace printks with KERN_ALERT to KERN_ERR/KERN_INFO (Bhanu Prakash
    Gollapudi)
  - cnic: Add VLAN ID as a parameter during netevent upcall (Michael Chan)
  - bnx2i: Updated copyright and bump version (Eddie Wai)
  - bnx2i: Modified to skip CNIC registration if iSCSI is not supported (Eddie
    Wai)
  - bnx2i: Added the use of kthreads to handle SCSI cmd completion (Eddie Wai)
  - iscsi: Use struct scsi_lun in iscsi structs instead of u8[8] (Andy Grover)
  - cnic: Wait for all Context IDs to be deleted before sending FCOE_DESTROY_FUNC
    (Michael Chan)
  - cnic: Fix Context ID space calculation (Michael Chan)
  - bnx2x: Implementation for netdev->ndo_fcoe_get_wwn (Vladislav Zolotarov)
  - bnx2: Fix endian swapping on firmware version string (Michael Chan)
  - bnx2: Close device if tx_timeout reset fails (Michael Chan)
  - bnx2: Read iSCSI config from shared memory during ->probe() (Michael Chan)
  - bnx2: Add MCP dump (Jeffrey Huang)
  - bnx2: remove unnecessary read of PCI_CAP_ID_EXP (Jon Mason)
  - cnic: Return proper error code if we fail to send netlink message (Michael
    Chan)
  - cnic: Fix ring setup/shutdown code (Michael Chan)
  - cnic: Fix port_mode setting (Michael Chan)
  - cnic: Replace get_random_bytes() with random32() (Michael Chan)
  - cnic, bnx2i: Add support for new devices - 57800, 57810, and 57840 (Michael
    Chan)
  - drivers/net: Remove casts of void * (Joe Perches)
  - bnx2fc: Fix kernel panic when deleting NPIV ports (Bhanu Prakash Gollapudi)
  - bnx2fc: scsi_dma_unmap() not invoked on IO completions (Bhanu Prakash
    Gollapudi)
  - bnx2fc: host stats show the link speed 'unknown' on NIC partitioned
    interfaces (Bhanu Prakash Gollapudi)
  - bnx2x: Update date to 2011/06/13 and version to 1.70.00-0 (Vladislav
    Zolotarov)
  - bnx2x: PFC support for 578xx (Dmitry Kravkov)
  - bnx2x: Rename LASI registers to definitions in mdio.h (Yaniv Rosner)
  - bnx2x: Add a periodic task for link PHY events (Yaniv Rosner)
  - bnx2x: Adjust BCM84833 to BCM578xx (Yaniv Rosner)
  - bnx2x: Adjust ETS to 578xx (Yaniv Rosner)
  - bnx2x: Add new PHY 54616s (Yaniv Rosner)
  - bnx2x: Add Warpcore support for 578xx (Yaniv Rosner)
  - bnx2x: Add new MAC support for 578xx (Yaniv Rosner)
  - bnx2x: Cosmetic changes. (Dmitry Kravkov)
  - bnx2x: update DCB data during PMF migration (Dmitry Kravkov)
  - bnx2x: 57712 parity handling (Vladislav Zolotarov)
  - New 7.0 FW: bnx2x, cnic, bnx2i, bnx2fc (Vlad Zolotarov)
  - cnic: Move indexing function pointers to struct kcq_info (Michael Chan)
  - linux-firmware: Add a new FW 7.0.20.0 (Vladislav Zolotarov)
  - ixgbe: Fix FCOE memory leak for DDP packets (Alexander Duyck)
  - ixgbe: fix PHY link setup for 82599 (Emil Tantilov)
  - ixgbe: fix __ixgbe_notify_dca() bail out code (Don Skidmore)
  - ixgbe: convert to ndo_fix_features (Don Skidmore)
  - ixgbe: only enable WoL for magic packet by default (Andy Gospodarek)
  - ixgbe: remove ifdef check for non-existent define (Emil Tantilov)
  - ixgbe: Pass staterr instead of re-reading status and error bits from
    descriptor (Alexander Duyck)
  - ixgbe: Move interrupt related values out of ring and into q_vector (Alexander
    Duyck)
  - ixgbe: add structure for containing RX/TX rings to q_vector (Alexander Duyck)
  - ixgbe: inline the ixgbe_maybe_stop_tx function (Alexander Duyck)
  - ixgbe: Update ATR to use recorded TX queues instead of CPU for routing
    (Alexander Duyck)
  - ixgbe: Make certain to initialize the fdir_perfect_lock in all cases
    (Alexander Duyck)
  - e1000: always call e1000_check_for_link() on e1000_ce4100 MACs. (Nicolas
    Schichan)
  - e1000: do vlan cleanup (Jiri Pirko)
  - e1000: convert to ndo_fix_features (Michał Mirosław)
  - e1000: remove unnecessary code (Greg Dietsche)
  - igbvf: do vlan cleanup (Jiri Pirko)
  - ixgbe: A fix to VF TX rate limit (Lior Levy)
  - ixgbe: Update method used for determining descriptor count for an skb
    (Alexander Duyck)
  - ixgbe: Add one function that handles most of context descriptor setup
    (Alexander Duyck)
  - ixgbe: Move all values that deal with count, next_to_use, next_to_clean to
    u16 (Alexander Duyck)
  - ixgbe: Convert IXGBE_DESC_UNUSED from macro to static inline function
    (Alexander Duyck)
  - ixgbe: pass adapter struct instead of netdev for interrupt data (Alexander
    Duyck)
  - ixgbe: update driver version string (Don Skidmore)
  - ixgbe: fix ring assignment issues for SR-IOV and drop cases (Alexander Duyck)
  - ixgbe: disable RSC when Rx checksum is off (Emil Tantilov)
  - ixgbe: move reset code into a separate function (Emil Tantilov)
  - ixgbe: move setting RSC into a separate function (Emil Tantilov)
  - ixgbe: add support for nfc addition and removal of filters (Alexander Duyck)
  - ixgbe: add support for displaying ntuple filters via the nfc interface
    (Alexander Duyck)
  - ixgbe: add basic support for setting and getting nfc controls (Alexander
    Duyck)
  - ixgbe: update perfect filter framework to support retaining filters
    (Alexander Duyck)
  - ixgbe: fix flags relating to perfect filters to support coexistence
    (Alexander Duyck)
  - ixgbe: remove ntuple filtering (Alexander Duyck)
  - ixgbe: setup per CPU PCI pool for FCoE DDP (Vasu Dev)
  - ixgbe: add support for Dell CEM (Emil Tantilov)
  - bnx2x: Created bnx2x_sp (Vladislav Zolotarov)
  - bnx2x: removed unused variables (Dmitry Kravkov)
  - bnx2x: use bnx2x_reload_if_running (Dmitry Kravkov)
  - bnx2x: dump FW memory when appropriate msglvl is raised (Dmitry Kravkov)
  - bnx2x: do not call link update without HW notification (Yaniv Rosner)
  - bnx2x: disable fairness if ETS is enabled (Dmitry Kravkov)
  - bnx2x: avoid release of unrequested irqs (Dmitry Kravkov)
  - bnx2x: put start bd csum in separate function (Dmitry Kravkov)
  - bnx2x: remove references to intr_sem (Dmitry Kravkov)
  - bnx2x: do not allocate FCoE ring if disabled (Dmitry Kravkov)
  - bnx2x: Improve cl45 access methods (Yaniv Rosner)
  - bnx2x: Modify XGXS functions (Yaniv Rosner)
  - bnx2x: Fix link status sync (Yaniv Rosner)
  - bnx2x: Adjust BCM8726 module detection settings (Yaniv Rosner)
  - bnx2x: Fix grammar and relocate code (Yaniv Rosner)
  - bnx2x: Fix BCM84833 settings (Yaniv Rosner)
  - bnx2x: Fix over current port display (Yaniv Rosner)
  - bnx2x: Add TX fault check for fiber PHYs (Yaniv Rosner)
  - bnx2x: Change return status type (Yaniv Rosner)
  - bnx2x: Fix port type display (Yaniv Rosner)
  - bnx2x: Add new phy BCM8722 (Yaniv Rosner)
  - Revert "bnx2fc: Fix kernel panic when deleting NPIV ports" (Bob Picco)
  - Revert "bnx2fc: scsi_dma_unmap() not invoked on IO completions" (Bob Picco)
  - Revert "bnx2x: prevent flooded warnning kernel info" (Bob Picco)
  - Revert "bnx2x: fix hw attention handling" (Bob Picco)
  - Revert "bnx2x: add missing break in bnx2x_dcbnl_get_cap" (Bob Picco)
  - ixgbe: DCB and perfect filters can coexist (John Fastabend)
  - ixgbe: fix bit mask for DCB version (John Fastabend)
  - ixgbe: setup redirection table for multiple packet buffers (John Fastabend)
  - ixgbe: DCB 82598 devices, tx_idx and rx_idx swapped (John Fastabend)
  - ixgbe: DCB use existing TX and RX queues (John Fastabend)
  - ixgbe: configure minimal packet buffers to support TC (John Fastabend)
  - ixgbe: consolidate MRQC and MTQC handling (John Fastabend)
  - ixgbe: consolidate packet buffer allocation (John Fastabend)
  - ixgbe: dcbnl reduce duplicated code and indentation (John Fastabend)
  - ixgbevf: do vlan cleanup (Jiri Pirko)
  - ixgbevf: remove unnecessary ampersands (Stephen Hemminger)
  - ixgbevf: Fix bungled declaration of ixgbevf_mbx_ops (Greg Rose)
  - ixgbevf: Update the driver string (Greg Rose)
  - e1000e: workaround invalid Tx/Rx tail descriptor register write (Bruce Allan)
  - e1000e: Spurious interrupts & dropped packets with 82577/8/9 in half-duplex
    (Bruce Allan)
  - e1000e: increase driver version number (Bruce Allan)
  - e1000e: alternate MAC address update (Bruce Allan)
  - e1000e: do not disable receiver on 82574/82583 (Bruce Allan)
  - e1000e: minor re-order of #include files (Bruce Allan)
  - e1000e: remove unnecessary check for NULL pointer (Bruce Allan)
  - intel drivers: repair missing flush operations (Jesse Brandeburg)
  - e1000e: use GFP_KERNEL allocations at init time (Jeff Kirsher)
  - e1000e: Add Jumbo Frame support to 82583 devices (Carolyn Wyborny)
  - e1000e: remove e1000_queue_stats (Eric Dumazet)
  - net: e1000e: Use is_multicast_ether_addr helper (Tobias Klauser)
  - e1000e: remove unnecessary reads of PCI_CAP_ID_EXP (Jon Mason)
  - e1000e: update driver version (Bruce Allan)
  - e1000e: Clear host wakeup bit on 82577/8 without touching PHY page 800 (Bruce
    Allan)
  - e1000e: access multiple PHY registers on same page at the same time (Bruce
    Allan)
  - e1000e: do not schedule the Tx queue until ready (Bruce Allan)
  - e1000e: log when swflag is cleared unexpectedly on ICH/PCH devices (Bruce
    Allan)
  - e1000e: 82579 intermittently disabled during S0->Sx (Bruce Allan)
  - e1000e: disable far-end loopback mode on ESB2 (Bruce Allan)
  - net: introduce __netdev_alloc_skb_ip_align (Eric Dumazet)
  - update modsign (Maxim Uvarov) [Orabug: 13615815]


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-100.2.1.el6uek]
changelog:
  - config: enable dm-nfs (Guru Anbalagane)
  - Update lpfc version for 8.3.5.58.2p driver release (Chuck Anderson)
  - Fix build warning with uninitialized variable (Chuck Anderson)
  - Fix warning on i386 system (CR 123966) (Chuck Anderson)
  - Fix mailbox and vpi memory leaks causing crashes (CR 126818) (Chuck Anderson)
  - Fixed unbounded firmware revision string from port caused the system panic
    (CR 126560) (Chuck Anderson)


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-100.3.1.el6uek]
changelog:
  - Btrfs: clear the extent uptodate bits during parent transid failures (Chris
    Mason)
  - Btrfs: add extra sanity checks on the path names in btrfs_mksubvol (Chris
    Mason)
  - Btrfs: make sure we update latest_bdev (Chris Mason)
  - Btrfs: improve error handling for btrfs_insert_dir_item callers (Chris Mason)
  - fnic: return zero on fnic_reset() success (Joe Jin)
  - [SCSI] libfc: improve flogi retries to avoid lport stuck (Vasu Dev) 
  - [SCSI] libfc: avoid exchanges collision during lport reset (Vasu Dev)
  - igbvf: update version number (Williams, Mitch A)


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-100.4.1.el6uek]
changelog:
  - sysfs: restore upstream sysfs code (Guru Anbalagane)
  - rpm: remove symlink on uninstall (Maxim Uvarov) [Orabug: 13791936]
  - Btrfs: fix casting error in scrub reada code (Chris Mason)


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-100.5.1.el6uek]
changelog:
  - proc: make sure mem_open() doesn't pin the target's memory (Oleg Nesterov) 
  - proc: mem_release() should check mm != NULL (Oleg Nesterov) [orabug 13811116]
  - proc: unify mem_read() and mem_write() (Oleg Nesterov)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-100.6.1.el6uek]
changelog:
  - regset: Return -EFAULT, not -EIO, on host-side memory fault (H. Peter Anvin)
    {CVE-2012-1097}
  - regset: Prevent null pointer reference on readonly regsets (H. Peter Anvin)
    {CVE-2012-1097}
  - cifs: fix dentry refcount leak when opening a FIFO on lookup (Jeff Layton)
    {CVE-2012-1090}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-100.7.1.el6uek]
changelog:
  - KVM: Ensure all vcpus are consistent with in-kernel irqchip settings (Avi
    Kivity) [Bugdb: 13871] {CVE-2012-1601}
  - jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer (Eric Sandeen)
    [Bugdb: 13871] {CVE-2011-4086}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-100.9.1.el6uek]
changelog:
  - mm: pmd_read_atomic: fix 32bit PAE pmd walk vs pmd_populate SMP race
    condition (Andrea Arcangeli) [Bugdb: 13966] {CVE-2012-2373}
  - mm: thp: fix pmd_bad() triggering in code paths holding mmap_sem read mode
    (Andrea Arcangeli)  {CVE-2012-1179}
  - KVM: Fix buffer overflow in kvm_set_irq() (Avi Kivity) [Bugdb: 13966]
    {CVE-2012-2137}
  - net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()
    (Jason Wang) [Bugdb: 13966] {CVE-2012-2136}
  - KVM: lock slots_lock around device assignment (Alex Williamson) [Bugdb:
    13966] {CVE-2012-2121}
  - KVM: unmap pages from the iommu when slots are removed (Alex Williamson)
    [Bugdb: 13966] {CVE-2012-2121}
  - KVM: introduce kvm_for_each_memslot macro (Xiao Guangrong) [Bugdb: 13966]
  - fcaps: clear the same personality flags as suid when fcaps are used (Eric
    Paris) [Bugdb: 13966] {CVE-2012-2123}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-100.0.19.el6uek]
changelog:
  - scripts/git-changelog: generate rpm changelog script (Maxim Uvarov)
  - Revert "hpwd watchdog mark page executable" (Maxim Uvarov)
  - Partial revert of mainline removal of deprecated sysfs interface for 13568528
    (Chuck Anderson)
  - scsi:lpfc update to 8.3.5.58 (Maxim Uvarov)
  - Let KERNEL_VERSION be 3.0.x, and override UTSNAME (Nelson Elhage)
  - qla4xxx: Fix qla4xxx_dump_buffer to dump buffer correctly (Vikas Chaudhary)
  - qla4xxx: Fix the IDC locking mechanism (Nilesh Javali)
  - qla4xxx: Wait for disable_acb before doing set_acb (Vikas Chaudhary)
  - qla4xxx: Don't recover adapter if device state is FAILED (Sarang Radke)
  - qla4xxx: fix call trace on rmmod with ql4xdontresethba=1 (Sarang Radke)
  - qla4xxx: Fix CPU lockups when ql4xdontresethba set (Mike Hernandez)
  - qla4xxx: Perform context resets in case of context failures. (Vikas
    Chaudhary)
  - do not obsolete firmware (Maxim Uvarov)
  - Revert "xen/pv-on-hvm kexec: add xs_reset_watches to shutdown watches from
    old kernel" (Konrad Rzeszutek Wilk)
  - Revert "xen-blkback: convert hole punching to discard request on loop
    devices" (Maxim Uvarov)
  - ath9k: Fix kernel panic in AR2427 in AP mode (Mohammed Shafi Shajakhan)
  - ptrace: partially fix the do_wait(WEXITED) vs EXIT_DEAD->EXIT_ZOMBIE race
    (Oleg Nesterov)
  - Revert "rtc: Disable the alarm in the hardware" (Linus Torvalds)
  - hung_task: fix false positive during vfork (Mandeep Singh Baines)
  - drm/radeon/kms/atom: fix possible segfault in pm setup (Alexander Müller)
  - xfs: log all dirty inodes in xfs_fs_sync_fs (Christoph Hellwig)
  - xfs: log the inode in ->write_inode calls for kupdate (Christoph Hellwig)
  - mfd: Turn on the twl4030-madc MADC clock (Kyle Manna)
  - mfd: Check for twl4030-madc NULL pointer (Kyle Manna)
  - mfd: Copy the device pointer to the twl4030-madc structure (Kyle Manna)
  - mfd: Fix mismatch in twl4030 mutex lock-unlock (Sanjeev Premi)
  - iwlwifi: update SCD BC table for all SCD queues (Emmanuel Grumbach)
  - ipv4: using prefetch requires including prefetch.h (Stephen Rothwell)
  - ipv4: reintroduce route cache garbage collector (Eric Dumazet)
  - ipv4: flush route cache after change accept_local (Weiping Pan)
  - sctp: Do not account for sizeof(struct sk_buff) in estimated rwnd (Thomas
    Graf)
  - sctp: fix incorrect overflow check on autoclose (Xi Wang)
  - sch_gred: should not use GFP_KERNEL while holding a spinlock (Eric Dumazet)
  - net: have ipconfig not wait if no dev is available (Gerlando Falauto)
  - mqprio: Avoid panic if no options are provided (Thomas Graf)
  - llc: llc_cmsg_rcv was getting called after sk_eat_skb. (Alex Juncu)
  - ppp: fix pptp double release_sock in pptp_bind() (Djalal Harouni)
  - net: bpf_jit: fix an off-one bug in x86_64 cond jump target (Markus Kötter)
  - sparc: Fix handling of orig_i0 wrt. debugging when restarting syscalls.
    (David S. Miller)
  - sparc64: Fix masking and shifting in VIS fpcmp emulation. (David S. Miller)
  - sparc32: Correct the return value of memcpy. (David S. Miller)
  - sparc32: Remove uses of %g7 in memcpy implementation. (David S. Miller)
  - sparc32: Remove non-kernel code from memcpy implementation. (David S. Miller)
  - sparc: Kill custom io_remap_pfn_range(). (David S. Miller)
  - sparc64: Patch sun4v code sequences properly on module load. (David S.
    Miller)
  - sparc32: Be less strict in matching %lo part of relocation. (David S. Miller)
  - sparc64: Fix MSIQ HV call ordering in pci_sun4v_msiq_build_irq(). (David S.
    Miller)
  - mm: hugetlb: fix non-atomic enqueue of huge page (Hillf Danton)
  - drm/radeon/kms: bail on BTC parts if MC ucode is missing (Alex Deucher)
  - watchdog: hpwdt: Changes to handle NX secure bit in 32bit path (Mingarelli,
    Thomas)
  - futex: Fix uninterruptible loop due to gate_area (Hugh Dickins)
  - oprofile, arm/sh: Fix oprofile_arch_exit() linkage issue (Vladimir Zapolskiy)
  - ARM: 7220/1: mmc: mmci: Fixup error handling for dma (Ulf Hansson)
  - ARM: 7214/1: mmc: mmci: Fixup handling of MCI_STARTBITERR (Ulf Hansson)
  - ARM:imx:fix pwm period value (Jason Chen)
  - VFS: Fix race between CPU hotplug and lglocks (Srivatsa S. Bhat)
  - memcg: keep root group unchanged if creation fails (Hillf Danton)
  - iwlwifi: allow to switch to HT40 if not associated (Wey-Yi Guy)
  - iwlwifi: do not set the sequence control bit is not needed (Wey-Yi Guy)
  - ath9k: fix max phy rate at rate control init (Rajkumar Manoharan)
  - media: s5p-fimc: Use correct fourcc for RGB565 colour format (Sylwester
    Nawrocki)
  - vfs: __read_cache_page should use gfp argument rather than GFP_KERNEL (Dave
    Kleikamp)
  - mfd: Fix twl-core oops while calling twl_i2c_* for unbound driver (Ilya
    Yanok)
  - cgroups: fix a css_set not found bug in cgroup_attach_proc (Mandeep Singh
    Baines)
  - mmc: vub300: fix type of firmware_rom_wait_states module parameter (Rusty
    Russell)
  - nilfs2: unbreak compat ioctl (Thomas Meyer)
  - SELinux: Fix RCU deref check warning in sel_netport_insert() (David Howells)
  - NFSv4.1: Ensure that we handle _all_ SEQUENCE status bits. (Trond Myklebust)
  - oprofile: Fix uninitialized memory access when writing to writing to
    oprofilefs (Robert Richter)
  - oom: fix integer overflow of points in oom_badness (Frantisek Hrbata)
  - binary_sysctl(): fix memory leak (Michel Lespinasse)
  - percpu: fix per_cpu_ptr_to_phys() handling of non-page-aligned addresses
    (Eugene Surovegin)
  - Input: synaptics - fix touchpad not working after S2R on Vostro V13 (Dmitry
    Torokhov)
  - MXC PWM: should active during DOZE/WAIT/DBG mode (Jason Chen)
  - ssb: fix init regression with SoCs (Hauke Mehrtens)
  - block: initialize request_queue's numa node during (Mike Snitzer)
  - mac80211: fix another race in aggregation start (Johannes Berg)
  - SCSI: fcoe: Fix preempt count leak in fcoe_filter_frames() (Thomas Gleixner)
  - SCSI: zfcp: return early from slave_destroy if slave_alloc returned early
    (Steffen Maier)
  - cfq-iosched: fix cfq_cic_link() race confition (Yasuaki Ishimatsu)
  - cfq-iosched: free cic_index if blkio_alloc_blkg_stats fails (majianpeng)
  - drm/i915: prevent division by zero when asking for chipset power (Eugeni
    Dodonov)
  - rtc: m41t80: Workaround broken alarm functionality (John Stultz)
  - ipip, sit: copy parms.name after register_netdevice (Ted Feng)
  - ARM: OMAP: rx51: fix USB (Felipe Contreras)
  - Revert "clockevents: Set noop handler in clockevents_exchange_device()"
    (Linus Torvalds)
  - ASoC: core: Don't schedule deferred_resume_work twice (Stephen Warren)
  - USB: option: Removing one bogus and adding some new Huawei combinations
    (Bjørn Mork)
  - usb: option: Add Huawei E398 controlling interfaces (Alex Hermann)
  - USB: cdc-acm: add IDs for Motorola H24 HSPA USB module. (Krzysztof Hałasa)
  - ibft: Fix finding IBFT ACPI table on UEFI (Yinghai Lu)
  - drm/radeon/kms: add some new pci ids (Alex Deucher)
  - staging: r8712u: Add new USB ID (Larry Finger)
  - fuse: fix fuse_retrieve (Miklos Szeredi)
  - ext4: handle EOF correctly in ext4_bio_write_page() (Yongqiang Yang)
  - ext4: avoid potential hang in mpage_submit_io() when blocksize < pagesize
    (Yongqiang Yang)
  - ext4: avoid hangs in ext4_da_should_update_i_disksize() (Andrea Arcangeli)
  - ext4: display the correct mount option in /proc/mounts for [no]init_itable
    (Theodore Ts'o)
  - md/raid5: fix bug that could result in reads from a failed device.
    (NeilBrown)
  - xfs: avoid synchronous transactions when deleting attr blocks (Christoph
    Hellwig)
  - xfs: fix nfs export of 64-bit inodes numbers on 32-bit kernels (Christoph
    Hellwig)
  - hwmon: (coretemp) Fix oops on CPU offlining (Jean Delvare)
  - hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops (Phillip Lougher)
  - Make TASKSTATS require root access (Linus Torvalds)
  - jbd/jbd2: validate sb->s_first in journal_get_superblock() (Eryu Guan)
  - x86, hpet: Immediately disable HPET timer 1 if rtc irq is masked (Mark
    Langsdorf)
  - mmc: mxcmmc: fix falling back to PIO (Sascha Hauer)
  - hwmon: (jz4740) fix signedness bug (Axel Lin)
  - linux/log2.h: Fix rounddown_pow_of_two(1) (Linus Torvalds)
  - mac80211: fix race condition caused by late addBA response (Nikolay Martynov)
  - iwlwifi: do not re-configure HT40 after associated (Wey-Yi Guy)
  - percpu: fix chunk range calculation (Tejun Heo)
  - intel-iommu: fix superpage support in pfn_to_dma_pte() (Allen Kay)
  - intel-iommu: set iommu_superpage on VM domains to lowest common denominator
    (Allen Kay)
  - intel-iommu: fix return value of iommu_unmap() API (Allen Kay)
  - target: Handle 0 correctly in transport_get_sectors_6() (Roland Dreier)
  - fix apparmor dereferencing potentially freed dentry, sanitize __d_path() API
    (Al Viro)
  - mm: vmalloc: check for page allocation failure before vmlist insertion (Mel
    Gorman)
  - mm: Ensure that pfn_valid() is called once per pageblock when reserving
    pageblocks (Michal Hocko)
  - ptp: Fix clock_getres() implementation (Thomas Gleixner)
  - thp: set compound tail page _count to zero (Youquan Song)
  - thp: add compound tail page _mapcount when mapped (Youquan Song)
  - fs/proc/meminfo.c: fix compilation error (Claudio Scordino)
  - ASoC: Provide a more complete DMA driver stub (Mark Brown)
  - ARM: davinci: dm646x evm: wrong register used in
    setup_vpif_input_channel_mode (Hans Verkuil)
  - ARM: at91: fix clock conid for atmel_tcb.1 on 9260/9g20 (Jean-Christophe
    PLAGNIOL-VILLARD)
  - arm: mx23: recognise stmp378x as mx23 (Wolfram Sang)
  - ARM: davinci: da850 evm: change audio edma event queue to EVENTQ_0
    (Manjunathappa, Prakash)
  - alarmtimers: Fix time comparison (Thomas Gleixner)
  - ALSA: hda/realtek - Fix Oops in alc_mux_select() (Takashi Iwai)
  - ALSA: sis7019 - give slow codecs more time to reset (David Dillow)
  - netconsole support for netfront (Zhenzhong Duan)
  - oracleasm: Fix two merge errors (Martin K. Petersen)
  - x86/numa: Add constraints check for nid parameters (Petr Holasek)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-100.0.20.el6uek]
changelog:
  - Enable Kabi Check (Guru Anbalagane)
  - net/bna driver update from 2.3.2.3 to 3.0.2.2 (Maxim Uvarov)
  - scsi/bfa driver update from 2.3.2.3 to 3.0.2.2 (Maxim Uvarov)
  - Updated version to 5.02.00.00.06.02-uek1 (Tej Parkash)
  - qla4xxx: Added error logging for firmware abort (Nilesh Javali)
  - qla4xxx: Disable generating pause frames in case of FW hung (Giridhar
    Malavali)
  - qla4xxx: Temperature monitoring for ISP82XX core. (Mike Hernandez)
  - qla4xxx: check for FW alive before calling chip_reset (Shyam Sunder)
  - qla4xxx: Remove the unused macros (Tej Parkash)
  - qla4xxx: cleanup, make qla4xxx_build_ddb_list short (Lalit Chandivade)
  - qla4xxx: clear the RISC interrupt bit during firmware init (Sarang Radke)
  - qla4xxx: clear the SCSI COMPLETION INTERRUPT bit during firmware init
    (Prasanna Mumbai)
  - qla4xxx: Fixed BFS with sendtargets as boot index. (Manish Rangankar)
  - qla4xxx: Correct the default relogin timeout value (Nilesh Javali)
  - qla4xxx: Limit the ACB Default Timeout value to 12s (Nilesh Javali)
  - bond_alb: don't disable softirq under bond_alb_xmit (Maxim Uvarov)
  - fix kernel version (Guru Anbalagane)


