Oracle Linux 5 / 6 : Unbreakable Enterprise Kernel (ELSA-2013-2546)

This script is Copyright (C) 2013-2014 Tenable Network Security, Inc.


Synopsis :

The remote Oracle Linux host is missing one or more security updates.

Description :

Description of changes:

[2.6.39-400.209.1]
- Revert 'stop mig handler when lockres in progress ,and return -EAGAIN'
(Srinivas Eeda) [Orabug: 16924802]
- ocfs2/dlm: Fix list traversal in dlm_process_recovery_data (Srinivas
Eeda) [Orabug: 17432400]
- ocfs2/dlm: ocfs2 dlm umount skip migrating lockres (Srinivas Eeda)
[Orabug: 16859627]

[2.6.39-400.208.1]
- Btrfs: make the chunk allocator completely tree lockless (Josef Bacik)
[Orabug: 17334251]
- mpt2sas: protect mpt2sas_ioc_list access with lock (Jerry Snitselaar)
[Orabug: 17383579]
- mptsas: update to 4.28.20.02 (Jerry Snitselaar) [Orabug: 17294806]
- RDS: protocol negotiation fails during reconnect (Bang Nguyen)
[Orabug: 17375389]
- config:remove LM80 modules to void blindly loading cause crash
(ethan.zhao) [Orabug: 16976462]

[2.6.39-400.207.0]
- Update lpfc version for 8.3.7.26.3p driver release (Gairy Grannum)
[Orabug: 17340816]
- lpfc 8.3.36: Update DIF support for passthru/strip/insert (James
Smart) [Orabug: 17340816]
- Update lpfc version for 8.3.7.26.1p driver release (Gairy Grannum)
[Orabug: 17376967]
- lpfc: whitespace fix (Vaios Papadimitriou) [Orabug: 17376967]
- Update copyrights for 8.3.41 modifications (James Smart) [Orabug:
17376967]
- Add first burst support to driver (James Smart) [Orabug: 17376967]
- Fixed the format of some log message fields (James Smart) [Orabug:
17376967]
- Add first burst support to driver (James Smart) [Orabug: 17376967]
- Fixed not able to perform PCI function reset when board was not in
online mode (James Smart) [Orabug: 17376967]
- Fixed failure in setting SLI3 board mode (James Smart) [Orabug: 17376967]
- Fixed SLI3 failing FCP write on check-condition no-sense with residual
zero (James Smart) [Orabug: 17376967]
- Fixed support for 128 byte WQEs (James Smart) [Orabug: 17376967]
- Ensure driver properly zeros unused fields in SLI4 mailbox commands
(James Smart) [Orabug: 17376967]
- Fixed max value of lpfc_lun_queue_depth (James Smart) [Orabug: 17376967]
- Fixed Receive Queue varied frame size handling (James Smart) [Orabug:
17376967]
- Fix mailbox byteswap issue on PPC (James Smart) [Orabug: 17376967]
- lpfc 8.3.40: Update Copyrights to 2013 for 8.3.38, 8.3.39, and 8.3.40
modifications (James Smart) [Orabug: 17376967]
- Fixed freeing of iocb when internal loopback times out (James Smart)
[Orabug: 17376967]
- lpfc 8.3.40: Fixed a race condition between SLI host and port failed
FCF rediscovery (James Smart) [Orabug: 17376967]
- lpfc 8.3.40: Fixed issue mailbox wait routine failed to issue dump
memory mbox command (James Smart) [Orabug: 17376967]
- treewide: Fix typos in kernel messages (Masanari Iida) [Orabug: 17376967]
- lpfc 8.3.40: Fixed system panic due to unsafe walking and deleting
linked list (James Smart) [Orabug: 17376967]
- lpfc 8.3.40: Fixed FCoE connection list vlan identifier and add FCF
list debug (James Smart) [Orabug: 17376967]
- lpfc 8.3.40: Clarified the behavior of the lpfc_max_luns module
parameter (James Smart) [Orabug: 17376967]
- lpfc 8.3.40: Fix to allow OCM to report FEC status (James Smart)
[Orabug: 17376967]
- lpfc 8.3.40: Fixed a missing return code in a logging message (James
Smart) [Orabug: 17376967]
- lpfc 8.3.40: Fixed some logging message fields (James Smart) [Orabug:
17376967]
- lpfc 8.3.40: Fixed list corruption when lpfc_drain_tx runs (James
Smart) [Orabug: 17376967]
- lpfc 8.3.40: Fix inconsistent list removal causes crash (James Smart)
[Orabug: 17376967]
- lpfc 8.3.40: Fixed system panic during handling unsolicited receive
buffer error condition (James Smart) [Orabug: 17376967]
- lpfc 8.3.40: Fixed crash during FCoE failover testing. (James Smart)
[Orabug: 17376967]
- lpfc 8.3.40: Fix lpfc_used_cpu to be more dynamic (James Smart)
[Orabug: 17376967]
- sctp: deal with multiple COOKIE_ECHO chunks (Max Matveev) [Orabug:
17371930] {CVE-2013-2206}
- Bluetooth: L2CAP - Fix info leak via getsockname() (Mathias Krause)
[Orabug: 17371037] {CVE-2012-6544}
- Bluetooth: HCI - Fix info leak via getsockname() (Mathias Krause)
[Orabug: 17370887] {CVE-2012-6544}
- Bluetooth: HCI - Fix info leak in getsockopt(HCI_FILTER) (Mathias
Krause) [Orabug: 17371061] {CVE-2012-6544}
- sctp: Use correct sideffect command in duplicate cookie handling (Vlad
Yasevich) [Orabug: 17371114] {CVE-2013-2206}
- af_key: initialize satype in key_notify_policy_flush() (Nicolas
Dichtel) [Orabug: 17370761] {CVE-2013-2237}
- dm: allow error target to replace either bio-based and request-based
targets (Joe Jin) [Orabug: 17357884]
- Btrfs: handle a bogus chunk tree nicely (Josef Bacik) [Orabug: 17361069]
- OFED: Move R2 field to bottom of mlx4_caps for backward compatibility
(Yuval Shaia) [Orabug: 17303785]
- RDS: double free rdma_cm_id (Bang Nguyen) [Orabug: 17192816]
- xen: initialize xen panic handler for PVHVM (Vaughan Cao) [Orabug:
17200031]
- sg: push file descriptor list locking down to per-device locking
(Vaughan Cao) [Orabug: 16835013]
- sg: checking sdp->detached isnt protected when open (Vaughan Cao)
[Orabug: 16835013]
- sg: no need sg_open_exclusive_lock (Vaughan Cao) [Orabug: 16835013]
- sg: use rwsem to solve race during exclusive open (Vaughan Cao)
[Orabug: 16835013]
- sg: remove sg_mutex (J&ouml
rn Engel) [Orabug: 16835013]
- sg: completely protect sfds (J&ouml
rn Engel) [Orabug: 16835013]
- sg: protect sdp->exclude (J&ouml
rn Engel) [Orabug: 16835013]
- sg: prevent unwoken sleep (J&ouml
rn Engel) [Orabug: 16835013]
- sg: remove closed flag (J&ouml
rn Engel) [Orabug: 16835013]
- sg: use wait_event_interruptible() (J&ouml
rn Engel) [Orabug: 16835013]
- sg: remove while (1) non-loop (J&ouml
rn Engel) [Orabug: 16835013]
- sg: remove unnecessary indentation (J&ouml
rn Engel) [Orabug: 16835013]
- RDS: ActiveBonding IP exclusion filter (Bang Nguyen) [Orabug: 17075950]
- RDS: Reconnect stalls for 15s (Bang Nguyen) [Orabug: 17277974]
- sk_buff: fix kabi broken for add new for union (Joe Jin) [Orabug:
14500568]
- tcp: fix skb_availroom() (Eric Dumazet) [Orabug: 14500568]
- tcp: avoid order-1 allocations on wifi and tx path (Eric Dumazet)
[Orabug: 14500568]
- tcp: Reallocate headroom if it would overflow csum_start (Thomas Graf)
[Orabug: 14500568]
- tcp: take care of misalignments (Eric Dumazet) [Orabug: 14500568]
- RDS: Reconnect causes panic at completion phase (Bang Nguyen) [Orabug:
17213597]
- RDS: added stats to track and display receive side memory usage
(Venkat Venkatsubra) [Orabug: 17045536]
- RDS: RDS reconnect stalls (Bang Nguyen) [Orabug: 1731355]
- ext4: fix race between sync and completed io work (Jeff Moyer)
[Orabug: 16908825]
- ext4: optimize locking for end_io extent conversion (Theodore Tso)
[Orabug: 16908825]
- ext4: remove unnecessary call to waitqueue_active() (Theodore Tso)
[Orabug: 16908825]
- ext4: Use correct locking for ext4_end_io_nolock() (Tao Ma) [Orabug:
16908825]
- xen/pci: Track PVHVM PIRQs. (Zhenzhong Duan) [Orabug: 16908825]
- ocfs2_prep_new_orphaned_file return ret (Xiaowei.Hu) [Orabug: 16823825]
- Revert 'Btrfs: remove ->dirty_inode' (Guangyu Sun) [Orabug: 16841843]
- bonding: emit event when bonding changes MAC (Weiping Pan) [Orabug:
16750157]
- net: fix incorrect credentials passing (Linus Torvalds) [Orabug:
16836975] {CVE-2013-1979}
- tg3: fix length overflow in VPD firmware parsing (Kees Cook) [Orabug:
16836958] {CVE-2013-1929}
- USB: cdc-wdm: fix buffer overflow (Oliver Neukum) [Orabug: 16836943]
{CVE-2013-1860}
- ext3: Fix format string issues (Lars-Peter Clausen) [Orabug: 16836934]
{CVE-2013-1848}
- cnic: dont use weak dependencies for ipv6 (Jerry Snitselaar) [Orabug:
16780307]
- Revert 'drm/i915: correctly order the ring init sequence' (Guangyu
Sun) [Orabug: 16486689]
- x86/boot-image: Dont leak phdrs in
arch/x86/boot/compressed/misc.c::Parse_elf() (Jesper Juhl) [Orabug:
16833437]
- spec: add /boot/vmlinuz*.hmac needed for fips mode (John Haxby)
[Orabug: 16807114]
- perf: Treat attr.config as u64 in perf_swevent_init() (Tommi Rantala)
[Orabug: 16808734] {CVE-2013-2094}
- spec: ol6 add multipath version deps (Maxim Uvarov) [Orabug: 16763586]

