# changelog

author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-46
changelog:
  - Resolves: rhbz#1227860 - Provide a way to disable the cleanup task
  - Resolves: rhbz#1227863 - ignore_group_members doesn't work for subdomains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-47
changelog:
  - Resolves: rhbz#1232738 - Cache is not updated after user is deleted from
                             ldap server


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-47.1
changelog:
  - Resolves: rhbz#1258398 - sysdb sudo search doesn't escape special
                             characters


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-47.6
changelog:
  - Resolves: rhbz#1291158 - Group members are not turned into ghost entries
                             when the user is purged from the SSSD cache


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-47.7
changelog:
  - Resolves: rhbz#1298252 - 'filter_users' in conjunction with
                             'default_domain_suffix'


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-47.8
changelog:
  - Resolves: rhbz#1305447 - sssd_nss memory usage keeps growing on
                             sssd-1.12.4-47.el6.x86_64 (RHEL6.7) when
                             trying to retrieve non-existing netgroups


author: Panu Matilainen <pmatilai@redhat.com> - 4.8.0-33
changelog:
  - Fix build-time double-free on file capability processing (#904818)
  - Fix include-directive getting processed on false branch (#920190)


author: Florian Festi <ffesti@redhat.com> - 4.8.0-38
changelog:
  - Fix race condidition where unchecked data is exposed in the file system
    (CVE-2013-6435)(#1163059)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-0
changelog:
  - Update to aarch64-shenandoah-jdk8u192-b12.
  - Remove patches included upstream
    - PR3548/RH1540242
    - JDK-6260348/PR3066
    - JDK-8185723/PR3553
    - JDK-8186461/PR3557
    - JDK-8201509/PR3579
    - JDK-8205104/PR3539/RH1548475
    - JDK-8206406/PR3610/RH1597825
    - JDK-8201495/PR2415
  - Re-generate patches (mostly due to upstream build changes)
    - JDK-8073139/PR1758/RH1191652
    - JDK-8197429/PR3546/RH1536622 (due to JDK-8189170)
    - JDK-8199936/PR3533
    - JDK-8199936/PR3591
    - PR3559 (due to JDK-8185723/JDK-8186461/JDK-8201509)
    - PR3593 (due to JDK-8081202)
    - RH1566890/CVE-2018-3639 (due to JDK-8189170)
    - RH1649664 (due to JDK-8196516)
    - RH1649731
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.192.b12-1
changelog:
  - Add 8160748 for AArch64 which is missing from upstream 8u version.
  - Add port of 8189170 to AArch64 which is missing from upstream 8u version.
  - Resolves: rhbz#1661577


author: Jiri Vanek jvanek@redhat.com - 1:1.8.0.201.b09-2
changelog:
  - Replaced pcsc-lite-devel (which is in optional channel) with pcsc-lite-libs.
  - added rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch to make jdk work with pcsc


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.201.b09-3
changelog:
  - Update patch for RH1566890.
    - Renamed rh1566890_speculative_store_bypass_so_added_more_per_task_speculation_control_CVE_2018_3639 to
      rh1566890-CVE_2018_3639-speculative_store_bypass.patch
    - Added dependent patch,
      rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.201.b13-0
changelog:
  - Update to aarch64-shenandoah-jdk8u201-b13.
  - Drop JDK-8160748 & JDK-8189170 AArch64 patches now applied upstream.
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.202.b08-0
changelog:
  - Update to aarch64-shenandoah-jdk8u202-b08.
  - Remove patches included upstream
    - JDK-8211387/PR3559
    - JDK-8073139/PR1758/RH1191652
    - JDK-8044235
    - JDK-8131048/PR3574/RH1498936
    - JDK-8164920/PR3574/RH1498936
  - Resolves: rhbz#1693468


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.212.b02-0
changelog:
  - Update to aarch64-shenandoah-jdk8u212-b02.
  - Remove patches included upstream
    - JDK-8197429/PR3546/RH153662{2,3}
    - JDK-8184309/PR3596
  - Re-generate patches
    - JDK-8203030
  - Add casts to resolve s390 ambiguity in calls to log2_intptr
  - Resolves: rhbz#1693468


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.107-1
changelog:
  - Update to latest upstream release with various fixes
    and enhancements detailed in WHATS_NEW file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.107-2
changelog:
  - Add report/list_item_separator lvm.conf option.
  - Add lv_active_{locally,remotely,exclusively} LV reporting fields.
  - Comment out devices/{preferred_names,filter} in default lvm.conf file.
  - Enhance lvconvert thin, thinpool, cache and cachepool command line support.
  - Display 'C' only for cache and cache-pool target types in lvs.
  - Prompt for confirmation before change LV into a snapshot exception store.
  - Return proper error codes for some failing lvconvert funtions.
  - Add initial code to use cache tools (cache_check|dump|repair|restore).
  - Add --activationmode degraded to activate degraded raid volumes by default.
  - Add separate lv_active_{locally,remotely,exclusively} LV reporting fields.
  - Recognize "auto"/"unmanaged" values in selection for appropriate fields only.
  - Add report/binary_values_as_numeric lvm.conf option for binary values as 0/1.
  - Add --binary arg to pvs,vgs,lvs and {pv,vg,lv}display -C for 0/1 on reports.
  - Add separate reporting fields for each each {pv,vg,lv}_attr bit.
  - Separate LV device status reporting fields out of LV fields.
  - Fix regression causing PVs not in VGs to be marked as allocatable (2.02.59).
  - Fix VG component of lvid in vgsplit/vgmerge and check in vg_validate.
  - Add lv_full_name, lv_parent and lv_dm_path fields to reports.
  - Change lv_path field to suppress devices that never appear in /dev/vg.
  - Postpone thin pool lvconvert prompts (2.02.107).
  - Require --yes option to skip prompt to lvconvert thin pool chunksize.
  - Support lvremove -ff to remove thin volumes from broken thin pools.
  - Require --yes to skip raid repair prompt.
  - Change makefile %.d generation to handle filename changes without make clean.
  - Fix use of buildir in make pofile.
  - Enhance private volumes UUIDs with suffixed for easier detection.
  - Do not use reserved _[tc]meta volumes for temporary LVs.
  - Leave backup pool metadata with _meta%d suffix instead of reserved _tmeta%d.
  - Allow RAID repair to reuse PVs from same image that suffered a failure.
  - New RAID images now avoid allocation on any PVs in the same parent RAID LV.
  - Always reevaluate filters just before creating PV.
  - Fix dm_report_field_string_list to handle delimiter with multiple chars.
  - Add dm_report_field_reserved_value for per-field reserved value definition.


author: Alasdair Kergon <agk@redhat.com> - 2.02.108-1
changelog:
  - Add lvscan --cache which re-scans constituents of a particular LV.
  - Make dmeventd's RAID plugin re-scan failed PVs when lvmetad is in use.
  - Improve lvconvert --merge and --splitsnapshot validation.


author: Alasdair Kergon <agk@redhat.com> - 2.02.109-1
changelog:
  - Allow approximate allocation with +%FREE in lvextend.
  - Fix a segfault in lvscan --cache when devices were already missing. (2.02.108)
  - Display actual size changed when resizing LV.
  - Remove possible spurious "not found" message on PV create before wiping.
  - Handle upgrade from 2.02.105 when an LV now gaining a uuid suffix is active.
  - Remove lv_volume_type field from reports. (2.02.108)
  - Fix incorrect persistent .cache after vgcreate with PV creation. (2.02.108)
  - Add dm_tree_set_optional_uuid_suffixes to libdevmapper to handle upgrades.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.109-2
changelog:
  - Fix pvcreate_check() to update cache correctly after signature wiping.
  - Fix primary device lookup failure for partition when processing mpath filter.
  - Remove spurious "Skipping mirror LV" message on pvmove of clustered mirror.
  - If LV inactive and non-clustered, do not issue "Cannot deactivate" on -aln.
  - Cleanly error when creating RAID with stripe size < PAGE_SIZE.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.110-1
changelog:
  - Fix manipulation with thin-pools which are excluded via volume_list.
  - Support lv/vgremove -ff to remove thin vols from broken/inactive thin pools.
  - Fix typo breaking configure --with-lvm1=shared.
  - Modify lvresize code to handle raid/mirrors and physical extents.
  - Don't allow pvcreate to proceed if scanning or filtering fails.
  - Print name of LV which on activation triggers delayed snapshot merge.
  - Add lv_layout and lv_role LV reporting fields.
  - Properly display lvs lv_attr volume type and target type bit for cache origin.
  - Improve libdevmapper-event select() error handling.
  - Add extra check for matching transation_id after message submitting.
  - Add dm_report_field_string_list_unsorted for str. list report without sorting.
  - Support --deferred with dmsetup remove to defer removal of open devices.
  - Update dm-ioctl.h to include DM_DEFERRED_REMOVE flag.
  - Add support for selection to match string list subset, recognize { } operator.
  - Fix string list selection with '[value]' to not match list that's superset.
  - Fix string list selection to match whole words only, not prefixes.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.111-1
changelog:
  - Reinstate nosync logic when extending mirror. (2.02.110)
  - Fix total area extent calculation when allocating cache pool. (2.02.110)
  - Pass properly sized char buffers for sscanf when initializing clvmd.
  - Restore proper buffer size for parsing mountinfo line (1.02.89)


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.111-2.el6_6.1
changelog:
  - Fix configure script to detect that systemd environment is not used and
    generate proper udev rules for lvmetad notification based on this information.


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.4-1
changelog:
  - new version 8.14.4 (#552078)
  - RPM attributes S, 5, T not recorded for statistics file
  - adapted patches: makemapman, dynamic, switchfile (#552078)
  - movefiles patch incorporated into aliases_dir patch
  - dropped patches (fixed upstream): exitpanic, certcnnul


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.4-5
changelog:
  - used noreplace for sasl config
  - used ghost instead of explicit provides
  - deffattr changed to (-,root,root,-)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 8.14.4-9
changelog:
  - fixed MAXHOSTNAMELEN for FQDN
    resolves: rhbz#640234
  - fixed assertion if server connection is lost while making LDAP query
    resolves: rhbz#837007
  - fixed milterfdleaks patch to check socket before using fcntl on it
    resolves: rhbz#845821
  - fixed ldap_routing macro
    resolves: rhbz#890227
  - properly set {client_port} value on little endian machines,
    patch by Kelsey Cumminngs <kgc@corp.sonic.net>
    resolves: rhbz#1106852


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-42
changelog:
  - Resolves: rhbz#1215765 - sssd nss responder gets wrong number of
                             secondary groups


author: Jakub Hrozek <jhrozek@redhat.com> - 1.12.4-45
changelog:
  - Resolves: rhbz#1226834 - id lookup for non-root domain users doesn't
                             return all groups on first attempt


author: Daniel Veillard <veillard@redhat.com> - 2.7.6-9.el6
changelog:
  - Fix a failure to report xmlreader parsing failures
  - Fix parser local buffers size problems (rhbz#843742)
  - Fix entities local buffers size problems (rhbz#843742)
  - Fix an error in previous commit (rhbz#843742)
  - Do not fetch external parsed entities
  - Impose a reasonable limit on attribute size (rhbz#843742)
  - Impose a reasonable limit on comment size (rhbz#843742)
  - Impose a reasonable limit on PI size (rhbz#843742)
  - Cleanups and new limit APIs for dictionaries (rhbz#843742)
  - Introduce some default parser limits (rhbz#843742)
  - Implement some default limits in the XPath module
  - Fixup limits parser (rhbz#843742)
  - Enforce XML_PARSER_EOF state handling through the parser
  - Avoid quadratic behaviour in some push parsing cases (rhbz#843742)
  - More avoid quadratic behaviour (rhbz#843742)
  - Strengthen behaviour of the push parser in problematic situations (rhbz#843742)
  - More fixups on the push parser behaviour (rhbz#843742)
  - Fix a segfault on XSD validation on pattern error
  - Fix an unimplemented part in RNG value validation


author: Jaromir Capik <jcapik@redhat.com> - 3.2.8-26
changelog:
  - #1089817 - Return value of pgrep is incorrect
  - #950748 - /lib64/libproc.so package both in procps and procps-devel
  - #1011216 - Backport man page fix of top utility - RES = CODE + DATA
  - #1082877 - top/man: RES - physical memory a task 'has used'->'is using'
  - #1034337 - Include man pages for openproc(), readproc() and readproctab()
  - Resolves: rhbz#1089817 rhbz#950748 rhbz#1011216 rhbz#1082877 rhbz#1034337


author: Jaromir Capik <jcapik@redhat.com> - 3.2.8-27
changelog:
  - #1060681 - ps -p cycles over all PIDs instead of just one
  - #963799 - Should shared memory be accounted in cached in free output?
  - Resolves: rhbz#1060681 rhbz#963799


author: Jaromir Capik <jcapik@redhat.com> - 3.2.8-28
changelog:
  - #1105125 - Locale dependent float delay in top and watch utilities
  - #1039013 - Include an API in RHEL to return the number of opened file descriptors for a process
  - Resolves: rhbz#1105125
  - Related: rhbz#1034337


author: Jaromir Capik <jcapik@redhat.com> - 3.2.8-31
changelog:
  - #993072 - Make the "free" command a little more human friendly
  - #1172059 - ps coredump in stat2proc()
  - #1120580 - [RFE] Have sysctl -p read info from /etc/sysctl.d
  - #1123311 - RFE: "w" should have "-n" flag to suppress reverse name resolution of IP addresses
  - #1163404 - [procps] find_elf_note invalid read if setenv has been called before libproc init
  - Resolves: rhbz#993072 rhbz#1172059 rhbz#1120580 rhbz#1123311 rhbz#1163404


author: Ray Strode <rstrode@redhat.com> - 1:1.2.16-9
changelog:
  Resolves: #547808
  - Fix activation of daemons (#545267)
  - Fix reload memleak (fdo #24697)
  - Don't forget about pending activations on reload (fdo #24350)
  - Fix reload race (fdo #21597)


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-2
changelog:
  - Add nss-util portion of a fix for pluggable ecc bug in nss and nss-util
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-3
changelog:
  - Apply the patch for the pluggable ecc fix
  - Resolves: Bug 1057224 - Pluggable ECC in NSS not enabled on RHEL 6 and above


author: Elio Maldonado <emaldona@redhat.com> - 3.15.3-4
changelog:
  - nssutil_growList and nssutil_ReadSecmodDB cleanup
  - Resolves: Bug 1019529 - New defect found in nss-util-3.14.0.0-2.el6


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-4
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove patches rendered obsolete by the rebase


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Fix the required nspr version to be 4.10.6


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-504.25.1.el6]
changelog:
  - [net] ipvs: allow rescheduling of new connections when port reuse is detected (Marcelo Leitner) [1222771 1108514]
  - [net] ipvs: Fix reuse connection if real server is dead (Marcelo Leitner) [1222771 1108514]
  - [netdrv] bonding: fix locking in enslave failure path (Nikolay Aleksandrov) [1222483 1221856]
  - [netdrv] bonding: primary_slave & curr_active_slave are not cleaned on enslave failure (Nikolay Aleksandrov) [1222483 1221856]
  - [netdrv] bonding: vlans don't get deleted on enslave failure (Nikolay Aleksandrov) [1222483 1221856]
  - [netdrv] bonding: mc addresses don't get deleted on enslave failure (Nikolay Aleksandrov) [1222483 1221856]
  - [netdrv] bonding: IFF_BONDING is not stripped on enslave failure (Nikolay Aleksandrov) [1222483 1221856]
  - [netdrv] bonding: fix error handling if slave is busy v2 (Nikolay Aleksandrov) [1222483 1221856]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-504.26.1.el6]
changelog:
  - [kernel] sched: Fix clock_gettime(CLOCK_[PROCESS/THREAD]_CPUTIME_ID) monotonicity (Seth Jennings) [1219501 1140024]
  - [kernel] sched: Replace use of entity_key() (Larry Woodman) [1219123 1124603]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.27.1.el6]
changelog:
  - [netdrv] mlx4_en: current_mac isn't updated in port up (Amir Vadai) [1224383 1081667]
  - [netdrv] mlx4_en: Fix mac_hash database inconsistency (Amir Vadai) [1224383 1081667]
  - [netdrv] mlx4_en: Protect MAC address modification with the state_lock mutex (Amir Vadai) [1224383 1081667]
  - [netdrv] mlx4_en: Fix errors in MAC address changing when port is down (Amir Vadai) [1224383 1081667]
  - [netdrv] mlx4: Verify port number in __mlx4_unregister_mac (Amir Vadai) [1224383 1081667]
  - [netdrv] mlx4_en: Adding missing initialization of perm_addr (Amir Vadai) [1225489 1120930]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.28.1.el6]
changelog:
  - [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Seth Jennings) [1202860 1185166] {CVE-2015-1805}
  - [net] ipv4: Missing sk_nulls_node_init in ping_unhash (Denys Vlasenko) [1218102 1218103] {CVE-2015-3636}
  - [net] conntrack: RFC5961 challenge ACK confuse conntrack LAST-ACK transition (Jesper Brouer) [1227467 1227468 1212801 1200541]
  - [net] tcp: Restore RFC5961-compliant behavior for SYN packets (Jesper Brouer) [1227467 1227468 1212801 1200541]
  - [x86] kernel: ignore NMI IOCK when in kdump kernel (Jerry Snitselaar) [1225054 1196263]
  - [x86] asm/entry/64: Remove a bogus 'ret_from_fork' optimization (Mateusz Guzik) [1209232 1209233] {CVE-2015-2830}
  - [fs] gfs2: try harder to obtain journal lock during recovery (Abhijith Das) [1222588 1110846]
  - [x86] perf: Add cpu_<prepare|starting|dying> for core_pmu (Jiri Olsa) [1219149 1188336]
  - [x86] mm: Linux stack ASLR implementation (Jacob Tanenbaum) [1195682 1195683] {CVE-2015-1593}
  - [fs] xfs: DIO write completion size updates race (Brian Foster) [1218499 1198440]
  - [net] ipv6: Don't reduce hop limit for an interface (Denys Vlasenko) [1208492 1208493]
  - [net] vlan: more careful checksum features handling (Vlad Yasevich) [1221844 1212384]
  - [kernel] tracing: Export tracing clock functions (Jerry Snitselaar) [1217986 1212502]
  - [edac] sb_edac: fix corruption/crash on imbalanced Haswell home agents (Seth Jennings) [1213468 1210148]
  - [netdrv] tun: Fix csum_start with VLAN acceleration (Jason Wang) [1217189 1036482]
  - [netdrv] tun: unbreak truncated packet signalling (Jason Wang) [1217189 1036482]
  - [netdrv] tuntap: hardware vlan tx support (Jason Wang) [1217189 1036482]
  - [vhost] vhost-net: fix handle_rx buffer size (Jason Wang) [1217189 1036482]
  - [netdrv] ixgbe: fix X540 Completion timeout (John Greene) [1215855 1150343]
  - [char] tty: drop driver reference in tty_open fail path (Mateusz Guzik) [1201893 1201894]
  - [netdrv] macvtap: Fix csum_start when VLAN tags are present (Vlad Yasevich) [1215914 1123697]
  - [netdrv] macvtap: signal truncated packets (Vlad Yasevich) [1215914 1123697]
  - [netdrv] macvtap: restore vlan header on user read (Vlad Yasevich) [1215914 1123697]
  - [netdrv] macvlan: Initialize vlan_features to turn on offload support (Vlad Yasevich) [1215914 1123697]
  - [netdrv] macvlan: Add support for 'always_on' offload features (Vlad Yasevich) [1215914 1123697]
  - [netdrv] mactap: Fix checksum errors for non-gso packets in bridge mode (Vlad Yasevich) [1215914 1123697]
  - [netdrv] revert "macvlan: fix checksums error when we are in bridge mode" (Vlad Yasevich) [1215914 1123697]
  - [net] core: Correctly set segment mac_len in skb_segment() (Vlad Yasevich) [1215914 1123697]
  - [net] core: generalize skb_segment() (Vlad Yasevich) [1215914 1123697]
  - [net] core: Add skb_headers_offset_update helper function (Vlad Yasevich) [1215914 1123697]
  - [netdrv] ixgbe: Correctly disable VLAN filter in promiscuous mode (Vlad Yasevich) [1215914 1123697]
  - [netdrv] ixgbe: remove vlan_filter_disable and enable functions (Vlad Yasevich) [1215914 1123697]
  - [netdrv] qlge: Fix TSO for non-accelerated vlan traffic (Vlad Yasevich) [1215914 1123697]
  - [netdrv] i40evf: Fix TSO and hw checksums for non-accelerated vlan packets (Vlad Yasevich) [1215914 1123697]
  - [netdrv] i40e: Fix TSO and hw checksums for non-accelerated vlan packets (Vlad Yasevich) [1215914 1123697]
  - [netdrv] ehea: Fix TSO and hw checksums with non-accelerated vlan packets (Vlad Yasevich) [1215914 1123697]
  - [netdrv] e1000: Fix TSO for non-accelerated vlan traffic (Vlad Yasevich) [1215914 1123697]
  - [kernel] ipc: sysv shared memory limited to 8TiB (George Beshers) [1224301 1171218]
  - [mm] hugetlb: improve page-fault scalability (Larry Woodman) [1212300 1120365]
  - [netdrv] hyperv: Fix the total_data_buflen in send path (Jason Wang) [1222556 1132918]
  - [crypto] drbg: fix maximum value checks on 32 bit systems (Herbert Xu) [1225950 1219907]
  - [crypto] drbg: remove configuration of fixed values (Herbert Xu) [1225950 1219907]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.30.2.el6]
changelog:
  - [crypto] rng: Remove krng (Herbert Xu) [1233512 1226418]
  - [crypto] drbg: Add stdrng alias and increase priority (Herbert Xu) [1233512 1226418]
  - [crypto] seqiv: Move IV seeding into init function (Herbert Xu) [1233512 1226418]
  - [crypto] eseqiv: Move IV seeding into init function (Herbert Xu) [1233512 1226418]
  - [crypto] chainiv: Move IV seeding into init function (Herbert Xu) [1233512 1226418]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-504.30.3.el6]
changelog:
  - [redhat] spec: Update dracut dependency to pull in drbg module (Frantisek Hrbata) [1241517 1241338]


author: Jindrich Novy <jnovy@redhat.com> 4.7.25-12
changelog:
  - fix for Java API __repmgr_send crash where eid=SELF_EID,
    don't update master_id so soon after election (upstream bz#16299)


author: Jindrich Novy <jnovy@redhat.com> 4.7.25-15
changelog:
  - apply backported patch from 4.8.26 to fix dbverify (#563610, #472131)
    (patch backported by Noriko Hosoi)


author: Karel Zak <kzak@redhat.com> 2.17.2-12.26
changelog:
  - fix #1320360 - lscpu shows wrong "Virtualization type" on Xen paravirtualization guest (PV)
  - fix #1319642 - [util-linux-ng] lscpu: Fix model and model name on Power Systems
  - fix #1319642 - [util-linux-ng] lscpu: Fix model and model name on Power Systems
  - fix #1310035 - Hostname not being displayed besides the telnet login prompt
  - fix #1310317 - fdisk -l fdisk double open fd
  - fix #1337478 - wrong error handler and/or error message on fdisk call as not root user


author: Karel Zak <kzak@redhat.com> 2.17.2-12.27
changelog:
  - fix #1349192 - RHEL6.8 util-linux-ng requires 642 kernel, but does not specify it as a dependency
  - fix #1023655 - 'pppd' hangs (uninterruptable) when run on tty


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.12.1.el6]
changelog:
  - [fs] gfs2: clear gl_object when deleting an inode in gfs2_delete_inode (Robert S Peterson) [1479397 1464541]
  - [fs] gfs2: clear gl_object if gfs2_create_inode fails (Robert S Peterson) [1479397 1464541]
  - [fs] gfs2: set gl_object in inode lookup only after block type check (Robert S Peterson) [1479397 1464541]
  - [fs] gfs2: introduce helpers for setting and clearing gl_object (Robert S Peterson) [1479397 1464541]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.13.1.el6]
changelog:
  - [netdv] brcmfmac: fix possible buffer overflow in brcmf_cfg80211_mgmt_tx() (Stanislaw Gruszka) [1474783 1474782] {CVE-2017-7541}
  - [x86] fix /proc/mtrr with base/size more than 44bits (Jerome Marchand) [1482855 1466530]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.14.1.el6]
changelog:
  - [fs] nfs: don't disconnect open-owner on NFS4ERR_BAD_SEQID (Dave Wysochanski) [1491123 1459636]
  - [net] l2cap: prevent stack overflow on incoming bluetooth packet (Neil Horman) [1490060 1490062] {CVE-2017-1000251}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.15.1.el6]
changelog:
  - [fs] binfmt_elf.c:load_elf_binary(): return -EINVAL on zero-length mappings (Petr Matousek) [1492959 1492961] {CVE-2017-1000253}
  - [fs] binfmt_elf.c: fix bug in loading of PIE binaries (Petr Matousek) [1492959 1492961] {CVE-2017-1000253}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.16.1.el6]
changelog:
  - [net] packet: fix tp_reserve race in packet_set_ring (Stefano Brivio) [1481941 1481943] {CVE-2017-1000111}
  - [net] packet: fix overflow in check for tp_frame_nr (Stefano Brivio) [1481941 1481943] {CVE-2017-1000111}
  - [net] packet: fix overflow in check for tp_reserve (Stefano Brivio) [1481941 1481943] {CVE-2017-1000111}
  - [netdrv] sfc: tx ring can only have 2048 entries for all EF10 NICs (Jarod Wilson) [1498019 1441773]
  - [fs] sunrpc: always treat the invalid cache as unexpired (Thiago Becker) [1497976 1477288]
  - [fs] sunrpc: xpt_auth_cache should be ignored when expired (Thiago Becker) [1497976 1477288]
  - [net] tcp: initialize rcv_mss to TCP_MIN_MSS instead of 0 (Davide Caratti) [1488344 1488340] {CVE-2017-14106}
  - [net] tcp: fix 0 divide in __tcp_select_window() (Davide Caratti) [1488344 1488340] {CVE-2017-14106}
  - [scsi] lpfc: fix "integer constant too large" error on 32bit archs (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: version 11.0.1.6 is 11.0.0.6 with no_hba_reset patches (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: Vport creation is failing with "Link Down" error (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: Fix panic on BFS configuration (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: Fix eh_deadline setting for sli3 adapters (Maurizio Lombardi) [1487220 1441169]
  - [scsi] lpfc: Correct panics with eh_timeout and eh_deadline (Maurizio Lombardi) [1487220 1441169]
  - [net] udp: consistently apply ufo or fragmentation (Davide Caratti) [1481532 1481529] {CVE-2017-1000112}
  - [net] ipv6: Should use consistent conditional judgement for ip6 fragment between __ip6_append_data and ip6_finish_output (Davide Caratti) [1481532 1481529] {CVE-2017-1000112}
  - [net] ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output (Davide Caratti) [1481532 1481529] {CVE-2017-1000112}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.17.1.el6]
changelog:
  - [fs] nfsd: reorder nfsd_cache_match to check more powerful discriminators first (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: split DRC global spinlock into per-bucket locks (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: convert num_drc_entries to an atomic_t (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: remove the cache_hash list (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: convert the lru list into a per-bucket thing (Thiago Becker) [1509876 1435787]
  - [fs] nfsd: clean up drc cache in preparation for global spinlock elimination (Thiago Becker) [1509876 1435787]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.18.1.el6]
changelog:
  - [s390] s390/qdio: clear DSCI prior to scanning multiple input queues (Hendrik Brueckner) [1513314 1467962]
  - [net] sctp: do not loose window information if in rwnd_over (Marcelo Leitner) [1514443 1492220]
  - [net] sctp: fix recovering from 0 win with small data chunks (Marcelo Leitner) [1514443 1492220]
  - [s390] zfcp: fix erp_action use-before-initialize in REC action trace (Hendrik Brueckner) [1512425 1497000]
  - [hv] vmbus: Fix error code returned by vmbus_post_msg() (Vitaly Kuznetsov) [1506145 1491846]
  - [hv] vmbus: Increase the time between retries in vmbus_post_msg() (Vitaly Kuznetsov) [1506145 1491846]
  - [hv] vmbus: Raise retry/wait limits in vmbus_post_msg() (Vitaly Kuznetsov) [1506145 1491846]
  - [hv] vmbus: Reduce the delay between retries in vmbus_post_msg() (Vitaly Kuznetsov) [1506145 1491846]
  - [scsi] be2iscsi: fix bad extern declaration (Maurizio Lombardi) [1507512 1497152]
  - [kernel] mqueue: fix a use-after-free in sys_mq_notify() (Davide Caratti) [1476122 1476124] {CVE-2017-11176}
  - [net] ipv6: accept 64k - 1 packet length in ip6_find_1stfragopt() (Matteo Croce) [1477008 1477006] {CVE-2017-7542}
  - [net] ipv6: avoid overflow of offset in ip6_find_1stfragopt (Matteo Croce) [1477008 1477006] {CVE-2017-7542}
  - [net] ipv6: Fix leak in ipv6_gso_segment() (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}
  - [net] gre: fix a possible skb leak (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}
  - [net] ipv6: xfrm: Handle errors reported by xfrm6_find_1stfragopt() (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}
  - [net] ipv6: Check ip6_find_1stfragopt() return value properly (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}
  - [net] ipv6: Prevent overrun when parsing v6 header options (Sabrina Dubroca) [1502417 1459951] {CVE-2017-9074}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.19.1.el6]
changelog:
  - [scsi] bnx2fc: Fix hung task messages when a cleanup response is not received during abort (Chad Dupuis) [1523783 1504260]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.20.1.el6]
changelog:
  - [x86] kaiser/efi: unbreak tboot (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] pti/mm: Fix trampoline stack problem with XEN PV (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] pti/mm: Fix XEN PV boot failure (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Invoke TRACE_IRQS_IRETQ in paranoid_userspace_restore_all (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] spec_ctrl: show added cpuid flags in /proc/cpuinfo after late microcode update (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Eliminate redundnat FEATURE Not Present messages (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: enable IBRS and stuff_RSB before calling NMI C code (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: skip CAP_SYS_PTRACE check to skip audit (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: disable ibrs while in intel_idle() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: skip IBRS/CR3 restore when paranoid exception returns to userland (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - Revert "x86/entry: Use retpoline for syscall's indirect calls" (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/dump_pagetables: Allow dumping current pagetables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Add a pgd argument to walk_pgd_level() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Add page table directory (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Remove unneeded nmi_userspace code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix nmi exit code with CONFIG_TRACE_IRQFLAGS (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Clear kdump pgd page to prevent incorrect behavior (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: consider the init_mm.pgd a kaiser pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: convert userland visible "kpti" name to "pti" (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: __load_cr3 in resume from RAM after kernel %gs has been restored (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: Revert the __GFP_COMP flag change (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Add back STUFF_RSB to interrupt and error paths (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: make is_kaiser_pgd reliable (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] revert: mm/kaiser: Disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: fix pgd freeing in error path (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix 32-bit program crash with 64-bit kernel on AMD boxes (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] Remove __cpuinitdata from some data & function (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] KVM/spec_ctrl: allow IBRS to stay enabled in host userland (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Remove STUFF_RSB in error and interrupt code (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] [kvm] Pad RSB on VM transition (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [security] Add SPEC_CTRL Kconfig option (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpuid: Provide get_scattered_cpuid_leaf() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpuid: Cleanup cpuid_regs definitions (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] microcode: Share native MSR accessing variants (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] nop: Make the ASM_NOP* macros work from assembly (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpu: Clean up and unify the NOP selection infrastructure (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Further simplify the paranoid_exit code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Don't switch to trampoline stack in paranoid_exit (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [fs] prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [kernel] locking/barriers: introduce new memory barrier gmb() (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] Fix typo preventing msr_set/clear_bit from having an effect (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] Add another set of MSR accessor functions (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: fix RESTORE_CR3 crash in kaiser_stop_machine (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: use atomic ops to poison/unpoison user pagetables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: trampoline stack comments (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Check if PUD is large when validating a kernel address (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] Separate out entry text section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] linux/const.h: Add _BITUL() and _BITULL() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] linux/mmdebug.h: add VM_WARN_ON() and VM_WARN_ON_ONCE() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] stddef.h: Move offsetofend() from vfio.h to a generic kernel header (Waiman Long) [1519799 1519802] {CVE-2017-5754}


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.111-2.el6_6.3
changelog:
  - Fix regression in vgimportclone script that caused failures on
    any duplicate PVs found, hence making the script unusable.


author: Petr Holasek <pholasek@redhat.com> [2.6.32-573.18.1.el6]
changelog:
  - [netdrv] bonding: "primary_reselect" with "failure" is not working properly (Jarod Wilson) [1295924 1290672]
  - [net] netpoll: Close race condition between poll_one_napi and napi_disable (Neil Horman) [1295370 1252212]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.20.1.el6]
changelog:
  - [sched] kernel: sched: Fix nohz load accounting -- again (Rafael Aquini) [1300349 1167755]
  - [sched] kernel: sched: Move sched_avg_update to update_cpu_load (Rafael Aquini) [1300349 1167755]
  - [sched] kernel: sched: Cure more NO_HZ load average woes (Rafael Aquini) [1300349 1167755]
  - [sched] kernel: sched: Cure load average vs NO_HZ woes (Rafael Aquini) [1300349 1167755]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.21.1.el6]
changelog:
  - [fs] pipe: fix offset and len mismatch on pipe_iov_copy_to_user failure (Seth Jennings) [1310148 1302223] {CVE-2016-0774}
  - [fs] gfs2: Add missing else in trans_add_meta/data (Robert S Peterson) [1304332 1267995]
  - [fs] fs-cache: Synchronise object death state change vs operation submission (David Howells) [1308471 1096893]
  - [fs] fs-cache: Reduce cookie ref count if submit fails (David Howells) [1308471 1096893]
  - [mm] memcg: oom_notify use-after-free fix (Rafael Aquini) [1302763 1294400]
  - [x86] fix corruption of XMM registers when interrupt handlers use FPU (Mikulas Patocka) [1298994 1259023]
  - [net] tcp: honour SO_BINDTODEVICE for TW_RST case too (Florian Westphal) [1303044 1292300]
  - [net] add inet_sk_transparent() helper (Florian Westphal) [1303044 1292300]
  - [net] ipv6: tcp_ipv6 policy route issue (Florian Westphal) [1303044 1292300]
  - [net] ipv6: reuse rt6_need_strict (Florian Westphal) [1303044 1292300]
  - [net] tcp: resets are misrouted (Florian Westphal) [1303044 1292300]
  - [net] tcp: tcp_v4_send_reset: binding oif to iif in no sock case (Florian Westphal) [1303044 1292300]
  - [crypto] api: Only abort operations on fatal signal (Herbert Xu) [1296014 1272314]
  - [crypto] testmgr: don't use interruptible wait in tests (Herbert Xu) [1296014 1272314]
  - [kernel] sched: add wait_for_completion_killable_timeout (Herbert Xu) [1296014 1272314]
  - [net] sctp: add routing output fallback (Xin Long) [1307073 1229124]
  - [net] sctp: fix dst leak (Xin Long) [1307073 1229124]
  - [net] sctp: fix src address selection if using secondary addresses (Xin Long) [1307073 1229124]
  - [net] sctp: reduce indent level on sctp_v4_get_dst (Xin Long) [1307073 1229124]
  - [scsi] hpsa: Update driver revision to RH5 (Joseph Szczypek) [1306192 1244959]
  - [scsi] hpsa: fix issues with multilun devices (Joseph Szczypek) [1306192 1244959]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.22.1.el6]
changelog:
  - [mm] always decrement anon_vma degree when the vma list is empty (Jerome Marchand) [1318364 1309898]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.23.1.el6]
changelog:
  - [x86] perf: Add more Broadwell model numbers (Jiri Olsa) [1320035 1242694]
  - [perf] perf/x86/intel: Remove incorrect model number from Haswell perf (Jiri Olsa) [1320035 1242694]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.24.1.el6]
changelog:
  - [sched] fix KABI break (Seth Jennings) [1314878 1230310]
  - [sched] fair: Test list head instead of list entry in throttle_cfs_rq (Seth Jennings) [1314878 1230310]
  - [sched] sched,perf: Fix periodic timers (Seth Jennings) [1314878 1230310]
  - [sched] sched: debug: Remove the cfs bandwidth timer_active printout (Seth Jennings) [1314878 1230310]
  - [sched] Cleanup bandwidth timers (Seth Jennings) [1314878 1230310]
  - [sched] sched: core: Use hrtimer_start_expires (Seth Jennings) [1314878 1230310]
  - [sched] fair: Fix unlocked reads of some cfs_b->quota/period (Seth Jennings) [1314878 1230310]
  - [sched] Fix potential near-infinite distribute_cfs_runtime loop (Seth Jennings) [1314878 1230310]
  - [sched] fair: Fix tg_set_cfs_bandwidth deadlock on rq->lock (Seth Jennings) [1314878 1230310]
  - [sched] Fix hrtimer_cancel/rq->lock deadlock (Seth Jennings) [1314878 1230310]
  - [sched] Fix cfs_bandwidth misuse of hrtimer_expires_remaining (Seth Jennings) [1314878 1230310]
  - [sched] Refine the code in unthrottle_cfs_rq (Seth Jennings) [1314878 1230310]
  - [sched] Update rq clock earlier in unthrottle_cfs_rq (Seth Jennings) [1314878 1230310]
  - [block] Fix q_suspended logic error for io submission (David Milburn) [1314209 1227342]
  - [block] nvme: No lock while DMA mapping data (David Milburn) [1314209 1227342]
  - [netdrv] ixgbe: finish ixgbe: Update ixgbe to use new vlan accleration (John Greene) [1315706 1249244]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.25.1.el6]
changelog:
  - [x86] nmi/64: Fix a paravirt stack-clobbering bug in the NMI code (Denys Vlasenko) [1259580 1259581] {CVE-2015-5157}
  - [x86] nmi/64: Switch stacks on userspace NMI entry (Denys Vlasenko) [1259580 1259581] {CVE-2015-5157}
  - [fs] anon_inodes implement dname (Aristeu Rozanski) [1322707 1296019]
  - [fs] xfs: Avoid pathological backwards allocation (Bill O'Donnell) [1320031 1302777]
  - [net] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event (Jacob Tanenbaum) [1297421 1297422] {CVE-2015-8767}
  - [net] udp: move logic out of udp[46]_ufo_send_check (Sabrina Dubroca) [1319276 1299975]
  - [net] af_unix: Guard against other == sk in unix_dgram_sendmsg (Jakub Sitnicki) [1315696 1309241]
  - [md] raid10: don't clear bitmap bit when bad-block-list write fails (Jes Sorensen) [1320863 1273546]
  - [md] raid1: don't clear bitmap bit when bad-block-list write fails (Jes Sorensen) [1320863 1273546]
  - [md] raid10: submit_bio_wait returns 0 on success (Jes Sorensen) [1320863 1273546]
  - [md] raid1: submit_bio_wait() returns 0 on success (Jes Sorensen) [1320863 1273546]
  - [md] crash in md-raid1 and md-raid10 due to incorrect list manipulation (Jes Sorensen) [1320863 1273546]
  - [md] raid10: ensure device failure recorded before write request returns (Jes Sorensen) [1320863 1273546]
  - [md] raid1: ensure device failure recorded before write request returns (Jes Sorensen) [1320863 1273546]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.26.1.el6]
changelog:
  - [kernel] revert "sched: core: Use hrtimer_start_expires" (Jiri Olsa) [1326043 1324318]
  - [kernel] Revert "Cleanup bandwidth timers" (Jiri Olsa) [1326043 1324318]
  - [kernel] revert "fair: Test list head instead of list entry in throttle_cfs_rq" (Jiri Olsa) [1326043 1324318]
  - [kernel] revert "sched, perf: Fix periodic timers" (Jiri Olsa) [1326043 1324318]
  - [kernel] Revert "fix KABI break" (Jiri Olsa) [1326043 1324318]


author: Tomas Hozza <thozza@redhat.com> - 32:9.8.2-0.43.rc1
changelog:
  - Fix excessive queries caused by DS chasing with stub zones when DNSSEC is not used (#1227189)
  - Added the fixed tarball with configuration to Sources (Related: #1223359)


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-97
changelog:
  - Resolves: rhbz#1367052 CVE-2015-5174 tomcat6: tomcat: URL Normalization issue
  - Resolves: rhbz#1367057 CVE-2016-0706 tomcat6: tomcat: directory disclosure
  - Resolves: rhbz#1367059 CVE-2016-0714 Security Manager bypass via persistence mechanisms
  - Resolves: rhbz#1367055 CVE-2015-5345 Directory disclosure


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-98
changelog:
  - Resolves: rhbz#1362211 CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368120 CVE-2016-6325 tomcat6: tomcat: tomcat writable config files allow privilege escalation


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-100
changelog:
  - Resolves: rhbz#1413588 CVE-2016-8745 tomcat6: tomcat: information disclosure due to incorrect Processor sharing
  - Resolves: rhbz#1402665 CVE-2016-6816 tomcat6: tomcat: HTTP Request smuggling vulnerability due to permitting invalid character in HTTP requests
  - Resolves: rhbz#1415824 The tomcat6 build is incompatible with the ECJ update


author: Tomas Hoger <thoger@redhat.com> 0:6.0.24-105
changelog:
  - Sync with 6.8 - add CVE-2016-6816 follow-up patches and revert unreleased fixes.
  - Related: rhbz#1397484 CVE-2016-6816 Adding system property from asfbz-60594 to allow use of some un-encoded characters
  - Related: rhbz#1397484 CVE-2016-6816 Resolving a security regression (2017-6056) caused by CVE-2016-6816
  - Reverts: rhbz#1415824 The tomcat6 build is incompatible with the ECJ update
  - Reverts: rhbz#1347778 The security manager doesn't work correctly


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-111
changelog:
  * Sync with 6.9
  - Resolves: rhbz#1498342 CVE-2017-12615 CVE-2017-12617 tomcat6: various flaws
  - Resolves: rhbz#1461291 CVE-2017-5664 tomcat6: tomcat: Security constrained bypass in error page mechanism
  - Resolves: rhbz#1441479 CVE-2017-5647 tomcat6: tomcat: Incorrect handling of pipelined requests when send file was used
  - Resolves: rhbz#1415824 The tomcat6 build is incompatible with the ECJ update


