# changelog

author: Don Zickus <dzickus@redhat.com> [2.6.18-48.el5]
changelog:
  - [net] s2io: check for error_state in ISR (Scott Moser ) [276871]
  - [fs] ext3: ensure do_split leaves enough free space in both blocks (Eric Sandeen ) [286501]
  - [kabi] whitelist GFS2 export symbols to allow driver updates (Jon Masters) [282901]
  - [gfs2] allow process to handle multiple flocks on a file (Abhijith Das ) [272021]
  - [gfs2] operations hang after mount--RESEND (Bob Peterson ) [276631]
  - [scsi] qlogic: fix nvram/vpd update memory corruptions (Marcus Barrow ) [260701]
  - [fs] Reset current->pdeath_signal on SUID binary execution (Peter Zijlstra) [251119] {CVE-2007-3848}
  - [gfs2] mount hung after recovery (Benjamin Marzinski ) [253089]
  - [GFS2] Move inode delete logic out of blocking_cb (Wendy Cheng ) [286821]
  - [dlm] Make dlm_sendd cond_resched more (Patrick Caulfield ) [250464]
  - [x86_64] fix 32-bit ptrace access to debug registers (Roland McGrath ) [247427]
  - [autofs4] fix deadlock during directory create (Ian Kent ) [253231]
  - [nfs] enable 'nosharecache' mounts fixes (Steve Dickson ) [243913]
  - [usb] usblcd: Locally triggerable memory consumption (Anton Arapov ) [276011] {CVE-2007-3513}
  - [misc] Bounds check ordering issue in random driver (Anton Arapov ) [275971] {CVE-2007-3105}


author: Don Zickus <dzickus@redhat.com> [2.6.18-49.el5]
changelog:
  - [sata] libata probing fixes and other cleanups (Jeff Garzik ) [260281]
  - [net] cxgb3: backport fixups and sysfs corrections (Andy Gospodarek ) [252243]


author: Don Zickus <dzickus@redhat.com> [2.6.18-50.el5]
changelog:
  - Revert: [net] bonding: convert timers to workqueues (Andy Gospodarek ) [210577]
  - [pata] enable IDE (siimage) DRAC4 (John Feeney ) [212391]
  - [GFS2] gfs2_writepage(s) workaround (Wendy Cheng ) [252392]
  - [scsi] aacraid: Missing ioctl() permission checks (Vitaly Mayatskikh ) [298381] {CVE-2007-4308}
  - [GFS2] Solve journaling/{release|invalidate}page issues (Steven Whitehouse ) [253008]
  - [x86_64] syscall vulnerability (Anton Arapov ) [297881] {CVE-2007-4573}
  - [GFS2] Fix i_cache stale entry (Wendy Cheng ) [253756]
  - [GFS2] deadlock running revolver load with lock_nolock (Benjamin Marzinski ) [288581]
  - [net] s2io: check for error_state in ISR (more) (Scott Moser ) [276871]


author: Don Zickus <dzickus@redhat.com> [2.6.18-51.el5]
changelog:
  - [GFS2] dlm: schedule during recovery loops (David Teigland ) [250464]
  - Revert: [pata] IDE (siimage) panics when DRAC4 reset (John Feeney ) [212391]


author: Don Zickus <dzickus@redhat.com> [2.6.18-52.el5]
changelog:
  - [net] iwlwifi: avoid BUG_ON in tx cmd queue processing (John W. Linville ) [306831]
  - [GFS2] Get super block a different way (Steven Whitehouse ) [306621]


author: Don Zickus <dzickus@redhat.com> [2.6.18-53.el5]
changelog:
  - [GFS2] handle multiple demote requests (Wendy Cheng ) [295641]
  - [scsi] megaraid_sas: kabi fix for /proc entries (Chip Coldwell ) [323231]
  - [sound] allow creation of null parent devices (Brian Maly ) [323771]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.2.el5]
changelog:
  - [net] bnx2: Add PHY workaround for 5709 A1 (Andy Gospodarek ) [345131]
  - [cifs] fix memory corruption due to bad error handling (Jeff Layton ) [345171]
  - [audit] improper handling of audit_log_start return values (Eric Paris ) [345151]
  - [fs] jbd: wait for t_sync_datalist buffer to complete (Eric Sandeen ) [345141]
  - [mm] ia64: flush i-cache before set_pte (Luming Yu ) [345161]
  - [x86] Fixes for the tick divider patch (Chris Lalancette ) [305011]
  - [alsa] Convert snd-page-alloc proc file to use seq_file (Jerome Marchand ) [297761] {CVE-2007-4571}


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.3.el5]
changelog:
  - [fs] missing dput in do_lookup error leaks dentries (Eric Sandeen ) [363481] {CVE-2007-5494}
  - [ppc] System cpus stuck in H_JOIN after migrating (Scott Moser ) [381151]
  - [scsi] ibmvSCSI: Unable to continue migrating lpar after errors (Scott Moser ) [381141]
  - [scsi] ibmvSCSI: client can't handle deactive/active device from server (Scott Moser ) [381121]
  - [audit] still allocate contexts when audit is disabled (Alexander Viro ) [381001]
  - [autofs4] fix race between mount and expire (Ian Kent ) [381071]
  - [net] ieee80211: off-by-two integer underflow (Anton Arapov ) [346391] {CVE-2007-4997}
  - [fs] sysfs: fix race condition around sd->s_dentry (Eric Sandeen ) [245777] {CVE-2007-3104}
  - [fs] sysfs: fix condition check in sysfs_drop_dentry() (Eric Sandeen ) [245777] {CVE-2007-3104}
  - [fs] sysfs: store inode nrs in s_ino (Eric Sandeen ) [245777] {CVE-2007-3104}
  - [nfs] v4: umounts oops in shrink_dcache_for_umount (Steve Dickson ) [381111]
  - [net] forcedeth: MSI interrupt bugfix (Andy Gospodarek ) [381131]
  - [ppc] kexec/kdump kernel hung on Power5+ and Power6 (Scott Moser ) [381101]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.4.el5]
changelog:
  - Revert: [fs] sysfs: fix race condition around sd->s_dentry (Eric Sandeen ) [245777] {CVE-2007-3104}
  - Revert: [fs] sysfs: fix condition check in sysfs_drop_dentry() (Eric Sandeen ) [245777] {CVE-2007-3104}
  - Revert: [fs] sysfs: store inode nrs in s_ino (Eric Sandeen ) [245777] {CVE-2007-3104}
  - [net] tg3: Fix performance regression on 5705 (Andy Gospodarek ) [381021]


author: Don Zickus <dzickus@redhat.com> [2.6.18-121.el5]
changelog:
  - [net] tun: fix printk warning (Mark McLoughlin ) [468536]
  - [xen] FV: fix lockdep warnings when running debug kernel (Don Dutile ) [459876]
  - [xen] fix crash on IRQ exhaustion (Bill Burns ) [442736]
  - [net] ipv4: fix byte value boundary check (Jiri Pirko ) [468148]
  - [ia64] fix ptrace hangs when following threads (Denys Vlasenko ) [461456]
  - [net] tcp: let skbs grow over a page on fast peers (Mark McLoughlin ) [467845]
  - [md] random memory corruption in snapshots (Mikulas Patocka ) [465825]
  - [misc] ptrace: fix exec report (Jerome Marchand ) [455060]
  - [gfs2] set gfp for data mappings to GFP_NOFS (Steven Whitehouse ) [467689]
  - [nfs] remove recoverable BUG_ON (Steve Dickson ) [458774]
  - [openib] ehca: attempt to free srq when none exists (AMEET M. PARANJAPE ) [463487]
  - [fs] don't allow splice to files opened with O_APPEND (Eugene Teo ) [466710] {CVE-2008-4554}
  - [fs] ext4: add missing aops (Eric Sandeen ) [466246]
  - [ppc64] add missing symbols to vmcoreinfo (Neil Horman ) [465396]
  - [net] sctp: INIT-ACK indicates no AUTH peer support oops (Eugene Teo ) [466082] {CVE-2008-4576}
  - [ppc64] fix race for a free SPU (AMEET M. PARANJAPE ) [465581]
  - [ppc64] SPUs hang when run with affinity-2 (AMEET M. PARANJAPE ) [464686]
  - [ppc64] SPUs hang when run with affinity-1 (AMEET M. PARANJAPE ) [464686]
  - [openib] ehca: add flush CQE generation (AMEET M. PARANJAPE ) [462619]
  - [x86] PAE: limit RAM to 64GB/PAE36 (Larry Woodman ) [465373]
  - [nfs] portmap client race (Steve Dickson ) [462332]
  - [input] atkbd: delay executing of LED switching request (Jiri Pirko ) [461233]
  - [x86] powernow_k8: depend on newer version of cpuspeed (Brian Maly ) [468764]
  - [fs] ext4: fix warning on x86_64 build (Eric Sandeen ) [463277]
  - [crypto] fix ipsec crash with MAC longer than 16 bytes (Neil Horman ) [459812]
  - [fs] ecryptfs: depend on newer version of ecryptfs-utils (Eric Sandeen ) [468772]
  - [ppc64] support O_NONBLOCK in /proc/ppc64/rtas/error_log (Vitaly Mayatskikh ) [376831]
  - [xen] ia64: make viosapic SMP-safe by adding lock/unlock (Tetsu Yamamoto ) [466552]
  - [xen] ia64: VT-i2 performance restoration (Bill Burns ) [467487]


author: Don Zickus <dzickus@redhat.com> [2.6.18-122.el5]
changelog:
  - [acpi] check common dmi tables on systems with acpi (Andy Gospodarek ) [469444]
  - [scsi] qla3xxx, qla4xxx: update/use new version format (Marcus Barrow ) [469414]
  - [md] dm-stripe.c: RAID0 event handling (Heinz Mauelshagen ) [437173]
  - [md] dm-raid45.c: add target to makefile (Heinz Mauelshagen ) [437180]
  - [md] dm-raid45.c: revert to RHEL5 dm-io kabi (Heinz Mauelshagen ) [437180]
  - [wireless] iwlwifi: avoid sleep in softirq context (John W. Linville ) [467831]
  - [net] bonding: allow downed interface before mod remove (Andy Gospodarek ) [467244]
  - [acpi] fix boot hang on old systems without _CST methods (Matthew Garrett ) [467927]
  - [scsi] qla2xxx: fix entries in class_device_attributes (Marcus Barrow ) [468873]
  - [ppc64] clock_gettime is not incrementing nanoseconds (AMEET M. PARANJAPE ) [469073]
  - [scsi] add fnic driver (mchristi@redhat.com ) [462385]
  - [scsi] add libfc and software fcoe driver (mchristi@redhat.com ) [436051]
  - [openib] ppc64: fix using SDP on 64K page systems (AMEET M. PARANJAPE ) [468872]
  - [fs] ext4: delay capable checks to avoid avc denials (Eric Sandeen ) [467216]
  - [fs] ext3: fix accessing freed memory in ext3_abort (Eric Sandeen ) [468547]
  - [fs] autofs4: correct offset mount expire check (Ian Kent ) [468187]
  - [fs] autofs4: cleanup autofs mount type usage (Ian Kent ) [468187]
  - [openib] ehca: queue and completion pair setup problem (AMEET M. PARANJAPE ) [468237]
  - [xen] PV: dom0 hang when device re-attached to in guest (Don Dutile ) [467773]
  - [scsi] qla2xxx: correct Atmel flash-part handling (Marcus Barrow ) [468573]
  - [scsi] qla2xxx: 84xx show FW VER and netlink code fixes (Marcus Barrow ) [464681]
  - [scsi] qla2xxx: restore disable by default of MSI, MSI-X (Marcus Barrow ) [468555]
  - [scsi] lpfc: Emulex RHEL-5.3 bugfixes (Tom Coughlan ) [461795]
  - [s390] qdio: speedup multicast on full HiperSocket queue (Hans-Joachim Picht ) [463162]
  - [ppc64] kexec/kdump: disable ptcal on QS21 (AMEET M. PARANJAPE ) [462744]
  - [ppc64] ptcal has to be disabled to use kexec on QS21 (AMEET M. PARANJAPE ) [462744]
  - [net] ixgbe: bring up device without crashing fix (AMEET M. PARANJAPE ) [467777]
  - [fs] ecryptfs: storing crypto info in xattr corrupts mem (Eric Sandeen ) [468192]
  - [misc] rtc: disable SIGIO notification on close (Vitaly Mayatskikh ) [465747]
  - [net] allow rcv on inactive slaves if listener exists (Andy Gospodarek ) [448144]
  - [net] e1000e: update driver to support recovery (AMEET M. PARANJAPE ) [445299]
  - [xen] virtio_net: some relatively minor fixes (Mark McLoughlin ) [468034]
  - [kabi] add dlm_posix_set_fsid (Jon Masters ) [468538]
  - [wireless] iwlwifi: fix busted tkip encryption _again_ (John W. Linville ) [467831]
  - [x86] make halt -f command work correctly (Ivan Vecera ) [413921]
  - [ppc64] EEH PCI-E: recovery fails E1000; support MSI (AMEET M. PARANJAPE ) [445299]
  - [x86_64] create a fallback for IBM Calgary (Pete Zaitcev ) [453680]
  - [drm] i915 driver arbitrary ioremap (Eugene Teo ) [464509] {CVE-2008-3831}
  - [xen] x86: allow the kernel to boot on pre-64 bit hw (Chris Lalancette ) [468083]


author: Don Zickus <dzickus@redhat.com> [2.6.18-123.el5]
changelog:
  - [s390] cio: reduce cpu utilization during device scan (Hans-Joachim Picht ) [459793]
  - [s390] cio: fix double unregistering of subchannels (Hans-Joachim Picht ) [456087]
  - [video] uvc: buf overflow in format descriptor parsing (Jay Fenlason ) [470427] {CVE-2008-3496}
  - [usb] add HID_QUIRK_RESET_LEDS to some keyboards (mchehab@infradead.org ) [434538]
  - [acpi] always use 32 bit value for GPE0 on HP xw boxes (Prarit Bhargava ) [456638]
  - [wireless] iwlagn/mac80211 IBSS fixes (John W. Linville ) [438388]
  - [ppc64] cell: fix page fault error checking in spufs (AMEET M. PARANJAPE ) [470301]
  - [input] atkbd: cancel delayed work before freeing struct (Jiri Pirko ) [461233]
  - [openib] ehca: deadlock race when creating small queues (Jesse Larrew ) [470137]
  - [openib] mthca: fix dma mapping leak (AMEET M. PARANJAPE ) [469902]
  - [openib] ib_core: use weak ordering for user memory (AMEET M. PARANJAPE ) [469902]
  - [ppc64] dma-mapping: provide attributes on cell platform (AMEET M. PARANJAPE ) [469902]
  - [net] bnx2: prevent ethtool -r EEH event (AMEET M. PARANJAPE ) [469962]
  - [net] bonding: update docs for arp_ip_target behavior (Andy Gospodarek ) [468870]
  - [xen] uninitialized watch structure can lead to crashes (Don Dutile ) [465849]
  - [openib] ehca: remove ref to QP if port activation fails (AMEET M. PARANJAPE ) [469941]
  - [usb] fix locking for input devices (James Paradis ) [468915]
  - [nfs] oops in direct I/O error handling (Steve Dickson ) [466164]
  - [md] crash in device mapper if the user removes snapshot (Mikulas Patocka ) [468473]
  - [openib] config update: enable some debugging (Doug Ledford ) [469410]
  - [sata] libata is broken with large disks (David Milburn ) [469715]
  - [md] dm-raid1: support extended status output (Jonathan Brassow ) [437177]
  - [s390] qdio: repair timeout handling for qdio_shutdown (Hans-Joachim Picht ) [463164]
  - [openib] race in ipoib_cm_post_receive_nonsrq (AMEET M. PARANJAPE ) [463485]
  - [xen] remove contiguous_bitmap (Chris Lalancette ) [463500]
  - [xen] ia64: backport check_pages_physically_contiguous (Chris Lalancette ) [463500]
  - [ppc64] cell: corrupt SPU coredump notes (AMEET M. PARANJAPE ) [431881]
  - [ppc64] spufs: missing context switch notification log-2 (AMEET M. PARANJAPE ) [462622]
  - [ppc64] spufs: missing context switch notification log-1 (AMEET M. PARANJAPE ) [462622]
  - [misc] spec: add generic Obsoletes for 3rd party drivers (Jon Masters ) [460047]
  - [x86] vDSO: use install_special_mapping (Peter Zijlstra ) [460276] {CVE-2008-3527}
  - [xen] limit node poking to available nodes (Joachim Deguara ) [449803]
  - [xen] live migration of PV guest fails (Don Dutile ) [469230]


author: Don Zickus <dzickus@redhat.com> [2.6.18-124.el5]
changelog:
  - [s390] qeth: EDDP for large TSO skb fragment list (Hans-Joachim Picht ) [468068]
  - [s390] missing bits for audit-fork (Alexander Viro ) [461831]
  - [net] ixgbe: add support for 82598AT (Andy Gospodarek ) [454910]
  - [libata] avoid overflow in ata_tf_read_block (David Milburn ) [471576]
  - [md] dm-mpath: NULL ptr access in path activation code (Milan Broz ) [471393]
  - [scsi] qla2xxx: no NPIV for loop connections (Marcus Barrow ) [471269]
  - [ppc64] spufs: clean up page fault error checking (AMEET M. PARANJAPE ) [470301]
  - [fs] cifs: corrupt data due to interleaved write calls (Jeff Layton ) [470267]
  - [misc] lots of interrupts with /proc/.../hz_timer=0 (Hans-Joachim Picht ) [470289]
  - [selinux] recognize addrlabel netlink messages (Thomas Graf ) [446063]
  - [acpi] thinkpad: fix autoloading (Matthew Garrett ) [466816]
  - [net] bnx2x: eeh, unload, probe, and endian fixes (Andy Gospodarek ) [468922]
  - [firewire] various bug and module unload hang fixes (Jay Fenlason ) [469710 469711]


author: Don Zickus <dzickus@redhat.com> [2.6.18-125.el5]
changelog:
  - [net] cxgb3: embed firmware in driver (Andy Gospodarek ) [469774]
  - [net] cxgb3: eeh, lro, and multiqueue fixes (Andy Gospodarek ) [441959]
  - [misc] support for Intel's Ibex Peak (peterm@redhat.com ) [472961]
  - [audit] race between inotify watch removal and unmount (Josef Bacik ) [472329] {CVE-2008-5182}
  - [net] mlx4: panic when inducing pci bus error (AMEET M. PARANJAPE ) [472769]
  - [s390] cio: DASD device driver times out (Hans-Joachim Picht ) [459803]
  - [misc] hugepages: ia64 stack overflow and corrupt memory (Larry Woodman ) [472802]
  - [net] niu: fix obscure 64-bit read issue (Andy Gospodarek ) [472849]
  - [x86] nmi_watchdog: call do_nmi_callback from traps-xen (Aristeu Rozanski ) [471111]
  - [GFS2] recovery stuck (Abhijith Das ) [465856]
  - [misc] fix check_dead_utrace vs do_wait() race (Oleg Nesterov ) [466774]
  - [scsi] cciss: add two new PCI IDs (Tom Coughlan ) [471679]
  - [x86] fix memory-less NUMA node booting (Prarit Bhargava ) [471424]
  - [pci] generic fix for EEH restore all registers (Jesse Larrew ) [470580]
  - [net] e1000e: remove fix for EEH restore all registers (Jesse Larrew ) [470580]
  - [agp] use contiguous memory to support xen (Rik van Riel ) [412691]
  - [edac] i5000_edac: fix misc/thermal error messages (Aristeu Rozanski ) [471933]
  - [alsa] fix PCM write blocking (Jaroslav Kysela ) [468202]
  - [xen] build xen-platform-pci as a module (Don Dutile ) [472504]
  - [scsi] qla2xx/qla84xx: failure to establish link (Marcus Barrow ) [472382]
  - [acpi] add systems to GPE register blacklist (Prarit Bhargava ) [471341]
  - [ia64] replace printk with mprintk in MCA/INIT context (Kei Tokunaga ) [471970]
  - [usb] add support for dell keyboard 431c:2003 (Mauro Carvalho Chehab ) [471469]
  - [net] e1000e: enable ECC correction on 82571 silicon (Andy Gospodarek ) [472095]
  - [dlm] fix up memory allocation flags (David Teigland ) [471871]
  - [xen] x86: fix highmem-xen.c BUG() (Chris Lalancette ) [452175]
  - [xen] guest crashes if RTL8139 NIC is only one specified (Don Dutile ) [471110]
  - [net] bnx2: fix oops on call to poll_controller (Neil Horman ) [470625]
  - [scsi] update fcoe drivers (mchristi@redhat.com ) [436051]
  - [net] bnx2: add support for 5716s (Andy Gospodarek ) [471903]
  - [openib] IPoIB: fix oops on fabric events (Doug Ledford ) [471890]
  - [libata] force sb600/700 ide mode into ahci on resume (David Milburn ) [466422]
  - [xen] increase maximum DMA buffer size (Rik van Riel ) [412691]
  - [xen] fix physical memory address overflow (Rik van Riel ) [412691]


author: Don Zickus <dzickus@redhat.com> [2.6.18-126.el5]
changelog:
  - [scsi] mpt fusion: disable msi by default (Tomas Henzl ) [474465]
  - [scsi] fcoe: update drivers (mchristi@redhat.com ) [474089]
  - [scsi] fix error handler to call scsi_decide_disposition (Tom Coughlan ) [474345]
  - [scsi] lpfc: fix cancel_retry_delay (Tom Coughlan ) [470610]
  - [x86] disable hpet on machine_crash_shutdown (Neil Horman ) [473038]
  - Revert [mm] keep pagefault from happening under pagelock (Don Zickus ) [473150]
  - [net] enic: update to version 1.0.0.648 (Andy Gospodarek ) [473871]
  - [scsi] qla4xxx: increase iscsi session check to 3-tuple (Marcus Barrow ) [474736]
  - [agp] update the names of some graphics drivers (John Villalovos ) [472438]
  - [net] atm: prevent local denial of service (Eugene Teo ) [473701] {CVE-2008-5079}
  - [scsi] remove scsi_dh_alua (mchristi@redhat.com ) [471920]
  - [scsi] qla2xx/qla84xx: occasional panic on loading (Marcus Barrow ) [472382]
  - [net] cxgb3: eeh and eeprom fixups (Andy Gospodarek ) [441959]
  - [net] cxgb3: fixup embedded firmware problems (Andy Gospodarek ) [469774]
  - [wireless] iwlwifi/mac80211: various small fixes (John W. Linville ) [468967]
  - [x86_64] fix AMD IOMMU boot issue (Joachim Deguara ) [473464]
  - [x86_64] limit num of mce sysfs files removed on suspend (Prarit Bhargava ) [467725]
  - [xen] console: make LUKS passphrase readable (Bill Burns ) [466240]
  - [x86_64] Calgary IOMMU sysdata fixes (Prarit Bhargava ) [474047]
  - [alsa] select 3stack-dig model for SC CELSIUS R670 (Jaroslav Kysela ) [470449]
  - [ata] libata: lba_28_ok sector off by one (David Milburn ) [464868]
  - [ppc64] fix system calls on Cell entered with XER.SO=1 (Jesse Larrew ) [474196]
  - [block] fix max_segment_size, seg_boundary mask setting (Milan Broz ) [471639]
  - [fs] jbd: alter EIO test to avoid spurious jbd aborts (Eric Sandeen ) [472276]
  - [acpi] acpi_cpufreq: fix panic when removing module (Prarit Bhargava ) [472844]
  - [openib] ehca: fix generating flush work completions (AMEET M. PARANJAPE ) [472812]
  - [ata] libata: sata_nv hard reset mcp55 (David Milburn ) [473152]
  - [misc] fix add return signal to ptrace_report_exec (AMEET M. PARANJAPE ) [471112]
  - [misc] utrace: prevent ptrace_induce_signal() crash (Oleg Nesterov ) [469754]
  - [misc] utrace: make ptrace_state refcountable (Oleg Nesterov ) [469754]
  - [net] virtio_net: mergeable receive buffers (Mark McLoughlin ) [473120]
  - [net] virtio_net: jumbo frame support (Mark McLoughlin ) [473114]
  - [net] tun: jumbo frame support (Mark McLoughlin ) [473110]
  - [net] fix unix sockets kernel panic (Neil Horman ) [470436] {CVE-2008-5029}
  - [xen] x86: emulate movzwl with negative segment offsets (Chris Lalancette ) [471801]