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-100.0.21.el6uek]
changelog:
  - git-changelog: add Orabug and CVE (Maxim Uvarov) [Add parsing Orabug and
    CVE.]
  - qla2xxx: Update the driver version to 8.03.07.12.39.0-k. (Giridhar Malavali)
  - Add support for pv hugepages and support for huge balloon pages. (Dave
    McCracken)
  - Btrfs: remove some verbose warnings (Chris Mason)
  - Btrfs: fix reservations in btrfs_page_mkwrite (Chris Mason)
  - Btrfs: use larger system chunks (Chris Mason)
  - Btrfs: add a delalloc mutex to inodes for delalloc reservations (Josef Bacik)
  - Btrfs: protect orphan block rsv with spin_lock (Josef Bacik)
  - Btrfs: don't call btrfs_throttle in file write (Josef Bacik)
  - Btrfs: release space on error in page_mkwrite (Josef Bacik)
  - Btrfs: fix btrfsck error 400 when truncating a compressed (Miao Xie)
  - Btrfs: do not use btrfs_end_transaction_throttle everywhere (Josef Bacik)
  - Btrfs: fix possible deadlock when opening a seed device (Li Zefan)
  - Btrfs: update global block_rsv when creating a new block group (Li Zefan)
  - Btrfs: rewrite btrfs_trim_block_group() (Li Zefan)
  - Btrfs: simplfy calculation of stripe length for discard operation (Li Zefan)
  - Btrfs: don't pre-allocate btrfs bio (Li Zefan)
  - Btrfs: don't pass a trans handle unnecessarily in volumes.c (Li Zefan)
  - Btrfs: reserve metadata space in btrfs_ioctl_setflags() (Li Zefan)
  - Btrfs: remove BUG_ON()s in btrfs_ioctl_setflags() (Li Zefan)
  - Btrfs: check the return value of io_ctl_init() (Li Zefan)
  - Btrfs: avoid possible NULL deref in io_ctl_drop_pages() (Li Zefan)
  - Btrfs: add pinned extents to on-disk free space cache correctly (Li Zefan)
  - Btrfs: revamp clustered allocation logic (Alexandre Oliva)
  - Btrfs: don't set up allocation result twice (Alexandre Oliva)
  - Btrfs: test free space only for unclustered allocation (Alexandre Oliva)
  - Btrfs: use bigger metadata chunks on bigger filesystems (Chris Mason)
  - Btrfs: lower the bar for chunk allocation (Chris Mason)
  - Btrfs: run chunk allocations while we do delayed refs (Chris Mason)
  - Btrfs: call d_instantiate after all ops are setup (Al Viro)
  - Btrfs: fix worker lock misuse in find_worker (Chris Mason)
  - xen/config: turn CONFIG_XEN_DEBUG_FS off. (Konrad Rzeszutek Wilk)
  - proc: clean up and fix /proc/<pid>/mem handling (Maxim Uvarov) [Orabug:
    13618927] CVE-2012-0056
  - set XEN_MAX_DOMAIN_MEMORY for 512 (Maxim Uvarov)
  - add __init arguments to init functions (Maxim Uvarov)
  - hpwdt: clean up set_memory_x call for 32 bit (Maxim Uvarov)


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-100.0.22.el6uek]
changelog:
  - xfs: fix acl count validation in xfs_acl_from_disk() (Dan Carpenter)
    CVE-2012-0038
  - Updated driver version to 5.02.00.00.06.02-uek2 (Tej Parkash)
  - ocfs2: use spinlock irqsave for downconvert lock.patch (Srinivas Eeda)
  - dm-nfs-for-uek2 (Adnan Misherfi)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-200.17.0.el6uek]
changelog:
  - mm: reduce the amount of work done when updating min_free_kbytes (Mel Gorman)
    [Orabug: 14073214]
  - ocfs2: clear unaligned io flag when dio fails (Junxiao Bi) [Orabug: 14063941]
  - aio: make kiocb->private NUll in init_sync_kiocb() (Junxiao Bi) [Orabug:
    14063941]
  - vmxnet3: cap copy length at size of skb to prevent dropped frames on tx (Neil
    Horman) [Orabug: 14159701]
  - mm/mempolicy.c: refix mbind_range() vma issue (KOSAKI Motohiro) [Orabug:
    14149364]
  - mm/mempolicy.c: fix pgoff in mbind vma merge (Caspar Zhang) [Orabug:14149364]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-200.18.0.el6uek]
changelog:
  - e1000e: disable rxhash when try to enable jumbo frame also rxhash and rxcsum
    have enabled (Joe Jin)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-200.20.0.el6uek]
changelog:
  - Update lpfc version for 8.3.5.68.6p driver release (Martin K. Petersen)
  - Fix system hang due to bad protection module parameters (CR 130769) (Martin
    K. Petersen)
  - oracleasm: Data integrity support (Martin K. Petersen)
  - sd: Allow protection_type to be overridden (Martin K. Petersen)
  - SCSI: Fix two bugs in DIX retry handling (Martin K. Petersen)
  - sd: Avoid remapping bad reference tags (Martin K. Petersen)
  - block: Fix bad range check in bio_sector_offset (Martin K. Petersen)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-200.21.0.el6uek]
changelog:
  - KVM: Fix buffer overflow in kvm_set_irq() (Avi Kivity) [Bugdb: 13966]
    {CVE-2012-2137}
  - net: sock: validate data_len before allocating skb in sock_alloc_send_pskb()
    (Jason Wang) [Bugdb: 13966] {CVE-2012-2136}
  - mm: pmd_read_atomic: fix 32bit PAE pmd walk vs pmd_populate SMP race
    condition (Andrea Arcangeli) [Bugdb: 13966] {CVE-2012-2373}
  - KVM: lock slots_lock around device assignment (Alex Williamson) [Bugdb:
    13966] {CVE-2012-2121}
  - KVM: unmap pages from the iommu when slots are removed (Alex Williamson)
    [Bugdb: 13966] {CVE-2012-2121}
  - KVM: introduce kvm_for_each_memslot macro (Xiao Guangrong) [Bugdb: 13966]
  - fcaps: clear the same personality flags as suid when fcaps are used (Eric
    Paris) [Bugdb: 13966] {CVE-2012-2123}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-200.22.1.el6uek]
changelog:
  - NFSv4: include bitmap in nfsv4 get acl data (Andy Adamson)  {CVE-2011-4131}
  - ocfs2:btrfs: aio-dio-loop changes broke setrlimit behavior [orabug 14207636]
    (Dave Kleikamp)
  - Add Oracle VM guest messaging driver (Zhigang Wang)
  - thp: avoid atomic64_read in pmd_read_atomic for 32bit PAE (Andrea Arcangeli)
    [Orabug: 14217003]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-200.26.1.el6uek]
changelog:
  - Fix leapsecond triggered hrtimer/futex load spike issue (John Stultz)
  - Fix clock_was_set so it is safe to call from atomic (John Stultz)


author: Joe Jin <joe.jin@oracle.come> [2.6.39-200.29.1.el6uek]
changelog:
  - 3.0.x: hrtimer: Update hrtimer base offsets each hrtimer_interrupt (John Stultz)
  - 3.0.x: time: Fix leapsecond triggered hrtimer/futex load spike issue (John Stultz)
  - 3.0.x: hrtimer: Fix clock_was_set so it is safe to call from irq context (John Stultz)
  - Revert "Fix clock_was_set so it is safe to call from atomic"
  - Revert "Fix leapsecond triggered hrtimer/futex load spike issue"
  - Revert "3.0.x: hrtimer: Update hrtimer base offsets each hrtimer_interrupt"


author: Joe Jin <joe.jin@oracle.com> [2.6.39-200.29.2.el6uek]
changelog:
  - epoll: clear the tfile_check_list on -ELOOP (Joe Jin) {CVE-2012-3375}
  - Don't limit non-nested epoll paths (Jason Baron)
  - epoll: kabi fixups for epoll limit wakeup paths (Joe Jin) {CVE-2011-1083}
  - epoll: limit paths (Jason Baron)  {CVE-2011-1083}
  - cred: copy_process() should clear child->replacement_session_keyring (Oleg
    Nesterov)  {CVE-2012-2745}


author: Joe Jin <joe.jin@oracle.com> [2.6.39-200.29.3.el6uek]
changelog:
  - htrimer: fix kabi break. (Joe Jin)
  - timekeeping: Add missing update call in timekeeping_resume() (Thomas
    Gleixner)
  - hrtimer: Update hrtimer base offsets each hrtimer_interrupt (John Stultz)
  - timekeeping: Provide hrtimer update function (Thomas Gleixner)
  - hrtimers: Move lock held region in hrtimer_interrupt() (Thomas Gleixner)
  - timekeeping: Maintain ktime_t based offsets for hrtimers (Thomas Gleixner)
  - timekeeping: Fix leapsecond triggered load spike issue (John Stultz)
  - hrtimer: Provide clock_was_set_delayed() (John Stultz)
  - time: Move common updates to a function (Thomas Gleixner)
  - timekeeping: Fix CLOCK_MONOTONIC inconsistency during leapsecond (John
    Stultz)
  - ntp: Correct TAI offset during leap second (Richard Cochran)
  - ntp: Fix leap-second hrtimer livelock (John Stultz)
  - Revert "3.0.x: hrtimer: Fix clock_was_set so it is safe to call from irq
    context" (Joe Jin)
  - Revert "3.0.x: time: Fix leapsecond triggered hrtimer/futex load spike issue"
    (Joe Jin)
  - Revert "3.0.x: hrtimer: Update hrtimer base offsets each hrtimer_interrupt"
    (Joe Jin)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-200.30.1.el6uek]
changelog:
  - htrimer: fix kabi break. (Joe Jin)
  - timekeeping: Add missing update call in timekeeping_resume() (Thomas
    Gleixner)
  - hrtimer: Update hrtimer base offsets each hrtimer_interrupt (John Stultz)
  - timekeeping: Provide hrtimer update function (Thomas Gleixner)
  - hrtimers: Move lock held region in hrtimer_interrupt() (Thomas Gleixner)
  - timekeeping: Maintain ktime_t based offsets for hrtimers (Thomas Gleixner)
  - timekeeping: Fix leapsecond triggered load spike issue (John Stultz)
  - hrtimer: Provide clock_was_set_delayed() (John Stultz)
  - time: Move common updates to a function (Thomas Gleixner)
  - timekeeping: Fix CLOCK_MONOTONIC inconsistency during leapsecond (John
    Stultz)
  - ntp: Correct TAI offset during leap second (Richard Cochran)
  - ntp: Fix leap-second hrtimer livelock (John Stultz)
  - Revert "3.0.x: hrtimer: Fix clock_was_set so it is safe to call from irq
    context" (Joe Jin)
  - Revert "3.0.x: time: Fix leapsecond triggered hrtimer/futex load spike issue"
    (Joe Jin)
  - Revert "3.0.x: hrtimer: Update hrtimer base offsets each hrtimer_interrupt"
    (Joe Jin)
  - Revert "epoll: epoll_wait() should not use timespec_add_ns()" (Maxim Uvarov)
  - epoll: epoll_wait() should not use timespec_add_ns() (Eric Dumazet)
  - epoll: clear the tfile_check_list on -ELOOP (Joe Jin)  {CVE-2012-3375}
  - Don't limit non-nested epoll paths (Jason Baron)
  - epoll: kabi fixups for epoll limit wakeup paths (Joe Jin)
  - epoll: limit paths (Jason Baron)  {CVE-2011-1083}
  - [libata] Add " 2GB ATA Flash Disk"/"ADMA428M" to DMA blacklist (Prarit
    Bhargava)
  - ext4: Fix overflow caused by missing cast in ext4_fallocate() (Utako Kusaka)
  - NFS: Map minor mismatch error to protocol not support error. (Steve Dickson)
  - NFSv4: Map NFS4ERR_SHARE_DENIED into an EACCES error instead of EIO (Trond
    Myklebust)
  - cred: copy_process() should clear child->replacement_session_keyring (Oleg
    Nesterov)  {CVE-2012-2745}
  - tg3: fix VLAN tagging regression (Kasper Pedersen)
  - [SCSI] libfc: fcoe_transport_create fails in single-CPU environment (Steven
    Clark) [Orabug: 14239242]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-200.31.1.el6uek]
changelog:
  - NFSv4: Ensure that we check lock exclusive/shared type against open modes
    (Trond Myklebust) [Orabug: 14563070]
  - NFSv4: Ensure that the LOCK code sets exception->inode (Trond Myklebust) 
    [Orabug: 14563070]


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.39-200.32.1.el6uek]
changelog:
  - dl2k: Clean up rio_ioctl (Stephan Mueller) [Orabug: 14680245] {CVE-2012-2313}
  - hugetlb: fix resv_map leak in error path (Christoph Lameter) [Orabug: 14680284] {CVE-2012-2390}
  - rds: set correct msg_namelen (Jay Fenlason) [Orabug: 14680018] {CVE-2012-3430}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.13.0.el6uek]
changelog:
  - x86, UV: Clean up uv_mmrs.h (Jack Steiner) [Orabug: 14751013]
  - x86, UV: Fix UV2 hub part number (Jack Steiner) [Orabug: 14751013]
  - x86/uv: Fix uninitialized spinlocks (Maxim Uvarov) [Orabug: 14751013]
  - x86/UV: Lower UV rtc clocksource rating (Dimitri Sivanich) [Orabug: 14751013]
  - config - clean up NBD selecting (Maxim Uvarov) [Orabug: 14547051]
  - [PATCH] ocfs2: fix NULL pointer dereference in
    ocfs2_duplicate_clusters_by_page v2 (Xiaowei.Hu) [Orabug: 14752693]
  - xen/pv-on-hvm kexec: add quirk for Xen 3.4 and shutdown watches. (Konrad
    Rzeszutek Wilk)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.14.1.el6uek]
changelog:
  - CVE-2012-3412 sfc: Fix maximum number of TSO segments and minimum TX queue
    size (Chuck Anderson) [Orabug: 14769994] {CVE-2012-3412}
  - sfc: Replace some literal constants with EFX_PAGE_SIZE/EFX_BUF_SIZE (Chuck
    Anderson) [Orabug: 14769994]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.15.1.el6uek]
changelog:
  - [net/sfc] limit number of sergents per skb on tx (Maxim Uvarov) [Orabug:
    14769994] {CVE-2012-3412}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.17.1.el6uek]
changelog:
  - CVE-2012-2313: dl2k: Clean up rio_ioctl (Chuck Anderson) [Orabug: 14680245]
  - CVE-2012-3430: rds: set correct msg_namelen (Chuck Anderson) [Orabug:
    14680018]


author: Chuck Anderson <chuck.anderson@oracle.com> [2.6.39-300.17.2.el6uek]
changelog:
  - hugepages: fix use after free bug in "quota" handling [Orabug: 15845276] {CVE-2012-2133}
  - udf: Fortify loading of sparing table [Orabug: 15845302] {CVE-2012-3400}
  - udf: Avoid run away loop when partition table length is corrupt [Orabug: 15845302] {CVE-2012-3400}
  - mm: Hold a file reference in madvise_remove [Orabug: 15846025] {CVE-2012-3511}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.17.3.el6uek]
changelog:
  - mm/hotplug: correctly add new zone to all other nodes' zone lists (Jiang Liu)
    [Orabug: 16020976 Bug-db: 14798] {CVE-2012-5517}
  - Divide by zero in TCP congestion control Algorithm. (Jesper Dangaard Brouer)
    [Orabug: 16020656 Bug-db: 14798] {CVE-2012-4565}
  - Fix length of buffer copied in __nfs4_get_acl_uncached (Sachin Prabhu) [Bug-
    db: 14798] {CVE-2012-2375}
  - Avoid reading past buffer when calling GETACL (Sachin Prabhu) [Bug-db: 14798]
    {CVE-2012-2375}
  - Avoid beyond bounds copy while caching ACL (Sachin Prabhu) [Bug-db: 14798]
    {CVE-2012-2375}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.18.1.el6uek]
changelog:
  - cgroup: notify_on_release may not be triggered in some cases (Daisuke
    Nishimura) [Orabug: 14795330]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.19.1.el6uek]
changelog:
  - Revert "RDS: Bypass workqueue when queueing cong updates" (Maxim Uvarov)
    [Orabug: 14647229]
  - xen/mmu: Use Xen specific TLB flush instead of the generic one. (Konrad
    Rzeszutek Wilk) [Oracle-bug: 14630170]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.20.1.el6uek]
changelog:
  - x86: Fetch stack from regs when possible in dump_trace() (Frederic
    Weisbecker) [Orabug: 14701687]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.21.1.el6uek]
changelog:
  - xen/netfront: teardown the device before unregistering it. (Ian Campbell)
    [Orabug: 14579353]
  - rds bug fixes (Maxim Uvarov)
  - CVE-2012-3511: mm: Hold a file reference in madvise_remove (Chuck Anderson)
    [Orabug: 15846025] {CVE-2012-3511}
  - CVE-2012-3400: udf: Avoid run away loop when partition table length is
    corrupted (Chuck Anderson) [Orabug: 15845302] {CVE-2012-3400}
  - CVE-2012-3400: udf: Fortify loading of sparing table (Chuck Anderson)
    [Orabug: 15845302] {CVE-2012-3400}
  - CVE-2012-2133: hugepages: fix use after free bug in "quota" handling (Chuck
    Anderson) [Orabug: 15845276] {CVE-2012-2133}
  - Added suspend and resume support (Cathy Avery) [Orabug: 14801157]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.22.1.el6uek]
changelog:
  - ext4: race-condition protection for ext4_convert_unwritten_extents_endio
    (Dmitry Monakhov) [Orabug: 14774219] {CVE-2012-4508}
  - [libata] Add " 2GB ATA Flash Disk"/"ADMA428M" to DMA blacklist (Prarit
    Bhargava) [Orabug: 15929836]
  - ext4: Fix overflow caused by missing cast in ext4_fallocate() (Utako Kusaka)
    [Orabug: 15929836]
  - NFS: Map minor mismatch error to protocol not support error. (Steve Dickson)
    [Orabug: 15929836]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.23.1.el6uek]
changelog:
  - oracleasm: Introduce module parameter for block size selection (Martin K.
    Petersen) [Orabug: 15924773 16017829]
  - kernel posttrans remove all crashkernel=* (Jason Luan) [Orabug: 15882974]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.24.1.el6uek]
changelog:
  - compilation fix oracleasm typo (Maxim Uvarov)
  - mm/hotplug: correctly add new zone to all other nodes' zone lists (Jiang Liu)
    [Orabug: 16020976 Bug-db: 14798] {CVE-2012-5517}
  - Divide by zero in TCP congestion control Algorithm. (Jesper Dangaard Brouer)
    [Orabug: 16020656 Bug-db: 14798] {CVE-2012-4565}
  - Fix length of buffer copied in __nfs4_get_acl_uncached (Sachin Prabhu) [Bug-
    db: 14798] {CVE-2012-2375}
  - Avoid reading past buffer when calling GETACL (Sachin Prabhu) [Bug-db: 14798]
    {CVE-2012-2375}
  - Avoid beyond bounds copy while caching ACL (Sachin Prabhu) [Bug-db: 14798]
    {CVE-2012-2375}


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-300.25.1.el6uek]
changelog:
  - bonding: rlb mode of bond should not alter ARP originating via bridge
    (zheng.li) [Orabug: 14650975]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.27.1.el6uek]
changelog:
  - xen-pciback: rate limit error messages from xen_pcibk_enable_msi{,x}() (Jan
    Beulich) [Orabug: 16243736] {CVE-2013-0231}
  - Xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests.
    (Frediano Ziglio) [Orabug: 16274171] {CVE-2013-0190}
  - netback: correct netbk_tx_err to handle wrap around. (Ian Campbell) [Orabug:
    16243309]
  - xen/netback: free already allocated memory on failure in
    xen_netbk_get_requests (Ian Campbell) [Orabug: 16243309]
  - xen/netback: don't leak pages on failure in xen_netbk_tx_check_gop. (Ian
    Campbell) [Orabug: 16243309]
  - xen/netback: shutdown the ring if it contains garbage. (Ian Campbell)
    [Orabug: 16243309]
  - ixgbevf fix typo in Makefile (Maxim Uvarov) [Orabug: 16179639 16168292]