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-112
changelog:
  - Resolves: rhbz#1806803 CVE-2020-1938 tomcat6: tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-115
changelog:
  - Resolves: CVE-2020-9484 tomcat6: tomcat: Apache Tomcat Remote Code Execution via session persistence


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-642.7.1.el6]
changelog:
  - [net] netfilter: ip(6)t_REJECT: fix wrong transport header pointer in TCP reset (William Townsend) [1372266 1343816]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.8.1.el6]
changelog:
  - [fs] lockd: unregister notifier blocks if the service fails to come up completely (Scott Mayhew) [1375637 1346317]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.9.1.el6]
changelog:
  - [net] vlan: Fix FCOE_MTU support (Maurizio Lombardi) [1381592 1367250]
  - [s390] mm: fix asce_bits handling with dynamic pagetable levels (Steve Best) [1377472 1341758]
  - [powerpc] eeh: Block PCI configuration space access during EEH (Gustavo Duarte) [1379596 1216944]
  - [fs] ecryptfs: prevent mounts backed by procfs (Mateusz Guzik) [1347101 1347102] {CVE-2016-1583}
  - [s390] mm: four page table levels vs. fork (Hendrik Brueckner) [1341546 1316461] {CVE-2016-2143}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.10.1.el6]
changelog:
  - [scsi] fnic: Fix to cleanup aborted IO to avoid device being offlined by mid-layer (Maurizio Lombardi) [1382620 1341298]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.12.1.el6]
changelog:
  - [netdrv] mlx5: Fix RC transport send queue overhead computation (Slava Shwartsman) [1392799 1384212]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.13.1.el6]
changelog:
  - [net] Fix use after free in the recvmmsg exit path (Davide Caratti) [1390805 1390046] {CVE-2016-7117}
  - [net] vlan: Propagate MAC address to VLANs (Jarod Wilson) [1396479 1381585]
  - [net] tcp: fix use after free in tcp_xmit_retransmit_queue() (Mateusz Guzik) [1379527 1379529] {CVE-2016-6828}
  - [net] netfilter: x_tables: check for bogus target offset (Mateusz Guzik) [1351421 1351422] {CVE-2016-4998}
  - [net] netfilter: x_tables: validate e->target_offset early (Mateusz Guzik) [1351421 1351422] {CVE-2016-4998}
  - [net] netfilter: x_tables: make sure e->next_offset covers remaining blob size (Mateusz Guzik) [1351421 1351422] {CVE-2016-4998}
  - [net] ipv6: Don't change dst->flags using assignments (Marcelo Leitner) [1391974 1389478]
  - [scsi] libfc: Revert: use offload EM instance again (Chris Leech) [1392818 1383078]
  - [netdrv] sfc: report supported link speeds on SFP connections (Jarod Wilson) [1388168 1384621]
  - [drm] vmwgfx: respect 'nomodeset' (Rob Clark) [1392875 1342114]
  - [hv] avoid vfree() on crash (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: handle various crash scenarios (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: Support kexec on ws2012 r2 and above (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: Support handling messages on multiple CPUs (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: remove code duplication in message handling (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: avoid unneeded compiler optimizations in vmbus_wait_for_unload() (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: avoid wait_for_completion() on crash (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: avoid scheduling in interrupt context in vmbus_initiate_unload() (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: don't loose HVMSG_TIMER_EXPIRED messages (Vitaly Kuznetsov) [1385482 1333167]
  - [hv] vmbus: Force all channel messages to be delivered on CPU 0 (Vitaly Kuznetsov) [1385482 1333167]
  - [scsi] mpt3sas: Fix panic when aer correct error occurred (Frank Ramsay) [1396272 1374743]
  - [fs] nfs4.1: Remove a bogus BUG_ON() in nfs4_layoutreturn_done (Steve Dickson) [1385480 1376467]
  - [firmware] dmi_scan: DMI information in sysfs is missing on SMBIOS 3.0 based systems (Steve Best) [1393464 1353807]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.14.1.el6]
changelog:
  - [net] sctp: validate chunk len before actually using it (Hangbin Liu) [1399456 1399457] {CVE-2016-9555}
  - [netdrv] qlcnic: add wmb() call in transmit data path (Harish Patil) [1403143 1342659]
  - [kernel] audit: fix a double fetch in audit_log_single_execve_arg() (Paul Moore) [1359302 1359304] {CVE-2016-6136}
  - [fs] nfs: Kill fscache warnings when mounting without -ofsc (David Howells) [1399172 1353844]
  - [fs] nfs: Fix a compile issue when CONFIG_NFS_FSCACHE was undefined (David Howells) [1399172 1353844]
  - [fs] nfs: Don't pass mount data to nfs_fscache_get_super_cookie() (David Howells) [1399172 1353844]
  - [fs] nfsd: handle fileid wraparound (Dave Wysochanski) [1399174 1397552]
  - [scsi] hpsa: correct logical resets (Joseph Szczypek) [1399175 1083110]
  - [scsi] hpsa: generate a controller NMI (Joseph Szczypek) [1399175 1083110]
  - [scsi] hpsa: update driver version to 3.4.10-0-RH3 (Joseph Szczypek) [1399175 1083110]
  - [scsi] hpsa: Check for null devices in ioaccel submission patch (Joseph Szczypek) [1399175 1083110]
  - [scsi] hpsa: check for null device pointers (Joseph Szczypek) [1399175 1083110]
  - [scsi] hpsa: correct skipping masked peripherals (Joseph Szczypek) [1399175 1083110]
  - [scsi] hpsa: generalize external arrays (Joseph Szczypek) [1399175 1083110]
  - [fs] ext4: fix extent tree corruption caused by hole punch (Lukas Czerner) [1397808 1351798]
  - [hv] do not lose pending heartbeat vmbus packets (Vitaly Kuznetsov) [1397739 1378614]
  - [powerpc] ppc64: Fix incorrect return value from __copy_tofrom_user (Gustavo Duarte) [1398185 1387243]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-642.15.1.el6]
changelog:
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1424626 1424628] {CVE-2017-6074}


author: Tom Lane <tgl@redhat.com> 1.3-7
changelog:
  - Apply two upstream fixes for crasher bugs
  Resolves: #609389
  - Fix FTBFS: ImplicitDSOLinking (see Fedora bug 564783)


author: Tom Lane <tgl@redhat.com> 1.3-8
changelog:
  - Apply patches for CVE-2009-5030, CVE-2012-3358
  Resolves: #831562
  - Include -DCMAKE_INSTALL_LIBDIR in cmake call; fixes FTBFS with recent
    versions of cmake


author: Petr Hracek <phracek@redhat.com> 1.3-10
changelog:
  - Apply patch for CVE-2013-6054 CVE-2013-1447 CVE-2013-6045 CVE-2013-6052 
  Resolves: #1038987 CVE-2013-6054 CVE-2013-1447 CVE-2013-6045 CVE-2013-6052


author: Nikola Forró <nforro@redhat.com> - 1.3-16
changelog:
  - Revert previous changes in patch for CVE-2016-5159
  - Fix double free in patch for CVE-2016-5139
  - Fix memory leaks and invalid read in cio_bytein
    Related: #1419775


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-49
changelog:
  - Require the matching version of ding-libs
  - Related: rhbz#1374813 - SSSD fails to process GPO from Active Directory.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-50
changelog:
  - Related: rhbz#1369921 - Members of nested netgroups configured in IdM
                            cannot be seen by getent on clients


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-51
changelog:
  - Revert the ding-libs requirement
  - Related: rhbz#1374813 - SSSD fails to process GPO from Active Directory.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-54
changelog:
  - Apply several more smartcard-related patches.
  - Related: rhbz#1300421 - Screen locks and smart card is removed - must
                            show a message to insert the correct smartcard


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-55
changelog:
  - Resolves: rhbz#1415785 - ldap_child does not remove temporary files
                             when it's killed with  SIGTERM


author: Lukas Slebodnik <lslebodn@redhat.com> - 1.13.3-56
changelog:
  - Resolves: rhbz#1404697 - SSSD does not skip GPO if no gpcFunctionalityVersion present
  - Resolves: rhbz#1374813 - SSSD fails to process GPO from Active Directory


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-57
changelog:
  - Resolves: rhbz#1473005 - The originalMemberOf attribute disappears from
                             the cache, causing intermittent HBAC issues


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-58
changelog:
  - Resolves: rhbz#1534618 - ABRT crash - /usr/libexec/sssd/sssd_nss
                             [rhel-6.9.z]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-641.el6]
changelog:
  - [netdrv] ixgbe: restore proper CHECKSUM_UNNECESSARY behavior for LRO packets (Neil Horman) [1318426]
  - [netdrv] revert " net/mlx5_core: Add pci error handlers to mlx5_core driver" (Don Dutile) [1324599]
  - [x86] kernel: espfix not working for 32-bit KVM paravirt guests (Jacob Tanenbaum) [1172767] {CVE-2014-8134}


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-642.el6]
changelog:
  - [scsi] fc: revert - ensure scan_work isn't active when freeing fc_rport (Ewan Milne) [1326447]
  - [netdrv] ixgbe: Update ixgbe driver to use __netdev_pick_tx in ixgbe_select_queue (John Greene) [1310749]
  - [netdrv] mlx5e: Fix adding vlan rule with vid zero twice (Kamal Heib) [1322809]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.1.1.el6]
changelog:
  - [net] tcp/dccp: warn user for preferred ip_local_port_range (Florian Westphal) [1333571 1314774]
  - [net] tcp/dccp: try to not exhaust ip_local_port_range in connect() (Florian Westphal) [1333571 1314774]
  - [net] tcp: improve REUSEADDR/NOREUSEADDR cohabitation (Florian Westphal) [1333571 1314774]
  - [base] firmware: Add lock for firmware devices (Lyude Paul) [1333572 1309875]
  - [net] netlabel: fix a problem with netlbl_secattr_catmap_setrng (Paul Moore) [1333579 1321174]
  - [md] dm: only initialize the request_queue once (Mike Snitzer) [1333575 1328329]
  - [md] raid10: include bio_end_io_list in nr_queued to prevent freeze_array hang (Jes Sorensen) [1333576 1320595]
  - [md] raid1: include bio_end_io_list in nr_queued to prevent freeze_array hang (Jes Sorensen) [1333576 1320595]
  - [md] raid5: Compare apples to apples (or sectors to sectors) (Jes Sorensen) [1333581 1295969]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.2.1.el6]
changelog:
  - [sched] Revert "kernel: sched: Cure load average vs NO_HZ woes" (Rafael Aquini) [1343015 1326373]
  - [sched] Revert "kernel: sched: Cure more NO_HZ load average woes" (Rafael Aquini) [1343015 1326373]
  - [sched] Revert "kernel: sched: Move sched_avg_update to update_cpu_load" (Rafael Aquini) [1343015 1326373]
  - [sched] Revert "kernel: sched: Fix nohz load accounting -- again" (Rafael Aquini) [1343015 1326373]
  - [fs] lockd: Don't try to register/unregister callbacks on the inet6addr_chain if the ipv6 module isn't loaded (Scott Mayhew) [1341496 1336483]
  - [fs] nfsd: Don't try to register/unregister callbacks on the inet6addr_chain if the ipv6 module isn't loaded (Scott Mayhew) [1341496 1336483]
  - [isdn] avoid calling tty_ldisc_flush() in atomic context (Sabrina Dubroca) [1337443 1328115]
  - [redhat] Update dracut dependency to pull in ecb module (Herbert Xu) [1334431 1315832]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.3.1.el6]
changelog:
  - [infiniband] security: Restrict use of the write interface (Don Dutile) [1332547 1332548] {CVE-2016-4565}


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.4.1.el6]
changelog:
  - [ipmi] Remove smi_msg from waiting_rcv_msgs list before handle_one_recv_msg() (David Arcari) [1355980 1347189]
  - [fs] ext4: Remove useless spinlock in ext4_getattr() (Lukas Czerner) [1355981 1315933]
  - [net] tcp: increase size at which tcp_bound_to_half_wnd bounds to > TCP_MSS_DEFAULT (Davide Caratti) [1354446 1349776]
  - [net] tcp: Prevent overzealous packetization by SWS logic (Davide Caratti) [1354446 1349776]
  - [fs] configfs: fix race between dentry put and lookup (Robert S Peterson) [1353828 1333448]
  - [drm] move idr2 implementation to lib (Milos Vyletel) [1353827 1316790]
  - [fs] cifs: Create dedicated keyring for spnego operations (Scott Mayhew) [1351670 1267754]
  - [infiniband] srp: Fix backport error in ib_srp::srp_queuecommand (Don Dutile) [1348062 1321094]
  - [fs] gfs2: don't set rgrp gl_object until it's inserted into rgrp tree (Robert S Peterson) [1347539 1344740]
  - [sched] avoid kernel panic during power off (Frank Ramsay) [1343894 1313035]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.5.1.el6]
changelog:
  - [scsi] megaraid_sas: Do not fire MR_DCMD_PD_LIST_QUERY to controllers which do not support it (Tomas Henzl) [1359039 1352826]
  - [scsi] libfc: sanity check cpu number extracted from xid (Chris Leech) [1359036 1351356]
  - [security] keys: potential uninitialized variable (Mateusz Guzik) [1345945 1345946] {CVE-2016-4470}
  - [fs] gfs2: Lock holder cleanup (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Large-filesystem fix for 32-bit systems (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Get rid of gfs2_ilookup (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Fix gfs2_lookup_by_inum lock inversion (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Initialize iopen glock holder for new inodes (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Release iopen glock in gfs2_create_inode error cases (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Wait for iopen glock dequeues (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Re-add an omission from upstream (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Eliminate parameter non_block on gfs2_inode_lookup (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Don't filter out I_FREEING inodes anymore (Robert S Peterson) [1359038 1238861]
  - [fs] gfs2: Check if iopen is held when deleting inode (Robert S Peterson) [1359037 1173286]
  - [fs] gfs2: Don't do glock put when inode creation fails (Robert S Peterson) [1359037 1173286]
  - [fs] gfs2: Prevent delete work from occurring on glocks used for create (Robert S Peterson) [1359037 1173286]
  - [fs] gfs2: Always use iopen glock for gl_deletes (Robert S Peterson) [1359037 1173286]
  - [fs] gfs2: Update master statfs buffer with sd_statfs_spin locked (Robert S Peterson) [1359037 1173286]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-642.6.1.el6]
changelog:
  - [net] tcp: make challenge acks less predictable (Florian Westphal) [1355606 1355607] {CVE-2016-5696}
  - [fs] sunrpc: move NO_CRKEY_TIMEOUT to the auth->au_flags (Scott Mayhew) [1366962 1294939]
  - [usbhid] hiddev: validate num_values for HIDIOCGUSAGES, HIDIOCSUSAGES commands (Yauheni Kaliuta) [1359999 1360008] {CVE-2016-5829}


author: Petr Lautrbach <plautrba@redhat.com> 2.1.23-14
changelog:
  - release the GSSAPI server credential handle immediately after the
    GSSAPI security context is established (#825863)


author: Petr Lautrbach <plautrba@redhat.com> 2.1.23-15
changelog:
  - don't use " for saslauth user's description (#1081445)
  - backport the ad_compat option (#994242)
  - fixed a memory leak in the client side DIGEST-MD5 code (#838628)


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.2.1.el6]
changelog:
  - [x86] entry/64: Don't use IST entry for #BP stack (Waiman Long) [1596113] {CVE-2018-10872}
  - [fs] gfs2: Flush delayed work earlier in gfs2_inode_lookup (Andreas Grunbacher) [1506281]
  - [mm] mempolicy: fix use after free when calling get_mempolicy (Augusto Caringi) [1576757] {CVE-2018-10675}
  - [mm] Fix NULL pointer dereference in dequeue_hwpoisoned_huge_page() (Larry Woodman) [1381653]
  - [fs] NFSv4.1: Fix up replays of interrupted requests (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Simplify struct nfs4_sequence_args too (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Label each entry in the session slot tables with its slot number (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Shrink struct nfs4_sequence_res by moving the session pointer (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: nfs4_alloc_slots doesn't need zeroing (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: clean up nfs4_recall_slot to use nfs4_alloc_slots (Benjamin Coddington) [1553423]
  - [fs] NFSv4.1: Fix a NFSv4.1 session initialisation regression (Benjamin Coddington) [1553423]
  - [scsi] ipr: Fix sync scsi scan (Gustavo Duarte) [1572310]
  - [scsi] ipr: Wait to do async scan until scsi host is initialized (Gustavo Duarte) [1572310]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.3.1.el6]
changelog:
  - [infiniband] ib/iser: Rewrite bounce buffer code path (Don Dutile) [1585312]
  - [sound] alsa: pcm: prevent UAF in snd_pcm_info (CVE-2017-0861) (Jaroslav Kysela) [1565188] {CVE-2017-0861}
  - [sound] alsa: seq: Fix racy pool initializations (Jaroslav Kysela) [1550176] {CVE-2018-7566}
  - [sound] alsa: seq: Fix use-after-free at creating a port (Jaroslav Kysela) [1503383] {CVE-2017-15265}
  - [sound] alsa: seq: Make ioctls race-free (Jaroslav Kysela) [1537452] {CVE-2018-1000004}
  - [mm] reduce total RAM held in per-CPU pvecs by flushing them on compound/THP page arrival (Larry Woodman) [1575819]
  - [usb] acm: fix the computation of the number of data bits (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [misc] spectre: fix gadgets found by smatch scanner, part 2 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] kvm/vmx: Remove barrier_nospec() in slot_largepage_idx() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kvm] Remove memory alias support (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [misc] spectre: fix gadgets found by smatch scanner (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: rme9652: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: opl3: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: hda: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: seq: oss: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: seq: oss: Fix unbalanced use lock for synth MIDI device (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [net] atm: Fix potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] posix-timers: Protect posix clock array access against speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] sys.c: fix potential Spectre v1 issue (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] sched/autogroup: Fix possible Spectre-v1 indexing for sched_prio_to_weight[] (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [kernel] perf/core: Fix possible Spectre-v1 indexing for ->aux_pages[] (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [ipc] sysvipc/sem: mitigate semnum index against spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [sound] alsa: control: Hardening for potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [media] dvb_ca_en50221: prevent using slot_info for Spectre attacs (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - media] dvb_ca_en50221: sanity check slot number from userspace (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [atm] zatm: Fix potential Spectre v1 (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] perf: Fix possible Spectre-v1 indexing for x86_pmu::event_map() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] perf: Fix possible Spectre-v1 indexing for hw_perf_event cache_* (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [net] nl80211: Sanitize array index in parse_txq_params (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] vfs, fdtable: Prevent bounds-check bypass via speculative execution (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] syscall: Sanitize syscall table de-references under speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [powerpc] Use barrier_nospec in copy_from_user() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Introduce barrier_nospec for other arches (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Introduce barrier_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] spectre_v1: Disable compiler optimizations over array_index_mask_nospec() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Implement array_index_mask_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [documentation] Document array_index_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Include <asm/barrier.h> dependency (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Allow index argument to have const-qualified type (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Kill array_index_nospec_mask_check() (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] nospec: Move array_index_nospec() parameter checking into separate macro (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [include] array_index_nospec: Sanitize speculative array de-references (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] get_user: Use pointer masking to limit speculation (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] uaccess: Use __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] Introduce __uaccess_begin_nospec() and uaccess_try_nospec (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] reorganize SMAP handling in user space accesses (Josh Poimboeuf) [1589032] {CVE-2018-3693}
  - [x86] uaccess: Tell the compiler that uaccess is unlikely to fault (Josh Poimboeuf) [1589032] {CVE-2018-3693}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.4.1.el6]
changelog:
  - [kernel] cpu/hotplug: Enable 'nosmt' as late as possible (Frantisek Hrbata) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Simplify p[g4um]d_page() macros (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/mm: Fix regression with huge pages on PAE (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Fix pud/pmd interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Add pud/pmd mask interfaces to handle large PAT bit (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [x86] x86/asm: Move PUD_PAGE macros to page_types.h (Josh Poimboeuf) [1593376] {CVE-2018-3620}
  - [net] tcp: detect malicious patterns in tcp_collapse_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: avoid collapses in tcp_prune_queue() if possible (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: free batches of packets in tcp_prune_ofo_queue() (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rb_to_skb() and other rb tree helpers (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: fix a stale ooo_last_skb after a replace (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: use an RB tree for ooo receive queue (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] add rbnode to struct sk_buff (Florian Westphal) [1611376] {CVE-2018-5390}
  - [net] tcp: refine tcp_prune_ofo_queue() to not drop all packets (Florian Westphal) [1611376] {CVE-2018-5390}
  - [x86] syscall: Fix regression when using the last syscall (process_vm_writev) (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [x86] syscall: Fix regression on strace and stap (Lauro Ramos Venancio) [1589032] {CVE-2018-3693}
  - [kvm] VMX: Fix host GDT.LIMIT corruption (CVE-2018-10301) (Paolo Bonzini) [1601851] {CVE-2018-10901}
  - [x86] Initialize __max_smt_threads to 1 (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: detect SMT disabled by BIOS (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Add topology_max_smt_threads() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix incorrect error return code in vm_insert_pfn() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Initialize the vmx_l1d_flush_pages' content (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Don't flush L1D cache if VMENTER_L1D_FLUSH_NEVER (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Take out the unused nosmt module parameter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm/dump_pagetables: Add a check_l1tf debugfs file (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries aganst L1TF for 32-bit PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Make flush_l1d visible in /proc/cpuinfo (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: protect _PAGE_FILE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [Documentation] Add section about CPU vulnerabilities (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs, kvm: Introduce boot-time control of L1TF mitigations (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Set CPU_SMT_NOT_SUPPORTED early (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Expose SMT control init function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Allow runtime control of L1D flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Serialize L1D flush parameter setter (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Move l1tf setup function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] l1tf: Handle EPT disabled state proper (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] kvm: Drop L1TF MSR list approach (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] litf: Introduce vmx status variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Online siblings when SMT control is turned on (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Use MSR save list for IA32_FLUSH_CMD if required (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Extend add_atomic_switch_msr() to allow VMENTER only MSRs (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Separate the VMX AUTOLOAD guest/host number accounting (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add find_msr() helper function (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Split the VMX MSR LOAD structures to have an host/guest numbers (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush logic (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Make indirect call speculation safe (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] VMX: Enable acknowledge interupt on vmexit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D MSR based flush (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add L1D flush algorithm (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM/VMX: Add module argument for L1TF mitigation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] KVM: Warn user if KVM is loaded SMT and L1TF CPU bug being present (Waiman Long) [1593376] {CVE-2018-3620}
  - [kvm] x86: Introducing kvm_x86_ops VM init/destroy hooks (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Boot HT siblings at least once (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] Revert "x86/apic: Ignore secondary threads if nosmt=force" (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Fix up pte->pfn conversion for PAE (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Move TOPOEXT reenablement before reading smp_num_siblings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpufeatures: Add detection of L1D cache flush support. (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Extend 64bit swap file size limit (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] apic: Ignore secondary threads if nosmt=force (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] CPU/AMD: Do not check CPUID max ext level before parsing SMP info (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/intel: Evaluate smp_num_siblings early (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/topology: Provide detect_extended_topology_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/common: Provide detect_ht_early() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu/AMD: Remove the pointless detect_ht() call (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Remove the pointless CPU printout (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Provide knobs to control SMT (Waiman Long) [1593376] {CVE-2018-3620}
  - [kernel] cpu/hotplug: Split do_cpu_down() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] topology: Provide topology_smt_supported() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] smp: Provide topology_is_primary_thread() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Move the l1tf function and define pr_fmt properly (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Limit swap file size to MAX_PA/2 (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Add sysfs reporting for l1tf (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect PROT_NONE PTEs against speculation (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Protect swap entries against L1TF (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Change order of offset/type in swap entry (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] speculation/l1tf: Increase 32bit PAE __PHYSICAL_PAGE_SHIFT (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] cpu: Fix incorrect vulnerabilities files function prototypes (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] bugs: Export the internal __cpu_bugs variable (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] spec_ctrl: sync with upstream cpu_set_bug_bits() (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] intel-family.h: Add GEMINI_LAKE SOC (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Fix swap entry comment and macro (Waiman Long) [1593376] {CVE-2018-3620}
  - [x86] mm: Move swap offset/type up in PTE to work around erratum (Waiman Long) [1593376] {CVE-2018-3620}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.5.1.el6]
changelog:
  - [s390] dasd: fix IO error for newly defined devices (Hendrik Brueckner) [1574448]
  - [s390] dasd: fix failing path verification (Hendrik Brueckner) [1581684]
  - [s390] qeth: on channel error, reject further cmd requests (Hendrik Brueckner) [1562009]
  - [s390] qdio: fix access to uninitialized qdio_q fields (Hendrik Brueckner) [1581685]
  - [powerpc] stf-barrier: update (rfi_)enabled_flush_types as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update debugfs as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update handle_ssbd() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update stf_barrier_enable() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: add cpu_show_spec_store_bypass() as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: add comment as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: move code from setup_64.c to security.c as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: move code from setup.h to security_features.h as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update fallback routine as in upstream (Gustavo Duarte) [1585299]
  - [powerpc] stf-barrier: update entry barrier slot as in upstream (Gustavo Duarte) [1585299]
  - [x86] Add host_initiated check in reading MSR_AMD64_VIRT_SPEC_CTRL (Wei Huang) [1608576]
  - [x86] KVM: pass host_initiated to functions that read MSRs (Wei Huang) [1608576]
  - [fs] gfs2: Special-case rindex for gfs2_grow (Robert S Peterson) [1384184]
  - [fs] Revert "[fs] gfs2: Special case the rindex in gfs2_write_alloc_required()" (Robert S Peterson) [1384184]
  - [net] ip: process in-order fragments efficiently (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: add helpers to process in-order fragments faster. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ipv6: defrag: drop non-last frags smaller than min mtu (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: use rb trees for IP frag queue. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] ip: discard IPv4 datagrams with overlapping segments. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] net: modify skb_rbtree_purge to return the truesize of all purged skbs. (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] net: speed up skb_rbtree_purge() (Stefano Brivio) [1613925] {CVE-2018-5391}
  - [net] skbuff: Rename RHEL6 version of skb_tree_purge() to skb_tree_purge_sk() (Stefano Brivio) [1613925] {CVE-2018-5391}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.6.1.el6]
changelog:
  - [x86] set __max_smt_threads for 1 core systems (Prarit Bhargava) [1623255]
  - [md] dm rq: fix a race condition in rq_completed() (Ming Lei) [1574568]
  - [scsi] scsi_transport_fc: Hold queue lock while calling blk_run_queue_async() (Ming Lei) [1574568]
  - [block] Avoid scheduling delayed work on a dead queue (Ming Lei) [1574568]
  - [block] Avoid that request_fn is invoked on a dead queue (Ming Lei) [1574568]
  - [block] Let blk_drain_queue() caller obtain the queue lock (Ming Lei) [1574568]
  - [block] Rename queue dead flag (Ming Lei) [1574568]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.7.1.el6]
changelog:
  - [s390] cio: update chpid descriptor after resource accessibility event (Hendrik Brueckner) [1574471]
  - [s390] af_iucv: enable control sends in case of SEND_SHUTDOWN (Hendrik Brueckner) [1559048]
  - [s390] qeth: repair SBAL elements calculation (Hendrik Brueckner) [1559021]
  - [kvm] VMX: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1628796]
  - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1628796]
  - [x86] KVM: VMX: skip L1TF flush on VM-entry if EPT is disabled (Marcelo Tosatti) [1616397]
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625976] {CVE-2018-14634}
  - [fs] exec.c: account for argv/envp pointers (Yauheni Kaliuta) [1625976] {CVE-2018-14634}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.8.1.el6]
changelog:
  - [block] fix warning on lockdep_assert_held(q->queue_lock) (Ming Lei) [1624747]
  - [kvm] vmx: fix vmwrite to invalid VMCS (Radim Krcmar) [1602011]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.10.1.el6]
changelog:
  - [net] sctp: sctp should release assoc when sctp_make_abort_user return NULL in sctp_close (Xin Long) [1646405]
  - [x86] kvm: Update cpuid properly when CR4.OSXAVE or CR4.PKE is changed (Wei Huang) [1425051]
  - [mm] mempolicy: migrate_to_node should only migrate to node (Rafael Aquini) [1577094]
  - [mm] vmscan: avoid possible deadlock caused by too_many_isolated() (Rafael Aquini) [1577094]
  - [fs] seqfile: always allow oom killer (Rodrigo Freire) [1632434]
  - [fs] seq_file: fallback to vmalloc instead of oom kill processes (Rodrigo Freire) [1632434]
  - [fs] seq_file: fallback to vmalloc allocation (Rodrigo Freire) [1632434]
  - [fs] proc/stat: convert to single_open_size() (Rodrigo Freire) [1632434]
  - [fs] seq_file: always clear m->count when we free m->buf (Rodrigo Freire) [1632434]
  - [fs] seq_file: single_open_size() new helper (Rodrigo Freire) [1632434]
  - [fs] stat: Use size_t for sizes instead of unsigned (Rodrigo Freire) [1632434]
  - [fs] proc: speed up /proc/stat handling (Rodrigo Freire) [1632434]


author: David Tardon <dtardon@redhat.com> - 1:4.2.8.2-11
changelog:
  - Resolves: rhbz#1223696 some labels in print dialog are not translated, even
    though the translations exist


author: Andreas Schneider <asn@redhat.com> - 3.6.23-34
changelog:
  - resolves: #1327697 - Fix netlogon credential checks
  - resolves: #1327746 - Fix dcerpc trailer verificaton


author: Andreas Schneider <asn@redhat.com> - 3.6.23-37
changelog:
  - resolves: #1380151 - Fix memory leak in idmap_ad module
  - resolves: #1333561 - Fix smbclient connection issues to DFS shares
  - resolves: #1372611 - Allow ntlmsssp session key setup without signing
                         (Workaround for broken NetApp and EMC NAS)


author: Andreas Schneider <asn@redhat.com> - 3.6.23-38
changelog:
  - resolves: #1347843 - Fix RPC queryUserList returning NO_MEMORY for
                         empty list


author: Andreas Schneider <asn@redhat.com> - 3.6.23-42
changelog:
  - resolves: #1428835 - Performance issues with vfs_dirsort and extended
                         attributes


author: Jiri Popelka <jpopelka@redhat.com> - 1:1.4.2-73
changelog:
  - Fix failover backend options parsing (bug #1231322).
  - The socket backend could go into an infinite loop with certain printers
    (bug #1276772, STR #3622)
  - dnssd backend: don't crash if avahi gives a callback with no TXT record
    (bug #1269305)
  - Don't unload jobs that couldn't be saved (bug #1283003, STR #4742).


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.4.2-76
changelog:
  - 1344782 - Banner pages do not show time-at-creation or time-at-processing
  - 1219571 - Invalid memory accesses lead to crash when configured class has implicit class as first member


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.4.2-77
changelog:
  - 1099617 - Using "lp -o orientation-requested=6" with a PDF file has no effect.
  - 1268131 - Printing PDF with fit-to-page doesn't take printer HW margins into account


author: Jiri Popelka <jpopelka@redhat.com> - 12:4.1.1-50.P1
changelog:
  - Lease table overflow crash. (#1133917)
  - Add ignore-client-uids option. (#1196768)
  - dhclient-script: it's OK if the arping reply comes from our system. (#1204095)
  - VLAN ID is only bottom 12-bits of TCI. (#1259552)
  - dhclient: Make sure link-local address is ready in stateless mode. (#1263466)
  - dhclient-script: make_resolv_conf(): Keep old nameservers
    if server sends domain-name/search, but no nameservers. (#1269595)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.03.39-1
changelog:
  - remount /proc to set attributes from fstab #984003
  - print something when arping is detecting colliding ip addresses
  - try dhcpv6 after v4 failed
  - Allow dhclient configuration files for DHCPv6 as well. (#815676)
  - ifdown: don't call nmcli on interface that is alread down
  - call flush addresses with scope global
  - init: inform users about .override files in .conf files
  - netfs: do not force NFS exports to be mounted before _netdev mounts
  - set net.ipv6.conf..autoconf in ifup-ipv6
  - mention rule6 files
  - securetty: check if the device is in the file before attempting to write to it
  - Process rule6-* for sit devices (#840009)
  - Killproc -d should parse same values as sleep
  - Make killproc more granular when delay is passed. (#428029, <xjakub@fi.muni.cz>)
  - bonding: set master up before slaves
  - Fix greps to correctly handle comments and quotation (#915659)


author: Lukas Nykryn <lnykryn@redhat.com> - 9.03.40-1
changelog:
  - sync disks before halt (#1006294)
  - provide KVM guest count and limit info message (#1014731)
  - add ability to disable LVM activation on boot (#1015065)


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.03.41-1
changelog:
  - netfs: implicitly handle glusterfs as a network filesystemd
  - init.d/functions: check parent dir of pid file for accessibility
  - ifup-eth: some options for bridge can be applied after the bridge is up
  - rc.sysinit: apply sysctl settings before starting udev
  - ifup: add possibility to specify value for -w parameter of arping
  - ifup-tunnel: call ifup-ipv6 in the end
  - pids_var_run: handle '(deleted)'
  - require correct version of upstart
  - rc.sysinit: use 'vgchange --ignoreskippedcluster'
  - during install do not create /var/lib/random-seed if /dev/urandom does not exist
  - rc.sysinit: increase the saved random-seed to 4K (#1023471)
  - umount-loop: make sure that we don't kill our own process
  - umount-loop: don't use xargs
  - ifup-eth: remove ipx relic (#1028135)
  - init.d/functions: add -b optin to status and killproc (#1047948)
  - remove duplicit then


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.03.42-1
changelog:
  - ipcalc: -c allow netmask
  - ipcalc: parse prefix more safely
  - vi.po: fix parentheses
  - network-functions: handle BONDING_OPTS better
  - custom naming for VLAN devices
  - bonding: match whole name of interface
  - network-functions: ETHTOOL_DELAY introduction patch
  - ifup-wireless: add support for wowlan
  - Remove NETWORKING_IPV6 from sysconfig.txt (#918622)
  - bridging: add possibility to set prio and ageing


author: Lukáš Nykrýn - 9.03.43-1
changelog:
  - ifup-aliases: arpcheck - check for parent operstate and carrier
  - ifdown: don't wait for aliases
  - hotplug: don't call ifup when new vlan appears
  - ifup-wireless: add support for wowlan (second part)
  - readonly-root: remount rpc_pipefs if readonly-root is used


author: Andreas Schneider <asn@redhat.com> - 3.6.24-44
changelog:
  - resolves: #1451105 - Fix trusted domain handling in winbind
  - resolves: #1431000 - Fix crash while trying to authenticate with a disabled
                         account
  - resolves: #1467395 - Add 'winbind request timeout' option


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-25
changelog:
  - Resolves: rhbz#1111528 - Expired shadow policy user(shadowLastChange=0)
                             is not prompted for password change


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-26
changelog:
  - Resolves: rhbz#1130017 - Saving group membership fails if provider is AD,
                             POSIX attributes are used and primary group contains
                             the user as a member


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-28
changelog:
  - Resolves: rhbz#1125187 - simple_allow_groups does not lookup groups from
                             other AD domains


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-29
changelog:
  - Resolves: rhbz#1103487 - CVE-2014-0249 - sssd: incorrect expansion of group
                             membership when encountering a non-POSIX group


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-30.1
changelog:
  - Resolves: rhbz#1146198 - Password expiration policies are not being
                             enforced by SSSD


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-30.3
changelog:
  - Resolves: rhbz#1165074 - RHEL6.6 sssd (1.11) doesn't return all group
                             memberships against an IPA server


author: Jakub Hrozek <jhrozek@redhat.com> - 1.11.6-30.4
changelog:
  - Relax the libldb requirements
  - Backport removal of unused signal functions to avoid conflict with Samba
  - Resolves: rhbz#1201666 - Relax the libldb requirements to unblock RH Storage


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.0.0-4
changelog:
  - Fix a heap-based buffer overflow vulnerability leading to
    remote code execution, CVE-2019-5544
    Resolves: #1788447


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.117-1
changelog:
  - Update to latest upstream release with various fixes and
    enhancementsdetailed in WHATS_NEW and WHATS_NEW_DM file.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.118-1
changelog:
  - Fix LV processing with selection to always do the selection on initial state.
  - Store metadata size + checksum in lvmcache and add struct lvmcache_vgsummary.
  - Remove inaccessible clustered PVs from 'pvs -a'.
  - Don't invalidate cached orphan information while global lock is held.
  - Avoid rescan of all devices when requested pvscan for removed device.
  - Measure configuration timestamps with nanoseconds when available.
  - Disable lvchange of major and minor of pool LVs.
  - Fix pvscan --cache to not scan and read ignored metadata areas on PVs.
  - Disallow vgconvert from changing metadata format when lvmetad is used.
  - Don't do a full read of VG when creating a new VG with an existing name.
  - Reduce amount of VG metadata parsing when looking for vgname on a PV.
  - Avoid reparsing same metadata when reading same metadata from multiple PVs.
  - Save extra device open/close when scanning device for size.
  - Fix seg_monitor field to report status also for mirrors and thick snapshots.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.118-2
changelog:
  - Don't skip invalidation of cached orphans if vg write lck is held (2.02.118).
  - Add --enable-halvm and --disable-halvm options to lvmconf script.
  - Add --services, --mirrorservice and --startstopservices option to lvmconf.
  - Use proper default value of global/use_lvmetad when processing lvmconf script.
  - Set correct vgid when updating cache when writing PV metadata.
  - Don't silently accept lvcreate -m with raid4/5/6.
  - Add A_PARTITION_BY_TAGS set when allocated areas should not share tags.
  - Respect allocation/cling_tag_list during intial contiguous allocation.
  - Don't skip invalidation of cached orphans if vg write lck is held (2.02.118).
  - Log relevant PV tags when using cling allocation.


author: Petr Menšík <pemensik@redhat.com> - 32:9.8.2-0.67.rc1
changelog:
  - Change EDNS flags only after successful query (#1416035)
  - Fix crash in ldap driver at bind-sdb stop (#1426626)


author: Petr Menšík <pemensik@redhat.com> - 32:9.8.2-0.68.rc1.4
changelog:
  - Limit number of queries triggered by a request (CVE-2020-8616)
  - Fix invalid tsig request (CVE-2020-8617)


author: Pavel Šimerda <psimerda@redhat.com> - 32:9.8.2-0.37.rc1
changelog:
  - Resolves: 1215687 - DNS resolution failure in high load environment with
    SERVFAIL and "out of memory/success" in the log


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.11-19.b12
changelog:
  - fixed desktop icons
  - Icon set to java-1.8.0
  - Development removed from policy tool
  - Resolves: rhbz#1081073


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.20-1.b26
changelog:
  - updated to u20-b26
  - adapted patch9999 enableArm64.patch
  - adapted patch100 s390-java-opts.patch
  - adapted patch102 size_t.patch
  - removed upstreamed patch  0001-PPC64LE-arch-support-in-openjdk-1.8.patch
  - adapted  system-lcms.patch
  - removed patch8 set-active-window.patch
  - removed patch9 javadoc-error-jdk-8029145.patch
  - removed patch10 javadoc-error-jdk-8037484.patch
  - removed patch99 applet-hole.patch - itw 1.5.1 is able to ive without it
  - Resolves: rhbz#1081073


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.20-3.b26
changelog:
  - fixed headless (policytool moved to normal)
   - jre/bin/policytool added to not headless exclude list
  - updated aarch694 source
  - ppc64le synced from fedora
  - Resolves: rhbz#1081073


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.25-3.b17
changelog:
  - added patch12,removeSunEcProvider-RH1154143
  - xdump excluded from ppc64le (rh1156151)
  - Add check for src.zip completeness. See RH1130490 (by sgehwolf@redhat.com)
  - Resolves: RHBZ#1154948


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.25-4.b17
changelog:
  - updated aarch64 sources
  - epoch synced to 1
  - all ppcs excluded from classes dump(1156151)
  - Resolves: rhbz#1173706


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.149
changelog:
  - Remove gconv transliteration loadable modules support (CVE-2014-5119,
    - _nl_find_locale: Improve handling of crafted locale names (CVE-2014-0475,


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 2.12-1.149.7
changelog:
  - Fix invalid file descriptor reuse while sending DNS query
    (#1207995, CVE-2013-7423).
  - Fix buffer overflow in gethostbyname_r with misaligned buffer
    (#1209375, CVE-2015-1781).


