[El-errata] ELSA-2020-4286 Important: Oracle Linux 8 kernel security and bug fix update

[Errata Announcements for Oracle Linux]

Oracle Linux Security Advisory ELSA-2020-4286

http://linux.oracle.com/errata/ELSA-2020-4286.html

The following updated rpms for Oracle Linux 8 have been uploaded to the 
Unbreakable Linux Network:

x86_64:
bpftool-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-abi-whitelists-4.18.0-193.28.1.el8_2.noarch.rpm
kernel-core-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-cross-headers-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-debug-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-debug-core-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-debug-devel-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-debug-modules-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-debug-modules-extra-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-devel-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-doc-4.18.0-193.28.1.el8_2.noarch.rpm
kernel-headers-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-modules-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-modules-extra-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-tools-4.18.0-193.28.1.el8_2.x86_64.rpm
kernel-tools-libs-4.18.0-193.28.1.el8_2.x86_64.rpm
perf-4.18.0-193.28.1.el8_2.x86_64.rpm
python3-perf-4.18.0-193.28.1.el8_2.x86_64.rpm

aarch64:
bpftool-4.18.0-193.28.1.el8_2.aarch64.rpm
kernel-cross-headers-4.18.0-193.28.1.el8_2.aarch64.rpm
kernel-headers-4.18.0-193.28.1.el8_2.aarch64.rpm
kernel-tools-4.18.0-193.28.1.el8_2.aarch64.rpm
kernel-tools-libs-4.18.0-193.28.1.el8_2.aarch64.rpm
perf-4.18.0-193.28.1.el8_2.aarch64.rpm
python3-perf-4.18.0-193.28.1.el8_2.aarch64.rpm


SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/kernel-4.18.0-193.28.1.el8_2.src.rpm



Description of changes:

[4.18.0-193.28.1.el8_2.OL8]
- Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted 
keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15-2.0.3.el7

[4.18.0-193.28.1.el8_2]
- [net] Bluetooth: L2CAP: Fix calling sk_filter on non-socket based 
channel (Gopal Tiwari) [1888256 1888258] {CVE-2020-12351}
- [net] Bluetooth: A2MP: Fix not initializing all members (Gopal Tiwari) 
[1888906 1888807] {CVE-2020-12352}

[4.18.0-193.27.1.el8_2]
- [powerpc] powerpc/pseries: Do not initiate shutdown when system is 
running on UPS (Diego Domingos) [1882243 1870477]
- [video] vgacon: Fix for missing check in scrollback handling (Lyude 
Paul) [1859471 1859472] {CVE-2020-14331}

[4.18.0-193.26.1.el8_2]
- [firmware] efi: don't reserve MOK config table memory region (Kairui 
Song) [1879988 1878584]
- [security] integrity: Load certs from the EFI MOK config table (Lenny 
Szubowicz) [1877528 1868306]
- [security] integrity: Move import of MokListRT certs to a separate 
routine (Lenny Szubowicz) [1877528 1868306]
- [firmware] efi: Support for MOK variable config table (Lenny 
Szubowicz) [1877528 1868306]
- [security] efi: Only print errors about failing to get certs if EFI 
vars are found (Lenny Szubowicz) [1877528 1804969]
- [fs] ceph: fix inode number handling on arches with 32-bit ino_t (Jeff 
Layton) [1875787 1866018]
- [fs] ceph: handle zero-length feature mask in session messages (Jeff 
Layton) [1875787 1866018]
- [fs] ceph: fix endianness bug when handling MDS session feature bits 
(Jeff Layton) [1875787 1866018]
- [netdrv] net/mlx5e: Fix missing cleanup of ethtool steering during rep 
rx cleanup (Alaa Hleihel) [1857777 1856660]

[4.18.0-193.25.1.el8_2]
- [net] netfilter: conntrack: proc: rename stat column (Florian 
Westphal) [1882095 1875681]
- [net] netfilter: conntrack: add clash resolution stat counter (Florian 
Westphal) [1882095 1875681]
- [net] netfilter: conntrack: remove ignore stats (Florian Westphal) 
[1882095 1875681]
- [net] netfilter: conntrack: do not increment two error counters at 
same time (Florian Westphal) [1882095 1875681]
- [net] netfilter: conntrack: do not auto-delete clash entries on reply 
(Florian Westphal) [1882095 1875681]
- [fs] xfs: fix boundary test in xfs_attr_shortform_verify (Eric 
Sandeen) [1881085 1875316] {CVE-2020-14385}
- [kernel] time/tick-broadcast: Fix tick_broadcast_offline() lockdep 
complaint (Alexey Klimov) [1880081 1877380]
- [net] atomics/treewide: Rename __atomic_add_unless() => 
atomic_fetch_add_unless() (Yauheni Kaliuta) [1880081 1813370]
- [kernel] timers: Lower base clock forwarding threshold (Phil Auld) 
[1877417 1833096]