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-300.28.1.el6uek]
changelog:
  - kmod: make __request_module() killable (Oleg Nesterov) [Orabug: 16286305]
    {CVE-2012-4398}
  - kmod: introduce call_modprobe() helper (Oleg Nesterov) [Orabug: 16286305]
    {CVE-2012-4398}
  - usermodehelper: implement UMH_KILLABLE (Oleg Nesterov) [Orabug: 16286305]
    {CVE-2012-4398}
  - usermodehelper: introduce umh_complete(sub_info) (Oleg Nesterov) [Orabug:
    16286305] {CVE-2012-4398}
  - KVM: x86: invalid opcode oops on SET_SREGS with OSXSAVE bit set
    (CVE-2012-4461) (Jerry Snitselaar) [Orabug: 16286290] {CVE-2012-4461}
  - exec: do not leave bprm->interp on stack (Kees Cook) [Orabug: 16286267]
    {CVE-2012-4530}
  - exec: use -ELOOP for max recursion depth (Kees Cook) [Orabug: 16286267]
    {CVE-2012-4530}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.29.1.el6uek]
changelog:
  - x86/xen: don't assume %ds is usable in xen_iret for 32-bit PVOPS. (Chuck
    Anderson) [Orabug: 16325076] {CVE-2013-0228 XSA-42 CVE-2013-0190}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.30.1.el6uek]
changelog:
  - ipmi: make kcs timeout parameters as module options (Pavel Bures)
  - xen: netback: handle compound page fragments on transmit. (Ian Campbell)
    [Orabug: 16362897]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-300.31.1.el6uek]
changelog:
  - SPEC: v2.6.39-300.31.1 (Maxim Uvarov) 
  - xen/mmu: On early bootup, flush the TLB when changing RO->RW bits Xen provided pagetables. (Konrad Rzeszutek Wilk)


author: Joe Jin <joe.jin@oracle.com> [2.6.39-300.32.2.el6uek]
changelog:
  - be2net: fix unconditionally returning IRQ_HANDLED in INTx (Sathya Perla) [Orabug: 16889661]  
  - be2net: fix a possible events_get() race on BE2 (Sathya Perla) [Orabug: 16889661]  
  - be2net: fix INTx ISR for interrupt behaviour on BE2 (Sathya Perla) [Orabug: 16889661]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.100.0.el6uek]
changelog:
  - xfs: prevent recursion in xfs_buf_iorequest (Christoph Hellwig)
  - xfs: punch new delalloc blocks out of failed writes inside (Dave Chinner)
  - xfs: handle EOF correctly in xfs_vm_writepage (Christoph Hellwig)
  - xfs: xfs_vm_writepage clear iomap_valid when (Alain Renaud)
  - xfs: fix memory reclaim deadlock on agi buffer (Peter Watkins)
  - xfs: use iolock on XFS_IOC_ALLOCSP calls (Dave Chinner)
  - xfs: fix incorrect b_offset initialisation (Dave Chinner)
  - xfs: using GFP_NOFS for blkdev_issue_flush (Shaohua Li)
  - xfs: limit specualtive delalloc to maxioffset (Dave Chinner)
  - xfs: don't fill statvfs with project quota for a directory (Jie Liu)
  - xfs: fix fstrim offset calculations (Dave Chinner)
  - xfs: fix deadlock in xfs_rtfree_extent (Kamal Dasu)
  - xfs: fix allocation length overflow in xfs_bmapi_write() (Dave Chinner)
  - xfs: do not flush data workqueues in xfs_flush_buftarg (Christoph Hellwig)
  - xfs: XFS_TRANS_SWAPEXT is not a valid flag for (Christoph Hellwig)
  - xfs: fix possible overflow in xfs_ioc_trim() (Lukas Czerner)
  - rds: Congestion flag does not get cleared causing the connection to hang
    (Bang Nguyen) [Orabug: 16424692]
  - dm table: set flush capability based on underlying devices (Mike Snitzer)
    [Orabug: 16392584]
  - wake_up_process() should be never used to wakeup a TASK_STOPPED/TRACED task
    (Oleg Nesterov) [Orabug: 16405869] {CVE-2013-0871}
  - ptrace: ensure arch_ptrace/ptrace_request can never race with SIGKILL (Oleg
    Nesterov) [Orabug: 16405869] {CVE-2013-0871}
  - ptrace: introduce signal_wake_up_state() and ptrace_signal_wake_up() (Oleg
    Nesterov) [Orabug: 16405869] {CVE-2013-0871}
  - NLS: improve UTF8 -> UTF16 string conversion routine (Alan Stern) [Orabug:
    16425571] {CVE-2013-1773}
  - drm/i915/lvds: ditch ->prepare special case (Daniel Vetter) [Orabug:
    14394113]
  - drm/i915: Leave LVDS registers unlocked (Keith Packard) [Orabug: 14394113]
  - drm/i915: don't clobber the pipe param in sanitize_modesetting (Daniel
    Vetter) [Orabug: 14394113]
  - drm/i915: Sanitize BIOS debugging bits from PIPECONF (Chris Wilson) [Orabug:
    14394113]
  - ipmi: make kcs timeout parameters as module options (Pavel Bures)
  - Linux 3.0.69 (Greg Kroah-Hartman)
  - Fix memory leak in cpufreq stats. (Tu, Xiaobing) [Orabug: 16524544]
  - md: raid0: fix error return from create_stripe_zones. (NeilBrown) [Orabug:
    16524499]
  - cifs: ensure that cifs_get_root() only traverses directories (Jeff Layton)
    [Orabug: 16524441]
  - btrfs: Init io_lock after cloning btrfs device struct (Thomas Gleixner)
    [Orabug: 16524430]
  - Linux 3.0.68 (Greg Kroah-Hartman)
  - cgroup: fix exit() vs rmdir() race (Li Zefan) [Orabug: 16524187]
  - cpuset: fix cpuset_print_task_mems_allowed() vs rename() race (Li Zefan)
    [Orabug: 16524180]
  - x86: Do not leak kernel page mapping locations (Kees Cook) [Orabug: 16524160]
  - ext4: fix race in ext4_mb_add_n_trim() (Niu Yawei) [Orabug: 16524038]
  - sysctl: fix null checking in bin_dn_node_address() (Xi Wang) [Orabug:
    16524021]
  - xen-blkback: do not leak mode property (Jan Beulich)
  - target: Add missing mapped_lun bounds checking during make_mappedlun setup
    (Nicholas Bellinger) [Orabug: 16523953]
  - ftrace: Call ftrace cleanup module notifier after all other notifiers (Steven
    Rostedt (Red Hat)) [Orabug: 16523318]
  - ftrace: Be first to run code modification on modules (Steven Rostedt)
    [Orabug: 16523318]
  - posix-timer: Don't call idr_find() with out-of-range ID (Tejun Heo) [Orabug:
    16522902]
  - spec: ol6 port to uek2 fancy debug info (Maxim Uvarov) [Orabug: 14351757]
  - Linux 3.0.67 (Greg Kroah-Hartman)
  - xen-netback: cancel the credit timer when taking the vif down (David Vrabel)
    [Orabug: 16516401]
  - ext4: add missing kfree() on error return path in add_new_gdb() (Dan
    Carpenter) [Orabug: 16516151]
  - ext4: Free resources in some error path in ext4_fill_super (Tao Ma) [Orabug:
    16516151]
  - tmpfs: fix use-after-free of mempolicy object (Greg Thelen) [Orabug:
    16515833] {CVE-2013-1767}
  - ocfs2: unlock super lock if lockres refresh failed (Junxiao Bi) [Orabug:
    16515772]
  - mmu_notifier_unregister NULL Pointer deref and multiple ->release() callouts
    (Robin Holt) [Orabug: 16515703]
  - mm: mmu_notifier: make the mmu_notifier srcu static (Andrea Arcangeli)
    [Orabug: 16515703]
  - mm: mmu_notifier: have mmu_notifiers use a global SRCU so they may safely
    schedule (Sagi Grimberg) [Orabug: 16515703]
  - Driver core: treat unregistered bus_types as having no devices (Bjorn
    Helgaas) [Orabug: 16515651]
  - hrtimer: Prevent hrtimer_enqueue_reprogram race (Leonid Shatz) [Orabug:
    16515570]
  - posix-cpu-timers: Fix nanosleep task_struct leak (Stanislaw Gruszka) [Orabug:
    16515546]
  - genirq: Avoid deadlock in spurious handling (Thomas Gleixner) [Orabug:
    16515515]
  - kbuild: AFTER_LINK (Roland McGrath) [Orabug: 14351757]
  - SPEC: fix doc build (Guru Anbalagane)
  - floppy: Fix a crash during rmmod (Vivek Goyal) [Orabug: 16040504]
  - Add SIOCRDSGETTOS to get the current TOS for the socket (Bang Nguyen)
    [Orabug: 16397197]
  - Changes to connect/TOS interface (Bang Nguyen) [Orabug: 16397197]
  - x86/msr: Add capabilities check (Alan Cox) [Orabug: 16405007] {CVE-2013-0268}
  - spec: unique debuginfo (Maxim Uvarov) [Orabug: 16245366]
  - 3.0.66 (Greg Kroah-Hartman)
  - Linux 3.0.65 (Greg Kroah-Hartman)
  - PCI/PM: Clean up PME state when removing a device (Rafael J. Wysocki)
    [Orabug: 16419018]
  - x86/mm: Check if PUD is large when validating a kernel address (Mel Gorman)
    [Orabug: 16419009]
  - Linux 3.0.64 (Greg Kroah-Hartman)
  - net: sctp: sctp_endpoint_free: zero out secret key data (Daniel Borkmann)
    [Orabug: 16417847]
  - net: sctp: sctp_setsockopt_auth_key: use kzfree instead of kfree (Daniel
    Borkmann) [Orabug: 16417847]
  - packet: fix leakage of tx_ring memory (Phil Sutter) [Orabug: 16417817]
  - net: loopback: fix a dst refcounting issue (Eric Dumazet) [Orabug: 16417800]
  - kernel/resource.c: fix stack overflow in __reserve_region_with_split() (T
    Makphaibulchoke) [Orabug: 16417783]
  - virtio_console: Don't access uninitialized data. (Sjur Brændeland) [Orabug:
    16417750]
  - Linux 3.0.63 (Greg Kroah-Hartman)
  - USB: XHCI: fix memory leak of URB-private data (Alan Stern) [Orabug:
    16405610]
  - x86-64: Replace left over sti/cli in ia32 audit exit code (Jan Beulich)
    [Orabug: 16405604]
  - Linux 3.0.62 (Greg Kroah-Hartman)
  - efi, x86: Pass a proper identity mapping in efi_call_phys_prelog (Nathan
    Zimmer) [Orabug: 16405090]
  - x86/msr: Add capabilities check (Alan Cox) [Orabug: 16405007]
  - fs/cifs/cifs_dfs_ref.c: fix potential memory leakage (Cong Ding) [Orabug:
    16405135]
  - Linux 3.0.61 (Greg Kroah-Hartman)
  - Linux 3.0.60 (Greg Kroah-Hartman)
  - xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests.
    (Frediano Ziglio) [Orabug: 16398133] {CVE-2013-0190 XSA-40}
  - xhci: fix null-pointer dereference when destroying half-built segment rings
    (Julius Werner) [Orabug: 16398006]
  - Linux 3.0.59 (Greg Kroah-Hartman)
  - intel-iommu: Free old page tables before creating superpage (Woodhouse,
    David) [Orabug: 16390878]
  - udf: fix memory leak while allocating blocks during write (Namjae Jeon)
    [Orabug: 16390872]
  - aoe: do not call bdi_init after blk_alloc_queue (Ed L. Cashin) [Orabug:
    16390867]
  - jbd2: fix assertion failure in jbd2_journal_flush() (Jan Kara) [Orabug:
    16390861]
  - ext4: fix extent tree corruption caused by hole punch (Forrest Liu) [Orabug:
    16383554]
  - pci: hotplug: fix null dereference in pci_set_payload() (Jerry Snitselaar)
    [Orabug: 16345420]
  - dm ioctl: prevent unsafe change to dm_ioctl data_size (Alasdair G Kergon)
    [Orabug: 16371437]
  - ring-buffer: Fix race between integrity check and readers (Steven Rostedt)
    [Orabug: 16371349]
  - RDMA/nes: Fix for terminate timer crash (Tatyana Nikolova) [Orabug: 16371298]
  - RDMA/nes: Fix for crash when registering zero length MR for CQ (Tatyana
    Nikolova) [Orabug: 16371298]
  - SUNRPC: Ensure that we free the rpc_task after cleanups are done (Trond
    Myklebust) [Orabug: 16371208]
  - ext4: fix memory leak in ext4_xattr_set_acl()'s error path (Eugene Shatokhin)
    [Orabug: 16345607]
  - xfs: Use preallocation for inodes with extsz hints (Dave Chinner) [Orabug:
    16307993]
  - This is a fix on dlm_clean_master_list() (Xiaowei.Hu) [Orabug: 12798517]
  - rds: this resolved crash while removing rds_rdma module. orabug: 16268201
    (Bang Nguyen)
  - rds: scheduling while atomic on failover orabug: 16275095 (Bang Nguyen)
  - SRP: Revert back to 2.6.39-400.8.0 code (Ajaykumar Hotchandani)
  - iSER: Revert back to 2.6.39-400.8.0 code (Ajaykumar Hotchandani)
  - the ac->ac_allow_chain_relink=0 won't disable group relink (Xiaowei.Hu)
    [Orabug: 14842737]
  - epoll: prevent missed events on EPOLL_CTL_MOD (Eric Wong) [Orabug: 16363540]
  - libata: fix Null pointer dereference on disk error (Xiaotian Feng) [Orabug:
    16344896]
  - libata: set dma_mode to 0xff in reset (Aaron Lu) [Orabug: 16344896]
  - sata_promise: fix hardreset lockdep error (Mikael Pettersson) [Orabug:
    16344878]
  - SCSI: mvsas: fix undefined bit shift (Xi Wang) [Orabug: 16344868]
  - Linux 3.0.58 (Greg Kroah-Hartman)
  - mm: limit mmu_gather batching to fix soft lockups on !CONFIG_PREEMPT (Michal
    Hocko) [Orabug: 16344783]
  - x86/xen: don't assume %ds is usable in xen_iret for 32-bit PVOPS. (Jan
    Beulich)  {CVE-2013-0228 XSA-42 CVE-2013-0190}
  - xen-blkfront: drop the use of llist_for_each_entry_safe (Konrad Rzeszutek
    Wilk) [Orabug: 16263164]
  - Revert "xen PVonHVM: use E820_Reserved area for shared_info" (Konrad
    Rzeszutek Wilk) [Orabug: 16297716]
  - Revert "xen/PVonHVM: fix compile warning in init_hvm_pv_info" (Konrad
    Rzeszutek Wilk)
  - xfs: use shared ilock mode for direct IO writes by default (Dave Chinner)
    [Orabug: 16304938]
  - sched: fix divide by zero at {thread_group,task}_times (Stanislaw Gruszka)
    [Orabug: 15956690]
  - Revert "Revert "cgroup: notify_on_release may not be triggered in some
    cases"" (Maxim Uvarov)
  - cgroup: remove incorrect dget/dput() pair in cgroup_create_dir() (Tejun Heo)
    [Orabug: 16299317]
  - nfs: fix null checking in nfs_get_option_str() (Xi Wang) [Orabug: 16299190]
  - nfsd4: fix oops on unusual readlike compound (J. Bruce Fields) [Orabug:
    16299190]
  - NFS: Fix calls to drop_nlink() (Trond Myklebust) [Orabug: 16299190]
  - NFS: avoid NULL dereference in nfs_destroy_server (NeilBrown) [Orabug:
    16299190]
  - virtio: force vring descriptors to be allocated from lowmem (Will Deacon)
    [Orabug: 16298929]
  - exec: do not leave bprm->interp on stack (Kees Cook) [Orabug: 16298170]
  - sctp: fix memory leak in sctp_datamsg_from_user() when copy from user space
    fails (Tommi Rantala) [Orabug: 16293274]
  - bonding: fix race condition in bonding_store_slaves_active (nikolay) [Orabug:
    16293049]
  - xen_fmr: Verify XEN platform before running xen_fmr drivers (Yuval Shaia)
    [Orabug: 16302435]
  - Linux 3.0.57 (Greg Kroah-Hartman)
  - tmpfs: fix shared mempolicy leak (Mel Gorman) [Orabug: 16292842]
  - workqueue: convert BUG_ON()s in __queue_delayed_work() to WARN_ON_ONCE()s
    (Tejun Heo) [Orabug: 16286334]
  - rds: unregister IB event handler on shutdown (Bang Nguyen) [Orabug: 16302435]
  - rds: HAIP support child interface (Bang Nguyen) [Orabug: 16302435]
  - Linux 3.0.56 (Greg Kroah-Hartman)
  - scsi: Silence unnecessary warnings about ioctl to partition (Jan Kara)
    [Orabug: 16285846]
  - ACPI: missing break (Alan Cox) [Orabug: 16285836]
  - workqueue: exit rescuer_thread() as TASK_RUNNING (Mike Galbraith) [Orabug:
    16285719]
  - mm: soft offline: split thp at the beginning of soft_offline_page() (Naoya
    Horiguchi) [Orabug: 16285709]
  - Linux 3.0.55 (Greg Kroah-Hartman)
  - x86-32: Export kernel_stack_pointer() for modules (H. Peter Anvin) [Orabug:
    16231017]
  - Linux 3.0.54 (Greg Kroah-Hartman)
  - jbd: Fix lock ordering bug in journal_unmap_buffer() (Jan Kara) [Orabug:
    16284655]
  - futex: avoid wake_futex() for a PI futex_q (Darren Hart) [Orabug: 16284620]
  - RDS HAIP misc fixes (Bang Nguyen) [Orabug: 16302435]
  - Ignore failover groups if HAIP is disabled (Bang Nguyen) [Orabug: 16302435]
  - RDS: RDS rolling upgrade (Saeed Mahameed) [Orabug: 16302435]
  - mlx4_core: use correct FMR number of clients according to PRM. (Saeed
    Mahameed) [Orabug: 16302435]
  - x86-32: Fix invalid stack address while in softirq (Robert Richter) [Orabug:
    16231017]
  - Linux 3.0.53 (Greg Kroah-Hartman)
  - Resource: fix wrong resource window calculation (Ram Pai) [Orabug: 16225482]
  - PCI : Calculate right add_size (Yinghai Lu) [Orabug: 16225482]
  - PCI : ability to relocate assigned pci-resources (Ram Pai) [Orabug: 16225482]
  - selinux: fix sel_netnode_insert() suspicious rcu dereference (Dave Jones)
    [Orabug: 16225467]
  - NFS: Wait for session recovery to finish before returning (Bryan Schumaker)
    [Orabug: 16225396]
  - usb: use usb_serial_put in usb_serial_probe errors (Jan Safrata) [Orabug:
    16225350]
  - netfilter: Mark SYN/ACK packets as invalid from original direction (Jozsef
    Kadlecsik) [Orabug: 16225312]
  - netfilter: Validate the sequence number of dataless ACK packets as well
    (Jozsef Kadlecsik) [Orabug: 16225312]
  - net-rps: Fix brokeness causing OOO packets (Tom Herbert) [Orabug: 16225270]
  - net: correct check in dev_addr_del() (Jiri Pirko) [Orabug: 16225247]
  - xen: netback: handle compound page fragments on transmit. (Ian Campbell)
  - xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests.
    (Andrew Cooper)  {CVE-2013-0190 XSA-40}
  - xen/gntdev: remove erronous use of copy_to_user (Daniel De Graaf)
  - xen/gntdev: correctly unmap unlinked maps in mmu notifier (Daniel De Graaf)
  - xen/gntdev: fix unsafe vma access (Daniel De Graaf)
  - xen/privcmd: Fix mmap batch ioctl. (Andres Lagar-Cavilla)
  - Xen: properly bound buffer access when parsing cpu/*/availability (Jan
    Beulich)
  - xen/grant-table: correctly initialize grant table version 1 (Matt Wilson)
  - x86/xen : Fix the wrong check in pciback (Yang Zhang)
  - xen/privcmd: Relax access control in privcmd_ioctl_mmap (Tamas Lengyel)
  - xen/vcpu: Fix vcpu restore path. (Wei Liu)
  - xen: Add EVTCHNOP_reset in Xen interface header files. (Wei Liu)
  - ipv6: setsockopt(IPIPPROTO_IPV6, IPV6_MINHOPCOUNT) forgot to set return value
    (Hannes Frederic Sowa) [Orabug: 16219504]
  - ipv4: avoid undefined behavior in do_ip_setsockopt() (Xi Wang) [Orabug:
    16219489]
  - crypto: cryptd - disable softirqs in cryptd_queue_worker to prevent data
    corruption (Jussi Kivilinna) [Orabug: 16219473]
  - mm: bugfix: set current->reclaim_state to NULL while returning from kswapd()
    (Takamori Yamaguchi) [Orabug: 16219405]
  - Linux 3.0.52 (Greg Kroah-Hartman)
  - intel-iommu: Fix AB-BA lockdep report (Roland Dreier) [Orabug: 16212693]
  - futex: Handle futex_pi OWNER_DIED take over correctly (Thomas Gleixner)
    [Orabug: 16212042]
  - l2tp: fix oops in l2tp_eth_create() error path (Tom Parkin) [Orabug:
    16211918]
  - net: usb: Fix memory leak on Tx data path (Hemant Kumar) [Orabug: 16211885]
  - ipv6: Set default hoplimit as zero. (Li RongQing) [Orabug: 16211773]
  - tcp: fix FIONREAD/SIOCINQ (Eric Dumazet) [Orabug: 16211727]
  - netlink: use kfree_rcu() in netlink_release() (Eric Dumazet) [Orabug:
    16211670]
  - NFS: Fix Oopses in nfs_lookup_revalidate and nfs4_lookup_revalidate (Trond
    Myklebust) [Orabug: 16211565]
  - NFSv4: nfs4_locku_done must release the sequence id (Trond Myklebust)
    [Orabug: 16211434]
  - target: Don't return success from module_init() if setup fails (Roland
    Dreier) [Orabug: 16211397]
  - floppy: Cleanup disk->queue before caling put_disk() if add_disk() was never
    called (Vivek Goyal) [Orabug: 16040504]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.101.0.el6uek]
changelog:
  - SPEC: v2.6.39-400.101.0 (Maxim Uvarov) 
  - PCI: Set device power state to PCI_D0 for device without native PM support (Ajaykumar Hotchandani) [Orabug: 16482495] 
  - xfs: don't assert on delalloc regions beyond EOF (Dave Chinner) 
  - ovmapi: several fixes and cleanups (Sasha Levin) [Orabug: 16541619] 
  - x86: ignore changes to paravirt_lazy_mode while in an interrupt context (Chuck Anderson) [Orabug: 16417326] 
  - RDS: fix rds-ping spinlock recursion (jeff.liu) [Orabug: 16223050] 
  - vhost: fix length for cross region descriptor (Michael S. Tsirkin) [Orabug: 16387183] {CVE-2013-0311} 
  - kabifix: block/scsi: Allow request and error handling timeouts to be specified (Maxim Uvarov) 
  - block/scsi: Allow request and error handling timeouts to be specified (Martin K. Petersen) [Orabug: 16372401] 
  - [SCSI] Shorten the path length of scsi_cmd_to_driver() (Li Zhong) [Orabug: 16372401] 
  - Fix NULL dereferences in scsi_cmd_to_driver (Mark Rustad) [Orabug: 16372401] 
  - SCSI: Fix error handling when no ULD is attached (Martin K. Petersen) [Orabug: 16372401] 
  - Handle disk devices which can not process medium access commands (Martin K. Petersen) [Orabug: 16372401] 
  - IB/core: Allow device-specific per-port sysfs files (Ralph Campbell) 
  - RDMA/cma: Pass QP type into rdma_create_id() (Sean Hefty) 
  - IB: Rename RAW_ETY to RAW_ETHERTYPE (Aleksey Senin) 
  - IB: Warning Resolution. (Ajaykumar Hotchandani) 
  - mlx4_core: fix FMR flags in free MTT range (Saeed Mahameed) 
  - mlx4_core/ib: sriov fmr bug fixes (Saeed Mahameed) 
  - mlx4_core: Change bitmap allocator to work in round-robin fashion (Saeed Mahameed) 
  - mlx4_vnic: move host admin vnics to closed state when closing the vnic. (Saeed Mahameed) 
  - mlx4_ib: make sure to flush clean_wq while closing sriov device (Saeed Mahameed) 
  - ib_sdp: fix deadlock when sdp_cma_handler is called while socket is being closed (Saeed Mahameed) 
  - ib_sdp: add unhandled events to rdma_cm_event_str (Saeed Mahameed) 
  - mlx4_core: use dev->sriov instead of hardcoed 127 vfs when initializing FMR MPT tables (Saeed Mahameed) 
  - mlx4_vnic: print vnic keep alive info in mlx4_vnic_info (Saeed Mahameed) 
  - drm/i915: bounds check execbuffer relocation count (Kees Cook) [Orabug: 16482650] {CVE-2013-0913} 
  - sched: Fix cgroup movement of waking process (Daisuke Nishimura) [Orabug: 13740515] 
  - sched: Fix cgroup movement of newly created process (Daisuke Nishimura) [Orabug: 13740515] 
  - sched: Fix cgroup movement of forking process (Daisuke Nishimura) [Orabug: 13740515]