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.497.el6
changelog:
  - kvm-vmstate-fix-breakage-by-7e72abc382b700a72549e8147bde.patch [bz#1294941]
  - Resolves: bz#1294941
    (QEMU crash on snapshot revert when using Cirrus)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.498.el6
changelog:
  - kvm-virtio-introduce-virtqueue_unmap_sg.patch [bz#1392520]
  - kvm-virtio-introduce-virtqueue_discard.patch [bz#1392520]
  - kvm-virtio-decrement-vq-inuse-in-virtqueue_discard.patch [bz#1392520]
  - kvm-balloon-fix-segfault-and-harden-the-stats-queue.patch [bz#1392520]
  - kvm-virtio-balloon-discard-virtqueue-element-on-reset.patch [bz#1392520]
  - kvm-virtio-zero-vq-inuse-in-virtio_reset.patch [bz#1392520]
  - kvm-PATCH-1-4-e1000-pre-initialize-RAH-RAL-registers.patch [bz#1300626]
  - kvm-net-update-nic-info-during-device-reset.patch [bz#1300626]
  - kvm-net-e1000-update-network-information-when-macaddr-is.patch [bz#1300626]
  - kvm-net-rtl8139-update-network-information-when-macaddr-.patch [bz#1300626]
  - Resolves: bz#1300626
    (e1000/rtl8139: qemu mac address can not be changed via set the hardware address in guest)
  - Resolves: bz#1392520
    ([RHEL6.9] KVM guest shuts itself down after 128th reboot)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.499.el6
changelog:
  - kvm-rename-qemu_aio_context-to-match-upstream.patch [bz#876993]
  - kvm-block-stop-relying-on-io_flush-in-bdrv_drain_all.patch [bz#876993]
  - kvm-block-add-bdrv_drain.patch [bz#876993]
  - kvm-block-avoid-very-long-pauses-at-the-end-of-mirroring.patch [bz#876993]
  - Resolves: bz#876993
    (qemu-kvm: vm's become non-responsive during migrate disk load from 2 domains to a 3ed)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.500.el6
changelog:
  - kvm-qcow2-Free-allocated-L2-cluster-on-error.patch [bz#1405882]
  - kvm-qcow2-Support-exact-L1-table-growth.patch [bz#1405882]
  - kvm-iotests-Fix-026-s-reference-output.patch [bz#1405882]
  - kvm-iotests-Fix-049-s-reference-output.patch [bz#1405882]
  - kvm-iotests-Disable-086.patch [bz#1405882]
  - kvm-block-commit-speed-is-an-optional-parameter.patch [bz#1405882]
  - kvm-iotests-Use-_img_info.patch [bz#1405882]
  - Resolves: bz#1405882
    (test cases 026 030 049 086 and 095 of qemu-iotests fail for qcow2 with qemu-kvm-rhev-0.12.1.2-2.498.el6)


author: Yash Mankad <ymankad@redhat.com> - 0.12.1.2-2.501.el6
changelog:
  - kvm-Revert-iotests-Use-_img_info.patch [bz#1405882]
  - kvm-Revert-block-commit-speed-is-an-optional-parameter.patch [bz#1405882]
  - kvm-Revert-iotests-Disable-086.patch [bz#1405882]
  - kvm-Revert-iotests-Fix-049-s-reference-output.patch [bz#1405882]
  - kvm-Revert-iotests-Fix-026-s-reference-output.patch [bz#1405882]
  - kvm-Revert-qcow2-Support-exact-L1-table-growth.patch [bz#1405882]
  - kvm-Revert-qcow2-Free-allocated-L2-cluster-on-error.patch [bz#1405882]
  - kvm-net-check-packet-payload-length.patch [bz#1398214]
  - Resolves: bz#1398214
    (CVE-2016-2857 qemu-kvm: Qemu: net: out of bounds read in net_checksum_calculate() [rhel-6.9])
  - Reverts: bz#1405882
    (test cases 026 030 049 086 and 095 of qemu-iotests fail for qcow2 with qemu-kvm-rhev-0.12.1.2-2.498.el6)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.502.el6
changelog:
  - kvm-cirrus_vga-fix-division-by-0-for-color-expansion-rop.patch [bz#1418231 bz#1419417]
  - kvm-cirrus_vga-fix-off-by-one-in-blit_region_is_unsafe.patch [bz#1418231 bz#1419417]
  - kvm-display-cirrus-check-vga-bits-per-pixel-bpp-value.patch [bz#1418231 bz#1419417]
  - kvm-display-cirrus-ignore-source-pitch-value-as-needed-i.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-handle-negative-pitch-in-cirrus_invalidate_re.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-allow-zero-source-pitch-in-pattern-fill-rops.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-fix-blit-address-mask-handling.patch [bz#1418231 bz#1419417]
  - kvm-cirrus-fix-oob-access-issue-CVE-2017-2615.patch [bz#1418231 bz#1419417]
  - Resolves: bz#1418231
    (CVE-2017-2615 qemu-kvm: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-6.9])
  - Resolves: bz#1419417
    (CVE-2017-2615 qemu-kvm-rhev: Qemu: display: cirrus: oob access while doing bitblt copy backward mode [rhel-6.9])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.503.el6
changelog:
  - kvm-cirrus-fix-patterncopy-checks.patch [bz#1420487 bz#1420489]
  - kvm-Revert-cirrus-allow-zero-source-pitch-in-pattern-fil.patch [bz#1420487 bz#1420489]
  - kvm-cirrus-add-blit_is_unsafe-call-to-cirrus_bitblt_cput.patch [bz#1420487 bz#1420489]
  - Resolves: bz#1420487
    (EMBARGOED CVE-2017-2620 qemu-kvm: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.9])
  - Resolves: bz#1420489
    (EMBARGOED CVE-2017-2620 qemu-kvm-rhev: Qemu: display: cirrus: potential arbitrary code execution via cirrus_bitblt_cputovideo [rhel-6.9])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.503.el6_9.1
changelog:
  - kvm-vns-tls-don-t-use-depricated-gnutls-functions.patch [bz#1428750]
  - kvm-vnc-apply-display-size-limits.patch [bz#1400438 bz#1425943]
  - Resolves: bz#1400438
    (qemu-kvm coredump in vnc_refresh_server_surface [rhel-6.9.z])
  - Resolves: bz#1425943
    (CVE-2017-2633 qemu-kvm-rhev: Qemu: VNC: memory corruption due to unchecked resolution limit [rhel-6.9.z])
  - Resolves: bz#1428750
    (Fails to build in brew)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.503.el6_9.2
changelog:
  - kvm-fix-cirrus_vga-fix-OOB-read-case-qemu-Segmentation-f.patch [bz#1443447 bz#1443449]
  - kvm-cirrus-vnc-zap-bitblit-support-from-console-code.patch [bz#1443447 bz#1443449]
  - Resolves: bz#1443447
    (CVE-2017-7718 qemu-kvm: Qemu: display: cirrus: OOB read access issue [rhel-6.9.z])
  - Resolves: bz#1443449
    (CVE-2017-7718 qemu-kvm-rhev: Qemu: display: cirrus: OOB read access issue [rhel-6.9.z])
  - Resolves: bz#1447544
    (CVE-2016-9603 qemu-kvm-rhev: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.9.z] )
  - Resolves: bz#1447540
    (CVE-2016-9603 qemu-kvm: Qemu: cirrus: heap buffer overflow via vnc connection [rhel-6.9.z])


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 0.12.1.2-2.503.el6_9.3
changelog:
  - kvm-cirrus-avoid-write-only-variables.patch [bz#1444377 bz#1444379]
  - kvm-cirrus-stop-passing-around-dst-pointers-in-the-blitt.patch [bz#1444377 bz#1444379]
  - kvm-cirrus-stop-passing-around-src-pointers-in-the-blitt.patch [bz#1444377 bz#1444379]
  - kvm-cirrus-fix-off-by-one-in-cirrus_bitblt_rop_bkwd_tran.patch [bz#1444377 bz#1444379]
  - kvm-cirrus-fix-PUTPIXEL-macro.patch [bz#1444377 bz#1444379]
  - Resolves: bz#1444377
    (CVE-2017-7980 qemu-kvm: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.9.z])
  - Resolves: bz#1444379
    (CVE-2017-7980 qemu-kvm-rhev: Qemu: display: cirrus: OOB r/w access issues in bitblt routines [rhel-6.9.z])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.472.el6
changelog:
  - kvm-virtio-pci-avoid-repeatedly-deassigning-notifers-of-.patch [bz#1124311]
  - Resolves: bz#1124311
    (Qemu-kvm aborted when boot with 232 virtio NICs (multiple function is on))


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.473.el6
changelog:
  - kvm-blockdev-preserve-I-O-throttling-across-drives_reope.patch [bz#1211513]
  - Resolves: bz#1211513
    (IO throttling doesn't work after migration)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.474.el6
changelog:
  - kvm-block-avoid-useless-checks-on-acb-bh.patch [bz#1130014]
  - kvm-clean-unnecessary-code-don-t-check-g_strdup-arg-for-.patch [bz#1205288]
  - kvm-Drop-superfluous-conditionals-around-g_strdup.patch [bz#1205288]
  - kvm-util-Drop-superfluous-conditionals-around-g_free.patch [bz#1205288]
  - kvm-util-Fuse-g_malloc-memset-into-g_new0.patch [bz#1205288]
  - kvm-util-uri-uri_new-can-t-fail-drop-dead-error-handling.patch [bz#1205288]
  - kvm-util-uri-realloc2n-can-t-fail-drop-dead-error-handli.patch [bz#1205288]
  - kvm-util-uri-URI-member-path-can-be-null-compare-more-ca.patch [bz#1205288]
  - kvm-util-uri-Add-overflow-check-to-rfc3986_parse_port.patch [bz#1205288]
  - Resolves: bz#1130014
    (test case 033 and 034 of qemu-iotests fail for vmdk)
  - Resolves: bz#1205288
    (Coverity-detected defect: buffer overrun at uri.c:2035)


author: Miroslav Rezanina <mrezanin@redhat.com> - 0.12.1.2-2.475.el6
changelog:
  - kvm-fdc-force-the-fifo-access-to-be-in-bounds-of-the-all.patch [bz#1219268]
  - Resolves: bz#1219268
    (EMBARGOED CVE-2015-3456 qemu-kvm: qemu: floppy disk controller flaw [rhel-6.7])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.476.el6
changelog:
  - kvm-block-Fix-bdrv_aio_cancel-RHEL-only.patch [bz#1220674]
  - Resolves: bz#1220674
    (Received no response to QMP command 'system_reset')


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.477.el6
changelog:
  - kvm-pcnet-fix-Negative-array-index-read.patch [bz#1225887]
  - kvm-pcnet-force-the-buffer-access-to-be-in-bounds-during.patch [bz#1225887]
  - Resolves: bz#1225887
    (EMBARGOED CVE-2015-3209 qemu-kvm: qemu: pcnet: multi-tmd buffer flow in the tx path [rhel-6.7])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.478.el6
changelog:
  - kvm-vdi-Avoid-direct-AIO-callback.patch [bz#1130046]
  - kvm-vdi-Initialize-acb-bh-in-vdi_aio_setup.patch [bz#1130046]
  - Resolves: bz#1130046
    (test case 084 of qemu-iotests fail for vdi)


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.479.el6
changelog:
  - kvm-posix-aio-compat-fix-acb-ev_signo-race-condition.patch [bz#1233292]
  - Resolves: bz#1233292
    (qemu-kvm randomly crashes with "kill failed failed: Invalid argument")


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.479.el6_7.1
changelog:
  - kvm-rtl8139-avoid-nested-ifs-in-IP-header-parsing-CVE-20.patch [bz#1248761]
  - kvm-rtl8139-drop-tautologous-if-ip-.-statement-CVE-2015-.patch [bz#1248761]
  - kvm-rtl8139-skip-offload-on-short-Ethernet-IP-header-CVE.patch [bz#1248761]
  - kvm-rtl8139-check-IP-Header-Length-field-CVE-2015-5165.patch [bz#1248761]
  - kvm-rtl8139-check-IP-Total-Length-field-CVE-2015-5165.patch [bz#1248761]
  - kvm-rtl8139-skip-offload-on-short-TCP-header-CVE-2015-51.patch [bz#1248761]
  - kvm-rtl8139-check-TCP-Data-Offset-field-CVE-2015-5165.patch [bz#1248761]
  - Resolves: bz#1248761
    (CVE-2015-5165 qemu-kvm: Qemu: rtl8139 uninitialized heap memory information leakage to guest [rhel-6.7.z])


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.479.el6_7.2
changelog:
  - kvm-net-add-checks-to-validate-ring-buffer-pointers-CVE-.patch [bz#1263274]
  - Resolves: bz#1263274
    (CVE-2015-5279 qemu-kvm: qemu: Heap overflow vulnerability in ne2000_receive() function [rhel-6.7.z])


author: Baoquan He <bhe@redhat.com> - 2.0.0-299
changelog:
  - mkdumprd: Use a flexible way to create rtc device, resolves bug 1315148
  - hyper-v: do not exclude hv_utils module, resolves bug 1228774


author: Baoquan He <bhe@redhat.com> - 2.0.0-301
changelog:
  - mkdumprd: Allow findmodule() to add dependency for lsmod output, resolves bug 1343282
  - mkdumprd: Kill useless code in moduledep(), resolves bug 1343282
  - mkdumprd: skip logical interfaces for bridge, resolves bug 1356615


author: Baoquan He <bhe@redhat.com> - 2.0.0-303
changelog:
  - mkdumprd: Remove load_selinux_policy script, resolves bug 1323086
  - mkdumprd: pass the value of DEV_ID to kdump, resolves bug 1322802


author: Baoquan He <bhe@redhat.com> - 2.0.0-306
changelog:
  - mkdumprd: fix env for mdadm, resolves bug 1404263
  - mkdumprd: create node for partition within RAID device, resolves bug 1404263
  - mkdumprd: refactor block_mknod(), resolves bug 1404263
  - uefi: Pass efi_smbios_addr to 2nd kernel, resolves bug 1404552


author: Caolán McNamara <caolanm@redhat.com> - 1:4.0.4.2-14
changelog:
  - Resolves: rhbz#1130264 crash in gstreamer callback on s390x
  - Resolves: rhbz#1131428 cannot export charts as svg
  - Resolves: rhbz#1035298 obsolete openoffice.org-langpack-ms_MY


author: David Tardon <dtardon@redhat.com> - 1:4.2.8.2-11.1
changelog:
  - Resolves: rhbz#1285818 various flaws
  - CVE-2015-4551 Arbitrary file disclosure in Calc and Writer
  - CVE-2015-5212 Integer underflow in PrinterSetup length
  - CVE-2015-5213 Integer overflow in DOC files
  - CVE-2015-5214 Bookmarks in DOC documents are insufficiently checked
    causing memory corruption


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.112-1.b16
changelog:
  - Update to aarch64-jdk8u112-b16.
  - Drop upstreamed patches for 8044762, 8049226, 8154210, 8158260 and 8160122.
  - Re-generate size_t and key size (RH1163501) patches against u112.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-1.b13
changelog:
  - Update to aarch64-jdk8u121-b13.
  - Add MD5 checksum for the new java.security file (EC < 224, DSA < 1024 restricted)
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.121-2.b13
changelog:
  - Add backports from 8u131 and 8u152 ahead of April CPU.
  - Apply backports before local RPM fixes so they will be the same as when applied upstream
  - Adjust RH1022017 following application of 8173783
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.131-0.b11
changelog:
  - Update to aarch64-jdk8u131-b11.
  - Drop upstreamed patches for 8147910, 8161993, 8170888 and 8173783.
  - Update generate_source_tarball.sh to remove patch remnants.
  - Cleanup tarball creation documentation to avoid duplication.
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-0.b15
changelog:
  - Update to aarch64-jdk8u141-b15.
  - Update location of OpenJDK system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 6515172, 8144566, 8155049, 8165231, 8174164, 8174729 and 8175097.
  - Update PR1983, PR2899 and PR2934 (SunEC + system NSS) to accomodate 8175110.
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-1.b15
changelog:
  - Backport "8180048: Interned string and symbol table leak memory during parallel unlinking"
  - Resolves: rhbz#1468473


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.141-2.b16
changelog:
  - Update to aarch64-jdk8u141-b16.
  - Revert change to remove-intree-libraries.sh following backout of 8173207
  - Resolves: rhbz#1466509


author: Marek Kasik <mkasik@redhat.com> - 0.12.4-4
changelog:
  - Add poppler-0.12.4-CVE-2010-3702.patch
      (Properly initialize parser)
  - Add poppler-0.12.4-CVE-2010-3703.patch
      (Properly initialize stack)
  - Add poppler-0.12.4-CVE-2010-3704.patch
      (Fix crash in broken pdf (code < 0))
  - Resolves: #639860


author: Jan Grulich <jgrulich@redhat.com> - 4.3.4-30
changelog:
  - Make sure all windows are properly closed and removed from the task manager applet
    Resolves: bz#1027703


author: Petr Menšík <pemensik@redhat.com> - 32:9.8.2-0.59.rc1
changelog:
  - Use /lib or /lib64 only if directory in chroot already exists
  - Tighten NSS library pattern, escape chroot mount path


author: Petr Menšík <pemensik@redhat.com> - 32:9.8.2-0.61.rc1
changelog:
  - Fix CVE-2016-9147 (ISC change 4510)
  - Fix regression introduced by CVE-2016-8864 (ISC change 4530)


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.51-3.b16
changelog:
  - direcotries aligned to rhel6, jdk7 like style ifarch 64 name.arch else naem
  - moved to rhel7, jdk8 like style of name.arch. Fixes 1259241
  - Resolves: rhbz#1254197


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.65-0.b17
changelog:
  - October 2015 security update to u65b17.
  - Add script for generating OpenJDK tarballs from a local Mercurial tree.
  - Update RH1191652 patch to build against current AArch64 tree.
  - Use appropriate source ID to avoid unpacking both tarballs on AArch64.
  - Fix library removal script so jpeg, giflib and png sources are removed.
  - Update system-lcms.patch to regenerated upstream (8042159) version.
  - Drop LCMS update from rhel6-built.patch
  - Resolves: rhbz#1257654


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.65-4.b17
changelog:
  - Add flag logic back to spec file but disable for now.
  - Restore system-lcms.patch as used in October CPU.
  - Resolves: rhbz#1295751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-0.b15
changelog:
  - January 2016 security update to u71b15.
  - Improve verbosity and helpfulness of tarball generation script.
  - Update patch documentation using version originally written for Fedora.
  - Drop prelink requirement as we no longer use execstack.
  - Drop ifdefbugfix patch as this is fixed upstream.
  - Provide optional boostrap build and turn it off by default.
  - Add patch for size_t formatting on s390 as size_t != intptr_t there.
  - Resolves: rhbz#1295751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.71-1.b15
changelog:
  - Add patch to turn off strict overflow on IndicRearrangementProcessor{,2}.cpp
  - Resolves: rhbz#1295751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-0.b03
changelog:
  - Update to u77b03.
  - Drop 8146566 which is applied upstream.
  - Replace s390 Java options patch with general version from IcedTea.
  - Apply s390 patches unconditionally to avoid arch-specific patch failures.
  - Remove fragment of s390 size_t patch that unnecessarily removes a cast, breaking ppc64le.
  - Remove aarch64-specific suffix as update/build version are now the same as for other archs.
  - Only use z format specifier on s390, not s390x.
  - Adjust tarball generation script to allow ecc_impl.h to be included.
  - Correct spelling mistakes in tarball generation script.
  - Synchronise minor changes from Fedora.
  - Use a simple backport for PR2462/8074839.
  - Don't backport the crc check for pack.gz. It's not tested well upstream.
  - Resolves: rhbz#1320661


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.77-0.b03
changelog:
  - Remove what remains of the SunEC sources in the remove-intree-libraries script.
  - Resolves: rhbz#1320661


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b05-shenandoah-merge-2019-09-09.
  - Update version logic to handle -shenandoah* tag suffix.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u232-b09.
  - Switch to GA mode for final release.
  - Remove PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Resolves: rhbz#1753423


author: Andrew John Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-2
changelog:
  - Remove CVE-2018-3639 mitigation due to performance regression and
      OpenJDK position on speculative execution vulnerabilities.
      https://mail.openjdk.java.net/pipermail/vuln-announce/2019-July/000002.html
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.232.b09-3
changelog:
  - Revert SSBD removal for now, until appropriate messaging has been decided.
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b05-0.1.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b05.
  - Attempt to fix Shenandoah formatting failures on S390, introduced by JDK-8232102.
  - Revise b05 snapshot to include JDK-8236178.
  - Add additional Shenandoah formatting fixes revealed by successful -Wno-error=format run
  - Resolves: rhbz#1785753


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.242.b07-0
changelog:
  - Update to aarch64-shenandoah-jdk8u242-b07.
  - Switch to GA mode for final release.
  - Remove Shenandoah S390 patch which is now included upstream as JDK-8236829.
  - Resolves: rhbz#1785753


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:7.4.629-5.2
changelog:
  - 1724045 - fix CVE-2019-12735 the :source! command allows arbitrary command execution via the modeline
  - fix spec warnings about expanding macros


author: Remi Collet <rcollet@redhat.com> - 5.3.3-38
changelog:
  - spl: fix use-after-free in ArrayIterator due to object
    change during sorting. CVE-2014-4698
  - spl: fix use-after-free in SPL Iterators. CVE-2014-4670


author: Remi Collet <rcollet@redhat.com> - 5.3.3-39
changelog:
  - xmlrpc: fix out-of-bounds read flaw in mkgmtime() CVE-2014-3668
  - core: fix integer overflow in unserialize() CVE-2014-3669
  - exif: fix heap corruption issue in exif_thumbnail() CVE-2014-3670


author: Remi Collet <rcollet@redhat.com> - 5.3.3-41
changelog:
  - core: fix double in zend_ts_hash_graceful_destroy CVE-2014-9425
  - core: fix use-after-free in unserialize CVE-2015-2787
  - exif: fix free on unitialized pointer CVE-2015-0232
  - gd: fix buffer read overflow in gd_gif.c CVE-2014-9709
  - date: fix use after free vulnerability in unserialize CVE-2015-0273
  - enchant: fix heap buffer overflow in enchant_broker_request_dict
    CVE-2014-9705
  - phar: use after free in phar_object.c CVE-2015-2301
  - soap: fix type confusion through unserialize


author: Remi Collet <rcollet@redhat.com> - 5.3.3-43
changelog:
  - core: fix multipart/form-data request can use excessive
    amount of CPU usage CVE-2015-4024
  - fix various functions accept paths with NUL character
    CVE-2015-4026, #1213407
  - ftp: fix integer overflow leading to heap overflow when
    reading FTP file listing CVE-2015-4022
  - phar: fix buffer over-read in metadata parsing CVE-2015-2783
  - phar: invalid pointer free() in phar_tar_process_metadata()
    CVE-2015-3307
  - phar: fix buffer overflow in phar_set_inode() CVE-2015-3329
  - phar: fix memory corruption in phar_parse_tarfile caused by
    empty entry file name CVE-2015-4021
  - soap: more fix type confusion through unserialize #1222538


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-95
changelog:
  - Related: rhbz#1084426 Reverting to prevent Satellite installation issues mentioned in rhbz-1302761


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-97
changelog:
  - Resolves: rhbz#1367051 CVE-2015-5174 URL Normalization issue
  - Resolves: rhbz#1367054 CVE-2016-0706 Security Manager bypass via StatusManagerServlet
  - Resolves: rhbz#1367058 CVE-2016-0714 Security Manager bypass via persistence mechanisms
  - Resolves: rhbz#1367054 CVE-2015-5345 Directory disclosure


author: Coty Sutherland <csutherl@redhat.com> 0:6.0.24-98
changelog:
  - Resolves: rhbz#1362210 CVE-2016-5388 Tomcat: CGI sets environmental variable based on user supplied Proxy request header
  - Resolves: rhbz#1368119


author: Christophe Fergeau <cfergeau@redhat.com> 0.26-2
changelog:
  - Add -Wl,-z,relro to the linker flags in order to fix a rpmdiff
    error. These flags used to be provided indirectly by openssl, and after
    openssl stopped exporting them, they were added by
    1002-gtk-Makefile.am-add-PIE-flags-to-libspice-client-gli.patch
    which was dropped during the rebase
    Related: rhbz#1185434


author: Christophe Fergeau <cfergeau@redhat.com> 0.26-3
changelog:
  - Add -Wl,-z,now as well to the link flags.  This flag was present in
    1002-gtk-Makefile.am-add-PIE-flags-to-libspice-client-gli.patch, and
    pkgwrangler still complains about:
    File /usr/lib/libspice-client-glib-2.0.so.8.5.0 lost GNU_RELRO security
    protection on i686
    Related: rhbz#1185434


author: Christophe Fergeau <cfergeau@redhat.com> 0.26-4
changelog:
  - Fix smartcard issues after VM restart (virsh destroy/virsh start)
    Resolves: rhbz#1205171
  - Remove obsolete patches
    Related: rhbz#1185434


author: Fabiano Fidêncio <fidencio@redhat.com> 0.26-5
changelog:
  - Connecting to VM changes its resolution
    Resolves: rhbz#1242605
  - Cannot enable display 1 when it was disabled in previous session
    Resolves: rhbz#1247920
  - Windows needs to send complete monitors_config message to client
    Resolves: rhbz#1265361
  - Add Client capability for windows monitor_config messsage
    Resolves: rhbz#1265359
  - High Resolution Multi-Monitor Windows Guest freeze
    Resolves: rhbz#1247749
  - Drop isoc packages on low bandwith
    Resolves: rhbz#1276707


author: Pavel Grunt <pgrunt@redhat.com> 0.26-8
changelog:
  - Make grab session related
    Resolves: rhbz#1330652
  - Improve messages in usb redirection dialog
    Resolves: rhbz#1298772
  - Use proxy only when needed
    Resolves: rhbz#1306311


author: Milind Changire <mchangir@redhat.com> - 3.12.2-9
changelog:
  - fixes bugs bz#1546717 bz#1557551 bz#1558948 bz#1561999 bz#1563804 
    bz#1565015 bz#1565119 bz#1565399 bz#1565577 bz#1567100 bz#1567899 bz#1568374 
    bz#1568969 bz#1569490 bz#1570514 bz#1570541 bz#1570582 bz#1571645 bz#1572087 
    bz#1572585 bz#1575895


author: Milind Changire <mchangir@redhat.com> - 3.12.2-10
changelog:
  - fixes bugs bz#1488120 bz#1565577 bz#1568297 bz#1570586 bz#1572043 
    bz#1572075 bz#1575840 bz#1575877


author: Milind Changire <mchangir@redhat.com> - 3.12.2-13
changelog:
  - fixes bugs bz#1493085 bz#1518710 bz#1554255 bz#1558948 bz#1558989 
    bz#1559452 bz#1567001 bz#1569312 bz#1569951 bz#1575539 bz#1575557 bz#1577051 
    bz#1580120 bz#1581184 bz#1581553 bz#1581647 bz#1582119 bz#1582129 bz#1582417 
    bz#1583047 bz#1588408 bz#1592666 bz#1594658


author: Milind Changire <mchangir@redhat.com> - 3.12.2-14
changelog:
  - fixes bugs bz#1547903 bz#1566336 bz#1568896 bz#1578716 bz#1581047 
    bz#1581231 bz#1582066 bz#1593865 bz#1597506 bz#1597511 bz#1597654 bz#1597768 
    bz#1598105 bz#1598356 bz#1599037 bz#1599823 bz#1600057 bz#1601314


author: Milind Changire <mchangir@redhat.com> - 3.12.2-16
changelog:
  - fixes bugs bz#1569657 bz#1608352 bz#1609163 bz#1609724 bz#1610825 
    bz#1611151 bz#1612098 bz#1615338 bz#1615440


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.2.10-8
changelog:
  - Synchronize patches for Samba 4.2.10 with RHEL 7.2.z
  - Resolves: #1383685 - Update samba4 to be on par with RHEL 7.2.z


author: Andreas Schneider <asn@redhat.com> - 4.0.0-67.rc4
changelog:
  - resolves: #1290708 - CVE-2015-7540
  - related: #1290708 - CVE-2015-5299
  - related: #1290708 - CVE-2015-5296
  - related: #1290708 - CVE-2015-5252
  - related: #1290708 - CVE-2015-5330


author: Adam Tkac <atkac redhat com> - 1.7.1-1
changelog:
  - update to 1.7.1 (#585990)
  - Use %{gitcoredir}/git-daemon as xinetd server (#529682) [Todd Zullinger]
  - Remove long fixed xinetd IPv6 workaround (#557528) [Todd Zullinger]
  - Make %{_var}/lib/git the default gitweb root (#556299) [Todd Zullinger]
  - Include gitweb/INSTALL file as documentation [Todd Zullinger]
  - Ship example gitweb config (%{_sysconfdir}/gitweb.conf) [Todd Zullinger]
  - Install missing gitweb.js (#558740) [Todd Zullinger]
  - Only BR perl(Error) [Todd Zullinger]
  - Use config.mak to set build options [Todd Zullinger]
  - Disable building of unused python remote helper libs [Todd Zullinger]
  - Comply with Emacs add-on packaging guidelines (#573423) [Jonathan Underwood]
    - Place elisp source files in separate emacs-git-el package
    - Place git support files in own directory under site-lisp
    - Use Emacs packaging macros
  - Replace $RPM_BUILD_ROOT with %{buildroot} [Todd Zullinger]


author: Petr Stodulka <pstodulk@redhat.com> - 1.7.1-7
changelog:
  - fixes memory corruption on git shortlog
  - add -f option for "git submodule add" to add files even when
    these are included in .gitignore
  - improve performance of extremly slow http(s)
  - fix cloning using http(s) protocol when redirection is requested
    Resolves: #874659 #1207253 #1237395 #1289984


author: Petr Stodulka <pstodulk@redhat.com> - 1.7.1-8
changelog:
  - fixes previous patch which add -f option for "git submodule add"
    which incorectly used unsupported option --ignore-missing for
    "git add --dry-run"
  - add control of GSSAPI credential delegation to enable HTTP(S)-SSO
    authentication
    Resolves: #1207253 #1368384


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.191.b12-0
changelog:
  - Add missing runtime requirements for dlopened dependencies
  - Add headful runtime requirement on Gtk+2 for Desktop API & look-and-feel
  - Add headless runtime requirements on lksctp-tools, pcsc-ltie-devel & cups-libs
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b12-0
changelog:
  - Fix jdk8073139-pr1758-rh1191652-ppc64_le_says_its_arch_is_ppc64_not_ppc64le_jdk.patch paths to pass git apply
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b13-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b13.
  - Update tarball generation script in preparation for PR3667/RH1656676 SunEC changes.
  - Use remove-intree-libraries.sh to remove the remaining SunEC code for now.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-0
changelog:
  - Update to aarch64-shenandoah-jdk8u191-b14.
  - Adjust JDK-8073139/PR1758/RH1191652 to apply following 8155627 backport.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.191.b14-1
changelog:
  - Add 8131048 & 8164920 (PR3574/RH1498936) to provide a CRC32 intrinsic for PPC64.
  - Resolves: rhbz#1661577


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-20
changelog:
  - Actually apply patches from previous build
  - Resolves: rhbz#1313940 - sudorule not working with ipa sudo_provider


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-21
changelog:
  - Resolves: rhbz#1313940 - SSSD PAM module does not support multiple
                             password prompts (e.g. Password + Token) with sudo


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-22.2
changelog:
  - Resolves: rhbz#1342058 - In IPA-AD trust environment access is granted
                             to AD user even if the user is disabled on AD.


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-22.6
changelog:
  - Explicitly Require the matching version of ding-libs
  - Related: rhbz#1379580 - SSSD fails to process GPO from Active Directory.


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-1.b12
changelog:
  - Replace tarballs with version including AArch64 fix for 8174962 (S8194686)
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.161-2.b13
changelog:
  - Update to b13 including Zero fix for 8174962 (S8194739) and restoring tzdata2017c update
  - Resolves: rhbz#1528233


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.171-2.b10
changelog:
  - Backported from fedora: aarch64BuildFailure.patch, rhbz_1536622-JDK8197429-jdk8.patch, rhbz_1540242.patch
  - Resolves: rhbz#1559766


author: Andreas Schneider <asn@redhat.com> - 3.6.23-21
changelog:
  - resolves: #1252180 - Fix 'force group' with 'winbind use default domain'.
  - resolves: #1250100 - Fix segfault in pam_winbind if option parsing fails


author: Andreas Schneider <asn@redhat.com> - 3.6.23-22
changelog:
  - resolves: #1290706 - CVE-2015-5299
  - related: #1290706 - CVE-2015-5296
  - related: #1290706 - CVE-2015-5252
  - related: #1290706 - CVE-2015-5330


author: Andreas Schneider <asn@redhat.com> - 3.6.23-26
changelog:
  - resolves: #1322686 - Fix CVE-2015-5370
  - resolves: #1322686 - Fix CVE-2016-2110
  - resolves: #1322686 - Fix CVE-2016-2111
  - resolves: #1322686 - Fix CVE-2016-2112
  - resolves: #1322686 - Fix CVE-2016-2115
  - resolves: #1322686 - Fix CVE-2016-2118 (Known as Badlock)


author: Andreas Schneider <asn@redhat.com> - 3.6.23-29
changelog:
  - resolves: #1322687 - Fix CVE-2015-5370
  - resolves: #1322687 - Fix CVE-2016-2110
  - resolves: #1322687 - Fix CVE-2016-2111
  - resolves: #1322687 - Fix CVE-2016-2112
  - resolves: #1322687 - Fix CVE-2016-2115
  - resolves: #1322687 - Fix CVE-2016-2118 (Known as Badlock)


author: Andreas Schneider <asn@redhat.com> - 3.6.23-34
changelog:
  - resolves: #1329967 - Fix netlogon credential checks
  - resolves: #1329975 - Fix dcerpc trailer verificaton


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-10
changelog:
  - Add patch to fix SSL CA name leaks, taken from NSS 3.27.2 release
  - Add patch to fix bash syntax error in tests/ssl.sh
  - Add patch to remove duplicate ciphersuites entries in sslinfo.c
  - Add patch to abort selfserv/strsclnt/tstclnt on non-parsable version range
  - Build with support for SSLKEYLOGFILE


author: Daiki Ueno <dueno@redhat.com> - 3.27.1-11
changelog:
  - Adjust the sslstress.txt filename so that it matches with the
    disableSSL2tests patch ported from RHEL 7
  - Exclude SHA384 and CHACHA20_POLY1305 ciphersuites from stress tests
  - Don't add gtests and ssl_gtests to nss_tests, unless gtests are enabled


author: Daiki Ueno <dueno@redhat.com> - 3.28.3-1
changelog:
  - Rebase to 3.28.3
  - Remove upstreamed moz-1282627-rh-1294606.patch,
    moz-1312141-rh-1387811.patch, moz-1315936.patch, and
    moz-1318561.patch
  - Remove no longer necessary nss-duplicate-ciphers.patch
  - Disable X25519 and exclude tests using it
  - Catch failed ASN1 decoding of RSA keys, by Kamil Dudka (#1427481)


author: Bastien Nocera <bnocera@redhat.com> 0.10.17-2
changelog:
  - Update Farsight plugins to 0.10.17
  - Disable LADSPA plugins, they should be in -bad (#540198)
  - Add support for authenticating RTSP sources
  Related: rhbz#543948


author: Wim Taymans <wtaymans@redhat.com> 0.10.23-2
changelog:
  - add patch to post provide-clock message to fix a major regression
    in 0.10.23
  - bump version to rebuild for fastrack
  Resolves: rhbz#622776


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.131-2.6.9.1
changelog:
  - Bump to 2.6.9 and u131b00.
  - Remove patch application debris in fsg.sh.
  - Re-generate PR2809 and RH1022017 against 2.6.9.
  - Add blacklisted.certs to installation file list.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.141-2.6.10.0
changelog:
  - Bump to 2.6.10 and u141b00.
  - Adjust RH1022017 following application of 8173783
  - Add more detailed output to fsg.sh and generate_source_tarball.sh.
  - Bump to u141b01 to include S8043723 fix for s390.
  - Resolves: rhbz#1438751


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.151-2.6.11.0
changelog:
  - Bump to 2.6.11 and u151b00.
  - Update java-access-bridge-security.patch to apply against 2.6.11.
  - Apply fix for 8185716 so ppc uses correct ins_encode format
  - Resolves: rhbz#1466509


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.161-2.6.12.0
changelog:
  - Bump to 2.6.12 and u161b00.
  - Update SystemTap tapsets to version in IcedTea 2.6.12pre01 to fix RH1492139.
  - Drop 8185716 patch, now applied upstream.
  - Update location of OpenJDK zlib system library source code in remove-intree-libraries.sh
  - Fix name of SystemTap tarball, following update.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.171-2.6.13.0
changelog:
  - Bump to 2.6.13 and u171b01.
  - Update java-1.7.0-openjdk-java-access-bridge-security.patch to apply after 8186080
  - Update RC4 patch (8076221/PR2809) to apply after 8148108 (DH lower limit increase)
  - Fix file path in rh1022017.patch.
  - Resolves: rhbz#1528233


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.0
changelog:
  - Bump to 2.6.14 and u181b00.
  - Drop 8197981 Zero 32-bit patch now applied upstream.
  - Update RC4 patch (8076221/PR2809) to apply after 8175075 (disable 3DES)
  - Resolves: rhbz#1559766


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.181-2.6.14.1
changelog:
  - Fix invalid license 'LGPL+' (should be LGPLv2+ for ECC code) and add missing ones
  - Resolves: rhbz#1559766


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.el6]
changelog:
  - [powerpc] 64s: Add support for a store forwarding barrier at kernel entry/exit (Mauricio Oliveira) [1581053] {CVE-2018-3639}
  - [x86] amd: Disable AMD SSBD mitigation in a VM (Waiman Long) [1580360]
  - [x86] spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Rename _RDS to _SSBD (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566899] {CVE-2018-3639}
  - [kernel] prctl: Add speculation control prctls (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] kvm: Expose the RDS bit to the guest (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs/AMD: Add support to disable RDS on Fam(15, 16, 17)h if requested (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Expose the /sys/../spec_store_bypass and X86_BUG_SPEC_STORE_BYPASS (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpu/intel: Knight Mill and Moorefield update to intel-family.h (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] speculation: Update Speculation Control microcode blacklist (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Clean up Spectre v2 related CPUID flags (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Add AMD feature bits for Speculation Control (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Add Intel feature bits for Speculation (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpufeatures: Add CPUID_7_EDX CPUID leaf (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] Extend RH cpuinfo to 10 extra words (Waiman Long) [1566899] {CVE-2018-3639}
  - [x86] invpcid: Enable 'noinvpcid' boot parameter for X86_32 (Waiman Long) [1560494]
  - [x86] dumpstack_32: Fix kernel panic in dump_trace (Waiman Long) [1577351]
  - [fs] gfs2: For fs_freeze, do a log flush and flush the ail1 list (Robert S Peterson) [1569148]
  - [net] dccp: check sk for closed state in dccp_sendmsg() (Stefano Brivio) [1576586] {CVE-2018-1130}
  - [net] ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped (Stefano Brivio) [1576586] {CVE-2018-1130}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.1.1.el6]
changelog:
  - [x86] microcode: Fix CPU synchronization routine (Prarit Bhargava) [1574592]
  - [x86] microcode: Synchronize late microcode loading (Prarit Bhargava) [1574592]
  - [x86] microcode: Request microcode on the BSP (Prarit Bhargava) [1574592]
  - [x86] microcode: Sanitize per-cpu microcode reloading interface (Prarit Bhargava) [1574592]
  - [x86] virt_spec_ctrl: Set correct host SSDB value for AMD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Eliminate TIF_SSBD checks in IBRS on/off functions (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Disable SSBD update from scheduler if not user settable (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Make ssbd_enabled writtable (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Remove thread_info check in __wrmsr_on_cpu() (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Write per-thread SSBD state to spec_ctrl_pcp (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Add a read-only ssbd_enabled debugfs file (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Switch the selection of mitigation from CPU vendor to CPU features (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Add AMD's SPEC_CTRL MSR usage (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Add AMD's variant of SSB_NO (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs/intel: Set proper CPU features and setup RDS (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM/VMX: Emulate MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM: SVM: Implement VIRT_SPEC_CTRL support for SSBD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation, KVM: Implement support for VIRT_SPEC_CTRL/LS_CFG (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Rework spec_ctrl base and mask logic (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Rework SPEC_CTRL update after late microcode loading (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Make sync_all_cpus_ibrs() write spec_ctrl_pcp value (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Unify x86_spec_ctrl_{set_guest, restore_host} (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Rework speculative_store_bypass_update() (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Add virtualized speculative store bypass disable support (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs, KVM: Extend speculation control for VIRT_SPEC_CTRL (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] KVM: Rename KVM SPEC_CTRL MSR functions to match upstream (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Handle HT correctly on AMD (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Add FEATURE_ZEN (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle SSBD enumeration (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] cpufeatures: Disentangle MSR_SPEC_CTRL enumeration from IBRS (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Use synthetic bits for IBRS/IBPB/STIBP (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] bugs: Fix missing void (Waiman Long) [1584356] {CVE-2018-3639}
  - [documentation] spec_ctrl: Do some minor cleanups (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] speculation: Make "seccomp" the default mode for Speculative Store Bypass (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Move speculation migitation control to arch code (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Use PR_SPEC_FORCE_DISABLE (Waiman Long) [1584356] {CVE-2018-3639}
  - [uapi] prctl: Add force disable speculation (Waiman Long) [1584356] {CVE-2018-3639}
  - [kernel] seccomp: Enable speculation flaw mitigations (Waiman Long) [1584356] {CVE-2018-3639}
  - [fs] proc: Provide details on speculation flaw mitigations (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] nospec: Allow getting/setting on non-current task (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Show IBPB in the Spectre_v2 sysfs file (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] pti: Check MSR_IA32_ARCH_CAPABILITIES for Meltdown vulnearability (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] spec_ctrl: Sync up naming of SPEC_CTRL MSR bits with upstream (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] pti: Fix kexec warning on debug kernel (Waiman Long) [1584356] {CVE-2018-3639}
  - [x86] kvm/fpu: Enable eager FPU restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] always enable eager FPU by default (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Load xsave pointer *after* initialization (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fix 32-bit signal frame handling (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Always restore_xinit_state() when use_eager_cpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Rename drop_init_fpu() to fpu_reset_state() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fix math_state_restore() race with kernel_fpu_begin() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Fold __drop_fpu() into its sole user (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't abuse drop_init_fpu() in flush_thread() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Introduce restore_init_xstate() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Document user_fpu_begin() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Factor out memset(xstate, 0) in fpu_finit() paths (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Change xstateregs_get()/set() to use ->xsave.i387 rather than ->fxsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Always allow FPU in interrupt if use_eager_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't abuse has_fpu in __kernel_fpu_begin/end() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Introduce per-cpu in_kernel_fpu state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Check tsk_used_math() in kernel_fpu_end() for eager FPU (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Change math_error() to use unlazy_fpu(), kill (now) unused save_init_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Merge simd_math_error() into math_error() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't do __thread_fpu_end() if use_eager_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Don't reset thread.fpu_counter (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: shift drop_init_fpu() from save_xstate_sig() to handle_signal() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Allow FPU to be used at interrupt time even with eagerfpu (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387.c: Initialize thread xstate only on CPU0 only once (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] kvm: fix kvm's usage of kernel_fpu_begin/end() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] rhel: initialize scattered CPUID features early (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: make eagerfpu= boot param tri-state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: enable eagerfpu by default for xsaveopt (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: decouple non-lazy/eager fpu restore from xsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: use non-lazy fpu restore for processors supporting xsave (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: remove unnecessary user_fpu_end() in save_xstate_sig() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: drop_fpu() before restoring new state from sigframe (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Unify signal handling code paths for x86 and x86_64 kernels (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: drop the fpu state during thread exit (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] signals: ia32_signal.c: add __user casts to fix sparse warnings (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Consolidate inline asm routines for saving/restoring fpu state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] signal: Cleanup ifdefs and is_ia32, is_x32 (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu/xsave: Keep __user annotation in casts (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] debug: Add KERN_<LEVEL> to bare printks, convert printks to pr_<level> (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] extable: Remove open-coded exception table entries in arch/x86/include/asm/xsave.h (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: Split up <asm/i387.h> into exported and internal interfaces (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: Uninline the generic FP helpers that we expose to kernel modules (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: (DON'T ACTUALLY) support lazy restore of FPU state (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: use 'restore_fpu_checking()' directly in task switching code (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: fix up some fpu_counter confusion (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: re-introduce FPU state preloading at context switch time (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move TS_USEDFPU flag from thread_info to task_struct (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move AMD K7/K8 fpu fxsave/fxrstor workaround from save to restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: do not preload FPU state at task switch time (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: don't ever touch TS_USEDFPU directly, use helper functions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: move TS_USEDFPU clearing out of __save_init_fpu and into callers (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: fix x86-64 preemption-unsafe user stack save/restore (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] i387: math_state_restore() isn't called from asm (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fix potentially dangerous trailing '; ' in #defined values/expressions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-32, fpu: Fix FPU exception handling on non-SSE systems (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Fix common misspellings (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] kvm: Initialize fpu state in preemptible context (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge fpu_save_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-32, fpu: Rewrite fpu_save_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Remove PSHUFB_XMM5_* macros (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Remove unnecessary ifdefs from i387 code. (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Simplify constraints for fxsave/fxtstor (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Fix cs value in convert_from_fxsr() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] x86-64, fpu: Disable preemption when using TS_USEDFPU (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge __save_init_fpu() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge tolerant_fwait() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] fpu: Merge fpu_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Disable xsave in i387 emulation mode (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Make xstate_enable_boot_cpu() __init, protect on CPU 0 (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Add __init attribute to setup_xstate_features() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Make init_xstate_buf static (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Check cpuid level for XSTATE_CPUID (0x0d) (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Introduce xstate enable functions (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Do not include asm/i387.h in asm/xsave.h (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Avoid unnecessary __clear_user() and xrstor in signal handling (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Cleanup return codes in check_for_xstate() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Separate fpu and xsave initialization (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] xsave: Move boot cpu initialization to xsave_init() (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Revert "[x86] fpu: change save_i387_xstate() to rely on unlazy_fpu()" (Paolo Bonzini) [1589047] {CVE-2018-3665}
  - [x86] Revert "[x86] fpu: shift clear_used_math() from save_i387_xstate() to handle_signal()" (Paolo Bonzini) [1589047] {CVE-2018-3665}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.6.2.el6]
changelog:
  - [fs] exec: Limit arg stack to at most 75 of _STK_LIM (Yauheni Kaliuta) [1625976] {CVE-2018-14634}
  - [fs] exec.c: account for argv/envp pointers (Yauheni Kaliuta) [1625976] {CVE-2018-14634}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-754.6.3.el6]
changelog:
  - [kvm] VMX: fixes for vmentry_l1d_flush module parameter (Marcelo Tosatti) [1628796]
  - [x86] speculation: Use ARCH_CAPABILITIES to skip L1D flush on vmentry (Marcelo Tosatti) [1628796]
  - [x86] KVM: VMX: skip L1TF flush on VM-entry if EPT is disabled (Marcelo Tosatti) [1616397]