[2.6.39-400.206.0]
- ipv6: ip6_append_data_mtu did not care about pmtudisc and frag_size
(Hannes Frederic Sowa) [Orabug: 17296421] {CVE-2013-4163}
- fib_trie: potential out of bounds access in trie_show_stats() (Jerry
Snitselaar) [Orabug: 16840280]
- aacraid: update from 1.1-7 to 1.2-0 (Jerry Snitselaar) [Orabug: 17296044]
- qlcnic: update from 5.2.29.45 to 5.2.43 (Jerry Snitselaar) [Orabug:
17267102]
- net: init perm_addr in register_netdevice() (Jiri Pirko) [Orabug:
17280581]
- config: disable THP for OL6 builds (Jerry Snitselaar) [Orabug: 17279055]
- ACPI / memhotplug: Fix a stale pointer in error path (Toshi Kani)
[Orabug: 17271787]
- xhci: Avoid NULL pointer deref when host dies. (Sarah Sharp) [Orabug:
17271780]
- xhci: fix null pointer dereference on ring_doorbell_for_active_rings
(Oleksij Rempel) [Orabug: 17271777]
- SCSI: sd: fix crash when UA received on DIF enabled device (Ewan D.
Milne) [Orabug: 17271761]
- hrtimers: Move SMP function call to thread context (Thomas Gleixner)
[Orabug: 17237808]
- lockd: protect nlm_blocked access in nlmsvc_retry_blocked (David
Jeffery) [Orabug: 17237800]
- SCSI: megaraid_sas: fix memory leak if SGL has zero length entries
(Bj&oslash
rn Mork) [Orabug: 17237796]
- vlan: fix a race in egress prio management (Eric Dumazet) [Orabug:
17237794]
- ifb: fix oops when loading the ifb failed (dingtianhong) [Orabug:
17237783]
- dummy: fix oops when loading the dummy failed (dingtianhong) [Orabug:
17237779]
- ifb: fix rcu_sched self-detected stalls (dingtianhong) [Orabug: 17237770]
- ipv6: call udp_push_pending_frames when uncorking a socket with
AF_INET pending data (Hannes Frederic Sowa) [Orabug: 17237766]
- ipv6,mcast: always hold idev->lock before mca_lock (Amerigo Wang)
[Orabug: 17237756]
- af_key: fix info leaks in notify messages (Mathias Krause) [Orabug:
17237752] {CVE-2013-2234}
- perf: Fix perf_lock_task_context() vs RCU (Peter Zijlstra) [Orabug:
17237744]
- perf: Remove WARN_ON_ONCE() check in __perf_event_enable() for valid
scenario (Jiri Olsa) [Orabug: 17237744]
- perf: Clone child context from parent context pmu (Jiri Olsa) [Orabug:
17237744]
- tracing: Use current_uid() for critical time tracing (Steven Rostedt
(Red Hat)) [Orabug: 17237735]
- ext4: fix overflow when counting used blocks on 32-bit architectures
(Jan Kara) [Orabug: 17231269]
- ext4: fix data offset overflow in ext4_xattr_fiemap() on 32-bit archs
(Jan Kara) [Orabug: 17231264]
- xhci: check for failed dma pool allocation (Mathias Nyman) [Orabug:
17231247]
- crypto: sanitize argument for format string (Kees Cook)
- drivers/cdrom/cdrom.c: use kzalloc() for failing hardware (Jonathan
Salwan) [Orabug: 17230700] {CVE-2013-2164}
- pch_uart: fix a deadlock when pch_uart as console (Liang Li) [Orabug:
17061700]
- UBIFS: fix a horrid bug (Artem Bityutskiy) [Orabug: 17061699]
- UBIFS: prepare to fix a horrid bug (Artem Bityutskiy) [Orabug: 17061697]
- dlci: validate the net device in dlci_del() (Zefan Li) [Orabug: 17061696]
- dlci: acquire rtnl_lock before calling __dev_get_by_name() (Zefan Li)
[Orabug: 17061695]
- Bluetooth: Fix crash in l2cap_build_cmd() with small MTU (Anderson
Lizardo) [Orabug: 17061694]
- fnic driver update from 1.5.0.41 to 1.5.0.45 (Maxim Uvarov) [Orabug:
17187644]
- mpt3sas: update from v02.100.00.00 to v3.00.00.00 (Sreekanth Reddy)
[Orabug: 17249188]
- mpt3sas: enable build of mpt3sas driver (Jerry Snitselaar) [Orabug:
17187698]
- mpt3sas: Updated driver code to have a compatibility with UEK r2 u5
kernel (Sreekanth Reddy) [Orabug: 17187698]
- mpt3sas: Bump driver version to v02.100.00.00 (Sreekanth Reddy)
[Orabug: 17187698]
- mpt3sas: when async scanning is enabled then while scanning, devices
are removed but their transport layer entries are not removed
(Sreekanth Reddy) [Orabug: 17187698]
- mpt3sas: MPI2.5 Rev F v2.5.1.1 specification (Sreekanth Reddy)
[Orabug: 17187698]
- mpt3sas: Infinite loops can occur if
MPI2_IOCSTATUS_CONFIG_INVALID_PAGE is not returned (Sreekanth Reddy)
[Orabug: 17187698]
- mpt3sas: fix for kernel panic when driver loads with HBA conected to
non LUN 0 configured expander (Sreekanth Reddy) [Orabug: 1718
7698]
- mpt3sas: Updated the Hardware timing requirements (Sreekanth Reddy)
[Orabug: 17187698]
- mpt3sas: 2013 source code copyright (Sreekanth Reddy) [Orabug: 17187698]
- mpt3sas: dont wank with fasync on ->release() (Al Viro) [Orabug: 17187698]
- mpt3sas: remove unused variables (Wei Yongjun) [Orabug: 17187698]
- mpt3sas: Remove unneeded version.h header inclusion (Sachin Kamat)
[Orabug: 17187698]
- mpt3sas: cut and paste bug storing trigger mpi (Dan Carpenter)
[Orabug: 17187698]
- mpt3sas: add new driver supporting 12GB SAS (Sreekanth Reddy) [Orabug:
17187698]
- scsi_transport_sas: add 12GB definitions for mpt3sas (Sreekanth Reddy)
[Orabug: 17187698]
- miscdevice: Adding support for MPT3SAS_MINOR(222) (Sreekanth Reddy)
[Orabug: 17187698]