author: Don Zickus <dzickus@redhat.com> [2.6.18-127.el5]
changelog:
  - Revert: [i386]: check for dmi_data in powernow_k8 driver (Prarit Bhargava ) [476184]
  - [xen] re-enable using xenpv in boot path for FV guests (Don Dutile ) [473899]
  - [xen] pv_hvm: guest hang on FV save/restore (Don Dutile ) [475778]
  - [openib] fix ipoib oops in unicast_arp_send (Doug Ledford ) [476005]
  - [scsi] fnic: remove link down count processing (mchristi@redhat.com ) [474935]
  - Revert: [x86] disable hpet on machine_crash_shutdown (Neil Horman ) [475652]
  - [scsi] ibmvscsi: EH fails due to insufficient resources (AMEET M. PARANJAPE ) [475618]
  - [x86_64] proc: export GART region through /proc/iomem (Neil Horman ) [475507]
  - [acpi] add xw8600 and xw6600 to GPE0 block blacklist (Prarit Bhargava ) [475418]
  - [net] cxgb3: fixup embedded firmware problems take 2 (Andy Gospodarek ) [469774]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.1.el5]
changelog:
  - [security] introduce missing kfree (Jiri Pirko ) [480597 480598] {CVE-2009-0031}
  - [sched] fix clock_gettime monotonicity (Peter Zijlstra ) [481122 477763]
  - [nfs] create rpc clients with proper auth flavor (Jeff Layton ) [481119 465456]
  - [net] sctp: overflow with bad stream ID in FWD-TSN chunk (Eugene Teo ) [478804 478805] {CVE-2009-0065}
  - [md] fix oops with device-mapper mirror target (Heinz Mauelshagen ) [481120 472558]
  - [openib] restore traffic in connected mode on HCA (AMEET M. PARANJAPE ) [479812 477000]
  - [net] add preemption point in qdisc_run (Jiri Pirko ) [477746 471398] {CVE-2008-5713}
  - [x86_64] copy_user_c assembler can leave garbage in rsi (Larry Woodman ) [481117 456682]
  - [misc] setpgid returns ESRCH in some situations (Oleg Nesterov ) [480576 472433]
  - [s390] zfcp: fix hexdump data in s390dbf traces (Hans-Joachim Picht ) [480996 470618]
  - [fs] hfsplus: fix buffer overflow with a corrupted image (Anton Arapov ) [469637 469638] {CVE-2008-4933}
  - [fs] hfsplus: check read_mapping_page return value (Anton Arapov ) [469644 469645] {CVE-2008-4934}
  - [fs] hfs: fix namelength memory corruption (Anton Arapov ) [470772 470773] {CVE-2008-5025}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.2.el5]
changelog:
  - [scsi] libata: sas_ata fixup sas_sata_ops (David Milburn ) [485909 483171]
  - [fs] ecryptfs: readlink flaw (Eric Sandeen ) [481606 481607] {CVE-2009-0269}
  - [qla2xxx] correct endianness during flash manipulation (Marcus Barrow ) [485908 481691]
  - [net] ixgbe: frame reception and ring parameter issues (Andy Gospodarek ) [483210 475625]
  - [misc] fix memory leak during pipe failure (Benjamin Marzinski ) [481576 478643]
  - [block] enforce a minimum SG_IO timeout (Eugene Teo ) [475405 475406] {CVE-2008-5700}
  - [nfs] handle attribute timeout and u32 jiffies wrap (Jeff Layton ) [483201 460133]
  -  [fs] ext[234]: directory corruption DoS (Eugene Teo ) [459601 459604] {CVE-2008-3528}
  - [net] deadlock in Hierarchical token bucket scheduler (Neil Horman ) [481746 474797]
  - [wireless] iwl: fix BUG_ON in driver (Neil Horman ) [483206 477671]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.3.el5]
changelog:
  - [net] skfp_ioctl inverted logic flaw (Eugene Teo ) [486539 486540] {CVE-2009-0675}
  - [net] memory disclosure in SO_BSDCOMPAT gsopt (Eugene Teo ) [486517 486518] {CVE-2009-0676}
  - [x86] limit max_cstate to use TSC on some platforms (Tony Camuso ) [488239 470572]
  - [ptrace] correctly handle ptrace_update return value (Jerome Marchand ) [487394 483814]
  - [misc] minor signal handling vulnerability (Oleg Nesterov ) [479963 479964] {CVE-2009-0028}
  - [firmware] dell_rbu: prevent oops (Don Howard ) [482941 482942]
  - [gfs2] panic in debugfs_remove when unmounting (Abhijith Das ) [485910 483617]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.4.el5]
changelog:
  - [x86_64] mce: do not clear an unrecoverable error status (Aristeu Rozanski ) [490433 489692]
  - [wireless] iwlwifi: booting with RF-kill switch enabled (John W. Linville ) [489846 482990]
  - [x86_64] fix gettimeoday TSC overflow issue (Prarit Bhargava ) [489847 467942]
  - [misc] signal: modify locking to handle large loads (AMEET M. PARANJAPE ) [489457 487376]
  - [x86] TSC keeps running in C3+ (Luming Yu ) [489310 474091]
  - [net] fix icmp_send and icmpv6_send host re-lookup code (Jiri Pirko ) [489253 439670] {CVE-2009-0778}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.7.el5]
changelog:
  - [nfs] remove bogus lock-if-signalled case (Bryn M. Reeves ) [456287 456288] {CVE-2008-4307}
  - [x86] NONSTOP_TSC in tsc clocksource (Luming Yu ) [493356 474091]
  - [ppc] keyboard not recognized on bare metal (Justin Payne ) [494293 455232]
  - [fs] ecryptfs: fix memory leak into crypto headers (Eric Sandeen ) [491255 491256] {CVE-2009-0787}
  - [xen] x86: silence WRMSR warnings (Chris Lalancette ) [488928 470035]
  - [ptrace] audit_syscall_entry to use right syscall number (Jiri Pirko ) [488001 488002] {CVE-2009-0834}
  - [dlm] fix length calculation in compat code (David Teigland ) [491677 487672]
  - [nfs] fix hung clients from deadlock in flush_workqueue (David Jeffery ) [488929 483627]
  - [ia64] use current_kernel_time/xtime in hrtimer_start() (Prarit Bhargava ) [490434 485323]
  - [net] bonding: fix arp_validate=3 slaves behaviour (Jiri Pirko ) [488064 484304]
  - [net] enic: return notify intr credits (Andy Gospodarek ) [472474 484824]
  - [input] wacom: 12x12 problem while using lens cursor (Aristeu Rozanski ) [489460 484959]
  - [net] ehea: improve behaviour in low mem conditions (AMEET M. PARANJAPE ) [487035 483148]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.8.el5]
changelog:
  - [misc] exit_notify: kill the wrong capable check [494270 494271] {CVE-2009-1337}
  - [misc] fork: CLONE_PARENT && parent_exec_id interaction (Don Howard ) [479963 479964] {CVE-2009-0028}
  - [scsi] qla2xxx: reduce DID_BUS_BUSY failover errors (Marcus Barrow ) [495635 244967]
  - [nfs] v4: client crash on file lookup with long names (Sachin S. Prabhu ) [494078 493942] {CVE-2009-1336}
  - [net] ixgbe: stop double counting frames and bytes (Andy Gospodarek ) [489459 487213]
  - [xen] x86: update the earlier APERF/MPERF patch (Chris Lalancette ) [495929 493557]
  - [xen] x86: fix dom0 panic when using dom0_max_vcpus (Chris Lalancette ) [495931 485119]
  - [net] fix oops when using openswan (Neil Horman ) [496044 484590]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.13.el5]
changelog:
  - [misc] add some long-missing capabilities to CAP_FS_MASK (Eric Paris ) [499075 497271 499076 497272] {CVE-2009-1072}
  - [agp] zero pages before sending to userspace (Jiri Olsa ) [497025 497026] {CVE-2009-1192}
  - [fs] keep eventpoll from locking up the box (Josef Bacik ) [497322 487585]
  - [misc] waitpid reports stopped process more than once (Vitaly Mayatskikh ) [486945 481199]
  - [ata] libata: ahci enclosure management bios workaround (David Milburn ) [500120 488471]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.14.el5]
changelog:
  - [nfs] v4: client handling of MAY_EXEC in nfs_permission (Peter Staubach ) [500301 500302] {CVE-2009-1630}
  - [fs] proc: avoid info leaks to non-privileged processes (Amerigo Wang ) [499546 499541]
  - [net] tg3: Fix firmware event timeouts (Jiri Pirko ) [502837 481715]
  - [scsi] libiscsi: fix nop response/reply and session cleanup race (Jiri Pirko ) [502916 497411]
  - [fs] cifs: fix pointer and checks in cifs_follow_symlink (Jeff Layton ) [496576 496577] {CVE-2009-1633}
  - [fs] cifs: fix error handling in parse_DFS_referrals (Jeff Layton ) [496576 496577] {CVE-2009-1633}
  - [fs] cifs: buffer overruns when converting strings (Jeff Layton ) [496576 496577] {CVE-2009-1633}
  - [fs] cifs: unicode alignment and buffer sizing problems (Jeff Layton ) [494279 494280] {CVE-2009-1439}
  - [x86] xen: fix local denial of service (Chris Lalancette ) [500950 500951] {CVE-2009-1758}
  - [misc] compile: add -fwrapv to gcc CFLAGS (Don Zickus ) [501751 491266]
  - [misc] random: make get_random_int more random (Amerigo Wang ) [499783 499776]
  - [gfs2] fix uninterruptible quotad sleeping (Steven Whitehouse ) [501742 492943]
  - [mm] cow vs gup race fix (Andrea Arcangeli ) [486921 471613]
  - [mm] fork vs gup race fix (Andrea Arcangeli ) [486921 471613]
  - [nfs] fix hangs during heavy write workloads (Peter Staubach ) [486926 469848]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.2.1.el5]
changelog:
  - Revert: [mm] cow vs gup race fix (Andrea Arcangeli ) [486921 471613]
  - Revert: [mm] fork vs gup race fix (Andrea Arcangeli ) [486921 471613]
  - Revert: [mm] fix swap race condition in fork-gup-race patch (Andrea Arcangeli ) [507297 506684]
  - Revert: [mm] prevent panic in copy_hugetlb_page_range (Larry Woodman ) [508030 507860]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.1.17.el5]
changelog:
  - [net] bnx2: fix problem of using wrong IRQ handler (Jiri Pirko ) [503689 489519]
  - [misc] wacom: reset state when tool is not in proximity (Aristeu Rozanski ) [508275 499870]
  - [net] r8169: fix crash when large packets are received (Ivan Vecera ) [504731 504732] {CVE-2009-1389}
  - [scsi] libsas: use the supplied address for SATA devices (David Milburn ) [506029 494658]
  - [char] TPM: get_event_name stack corruption (Dean Nelson ) [506906 503905]
  - [ptrace] fix do_coredump vs ptrace_start() deadlock (Oleg Nesterov ) [504265 504157] {CVE-2009-1388}
  - [xen] netback: change back to a flipping interface (Chris Lalancette ) [497812 479754]
  - [net] e1000: fix skb_over_panic (Neil Horman ) [503440 503441] {CVE-2009-1385}
  - [misc] core dump: wrong thread info in core dump file (Amerigo Wang ) [505322 503553]
  - [fs] vfs: skip I_CLEAR state inodes in drop_pagecache_sb (Eric Sandeen ) [503692 500164]
  - [audit] watch: fix removal of AUDIT_DIR rule on rmdir (Alexander Viro ) [507561 501321]
  - [ia64] xen: switch from flipping to copying interface (Chris Lalancette ) [497812 479754]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.3.1.el5]
changelog:
  - [pci] quirk: disable MSI on VIA VT3364 chipsets (Dean Nelson ) [507529 501374]
  - [char] tty: prevent an O_NDELAY writer from blocking (Mauro Carvalho Chehab ) [510239 506806]
  - [misc] hrtimer: fix a soft lockup (Amerigo Wang ) [418061 418071] {CVE-2007-5966}
  - [misc] hrtimer: check relative timeouts for overflow (AMEET M. PARANJAPE ) [510018 492230]


author: Don Howard <dhoward@redhat.com> [2.6.18-128.4.1.el5]
changelog:
  - [fs] ecryptfs: check tag 11 packet literal data buffer size (Eric Sandeen ) [512862 512863] {CVE-2009-2406}
  - [fs] ecryptfs: check tag 3 packet encrypted key size (Eric Sandeen ) [512886 512887] {CVE-2009-2407}
  - [misc] personality handling: fix PER_CLEAR_ON_SETID (Vitaly Mayatskikh ) [511173 508842] {CVE-2009-1895}
  - [xen] HV: remove high latency spin_lock (Chris Lalancette ) [512311 459410]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-128.7.1.el5]
changelog:
  - [net] prevent null pointer dereference in udp_sendmsg (Vitaly Mayatskikh) [518047 518043] {CVE-2009-2698}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.2.1.el5]
changelog:
  - [x86_64] kvm: bound last_kvm to prevent backwards time (Glauber Costa ) [524527 524076]
  - [x86] kvm: fix vsyscall going backwards (Glauber Costa ) [524527 524076]
  - [misc] fix RNG to not use first generated random block (Neil Horman ) [523289 522860]
  - [x86] kvm: mark kvmclock_init as cpuinit (Glauber Costa ) [524151 523450]
  - [x86_64] kvm: allow kvmclock to be overwritten (Glauber Costa ) [524150 523447]
  - [x86] kvmclock: fix bogus wallclock value (Glauber Costa ) [524152 519771]
  - [scsi] scsi_dh_rdace: add more sun hardware (mchristi@redhat.com ) [523237 518496]
  - [misc] cprng: fix cont test to be fips compliant (Neil Horman ) [523290 523259]
  - [net] bridge: fix LRO crash with tun (Andy Gospodarek ) [522636 483646]
  - Revert: [x86_64] fix gettimeoday TSC overflow issue - 1 (Don Zickus ) [489847 467942]
  - Revert: [net] atalk/irda: memory leak to user in getname (Danny Feng ) [519309 519310] {CVE-2009-3001 CVE-2009-3002}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.4.1.el5]
changelog:
  - [net] bonding: set primary param via sysfs (Jiri Pirko ) [517971 499884]
  - [scsi] fusion: re-enable mpt_msi_enable option (Tomas Henzl ) [526963 520820]
  - [net] ipt_recent: sanity check hit count (Amerigo Wang ) [527434 523982]
  - [net] ipv4: ip_append_data handle NULL routing table (Jiri Pirko ) [527436 520297]
  - [nfs] fix cache invalidation problems in nfs_readdir (Jeff Layton ) [526960 511170]
  - [net] tc: fix unitialized kernel memory leak (Jiri Pirko ) [520994 520863]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.5.1.el5]
changelog:
  - [fs] eCryptfs: prevent lower dentry from going negative (Eric Sandeen ) [527834 527835] {CVE-2009-2908}
  - [nfs] v4: reclaimer thread stuck in an infinite loop (Sachin S. Prabhu ) [529162 526888]
  - [net] r8169: avoid losing MSI interrupts (Ivan Vecera ) [529366 514589]
  - [scsi] st.c: memory use after free after MTSETBLK ioctl (David Jeffery ) [528133 520192]
  - [net] r8169: balance pci_map/unmap pair, use hw padding (Ivan Vecera ) [529143 515857] {CVE-2009-3613}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.6.1.el5]
changelog:
  - [fs] fix pipe null pointer dereference (Jeff Moyer) [530938 530939] {CVE-2009-3547}
  - [security] require root for mmap_min_addr (Eric Paris ) [518142 518143] {CVE-2009-2695}
  - [net] lvs: adjust sync protocol handling for ipvsadm -2 (Neil Horman ) [528645 524129]
  - [xen] allow booting with broken serial hardware (Chris Lalancette ) [524153 518338]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-164.7.1.el5]
changelog:
  - [xen] fix numa on magny-cours systems (Bhavna Sarathy ) [539684 526051]
  - [xen] fix crash with memory imbalance (Bhavna Sarathy ) [539690 526785]
  - [net] sched: fix panic in bnx2_poll_work (John Feeney ) [539686 526481]
  - [acpi] prevent duplicate dirs in /proc/acpi/processor (Matthew Garrett ) [539692 537395]
  - [x86] fix boot crash with < 8-core AMD Magny-cours system (Bhavna Sarathy) [539682 522215]
  - [x86] support amd magny-cours power-aware scheduler fix (Bhavna Sarathy ) [539680 513685]
  - [x86] disable NMI watchdog on CPU remove (Prarit Bhargava ) [539691 532514]
  - [acpi] bm_check and bm_control update (Luming Yu ) [539677 509422]
  - [x86_64] amd: iommu system management erratum 63 fix (Bhavna Sarathy ) [539689 531469]
  - [net] bnx2i/cnic: update driver version for RHEL5.5 (Mike Christie ) [537014 516233]
  - [x86] fix L1 cache by adding missing break (Bhavna Sarathy ) [539688 526770]
  - [x86] amd: fix hot plug cpu issue on 32-bit magny-cours (Bhavna Sarathy ) [539688 526770]
  - [acpi] disable ARB_DISABLE on platforms where not needed (Luming Yu ) [539677 509422]
  - [fs] private dentry list to avoid dcache_lock contention (Lachlan McIlroy ) [537019 526612]
  - [scsi] qla2xxx: enable msi-x correctly on qlogic 2xxx series (Marcus Barrow ) [537020 531593]
  - [apic] fix server c1e spurious lapic timer events (Bhavna Sarathy ) [539681 519422]
  - [net] netlink: fix typo in initialization (Jiri Pirko ) [528872 527906]
  - [x86] set cpu_llc_id on AMD CPUs (Bhavna Sarathy ) [539678 513684]
  - [x86] fix up threshold_bank4 support on AMD Magny-cours (Bhavna Sarathy ) [539678 513684]
  - [x86] fix up L3 cache information for AMD Magny-cours (Bhavna Sarathy ) [539678 513684]
  - [x86] amd: fix CPU llc_shared_map information (Bhavna Sarathy ) [539678 513684]
  - [nfs] v4: fix setting lock on open file with no state (Jeff Layton ) [533114 533115] {CVE-2009-3726}
  - [misc] futex priority based wakeup (Jon Thomas ) [533858 531552]
  - [dlm] use GFP_NOFS on all lockspaces (David Teigland ) [533859 530537]
  - [drm] r128: check for init on all ioctls that require it (Danny Feng ) [529602 529603] {CVE-2009-3620}
  - [scsi] mpt: errata 28 fix on LSI53C1030 (Tomas Henzl ) [529308 518689]
  - [x86] add ability to access Nehalem uncore config space (John Villalovos ) [539675 504330]
  - [net] AF_UNIX: deadlock on connecting to shutdown socket (Jiri Pirko ) [529630 529631] {CVE-2009-3621}
  - [fs] inotify: remove debug code (Danny Feng ) [533822 499019]
  - [fs] inotify: fix race (Danny Feng ) [533822 499019]
  - [audit] dereferencing krule as if it were an audit_watch (Alexander Viro ) [533861 526819]
  - [mm] fix spinlock performance issue on large systems (John Villalovos ) [539685 526078]
  - [x86] finish sysdata conversion (Danny Feng ) [537346 519633]
  - [pci] pciehp: fix PCIe hotplug slot detection (Michal Schmidt ) [530383 521731]
  - [x86] oprofile: support arch perfmon (John Villalovos ) [539683 523479]
  - [x86] oprofile: fix K8/core2 on multiple cpus (John Villalovos ) [539683 523479]
  - [x86] oprofile: utilize perf counter reservation (John Villalovos ) [539683 523479]
  - [pci] avoid disabling acpi to use non-core PCI devices (Mauro Carvalho Chehab ) [539675 504330]
  - [misc] support Intel multi-APIC-cluster systems (Prarit Bhargava ) [539676 507333]
  - [x86] suspend-resume: work on large logical CPU systems (John Villalovos ) [539674 499271]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-164.8.1.el5]
changelog:
  - [xen] iommu-amd: extend loop ctr for polling completion wait (Bhavna Sarathy ) [539687 518474 526766]
  - [xen] iommu: add passthrough and no-intremap parameters (Bhavna Sarathy ) [539687 518474 526766]
  - [xen] iommu: enable amd iommu debug at run-time (Bhavna Sarathy ) [539687 518474 526766]
  - [xen] support interrupt remapping on M-C (Bhavna Sarathy ) [539687 518474 526766]
  - [xen] iommu: move iommu_setup() to setup ioapic correctly (Bhavna Sarathy ) [539687 518474 526766]
  - [net] bnx2x: add support for bcm8727 phy (Stanislaw Gruszka ) [540381 515716]
  - [x86] cpu: upstream cache fixes needed for amd m-c (Bhavna Sarathy ) [540469 526315]
  - [x86_64] set proc id and core id before calling fixup_dcm (Bhavna Sarathy) [540469 526315]
  - [x86] mce_amd: fix up threshold_bank4 creation (Bhavna Sarathy ) [540469 526315]
  - Revert: [net] sched: fix panic in bnx2_poll_work (John Feeney ) [539686 526481]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.10.1.el5]
changelog:
  - [net] e1000, r9169: fix rx length check errors (Cong Wang ) [550914 550915]
  - [net] e1000e: fix rx length check errors (Amerigo Wang ) [551222 551223]
  - [net] ipv6: fix ipv6_hop_jumbo remote system crash (Amerigo Wang ) [548642 548643] {CVE-2007-4567}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.11.1.el5]
changelog:
  - [firewire] ohci: handle receive packets with zero data (Jay Fenlason) [547241 547242] {CVE-2009-4138}
  - [x86] sanity check for AMD northbridges (Andrew Jones) [549905 547518]
  - [x86_64] disable vsyscall in kvm guests (Glauber Costa) [550968 542612]
  - [fs] ext3: replace lock_super with explicit resize lock (Eric Sandeen) [549908 525100]
  - [fs] respect flag in do_coredump (Danny Feng) [544188 544189] {CVE-2009-4036}
  - [gfs2] make O_APPEND behave as expected (Steven Whitehouse) [547521 544342]
  - [fs] hfs: fix a potential buffer overflow (Amerigo Wang) [540740 540741] {CVE-2009-4020}
  - [fuse] prevent fuse_put_request on invalid pointer (Danny Feng) [538736 538737] {CVE-2009-4021}
  - [mm] call vfs_check_frozen after unlocking the spinlock (Amerigo Wang) [548370 541956]
  - [infiniband] init neigh->dgid.raw on bonding events (Doug Ledford) [543448 538067]
  - [scsi] gdth: prevent negative offsets in ioctl (Amerigo Wang) [539420 539421] {CVE-2009-3080}
  - [fs] gfs2: fix glock ref count issues (Steven Whitehouse) [544978 539240]
  - [net] call cond_resched in rt_run_flush (Amerigo Wang) [547530 517588]
  - [scsi] megaraid: fix sas permissions in sysfs (Casey Dahlin) [537312 537313] {CVE-2009-3889 CVE-2009-3939}
  - [ia64] kdump: restore registers in the stack on init (Takao Indoh ) [542582 515753]
  - [x86] kvm: don't ask HV for tsc khz if not using kvmclock (Glauber Costa ) [537027 531268]
  - [net] sched: fix panic in bnx2_poll_work (John Feeney ) [539686 526481]
  - [x86_64] fix 32-bit process register leak (Amerigo Wang ) [526797 526798]
  - [cpufreq] add option to avoid smi while calibrating (Matthew Garrett ) [537343 513649]
  - [kvm] use upstream kvm_get_tsc_khz (Glauber Costa ) [540896 531025]
  - [net] fix unbalance rtnl locking in rt_secret_reschedule (Neil Horman ) [549907 510067]
  - [net] r8169: imporved rx length check errors (Neil Horman ) [552913 552438]
  - [scsi] lpfc: fix FC ports offlined during target controller faults (Rob Evers ) [549906 516541]
  - [net] emergency route cache flushing fixes (Thomas Graf ) [545662 545663] {CVE-2009-4272}
  - [fs] fasync: split 'fasync_helper()' into separate add/remove functions (Danny Feng ) [548656 548657] {CVE-2009-4141}
  - [scsi] qla2xxx: NPIV vport management pseudofiles are world writable (Tom Coughlan ) [537317 537318] {CVE-2009-3556}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.11.1.el5]
changelog:
  - [firewire] ohci: handle receive packets with zero data (Jay Fenlason) [547241 547242] {CVE-2009-4138}
  - [x86] sanity check for AMD northbridges (Andrew Jones) [549905 547518]
  - [x86_64] disable vsyscall in kvm guests (Glauber Costa) [550968 542612]
  - [fs] ext3: replace lock_super with explicit resize lock (Eric Sandeen) [549908 525100]
  - [fs] respect flag in do_coredump (Danny Feng) [544188 544189] {CVE-2006-6304}
  - [gfs2] make O_APPEND behave as expected (Steven Whitehouse) [547521 544342]
  - [fs] hfs: fix a potential buffer overflow (Amerigo Wang) [540740 540741] {CVE-2009-4020}
  - [fuse] prevent fuse_put_request on invalid pointer (Danny Feng) [538736 538737] {CVE-2009-4021}
  - [mm] call vfs_check_frozen after unlocking the spinlock (Amerigo Wang) [548370 541956]
  - [infiniband] init neigh->dgid.raw on bonding events (Doug Ledford) [543448 538067]
  - [scsi] gdth: prevent negative offsets in ioctl (Amerigo Wang) [539420 539421] {CVE-2009-3080}
  - [fs] gfs2: fix glock ref count issues (Steven Whitehouse) [544978 539240]
  - [net] call cond_resched in rt_run_flush (Amerigo Wang) [547530 517588]
  - [scsi] megaraid: fix sas permissions in sysfs (Casey Dahlin) [537312 537313] {CVE-2009-3889 CVE-2009-3939}
  - [ia64] kdump: restore registers in the stack on init (Takao Indoh ) [542582 515753]
  - [x86] kvm: don't ask HV for tsc khz if not using kvmclock (Glauber Costa ) [537027 531268]
  - [net] sched: fix panic in bnx2_poll_work (John Feeney ) [539686 526481]
  - [x86_64] fix 32-bit process register leak (Amerigo Wang ) [526797 526798]
  - [cpufreq] add option to avoid smi while calibrating (Matthew Garrett ) [537343 513649]
  - [kvm] use upstream kvm_get_tsc_khz (Glauber Costa ) [540896 531025]
  - [net] fix unbalance rtnl locking in rt_secret_reschedule (Neil Horman ) [549907 510067]
  - [net] r8169: imporved rx length check errors (Neil Horman ) [550914 550915] {CVE-2009-4537}
  - [scsi] lpfc: fix FC ports offlined during target controller faults (Rob Evers ) [549906 516541]
  - [net] emergency route cache flushing fixes (Thomas Graf ) [545662 545663] {CVE-2009-4272}
  - [fs] fasync: split 'fasync_helper()' into separate add/remove functions (Danny Feng ) [548656 548657] {CVE-2009-4141}
  - [scsi] qla2xxx: NPIV vport management pseudofiles are world writable (Tom Coughlan ) [537317 537318] {CVE-2009-3556}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.12.1.el5]
changelog:
  - [net] e1000: fix rx length check errors (Neil Horman) [552137 552138] {CVE-2009-4536}
  - Revert: [net] e1000, r9169: fix rx length check errors (Cong Wang ) [550914 550915]
  - [fs] jbd: fix race in slab creation/deletion (Josef Bacik) [553132 496847]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.13.1.el5]
changelog:
  - [net] e1000e: fix broken wol (Andy Gospodarek) [559335 557974]
  - [net] gro: fix illegal merging of trailer trash (Herbert Xu) [561417 537876]
  - [xen] hook sched rebalance logic to opt_hardvirt (Christopher Lalancette ) [562777 529271]
  - [xen] crank the correct stat in the scheduler (Christopher Lalancette ) [562777 529271]
  - [xen] whitespace fixups in xen scheduler (Christopher Lalancette ) [562777 529271]
  - [scsi] cciss: ignore stale commands after reboot (Tomas Henzl ) [562772 525440]
  - [scsi] cciss: version change (Tomas Henzl ) [562772 525440]
  - [scsi] cciss: switch to using hlist (Tomas Henzl ) [562772 525440]
  - [net] bonding: allow bond in mode balance-alb to work (Jiri Pirko ) [560588 487763]
  - [net] e1000e: fix WoL on 82577/82578 (Jiri Pirko ) [543449 517593]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.14.1.el5]
changelog:
  - [fs] ext4: Avoid null pointer dereference when decoding EROFS w/o a journal (Jiri Pirko) [547256 547257] {CVE-2009-4308}
  - [net] sctp: backport cleanups for ootb handling (Neil Horman) [555666 555667] {CVE-2010-0008}
  - [mm] fix sys_move_pages infoleak (Eugene Teo) [562589 562590] {CVE-2010-0415}
  - [x86_64] wire up compat sched_rr_get_interval (Danny Feng) [557684 557092]
  - [net] netfilter: enforce CAP_NET_ADMIN in ebtables (Danny Feng) [555242 555243] {CVE-2010-0007}
  - [misc] fix kernel info leak with print-fatal-signals=1 (Danny Feng) [554583 554584] {CVE-2010-0003}
  - [net] ipv6: fix OOPS in ip6_dst_lookup_tail (Thomas Graf) [559238 552354]
  - [kvm] pvclock on i386 suffers from double registering (Glauber Costa) [561454 557095]
  - [pci] VF can't be enabled in dom0 (Don Dutile) [560665 547980]
  - [kvm] kvmclock won't restore properly after resume (Glauber Costa) [560640 539521]
  - [mm] prevent performance hit for 32-bit apps on x86_64 (Larry Woodman) [562746 544448]
  - [fs] fix possible inode corruption on unlock (Eric Sandeen) [564281 545612]
  - [gfs2] careful unlinking inodes (Steven Whitehouse ) [564288 519049]
  - [gfs2] gfs2_delete_inode failing on RO filesystem (Abhijith Das ) [564290 501359]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.15.1.el5]
changelog:
  - [net] sctp: backport cleanups for ootb handling V2 (Neil Horman) [555666 555667] {CVE-2010-0008}
  - Reverting: [net] sctp: backport cleanups for ootb handling (Neil Horman) [555666 555667] {CVE-2010-0008}


author: Don Zickus <dzickus@redhat.com> [2.6.18-158.el5]
changelog:
  - [s390] add missing kernel option CONFIG_SHARED_KERNEL (Hans-Joachim Picht ) [506947]
  - [gfs2] fix incorrent statfs_slow consistency check (Benjamin Marzinski ) [505171]
  - [net] be2net: fix msix performance regression (Andy Gospodarek ) [510008]
  - [gfs2] umount.gfs2 hangs eating CPU (Abhijith Das ) [508876]
  - [block] protect the per-gendisk partition array with rcu (Jeff Moyer ) [495866]
  - [net] igb: fix panic when assigning device to guest (Andy Gospodarek ) [507173]
  - [ia64] xen: dom0 get/set_address_size (Chris Lalancette ) [510069]
  - [x86] fix suspend/resume issue on SB800 chipset (Bhavna Sarathy ) [498135]
  - [scsi] cciss: fix spinlock (Tomas Henzl ) [509818]
  - [scsi] qla2xxx: NPIV broken for PPC, endian fix (Marcus Barrow ) [510268]
  - [scsi] qla2xxx: prevent hangs in extended error handling (Marcus Barrow ) [470510]
  - [mm] prevent softlockups in copy_hugetlb_page_range (Larry Woodman ) [508919]
  - [scsi] cxgb3i: fix vlan support (mchristi@redhat.com ) [508409]
  - [net] bnx2i: RHEL-5.4 code cleanups (mchristi@redhat.com ) [504181]
  - [x86_64] import asm/svm.h and asm/vmx.h (Eduardo Habkost ) [507483]
  - [x86_64] import asm/virtext.h (Eduardo Habkost ) [507483]
  - [x86_64] add MSR_VM_* defines (Eduardo Habkost ) [507483]
  - [x86_64] disable VMX and SVM on machine_crash_shutdown (Eduardo Habkost ) [507483]
  - [x86_64] add EFER_SVME define (Eduardo Habkost ) [507483]
  - [x86_64] define X86_CR4_VMXE (Eduardo Habkost ) [507483]
  - [net] qlge: rhel-5.4 cleanups (Marcus Barrow ) [509647]
  - [scsi] lpfc: fix ctx_idx increase and update version (Rob Evers ) [509010]
  - [scsi] lpfc: move pointer ref. inside alloc check in (Rob Evers ) [509010]
  - [scsi] lpfc: update to version 8.2.0.48 (Rob Evers ) [509010]
  - [mm] fix re-read performance regression (Josef Bacik ) [506511]
  - [net] ipsec: add missing braces to fix policy querying (Herbert Xu ) [462731]
  - [net] tg3: 5785F and 50160M support (Andy Gospodarek ) [506205]
  - [pci] intel-iommu: fix iommu address space allocation (Chris Wright ) [509207]
  - [xen] virtio: do not statically allocate root device (Mark McLoughlin ) [501468]
  - [xen] virtio: add PCI device release function (Mark McLoughlin ) [501468]
  - [misc] driver core: add root_device_register (Mark McLoughlin ) [501468]
  - [block] blktrace: fix recursive block remap tracepoint (Jason Baron ) [502573]
  - [scsi] qla2xxx: rhel-5.4 fixes and cleanups (Marcus Barrow ) [507246]
  - [xen] HV: remove high latency spin_lock (Chris Lalancette ) [459410]
  - [xen] ia64: add get/set_address_size support (Chris Lalancette ) [510069]