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-1
changelog:
  - updated translations: bn_IN, de, fi, fr, gu, hi, it, ja, kn, ko, ml, mr, or,
                          pt_BR, ru, ta, te, zh_CN, zh_TW


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-4
changelog:
  - fixed possible privilege escalation flaw via use of python pickle
    (CVE-2011-2520), replaced pickle by json (rhbz#717985, rhbz#719871)
  - stop D-BUS firewall mechanism on update


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-6
changelog:
  - Added missing dependency for newt-python (RHBZ#756048)
  - Latest translations from transifex (RHBZ#819809)
  - Allow user to select and add trust and masq interfaces (RHBZ#720831)
  - New D-Bus methods to read an write service settings, use in s-c-fw (RHBZ#711231)
  - Drop eth from std device names list (rhbz#682391)


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-7
changelog:
  - Fixed screen corruption introduced with (RHBZ#720831)
  - Replaced pickle by json introduced with (RHBZ#711231)


author: Thomas Woerner <twoerner@redhat.com> 1.2.27-7.2
changelog:
  - moved fw_nm into the base sub package to fix a bug introduced with the
    RHBZ#720831 fix (RHBZ#1164223)


author: Jan Kaluza <jkaluza@redhat.com> - 2.2.15-48
changelog:
  - core: backport NoDecode option of AllowEncodedSlashes (#1002658)
  - mod_authz_host: disallow the '#' character in allow, deny (#1179911)
  - mod_ssl: fix memory leak on httpd reloads (#1236515)
  - mod_proxy: fix regression caused inherited workers to use a different
    scoreboard slot then the original one (#1252574)
  - mod_rewrite: allow running external mapping program as non-root (#1035230)
  - mod_reqtimeout: fix a timed out connection going into the keep-alive state
    after a timeout when discarding a request body (#1213967)
  - core: fix possible crash in SIGINT handling (#1233109)
  - mod_ssl: extend SSLSessionCacheTimeout to sessions resumed by TLS (#1190509)
  - initscript: do not print error when stopping stopped httpd (#1189941)
  - mod_ssl: fail for colons in credentials with FakeBasicAuth (#1027442)
  - mod_proxy: add "proxy-flushall" env variable which reduces the impact
    of caching 16K of the request body. (#952395)
  - mod_ssl: Do not send SSL warning when SNI hostname is not found as per
    RFC 6066 (#1289096)


author: Jan Kaluza <jkaluza@redhat.com> - 2.2.15-53
changelog:
  - core: fix possible long graceful restart caused by race condition between
    httpd children processes (#1301758)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-54.1
changelog:
  - Resolves: #1374729 - ProxyRemote with HTTPS backend sends requests
    with absoluteURI instead of abs_path


author: Luboš Uhliarik <luhliari@redhat.com> - 2.2.15-54.2
changelog:
  - Resolves: #1391517 - when ProxyErrorOverride is On, modcluster
    return 503 status code on subsequent requests


author: Nikola Forró <nforro@redhat.com> - 0.40.rc1-19
changelog:
  - fix loading config files from /etc/cgconfig.d to make it work with libcgroup-pam
    resolves: #1345762


author: Karel Zak <kzak@redhat.com> 2.17.2-12.19
changelog:
  - fix #1088411 - lsblk does not list dm-multipath and partitioned devices
  - fix #1215840 - slogins segfault and failure to allocate memory
  - fix #1023655 - 'pppd' hangs (uninterruptable) when run on tty
  - fix #1168390 - lscpu doesn't show all nodes on a discontinuous NUMA setup
  - fix #1191236 - 'umount -f' calls readlink on dead NFS mounts and hangs
  - fix #1172297 - umount --fake fails to edit mtab for NFS mounts which are already gone
  - fix #961148  - RHEL6: swapon: add "discard" support
  - fix #1150302 - ionice support class names
  - fix #1085062 - fdisk -l fails to fully process /proc/partitions when multipath device
  - fix #1122839 - fallocate and findmnt have wrong options according to man pages
  - fix #1089663 - Not all xfs mount options are described in mount(8)
  - fix #1295737 - man page for hwclock doesn't include --compare option
  - fix #1140594 - mount --move badly documented
  - fix #1296894 - RHEL6: update audit event in hwclock
  - fix #1266191 - fdisk does not handle >2TB disks correctly


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.21.1.el6]
changelog:
  - [scsi] scsi: megaraid_sas: return error when create DMA pool failed (Tomas Henzl) [1712858] {CVE-2019-11810}
  - [net] net: Set sk_prot_creator when copying sockets to the right proto (Andrea Claudi) [1657117] {CVE-2018-9568}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.24.1.el6]
changelog:
  - [net] ip: Don't leak head fragment on queue timeout (Stefano Brivio) [1752536]
  - [vhost] vhost_net: fix possible infinite loop (Eugenio Perez) [1702941]
  - [vhost] vhost: introduce vhost_exceeds_weight() (Eugenio Perez) [1702941]
  - [vhost] vhost_net: introduce vhost_exceeds_weight() (Eugenio Perez) [1702941]
  - [vhost] vhost_net: use packet weight for rx handler, too (Eugenio Perez) [1702941]
  - [vhost] vhost-net: set packet weight of tx polling to 2 * vq size (Eugenio Perez) [1702941]
  - [x86] x86/pti: Fix incorrect global bit setting with PTI on (Waiman Long) [1645724]
  - [x86] spec_ctrl: disable IBRS in idle, part 2 (Rafael Aquini) [1560787]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.25.1.el6]
changelog:
  - [kvm] KVM: VMX: Set VMENTER_L1D_FLUSH_NOT_REQUIRED if !X86_BUG_L1TF (Waiman Long) [1733760]
  - [virt] KVM: coalesced_mmio: add bounds checking (Bandan Das) [1746799] {CVE-2019-14821}
  - [virt] KVM: MMIO: Lock coalesced device when checking for available entry (Bandan Das) [1746799] {CVE-2019-14821}
  - [scsi] scsi: bnx2fc: Handle scope bits when array returns BUSY or TSF (Nilesh Javali) [1749512]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'task', 'port', 'orig_task' (Nilesh Javali) [1749512]
  - [scsi] scsi: bnx2fc: remove set but not used variables 'lport', 'host' (Nilesh Javali) [1749512]
  - [security] KEYS: prevent creating a different user's keyrings (David Howells) [1537371]
  - [documentation] Documentation: Add ITLB_MULTIHIT documentation (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [kvm] KVM: introduce no_huge_pages module parameter (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86: Add ITLB_MULTIHIT bug infrastructure (Paolo Bonzini) [1692385] {CVE-2018-12207}
  - [x86] x86/spec_ctrl/taa: Enable TAA status change after late microcode (Waiman Long) [1766531] {CVE-2019-11135}
  - [documentation] x86/speculation/taa: Add documentation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [base] x86/speculation/taa: Add sysfs reporting for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/speculation/taa: Add mitigation for TSX Async Abort (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/cpu: Add a helper function x86_read_arch_cap_msr() (Waiman Long) [1766531] {CVE-2019-11135}
  - [x86] x86/msr: Add the IA32_TSX_CTRL MSR (Waiman Long) [1766531] {CVE-2019-11135}
  - [drm] drm/i915/cmdparser: Fix jump whitelist clearing (Denys Vlasenko) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Lower RM timeout to avoid DSI hard hangs (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/gen8+: Add RC6 CTX corruption WA (Dave Airlie) [1756824] {CVE-2019-0154}
  - [drm] drm/i915/cmdparser: Ignore Length operands during command matching (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/cmdparser: Add support for backward jumps (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add gen9 BCS cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Allow parsing of unsized batches (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Support ro ppgtt mapped cmdparser shadow buffers (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Add support for mandatory cmdparsing (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Remove Master tables from cmdparser (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Disable Secure Batches for gen6+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915: Rename gen7 cmdparser tables (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Disable read-only support under GVT (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] erm/i915/gtt: Read-only pages for insert_entries on bdw+ (Dave Airlie) [1756891] {CVE-2019-0155}
  - [drm] drm/i915/gtt: Add read only pages to gen8_pte_encode (Dave Airlie) [1756891] {CVE-2019-0155}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.26.1.el6]
changelog:
  - [s390] scsi: zfcp: fix reaction on bit error threshold notification (Philipp Rudo) [1764544]
  - [drm] vmwgfx: refuse to hibernate if we have any resources v2 (Kenneth Yin) [1748195]
  - [fs] CIFS: avoid using MID 0xFFFF (Leif Sahlberg) [1739948]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.27.1.el6]
changelog:
  - [mm] mempolicy: fix a memory corruption by refcount imbalance in alloc_pages_vma() (Waiman Long) [1785321]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.28.1.el6]
changelog:
  - [netdrv] ixgbevf: Use cached link state instead of re-reading the value for ethtool (Ken Cox) [1795404]
  - [isdn] mISDN: enforce CAP_NET_RAW for raw sockets (Andrea Claudi) [1779473] {CVE-2019-17055}
  - [net] cfg80211: wext: avoid copying malformed SSIDs (Jarod Wilson) [1778625] {CVE-2019-17133}
  - [netdrv] bonding: speed/duplex update at NETDEV_UP event (Patrick Talbert) [1772779]
  - [netdrv] bonding: make speed, duplex setting consistent with link state (Patrick Talbert) [1772779]
  - [netdrv] bonding: simplify / unify event handling code for 3ad mode (Patrick Talbert) [1772779]
  - [netdrv] bonding: unify all places where actor-oper key needs to be updated (Patrick Talbert) [1772779]
  - [netdrv] bonding: simple code refactor (Patrick Talbert) [1772779]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.29.1.el6]
changelog:
  - [wireless] rtlwifi: Fix potential overflow on P2P code (Jarod Wilson) [1775226] {CVE-2019-17666}
  - [x86] mm: revert x86_64 and arm64 ELF_ET_DYN_BASE base changes (Denys Vlasenko) [1485759]
  - [powerpc] powerpc: move ELF_ET_DYN_BASE to 4GB / 4MB (Denys Vlasenko) [1485759]
  - binfmt_elf: use ELF_ET_DYN_BASE only for PIE (Denys Vlasenko) [1485759]
  - [powerpc] powerpc: Use generic PIE randomization (Denys Vlasenko) [1485759]


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.95-2.6.4.0
changelog:
  - Bump to 2.6.4 and u95b00.
  - Backport tarball creation script from OpenJDK 8 RPMs and update fsg.sh to work with it.
  - Drop 8072932or8074489 patch as applied upstream in u91b01.
  - Drop installation of soundfont symlink following inclusion of 8140620/PR2710 in 2.6.3
  - Resolves: rhbz#1295765


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.99-2.6.5.0
changelog:
  - Bump to 2.6.5 and u99b00.
  - Correct check for fsg.sh in tarball creation script
  - Resolves: rhbz#1320656


author: Patsy Franklin <pfrankli@redhat.com> - 2016f-1
changelog:
  - Rebase to 2016f
    - Egypt cancelled DST.
    - Asia/Novosibirsk transitions from +06 to +07 on 2016-07-24 at 02:00.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-1.prerelease
changelog:
  - Rebase to prerelease version of tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07. 
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016g-2
changelog:
  - Rebase to tzdata-2016g.
    - Turkey changed from EET/EEST (+02/+03) to permanent +03,
      on 2016-09-07.
    - A new leap second will be added on 2016-12-31 23:59:60 UTC.


author: Patsy Franklin <pfrankli@redhat.com> - 2016i-1
changelog:
  - Rebase to tzdata-2016i:
    - Cyprus is now split into two time zones as of 2016-10-30
    - Tonga will reintroduce DST on 2016-11-06


author: Patsy Franklin <pfrankli@redhat.com> - 2016j-1
changelog:
  - Rebase to tzdata-2016ij
    - Saratov region of Russia is moving from +03 offset to +04 offset
      on 2016-12-04.


author: Patsy Franklin <pfrankli@redhat.com> - 2017a-1
changelog:
  - Rebase to tzdata-2017a
    - Mongolia no longer observes DST. (BZ #1425222)
    - Add upstream patch to fix over-runing of POSIX limit on zone abbreviations.
  - Add zone1970.tab file to the install list. (BZ #1427694)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b07.
  - Require tzdata 2020a so system tzdata matches resource updates in b07
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b09.
  - With JDK-8248399 fixed, a broken jfr binary is no longer installed on architectures without JFR.
  - Resolves: rhbz#1838811


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.262.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u262-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u262 release.
  - Fix typo in jfr_arches which leads to ppc64 being wrongly excluded.
  - Split JDK-8042159 patch into per-repo patches as upstream.
  - Update JDK-8042159 JDK patch to apply after JDK-8238002 changes to Awt2dLibraries.gmk
  - Resolves: rhbz#1838811


author: Eric Sandeen <sandeen@redhat.com> 3.1.1-7
changelog:
  - Fix xfs_metadump hang (#730886)
  - mkfs.xfs: don't increase agblocks past maximum (#738279)
  - Fix double reporting of quota values (#749435)
  - xfs_quota: handle malformed entries in mtab (749434)


author: Eric Sandeen <sandeen@redhat.com> 3.1.1-8
changelog:
  - mkfs.xfs: better handle misaligned 4k devices (#836433)
  - mkfs.xfs: default to physical sectorsize (#836433)
  - mkfs.xfs: clarify errors when specified AG size is too large (#730433)


author: Eric Sandeen <sandeen@redhat.com> 3.1.1-11
changelog:
  - mkfs.xfs: Use multidisk mode when geometry is on cmdline (#961501)
  - xfs_io: Update  man page to include chproj, lsproj (#962394)
  - xfs_io: Remove broken setfl command (#962394)
  - xfs_logprint: Handle multiply-logged fields (#962397)
  - xfs_repair: Handle fragmented multiblock dir2 directories (#964216)
  - xfs_repair: avoid segfault with ag_stride (#93904)


author: Eric Sandeen <sandeen@redhat.com> 3.1.1-15
changelog:
  - libxfs: restrict platform_test_xfs_fd to regular files (#1018751)
  - xfs_repair: avoid segfault if reporting progress early in repair (#1020438)
  - xfs_fsr: fix SWAPEXT failures under selinux (#1024702)


author: Eric Sandeen <sandeen@redhat.com> 3.1.1-16
changelog:
  - xfs_copy: do not exit with error code if we succeed (#1100107)
  - xfs_copy: fix corruption when source fs sector size is > 512 bytes (#1104956)


author: Petr Machata <pmachata@redhat.com> - 1.41.0-19
changelog:
  - Backport upstream patch for fixing of memory leaks in
    Boost.Serialization (boost-1.41.0-serialization-leak.patch)


author: Petr Machata <pmachata@redhat.com> - 1.41.0-21
changelog:
  - Fix building of Python module for Boost-MPI and ship it
    (boost-1.41.0-mpi-python.patch, __init__.py)


author: Jonathan Wakely <jwakely@redhat.com> - 1.41.0-22
changelog:
  - Fix shared_ptr to work with recent GCC and C++11.
    (boost-1.41.0-shared_ptr-deleted-copy.patch)
  - Resolves: #1108268


author: Petr Machata <pmachata@redhat.com> - 1.41.0-23
changelog:
  - Fix conformance problems in Boost.Interprocess, Boost.Intrusive and
    Boost.Graph
    (boost-1.41.0-graph-conformance.patch,
    boost-1.41.0-interprocess-conformance.patch,
    boost-1.41.0-interprocess-conformance-maxval.patch,
    boost-1.41.0-intrusive-conformance.patch)


author: Petr Machata <pmachata@redhat.com> - 1.41.0-24
changelog:
  - Fix conformance problems in Boost.Numeric (uBLAS) and
    Boost.CircularBuffer (boost-1.41.0-numeric-conformance.patch,
    boost-1.41.0-circular_buffer-adl.patch)


author: Michal Schmidt <mschmidt@redhat.com> - 1.41.0-25
changelog:
  - mpich obsoleted mpich2. Build against mpich and rename subpackages
    accordingly. Obsolete mpich2 subpackages.


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-96
changelog:
  - prevent a server from skipping SSHFP lookup (#1081338) CVE-2014-2653
  - ignore environment variables with embedded '=' or '\0' characters CVE-2014-2532
  - backport ControlPersist option (#953088)
  - log when a client requests an interactive session and only sftp is allowed (#997377)
  - don't try to load RSA1 host key in FIPS mode (#1009959)
  - restore Linux oom_adj setting when handling SIGHUP to maintain behaviour over restart
    (#1010429)
  - ssh-keygen -V - relative-specified certificate expiry time should be relative to current time
    (#1022459)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-97
changelog:
  - x11 forwarding - be less restrictive when can't bind to one of available addresses
    (#1027197)
  - better fork error detection in audit patch (#1028643)
  - fix openssh-5.3p1-x11.patch for non-linux platforms (#1100913)


author: Petr Lautrbach <plautrba@redhat.com> 5.3p1-98
changelog:
  - add possibility to autocreate only RSA key into initscript (#1111568)
  - fix several issues reported by coverity


author: Phillip Lougher <plougher@redhat.com> [2.6.32-696.el6]
changelog:
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1424628] {CVE-2017-6074}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.1.1.el6]
changelog:
  - [block] fix use-after-free in seq file (Denys Vlasenko) [1418548 1418549] {CVE-2016-7910}
  - [firmware] Replacing the chelsio firmware (t4,t5)fw-1.15.37.0 (Sai Vemuri) [1433865 1425749]
  - [kernel] genirq: Avoid taking sparse_irq_lock for non-existent irqs (Dave Wysochanski) [1428106 1360930]
  - [tty] n_hdlc: get rid of racy n_hdlc.tbuf (Herton R. Krzesinski) [1429917 1429918] {CVE-2017-2636}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.2.1.el6]
changelog:
  - [sched] fair: Rework throttle_count sync (Jiri Olsa) [1436241 1250762]
  - [sched] fair: Reorder cgroup creation code (Jiri Olsa) [1436241 1250762]
  - [sched] fair: Initialize throttle_count for new task-groups lazily (Jiri Olsa) [1436241 1250762]
  - [sched] fair: Do not announce throttled next buddy in dequeue_task_fair() (Jiri Olsa) [1436241 1250762]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.3.1.el6]
changelog:
  - [netdrv] be2net: Fix endian issue in logical link config command (Ivan Vecera) [1442979 1436527]
  - [scsi] lpfc: update for rhel6 11.0.0.6 (Maurizio Lombardi) [1439636 1429881]
  - [scsi] lpfc: The lpfc driver does not issue RFF_ID and RFT_ID in the correct sequence (Maurizio Lombardi) [1439636 1429881]
  - [x86] vmalloc_sync: avoid syncing vmalloc area on crashing cpu (Pingfan Liu) [1443499 1146727]
  - [kernel] audit: plug cred memory leak in audit_filter_rules (Richard Guy Briggs) [1443234 1434560]
  - [net] tcp: avoid infinite loop in tcp_splice_read() (Davide Caratti) [1430577 1430578] {CVE-2017-6214}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.4.1.el6]
changelog:
  - [fs] xfs: handle array index overrun in xfs_dir2_leaf_readbuf() (Carlos Maiolino) [1445179 1440361]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.5.1.el6]
changelog:
  - [fs] sunrpc: Ensure that we wait for connections to complete before retrying (Dave Wysochanski) [1450850 1448170]
  - [net] ipv6: check raw payload size correctly in ioctl (Jamie Bainbridge) [1450870 1441909]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.6.1.el6]
changelog:
  - [netdrv] ixgbe: fix setup_fc for x550em (Ken Cox) [1457347 1442030]
  - [fs] nfsd: stricter decoding of write-like NFSv2/v3 ops (J. Bruce Fields) [1449274 1446755] {CVE-2017-7895}
  - [fs] nfsd4: minor NFSv2/v3 write decoding cleanup (J. Bruce Fields) [1449274 1446755] {CVE-2017-7895}
  - [scsi] libfc: quarantine timed out xids (Chris Leech) [1455550 1431440]
  - [fs] nfsv4: fix getacl ERANGE for some ACL buffer sizes (J. Bruce Fields) [1449096 869942]
  - [fs] nfsv4: fix getacl head length estimation (J. Bruce Fields) [1449096 869942]
  - [mm] hugetlb: check for pte NULL pointer in page_check_address() (Herton R. Krzesinski) [1444351 1431508]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.6.2.el6]
changelog:
  - [mm] enlarge stack guard gap (Larry Woodman) [1452729 1452730] {CVE-2017-1000364 CVE-2017-1000366}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.6.3.el6]
changelog:
  - [mm] allow JVM to implement its own stack guard pages (Larry Woodman) [1466667 1464237]
  - [mm] enlarge stack guard gap (Larry Woodman) [1466667 1464237]
  - Revert: [mm] enlarge stack guard gap (Larry Woodman) [1466667 1464237]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.21.1.el6]
changelog:
  - [fs] sunrpc: Revert "sunrpc: always treat the invalid cache as unexpired" (Thiago Becker) [1535938 1532786]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.22.1.el6]
changelog:
  - [mm] add cpu_relax() to "dont return 0 too early" patch (Ian Kent) [1527811 988988]
  - [mm] don't return 0 too early from find_get_pages() (Ian Kent) [1527811 988988]
  - [crypto] cryptd: Add cryptd_max_cpu_qlen module parameter (Jon Maxwell) [1527802 1503322]
  - [powerpc] spinlock: add gmb memory barrier (Mauricio Oliveira) [1531720 1538543]
  - [powerpc] Prevent Meltdown attack with L1-D$ flush (Mauricio Oliveira) [1531720 1538543]
  - [s390] vtime: turn BP on when going idle (Hendrik Brueckner) [1532733 1538542]
  - [s390] cpuinfo: show facilities as reported by stfle (Hendrik Brueckner) [1532733 1538542]
  - [s390] kconfigs: turn off SHARED_KERNEL support for s390 (Hendrik Brueckner) [1532733 1538542]
  - [s390] add ppa to system call and program check path (Hendrik Brueckner) [1532733 1538542]
  - [s390] spinlock: add gmb memory barrier (Hendrik Brueckner) [1532733 1538542]
  - [s390] introduce CPU alternatives (Hendrik Brueckner) [1532733 1538542]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.23.1.el6]
changelog:
  - [scsi] avoid a permanent stop of the scsi device's request queue (Ewan Milne) [1519857 1513455]
  - [x86] retpoline/hyperv: Convert assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Upgrade GCC retpoline warning to an error for brew builds (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Don't use kernel indirect thunks in vsyscalls (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Add a read-only retp_enabled debugfs knob (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: detect unretpolined modules (Waiman Long) [1543022 1535645]
  - [x86] retpoline/ACPI: Convert indirect jump in wakeup code (Waiman Long) [1543022 1535645]
  - [x86] retpoline/efi: Convert stub indirect calls & jumps (Waiman Long) [1543022 1535645]
  - [watchdog] hpwdt: remove indirect call in drivers/watchdog/hpwdt.c (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: cleanup __ptrace_may_access (Waiman Long) [1543022 1535645]
  - [x86] bugs: Drop one "mitigation" from dmesg (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: fix ptrace IBPB optimization (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Avoid returns in IBRS-disabled regions (Waiman Long) [1543022 1535645]
  - [x86] spectre/meltdown: avoid the vulnerability directory to weaken kernel security (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Update spec_ctrl.txt and kernel-parameters.txt (Waiman Long) [1543022 1535645]
  - [x86] Use IBRS for firmware update path (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: stuff RSB on context switch with SMEP enabled (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: use upstream RSB stuffing function (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: add ibrs_enabled=3 (ibrs_user) (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Integrate IBRS with retpoline (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: print features changed by microcode loading (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: refactor the init and microcode loading paths (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: move initialization of X86_FEATURE_IBPB_SUPPORT (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove SPEC_CTRL_PCP_IBPB bit (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove ibrs_enabled variable (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: add ibp_disabled variable (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: add X86_FEATURE_IBP_DISABLE (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove IBP disable for AMD model 0x16 (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove performance measurements from documentation (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: make ipbp_enabled read-only (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: remove ibpb_enabled=2 mode (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: Enable spec_ctrl functions for x86-32 (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: move vmexit rmb in the last branch before IBRS (Waiman Long) [1543022 1535645]
  - [x86] spec_ctrl: satisfy the barrier like semantics of IBRS (Waiman Long) [1543022 1535645]
  - [x86] spectre_v1: Mark it as mitigated (Waiman Long) [1543022 1535645]
  - [x86] pti: Do not enable PTI on CPUs which are not vulnerable to Meltdown (Waiman Long) [1543022 1535645]
  - [x86] mce: Make machine check speculation protected (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Add LFENCE to the retpoline/RSB filling RSB macros (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Fill return stack buffer on vmexit (Waiman Long) [1543022 1535645]
  - [x86] retpoline/irq32: Convert assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] retpoline/checksum32: Convert assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] retpoline/entry: Convert entry assembler indirect (Waiman Long) [1543022 1535645]
  - [x86] retpoline/crypto: Convert crypto assembler indirect jumps (Waiman Long) [1543022 1535645]
  - [x86] spectre: Add boot time option to select Spectre v2 mitigation (Waiman Long) [1543022 1535645]
  - [x86] retpoline: Add initial retpoline support (Waiman Long) [1543022 1535645]
  - [x86] cpu: Implement CPU vulnerabilites sysfs functions (Waiman Long) [1543022 1535645]
  - [base] sysfs/cpu: Add vulnerability folder (Waiman Long) [1543022 1535645]
  - [x86] cpufeatures: Add X86_BUG_SPECTRE_V[12] (Waiman Long) [1543022 1535645]
  - [x86] pti: Add the pti= cmdline option and documentation (Waiman Long) [1543022 1535645]
  - [x86] cpufeatures: Add X86_BUG_CPU_MELTDOWN (Waiman Long) [1543022 1535645]
  - [x86] pti: Rename CONFIG_KAISER to CONFIG_PAGE_TABLE_ISOLATION (Waiman Long) [1543022 1535645]
  - [x86] cpu: Expand cpufeature facility to include cpu bugs (Waiman Long) [1543022 1535645]
  - [x86] cpu: Merge bugs.c and bugs_64.c (Waiman Long) [1543022 1535645]
  - [x86] cpu/intel: Introduce macros for Intel family numbers (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Add missing '\n' at end of ALTERNATIVE inline asm (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Fix alt_max_short macro to really be a max() (Waiman Long) [1543022 1535645]
  - [x86] asm: Make asm/alternative.h safe from assembly (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Document macros (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Fix ALTERNATIVE_2 padding generation properly (Waiman Long) [1543022 1535645]
  - [x86] alternatives: Add instruction padding (Waiman Long) [1543022 1535645]
  - [x86] alternative: Add header guards to <asm/alternative-asm.h> (Waiman Long) [1543022 1535645]
  - [x86] alternative: Use .pushsection/.popsection (Waiman Long) [1543022 1535645]
  - [x86] copy_user_generic: Optimize copy_user_generic with CPU erms feature (Waiman Long) [1543022 1535645]
  - [x86] Make .altinstructions bit size neutral (Waiman Long) [1543022 1535645]
  - [x86] pti: Rework the trampoline stack switching code (Waiman Long) [1543022 1535645]
  - [x86] pti: Disable interrupt before trampoline stack switching (Waiman Long) [1543022 1535645]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.24.1.el6]
changelog:
  - [kernel] sched/core: Rework rq->clock update skips (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] sched: Remove useless code in yield_to() (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] sched: Set skip_clock_update in yield_task_fair() (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] sched, rt: Update rq clock when unthrottling of an otherwise idle CPU (Lauro Ramos Venancio) [1551475 1212959]
  - [kernel] lockdep: Fix lock_is_held() on recursion (Lauro Ramos Venancio) [1551475 1212959]
  - [net] bonding: discard lowest hash bit for 802.3ad layer3+4 (Hangbin Liu) [1550103 1532167]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.25.1.el6]
changelog:
  - [net] packet: Allow packets with only a header (but no payload) (Lorenzo Bianconi) [1557896 1535024]
  - [net] packet: make packet too small warning match condition (Lorenzo Bianconi) [1557896 1535024]
  - [net] packet: bail out of packet_snd() if L2 header creation fails (Lorenzo Bianconi) [1557896 1535024]
  - [net] packet: make packet_snd fail on len smaller than l2 header (Lorenzo Bianconi) [1557896 1535024]
  - [net] dccp: use-after-free in DCCP code (Stefano Brivio) [1520818 1520817] {CVE-2017-8824}
  - [fs] nfsd: check for oversized NFSv2/v3 arguments (J. Bruce Fields) [1447640 1447641] {CVE-2017-7645}
  - [netdrv] be2net: Fix UE detection logic for BE3 (Ivan Vecera) [1552706 1437991]
  - [x86] skip check for spurious faults for non-present faults (Daniel Vacek) [1551471 1495167]
  - [x86] mm: Fix boot crash caused by incorrect loop count calculation in sync_global_pgds() (Daniel Vacek) [1551471 1495167]
  - [scsi] lpfc: Null pointer dereference when log_verbose is set to 0xffffffff (Dick Kennedy) [1540481 1538340]
  - [mm] prevent concurrent unmap_mapping_range() on the same inode (Miklos Szeredi) [1538654 1408108]
  - [s390] fix transactional execution control register handling (Hendrik Brueckner) [1538591 1520862]
  - [netdrv] bnx2x: prevent crash when accessing PTP with interface down (Michal Schmidt) [1538586 1518669]
  - [v4l] media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic fixup (Jarod Wilson) [1548429 1548432] {CVE-2017-13166}
  - [v4l] media: v4l2-compat-ioctl32.c: refactor compat ioctl32 logic (Jarod Wilson) [1548429 1548432] {CVE-2017-13166}
  - [net] netfilter: xt_TCPMSS: add more sanity tests on tcph->doff (Florian Westphal) [1543089 1543091] {CVE-2017-18017}
  - [net] netfilter: xt_TCPMSS: fix handling of malformed TCP header and options (Florian Westphal) [1543089 1543091] {CVE-2017-18017}
  - [net] netfilter: xt_TCPMSS: SYN packets are allowed to contain data (Florian Westphal) [1543089 1543091] {CVE-2017-18017}
  - [net] bluetooth: Prevent uninitialized data (Gopal Tiwari) [1519627 1519626] {CVE-2017-1000410}


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.26.1.el6]
changelog:
  - [s390] qeth: check not more than 16 SBALEs on the completion queue (Hendrik Brueckner) [1557477 1520860]
  - [x86] pti: Disable kaiser_add_mapping if X86_FEATURE_NOPTI (Waiman Long) [1561441 1557562] {CVE-2017-5754}
  - [x86] irq/ioapic: Check for valid irq_cfg pointer in smp_irq_move_cleanup_interrupt (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] kexec/64: Clear control page after PGD init (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] efi/64: Fix potential PTI data corruption problem (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti/mm: Fix machine check with PTI on old AMD CPUs (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti/mm: Enable PAGE_GLOBAL if not affected by Meltdown (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] retpoline: Avoid retpolines for built-in __init functions (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] kexec/32: Allocate 8k PGD for PTI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] spec_ctrl: Patch out lfence on old 32-bit CPUs (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] cpufeature: Blacklist SPEC_CTRL/PRED_CMD on early Spectre v2 microcodes (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] spec_ctrl/32: Enable IBRS processing on kernel entries & exits (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] spec_ctrl/32: Stuff RSB on kernel entry (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Allow CONFIG_PAGE_TABLE_ISOLATION for x86_32 (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti/32: Add a PAE specific version of __pti_set_user_pgd (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Support PAE page table dumping (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable/pae: Use separate kernel PMDs for user page-table (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] mm/pae: Populate valid user PGD entries (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Enable x86-32 for kaiser.c (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Disable PCID handling in x86-32 TLB flushing code (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable: Disable user PGD poisoning for PAE (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable: Move more PTI functions out of pgtable_64.h (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable: Move pgdp kernel/user conversion functions to pgtable.h (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable/32: Allocate 8k page-tables when PTI is enabled (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pgtable/pae: Unshare kernel PMDs when PTI is enabled (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Handle debug exception similar to NMI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Add PTI cr3 switch to non-NMI entry/exit points (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Add PTI cr3 switches to NMI handler code (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Introduce SAVE_ALL_NMI and RESTORE_ALL_NMI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Enable the use of trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Change INT80 to be an interrupt gate (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Handle Entry from Kernel-Mode on Entry-Stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Leave the kernel via trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Enter the kernel via trampoline stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Restore segments before int registers (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Split off return-to-kernel path (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Unshare NMI return path (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Put ESPFIX code into a macro (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Load task stack from x86_tss.sp1 in SYSENTER handler (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Rename TSS_sysenter_sp0 to TSS_entry_stack (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] pti: Add X86_FEATURE_NOPTI to permanently disable PTI (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] entry/32: Simplify and fix up the SYSENTER stack #DB/NMI fixup (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] doublefault: Set the right gs register for doublefault (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] syscall: int80 must not clobber r12-15 (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] syscall: change ia32_syscall() to create the full register frame in ia32_do_call() (Waiman Long) [1553283 1550599] {CVE-2017-5754}
  - [x86] cve: Make all Meltdown/Spectre percpu variables available to x86-32 (Waiman Long) [1553283 1550599] {CVE-2017-5754}


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.27.1.el6]
changelog:
  - [mm] account skipped entries to avoid looping in find_get_pages (Dave Wysochanski) [1565989 1559386]
  - [x86] pti/32: Don't use trampoline stack on Xen PV (Waiman Long) [1568327 1562725]
  - [x86] pti: Use boot_cpu_has(X86_FEATURE_PTI_SUPPORT) for early call sites (Waiman Long) [1568327 1562725]
  - [x86] pti: Set X86_FEATURE_PTI_SUPPORT early (Waiman Long) [1568327 1562725]
  - [x86] pti: Rename X86_FEATURE_NOPTI to X86_FEATURE_PTI_SUPPORT (Waiman Long) [1568327 1562725]
  - [x86] pti/32: Fix setup_trampoline_page_table() bug (Waiman Long) [1568327 1562725]
  - [x86] entry: Remove extra argument in call instruction (Waiman Long) [1568332 1562552]
  - [x86] syscall: Fix ia32_ptregs handling bug in 64-bit kernel (Waiman Long) [1568332 1562552]
  - [x86] efi/64: Align efi_pgd on even page boundary (Waiman Long) [1568535 1558845]
  - [x86] pgtable/pae: Revert "Use separate kernel PMDs for user page-table" (Waiman Long) [1568535 1558845]
  - [x86] pgtable/pae: Revert "Unshare kernel PMDs when PTI is enabled" (Waiman Long) [1568535 1558845]
  - [x86] mm: Dump both kernel & user page tables at fault (Waiman Long) [1568535 1558845]
  - [x86] entry/32: Fix typo in PARANOID_EXIT_TO_KERNEL_MODE (Waiman Long) [1568535 1558845]


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.28.1.el6]
changelog:
  - [x86] entry/64: Don't use IST entry for #BP stack (Waiman Long) [1567078 1567079] {CVE-2018-8897}
  - [x86] xen: do not use xen_info on HVM, set pv_info name to "Xen HVM" (Vitaly Kuznetsov) [1569141 1568241]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.30.1.el6]
changelog:
  - [net] netlabel: cope with NULL catmap (Paolo Abeni) [1827226] {CVE-2020-10711}
  - [netdrv] bonding: don't set slave->link in bond_update_speed_duplex() (Patrick Talbert) [1828604]
  - [security] KEYS: prevent KEYCTL_READ on negative key (Patrick Talbert) [1498368] {CVE-2017-12192}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.31.1.el6]
changelog:
  - [x86] x86/speculation: Provide SRBDS late microcode loading support (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add Ivy Bridge to affected list (Waiman Long) [1827185] {CVE-2020-0543}
  - [documentation] x86/speculation: Add SRBDS vulnerability and mitigation documentation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/speculation: Add Special Register Buffer Data Sampling (SRBDS) mitigation (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add 'table' argument to cpu_matches() (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add a steppings field to struct x86_cpu_id (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu/bugs: Convert to new matching macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/cpu: Add consistent CPU match macros (Waiman Long) [1827185] {CVE-2020-0543}
  - [x86] x86/devicetable: Move x86 specific macro out of generic code (Waiman Long) [1827185] {CVE-2020-0543}
  - [netdrv] bonding/802.3ad: fix link_failure_count tracking (Patrick Talbert) [1841819]
  - [mm] mm: migration: add migrate_entry_wait_huge() (Waiman Long) [1839653]
  - [powerpc] powerpc/book3s64: Fix link stack flush on context switch (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: support nospectre_v2 cmdline option (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/security: Fix spectre_v2 reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Update Spectre v2 reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Add nospectre_v2 command line argument (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/fsl: Fix spectre_v2 mitigations reporting (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/pseries: Query hypervisor for count cache flush settings (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add support for software count cache flush (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add new security feature flags for count cache flush (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/asm: Add a patch_site macro & helpers for patching instructions (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Make meltdown reporting Book3S 64 specific (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Call setup_barrier_nospec() from setup_arch() (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Make stf barrier PPC_BOOK3S_64 specific (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Gustavo Duarte) [1796810]
  - [powerpc] powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Enhance the information in cpu_show_spectre_v1() (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64: Use barrier_nospec in syscall entry (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Enable barrier_nospec based on firmware settings (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Patch barrier_nospec in modules (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add support for ori barrier_nospec patching (Gustavo Duarte) [1796810]
  - [powerpc] powerpc/64s: Add barrier_nospec (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Add helper to check if offset is within relative branch range (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Have patch_instruction detect faults (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Introduce asm-prototypes.h (Gustavo Duarte) [1796810]
  - [powerpc] powerpc: Move local setup.h declarations to arch includes (Gustavo Duarte) [1796810]


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.32.1.el6]
changelog:
  - [wireless] libertas: make lbs_ibss_join_existing() return error code on rates overflow (Jarod Wilson) [1776569]
  - [wireless] libertas: don't exit from lbs_ibss_join_existing() with RCU read lock held (Jarod Wilson) [1776569]
  - [wireless] libertas: Fix two buffer overflows at parsing bss descriptor (Jarod Wilson) [1776569]
  - [security] keys: Protect request_key() against a type with no match function (Patrick Talbert) [1433220] {CVE-2017-2647}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-754.34.1.el6]
changelog:
  - [mm] mm: prevent get_user_pages() from overflowing page refcount (Aristeu Rozanski) [1705003]
  - [mm] mm/hugetlb.c: __get_user_pages ignores certain follow_hugetlb_page errors (Aristeu Rozanski) [1705003]


author: John Eckersberg <jeckersb@redhat.com> - 0.1.2-2
changelog:
  - Remove README and LICENSE from docs on -devel package
  - Remove -static package and merge contents into the -devel package


author: John Eckersberg <jeckersb@redhat.com> - 0.1.2-4
changelog:
  - Minor tweaks to spec file
  - Enable %check section
  - Thanks Gareth Armstrong <gareth.armstrong@hp.com>


author: Karsten Hopp <karsten@redhat.com> 1.1.6-15
changelog:
  - disable sane subpackage and sane requirements for mainframes, we don't have
    sane on s390 and s390x


author: Joel Granados <jgranado@redhat.com> - 1.1.6-17
changelog:
  - Fix the shebang issue.  See https://fedoraproject.org/wiki/Features/SystemPythonExecutablesUseSystemPython


author: Harald Hoyer <harald@redhat.com> 004-334
changelog:
  - fcoe: add --link-retry=100 to fipvlan call
  Resolves: rhbz#1012316
  - ldd: redirect error to /dev/null
  - do not turn off biosdevname, if not given on kernel cmdline
  Resolves: rhbz#1011508
  - network: fixed ibft parsing
  Resolves: rhbz#1011508


author: Harald Hoyer <harald@redhat.com> 004-347
changelog:
  - backport of the rootfallback= kernel cmdline option
  Resolves: rhbz#737687
  - call iscsistart regardless of network failures
  Resolves: rhbz#1099603
  - set the firmware loading timeout to 600
  Related: rhbz#1077186
  - add install_items to dracut.conf man page
  Resolves: rhbz#1041484
  - pickup nvme driver
  Resolves: rhbz#1041484
  - create  /dev/btrfs-control
  Resolves: rhbz#1070676
  - create all hook directories
  Resolves: rhbz#1051448


author: Harald Hoyer <harald@redhat.com> 004-356
changelog:
  - fixed support for multiple fcoe devices
  Resolves: rhbz#1022766
  - fixed iscsiroot with iscsi_firmware boot
  Resolves: rhbz#1126346