author: Andreas Schwab <schwab@linux-m68k.org> [2.6.39-400.102.0.el6uek]
changelog:
  - procfs: do not confuse jiffies with cputime64_t (Andreas Schwab) [Orabug: 16567925] 
  - procfs: do not overflow get_{idle,iowait}_time for nohz (Michal Hocko) [Orabug: 16567925] 
  - xen/mmu: On early bootup, flush the TLB when changing RO->RW bits Xen provided pagetables. (Konrad Rzeszutek Wilk) 
  - xen/mmu: On early bootup, flush the TLB when changing RO->RW bits Xen provided pagetables. (Konrad Rzeszutek Wilk) 
  - xen/events: Handle VIRQ_TIMER before any other hardirq in event loop. (Keir Fraser) 
  - xen-blkfront: remove frame list from blk_shadow (Roger Pau Monne) 
  - xen-blkfront: pre-allocate pages for requests (Roger Pau Monne) 
  - xen-blkback: don't store dev_bus_addr (Roger Pau Monne) 
  - xen-blkfront: switch from llist to list (Roger Pau Monne) 
  - xen-blkback: fix foreach_grant_safe to handle empty lists (Roger Pau Monne) 
  - xen-blkfront: replace kmalloc and then memcpy with kmemdup (Mihnea Dobrescu-Balaur) 
  - xen-blkback: fix dispatch_rw_block_io() error path (Jan Beulich) 
  - xen/blkback: Change statistics counter types to unsigned (Zoltan Kiss) 
  - xen/blkback: correctly respond to unknown, non-native requests (David Vrabel) 
  - xen-blkback: do not leak mode property (Jan Beulich) 
  - xen-blkback: use balloon pages for persistent grants (Roger Pau Monne) 
  - xen/blkback: Don't trust the handle from the frontend. (Konrad Rzeszutek Wilk) 
  - xen-blkback: do not leak mode property (Jan Beulich) 
  - xen-pciback: notify hypervisor about devices intended to be assigned to guests (Jan Beulich) 
  - xen/pciback: Don't disable a PCI device that is already disabled. (Konrad Rzeszutek Wilk) 
  - xen-pciback: rate limit error messages from xen_pcibk_enable_msi{,x}() (Jan Beulich) {CVE-2013-0231} 
  - x86/xen : Fix the wrong check in pciback (Yang Zhang) 
  - xen/events: avoid race with raising an event in unmask_evtchn() (David Vrabel) 
  - xenbus: fix compile failure on ARM with Xen enabled (Steven Noonan) 
  - xen/pci: We don't do multiple MSI's. (Konrad Rzeszutek Wilk) 
  - xen: event channel arrays are xen_ulong_t and not unsigned long (Ian Campbell) 
  - xen: Send spinlock IPI to all waiters (Stefan Bader) 
  - xen: introduce xen_remap, use it instead of ioremap (Stefano Stabellini) 
  - xen: close evtchn port if binding to irq fails (Wei Liu) 
  - xen-evtchn: correct comment and error output (Wei Liu) 
  - xen/tmem: Add missing %s in the printk statement. (Konrad Rzeszutek Wilk) 
  - xen: implement updated XENMEM_add_to_physmap_range ABI (Ian Campbell) 
  - xen/smp: Move the common CPU init code a bit to prep for PVH patch. (Konrad Rzeszutek Wilk) 
  - xen: fix error handling path if xen_allocate_irq_dynamic fails (Wei Liu) 
  - x86/xen: don't assume %ds is usable in xen_iret for 32-bit PVOPS. (Jan Beulich) {CVE-2013-0190} 
  - xen-blkfront: drop the use of llist_for_each_entry_safe (Konrad Rzeszutek Wilk) [Orabug: 16263164] 
  - Revert "xen PVonHVM: use E820_Reserved area for shared_info" (Konrad Rzeszutek Wilk) [Orabug: 16297716] 
  - Revert "xen/PVonHVM: fix compile warning in init_hvm_pv_info" (Konrad Rzeszutek Wilk)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.103.0.el6uek]
changelog:
  - vmxnet3: prevent div-by-zero panic when ring resizing uninitialized dev (Bhavesh Davda) [Orabug: 16661957] 
  - mptsas: fix kerneldoc build error (Jerry Snitselaar) [Orabug: 16482053] 
  - mptsas: do not call __mptsas_probe in kthread (Jerry Snitselaar) [Orabug: 14175509] 
  - mpt2sas: update to LSI version 16.05.01.00 (Jerry Snitselaar) [Orabug: 16470913] 
  - mptsas: update to LSI version 4.28.20.01 (Jerry Snitselaar) [Orabug: 16482053] 
  - megaraid_sas: update to LSI version 6.505 (Jerry Snitselaar) [Orabug: 16482181] 
  - ocfs2: Fix NULL dereference for moving extents (Dan Carpenter) [Orabug: 16631951] 
  - ocfs2: fix error handling in ocfs2_ioctl_move_extents() (Dan Carpenter) [Orabug: 16631951] 
  - qla2xxx: Updated the driver version to 8.05.00.03.39.0-k. (Saurav Kashyap) 
  - qla2xxx: Bind with ISPFX00. (Saurav Kashyap) 
  - qla2xxx: Update the driver version to 8.04.00.15.39.0-k. (Chad Dupuis) 
  - qla2xxx: Add clarifying printk to thermal access fail cases. (Joe Carnuccio) 
  - qla2xxx: Update the driver version to 8.04.00.14.39.0-k. (Saurav Kashyap) 
  - qla2xxx: Debug ID corrections. (Armen Baloyan) 
  - qla2xxx: Add iounmap(ha->cregbase) calls for ISPFX00 adapters for proper driver cleanup during load / unload. (Armen Baloyan) 
  - qla2xxx: Clear the outstanding command array for task management processing for ISPFx00. (Giridhar Malavali) 
  - qla2xxx: Remove Request / Response transfer error AENs handling from qlafx00_async_event(). (Armen Baloyan) 
  - qla2xxx: Proper cleanup of BSG request when the request time-out on ISPFx00. (Armen Baloyan) 
  - qla2xxx: Fix issue with calling sp_done() twice for task management commands (Giridhar Malavali) 
  - qla2xxx: Fix bug in cont_entry handling for the cases when FW provides more data than mid layer can handle. (Armen Baloyan) 
  - qla2xxx: Correction to structure size while registering host information with firmware. (Srinivasa Rao) 
  - Revert "qla2xxx: Add setting of driver version string for vendor application." (Saurav Kashyap) 
  - qla2xxx: Update the driver version to 8.04.00.13.39.0-k. (Saurav Kashyap) 
  - qla2xxx: Remove unnecessary operations from qlafx00_soc_cpu_reset() and add resetting IRQ ack register per core (Armen Baloyan) 
  - qla2xxx: Addedd logic to monitor aenmbx0 register for fixed intervals on ISPFx00. (Giridhar Malavali) 
  - qla2xxx: Wait for IDC complete event to finish loopback operation. (Chad Dupuis) 
  - qla2xxx: Integrate generic card temperature with mezz card temperature. (Joe Carnuccio) 
  - qla2xxx: Don't process state change aen for reset owner. (Saurav Kashyap) 
  - qla2xxx: Don't process RSCNs for a vport on the same physical adapter. (Chad Dupuis) 
  - qla2xxx: Add setting of driver version string for vendor application. (Joe Carnuccio) 
  - qla2xxx: Correction of comment in MBC opcode defines. (Joe Carnuccio) 
  - qla2xxx: Correct list-iteration bug in Report-ID Acquisition codes. (Andrew Vasquez) 
  - qla2xxx: Don't bind with ISPFx00. (Saurav Kashyap) 
  - qla2xxx: Re-register ISPFx00 host info with firmware after adapter reset. (Armen Baloyan) 
  - qla2xxx: Provide UTC time to firmware when registering ISPFx00 host information (Armen Baloyan) 
  - qla2xxx: Fix incorrect driver version string return to application get host info request for ISPFx00 (Armen Baloyan) 
  - qla2xxx: Enhancements to support ISPFx00. (Giridhar Malavali) 
  - qla2xxx: Update the driver version to 8.04.00.12.39.0-k. (Saurav Kashyap) 
  - Revert "qla2xxx: Optimize existing port name server query matching." (Saurav Kashyap) 
  - Revert "qla2xxx: Avoid losing any fc ports when loop id's are exhausted." (Saurav Kashyap) 
  - qla2xxx: Update the copyright information. (Saurav Kashyap) 
  - qla2xxx: Display the lock owner on lock acquire failure. (Saurav Kashyap) 
  - qla2xxx: Move loopback mode reset after chip reset check. (Chad Dupuis) 
  - qla2xxx: Extra loopback error handling for ISP83xx. (Chad Dupuis) 
  - qla2xxx: don't free pool that wasn't allocated (Dan Carpenter) 
  - qla2xxx: Unload hangs after issuing BSG commands to vport. (Chad Dupuis) 
  - qla2xxx: Do MPI reset only for 81xx. (Saurav Kashyap) 
  - qla2xxx: Do link initialization on get loop id failure. (Joe Carnuccio)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.104.0.el6uek]
changelog:
  - Merge tag 'v2.6.39-400.20.1.16313854' of git://ca-git.us.oracle.com/linux-uek-2.6.39-ofed into uek2-master (Maxim Uvarov) [Orabug: 16313854] 
  - spec: fix instalation if hardlink is installed (Maxim Uvarov) 
  - Parallel mtrr init between cpus (Zhenzhong Duan) 
  - KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797) (Andy Honig) [Orabug: 16711660] {CVE-2013-1797} 
  - Bluetooth: Fix incorrect strncpy() in hidp_setup_hid() (Anderson Lizardo) [Orabug: 16711065] {CVE-2013-0349} 
  - USB: io_ti: Fix NULL dereference in chase_port() (Wolfgang Frisch) [Orabug: 16425358] {CVE-2013-1774} 
  - keys: fix race with concurrent install_user_keyrings() (David Howells) [Orabug: 16493354] {CVE-2013-1792} 
  - KVM: Fix bounds checking in ioapic indirect register reads (CVE-2013-1798) (Andy Honig) [Orabug: 16710951] {CVE-2013-1798} 
  - KVM: x86: fix for buffer overflow in handling of MSR_KVM_SYSTEM_TIME (CVE-2013-1796) (Andy Honig) [Orabug: 16710806] {CVE-2013-1796} 
  - be2iscsi : Bump the driver version (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Fix issue in passing the exp_cmdsn and max_cmdsn (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Fix possible reentrancy issue in be_iopoll (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Fix the copyright information (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Fix checking Adapter state while establishing CXN (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Fix dynamic CID allocation Mechanism in driver (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi : Fix the NOP-In handling code path (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Fix the Port Link Status issue (John Soni Jose) [Orabug: 16704553] 
  - beiscsi: Fix displaying the Active Session Count from driver (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Fix displaying the FW Version from driver. (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Fix support for DEFQ extension (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Fix MACRO for checking the adapter type (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Fix freeing CXN specific driver resources. (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Fix MSIx support in SKH-R to 32 (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Fix MBX Command issues (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Fix when MBX fails with Insufficient buffer error (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Send uninitialize pattern to FW (John Soni Jose) [Orabug: 16704553] 
  - be2iscsi: Get Port State and Speed of the Adapter (John Soni Jose) [Orabug: 16704553] 
  - hpwdt: Only BYTE reads/writes to WD Timer port 0x72 (Mingarelli, Thomas) 
  - misc: hpilo: ignore auxiliary HP iLO BMC's (Mark Rusk) 
  - MISC: hpilo, remove pci_disable_device (Jiri Slaby) 
  - misc: hpilo: increase number of max supported channels (Camuso, Tony) 
  - Fix device removal NULL pointer dereference (Joe Jin) [Orabug: 16684527] 
  - put stricter guards on queue dead checks (James Bottomley) [Orabug: 16684527] 
  - RDS: Fixes race conditions that may lead to non-optimal paths, causing lower throughput (Bang Nguyen) [Orabug: 16571410] 
  - 8139cp: Prevent dev_close/cp_interrupt race on MTU change (John Greene) 
  - 8139cp: properly support change of MTU values [v2] (John Greene) 
  - 8139cp: fix coherent mapping leak in error path. (françois romieu) 
  - 8139cp: re-enable interrupts after tx timeout (David Woodhouse) 
  - 8139cp: set ring address after enabling C+ mode (David Woodhouse) 
  - 8139cp: revert "set ring address before enabling receiver" (françois romieu) 
  - sched: Use resched IPI to kick off the nohz idle balance (Suresh Siddha) [Orabug: 16424589] 
  - llc: fix info leak via getsockname() (Mathias Krause) [Orabug: 16675488] {CVE-2012-6542} 
  - qla4xxx: update driver version to v5.03.00.02.06.02-uek2 (Tej Parkash) 
  - qla4xxx: Silence the compile warning for uint comparison (Adheer Chandravanshi) 
  - qla4xxx: changing default behaviour of ql4xdisablesysfsboot to true (Tej Parkash) 
  - qla4xxx: Silence gcc warning for uninitialized veriable (Vikas Chaudhary) 
  - qla4xxx: Added print statements to display AENs (Vikas Chaudhary) 
  - qla4xxx: Use correct value for max flash node entries (Adheer Chandravanshi) 
  - qla4xxx: Restrict logout from boot target session using session id (Adheer Chandravanshi) 
  - qla4xxx: Use correct flash ddb offset for ISP40XX (Adheer Chandravanshi) 
  - qla4xxx: Replace dev type macros with generic portal type macros (Adheer Chandravanshi) 
  - scsi_transport_iscsi: Declare portal type string macros for generic use (Adheer Chandravanshi) 
  - qla4xxx: Add flash node mgmt support (Adheer Chandravanshi) 
  - libiscsi: export function iscsi_switch_str_param (Adheer Chandravanshi) 
  - scsi_transport_iscsi: Add flash node mgmt support (Adheer Chandravanshi) 
  - qla4xxx: Skip retry of initialize_adapter only for ISP8XXX (Nilesh Javali) 
  - qla4xxx: Assign correct CHAP table address to FLT (Vikas Chaudhary) 
  - qla4xxx: Added missing check for ISP83XX in CHAP related functions (Vikas Chaudhary) 
  - qla4xxx: don't free NULL dma pool (Dan Carpenter) 
  - qla4xxx: Fixed request queue count manipulation on response path (Tej Parkash) 
  - qla4xxx: Fix debug level to avoid floods of same message (Vikas Chaudhary) 
  - qla4xxx: Pass correct LUN address to firmware in case of lun_reset (Vikas Chaudhary) 
  - qla4xxx: Fix double reset in case of firmware hung for ISP83XX (Vikas Chaudhary) 
  - qla4xxx: Set graceful reset bit for ISP83XX (Vikas Chaudhary) 
  - qla4xxx: Boot from SAN fix for ISP83XX (Vikas Chaudhary) 
  - qla4xxx: Take E-port out of reset before disabling pause frames (Manish Dusane) 
  - qla4xxx: Fix return code for qla4xxx_session_get_param. (Manish Rangankar) 
  - qla4xxx: wait for boot target login response during probe (Manish Rangankar) 
  - qla4xxx: Added support for force firmware dump (Vikas Chaudhary) 
  - qla4xxx: Re-register IRQ handler while retrying initialize of adapter (Poornima Vonti) 
  - qla4xxx: Throttle active IOCBs to firmware limits (Karen Higgins) 
  - qla4xxx: Remove unnecessary code from qla4xxx_init_local_data (Karen Higgins) 
  - qla4xxx: Quiesce driver activities while loopback (Nilesh Javali) 
  - qla4xxx: Rename MBOX_ASTS_IDC_NOTIFY to MBOX_ASTS_IDC_REQUEST_NOTIFICATION (Nilesh Javali) 
  - qla4xxx: Add spurious interrupt messages under debug level 2 (Nilesh Javali) 
  - scsi_transport_iscsi: export iscsi class session's target_id in sysfs. (Manish Rangankar) 
  - r8169: fix auto speed down issue (hayeswang) 
  - r8169: honor jumbo settings when chipset is requested to start. (françois romieu) 
  - Revert "r8169: enable internal ASPM and clock request settings". (Francois Romieu) 
  - Revert "r8169: enable ALDPS for power saving". (Francois Romieu) 
  - r8169: fix vlan tag read ordering. (françois romieu) 
  - r8169: remove the obsolete and incorrect AMD workaround (Timo Teräs) 
  - r8169: remove unneeded dirty_rx index (Timo Teräs) 
  - remove init of dev->perm_addr in drivers (Jiri Pirko) 
  - r8169: workaround for missing extended GigaMAC registers (françois romieu) 
  - r8169: remove __dev* attributes (Bill Pemberton) 
  - r8169: Drop tp arg from rtl8169_tx_vlan_tag() (Kirill Smelkov) 
  - r8169: remove unused macros. (Dayanidhi Sreenivasan) 
  - r8169: enable internal ASPM and clock request settings (hayeswang) 
  - r8169: allow multicast packets on sub-8168f chipset. (Nathan Walp) 
  - r8169: Fix WoL on RTL8168d/8111d. (Cyril Brulebois) 
  - r8169: Kill SafeMtu macro (Kirill Smelkov) 
  - r8169: enable ALDPS for power saving (hayeswang) 
  - hpsa: check for dma_mapping_error in hpsa_passthru ioctls (Stephen M. Cameron) 
  - hpsa: reorganize error handling in hpsa_passthru_ioctl (Stephen M. Cameron) 
  - hpsa: check for dma_mapping_error in hpsa_map_sg_chain_block (Stephen M. Cameron) 
  - hpsa: Check for dma_mapping_error for all code paths using fill_cmd (Stephen M. Cameron) 
  - hpsa: Check for dma_mapping_error in hpsa_map_one (Shuah Khan) 
  - Drivers: scsi: remove __dev* attributes. (Greg Kroah-Hartman) 
  - hpsa: removed unused member maxQsinceinit (Stephen M. Cameron) 
  - hpsa: use check_signature (Akinobu Mita) 
  - iser: panic on iser connect (Shamir Rabinovitch) [Orabug: 16313854] 
  - Btrfs: fix backport conflicts (Liu Bo) 
  - Revert "Btrfs: using for_each_set_bit_from to simplify the code" (Liu Bo) 
  - Revert "Btrfs: move the sb_end_intwrite until after the throttle logic" (Liu Bo) 
  - Revert "btrfs: Convert to new freezing mechanism" (Liu Bo) 
  - Revert "Btrfs: add qgroup inheritance" (Liu Bo) 
  - Revert "Btrfs: call the qgroup accounting functions" (Liu Bo) 
  - btrfs: Don't BUG_ON kzalloc error in btrfs_lookup_csums_range() (Mark Fasheh) 
  - Btrfs: show useful info in space reservation tracepoint (Liu Bo) 
  - fs: export fget_light to modules (Liu Bo) 
  - Revert "Btrfs: implement ->show_devname" (Liu Bo) 
  - Revert "Btrfs: fix off-by-one in lseek" (Liu Bo) 
  - Revert "Btrfs: fix autodefrag and umount lockup" (Liu Bo) 
  - Revert "Btrfs: flush all dirty inodes if writeback can not start" (Liu Bo) 
  - Btrfs: make aux field of ulist 64 bit (Alexander Block) 
  - Btrfs: fix some endian bugs handling the root times (Dan Carpenter) 
  - btrfs: get ->kill_sb() of its own (Al Viro) 
  - btrfs: consolidate failure exits in btrfs_mount() a bit (Al Viro) 
  - btrfs: handle null fs_info in btrfs_panic() (Eric Sandeen) 
  - Btrfs: fix backport conflicts (Liu Bo) 
  - btrfs: fix mount/umount race (Al Viro) 
  - Btrfs: fix race between snapshot deletion and getting inode (Liu Bo) 
  - Btrfs: fix a scrub regression in case of write errors (Stefan Behrens) 
  - btrfs: move transaction aborts to the point of failure (David Sterba) 
  - btrfs: btrfs_update_root error push-up (Jeff Mahoney) 
  - Btrfs: do not BUG_ON on aborted situation (Liu Bo) 
  - btrfs: __add_reloc_root error push-up (Jeff Mahoney) 
  - btrfs: Panic on bad rbtree operations (Jeff Mahoney) 
  - Btrfs: save us a read_lock(again) (Liu Bo) 
  - Btrfs: make sure a bitmap has enough bytes (Josef Bacik) 
  - Btrfs: advance window_start if we're using a bitmap (Josef Bacik) 
  - Btrfs: use cluster->window_start when allocating from a cluster bitmap (Josef Bacik) 
  - Btrfs: fix memory leak in load_free_space_cache() (Tsutomu Itoh) 
  - btrfs: free-space-cache.c: remove extra semicolon. (Justin P. Mattock) 
  - Btrfs: fix trim 0 bytes after a device delete (Liu Bo) 
  - Btrfs: don't set for_cow parameter for tree block functions(again) (Jan Schmidt) 
  - Btrfs: add allocator tracepoints (Josef Bacik) 
  - Btrfs: mark delayed refs as for cow (Arne Jansen) 
  - Btrfs: fix a bug on overcommit stuff (Liu Bo) 
  - Btrfs: add get_restripe_target() helper (Ilya Dryomov) 
  - Btrfs: fix enospc error caused by wrong checks of the chunk (Miao Xie) 
  - Btrfs: cleanup duplicated division functions (Miao Xie) 
  - Btrfs: do not merge logged extents if we've removed them from the tree (Josef Bacik) 
  - Btrfs: do not mark ems as prealloc if we are writing to them (Josef Bacik) 
  - Btrfs: Check for NULL page in extent_range_uptodate (Mitch Harder) 
  - Btrfs: fix return value check of extent_io_ops (Tsutomu Itoh) 
  - btrfs: Remove set bits return from clear_extent_bit (Jeff Mahoney) 
  - fs: push rcu_barrier() from deactivate_locked_super() to filesystems (Kirill A. Shutemov) 
  - btrfs: Catch locking failures in {set,clear,convert}_extent_bit (Jeff Mahoney) 
  - Btrfs: make function avoid (Liu Bo) 
  - btrfs: split extent_state ops (Liu Bo) 
  - Btrfs: add nested locking mode for paths (Arne Jansen) 
  - btrfs: take allocation of ->tree_root into open_ctree() (Al Viro) 
  - btrfs: clean_tree_block should panic on observed memory corruption and return void (Jeff Mahoney) 
  - btrfs: sanitizing ->fs_info, part 4 (Al Viro) 
  - btrfs: find_and_setup_root error push-up (Jeff Mahoney) 
  - Btrfs: check the return value of btrfs_start_delalloc_inodes() (Miao Xie) 
  - Btrfs: reduce CPU contention while waiting for delayed extent operations (Chris Mason) 
  - Btrfs: put back delayed refs that are too new (Arne Jansen) 
  - Btrfs: space leak tracepoints (Josef Bacik) 
  - btrfs: btrfs_drop_snapshot should return int (Jeff Mahoney) 
  - Btrfs: introduce a btrfs_dev_replace_item type v2 (Stefan Behrens) 
  - btrfs: Add btrfs_panic() (Jeff Mahoney) 
  - Btrfs: check return value of lookup_extent_mapping() correctly (Tsutomu Itoh) 
  - Btrfs: serialize unlocked dio reads with truncate (Miao Xie) 
  - btrfs: Go readonly on tree errors in balance_level (Mark Fasheh) 
  - btrfs: Go readonly on bad extent refs in update_ref_for_cow() (Mark Fasheh) 
  - Btrfs: rename root_times_lock to root_item_lock (Anand Jain) 
  - Btrfs: remove btrfs_insert_some_items (Liu Bo) 
  - Btrfs: fix trivial error in btrfs_ioctl_resize() (Miao Xie) 
  - Btrfs: do not defrag a file partially (Liu Bo) 
  - switch a bunch of places to mnt_want_write_file() (Al Viro) 
  - vfs: mnt_drop_write_file() (Al Viro) 
  - btrfs: join DEV_STATS ioctls to one (David Sterba) 
  - Btrfs: use mnt_want_write_file instead of mnt_want_write (Liu Bo) 
  - Btrfs: bring back balance pause/resume logic (Ilya Dryomov) 
  - Btrfs: allow for resuming restriper after it was paused (Ilya Dryomov) 
  - Btrfs: do not do balance in readonly mode (Liu Bo) 
  - Btrfs: add ioctl to get and reset the device stats (Stefan Behrens) 
  - Btrfs: introduce subvol uuids and times (Alexander Block) 
  - Btrfs: fix wrong reserved space in qgroup during snap/subv creation (Miao Xie) 
  - Btrfs: set/change the label of a mounted file system (jeff.liu) 
  - Btrfs: Add a new ioctl to get the label of a mounted file system (jeff.liu) 
  - Btrfs: add support for device replace ioctls (Stefan Behrens) 
  - Btrfs: allow repair code to include target disk when searching mirrors (Stefan Behrens) 
  - Btrfs: change core code of btrfs to support the device replace operations (Stefan Behrens) 
  - Btrfs: add new sources for device replace code (Stefan Behrens) 
  - Btrfs: add code to scrub to copy read data to another disk (Stefan Behrens) 
  - Btrfs: disallow mutually exclusive admin operations from user mode (Stefan Behrens) 
  - Btrfs: introduce a btrfs_dev_replace_item type (Stefan Behrens) 
  - Btrfs: enhance btrfs structures for device replace support (Stefan Behrens) 
  - Btrfs: pass fs_info instead of root (Stefan Behrens) 
  - Btrfs: Pass fs_info to btrfs_num_copies() instead of mapping_tree (Stefan Behrens) 
  - Btrfs: in scrub repair code, simplify alloc error handling (Stefan Behrens) 
  - Btrfs: in scrub repair code, optimize the reading of mirrors (Stefan Behrens) 
  - Btrfs: make the scrub page array dynamically allocated (Stefan Behrens) 
  - btrfs: let ->s_fs_info point to fs_info, not root... (Al Viro) 
  - btrfs: make open_ctree() return int (Al Viro) 
  - btrfs: clean_tree_block should panic on observed memory corruption and return void (Jeff Mahoney) 
  - btrfs: drop gfp_t from lock_extent (Jeff Mahoney) 
  - Btrfs: use seqlock to protect fs_info->avail_{data, metadata, system}_alloc_bits (Miao Xie) 
  - Btrfs: make filesystem read-only when submitting barrier fails (Stefan Behrens) 
  - btrfs: Don't BUG_ON errors in __finish_chunk_alloc() (Mark Fasheh) 
  - Btrfs: allow for selecting only completely empty chunks (Ilya Dryomov) 
  - Btrfs: eliminate a use-after-free in btrfs_balance() (Ilya Dryomov) 
  - Btrfs: fix a regression in balance usage filter (Ilya Dryomov) 
  - Btrfs: bring back balance pause/resume logic (Ilya Dryomov) 
  - Btrfs: resume balance on rw (re)mounts properly (Ilya Dryomov) 
  - Btrfs: restore restriper state on all mounts (Ilya Dryomov) 
  - Btrfs: allow dup for data chunks in mixed mode (Ilya Dryomov) 
  - Btrfs: validate target profiles only if we are going to use them (Ilya Dryomov) 
  - Btrfs: move alloc_profile_is_valid() to volumes.c (Ilya Dryomov) 
  - Btrfs: add wrappers for working with alloc profiles (Ilya Dryomov) 
  - Btrfs: make avail_*_alloc_bits fields dynamic (Ilya Dryomov) 
  - Btrfs: add balance progress reporting (Ilya Dryomov) 
  - Btrfs: allow for canceling restriper (Ilya Dryomov) 
  - Btrfs: allow for pausing restriper (Ilya Dryomov) 
  - Btrfs: add skip_balance mount option (Ilya Dryomov) 
  - Btrfs: recover balance on mount (Ilya Dryomov) 
  - Btrfs: save balance parameters to disk (Ilya Dryomov) 
  - Btrfs: soft profile changing mode (aka soft convert) (Ilya Dryomov) 
  - Btrfs: implement online profile changing (Ilya Dryomov) 
  - Btrfs: virtual address space subset filter (Ilya Dryomov) 
  - Btrfs: devid subset filter (Ilya Dryomov) 
  - Btrfs: devid filter (Ilya Dryomov) 
  - Btrfs: usage filter (Ilya Dryomov) 
  - Btrfs: profiles filter (Ilya Dryomov) 
  - Btrfs: add basic infrastructure for selective balancing (Ilya Dryomov) 
  - Btrfs: add basic restriper infrastructure (Ilya Dryomov) 
  - Btrfs: introduce masks for chunk type and profile (Ilya Dryomov) 
  - Btrfs: get rid of *_alloc_profile fields (Ilya Dryomov) 
  - btrfs: extended inode ref iteration (Mark Fasheh) 
  - btrfs: return void in functions without error conditions (Jeff Mahoney) 
  - btrfs: Fix busyloops in transaction waiting code (Jan Kara) 
  - Btrfs: do not allow logged extents to be merged or removed (Josef Bacik) 
  - Btrfs: delete inline extents when we find them during logging (Josef Bacik) 
  - Btrfs: use tokens where we can in the tree log (Josef Bacik) 
  - btrfs: extended inode refs (Mark Fasheh) 
  - Btrfs: do not call file_update_time in aio_write (Josef Bacik) 
  - btrfs: delalloc for page dirtied out-of-band in fixup worker (Jeff Mahoney) 
  - Btrfs: wait on ordered extents at the last possible moment (Josef Bacik) 
  - Btrfs: keep track of the extents original block length (Josef Bacik) 
  - Btrfs: fix deadlock due to unsubmitted (Miao Xie) 
  - Btrfs: fix wrong outstanding_extents when doing DIO write (Miao Xie) 
  - Btrfs: implement unlocked dio write (Miao Xie) 
  - Btrfs: fix dio write vs buffered read race (Josef Bacik) 
  - Btrfs: log changed inodes based on the extent map tree (Josef Bacik) 
  - Btrfs: don't allocate a seperate csums array for direct reads (Josef Bacik) 
  - Btrfs: create a pinned em when writing to a prealloc range in DIO (Josef Bacik) 
  - Btrfs: lock extents as we map them in DIO (Josef Bacik) 
  - Btrfs: fix warning of free_extent_map (Liu Bo) 
  - Btrfs: return EIO if we have extent tree corruption (Josef Bacik) 
  - btrfs: use rcu_barrier() to wait for bdev puts at unmount (Eric Sandeen) 
  - Btrfs: remove btrfs_try_spin_lock (Liu Bo) 
  - Btrfs: get better concurrency for snapshot-aware defrag work (Liu Bo) 
  - Btrfs: improve the delayed inode throttling (Chris Mason) 
  - Btrfs: enforce min_bytes parameter during extent allocation (Chris Mason) 
  - Btrfs: avoid deadlock on transaction waiting list (Liu Bo) 
  - Btrfs: do not BUG_ON in prepare_to_reloc (Liu Bo) 
  - Btrfs: free all recorded tree blocks on error (Liu Bo) 
  - Btrfs: build up error handling for merge_reloc_roots (Liu Bo) 
  - Btrfs: check for NULL pointer in updating reloc roots (Liu Bo) 
  - Btrfs: fix unclosed transaction handler when the async transaction commitment fails (Miao Xie) 
  - Btrfs: fix wrong handle at error path of create_snapshot() when the commit fails (Miao Xie) 
  - Btrfs: use set_nlink if our i_nlink is 0 (Josef Bacik) 
  - btrfs: fixup/remove module.h usage as required (Paul Gortmaker) 
  - Btrfs: cleanup to make the function btrfs_delalloc_reserve_metadata more logic (Wang Shilong) 
  - btrfs: use only inline_pages from extent buffer (David Sterba) 
  - Btrfs: fix wrong reserved space when deleting a snapshot/subvolume (Miao Xie) 
  - Btrfs: remove unnecessary dget_parent/dput when creating the pending snapshot (Miao Xie) 
  - btrfs: remove a printk from scan_one_device (David Sterba) 
  - Btrfs: fix NULL pointer after aborting a transaction (Liu Bo) 
  - Btrfs: fix memory leak of log roots (Liu Bo) 
  - Btrfs: copy everything if we've created an inline extent (Josef Bacik) 
  - btrfs: cleanup for open-coded alignment (Qu Wenruo) 
  - Btrfs: do not change inode flags in rename (Liu Bo) 
  - Btrfs: use reserved space for creating a snapshot (Liu Bo) 
  - clear chunk_alloc flag on retryable failure (Alexandre Oliva) 
  - Btrfs: fix backref walking race with tree deletions (Jan Schmidt) 
  - Btrfs: make sure NODATACOW also gets NODATASUM set (Josef Bacik) 
  - Btrfs: fix remount vs autodefrag (Miao Xie) 
  - Btrfs: snapshot-aware defrag (Liu Bo) 
  - btrfs: limit fallocate extent reservation to 256MB (Zach Brown) 
  - btrfs: Init io_lock after cloning btrfs device struct (Thomas Gleixner) 
  - Btrfs: fix cleaner thread not working with inode cache option (Liu Bo) 
  - Btrfs: fix the deadlock between the transaction start/attach and commit (Miao Xie) 
  - btrfs: define BTRFS_MAGIC as a u64 value (Zach Brown) 
  - Btrfs: place ordered operations on a per transaction list (Josef Bacik) 
  - Btrfs: relax the block group size limit for bitmaps (Josef Bacik) 
  - Btrfs: remove unused extent io tree ops V2 (Josef Bacik) 
  - btrfs: add cancellation points to defrag (David Sterba) 
  - btrfs: put some enospc messages under enospc_debug (David Sterba) 
  - Btrfs: cleanup orphan reservation if truncate fails (Josef Bacik) 
  - Btrfs: steal from global reserve if we are cleaning up orphans (Josef Bacik) 
  - Btrfs: fix memory leak of pending_snapshot->inherit (Miao Xie) 
  - Btrfs: fix the race between bio and btrfs_stop_workers (Miao Xie) 
  - Btrfs: extend the checksum item as much as possible (Liu Bo) 
  - btrfs: remove cache only arguments from defrag path (Eric Sandeen) 
  - Btrfs: if we aren't committing just end the transaction if we error out (Josef Bacik) 
  - Btrfs: handle errors in compression submission path (Josef Bacik) 
  - Btrfs: rework the overcommit logic to be based on the total size (Josef Bacik) 
  - Btrfs: account for orphan inodes properly during cleanup (Josef Bacik) 
  - Btrfs: unreserve space if our ordered extent fails to work (Josef Bacik) 
  - Btrfs: fix how we discard outstanding ordered extents on abort (Josef Bacik) 
  - Btrfs: fix freeing delayed ref head while still holding its mutex (Josef Bacik) 
  - btrfs: ensure we don't overrun devices_info[] in __btrfs_alloc_chunk (Eric Sandeen) 
  - btrfs: remove unnecessary DEFINE_WAIT() declarations (Eric Sandeen) 
  - btrfs: remove unused "item" in btrfs_insert_delayed_item() (Eric Sandeen) 
  - btrfs: fix varargs in __btrfs_std_error (Eric Sandeen) 
  - btrfs: add missing break in btrfs_print_leaf() (Eric Sandeen) 
  - btrfs: annotate intentional switch case fallthroughs (Eric Sandeen) 
  - btrfs: handle null fs_info in btrfs_panic() (Eric Sandeen) 
  - btrfs: remove unused fs_info from btrfs_decode_error() (Eric Sandeen) 
  - btrfs: list_entry can't return NULL (Eric Sandeen) 
  - Btrfs: do not overcommit if we don't have enough space for global rsv (Josef Bacik) 
  - Btrfs: remove extent mapping if we fail to add chunk (Josef Bacik) 
  - Btrfs: fix chunk allocation error handling (Josef Bacik) 
  - Btrfs: use bit operation for ->fs_state (Miao Xie) 
  - Btrfs: use the inode own lock to protect its delalloc_bytes (Miao Xie) 
  - Btrfs: use percpu counter for fs_info->delalloc_bytes (Miao Xie) 
  - Btrfs: use percpu counter for dirty metadata count (Miao Xie) 
  - Btrfs: protect fs_info->alloc_start (Miao Xie) 
  - Btrfs: add a comment for fs_info->max_inline (Miao Xie) 
  - Btrfs: Check CAP_DAC_READ_SEARCH for BTRFS_IOC_INO_PATHS (Kusanagi Kouichi) 
  - Revert "Btrfs: fix permissions of empty files not affected by umask" (Josef Bacik) 
  - Btrfs: don't traverse the ordered operation list repeatedly (Miao Xie) 
  - Btrfs: traverse and flush the delalloc inodes once (Miao Xie) 
  - Btrfs: check the return value of btrfs_run_ordered_operations() (Miao Xie) 
  - Btrfs: check the return value of btrfs_start_delalloc_inodes() (Miao Xie) 
  - Btrfs: make raid attr array more readable (Miao Xie) 
  - Btrfs: record first logical byte in memory (Liu Bo) 
  - Btrfs: save us a read_lock (Liu Bo) 
  - Btrfs: use token to avoid times mapping extent buffer (Liu Bo) 
  - Btrfs: kill unused argument of btrfs_pin_extent_for_log_replay (Liu Bo) 
  - Btrfs: kill unused argument of update_block_group (Liu Bo) 
  - Btrfs: kill unused arguments of cache_block_group (Liu Bo) 
  - Btrfs: remove deprecated comments (Liu Bo) 
  - Btrfs: don't re-enter when allocating a chunk (Josef Bacik) 
  - Btrfs: use wrapper page_offset (Miao Xie) 
  - Btrfs: flush all dirty inodes if writeback can not start (Miao Xie) 
  - Btrfs: make delayed ref lock logic more readable (Miao Xie) 
  - Btrfs: fix lots of orphan inodes when the space is not enough (Miao Xie) 
  - Btrfs: cleanup similar code in delayed inode (Miao Xie) 
  - Btrfs: use common work instead of delayed work (Miao Xie) 
  - Btrfs: cleanup unnecessary clear when freeing a transaction or a trans handle (Miao Xie) 
  - Btrfs: use slabs for delayed reference allocation (Miao Xie) 
  - btrfs: access superblock via pagecache in scan_one_device (David Sterba) 
  - Btrfs: fix crash in log replay with qgroups enabled (Arne Jansen) 
  - Btrfs: move d_instantiate outside the transaction during mksubvol (Chris Mason) 
  - Btrfs: fix possible stale data exposure (Josef Bacik) 
  - Btrfs: fix missing i_size update (Josef Bacik) 
  - Btrfs: fix race between snapshot deletion and getting inode (Liu Bo) 
  - Btrfs: fix wrong sync_writers decrement in btrfs_file_aio_write() (Miao Xie) 
  - Btrfs: reduce lock contention on extent buffer locks (Chris Mason) 
  - Btrfs: add rw argument to merge_bio_hook() (David Woodhouse) 
  - btrfs: don't try to notify udev about missing devices (Eric Sandeen) 
  - Btrfs: fix repeated delalloc work allocation (Miao Xie) 
  - Btrfs: fix missed transaction->aborted check (Miao Xie) 
  - Btrfs: Add ACCESS_ONCE() to transaction->abort accesses (Miao Xie) 
  - Btrfs: put csums on the right ordered extent (Josef Bacik) 
  - Btrfs: fix panic when recovering tree log (Josef Bacik) 
  - Btrfs: reorder locks and sanity checks in btrfs_ioctl_defrag (Ilya Dryomov) 
  - Btrfs: fix unlock order in btrfs_ioctl_rm_dev (Ilya Dryomov) 
  - btrfs: update timestamps on truncate() (Eric Sandeen) 
  - btrfs: fix btrfs_cont_expand() freeing IS_ERR em (Zach Brown) 
  - Btrfs: fix a bug when llseek for delalloc bytes behind prealloc extents (Liu Bo) 
  - Btrfs: fix off-by-one in lseek (Liu Bo) 
  - Btrfs: reset path lock state to zero (Liu Bo) 
  - Btrfs: let allocation start from the right raid type (Liu Bo) 
  - Btrfs: add orphan before truncating pagecache (Josef Bacik) 
  - Btrfs: set flushing if we're limited flushing (Josef Bacik) 
  - Btrfs: fix resize a readonly device (Miao Xie) 
  - Btrfs: do not delete a subvolume which is in a R/O subvolume (Miao Xie) 
  - btrfs: get the device in write mode when deleting it (Lukas Czerner) 
  - btrfs: remove unnecessary cur_trans set before goto loop in join_transaction (Wang Sheng-Hui) 
  - btrfs: fix comment typos (Liu Bo) 
  - Revert "Btrfs: reorder tree mod log operations in deleting a pointer" (Chris Mason) 
  - Revert "Btrfs: MOD_LOG_KEY_REMOVE_WHILE_MOVING never change node's nritems" (Chris Mason) 
  - Btrfs: fix a bug of per-file nocow (Liu Bo) 
  - Btrfs: fix hash overflow handling (Chris Mason) 
  - Btrfs: don't take inode delalloc mutex if we're a free space inode (Josef Bacik) 
  - Btrfs: fix autodefrag and umount lockup (Josef Bacik) 
  - Btrfs: fix permissions of empty files not affected by umask (Filipe Brandenburger) 
  - Btrfs: put raid properties into global table (Liu Bo) 
  - Btrfs: fix BUG() in scrub when first superblock reading gives EIO (Stefan Behrens) 
  - Btrfs: only unlock and relock if we have to (Josef Bacik) 
  - Btrfs: optimize leaf_space_used (Josef Bacik) 
  - Btrfs: don't memset new tokens (Josef Bacik) 
  - Btrfs: only clear dirty on the buffer if it is marked as dirty (Josef Bacik) 
  - Btrfs: move checks in set_page_dirty under DEBUG (Josef Bacik) 
  - Btrfs: add path->really_keep_locks (Josef Bacik) 
  - Btrfs: inline csums if we're fsyncing (Josef Bacik) 
  - Btrfs: don't bother copying if we're only logging the inode (Josef Bacik) 
  - Btrfs: only log the inode item if we can get away with it (Josef Bacik) 
  - btrfs: Notify udev when removing device (Lukas Czerner) 
  - Btrfs: fix wrong return value of btrfs_truncate_page() (Miao Xie) 
  - Btrfs: punch hole past the end of the file (Miao Xie) 
  - Btrfs: fix the page that is beyond EOF (Miao Xie) 
  - Btrfs: fix off-by-one error of the same page check in btrfs_punch_hole() (Miao Xie) 
  - Btrfs: don't auto defrag a file when doing directIO (Miao Xie) 
  - Btrfs: use ctl->unit for free space calculation instead of block_group->sectorsize (Wang Sheng-Hui) 
  - Btrfs: refactor error handling to drop inode in btrfs_create() (Filipe Brandenburger) 
  - Btrfs: fix permissions of empty files not affected by umask (Filipe Brandenburger) 
  - Btrfs: add fiemap's flag check (Tsutomu Itoh) 
  - Btrfs: don't add a NULL extended attribute (Liu Bo) 
  - Btrfs: skip adding an acl attribute if we don't have to (Liu Bo) 
  - Btrfs: fix off-by-one error of the reserved size of btrfs_allocate() (Miao Xie) 
  - Btrfs: use existing align macros in btrfs_allocate() (Miao Xie) 
  - Btrfs: fix a scrub regression in case of write errors (Stefan Behrens) 
  - Btrfs: fix a build warning for an unused label (Stefan Behrens) 
  - Btrfs: restructure btrfs_run_defrag_inodes() (Miao Xie) 
  - Btrfs: fix unprotected defragable inode insertion (Miao Xie) 
  - Btrfs: use slabs for auto defrag allocation (Miao Xie) 
  - Btrfs: get write access for scrub (Miao Xie) 
  - Btrfs: get write access when removing a device (Miao Xie) 
  - Btrfs: get write access when doing resize fs (Miao Xie) 
  - Btrfs: get write access when setting the default subvolume (Miao Xie) 
  - Btrfs: fix wrong return value of btrfs_wait_for_commit() (Miao Xie) 
  - Btrfs: don't start a new transaction when starting sync (Miao Xie) 
  - Btrfs: pass root object into btrfs_ioctl_{start, wait}_sync() (Miao Xie) 
  - Btrfs: fix an while-loop of listxattr (Liu Bo) 
  - Btrfs: do not warn_on io_ctl->cur in io_ctl_map_page (Wang Sheng-Hui) 
  - Btrfs: allow repair code to include target disk when searching mirrors (Stefan Behrens) 
  - Btrfs: increase BTRFS_MAX_MIRRORS by one for dev replace (Stefan Behrens) 
  - Btrfs: optionally avoid reads from device replace source drive (Stefan Behrens) 
  - Btrfs: changes to live filesystem are also written to replacement disk (Stefan Behrens) 
  - Btrfs: introduce GET_READ_MIRRORS functionality for btrfs_map_block() (Stefan Behrens) 
  - Btrfs: handle errors from btrfs_map_bio() everywhere (Stefan Behrens) 
  - Btrfs: disallow some operations on the device replace target device (Stefan Behrens) 
  - Btrfs: enhance btrfs structures for device replace support (Stefan Behrens) 
  - Btrfs: avoid risk of a deadlock in btrfs_handle_error (Stefan Behrens) 
  - Btrfs: pass fs_info instead of root (Stefan Behrens) 
  - Btrfs: add btrfs_scratch_superblock() function (Stefan Behrens) 
  - Btrfs: pass fs_info to btrfs_map_block() instead of mapping_tree (Stefan Behrens) 
  - Btrfs: Pass fs_info to btrfs_num_copies() instead of mapping_tree (Stefan Behrens) 
  - Btrfs: add two more find_device() methods (Stefan Behrens) 
  - Btrfs: move some common code into a subfunction (Stefan Behrens) 
  - Btrfs: cleanup scrub bio and worker wait code (Stefan Behrens) 
  - Btrfs: in scrub repair code, simplify alloc error handling (Stefan Behrens) 
  - Btrfs: in scrub repair code, optimize the reading of mirrors (Stefan Behrens) 
  - Btrfs: make the scrub page array dynamically allocated (Stefan Behrens) 
  - Btrfs: remove the block device pointer from the scrub context struct (Stefan Behrens) 
  - Btrfs: rename the scrub context structure (Stefan Behrens) 
  - Btrfs: protect devices list with its mutex (Liu Bo) 
  - Btrfs: cleanup for btrfs_btree_balance_dirty (Liu Bo) 
  - Btrfs: merge inode_list in __merge_refs (Alexander Block) 
  - Btrfs: set hole punching time properly (Tsutomu Itoh) 
  - Btrfs: Don't trust the superblock label and simply printk("%s") it (Stefan Behrens) 
  - Btrfs: fix a double free on pending snapshots in error handling (Liu Bo) 
  - Btrfs: fix a deadlock in aborting transaction due to ENOSPC (Liu Bo) 
  - fs/btrfs: drop if around WARN_ON (Julia Lawall) 
  - fs/btrfs: use WARN (Julia Lawall) 
  - Btrfs: fix missing log when BTRFS_INODE_NEEDS_FULL_SYNC is set (Miao Xie) 
  - Btrfs: fix unprotected extent map operation when logging file extents (Miao Xie) 
  - Btrfs: fix wrong file extent length (Miao Xie) 
  - Btrfs: fix missing flush when committing a transaction (Miao Xie) 
  - Btrfs: fix joining the same transaction handler more than 2 times (Miao Xie) 
  - Btrfs: cleanup for btrfs_wait_order_range (Liu Bo) 
  - Btrfs: do not log extents when we only log new names (Liu Bo) 
  - Btrfs: don't allow degraded mount if too many devices are missing (Stefan Behrens) 
  - Btrfs: Fix typo in fs/btrfs (Masanari Iida) 
  - Btrfs: Remove the invalid shrink size check up from btrfs_shrink_dev() (jeff.liu) 
  - Btrfs: make ordered extent be flushed by multi-task (Miao Xie) 
  - Btrfs: make ordered operations be handled by multi-task (Miao Xie) 
  - Btrfs: make delalloc inodes be flushed by multi-task (Miao Xie) 
  - Btrfs: fill the global reserve when unpinning space (Josef Bacik) 
  - Btrfs: cleanup unused arguments (Liu Bo) 
  - Btrfs: kill unnecessary arguments in del_ptr (Liu Bo) 
  - Btrfs: reorder tree mod log operations in deleting a pointer (Liu Bo) 
  - Btrfs: MOD_LOG_KEY_REMOVE_WHILE_MOVING never change node's nritems (Liu Bo) 
  - Btrfs: fix unnecessary while loop when search the free space, cache (Miao Xie) 
  - Btrfs: recheck bio against block device when we map the bio (Josef Bacik) 
  - Btrfs: improve the noflush reservation (Miao Xie) 
  - Btrfs: fix wrong comment in can_overcommit() (Miao Xie) 
  - Btrfs: Fix printk and variable name (Masanari Iida) 
  - btrfs: unpin_extent_cache: fix the typo and unnecessary arguements (Liu Bo) 
  - Btrfs: do not bug when we fail to commit the transaction (Josef Bacik) 
  - Btrfs: fix memory leak when cloning root's node (Liu Bo) 
  - Btrfs: Use btrfs_update_inode_fallback when creating a snapshot (Josef Bacik) 
  - Btrfs: fix deadlock caused by the nested chunk allocation (Miao Xie) 
  - btrfs: Return EINVAL when length to trim is less than FSB (Lukas Czerner) 
  - Btrfs: Fix wrong error handling code (Stefan Behrens) 
  - Fix a sign bug causing invalid memory access in the ino_paths ioctl. (Gabriel de Perthuis) 
  - Btrfs: comment for loop in tree_mod_log_insert_move (Jan Schmidt) 
  - Btrfs: fix extent buffer reference for tree mod log roots (Jan Schmidt) 
  - Btrfs: determine level of old roots (Jan Schmidt) 
  - Btrfs: tree mod log's old roots could still be part of the tree (Jan Schmidt) 
  - Btrfs: fix a tree mod logging issue for root replacement operations (Jan Schmidt) 
  - Btrfs: don't put removals from push_node_left into tree mod log twice (Jan Schmidt) 
  - btrfs: Fix compilation with user namespace support enabled (Eric W. Biederman) 
  - Btrfs: remove repeated eb->pages check in, disk-io.c/csum_dirty_buffer (Wang Sheng-Hui) 
  - Btrfs: fix page leakage (Josef Bacik) 
  - Btrfs: do not warn_on when we cannot alloc a page for an extent buffer (Josef Bacik) 
  - Btrfs: don't bug on enomem in readpage (Josef Bacik) 
  - Btrfs: cleanup pages properly when ENOMEM in compression (Josef Bacik) 
  - Btrfs: make filesystem read-only when submitting barrier fails (Stefan Behrens) 
  - Btrfs: make compress and nodatacow mount options mutually exclusive (Andrei Popa) 
  - btrfs: fix message printing (Daniel J Blueman) 
  - Btrfs: don't bother committing delayed inode updates when fsyncing (Josef Bacik) 
  - btrfs: move inline function code to header file (Robin Dong) 
  - Btrfs: remove unnecessary IS_ERR in bio_readpage_error() (Tsutomu Itoh) 
  - Btrfs: don't commit instead of overcommitting (Josef Bacik) 
  - Btrfs: confirmation of value is added before trace_btrfs_get_extent() is called (Tsutomu Itoh) 
  - Btrfs: be smarter about dropping things from the tree log (Josef Bacik) 
  - Btrfs: don't lookup csums for prealloc extents (Josef Bacik) 
  - Btrfs: cache extent state when writing out dirty metadata pages (Josef Bacik) 
  - Btrfs: do not hold the file extent leaf locked when adding extent item (Josef Bacik) 
  - Btrfs: do not async metadata csumming in certain situations (Josef Bacik) 
  - btrfs: fix min csum item size warnings in 32bit (Zach Brown) 
  - Btrfs: run delayed refs first when out of space (Josef Bacik) 
  - Btrfs: add a type field for the transaction handle (Miao Xie) 
  - btrfs: improved readablity for add_inode_ref (Jan Schmidt) 
  - Btrfs: handle not finding the extent exactly when logging changed extents (Josef Bacik) 
  - btrfs: move transaction aborts to the point of failure (David Sterba) 
  - Btrfs: fix the missing error information in create_pending_snapshot() (Miao Xie) 
  - Btrfs: fix off-by-one in file clone (Liu Bo) 
  - btrfs: allow setting NOCOW for a zero sized file via ioctl (David Sterba) 
  - Btrfs: fix punch hole when no extent exists (Josef Bacik) 
  - Btrfs: don't do anything in our ->freeze_fs and ->unfreeze_fs (Josef Bacik) 
  - Btrfs: remove unused write cache pages hook (Josef Bacik) 
  - Btrfs: fix race when getting the eb out of page->private (Josef Bacik) 
  - Btrfs: do not hold the write_lock on the extent tree while logging (Josef Bacik) 
  - Btrfs: kill obsolete arguments in btrfs_wait_ordered_extents (Liu Bo) 
  - Btrfs: cleanup fs_info->hashers (Liu Bo) 
  - Btrfs: cleanup for duplicated code in find_free_extent (Liu Bo) 
  - btrfs: return EPERM upon rmdir on a subvolume (David Sterba) 
  - Btrfs: using for_each_set_bit_from to simplify the code (Wei Yongjun) 
  - Btrfs: remove unnecessary code in btree_get_extent() (Tsutomu Itoh) 
  - Btrfs: cleanup of error processing in btree_get_extent() (Tsutomu Itoh) 
  - btrfs: reada_extent doesn't need kref for refcount (Al Viro) 
  - Revert "Btrfs: do not do filemap_write_and_wait_range in fsync" (Miao Xie) 
  - Btrfs: remove bytes argument from do_chunk_alloc (Josef Bacik) 
  - Btrfs: delay block group item insertion (Josef Bacik) 
  - btrfs: Kill some bi_idx references (Kent Overstreet) 
  - Btrfs: fix unnecessary warning when the fragments make the space alloc fail (Miao Xie) 
  - Btrfs: move the sb_end_intwrite until after the throttle logic (Josef Bacik) 
  - Btrfs: use larger limit for translation of logical to inode (Liu Bo) 
  - Btrfs: use helper for logical resolve (Liu Bo) 
  - Btrfs: fix a bug in parsing return value in logical resolve (Liu Bo) 
  - Btrfs: cleanup for unused ref cache stuff (liubo) 
  - Btrfs: fix corrupted metadata in the snapshot (Miao Xie) 
  - btrfs: polish names of kmem caches (David Sterba) 
  - Btrfs: fix our overcommit math (Josef Bacik) 
  - Btrfs: wait on async pages when shrinking delalloc (Josef Bacik) 
  - Btrfs: use flag EXTENT_DEFRAG for snapshot-aware defrag (Liu Bo) 
  - Btrfs: fix error handling in delete_block_group_cache() (Tsutomu Itoh) 
  - Btrfs: fix wrong size for the reservation when doing, file pre-allocation. (Miao Xie) 
  - Btrfs: output more information when aborting a unused transaction handle (Miao Xie) 
  - Btrfs: fix unprotected ->log_batch (Miao Xie) 
  - Btrfs: fix wrong size for the reservation of the, snapshot creation (Miao Xie) 
  - Btrfs: fix the snapshot that should not exist (Miao Xie) 
  - Btrfs: add a new "type" field into the block reservation structure (Miao Xie) 
  - Btrfs: use a slab for ordered extents allocation (Miao Xie) 
  - Btrfs: fix file extent discount problem in the, snapshot (Miao Xie) 
  - Btrfs: fix full backref problem when inserting shared block reference (Miao Xie) 
  - Btrfs: fix error path in create_pending_snapshot() (Miao Xie) 
  - Btrfs: fix possible memory leak in scrub_setup_recheck_block() (Wei Yongjun) 
  - Btrfs: btrfs_drop_extent_cache should never fail (Josef Bacik) 
  - Btrfs: do not take cleanup_work_sem in btrfs_run_delayed_iputs() (Sage Weil) 
  - Btrfs: set journal_info in async trans commit worker (Sage Weil) 
  - Btrfs: pass lockdep rwsem metadata to async commit transaction (Sage Weil) 
  - Btrfs: add hole punching (Josef Bacik) 
  - Btrfs: remove unused hint byte argument for btrfs_drop_extents (Josef Bacik) 
  - Btrfs: check if an inode has no checksum when logging it (Liu Bo) 
  - Btrfs: fix a bug in checking whether a inode is already in log (Liu Bo) 
  - Btrfs: fix wrong orphan count of the fs/file tree (Miao Xie) 
  - Btrfs: improve fsync by filtering extents that we want (Liu Bo) 
  - Btrfs: do not needlessly restart the transaction for enospc (Josef Bacik) 
  - Btrfs: cleanup extents after we finish logging inode (Liu Bo) 
  - Btrfs: only warn if we hit an error when doing the tree logging (Josef Bacik) 
  - Btrfs: turbo charge fsync (Josef Bacik) 
  - Btrfs: fix possible corruption when fsyncing written prealloced extents (Josef Bacik) 
  - Btrfs: do not allocate chunks as agressively (Josef Bacik) 
  - Btrfs: update last trans if we don't update the inode (Josef Bacik) 
  - Btrfs: fix gcc warnings for 32bit compiles (Jan Schmidt) 
  - switch btrfs_ioctl_clone() to fget_light() (Al Viro) 
  - switch btrfs_ioctl_snap_create_transid() to fget_light() (Al Viro) 
  - btrfs: fix the commment for the action flags in delayed-ref.h (Wang Sheng-Hui) 
  - btrfs: fix trivial typo for the comment of BTRFS_FREE_INO_OBJECTID (Wang Sheng-Hui) 
  - btrfs: fix comment typo in btrfs_finish_ordered_io (Liu Bo) 
  - Btrfs: fix that repair code is spuriously executed for transid failures (Stefan Behrens) 
  - Btrfs: fix ordered extent leak when failing to start a transaction (Liu Bo) 
  - Btrfs: revert checksum error statistic which can cause a BUG() (Stefan Behrens) 
  - Btrfs: remove superblock writing after fatal error (Stefan Behrens) 
  - Btrfs: allow delayed refs to be merged (Josef Bacik) 
  - Btrfs: fix enospc problems when deleting a subvol (Josef Bacik) 
  - Btrfs: fix wrong mtime and ctime when creating snapshots (Miao Xie) 
  - Btrfs: fix race in run_clustered_refs (Arne Jansen) 
  - Btrfs: don't run __tree_mod_log_free_eb on leaves (Chris Mason) 
  - Btrfs: increase the size of the free space cache (Josef Bacik) 
  - Btrfs: barrier before waitqueue_active (Josef Bacik) 
  - Btrfs: fix deadlock in wait_for_more_refs (Arne Jansen) 
  - btrfs: fix second lock in btrfs_delete_delayed_items() (Fengguang Wu) 
  - Btrfs: do not strdup non existent strings (Josef Bacik) 
  - Btrfs: do not use missing devices when showing devname (Josef Bacik) 
  - Btrfs: fix that error value is changed by mistake (Stefan Behrens) 
  - Btrfs: fix a misplaced address operator in a condition (Stefan Behrens) 
  - Btrfs: remove mnt_want_write call in btrfs_mksubvol (Alexander Block) 
  - btrfs: nuke pdflush from comments (Artem Bityutskiy) 
  - btrfs: nuke write_super from comments (Artem Bityutskiy) 
  - btrfs: Convert to new freezing mechanism (Jan Kara) 
  - btrfs: use printk_get_level and printk_skip_level, add __printf, fix fallout (Joe Perches) 
  - btrfs: Push mnt_want_write() outside of i_mutex (Jan Kara) 
  - Btrfs: add btrfs_compare_trees function (Alexander Block) 
  - Btrfs: make iref_to_path non static (Alexander Block) 
  - Btrfs: add a barrier before a waitqueue_active check (Chris Mason) 
  - Btrfs: call the ordered free operation without any locks held (Chris Mason) 
  - Btrfs: Check INCOMPAT flags on remount and add helper function (Mitch Harder) 
  - Btrfs: add helper for tree enumeration (Arne Jansen) 
  - btrfs: allow cross-subvolume file clone (David Sterba) 
  - Btrfs: improve multi-thread buffer read (Liu Bo) 
  - Btrfs: make btrfs's allocation smoothly with preallocation (Liu Bo) 
  - Btrfs: lock the transition from dirty to writeback for an eb (Josef Bacik) 
  - Btrfs: fix potential race in extent buffer freeing (Josef Bacik) 
  - Btrfs: don't return true in releasepage unless we actually freed the eb (Josef Bacik) 
  - Btrfs: suppress printk() if all device I/O stats are zero (Stefan Behrens) 
  - Btrfs: remove unwanted printk() for btrfs device I/O stats (Stefan Behrens) 
  - Btrfs: rewrite BTRFS_SETGET_FUNCS (Li Zefan) 
  - Btrfs: zero unused bytes in inode item (Li Zefan) 
  - Btrfs: kill free_space pointer from inode structure (Li Zefan) 
  - btrfs read error corrected message floods the console during recovery (Anand Jain) 
  - Btrfs: do not count in readonly bytes (Liu Bo) 
  - Btrfs: add ro notification to dump_space_info (Liu Bo) 
  - Btrfs: fix a bug of writting free space cache during balance (Liu Bo) 
  - Btrfs: do not abort transaction in prealloc case (Liu Bo) 
  - Btrfs: kill root from btrfs_is_free_space_inode (Liu Bo) 
  - Btrfs: fix btrfs_is_free_space_inode to recognize btree inode (Liu Bo) 
  - Btrfs: avoid I/O repair BUG() from btree_read_extent_buffer_pages() (Stefan Behrens) 
  - Btrfs: rework shrink_delalloc (Josef Bacik) 
  - Btrfs: do not set subvolume flags in readonly mode (Liu Bo) 
  - Btrfs: check write access to mount earlier while creating snapshots (Liu Bo) 
  - Btrfs: fix typo in cow_file_range_async and async_cow_submit (Liu Bo) 
  - Btrfs: change how we indicate we're adding csums (Josef Bacik) 
  - Btrfs: return error of btrfs_update_inode() to caller (Tsutomu Itoh) 
  - Btrfs: fix error handling in __add_reloc_root() (Dan Carpenter) 
  - Btrfs: do not ignore errors from btrfs_cleanup_fs_roots() when mounting (Ilya Dryomov) 
  - Btrfs: do not return EINVAL instead of ENOMEM from open_ctree() (Ilya Dryomov) 
  - Btrfs: add DEVICE_READY ioctl (Josef Bacik) 
  - Btrfs: flush delayed inodes if we're short on space (Josef Bacik) 
  - btrfs: join DEV_STATS ioctls to one (David Sterba) 
  - btrfs: ignore unfragmented file checks in defrag when compression enabled - rebased (Andrew Mahone) 
  - Btrfs: small naming cleanup in join_transaction() (Dan Carpenter) 
  - Btrfs: allow mount -o remount,compress=no (Arnd Hannemann) 
  - Btrfs: remove ->dirty_inode (Josef Bacik) 
  - Btrfs: reduce calls to wake_up on uncontended locks (Chris Mason) 
  - Btrfs: don't wait around for new log writers on an SSD (Chris Mason) 
  - Btrfs: fix typo in convert_extent_bit (Liu Bo) 
  - Btrfs: add qgroup inheritance (Arne Jansen) 
  - Btrfs: call the qgroup accounting functions (Jan Schmidt) 
  - Btrfs: added helper to create new trees (Arne Jansen) 
  - Btrfs: check the root passed to btrfs_end_transaction (Arne Jansen) 
  - Btrfs: add helper for tree enumeration (Arne Jansen) 
  - Btrfs: join tree mod log code with the code holding back delayed refs (Jan Schmidt) 
  - Btrfs: fix buffer leak in btrfs_next_old_leaf (Jan Schmidt) 
  - Btrfs: hold a ref on the inode during writepages (Josef Bacik) 
  - Btrfs: fix tree log remove space corner case (Josef Bacik) 
  - Btrfs: fix wrong check during log recovery (Liu Bo) 
  - Btrfs: use _IOR for BTRFS_IOC_SUBVOL_GETFLAGS (Alexander Block) 
  - Btrfs: don't count I/O statistic read errors for missing devices (Stefan Behrens) 
  - Btrfs: resolve tree mod log locking issue in btrfs_next_leaf (Jan Schmidt) 
  - Btrfs: fix tree mod log rewind of ADD operations (Jan Schmidt) 
  - Btrfs: leave critical region in btrfs_find_all_roots as soon as possible (Jan Schmidt) 
  - Btrfs: always put insert_ptr modifications into the tree mod log (Jan Schmidt) 
  - Btrfs: fix tree mod log for root replacements at leaf level (Jan Schmidt) 
  - Btrfs: support root level changes in __resolve_indirect_ref (Jan Schmidt) 
  - Btrfs: avoid waiting for delayed refs when we must not (Jan Schmidt) 
  - Btrfs: delay iput with async extents (Josef Bacik) 
  - Btrfs: add a missing spin_lock (Josef Bacik) 
  - Btrfs: don't assume to be on the correct extent in add_all_parents (Alexander Block) 
  - Btrfs: introduce btrfs_next_old_item (Alexander Block) 
  - Btrfs: cast devid to unsigned long long for printk %llu (Chris Mason) 
  - Btrfs: init old_generation in get_old_root (Chris Mason) 
  - Btrfs: destroy the items of the delayed inodes in error handling routine (Miao Xie) 
  - Btrfs: make sure that we've made everything in pinned tree clean (Liu Bo) 
  - Btrfs: avoid memory leak of extent state in error handling routine (Liu Bo) 
  - Btrfs: do not resize a seeding device (Liu Bo) 
  - Btrfs: fix missing inherited flag in rename (Liu Bo) 
  - Btrfs: fix incompat flags setting (Li Zefan) 
  - Btrfs: fix defrag regression (Li Zefan) 
  - Btrfs: call filemap_fdatawrite twice for compression (Josef Bacik) 
  - Btrfs: keep inode pinned when compressing writes (Josef Bacik) 
  - Btrfs: implement ->show_devname (Josef Bacik) 
  - Btrfs: use rcu to protect device->name (Josef Bacik) 
  - Btrfs: unlock everything properly in the error case for nocow (Josef Bacik) 
  - Btrfs: fix btrfs_destroy_marked_extents (Josef Bacik) 
  - Btrfs: abort the transaction if the commit fails (Josef Bacik) 
  - Btrfs: wake up transaction waiters when aborting a transaction (Josef Bacik) 
  - Btrfs: fix locking in btrfs_destroy_delayed_refs (Josef Bacik) 
  - Btrfs: pass locked_page into extent_clear_unlock_delalloc if theres an error (Josef Bacik) 
  - Btrfs: fix race in tree mod log addition (Jan Schmidt) 
  - Btrfs: add btrfs_next_old_leaf (Jan Schmidt) 
  - Btrfs: fix return value for __tree_mod_log_oldest_root (Jan Schmidt) 
  - Btrfs: use btrfs_read_lock_root_node in get_old_root (Jan Schmidt) 
  - Btrfs: remove obsolete btrfs_next_leaf call from __resolve_indirect_ref (Jan Schmidt) 
  - Btrfs: remove call to btrfs_header_nritems with no effect (Jan Schmidt) 
  - Btrfs: fix tree mod log rewinded level and rewinding of moved keys (Jan Schmidt) 
  - Btrfs: fix tree mod log del_ptr (Jan Schmidt) 
  - Btrfs: add tree_mod_dont_log helper (Jan Schmidt) 
  - Btrfs: add missing spin_lock for insertion into tree mod log (Jan Schmidt) 
  - Btrfs: add inodes before dropping the extent lock in find_all_leafs (Jan Schmidt) 
  - Btrfs: use delayed ref sequence numbers for all fs-tree updates (Jan Schmidt) 
  - Btrfs: set ioprio of scrub readahead to idle (Stefan Behrens) 
  - Btrfs: fix return code in drop_objectid_items (Josef Bacik) 
  - Btrfs: check to see if the inode is in the log before fsyncing (Josef Bacik) 
  - Btrfs: return value of btrfs_read_buffer is checked correctly (Tsutomu Itoh) 
  - Btrfs: read device stats on mount, write modified ones during commit (Stefan Behrens) 
  - Btrfs: add ioctl to get and reset the device stats (Stefan Behrens) 
  - Btrfs: add device counters for detected IO and checksum errors (Stefan Behrens) 
  - btrfs: Drop unused function btrfs_abort_devices() (Asias He) 
  - Btrfs: fix the same inode id problem when doing auto defragment (Miao Xie) 
  - Btrfs: fall back to non-inline if we don't have enough space (Josef Bacik) 
  - Btrfs: fix how we deal with the orphan block rsv (Josef Bacik) 
  - Btrfs: convert the inode bit field to use the actual bit operations (Josef Bacik) 
  - Btrfs: merge contigous regions when loading free space cache (Josef Bacik) 
  - Btrfs: use fastpath in extent state ops as much as possible (Liu Bo) 
  - Btrfs: fix wrong error returned by adding a device (Liu Bo) 
  - Btrfs: finish ordered extents in their own thread (Josef Bacik) 
  - Btrfs: do not check delalloc when updating disk_i_size (Josef Bacik) 
  - Btrfs: avoid buffer overrun in mount option handling (Jim Meyering) 
  - Btrfs: NUL-terminate path buffer in DEV_INFO ioctl result (Jim Meyering) 
  - Btrfs: avoid buffer overrun in btrfs_printk (Jim Meyering) 
  - Fix minor type issues (Daniel J Blueman) 
  - btrfs: allow changing 'thread_pool' size at remount time (Sergei Trofimovich) 
  - Btrfs: cache no acl on new inodes (Josef Bacik) 
  - Btrfs: use i_version instead of our own sequence (Josef Bacik) 
  - Btrfs: tree mod log sanity checks in join_transaction (Jan Schmidt) 
  - Btrfs: fs_info variable for join_transaction (Jan Schmidt) 
  - Btrfs: use the tree modification log for backref resolving (Jan Schmidt) 
  - Btrfs: add btrfs_search_old_slot (Jan Schmidt) 
  - Btrfs: add del_ptr and insert_ptr modifications to the tree mod log (Jan Schmidt) 
  - Btrfs: put all block modifications into the tree mod log (Jan Schmidt) 
  - Btrfs: add tree modification log functions (Jan Schmidt) 
  - btrfs: trivial endianness annotations (Al Viro) 
  - Btrfs: add tree mod log to fs_info (Jan Schmidt) 
  - Btrfs: dummy extent buffers for tree mod log (Jan Schmidt) 
  - Btrfs: move struct seq_list to ctree.h (Jan Schmidt) 
  - Btrfs: add waitqueue instead of doing busy waiting for more delayed refs (Jan Schmidt) 
  - Btrfs: add sequence numbers to delayed refs (Arne Jansen) 
  - Btrfs: always save ref_root in delayed refs (Arne Jansen) 
  - Btrfs: mark delayed refs as for cow (Arne Jansen) 
  - Btrfs: don't set for_cow parameter for tree block functions (Jan Schmidt) 
  - Btrfs: look into the extent during find_all_leafs (Jan Schmidt) 
  - Btrfs: bugfix: ignore the wrong key for indirect tree block backrefs (Jan Schmidt) 
  - Btrfs: bugfix in btrfs_find_parent_nodes (Jan Schmidt) 
  - Btrfs: ulist realloc bugfix (Jan Schmidt) 
  - Btrfs: generic data structure to build unique lists (Arne Jansen) 
  - Btrfs: cleanup: use consistent lock naming (Dan Carpenter) 
  - Btrfs: remove the useless assignment to *entry in function tree_insert of file extent_io.c (Wang Sheng-Hui) 
  - Btrfs: fix the comment for find_first_extent_bit (Wang Sheng-Hui) 
  - Btrfs: fix btrfs_release_extent_buffer_page with the right usage of num_extent_pages (Wang Sheng-Hui) 
  - Btrfs: avoid sleeping in verify_parent_transid while atomic (Chris Mason) 
  - Btrfs: fix crash in scrub repair code when device is missing (Stefan Behrens) 
  - btrfs: Fix mismatching struct members in ioctl.h (Alexander Block) 
  - Btrfs: fix page leak when allocing extent buffers (Josef Bacik) 
  - Btrfs: Add properly locking around add_root_to_dirty_list (Chris Mason) 
  - Btrfs: reduce lock contention during extent insertion (Chris Mason) 
  - Btrfs: fix block_rsv and space_info lock ordering (Stefan Behrens) 
  - Btrfs: Prevent root_list corruption (Daniel J Blueman) 
  - Btrfs: fix repair code for RAID10 (Jan Schmidt) 
  - Btrfs: do not start delalloc inodes during sync (Josef Bacik) 
  - Btrfs: fix that check_int_data mount option was ignored (Stefan Behrens) 
  - Btrfs: don't count CRC or header errors twice while scrubbing (Stefan Behrens) 
  - Btrfs: fix btrfs_ioctl_dev_info() crash on missing device (Stefan Behrens) 
  - btrfs: don't return EINTR (Arne Jansen) 
  - Btrfs: double unlock bug in error handling (Dan Carpenter) 
  - Btrfs: always store the mirror we read the eb from (Josef Bacik) 
  - fs/btrfs/volumes.c: add missing free_fs_devices (Julia Lawall) 
  - Btrfs: fix max chunk size check in chunk allocator (Ilya Dryomov) 
  - Btrfs: add missing read locks in backref.c (Jan Schmidt) 
  - Btrfs: don't call free_extent_buffer twice in iterate_irefs (Jan Schmidt) 
  - Btrfs: Make free_ipath() deal gracefully with NULL pointers (Jesper Juhl) 
  - Btrfs: avoid possible use-after-free in clear_extent_bit() (Li Zefan) 
  - Btrfs: retrurn void from clear_state_bit (Li Zefan) 
  - btrfs: add missing unlocks to transaction abort paths (David Sterba) 
  - Btrfs: do not mount when we have a sectorsize unequal to PAGE_SIZE (Liu Bo) 
  - btrfs: don't add both copies of DUP to reada extent tree (Arne Jansen) 
  - btrfs: fix race in reada (Arne Jansen) 
  - Btrfs: use commit root when loading free space cache (Josef Bacik) 
  - Btrfs: fix use-after-free in __btrfs_end_transaction (Dave Jones) 
  - Btrfs: check return value of bio_alloc() properly (Tsutomu Itoh) 
  - Btrfs: fix eof while discarding extents (Liu Bo) 
  - Btrfs: fix uninit variable in repair_eb_io_failure (Chris Mason) 
  - btrfs: assignment in write_dev_flush() doesn't need two semi-colons (Jesper Juhl) 
  - Btrfs: update the checks for mixed block groups with big metadata blocks (Chris Mason) 
  - Btrfs: update to the right index of defragment (Liu Bo) 
  - Btrfs: do not bother to defrag an extent if it is a big real extent (Liu Bo) 
  - Btrfs: add a check to decide if we should defrag the range (Liu Bo) 
  - Btrfs: fix recursive defragment with autodefrag option (Liu Bo) 
  - Btrfs: fix the mismatch of page->mapping (Liu Bo) 
  - Btrfs: fix race between direct io and autodefrag (Liu Bo) 
  - Btrfs: fix deadlock during allocating chunks (Liu Bo) 
  - Btrfs: don't use crc items bigger than 4KB (Chris Mason) 
  - Btrfs: flush out and clean up any block device pages during mount (Chris Mason) 
  - btrfs: disallow unequal data/metadata blocksize for mixed block groups (David Sterba) 
  - Btrfs: enhance superblock sanity checks (David Sterba) 
  - Btrfs: change scrub to support big blocks (Stefan Behrens) 
  - Btrfs: minor cleanup in scrub (Stefan Behrens) 
  - Btrfs: introduce common define for max number of mirrors (Stefan Behrens) 
  - Btrfs: fix infinite loop in btrfs_shrink_device() (Ilya Dryomov) 
  - Btrfs: fix memory leak in resolver code (Ilya Dryomov) 
  - Btrfs: improve the logic in btrfs_can_relocate() (Ilya Dryomov) 
  - Btrfs: add __get_block_group_index() helper (Ilya Dryomov) 
  - Btrfs: stop silently switching single chunks to raid0 on balance (Ilya Dryomov) 
  - Btrfs: fix regression in scrub path resolving (Jan Schmidt) 
  - btrfs: fix locking issues in find_parent_nodes() (Li Zefan) 
  - Btrfs: avoid positive number with ERR_PTR (Jan Schmidt) 
  - Btrfs: fix uninit warning in backref.c (Jan Schmidt) 
  - Btrfs: new backref walking code (Jan Schmidt) 
  - Btrfs: added btrfs_find_all_roots() (Jan Schmidt) 
  - Btrfs: actually call btrfs_init_lockdep (Jan Schmidt) 
  - Btrfs: deal with read errors on extent buffers differently (Josef Bacik) 
  - Btrfs: don't use threaded IO completion helpers for metadata writes (Chris Mason) 
  - Btrfs: adjust the write_lock_level as we unlock (Chris Mason) 
  - Btrfs: loop waiting on writeback (Chris Mason) 
  - Btrfs: add the ability to cache a pointer into the eb (Chris Mason) 
  - Btrfs: ensure an entire eb is written at once (Josef Bacik) 
  - Btrfs: introduce mark_extent_buffer_accessed (Josef Bacik) 
  - Btrfs: introduce free_extent_buffer_stale (Josef Bacik) 
  - Btrfs: only use the existing eb if it's count isn't 0 (Josef Bacik) 
  - Btrfs: set page->private to the eb (Josef Bacik) 
  - Btrfs: allow metadata blocks larger than the page size (Chris Mason) 
  - Btrfs: remove search_start and search_end from find_free_extent and callers (Josef Bacik) 
  - Btrfs: remove the ideal caching code (Josef Bacik) 
  - btrfs: Fix busyloop in transaction_kthread() (Jan Kara)