[2.6.39-400.205.0]
- xen/time: remove blocked time accounting from xen 'clockchip' (Laszlo
Ersek) [Orabug: 17073675]
- unix: fix a race condition in unix_release() (Paul Moore) [Orabug:
17209195]
- ipv6: ip6_sk_dst_check() must not assume ipv6 dst (Eric Dumazet)
[Orabug: 17215196] {CVE-2013-2232}
- block: do not pass disk names as format strings (Kees Cook) [Orabug:
17230067] {CVE-2013-2851}
- libceph: Fix NULL pointer dereference in auth client code (Tyler
Hicks) [Orabug: 17230100] {CVE-2013-1059}
- config: add xsigo config options (Ajaykumar Hotchandani) [Orabug:
17248170]
- mpt2sas: update from 16.05.01.00 to 17.00.00.00 (Jerry Snitselaar)
[Orabug: 17237402]
- qla4xxx: Updated driver version to 5.03.00.03.06.02-uek2 (Tej Parkash)
[Orabug: 17220575]
- libiscsi: Add missing prints for session and connection sysfs attrs
(Adheer Chandravanshi) [Orabug: 17220575]
- qla4xxx: Export more firmware info in sysfs (Adheer Chandravanshi)
[Orabug: 17220575]
- qla4xxx: Only BIOS boot target entries should be at index 0 and 1.
(Adheer Chandravanshi) [Orabug: 17220575]
- qla4xxx: discovery_parent_idx can be shown without any check. (Adheer
Chandravanshi) [Orabug: 17220575]
- qla4xxx: Set IPv6 traffic class if device type is IPv6. (Adheer
Chandravanshi) [Orabug: 17220575]
- qla4xxx: Use discovery_parent_idx instead of discovery_parent_type
(Adheer Chandravanshi) [Orabug: 17220575]
- qla4xxx: Allow removal of failed session using logout. (Adheer
Chandravanshi) [Orabug: 17220575]
- qla4xxx: Exporting new attrs for iscsi session and connection in sysfs
(Adheer Chandravanshi) [Orabug: 17220575]
- libiscsi: Exporting new attrs for iscsi session and connection in
sysfs (Adheer Chandravanshi) [Orabug: 17220575]
- scsi_transport_iscsi: Exporting new attrs for iscsi session and
connection in sysfs (Adheer Chandravanshi) [Orabug: 17220575]
- libiscsi: Added new boot entries in the session sysfs (Eddie Wai)
[Orabug: 17220575]
- iscsi class, qla4xxx: fix sess/conn refcounting when find fns are used
(Mike Christie) [Orabug: 17220575]
- qla4xxx: Fix iocb_cnt calculation in qla4xxx_send_mbox_iocb() (Vikas
Chaudhary) [Orabug: 17220575]
- scsi_transport_iscsi: fix error return code in iscsi_transport_init()
(Wei Yongjun) [Orabug: 17220575]
- qla4xxx: Assign values using correct datatype (Adheer Chandravanshi)
[Orabug: 17220575]
- qla4xxx: Fix smatch warnings (Adheer Chandravanshi) [Orabug: 17220575]
- qla4xxx: Fix sparse warning for qla4xxx_sysfs_ddb_tgt_create (Vikas
Chaudhary) [Orabug: 17220575]
- RDS: (Bang Nguyen) [Orabug: 17206167]
- neighbour: fix a race in neigh_destroy() (Eric Dumazet) [Orabug: 17230315]
- be2net: Updating version number (Sarveshwar Bandi) [Orabug: 17219620]
- be2net: Fix to avoid hardware workaround when not needed (Sarveshwar
Bandi) [Orabug: 17219620]
- net/trivial: replace numeric with standard PM state macros (Yijing
Wang) [Orabug: 17219620]
- be2net: Fix 32-bit DMA Mask handling (Somnath Kotur) [Orabug: 17219620]
- be2net: Implement initiate FW dump feature for Lancer (Somnath Kotur)
[Orabug: 17219620]
- be2net: Fix crash on 2nd invocation of PCI AER/EEH error_detected hook
(Somnath Kotur) [Orabug: 17219620]
- be2net: Mark checksum fail for IP fragmented packets (Somnath Kotur)
[Orabug: 17219620]
- be2net: Trim padded packets for Lancer (Somnath Kotur) [Orabug: 17219620]
- be2net: Pad skb to meet min Tx pkt size in lancer (Somnath Kotur)
[Orabug: 17219620]
- be2net: cleanup be_get_drvinfo() (Somnath Kotur) [Orabug: 17219620]
- be2net: refactor HW workarounds in be_xmit() (Sathya Perla) [Orabug:
17219620]
- be2net: bug fix on returning an invalid nic descriptor (Wei Yang)
[Orabug: 17219620]
- be2net: Avoid double insertion of vlan tags. (Sarveshwar Bandi)
[Orabug: 17219620]
- be2net: disable TX in be_close() (Sathya Perla) [Orabug: 17219620]
- be2net: fix EQ from getting full while cleaning RX CQ (Sathya Perla)
[Orabug: 17219620]
- be2net: fix payload_len value for GET_MAC_LIST cmd req (Sathya Perla)
[Orabug: 17219620]
- be2net: provision VF resources before enabling SR-IOV (Sathya Perla)
[Orabug: 17219620]
- be2net: Fix to fail probe if MSI-X enable fails for a VF (Somnath
Kotur) [Orabug: 17219620]
- be2net: avoid napi_disable() when it has not been enabled (Somnath
Kotur) [Orabug: 17219620]
- be2net: Fix firmware download for Lancer (Somnath Kotur) [Orabug:
17219620]
- be2net: Fix to receive Multicast Packets when Promiscuous mode is
enabled on certain devices (Ajit Khaparde) [Orabug: 17219620]
- be2net: Fix to show tx priority pause counter in ethtool -S (Ajit
Khaparde) [Orabug: 17219620]
- be2net: Fix to use 32-bit stats to report rx_drops_no_fragment (Ajit
Khaparde) [Orabug: 17219620]
- be2net: Fix to use version 2 of cq_create for SkyHawk-R devices (Ajit
Khaparde) [Orabug: 17219620]
- be2net: FLR must be first cmd issued to Lancer FW (Kalesh AP) [Orabug:
17219620]
- be2net: Use GET_FUNCTION_CONFIG V1 cmd (Kalesh AP) [Orabug: 17219620]
- be2net: Fix to show wol disabled/enabled state correctly. (Sarveshwar
Bandi) [Orabug: 17219620]
- be2net: Fixed memory leak (Suresh Reddy) [Orabug: 17219620]
- be2net: Avoid diagnostic test in certain versions of firmware to avoid
NIC freeze. (Suresh Reddy) [Orabug: 17219620]
- be2net: Renamed rx_address_mismatch_errors to rx_address_filtered
(Suresh Reddy) [Orabug: 17219620]
- be2net: Add support for setting and getting rx flow hash options
(Suresh Reddy) [Orabug: 17219620]
- be2net: Fix PVID tag offload for packets with inline VLAN tag. (Ajit
Khaparde) [Orabug: 17219620]
- be2net: fix a Tx stall bug caused by a specific ipv6 packet (Ajit
Khaparde) [Orabug: 17219620]
- be2net: Remove an incorrect pvid check in Tx (Ajit Khaparde) [Orabug:
17219620]
- be2net: enable IOMMU pass through for be2net (Craig Hada) [Orabug:
17219620]
- be2net: Use GET_PROFILE_CONFIG V1 cmd for BE3-R (Vasundhara Volam)
[Orabug: 17219620]
- be2net: Avoid flashing BE3 UFI on BE3-R chip. (Vasundhara Volam)
[Orabug: 17219620]
- be2net: Dont log 'Out of MCCQ wrbs' error (Vasundhara Volam) [Orabug:
17219620]
- be2net: Use TXQ_CREATE_V2 cmd (Vasundhara Volam) [Orabug: 17219620]
- be2net: take care of __vlan_put_tag return value (Ivan Vecera)
[Orabug: 17219620]
- be2net: remove unused variable 'sge' (Ivan Vecera) [Orabug: 17219620]
- megaraid: update from 6.505 to 6.600.18.00 (Jerry Snitselaar) [Orabug:
17187623]
- xsigo: Kconfig and Makefile updates (Ajaykumar Hotchandani) [Orabug:
17248170]
- xsigo: Integrate 7489 release in UEK2 (Ajaykumar Hotchandani) [Orabug:
17248170]
- fs writeback: fix race in mark inode dirty.patch (Srinivas Eeda)
[Orabug: 17198525]
- sxge: Check link state before xmit (Joe Jin) [Orabug: 17201198]
- writeback: Fix periodic writeback after fs mount (Srinivas Eeda)
[Orabug: 17185874]
- spec: use _target_cpu in suffix for devel dir (Jerry Snitselaar)
[Orabug: 17181059]
- mm: leave hugepage pmd (Guru Anbalagane) [Orabug: 17186750]
- Disable THP config (Guru Anbalagane) [Orabug: 17186750]
- RDS: Fix a bug in QoS protocol negotiation (Bang Nguyen) [Orabug:
17079972]
- RDS: alias failover is not working properly (Bang Nguyen) [Orabug:
17177994]
- rdma_cm: CMA_QUERY_HANDLER: BAD STATUS -110 and -22 (Chien-Hua Yen)
[Orabug: 16708786]
- [RDS] add NETFILTER suppport (Ahmed Abbas) [Orabug: 17082619]