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.11.1.el6]
changelog:
  - [x86] mm/fault: Allow stack access below rsp (Waiman Long) [1644401]
  - [sound] alsa: rawmidi: Change resized buffers atomically (Denys Vlasenko) [1593083] {CVE-2018-10902}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.12.1.el6]
changelog:
  - [x86] vDSO: Don't generate retpoline for indirect call (Waiman Long) [1638552]
  - [fs] cifs: fix reparse point/symlink breakage (Leif Sahlberg) [1636484]
  - [scsi] qla2xxx: Mask off Scope bits in retry delay (Himanshu Madhani) [1588133]
  - [net] tcp: make tcp_retransmit_timer a no-op on empty write queue (Paolo Abeni) [1585892]
  - [kernel] sched/sysctl: Check user input value of sysctl_sched_time_avg (Lauro Ramos Venancio) [1579128]
  - [fs] Fix up non-directory creation in SGID directories (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] hugetlbfs: switch to inode_init_owner() (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] udf: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ubifs: replace inode uid, gid, mode initialization with helper function (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ramfs: replace inode uid, gid, mode initialization with helper function (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ext4: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ext3: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] ext2: replace inode uid, gid, mode init with helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] btrfs: replace inode uid, gid, mode initialization with helper function (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [fs] vfs: Add inode uid,gid,mode init helper (Miklos Szeredi) [1600951] {CVE-2018-13405}
  - [s390] kernel: adapt to changed CPU vulnerabilities function prototypes (Hendrik Brueckner) [1625381]
  - [s390] detect etoken facility (Hendrik Brueckner) [1625381]
  - [s390] Correct register corruption in critical section cleanup (Hendrik Brueckner) [1625381]
  - [s390] remove indirect branch from do_softirq_own_stack (Hendrik Brueckner) [1625381]
  - [s390] move spectre sysfs attribute code (Hendrik Brueckner) [1625381]
  - [s390] kernel: use expoline for indirect branches (Hendrik Brueckner) [1625381]
  - [s390] ftrace: use expoline for indirect branches (Hendrik Brueckner) [1625381]
  - [s390] move expoline assembler macros to a header (Hendrik Brueckner) [1625381]
  - [s390] correct module section names for expoline code revert (Hendrik Brueckner) [1625381]
  - [x86] speculation/l1tf: Fix overflow in l1tf_pfn_limit() on 32bit (Oleksandr Natalenko) [1670328]
  - [perf] Fix a race between ring_buffer_detach() and ring_buffer_attach() (Jiri Olsa) [1589340]
  - [perf] Fix mmap() accounting hole (Jiri Olsa) [1627672]
  - [perf] Fix perf mmap bugs (Jiri Olsa) [1627672]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.1.el6]
changelog:
  - [x86] x86/speculation: Don't print MDS_MSG_SMT message if mds_nosmt specified (Waiman Long) [1710081 1710517]
  - [x86] x86/spec_ctrl: Fix incorrect MDS handling in late microcode loading (Waiman Long) [1710081 1710517]
  - [x86] x86/speculation: Fix misuse of boot_cpu_has() with bug bits (Waiman Long) [1710121]
  - [x86] x86/speculation/mds: Fix documentation typo (Waiman Long) [1710517]
  - [documentation] Documentation: Correct the possible MDS sysfs values (Waiman Long) [1710517]
  - [x86] x86/mds: Add MDSUM variant to the MDS documentation (Waiman Long) [1710517]
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Waiman Long) [1710517]
  - [x86] x86/speculation/mds: Fix comment (Waiman Long) [1710517]
  - [x86] x86/speculation/mds: Add SMT warning message (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Remove redundant arch_smt_update() invocation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Add debugfs x86/smt_present file (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/spec_ctrl: Update MDS mitigation status after late microcode load (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Add MDS vulnerability documentation (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [documentation] Documentation: Move L1TF to separate directory (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Consolidate CPU whitelists (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/l1tf: Show actual SMT state (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Simplify sysfs report of VMX L1TF vulnerability (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [kernel] sched/smt: Provide sched_smt_active() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/speculation: Provide arch_smt_update() (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}
  - [x86] x86/mm: Fix compilation warning in pgtable_types.h (Waiman Long) [1692386 1692387 1692388] {CVE-2018-12126 CVE-2018-12127 CVE-2018-12130}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.16.1.el6]
changelog:
  - [virt] xenbus: Fix memory leak on release (Vitaly Kuznetsov) [1661666]
  - [fs] dcache: fix locking around setting DCACHE_SHRINKING flag (Miklos Szeredi) [1672269]
  - [x86] KVM: SVM: Selective cr0 intercept (Wei Huang) [1655873]
  - [x86] KVM: SVM: Restore unconditional cr0 intercept under npt (Wei Huang) [1655873]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.17.1.el6]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719840] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719585] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719585] {CVE-2019-11477}
  - [lib] idr: free the top layer if idr tree has the maximum height (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix top layer handling (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix backtrack logic in idr_remove_all (Denys Vlasenko) [1698139] {CVE-2019-3896}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.18.1.el6]
changelog:
  - [virt] xenbus: don't look up transaction IDs for ordinary writes (Vitaly Kuznetsov) [1663262]
  - [virt] xenbus: don't BUG() on user mode induced condition (Vitaly Kuznetsov) [1663262]
  - [virt] xenbus: Add proper handling of XS_ERROR from Xenbus for transactions (Vitaly Kuznetsov) [1663262]
  - [fs] proc: restrict kernel stack dumps to root (Denys Vlasenko) [1638193] {CVE-2018-17972}
  - [crypto] salsa20 - fix blkcipher_walk API usage (Bruno Eduardo de Oliveira Meneguele) [1543984]
  - [mm] vmscan: do not loop on too_many_isolated for ever (Rafael Aquini) [1658254]
  - [x86] spec_ctrl: Don't report the use of retpoline on Skylake as vulnerable (Waiman Long) [1666102]
  - [mm] try harder to allocate vmemmap blocks (Rafael Aquini) [1591394]
  - [v4l] dvb: revert spectre v1 mitigation (Josh Poimboeuf) [1647975]
  - [fs] binfmt_misc.c: do not allow offset overflow (Bill O'Donnell) [1710149]
  - [x86] pti: Don't use PCID and INVPCID in x86-32 (Waiman Long) [1702782]
  - [mm] mincore.c: make mincore() more conservative (Rafael Aquini) [1664197] {CVE-2019-5489}
  - [x86] spec: Move retp_compiler() inline function to bugs.c (Waiman Long) [1722185]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.18.2.el6]
changelog:
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Waiman Long) [1724512] {CVE-2019-1125}


author: - Guenther Deschner <gdeschner@redhat.com> - 3.6.23-6
changelog:
  - resolves: #1105500 - CVE-2014-0244: DoS in nmbd.
  - resolves: #1108841 - CVE-2014-3493: DoS in smbd with unicode path names.


author: - Andreas Schneider <asn@redhat.com> - 3.6.23-8
changelog:
  - resolves: #1110733 - Fix write operations as guest with 'security = share'.
  - resolves: #1053886 - Fix receiving the gecos field with winbind.


author: Rafael Aquini <aquini@redhat.com> [2.6.32-501.el6]
changelog:
  - [md] revert "raid1: Rewrite the implementation of iobarrier" (Jes Sorensen) [1127231]
  - [md] revert "raid1: fix request counting bug in new 'barrier' code" (Jes Sorensen) [1127231]
  - [scsi] hpsa: version string change (Tomas Henzl) [1054631]
  - [scsi] hpsa: change doorbell reset delay to ten seconds (Tomas Henzl) [1054631]
  - [scsi] hpsa: add a delay to kdump path (Tomas Henzl) [1054631]
  - [infiniband] ipoib: No longer use flush as a parameter (Doug Ledford) [1111073]
  - [infiniband] ipoib: Make ipoib_mcast_stop_thread flush the workqueue (Doug Ledford) [1111073]
  - [infiniband] ipoib: Use dedicated workqueues per interface (Doug Ledford) [1111073]
  - [infiniband] ipoib: change init sequence ordering (Doug Ledford) [1111073]
  - [infiniband] ipoib: fix mcast_dev_flush/mcast_restart_task race (Doug Ledford) [1111073]
  - [infiniband] ipoib: fix MCAST_FLAG_BUSY usage (Doug Ledford) [1111073]
  - [infiniband] ipoib: Make the carrier_on_task race aware (Doug Ledford) [1111073]
  - [infiniband] ipoib: Consolidate rtnl_lock tasks in workqueue (Doug Ledford) [1111073]
  - [infiniband] ipoib: Avoid multicast join attempts with invalid P_key (Doug Ledford) [1111073]
  - [infiniband] ipoib: Avoid flushing the workqueue from worker context (Doug Ledford) [1111073]
  - [infiniband] ipoib: Use P_Key change event instead of P_Key polling mechanism (Doug Ledford) [1111073]
  - [infiniband] mlx5: Enable "block multicast loopback" for kernel consumers (Doug Ledford) [1128863]
  - [mm] memory-failure: support use of a dedicated thread to handle SIGBUS BUS_MCEERR_AO (Rui Wang) [1108366]
  - [mm] memory-failure: don't let collect_procs() skip over processes for MF_ACTION_REQUIRED (Rui Wang) [1108366]
  - [mm] memory-failure: send right signal code to correct thread (Rui Wang) [1108366]
  - [x86] mce: Pay no attention to 'F' bit in MCACOD when parsing 'UC' errors (Rui Wang) [1093437]
  - [x86] kvm: trace kvm_ple_window grow/shrink (Radim Krcmar) [1093208]
  - [x86] kvm: vmx: dynamise PLE window (Radim Krcmar) [1093208]
  - [x86] kvm: vmx: make PLE window per-VCPU (Radim Krcmar) [1093208]
  - [x86] kvm: introduce sched_in to kvm_x86_ops (Radim Krcmar) [1093208]
  - [virt] kvm: add kvm_arch_sched_in (Radim Krcmar) [1093208]
  - [fs] Add full_check test before calling add_to_tfile_check() to prevent panic in reverse_path_check_proc() (Larry Woodman) [1130730]
  - [perf] x86: Fix Silvermont offcore masks (Jiri Olsa) [1036335]
  - [perf] x86: Add model number for Avoton Silvermont (Jiri Olsa) [1036335]
  - [perf] x86: Add Silvermont 22nm Atom support (Jiri Olsa) [1036335]
  - [perf] x86: use INTEL_UEVENT_EXTRA_REG to define MSR_OFFCORE_RSP_X (Jiri Olsa) [1036335]
  - [perf] x86: Fix Intel shared extra MSR allocation (Jiri Olsa) [1036335]
  - [x86] amd: perf: Unify AMD's generic and family 15h pmus (Jiri Olsa) [1133680]


author: Rafael Aquini <aquini@redhat.com> [2.6.32-502.el6]
changelog:
  - [kernel] audit: audit_log_start running on auditd should not stop (Richard Guy Briggs) [1019898]
  - [kernel] audit: drop audit_cmd_lock in AUDIT_USER family of cases (Richard Guy Briggs) [1019898]
  - [security] selinux: call WARN_ONCE() instead of calling audit_log_start() (Richard Guy Briggs) [1019898]
  - [crypto] drbg: fix failure of generating multiple of 2**16 bytes (Herbert Xu) [1130529]
  - [x86] uv: Set n_lshift based on GAM_GR_CONFIG MMR for UV3 (George Beshers) [1096981]
  - [fs] nfs: Close another NFSv4 recovery race (Steve Dickson) [1093922]
  - [fs] nfs: Refactor _nfs4_open_and_get_state to set ctx->state (Steve Dickson) [1093922]
  - [fs] nfs: cleanup: pass the nfs_open_context to nfs4_do_open (Steve Dickson) [1093922]
  - [fs] sunrpc: Handle EPIPE in xprt_connect_status (Steve Dickson) [1130619]
  - [fs] sunrpc: Ensure xprt_connect_status handles all potential connection errors (Steve Dickson) [1130619]
  - [fs] sunrpc: Ensure that we handle ENOBUFS errors correctly (Steve Dickson) [1130619]
  - [fs] sunrpc: Ensure call_connect_status() deals correctly with SOFTCONN tasks (Steve Dickson) [1130619]
  - [fs] sunrpc: Ensure that call_connect times out correctly (Steve Dickson) [1130619]
  - [fs] sunrpc: Handle connect errors ECONNABORTED and EHOSTUNREACH (Steve Dickson) [1130619]
  - [fs] sunrpc: call_connect_status should recheck bind and connect status on error (Steve Dickson) [1130619]
  - [fs] sunrpc: Report network/connection errors correctly for SOFTCONN rpc tasks (Steve Dickson) [1130619]
  - [fs] ext3: Fix fdatasync() for files with only i_size changes (Eric Sandeen) [1127023]
  - [fs] gfs2: Change maxlen variables to size_t (Robert S Peterson) [1126899]
  - [mm] hugetlb: add cond_resched_lock() in return_unused_surplus_pages() (Motohiro Kosaki) [1129085]
  - [mm] hugetlb: fix softlockup when a large number of hugepages are freed (Motohiro Kosaki) [1129085]
  - [net] fix ipv4: match prefsrc when deleting routes (Jiri Benc) [1056443]
  - [net] bridge: explictly tag vlan-accelerated frames destined to the host (Vlad Yasevich) [1121991]
  - [net] ipv4: avoid parallel route cache gc executions (Hannes Frederic Sowa) [1121228]
  - [net] ipv4: move route garbage collector to work queue (Hannes Frederic Sowa) [1121228]
  - [net] ethtool: reallow ETHTOOL_SFLAGS to set TX/RX VLAN offloads (Michal Schmidt) [1134359]
  - [net] tcp: tsq: fix nonagle handling (Jiri Pirko) [1134401]
  - [kvm] iommu: fix the third parameter of kvm_iommu_put_pages (Radomir Vrbovsky) [1131953] {CVE-2014-3601}
  - [s390] sysinfo: convert /proc/sysinfo to seqfile (Hendrik Brueckner) [1130987]
  - [s390] con3215: fix hanging console issue (Hendrik Brueckner) [1130986]
  - [s390] dasd: validate request size before building CCW/TCW request (Hendrik Brueckner) [1130988]
  - [scsi] revert "fc: ensure scan_work isn't active when freeing fc_rport" (Maurizio Lombardi) [1135888]
  - [edac] sb_edac: Modify H/W event reporting policy (Rui Wang) [1129067]
  - [alsa] control: Fix replacing user controls (Denys Vlasenko) [1117322] {CVE-2014-4654 CVE-2014-4655}
  - [netdrv] bnx2x: Fix RSS on big-endian (Michal Schmidt) [1119291]
  - [netdrv] bnx2x: Utilize FW 7.10.51 (Michal Schmidt) [1119291]
  - [netdrv] firmware: add bnx2x FW 7.10.51 (Michal Schmidt) [1119291]
  - [security] selinux: fix a problem with IPv6 traffic denials in selinux_ip_postroute() (Paul Moore) [1130082]


author: Rafael Aquini <aquini@redhat.com> [2.6.32-503.el6]
changelog:
  - [kernel] futex: Fix errors in nested key ref-counting (Denys Vlasenko) [1094458] {CVE-2014-0205}
  - [fs] vfs: add missing __putname() in patch_mountpoint() (Ian Kent) [1135165]
  - [fs] nfs: Don't busy-wait on SIGKILL in __nfs_iocounter_wait (Benjamin Coddington) [1113269]
  - [netdrv] mlx4: add vlan_rx_register to the master ops (Doug Ledford) [1133506]
  - [infiniband] ocrdma: use right macro in query ah (Doug Ledford) [1133506]
  - [infiniband] ocrdma: resolve L2 address when creating user AH (Doug Ledford) [1133506]
  - [infiniband] ocrdma: get vlan tag from ib_qp_attrs (Doug Ledford) [1133506]
  - [infiniband] ocrdma: add default gid at index 0 (Doug Ledford) [1133506]
  - [infiniband] ocrdma: obtain sl from deivce structure (Doug Ledford) [1133506]
  - [infiniband] ocrdma: do not skip setting deffered_arm (Doug Ledford) [1133506]
  - [infiniband] ocrdma: Initialize the GID table while registering the device (Doug Ledford) [1133506]
  - [infiniband] ocrdma: Increase the size of STAG array in dev structure to 16K (Doug Ledford) [1133506]
  - [infiniband] ocrdma: Add missing adapter mailbox opcodes (Doug Ledford) [1133506]
  - [infiniband] ocrdma: Return proper value for max_mr_size (Doug Ledford) [1133506]
  - [infiniband] ocrdma: Allow only SEND opcode in case of UD QPs (Doug Ledford) [1133506]
  - [infiniband] ocrdma: Avoid reporting wrong completions in case of error CQEs (Doug Ledford) [1133506]
  - [infiniband] ocrdma: Query and initalize the PFC SL (Doug Ledford) [1133506]
  - [infiniband] ocrdma: Avoid posting DPP requests for RDMA READ (Doug Ledford) [1133506]
  - [infiniband] core: When marsheling uverbs path, clear unused fields (Amir Vadai) [1130394]
  - [infiniband] mlx4: Avoid executing gid task when device is being removed (Amir Vadai) [1130394]
  - [infiniband] mlx4: Fix lockdep splat for the iboe lock (Amir Vadai) [1130394]
  - [infiniband] mlx4: Get upper dev addresses as RoCE GIDs when port comes up (Amir Vadai) [1130394]
  - [infiniband] mlx4: Reorder steps in RoCE GID table initialization (Amir Vadai) [1130394]
  - [infiniband] mlx4: Don't duplicate the default RoCE GID (Amir Vadai) [1130394]
  - [infiniband] mlx4: Avoid null pointer dereference in mlx4_ib_scan_netdevs() (Amir Vadai) [1130394]
  - [netdrv] b43: fix the wrong assignment of status.freq in b43_rx() (John Greene) [1132160]
  - [lib] lzo: properly check for overruns (Denys Vlasenko) [1113901] {CVE-2014-4608}
  - [lib] lzo: Update LZO compression to current upstream version (Denys Vlasenko) [1113901] {CVE-2014-4608}
  - [drm] nouveau: add more checks to PRAMIN image fetching (Ben Skeggs) [1133695 1076733]
  - [drm] nouveau: allow non-optimus setups to load vbios from acpi (Ben Skeggs) [1133695 1076733]
  - [drm] nouveau: fix a potential NULL deref in the PROM shadowing function (Ben Skeggs) [1133695 1076733]
  - [drm] nouveau: fetch the vbios from PROM using only aligned 32-bit accesses (Ben Skeggs) [1133695 1076733]
  - [net] Revert "introduce netif_skb_dev_features" (Florian Westphal) [1029603]
  - [net] revert "ip, ipv6: handle gso skbs in forwarding path" (Florian Westphal) [1029603]


author: Rafael Aquini <aquini@redhat.com> [2.6.32-504.el6]
changelog:
  - [netdrv] revert "cxgb4: set skb->rxhash" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Use netif_set_real_num_rx/tx_queues()" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Turn on delayed ACK" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use ULP_MODE_TCPDDP" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Debugfs dump_qp() updates" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Drop peer_abort when no endpoint found" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Detect DB FULL events and notify RDMA ULD" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Common platform specific changes for DB Drop Recovery" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: DB Drop Recovery for RDMA and LLD queues" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add debugfs RDMA memory stats" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add DB Overflow Avoidance" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: DB Drop Recovery for RDMA and LLD queues" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use vmalloc() for debugfs QP dump" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Remove kfifo usage" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Include vmalloc.h for vmalloc and vfree" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: set maximal number of default RSS queues" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Remove duplicate register definitions" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Update RDMA/cxgb4 due to macro definition removal in cxgb4 driver" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Move dereference below NULL test" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix incorrect values for MEMWIN*_APERTURE and MEMWIN*_BASE" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add functions to read memory via PCIE memory window" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Code cleanup to enable T4 Configuration File support" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add support for T4 configuration file" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add support for T4 hardwired driver configuration settings" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Don't attempt to upgrade T4 firmware when cxgb4 will end up as a slave" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix error handling in create_qp()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Dynamically allocate memory in t4_memory_rw() and get_vpd_params()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix build error due to missing linux/vmalloc.h include" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: allocate enough data in t4_memory_rw()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Address various sparse warnings" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Remove unnecessary #ifdef condition" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Don't free chunk that we have failed to allocate" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix unable to get UP event from the LLD" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix initialization of SGE_CONTROL register" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: use WARN" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Chelsio FCoE offload driver submission" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: remove __dev* attributes" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add T4 filter support" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add LE hash collision bug fix path in LLD driver" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix LE hash collision bug for active open connection" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix LE hash collision bug for passive open connection" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix bug for active and passive LE hash collision path" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Use netdev_<level> and pr_<level>" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix incorrect PFVF CMASK" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Abort connections that receive unexpected streaming mode data" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Abort connections when moving to ERROR state" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Display streaming mode error only if detected in RTS" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Keep QP referenced until TID released" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Always log async errors" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Only log rx_data warnings if cpl status is non-zero" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix endpoint timeout race condition" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Don't reconnect on abort for mpa_rev 1" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Don't wakeup threads for MPAv2" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Insert hwtid in pass_accept_req instead in pass_establish" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Address sparse warnings" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: "cookie" can stay in host endianness" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix cast warning" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Allow for backward compatibility with new VPD scheme" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add register definations for T5" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add macros, structures and inline functions for T5" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Initialize T5" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Dump T5 registers" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add T5 write combining support" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Enable doorbell drop recovery only for T4 adapter" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add T5 debugfs support" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add T5 PCI ids" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Update driver version and description" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Disable SR-IOV support for PF4-7 for T5" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add Support for Chelsio T5 adapter" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Turn off db coalescing when RDMA QPs are in use" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add module_params to enable DB FC & Coalescing on T5" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use DSGLs for fastreg and adapter memory writes for T5" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Map pbl buffers for dma if using DSGL" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Bump tcam_full stat and WR reply timeout" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix onchip queue support for T5" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix error return code in create_qp()" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix SQ allocation when on-chip SQ is disabled" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix pci_device_id structure initialization with correct PF number" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Support CPL_SGE_EGR_UPDATEs encapsulated in a CPL_FW4_MSG" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Support CPL_SGE_EGR_UPDATEs encapsulated in a CPL_FW4_MSG" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: fix error recovery when t4_fw_hello returns a positive value" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Force uninitialized state if FW_ON_ADAPTER is < FW_VERSION and we're the MASTER_PF" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Correct comparisons and calculations using skb->tail and skb-transport_header" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Do not set net_device::dev_id to VI index" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix stack info leak in c4iw_create_qp()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add routines to create and remove listening IPv6 servers" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add CLIP support to store compressed IPv6 address" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cma: Add IPv6 support for iWARP" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add support for active and passive open connection with IPv6 address" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Handle newer firmware changes" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use correct bit shift macros for vlan filter tuples" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix QP flush logic" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix accounting for unsignaled SQ WRs to deal with wrap" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Set arp error handler for PASS_ACCEPT_RPL messages" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Always do GTS write if cidx_inc == CIDXINC_MASK" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Advertise ~0ULL as max MR size" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Issue RI.FINI before closing when entering TERM" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: remove workqueue when driver registration fails" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: remove unnecessary pci_set_drvdata()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cgxb4: remove duplicate include in cxgb4.h" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Much cleaner implementation of is_t4()/is_t5()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: added much cleaner implementation of is_t4()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add new scheme to update T4/T5 firmware" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix formatting of physical address" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Make _c4iw_write_mem_dma() static" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: calls skb_set_hash" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Reserve stid 0 for T4/T5 adapters" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Include TCP as protocol when creating server filters" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Assign filter server TIDs properly" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Account for stid entries properly in case of IPv6" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add API to correctly calculate tuple fields" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: make functions static and remove dead code" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Calculate the filter server TID properly" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Server filters are supported only for IPv4" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use cxgb4_select_ntuple to correctly calculate ntuple fields" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: allow large buffer size to have page size" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Changed FW check version to match FW binary version" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: silence shift wrapping static checker warning" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Avoid disabling PCI device for towice" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Don't retrieve stats during recovery" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix gcc warning on 32-bit arch" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix referencing freed adapter" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add missing neigh_release in LE-Workaround path" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Use pci_enable_msix_range() instead of pci_enable_msix()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add support to recognize 40G links" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Print adapter VPD Part Number instead of Engineering Change field" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Allow >10G ports to have multiple queues" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: LE-Workaround is not atomic in firmware" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Query firmware for T5 ULPTX MEMWRITE DSGL capabilities" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Remove unused registers and add missing ones" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Don't assume LSO only uses SGL path in t4_eth_xmit()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add more PCI device ids" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cgxb4: Stop using ethtool SPEED_* constants" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: use remove handler as shutdown handler" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix some small bugs in t4_sge_init_soft() when our Page Size is 64KB" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add code to dump SGE registers when hitting idma hangs" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Rectify emitting messages about SGE Ingress DMA channels being potentially stuck" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Updates for T5 SGE's Egress Congestion Threshold" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Calculate len properly for LSO path" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Treat CPL_ERR_KEEPALV_NEG_ADVICE as negative advice" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Doorbell Drop Avoidance Bug Fixes" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix underflows in c4iw_create_qp()" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix four byte info leak in c4iw_create_cq()" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Cap CQ size at T4_MAX_IQ_SIZE" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Allow loopback connections" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Always release neigh entry" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix incorrect BUG_ON conditions" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Mind the sq_sig_all/sq_sig_type QP attributes" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Default peer2peer mode to 1" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Save the correct map length for fast_reg_page_lists" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Don't leak skb in c4iw_uld_rx_handler()" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix possible memory leak in RX_PKT processing" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Ignore read reponse type 1 CQEs" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Connect_request_upcall fixes" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Update snd_seq when sending MPA messages" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Call dev_kfree/consume_skb_any instead of kfree_skb" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxbg4: Remove addressof casts to same type" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Adds device ID for few more Chelsio Adapters" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: set error code on kmalloc() failure" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Lock around accept/reject downcalls" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Drop RX_DATA packets if the endpoint is gone" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: rx_data() needs to hold the ep mutex" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Disable DSGL use by default" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use the BAR2/WC path for kernel QPs and T5 devices" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Endpoint timeout fixes" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: rmb() after reading valid gen bit" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: SQ flush fix" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Max fastreg depth depends on DSGL support" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use pr_warn_ratelimited" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Initialize reserved fields in a FW work request" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add missing debug stats" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Use uninitialized_var()" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix over-dereference when terminating" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Save the correct mac addr for hw-loopback connections in the L2T" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: use the correct max size for firmware flash" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix endpoint mutex deadlocks" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Force T5 connections to use TAHOE congestion control" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Only allow kernel db ringing for T4 devs" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Update Kconfig to include Chelsio T5 adapter" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Decode PCIe Gen3 link speed" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix memory leaks in c4iw_alloc() error paths" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Fix vlan support" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: Add missing padding at end of struct c4iw_create_cq_resp" (Prarit Bhargava) [1140743]
  - [infiniband] revert "cxgb4: add missing padding at end of struct c4iw_alloc_ucontext_resp" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Decode the firmware port and module type a bit more for ethtool" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Check if rx checksum offload is enabled, while reading hardware calculated checksum" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: Allocate and use IQs specifically for indirect interrupts" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: Choose appropriate hw mtu index and ISS for iWARP connections" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: don't truncate the recv window size" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Change default Interrupt Holdoff Packet Count Threshold" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fixes cxgb4 probe failure in VM when PF is exposed through PCI Passthrough" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Use FW interface to get BAR0 value" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Replaced the backdoor mechanism to access the HW memory with PCIe Window method" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Adds device ID for few more Chelsio T4 Adapters" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: remove unnecessary null test before debugfs_remove_recursive" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: Detect Ing. Padding Boundary at run-time" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: use firmware ord/ird resource limits" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: display TPTE on errors" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: work request logging feature" (Prarit Bhargava) [1140743]
  - [netdrv] revert "iw_cxgb4: Move common defines to cxgb4" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Add the MC1 registers to read in the interrupt handler" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fixed incorrect check for memory operation in t4_memory_rw" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: only free allocated fls" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Fix possible race condition in cleanup" (Prarit Bhargava) [1140743]
  - [infiniband] revert "iw_cxgb4: fix for 64-bit integer division" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Add core T4 PCI-E SR-IOV Virtual Function hardware definitions and device communication code" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Add T4 Virtual Function Scatter-Gather Engine DMA code" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Add main T4 PCI-E SR-IOV Virtual Function driver for cxgb4vf" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Add new Makefile for T4 PCI-E SR-IOV Virtual Function driver cxgb4vf" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Stitch new T4 PCI-E SR-IOV Virtual Function driver into the build" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Remove obsolete comment about the lack of a TX Timer Callback" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Use correct shift factor for extracting the SGE DMA Ingress Padding Boundary" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: remove obsolete DECLARE_PCI_UNMAP_ADDR usage" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Implement "Unhandled Interrupts" statistic" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix TX Queue restart" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix SGE resource resource deallocation bug" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Fix off-by-one error checking for the end of the mailbox delay array" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Fix bug where we were only allocating one queue in MSI mode" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: do not use PCI resources before pci_enable_device()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Use netif_set_real_num_rx/tx_queues()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: make single bit signed bitfields unsigned" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: remove call to stop TX queues at load time" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: don't implement trivial (and incorrect) ndo_select_queue()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix bug in Generic Receive Offload" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix some errors in Gather List to skb conversion" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: flesh out PCI Device ID Table" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Fail open if link_start() fails" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: add call to Firmware to reset VF State" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: minor comment/symbolic name cleanup" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: add ethtool statistics for GRO" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix up "Section Mismatch" compiler warning" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Advertise NETIF_F_TSO_ECN" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix setting unicast/multicast addresses" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Ingress Queue Entry Size needs to be 64 bytes" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: fix mailbox data/control coherency domain race" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: recover from failure in cxgb4vf_open()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Check driver parameters in the right place" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Behave properly when CONFIG_DEBUG_FS isn't defined" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Quiesce Virtual Interfaces on shutdown" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Use defined Mailbox Timeout" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: improve Kconfig dependencies" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: do vlan cleanup" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: remove __dev* attributes" (Prarit Bhargava) [1140743]
  - [netdrv] revert "chelsio: Use netdev_<level> and pr_<level>" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Fix extraction of cpl_rx_pkt from the response queue descriptor" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Fix VLAN extraction counter increment" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Add support for Chelsio T5 adapter" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Support CPL_SGE_EGR_UPDATEs encapsulated in a CPL_FW4_MSG" (Prarit Bhargava) [1140743]
  - [netdrv] revert "net: cxgb4vf: Staticize local symbols" (Prarit Bhargava) [1140743]
  - [netdrv] revert "net: cxgb4vf: remove unnecessary pci_set_drvdata()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "net: cxgb4vf: use DEFINE_PCI_DEVICE_TABLE" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: added much cleaner implementation of is_t4()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: make functions static and remove dead code" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Remove superfluous call to pci_disable_msix()" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4vf: Adds device Id for few more Chelsio adapters" (Prarit Bhargava) [1140743]
  - [netdrv] revert "cxgb4: Export symbols required by cxgb4i for ipv6 support and required defines" (Prarit Bhargava) [1140743]
  - [scsi] revert "libcxgbi: Add ipv6 api to driver" (Prarit Bhargava) [1140743]
  - [scsi] revert "cxgb4i: Add ipv6 code to driver, call into libcxgbi ipv6 api" (Prarit Bhargava) [1140743]
  - [scsi] revert "cxgb4i: Fix ipv6 build failure caught with randconfig" (Prarit Bhargava) [1140743]
  - [scsi] revert "cxgb4i: remove spurious use of rcu" (Prarit Bhargava) [1140743]
  - [scsi] revert "cxgb4i: Guard ipv6 code with a config check" (Prarit Bhargava) [1140743]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.1.1.el6]
changelog:
  - [fs] call d_op->d_hash on last component of umount path (Abhijith Das) [1145193 1129712]
  - [usb] serial: memory corruption flaw (Jacob Tanenbaum) [1141401 1141402] {CVE-2014-3185}
  - [char] ipmi: Clear drvdata when interface is removed (Tony Camuso) [1149578 1135910]
  - [char] ipmi: init shadow_ipmi_smi_handlers early in ipmi_si_intf (Tony Camuso) [1149580 1139464]
  - [net] ipsec: update MAX_AH_AUTH_LEN to support sha512 (Herbert Xu) [1149083 1140103]
  - [net] revert "bridge: Set vlan_features to allow offloads on vlans" (Vlad Yasevich) [1144442 1121991]
  - [netdrv] virtio-net: fix big buffer receiving (Jason Wang) [1148693 1144073]
  - [netdrv] tg3: prevent ifup/ifdown during PCI error recovery (Ivan Vecera) [1142570 1117009]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.2.1.el6]
changelog:
  - [fs] udf: Avoid infinite loop when processing indirect ICBs (Jacob Tanenbaum) [1142319 1142320] {CVE-2014-6410}
  - [fs] isofs: unbound recursion when processing relocated directories (Jacob Tanenbaum) [1142268 1142269] {CVE-2014-5472 CVE-2014-5471}
  - [net] ipv6: delete expired route in ip6_pmtu_deliver (Hannes Frederic Sowa) [1161418 1156137]
  - [net] sctp: fix remote memory pressure from excessive queueing (Daniel Borkmann) [1155746 1154676] {CVE-2014-3688}
  - [net] sctp: fix panic on duplicate ASCONF chunks (Daniel Borkmann) [1155733 1154676] {CVE-2014-3687}
  - [net] sctp: fix skb_over_panic when receiving malformed ASCONF chunks (Daniel Borkmann) [1147857 1154676] {CVE-2014-3673}
  - [net] sctp: handle association restarts when the socket is closed (Daniel Borkmann) [1147857 1154676]
  - [md] dm-thin: refactor requeue_io to eliminate spinlock bouncing (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: optimize retry_bios_on_resume (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: sort the deferred cells (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: direct dispatch when breaking sharing (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: remap the bios in a cell immediately (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: defer whole cells rather than individual bios (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: factor out remap_and_issue_overwrite (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: performance improvement to discard processing (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: grab a virtual cell before looking up the mapping (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: implement thin_merge (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm: improve documentation and code clarity in dm_merge_bvec (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: adjust max_sectors_kb based on thinp blocksize (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] block: fix alignment_offset math that assumes io_min is a power-of-2 (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: throttle incoming IO (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: prefetch missing metadata pages (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-transaction-manager: add support for prefetching blocks of metadata (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin-metadata: change dm_thin_find_block to allow blocking, but not issuing, IO (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-bio-prison: switch to using a red black tree (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-bufio: evict buffers that are past the max age but retain some buffers (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-bufio: switch from a huge hash table to an rbtree (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-bufio: update last_accessed when relinking a buffer (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-bufio: use kzalloc when allocating dm_bufio_client (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin-metadata: do not allow the data block size to change (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: cleanup noflush_work to use a proper completion (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [md] dm-thin: fix DMERR typo in pool_status error path (Mike Snitzer) [1161420 1161421 1142773 1145230]
  - [fs] xfs: xlog_cil_force_lsn doesn't always wait correctly (Eric Sandeen) [1158325 1133304]
  - [netdrv] ixgbe: allow TXDCTL.WRTHRESH to be 1 will small ITR values (John Greene) [1158326 1132267]
  - [netdrv] ixgbe: Intel Change to allow itr changes without CONFIG_BQL support (John Greene) [1158326 1132267]
  - [video] offb: Fix setting of the pseudo-palette for >8bpp (Gerd Hoffmann) [1158328 1142450]
  - [video] offb: Add palette hack for qemu "standard vga" framebuffer (Gerd Hoffmann) [1158328 1142450]
  - [video] offb: Fix bug in calculating requested vram size (Gerd Hoffmann) [1158328 1142450]
  - [net] sock_queue_err_skb() dont mess with sk_forward_alloc (Jiri Benc) [1155427 1148257]
  - [net] guard tcp_set_keepalive() to tcp sockets (Florian Westphal) [1141744 1141746] {CVE-2012-6657}
  - Revert: [net] revert "bridge: Set vlan_features to allow offloads on vlans" (Vlad Yasevich) [1144442 1121991]
  - [x86] kvm: fix PIT timer race condition (mguzik) [1149592 1149593] {CVE-2014-3611}
  - [x86] kvm: vmx: handle invept and invvpid vm exits gracefull (mguzik) [1144826 1144837 1144827 1144838] {CVE-2014-3646 CVE-2014-3645}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.3.1.el6]
changelog:
  - [s390] zcrypt: toleration of new crypto adapter hardware (Hendrik Brueckner) [1158311 1134984]
  - [s390] zcrypt: support for extended number of ap domains (Hendrik Brueckner) [1158311 1134984]
  - [md] dm-thin: fix potential for infinite loop in pool_io_hints (Mike Snitzer) [1161420 1161421 1142773 1145230]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.3.2.el6]
changelog:
  - [md] dm-thin: fix pool_io_hints to avoid looking at max_hw_sectors (Mike Snitzer) [1161420 1161421 1142773 1145230]


author: Petr Pisar <ppisar@redhat.com> - 4:5.10.1-133
changelog:
  - Resolves: #698552 - Correct taintedness tests
  - Resolves: #825713 - Fix find2perl to translate ? glob properly
  - Resolves: #810469 - Upgrade IO-Compress, Compress-Raw-Bzip2, and
    Compress-Raw-Zlib to 2.021
  - Resolves: #819042 - Set default output for Pod::Man and Pod::Text
    parse_file() methods
  - Resolves: #905482 - Require glibc-devel, gdbm-devel, db4-devel by perl-devel


author: Petr Pisar <ppisar@redhat.com> - 4:5.10.1-134
changelog:
  - Resolves: #973022 - Make non-option handler for Getopt::Long::GetOptions()
    compatible with XML::Simple


author: Petr Pisar <ppisar@redhat.com> - 4:5.10.1-138
changelog:
  - Fix backslash interpolation in Locale::Maketext (bug #1025906)
  - Do not ignore single-letter-named packages by Module::Plugable (bug #1086215)
  - Run-require exact version of perl-libs by perl-suidperl (bug #1161170)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.16.0
changelog:
  - Bump to 2.6.16 and u201b00.
  - Update 8076221/PR2809 (disable RC4) to apply after 8208350 (disable DES)
  - Resolves: rhbz#1633817


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.201-2.6.17pre01.0
changelog:
  - Bump to 2.6.17pre01.
  - Add support for icedtea_snapshot so we can build pre-releases.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.211-2.6.17.0
changelog:
  - Bump to 2.6.17.
  - Adjust jdk8076221-pr2809-disable_rc4_cipher_suites.patch to apply after 8211883
  - Resolves: rhbz#1661577


author: Severin Gehwolf <sgehwolf@redhat.com> - 1:1.7.0.211-2.6.17.1
changelog:
  - Produce debug symbols for libpulse-java.so
  - Set IT_CFLAGS=-g so that debug symbols for the pulse audio
  - native library are being produced. This is needed to fix
  - rpmdiff errors of missing .debug_info in pulse-java.so.debug.
  - Resolves: rhbz#1661577


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.231-2.6.19.0
changelog:
  - Bump to 2.6.19 (including tapsets) and OpenJDK 7u231-b01.
  - Fix fsg.sh to fail if patching fails.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.241-2.6.20.0
changelog:
  - Bump to 2.6.20 and OpenJDK 7u241-b01.
  - Drop PR1834/RH1022017 which is now handled by JDK-8228825 upstream.
  - Drop JDK-8226318/RH1738637 which is now included upstream.
  - Resolves: rhbz#1753423


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Update to aarch64-jdk8u151-b12.
  - Update location of OpenJDK zlib system library source code in remove-intree-libraries.sh
  - Drop upstreamed patches for 8179084 and RH1367357 (part of 8183028).
  - Update RH1191652 (root) to accomodate 8151841 (GCC 6 support).
  - Update RH1163501 to accomodate 8181048 (crypto refactoring)
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Add 8075484/PR3473/RH1490713 which is listed as being in 8u151 but not supplied by Oracle.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Fix premature shutdown of NSS in SunEC provider.
  - Move -ffp-no-contract fix to local fixes section.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Update SystemTap tapsets to version in IcedTea 3.6.0pre02 to fix RH1492139.
  - Resolves: rhbz#1499207


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.151-0.b12
changelog:
  - Correct fix to RH1191652 root patch so existing COMMON_CCXXFLAGS_JDK is not lost.
  - Resolves: rhbz#1499207


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.151-1.b12
changelog:
  - repack policies adapted to new counts and paths
  - note that also c-j-c is needed to make this apply in next update
  - Resolves: rhbz#1499207


author: Than Ngo <than@redhat.com> - 4.3.4-22
changelog:
  - Resolves: bz#666295, Missing help page(s) for Plasma workspace
  - Resolves: bz#587917, gnome/kde system monitor tool use same icon


author: Martin Stransky <stransky@redhat.com> - 60.7.2-3
changelog:
  - Rebuild to fix rhbz#1725919 - Thunderbird fails to authenticate
    with gmail with ssl/tls and OAuth2.