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-400.106.0.el6uek]
changelog:
  - spec: fix suffix order of a directory name (Guangyu Sun) [Orabug: 16682371] 
  - Merge tag 'v2.6.39-400#qu4bcom' of git://ca-git.us.oracle.com/linux-snits-public into uek2-master (Maxim Uvarov) [Orabug: 16626319] 
  - Merge tag 'v2.6.39-400#qu4qlge' of git://ca-git.us.oracle.com/linux-snits-public into uek2-master (Maxim Uvarov) [Orabug: 16732027] 
  - Merge tag 'v2.6.39-400#qu4lpfc' of git://ca-git.us.oracle.com/linux-snits-public into uek2-master (Maxim Uvarov) [Orabug: 16749881] 
  - block: default SCSI command filter does not accomodate commands overlap across device classes (Jamie Iles) [Orabug: 16387137] {CVE-2012-4542} 
  - Parallel mtrr init between cpus (Zhenzhong Duan) [Orabug: 16434164] 
  - fuse: return -EGAIN if not connected (Josef Bacik) [Orabug: 16740418] 
  - qlcnic: update to version 5.2.29.45 (Jerry Snitselaar) [Orabug: 16694438] 
  - qlge: update to version 1.00.00.32 (Jerry Snitselaar) [Orabug: 16732027] 
  - lpfc: Corrected Copyright string (Gairy Grannum) [Orabug: 16749881] 
  - lpfc: enable BlockGuard Support by default (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.37: Fixed exhausted retry for plogi to nameserver. (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.37: Fixed ELS_REC received on the unsolicited receive queue (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.36: Correct mask error (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.36: Correct buffer length overrun (James Smart) [Orabug: 16749881] 
  - lpfc: typo cleanup (Linus Torvalds) [Orabug: 16749881] 
  - lpfc 8.3.36: Update DIF support for passthru/strip/insert (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.36: Fix bug with Target Resets and FCP2 devices (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.35: Fixed not reporting logical link speed to SCSI midlayer when QoS not on (James Smart) [Orabug: 16749881] 
  - lpfc: Update lpfc version for 8.3.7.10.4p driver release (Gairy Grannum) [Orabug: 16749881] 
  - lpfc 8.3.35: Correct request_firmware use that was increasing boot times (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.35: Correct request_firmware use that was increasing boot times (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed driver handling of CLEAR_LA with NPIV enabled causing SID=0 frames out (James Smart) [Orabug: 16749881] 
  - scsi: fix lpfc build when wmb() is defined as mb() (Randy Dunlap) [Orabug: 16749881] 
  - lpfc: Reduced tmo value set to FLOGI WQE for quick recovery from FLOGI sequence timeout (James Smart) [Orabug: 16749881] 
  - lpfc: Add log message when completes with clean address bit set to zero (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed driver vector mapping to CPU affinity (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed driver vector mapping to CPU affinity (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed iocb flags not being reset for scsi commands (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed system panic during EEH recovery due to midlayer acting on outstanding I/O (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed system panic during EEH recovery due to midlayer acting on outstanding I/O (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed not returning FAILED status when SCSI invoking host reset handler failed (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed bad book keeping in posting els sgls to port (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed deadlock between hbalock and nlp_lock use (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed BlockGuard to take advantage of rdprotect/wrprotect info when available (James Smart) [Orabug: 16749881] 
  - lpfc: Reduced spinlock contention on SCSI buffer list (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed crash when processing bsg's sg list with high memory pages (James Smart) [Orabug: 16749881] 
  - lpfc: Fix lpfc_fcp_look_ahead module parameter (James Smart) [Orabug: 16749881] 
  - lpfc: Fix driver issues with SCSI Host reset (James Smart) [Orabug: 16749881] 
  - lpfc: Doorbell formation information logged in dual-chute mode WQ and RQ setup (James Smart) [Orabug: 16749881] 
  - lpfc: Fix driver issues with large s/g lists for BlockGuard (James Smart) [Orabug: 16749881] 
  - lpfc: Fix driver issues with large lpfc_sg_seg_cnt values (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed pt2pt and loop discovery problems on topology changes. (James Smart) [Orabug: 16749881] 
  - lpfc: Remove driver dependency on HZ (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.38: Fixed async FCF modified event to in-use FCF failure to trigger recovery (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed BlockGuard error reporting (James Smart) [Orabug: 16749881] 
  - lpfc: Fixed VPI allocation issues after firmware dump is performed (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.38: Fixed potential mis-interpretation of READ_TOPOLOGY reserved fields (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.38: Fix default value for lpfc_enable_rrq. (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.38: Fixed circular locking dependency and inconsistent lock state issues (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.38: Fixed PT2PT bring up problem for FC SLI4. (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.38: Fixed OXID reuse issue. (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.38: Fixed async FCF modified event to in-use FCF failure to trigger recovery (James Smart) [Orabug: 16749881] 
  - lpfc: fix potential NULL pointer dereference in lpfc_sli4_rq_put() (Wei Yongjun) [Orabug: 16749881] 
  - lpfc 8.3.38: Fixed deadlock condition in FCF round robin handling (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.38: Fixed bsg timeout handling issues that would result in crashes (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.38: Fixed NMI watch dog panic's when resetting the hba. (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.38: Fixed degraded performance after cable pulls (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.37: Provide support for change_queue_type (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.37: Fixed infinite loop in lpfc_sli4_fcf_rr_next_index_get. (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.37: Fixed crash due to SLI Port invalid resource count (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.37: Fix potential memory corruption bug (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.37: Provide support for FCoE protocol dual-chute (ULP) operation (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.37: Fixed stale ndlp state when the node is marked for deferred removal. (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.37: Removed use of NOP mailboxes for interrupt verification (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.37: Removed use of NOP mailboxes for interrupt verification (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.35: Fixed not checking solicition in progress bit when verifying FCF record for use (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.35: Fixed PRLI not being retried if a LS_RJT with a reason (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.35: Correct request_firmware use that was increasing boot times (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.35: Expand I/O channel support for large systems (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.35: Fix interrupt delay multipler conversion for eq_create (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.34: Correct typecasts for snprintf messages (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Add Interrupts per second stats via debugfs (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.34: Adjust IO Channels to 1 when INTx (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.34: Fix number of IO channels to match CPUs (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Add debugfs interface to display SLI queue information (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Tie parallel I/O queues into separate MSIX vectors (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Allow per-hba interrupt rate tuning (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Tie parallel I/O queues into separate MSIX vectors (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Fixed debugfs queInfo to include queue stats (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Add lpfc_fcp_look_ahead module parameter (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Allow per-hba interrupt rate tuning (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Parallelize SLI-4 Q distribution (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Allow per-hba interrupt rate tuning (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Make I/O to hw queue distribution algorithm a module parameter (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Change Naming convention for SLI4 Interrupt vector (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Allow per-hba interrupt rate tuning (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Tie parallel I/O queues into separate MSIX vectors (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Formally separate lpfc_sli_ring SLI-3 and SLI-4 variantions (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Add Interrupts per second stats via debugfs (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Parallelize SLI-4 Q distribution (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Misc changes to optimize critical path (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Formally separate lpfc_sli_ring SLI-3 and SLI-4 variantions (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Convert to no SCSI host lock in queuecommand (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Convert to no SCSI host lock in queuecommand (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Convert to no SCSI host lock in queuecommand (James Smart) [Orabug: 16749881] 
  - lpfc 8.3.33: Add debugfs interface to display SLI queue information (James Smart) [Orabug: 16749881] 
  - bnx2x: update to broadcom version 1.76.54 (Jerry Snitselaar) 
  - bnx2fc: update to broadcom version 2.3.4 (Jerry Snitselaar) 
  - bnx2i: update to broadcom version 2.7.6.1d (Jerry Snitselaar) 
  - cnic: update to broadcom version 2.5.16g (Jerry Snitselaar) 
  - bnx2: update to broadcom version 2.2.3n (Jerry Snitselaar) 
  - tg3: update to broadcom version 3.129d (Jerry Snitselaar) 
  - drivers:net: dma_alloc_coherent: use __GFP_ZERO instead of memset(, 0) (Joe Perches) 
  - drivers:net: Remove dma_alloc_coherent OOM messages (Joe Perches) 
  - be2net: Use new F/W mailbox cmd to manipulate interrupts. (Somnath Kotur) 
  - be2net: enable interrupts in be_probe() (RoCE and other ULPs need them) (Somnath Kotur) 
  - be2net: Update copyright year (Vasundhara Volam) 
  - be2net: use CSR-BAR SEMAPHORE reg for BE2/BE3 (Sathya Perla) 
  - benet: Wait f/w POST until timeout (Gavin Shan) 
  - be2net: remove BUG_ON() in be_mcc_compl_is_new() (Sathya Perla) 
  - be2net: update driver version to 4.6.x (Sathya Perla) 
  - be2net: fix re-loaded PF driver to re-gain control of its VFs (Sathya Perla) 
  - be2net: Updating Module Author string and log message string to "Emulex Corporation" (Sarveshwar Bandi) 
  - be2net: fix unconditionally returning IRQ_HANDLED in INTx (Sathya Perla) 
  - ethtool: fix drvinfo strings set in drivers (Jiri Pirko) 
  - be2net: fix wrong frag_idx reported by RX CQ (Sathya Perla) 
  - be2net: fix be_close() to ensure all events are ack'ed (Sathya Perla) 
  - drivers/net: fix up function prototypes after __dev* removals (Greg Kroah-Hartman) 
  - be2net: remove __dev* attributes (Bill Pemberton) 
  - [scsi] fnic driver update to 1.5.0.41 (Maxim Uvarov) 
  - [SCSI] sd: Permit merged discard requests (Martin K. Petersen) 
  - [SCSI] scsi_dh_alua: backoff alua rtpg retry linearly vs. geometrically (Rob Evers) 
  - [SCSI] scsi_dh_alua: retry alua rtpg extended header for illegal request response (Rob Evers) 
  - [SCSI] scsi_dh_alua: implement 'implied transition timeout' (Rob Evers) 
  - [SCSI] scsi_dh_alua: Fix the time inteval for alua rtpg commands (Moger, Babu) 
  - [SCSI] scsi_dh_alua: Decrease retry interval (Hannes Reinecke) 
  - [SCSI] scsi_dh_alua: Fix Erroneous TPG ID check (Hannes Reinecke) 
  - [SCSI] scsi_dh_alua: always update TPGS status on activate (Hannes Reinecke) 
  - [SCSI] scsi scan: don't fail scans when host is in recovery (Mike Christie) 
  - [SCSI] scsi_lib: pause between error retries (James Smart) 
  - RDS: Fixes race conditions that may lead to non-optimal paths, causing lower throughput. (Bang Nguyen) [Orabug: 16571410] 
  - Merge tag 'v2.6.39-400.20.1.16313854' of git://ca-git.us.oracle.com/linux-uek-2.6.39-ofed into uek2-master (Maxim Uvarov) [Orabug: 16313854] 
  - sched: Use resched IPI to kick off the nohz idle balance (Suresh Siddha) [Orabug: 16424589] 
  - x86, efi/efi.c: Suppress error message when desc_size not equal size from UEFI Porting from Yinghai's patch from following link http://permalink.gmane.org/gmane.linux.kernel/1131668 x86, efi: Only print warning when desc_size is smaller than defined one. Used to suppress the error message when desc_size not equal size from UEFI. (ethan.zhao) [Orabug: 15814305] 
  - SPEC: add x86_energy_perf_policy tool Add tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy to ol5 ol6 uek kernel rpmbuild spec file and create shell wrapper for this tool. (ethan.zhao) [Orabug: 16036151] 
  - igbvf: Update to 2.0.4 (ethan.zhao) [Orabug: 16626308] 
  - ixgbevf: Update to 2.8.7 (ethan.zhao) [Orabug: 16626308] 
  - ixgbe: Update to 3.14.5 (ethan.zhao) [Orabug: 16626308] 
  - igb: Update to 4.1.2 (ethan.zhao) [Orabug: 16626308] 
  - e1000e: Update to 2.3.2 (ethan.zhao) [Orabug: 16626308]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.107.1.el6uek]
changelog:
  - xen/pci: Track PVHVM PIRQs. (Zhenzhong Duan) 
  - ocfs2_prep_new_orphaned_file return ret (Xiaowei.Hu) [Orabug: 16823825] 
  - Revert "Btrfs: remove ->dirty_inode" (Guangyu Sun) [Orabug: 16841843] 
  - bonding: emit event when bonding changes MAC (Weiping Pan) [Orabug: 16750157] 
  - net: fix incorrect credentials passing (Linus Torvalds) [Orabug: 16836975] {CVE-2013-1979} 
  - tg3: fix length overflow in VPD firmware parsing (Kees Cook) [Orabug: 16836958] {CVE-2013-1929} 
  - USB: cdc-wdm: fix buffer overflow (Oliver Neukum) [Orabug: 16836943] {CVE-2013-1860} 
  - ext3: Fix format string issues (Lars-Peter Clausen) [Orabug: 16836934] {CVE-2013-1848} 
  - cnic: don't use weak dependencies for ipv6 (Jerry Snitselaar) [Orabug: 16780307] 
  - Revert "drm/i915: correctly order the ring init sequence" (Guangyu Sun) [Orabug: 16486689] 
  - x86/boot-image: Don't leak phdrs in arch/x86/boot/compressed/misc.c::Parse_elf() (Jesper Juhl) [Orabug: 16833437] 
  - spec: add /boot/vmlinuz*.hmac needed for fips mode (John Haxby) [Orabug: 16807114] 
  - perf: Treat attr.config as u64 in perf_swevent_init() (Tommi Rantala) [Orabug: 16808734] {CVE-2013-2094} 
  - spec: ol6 add multipath version deps (Maxim Uvarov) [Orabug: 16763586] 
  - Fix EN driver to work with newer FWs based on latest mlx4_core (Yuval Shaia) [Orabug: 16748891] 
  - xen-netfront: delay gARP until backend switches to Connected (Laszlo Ersek) 
  - fuse: enhance fuse dev to be numa aware (Srinivas Eeda) [Orabug: 16218187] 
  - fuse: add fuse numa node struct (Srinivas Eeda) [Orabug: 16218187] 
  - fuse: add numa mount option (Srinivas Eeda) [Orabug: 16218187] 
  - xen-blkfront: use a different scatterlist for each request (Roger Pau Monne) [Orabug: 16660413] 
  - bonding: allow all slave speeds (Jiri Pirko) [Orabug: 16759490] 
  - dlmglue race condition,wrong lockres_clear_pending (Xiaowei.Hu) [Orabug: 13611997]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.108.1.el6uek]
changelog:
  - Revert "dlmglue race condition,wrong lockres_clear_pending" (Maxim Uvarov) [Orabug: 16897450] 
  - Suppress the error message from being printed in ocfs2_rename (Xiaowei.Hu) [Orabug: 16790405] 
  - fnic: return zero on fnic_reset() success (Joe Jin) [Orabug: 16885029]