[2.6.39-400.204.0]
- be2net: enable interrupts in probe (Jerry Snitselaar) [Orabug: 17080364]
- xen-netfront: use skb_partial_csum_set() to simplify the codes (Li
RongQing)
- xen-netfront: split event channels support for Xen frontend driver
(Wei Liu)
- xen-netfront: avoid leaking resources when setup_netfront fails (Wei Liu)
- xen-netfront: reduce gso_max_size to account for max TCP header (Wei Liu)
- xen-netfront: frags -> slots in log message (Wei Liu)
- xen-netfront: frags -> slots in xennet_get_responses (Wei Liu)
- xen-netfront: remove unused variable 'extra' (Wei Liu)
- xen/netfront: improve truesize tracking (Ian Campbell)
- xen-netfront: remove __dev* attributes (Bill Pemberton)
- xen/netfront: handle compound page fragments on transmit (Ian Campbell)
- xen-netfront: use __pskb_pull_tail to ensure linear area is big enough
on RX (Ian Campbell)
- ocfs2: xattr: fix inlined xattr reflink (Junxiao Bi) [Orabug: 15914937]
- futex: Revert 'futex: Mark get_robust_list as deprecated' (Thomas
Gleixner) [Orabug: 16818441]
- xen: do not disable netfront in dom0 (Marek Marczykowski)
- xen-netfront: correct MAX_TX_TARGET calculation. (Wei Liu)
- xen-netback: xenbus.c: use more current logging styles (Wei Liu)
- xen: Use more current logging styles (Joe Perches)
- xen-netback: double free on unload (Dan Carpenter)
- xen-netback: dont de-reference vif pointer after having called
xenvif_put() (Jan Beulich)
- xen-netback: split event channels support for Xen backend driver (Wei Liu)
- xen-netback: enable user to unload netback module (Wei Liu)
- xen-netback: remove dead code (Wei Liu)
- xen-netback: better names for thresholds (Wei Liu)
- xen-netback: avoid allocating variable size array on stack (Wei Liu)
- xen-netback: remove redundent parameter in netbk_count_requests (Wei Liu)