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-43
changelog:
  - Fix blkdeviotune for shutoff domain (rhbz#1122819)
  - rpc: message related sizes enlarged (rhbz#1126393)
  - Increase the size of REMOTE_MIGRATE_COOKIE_MAX to REMOTE_STRING_MAX (rhbz#1126393)
  - Fix max stream packet size for old clients (rhbz#1126393)
  - Adjust legacy max payload size to account for header information (rhbz#1126393)
  - rpc: Correct the wrong payload size checking (rhbz#1126393)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-46
changelog:
  - cpu: separate host-model and host-passthrough (rhbz#1138222)
  - Don't include non-migratable features in host-model (rhbz#1138222)
  - Don't add dhcp hosts to hostsfile twice (rhbz#1137011)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-46.el6_6.2
changelog:
  - qemu: allow restore with non-migratable XML input (rhbz#1155564)
  - qemu: Introduce qemuDomainDefCheckABIStability (rhbz#1155564)
  - Make ABI stability issue easier to debug (rhbz#1155564)
  - CVE-2014-3633: qemu: blkiotune: Use correct definition when looking up disk (CVE-2014-3633)
  - domain_conf: fix domain deadlock (CVE-2014-3657)
  - CVE-2014-7823: dumpxml: security hole with migratable flag (CVE-2014-7823)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-46.el6_6.3
changelog:
  - qemu: Fix checking of ABI stability when restoring external checkpoints (rhbz#1180521)
  - qemu: Use "migratable" XML definition when doing external checkpoints (rhbz#1180521)
  - qemu: Fix memleak after commit 59898a88ce8431bd3ea249b8789edc2ef9985827 (rhbz#1180521)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-46.el6_6.4
changelog:
  - conf: Don't format actual network definition in migratable XML (rhbz#1203367)
  - util: more verbose error when failing to create macvtap device (rhbz#1203367)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-46.el6_6.5
changelog:
  - Create directory for lease files if it's missing (rhbz#1208619)
  - qemu: cgroup: Properly set up vcpu pinning (rhbz#1209891)


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.25-3.b17
changelog:
  - added patch12,removeSunEcProvider-RH1154143
  - xdump excluded from ppc64le (rh1156151)
  - Add check for src.zip completeness. See RH1130490 (by sgehwolf@redhat.com)
  - Resolves: rhbz#1154143


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.25-4.b17
changelog:
  - updated aarch64 sources
  - epoch synced to 1
  - all ppcs excluded from classes dump(1156151)
  - removed duplicated provides
  - Resolves: rhbz#1146622


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-27.b13
changelog:
  - updated to security u45
  - minor sync with 6.7
   - generate_source_tarball.sh
   - adapted java-1.8.0-openjdk-s390-java-opts.patch and java-1.8.0-openjdk-size_t.patch
   - reworked (synced) zero patches (removed 103,11 added 204, 400-403)
   - added upstreamed patch 501 and 505
   - included removeSunEcProvider-RH1154143.patch
  - returned java (jre only) provides
  - repacked policies (source20)
  - removed duplicated NVR provides
  - added automated test for priority (length7)
  - Resolves: RHBZ#1209075

  Fri Jan 09 2015 Severin Gehwolf <sgehwolf@redhat.com> - 1:1.8.0.31-1.b13
  - Update to January CPU patch update.
  - Resolves: RHBZ#1180300


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.45-27.b13
changelog:
  - Add back ExclusiveArch declaration lost in merge.
  - Fix names of PStack patch and removal script to not clash with 7 versions.
  - Remove unneeded test case from RHEL 7 ppc64le bug.
  - Resolves: rhbz#1209075


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.45-35.b13
changelog:
  - Omit jsa files from power64 file list as well, as they are never generated
  - Use the template interpreter on ppc64le
  - priority set  gcj < lengthOffFour < otherJdks (RH1175457)
  - misusing already fixed bug
  - Resolves: rhbz#1189853


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.51-0.b16
changelog:
  - July 2015 security update to u51b16.
  - Add script for generating OpenJDK tarballs from a local Mercurial tree.
  - Add %{name} prefix to patches to avoid conflicts with OpenJDK 7 versions.
  - Add patches for RH issues fixed in IcedTea 2.x and/or the upcoming u60.
  - Use 'openjdk' as directory prefix to allow patch interchange with IcedTea.
  - Re-generate EC disablement patch following CPU DH changes.
  - Resolves: rhbz#1235161


author: Jakub Hrozek <jhrozek@redhat.com> - 1.13.3-57
changelog:
  - Resolves: rhbz#1438360 - The originalMemberOf attribute disappears from
                             the cache, causing intermittent HBAC issues


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.13.3-58
changelog:
  - Resolves: rhbz#1421057 - pam_sss crashes in do_pam_conversation if no conversation
                             function is provided by the client app
  - Resolves: rhbz#1487040 - sssd does not evaluate AD UPN suffixes which results ini
                             failed user logins
  - Resolves: rhbz#1487944 - ABRT crash - /usr/libexec/sssd/sssd_nss
  - Resolves: rhbz#1489485 - sssd is not pulling groups in a trusted domain, with the
                             Global scope


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.13.3-59
changelog:
  - Resolves: rhbz#1326007 - Memory cache corruption when rsync and/or tar to copy owner and group info from LDAP
  - Resolves: rhbz#1442703 - Smart Cards: Certificate in the ID View
  - Resolves: rhbz#1507435 - CVE-2017-12173 sssd: unsanitized input when searching in local cache database [rhel-6.10]
  - Resolves: rhbz#1487040 - sssd does not evaluate AD UPN suffixes which results in failed user logins


author: Fabiano Fidêncio <fidencio@redhat.com> - 1.13.3-60
changelog:
  - Related: rhbz#1442703 - Smart Cards: Certificate in the ID View
  - Related: rhbz# 1401546 - Please back-port fast failover from sssd 1.14 on RHEL 7 into sssd 1.13 on RHEL 6


author: Elio Maldonado <emaldona@redhat.com> - 3.16.1-15
changelog:
  - Resolves: Bug 1165003 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Support TLS_FALLBACK_SCSV in tstclnt and ssltap


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-2
changelog:
  - Restore patch for certutil man page
  - supply missing options descriptions to the man page
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3


author: Elio Maldonado <emaldona@redhat.com> - 3.16.2.3-3
changelog:
  - Resolves: Bug 1158160 - Upgrade to NSS 3.16.2.3 for Firefox 31.3
  - Remove unused indentation pseudo patch
  - require nss util 3.16.2.3


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.9.1.el6]
changelog:
  - [net] ipv6: increase ip6_rt_max_size to 16384 (Hannes Frederic Sowa) [1177581 1112946]
  - [net] ipv6: don't set DST_NOCOUNT for remotely added routes (Hannes Frederic Sowa) [1177581 1112946]
  - [net] ipv6: don't count addrconf generated routes against gc limit (Hannes Frederic Sowa) [1177581 1112946]
  - [net] ipv6: Don't put artificial limit on routing table size (Hannes Frederic Sowa) [1177581 1112946]
  - [scsi] bnx2fc: fix tgt spinlock locking (Maurizio Lombardi) [1179098 1079656]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.11.1.el6]
changelog:
  - [virt] kvm: excessive pages un-pinning in kvm_iommu_map error path (Jacob Tanenbaum) [1156520 1156521] {CVE-2014-8369}
  - [x86] crypto: Add support for 192 & 256 bit keys to AESNI RFC4106 (Jarod Wilson) [1184332 1176211]
  - [block] nvme: Clear QUEUE_FLAG_STACKABLE (David Milburn) [1180555 1155715]
  - [net] netfilter: conntrack: disable generic tracking for known protocols (Daniel Borkmann) [1182071 1114697] {CVE-2014-8160}
  - [xen] pvhvm: Fix vcpu hotplugging hanging (Vitaly Kuznetsov) [1179343 1164278]
  - [xen] pvhvm: Don't point per_cpu(xen_vpcu, 33 and larger) to shared_info (Vitaly Kuznetsov) [1179343 1164278]
  - [xen] enable PVHVM VCPU placement when using more than 32 CPUs (Vitaly Kuznetsov) [1179343 1164278]
  - [xen] support large numbers of CPUs with vcpu info placement (Vitaly Kuznetsov) [1179343 1164278]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.13.1.el6]
changelog:
  - [netdrv] enic: fix rx skb checksum (Stefan Assmann) [1189068 1115505]
  - [scsi] Revert "fix our current target reap infrastructure" (David Milburn) [1188941 1168072]
  - [scsi] Revert "dual scan thread bug fix" (David Milburn) [1188941 1168072]
  - [net] tcp: do not copy headers in tcp_collapse() (Alexander Duyck) [1188838 1156289]
  - [net] tcp: use tcp_flags in tcp_data_queue() (Alexander Duyck) [1188838 1156289]
  - [net] tcp: use TCP_SKB_CB(skb)->tcp_flags in input path (Alexander Duyck) [1188838 1156289]
  - [net] tcp: remove unused tcp_fin() parameters (Alexander Duyck) [1188838 1156289]
  - [net] tcp: rename tcp_skb_cb flags (Alexander Duyck) [1188838 1156289]
  - [net] tcp: unify tcp flag macros (Alexander Duyck) [1188838 1156289]
  - [net] tcp: unalias tcp_skb_cb flags and ip_dsfield (Alexander Duyck) [1188838 1156289]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.14.1.el6]
changelog:
  - [s390] crypto: kernel oops at insmod of the z90crypt device driver (Hendrik Brueckner) [1191916 1172137]
  - [sound] alsa: usb-audio: Fix crash at re-preparing the PCM stream (Jerry Snitselaar) [1192105 1167059]
  - [usb] ehci: bugfix: urb->hcpriv should not be NULL (Jerry Snitselaar) [1192105 1167059]
  - [mm] mmap: uncached vma support with writenotify (Jerry Snitselaar) [1192105 1167059]
  - [kernel] futex: Mention key referencing differences between shared and private futexes (Larry Woodman) [1192107 1167405]
  - [kernel] futex: Ensure get_futex_key_refs() always implies a barrier (Larry Woodman) [1192107 1167405]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.15.1.el6]
changelog:
  - [netdrv] ixgbe: remove CIAA/D register reads from bad VF check (John Greene) [1196312 1156061]
  - [pci] Make FLR and AF FLR reset warning messages different (Myron Stowe) [1192365 1184540]
  - [pci] Fix unaligned access in AF transaction pending test (Myron Stowe) [1192365 1184540]
  - [pci] Merge multi-line quoted strings (Myron Stowe) [1192365 1184540]
  - [pci] Wrong register used to check pending traffic (Myron Stowe) [1192365 1184540]
  - [pci] Add pci_wait_for_pending() -- refactor pci_wait_for_pending_transaction() (Myron Stowe) [1192365 1184540]
  - [pci] Use pci_wait_for_pending_transaction() instead of for loop (Myron Stowe) [1192365 1184540]
  - [pci] Add pci_wait_for_pending_transaction() (Myron Stowe) [1192365 1184540]
  - [pci] Wait for pending transactions to complete before 82599 FLR (Myron Stowe) [1192365 1184540]
  - [scsi] storvsc: fix a bug in storvsc limits (Vitaly Kuznetsov) [1196532 1174168]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-504.16.1.el6]
changelog:
  - [fs] gfs2: Move gfs2_file_splice_write outside of #ifdef (Robert S Peterson) [1198329 1193559]
  - [security] keys: close race between key lookup and freeing (Radomir Vrbovsky) [1179849 1179850] {CVE-2014-9529}
  - [net] sctp: fix slab corruption from use after free on INIT collisions (Daniel Borkmann) [1196587 1135425] {CVE-2015-1421}
  - [fs] gfs2: Allocate reservation during splice_write (Robert S Peterson) [1198329 1193559]
  - [fs] nfs: Be less aggressive about returning delegations for open files (Steve Dickson) [1196314 1145334]
  - [fs] nfs: Avoid PUTROOTFH when managing leases (Benjamin Coddington) [1196313 1143013]
  - [crypto] testmgr: mark rfc4106(gcm(aes)) as fips_allowed (Jarod Wilson) [1194983 1185395]
  - [crypto] Extending the RFC4106 AES-GCM test vectors (Jarod Wilson) [1194983 1185395]
  - [char] raw: Return short read or 0 at end of a raw device, not EIO (Jeff Moyer) [1195747 1142314]
  - [scsi] hpsa: Use local workqueues instead of system workqueues - part1 (Tomas Henzl) [1193639 1134115]
  - [x86] kvm: vmx: invalid host cr4 handling across vm entries (Jacob Tanenbaum) [1153326 1153327] {CVE-2014-3690}
  - [fs] isofs: Fix unchecked printing of ER records (Radomir Vrbovsky) [1180481 1180492] {CVE-2014-9584}
  - [fs] bio: fix argument of __bio_add_page() for max_sectors > 0xffff (Fam Zheng) [1198428 1166763]
  - [media] ttusb-dec: buffer overflow in ioctl (Alexander Gordeev) [1170971 1167115] {CVE-2014-8884}
  - [kernel] trace: insufficient syscall number validation in perf and ftrace subsystems (Jacob Tanenbaum) [1161567 1161568] {CVE-2014-7826 CVE-2014-7825}
  - [fs] nfs: Fix a delegation callback race (Dave Wysochanski) [1187639 1149831]
  - [fs] nfs: Don't use the delegation->inode in nfs_mark_return_delegation() (Dave Wysochanski) [1187639 1149831]
  - [infiniband] ipoib: don't queue a work struct up twice (Doug Ledford) [1187664 1187666 1184072 1159925]
  - [infiniband] ipoib: make sure we reap all our ah on shutdown (Doug Ledford) [1187664 1187666 1184072 1159925]
  - [infiniband] ipoib: cleanup a couple debug messages (Doug Ledford) [1187664 1187666 1184072 1159925]
  - [infiniband] ipoib: flush the ipoib_workqueue on unregister (Doug Ledford) [1187664 1187666 1184072 1159925]
  - [infiniband] ipoib: fix ipoib_mcast_restart_task (Doug Ledford) [1187664 1187666 1184072 1159925]
  - [infiniband] ipoib: fix race between mcast_dev_flush and mcast_join (Doug Ledford) [1187664 1187666 1184072 1159925]
  - [infiniband] ipoib: remove unneeded locks (Doug Ledford) [1187664 1187666 1184072 1159925]
  - [infiniband] ipoib: don't restart our thread on ENETRESET (Doug Ledford) [1187664 1187666 1184072 1159925]
  - [infiniband] ipoib: Handle -ENETRESET properly in our callback (Doug Ledford) [1187664 1187666 1184072 1159925]
  - [infiniband] ipoib: make delayed tasks not hold up everything (Doug Ledford) [1187664 1187666 1184072 1159925]
  - [infiniband] ipoib: Add a helper to restart the multicast task (Doug Ledford) [1187664 1187666 1184072 1159925]
  - [infiniband] ipoib: fix IPOIB_MCAST_RUN flag usage (Doug Ledford) [1187664 1187666 1184072 1159925]
  - [infiniband] ipoib: Remove unnecessary port query (Doug Ledford) [1187664 1187666 1184072 1159925]
  - [x86] kvm: Avoid pagefault in kvm_lapic_sync_to_vapic (Paolo Bonzini) [1192055 1116398]
  - [s390] kernel: fix cpu target address of directed yield (Hendrik Brueckner) [1188339 1180061]
  - [mm] memcg: do not allow task about to OOM kill to bypass the limit (Johannes Weiner) [1198110 1088334] {CVE-2014-8171}
  - [mm] memcg: do not declare OOM from __GFP_NOFAIL allocations (Johannes Weiner) [1198110 1088334] {CVE-2014-8171}
  - [fs] buffer: move allocation failure loop into the allocator (Johannes Weiner) [1198110 1088334] {CVE-2014-8171}
  - [mm] memcg: handle non-error OOM situations more gracefully (Johannes Weiner) [1198110 1088334] {CVE-2014-8171}
  - [mm] memcg: do not trap chargers with full callstack on OOM (Johannes Weiner) [1198110 1088334] {CVE-2014-8171}
  - [mm] memcg: rework and document OOM waiting and wakeup (Johannes Weiner) [1198110 1088334] {CVE-2014-8171}
  - [mm] memcg: enable memcg OOM killer only for user faults (Johannes Weiner) [1198110 1088334] {CVE-2014-8171}
  - [x86] mm: finish user fault error path with fatal signal (Johannes Weiner) [1198110 1088334] {CVE-2014-8171}
  - [mm] pass userspace fault flag to generic fault handler (Johannes Weiner) [1198110 1088334] {CVE-2014-8171}
  - [s390] mm: do not invoke OOM killer on kernel fault OOM (Johannes Weiner) [1198110 1088334] {CVE-2014-8171}
  - [powerpc] mm: remove obsolete init OOM protection (Johannes Weiner) [1198110 1088334] {CVE-2014-8171}
  - [powerpc] mm: invoke oom-killer from remaining unconverted page fault handlers (Johannes Weiner) [1198110 1088334] {CVE-2014-8171}
  - [security] selinux: Permit bounded transitions under NO_NEW_PRIVS or NOSUID (Denys Vlasenko) [1104567 1104568] {CVE-2014-3215}
  - [security] Add PR_<GET, SET>_NO_NEW_PRIVS to prevent execve from granting privs (Denys Vlasenko) [1104567 1104568] {CVE-2014-3215}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-504.16.2.el6]
changelog:
  - [infiniband] core: Prevent integer overflow in ib_umem_get address arithmetic (Doug Ledford) [1181173 1179327] {CVE-2014-8159}


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-40
changelog:
  - formatdomain.html.in: Document implementation limitation of QoS (rhbz#980350)
  - Fix error in qemuDomainSetNumaParamsLive (rhbz#857312)
  - cpu: Add new Broadwell CPU model (rhbz#1100381)
  - docs: publish correct enum values (rhbz#1113316)
  - qemu: blockcopy: Don't remove existing disk mirror info (rhbz#1113828)
  - qemu: fix guestfwd chardev option back how it was (rhbz#1112066)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-41
changelog:
  - Add invariant TSC cpu flag (rhbz#996772)
  - Fix segfault when starting a domain with no cpu definition (rhbz#996772)
  - qemu: copy: Accept 'format' parameter when copying to a non-existing img (rhbz#1113828)
  - Bind connection close callback APIs to python binding (rhbz#1114619)
  - qemu: Factor out body of qemuDomainGetMetadata for universal use (rhbz#1115039)
  - qemu: Factor out body of qemuDomainSetMetadata for universal use (rhbz#1115039)
  - conf: Factor out setting of metadata to simplify code (rhbz#1115039)
  - util: Add helper to convert libxml2 nodes to a string (rhbz#1115039)
  - conf: Add support for requesting of XML metadata via the API (rhbz#1115039)
  - conf: allow to add XML metadata using the virDomainSetMetadata api (rhbz#1115039)
  - conf: Avoid false positive of uninitialized variable use (rhbz#1115039)
  - lib: Don't force the key argument when deleting metadata (rhbz#1115039)
  - test: Add <metadata> support into the test drivera (rhbz#1115039)
  - tests: Add metadata tests (rhbz#1115039)
  - conf: Don't corrupt metadata on OOM (rhbz#1115039)
  - Ignore additional fields in iscsiadm output (rhbz#1116741)
  - conf: net: Fix helper for applying new network definition (rhbz#1116754)
  - blockjob: wait for pivot to complete (rhbz#1119385)
  - virsh: Introduce macros to reject mutually exclusive arguments (rhbz#1117177)
  - virsh-domain: Add --live, --config, --current logic to cmdAttachDisk (rhbz#1117177)
  - virsh-domain: Add --live, --config, --current logic to cmdDetachDevice (rhbz#1117177)
  - virsh-domain: Add --live, --config, --current logic to cmdDetachDisk (rhbz#1117177)
  - virsh: Use inactive definition when removing disk from config (rhbz#1117177)
  - virsh-domain: Add --live, --config, --current logic to cmdAttachDevice (rhbz#1117177)


author: Jiri Denemark <jdenemar@redhat.com> - 0.10.2-42
changelog:
  - conf: Fix backport of metadata API code (rhbz#1115039)
  - conf: Always format seclabel's model (rhbz#1113860)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-40
changelog:
  - fix CVE-2014-8176 - invalid free in DTLS buffering code
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-1791 - race condition handling NewSessionTicket
  - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-41
changelog:
  - improved fix for CVE-2015-1791
  - add missing parts of CVE-2015-0209 fix for corectness although unexploitable


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-43
changelog:
  - fix CVE-2015-3194 - certificate verify crash with missing PSS parameter
  - fix CVE-2015-3195 - X509_ATTRIBUTE memory leak
  - fix CVE-2015-3196 - race condition when handling PSK identity hint


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-46
changelog:
  - fix 1-byte memory leak in pkcs12 parse (#1229871)
  - document some options of the speed command (#1197095)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48
changelog:
  - fix CVE-2016-0702 - side channel attack on modular exponentiation
  - fix CVE-2016-0705 - double-free in DSA private key parsing
  - fix CVE-2016-0797 - heap corruption in BN_hex2bn and BN_dec2bn


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-48.1
changelog:
  - fix CVE-2016-2105 - possible overflow in base64 encoding
  - fix CVE-2016-2106 - possible overflow in EVP_EncryptUpdate()
  - fix CVE-2016-2107 - padding oracle in stitched AES-NI CBC-MAC
  - fix CVE-2016-2108 - memory corruption in ASN.1 encoder
  - fix CVE-2016-2109 - possible DoS when reading ASN.1 data from BIO
  - fix CVE-2016-0799 - memory issues in BIO_printf


author: Tom Lane <tgl@redhat.com> 5.1.67-1
changelog:
  - Update to 5.1.67, for assorted upstream bugfixes including
    CVEs announced in January 2013
  Resolves: #901381


author: Tom Lane <tgl@redhat.com> 5.1.69-1
changelog:
  - Update to 5.1.69, for assorted upstream bugfixes including
    CVEs announced in April 2013
  Resolves: #953085


author: Honza Horak <hhorak@redhat.com> 5.1.70-1
changelog:
  - Update to MySQL 5.1.70, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-70.html
    Resolves: #990796, #842052
  - Fix mysqldump failure against MySQL 5.0.x server due missing tables
    Resolves: #877557
  - Add logrotate script
    Resolves: #904061
  - Fix init script to not show failed on start even when server started
    Resolves: #884651


author: Honza Horak <hhorak@redhat.com> 5.1.71-1
changelog:
  - Update to MySQL 5.1.71, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-71.html
    Resolves: #990796


author: Jakub Dorňák <jdornak@redhat.com> - 5.1.73-1
changelog:
  - Update to MySQL 5.1.73, for various fixes described at
    http://dev.mysql.com/doc/relnotes/mysql/5.1/en/news-5-1-73.html
    (CVE-2014-0412, CVE-2014-0437, CVE-2013-5908, CVE-2014-0393,
    CVE-2014-0386, CVE-2014-0401, CVE-2014-0402)
    Resolves: #1055882


author: Honza Horak <hhorak@redhat.com> 5.1.73-2
changelog:
  - Make mysqld init script more robust and ignore existing but
    non-being-used unix socket file
    Resolves: #1037650


author: Joe Orton <jorton@redhat.com> - 1.6.11-4
changelog:
  - add security fixes for CVE-2011-1752, CVE-2011-1783, CVE-2011-1921 (#709221)
  - add security fix for CVE-2011-0715 (#681174)
  - add security fixes for CVE-2010-4644, CVE-2010-4539 (#672679)


author: Joe Orton <jorton@redhat.com> - 1.6.11-5
changelog:
  - add init script for svnserve (#720790, #711904)
  - fix segfault with "AuthzForceUsernameCase lower" (#751321)
  - fix parent directory access with merges (#749494)


author: Andreas Schneider <asn@redhat.com> - 3.6.23-15
changelog:
  - resolves: #1165750 - Fix guid retrieval for published printers.
  - resolves: #1163383 - Fix 'net ads join -k' with existing keytab entries.
  - resolves: #1195456 - Fix starting daemons on read only filesystems.
  - resolves: #1138552 - Fix CPU utilization when re-reading the printcap info.
  - resolves: #1144916 - Fix smbclient NTLMv2 authentication.
  - resolves: #1164336 - Document 'sharesec' command for
                         'access based share enum' option.


author: Ondrej Vasik <ovasik@redhat.com> - 8.4-33
changelog:
  - su: don't terminate parent process upon SIGTERM(#1063887)
  - tail: do not show "reverting to polling" warning when not
    necessary (#1046818)
  - chcon: document default behaviour for symlink (#1064621)
  - fix dd sparse test failure on XFS (#1075679)


author: Ondrej Vasik <ovasik@redhat.com> - 8.4-34
changelog:
  - tail: disable inotify in --follow for vxfs (#1104244)
  - df: dereference symlinks to disk device nodes (#812449)
  - dd: add support for count_bytes iflag (#1098078)


author: Petr Pisar <ppisar@redhat.com> - 4:5.10.1-130
changelog:
  - Resolves: #915693 - CVE-2012-5526 (newline injection due to improper CRLF
    escaping in Set-Cookie and P3P headers)
  - Resolves: #915693 - CVE-2012-6329 (possible arbitrary code execution via
    Locale::Maketext)
  - Resolves: #915693 - CVE-2013-1667 (DoS in rehashing code)


author: Petr Pisar <ppisar@redhat.com> - 4:5.10.1-132
changelog:
  - Resolves: #767608 - Fix memory leak when accessing non-matched named
    capturing groups
  - Resolves: #839788 - Do not crash if declared DESTROY method has not been
    defined


author: Pavel Zhukov <pzhukov@redhat.com> - 12:4.1.1-55.P1
changelog:
  - Resolves: #1527995 - allow static route with a 0.0.0.0 next-hop address
  - Related: #1527995 -  install link-local static routes with correct scope


author: Tim Waugh <twaugh@redhat.com> - 1:1.4.2-69
changelog:
  - Document ErrorPolicy in cupsd.conf manpage (bug #1120587, STR #4457).
  - Prevent cups-polld busy loop when access is restricted (bug #1164854).
  - Apply upstream patch to prevent crash in cupsdContinueJob() (bug #1187840).
  - Added failover backend to support priority-based failover (bug #1115219).
  - Apply patch to fix sanitize_title documentation (bug #988062, STR #4569).


author: Tim Waugh <twaugh@redhat.com> - 1:1.4.2-70
changelog:
  - Fixed SetEnv patch (bug #1198394).
  - Validate ErrorPolicy directory when reading configuration (bug #1196217,
    STR #4591).


author: Tomas Hozza <thozza@redhat.com> 32:9.8.2-0.31.rc1
changelog:
  - Fix RRL slip behavior when set to 1 (#1112356)
  - Fix issue causing bind to hang after reload if using DYNDB (#1142152)


author: Stephen Gallagher <sgallagh@redhat.com> - 0.1.2-3
changelog:
  - New upstream release 0.1.2
  - Fixes a serious issue with libdhash where hash_enter() would never update
  - existing entries for a key.


author: Stephen Gallagher <sgallagh@redhat.com> - 0.1.2-6
changelog:
  - Resolves: rhbz#668586 - ding-libs subpackages should have explicit version
  -                         requirements


author: Stephen Gallagher <sgallagh@redhat.com> - 0.1.2-7
changelog:
  - Resolves: rhbz#736074 - dhash can corrupt memory if initial table size is
                            large


author: Stephen Gallagher <sgallagh@redhat.com> - 0.1.2-8
changelog:
  - Fix bad patch
  - Related:  rhbz#736074 - dhash can corrupt memory if initial table size is
                            large


author: Jakub Hrozek <jhrozek@redhat.com> - 0.4.0-11
changelog:
  - Do not package built objects in dhash-devel
  - Fix NVR in the previous changelog entry
  - Related: rhbz#1069287 - Rebase ding-libs to latest version in 6.6


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-33
changelog:
  - Fix yum-security manpage.
  - Resolves: bug#865694
  - Resolves: bug#1208155
  - Add libxml2-python to Requires for repo-rss.
  - Resolves: bug#1155093
  - yumdownloader: fix description of --archlist in the manpage.
  - Resolves: bug#1165661
  - Add missing options to reposync manpage.
  - Resolves: bug#1189033
  - Exclude dups from the list of security updates.
  - Resolves: bug#1209212
  - yum-config-manager: update config file specified using -c option.
  - Resolves: bug#1225753
  - yum-config-manager: require \* syntax to disable all repos.
  - Resolves: bug#1225754
  - Remove -v from repoquery man page.
  - Resolves: bug#1285748


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-34
changelog:
  - Fix 'updateinfo list available' logic and make 'updates' the default.
  - Resolves: bug#1144887
  - Fix updateinfo to exclude wrong arch updates.
  - Resolves: bug#1191313


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-36
changelog:
  - Fix performance issue when excluding dups from the list of security updates.
  - Related: bug#1209212


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-38
changelog:
  - Fix count of applicable security updates.
  - Resolves: bug#1347813
  - auto-update-debuginfo: fix check for repos in opts.
  - Resolves: bug#1293982
  - yum-plugin-verify: set exit status to 1 in case of problems.
  - Resolves: bug#1313574
  - repoquery: fix --pkgnarrow=installed.
  - Resolves: bug#1280453


author: Valentina Mukhamedzhanova <vmukhame@redhat.com> -1.1.30-39
changelog:
  - Filter duplicates when counting security updates.
  - Resolves: bug#1272025
  - Update yum-verify man page.
  - Related: bug#1347813


author: Elio Maldonado <emaldona@redhat.com> - 3.14.3-15
changelog:
  - Fix shlibsign to return non-zero on failure
  - Resolves: Bug 587634 - shlibsign returns 0 although if fails


author: Bob Relyea <rrelyea@redhat.com> - 3.14.3-21
changelog:
  - Require nss-softokn-freebl of at least the same version and release
  - Resolves: Bug 1183448 - nss-softokn-3.14.3-19.el6_6 breaking yum and rpm


author: Tom Lane <tgl@redhat.com> 8.4.11-1
changelog:
  - Update to PostgreSQL 8.4.11, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-11.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-10.html
    including the fixes for CVE-2012-0866, CVE-2012-0867, CVE-2012-0868
  Resolves: #812082


author: Tom Lane <tgl@redhat.com> 8.4.12-1
changelog:
  - Update to PostgreSQL 8.4.12, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-12.html
    including the fixes for CVE-2012-2143, CVE-2012-2655
  Resolves: #830726


author: Tom Lane <tgl@redhat.com> 8.4.13-1
changelog:
  - Update to PostgreSQL 8.4.13, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
    including the fixes for CVE-2012-3488, CVE-2012-3489
  Resolves: #852021


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.18-1
changelog:
  - Update to PostgreSQL 8.4.18, for various fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-14.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-15.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-16.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-17.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-18.html
    including fixes for CVE-2013-0255, CVE-2013-1900 (#1017837)


author: Pavel Raiskup <praiskup@redhat.com> - 8.4.20-1
changelog:
  - Update to PostgreSQL 8.4.20 (#1065843) for fixes described at
    http://www.postgresql.org/docs/8.4/static/release-8-4-19.html
    http://www.postgresql.org/docs/8.4/static/release-8-4-20.html


author: Christine Caulfield <ccaulfie@redhat.com> - 3.0.12.1-75
changelog:
  - libfence: Remove fencedevice params from fence_node -S so that asking for
    status does not shut down a node if action= is set
    Resolves: rhbz#1252991
  - schema: add RRP attributes for <token> section
    Resolves: rhbz#1221728


author: Christine Caulfield <ccaulfie@redhat.com> - 3.0.12.1-80
changelog:
  - cman_tool: prevent segv in cman_tool nodes -F addr crash of qdisk is present
    Resolves: rhbz#1384968


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 3.0.12.1-84.1
changelog:
  - fenced: make sure that a node that leaves and rejoins with a different
    membership is fenced.
    Resolves: rhbz#1510500


author: Tom Lane <tgl@redhat.com> 8.4.701-4
changelog:
  - Add patch to provide some stub functions for JDBC 4.1 compatibility
  Resolves: #816731
  - Minor modernization of specfile, eg use maven directory macros,
    remove long-obsolete minimum versions from BuildRequires


author: Tom Lane <tgl@redhat.com> 8.4.701-5
changelog:
  - Switch to noarch (non-GCJ) build so that we can BuildRequire JDK >= 1.6;
    without this we don't get a JDBC4 driver at all, let alone 4.1.
  Related: #816731


author: Tom Lane <tgl@redhat.com> 8.4.701-8
changelog:
  - Add explicit Obsoletes to get rid of old arch-specific packages,
    per discussions in bugs 821892 and 822206
  Related: #816731


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-25
changelog:
  - fix CVE-2010-5298 - possible use of memory after free
  - fix CVE-2014-0195 - buffer overflow via invalid DTLS fragment
  - fix CVE-2014-0198 - possible NULL pointer dereference
  - fix CVE-2014-0221 - DoS from invalid DTLS handshake packet
  - fix CVE-2014-0224 - SSL/TLS MITM vulnerability
  - fix CVE-2014-3470 - client-side DoS when using anonymous ECDH


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-26
changelog:
  - drop EXPORT, RC2, and DES from the default cipher list (#1057520)
  - print ephemeral key size negotiated in TLS handshake (#1057715)
  - do not include ECC ciphersuites in SSLv2 client hello (#1090952)
  - properly detect encryption failure in BIO (#1100819)
  - fail on hmac integrity check if the .hmac file is empty (#1105567)
  - FIPS mode: make the limitations on DSA, DH, and RSA keygen
    length enforced only if OPENSSL_ENFORCE_MODULUS_BITS environment
    variable is set


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-29
changelog:
  - fix CVE-2014-3505 - doublefree in DTLS packet processing
  - fix CVE-2014-3506 - avoid memory exhaustion in DTLS
  - fix CVE-2014-3507 - avoid memory leak in DTLS
  - fix CVE-2014-3508 - fix OID handling to avoid information leak
  - fix CVE-2014-3509 - fix race condition when parsing server hello
  - fix CVE-2014-3510 - fix DoS in anonymous (EC)DH handling in DTLS
  - fix CVE-2014-3511 - disallow protocol downgrade via fragmentation


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30.2
changelog:
  - fix CVE-2014-3567 - memory leak when handling session tickets
  - fix CVE-2014-3513 - memory leak in srtp support
  - add support for fallback SCSV to partially mitigate CVE-2014-3566
    (padding attack on SSL3)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30.5
changelog:
  - fix CVE-2014-3570 - incorrect computation in BN_sqr()
  - fix CVE-2014-3571 - possible crash in dtls1_get_record()
  - fix CVE-2014-3572 - possible downgrade of ECDH ciphersuite to non-PFS state
  - fix CVE-2014-8275 - various certificate fingerprint issues
  - fix CVE-2015-0204 - remove support for RSA ephemeral keys for non-export
    ciphersuites and on server
  - fix CVE-2015-0205 - do not allow unauthenticated client DH certificate
  - fix CVE-2015-0206 - possible memory leak when buffering DTLS records


author: Remi Collet <rcollet@redhat.com> - 5.3.3-47
changelog:
  - fix wrong warning in openssl_encrypt() for missing IV
    when IV is not required #1260315
  - fix segfault's when you try and allocate an SplFixedArray
    with size >= 9999 #1071344
  - segfault in php_pgsql_meta_data CVE-2015-4644  #1234434
  - add options to enable TLS in curl #1255920
  - fix segfault in gc_collect_cycles #1122681


author: Than Ngo <than@redhat.com> - 6:4.3.4-15
changelog:
  - Resolves: bz#587016, print dialogue does not remember previous settings
  - Resolves: bz#682611, Konqueror splash page in zh_TW is wrong
  - Resolves: bz#734734, plasma eating up cpu-time when systemtray some icon
  - Resolves: bz#826114, konqueror crash when trying to add "Terminal Emulator" to main menu bar


author: Lukáš Tinkl <ltinkl@redhat.com> - 6:4.3.4-22
changelog:
  - Resolves rhbz#1206180 - Opening a terminal in Konqueror / Dolphin does not 
    inherit environment variables


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-57
changelog:
  - Release 1.2.11.15-57
  - Resolves: #1223068 - ldapdelete fails with -r option to delete a sub suffix (DS 48146)
  - Resolves: #1219990 - bind on db chained to AD returns err=32 (DS 48183)
  - Resolves: #1219208 - cleanAllRUV task limit not being enforced correctly (DS 48158)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-58
changelog:
  - Release 1.2.11.15-58
  - Resolves: #1223068 - Regression introduced by the simple paged results fixes. (DS 48146)
  - Resolves: #1203338 - ns-slapd double free or corruption crash (DS 48149)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-59
changelog:
  - Release 1.2.11.15-59
  - Resolves: #1211006 - start/stop/restart-dirsrv utilities should ignore admin-serv directory (DS 48148)
  - Resolves: #1203338 - ns-slapd double free or corruption crash (DS 48149)
  - Resolves: #1228402 - Individual abandoned simple paged results request has no chance to be cleaned up (DS 48192)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-60
changelog:
  - Release 1.2.11.15-60
  - Resolves: #1228402 - Individual abandoned simple paged results request has no chance to be cleaned up (DS 48192)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-62
changelog:
  - Release 1.2.11.15-62
  - Resolves: #1260004 - regression - COS cache doesn't properly mark vattr cache as invalid when there are multiple suffixes (DS 47981)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-63
changelog:
  - Release 1.2.11.15-63
  - Resolves: #1268204 - ns-slapd crashing frequently cause is unknown (DS 48192)
  - Resolves: #1265972 - Fractional replication evaluates several times the same CSN (DS 48266 48284)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-64
changelog:
  -Release 1.2.11.15-64
  - Resolves: #1268204 - ns-slapd crashing frequently cause is unknown (DS 48192)
  - Resolves: #1268772 - pagedresults - when timed out, search results could have been already freed. (DS 48299)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-65
changelog:
  -Release 1.2.11.15-65
  - Resolves: #1265972 - Fractional replication evaluates several times the same CSN (DS 48266)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-109
changelog:
  - Fix problems with failing persistent connections (#1131585)
  - Fix memory leaks in auditing patch (#1208584)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-110
changelog:
  - Fix minor problems found by covscan/gcc (#1196063)
  - Add missing options in man ssh (#1197763)
  - Add KbdInteractiveAuthentication documentation to man sshd_config (#1109251)
  - Correct freeing newkeys structure when privileged monitor exits (#1208584)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-113
changelog:
  - Fix segfaulting agent during removal of CAC credentials (#1253612)
  - Make  pam_namespace  usage consistent across system-wide (#1250069)
  - Add GSSAPIKexAlgorithms option for both server and client (#1253060)
  - ECDSA host key not loaded by sshd by default (fix man page) (#1218070)
  - Resolve segfault in pam_ssh_agent_auth in FIPS mode (#1278315)
  - Backport Match LocalAddress from OpenSSH 6.1 (#1211673)
  - Backport security patches from openssh-6.9 and 7.0 (#1281468)
  -  CVE-2015-5352: XSECURITY restrictions bypass under certain conditions
  -  CVE-2015-5600: MaxAuthTries limit bypass via duplicates in KbdInteractiveDevices
  -  CVE-2015-6563: Privilege separation weakness related to PAM support
  -  CVE-2015-6564: Use-after-free bug related to PAM support
  -  weakness of agent locking (ssh-add -x) to password guessing (#1238238)
  - Clarify a keyword that appears in multiple matching Match blocks (#1219820)
  - Clarity of TERM variable in AcceptEnv and SendEnv options (#1285003)
  - Enhance AllowGroups documentation in man page (#1284997)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-114
changelog:
  - pam_ssh_agent_auth: Provide authorized_keys_command= feature (#1299555)
  - CVE-2016-1908: Prevent possible fallback from untrusted X11 forwarding (#1299048)


author: Jakub Jelen <jjelen@redhat.com> 5.3p1-116
changelog:
  - Restore functionallity of pam_ssh_agent_auth in FIPS mode (#1278315)
  - Initialize devices_done variable for challenge response (#1281468)
  - Update behaviour of X11 forwarding to match upstream (#1299048)


author: Phillip Lougher <plougher@redhat.com> [2.6.32-748.el6]
changelog:
  - [mm] fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE (Bhupesh Sharma) [1494380]
  - [mm] brk: fix min_brk lower bound computation for COMPAT_BRK (Bhupesh Sharma) [1494380]
  - [mm] split ET_DYN ASLR from mmap ASLR (Bhupesh Sharma) [1494380]
  - [s390] redefine randomize_et_dyn for ELF_ET_DYN_BASE (Bhupesh Sharma) [1494380]
  - [mm] expose arch_mmap_rnd when available (Bhupesh Sharma) [1494380]
  - [s390] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [s390] mmap: randomize mmap base for bottom up direction (Bhupesh Sharma) [1494380]
  - [powerpc] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [x86] standardize mmap_rnd() usage (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: create Kconfig variable for PIE randomization (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: PIE: make PF_RANDOMIZE check comment more accurate (Bhupesh Sharma) [1494380]
  - [fs] binfmt_elf: fix PIE execution with randomization disabled (Bhupesh Sharma) [1494380]
  - [acpi] acpica: Support calling _REG methods within ACPI interpreter (Lenny Szubowicz) [1522849]
  - [acpi] acpica: Function to test if ACPI interpreter already entered (Lenny Szubowicz) [1522849]
  - [acpi] acpica: Function to test if ACPI mutex held by this thread (Lenny Szubowicz) [1522849]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-749.el6]
changelog:
  - [powerpc] pseries: Restore default security feature flags on setup (Mauricio Oliveira) [1561788]
  - [powerpc] Move default security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Fix clearing of security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Wire up cpu_show_spectre_v2() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Wire up cpu_show_spectre_v1() (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Use the security flags in pseries_setup_rfi_flush() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Enhance the information in cpu_show_meltdown() (Mauricio Oliveira) [1561788]
  - [powerpc] 64s: Move cpu_show_meltdown() (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Set or clear security feature flags (Mauricio Oliveira) [1561788]
  - [powerpc] Add security feature flags for Spectre/Meltdown (Mauricio Oliveira) [1561788]
  - [powerpc] pseries: Add new H_GET_CPU_CHARACTERISTICS flags (Mauricio Oliveira) [1561788]
  - [lib] seq: Add seq_buf_printf() (Mauricio Oliveira) [1561788]
  - [powerpc] rfi-flush: Call setup_rfi_flush() after LPM migration (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Differentiate enabled and patched flush types (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Always enable fallback flush on pseries (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Make it possible to call setup_rfi_flush() again (Mauricio Oliveira) [1561786]
  - [powerpc] rfi-flush: Move the logic to avoid a redo into the debugfs code (Mauricio Oliveira) [1561786]
  - [x86] pti/32: Don't use trampoline stack on Xen PV (Waiman Long) [1562725]
  - [x86] pti: Use boot_cpu_has(X86_FEATURE_PTI_SUPPORT) for early call sites (Waiman Long) [1562725]
  - [x86] pti: Set X86_FEATURE_PTI_SUPPORT early (Waiman Long) [1562725]
  - [x86] pti: Rename X86_FEATURE_NOPTI to X86_FEATURE_PTI_SUPPORT (Waiman Long) [1562725]
  - [x86] pti/32: Fix setup_trampoline_page_table() bug (Waiman Long) [1562725]
  - [x86] entry: Remove extra argument in call instruction (Waiman Long) [1562552]
  - [x86] syscall: Fix ia32_ptregs handling bug in 64-bit kernel (Waiman Long) [1557562 1562552]
  - [x86] efi/64: Align efi_pgd on even page boundary (Waiman Long) [1558845]
  - [x86] pgtable/pae: Revert "Use separate kernel PMDs for user page-table" (Waiman Long) [1558845]
  - [x86] pgtable/pae: Revert "Unshare kernel PMDs when PTI is enabled" (Waiman Long) [1558845]
  - [x86] mm: Dump both kernel & user page tables at fault (Waiman Long) [1558845]
  - [x86] entry/32: Fix typo in PARANOID_EXIT_TO_KERNEL_MODE (Waiman Long) [1558845]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-750.el6]
changelog:
  - [fs] fuse: fix punching hole with unaligned end (Miklos Szeredi) [1387473] {CVE-2017-15121}
  - [documentation] kdump: fix documentation about panic_on_warn to match rhel6 (Pingfan Liu) [1555196]
  - [fs] Provide sane values for nlink (Leif Sahlberg) [1554342]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-751.el6]
changelog:
  - [md] dm thin: fix regression that caused discards to be disabled if passdown was (Mike Snitzer) [1569377]
  - [s390] configs: enable auto expoline support (Hendrik Brueckner) [1554959]
  - [s390] correct nospec auto detection init order (Hendrik Brueckner) [1554959]
  - [s390] add sysfs attributes for spectre (Hendrik Brueckner) [1554959]
  - [s390] report spectre mitigation via syslog (Hendrik Brueckner) [1554959]
  - [s390] add automatic detection of the spectre defense (Hendrik Brueckner) [1554959]
  - [s390] move nobp parameter functions to nospec-branch.c (Hendrik Brueckner) [1554959]
  - [s390] do not bypass BPENTER for interrupt system calls (Hendrik Brueckner) [1554959]
  - [s390] Replace IS_ENABLED(EXPOLINE_*) with IS_ENABLED(CONFIG_EXPOLINE_*) (Hendrik Brueckner) [1554959]
  - [s390] introduce execute-trampolines for branches (Hendrik Brueckner) [1554959]
  - [s390] run user space and KVM guests with modified branch prediction (Hendrik Brueckner) [1554959]
  - [s390] add optimized array_index_mask_nospec (Hendrik Brueckner) [1554959]
  - [s390] scrub registers on kernel entry and KVM exit (Hendrik Brueckner) [1554959]
  - [s390] align and prepare spectre mitigation for upstream commits (Hendrik Brueckner) [1554959]
  - [x86] xen: do not use xen_info on HVM, set pv_info name to "Xen HVM" (Vitaly Kuznetsov) [1568241]
  - [net] sctp: verify size of a new chunk in _sctp_make_chunk() (Stefano Brivio) [1551908] {CVE-2018-5803}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-752.el6]
changelog:
  - [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1572487]
  - [fs] fix WARNING in rmdir() (Miklos Szeredi) [1282117]
  - [net] sctp: label accepted/peeled off sockets (Marcelo Leitner) [1571357]
  - [net] security: export security_sk_clone (Marcelo Leitner) [1571357]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-753.el6]
changelog:
  - [x86] vm86-32: Properly set up vm86-32 stack for task switching (Waiman Long) [1572865]
  - [x86] spec_ctrl: Enable IBRS and RSB stuffing in 32-bit interrupts (Waiman Long) [1571362]
  - [x86] entry/32: Fix regressions in 32-bit debug exception (Waiman Long) [1571362]