author: Don Zickus <dzickus@redhat.com> [2.6.18-159.el5]
changelog:
  - [scsi] cciss: fix sysfs broken symlink regression (Rob Evers ) [510178]
  - [kabi] add consume_skb (Jon Masters ) [479200]
  - [net] ipv6: fix incorrect disable_ipv6 behavior (jolsa@redhat.com ) [512258]
  - [net] ipv6: fix BUG when disabled module is unloaded (jolsa@redhat.com ) [512258]
  - [net] ipv6: add 'disable' module parameter support (jolsa@redhat.com ) [512258]
  - Revert: [mm] fix swap race in fork-gup patch group (Larry Woodman ) [508919]
  - [scsi] mptfusion: fix OOPS in failover path (Rob Evers ) [504835]
  - [scsi] stex: minimize DMA coherent allocation (David Milburn ) [486466]
  - [misc] personality handling: fix PER_CLEAR_ON_SETID (Vitaly Mayatskikh ) [508842]
  - [misc] build with -fno-delete-null-pointer-checks (Eugene Teo ) [511181]
  - [scsi] qla2xxx: provide reset capability for EEH (Marcus Barrow ) [511141]
  - [scsi] bnx2i: fix host setup and libiscsi abort locking (mchristi@redhat.com ) [511096]
  - [xen] ia64: fix rmmod of PCI devices (Chris Lalancette ) [507520]
  - [pci] kvm: PCI FLR support for device assignment (Don Dutile ) [510805]
  - [gfs2] don't put unlikely reclaim glocks on reclaim list (Benjamin Marzinski ) [504335]


author: Don Zickus <dzickus@redhat.com> [2.6.18-160.el5]
changelog:
  - [scsi] mptsas: fix max_id initialization (mchristi@redhat.com ) [455678]
  - [ata] ahci: add IDs for Ibex Peak ahci controllers (David Milburn ) [513067]
  - [scsi] lpfc: update to 8.2.0.48.2p, fix multiple panics (Rob Evers ) [512266]
  - [gfs2] remove dcache entries for remote deleted inodes (Benjamin Marzinski ) [505548]
  - [alsa] add native support for IbexPeak audio (Jaroslav Kysela ) [509526]
  - [alsa] IbexPeak related patches for codec auto-config (Jaroslav Kysela ) [509526]
  - [scsi] cciss: call bus_unregister in cciss_remove_one (Rob Evers ) [513070]
  - [scsi] cciss: add driver sysfs entries (Rob Evers ) [513070]
  - [net] e1000e/igb: make sure wol can be configured (Andy Gospodarek ) [513032]
  - [fs] xfs: only compile for x86_64 (Eric Sandeen ) [512827]
  - [ahci] add SATA GEN3 related messages (David Milburn ) [512086]
  - [net] tun/tap: open /dev/net/tun and then poll() it fix (Danny Feng ) [512286] {CVE-2009-1897}
  - [net] mlx4_en: problem with LRO that segfaults KVM host (Doug Ledford ) [510789]
  - [openib] mthca: fix over sized kmalloc usage (Doug Ledford ) [508902]
  - [s390] zcrypt: request gets timed out under high load (Hans-Joachim Picht ) [511289]


author: Don Zickus <dzickus@redhat.com> [2.6.18-161.el5]
changelog:
  - [dlm] free socket in error exit path (David Teigland ) [508829]
  - [net] tg3: fix concurrent migration of VM clients (John Feeney ) [511918]
  - [scsi] mptfusion: revert to pci_map (Tomas Henzl ) [514049]
  - [scsi] bnx2i: fix conn disconnection bugs (mchristi@redhat.com ) [513802]
  - [scsi] qla2xxx: unable to destroy npiv HBA ports (Marcus Barrow ) [514352]
  - [scsi] ALUA: send STPG if explicit and implicit (mchristi@redhat.com ) [482737]
  - [scsi] megaraid: fix the tape drive issue (Tomas Henzl ) [510665]
  - [scsi] cxgb3i: fix skb allocation (mchristi@redhat.com ) [514073]
  - [fs] __bio_clone: don't calculate hw/phys segment counts (Milan Broz ) [512387]
  - [fs] ecryptfs: check tag 11 packet data buffer size (Eric Sandeen ) [512863] {CVE-2009-2406}
  - [fs] ecryptfs: check tag 3 packet encrypted key size (Eric Sandeen ) [512887] {CVE-2009-2407}
  - [xen] amd iommu: crash with pass-through on large memory (Bhavna Sarathy ) [514910]


author: Don Zickus <dzickus@redhat.com> [2.6.18-164.el5]
changelog:
  - [misc] information leak in sigaltstack (Vitaly Mayatskikh ) [515396]
  - [misc] execve: must clear current->clear_child_tid (Oleg Nesterov ) [515429]
  - [net] igb: set lan id prior to configuring phy (Stefan Assmann ) [508870]
  - [net] udp: socket NULL ptr dereference (Vitaly Mayatskikh ) [518043] {CVE-2009-2698}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-164.1.1.el5]
changelog:
  - [net] sky2: revert some phy power refactoring changes (Neil Horman ) [517976 509891]
  - [net] atalk/irda: memory leak to user in getname (Danny Feng ) [519309 519310] {CVE-2009-3001 CVE-2009-3002}
  - [x86_64] fix gettimeoday TSC overflow issue - 1 (Prarit Bhargava ) [489847 467942]
  - [md] prevent crash when accessing suspend_* sysfs attr (Danny Feng ) [518135 518136] {CVE-2009-2849}
  - [nfs] nlm_lookup_host: don't return invalidated nlm_host (Sachin S. Prabhu ) [517967 507549]
  - [net] bonding: tlb/alb: set active slave when enslaving (Jiri Pirko ) [517971 499884]
  - [nfs] r/w I/O perf degraded by FLUSH_STABLE page flush (Peter Staubach ) [521244 498433]
  - [SELinux] allow preemption b/w transition perm checks (Eric Paris ) [520919 516216]
  - [scsi] scsi_transport_fc: fc_user_scan correction (David Milburn ) [521239 515176]
  - [net] tg3: refrain from touching MPS (John Feeney ) [521241 516123]
  - [net] qlge: fix hangs and read performance (Marcus Barrow ) [519783 517893]
  - [scsi] qla2xxx: allow use of MSI when MSI-X disabled (Marcus Barrow ) [519782 517922]
  - [net] mlx4_en fix for vlan traffic (Doug Ledford ) [520906 514141]
  - [net] mlx4_core: fails to load on large systems (Doug Ledford ) [520908 514147]
  - [x86] disable kvmclock by default (Glauber Costa ) [520685 476075]
  - [x86] disable kvmclock when shuting the machine down (Glauber Costa ) [520685 476075]
  - [x86] re-register clock area in prepare_boot_cpu (Glauber Costa ) [520685 476075]
  - [x86] kvmclock smp support (Glauber Costa ) [520685 476075]
  - [x86] use kvm wallclock (Glauber Costa ) [520685 476075]
  - [x86_64] kvm clocksource's implementation (Glauber Costa ) [520685 476075]
  - [x86] kvm: import kvmclock.c (Glauber Costa ) [520685 476075]
  - [x86] kvm: import pvclock.c and headers (Glauber Costa ) [520685 476075]
  - [x86] export additional cpu flags in /proc/cpuinfo (Prarit Bhargava ) [520686 517928]
  - [x86] detect APIC clock calibration problems (Prarit Bhargava ) [521238 503957]
  - [x86] pnpacpi: fix serial ports on IBM Point-of-Sale HW (Kevin Monroe ) [520905 506799]


author: Don Zickus <dzickus@redhat.com> [2.6.18-156.el5]
changelog:
  - [misc] kdump: make mcp55 chips work (Neil Horman ) [462519]
  - [ide] enable VX800 to use UDMA mode (John Feeney ) [504121]
  - [misc] wacom: reset state when tool is not in proximity (Aristeu Rozanski ) [499870]
  - [scsi] lpfc: update to version 8.2.0.46 (Rob Evers ) [506792]
  - [mm] prevent panic in copy_hugetlb_page_range (Larry Woodman ) [507860]
  - [gfs2] keep statfs info in sync on grows (Benjamin Marzinski ) [494885]
  - [gfs2] always queue work after after setting GLF_LOCK (Benjamin Marzinski ) [506140]
  - [scsi] cxgb3i: use kref to track ddp, support page sizes (mchristi@redhat.com ) [506151]
  - [security] drop mmap_min_addr to 4096 (Eric Paris ) [507017]
  - [misc] hrtimer: fix a soft lockup (Amerigo Wang ) [418071] {CVE-2007-5966}
  - [net] backport net_rx_action tracepoint (Neil Horman ) [506138]
  - [gfs2] fix truncate buffered/direct I/O issue (Steven Whitehouse ) [504676]
  - [xen] x86: fix IRQ problem on legacy hardware (ddugger@redhat.com ) [505491]
  - [xen] disable 2MB support on PAE kernels (Bhavna Sarathy ) [503737]


author: Don Zickus <dzickus@redhat.com> [2.6.18-157.el5]
changelog:
  - [mm] readv: sometimes returns less than it should (Amerigo Wang ) [500693]
  - [net] be2net: fix races in napi and interrupt handling (Andy Gospodarek ) [508839]
  - [net] be2net: fix deadlock with bonding (Andy Gospodarek ) [508871]
  - [xen] quiet printk on FV guest shutdown (Don Dutile ) [501474]
  - [fs] fuse: enable building the subsystem (Josef Bacik ) [457975]
  - [gfs2] fix panic in glock memory shrinker (Benjamin Marzinski ) [508806]
  - [net] rt2x00: use mac80211-provided workqueue (John W. Linville ) [506845]
  - [pci] quirk: disable MSI on VIA VT3364 chipsets (Dean Nelson ) [501374]
  - [net] undo vlan promiscuity count when unregistered (Neil Horman ) [481283]
  - [net] be2net: crash on PPC with LRO and jumbo frames (Andy Gospodarek ) [508404]
  - [net] RTNL: assertion failed due to bonding notify (Stanislaw Gruszka ) [508297]
  - [scsi] ibmvfc: process async events before cmd responses (AMEET M. PARANJAPE ) [508127]
  - [scsi] ibmvfc: fix endless PRLI loop in discovery (AMEET M. PARANJAPE ) [508127]
  - [scsi] ibmvfc: improve LOGO/PRLO ELS handling (AMEET M. PARANJAPE ) [508127]
  - [net] iucv: provide second per-cpu cmd parameter block (Hans-Joachim Picht ) [503240]
  - [net] sky2: /proc/net/dev statistics are broken (Flavio Leitner ) [507932]
  - [scsi] qla2xxx: prevent I/O stoppage (Marcus Barrow ) [507620]
  - [scsi] qla2xxx: updates 24xx firmware to 4.04.09 (Marcus Barrow ) [507398]
  - [scsi] qla2xxx: updates 25xx firmware to 4.04.09 (Marcus Barrow ) [507398]
  - [scsi] qla4xxx: extended sense data errors, cleanups (Marcus Barrow ) [506981]
  - [char] tty: prevent an O_NDELAY writer from blocking (Mauro Carvalho Chehab ) [506806]
  - [xen] allow msi reconfigure for pt_bind_irq (ddugger@redhat.com ) [507970]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.4.1.el5]
changelog:
  - [acpi] warn on hot-add of memory exceeding 4G boundary (Prarit Bhargava) [587957 571544]
  - [net] tipc: fix various oopses in uninitialized code (Neil Horman) [578058 558693] {CVE-2010-1187}
  - [block] cfq-iosched: fix IOPRIO_CLASS_IDLE accounting (Jeff Moyer) [588219 574285]
  - [block] cfq-iosched: async queue allocation per priority (Jeff Moyer) [588219 574285]
  - [block] cfq-iosched: fix async queue behaviour (Jeff Moyer) [588219 574285]
  - [block] cfq-iosched: propagate down request sync flag (Jeff Moyer) [588219 574285]
  - [block] introduce the rq_is_sync macro (Jeff Moyer) [588219 574285]
  - [fs] vfs: fix LOOKUP_FOLLOW on automount symlinks (Jeff Layton) [567815 567816] {CVE-2010-1088}
  - [nfs] fix an oops when truncating a file (Jeff Layton) [567194 567195] {CVE-2010-1087}
  - [fs] fix kernel oops while copying from ext3 to gfs2 (Abhijith Das) [586008 555754] {CVE-2010-1436}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.5.1.el5]
changelog:
  - [net] bonding: fix broken multicast with round-robin mode (Andy Gospodarek) [594057 570645]
  - [net] tg3: fix INTx fallback when MSI fails (Steve Best) [592844 587666]
  - [net] sched: fix SFQ qdisc crash w/limit of 2 packets (Jiri Pirko) [594054 579774]
  - [nfs] revert retcode check in nfs_revalidate_mapping() (Jeff Layton) [594061 557423]
  - [misc] futex: handle futex value corruption gracefully (Jerome Marchand) [563093 480396] {CVE-2010-0622}
  - [misc] futex: handle user space corruption gracefully (Jerome Marchand) [563093 480396] {CVE-2010-0622}
  - [misc] futex: fix fault handling in futex_lock_pi (Jerome Marchand) [563093 480396] {CVE-2010-0622}
  - [net] e1000: fix WoL init when WoL disabled in EEPROM (Dean Nelson) [591493 568561]
  - [virtio] fix GFP flags passed by virtio balloon driver (Amit Shah) [591611 584683]
  - [net] sctp: fix skb_over_panic w/too many unknown params (Neil Horman) [584657 584658] {CVE-2010-1173}
  - [acpi] fix WARN on unregister in power meter driver (Matthew Garrett) [592846 576246]
  - [mm] keep get_unmapped_area_prot functional (Danny Feng) [556709 556710] {CVE-2010-0291}
  - [mm] switch do_brk to get_unmapped_area (Danny Feng) [556709 556710] {CVE-2010-0291}
  - [mm] take arch_mmap_check into get_unmapped_area (Danny Feng) [556709 556710] {CVE-2010-0291}
  - [mm] get rid of open-coding in ia64_brk (Danny Feng) [556709 556710] {CVE-2010-0291}
  - [mm] unify sys_mmap* functions (Danny Feng) [556709 556710] {CVE-2010-0291}
  - [mm] kill ancient cruft in s390 compat mmap (Danny Feng) [556709 556710] {CVE-2010-0291}
  - [mm] fix pgoff in have to relocate case of mremap (Danny Feng) [556709 556710] {CVE-2010-0291}
  - [mm] fix the arch checks in MREMAP_FIXED case (Danny Feng) [556709 556710] {CVE-2010-0291}
  - [mm] fix checks for expand-in-place mremap (Danny Feng) [556709 556710] {CVE-2010-0291}
  - [mm] add new vma_expandable helper function (Danny Feng) [556709 556710] {CVE-2010-0291}
  - [mm] move MREMAP_FIXED into its own header (Danny Feng) [556709 556710] {CVE-2010-0291}
  - [mm] move locating vma code and checks on it (Danny Feng) [556709 556710] {CVE-2010-0291}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.6.1.el5]
changelog:
  - [fs] gfs2: fix permissions checking for setflags ioctl (Steven Whitehouse) [595580 595399] {CVE-2010-1641}
  - [mm] clear page errors when issuing a fresh read of page (Rik van Riel) [599739 590763]
  - [misc] keys: do not find already freed keyrings (Vitaly Mayatskikh) [585099 585100] {CVE-2010-1437}
  - [net] sctp: file must be valid before setting timeout (Jiri Pirko) [598355 578261]
  - [net] tg3: fix panic in tg3_interrupt (John Feeney) [600498 569106]
  - [net] e1000/e1000e: implement simple interrupt moderation (Andy Gospodarek) [599332 586416]
  - [net] cnic: Fix crash during bnx2x MTU change (Stanislaw Gruszka) [596385 582367]
  - [net] bxn2x: add dynamic lro disable support (Stanislaw Gruszka) [596385 582367]
  - [net] implement dev_disable_lro api for RHEL5 (Stanislaw Gruszka) [596385 582367]
  - [x86_64] fix time drift due to faulty lost tick tracking (Ulrich Obergfell) [601090 579711]
  - [net] neigh: fix state transitions via Netlink request (Jiri Pirko) [600215 485903]
  - [mm] fix hugepage corruption using vm.drop_caches (Larry Woodman) [599737 579469]
  - [nfs] don't unhash dentry in nfs_lookup_revalidate (Jeff Layton) [596384 582321]
  - [fs] remove unneccessary f_ep_lock from fasync_helper (Lachlan McIlroy) [599730 567479]
  - [xen] set hypervisor present CPUID bit (Paolo Bonzini) [599734 573771]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.7.1.el5]
changelog:
  - [virt] don't compute pvclock adjustments if we trust tsc (Glauber Costa) [601080 570824]
  - [virt] add a global synchronization point for pvclock (Glauber Costa) [601080 570824]
  - [virt] enable pvclock flags in vcpu_time_info structure (Glauber Costa) [601080 570824]
  - [misc] add atomic64_cmpxcgh to x86_64 include files (Glauber Costa) [601080 570824]
  - [x86] grab atomic64 types from upstream (Glauber Costa) [601080 570824]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.9.1.el5]
changelog:
  - [xen] ia64: unset be from the task psr (Andrew Jones) [587475 587477] {CVE-2010-2070}
  - [fs] ext4: MOVE_EXT can't overwrite append-only files (Eric Sandeen) [601007 601008] {CVE-2010-2066}
  - [pci] acpiphp: fix missing acpiphp_glue_exit (Prarit Bhargava) [607486 515556]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.10.1.el5]
changelog:
  - [fs] xfs: don't let swapext operate on write-only files (Jiri Pirko) [605160 605161] {CVE-2010-2226}
  - [fs] nfs: fix bug in nfsd4 read_buf (Jiri Olsa) [612034 612035] {CVE-2010-2521}
  - [fs] cifs: reject DNS upcall add_key req from userspace (Jeff Layton) [612170 612171] {CVE-2010-2524}
  - [security] keys: new key flag for add_key from userspace (Jeff Layton) [612170 612171] {CVE-2010-2524}
  - [message] mptsas: fix disk add failing due to timeout (Rob Evers) [612539 542892]
  - [block] cfq-iosched: fix bad locking in changed_ioprio (Jeff Moyer) [607483 582435]
  - [block] cfq-iosched: kill cfq_exit_lock (Jeff Moyer) [607483 582435]
  - [fs] cifs: fix kernel BUG with remote OS/2 server (Jeff Layton) [608587 608588] {CVE-2010-2248}
  - [net] bluetooth: fix possible bad memory access via sysfs (Mauro Carvalho Chehab) [576020 576021] {CVE-2010-1084}
  - [net] tcp: fix rcv mss estimate for lro (Stanislaw Gruszka) [613900 593801]
  - [net] cnic: fix panic when nl msg rcvd when device down (Stanislaw Gruszka) [615260 595862]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.11.2.el5]
changelog:
  - [mm] pass correct mm when growing stack (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] fix up some user-visible effects of stack guard page (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] fix page table unmap for stack guard page properly (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] fix missing unmap for stack guard page failure case (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] keep a guard page below a grow-down stack segment (Jiri Pirko) [607857 607858] {CVE-2010-2240}


author: Don Howard <dhoward@redhat.com> [2.6.18-194.11.4.el5]
changelog:
  - [misc] make compat_alloc_user_space() incorporate the access_ok() (Don Howard) [634463 634464] {CVE-2010-3081}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.12.1.el5]
changelog:
  - [pci] msi: add option for lockless interrupt mode (Prarit Bhargava) [621940 599295]
  - [fs] ecryptfs: fix ecryptfs_uid_hash buffer overflow (Jerome Marchand) [611386 611387] {CVE-2010-2492}
  - [scsi] ips driver sleeps while holding spin_lock (Steve Best) [620661 616961]
  - [fs] gfs2: fix rename causing kernel oops (Robert S Peterson) [614916 602025] {CVE-2010-2798}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.11.2.el5]
changelog:
  - Branch build based on 2.6.18-194.11.1.el5
  - [mm] pass correct mm when growing stack (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] fix up some user-visible effects of stack guard page (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] fix page table unmap for stack guard page properly (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] fix missing unmap for stack guard page failure case (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] keep a guard page below a grow-down stack segment (Jiri Pirko) [607857 607858] {CVE-2010-2240}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.13.1.el5]
changelog:
  - [xen] fix guest crash on non-EPT machine may crash host (Paolo Bonzini) [621429 621430] {CVE-2010-2938}
  - [fs] ext4: consolidate in_range definitions (Eric Sandeen) [624331 624332] {CVE-2010-3015}
  - [mm] add option to skip ZERO_PAGE mmap of /dev/zero (Larry Woodman) [623141 619541]
  - [net] bonding: check if clients MAC addr has changed (Flavio Leitner) [623143 610234]
  - [net] sctp: fix length checks (Neil Horman) [624369 605305]
  - [xen] bring back VMXE/SVME flags (Andrew Jones) [624365 570091]
  - Syncing following patches from branched builds:
  - [mm] accept an abutting stack segment (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] pass correct mm when growing stack (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] fix up some user-visible effects of stack guard page (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] fix page table unmap for stack guard page properly (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] fix missing unmap for stack guard page failure case (Jiri Pirko) [607857 607858] {CVE-2010-2240}
  - [mm] keep a guard page below a grow-down stack segment (Jiri Pirko) [607857 607858] {CVE-2010-2240}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.14.1.el5]
changelog:
  - [s390] dasd: force online does not work (Hendrik Brueckner) [627194 619466]
  - [s390] dasd: allocate fallback cqr for reserve/release (Hendrik Brueckner) [627195 619465]
  - [fs] xfs: fix untrusted inode number lookup (Dave Chinner) [629219 624862]
  - [net] sched: fix some kernel memory leaks (Jiri Pirko) [624904 624638] {CVE-2010-2942}
  - [usb] fix usbfs information leak (Eugene Teo) [566628 566629] {CVE-2010-1083}
  - [fs] xfs: rename XFS_IGET_BULKSTAT to XFS_IGET_UNTRUSTED (Dave Chinner) [624366 607032] {CVE-2010-2943}
  - [fs] xfs: validate untrusted inode numbers during lookup (Dave Chinner) [624366 607032] {CVE-2010-2943}
  - [fs] xfs: always use iget in bulkstat (Dave Chinner) [624366 607032] {CVE-2010-2943}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.15.1.el5]
changelog:
  - [net] cxgb3: don't flush workqueue if called from wq (Doug Ledford) [630978 630124]
  - [net] cxgb3: get fatal parity error status on interrupt (Doug Ledford) [630978 630124]
  - [net] cxgb3: clear fatal parity error register on init (Doug Ledford) [630978 630124]
  - [net] cxgb3: add define for fatal parity error bit (Doug Ledford) [630978 630124]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.17.1.el5]
changelog:
  - Syncing following patch from branched build:
  - [misc] make compat_alloc_user_space() incorporate the access_ok() (Don Howard) [634463 634464] {CVE-2010-3081}


author: Jarod Wilson <jarod@redhat.com> [2.6.18-189.el5]
changelog:
  - [net] wireless fixes from 2.6.32.7 (John Linville) [559711]
  - [net] wireless fixes from 2.6.32.4 (John Linville) [559711]
  - [net] wireless fixes through 2.6.32.3 (John Linville) [559711]
  - [net] wireless fixes from 2.6.32.2 (John Linville) [559711]


author: Jarod Wilson <jarod@redhat.com> [2.6.18-190.el5]
changelog:
  - [x86_64] mce: avoid deadlocks during MCE broadcasts (Prarit Bhargava) [562866]
  - [scsi] device_handler: add netapp to alua dev list (Mike Christie) [562080]
  - [misc] wacom: add Intuos4 support (Don Zickus) [502708]
  - [scsi] be2iscsi: fix eh bugs and enable new hw support (Mike Christie) [564145]
  - [net] ixgbe: initial support of ixgbe PF and VF drivers (Andy Gospodarek) [525577]
  - [fs] ext4: avoid divide by 0 when mounting corrupted fs (Eric Sandeen) [547253]
  - [net] bnx2x: update to 1.52.1-6 firmware (Stanislaw Gruszka) [560556]
  - [net] bnx2x: update to 1.52.1-6 (Stanislaw Gruszka) [560556]
  - [misc] hvc_iucv: alloc send/receive buffers in DMA zone (Hendrik Brueckner) [566202]
  - [net] ixgbe: prevent speculatively processing descriptors (Steve Best) [566309]
  - [fs] fix randasys crashes x86_64 systems regression (Peter Bogdanovic) [562857]
  - [scsi] fix bugs in fnic and libfc (Mike Christie) [565594]
  - [net] tg3: fix 57765 LED (John Feeney) [566016]
  - [net] tg3: fix race condition with 57765 devices (John Feeney) [565965]
  - [fs] gfs2: use correct GFP for alloc page on write (Steven Whitehouse) [566221]
  - [scsi] lpfc: update version for 8.2.0.63.3p release (Rob Evers) [564506]
  - [scsi] lpfc: fix driver build issues in rhel5.5 (Rob Evers) [564506]
  - [scsi] lpfc: relax event queue field checking (Rob Evers) [564506]
  - [scsi] lpfc: implement the PORT_CAPABITIES mailbox cmd (Rob Evers) [564506]
  - [scsi] lpfc: fix a merge issue (Rob Evers) [564506]
  - [scsi] lpfc: Add support for new SLI features (Rob Evers) [564506]
  - [scsi] lpfc: Add support for 64-bit PCI BAR region 0 (Rob Evers) [564506]
  - [nfs] fix a deadlock in the sunrpc code (Steve Dickson) [548846]
  - [fs] ecryptfs: fix metadata in xattr feature regression (Eric Sandeen) [553670]
  - [scsi] qla2xxx: return FAILED if abort command fails (Rob Evers) [559972]
  - [virtio] fix module loading for virtio-balloon module (Anthony Liguori) [564361]
  - [mm] xen: make mmap() with PROT_WRITE (Andrew Jones) [562761]
  - [hwmon] w83627hf: fix data to platform_device_add_data (Dean Nelson) [557172]
  - [hwmon] smsc47m1: fix data to platform_device_add_data (Dean Nelson) [560944]
  - [hwmon] it87: fix sio_data to platform_device_add_data (Dean Nelson) [559950]
  - [hwmon] f71805f: fix sio_data to platform_device_add_data (Dean Nelson) [564399]
  - [base] make platform_device_add_data accept const pointer (Dean Nelson) [557172 559950 560944 564399]
  - [net] forcedeth: fix putting system into S4 (Matthew Garrett) [513203]
  - [net] netfilter: allow changing queue length via netlink (Steve Best) [562945]
  - [mm] i386: fix iounmap's use of vm_struct's size field (Danny Feng) [549465]
  - [ppc] fix sched while atomic error in alignment handler (Steve Best) [543637]
  - [pci] aer: disable advanced error reporting by default (Prarit Bhargava) [559978]
  - [s390] qeth: set default BLKT settings by OSA hw level (Hendrik Brueckner) [559621]
  - [net] e1000e: fix deadlock unloading module on some ICH8 (Andy Gospodarek) [555818]
  - [misc] rwsem: fix a bug in rwsem_is_locked() (Amerigo Wang) [526092]
  - [s390] clear high-order bits after switch to 64-bit mode (Hendrik Brueckner) [546302]