[2.6.39-400.203.0]
- xen/netback: correctly calculate required slots of skb. (Annie Li)
[Orabug: 16934362]
- RDS: Local address resolution may be delayed after IP has moved. RDS
to update local ARP cache directly to speed it up. (Bang Nguy
en) [Orabug: 16979994]
- mlx4: fix data corruption in hugetlb_user_mr (Chien Yen) [Orabug:
16772016]
- fix compilation blk-core.c with missing rate-limit header (Maxim Uvarov)
- block: rate-limit the error message from failing commands (Yi Zou)
[Orabug: 15918663]
- Revert 'xen-blkfront: use a different scatterlist for each request'
(Konrad Rzeszutek Wilk)
- xen/pciback: Fix for backport compilation issues. (Konrad Rzeszutek Wilk)
- Revert 'xen-blkfront: use a different scatterlist for each request'
(Konrad Rzeszutek Wilk)
- xen-blkfront: use a different scatterlist for each request (Roger Pau
Monne)
- xen-blkback: check the number of iovecs before allocating a bios
(Roger Pau Monne)
- xen-blkfront: set blk_queue_max_hw_sectors correctly (Roger Pau Monne)
- xen-blkback: workaround compiler bug in gcc 4.1 (Roger Pau Monne)
- xen/blkback: Check for insane amounts of request on the ring (v6).
(Konrad Rzeszutek Wilk)
- xen/io/ring.h: new macro to detect whether there are too many requests
on the ring (Jan Beulich)
- xen/blkback: Check device permissions before allowing OP_DISCARD
(Konrad Rzeszutek Wilk) {CVE-2013-2140}
- xen/blkback: Fix backporting of printk_ratelimit. (Konrad Rzeszutek Wilk)
- xen/blkback: Check device permissions before allowing OP_DISCARD
(Konrad Rzeszutek Wilk) {CVE-2013-2140}
- xen/blkback: Use physical sector size for setup (Stefan Bader)
- xen-blkback/sysfs: Move the parameters for the persistent grant
features (Konrad Rzeszutek Wilk)
- xen-blkfront: Introduce a 'max' module parameter to alter the amount
of indirect segments. (Konrad Rzeszutek Wilk)
- xen-blkfront: use a different scatterlist for each request (Roger Pau
Monne)
- xen-blkback: allocate list of pending reqs in small chunks (Roger Pau
Monne)
- xen-block: implement indirect descriptors (Roger Pau Monne)
- xen-blkback: expand map/unmap functions (Roger Pau Monne)
- xen-blkback: make the queue of free requests per backend (Roger Pau Monne)
- xen-blkback: move pending handles list from blkbk to pending_req
(Roger Pau Monne)
- xen-blkback: implement LRU mechanism for persistent grants (Roger Pau
Monne)
- xen-blkback: use balloon pages for all mappings (Roger Pau Monne)
- xen-blkback: print stats about persistent grants (Roger Pau Monne)