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30.6
changelog:
  - fix CVE-2015-0209 - potential use after free in d2i_ECPrivateKey()
  - fix CVE-2015-0286 - improper handling of ASN.1 boolean comparison
  - fix CVE-2015-0287 - ASN.1 structure reuse decoding memory corruption
  - fix CVE-2015-0288 - X509_to_X509_REQ NULL pointer dereference
  - fix CVE-2015-0289 - NULL dereference decoding invalid PKCS#7 data
  - fix CVE-2015-0292 - integer underflow in base64 decoder
  - fix CVE-2015-0293 - triggerable assert in SSLv2 server


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30.8
changelog:
  - drop the AES-GCM restriction of 2^32 operations because the IV is
    always 96 bits (32 bit fixed field + 64 bit invocation field)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30.9
changelog:
  - fix CVE-2015-4000 - prevent the logjam attack on client - restrict
    the DH key size to at least 768 bits (limit will be increased in future)


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-30.10
changelog:
  - fix CVE-2014-8176 - invalid free in DTLS buffering code
  - fix CVE-2015-1789 - out-of-bounds read in X509_cmp_time
  - fix CVE-2015-1790 - PKCS7 crash with missing EncryptedContent
  - fix CVE-2015-1791 - race condition handling NewSessionTicket
  - fix CVE-2015-1792 - CMS verify infinite loop with unknown hash function
  - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
    read in multithreaded applications


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.18.5.el6]
changelog:
  - [x86] spec_ctrl: allow use_ibp_disable only if both SPEC_CTRL and IBPB_SUPPORT are missing (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Documentation spec_ctrl.txt (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: remove irqs_disabled() check from intel_idle() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use enum when setting ibrs/ibpb_enabled (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: undo speculation barrier for ibrs_enabled and noibrs_cmdline (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce ibpb_enabled = 2 for IBPB instead of IBRS (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: introduce SPEC_CTRL_PCP_ONLY_IBPB (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: cleanup s/flush/sync/ naming when sending IPIs (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: set IBRS during CPU init if in ibrs_enabled == 2 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use IBRS_ENABLED instead of 1 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: allow the IBP disable feature to be toggled at runtime (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: always initialize save_reg in ENABLE_IBRS_SAVE_AND_CLOBBER (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: ibrs_enabled() is expected to return > 1 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: CLEAR_EXTRA_REGS and extra regs save/restore (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on syscall (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Add back STUFF_RSB to interrupt and error paths (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: make is_kaiser_pgd reliable (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] revert: mm/kaiser: Disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: fix pgd freeing in error path (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix 32-bit program crash with 64-bit kernel on AMD boxes (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: reload spec_ctrl cpuid in all microcode load paths (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Prevent unwanted speculation without IBRS (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: add noibrs noibpb boot options (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Use retpoline for syscall's indirect calls (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] syscall: Clear unused extra registers on 32-bit compatible syscall entrance (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: rescan cpuid after a late microcode update (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: add debugfs ibrs_enabled ibpb_enabled (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: consolidate the spec control boot detection (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] Remove __cpuinitdata from some data & function (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] KVM/spec_ctrl: allow IBRS to stay enabled in host userland (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: move stuff_RSB in spec_ctrl.h (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Remove STUFF_RSB in error and interrupt code (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Stuff RSB for entry to kernel for non-SMEP platform (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm: Only set IBPB when the new thread cannot ptrace (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm: Set IBPB upon context switch (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] idle: Disable IBRS when offlining cpu and re-enable (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] idle: Disable IBRS entering idle and enable it on wakeup (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: implement spec ctrl C methods (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: save IBRS MSR value in save_paranoid for NMI (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] enter: Use IBRS on syscall and interrupts (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: swap rdx with rsi for nmi nesting detection (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: spec_ctrl_pcp and kaiser_enabled_pcp in same cachline (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: use per-cpu knob instead of ALTERNATIVES for ibpb and ibrs (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] enter: MACROS to set/clear IBRS and set IBPB (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] x86: add SPEC_CTRL to MSR and CPUID lists (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] svm: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] svm: Set IBPB when running a different VCPU (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] vmx: add MSR_IA32_SPEC_CTRL and MSR_IA32_PRED_CMD (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] vmx: Set IBPB when running a different VCPU (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [kvm] x86: clear registers on VM exit (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] [kvm] Pad RSB on VM transition (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [security] Add SPEC_CTRL Kconfig option (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpu/AMD: Control indirect branch predictor when SPEC_CTRL not available (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] feature: Report presence of IBPB and IBRS control (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] feature: Enable the x86 feature to control Speculation (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpuid: Provide get_scattered_cpuid_leaf() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpuid: Cleanup cpuid_regs definitions (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] microcode: Share native MSR accessing variants (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] nop: Make the ASM_NOP* macros work from assembly (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] cpu: Clean up and unify the NOP selection infrastructure (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] entry: Further simplify the paranoid_exit code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Remove trampoline check from paranoid entry path (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Don't switch to trampoline stack in paranoid_exit (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Simplify trampoline stack restore code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [misc] locking/barriers: prevent speculative execution based on Coverity scan results (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [fs] udf: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [fs] prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [scsi] qla2xxx: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [netdrv] p54: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [netdrv] carl9170: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [media] uvcvideo: prevent speculative execution (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] cpu/AMD: Remove now unused definition of MFENCE_RDTSC feature (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] cpu/AMD: Make the LFENCE instruction serialized (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [kernel] locking/barriers: introduce new memory barrier gmb() (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] Fix typo preventing msr_set/clear_bit from having an effect (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] Add another set of MSR accessor functions (Waiman Long) [1519787 1519789] {CVE-2017-5753}
  - [x86] mm/kaiser: Replace kaiser with kpti to sync with upstream (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map the trace idt tables in userland shadow pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add "kaiser" and "nokaiser" boot options (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: fix RESTORE_CR3 crash in kaiser_stop_machine (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use stop_machine for enable/disable knob (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: use atomic ops to poison/unpoison user pagetables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use invpcid to flush the two kaiser PCID AISD (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use two PCID ASIDs optimize the TLB during enter/exit kernel (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: stop patching flush_tlb_single (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: If INVPCID is available, use it to flush global mappings (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: use PCID feature to make user and kernel switches faster (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/64: Initialize CR4.PCIDE early (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Add a 'noinvpcid' boot option to turn off INVPCID (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Add the 'nopcid' boot option to turn off PCID (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: validate trampoline stack (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Move SYSENTER_stack to the beginning of struct tss_struct (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: isolate the user mapped per cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: selective boot time defaults (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser/xen: Dynamically disable KAISER when running under Xen PV (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add Kconfig (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: avoid false positives during non-kaiser pgd updates (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Respect disabled CPU features (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] kaiser/mm: trampoline stack comments (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: stack trampoline (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: re-enable vsyscalls (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow to build KAISER with KASRL (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow KAISER to be enabled/disabled at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: un-poison PGDs at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add a function to check for KAISER being enabled (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add debugfs file to turn KAISER on/off at runtime (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: disable native VSYSCALL (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map virtually-addressed performance monitoring buffers (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add kprobes text section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map trace interrupt entry (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map entry stack per-cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: map dynamically-allocated LDTs (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: make sure static PGDs are 8k in size (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: allow NX poison to be set in p4d/pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: unmap kernel from userspace page tables (core patch) (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: mark per-cpu data structures required for entry/exit (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: introduce user-mapped per-cpu areas (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: add cr3 switches to entry code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: remove scratch registers (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: prepare assembly for entry/exit CR3 switching (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Disable global pages by default with KAISER (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Document X86_CR4_PGE toggling behavior (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/tlb: Make CR4-based TLB flushes more robust (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Do not set _PAGE_USER for init_mm page tables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] increase robusteness of bad_iret fixup handler (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm: Check if PUD is large when validating a kernel address (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] Separate out entry text section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] linux/const.h: Add _BITUL() and _BITULL() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] linux/mmdebug.h: add VM_WARN_ON() and VM_WARN_ON_ONCE() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [include] stddef.h: Move offsetofend() from vfio.h to a generic kernel header (Waiman Long) [1519799 1519802] {CVE-2017-5754}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.18.6.el6]
changelog:
  - [x86] spec_ctrl: set IBRS during resume from RAM if ibrs_enabled is 2 (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: __load_cr3 in resume from RAM after kernel %gs has been restored (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/kaiser: Revert the __GFP_COMP flag change (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix paranoid_exit() trampoline clobber (Waiman Long) [1519799 1519802] {CVE-2017-5754}


author: Denys Vlasenko <dvlasenk@redhat.com> [2.6.32-696.18.7.el6]
changelog:
  - [x86] spec_ctrl: svm: spec_ctrl at vmexit needs per-cpu areas functional (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: Eliminate redundnat FEATURE Not Present messages (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: enable IBRS and stuff_RSB before calling NMI C code (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: skip CAP_SYS_PTRACE check to skip audit (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: disable ibrs while in intel_idle() (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] spec_ctrl: skip IBRS/CR3 restore when paranoid exception returns to userland (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - Revert "x86/entry: Use retpoline for syscall's indirect calls" (Waiman Long) [1519797 1519796] {CVE-2017-5715}
  - [x86] mm/dump_pagetables: Allow dumping current pagetables (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Add a pgd argument to walk_pgd_level() (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/dump_pagetables: Add page table directory (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Remove unneeded nmi_userspace code (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] entry: Fix nmi exit code with CONFIG_TRACE_IRQFLAGS (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: init_tss is supposed to go in the PAGE_ALIGNED per-cpu section (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: Clear kdump pgd page to prevent incorrect behavior (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: consider the init_mm.pgd a kaiser pgd (Waiman Long) [1519799 1519802] {CVE-2017-5754}
  - [x86] mm/kaiser: convert userland visible "kpti" name to "pti" (Waiman Long) [1519799 1519802] {CVE-2017-5754}


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-25
changelog:
  - related: #921612
    reverted the boundary when the sa data files are stored in directories
    and default history value back to 28. Without the revert, backward
    compatibility could be broken in some cases.


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-26
changelog:
  - resolves: #1110851
    added sysstat(5) man page describing /etc/sysconfig/sysstat file
  - resolves: #1102603
    added possibility to set compress method in /etc/sysconfig/sysstat file


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-27
changelog:
  - resolves: #1124180
    added workaround for dyn-tick kernel feature which makes /proc/stat file
    unreliable under certain circumstances


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-28
changelog:
  - resolves: #1224878
    fixed bug when pidstat could run out of pre-allocated space for PIDs
  - resolves: #887231
    fixed segfaults on bogus localtime input
  - resolves: #1185057
    added two new columns to iostat: r_await and w_await
  - resolves: #1188612
    fixed description of %util field in sar(1) and iostat(1) man pages


author: Peter Schiffer <pschiffe@redhat.com> - 9.0.4-31
changelog:
  - related: #1224878
    in some corner cases, pidstat could still output values for % CPU bigger
    than 100; this commit fixes the issue


author: Michal Sekletar <msekleta@redhat.com> - 9.0.4-32
changelog:
  - cifsiostat: report correct number of open/closed files (#1346844)
  - sar: output timestamps when running with ko_KR.UTF-8 locale (#1363947)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.265.b01-0
changelog:
  - Update to aarch64-shenandoah-jdk8u265-b01.
  - Update release notes for 8u265 release.
  - Resolves: rhbz#1860462


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b09-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b09 (EA).
  - Switch to EA mode.
  - Add debugging output for build.
  - JFR must now be explicitly disabled when unwanted (e.g. x86), following switch of upstream default.
  - Update tarball generation script to use PR3795, following inclusion of JDK-8177334
  - Add additional s390 size_t case in g1ConcurrentMarkObjArrayProcessor.cpp introduced by JDK-8057003
  - Add additional s390 log2_intptr case in shenandoahUtils.cpp introduced by JDK-8245464
  - Enable JFR on x86, now we have JDK-8252096: Shenandoah: adjust SerialPageShiftCount for x86_32 and JFR
  - Update tarball generation script to use PR3799, following inclusion of JDK-8245468 (TLSv1.3)
  - Resolves: rhbz#1876665


author: Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Set vendor property and vendor URLs
  - Made URLs to be preconfigured by OS
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Update to aarch64-shenandoah-jdk8u272-b10.
  - Switch to GA mode for final release.
  - Update release notes for 8u272 release.
  - Add backport of JDK-8254177 to update to tzdata 2020b
  - Require tzdata 2020b due to resource changes in JDK-8254177
  - Adjust PR3593 following g1StringDedupTable.cpp context change in JDK-8240124 & JDK-8244955
  - Include a test in the RPM to check the build has the correct vendor information.
  - Use 'oj_' prefix on new vendor globals to avoid a conflict with RPM's vendor value.
  - Improve quoting of vendor name
  - Add backport of JDK-8215727: "Restore JFR thread sampler loop to old / previous behaviour"
  - This tarball is embargoed until 2020-10-20 @ 1pm PT.
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.272.b10-0
changelog:
  - Remove the 64-bit siphash test which fails to compile on x86-32 debug builds with gcc 4.4.7 in RHEL 6
  - Resolves: rhbz#1876665


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.1
changelog:
  - Bump to 2.6.7 and u111b00.
  - Update SystemTap bundle with fix for PR3091/RH1204159
  - Drop patches (PR2938 (ttable_match_7) and PR2939 (fontpath)) applied upstream.
  - Resolves: rhbz#1350040


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.111-2.6.7.2
changelog:
  - Reset permissions of resources.jar to avoid it only being readable by root (PR1437).
  - Resolves: rhbz#1350040


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.1
changelog:
  - Bump to 2.6.8 and u121b00.
  - Drop patches (S7081817, S8140344, S8145017 and S8162344) applied upstream.
  - Require at least the build-time version of NSS at run-time due to static linking.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.121-2.6.8.2
changelog:
  - Require a version of java-1.7.0-openjdk-devel with a working jar uf
  - Remove unneeded AArch64 environment variable setting.
  - Resolves: rhbz#1381990


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.2.el6]
changelog:
  - [lib] idr: free the top layer if idr tree has the maximum height (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix top layer handling (Denys Vlasenko) [1698139] {CVE-2019-3896}
  - [lib] idr: fix backtrack logic in idr_remove_all (Denys Vlasenko) [1698139] {CVE-2019-3896}


author: Phillip Lougher <plougher@redhat.com> [2.6.32-754.15.3.el6]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719614] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719840] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719585] {CVE-2019-11477}
  - [net] tcp: pass previous skb to tcp_shifted_skb() (Florian Westphal) [1719585] {CVE-2019-11477}


author: Weiping Pan <wpan@redhat.com> 2.0.8 4
changelog:
  - add  .clear_inode callback, fix bug 1157408.
  - rebuild oracleasm for RHEL6.6 in brew, update the version to 2.0.8-4


author: Eugene Syromiatnikov <esyr@redhat.com> 2.0.8-16.1
changelog:
  - Add "use-after-free-asm-request.patch"
  - (oracleasm: Fix use after free for request processing timer)
  - Resolves: #1673777


author: Tomas Hozza <thozza@redhat.com> 32:9.8.2-0.25.rc1
changelog:
  - configure with --enable-filter-aaaa to enable use of filter-aaaa-on-v4 option (#1025008)
  - Fix race condition when destroying a resolver fetch object (#993612)
  - Fix the RRL functionality to include referrals-per-second and nodata-per-second options (#1036700)
  - Fix segfault on SERVFAIL to NXDOMAIN failover (#919545)


author: Tomas Hozza <thozza@redhat.com> 32:9.8.2-0.26.rc1
changelog:
  - Configure BIND with --with-dlopen=yes to support dynamically loadable DLZ drivers (#846065)
  - Fix initscript to return correct exit value when calling checkconfig/configtest/check/test (#848033)
  - Don't (un)mount chroot filesystem when running initscript command configtest with running server (#851123)
  - Fix zone2sqlite tool to accept zones containing "." or "-" or starting with a digit (#919414)
  - Fix initscript not to mount chroot filesystem is named is already running (#948743)
  - Fix initscript to check if the PID in PID-file is really s PID of running named server (#980632)
  - Correct the installed documentation ownership (#1051283)


author: Tomas Hozza <thozza@redhat.com> 32:9.8.2-0.27.rc1
changelog:
  - Fix segmentation fault in nsupdate when -r option is used (#1064045)
  - Fix race condition on send buffer in host tool when sending UDP query (#1008827)
  - Allow authentication using TSIG in allow-notify configuration statement (#1044545)
  - Fix SELinux context of /var/named/chroot/etc/localtime (#902431)
  - Include updated named.ca file with root server addresses (#917356)
  - Don't generate rndc.key if there is rndc.conf on start-up (#997743)
  - Fix dig man page regarding how to disable IDN (#1023045)
  - Handle ICMP Destination unreachable (Protocol unreachable) response (#1066876)


author: Tomas Hozza <thozza@redhat.com> 32:9.8.2-0.28.rc1
changelog:
  - Add support for TLSA resource records (#956685)
  - Increase defaults for lwresd workers and make workers and client objects number configurable (#1092035)


author: Tomas Hozza <thozza@redhat.com> 32:9.8.2-0.30.rc1.3
changelog:
  - DNS resolution failure in high load environment with SERVFAIL and "out of memory/success" in the log (#1220366)


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b07-0.0.ea
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b07 and Shenandoah merge 2019-06-13.
  - Resolves: rhbz#1724452


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.222.b09-0
changelog:
  - Update to aarch64-shenandoah-jdk8u222-b09.
  - Switch to GA mode for final release.
  - Resolves: rhbz#1724452


author: Giuseppe Scrivano <gscrivan@redhat.com> - 0.9.0-21
changelog:
  - Fix error reporting (rhbz#1093980)
  - Fix parser error when install virt-manager (rhbz#1093979)
  - Fix Preferences/Feedback UI alignment (rhbz#1094083)


author: Giuseppe Scrivano <gscrivan@redhat.com> - 0.9.0-22
changelog:
  - Fix alignment of Preferences/VM Details (rhbz#1094083)
  - Fix description of "Source Name" in create-pool (rhbz#1094005)
  - Handle ipv6 addresses (rhbz#870383)
  - virt-manager: escape host string (rhbz#1094600)


author: Giuseppe Scrivano <gscrivan@redhat.com> - 0.9.0-29
changelog:
  - Use correct signal and callback names to catch cpu-threads property changes (rhbz#1190641)
  - Fix crash caused by closing an unowned fd (rhbz#1174464)


author: Phillip Lougher <plougher@redhat.com> [2.6.32-690.el6]
changelog:
  - [drm] core: Do not preserve framebuffer on rmfb, v4 (Rob Clark) [1405267]
  - [scsi] mpt3sas: Fix for block device of raid exists even after deleting raid disk (Tomas Henzl) [1416552]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-691.el6]
changelog:
  - [net] tcp: correct memory barrier usage in tcp_check_space() (Oleg Nesterov) [1386136]
  - [fs] epoll: prevent missed events on EPOLL_CTL_MOD (Oleg Nesterov) [1386136]
  - [acpi] acpica: Fix regression in FADT revision checks (Lenny Szubowicz) [1418339]
  - [net] ipv6: stop sending PTB packets for MTU < 1280 (Hannes Frederic Sowa) [1415931] {CVE-2016-10142}
  - [net] fix dst_ops_extend leaks (Sabrina Dubroca) [1399633]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-692.el6]
changelog:
  - [fs] gfs2: Limit number of transaction blocks requested for truncates (Robert S Peterson) [1401058]
  - [fs] revert "sunrpc: make AF_LOCAL connect synchronous" (Benjamin Coddington) [1420044]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-693.el6]
changelog:
  - [netdrv] sfc: Add efx_nic member with fixed netdev features (Jarod Wilson) [1419396]
  - [netdrv] sfc: Take mac_lock before calling efx_ef10_filter_table_probe (Jarod Wilson) [1419396]
  - [netdrv] sfc: Fix VLAN filtering feature if vPort has VLAN_RESTRICT flag (Jarod Wilson) [1419396]
  - [netdrv] sfc: clean fallbacks between promisc/normal in efx_ef10_filter_sync_rx_mode (Jarod Wilson) [1419396]
  - [netdrv] sfc: support cascaded multicast filters (Jarod Wilson) [1419396]
  - [netdrv] sfc: Make failed filter removal less noisy (Jarod Wilson) [1410750]
  - [netdrv] sfc: re-factor efx_ef10_filter_sync_rx_mode() (Jarod Wilson) [1410750]
  - [netdrv] sfc: refactor debug-or-warnings printks (Jarod Wilson) [1410750]
  - [net] implement netif_cond_dbg macro (Jarod Wilson) [1410750]


author: Phillip Lougher <plougher@redhat.com> [2.6.32-694.el6]
changelog:
  - [fs] posix_acl: Clear SGID bit when setting file permissions (Andreas Grunbacher) [1371252] {CVE-2016-7097}
  - [fs] switch posix_acl_equiv_mode() to umode_t * (Andreas Grunbacher) [1371252] {CVE-2016-7097}
  - [perf] sched latency: Fix thread pid reuse issue (Jiri Olsa) [1400743]
  - [fs] ext4: fix races of writeback with punch hole and zero range (Lukas Czerner) [1394786]
  - [fs] ext4: validate s_reserved_gdt_blocks on mount (Lukas Czerner) [1394786]
  - [fs] ext4: release bh in make_indexed_dir (Lukas Czerner) [1394786]
  - [fs] ext4: reinforce check of i_dtime when clearing high fields of uid and gid (Lukas Czerner) [1394786]
  - [fs] ext4: validate that metadata blocks do not overlap superblock (Lukas Czerner) [1394786]
  - [fs] ext4: short-cut orphan cleanup on error (Lukas Czerner) [1394786]
  - [fs] ext4: fix reference counting bug on block allocation error (Lukas Czerner) [1394786]
  - [fs] ext4: check for extents that wrap around (Lukas Czerner) [1394786]
  - [fs] ext4: silence UBSAN in ext4_mb_init() (Lukas Czerner) [1394786]
  - [fs] ext4: address UBSAN warning in mb_find_order_for_block() (Lukas Czerner) [1394786]
  - [fs] ext4: clean up error handling when orphan list is corrupted (Lukas Czerner) [1394786]
  - [fs] ext4: fix hang when processing corrupted orphaned inode list (Lukas Czerner) [1394786]
  - [fs] jbd2: Fix unreclaimed pages after truncate in data=journal mode (Lukas Czerner) [1394786]
  - [fs] ext4: Fix handling of extended tv_sec (Lukas Czerner) [1394786]
  - [fs] create and use seq_show_option for escaping (Lukas Czerner) [1394786]
  - [fs] ext4: replace open coded nofail allocation in ext4_free_blocks() (Lukas Czerner) [1394786]
  - [fs] ext4: Introduce EFSBADCRC and EFSCORRUPTED error codes (Lukas Czerner) [1394786]
  - [block] ensure request->part is valid (Jeff Moyer) [1416341]
  - [sound] alsa: hda - fix Lewisburg audio issue (Jaroslav Kysela) [1413134]


author: Lukáš Nykrýn <lnykryn@redhat.com> - 9.03.47-1
changelog:
  - rc.sysinit: be more verbose
  - init.d/functions: rc.debug option to debug initscripts
  - ifup-aliases: inherit ARPCHECK from parent device
  - netfs: don't race NFS umount to network shutdown
  - network: report that we can't shut down network for root on netfs
  - Fix tcsh + grep-2.7. (#636552)
  - sysctl.conf: move bridge setting to module-init-tools
  - rc.sysinit: set affinity also for current shell
  - ifdown-eth: use scope host for lo
  - improve_check_for_bond_master_in_install_bonding_driver
  - network-functions: fix check in install_bonding_driver
  - ifdown-post: remove resolv.conf only in specific cases
  - netconsole: lets run earlier
  - ipcalc: support RFC3021 (#997271)
  - halt: add delay after upsdrvctl shutdown
  - ifup: also set multicast_snooping after the bridge is up


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-3.b15
changelog:
  - Restrict debug builds to shipped JIT architectures, excluding unshipped ppc64
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-5.b18
changelog:
  - Update to aarch64-jdk8u111-b18, synced with upstream u111, S8170873 and new AArch64 fixes
  - Replace our correct version of 8159244 with the amendment to the 8u version from 8160122.
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-5.b18
changelog:
  - Use java-1.7.0-openjdk to bootstrap on RHEL to allow us to use main build target
  - Resolves: rhbz#1410612


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-5.b18
changelog:
  - Disable -ffp-no-contract option introduced by 8170873 as not available on RHEL 6 GCC.
  - Resolves: rhbz#1410612


author: Karel Zak <kzak@redhat.com> 2.17.2-12.16
changelog:
  - fix #1033309 - man rename references mmv command which is not available
  - fix #1039187 - taskset man page PERMISSIONS section is incorrect
  - fix #999625 - mount does not appear to be correctly documented for default mount options
  - fix #1004021 - document blkid -w behaviour
  - fix #1011590 - fdisk: Floating point exception on multipath mapped device
  - fix #1031641 - findmnt should handle better trailing "/" in /proc/mounts entries
  - fix #1104575 - kill(1) doesn't check errno after calling strtol()
  - fix #1049055 - backport PID ns support to unshare(1) in util-linux-ng
  - fix #957906 - backport 'nsenter' utility to util-linux
  - fix #619521 - requesting to add logins(1m) command to distribution of Red Hat


author: Rex Dieter <rdieter@fedoraproject.org> - 1.900.1-13
changelog:
  - CVE-2008-3520 jasper: multiple integer overflows in jas_alloc calls (#461476)
  - CVE-2008-3522 jasper: possible buffer overflow in 
    jas_stream_printf() (#461478)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-17
changelog:
  - CVE-2014-9029 - incorrect component number check in COC, RGN and QCC
                    marker segment decoders (#1171209)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-18
changelog:
  - CVE-2014-8137 - double-free in in jas_iccattrval_destroy (#1173567)
  - CVE-2014-8138 - heap overflow in jp2_decode (#1173567)


author: Jiri Popelka <jpopelka@redhat.com> - 1.900.1-19
changelog:
  - CVE-2014-8157 - dec->numtiles off-by-one check in jpc_dec_process_sot() (#1183672)
  - CVE-2014-8158 - unrestricted stack memory use in jpc_qmfb.c (#1183680)


author: Josef Ridky <jridky@redhat.com> - 1.900.1-20
changelog:
  - Multiple security fixes (fixed by thoger):
    CVE-2015-5203 CVE-2015-5221 CVE-2016-1577 CVE-2016-1867 CVE-2016-2089
    CVE-2016-2116 CVE-2016-8654 CVE-2016-8690 CVE-2016-8691 CVE-2016-8692
    CVE-2016-8693 CVE-2016-8883 CVE-2016-8884 CVE-2016-8885 CVE-2016-9262
    CVE-2016-9387 CVE-2016-9388 CVE-2016-9389 CVE-2016-9390 CVE-2016-9391
    CVE-2016-9392 CVE-2016-9393 CVE-2016-9394 CVE-2016-9560 CVE-2016-9583
    CVE-2016-9591 CVE-2016-9600 CVE-2016-10248 CVE-2016-10249 CVE-2016-10251
  - Fix implicit declaration warning caused by security fixes above


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-44
changelog:
  - use only full matches for hosts used as IP address in cookies (CVE-2014-3613)
  - fix handling of CURLOPT_COPYPOSTFIELDS in curl_easy_duphandle (CVE-2014-3707)


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-46
changelog:
  - require credentials to match for NTLM re-use (CVE-2015-3143)
  - close Negotiate connections when done (CVE-2015-3148)


author: Kamil Dudka <kdudka@redhat.com> 7.19.7-49
changelog:
  - prevent NSS from incorrectly re-using a session (#1269660)
  - prevent test46 from failing due to expired cookie (#1277551)


author: Jindrich Novy <jnovy@redhat.com> 2007-31
changelog:
  - do not conflict with dvipdfm
  - update perl requires filter
  - update latin.ldf (#469948)
  - do not provide any perl dependencies (#516350)


author: Tom "spot" Callaway <tcallawa@redhat.com> 2007-32
changelog:
  - resolve conflict between texlive-texmf (and -doc) and tetex-perltex
  - resolve conflict between texlive-texmf and tetex-prosper
  - resolve conflict between texlive-texmf and tetex-perltex


author: Jindrich Novy <jnovy@redhat.com> 2007-34
changelog:
  - fix permissions of /var/lib/texmf/web2c (#512459, #531894)
  - add IEEEconf (#495877)
  - update achemso (#521459)
  - update perltex to 2.0 from CTAN
  - obsolete tetex-perltex


author: Jindrich Novy <jnovy@redhat.com> 2007-36
changelog:
  - allow to make LaTeX format from source more than 5 years old
    (it gives a warning instead of an error)
    http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=531569#56


author: Marek Kasik <mkasik@redhat.com> - 0.12.3-3
changelog:
  - Correct %changelog
  - Correct permissions of goo/GooTimer.h
  - Convert pdftohtml.1 to utf8
  - Related: #543948


author: Marek Kasik <mkasik@redhat.com> - 0.12.3-4
changelog:
  - Fix text selection
  - Add patch poppler-0.12.3-text-selection.patch by Brian Ewins
  - Add patch poppler-0.12.3-text-selection-tables.patch by Marek Kasik
  - Make Provides/Obsoletes versioned
  - Add requirement of poppler-data
  - Resolves: #557812


author: Jan Stancek <jstancek@redhat.com> [2.6.32-696.29.1.el6]
changelog:
  - [x86] x86/spec_ctrl: Fix late microcode problem with AMD (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Clean up entry code & remove unused APIs (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Mask off SPEC_CTRL MSR bits that are managed by kernel (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: add support for SSBD to RHEL IBRS entry/exit macros (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Rename _RDS to _SSBD (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/speculation: Add prctl for Speculative Store Bypass mitigation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/process: Allow runtime control of Speculative Store Bypass (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [kernel] prctl: Add speculation control prctls (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/kvm: Expose the RDS bit to the guest (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs/AMD: Add support to disable RDS on Fam[15, 16, 17]h if requested (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Sync up RDS setting with IBRS code (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Provide boot parameters for the spec_store_bypass_disable mitigation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Expose the /sys/../spec_store_bypass and X86_BUG_SPEC_STORE_BYPASS (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/bugs: Read SPEC_CTRL MSR during boot and re-use reserved bits (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/spec_ctrl: Use separate PCP variables for IBRS entry and exit (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] cpu/intel: Knight Mill and Moorefield update to intel-family.h (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/speculation: Update Speculation Control microcode blacklist (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpuid: Fix up "virtual" IBRS/IBPB/STIBP feature bits on Intel (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Clean up Spectre v2 related CPUID flags (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add AMD feature bits for Speculation Control (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add Intel feature bits for Speculation (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpufeatures: Add CPUID_7_EDX CPUID leaf (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] x86/cpu: Fill in feature word 13, CPUID_8000_0008_EBX (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] Extend RH cpuinfo to 10 extra words (Waiman Long) [1566893 1566899] {CVE-2018-3639}
  - [x86] kpti/kexec: fix wrong page address in clear_page (Dave Young) [1573176 1572487]


author: Stephen Gallagher <sgallagh@redhat.com> - 1.2.1-3
changelog:
  - Resolves: rhbz#692251 - tdb_extend() can cause a memory-usage explosion if
  -                         the size of its entries are very large


author: Jakub Hrozek <jhrozek@redhat.com> - 1.2.10-1
changelog:
  - Resolves: rhbz#766334 - Rebase libtdb to match the version required
                            by Samba4
  - Enable the Python bindings to satisfy samba4 BuildRequirements
  - Obsoletes tdb-1.2.9-limit-tdb_expand.patch


author: Jakub Hrozek <jhrozek@redhat.com> - 1.3.8-3.2
changelog:
  - Move _tdb_text.py to python-tdb subpackage
  - Resolves: rhbz#1329664 - tdb mispackaged tdb_text.py file


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.10.1.el6]
changelog:
  - [sound] Fix USB audio issues (wrong URB_ISO_ASAP semantics) (Jaroslav Kysela) [1273916 1255071]
  - [security] keys: Don't permit request_key() to construct a new keyring (David Howells) [1275927 1273463] {CVE-2015-7872}
  - [security] keys: Fix crash when attempt to garbage collect an uninstantiated keyring (David Howells) [1275927 1273463] {CVE-2015-7872}
  - [security] keys: Fix race between key destruction and finding a keyring by name (David Howells) [1275927 1273463] {CVE-2015-7872}
  - [ipc] Initialize msg/shm IPC objects before doing ipc_addid() (Stanislav Kozina) [1271504 1271505] {CVE-2015-7613}
  - [fs] vfs: Test for and handle paths that are unreachable from their mnt_root (Eric W. Biederman) [1209368 1209369] {CVE-2015-2925}
  - [fs] dcache: Handle escaped paths in prepend_path (Eric W. Biederman) [1209368 1209369] {CVE-2015-2925}
  - [netdrv] igb: add support for 1512 PHY (Stefan Assmann) [1278275 1238551]
  - [hid] fix unused rsize usage (Don Zickus) [1268203 1256568]
  - [hid] fix data access in implement() (Don Zickus) [1268203 1256568]
  - [fs] NFS: Hold i_lock in nfs_wb_page_cancel() while locking a request (Benjamin Coddington) [1273721 1135601]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.11.1.el6]
changelog:
  - [kvm] svm: unconditionally intercept DB (Paolo Bonzini) [1279467 1279468] {CVE-2015-8104}
  - [x86] virt: guest to host DoS by triggering an infinite loop in microcode (Paolo Bonzini) [1277557 1277559] {CVE-2015-5307}


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.13.1.el6]
changelog:
  - [security] Don't leak a key reference if request_key tries to use a revoked keyring (David Howells) [1288095 1188442]
  - [fs] gfs2: Protect freeing directory hash table with i_lock spin_lock (Robert S Peterson) [1288093 1250663]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.14.1.el6]
changelog:
  - [scsi] bfa: Fix incorrect de-reference of pointer (Chad Dupuis) [1292370 1258533]
  - [netdrv] genetlink-compat: register multicast groups (Stanislaw Gruszka) [1291978 1259870]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.16.1.el6]
changelog:
  - [net] bonding: propagate LRO disable to slave devices (Jarod Wilson) [1287993 1259008]
  - [net] Move bonding headers under include/net (Jarod Wilson) [1287993 1259008]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.17.1.el6]
changelog:
  - [kernel] hrtimer: add force_hrtimer_reprogram kernel parameter (Prarit Bhargava) [1292082 1285142]
  - [mm] fix anon_vma->degree underflow in anon_vma endless growing prevention (Jerome Marchand) [1285693 1151823]
  - [mm] fix corner case in anon_vma endless growing prevention (Jerome Marchand) [1285693 1151823]
  - [mm] prevent endless growth of anon_vma hierarchy (Jerome Marchand) [1285693 1151823]
  - [mm] avoid anon_vma_chain allocation under anon_vma lock (Jerome Marchand) [1285693 1151823]
  - [mm] avoid repeated anon_vma lock/unlock sequences in unlink_anon_vmas() (Jerome Marchand) [1285693 1151823]
  - [mm] avoid repeated anon_vma lock/unlock sequences in anon_vma_clone() (Jerome Marchand) [1285693 1151823]
  - [scsi] only re-lock door after EH on devices that were reset (Ewan Milne) [1282464 995234]
  - [fs] fs: Unhash and evict unused children dentries after rmdir (Lukas Czerner) [1282621 1241030]
  - [fs] revert 'vfs: Unhash and evict unused children dentries after rmdir' (Carlos Maiolino) [1282621 1241030]
  - [netdrv] macvtap: fix network header pointer for VLAN tagged pkts (Ivan Vecera) [1280206 1213846]
  - [net] Fix vlan_get_protocol for stacked vlan (Ivan Vecera) [1280206 1213846]
  - [scsi] ipr: Fix incorrect trace indexing (Gustavo Duarte) [1280211 1209543]
  - [scsi] ipr: Fix invalid array indexing for HRRQ (Gustavo Duarte) [1280211 1209543]


author: Jeff E. Nelson <jen@redhat.com> - 0.12.1.2-2.479.el6_7.3
changelog:
  - kvm-net-pcnet-add-check-to-validate-receive-data-size-CV.patch [bz#1287950]
  - kvm-pcnet-fix-rx-buffer-overflow-CVE-2015-7512.patch [bz#1287950]
  - Resolves: bz#1287950
    (CVE-2015-7504 CVE-2015-7512 qemu-kvm: various flaws [rhel-6.7.z])


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-119
changelog:
  - Resolve sftp force permission colision with umask (#1341747)
  - Relax bits needed check to allow hmac-sha2-512 with gss-group1-sha1- (#1353359)
  - close ControlPersist background process stderr when not in debug mode (#1335539)
  - Do not add a message "The agent has no identities." in ~/.ssh/authorized_keys (#1353410)


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-120
changelog:
  - Prevent infinite loop when Ctrl+Z pressed at password prompt (#1218424)
  - Remove RC4 cipher and MD5 based MAC from the default client proposal (#1373836)


author: Jakub Jelen <jjelen@redhat.com> - 5.3p1-122
changelog:
  - Allow to use ibmca crypto hardware (#1397547)
  - CVE-2015-8325: privilege escalation via user's PAM environment and UseLogin=yes (1405374)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-39
changelog:
  - Release 1.2.11.15-39
  - Resolves: #1123863
    EMBARGOED CVE-2014-3562 - unauthenticated information disclosure (Bug 1123477)
  - Resolves: #1123863
    High contention on computed attribute lock (DS 616)
  - Resolves: #1062763
    single valued attribute replicated ADD does not work (DS 47692)
  - Resolves: #1121596
    Deleting attribute present in nsslapd-allowed-to-delete-attrs returns Operations error (DS 443)
  - Resolves: #1014111
    Repl-monitor.pl ignores the provided connection parameters (DS 47862)
  - Resolves: #1115281
    New defects found in 389-ds-base-1.2.11 (DS 47863)
  - Resolves: #1112729
    paged results control is not working in some cases when we have a subsuffix. (DS 47824)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-40
changelog:
  - Release 1.2.11.15-40
  - Resolves: #1130252 - dirsrv not running with old openldap (DS 47875)
  - Resolves: #1103287 - logconv.pl memory continually grows (DS 47446)
  - Resolves: #1121596 - Deleting attribute present in nsslapd-allowed-to-delete-attrs returns Operations error (DS 443)
  - Resolves: #1109381 - winsync doesn't sync DN valued attributes if DS DN value doesn't exist (DS 415)
  - Resolves: #1128759 - Performance degradation with scope ONE after some load (DS 47874)
  - Resolves: #1127612 - Filter AND with only one clause should be optimized (DS 47872)
  - Resolves: #1014111 - repl-monitor fails to convert "*" to default values (DS 47862)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-42
changelog:
  - Release 1.2.11.15-42
  - Resolves: #1129660 - Adding users to user group throws Internal server error.