author: Jarod Wilson <jarod@redhat.com> [2.6.18-191.el5]
changelog:
  - [wireless] iwlwifi: fix dual band N-only use on 5x00 (Stanislaw Gruszka) [566696]
  - [net] be2net: critical bugfix from upstream (Ivan Vecera) [567718]
  - [net] tg3: fix 5717 and 57765 asic revs panic under load (John Feeney) [565964]
  - [net] bnx2x: use single tx queue (Stanislaw Gruszka) [567979]
  - [net] igb: fix WoL initialization when disabled in eeprom (Stefan Assmann) [564102]
  - [net] igb: fix warning in igb_ethtool.c (Stefan Assmann) [561076]
  - [net] s2io: restore ability to tx/rx vlan traffic (Neil Horman) [562732]
  - [net] ixgbe: stop unmapping DMA buffers too early (Andy Gospodarek) [568153]
  - [net] e1000e: disable NFS filtering capabilites in ICH hw (Andy Gospodarek) [558809]
  - [net] bnx2: update firmware and version to 2.0.8 (Andy Gospodarek) [561578]
  - [net] mlx4: fix broken SRIOV code (Doug Ledford) [567730]
  - [net] mlx4: pass eth attributes down to vlan interfaces (Doug Ledford) [557109]
  - [x86_64] fix missing 32 bit syscalls on 64 bit (Wade Mealing) [559410]
  - [s390] zcrypt: Do not remove coprocessor on error 8/72 (Hendrik Brueckner) [561067]
  - [misc] usb-serial: add support for Qualcomm modems (Pete Zaitcev) [523888]
  - [scsi] mpt2sas: fix missing initialization (Tomas Henzl) [565637]
  - [i386] mce: avoid deadlocks during MCE broadcasts (Prarit Bhargava) [562862]
  - [x86_64] k8: do not mark early_is_k8_nb as __init (Paolo Bonzini) [567275]
  - [ia64] kdump: fix a deadlock while redezvousing (Neil Horman) [506694]
  - [dm] raid45: constructor error path oops fix (Heinz Mauelshagen) [565494]
  - [mm] prevent severe performance degradation hang fix (Dave Anderson) [544448]
  - [net] cxgb3: memory barrier addition fixup (Steve Best) [561957]


author: Jarod Wilson <jarod@redhat.com> [2.6.18-192.el5]
changelog:
  - [cpu] fix amd l3 cache disable functionality (Jarod Wilson) [517586]
  - [misc] backport upstream strict_strto* functions (Jarod Wilson) [517586]
  - [wireless] rt2x00: fix work cancel race conditions (Stanislaw Gruszka) [562972]
  - [net] igb: fix DCA support for 82580 NICs (Stefan Assmann) [513712]
  - Revert: [ia64] kdump: fix a deadlock while redezvousing (Neil Horman) [506694]
  - [block] cfq: kick busy queues w/o waiting for merged req (Jeff Moyer) [570814]
  - [fs] cifs: max username len check in setup does not match (Jeff Layton) [562947]
  - [fs] cifs: CIFS shouldn't make mountpoints shrinkable (Jeff Layton) [562947]
  - [fs] cifs: fix dentry hash for case-insensitive mounts (Jeff Layton) [562947]
  - [fs] cifs: fix len for converted unicode readdir names (Jeff Layton) [562947]
  - [x86_64] xen: fix missing 32-bit syscalls on 64-bit Xen (Christopher Lalancette) [559410]
  - [fs] gfs2: fix kernel BUG when using fiemap (Abhijith Das) [569610]
  - [net] sctp: backport cleanups for ootb handling (Neil Horman) [555667] {CVE-2010-0008}
  - [xen] vtd: ignore unknown DMAR entries (Don Dugger) [563900]


author: Jarod Wilson <jarod@redhat.com> [2.6.18-193.el5]
changelog:
  - [fs] gfs2: locking fix for potential dos (Steven Whitehouse) [572390] {CVE-2010-0727}
  - [acpi] power_meter: avoid oops on driver load (Matthew Garrett) [566575]
  - [net] r8169: fix assignments in backported net_device_ops (Ivan Vecera) [568040]
  - [net] virtio_net: refill rx buffer on out-of-memory (Herbert Xu) [554078]


author: Jarod Wilson <jarod@redhat.com> [2.6.18-194.el5]
changelog:
  - [net] mlx4: pass attributes down to vlan interfaces (Doug Ledford) [573098]
  - [block] cfq-iosched: fix sequential read perf regression (Jeff Moyer) [571818]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-194.1.1.el5]
changelog:
  - [xen] arpl on MMIO area crashes the guest (Paolo Bonzini) [572979 572982] {CVE-2010-0730}
  - [mm] fix boot on s390x after bootmem overlap patch (Amerigo Wang) [580838 550974]
  - [net] bnx2: avoid restarting cnic in some contexts (Andy Gospodarek) [581148 554706]
  - [iscsi] fix slow failover times (Mike Christie) [580840 570681]
  - [misc] kernel: fix elf load DoS on x86_64 (Danny Feng) [560552 560553] {CVE-2010-0307}
  - [netlink] connector: delete buggy notification code (Jiri Olsa) [561684 561685] {CVE-2010-0410}
  - [sound] hda_intel: avoid divide by zero in azx devices (Jaroslav Kysela) [567171 567172] {CVE-2010-1085}
  - [dvb] fix endless loop when decoding ULE at dvb-core (Mauro Carvalho Chehab) [569241 569242] {CVE-2010-1086}
  - [scsi] fnic: fix tx queue handling (Mike Christie) [580829 576709]
  - [fusion] mptsas: fix event_data alignment (Tomas Henzl) [580832 570000]
  - [edac] fix internal error message in amd64_edac driver (Bhavna Sarathy) [580836 569938]
  - [x86_64] fix floating point state corruption after signal (Oleg Nesterov) [580841 560891]
  - [mm] don't let reserved memory overlap bootmem_map (Amerigo Wang) [580838 550974]
  - [s390] kernel: correct TLB flush of page table entries (Hendrik Brueckner) [580839 545527]
  - [xen] iommu: clear IO-APIC pins on boot and shutdown (Paolo Bonzini) [580199 548201]
  - [xen] vtd: fix ioapic pin array (Don Dugger) [581150 563546]


author: Jarod Wilson <jarod@redhat.com> [2.6.18-301.el5]
changelog:
  - [net] e1000e: Avoid wrong check on TX hang (Dean Nelson) [746272]
  - [net] tg3: Fix TSO loopback test (John Feeney) [755202]
  - [net] ipvs: Fix memory leak when using one packet scheduler (Thomas Graf) [757882]
  - [net] ipv6: Defer device init until valid qdisc specified (Neil Horman) [758736]
  - [block] nbd: prevent sock_xmit from attempting to use NULL socket (Jeff Moyer) [676491]
  - [net] tg3: Scale back code that modifies MRRS (John Feeney) [758882]
  - [fs] xfs: Fix memory corruption in xfs_readlink (Carlos Maiolino) [749160] {CVE-2011-4077}
  - [net] cxgb3: key cxgb3 driver to work based on NETIF_F_GRO (Neil Horman) [754709]
  - [net] cxgb3: fix vfree BUG halt in rcu calback (Neil Horman) [756410]
  - [net] ipv4: fix IN_DEV_ACCEPT_LOCAL() (Weiping Pan) [758993]
  - [misc] cpu: Fix APIC calibration issues on VMware (Prarit Bhargava) [743368]
  - [net] igb: Loopback functionality support for i350 devices (Stefan Assmann) [758059]


author: Jarod Wilson <jarod@redhat.com> [2.6.18-302.el5]
changelog:
  - [redhat] configs: Include generic ppc64 opts on all ppc64 configs (Alexander Gordeev) [748426]
  - [fs] xfs: don't block on buffer read errors (Boris Ranto) [709223]
  - [fs] nfs: Display lookupcache option in /proc/mounts (Sachin Prabhu) [706305]
  - [net] bonding: Don't allow mode change via sysfs w/slaves present (Veaceslav Falico) [768208]
  - [net] be2net: Fix disabling multicast promiscuous mode (Ivan Vecera) [751998]
  - [net] be2net: Fix endian issue in RX filter command (Ivan Vecera) [751998]
  - [net] be2net: Changing MAC Address of a VF was broken (Ivan Vecera) [751998]
  - [net] be2net: don't create multiple rings in multi channel mode (Ivan Vecera) [751998]
  - [net] be2net: Making die temperature ioctl call async (Ivan Vecera) [751998]
  - [net] be2net: Fix Endian issues in response read log length field (Ivan Vecera) [751998]
  - [net] be2net: Change data type of on die temperature stat (Ivan Vecera) [751998]
  - [net] be2net: Add 60 second delay for dump on recovery from EEH (Ivan Vecera) [751998]
  - [net] be2net: Show newly flashed FW ver in ethtool (Ivan Vecera) [751998]
  - [net] be2net: increase FW update completion timeout (Ivan Vecera) [751998]
  - [net] be2net: Fix race in posting rx buffers (Ivan Vecera) [751998]
  - [net] be2net: Store vid from grp5 event instead of vlan_tag (Ivan Vecera) [751998]
  - [net] be2net: drop pkts that do not belong to the port (Ivan Vecera) [751998]
  - [fs] ext4: fix BUG_ON() in ext4_ext_insert_extent() (Lukas Czerner) [747946] {CVE-2011-3638}


author: Jarod Wilson <jarod@redhat.com> [2.6.18-303.el5]
changelog:
  - [scsi] qla2xxx: Update FC-transport port_state translation matrix (Chad Dupuis) [765866]
  - [scsi] qla2xxx: Don't call alloc_fw_dump for ISP82XX (Chad Dupuis) [765866]
  - [scsi] qla2xxx: Remove qla2x00_wait_for_loop_ready function (Chad Dupuis) [765866]
  - [scsi] qla2xxx: Display FCP_CMND priority on update (Chad Dupuis) [765866]
  - [scsi] qla2xxx: Check for SCSI status on underruns (Chad Dupuis) [765866]
  - [scsi] qla4xxx: v5.02.04.02.05.08-d0 (Chad Dupuis) [769019]
  - [scsi] qla4xxx: clear the RISC interrupt bit during firmware init (Chad Dupuis) [769019]
  - [scsi] qla4xxx: v5.02.04.01.05.08-d0 (Chad Dupuis) [758762]
  - [scsi] qla4xxx: Fix panic due to incorrect tag_value_stride (Chad Dupuis) [758762]
  - [fs] xfs: implement ->dirty_inode to fix timestamp handling (Carlos Maiolino) [653215]
  - [net] drop_monitor: return -EAGAIN on duplicate state changes (Neil Horman) [688791]
  - [net] ipv6: make disable_ipv6 work (Weiping Pan) [760199]
  - [net] bnx2x: fix failure to bring link up on BCM57810 (Michal Schmidt) [751025]
  - [scsi] isci: link speeds default to gen2 (David Milburn) [768151]
  - [fs] jbd: fix race in buffer processing in commit code (Josef Bacik) [756643]
  - [s390] kernel: cpu hotplug vs missing pfault completion interrupt (Hendrik Brueckner) [753194]
  - [block] loop: Don't call loop_unplug on non-configured device (Veaceslav Falico) [617668]
  - [virt] xen/netback: Clear IFF_TX_SKB_SHARING flags (Neil Horman) [753173]
  - [scsi] sd: fix 32-on-64 block device ioctls (Paolo Bonzini) [752386] {CVE-2011-4127}
  - [md] dm: do not forward ioctls from LVs to the underlying devices (Paolo Bonzini) [752386] {CVE-2011-4127}
  - [block] fail SCSI passthrough ioctls on partition devices (Paolo Bonzini) [752386] {CVE-2011-4127}
  - [block] add and use scsi_blk_cmd_ioctl (Paolo Bonzini) [752386] {CVE-2011-4127}


author: Jarod Wilson <jarod@redhat.com> [2.6.18-304.el5]
changelog:
  - [fs] gfs2: Fix inode allocation error path (Robert S Peterson) [767377]
  - [fs] gfs2: Clean up fsync (Robert S Peterson) [767377]
  - [misc] fix list_head userspace export regression error (Jarod Wilson) [772663]
  - [block] disable SG_IO ioctls on virtio-blk devices (Paolo Bonzini) [771592]
  - [net] cxgb4: fix firmware corruption (Neil Horman) [756661]
  - [net] be2net: remove incorrect calls to netif_carrier_off (Ivan Vecera) [771391]
  - [scsi] lpfc: Update lpfc version for 8.2.0.108.3p driver release (Rob Evers) [769385]
  - [scsi] lpfc: Fix panic during EEH recovery on SLI4 FC port (Rob Evers) [769385]
  - [scsi] lpfc: Fix a crash while deleting 256 vports (Rob Evers) [769385]
  - [scsi] lpfc: Fixed OCM failing *_OBJECT mailbox pass-through (Rob Evers) [769385]
  - [scsi] lpfc: Fixed firmware download regression (Rob Evers) [769385]
  - [scsi] lpfc: Fix system crash when LPe16000 fails to initialize (Rob Evers) [769385]


author: Jarod Wilson <jarod@redhat.com> [2.6.18-305.el5]
changelog:
  - [edac] i5000: don't crash before showing the edac error (Mauro Carvalho Chehab) [713034]
  - [Documentation] Add pci=noseg to kernel-parameters.txt (Prarit Bhargava) [743168]
  - [net] ipv6: fix tcp_v6_conn_request (Jiri Benc) [714670]
  - [redhat] update RHEL_MINOR to 8 for 5.8 release (Jarod Wilson) [773033]
  - [misc] Move exit_robust_list to mm_release, null lists on cleanup (Laszlo Ersek) [750283] {CVE-2012-0028}
  - [fs] nfs: Fix an O_DIRECT Oops (Jeff Layton) [754620] {CVE-2011-4325}
  - [xen] x86: fix a few 32-on-64 compat mode issues (Igor Mammedov) [700752]


author: Jarod Wilson <jarod@redhat.com> [2.6.18-306.el5]
changelog:
  - [s390] pfault: ignore leftover completion interrupts (Jarod Wilson) [753194]
  - [cpufreq] powernow-k8: Fix indexing issue (Frank Arnold) [782773]
  - [scsi] device_handler: optimize transition retries (Rob Evers) [733635]
  - [net] qlge: fix size of external list for TX address descriptors (Chad Dupuis) [772696]
  - [net] igmp: Avoid zero delay when rx'ing odd mix of IGMP queries (Jiri Pirko) [772869]
  - [net] be2net: create RSS rings even in multi-channel configs (Ivan Vecera) [773114]
  - [net] ipv6: track device renames in snmp6 (Andy Gospodarek) [758923]
  - [fs] jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer (Eric Sandeen) [783284] {CVE-2011-4086}
  - [fs] epoll: workarounds to preserve kernel ABI (Jason Baron) [681692] {CVE-2011-1083}
  - [fs] epoll: limit paths (Jason Baron) [681692] {CVE-2011-1083}
  - [fs] epoll: prevent creating circular epoll structures (Jason Baron) [681692] {CVE-2011-1083}
  - [fs] epoll: add ep_call_nested() (Jason Baron) [681692] {CVE-2011-1083}
  - [fs] gfs2: additional fix for inode allocation error path (Robert S Peterson) [767377]
  - [fs] gfs2: Revert clean up fsync changes (Robert S Peterson) [767377]
  - [fs] ext4: ignore EXT4_INODE_JOURNAL_DATA flag with delalloc (Lukas Czerner) [769386]
  - [mm] filemap: Make write(2) interruptible by a fatal signal (Lukas Czerner) [740898]
  - [mm] Make task in balance_dirty_pages killable (Lukas Czerner) [740898]
  - [fs] ext4: fix the deadlock in mpage_da_map_and_submit (Lukas Czerner) [740898]
  - [fs] ext4: fix deadlock in ext4_ordered_write_end (Lukas Czerner) [740898]
  - [fs] ext4: mark multi-page IO complete on mapping failure (Lukas Czerner) [740898]
  - [fs] ext4: make invalidate pages handle page range properly (Lukas Czerner) [740898]
  - [fs] ext4: call mpage_da_submit_io from mpage_da_map_blocks (Lukas Czerner) [740898]
  - [fs] nfsd: Avoid excess stack usage in svc_tcp_recvfrom (J. Bruce Fields) [765751]
  - [fs] nfsd: Replace two page lists in struct svc_rqst with one (J. Bruce Fields) [765751]


author: Jarod Wilson <jarod@redhat.com> [2.6.18-307.el5]
changelog:
  - [s390] crypto: Reset sha2 index after processing partial block (David Howells) [677860]
  - Revert: [fs] xfs: implement ->dirty_inode to fix timestamp (Eric Sandeen) [653215]


author: Jarod Wilson <jarod@redhat.com> [2.6.18-308.el5]
changelog:
  - [scsi] lpfc: Update lpfc version for 8.2.0.108.4p driver release (Rob Evers) [784073]
  - [scsi] lpfc: Fix FCP EQ memory check init w/single int vector (Rob Evers) [784073]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.1.1.el5]
changelog:
  - Revert: [scsi] qla2xxx: avoid SCSI host_lock dep in queuecommand (Chad Dupuis) [790907 782790]
  - Revert: [scsi] qla2xxx: fix IO failure during chip reset (Chad Dupuis) [790907 782790]
  - [net] tg3: Fix 4k tx and recovery code (John Feeney) [790910 782677]
  - [net] bnx2x: make bnx2x_close static again (Michal Schmidt) [790912 782124]
  - [net] bnx2x: add fan failure event handling (Michal Schmidt) [790912 782124]
  - [usb] cdc-acm: make lock use interrupt safe (Bryn M. Reeves) [790778 789067]
  - [kernel] sysctl: restrict write access to dmesg_restrict (Phillip Lougher) [749246 749247]
  - [net] igb: reset PHY after recovering from PHY power down (Stefan Assmann) [786168 783043]
  - [fs] prevent lock contention in shrink_dcache_sb via private list (Lachlan McIlroy) [789369 746122]


author: Akemi Yagi <toracat@centos.org> [2.6.18-308.1.1.el5.centos.plus]
changelog:
  - Roll in CentOS Branding
  - added new config files for i686, x86_64 with extra features turned on
    including all Network Adapters, all Video4Linux adapers, all Radio devices,
    JFS, ReiserFS, NCP (Novell partitions) and LDM (Windows Dynamic
    Partitions) BusLogic support.
  - removed the rhel and olpc sections at the beginning of the prep section
    that apply generic templates
  - added reiserfs patch (bug 3156)
  - Note: NTFS is broken in 5.3 (kernels >=2.6.18-128), therefore is not enabled.
    see bug 3363 bugzilla 481495
  - Note: FUSE is enabled in distro kernel as of 5.4 (kernels >=2.6.8.164)
  - Note: Intel wiki LEDS is enabled in distro kernel in 5.4 (bug 3544)
  - Note: Do not enable CONFIG_RTxxxx_LEDS=y ; one or more of them will
    cause compilation to fail.
  - Note: INFINIBAND_AMSO1100 disabled in 5.4 because enabling it leads to a
    comlilation error.
  - added acpi-early-pdc patches (bug 4139)
  - added alps-E6400.patch (bug 4192)
  - added usb-allow-restart.patch (bug 4196)
  - enabled "cx88-dvb.ko" and related modules (bug 4365)
  - replaced bug4192 patch with the one from upstream [bugzilla 564086]
  - enabled irDA modules (bug 4683)
  - three cplus centos patches are now in 5.6, therefore removed.
  - added jfs patch (bug 4747)
  - added sata_via patch (bug 4851)
  - added ata-sch-slave.patch (bug 4923)
  - Two centos patches are now in 5.8, therefore removed.
  - pata_acpi is now disabled (bug 5537)


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.3.1.el5]
changelog:
  - [net] be2net: cancel be_worker during EEH recovery (Ivan Vecera) [805462 773735]
  - [net] be2net: add vlan/rx-mode/flow-control config to be_setup (Ivan Vecera) [805462 773735]
  - [x86] disable TSC synchronization when using kvmclock (Marcelo Tosatti) [805460 799170]
  - [fs] vfs: fix LOOKUP_DIRECTORY not propagated to managed_dentry (Ian Kent) [801726 798809]
  - [fs] vfs: fix d_instantiate_unique (Ian Kent) [801726 798809]
  - [fs] nfs: allow high priority COMMITs to bypass inode commit lock (Jeff Layton) [799941 773777]
  - [fs] nfs: don't skip COMMITs if system under is mem pressure (Jeff Layton) [799941 773777]
  - [scsi] qla2xxx: Read the HCCR register to flush any PCIe writes (Chad Dupuis) [798748 772192]
  - [scsi] qla2xxx: Complete mbox cmd timeout before next reset cycle (Chad Dupuis) [798748 772192]
  - [s390] qdio: wrong buffers-used counter for ERROR buffers (Hendrik Brueckner) [801724 790840]
  - [net] bridge: Reset IPCB when entering IP stack (Herbert Xu) [804721 749813]
  - [fs] procfs: add hidepid= and gid= mount options (Jerome Marchand) [770649 770650]
  - [fs] procfs: parse mount options (Jerome Marchand) [770649 770650]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.6.1.el5]
changelog:
  - [scsi] fc class: fix scanning when devs are offline (Mike Christie) [816684 799530]
  - [md] dm-multipath: delay retry of bypassed pg (Mike Christie) [816684 799530]
  - [net] bonding: properly unset current_arp_slave on slave link up (Veaceslav Falico) [811927 800575]
  - [net] bonding: remove {master,vlan}_ip and query devices instead (Andy Gospodarek) [810321 772216]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.8.1.el5]
changelog:
  - [net] sock: validate data_len before allocating skb in sock_alloc_send_pskb() (Jason Wang) [816290 816106] {CVE-2012-2136}
  - [net] tg3: Fix VLAN tagging assignments (John Feeney) [817691 797011]
  - [net] ixgbe: do not stop stripping VLAN tags in promiscuous mode (Andy Gospodarek) [809791 804800]
  - [s390] zcrypt: Fix parameter checking for ZSECSENDCPRB ioctl (Hendrik Brueckner) [810123 808489]
  - [x86] unwind information fix for the vsyscall DSO (Prarit Bhargava) [807930 805799]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.9.1.el5]
changelog:
  - [fs] jbd: clear b_modified before moving the jh to a different transaction (Josef Bacik) [827205 563247]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.10.1.el5]
changelog:
  - [xen] x86_64: check address on trap handlers or guest callbacks (Paolo Bonzini) [813430 813431] {CVE-2012-0217}
  - [xen] x86_64: Do not execute sysret with a non-canonical return address (Paolo Bonzini) [813430 813431] {CVE-2012-0217}
  - [xen] x86: prevent hv boot on AMD CPUs with Erratum 121 (Laszlo Ersek) [824969 824970] {CVE-2012-2934}
  - [scsi] qla2xxx: Use ha->pdev->revision in 4Gbps MSI-X check. (Chad Dupuis) [816373 800653]
  - [fs] sunrpc: do array overrun check in svc_recv before page alloc (J. Bruce Fields) [820358 814626]
  - [fs] knfsd: fix an NFSD bug with full size non-page-aligned reads (J. Bruce Fields) [820358 814626]
  - [fs] sunrpc: fix oops due to overrunning server's page array (J. Bruce Fields) [820358 814626]
  - [fs] epoll: clear the tfile_check_list on -ELOOP (Jason Baron) [829670 817131]
  - [x86_64] sched: Avoid unnecessary overflow in sched_clock (Prarit Bhargava) [824654 818787]
  - [net] sunrpc: Don't use list_for_each_entry_safe in rpc_wake_up (Steve Dickson) [817571 809937]
  - [s390] qeth: add missing wake_up call (Hendrik Brueckner) [829059 790900]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.11.1.el5]
changelog:
  - [net] ixgbe: remove flow director stats (Andy Gospodarek) [832169 830226]
  - [net] ixgbe: fix default return value for ixgbe_cache_ring_fdir (Andy Gospodarek) [832169 830226]
  - [net] ixgbe: reverting setup redirection table for multiple packet buffers (Andy Gospodarek) [832169 830226]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.13.1.el5]
changelog:
  - [net] e1000e: Cleanup logic in e1000_check_for_serdes_link_82571 (Dean Nelson) [841370 771366]
  - [net] e1000e: Correct link check logic for 82571 serdes (Dean Nelson) [841370 771366]
  - [mm] NULL pointer dereference in __vm_enough_memory (Jerome Marchand) [840077 836244]
  - [fs] dlm: fix slow rsb search in dir recovery (David Teigland) [838140 753244]
  - [fs] autofs: propogate LOOKUP_DIRECTORY flag only for last comp (Ian Kent) [830264 814418]
  - [fs] ext4: properly dirty split extent nodes (Eric Sandeen) [840946 839770]
  - [scsi] don't offline devices with a reservation conflict (David Jeffery) [839196 835660]
  - [fs] ext4: Fix overflow caused by missing cast in ext4_fallocate (Lukas Czerner) [837226 830351]
  - [net] dl2k: Clean up rio_ioctl (Weiping Pan) [818822 818823] {CVE-2012-2313}
  - [x86] sched: Avoid unnecessary overflow in sched_clock (Prarit Bhargava) [835450 834562]
  - [net] tg3: Fix TSO handling (John Feeney) [833182 795672]
  - [input] evdev: use after free from open/disconnect race (David Jeffery) [832448 822166]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.15.1.el5]
changelog:
  - [net] sfc: Fix max no of TSO segments and min TX queue size (Michal Schmidt) [845554 845555] {CVE-2012-3412}
  - [kernel] xacct_add_tsk: fix pure theoretical ->mm use-after-free (Nikola Pajkovsky) [849723 849725] {CVE-2012-3510}
  - [fs] hfsplus: Buffer overflow in the HFS plus filesystem (Jacob Tanenbaum) [820255 820256] {CVE-2012-2319}
  - [net] netfilter: add dscp netfilter match (Thomas Graf) [847327 842029]
  - [net] rds: set correct msg_namelen (Weiping Pan) [822727 822728] {CVE-2012-3430}
  - [misc] ERESTARTNOINTR seen from fork call in userspace (Oleg Nesterov) [847359 693822]
  - [fs] quota: manage reserved space when quota is not active (Eric Sandeen) [847326 818087]
  - [fs] quota: Fix warning if delayed write before quota is enabled (Eric Sandeen) [847326 818087]
  - [fs] ext3: pass custom EOF to generic_file_llseek_size() (Eric Sandeen) [847943 784191]
  - [fs] ext4: use core vfs llseek code for dir seeks (Eric Sandeen) [847943 784191]
  - [fs] vfs: allow custom EOF in generic_file_llseek code (Eric Sandeen) [847943 784191]
  - [fs] ext4: return 32/64-bit dir name hash according to usage type (Eric Sandeen) [847943 784191]
  - [fs] ext4: improve llseek error handling for large seek offsets (Eric Sandeen) [847943 784191]
  - [fs] ext3: return 32/64-bit dir name hash according to usage type (Eric Sandeen) [847943 784191]
  - [s390/ppc64] add is_compat_task() for s390 and ppc64 (Eric Sandeen) [847943 784191]
  - [fs] vfs: add generic_file_llseek_size (Eric Sandeen) [847943 784191]
  - [fs] nfsd: vfs_llseek() with 32 or 64 bit offsets (hashes) (Eric Sandeen) [847943 784191]
  - [fs] nfsd: rename 'int access' to 'int may_flags' in nfsd_open() (Eric Sandeen) [847943 784191]
  - [fs] add new FMODE flags: FMODE_32bithash and FMODE_64bithash (Eric Sandeen) [847943 784191]
  - [fs] nfsd4: Remove check for a 32-bit cookie in nfsd4_readdir() (Eric Sandeen) [847943 784191]
  - [xen] x86: whitelist Enhanced SpeedStep for dom0 (Laszlo Ersek) [846125 809103]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.16.1.el5]
changelog:
  - Revert: [fs] nfsd4: Remove check for a 32-bit cookie in nfsd4_readdir() (Eric Sandeen) [847943 784191]
  - Revert: [fs] add new FMODE flags: FMODE_32bithash and FMODE_64bithash (Eric Sandeen) [847943 784191]
  - Revert: [fs] nfsd: rename 'int access' to 'int may_flags' in nfsd_open() (Eric Sandeen) [847943 784191]
  - Revert: [fs] nfsd: vfs_llseek() with 32 or 64 bit offsets (hashes) (Eric Sandeen) [847943 784191]
  - Revert: [fs] vfs: add generic_file_llseek_size (Eric Sandeen) [847943 784191]
  - Revert: [s390/ppc64] add is_compat_task() for s390 and ppc64 (Eric Sandeen) [847943 784191]
  - Revert: [fs] ext3: return 32/64-bit dir name hash according to usage type (Eric Sandeen) [847943 784191]
  - Revert: [fs] ext4: improve llseek error handling for large seek offsets (Eric Sandeen) [847943 784191]
  - Revert: [fs] ext4: return 32/64-bit dir name hash according to usage type (Eric Sandeen) [847943 784191]
  - Revert: [fs] vfs: allow custom EOF in generic_file_llseek code (Eric Sandeen) [847943 784191]
  - Revert: [fs] ext4: use core vfs llseek code for dir seeks (Eric Sandeen) [847943 784191]
  - Revert: [fs] ext3: pass custom EOF to generic_file_llseek_size() (Eric Sandeen) [847943 784191]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.19.1.el5]
changelog:
  - [net] be2net: Remove code that stops further access to BE NIC based on UE bits (Alexander Gordeev) [867896 862811]
  - [net] netpoll: fix an incorrect check for NULL pointer (Alexander Gordeev) [856079 848098]
  - [net] mlx4: Add support for EEH error recovery (Alexander Gordeev) [847404 798048]
  - [fs] ext4: fix undefined bit shift result in ext4_fill_flex_info (Eric Sandeen) [809688 809689] {CVE-2012-2100}
  - [fs] ext4: fix undefined behavior in ext4_fill_flex_info (Eric Sandeen) [809688 809689] {CVE-2012-2100}
  - [fs] fix crash if block {device|size} read & changed at sametime (Mikulas Patocka) [864823 756506]
  - [x86] mm: randomize SHLIB_BASE (Dave Anderson) [804953 804954] {CVE-2012-1568}
  - [net] ipv6: Fix fib6_dump_table walker leak (Jiri Benc) [861387 819830]
  - [fs] cifs: update cifs_dfs_d_automount caller path (Sachin Prabhu) [858774 857448]
  - [xen] x86: change the default behaviour of CVE-2012-2934 fix (Petr Matousek) [859946 858724]
  - [net] ipvs: allow transmit of GRO aggregated skbs (Jesper Brouer) [857966 854067]
  - [scsi] isci: fixup linkspeed definitions (David Milburn) [854986 833000]
  - [fs] nfs: nfs_d_automount update caller path after do_add_mount (Carlos Maiolino) [857552 834379]
  - [fs] vfs: Fix vfsmount overput on simultaneous automount (Carlos Maiolino) [857552 834379]