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-400.109.1.el6uek]
changelog:
  - while removing a non-empty directory, the kernel dumps a message: (rmdir,21743,1):ocfs2_unlink:953 ERROR: status = -39 (Xiaowei.Hu) [Orabug: 16790405] 
  - stop mig handler when lockres in progress ,and return -EAGAIN (Xiaowei.Hu) [Orabug: 16876446]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.109.2.el6uek]
changelog:
  - be2net: enable interrupts in probe (Jerry Snitselaar) [Orabug: 17080364]  
  - Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg() (Mathias Krause) [Orabug: 17173830] {CVE-2013-3225} 
  - Bluetooth: fix possible info leak in bt_sock_recvmsg() (Mathias Krause) [Orabug: 17173830] {CVE-2013-3224} 
  - atm: update msg_namelen in vcc_recvmsg() (Mathias Krause) [Orabug: 17173830] {CVE-2013-3222} 
  - rtnl: fix info leak on RTM_GETLINK request for VF devices (Mathias Krause) [Orabug: 17173830] {CVE-2013-2635} 
  - dcbnl: fix various netlink info leaks (Mathias Krause) [Orabug: 17173830] {CVE-2013-2634} 
  - udf: avoid info leak on export (Mathias Krause) [Orabug: 17173830] {CVE-2012-6548} 
  - tracing: Fix possible NULL pointer dereferences (Namhyung Kim) [Orabug: 17173830] {CVE-2013-3301} 
  - b43: stop format string leaking into error msgs (Kees Cook) [Orabug: 17173830] {CVE-2013-2852} 
  - signal: always clear sa_restorer on execve (Kees Cook) [Orabug: 17173830] {CVE-2013-0914}