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-43
changelog:
  - Release 1.2.11.15-43
  - Resolves: #1112702 - Broken dereference control with the FreeIPA 4.0 ACIs (#47885)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-44
changelog:
  - Release 1.2.11.15-44
  - Resolves: #1079098 - Simultaneous adding a user and binding as the user could fail in the password policy check (DS 47748) - Simple bind hangs after enabling password policy


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-45
changelog:
  - Release 1.2.11.15-45
  - Resolves: #1112702 - Broken dereference control with the FreeIPA 4.0 ACIs (#47885)


author: Noriko Hosoi <nhosoi@redhat.com> - 1.2.11.15-47
changelog:
  - Release 1.2.11.15-47
  - Resolves: #1147479 - Memory leak during Reliab15 execution (6.6.z - #47750)


author: David Vossel <dvossel@redhat.com> - 3.9.5-8
changelog:
  - Revert accidental modification of exportfs's
    unlock_on_stop option.
  - Add on/off as valid value for ip.sh monitor_link

    Resolves: rhbz#1091102
    Resolves: rhbz#1039119


author: David Vossel <dvossel@redhat.com> - 3.9.5-9
changelog:
  - When signalling pids accessing a mount_point to exit,
    make sure to only signal each pid once.

    Resolves: rhbz#1089004


author: David Vossel <dvossel@redhat.com> - 3.9.5-11
changelog:
  - Updates required, unique, and primary fields in bind-mount.sh
    metadata

    Resolves: rhbz#1094789


author: Petr Oros <poros@redhat.com> - 1:1.17-21
changelog:
  - Update microcode data file to 20151106 revision.
  - Resolves: #1244968
  - Remove bad file permissions on /lib/udev/rules.d/89-microcode.rules
  - Resolves: #1201276


author: Petr Oros <poros@redhat.com> - 1:1.17-24
changelog:
  - Update microcode data file to 20161104 revision.
  - Add workaround for E5-26xxv4
  - Resolves: #1346045


author: Petr Oros <poros@redhat.com> - 1:1.17-25.2
changelog:
  - Update Intel CPU microde for 06-3f-02, 06-4f-01, and 06-55-04
  - Add amd microcode_amd_fam17h.bin data file
  - Resolves: #1527357


author: John Dennis <jdennis@redhat.com> - 2.1.12-4
changelog:
  - resolves: bug#855317
    CVE-2012-3547 freeradius: Stack-based buffer overflow by processing
    certain expiration date fields of a certificate during x509 certificate
    validation


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.1.12-5
changelog:
  - Add support for microsecond precision of home server's response_window
    option, client's response_window option with the same precision and home
    server's response_timeouts option, backported from v3.0.x.
  - Resolves: bug#1107843


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.1.12-6
changelog:
  - Fix missing braces around a condition branch in client response_window
    patch.
  - Resolves: bug#1107843


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-1
changelog:
  - Upgrade to the latest upstream release v2.2.6
    Resolves: Bug#921563  raddebug not working correctly
    Resolves: Bug#921567  raddebug -t 0 exists immediately
    Resolves: Bug#1060319 MSCHAP Authentication is not working using automatic
                          windows user credentials
    Resolves: Bug#1078736 Rebase FreeRADIUS to 2.2.4
    Resolves: Bug#1135439 Default message digest defaults to sha1
    Resolves: Bug#1142669 EAP-TLS and OCSP validation causing segmentation
                          fault
    Resolves: Bug#1173388 dictionary.mikrotik missing Attributes
  - Remove radutmp rotation
    Resolves: Bug#904578  radutmp should not rotate
  - Check for start_servers not exceeding max_servers
    Resolves: Bug#1146828 radiusd silently fails when start_servers is higher
                          than max_servers


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-4
changelog:
  - Move OpenSSL init out of version check
    Resolves: Bug#1189394 radiusd segfaults after update
  - Comment-out ippool-dhcp.conf inclusion
    Resolves: Bug#1189386 radiusd fails to start after 'clean' installation


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-5
changelog:
  - Fix EAP client authentication with TLS 1.2
    Resolves: Bug#1254176 FreeRADIUS 2.2.6 miscalculates MPPE keys with TLS 1.2


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-6
changelog:
  - Fix EAP-TTLS/CHAP/MSCHAP/MSCHAPv2 authentication with WPA supplicant v2.4
    Related: Bug#1254176 FreeRADIUS 2.2.6 miscalculates MPPE keys with TLS 1.2


author: Jiri Vanek <jvanek@redhat.com> - 1.7.0.65-2.5.1.2
changelog:
  - added and applied fix for samrtcard io patch405, pr1864_smartcardIO.patch
  - Resolves: rhbz#1115875


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.65-2.5.3pre01.1
changelog:
  - Bump to 2.5.3pre01.
  - Remove obsolete patches, which are now included upstream.
  - Disable LCMS via environment variables rather than maintaining a patch.
  - Resolves: rhbz#1148309


author: Jiri Vanek <jvanek@redhat.com> - 1:1.7.0.71-2.5.3.2
changelog:
  - added and applied patch407, bug1146622-fix.patch
  - removed chrpath (sync with 6.7)
  - Resolves: rhbz#1173706


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.7.0.75-2.5.4.0
changelog:
  - Bump to 2.5.4 using OpenJDK 7u75 b13.
  - Remove earlier temporary patch for RH1146622 (included upstream)
  - Fix elliptic curve list as part of fsg.sh
  - Resolves: rhbz#1180295
  - Resolves: rhbz#1173706


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-2.b13
changelog:
  - Add missing hunk from 8147771, missed due to inclusion of unneeded 8138811
  - Resolves: rhbz#1350034


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-3.b13
changelog:
  - Replace bad 8159244 patch from upstream 8u with fresh backport from OpenJDK 9.
  - Resolves: rhbz#1350034


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.101-4.b15
changelog:
  - Update to aarch64-jdk8u101-b15.
  - Rebase SystemTap tarball on IcedTea 3.1.0 versions so as to avoid patching.
  - Drop additional hunk for 8147771 which is now applied upstream.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.102-0.b14
changelog:
  - Update to aarch64-jdk8u102-b14.
  - Drop 8140620, 8148752 and 6961123, all of which appear upstream in u102.
  - Move 8159244 to 8u111 section as it only appears to be in unpublished u102 b31.
  - Move 8158260 to 8u112 section following its backport to 8u.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-0.b14
changelog:
  - Update to aarch64-jdk8u111-b14.
  - Drop the CORBA typo fix, which appears upstream in u111.
  - Add LCMS 2 patch to fix Red Hat security issue RH1367357 in the local OpenJDK copy.
  - Resolves: rhbz#1381990


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.111-1.b15
changelog:
  - Remove method reference from java.io.ObjectInputStream to allow compilation on old ECJ.
  - Resolves: rhbz#1393047


author: Jakub Jelinek <jakub@redhat.com> 4.4.7-10
changelog:
  - backport two further OpenMP 4.0 libgomp tasking fixes (#1099549)
  - fix scheduler wrong-code with DEBUG_INSNs containing volatile ASM_OPERANDS
    (#1127118, PR rtl-optimization/61801)


author: Jakub Jelinek <jakub@redhat.com> 4.4.7-12
changelog:
  - only use PCH in toplevel inclusions (#1177458, PR pch/38987, PR pch/52518)
  - don't vectorize bitfield and boolean types (#1150606,
    PR tree-optimization/43390)
  - fix up a Cray pointer handling bug (#1134560, PR fortran/62174)
  - fix up stdarg optimization when address of a va_list variable escapes
    in a phi node (#1190640, PR target/64979)


author: Jakub Jelinek <jakub@redhat.com> 4.4.7-17
changelog:
  - change libgomp default spincount if OMP_WAIT_POLICY is not specified
    (#1229852, PR libgomp/43706)
  - remove -Wl,-z,nodlopen from Ada libraries, which no longer contain
    trampolines (#1241495)
  - guard __gcov_flush body in libgcov.a with a mutex (#1251488,
    PR gcov/49484, PR gcov-profile/52627)
  - add missing s390.exp hunk from -mhotpatch= support (#1233260)


author: Jakub Jelinek <jakub@redhat.com> 4.4.7-18
changelog:
  - fix up std::rethrow_exception (PR libstdc++/62258, #1380760)
  - fix fortran ICE in resolve_ordinary_assign (PR fortran/43362, #1356346)


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.4.1.el6]
changelog:
  - [fs] nfs: Make sure pre_change_attr is initialized correctly (Scott Mayhew) [1163214 1160042]
  - [usb] ehci: Fix a regression in the ISO scheduler (Gustavo Duarte) [1162072 1145805]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.5.1.el6]
changelog:
  - [fs] nfsd: don't halt scanning the DRC LRU list when there's an RC_INPROG entry (J. Bruce Fields) [1168129 1150675]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.6.1.el6]
changelog:
  - [fs] ext4: don't count external journal blocks as overhead (Eric Sandeen) [1168504 1163811]
  - [net] sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet (Daniel Borkmann) [1163090 1153980] {CVE-2014-7841}
  - [netdrv] e100: fix typo in MDI/MDI-X eeprom check in e100_phy_init (John Greene) [1165985 1156417]
  - [powerpc] Add smp_mb()s to arch_spin_unlock_wait() (Gustavo Duarte) [1165986 1136224]
  - [powerpc] Add smp_mb() to arch_spin_is_locked() (Gustavo Duarte) [1165986 1136224]
  - [kernel] cpuset: PF_SPREAD_PAGE and PF_SPREAD_SLAB should be atomic flags (Aaron Tomlin) [1165002 1045310]
  - [documentation] cpuset: Update the cpuset flag file (Aaron Tomlin) [1165002 1045310]
  - [alsa] control: Make sure that id->index does not overflow (Jacob Tanenbaum) [1149140 1117312] {CVE-2014-4656}
  - [alsa] control: Handle numid overflow (Jacob Tanenbaum) [1149140 1117312] {CVE-2014-4656}
  - [s390] mm: fix SIGBUS handling (Hendrik Brueckner) [1169433 1145070]
  - [fs] gfs2: fix bad inode i_goal values during block allocation (Abhijith Das) [1165001 1130684]
  - [md] dm-thin: fix pool_io_hints to avoid looking at max_hw_sectors (Mike Snitzer) [1161420 1161421 1142773 1145230]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.7.1.el6]
changelog:
  - [kernel] ipc/sem: Fully initialize sem_array before making it visible (Rik van Riel) [1172029 1165277]
  - [kernel] ipc/sem: synchronize semop and semctl with IPC_RMID (Rik van Riel) [1172029 1165277]
  - [kernel] ipc/sem: update sem_otime for all operations (Larry Woodman) [1172025 1168588]
  - [fs] fuse: prevent null nd panic on dentry revalidate (Brian Foster) [1172022 1162782]
  - [net] netfilter: ipset: timeout values corrupted on set resize (Marcelo Leitner) [1172764 1152754]
  - [net] netfilter: fix xt_TCPOPTSTRIP in forwarding path (Marcelo Leitner) [1172027 1135650]
  - [usb] ehci: Fix panic on hotplug race condition (Don Zickus) [1172024 1107010]
  - [usb] usb_wwan: replace release and disconnect with a port_remove hook (Stanislaw Gruszka) [1172030 1148615]
  - [x86] traps: stop using IST for #SS (Petr  Matousek) [1172810 1172811] {CVE-2014-9322}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.32-504.8.1.el6]
changelog:
  - [crypto] crc32c: Kill pointless CRYPTO_CRC32C_X86_64 option (Jarod Wilson) [1175509 1036212]
  - [crypto] testmgr: add larger crc32c test vector to test FPU path in crc32c_intel (Jarod Wilson) [1175509 1036212]
  - [crypto] tcrypt: Added speed test in tcrypt for crc32c (Jarod Wilson) [1175509 1036212]
  - [crypto] crc32c: Optimize CRC32C calculation with PCLMULQDQ instruction (Jarod Wilson) [1175509 1036212]
  - [crypto] crc32c: Rename crc32c-intel.c to crc32c-intel_glue.c (Jarod Wilson) [1175509 1036212]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-639.el6]
changelog:
  - [input] wacom: fix ExpressKeys remote events (Aristeu Rozanski) [1318027]
  - [fs] revert "writeback: remove wb_list" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: bdi_writeback_task must set task state before calling schedule" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: merge bdi_writeback_task and bdi_start_fn" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: harmonize writeback threads naming" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: fix possible race when creating bdi threads" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wake-ups in the forker thread - 1" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wake-ups in the forker thread - 2" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wake-ups in bdi threads" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: simplify bdi code a little" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not remove bdi from bdi_list" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: move last_active to bdi" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: restructure bdi forker loop a little" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: move bdi threads exiting logic to the forker thread" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: prevent unnecessary bdi threads wakeups" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: optimize periodic bdi thread wakeups" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: remove unnecessary init_timer call" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: cleanup bdi_register" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: fix bad _bh spinlock nesting" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: do not lose wakeup events when forking bdi threads" (Jeff Moyer) [1322297]
  - [fs] revert "writeback: Fix lost wake-up shutting down writeback thread" (Jeff Moyer) [1322297]
  - [mm] revert "backing-dev: ensure wakeup_timer is deleted" (Jeff Moyer) [1322297]
  - [perf] revert: perf changes out of "sched, perf: Fix periodic timers" (Jiri Olsa) [1322488]


author: Aristeu Rozanski <aris@redhat.com> [2.6.32-640.el6]
changelog:
  - [net] use GFP_ATOMIC in dst_ops_extend_register (Sabrina Dubroca) [1323252]
  - [kernel] revert "sched: core: Use hrtimer_start_expires" (Jiri Olsa) [1324318]
  - [kernel] Revert "Cleanup bandwidth timers" (Jiri Olsa) [1324318]
  - [kernel] revert "fair: Test list head instead of list entry in throttle_cfs_rq" (Jiri Olsa) [1324318]
  - [kernel] revert "sched, perf: Fix periodic timers" (Jiri Olsa) [1324318]
  - [kernel] Revert "fix KABI break" (Jiri Olsa) [1324318]


author: Petr Holasek <pholasek@redhat.com> [2.6.32-642.4.2.el6]
changelog:
  - [net] tcp: make challenge acks less predictable (Florian Westphal) [1355606 1355607] {CVE-2016-5696}


author: Adam Jackson <ajax@redhat.com> 1.15.0-25
changelog:
  - CVE fixes for: CVE-2014-8099, CVE-2014-8098, CVE-2014-8097, CVE-2014-8096,
    CVE-2014-8095, CVE-2014-8094, CVE-2014-8093, CVE-2014-8092, CVE-2014-8091,
    CVE-2014-8101, CVE-2014-8100, CVE-2014-8103, CVE-2014-8102


author: Tomáš Mráz <tmraz@redhat.com> 1.0.1e-39
changelog:
  - fix CVE-2015-3216 - regression in RAND locking that can cause segfaults on
    read in multithreaded applications


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-1
changelog:
  - Rebase to nspr-4.10.8
  - Resolves: Bug 1200920 - Rebase nspr to 4.10.8 for Firefox 38 ESR [RHEL-6.6]


author: Elio Maldonado <emaldona@redhat.com> - 4.10.8-2
changelog:
  - Resolves: Bug 1269361 - CVE-2015-7183
  - nspr: heap-buffer overflow in PL_ARENA_ALLOCATE can lead to crash (under ASAN), potential memory corruption


author: Elio Maldonado <emaldona@redhat.com> - 4.11.0-1
changelog:
  - Rebase to NSPR 4.11
  - Resolves: Bug 1297891 - Rebase RHEL 6.8 to NSPR 4.11 in preparation for Firefox 45


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-573.el6]
changelog:
  - [security] selinux: don't waste ebitmap space when importing NetLabel categories (Paul Moore) [1130197]
  - [x86] Revert "Add driver auto probing for x86 features v4" (Prarit Bhargava) [1231280]
  - [net] bridge: netfilter: don't call iptables on vlan packets if sysctl is off (Florian Westphal) [1236551]
  - [net] ebtables: Allow filtering of hardware accelerated vlan frames (Florian Westphal) [1236551]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.2.1.el6]
changelog:
  - [net] udp: fix behavior of wrong checksums (Denys Vlasenko) [1240758 1240759] {CVE-2015-5364 CVE-2015-5366}
  - [fs] vfs: Unhash and evict unused children dentries after rmdir (Lukas Czerner) [1243400 1241030]
  - [fs] vfs: Prevent syncing frozen file system (Lukas Czerner) [1243404 1241791]
  - [fs] vfs: Prevent freeing unlinked file to be indefinitely delayed (Lukas Czerner) [1243406 1236736]
  - [fs] vmcore: continue vmcore initialization if PT_NOTE is found empty (Baoquan He) [1245195 1236437]
  - [fs] vmcore: prevent PT_NOTE p_memsz overflow during header update (Baoquan He) [1245195 1236437]
  - [kernel] audit/fix non-modular users of module_init in core code (Baoquan He) [1245195 1236437]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.3.1.el6]
changelog:
  - [md] Revert "dm: don't schedule delayed run of the queue if nothing to do" (Mike Snitzer) [1246095 1240767]
  - [md] Revert "dm: only run the queue on completion if congested or no requests pending" (Mike Snitzer) [1246095 1240767]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.4.1.el6]
changelog:
  - [firmware] add iwlwifi-8000C-13 ucode (Stanislaw Gruszka) [1242969 1134603]
  - [net] Always propagate flag changes to interfaces (Jarod Wilson) [1253734 1222823]
  - [s390] zcrypt: Fixed reset and interrupt handling of AP queues (Hendrik Brueckner) [1253729 1238308]
  - [scsi] zfcp: Use correct length for FCP_RSP_INFO (Hendrik Brueckner) [1253728 1223105]
  - [tools] perf: avoid possible race condition in copyfile (Milos Vyletel) [1253733 1229673]
  - [tools] perf: Introduce copyfile_offset function (Milos Vyletel) [1253733 1229673]
  - [tools] perfs: Add rm_rf utility function (Milos Vyletel) [1253733 1229673]
  - [net] vlan: restore VLAN_GROUP_ARRAY_LEN definition (Michal Schmidt) [1246102 1242145]
  - [md] dm btree remove: fix bug in redistribute3 (Mike Snitzer) [1246105 1242023]
  - [netdrv] vmxnet3: prevent receive getting out of sequence on napi poll (Neil Horman) [1246092 1236564]
  - [kernel] sched, cgroup: replace signal_struct->group_rwsem with a global percpu_rwsem (Oleg Nesterov) [1246081 1198732]
  - [kernel] percpu_rw_semaphore: add lockdep annotations (Oleg Nesterov) [1246081 1198732]
  - [kernel] percpu_rw_semaphore: kill ->writer_mutex, add ->write_ctr (Oleg Nesterov) [1246081 1198732]
  - [kernel] percpu_rw_semaphore: reimplement to not block the readers unnecessarily (Oleg Nesterov) [1246081 1198732]
  - [kernel] percpu-rwsem: use synchronize_sched_expedited (Oleg Nesterov) [1246081 1198732]
  - [kernel] percpu-rw-semaphores: use rcu_read_lock_sched (Oleg Nesterov) [1246081 1198732]
  - [kernel] percpu-rw-semaphores: use light/heavy barriers (Oleg Nesterov) [1246081 1198732]
  - [kernel] blockdev: turn a rw semaphore into a percpu rw semaphore (Oleg Nesterov) [1246081 1198732]
  - [kernel] softirq: Add softirq_2ms_loop and default to existing RHEL6 behaviour (Prarit Bhargava) [1246064 970263]
  - [kernel] softirq: reduce latencies (Prarit Bhargava) [1246064 970263]


author: Frantisek Hrbata <fhrbata@redhat.com> [2.6.32-573.7.1.el6]
changelog:
  - Revert: [kernel] softirq: reduce latencies (Prarit Bhargava) [1246064 970263]
  - Revert: [kernel] softirq: Add softirq_2ms_loop and default to existing RHEL6 behaviour (Prarit Bhargava) [1246064 970263]


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-7
changelog:
  - Addresses segfauls in Marshal.load.
    * ruby-1.8.7-p358-marshal-load-segv-fix.patch
  - Resolves: rhbz#789120


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-8
changelog:
  - Addresses entity expansion DoS vulnerability in REXML.
    * ruby-2.0.0-entity-expansion-DoS-vulnerability-in-REXML.patch
  - Resolves: rhbz#915380


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-9
changelog:
  - Fix regression introduced by fix for entity expansion DOS vulnerability
    in REXML (https://bugs.ruby-lang.org/issues/7961)
    * ruby-2.0.0-add-missing-rexml-require.patch
  - Related: rhbz#915380


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-10
changelog:
  - $SAFE escaping vulnerability about Exception#to_s / NameError#to_s
    * ruby-1.8.7-p371-CVE-2012-4481.patch
    - Related: rhbz#915380


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-11
changelog:
  - hostname check bypassing vulnerability in SSL client.
    * ruby-1.8.7-p374-CVE-2013-4073-fix-hostname-verification.patch
    - Resolves: rhbz#979301


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-12
changelog:
  - Fix regression introduced by CVE-2013-4073
    https://bugs.ruby-lang.org/issues/8575
    * ruby-2.0.0-p255-Fix-SSL-client-connection-crash-for-SAN-marked-critical.patch
    - Related: rhbz#979301


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.352-13
changelog:
  - Workaround build issues against OpenSSL with enabled ECC curves.
  - Make DRb compatible with OpenSSL 1.0.1.
    * ruby-1.9.3-p222-generate-1024-bits-RSA-key-instead-of-512-bits.patch
  - Fix CVE-2013-4164 Heap Overflow in Floating Point Parsing
    * ruby-1.9.3-p484-CVE-2013-4164-ignore-too-long-fraction-part-which-does-not-affect-the-result.patch
    - Resolves: rhbz#1033502


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.374-1
changelog:
  - Update to Ruby 1.8.7-p374.
    * Remove Patch41: ruby-ppc64-segv-fix.patch; subsumed
    * Remove Patch45: ruby-1.8.7-CVE-2011-0188.patch; subsumed
    * Remove Patch46: ruby-1.8.7-FIPS.patch; subsumed
    * Remove Patch47: ruby-1.8.7-p352-mkconfig.rb-fix-for-continued-lines.patch; subsumed
    * Remove Patch48: ruby-1.8.7-p352-CVE-2011-4815.patch; subsumed
    * Remove Patch49: ruby-1.8.7-p358-marshal-load-segv-fix.patch; subsumed
    * Remove Patch50: ruby-2.0.0-entity-expansion-DoS-vulnerability-in-REXML.patch; subsumed
    * Remove Patch51: ruby-2.0.0-add-missing-rexml-require.patch; subsumed
    * Remove Patch52: ruby-1.8.7-p371-CVE-2012-4481.patch; subsumed
    * Remove Patch53: ruby-1.8.7-p374-CVE-2013-4073-fix-hostname-verification.patch; subsumed
    Resolves: rhbz#830098
  - Enable ECC support, provided by OpenSSL, in Ruby
    * ruby-1.9.3-p482-Fix-build-against-OpenSSL-with-enabled-ECC-curves.patch
    Resolves: rhbz#1033864
  - Exclude test that fails when issuing a certificate with RSA signature and
    DSS1 digest for earlier OpenSSL versions when used in conjunction with
    OpenSSL 1.0.1.
    * ruby-1.9.3-p172-Exclude-failing-tests-written-for-earlier-OpenSSL.patch
    Resolves: rhbz#1034351
  - Rename Tracer.fire to SystemTap.fire to avoid conflict with Ruby's tracer.
    Resolves: rhbz#784766


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.374-2
changelog:
  - Replace hardcoded MD5 by sha256 to prevent SSL server failure in FIPS mode.
    * ruby-1.8.7-p374-Replace-md5-by-sha256-to-fix-SSL-server-FIPS-compatibility.patch
  - Resolves: rhbz#802946


author: Vít Ondruch <vondruch@redhat.com> - 1.8.7.374-3
changelog:
  - Fix REXML billion laughs attack via parameter entity expansion
    (CVE-2014-8080).
    Resolves: rhbz#1163993
  - REXML incomplete fix for CVE-2014-8080 (CVE-2014-8090).
    Resolves: rhbz#1163993


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.141-1
changelog:
  - Do not check for suspended devices if scanning for lvmetad update.
  - Fix part. table filter with external_device_info_source="udev" and blkid<2.20.
  - Add metadata/check_pv_device_sizes switch to lvm.conf for device size checks.
  - Warn if device size is less than corresponding PV size in metadata.
  - Cache device sizes internally.
  - Restore support for command breaking in process_each_lv_in_vg() (2.02.118).
  - Use correct mempool when process_each_lv_in_vg() (2.02.118).
  - Fix lvm.8 man to show again prohibited suffixes.
  - Fix configure to set proper use_blkid_wiping if autodetected as disabled.
  - Initialise udev in clvmd for use in device scanning. (2.02.116)
  - Add seg_le_ranges report field for common format when displaying seg devices.
  - Honour report/list_item_separator for seg_metadata_le_ranges report field.
  - Don't mark hidden devs in -o devices,metadata_devices,seg_pe_ranges.(2.02.140)
  - Change LV sizes in seg_pe_ranges report field to match underlying devices.
  - Add kernel_cache_settings report field for cache LV settings used in kernel.
  - Fix man page for dmsetup udevcreatecookie.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-1
changelog:
  - Use uninitilized pool header detection in all cases.
  - Fix read error detection when checking for uninitialized thin-pool header.
  - Fix error path for internal error in lvmetad vg lookup code.
  - Fix error path when sending thin-pool message fails in update_pool_lv().
  - Support reporting CheckNeeded and Fail state for thin-pool and thin LV.
  - For failing thin-pool and thin volume correctly report percentage as INVALID.
  - Report -1, not 'unkown' for lv_{snapshot_invalid,merge_failed} with --binary.
  - If PV belongs to some VG and metadata missing, skip it if system ID is used.
  - Automatically change PV header extension to latest version if writing PV/VG.
  - Identify used PVs in pv_attr field by new 'u' character.
  - Add pv_in_use reporting field to report if PV is used or not.
  - Add pv_ext_vsn reporting field to report PV header extension version.
  - Add protective flag marking PVs as used even if no metadata available.
  - Fix memory pool corruption in pvmove (2.02.141).
  - Support control of spare metadata creation when repairing thin-pool.
  - Fix config type of 'log/verbose' from bool to int (2.02.99).
  - Fix inverted data LV thinp watermark calc for dmeventd response (2.02.133).
  - Use use_blkid_wiping=0 if not defined in lvm.conf and support not compiled in.
  - Clear cached bootloader areas when PV format changed.
  - Fix string boundary check in _get_canonical_field_name().
  - Always initialized hist struct in _stats_parse_histogram().
  - Improve status parsing for thin-pool and thin devices.
  - Use fully aligned allocations for dm_pool_strdup/strndup() (1.02.64).
  - Fix thin-pool table parameter feature order to match kernel output.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-2
changelog:
  - Fix resize of stacked raid thin data volume (2.02.141).
  - Allow for raid leg replacement if not both data and metadata image are on pvs.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-3
changelog:
  - Detect and warn about mismatch between devices used and assumed for an LV.
  - If available, use /proc/self/mountinfo to detect mounted volume in fsadm.


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-4
changelog:
  - Remove spurious error about no value in /sys/dev/block/major:minor/dm/uuid.
  - Fix device mismatch detection for LV if persistent .cache file is used.
  - Fix holder device not being found in /dev while sysfs has it during dev scan.
  - Document that lvmlockd and lvmpolld features are available only if compiled in
    (RHEL6 lvm2 doesn't have lvmlockd and lvmpolld compiled in).


author: Peter Rajnoha <prajnoha@redhat.com> - 2.02.143-7
changelog:
  - Workaround for raid leg allocation failure after not-in-sync raid leg failure.
  - Fix flushing of outstanding IO for mirror target (2.02.133).


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-276
changelog:
  - Allow gluster to manage own log files.
  - S30samba-start gluster hooks wants to search audit logs. Dontaudit it.
  - Label gluster python hooks also as bin_t.
  - Allow samba_t net_admin capability to make CIFS mount working.
  Resolves:#1229605
  - Allow ssh_keygen_t to manage keys located in /var/lib/gluster.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-278
changelog:
  - Allow logrotate get attributes of all unallocated tty device nodes.
  - Add logging_syslogd_run_nagios_plugins boolean for rsyslog to allow transition to nagios unconfined plugins.
  - Allow glusterd to connect to init.
  Resolves:#1230371
  - Allow gluster do dbus chat with domain running as initrc_t.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.1
changelog:
  - Backport gluster fixes from RHEL7
   - execute showmount in own domain
  Resolves:#1248520
   - execute nsfd in own domain
   - allow gluster to connect to all ports
   - Add support for /usr/sbin/ctdbd_wrapper.
   - nrpe needs kill capability to make gluster moniterd nodes working.


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.2
changelog:
  - Allow nmbd to create pids files/dirs under /var/run/samba with correct labeling.
  Resolves:#1248520


author: Miroslav Grepl <mgrepl@redhat.com> 3.7.19-279.el6_7.6
changelog:
  - Allow qpidd to be working with MRG. It requires to manage symlinks in /var/lib/qpidd.
  Resolves:#1257318
  Resolves:#1257319


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-5
changelog:
  - Fix EAP client authentication with TLS 1.2
    Resolves: Bug#1248484 FreeRADIUS 2.2.6 miscalculates MPPE keys with TLS 1.2


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-6
changelog:
  - Fix EAP-TTLS/CHAP/MSCHAP/MSCHAPv2 authentication with WPA supplicant v2.4
    Related: Bug#1248484 FreeRADIUS 2.2.6 miscalculates MPPE keys with TLS 1.2


author: Nikolai Kondrashov <Nikolai.Kondrashov@redhat.com> - 2.2.6-7
changelog:
  - Resolves: Bug#1469115 CVE-2017-10979 freeradius: Out-of-bounds write in
                          rad_coalesce()
  - Resolves: Bug#1469118 CVE-2017-10978 freeradius: Out-of-bounds read/write
                          due to improper output buffer size check in make_secret()
  - Resolves: Bug#1469120 CVE-2017-10980 freeradius: Memory leak in decode_tlv() 
  - Resolves: Bug#1469122 CVE-2017-10981 freeradius: Memory leak in
                          fr_dhcp_decode()
  - Resolves: Bug#1469124 CVE-2017-10982 freeradius: Out-of-bounds read in
                          fr_dhcp_decode_options()
  - Resolves: Bug#1469126 CVE-2017-10983 freeradius: Out-of-bounds read in
                          fr_dhcp_decode() when decoding option 63


author: Patsy Franklin <pfrankli@redhat.com> - 2016c-1
changelog:
  - Rebase to 2016c
    - Azerbaijan no longer observes DST.
    - Chile reverts from permanent to seasonal DST.


author: Patsy Franklin <pfrankli@redhat.com> - 2016d-1
changelog:
  - Rebase to 2016d
    - America/Caracas switches from -0430 to -04 on 2016-05-01 at 02:30.
    - Asia/Magadan switches from +10 to +11 on 2016-04-24 at 02:00.
    - New zone Asia/Tomsk, split off from Asia/Novosibirsk.  It covers
      Tomsk Oblast, Russia, which switches from +06 to +07 on 2016-05-29
      at 02:00.


author: Kurt Stutsman <kstutsma@redhat.com> [2.6.32-566.el6]
changelog:
  - [netdrv] iwlwifi: use custom workqueue (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: remove not used *bt-coex* files (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: avoid use-after-free on iwl_mvm_d0i3_enable_tx() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: clean net-detect info if device was reset during suspend (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: take the UCODE_DOWN reference when resuming (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: BT Coex - duplicate the command if sent ASYNC (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: nvm: force mac from otp in case nvm mac is reserved (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Free fw_status after use to avoid memory leak (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix MLME trigger (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: don't disable the busmaster DMA clock for family 8000 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: 7000: modify the firmware name for 3165 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: forbid MIMO on devices that don't support it (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: force quota update update after FW restart (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix typo in CONFIG option (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't power off the device between INIT and OPER firmwares (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: prevent using unmapped memory in fw monitor (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Avoid signal based decisions if ave beacon RSSI is 0 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix scan iteration complete notification handling (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't stop the FW monitor too early (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix Tx Power firmware API (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: capture connection loss as part of MLME trigger (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for time events (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: do string formatting in debug triggers (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: fix spelling errors (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't return uninitialized value in get_survey() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove unused arguments (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Fix wrongfully flushing frames in the roc/off channel queue (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add debugfs entry with the number of net-detect scans (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: refactor rs_update_rate_tbl (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: check the size of the trigger struct from the firmware file (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for firmware dump upon MLME failures (Stanislaw Gruszka) [1134606]
  - [net] mac80211: Fix mac80211.h docbook comments (Stanislaw Gruszka) [1134606]
  - [net] mac80211: notify the driver about deauth (Stanislaw Gruszka) [1134606]
  - [net] mac80211: notify the driver about association status (Stanislaw Gruszka) [1134606]
  - [net] mac80211: notify the driver about authentication status (Stanislaw Gruszka) [1134606]
  - [netdrv] mac80211: convert rssi_callback() to event_callback() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: fix comment indentation (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Clean up UMAC scan UIDs in the reset and drv_stop flows (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: 8000: change PNVM in case it doesn't match to the HW step (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix debug print in the RSA ownership workaround (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: allow to configure the timeout for the Tx queues (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: drop support for early versions of 8000 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: use debugfs_create_bool() for enable_scan_iteration_notif (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: initialize trans_pcie->ref_count on configure() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: inform mac80211 about umac scans that was aborted by restart (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove d0i3 ref correctly during AP start (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: Fix memory leak in iwl_req_fw_callback() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove WARN_ON for invalid BA notification (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: take IWL_MVM_REF_UCODE_DOWN before restarting hw (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't wait for firmware verification (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: add new 3165 series PCI IDs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove time-event start/end failure warning (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add iccm data to 8000 b-step data dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: add rx packet sequence number to dbg print (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: properly flush the queues for buffering transport (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: assign new TLV bit for multi-source LAR (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: continue (with error) CSA on GO time event failure (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: simplify iwl_mvm_get_wakeup_status() return (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't double unlock the mutex in __iwl_mvm_resume() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: clarify time event end handling (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Always enable the smart FIFO (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: update copyright to include 2015 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: add more new 8260 series PCI IDs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: BT Coex - update the new API (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix force NMI for 8000 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: freeze the non-shared queues when a station goes to sleep (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: allow the op_mode to freeze the stuck queue timer (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: update Tx statistics when using fixed rate (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't init MCC during CT-kill (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove warning on station exhaustion (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: trans: Take ownership on secure machine before FW load (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: add new 8260 series PCI IDs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: improve ss_params debug print (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: don't allow the FW to return invalid ch indices (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: reflect TDLS pm state in mvmvif->pm_enabled (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix identation (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove unneeded include iwl-fw-error-dump.h (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: use correct NVM offset for LAR enable for new NVMs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: fix smatch warning: warn: inconsistent indenting (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: include more registers in the prph dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: speed up the Tx DMA stop flow (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support family 8000 B2/C steps (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: always update the quota after association (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: BT Coex - disable RRC by default (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove IWL_UCODE_TLV_API_SF_NO_DUMMY_NOTIF (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove IWL_UCODE_TLV_API_DISABLE_STA_TX (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: bump API to 13 for devices that use iwlmvm (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: set LAR MCC on D3/D0 transitions (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support LAR updates from BIOS (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: take the MAC address from HW registers (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: allow disabling LAR via module param (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support new PHY_SKU nvm section for family 8000 B0 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: disable 11ac if 11n is disabled (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: iwlmvm: LAR: disable LAR support due to NVM vs TLV conflict (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: change last 5ghz channel to 165 & add support for 8000 family (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: use IWL_DEFAULT_MAX_TX_POWER for max_eirp (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: nvm: init correct nvm channel list for 8000 devices (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: LAR: Add chub mcc change notify command (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: don't declare support for 5ghz if not supported (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: ignore IBSS flag as regulatory NO-IR indication (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: consider LAR support during NVM parse (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: create regdomain from mcc_update_cmd response (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: init country code on init/recovery (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add MCC update FW API (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: disconnect if CSA time event fails scheduling (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: dvm: drop VO packets when mac80211 tells us to (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix compilation with IWLWIFI_DEBUGFS not set (Stanislaw Gruszka) [1134606]
  - [netdrv] wireless: Use eth_<foo>_addr instead of memset (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't override passive dwell in case of fragmented scan (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for firmware dump upon low RSSI (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for firmware dump upon statistics (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: restart firmware recording when no configuration is set (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for firmware dump upon command response (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for firmware dump upon channel switch (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add trigger for firmware dump upon missed beacons (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add the cause of the firmware dump in the dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add framework for triggers for fw dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: use only 40 ms for fragmented scan (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: allow to force the Rx chains from debugfs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: add new TLV capability flag for BT PLCR (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't iterate interfaces to disconnect in net-detect (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: new Alive / error table API (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support beacon statistics for BSS client (Stanislaw Gruszka) [1134606]
  - [net] cfg80211: add nl80211 beacon-only statistics (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't write to DBGC_OUT_CTRL when stopping the recording (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove deprecated scan API code (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: deprecate -9.ucode for 3160 / 7260 / 7265 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support radio statistics as global survey (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add statistics API version 10 (Stanislaw Gruszka) [1134606]
  - [net] cfg80211: add scan time to survey data (Stanislaw Gruszka) [1134606]
  - [netdrv] cfg80211: remove "channel" from survey names (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: apply destination before releasing reset (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove unused function in BT coex (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix BT coex shared antenna activity check (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: print single stream params via debugfs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: avoid ss_force from being reset after tx idle (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: increase the number of PAPD channel groups to 9 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: consider TDLS queues as used during drain (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: disable MIMO for low latency P2P (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: adapt rate matching to new STBC/BFER (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: disable beamformer unless FW supports it (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't try to stop scans that are not running anymore (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: better match tx response rate to the LQ table (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: call ieee80211_scan_completed() even if scan abort fails (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: reduce quota threshold (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't send a command the firmware doesn't know (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Fix building channels in scan_config_cmd (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Enable EBS also in single scan on umac interface (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Fix a few EBS error handling bugs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: allow to define the stuck queue timer per queue (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: enable watchdog on Tx queues for mvm (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: ignore stale TDLS ch-switch responses (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: improve TDLS ch-sw state machine (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: prepare the enablement of 31 TFD queues (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: enable forcing single stream Tx decision (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: remove space padding after sysassert description (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add beamformer support (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: don't dump useless data when a TFD queue hangs (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't reprobe if we fail during reconfig and fw_restart is false (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: check IWL_UCODE_TLV_API_SCD_CFG in API and not in capa (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: fix rx chains configuration in phy ctxt cmd (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: support secured boot flow for family 8000 B step (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: use a new API for enabling STBC (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: refactor ht/vht init (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: remove stats argument from functions (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: really disable TDLS queues (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: BT Coex - set all the co-running values to 0 (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Do not consider invalid HW queues in queue mask (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support family 8000 C step (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: init ref_lock (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: document switch case fall-through in iwl_mvm_send_sta_key (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: use STBC regardless of power save mode (Stanislaw Gruszka) [1134606]
  - [netdrv] Revert "iwlwifi: mvm: drop non VO frames when flushing" (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add support for new LTR command (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: BT Coex - fine tune the MPLUT register (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: move U-APSD decision to authentication (Stanislaw Gruszka) [1134606]
  - [netdrv] mac80211: move U-APSD enablement to vif flags (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: ignore temperature updates in the RX statistics notification (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: cleanup unuseful and overflowing traces (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: generate statistics debugfs code (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: move statistics API to new header file (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: sync statistics firmware API (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: correctly set the NMI register (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add rxf and txf to dump data (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add support for dumping a secondary SRAM (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add debugfs file for misbehaving U-APSD AP (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: let the firmware configure the scheduler (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: remove unused TLV capability flags (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add print of he nvm version (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: set max_out_time equal to frag_passive_dwell in fragmented scan (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: allow to disable MIMO for P2P only (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: allow to collect debug data from non-sleepable context (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: make sure state isn't in d0i3 when stopping fw monitor (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Add debugfs entry to enable scan offload notification (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: add new config and PCI IDs for 4165 series (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: make sure state isn't in d0i3 when collecting fw dbg (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: repeat initial legacy rates in LQ table (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: don't indicate no BA if STA was in powersave (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: organize and cleanup consts (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Alter passive scan fragmentation parameters in case of multi-MAC (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: call to pcie_apply_destination also on family 8000 B step (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: ask the fw to wakeup (from d0i3) on sysassert (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: tlv: add support for IWL_UCODE_TLV_SDIO_ADMA_ADDR TLV (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: use iwl_mvm_sta_from_mac80211() consistently (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: use iwl_mvm_vif_from_mac80211() consistently (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: remove useless extern definition of iwl4265_2ac_sdio_cfg (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: clean refs before stop_device() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: dvm: main: Use setup_timer (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: dvm: tt: Use setup_timer (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support 2 different channels (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: wait for d0i3 exit on hw restart (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: consider d0i3_disable in iwl_mvm_is_d0i3_supported() (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: support multiple d0i3 modes (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support IWL_D0I3_MODE_ON_SUSPEND d0i3 mode (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: allow both d0i3 and d3 wowlan configuration modes (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: add basic reference accounting (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: convert the SRAM dump to the generic memory dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: change SMEM dump to general purpose memory dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add smem content to dump data (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support additional nvm_file in family 8000 B step (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: rs: fix max rate allowed if no rate is allowed (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: clear tt values when entering CT-kill (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: Set the HW step in the core dump (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: allow RSSI compensation (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add debugfs to trigger fw debug logs collection (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: pcie: let the Manageability Engine know when we leave (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: support LnP 1x1 antenna configuration (Stanislaw Gruszka) [1134606]
  - [netdrv] Revert "iwlwifi: use correct fw file in 8000 b-step" (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: mvm: add fw runtime stack to dump data (Stanislaw Gruszka) [1134606]
  - [netdrv] iwlwifi: remove MODULE_VERSION (Stanislaw Gruszka) [1134606]