author: Johnny Hughes <johnny@centos.org> [2.6.18-308.20.1.el5.centos.plus]
changelog:
  - added new config files for i686, x86_64 with extra features turned on
    including all Network Adapters, all Video4Linux adapers, all Radio devices,
    JFS, ReiserFS, NCP (Novell partitions) and LDM (Windows Dynamic
    Partitions) BusLogic support.
  - removed the rhel and olpc sections at the beginning of the prep section
    that apply generic templates
  - added reiserfs patch (bug 3156)
  - Note: NTFS is broken in 5.3 (kernels >=2.6.18-128), therefore is not enabled.
    see bug 3363 bugzilla 481495
  - Note: FUSE is enabled in distro kernel as of 5.4 (kernels >=2.6.8.164)
  - Note: Intel wiki LEDS is enabled in distro kernel in 5.4 (bug 3544)
  - Note: Do not enable CONFIG_RTxxxx_LEDS=y ; one or more of them will
    cause compilation to fail.
  - Note: INFINIBAND_AMSO1100 disabled in 5.4 because enabling it leads to a
    comlilation error.
  - added acpi-early-pdc patches (bug 4139)
  - added alps-E6400.patch (bug 4192)
  - added usb-allow-restart.patch (bug 4196)
  - enabled "cx88-dvb.ko" and related modules (bug 4365)
  - replaced bug4192 patch with the one from upstream [bugzilla 564086]
  - enabled irDA modules (bug 4683)
  - three cplus centos patches are now in 5.6, therefore removed.
  - added jfs patch (bug 4747)
  - added sata_via patch (bug 4851)
  - added ata-sch-slave.patch (bug 4923)
  - Two centos patches are now in 5.8, therefore removed.
  - pata_acpi is now disabled (bug 5537)


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-308.21.1.el5]
changelog:
  - [fs] ext4: race-cond protect for convert_unwritten_extents_endio (Lukas Czerner) [869910 869911] {CVE-2012-4508}
  - [fs] ext4: serialize fallocate w/ ext4_convert_unwritten_extents (Lukas Czerner) [869910 869911] {CVE-2012-4508}
  - [fs] ext4: flush the i_completed_io_list during ext4_truncate (Lukas Czerner) [869910 869911] {CVE-2012-4508}
  - [net] WARN if struct ip_options was allocated directly by kmalloc (Jiri Pirko) [874973 872612]
  - [net] ipv4: add RCU protection to inet->opt (Jiri Pirko) [872113 855302] {CVE-2012-3552}
  - [scsi] qla2xx: Don't toggle inter bits after IRQ lines attached (Chad Dupuis) [870118 800708]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.23.1.el5]
changelog:
  - [net] bnx2x: Add remote-fault link detection (Alexander Gordeev) [870120 796905]
  - [net] bnx2x: Cosmetic changes (Alexander Gordeev) [870120 796905]
  - [net] rds-ping cause kernel panic (Alexander Gordeev) [822755 822756] {CVE-2012-2372}
  - [xen] add guest address range checks to XENMEM_exchange handlers (Igor Mammedov) [878033 878034] {CVE-2012-5513}
  - [xen] x86/physmap: Prevent incorrect updates of m2p mappings (Igor Mammedov) [870148 870149] {CVE-2012-4537}
  - [xen] VCPU/timer: Dos vulnerability prev overflow in calculations (Igor Mammedov) [870150 870151] {CVE-2012-4535}
  - [scsi] sg: fix races during device removal (Ewan Milne) [868950 861004]


author: Akemi Yagi <toracat@centos.org> [2.6.18-308.4.1.el5.centos.plus]
changelog:
  - Roll in CentOS Branding
  - added new config files for i686, x86_64 with extra features turned on
    including all Network Adapters, all Video4Linux adapers, all Radio devices,
    JFS, ReiserFS, NCP (Novell partitions) and LDM (Windows Dynamic
    Partitions) BusLogic support.
  - removed the rhel and olpc sections at the beginning of the prep section
    that apply generic templates
  - added reiserfs patch (bug 3156)
  - Note: NTFS is broken in 5.3 (kernels >=2.6.18-128), therefore is not enabled.
    see bug 3363 bugzilla 481495
  - Note: FUSE is enabled in distro kernel as of 5.4 (kernels >=2.6.8.164)
  - Note: Intel wiki LEDS is enabled in distro kernel in 5.4 (bug 3544)
  - Note: Do not enable CONFIG_RTxxxx_LEDS=y ; one or more of them will
    cause compilation to fail.
  - Note: INFINIBAND_AMSO1100 disabled in 5.4 because enabling it leads to a
    comlilation error.
  - added acpi-early-pdc patches (bug 4139)
  - added alps-E6400.patch (bug 4192)
  - added usb-allow-restart.patch (bug 4196)
  - enabled "cx88-dvb.ko" and related modules (bug 4365)
  - replaced bug4192 patch with the one from upstream [bugzilla 564086]
  - enabled irDA modules (bug 4683)
  - three cplus centos patches are now in 5.6, therefore removed.
  - added jfs patch (bug 4747)
  - added sata_via patch (bug 4851)
  - added ata-sch-slave.patch (bug 4923)
  - Two centos patches are now in 5.8, therefore removed.
  - pata_acpi is now disabled (bug 5537)
  - added tg3-fix-vlan-tagging patch (bug 5572)


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-308.8.2.el5]
changelog:
  - [xen] x86_64: check address on trap handlers or guest callbacks (Paolo Bonzini) [813430 813431] {CVE-2012-0217}
  - [xen] x86_64: Do not execute sysret with a non-canonical return address (Paolo Bonzini) [813430 813431] {CVE-2012-0217}
  - [xen] x86: prevent hv boot on AMD CPUs with Erratum 121 (Laszlo Ersek) [824969 824970]


author: Jarod Wilson <jarod@redhat.com> [2.6.18-300.el5]
changelog:
  - [pci] intel-iommu: Default to non-coherent for unattached domains (Don Dutile) [753924]
  - [scsi] bfa: update driver embedded firmware to 3.0.0.0 (Rob Evers) [752972]
  - [scsi] bnx2i: Fix endian on TTT for NOP out transmission (Mike Christie) [752626]
  - [input] evdev: Fix spin lock context in evdev_pass_event() (Don Zickus) [734900]
  - [net] bnx2x: Add new PHY BCM54616 (Michal Schmidt) [733889]
  - [scsi] ipr: add definitions for additional adapter (Steve Best) [753910]
  - [scsi] ipr: Fix BUG on adapter dump timeout (Steve Best) [753910]
  - [scsi] ipr: Add support to flash FPGA and flash back DRAM images (Steve Best) [753910]
  - [scsi] ipr: Stop reading adapter dump prematurely (Steve Best) [753910]
  - [char] rtc: fix reported IRQ rate for when HPET is enabled (Prarit Bhargava) [740299]
  - [block] cciss: add Smart Array 5i to the kdump blacklist (Tomas Henzl) [752690]
  - [scsi] qla4xxx: Update version number to V5.02.04.00.05.08-d0 (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Do not recover adapter if in FAILED state (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Fix duplicate targets in BIOS do not show up (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Fix rmmod kernel trace with ql4xdontresethba=1 (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Add ql4xmaxcmds Command Line Parameter (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Correct the locking mechanism (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Minidump implementation (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Device quiescent and loopback changes (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Add new FLT firmware region (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Prevent CPU lockups when ql4xdontresethba is set (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Updated the reset sequence for ISP82xx (Chad Dupuis) [714214]
  - [scsi] qla4xxx: set set_ddb_entry with correct dma buffer (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Reset retry_relogin_timer to trigger a relogin (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Update ddb_entry on fw_ddb_index changes (Chad Dupuis) [714214]
  - [scsi] qla4xxx: BFS issue when same target devices added twice (Chad Dupuis) [714214]
  - [scsi] qla4xxx: mark device missing in recover adapter (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Perform context resets on context failures (Chad Dupuis) [714214]
  - [scsi] qla4xxx: show hardware/firmware regs for more debug info (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Pass correct fw_ddb_index to abort_task (Chad Dupuis) [714214]
  - [scsi] qla4xxx: check command already completed when abort issued (Chad Dupuis) [714214]
  - [scsi] qla4xxx: Use os_target_id to identify a session (Chad Dupuis) [714214]
  - [fs] dcache: Fix dentry loop detection deadlock (David Howells) [717959]
  - [net] cxgb4: fix ability to disable tx cksum and change tso (Neil Horman) [754711]
  - [fs] nfs: when attempting dir open, fall back on normal lookup (Jeff Layton) [740162]
  - [fs] nfs: remove BUG() from encode_share_access() (Jeff Layton) [754901]
  - [fs] epoll: use up all the timeout (Jason Baron) [705138]
  - [s390] qdio: avoid race leading to stall if CQ is used (Hendrik Brueckner) [753193]
  - [scsi] libsas: disable scanning lun > 0 on ata devices (David Milburn) [749309]
  - [scsi] isci: atapi support (David Milburn) [749309]
  - [scsi] isci: initial sgpio write support (David Milburn) [743965]
  - [scsi] isci: fix sgpio register definitions (David Milburn) [743965]
  - [scsi] isci: export phy events via ->lldd_control_phy() (David Milburn) [747670]
  - [scsi] isci: port state should be set to stopping on last phy (David Milburn) [747670]
  - [scsi] isci: fix decode of DONE_CRC_ERR TC completion status (David Milburn) [747670]
  - [scsi] isci: SATA/STP I/O only returned in normal path to libsas (David Milburn) [747670]
  - [scsi] isci: fix support for large smp requests (David Milburn) [747670]
  - [scsi] isci: fix missed unlock in apc_agent_timeout() (David Milburn) [747670]
  - [scsi] isci: fix event-get pointer increment (David Milburn) [747670]
  - [scsi] isci: add version number (David Milburn) [747670]
  - [scsi] isci: dynamic interrupt coalescing (David Milburn) [747670]
  - [scsi] isci: fix sata response handling (David Milburn) [747670]
  - [scsi] isci: Leave requests alone if already terminating (David Milburn) [747670]
  - [misc] irq: Check for spurious IRQ only on disabled IRQs (Prarit Bhargava) [756412]
  - [net] sctp: Fix another race during accept/peeloff (Thomas Graf) [714870]
  - [net] bonding: change slave->speed from u16 to u32 (Weiping Pan) [747547]
  - [scsi] bnx2i: set PF_NOFREEZE in IO thread (Mike Christie) [753729]
  - [fs] hfs: add sanity check for file name length (Eric Sandeen) [755433] {CVE-2011-4330}
  - [fs] aio: remove upper bound on retries (Jeff Moyer) [753271]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-341.el5]
changelog:
  - [fs] ext4: fix missing iput of root for some mount error paths (Phillip Lougher) [845906]
  - [ata] libata-eh: fix slave link EH action mask handling (David Milburn) [855228]
  - [fs] cifs: update cifs_dfs_d_automount caller path (Sachin Prabhu) [857448]
  - [net] bnx2x: fix rx checksum validation for IPv6 (Michal Schmidt) [852096]
  - [fs] tcp: bind() fix autoselection to share ports (Jacob Tanenbaum) [846518]
  - [xen] x86: change the default behaviour of CVE-2012-2934 fix (Petr Matousek) [858724]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-342.el5]
changelog:
  - [fs] nfsd: don't fail unchecked creates of non-special files (J. Bruce Fields) [848666]
  - [fs] nfsd4: return nfserr_symlink on v4 OPEN of non-regular file (J. Bruce Fields) [848666]
  - [sound] alsa: snd-aloop - improve the sample copy accurracy (Jaroslav Kysela) [854008]
  - [sound] alsa: aloop - Fix possible IRQ lock inversion (Jaroslav Kysela) [854008]
  - [sound] alsa: snd-aloop - add pause support (Jaroslav Kysela) [854008]
  - [redhat] kabi: Adding symbol nmi_watchdog (Jiri Olsa) [796988]
  - [redhat] kabi: Adding symbol ip_mc_rejoin_group (Jiri Olsa) [796988]
  - [redhat] kabi: Adding symbol kernel_sock_ioctl (Jiri Olsa) [796988]
  - [redhat] kabi: Adding symbol kernel_bind (Jiri Olsa) [796988]
  - [redhat] kabi: Adding symbol netdev_fix_features (Jiri Olsa) [796988]
  - [redhat] kabi: Adding symbol netdev_increment_features (Jiri Olsa) [796988]
  - [redhat] kabi: Adding symbol unregister_kprobe (Jiri Olsa) [796988]
  - [redhat] kabi: Adding symbol register_kprobe (Jiri Olsa) [796988]
  - [fs] cifs: fix name parsing in CIFSSMBQAllEAs (Sachin Prabhu) [846522]
  - [fs] xfs: obey minleft values during extent allocation correctly (Carlos Maiolino) [611746]
  - [net] vlan support ethtool get driver info (Jacob Tanenbaum) [844277]
  - [net] bnx2x: remove false warning regarding interrupt number (Michal Schmidt) [859158]
  - [net] ipv6: Fix fib6_dump_table walker leak (Jiri Benc) [819830]
  - [scsi] fcoe: move link speed checking into its own routine (Neil Horman) [852340]
  - [net] tg3: fix get stats to avoid lockup (John Feeney) [840864]
  - [pci] Quirk for still enabled interrupts Intel Sandy Bridge GPUs (Prarit Bhargava) [816725]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-343.el5]
changelog:
  - [fs] ext4: correct comments for ext4_free_blocks() (Lukas Czerner) [847975]
  - [fs] ext4: fix i_blocks/quota accounting when extent insert fails (Eric Sandeen) [847975]
  - [fs] ext4: Add flags to the ext4_free_blocks() (Lukas Czerner) [847975]
  - [fs] ext4: fold ext4_free_blocks() and ext4_mb_free_blocks() (Eric Sandeen) [847975]
  - [fs] ext4: fix race in xattr block allocation path (Nikola Pajkovsky) [844854]
  - [misc] kdump: fix crash_kexec()/smp_send_stop() race in panic() (Takahiro MUNEDA) [748004]
  - [char] ipmi: lock si_lock in poll() to avoid system stall (Nikolay Aleksandrov) [795344]
  - [sound] alsa: add one more Haswell PCI ID (Jaroslav Kysela) [831964]
  - [net] tg3: Fix autoneg off (John Feeney) [854827]
  - [net] ethtool: Report link-down while interface is down (Ivan Vecera) [849566]
  - [x86] mm: randomize SHLIB_BASE (Dave Anderson) [804954] {CVE-2012-1568}
  - [net] bnx2x: fix rx performance regression due to small ring size (Michal Schmidt) [852096]
  - [fs] ext4: Add err check after calling ext4_mb_regular_allocator (Eric Sandeen) [833636]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-344.el5]
changelog:
  - [fs] ext4: fix undefined bit shift result in ext4_fill_flex_info (Eric Sandeen) [809689] {CVE-2012-2100}
  - [fs] ext4: fix undefined behavior in ext4_fill_flex_info (Eric Sandeen) [809689] {CVE-2012-2100}
  - [misc] panic: fix a possible deadlock in panic() (Takahiro MUNEDA) [864553]
  - [fs] xfs: ensure f_ffree returned by statfs() is non-negative (Carlos Maiolino) [844961]
  - [fs] fix crash if block {device|size} read & changed at sametime (Mikulas Patocka) [756506]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-345.el5]
changelog:
  - [net] revert igb: Drop unnecessary write of E1000_IMS from ... (Stefan Assmann) [864848]
  - [net] bna: remove tech preview status (Ivan Vecera) [816215]
  - [scsi] bfa: remove tech-preview tainting (Rob Evers) [816212]
  - [scsi] bfa: Fix NULL pointer dereference with vport module unload (Rob Evers) [865962]
  - [scsi] sg: fix races during device removal (Ewan Milne) [861004]
  - [fs] autofs4: fix reset pending flag on mount fail (Ian Kent) [866937]
  - [net] mlx4: Fix an oops in vlan handling (Doug Ledford) [842486]
  - [net] be2net: Remove stops to further access to BE NIC on UE bits (Ivan Vecera) [862811]
  - [net] be2net: Fix traffic stall INTx mode (Ivan Vecera) [857872]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-346.el5]
changelog:
  - [mm] check for populated zone in __drain_pages (Rafael Aquini) [873708]
  - [mm] do not allocate pagesets for unpopulated zones (Rafael Aquini) [873708]
  - [mm] do not check unpopulated zones for draining/counter updates (Rafael Aquini) [873708]
  - [x86] Mark Haswell HDMI Audio as unsupported. (Prarit Bhargava) [874248]
  - [misc] Backport mark_hardware_unsupported() (Prarit Bhargava) [874248]
  - [fs] ext4: race-cond protect for convert_unwritten_extents_endio (Lukas Czerner) [869911] {CVE-2012-4508}
  - [fs] ext4: serialize fallocate w/ ext4_convert_unwritten_extents (Lukas Czerner) [869911] {CVE-2012-4508}
  - [fs] ext4: flush the i_completed_io_list during ext4_truncate (Lukas Czerner) [869911] {CVE-2012-4508}
  - [fs] ext4: init pagevec in ext4_da_block_invalidatepages (Eric Sandeen) [869980]
  - [scsi] megaraid_sas: mark Invader support as tech preview (Tomas Henzl) [855434]
  - [scsi] mpt2sas: Fix panic when drives removed during diag reset (Tomas Henzl) [871422]
  - [net] bnx2x: Fix 57810 1G-KR link against certain switches. (Michal Schmidt) [865639]
  - [fs] Fix FREEZE/THAW compat_ioctl regression (Lukas Czerner) [874029]
  - [net] WARN if struct ip_options was allocated directly by kmalloc (Jiri Pirko) [872612]
  - [net] ipv4: add RCU protection to inet->opt (Jiri Pirko) [855302] {CVE-2012-3552}
  - [net] rds-ping cause kernel panic (Jay Fenlason) [822756] {CVE-2012-2372}
  - [x86] exclude iomem resource over 4G for i686 non PAE kernel (Dave Young) [875743]
  - [fs] ext4: remove mb_groups before tearing down the buddy_cache (Carlos Maiolino) [869135]
  - [fs] ext3: retry failed direct IO allocations (Carlos Maiolino) [657575]
  - [net] svcrpc: enforce a maximum socket buffer size (J. Bruce Fields) [863535]
  - [x86] Revert 'mm: randomize SHLIB_BASE' (Dave Anderson) [871692]
  - [xen] x86: whitelist AMD thermal & power management for dom0 (Laszlo Ersek) [872306]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-347.el5]
changelog:
  - [xen] add guest address range checks to XENMEM_exchange handlers (Igor Mammedov) [878034] {CVE-2012-5513}
  - [xen] x86/physmap: Prevent incorrect updates of m2p mappings (Igor Mammedov) [870149] {CVE-2012-4537}
  - [xen] VCPU/timer: Dos vulnerability prev overflow in calculations (Igor Mammedov) [870151] {CVE-2012-4535}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.1.1.el5]
changelog:
  - [pci] intel-iommu: reduce max num of domains supported (Don Dutile) [886876 885125]
  - [fs] gfs2: Fix leak of cached directory hash table (Steven Whitehouse) [886124 831330]
  - [x86] mm: randomize SHLIB_BASE (Petr Matousek) [804953 804954] {CVE-2012-1568}
  - [net] be2net: create RSS rings even in multi-channel configs (Ivan Vecera) [884702 878209]
  - [net] tg3: Avoid dma read error (John Feeney) [885692 877474]
  - [misc] Fix unsupported hardware message (Prarit Bhargava) [885063 876587]
  - [net] ipv6: discard overlapping fragment (Jiri Pirko) [874837 874838] {CVE-2012-4444}
  - [usb] Fix serial port reference counting on hotplug remove (Don Zickus) [885700 845447]
  - [net] bridge: export its presence and fix bonding igmp reporting (Veaceslav Falico) [884742 843473]
  - [fs] nfs: move wait for server->active from put_super to kill_sb (Jeff Layton) [884708 839839]
  - [scsi] libfc: fix indefinite rport restart (Neil Horman) [884740 595184]
  - [scsi] libfc: Retry a rejected PRLI request (Neil Horman) [884740 595184]
  - [scsi] libfc: Fix remote port restart problem (Neil Horman) [884740 595184]
  - [xen] memop: limit guest specified extent order (Laszlo Ersek) [878449 878450] {CVE-2012-5515}
  - [xen] get bottom of EBDA from the multiboot data structure (Paolo Bonzini) [885062 881885]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.4.1.el5]
changelog:
  - [virt] xen-netback: backports (Andrew Jones) [910884 910885] {CVE-2013-0216}
  - [virt] xen-netback: netif_schedulable should take a netif (Andrew Jones) [910884 910885] {CVE-2013-0216}
  - [virt] pciback: rate limit error mess from pciback_enable_msi() (Igor Mammedov) [910876 910877] {CVE-2013-0231}
  - [net] be2net: remove BUG_ON() in be_mcc_compl_is_new() (Ivan Vecera) [923910 907524]
  - [net] ipv4: Update MTU to all related cache entries (Amerigo Wang) [923353 905190]
  - [net] annotate rt_hash_code() users (Amerigo Wang) [923353 905190]
  - [net] xfrm_user: fix info leak in copy_to_user_state() (Thomas Graf) [922426 922427] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_policy() (Thomas Graf) [922426 922427] {CVE-2012-6537}
  - [net] xfrm_user: fix info leak in copy_to_user_tmpl() (Thomas Graf) [922426 922427] {CVE-2012-6537}
  - [net] atm: fix info leak in getsockopt(SO_ATMPVC) (Thomas Graf) [922384 922385] {CVE-2012-6546}
  - [net] atm: fix info leak via getsockname() (Thomas Graf) [922384 922385] {CVE-2012-6546}
  - [net] tun: fix ioctl() based info leaks (Thomas Graf) [922348 922349] {CVE-2012-6547}
  - [net] llc, zero sockaddr_llc struct (Thomas Graf) [922327 922329] {CVE-2012-6542}
  - [net] llc: fix info leak via getsockname() (Thomas Graf) [922327 922329] {CVE-2012-6542}
  - [net] xfrm_user: return error pointer instead of NULL (Thomas Graf) [919386 919387] {CVE-2013-1826}
  - [net] ixgbevf: allocate room for mailbox MSI-X interrupt's name (Laszlo Ersek) [924134 862862]
  - [fs] knfsd: allow nfsd READDIR to return 64bit cookies (Niels de Vos) [924087 918952]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.6.1.el5]
changelog:
  - [char] ipmi: use a tasklet for handling received messages (Tony Camuso) [953435 947732]
  - [char] ipmi: do run_to_completion properly in deliver_recv_msg (Tony Camuso) [953435 947732]
  - [fs] nfs4: fix locking around cl_state_owners list (Dave Wysochanski) [954296 948317]
  - [fs] nfs: Fix bugs on short read (Sachin Prabhu) [952098 924011]
  - [xen] AMD IOMMU: spot missing IO-APIC entries in IVRS table (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] AMD, IOMMU: Make per-device interrupt remap table default (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] AMD, IOMMU: Disable IOMMU if SATA Combined mode is on (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] AMD, IOMMU: On creating entry clean up in remapping tables (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] ACPI: acpi_table_parse() should return handler's err code (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [xen] introduce xzalloc() & Co (Igor Mammedov) [910912 910913] {CVE-2013-0153}
  - [x86] fpu: fix CONFIG_PREEMPT=y corruption of FPU stack (Prarit Bhargava) [948187 731531]
  - [i386] add sleazy FPU optimization (Prarit Bhargava) [948187 731531]
  - [x86-64] non lazy 'sleazy' fpu implementation (Prarit Bhargava) [948187 731531]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.9.1.el5]
changelog:
  - [net] tg3: buffer overflow in VPD firmware parsing (Jacob Tanenbaum) [949939 949940] {CVE-2013-1929}
  - [net] atm: update msg_namelen in vcc_recvmsg() (Nikola Pajkovsky) [955222 955223] {CVE-2013-3222}
  - [fs] ext4: prevent race while walking extent tree for fiemap (Lukas Czerner) [960014 692071]
  - [fs] ext4: Fix possibly very long loop in fiemap (Lukas Czerner) [960014 692071]
  - [fs] ext4: make FIEMAP and delayed allocation play well together (Lukas Czerner) [960014 692071]
  - [fs] ext4: handle NULL p_ext in ext4_ext_next_allocated_block() (Lukas Czerner) [960014 692071]
  - [fs] ext4: drop ec_type from the ext4_ext_cache structure (Lukas Czerner) [960014 692071]
  - [fs] afs: export a couple of core functions for AFS write support (Lukas Czerner) [960014 692071]
  - [net] llc: Fix missing msg_namelen update in llc_ui_recvmsg() (Jesper Brouer) [956096 956097] {CVE-2013-3231}
  - [net] tipc: fix info leaks via msg_name in recv_msg/recv_stream (Jesper Brouer) [956148 956149] {CVE-2013-3235}
  - [net] Bluetooth: RFCOMM Fix info leak in ioctl(RFCOMMGETDEVLIST) (Radomir Vrbovsky) [922406 922407] {CVE-2012-6545}
  - [net] Bluetooth: RFCOMM - Fix info leak via getsockname() (Radomir Vrbovsky) [922406 922407] {CVE-2012-6545}
  - [kernel] kmod: avoid deadlock from recursive request_module call (Frantisek Hrbata) [957152 949568]
  - [kernel] wait_for_helper: SIGCHLD from u/s cause use-after-free (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - [kernel] Fix ____call_usermodehelper errs being silently ignored (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - [kernel] wait_for_helper: remove unneeded do_sigaction() (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - [kernel] kmod: avoid deadlock from recursive kmod call (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - [kernel] kmod: make request_module() killable (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.10.1.el5]
changelog:
  - [net] Bluetooth: fix possible info leak in bt_sock_recvmsg() (Radomir Vrbovsky) [955600 955601] {CVE-2013-3224}
  - [net] Bluetooth: HCI & L2CAP information leaks (Jacob Tanenbaum) [922415 922416] {CVE-2012-6544}
  - [misc] signal: use __ARCH_HAS_SA_RESTORER instead of SA_RESTORER (Nikola Pajkovsky) [920503 920504] {CVE-2013-0914}
  - [misc] signal: always clear sa_restorer on execve (Nikola Pajkovsky) [920503 920504] {CVE-2013-0914}
  - [misc] signal: Def __ARCH_HAS_SA_RESTORER for sa_restorer clear (Nikola Pajkovsky) [920503 920504] {CVE-2013-0914}
  - [net] cxgb4: zero out another firmware request struct (Jay Fenlason) [971872 872531]
  - [net] cxgb4: clear out most firmware request structures (Jay Fenlason) [971872 872531]
  - [kernel] Make futex_wait() use an hrtimer for timeout (Prarit Bhargava) [958021 864648]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.11.1.el5]
changelog:
  - Revert: [kernel] kmod: make request_module() killable (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] kmod: avoid deadlock from recursive kmod call (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] wait_for_helper: remove unneeded do_sigaction() (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] Fix ____call_usermodehelper errs being silently ignored (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] wait_for_helper: SIGCHLD from u/s cause use-after-free (Frantisek Hrbata) [858752 858753] {CVE-2012-4398}
  - Revert: [kernel] kmod: avoid deadlock from recursive request_module call (Frantisek Hrbata) [957152 949568]
  - Revert: [x86-64] non lazy sleazy fpu implementation (Prarit Bhargava) [948187 731531]
  - Revert: [i386] add sleazy FPU optimization (Prarit Bhargava) [948187 731531]
  - Revert: [x86] fpu: fix CONFIG_PREEMPT=y corruption of FPU stack (Prarit Bhargava) [948187 731531]
  - Revert: [ia64] fix KABI breakage on ia64 (Prarit Bhargava) [966878 960783]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.12.1.el5]
changelog:
  - Revert: [fs] afs: export a couple of core functions for AFS write support (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: drop ec_type from the ext4_ext_cache structure (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: handle NULL p_ext in ext4_ext_next_allocated_block() (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: make FIEMAP and delayed allocation play well together (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: Fix possibly very long loop in fiemap (Lukas Czerner) [960014 692071]
  - Revert: [fs] ext4: prevent race while walking extent tree for fiemap (Lukas Czerner) [960014 692071]