[4.18.0-193.24.1.el8_2]
- [kernel] timers: Remove must_forward_clk (Phil Auld) [1877417 1833096]
- [kernel] timers: Spare timer softirq until next expiry (Phil Auld) 
[1877417 1833096]
- [kernel] timers: Expand clk forward logic beyond nohz (Phil Auld) 
[1877417 1833096]
- [kernel] timers: Reuse next expiry cache after nohz exit (Phil Auld) 
[1877417 1833096]
- [kernel] timers: Always keep track of next expiry (Phil Auld) [1877417 
1833096]
- [kernel] timers: Optimize _next_timer_interrupt() level iteration 
(Phil Auld) [1877417 1833096]
- [kernel] timers: Add comments about calc_index() ceiling work (Phil 
Auld) [1877417 1833096]
- [kernel] timers: Move trigger_dyntick_cpu() to enqueue_timer() (Phil 
Auld) [1877417 1833096]
- [kernel] timers: Use only bucket expiry for base->next_expiry value 
(Phil Auld) [1877417 1833096]
- [kernel] timers: Preserve higher bits of expiration on index 
calculation (Phil Auld) [1877417 1833096]
- [kernel] timer: Fix wheel index calculation on last level (Phil Auld) 
[1877417 1833096]
- [kernel] timer: Prevent base->clk from moving backward (Phil Auld) 
[1877417 1833096]
- [kernel] timer: Read jiffies once when forwarding base clk (Phil Auld) 
[1877417 1833096]
- [infiniband] RDMA/umem: Fix ib_umem_find_best_pgsz() (Kamal Heib) 
[1872424 1856158]
- [net] net: accept an empty mask in 
/sys/class/net/*/queues/rx-*/rps_cpus (Nitesh Narayan Lal) [1870181 1868433]
- [net] net: Restrict receive packets queuing to housekeeping CPUs 
(Nitesh Narayan Lal) [1867174 1844520]
- [pci] PCI: Restrict probe functions to housekeeping CPUs (Nitesh 
Narayan Lal) [1867174 1844520]
- [lib] lib: Restrict cpumask_local_spread to houskeeping CPUs (Nitesh 
Narayan Lal) [1867174 1844520]
- [s390] s390/pci: Fix unexpected write combine on resource (Philipp 
Rudo) [1869276 1827311]

[4.18.0-193.23.1.el8_2]
- [net] packet: fix overflow in tpacket_rcv (Hangbin Liu) [1876223 
1876224] {CVE-2020-14386}
- [net] packet: make tp_drops atomic (Hangbin Liu) [1876223 1876224] 
{CVE-2020-14386}

[4.18.0-193.22.1.el8_2]
- [crypto] pefile: Support multiple signatures in 
verify_pefile_signature (Lenny Szubowicz) [1877530 1862072]
- [crypto] Revert "pefile: Tolerate other pefile signatures after first" 
(Bruno Meneguele)
- [infiniband] IB/hfi1: Fix another case where pq is left on waitlist 
(Kamal Heib) [1872766 1859209]
- [infiniband] IB/hfi1: Ensure pq is not left on waitlist (Kamal Heib) 
[1872766 1859209]

[4.18.0-193.21.1.el8_2]
- [scsi] scsi: ibmvfc: Fix NULL return compiler warning (Steve Best) 
[1866371 1810653]
- [scsi] scsi: ibmvfc: Avoid loss of all paths during SVC node reboot 
(Steve Best) [1866371 1810653]

[4.18.0-193.20.1.el8_2]
- [infiniband] IB/rdmavt: Fix RQ counting issues causing use of an 
invalid RWQE (Kamal Heib) [1872771 1850314]
- [block] blk-mq: Rerun dispatching in the case of budget contention 
(Ming Lei) [1869779 1824037]
- [block] blk-mq: Add blk_mq_delay_run_hw_queues() API call (Ming Lei) 
[1869779 1824037]
- [block] blk-mq: In blk_mq_dispatch_rq_list() "no budget" is a reason 
to kick (Ming Lei) [1869779 1824037]
- [block] blk-mq: Put driver tag in blk_mq_dispatch_rq_list() when no 
budget (Ming Lei) [1869779 1824037]
- [md] dm mpath: use double checked locking in fast path (Mike Snitzer) 
[1869386 1848651]
- [md] dm mpath: rename current_pgpath to pgpath in 
multipath_prepare_ioctl (Mike Snitzer) [1869386 1848651]
- [md] dm mpath: rework __map_bio() (Mike Snitzer) [1869386 1848651]
- [md] dm mpath: factor out multipath_queue_bio (Mike Snitzer) [1869386 
1848651]
- [md] dm mpath: push locking down to must_push_back_rq() (Mike Snitzer) 
[1869386 1848651]
- [md] dm mpath: take m->lock spinlock when testing QUEUE_IF_NO_PATH 
(Mike Snitzer) [1869386 1848651]
- [md] dm mpath: changes from initial m->flags locking audit (Mike 
Snitzer) [1869386 1848651]
- [md] dm rq: don't call blk_mq_queue_stopped() in dm_stop_queue() (Mike 
Snitzer) [1869386 1848651]
- [md] dm: do not use waitqueue for request-based DM (Mike Snitzer) 
[1869386 1848651]
- [block] blk-mq: consider non-idle request as "inflight" in 
blk_mq_rq_inflight() (Mike Snitzer) [1869386 1848651]
- [kernel] sched/deadline: Initialize ->dl_boosted (Phil Auld) [1867612 
1854179]
- [kernel] sched/core: Fix PI boosting between RT and DEADLINE tasks 
(Phil Auld) [1867612 1854179]
- [net] net/smc: tolerate future SMCD versions (Philipp Rudo) [1866390 
1854992]
- [net] openvswitch: fixes potential deadlock in dp cleanup code (Eelco 
Chaudron) [1859216 1845662]
- [net] openvswitch: reorder masks array based on usage (Eelco Chaudron) 
[1859216 1845662]
- [net] openvswitch: take into account de-fragmentation/gso_size in 
execute_check_pkt_len (Lorenzo Bianconi) [1860169 1851888]