[2.6.39-400.202.0]
- l2tp: Fix sendmsg() return value (Guillaume Nault)
- l2tp: Fix PPP header erasure and memory leak (Guillaume Nault)
[Orabug: 17030957]
- packet: packet_getname_spkt: make sure string is always 0-terminated
(Daniel Borkmann) [Orabug: 17030956]
- net: sctp: fix NULL pointer dereference in socket destruction (Daniel
Borkmann) [Orabug: 17030954]
- ip_tunnel: fix kernel panic with icmp_dest_unreach (Eric Dumazet)
[Orabug: 17030953]
- netlabel: improve domain mapping validation (Paul Moore) [Orabug:
17030951]
- ipv6: fix possible crashes in ip6_cork_release() (Eric Dumazet)
[Orabug: 17030950]
- tcp: fix tcp_md5_hash_skb_data() (Eric Dumazet) [Orabug: 17030948]
- fmr: D-NFS/RDM (FMR) patches for OFED (abhishek varshney) [Orabug:
16966484]
- lpfc: Update lpfc version for 8.3.7.10.7p driver release (James Smart)
[Orabug: 17026768]
- lpfc: Fix starting reference tag when calculating BG error (James
Smart) [Orabug: 17026768]
- lpfc: Fix BlockGuard error checking (James Smart) [Orabug: 17026768]
- tg3: update from broadcom version 3.129d to 3.131d (Jerry Snitselaar)
[Orabug: 17024939]
- mm/THP: use pmd_populate() to update the pmd with pgtable_t pointer
(Aneesh Kumar K.V) [Orabug: 17025306]
- mac80211: close AP_VLAN interfaces before unregistering all (Johannes
Berg) [Orabug: 17025303]
- batman-adv: Only write requested number of byte to user buffer (Sven
Eckelmann) [Orabug: 17025019]
- x25: Validate incoming call user data lengths (Matthew Daley) [Orabug:
17025021]
- aoe: reserve enough headroom on skbs (Eric Dumazet) [Orabug: 17025018]
- perf,x86: fix kernel crash with PEBS/BTS after suspend/resume
(Stephane Eranian) [Orabug: 17024915]
- dcbnl: fix various netlink info leaks (Mathias Krause) [Orabug:
17024912] {CVE-2013-2634}
- e1000e driver update from 2.3.2 to 2.4.14 (Maxim Uvarov) Merge Intel
drivers update.
- ixgbe driver update from 3.14.5 to 3.15.1 (Maxim Uvarov) Merge Intel
drivers update.
- igbvf driver update from 2.0.4 to 2.3.2 (Maxim Uvarov) Merge Intel
drivers update.
- igb driver update from 4.1.2 to 4.3.0 (Maxim Uvarov) Merge Intel
drivers update.
- spec: change version to 400.200.0 for ol5 (Maxim Uvarov)
- RDS: restore two-sided reconnect with the lower IP node having a
constant 100 ms backoff. (Bang Nguyen) [Orabug: 16710287]
- scsi_prep_fn() check for empty queue (Maxim Uvarov) [Orabug: 17015328]
- x86: Fix typo in kexec register clearing (Kees Cook) [Orabug: 16992876]
- mm: migration: add migrate_entry_wait_huge() (Naoya Horiguchi)
[Orabug: 16992874]
- swap: avoid read_swap_cache_async() race to deadlock while waiting on
discard I/O completion (Rafael Aquini) [Orabug: 16992871]
- b43: stop format string leaking into error msgs (Kees Cook) [Orabug:
16992869] {CVE-2013-2852}
- nohz: Fix update_ts_time_stat idle accounting (Michal Hocko) [Orabug:
16985182]
- tracing: Fix possible NULL pointer dereferences (Namhyung Kim)
[Orabug: 16963984]
- drm: fix a use-after-free when GPU acceleration disabled (Huacai Chen)
[Orabug: 16963983]
- cifs: fix potential buffer overrun when composing a new options string
(Jeff Layton) [Orabug: 16963818]
- drivers/block/brd.c: fix brd_lookup_page() race (Brian Behlendorf)
[Orabug: 16963816]
- mm: mmu_notifier: re-fix freed page still mapped in secondary MMU
(Xiao Guangrong) [Orabug: 16963814]
- klist: del waiter from klist_remove_waiters before wakeup waitting
process (wang, biao) [Orabug: 16963813]
- ocfs2: goto out_unlock if ocfs2_get_clusters_nocache() failed in
ocfs2_fiemap() (Joseph Qi) [Orabug: 16963812]
- fat: fix possible overflow for fat_clusters (OGAWA Hirofumi) [Orabug:
16963811]
- cifs: only set ops for inodes in I_NEW state (Jeff Layton) [Orabug:
16963810]
- usermodehelper: check subprocess_info->path != NULL (Oleg Nesterov)
[Orabug: 16909862]
- ipv6: do not clear pinet6 field (Eric Dumazet) [Orabug: 16909856]
- macvlan: fix passthru mode race between dev removal and rx path (Jiri
Pirko) [Orabug: 16909854]
- bridge: fix race with topology change timer (stephen hemminger)
[Orabug: 16909638]
- tick: Cleanup NOHZ per cpu data on cpu down (Thomas Gleixner) [Orabug:
16909637]
- timer: Don't reinitialize the cpu base lock during CPU_UP_PREPARE
(Tirupathi Reddy) [Orabug: 16909635]
- x86/mm: account for PGDIR_SIZE alignment (Jerry Hoemann) [Orabug:
16903170]
- kernel/audit_tree.c: tree will leak memory when failure occurs in
audit_trim_trees() (Chen Gang) [Orabug: 16903120]
- clockevents: Set dummy handler on CPU_DEAD shutdown (Thomas Gleixner)
[Orabug: 16902369]
- cgroup: fix an off-by-one bug which may trigger BUG_ON() (Li Zefan)
[Orabug: 16902267]
- hrtimer: Add expiry time overflow check in hrtimer_interrupt (Prarit
Bhargava) [Orabug: 16902194]
- hrtimer: Fix ktime_add_ns() overflow on 32bit architectures (David
Engraf) [Orabug: 16902186]
- fs/fscache/stats.c: fix memory leak (Anurup m) [Orabug: 16901677] -
Bluetooth: RFCOMM
- Fix missing msg_namelen update in rfcomm_sock_recvmsg() (Mathias
Krause) [Orabug: 16888256] {CVE-2013-3225}
- Bluetooth: fix possible info leak in bt_sock_recvmsg() (Mathias
Krause) [Orabug: 16888251] {CVE-2013-3224}
- atm: update msg_namelen in vcc_recvmsg() (Mathias Krause) [Orabug:
16888219] {CVE-2013-3222}
- net: sctp: sctp_auth_key_put: use kzfree instead of kfree (Daniel
Borkmann) [Orabug: 16888213]
- Btrfs: make sure nbytes are right after log replay (Josef Bacik)
[Orabug: 16864338]
- Revert 'sysfs: fix race between readdir and lseek' (Jiri Kosina)
[Orabug: 16858013]
- crypto: algif - suppress sending source address information in recvmsg
(Mathias Krause) [Orabug: 16864292]
- sched: Convert BUG_ON()s in try_to_wake_up_local() to WARN_ON_ONCE()s
(Tejun Heo) [Orabug: 16864274]
- kernel/signal.c: stop info leak via the tkill and the tgkill syscalls
(Emese Revfy) [Orabug: 16864214]
- Revert '8021q: fix a potential use-after-free' (Greg Kroah-Hartman)
[Orabug: 16858417]
- hrtimer: Don't reinitialize a cpu_base lock on CPU_UP (Michael Bohan)
[Orabug: 16864124]
- PM / reboot: call syscore_shutdown() after disable_nonboot_cpus()
(Huacai Chen) [Orabug: 16863936]
- tracing: Fix double free when function profile init failed (Namhyung
Kim) [Orabug: 16863887]
- mm: prevent mmap_cache race in find_vma() (Jan Stancek) [Orabug: 16863788]
- block: avoid using uninitialized value in from queue_var_store (Arnd
Bergmann) [Orabug: 16863776]
- bonding: get netdev_rx_handler_unregister out of locks (Veaceslav
Falico) [Orabug: 16863608]
- net: add a synchronize_net() in netdev_rx_handler_unregister() (Eric
Dumazet) [Orabug: 16863608]
- 8021q: fix a potential use-after-free (Cong Wang) [Orabug: 16858417] -
efivars: Handle duplicate names from get_next_variable() (Matt Fleming)
[Orabug: 16858386]
- efivars: explicitly calculate length of VariableName (Matt Fleming)
[Orabug: 16858386]
- loop: prevent bdev freeing while device in use (Anatol Pomozov)
[Orabug: 16858270]
- Btrfs: limit the global reserve to 512mb (Josef Bacik) [Orabug: 16858090]
- sysfs: handle failure path correctly for readdir() (Ming Lei) [Orabug:
16858013]
- sysfs: fix race between readdir and lseek (Ming Lei) [Orabug: 16858013]
- udf: avoid info leak on export (Mathias Krause) [Orabug: 16857424]
{CVE-2012-6548}
- isofs: avoid info leak on export (Mathias Krause) [Orabug: 16857416]
{CVE-2012-6549}
- Fix: compat_rw_copy_check_uvector() misuse in aio, readv, writev, and
security keys (Mathieu Desnoyers) [Orabug: 16857392]
- key: Fix resource leak (Alan Cox) [Orabug: 16857374]
- clockevents: Don't allow dummy broadcast timers (Mark Rutland)
[Orabug: 16857329]
- IPoIB: Fix send lockup due to missed TX completion (Mike Marciniszyn)
[Orabug: 16857300]
- ext4: fix the wrong number of the allocated blocks in
ext4_split_extent() (Zheng Liu) [Orabug: 16857255]
- mm/hugetlb: fix total hugetlbfs pages count when using memory
overcommit accouting (Wanpeng Li) [Orabug: 16857202]
- drm/i915: restrict kernel address leak in debugfs (Kees Cook) [Orabug:
16857108]
- rtnl: fix info leak on RTM_GETLINK request for VF devices (Mathias
Krause) [Orabug: 16837612] {CVE-2013-2635}
- tun: add a missing nf_reset() in tun_net_xmit() (Eric Dumazet)
[Orabug: 16837512]
- rds: limit the size allocated by rds_message_alloc() (Cong Wang)
[Orabug: 16837486]
- loopdev: fix a deadlock (Guo Chao) [Orabug: 16837353]
- block: use i_size_write() in bd_set_size() (Guo Chao) [Orabug: 16837353]
- selinux: use GFP_ATOMIC under spin_lock (Dan Carpenter) [Orabug: 16837318]
- md: protect against crash upon fsync on ro array (Sebastian Riemer)
[Orabug: 16837271]
- signal: always clear sa_restorer on execve (Kees Cook) [Orabug:
16837208] {CVE-2013-0914}
- virtio: rng: disallow multiple device registrations, fixes crashes
(Amit Shah) [Orabug: 16836152]