author: Akemi Yagi <toracat@centos.org> [2.6.18-348.12.1.el5.centos.plus]
changelog:
  - Roll in CentOS Branding
  - added new config files for i686, x86_64 with extra features turned on
    including all Network Adapters, all Video4Linux adapers, all Radio devices,
    JFS, ReiserFS, NCP (Novell partitions) and LDM (Windows Dynamic
    Partitions) BusLogic support.
  - removed the rhel and olpc sections at the beginning of the prep section
    that apply generic templates
  - added reiserfs patch (bug 3156)
  - Note: NTFS is broken in 5.3 (kernels >=2.6.18-128), therefore is not enabled.
    see bug 3363 bugzilla 481495
  - Note: FUSE is enabled in distro kernel as of 5.4 (kernels >=2.6.8.164)
  - Note: Intel wiki LEDS is enabled in distro kernel in 5.4 (bug 3544)
  - Note: Do not enable CONFIG_RTxxxx_LEDS=y ; one or more of them will
    cause compilation to fail.
  - Note: INFINIBAND_AMSO1100 disabled in 5.4 because enabling it leads to a
    comlilation error.
  - added acpi-early-pdc patches (bug 4139)
  - added alps-E6400.patch (bug 4192)
  - added usb-allow-restart.patch (bug 4196)
  - enabled "cx88-dvb.ko" and related modules (bug 4365)
  - replaced bug4192 patch with the one from upstream [bugzilla 564086]
  - enabled irDA modules (bug 4683)
  - three cplus centos patches are now in 5.6, therefore removed.
  - added jfs patch (bug 4747)
  - added sata_via patch (bug 4851)
  - added ata-sch-slave.patch (bug 4923)
  - Two centos patches are now in 5.8, therefore removed.
  - pata_acpi is now disabled (bug 5537)
  - add a patch snd_pci_quirk_lookup-bug6214.patch [bug#6214]
  - added readpage over i_node patch (bug#6351)
  - added acpi-video-device-notify patch (bug 6415)


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.13.1.el5]
changelog:
  - [net] sctp: Disallow new connection on a closing socket (Daniel Borkmann) [976569 974936] {CVE-2013-2206}
  - [net] sctp: Use correct sideffect command in dup cookie handling (Daniel Borkmann) [976569 974936] {CVE-2013-2206}
  - [net] sctp: deal with multiple COOKIE_ECHO chunks (Daniel Borkmann) [976569 974936] {CVE-2013-2206}
  - [net] tcp: bind() use stronger condition for bind_conflict (Flavio Leitner) [980811 957604]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.14.1.el5]
changelog:
  - [net] Fix panic for vlan over gre via tun (Thomas Graf) [983452 981337]
  - [x86] mm: introduce proper mem barriers smp_invalidate_interrupt (Rafael Aquini) [983628 865095]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.15.1.el5]
changelog:
  - [fs] nfs: flush cached dir information slightly more readily (Scott Mayhew) [976441 853145]
  - [fs] nfs: Fix resolution prob with cache_change_attribute (Scott Mayhew) [976441 853145]
  - [fs] nfs: define function to update nfsi->cache_change_attribute (Scott Mayhew) [976441 853145]
  - [net] af_key: fix info leaks in notify messages (Jiri Benc) [980999 981000] {CVE-2013-2234}
  - [net] af_key: initialize satype in key_notify_policy_flush() (Jiri Benc) [981222 981224] {CVE-2013-2237}
  - [net] ipv6: ip6_sk_dst_check() must not assume ipv6 dst (Jiri Pirko) [981556 981557] {CVE-2013-2232}
  - [net] fix invalid free in ip_cmsg_send() callers (Petr Matousek) [980141 980142] {CVE-2013-2224}
  - [x86_64] Early segment setup for VT (Paolo Bonzini) [979920 978305]
  - [block] cpqarray: info leak in ida_locked_ioctl() (Tomas Henzl) [971245 971246] {CVE-2013-2147}
  - [block] cdrom: use kzalloc() for failing hardware (Frantisek Hrbata) [973103 973104] {CVE-2013-2164}
  - [mm] Break out when there is nothing more to write for the fs. (Larry Woodman) [972583 965359]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.16.1.el5]
changelog:
  - [x86_64] Fix kdump failure due to 'x86_64: Early segment setup' (Paolo Bonzini) [988251 987244]
  - [xen] skip tracing if it was disabled instead of dying (Igor Mammedov) [987976 967053]
  - [ia64] fix KABI breakage on ia64 (Prarit Bhargava) [966878 960783]
  - [x86] fpu: fix CONFIG_PREEMPT=y corruption of FPU stack (Prarit Bhargava) [948187 731531]
  - [i386] add sleazy FPU optimization (Prarit Bhargava) [948187 731531]
  - [x86-64] non lazy 'sleazy' fpu implementation (Prarit Bhargava) [948187 731531]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.17.1.el5]
changelog:
  - [net] be2net: Fix to avoid hardware workaround when not needed (Ivan Vecera) [999819 995961]
  - [net] be2net: Mark checksum fail for IP fragmented packets (Ivan Vecera) [983864 956322]
  - [net] be2net: Avoid double insertion of vlan tags (Ivan Vecera) [983864 956322]
  - [net] be2net: disable TX in be_close() (Ivan Vecera) [983864 956322]
  - [net] be2net: fix EQ from getting full while cleaning RX CQ (Ivan Vecera) [983864 956322]
  - [net] be2net: avoid napi_disable() when not enabled (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix receive Multicast Packets w/ Promiscuous mode (Ivan Vecera) [983864 956322]
  - [net] be2net: Fixed memory leak (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix PVID tag offload for packets w/ inline VLAN tag (Ivan Vecera) [983864 956322]
  - [net] be2net: fix a Tx stall bug caused by a specific ipv6 packet (Ivan Vecera) [983864 956322]
  - [net] be2net: Remove an incorrect pvid check in Tx (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix issues in error recovery with wrong queue state (Ivan Vecera) [983864 956322]
  - [net] netpoll: revert 6bdb7fe3104 and fix be_poll() instead (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix to parse RSS hash Receive completions correctly (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix cleanup path when EQ creation fails (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix Endian (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix to trim skb for padded vlan packets (Ivan Vecera) [983864 956322]
  - [net] be2net: Explicitly clear reserved field in Tx Descriptor (Ivan Vecera) [983864 956322]
  - [net] be2net: remove unnecessary usage of unlikely() (Ivan Vecera) [983864 956322]
  - [net] be2net: do not modify PCI MaxReadReq size (Ivan Vecera) [983864 956322]
  - [net] be2net: cleanup be_vid_config() (Ivan Vecera) [983864 956322]
  - [net] be2net: don't call vid_config() when there no vlan config (Ivan Vecera) [983864 956322]
  - [net] be2net: Ignore status of some ioctls during driver load (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix wrong status getting returned for MCC commands (Ivan Vecera) [983864 956322]
  - [net] be2net: Fix VLAN/multicast packet reception (Ivan Vecera) [983864 956322]
  - [net] be2net: fix wrong frag_idx reported by RX CQ (Ivan Vecera) [983864 956322]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.18.1.el5]
changelog:
  - [net] be2net: enable polling prior enabling interrupts globally (Ivan Vecera) [1005239 987539]
  - [kernel] signals: stop info leak via tkill and tgkill syscalls (Oleg Nesterov) [970874 970875] {CVE-2013-2141}
  - [net] ipv6: do udp_push_pending_frames AF_INET sock pending data (Jiri Benc) [987647 987648] {CVE-2013-4162}
  - [mm] use-after-free in madvise_remove() (Jacob Tanenbaum) [849735 849736] {CVE-2012-3511}
  - [fs] autofs: remove autofs dentry mount check (Ian Kent) [1001488 928098]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.2.1.el5]
changelog:
  - [misc] tainted flags, fix buffer size (Prarit Bhargava) [905829 901547]
  - [net] be2net: fix unconditionally returning IRQ_HANDLED in INTx (Ivan Vecera) [884704 878316]
  - [net] be2net: fix INTx ISR for interrupt behaviour on BE2 (Ivan Vecera) [884704 878316]
  - [net] be2net: fix a possible events_get() race on BE2 (Ivan Vecera) [884704 878316]
  - [firmware] Expand kernel boot-time storage for DMI table structs (Lenny Szubowicz) [902683 862865]
  - [fs] udf: Fortify loading of sparing table (Nikola Pajkovsky) [843140 843141] {CVE-2012-3400}
  - [fs] udf: Improve table length check to avoid possible overflow (Nikola Pajkovsky) [843140 843141] {CVE-2012-3400}
  - [fs] udf: Avoid run away loop when partition table is corrupted (Nikola Pajkovsky) [843140 843141] {CVE-2012-3400}


author: Akemi Yagi <toracat@centos.org> [2.6.18-348.2.1.el5.centos.plus]
changelog:
  - Roll in CentOS Branding
  - added new config files for i686, x86_64 with extra features turned on
    including all Network Adapters, all Video4Linux adapers, all Radio devices,
    JFS, ReiserFS, NCP (Novell partitions) and LDM (Windows Dynamic
    Partitions) BusLogic support.
  - removed the rhel and olpc sections at the beginning of the prep section
    that apply generic templates
  - added reiserfs patch (bug 3156)
  - Note: NTFS is broken in 5.3 (kernels >=2.6.18-128), therefore is not enabled.
    see bug 3363 bugzilla 481495
  - Note: FUSE is enabled in distro kernel as of 5.4 (kernels >=2.6.8.164)
  - Note: Intel wiki LEDS is enabled in distro kernel in 5.4 (bug 3544)
  - Note: Do not enable CONFIG_RTxxxx_LEDS=y ; one or more of them will
    cause compilation to fail.
  - Note: INFINIBAND_AMSO1100 disabled in 5.4 because enabling it leads to a
    comlilation error.
  - added acpi-early-pdc patches (bug 4139)
  - added alps-E6400.patch (bug 4192)
  - added usb-allow-restart.patch (bug 4196)
  - enabled "cx88-dvb.ko" and related modules (bug 4365)
  - replaced bug4192 patch with the one from upstream [bugzilla 564086]
  - enabled irDA modules (bug 4683)
  - three cplus centos patches are now in 5.6, therefore removed.
  - added jfs patch (bug 4747)
  - added sata_via patch (bug 4851)
  - added ata-sch-slave.patch (bug 4923)
  - Two centos patches are now in 5.8, therefore removed.
  - pata_acpi is now disabled (bug 5537)
  - add a patch snd_pci_quirk_lookup-bug6214.patch [bug#6214]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-348.3.1.el5]
changelog:
  - [utrace] ensure arch_ptrace() can never race with SIGKILL (Oleg Nesterov) [912071 912072] {CVE-2013-0871}
  - [x86] msr: Add capabilities check (Nikola Pajkovsky) [908696 908697] {CVE-2013-0268}


author: Akemi Yagi <toracat@centos.org> [2.6.18-348.4.1.el5.centos.plus]
changelog:
  - Roll in CentOS Branding
  - added new config files for i686, x86_64 with extra features turned on
    including all Network Adapters, all Video4Linux adapers, all Radio devices,
    JFS, ReiserFS, NCP (Novell partitions) and LDM (Windows Dynamic
    Partitions) BusLogic support.
  - removed the rhel and olpc sections at the beginning of the prep section
    that apply generic templates
  - added reiserfs patch (bug 3156)
  - Note: NTFS is broken in 5.3 (kernels >=2.6.18-128), therefore is not enabled.
    see bug 3363 bugzilla 481495
  - Note: FUSE is enabled in distro kernel as of 5.4 (kernels >=2.6.8.164)
  - Note: Intel wiki LEDS is enabled in distro kernel in 5.4 (bug 3544)
  - Note: Do not enable CONFIG_RTxxxx_LEDS=y ; one or more of them will
    cause compilation to fail.
  - Note: INFINIBAND_AMSO1100 disabled in 5.4 because enabling it leads to a
    comlilation error.
  - added acpi-early-pdc patches (bug 4139)
  - added alps-E6400.patch (bug 4192)
  - added usb-allow-restart.patch (bug 4196)
  - enabled "cx88-dvb.ko" and related modules (bug 4365)
  - replaced bug4192 patch with the one from upstream [bugzilla 564086]
  - enabled irDA modules (bug 4683)
  - three cplus centos patches are now in 5.6, therefore removed.
  - added jfs patch (bug 4747)
  - added sata_via patch (bug 4851)
  - added ata-sch-slave.patch (bug 4923)
  - Two centos patches are now in 5.8, therefore removed.
  - pata_acpi is now disabled (bug 5537)
  - add a patch snd_pci_quirk_lookup-bug6214.patch [bug#6214]
  - added readpage over i_node patch (bug#6351)


author: Phillip Lougher <plougher@redhat.com> [2.6.18-340.el5]
changelog:
  - [fs] cifs: Invalidate file cache in case of posix open (Sachin Prabhu) [852526]
  - [scsi] bfa: Address memory leaks in rare cases (Rob Evers) [843634]
  - [scsi] bfa: add comment regarding firmware versioning (Rob Evers) [843634]
  - [scsi] bfa: set correct return codes, misc. cleanup (Rob Evers) [843634]
  - [ia64] export cpu_sibling_map (like i386 and x86_64) (Nikola Pajkovsky) [847026]
  - [net] sfc: Fix VLAN TX offload features (Michal Schmidt) [847026]
  - [net] sfc: Set default parallelism to per-core by default (Michal Schmidt) [847026]
  - [net] sfc: Remove ancient support for nesting of TX stop (Michal Schmidt) [847026]
  - [net] sfc: Properly initialise NAPI context (Michal Schmidt) [847026]
  - [net] sfc: Warn if unable to create MTDs (Michal Schmidt) [847026]
  - [net] sfc: Fix ethtool_ops::get_link (Michal Schmidt) [847026]
  - [x86] amd: Re-enable CPU topology extensions (Frank Arnold) [848487]
  - [x86] amd: Fix L1i/L2 cache sharing info for AMD family 15h procs (Frank Arnold) [848487]
  - [net] bnx2x: Fix compiler warnings (Michal Schmidt) [846985]
  - [net] bnx2x: Fix recovery flow cleanup during probe (Michal Schmidt) [846985]
  - [net] bnx2x: fix unload previous driver flow when flr-capable (Michal Schmidt) [846985]
  - [net] bnx2x: fix mem leak when command is unknown (Michal Schmidt) [846985]
  - [net] bnx2x: Correct EEE statistics gathering (Michal Schmidt) [846985]
  - [net] bnx2x: fix 57840_MF pci id (Michal Schmidt) [846987]
  - [net] bnx2x: Add new 57840 device IDs (Michal Schmidt) [846987]
  - [infiniband] Backport of deactivate_locked_super (Doug Ledford) [846159]
  - [infiniband] More device->class_device conversions (Doug Ledford) [846159]
  - [infiniband] Don't use vmalloc_user (Doug Ledford) [846159]
  - [infiniband] make up for lack of HT_IRQ config option (Doug Ledford) [846159]
  - [infiniband] aio_write not right entrypoint to use in our kernel (Doug Ledford) [846159]
  - [infiniband] Pull in backport from ofed 1.4.2 (Doug Ledford) [846159]
  - [infiniband] Import of backport patch from ofed 1.4.2 (Doug Ledford) [846159]
  - [infiniband] Revert upstream 'cpumask: use new cpumask API ...' (Doug Ledford) [846159]
  - [infiniband] Revert upstream 'IB/ipath: Convert from .nopage ...' (Doug Ledford) [846159]
  - [infiniband] Revert upstream 'IB/ipath: Make ipath_portdata ...' (Doug Ledford) [846159]
  - [infiniband] Revert upstream 'Infiniband: make ipath driver ...' (Doug Ledford) [846159]
  - [infiniband] Enable Kconfig for ipath (Doug Ledford) [846159]
  - [net] ipvs: allow transmit of GRO aggregated skbs (Jesper Brouer) [854067]
  - [scsi] bnx2i: Fixed NULL ptr deference for 1G Linux iSCSI offload (Tomas Henzl) [851320]
  - [net] netpoll: fix an incorrect check for NULL pointer (Amerigo Wang) [848098]
  - [net] bridge: fix bridge module unloading race (Jiri Pirko) [854815]
  - [net] add unknown state to sysfs NIC duplex export (Nikolay Aleksandrov) [853472]
  - [scsi] isci: fixup linkspeed definitions (David Milburn) [833000]
  - [virt] hv: detect hyperv platform through x86_hyper_vendor (Jason Wang) [852692]
  - [misc] lockdep: double MAX_LOCKDEP_ENTRIES (Prarit Bhargava) [852546]
  - [scsi] qla2xx: Don't toggle inter bits after IRQ lines attached (Chad Dupuis) [800708]
  - [fs] autofs4: Merge the remaining dentry ops tables (Ian Kent) [850977]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-365.el5]
changelog:
  - [net] be2net: Mark checksum fail for IP fragmented packets (Ivan Vecera) [956322]
  - [net] be2net: Avoid double insertion of vlan tags (Ivan Vecera) [956322]
  - [net] be2net: disable TX in be_close() (Ivan Vecera) [956322]
  - [net] be2net: fix EQ from getting full while cleaning RX CQ (Ivan Vecera) [956322]
  - [net] be2net: avoid napi_disable() when not enabled (Ivan Vecera) [956322]
  - [net] be2net: Fix receive Multicast Packets w/ Promiscuous mode (Ivan Vecera) [956322]
  - [net] be2net: Fixed memory leak (Ivan Vecera) [956322]
  - [net] be2net: Fix PVID tag offload for packets w/ inline VLAN tag (Ivan Vecera) [956322]
  - [net] be2net: fix a Tx stall bug caused by a specific ipv6 packet (Ivan Vecera) [956322]
  - [net] be2net: Remove an incorrect pvid check in Tx (Ivan Vecera) [956322]
  - [net] be2net: Fix issues in error recovery with wrong queue state (Ivan Vecera) [956322]
  - [net] netpoll: revert 6bdb7fe3104 and fix be_poll() instead (Ivan Vecera) [956322]
  - [net] be2net: Fix to parse RSS hash Receive completions correctly (Ivan Vecera) [956322]
  - [net] be2net: Fix cleanup path when EQ creation fails (Ivan Vecera) [956322]
  - [net] be2net: Fix Endian (Ivan Vecera) [956322]
  - [net] be2net: Fix to trim skb for padded vlan packets (Ivan Vecera) [956322]
  - [net] be2net: Explicitly clear reserved field in Tx Descriptor (Ivan Vecera) [956322]
  - [net] be2net: remove unnecessary usage of unlikely() (Ivan Vecera) [956322]
  - [net] be2net: do not modify PCI MaxReadReq size (Ivan Vecera) [956322]
  - [net] be2net: cleanup be_vid_config() (Ivan Vecera) [956322]
  - [net] be2net: don't call vid_config() when there no vlan config (Ivan Vecera) [956322]
  - [net] be2net: Ignore status of some ioctls during driver load (Ivan Vecera) [956322]
  - [net] be2net: Fix wrong status getting returned for MCC commands (Ivan Vecera) [956322]
  - [net] be2net: Fix VLAN/multicast packet reception (Ivan Vecera) [956322]
  - [net] be2net: fix wrong frag_idx reported by RX CQ (Ivan Vecera) [956322]
  - [infiniband] cxgb4: Compile when CXGB4 is set, not CXGB3 (Doug Ledford) [871555]
  - Revert: [infiniband] qib: add qib, mod ipath to only support HTX (Doug Ledford) [871555]
  - Revert: [infiniband] Enable Kconfig for ipath (Doug Ledford) [871555]
  - Revert: [infiniband] Revert upstream 'Infiniband: make ipath' (Doug Ledford) [871555]
  - Revert: [infiniband] Revert upstream 'IB/ipath: Make ipath_port' (Doug Ledford) [871555]
  - Revert: [infiniband] Revert upstream 'IB/ipath: Convert from ...' (Doug Ledford) [871555]
  - Revert: [infiniband] Revert upstream 'cpumask: use new cpumask' (Doug Ledford) [871555]
  - Revert: [infiniband] Import of backport patch from ofed 1.4.2 (Doug Ledford) [871555]
  - Revert: [infiniband] Pull in backport from ofed 1.4.2 (Doug Ledford) [871555]
  - Revert: [infiniband] aio_write not right entrypoint to use in our (Doug Ledford) [871555]
  - Revert: [infiniband] make up for lack of HT_IRQ config option (Doug Ledford) [871555]
  - Revert: [infiniband] Don't use vmalloc_user (Doug Ledford) [871555]
  - Revert: [infiniband] More device->class_device conversions (Doug Ledford) [871555]
  - Revert: [scsi] qla4xxx: ISP8xxx: Correct retry of adapter initial (Chad Dupuis) [978150]
  - [net] af_key: fix info leaks in notify messages (Jiri Benc) [981000] {CVE-2013-2234}
  - [net] af_key: initialize satype in key_notify_policy_flush() (Jiri Benc) [981224] {CVE-2013-2237}
  - [net] Fix panic for vlan over gre via tun (Thomas Graf) [981337]
  - [net] ipv6: ip6_sk_dst_check() must not assume ipv6 dst (Jiri Pirko) [981557] {CVE-2013-2232}


author: Phillip Lougher <plougher@redhat.com> [2.6.18-366.el5]
changelog:
  - [net] be2net: Activate new FW after FW download for Lancer (Ivan Vecera) [982590]
  - [net] be2net: Fix initialization sequence for Lancer (Ivan Vecera) [982590]
  - [net] be2net: Fix FW download in Lancer (Ivan Vecera) [982590]
  - [net] qlge: Fix receive path to drop error frames (Chad Dupuis) [975852]
  - [net] qlge: remove NETIF_F_TSO6 flag (Chad Dupuis) [975852]
  - [net] qlge: Moving low level frame error to ethtool statistics (Chad Dupuis) [975852]
  - [net] qlge: Fixed double pci free on tx_ring->q allocation fail (Chad Dupuis) [975852]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-367.el5]
changelog:
  - [net] ipv6: do udp_push_pending_frames AF_INET sock pending data (Jiri Benc) [987648] {CVE-2013-4162}
  - [net] mlx4: restore pre-RHEL5.9 default value of log_num_mac (Michal Schmidt) [968352]
  - [x86_64] Fix kdump failure due to 'x86_64: Early segment setup' (Paolo Bonzini) [987244]
  - [fs] vfs: remove unused __d_splice_alias argument (J. Bruce Fields) [785916]
  - [fs] vfs: stop d_splice_alias creating directory aliases (J. Bruce Fields) [785916]
  - [xen] skip tracing if it was disabled instead of dying (Igor Mammedov) [967053]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-368.el5]
changelog:
  - [net] tg3: Add read dma workaround for 5720 (Ivan Vecera) [984064]
  - [net] tg3: Add New 5719 Read DMA workaround (Ivan Vecera) [984064]
  - [net] vlan: fix perf regression due to missing features flags (Michal Schmidt) [977711]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-369.el5]
changelog:
  - [fs] nlm: Ensure we resend pending blocking locks after a reclaim (Steve Dickson) [918592]
  - [kernel] kmod: kthread_run causes oom killer deadlock (Frantisek Hrbata) [983506]
  - [fs] nfs4: ratelimit some messages, add name to bad seq-id mess (Dave Wysochanski) [953121]
  - [fs] nfsd: fix EXDEV checking in rename (J. Bruce Fields) [515599]
  - [misc] tty: Fix abusers of current-sighand->tty (Aaron Tomlin) [858981]
  - [net] ipv6: don't call addrconf_dst_alloc again when enable lo (Jiri Benc) [981417]
  - [redhat] kabi: Adding symbol fc_fabric_login (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_recv (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_mgr_reset (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_lport_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_recv (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_lport_destroy (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_els_send (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_destroy (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_fabric_logoff (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_set_mfs (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_elsct_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_link_up (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_recv_flogi (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_change_queue_depth (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fcoe_ctlr_link_down (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_change_queue_type (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_mgr_free (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_exch_mgr_alloc (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_lport_config (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_disc_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol strict_strtoul (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_rport_init (Jiri Olsa) [864256]
  - [redhat] kabi: Adding symbol fc_get_host_port_state (Jiri Olsa) [864256]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-370.el5]
changelog:
  - [net] be2net: Fix to avoid hardware workaround when not needed (Ivan Vecera) [995961]
  - [kernel] signals: stop info leak via tkill and tgkill syscalls (Oleg Nesterov) [970875] {CVE-2013-2141}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.1.1.el5]
changelog:
  - [crypto] ansi_cprng fix off by one err in non-block size request (Neil Horman) [1007692 1007693] {CVE-2013-4345}
  - [fs] gfs2: yield() in shrinker to allow glock_workqueues to run (Abhijith Das) [1014714 928518]
  - [net] ipv6: ipv6_create_tempaddr cleanup (Petr Holasek) [999361 999362] {CVE-2013-0343}
  - [net] ipv6: remove max_addresses check from ipv6_create_tempaddr (Petr Holasek) [999361 999362] {CVE-2013-0343}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.1.2.el5]
changelog:
  - [xen] x86: check segment descriptor read result in 64-bit OUTS emulation (Radim Krcmar) [1012958 1012959] {CVE-2013-4368}
  - [md] dm snapshot: fix data corruption (Mikulas Patocka) [1004734 975353] {CVE-2013-4299}


author: Akemi Yagi <toracat@centos.org> [2.6.18-371.1.2.el5.centos.plus]
changelog:
  - Roll in CentOS Branding
  - added new config files for i686, x86_64 with extra features turned on
    including all Network Adapters, all Video4Linux adapers, all Radio devices,
    JFS, ReiserFS, NCP (Novell partitions) and LDM (Windows Dynamic
    Partitions) BusLogic support.
  - removed the rhel and olpc sections at the beginning of the prep section
    that apply generic templates
  - added reiserfs patch (bug 3156)
  - Note: NTFS is broken in 5.3 (kernels >=2.6.18-128), therefore is not enabled.
    see bug 3363 bugzilla 481495
  - Note: FUSE is enabled in distro kernel as of 5.4 (kernels >=2.6.8.164)
  - Note: Intel wiki LEDS is enabled in distro kernel in 5.4 (bug 3544)
  - Note: Do not enable CONFIG_RTxxxx_LEDS=y ; one or more of them will
    cause compilation to fail.
  - Note: INFINIBAND_AMSO1100 disabled in 5.4 because enabling it leads to a
    comlilation error.
  - added acpi-early-pdc patches (bug 4139)
  - added alps-E6400.patch (bug 4192)
  - added usb-allow-restart.patch (bug 4196)
  - enabled "cx88-dvb.ko" and related modules (bug 4365)
  - replaced bug4192 patch with the one from upstream [bugzilla 564086]
  - enabled irDA modules (bug 4683)
  - three cplus centos patches are now in 5.6, therefore removed.
  - added jfs patch (bug 4747)
  - added sata_via patch (bug 4851)
  - added ata-sch-slave.patch (bug 4923)
  - Two centos patches are now in 5.8, therefore removed.
  - pata_acpi is now disabled (bug 5537)
  - add a patch snd_pci_quirk_lookup-bug6214.patch [bug#6214] (removed as of 2.6.18-371)
  - added readpage over i_node patch (bug#6351) (removed as of 2.6.18-371)
  - added acpi-video-device-notify patch (bug 6415)