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.109.5.el6uek]
changelog:
  - fs writeback: fix race in mark inode dirty.patch (Srinivas Eeda) [Orabug: 17207406]  
  - writeback: Fix periodic writeback after fs mount (Srinivas Eeda) [Orabug: 17201235]  
  - spec: use _target_cpu in suffix for devel dir (Jerry Snitselaar) [Orabug: 17181059]


author: Jerry Snitselaar <jerry.snitselaar@oracle.com> [2.6.39-400.109.6.el6uek]
changelog:
  - block: do not pass disk names as format strings (Kees Cook) [Orabug: 17230083] {CVE-2013-2851} 
  - libceph: Fix NULL pointer dereference in auth client code (Tyler Hicks) [Orabug: 17230108] {CVE-2013-1059} 
  - ipv6: ip6_sk_dst_check() must not assume ipv6 dst (Eric Dumazet) [Orabug: 17371078] {CVE-2013-2232} 
  - af_key: initialize satype in key_notify_policy_flush() (Nicolas Dichtel) [Orabug: 17370788] {CVE-2013-2237} 
  - Bluetooth: HCI - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17370892] {CVE-2012-6544} 
  - Bluetooth: L2CAP - Fix info leak via getsockname() (Mathias Krause) [Orabug: 17371050] {CVE-2012-6544} 
  - Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER) (Mathias Krause) [Orabug: 17371065] {CVE-2012-6544} 
  - sctp: Use correct sideffect command in duplicate cookie handling (Vlad Yasevich) [Orabug: 17371118] {CVE-2013-2206} 
  - sctp: deal with multiple COOKIE_ECHO chunks (Max Matveev) [Orabug: 17372121] {CVE-2013-2206}


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.8.0.el6uek]
changelog:
  - git-changelog: don't print debug info (Maxim Uvarov)
  - spec: remove not used firmwares (Maxim Uvarov) [Orabug: 16048277]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.9.0.el6uek]
changelog:
  - mlx4_ib: alias_GUID, calculate slave port state in sa query handler
    (Ajaykumar Hotchandani) [Orabug: 15997083]
  - RDS: Fixes warning while rds-info. spin_lock_irqsave() is changed to
    spin_lock_bh(). (Ajaykumar Hotchandani) [Orabug: 15997083]
  - mlx4_en: handle HCA events correctly (Ajaykumar Hotchandani) [Orabug:
    15997083]
  - ixgbevf fix typo in Makefile (Maxim Uvarov) [Orabug: 16168292]
  - [patch3/3] kernel config: Mellanox OFED R2, 0080 release (Ajaykumar
    Hotchandani) [Orabug: 15997083]
  - [patch2/3] RDS merge for UEK2 (Ajaykumar Hotchandani) [Orabug: 15997083]
  - [patch1/3] Merge for Mellanox OFED R2, 0080 release (Ajaykumar Hotchandani)
    [Orabug: 15997083]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.10.0.el6uek]
changelog:
  - btrfs: fix incompatible pointer warning (Jerry Snitselaar)
  - bnx2x: enable support for ethtool op get_rxfh_indir_size (Jerry Snitselaar)
  - Revert "cgroup: notify_on_release may not be triggered in some cases" (Maxim
    Uvarov) [Orabug: 16167473]
  - mlx4: disable build for i686 (Maxim Uvarov)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.11.0.el6uek]
changelog:
  - cnic: don't use weak dependencies for ipv6 (Jerry Snitselaar) [Orabug:
    16207564]
  - ext4: remove unaligned AIO warning printk (Eric Sandeen) [Orabug: 14096480]
  - SPEC: add block/net modules to list used by installer (Guru Anbalagane)
    [Orabug: 14224837]
  - dm mpath: add retain_attached_hw_handler feature (Mike Snitzer) [Orabug:
    16199397]
  - [SCSI] scsi_dh: add scsi_dh_attached_handler_name (Mike Snitzer) [Orabug:
    16199397]
  - xen/grant-table: Force to use v1 of grants. (Konrad Rzeszutek Wilk) [Oracle-
    bug: 16039922]
  - xen: netback: handle compound page fragments on transmit. (Ian Campbell)
  - xen: Fix stack corruption in xen_failsafe_callback for 32bit PVOPS guests.
    (Andrew Cooper)  {CVE-2013-0190}
  - xen/grant-table: correctly initialize grant table version 1 (Matt Wilson)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.12.0.el6uek]
changelog:
  - IB: Add config options for Mellanox driver Xen FMR support. (Ajaykumar
    Hotchandani) [Orabug: 16234102]
  - IB: Enable Xen FMR support for Mellanox driver. (Ajaykumar Hotchandani)
    [Orabug: 16234102]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.13.0.el6uek]
changelog:
  - kmod: make __request_module() killable (Oleg Nesterov) [Orabug: 16286305]
    {CVE-2012-4398}
  - kmod: introduce call_modprobe() helper (Oleg Nesterov) [Orabug: 16286305]
    {CVE-2012-4398}
  - usermodehelper: implement UMH_KILLABLE (Oleg Nesterov) [Orabug: 16286305]
    {CVE-2012-4398}
  - usermodehelper: introduce umh_complete(sub_info) (Oleg Nesterov) [Orabug:
    16286305] {CVE-2012-4398}
  - KVM: x86: invalid opcode oops on SET_SREGS with OSXSAVE bit set
    (CVE-2012-4461) (Jerry Snitselaar) [Orabug: 16286290] {CVE-2012-4461}
  - exec: do not leave bprm->interp on stack (Kees Cook) [Orabug: 16286267]
    {CVE-2012-4530}
  - exec: use -ELOOP for max recursion depth (Kees Cook) [Orabug: 16286267]
    {CVE-2012-4530}
  - xen-pciback: rate limit error messages from xen_pcibk_enable_msi{,x}() (Jan
    Beulich) [Orabug: 16243736] {CVE-2013-0231}
  - netback: correct netbk_tx_err to handle wrap around. (Ian Campbell) [Orabug:
    16243309] {CVE-2013-0216 CVE-2013-0217}
  - xen/netback: free already allocated memory on failure in
    xen_netbk_get_requests (Ian Campbell) [Orabug: 16243309] {CVE-2013-0216
    CVE-2013-0217}
  - xen/netback: don't leak pages on failure in xen_netbk_tx_check_gop. (Ian
    Campbell) [Orabug: 16243309] {CVE-2013-0216 CVE-2013-0217}
  - xen/netback: shutdown the ring if it contains garbage. (Ian Campbell)
    [Orabug: 16243309] {CVE-2013-0216 CVE-2013-0217}
  - SCSI: scsi_remove_target: fix softlockup regression on hot remove (Dan
    Williams) [Orabug: 16242926]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.14.0.el6uek]
changelog:
  - xfs: use shared ilock mode for direct IO writes by default (Dave Chinner)
    [Orabug: 16304938]
  - sched: fix divide by zero at {thread_group,task}_times (Stanislaw Gruszka)
    [Orabug: 15956690]
  - Revert "Revert "cgroup: notify_on_release may not be triggered in some
    cases"" (Maxim Uvarov)
  - xen_fmr: Verify XEN platform before running xen_fmr drivers (Yuval Shaia)
    [Orabug: 16302435]
  - rds: unregister IB event handler on shutdown (Bang Nguyen) [Orabug: 16302435]
  - rds: HAIP support child interface (Bang Nguyen) [Orabug: 16302435]
  - RDS HAIP misc fixes (Bang Nguyen) [Orabug: 16302435]
  - Ignore failover groups if HAIP is disabled (Bang Nguyen) [Orabug: 16302435]
  - RDS: RDS rolling upgrade (Saeed Mahameed) [Orabug: 16302435]
  - mlx4_core: use correct FMR number of clients according to PRM. (Saeed
    Mahameed) [Orabug: 16302435]