[2.6.39-400.201.0]
- spec: change version to 400.200.0 for ol5 (Maxim Uvarov)
- RDS: restore two-sided reconnect with the lower IP node having a
constant 100
ms backoff. (Bang Nguyen) [Orabug: 16710287]
- scsi_prep_fn() check for empty queue (Maxim Uvarov) [Orabug: 17015328]
- spec: change version to 400.200.0 (Maxim Uvarov)
- NFSv4.x: Fix handling of partially delegated locks (Trond Myklebust)
[Orabug:17004718]
- rds: set correct msg_namelen (Weiping Pan) {CVE-2012-3430}
- x86/irq/ioapic: Check for valid irq_cfg pointer in
smp_irq_move_cleanup_interrupt (Dimitri Sivanich) [Orabug: 16874839]
- [SCSI] scsi_error: classify some ILLEGAL_REQUEST sense as a permanent
TARGET_ERROR (Mike Snitzer) [Orabug: 16862947]
- printk: fix buffer overflow when calling log_prefix function from
call_console_drivers (Alexandre SIMON) [Orabug: 16425333] {CVE-2013-1772}
- xen/enlighten: IS_ENABLE macro does not exist. (Konrad Rzeszutek Wilk)
- xen/pci: Track PVHVM PIRQs. (Konrad Rzeszutek Wilk)
- xenbus_client.c: correct exit path for xenbus_map_ring_valloc_hvm (Wei
Liu)
- xen: Clean up apic ipi interface (Stefan Bader)
- xenbus: save xenstore local status for later use (Aurelien Chartier)
- xenbus: delay xenbus frontend resume if xenstored is not running
(Aurelien Chartier)
- xen/xenbus: Fixed over 80 character limit issue (Lisa Nguyen)
- xen/xenbus: Fixed indentation error in switch case (Lisa Nguyen)
- xen/privcmd: fix condition in privcmd_close() (Dan Carpenter)
- xen: mask x2APIC feature in PV (Zhenzhong Duan)
- xen: SWIOTLB is only used on x86 (Arnd Bergmann)
- Support checksum and gso offload of ipv6 in netback (Annie Li)
[Orabug: 16974811]
- iser: iscsiadm logout hangs (Shamir Rabinovitch) [Orabug: 16313854]
- RDS: IP config needs to be updated when network/rdma service
restarted. (Bang
Nguyen) [Orabug: 16963884]
- RDS: check for valid rdma id before initiating connection (Bang
Nguyen) [Orabug: 16857341]
- RDS: reduce slab memory usage (Bang Nguyen) [Orabug: 16935507]
- RDMA CM: Avoid possible SEGV during connection shutdown (Bang Nguyen)
[Orabug: 16750726]
- iommu/vt-d: add quirk for broken interrupt remapping on 55XX chipsets
(Neil Horman) [Orabug: 16875921]
- xen: mask x2APIC feature in PV (Zhenzhong Duan) [Orabug: 16372098]
- scsi_dh_alua: Evaluate TPGS setting from inquiry data (Hannes
Reinecke) [Orabug: 16737121]
- scsi_dh: Implement match callback function (Hannes Reinecke) [Orabug:
16737121]
- RDS: Move connection along with IP when failing over/back. (Bang Nguyen)
[Orabug: 16916648]
- random: Add support for architectural random hooks (H. Peter Anvin)
[Orabug: 16916375]
- random: use lockless techniques in the interrupt path (Theodore Ts'o)
[Orabug: 16916375]
- random: make 'add_interrupt_randomness()' do something sane (Theodore
Ts'o)
[Orabug: 16916375]
- random: Use arch_get_random_int instead of cycle counter if avail (Linus
Torvalds) [Orabug: 16916375]
- random: Adjust the number of loops when initializing (H. Peter Anvin)
[Orabug: 16916375]
- random: Use arch-specific RNG to initialize the entropy store
(Theodore Ts'o)
[Orabug: 16916375]
- x86, random: Architectural inlines to get random integers with RDRAND (H.
Peter Anvin) [Orabug: 16916375]
- RDS: Rename HAIP parameters to Active Bonding (Bang Nguyen) [Orabug:
16810395]
- rds shouldn't release fmr when ib_device was already released. (Zheng Li)
[Orabug: 16605377]
- rds remove dev race. (Zheng Li) [Orabug: 16605377]
- reinit ip_config when service rdma restart. (Zheng Li) [Orabug: 16605377]
- while removing a non-empty directory, the kernel dumps a message:
(rmdir,21743,1):ocfs2_unlink:953 ERROR: status = -39 (Xiaowei.Hu)
[Orabug:
16790405]
- stop mig handler when lockres in progress ,and return -EAGAIN (Xiaowei.Hu)
[Orabug: 16876446]
- Revert 'dlmglue race condition,wrong lockres_clear_pending' (Maxim Uvarov)
[Orabug: 16897450]
- Suppress the error message from being printed in ocfs2_rename (Xiaowei.Hu)
[Orabug: 16790405]
- fnic: return zero on fnic_reset() success (Joe Jin) [Orabug: 16885029]
- Revert 'x86, mm: Revert back good_end setting for 64bit' (Maxim Uvarov)
- ocfs2_prep_new_orphaned_file return ret (Xiaowei.Hu) [Orabug: 16823825]
- x86, mm: Revert back good_end setting for 64bit (Maxim Uvarov)
- oprofile, x86: Reimplement nmi timer mode using perf event (Robert
Richter)
[Orabug: 15924015]
- Revert 'Btrfs: remove ->dirty_inode' (Guangyu Sun) [Orabug: 16841843]
- bonding: emit event when bonding changes MAC (Weiping Pan) [Orabug:
16750157]
- net: fix incorrect credentials passing (Linus Torvalds) [Orabug: 16836975]