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.3.1.el5]
changelog:
  - [net] be2net: don't use GRO for packets w/ re-inserted VLAN tags (Ivan Vecera) [1023348 1008691]
  - [net] tg3: call pci_enable_wake() to set power state (John Feeney) [1014973 996331]
  - [misc] backport fixes for percpu-rw-semaphore (Mikulas Patocka) [1014715 867997]
  - [xen] information leak via I/O instruction emulation (Igor Mammedov) [1009602 1009603] {CVE-2013-4355}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.4.1.el5]
changelog:
  - [char] ipmi: fix message handling during panics (Tony Camuso) [1049731 995293]
  - [net] igb: Use 32bit mask calculating the flow control watermarks (Stefan Assmann) [1041694 1036115]
  - [fs] NTLM auth and sign - Use appropriate server challenge (Sachin Prabhu) [1029865 1018286]
  - [xen] gnttab: correct locking order reversal (Radim Krcmar) [1026245 1026246] {CVE-2013-4494}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.6.1.el5]
changelog:
  - [net] be2net: don't use skb_get_queue_mapping() (Ivan Vecera) [1066302 1063955]
  - [ipc] change refcount to atomic_t (Phillip Lougher) [1024866 1024868] {CVE-2013-4483}
  - [s390] qeth: buffer overflow in snmp ioctl (Jacob Tanenbaum) [1034402 1034404] {CVE-2013-6381}
  - [scsi] AACRAID Driver compat IOCTL missing capability check (Jacob Tanenbaum) [1033531 1033532] {CVE-2013-6383}
  - [xen] x86/AMD: work around erratum 793 (Radim Krcmar) [1035834 1035836] {CVE-2013-6885}
  - [xen] do not expose hypercalls to rings 1 and 2 of HVM guests (Andrew Jones) [1029112 1029113] {CVE-2013-4554}
  - [redhat] kabi: Adding symbol print_hex_dump (Jiri Olsa) [1054055 662558]
  - [scsi] Add 'eh_deadline' to limit SCSI EH runtime (Ewan Milne) [1050097 956132]
  - [scsi] remove check for 'resetting' (Ewan Milne) [1050097 956132]
  - [scsi] dc395: Move 'last_reset' into internal host structure (Ewan Milne) [1050097 956132]
  - [scsi] tmscsim: Move 'last_reset' into host structure (Ewan Milne) [1050097 956132]
  - [scsi] advansys: Remove 'last_reset' references (Ewan Milne) [1050097 956132]
  - [scsi] dpt_i2o: return SCSI_MLQUEUE_HOST_BUSY when in reset (Ewan Milne) [1050097 956132]
  - [scsi] dpt_i2o: Remove DPTI_STATE_IOCTL (Ewan Milne) [1050097 956132]
  - [net] ipv6: fix leaking uninit port number of offender sockaddr (Florian Westphal) [1035880 1035881] {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263}
  - [net] fix addr_len/msg->msg_namelen assign in recv_error funcs (Florian Westphal) [1035880 1035881] {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263}
  - [net] prevent leakage of uninitialized memory to user in recv (Florian Westphal) [1035880 1035881] {CVE-2013-7264 CVE-2013-7265 CVE-2013-7281 CVE-2013-7263}
  - [net] be2net: prevent Tx stall on SH-R when packet size < 32 (Ivan Vecera) [1051535 1007995]
  - [net] be2net: Trim padded packets for Lancer (Ivan Vecera) [1051535 1007995]
  - [net] be2net: Pad skb to meet min Tx pkt size in lancer (Ivan Vecera) [1051535 1007995]
  - [net] be2net: refactor HW workarounds in be_xmit() (Ivan Vecera) [1051535 1007995]
  - [fs] exec/ptrace: fix get_dumpable() incorrect tests (Petr Oros) [1039483 1039484] {CVE-2013-2929}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.7.1.el5]
changelog:
  - [s390x] af_iucv: Kernel panic during connect (IUCV transport) (Hendrik Brueckner) [1077045 1026388]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.8.1.el5]
changelog:
  - [virt] HID: memory corruption flaw drivers/usb/input/hid-core.c (Jacob Tanenbaum) [1032996 1032999] {CVE-2013-2888}
  - [virt] HID: memory corruption flaw in drivers/hv/hid-core.c (Jacob Tanenbaum) [1032996 1032999] {CVE-2013-2888}
  - [scsi] lpfc: Fix task management commands having a fixed timeout (Ewan Milne) [1073123 1061120]
  - [net] tcp: drop SYN+FIN messages (Jiri Pirko) [1066057 1066058] {CVE-2012-6638}
  - [fs] GFS2: Check if glock held in gfs2_readpage (Robert S Peterson) [1073953 1063434]
  - [net] sunrpc: fix deadlock in task wakeup code (Jeff Layton) [1073731 998126]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.9.1.el5]
changelog:
  - [nfs] sunrpc: don't use a credential with extra groups (Mateusz Guzik) [1095062 976201]
  - [scsi] lpfc: Remove NDLP reference put in lpfc_cmpl_els_logo_acc (Rob Evers) [1096061 1075228]
  - [infiniband] rds: dereference of a NULL device (Jacob Tanenbaum) [1079216 1079217] {CVE-2013-7339}
  - [kernel] futex: check relative timeouts for overflow (Denys Vlasenko) [1091832 1084168]
  - [virt] kvm: correctly detect KVM when hv emulation is enalbed (Jason Wang) [1094152 985767]
  - [security] Fix spurious warnings in security_ops_task_setrlimit (Mateusz Guzik) [1092869 916235]
  - [block] floppy: don't write kernel-only members to FDRAWCMD output (Denys Vlasenko) [1094302 1094303] {CVE-2014-1738 CVE-2014-1737}
  - [block] floppy: ignore kernel-only members in FDRAWCMD input (Denys Vlasenko) [1094302 1094303] {CVE-2014-1738 CVE-2014-1737}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.11.1.el5]
changelog:
  - [fs] dcache: fix cleanup on warning in d_splice_alias (Denys Vlasenko) [1109720 1080606]
  - [net] neigh: Make neigh_add_timer symmetrical to neigh_del_timer (Marcelo Ricardo Leitner) [1111195 1109888]
  - [net] neigh: set NUD_INCOMPLETE when probing router reachability (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: router reachability probing (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: probe routes asynchronous in rt6_probe (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ndisc: Update neigh->updated with write lock (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: remove the unnecessary statement in find_match() (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: fix route selection if CONFIG_IPV6_ROUTER_PREF unset (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: Fix def route failover when CONFIG_IPV6_ROUTER_PREF=n (Marcelo Ricardo Leitner) [1106354 1090806]
  - [net] ipv6: Prefer reachable nexthop only if the caller requests (Marcelo Ricardo Leitner) [1106354 1090806]
  - [fs] ext4/jbd2: don't wait forever stale tid caused by wraparound (Eric Sandeen) [1097528 980268]
  - [fs] ext4: Initialize fsync transaction ids in ext4_new_inode() (Eric Sandeen) [1097528 980268]
  - [fs] jbd2: don't wake kjournald unnecessarily (Eric Sandeen) [1097528 980268]
  - [fs] jbd2: fix fsync() tid wraparound bug (Eric Sandeen) [1097528 980268]
  - [infiniband] rds: do not deref NULL dev in rds_iw_laddr_check() (Jacob Tanenbaum) [1093311 1093312] {CVE-2014-2678}
  - [fs] nfs4: Add recovery for individual stateids - partial backport. (Dave Wysochanski) [1113468 867570]
  - [fs] nfs4: Don't start state recovery in nfs4_close_done - clean backport. (Dave Wysochanski) [1113468 867570]
  - [xen] page-alloc: scrub anonymous domain heap pages upon freeing (Vitaly Kuznetsov) [1103648 1103649] {CVE-2014-4021}


author: Akemi Yagi <toracat@centos.org> [2.6.18-371.11.1.el5.centos.plus]
changelog:
  - Roll in CentOS Branding
  - added new config files for i686, x86_64 with extra features turned on
    including all Network Adapters, all Video4Linux adapers, all Radio devices,
    JFS, ReiserFS, NCP (Novell partitions) and LDM (Windows Dynamic
    Partitions) BusLogic support.
  - removed the rhel and olpc sections at the beginning of the prep section
    that apply generic templates
  - added reiserfs patch (bug 3156)
  - Note: NTFS is broken in 5.3 (kernels >=2.6.18-128), therefore is not enabled.
    see bug 3363 bugzilla 481495
  - Note: FUSE is enabled in distro kernel as of 5.4 (kernels >=2.6.8.164)
  - Note: Intel wiki LEDS is enabled in distro kernel in 5.4 (bug 3544)
  - Note: Do not enable CONFIG_RTxxxx_LEDS=y ; one or more of them will
    cause compilation to fail.
  - Note: INFINIBAND_AMSO1100 disabled in 5.4 because enabling it leads to a
    comlilation error.
  - added acpi-early-pdc patches (bug 4139)
  - added alps-E6400.patch (bug 4192)
  - added usb-allow-restart.patch (bug 4196)
  - enabled "cx88-dvb.ko" and related modules (bug 4365)
  - replaced bug4192 patch with the one from upstream [bugzilla 564086]
  - enabled irDA modules (bug 4683)
  - three cplus centos patches are now in 5.6, therefore removed.
  - added jfs patch (bug 4747)
  - added sata_via patch (bug 4851)
  - added ata-sch-slave.patch (bug 4923)
  - Two centos patches are now in 5.8, therefore removed.
  - pata_acpi is now disabled (bug 5537)
  - add a patch snd_pci_quirk_lookup-bug6214.patch [bug#6214] (removed as of 2.6.18-371)
  - added readpage over i_node patch (bug#6351) (removed as of 2.6.18-371)
  - added acpi-video-device-notify patch (bug 6415)
  - enabled CONFIG_USB_SUSPEND (bug 273).


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.12.1.el5]
changelog:
  - [audit] auditsc: audit_krule mask accesses need bounds checking (Denys Vlasenko) [1102702 1102703] {CVE-2014-3917}
  - [mm] writeback: Fix hang when low on memory due to NFS traffic (Larry Woodman) [1125246 1080194]
  - [net] tg3: Fix Read DMA workaround for 5719 A0 (Ivan Vecera) [1121017 924590]
  - [fs] jbd: don't wake kjournald unnecessarily (Denys Vlasenko) [1116027 1081785]
  - [fs] jbd: don't wait (forever) for stale tid caused by wraparound (Denys Vlasenko) [1116027 1081785]
  - [fs] ext4: fix waiting and sending of barrier in ext4_sync_file() (Denys Vlasenko) [1116027 1081785]
  - [fs] jbd2: Add function jbd2_trans_will_send_data_barrier() (Denys Vlasenko) [1116027 1081785]
  - [fs] jbd2: fix sending of data flush on journal commit (Denys Vlasenko) [1116027 1081785]
  - [fs] ext4, jbd2: Add barriers for file systems with ext journals (Denys Vlasenko) [1116027 1081785]
  - [fs] jbd: fix fsync() tid wraparound bug (Denys Vlasenko) [1116027 1081785]
  - [fs] ext4: fix fdatasync() for files with only i_size changes (Eric Sandeen) [1117665 1102768]


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-371.2.1.el5]
changelog:
  - [scsi] mpt2sas: bump version (Tomas Henzl) [1018458 956330]
  - [scsi] mpt2sas: fix the incorrect scsi_dma_map error checking (Tomas Henzl) [1018458 956330]
  - [xen] x86: check segment descriptor read result in 64-bit OUTS emulation (Radim Krcmar) [1012958 1012959] {CVE-2013-4368}
  - [md] dm snapshot: fix data corruption (Mikulas Patocka) [1004734 975353] {CVE-2013-4299}


author: Phillip Lougher <plougher@redhat.com> [2.6.18-363.el5]
changelog:
  - [virt] netback: don't disconnect frontend with oversize packet (Andrew Jones) [971155]
  - [virt] netfront: reduce gso_max_size to account max TCP header (Andrew Jones) [971155]
  - [block] cdrom: use kzalloc() for failing hardware (Frantisek Hrbata) [973104] {CVE-2013-2164}
  - [block] cciss: Update version string (Linda Knippers) [919633]


author: Phillip Lougher <plougher@redhat.com> [2.6.18-364.el5]
changelog:
  - [net] sctp: Disallow new connection on a closing socket (Daniel Borkmann) [974936] {CVE-2013-2206}
  - [net] sctp: Use correct sideffect command in dup cookie handling (Daniel Borkmann) [974936] {CVE-2013-2206}
  - [net] sctp: deal with multiple COOKIE_ECHO chunks (Daniel Borkmann) [974936] {CVE-2013-2206}
  - [scsi] qla4xxx: Update vers to 5.02.04.06.05.10-d0 for Inbox rel (Chad Dupuis) [978150]
  - [scsi] qla4xxx: ISP8xxx: Correct retry of adapter initialization (Chad Dupuis) [978150]
  - [scsi] qla4xxx: Fix req queue count manipulation on response path (Chad Dupuis) [978150]
  - [scsi] qla4xxx: Fix targets not coming back if chap is enabled (Chad Dupuis) [978150]
  - [scsi] qla4xxx: Correct early completion of pending mbox (Chad Dupuis) [978150]
  - [net] fix invalid free in ip_cmsg_send() callers (Petr Matousek) [980142] {CVE-2013-2224}
  - [x86_64] Early segment setup for VT (Paolo Bonzini) [978305]
  - [block] cpqarray: info leak in ida_locked_ioctl() (Tomas Henzl) [971246] {CVE-2013-2147}
  - [net] tcp: bind() use stronger condition for bind_conflict (Flavio Leitner) [957604]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-390.el5]
changelog:
  - [net] neigh: set NUD_INCOMPLETE when probing router reachability (Marcelo Ricardo Leitner) [1090806]
  - [net] ipv6: router reachability probing (Marcelo Ricardo Leitner) [1090806]
  - [net] ipv6: probe routes asynchronous in rt6_probe (Marcelo Ricardo Leitner) [1090806]
  - [net] ndisc: Update neigh->updated with write lock (Marcelo Ricardo Leitner) [1090806]
  - [net] ipv6: remove the unnecessary statement in find_match() (Marcelo Ricardo Leitner) [1090806]
  - [net] ipv6: fix route selection if CONFIG_IPV6_ROUTER_PREF unset (Marcelo Ricardo Leitner) [1090806]
  - [net] ipv6: Fix def route failover when CONFIG_IPV6_ROUTER_PREF=n (Marcelo Ricardo Leitner) [1090806]
  - [net] ipv6: Prefer reachable nexthop only if the caller requests (Marcelo Ricardo Leitner) [1090806]
  - [fs] ext4/jbd2: don't wait forever stale tid caused by wraparound (Eric Sandeen) [980268]
  - [fs] ext4: Initialize fsync transaction ids in ext4_new_inode() (Eric Sandeen) [980268]
  - [fs] jbd2: don't wake kjournald unnecessarily (Eric Sandeen) [980268]
  - [fs] jbd2: fix fsync() tid wraparound bug (Eric Sandeen) [980268]
  - [fs] knfsd: demote some printk()s to dprintk()s (J. Bruce Fields) [984732]
  - [infiniband] rds: do not deref NULL dev in rds_iw_laddr_check() (Jacob Tanenbaum) [1093312] {CVE-2014-2678}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-391.el5]
changelog:
  - [fs] dcache: fix cleanup on warning in d_splice_alias (Denys Vlasenko) [1080606]
  - [net] forcedeth: run loopback test only on chips that support it (Ivan Vecera) [661959]
  - [net] neigh: Make neigh_add_timer symmetrical to neigh_del_timer (Marcelo Ricardo Leitner) [1109888]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-392.el5]
changelog:
  - [redhat] kabi: Adding symbol pci_num_vf (Jiri Olsa) [999389]
  - [fs] gfs2: Allocate directory memory with GFP_NOFS (Robert S Peterson) [1103256]
  - [kernel] compat: compat_sys_times: don't take tasklist_lock (Mateusz Guzik) [984541]
  - [fs] nfs4: Add recovery for individual stateids (Dave Wysochanski) [867570]
  - [fs] nfs4: Don't start state recovery in nfs4_close_done (Dave Wysochanski) [867570]
  - [s390] kernel: fix save and restore of the fp-control register (Hendrik Brueckner) [1034342]
  - [net] bridge: fix some kernel warning in multicast timer (Amerigo Wang) [902454]
  - [net] bridge: send query as soon as leave is received (Amerigo Wang) [902454]
  - [net] bridge: only expire the mdb entry when query is received (Amerigo Wang) [902454]
  - [net] bridge: Fix typo that may render snooping less effective (Amerigo Wang) [902454]
  - [net] AF_UNIX: EOF on non-blocking SOCK_SEQPACKET (Swapnil Nagarkar) [1025410]
  - [fs] gfs2: clear directory cache from master directory at unmount (Robert S Peterson) [859964]
  - [net] netlink: Make netlink processing routines semi-synchronious (Daniel Borkmann) [947562]
  - [xen] page-alloc: scrub anonymous domain heap pages upon freeing (Vitaly Kuznetsov) [1103649]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-393.el5]
changelog:
  - [fs] jbd: don't wake kjournald unnecessarily (Denys Vlasenko) [1081785]
  - [fs] jbd: don't wait (forever) for stale tid caused by wraparound (Denys Vlasenko) [1081785]
  - [fs] ext4: fix waiting and sending of barrier in ext4_sync_file() (Denys Vlasenko) [1081785]
  - [fs] jbd2: Add function jbd2_trans_will_send_data_barrier() (Denys Vlasenko) [1081785]
  - [fs] jbd2: fix sending of data flush on journal commit (Denys Vlasenko) [1081785]
  - [fs] ext4, jbd2: Add barriers for file systems with ext journals (Denys Vlasenko) [1081785]
  - [fs] jbd: fix fsync() tid wraparound bug (Denys Vlasenko) [1081785]
  - [fs] ext4: fix fdatasync() for files with only i_size changes (Eric Sandeen) [1102768]
  - [fs] ext3: explicitly rm inode from orphan list after failed io (Eric Sandeen) [1088041]
  - [infiniband] mlx4: Fix BlueFlame race (Amir Vadai) [1088582]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-394.el5]
changelog:
  - Revert: [net] bridge: Fix typo that may render snooping less effective (Amerigo Wang) [902454]
  - Revert: [net] bridge: only expire the mdb entry when query is received (Amerigo Wang) [902454]
  - Revert: [net] bridge: send query as soon as leave is received (Amerigo Wang) [902454]
  - Revert: [net] bridge: fix some kernel warning in multicast timer (Amerigo Wang) [902454]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-395.el5]
changelog:
  - [fs] gfs2: When glock is freed make sure it gets unlocked in DLM (Abhijith Das) [1022254]
  - [fs] gfs2: Requeue work if reply becomes pending during work_func (Abhijith Das) [1022254]
  - [fs] gfs2: Wait for glock demotes when evicting an inode (Abhijith Das) [1022254]
  - [fs] gfs2: Attempt to close GLF_DIRTY timing windows (Abhijith Das) [1022254]
  - [fs] gfs2: Change truncate page allocation to be GFP_NOFS (Abhijith Das) [1022254]
  - [net] tg3: Poll cpmu link state on APE + ASF enabled devices (Ivan Vecera) [1097866]
  - [net] tg3: Fix Read DMA workaround for 5719 A0 (Ivan Vecera) [924590]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-396.el5]
changelog:
  - [s390] kernel: fix restore of invalid floating-point-control (Hendrik Brueckner) [1121953]
  - [fs] cifs: Use cifs_set_ops() in fill_in_inode() functions (Sachin Prabhu) [1108624]
  - [fs] cifs: Fix cifs_set_ops() (Sachin Prabhu) [1108624]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-397.el5]
changelog:
  - [fs] gfs2: Detect and release delayed bufdata structures (Robert S Peterson) [516025]
  - [fs] nfs: don't invalidate dentries that act as mountpoints (Steve Dickson) [1117211]
  - [audit] auditsc: audit_krule mask accesses need bounds checking (Denys Vlasenko) [1102703] {CVE-2014-3917}
  - [scsi] Initialize eh_timeout value earlier on probe (Ewan Milne) [1119532]
  - [mm] writeback: Fix hang when low on memory due to NFS traffic (Larry Woodman) [1080194]
  - [fs] skip atime update on a frozen filesystem (Aaron Tomlin) [1000836]
  - [xen] x86: check segment descriptor read in 64-bit OUTS emulation (Radim Krcmar) [1012959]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-400.el5]
changelog:
  - [net] bridge: disable snooping if there is no querier (Frantisek Hrbata) [902454]
  - [s390] kernel: sysinfo: convert /proc/sysinfo to seqfile (Alexander Gordeev) [1131283]
  - [net] netlink: verify permisions of socket creator (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: store effective caps at socket() time (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Rename netlink_capable netlink_allowed (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Fix permission check in netlink_connect() (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: fix possible spoofing from non-root processes (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: Make NETLINK_USERSOCK work again (Jiri Benc) [1094266] {CVE-2014-0181}
  - [net] netlink: fix for too early rmmod (Jiri Benc) [1094266] {CVE-2014-0181}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-402.el5]
changelog:
  - [block] virtio: Reset device after blk_cleanup_queue() (Stefan Hajnoczi) [1006536]
  - [block] virtio: Call del_gendisk() before disable guest kick (Stefan Hajnoczi) [1006536]
  - [block] virtio: Drop unused request tracking list (Stefan Hajnoczi) [1006536]
  - [fs] cifs: setfacl removes part of ACL when setting POSIX ACLs (Sachin Prabhu) [1105625]
  - [fs] splice: perform generic write checks (Eric Sandeen) [1155908] {CVE-2014-7822}
  - [fs] ext4: verify block bitmap (Lukas Czerner) [1034403]
  - [fs] ext4: fix type declaration of ext4_validate_block_bitmap (Lukas Czerner) [1034403]
  - [fs] ext4: error out if verifying the block bitmap fails (Lukas Czerner) [1034403]
  - [x86] traps: stop using IST for #SS (Petr Matousek) [1172809] {CVE-2014-9322}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-403.el5]
changelog:
  - [s390] zcrypt: Toleration of new crypto hardware (Hendrik Brueckner) [1182522]
  - [fs] cifs: Use pid from cifsFileInfo in wrt pages/set_file_size (Sachin Prabhu) [1169304]
  - [xen] x86: confine internally handled MMIO to solitary regions (Denys Vlasenko) [1164256] {CVE-2014-8867}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-404.el5]
changelog:
  - [infiniband] core: Prevent integer overflow in ib_umem_get (Doug Ledford) [1179353] {CVE-2014-8159}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-405.el5]
changelog:
  - [net] tcp: zero retrans_stamp if all retrans were acked (Marcelo Leitner) [1205521]
  - [net] tcp: fix retrans_stamp advancing in error cases (Marcelo Leitner) [1205521]
  - [net] tcp: Fix inconsistency source (Marcelo Leitner) [1205521]
  - [ipc] sem: fix the potential use-after-free in freeary() (Oleg Nesterov) [1124574]
  - [scsi] lpfc: Fix crash in device reset handler (Rob Evers) [1070964]
  - [mm] fix broken max_reclaims_in_progress memory reclaim throttle (Lachlan McIlroy) [1164105]
  - [x86_64] fpu: save_i387() must clr TS_USEDFPU along with stts() (Oleg Nesterov) [1193505]
  - [block] virtio: Call revalidate_disk() upon online disk resize (Stefan Hajnoczi) [1200855]
  - [block] virtio: fix config handler race (Stefan Hajnoczi) [1200855]
  - [block] virtio: allow re-reading config space at runtime (Stefan Hajnoczi) [1200855]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-406.el5]
changelog:
  - [fs] pipe: fix pipe corruption and iovec overrun on partial copy (Mateusz Guzik) [1203787] {CVE-2015-1805}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-407.el5]
changelog:
  - [utrace] check ->utrace != NULL in utrace_unsafe_exec() (Oleg Nesterov) [1226967]
  - [s390] zcrypt: Fixed reset and interrupt handling of AP queues (Hendrik Brueckner) [1238991]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-408.el5]
changelog:
  - [net] udp: fix behavior of wrong checksums (Denys Vlasenko) [1240757] {CVE-2015-5364 CVE-2015-5366}
  - [net] ipv6/udp: Use correct var to determine non-blocking cond (Denys Vlasenko) [1240757] {CVE-2015-5364 CVE-2015-5366}
  - [net] SNMP: Restore Udp6InErrors incrementation (Denys Vlasenko) [1240757] {CVE-2015-5364 CVE-2015-5366}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-409.el5]
changelog:
  - [fs] ext4: limit group search loop for non-extent files (Lukas Czerner) [1301100]
  - [fb] vm: convert fb_mmap to vm_iomap_memory() helper (Jacob Tanenbaum) [1035240] {CVE-2013-2596}
  - [s390] add dummy io_remap_pfn_range() to asm-s390/pgtable.h (Jacob Tanenbaum) [1035240] {CVE-2013-2596}
  - [mm] vm: add vm_iomap_memory() helper function (Jacob Tanenbaum) [1035240] {CVE-2013-2596}
  - [sched] prevent division by zero x->cpu_power (Denys Vlasenko) [1209728]
  - [xen] x86: fully ignore segment override for register-only ops (Mateusz Guzik) [1200373] {CVE-2015-2151}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-412.el5]
changelog:
  - [s390] kernel: Fix tlb flushing with idte. (Hendrik Brueckner) [1350541]
  - [fs] Do not double unlock the dcache_lock in d_materialise_unique (Miklos Szeredi) [1198315]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-413.el5]
changelog:
  - [redhat] Disable 'Invalid version (double separator '-')' error (Alexander Gordeev) [1375746]
  - [fs] jbd: Fix oops in journal_remove_journal_head() (Lukas Czerner) [1067708]
  - [fs] jbd: Fix race between CP and journal_get_write_access() (Lukas Czerner) [1067708]
  - [fs] ecryptfs: prevent mounts backed by procfs (Mateusz Guzik) [1347100] {CVE-2016-1583}