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-400.15.0.el6uek]
changelog:
  - x86/xen: don't assume %ds is usable in xen_iret for 32-bit PVOPS. (Jan
    Beulich)  {CVE-2013-0228}
  - xen-blkfront: drop the use of llist_for_each_entry_safe (Konrad Rzeszutek
    Wilk) [Orabug: 16263164]
  - Revert "xen PVonHVM: use E820_Reserved area for shared_info" (Konrad
    Rzeszutek Wilk) [Orabug: 16297716]
  - Revert "xen/PVonHVM: fix compile warning in init_hvm_pv_info" (Konrad
    Rzeszutek Wilk)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.16.0.el6uek]
changelog:
  - epoll: prevent missed events on EPOLL_CTL_MOD (Eric Wong) [Orabug: 16363540]
  - rds: this resolved crash while removing rds_rdma module. orabug: 16268201
    (Bang Nguyen) [Orabug: 16268201]
  - rds: scheduling while atomic on failover orabug: 16275095 (Bang Nguyen)
    [Orabug: 16268201]
  - SRP: Revert back to 2.6.39-400.8.0 code (Ajaykumar Hotchandani) [Orabug:
    16268201]
  - iSER: Revert back to 2.6.39-400.8.0 code (Ajaykumar Hotchandani) [Orabug:
    16268201]


author: Guru Anbalagane <guru.anbalagane@oracle.com> [2.6.39-400.17.1.el6uek]
changelog:
  - This is a fix on dlm_clean_master_list() (Xiaowei.Hu)
  - RDS: fix rds-ping spinlock recursion (jeff.liu) [Orabug: 16223050]
  - vhost: fix length for cross region descriptor (Michael S. Tsirkin) [Orabug:
    16387183] {CVE-2013-0311}
  - kabifix: block/scsi: Allow request and error handling timeouts to be
    specified (Maxim Uvarov)
  - block/scsi: Allow request and error handling timeouts to be specified (Martin
    K. Petersen) [Orabug: 16372401]
  - [SCSI] Shorten the path length of scsi_cmd_to_driver() (Li Zhong) [Orabug:
    16372401]
  - Fix NULL dereferences in scsi_cmd_to_driver (Mark Rustad) [Orabug: 16372401]
  - SCSI: Fix error handling when no ULD is attached (Martin K. Petersen)
    [Orabug: 16372401]
  - Handle disk devices which can not process medium access commands (Martin K.
    Petersen) [Orabug: 16372401]
  - the ac->ac_allow_chain_relink=0 won't disable group relink (Xiaowei.Hu)
    [Orabug: 14842737]
  - pci: hotplug: fix null dereference in pci_set_payload() (Jerry Snitselaar)
    [Orabug: 16345420]


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.107.0.el6uek]
changelog:
  - Fix EN driver to work with newer FWs based on latest mlx4_core (Yuval Shaia) [Orabug: 16748891] 
  - Merge tag 'v2.6.39-400.105.0.ol5_bug13611997#bug13611997' of git://ca-git.us.oracle.com/linux-xiaowhu-public into uek2-master (Maxim Uvarov) [Orabug: 13611997] 
  - xen-netfront: delay gARP until backend switches to Connected (Laszlo Ersek) 
  - fuse: enhance fuse dev to be numa aware (Srinivas Eeda) 
  - fuse: add fuse numa node struct (Srinivas Eeda) 
  - fuse: add numa mount option (Srinivas Eeda) 
  - xen-blkfront: use a different scatterlist for each request (Roger Pau Monne) 
  - bonding: allow all slave speeds (Jiri Pirko) [Orabug: 16759490] 
  - dlmglue race condition,wrong lockres_clear_pending (Xiaowei.Hu)


author: Maxim Uvarov <maxim.uvarov@oracle.com> [2.6.39-400.201.0.el6uek]
changelog:
  - spec: change version to 400.200.0 for ol5 (Maxim Uvarov)
  - RDS: restore two-sided reconnect with the lower IP node having a constant 100
    ms backoff. (Bang Nguyen) [Orabug: 16710287]
  - scsi_prep_fn() check for empty queue (Maxim Uvarov) [Orabug: 17015328]
  - spec: change version to 400.200.0 (Maxim Uvarov)
  - NFSv4.x: Fix handling of partially delegated locks (Trond Myklebust) [Orabug:
    17004718]
  - rds: set correct msg_namelen (Weiping Pan)  {CVE-2012-3430}
  - x86/irq/ioapic: Check for valid irq_cfg pointer in
    smp_irq_move_cleanup_interrupt (Dimitri Sivanich) [Orabug: 16874839]
  - [SCSI] scsi_error: classify some ILLEGAL_REQUEST sense as a permanent
    TARGET_ERROR (Mike Snitzer) [Orabug: 16862947]
  - printk: fix buffer overflow when calling log_prefix function from
    call_console_drivers (Alexandre SIMON) [Orabug: 16425333] {CVE-2013-1772}
  - xen/enlighten: IS_ENABLE macro does not exist. (Konrad Rzeszutek Wilk)
  - xen/pci: Track PVHVM PIRQs. (Konrad Rzeszutek Wilk)
  - xenbus_client.c: correct exit path for xenbus_map_ring_valloc_hvm (Wei Liu)
  - xen: Clean up apic ipi interface (Stefan Bader)
  - xenbus: save xenstore local status for later use (Aurelien Chartier)
  - xenbus: delay xenbus frontend resume if xenstored is not running (Aurelien
    Chartier)
  - xen/xenbus: Fixed over 80 character limit issue (Lisa Nguyen)
  - xen/xenbus: Fixed indentation error in switch case (Lisa Nguyen)
  - xen/privcmd: fix condition in privcmd_close() (Dan Carpenter)
  - xen: mask x2APIC feature in PV (Zhenzhong Duan)
  - xen: SWIOTLB is only used on x86 (Arnd Bergmann)
  - Support checksum and gso offload of ipv6 in netback (Annie Li) [Orabug:
    16974811]
  - iser: iscsiadm logout hangs (Shamir Rabinovitch) [Orabug: 16313854]
  - RDS: IP config needs to be updated when network/rdma service restarted. (Bang
    Nguyen) [Orabug: 16963884]
  - RDS: check for valid rdma id before initiating connection (Bang Nguyen)
    [Orabug: 16857341]
  - RDS: reduce slab memory usage (Bang Nguyen) [Orabug: 16935507]
  - RDMA CM: Avoid possible SEGV during connection shutdown (Bang Nguyen)
    [Orabug: 16750726]
  - iommu/vt-d: add quirk for broken interrupt remapping on 55XX chipsets (Neil
    Horman) [Orabug: 16875921]
  - xen: mask x2APIC feature in PV (Zhenzhong Duan) [Orabug: 16372098]
  - scsi_dh_alua: Evaluate TPGS setting from inquiry data (Hannes Reinecke)
    [Orabug: 16737121]
  - scsi_dh: Implement match callback function (Hannes Reinecke) [Orabug:
    16737121]
  - RDS: Move connection along with IP when failing over/back. (Bang Nguyen)
    [Orabug: 16916648]
  - random: Add support for architectural random hooks (H. Peter Anvin) [Orabug:
    16916375]
  - random: use lockless techniques in the interrupt path (Theodore Ts'o)
    [Orabug: 16916375]
  - random: make 'add_interrupt_randomness()' do something sane (Theodore Ts'o)
    [Orabug: 16916375]
  - random: Use arch_get_random_int instead of cycle counter if avail (Linus
    Torvalds) [Orabug: 16916375]
  - random: Adjust the number of loops when initializing (H. Peter Anvin)
    [Orabug: 16916375]
  - random: Use arch-specific RNG to initialize the entropy store (Theodore Ts'o)
    [Orabug: 16916375]
  - x86, random: Architectural inlines to get random integers with RDRAND (H.
    Peter Anvin) [Orabug: 16916375]
  - RDS: Rename HAIP parameters to Active Bonding (Bang Nguyen) [Orabug:
    16810395]
  - rds shouldn't release fmr when ib_device was already released. (Zheng Li)
    [Orabug: 16605377]
  - rds remove dev race. (Zheng Li) [Orabug: 16605377]
  - reinit ip_config when service rdma restart. (Zheng Li) [Orabug: 16605377]
  - while removing a non-empty directory, the kernel dumps a message:
    (rmdir,21743,1):ocfs2_unlink:953 ERROR: status = -39 (Xiaowei.Hu) [Orabug:
    16790405]
  - stop mig handler when lockres in progress ,and return -EAGAIN (Xiaowei.Hu)
    [Orabug: 16876446]
  - Revert "dlmglue race condition,wrong lockres_clear_pending" (Maxim Uvarov)
    [Orabug: 16897450]
  - Suppress the error message from being printed in ocfs2_rename (Xiaowei.Hu)
    [Orabug: 16790405]
  - fnic: return zero on fnic_reset() success (Joe Jin) [Orabug: 16885029]
  - Revert "x86, mm: Revert back good_end setting for 64bit" (Maxim Uvarov)
  - ocfs2_prep_new_orphaned_file return ret (Xiaowei.Hu) [Orabug: 16823825]
  - x86, mm: Revert back good_end setting for 64bit (Maxim Uvarov)
  - oprofile, x86: Reimplement nmi timer mode using perf event (Robert Richter)
    [Orabug: 15924015]
  - Revert "Btrfs: remove ->dirty_inode" (Guangyu Sun) [Orabug: 16841843]
  - bonding: emit event when bonding changes MAC (Weiping Pan) [Orabug: 16750157]
  - net: fix incorrect credentials passing (Linus Torvalds) [Orabug: 16836975]
    {CVE-2013-1979}
  - tg3: fix length overflow in VPD firmware parsing (Kees Cook) [Orabug:
    16836958] {CVE-2013-1929}
  - USB: cdc-wdm: fix buffer overflow (Oliver Neukum) [Orabug: 16836943]
    {CVE-2013-1860}
  - ext3: Fix format string issues (Lars-Peter Clausen) [Orabug: 16836934]
    {CVE-2013-1848}
  - blk: avoid divide-by-zero with zero discard granularity (Linus Torvalds)
    [Orabug: 16844561]
  - xen/pci: Track PVHVM PIRQs. (Zhenzhong Duan) [Orabug: 16402281]
  - cnic: don't use weak dependencies for ipv6 (Jerry Snitselaar) [Orabug:
    16780307 16207564]
  - Revert "drm/i915: correctly order the ring init sequence" (Guangyu Sun)
    [Orabug: 16486689]
  - x86/boot-image: Don't leak phdrs in
    arch/x86/boot/compressed/misc.c::Parse_elf() (Jesper Juhl) [Orabug: 16833437]
  - spec: add /boot/vmlinuz*.hmac needed for fips mode (John Haxby) [Orabug:
    16807114]
  - [SCSI] isci: add version number (Dan Williams) [Orabug: 16823000]
  - perf: Treat attr.config as u64 in perf_swevent_init() (Tommi Rantala)
    [Orabug: 16808734] {CVE-2013-2094}
  - xen-netback: don't disconnect frontend when seeing oversize packet (Wei Liu)
    {XSA-39}
  - xen-netback: coalesce slots in TX path and fix regressions (Wei Liu)  {XSA-39
    XSA-39 XSA-39 XSA-39}
  - xen-netback: fix sparse warning (stephen hemminger)
  - block: add plug for blkdev_issue_discard (Shaohua Li) [Orabug: 16737121]
  - block: discard granularity might not be power of 2 (Shaohua Li) [Orabug:
    16737121]
  - block: split discard into aligned requests (Paolo Bonzini) [Orabug: 16737121]
  - block: reorganize rounding of max_discard_sectors (Paolo Bonzini) [Orabug:
    16737121]
  - block: Consolidate command flag and queue limit checks for merges (Martin K.
    Petersen) [Orabug: 16737121]
  - block: Clean up special command handling logic (Martin K. Petersen) [Orabug:
    16737121]
  - block: separate out blk_rq_merge_ok() and blk_try_merge() from elevator
    functions (Tejun Heo) [Orabug: 16737121]
  - spec: ol6 add multipath version deps (Maxim Uvarov) [Orabug: 16763586]
  - xen-netback: remove skb in xen_netbk_alloc_page (Wei Liu)
  - xen-netback: correctly return errors from netbk_count_requests() (David
    Vrabel)
  - xen-netback: allow changing the MAC address of the interface (Matt Wilson)
  - xen/netback: only non-freed SKB is queued into tx_queue (Annie Li)
  - xen: resolve section mismatch warnings in xen-acpi-processor (Ben Guthro)
  - xen: Re-upload processor PM data to hypervisor after S3 resume (v2) (Ben
    Guthro)
  - xen/spinlock: Fix check from greater than to be also be greater or equal to.
    (Konrad Rzeszutek Wilk)
  - xen/smp/pvhvm: Don't point per_cpu(xen_vpcu, 33 and larger) to shared_info
    (Konrad Rzeszutek Wilk)
  - xen/vcpu: Document the xen_vcpu_info and xen_vcpu (Konrad Rzeszutek Wilk)
  - xen/vcpu/pvhvm: Fix vcpu hotplugging hanging. (Konrad Rzeszutek Wilk)
  - xen/smp: Unifiy some of the PVs and PVHVM offline CPU path (Konrad Rzeszutek
    Wilk)
  - xen/smp/pvhvm: Don't initialize IRQ_WORKER as we are using the native one.
    (Konrad Rzeszutek Wilk)
  - xen/spinlock: Disable IRQ spinlock (PV) allocation on PVHVM (Konrad Rzeszutek
    Wilk)
  - xen/spinlock:  Check against default value of -1 for IRQ line. (Konrad
    Rzeszutek Wilk)
  - xen/time: Add default value of -1 for IRQ and check for that. (Konrad
    Rzeszutek Wilk)
  - xen/events: Check that IRQ value passed in is valid. (Konrad Rzeszutek Wilk)
  - xen/time: Fix kasprintf splat when allocating timer%d IRQ line. (Konrad
    Rzeszutek Wilk)
  - xen/smp/spinlock: Fix leakage of the spinlock interrupt line for every CPU
    online/offline (Konrad Rzeszutek Wilk)
  - xen/smp: Fix leakage of timer interrupt line for every CPU online/offline.
    (Konrad Rzeszutek Wilk)
  - xen: drop tracking of IRQ vector (Jan Beulich)
  - xen kconfig: fix select INPUT_XEN_KBDDEV_FRONTEND (Andrew Jones)
  - xen: drop tracking of IRQ vector (Jan Beulich)
  - x86/xen: populate boot_params with EDD data (David Vrabel)
  - pci/hotplug: keep compatible with other OSes and suppress AER Back port
    commit 7f822999e12a144e68c915194267108f8051cf9b and 2debd9289997fc5d1c0043b41
    201a8b40d5e11d0,bffe4f72fcdd92bfb24909d586d1636e5cec500d by Yinghai from
    upstream to keep compatible with other OSes while doing PCIe hotplug
    function. not only used to suppress AER. (ethan.zhao) [Orabug: 16458024]


author: Guangyu Sun <guangyu.sun@oracle.com> [2.6.39-400.202.0.el6uek]
changelog:
  - l2tp: Fix sendmsg() return value (Guillaume Nault)   
  - l2tp: Fix PPP header erasure and memory leak (Guillaume Nault) [Orabug: 17030957]  
  - packet: packet_getname_spkt: make sure string is always 0-terminated (Daniel Borkmann) [Orabug: 17030956]  
  - net: sctp: fix NULL pointer dereference in socket destruction (Daniel Borkmann) [Orabug: 17030954]  
  - ip_tunnel: fix kernel panic with icmp_dest_unreach (Eric Dumazet) [Orabug: 17030953]  
  - netlabel: improve domain mapping validation (Paul Moore) [Orabug: 17030951]  
  - ipv6: fix possible crashes in ip6_cork_release() (Eric Dumazet) [Orabug: 17030950]  
  - tcp: fix tcp_md5_hash_skb_data() (Eric Dumazet) [Orabug: 17030948]  
  - fmr: D-NFS/RDM (FMR) patches for OFED (abhishek varshney) [Orabug: 16966484]  
  - lpfc: Update lpfc version for 8.3.7.10.7p driver release (James Smart) [Orabug: 17026768]  
  - lpfc: Fix starting reference tag when calculating BG error (James Smart) [Orabug: 17026768]  
  - lpfc: Fix BlockGuard error checking (James Smart) [Orabug: 17026768]  
  - tg3: update from broadcom version 3.129d to 3.131d (Jerry Snitselaar) [Orabug: 17024939]  
  - mm/THP: use pmd_populate() to update the pmd with pgtable_t pointer (Aneesh Kumar K.V) [Orabug: 17025306]  
  - mac80211: close AP_VLAN interfaces before unregistering all (Johannes Berg) [Orabug: 17025303]  
  - batman-adv: Only write requested number of byte to user buffer (Sven Eckelmann) [Orabug: 17025019]  
  - x25: Validate incoming call user data lengths (Matthew Daley) [Orabug: 17025021]  
  - aoe: reserve enough headroom on skbs (Eric Dumazet) [Orabug: 17025018]  
  - perf,x86: fix kernel crash with PEBS/BTS after suspend/resume (Stephane Eranian) [Orabug: 17024915]  
  - dcbnl: fix various netlink info leaks (Mathias Krause) [Orabug: 17024912] {CVE-2013-2634} 
  - e1000e driver update from 2.3.2 to 2.4.14 (Maxim Uvarov) Merge Intel drivers update.

  Signed-off-by: Maxim Uvarov <maxim.uvarov@oracle.com>  
  - ixgbe driver update from 3.14.5 to 3.15.1 (Maxim Uvarov) Merge Intel drivers update.

  Signed-off-by: Maxim Uvarov <maxim.uvarov@oracle.com>  
  - igbvf driver update from 2.0.4 to 2.3.2 (Maxim Uvarov) Merge Intel drivers update.

  Signed-off-by: Maxim Uvarov <maxim.uvarov@oracle.com>  
  - igb driver update from 4.1.2 to 4.3.0 (Maxim Uvarov) Merge Intel drivers update.

  Signed-off-by: Maxim Uvarov <maxim.uvarov@oracle.com>  
  - spec: change version to 400.200.0 for ol5 (Maxim Uvarov)   
  - RDS: restore two-sided reconnect with the lower IP node having a constant 100 ms backoff. (Bang Nguyen) [Orabug: 16710287]  
  - scsi_prep_fn() check for empty queue (Maxim Uvarov) [Orabug: 17015328]  
  - x86: Fix typo in kexec register clearing (Kees Cook) [Orabug: 16992876]  
  - mm: migration: add migrate_entry_wait_huge() (Naoya Horiguchi) [Orabug: 16992874]  
  - swap: avoid read_swap_cache_async() race to deadlock while waiting on discard I/O completion (Rafael Aquini) [Orabug: 16992871]  
  - b43: stop format string leaking into error msgs (Kees Cook) [Orabug: 16992869] {CVE-2013-2852} 
  - nohz: Fix update_ts_time_stat idle accounting (Michal Hocko) [Orabug: 16985182]  
  - tracing: Fix possible NULL pointer dereferences (Namhyung Kim) [Orabug: 16963984]  
  - drm: fix a use-after-free when GPU acceleration disabled (Huacai Chen) [Orabug: 16963983]  
  - cifs: fix potential buffer overrun when composing a new options string (Jeff Layton) [Orabug: 16963818]  
  - drivers/block/brd.c: fix brd_lookup_page() race (Brian Behlendorf) [Orabug: 16963816]  
  - mm: mmu_notifier: re-fix freed page still mapped in secondary MMU (Xiao Guangrong) [Orabug: 16963814]  
  - klist: del waiter from klist_remove_waiters before wakeup waitting process (wang, biao) [Orabug: 16963813]  
  - ocfs2: goto out_unlock if ocfs2_get_clusters_nocache() failed in ocfs2_fiemap() (Joseph Qi) [Orabug: 16963812]  
  - fat: fix possible overflow for fat_clusters (OGAWA Hirofumi) [Orabug: 16963811]  
  - cifs: only set ops for inodes in I_NEW state (Jeff Layton) [Orabug: 16963810]  
  - usermodehelper: check subprocess_info->path != NULL (Oleg Nesterov) [Orabug: 16909862]  
  - ipv6: do not clear pinet6 field (Eric Dumazet) [Orabug: 16909856]  
  - macvlan: fix passthru mode race between dev removal and rx path (Jiri Pirko) [Orabug: 16909854]  
  - bridge: fix race with topology change timer (stephen hemminger) [Orabug: 16909638]  
  - tick: Cleanup NOHZ per cpu data on cpu down (Thomas Gleixner) [Orabug: 16909637]  
  - timer: Don't reinitialize the cpu base lock during CPU_UP_PREPARE (Tirupathi Reddy) [Orabug: 16909635]  
  - x86/mm: account for PGDIR_SIZE alignment (Jerry Hoemann) [Orabug: 16903170]  
  - kernel/audit_tree.c: tree will leak memory when failure occurs in audit_trim_trees() (Chen Gang) [Orabug: 16903120]  
  - clockevents: Set dummy handler on CPU_DEAD shutdown (Thomas Gleixner) [Orabug: 16902369]  
  - cgroup: fix an off-by-one bug which may trigger BUG_ON() (Li Zefan) [Orabug: 16902267]  
  - hrtimer: Add expiry time overflow check in hrtimer_interrupt (Prarit Bhargava) [Orabug: 16902194]  
  - hrtimer: Fix ktime_add_ns() overflow on 32bit architectures (David Engraf) [Orabug: 16902186]  
  - fs/fscache/stats.c: fix memory leak (Anurup m) [Orabug: 16901677]  
  - Bluetooth: RFCOMM - Fix missing msg_namelen update in rfcomm_sock_recvmsg() (Mathias Krause) [Orabug: 16888256] {CVE-2013-3225} 
  - Bluetooth: fix possible info leak in bt_sock_recvmsg() (Mathias Krause) [Orabug: 16888251] {CVE-2013-3224} 
  - atm: update msg_namelen in vcc_recvmsg() (Mathias Krause) [Orabug: 16888219] {CVE-2013-3222} 
  - net: sctp: sctp_auth_key_put: use kzfree instead of kfree (Daniel Borkmann) [Orabug: 16888213]  
  - Btrfs: make sure nbytes are right after log replay (Josef Bacik) [Orabug: 16864338]  
  - Revert "sysfs: fix race between readdir and lseek" (Jiri Kosina) [Orabug: 16858013]  
  - crypto: algif - suppress sending source address information in recvmsg (Mathias Krause) [Orabug: 16864292]  
  - sched: Convert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s (Tejun Heo) [Orabug: 16864274]  
  - kernel/signal.c: stop info leak via the tkill and the tgkill syscalls (Emese Revfy) [Orabug: 16864214]  
  - Revert "8021q: fix a potential use-after-free" (Greg Kroah-Hartman) [Orabug: 16858417]  
  - hrtimer: Don't reinitialize a cpu_base lock on CPU_UP (Michael Bohan) [Orabug: 16864124]  
  - PM / reboot: call syscore_shutdown() after disable_nonboot_cpus() (Huacai Chen) [Orabug: 16863936]  
  - tracing: Fix double free when function profile init failed (Namhyung Kim) [Orabug: 16863887]  
  - mm: prevent mmap_cache race in find_vma() (Jan Stancek) [Orabug: 16863788]  
  - block: avoid using uninitialized value in from queue_var_store (Arnd Bergmann) [Orabug: 16863776]  
  - bonding: get netdev_rx_handler_unregister out of locks (Veaceslav Falico) [Orabug: 16863608]  
  - net: add a synchronize_net() in netdev_rx_handler_unregister() (Eric Dumazet) [Orabug: 16863608]  
  - 8021q: fix a potential use-after-free (Cong Wang) [Orabug: 16858417]  
  - efivars: Handle duplicate names from get_next_variable() (Matt Fleming) [Orabug: 16858386]  
  - efivars: explicitly calculate length of VariableName (Matt Fleming) [Orabug: 16858386]  
  - loop: prevent bdev freeing while device in use (Anatol Pomozov) [Orabug: 16858270]  
  - Btrfs: limit the global reserve to 512mb (Josef Bacik) [Orabug: 16858090]  
  - sysfs: handle failure path correctly for readdir() (Ming Lei) [Orabug: 16858013]  
  - sysfs: fix race between readdir and lseek (Ming Lei) [Orabug: 16858013]  
  - udf: avoid info leak on export (Mathias Krause) [Orabug: 16857424] {CVE-2012-6548} 
  - isofs: avoid info leak on export (Mathias Krause) [Orabug: 16857416] {CVE-2012-6549} 
  - Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and security keys (Mathieu Desnoyers) [Orabug: 16857392]  
  - key: Fix resource leak (Alan Cox) [Orabug: 16857374]  
  - clockevents: Don't allow dummy broadcast timers (Mark Rutland) [Orabug: 16857329]  
  - IPoIB: Fix send lockup due to missed TX completion (Mike Marciniszyn) [Orabug: 16857300]  
  - ext4: fix the wrong number of the allocated blocks in ext4_split_extent() (Zheng Liu) [Orabug: 16857255]  
  - mm/hugetlb: fix total hugetlbfs pages count when using memory overcommit accouting (Wanpeng Li) [Orabug: 16857202]  
  - drm/i915: restrict kernel address leak in debugfs (Kees Cook) [Orabug: 16857108]  
  - rtnl: fix info leak on RTM_GETLINK request for VF devices (Mathias Krause) [Orabug: 16837612] {CVE-2013-2635} 
  - tun: add a missing nf_reset() in tun_net_xmit() (Eric Dumazet) [Orabug: 16837512]  
  - rds: limit the size allocated by rds_message_alloc() (Cong Wang) [Orabug: 16837486]  
  - loopdev: fix a deadlock (Guo Chao) [Orabug: 16837353]  
  - block: use i_size_write() in bd_set_size() (Guo Chao) [Orabug: 16837353]  
  - selinux: use GFP_ATOMIC under spin_lock (Dan Carpenter) [Orabug: 16837318]  
  - md: protect against crash upon fsync on ro array (Sebastian Riemer) [Orabug: 16837271]  
  - signal: always clear sa_restorer on execve (Kees Cook) [Orabug: 16837208] {CVE-2013-0914} 
  - virtio: rng: disallow multiple device registrations, fixes crashes (Amit Shah) [Orabug: 16836152]