{CVE-2013-1979}
- tg3: fix length overflow in VPD firmware parsing (Kees Cook) [Orabug:
16836958] {CVE-2013-1929}
- USB: cdc-wdm: fix buffer overflow (Oliver Neukum) [Orabug: 16836943]
{CVE-2013-1860}
- ext3: Fix format string issues (Lars-Peter Clausen) [Orabug: 16836934]
{CVE-2013-1848}
- blk: avoid divide-by-zero with zero discard granularity (Linus Torvalds)
[Orabug: 16844561]
- xen/pci: Track PVHVM PIRQs. (Zhenzhong Duan) [Orabug: 16402281]
- cnic: don't use weak dependencies for ipv6 (Jerry Snitselaar) [Orabug:
16780307 16207564]
- Revert 'drm/i915: correctly order the ring init sequence' (Guangyu Sun)
[Orabug: 16486689]
- x86/boot-image: Don't leak phdrs in
arch/x86/boot/compressed/misc.c::Parse_elf() (Jesper Juhl) [Orabug:
16833437]
- spec: add /boot/vmlinuz*.hmac needed for fips mode (John Haxby) [Orabug:
16807114]
- [SCSI] isci: add version number (Dan Williams) [Orabug: 16823000]
- perf: Treat attr.config as u64 in perf_swevent_init() (Tommi Rantala)
[Orabug: 16808734] {CVE-2013-2094}
- xen-netback: don't disconnect frontend when seeing oversize packet
(Wei Liu)
{XSA-39}
- xen-netback: coalesce slots in TX path and fix regressions (Wei Liu)
{XSA-39
XSA-39 XSA-39 XSA-39}
- xen-netback: fix sparse warning (stephen hemminger)
- block: add plug for blkdev_issue_discard (Shaohua Li) [Orabug: 16737121]
- block: discard granularity might not be power of 2 (Shaohua Li) [Orabug:
16737121]
- block: split discard into aligned requests (Paolo Bonzini) [Orabug:
16737121]
- block: reorganize rounding of max_discard_sectors (Paolo Bonzini) [Orabug:
16737121]
- block: Consolidate command flag and queue limit checks for merges
(Martin K.
Petersen) [Orabug: 16737121]
- block: Clean up special command handling logic (Martin K. Petersen)
[Orabug:
16737121]
- block: separate out blk_rq_merge_ok() and blk_try_merge() from elevator
functions (Tejun Heo) [Orabug: 16737121]
- spec: ol6 add multipath version deps (Maxim Uvarov) [Orabug: 16763586]
- xen-netback: remove skb in xen_netbk_alloc_page (Wei Liu)
- xen-netback: correctly return errors from netbk_count_requests() (David
Vrabel)
- xen-netback: allow changing the MAC address of the interface (Matt Wilson)
- xen/netback: only non-freed SKB is queued into tx_queue (Annie Li)
- xen: resolve section mismatch warnings in xen-acpi-processor (Ben Guthro)
- xen: Re-upload processor PM data to hypervisor after S3 resume (v2) (Ben
Guthro)
- xen/spinlock: Fix check from greater than to be also be greater or
equal to.
(Konrad Rzeszutek Wilk)
- xen/smp/pvhvm: Don't point per_cpu(xen_vpcu, 33 and larger) to shared_info
(Konrad Rzeszutek Wilk)
- xen/vcpu: Document the xen_vcpu_info and xen_vcpu (Konrad Rzeszutek Wilk)
- xen/vcpu/pvhvm: Fix vcpu hotplugging hanging. (Konrad Rzeszutek Wilk)
- xen/smp: Unifiy some of the PVs and PVHVM offline CPU path (Konrad
Rzeszutek
Wilk)
- xen/smp/pvhvm: Don't initialize IRQ_WORKER as we are using the native one.
(Konrad Rzeszutek Wilk)
- xen/spinlock: Disable IRQ spinlock (PV) allocation on PVHVM (Konrad
Rzeszutek
Wilk)
- xen/spinlock: Check against default value of -1 for IRQ line. (Konrad
Rzeszutek Wilk)
- xen/time: Add default value of -1 for IRQ and check for that. (Konrad
Rzeszutek Wilk)
- xen/events: Check that IRQ value passed in is valid. (Konrad Rzeszutek
Wilk)
- xen/time: Fix kasprintf splat when allocating timer%d IRQ line. (Konrad
Rzeszutek Wilk)
- xen/smp/spinlock: Fix leakage of the spinlock interrupt line for every CPU
online/offline (Konrad Rzeszutek Wilk)
- xen/smp: Fix leakage of timer interrupt line for every CPU online/offline.
(Konrad Rzeszutek Wilk)
- xen: drop tracking of IRQ vector (Jan Beulich)
- xen kconfig: fix select INPUT_XEN_KBDDEV_FRONTEND (Andrew Jones)
- xen: drop tracking of IRQ vector (Jan Beulich)
- x86/xen: populate boot_params with EDD data (David Vrabel)
- pci/hotplug: keep compatible with other OSes and suppress AER Back port
commit 7f822999e12a144e68c915194267108f8051cf9b and
2debd9289997fc5d1c0043b41
201a8b40d5e11d0,bffe4f72fcdd92bfb24909d586d1636e5cec500d by Yinghai from
upstream to keep compatible with other OSes while doing PCIe hotplug
function. not only used to suppress AER. (ethan.zhao) [Orabug: 16458024]

See also :

https://oss.oracle.com/pipermail/el-errata/2013-September/003663.html
https://oss.oracle.com/pipermail/el-errata/2013-September/003664.html

Solution :

Update the affected unbreakable enterprise kernel packages.

Risk factor :

High / CVSS Base Score : 7.8
(CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C)
Public Exploit Available : true