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-415.el5]
changelog:
  - [fs] gfs2: Initialize atime of I_NEW inodes (Andreas Grunbacher) [1374861]
  - [fs] gfs2: Update file times after grabbing glock (Andreas Grunbacher) [1374861]
  - Revert: [fs] gfs2: Only refresh newer in-memory timestamps (Andreas Grunbacher) [1374861]


author: Alexander Gordeev <agordeev@redhat.com> [2.6.18-417.el5]
changelog:
  - [virt] hv: do not lose pending heartbeat vmbus packets (Vitaly Kuznetsov) [1391167]
  - [net] Fix use after free in the recvmmsg exit path (Davide Caratti) [1390044] {CVE-2016-7117}


author: Radomir Vrbovsky <rvrbovsk@redhat.com> [2.6.18-419.el5]
changelog:
  - [net] dccp: Use AF-independent rebuild_header routine (Hannes Frederic Sowa) [1424751]
  - [net] dccp: fix freeing skb too early for IPV6_RECVPKTINFO (Hannes Frederic Sowa) [1424633] {CVE-2017-6074}
  - [redhat] kernel.spec.template: disable autoloading for dccp proto (Hannes Frederic Sowa) [1425177]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.5.el5]
changelog:
  - [ia64] ptrace: access to user register backing (Roland McGrath ) [259801]
  - [fs] cifs: buffer overflow due to corrupt response (Jeff Layton ) [372991]
  - [net] s2io: correct VLAN frame reception (Andy Gospodarek ) [426289]
  - [net] s2io: allow VLAN creation on interfaces (Andy Gospodarek ) [426289]
  - [misc] tux: get rid of O_ATOMICLOOKUP (Michal Schmidt ) [426494]
  - [x86_64] fix race conditions in setup_APIC_timer (Geoff Gustafson ) [424181]
  - [fs] core dump file ownership (Don Howard ) [396991]
  - [nfs] let rpciod finish sillyrename then umount (Steve Dickson ) [414041]
  - [nfs] fix a race in silly rename (Steve Dickson ) [414041]
  - [nfs] clean up the silly rename code (Steve Dickson ) [414041]
  - [nfs] infrastructure changes for silly renames (Steve Dickson ) [414041]
  - [nfs] introduce nfs_removeargs and nfs_removeres (Steve Dickson ) [414041]
  - [ia64] remove stack hard limit (Aron Griffis ) [412091]
  - [fs] sysfs: fix race condition around sd->s_dentry (Eric Sandeen ) [245777] {CVE-2007-3104}
  - [fs] sysfs: fix condition check in sysfs_drop_dentry() (Eric Sandeen ) [245777] {CVE-2007-3104}
  - [fs] sysfs: store inode nrs in s_ino (Eric Sandeen ) [245777] {CVE-2007-3104}
  - [xen] ia64: vulnerability of copy_to_user in PAL emu (Jarod Wilson ) [425938]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.7.el5]
changelog:
  - [misc] enabling a non-hotplug cpu should cause panic (Kei Tokunaga ) [429108]
  - [cpufreq] don't take sem in cpufreq_quick_get (Doug Chapman ) [400821]
  - [cpufreq] remove hotplug cpu cruft (Doug Chapman ) [400821]
  - [cpufreq] governor: use new rwsem locking in work cb (Doug Chapman ) [400821]
  - [cpufreq] ondemand governor restructure the work cb (Doug Chapman ) [400821]
  - [cpufreq] rewrite lock to eliminate hotplug issues (Doug Chapman ) [400821]
  - [scsi] fix various lpfc driver issues (Chip Coldwell ) [424271]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.8.el5]
changelog:
  - [scsi] cciss: fix incompatibility with hpacucli (Tomas Henzl ) [429515]
  - [cpufreq] booting with maxcpus=1 panics (Doug Chapman ) [429516]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.9.el5]
changelog:
  - Revert: [cpufreq] booting with maxcpus=1 panics (Doug Chapman ) [429516]
  - Revert: [cpufreq] don't take sem in cpufreq_quick_get (Doug Chapman ) [400821]
  - Revert: [cpufreq] remove hotplug cpu cruft (Doug Chapman ) [400821]
  - Revert: [cpufreq] governor: use new rwsem locking in work cb (Doug Chapman ) [400821]
  - Revert: [cpufreq] ondemand governor restructure the work cb (Doug Chapman ) [400821]
  - Revert: [cpufreq] rewrite lock to eliminate hotplug issues (Doug Chapman ) [400821]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.11.el5]
changelog:
  - [ia64] enable CMCI on hot-plugged processors (Fabio Olive Leite ) [430632]
  - [audit] break execve records into smaller parts (Eric Paris ) [429691]
  - [s390] data corruption on DASD while toggling CHPIDs (Hans-Joachim Picht ) [402911]
  - [xen] ia64: hv hangs on Corrected Platform Errors (Tetsu Yamamoto ) [428290]
  - [xen] ia64: running java-vm causes dom0 to hang (Tetsu Yamamoto ) [424191]


author: Don Howard <dhoward@redhat.com> [2.6.18-53.1.13]
changelog:
  - revert to 2.6.18-53.1.6.el5
  - [x86_64] kernel vmsplice_to_pipe flaw (Alexander Viro ) [432252] {CVE-2008-0600}


author: Don Howard <dhoward@redhat.com> [2.6.18-53.1.13.el5]
changelog:
  - revert to 2.6.18-53.1.6.el5
  - [x86_64] check permissions in vmsplice_to_pipe (Alexander Viro ) [432252] {CVE-2008-0600}


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.14.el5]
changelog:
  - merge from 2.6.18-53.1.13 to 2.6.18-53.1.12
  - [nfs] potential file corruption issue when writing (Jeff Layton ) [432078]
  - [ppc] chrp: fix possible strncmp NULL pointer usage (Vitaly Mayatskikh ) [396821]
  - [isdn] i4l: fix memory overruns (Vitaly Mayatskikh ) [425171]
  - [isdn] fix possible isdn_net buffer overflows (Aristeu Rozanski ) [392151] {CVE-2007-6063}
  - [mm] hugepages: leak due to pagetable page sharing (Larry Woodman ) [431522]
  - [net] NULL dereference in iwl driver (Vitaly Mayatskikh ) [401421] {CVE-2007-5938}
  - [misc] Denial of service with wedged processes (Jerome Marchand ) [221403]
  - [xen] ia64: hvm guest memory range checking (Jarod Wilson ) [408701]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.15.el5]
changelog:
  - [libata] sata_nv: un-blacklist hitachi drives (David Milburn ) [433617]
  - [libata] sata_nv: may send cmds with duplicate tags (David Milburn ) [433617]
  - [s390] qdio: output queue stall on FCP and net devs (Hans-Joachim Picht ) [412071]
  - [xen] ia64: guest has bad network performance (Tetsu Yamamoto ) [433616]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.16.el5]
changelog:
  - [misc] fix range check in fault handlers with mremap (Vitaly Mayatskikh ) [428970]
  - [video] neofb: avoid overwriting fb_info fields (Anton Arapov ) [430253]


author: Don Howard <dhoward@redhat.com> [2.6.18-53.1.17.el5]
changelog:
  - [fs] fix race condition in dnotify (Alexander Viro ) [439758] {CVE-2008-1375}
  - [pci] hotplug: PCI Express problems with bad DLLPs (Kei Tokunaga ) [440438]
  - [nfs] stop sillyrenames and unmounts from racing (Steve Dickson ) [440447]
  - [x86] clear df flag for signal handlers (Jason Baron ) [437316] {CVE-2008-1367}
  - [xen] ia64: ftp stress test fixes between HVM/Dom0 (Tetsu Yamamoto ) [427400] {CVE-2008-1619}
  - [xen] ia64: fix ssm_i emulation barrier and vdso pv (Tetsu Yamamoto ) [427400] {CVE-2008-1619}


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.19.el5]
changelog:
  - [xen] check num of segments in block backend driver (Bill Burns ) [378281]
  - [x86_64] update IO-APIC dest field to 8-bit for xAPIC (Dave Anderson ) [442922]
  - Update: [fs] fix race condition in dnotify (Alexander Viro ) [439758] {CVE-2008-1375}
  - Update: [xen] ia64: ftp stress test fixes between HVM/Dom0 (Tetsu Yamamoto ) [427400] {CVE-2008-1619}


author: Anton Arapov <aarapov@redhat.com> [2.6.18-53.1.21.el5]
changelog:
  - [misc] infinite loop in highres timers (Michal Schmidt ) [440001]
  - [video] PWC driver DoS (Pete Zaitcev ) [308521]
  - [x86_64] fix unprivileged crash on %cs corruption (Jarod Wilson ) [439787]
  - [net] ESP: ensure IV is in linear part of the skb (Thomas Graf ) [427247]
  - [cpufreq] booting with maxcpus=1 panics (Doug Chapman ) [429516]
  - [net] sunrpc: lockd recovery is broken (Steve Dickson ) [445360]
  - [cpufreq] don't take sem in cpufreq_quick_get (Doug Chapman ) [400821]
  - [cpufreq] remove hotplug cpu cruft (Doug Chapman ) [400821]
  - [cpufreq] governor: use new rwsem locking in work cb (Doug Chapman ) [400821]
  - [cpufreq] ondemand governor restructure the work cb (Doug Chapman ) [400821]
  - [cpufreq] rewrite lock to eliminate hotplug issues (Doug Chapman ) [400821]


author: Don Zickus <dzickus@redhat.com> [2.6.18-1.3014.el5]
changelog:
  - XEN: Replace inappropriate domain_crash_synchronous use (Herbert Xu ) [221239]
  - SATA timeout boot message  (Peter Martuccelli ) [222108]
  - Netlabel: off by one and init bug in netlbl_cipsov4_add_common (Eric Paris ) [221648]
  - NetLabel: fix locking issues (Eric Paris ) [221504]
  - mm: fix statistics in vmscan.c (Peter Zijlstra ) [222030]
  - usb: Sun/AMI virtual floppy issue (Pete Zaitcev ) [219628]
  - bonding: eliminate rtnl assertion spew (Andy Gospodarek ) [210577]
  - Xen: Make HVM hypercall table NR_hypercalls entries big. (Herbert Xu ) [221818]
  - xen: Add PACKET_AUXDATA cmsg (Herbert Xu ) [219681]


author: Don Zickus <dzickus@redhat.com> [2.6.18-2.el5]
changelog:
  - mm: handle mapping of memory without a struct page backing it (Erik Jacobson ) [221029]
  - rng: check to see if bios locked device (Erik Jacobson ) [221029]
  - sata: support legacy IDE mode of SB600 SATA (Bhavana Nagendra ) [221636]
  - xen: quick fix for Cannot allocate memory (Steven Rostedt ) [217056]
  - XEN: Register PIT handlers to the correct domain (Herbert Xu ) [222520]
  - SATA AHCI: support AHCI class code (Jeff Garzik ) [222674]
  - fix vdso in core dumps (Roland McGrath ) [211744]


author: Don Zickus <dzickus@redhat.com> [2.6.18-3.el5]
changelog:
  - scsi: fix EX8350 panic (stex.ko) (Jun'ichi Nick Nomura ) [220783]
  - Audit: Mask upper bits on 32 bit syscall auditing on ppc64 (Eric Paris ) [213276]


author: Don Zickus <dzickus@redhat.com> [2.6.18-4.el5]
changelog:
  - IPSec: incorrect return code in xfrm_policy_lookup (Eric Paris ) [218591]
  - more kabi whitelist updates (Jon Masters)


author: Don Zickus <dzickus@redhat.com> [2.6.18-5.el5]
changelog:
  - x86: /proc/mtrr interface MTRR bug fix (Bhavana Nagendra ) [223821]
  - Revert: bonding: eliminate rtnl assertion spew (Andy Gospodarek ) [210577]
  - ia64: Check for TIO errors on shub2 Altix (George Beshers ) [223529]
  - nfs: Unable to mount more than 1 Secure NFS mount (Steve Dickson ) [220649]


author: Don Howard <dhoward@redhat.com> [2.6.18-8.1.1.el5]
changelog:
  - [cpufreq] Remove __initdata from tscsync (Prarit Bhargava ) [229887]
  - [security] Fix key serial number collision problem (David Howells ) [229883] {CVE-2007-0006}
  - [fs] Don't core dump read-only binarys (Don Howard ) [229885] {CVE-2007-0958}
  - [xen] Enable booting on machines with > 64G (Chris Lalancette) [230117]
  - Fix potential buffer overflow in cardman 4040 cmx driver (Don Howard) [229884] {CVE-2007-0005}


author: Don Howard <dhoward@redhat.com> [2.6.18-8.1.2.el5]
changelog:
  - [utrace] exploit and unkillable cpu fixes (Roland McGrath ) [228816] (CVE-2007-0771)
  - [net] IPV6 security holes in ipv6_sockglue.c - 2 (David S. Miller ) [232257] {CVE-2007-1000}
  - [net] IPV6 security holes in ipv6_sockglue.c (David S. Miller ) [232255] {CVE-2007-1388}
  - [audit] GFP_KERNEL allocations in non-blocking context fix (Alexander Viro ) [233157]


author: Don Howard <dhoward@redhat.com> [2.6.18-8.1.4.el5]
changelog:
  - [ipv6] Fix routing regression. (David S. Miller ) [238046]
  - [mm] Gdb does not accurately output the backtrace. (Dave Anderson ) [235511]
  - [NMI] change watchdog timeout to 30 seconds (Larry Woodman ) [237655]
  - [dlm] fix mode munging (David Teigland ) [238731]
  - [net] kernel-headers: missing include of types.h (Neil Horman ) [238749]
  - [net] fib_semantics.c out of bounds check (Thomas Graf ) [238948] {CVE-2007-2172}
  - [net] disallow RH0 by default (Thomas Graf ) [238949] {CVE-2007-2242}
  - [net] Fix user OOPS'able bug in FIB netlink (David S. Miller ) [238960] {CVE-2007-1861}
  - [net] IPv6 fragments bypass in nf_conntrack netfilter code (Thomas Graf ) [238947] {CVE-2007-1497}
  - [net] ipv6_fl_socklist is inadvertently shared (David S. Miller ) [238944] {CVE-2007-1592}
  - [net] Various NULL pointer dereferences in netfilter code (Thomas Graf ) [238946] {CVE-2007-1496}


author: Jerome Marchand <jmarchan@redhat.com> [2.6.18-8.1.5.el5]
changelog:
  - [fs] prevent oops in compat_sys_mount (Jeff Layton ) [240456] {CVE-2006-7203}
  - [e1000] fix watchdog timeout panics (Andy Gospodarek ) [238048]
  - [ext3] return ENOENT from ext3_link when racing with unlink (Eric Sandeen ) [239787]


author: Don Howard <dhoward@redhat.com> [2.6.18-8.1.6.el5]
changelog:
  - [bluetooth] close information leaks in setsockopt (Marcel Holtmann ) [241862]{CVE-2007-1353}
  - [net] fix memory leak in PPPoE (Neil Horman ) [241863] {CVE-2007-2525}
  - [random] fix seeding of dev/random (Aristeu Rozanski ) [241888] {CVE-2007-2453}


author: Don Howard <dhoward@redhat.com> [2.6.18-8.1.9.el5]
changelog:
  - [misc] cpuset information leak (Prarit Bhargava ) [245773] {CVE-2007-2875}
  - [net] ip_conntrack_sctp: fix remotely triggerable panic (Don Howard ) [245774] {CVE-2007-2876}
  - [misc] Overflow in CAPI subsystem (Anton Arapov ) [232260] {CVE-2007-1217}
  - [CIFS] fix signing sec= mount options (Jeff Layton ) [253315] {CVE-2007-3843}
  - [CIFS] respect umask when unix extensions are enabled (Jeff Layton ) [253314] {CVE-2007-3740}
  - [misc] i915_dma: fix batch buffer security bit for i965 chipsets (Aristeu Rozanski ) [252305] {CVE-2007-3851}
  - [fs] - Move msdos compat ioctl to msdos dir (Eric Sandeen ) [253317]
  - [fs] - fix VFAT compat ioctls on 64-bit systems (Eric Sandeen ) [253317] {CVE-2007-2878}


author: Don Howard <dhoward@redhat.com> [2.6.18-8.1.10.el5]
changelog:
  - [mm] Prevent the stack growth into hugetlb reserved regions (Konrad Rzeszutek) [253313] {CVE-2007-3739}


author: Anton Arapov <aarapov@redhat.com> [2.6.18-8.1.11.el5]
changelog:
  - [xen] Guest access to MSR may cause system crash/data corruption (Bhavana Nagendra ) [253312] {CVE-2007-3733}
  - [dlm] A TCP connection to DLM port blocks DLM operations (Patrick Caulfield ) [245922] {CVE-2007-3380}
  - [ppc] 4k page mapping support for userspace in 64k kernels (Scott Moser ) [275841] {CVE-2007-3850}
  - [ptrace] NULL pointer dereference triggered by ptrace (Anton Arapov ) [275981] {CVE-2007-3731}
  - [fs] hugetlb: fix prio_tree unit (Konrad Rzeszutek ) [253929] {CVE-2007-4133}


author: Anton Arapov <aarapov@redhat.com> [2.6.18-8.1.12.el5]
changelog:
  - [x86_64] Don't leak NT bit into next task (Dave Anderson ) [298151] {CVE-2007-4574}
  - [fs] Reset current->pdeath_signal on SUID binary execution (Peter Zijlstra ) [252307] {CVE-2007-3848}
  - [misc] Bounds check ordering issue in random driver (Anton Arapov ) [275961] {CVE-2007-3105}
  - [usb] usblcd: Locally triggerable memory consumption (Anton Arapov ) [276001] {CVE-2007-3513}
  - [x86_64] Zero extend all registers after ptrace in 32bit entry path (Anton Arapov ) [297871] {CVE-2007-4573}
  - [net] igmp: check for NULL when allocating GFP_ATOMIC skbs (Neil Horman ) [303281]


author: Don Howard <dhoward@redhat.com> [2.6.18-8.1.14.el5]
changelog:
  - Revert changes back to 2.6.18-8.1.10.
  - [x86_64] Zero extend all registers after ptrace in 32bit entry path (Anton Arapov ) [297871] {CVE-2007-4573}


author: Anton Arapov <aarapov@redhat.com> [2.6.18-8.1.15.el5]
changelog:
  - [dlm] A TCP connection to DLM port blocks DLM operations (Patrick Caulfield ) [245922] {CVE-2007-3380}
  - [ppc] 4k page mapping support for userspace in 64k kernels (Scott Moser ) [275841] {CVE-2007-3850}
  - [ptrace] NULL pointer dereference triggered by ptrace (Anton Arapov ) [275981] {CVE-2007-3731}
  - [fs] hugetlb: fix prio_tree unit (Konrad Rzeszutek ) [253929] {CVE-2007-4133}
  - [x86_64] Don't leak NT bit into next task (Dave Anderson ) [298151] {CVE-2007-4574}
  - [fs] Reset current->pdeath_signal on SUID binary execution (Peter Zijlstra ) [252307] {CVE-2007-3848}
  - [misc] Bounds check ordering issue in random driver (Anton Arapov ) [275961] {CVE-2007-3105}
  - [usb] usblcd: Locally triggerable memory consumption (Anton Arapov ) [276001] {CVE-2007-3513}
  - [net] igmp: check for NULL when allocating GFP_ATOMIC skbs (Neil Horman ) [303281]
  - [scsi] aacraid: Missing ioctl() permission checks (Vitaly Mayatskikh ) [298371] {CVE-2007-4308}
  - [xen] Guest access to MSR may cause system crash/data corruption (Bhavana Nagendra ) [253312] {CVE-2007-3733}


author: Don Howard <dhoward@redhat.com> [2.6.18.8-1.6.el5]
changelog:
  - [bluetooth] close information leaks in setsockopt (Marcel Holtmann ) [241862]{CVE-2007-1353}
  - [net] fix memory leak in PPPoE (Neil Horman ) [241863] {CVE-2007-2525}
  - [random] fix seeding of dev/random (Aristeu Rozanski ) [241888]


author: Don Zickus <dzickus@redhat.com> [2.6.18-85.el5]
changelog:
  - [xen] ia64: fix kprobes slowdown on single step (Tetsu Yamamoto ) [434558]
  - [xen] mprotect performance improvements (Rik van Riel ) [412731]
  - [GFS2] remove assertion 'al->al_alloced' failed (Abhijith Das ) [432824]
  - [misc] remove unneeded EXPORT_SYMBOLS (Don Zickus ) [295491]
  - [net] e1000e: wake on lan fixes (Andy Gospodarek ) [432343]
  - [sound] add support for HP-RP5700 model (Jaroslav Kysela ) [433593]
  - [scsi] hptiop: fixes buffer overflow, adds pci-ids (Chip Coldwell ) [430662]
  - [crypto] xcbc: fix IPsec crash with aes-xcbc-mac (Herbert Xu ) [435377]
  - [misc] fix memory leak in alloc_disk_node (Jerome Marchand ) [395871]
  - [net] cxgb3: rdma arp and loopback fixes (Andy Gospodarek ) [253449]
  - [misc] fix range check in fault handlers with mremap (Vitaly Mayatskikh ) [428971]
  - [ia64] fix userspace compile error in gcc_intrin.h (Doug Chapman ) [429074]
  - [ppc64] fix xics set_affinity code (Brad Peters ) [435126]
  - [scsi] sym53c8xx: use proper struct (Brad Peters ) [434857]
  - [ppc64] permit pci error state recovery (Brad Peters ) [434857]
  - [misc] fix ALIGN macro (Thomas Graf ) [434940]
  - [x86] fix relocate_kernel to not overwrite pgd (Neil Horman ) [346431]
  - [net] qla2xxx: wait for flash to complete write (Marcus Barrow ) [434992]
  - [ppc64] iommu DMA alignment fix (Brad Peters ) [426875]
  - [x86] add HP DL580 G5 to bfsort whitelist (Tony Camuso ) [434792]
  - [video] neofb: avoid overwriting fb_info fields (Anton Arapov ) [430254]
  - [x86] blacklist systems that need nommconf (Prarit Bhargava ) [433671]
  - [sound] add support for AD1882 codec (Jaroslav Kysela ) [429073]
  - [scsi] ibmvscsi: set command timeout to 60 seconds (Brad Peters ) [354611]
  - [x86] mprotect performance improvements (Rik van Riel ) [412731]
  - [fs] nlm: fix refcount leak in nlmsvc_grant_blocked (Jeff Layton ) [432626]
  - [net] igb: more 5.2 fixes and backports (Andy Gospodarek ) [252004]
  - [net] remove IP_TOS setting privilege checks (Thomas Graf ) [431074]
  - [net] ixgbe: obtain correct protocol info on xmit (Andy Gospodarek ) [428230]
  - [nfs] fslocations/referrals broken (Brad Peters ) [432690]
  - [net] sctp: socket initialization race (Neil Horman ) [426234]
  - [net] ipv6: fix IPsec datagram fragmentation (Herbert Xu ) [432314]
  - [audit] fix bogus reporting of async signals (Alexander Viro ) [432400]
  - [cpufreq] xen: properly register notifier (Bhavana Nagendra ) [430940]
  - [x86] fix TSC feature flag check on AMD (Bhavana Nagendra ) [428479]


author: Don Zickus <dzickus@redhat.com> [2.6.18-86.el5]
changelog:
  - [sound] HDMI device IDs for AMD ATI chipsets (Bhavana Nagendra ) [435658]
  - [scsi] fusion: 1078 corrupts data in 36GB mem region (Chip Coldwell ) [436210]
  - [GFS2] gfs2_adjust_quota has broken unstuffing code (Abhijith Das ) [434736]
  - [docs] add oom_adj and oom_score use to proc.txt (Larry Woodman ) [277151]
  - [GFS2] optimise loop in gfs2_bitfit (Bob Peterson ) [435456]
  - [crypto] fix SA creation with ESP encryption-only (Thomas Graf ) [436267]
  - [crypto] fix SA creation with AH (Thomas Graf ) [435243]
  - [ppc64] spufs: invalidate SLB then add a new entry (Brad Peters ) [436336]
  - [ppc64] SLB: serialize invalidation against loading (Brad Peters ) [436336]
  - [ppc64] cell: remove SPU_CONTEXT_SWITCH_ACTIVE flag (Brad Peters ) [434155]
  - Revert: [net] sunrpc: fix hang due to eventd deadlock (Jeff Layton ) [438044]
  - [ppc64] broken MSI on cell blades when IOMMU is on (Brad Peters ) [430949]
  - [cpufreq] powernow: blacklist bad acpi tables (Chris Lalancette ) [430947]
  - [firmware] ibft_iscsi: prevent misconfigured iBFTs (Konrad Rzeszutek ) [430297]
  - [xen] HV inside a FV guest, crashes the host (Bill Burns ) [436351]


author: Don Zickus <dzickus@redhat.com> [2.6.18-87.el5]
changelog:
  - [scsi] qla4xxx: negotiation issues with new switches (Marcus Barrow ) [438032]
  - [net] qla3xxx: have link SM use work threads (Marcus Barrow ) [409171]
  - [scsi] qla4xxx: fix completion, lun reset code (Marcus Barrow ) [438214]
  - [scsi] lpfc: update driver to 8.2.0.22 (Chip Coldwell ) [437050]
  - [scsi] lpfc: update driver to 8.2.0.21 (Chip Coldwell ) [437050]
  - [block] sg: cap reserved_size values at max_sectors (David Milburn ) [433481]
  - Revert: [xen] idle=poll instead of hypercall block (Bill Burns ) [437252]
  - [scsi] lpfc: update driver to 8.2.0.20 (Chip Coldwell ) [430600]
  - [xen] add warning to 'time went backwards' message (Prarit Bhargava ) [436775]
  - [x86] clear df flag for signal handlers (Jason Baron ) [436131]
  - [usb] fix iaa watchdog notifications (Bhavana Nagendra ) [435670]
  - [usb] new iaa watchdog timer (Bhavana Nagendra ) [435670]


author: Don Zickus <dzickus@redhat.com> [2.6.18-88.el5]
changelog:
  - [pci] hotplug: PCI Express problems with bad DLLPs (Kei Tokunaga ) [433355]
  - [net] bnx2x: update 5.2 to support latest firmware (Andy Gospodarek ) [435261]
  - [ipsec] use hmac instead of digest_null (Herbert Xu ) [436267]
  - [utrace] race crash fixes (Roland McGrath ) [428693 245429 245735 312961]
  - [x86_64] EXPORT smp_call_function_single (George Beshers ) [438720]
  - [s390] FCP/SCSI write IO stagnates (Jan Glauber ) [437099]
  - [net] ipv6: check ptr in ip6_flush_pending_frames (Neil Horman ) [439059]
  - [nfs] stop sillyrenames and unmounts from racing (Steve Dickson ) [437302]
  - [ppc64] oprofile: add support for Power5+ and later (Brad Peters ) [244719]
  - [agp] add cantiga ids (Geoff Gustafson ) [438919]
  - [x86] oprofile: support for Penryn-class processors (Geoff Gustafson ) [253056]
  - [net] ipv6: fix default address selection rule 3 (Neil Horman ) [438429]
  - [audit] fix panic, regression, netlink socket usage (Eric Paris ) [434158]
  - [net] eHEA: checksum error fix (Brad Peters ) [438212]
  - [s390] fix qeth scatter-gather (Jan Glauber ) [438180]
  - [ata] fix SATA IDE mode bug upon resume (Bhavana Nagendra ) [432652]
  - [openib] update ipath driver (Doug Ledford ) [253023]
  - [openib] update the nes driver from 0.4 to 1.0 (Doug Ledford ) [253023]
  - [openib] IPoIB updates (Doug Ledford ) [253023]
  - [openib] cleanup of the xrc patch removal (Doug Ledford ) [253023]
  - [openib] remove srpt and empty vnic driver files (Doug Ledford ) [253023]
  - [openib] enable IPoIB connect mode support (Doug Ledford ) [253023]
  - [openib] SDP accounting fixes (Doug Ledford ) [253023]
  - [openib] add improved error handling in srp driver (Doug Ledford ) [253023]
  - [openib] minor core updates between rc1 and final (Doug Ledford ) [253023]
  - [openib] update ehca driver to version 0.25 (Doug Ledford ) [253023]
  - [openib] remove xrc support (Doug Ledford ) [253023]
  - [ppc64] hardware watchpoints: add DABRX init (Brad Peters ) [438259]
  - [ppc64] hardware watchpoints: add DABRX definitions (Brad Peters ) [438259]
  - [x86_64] address space randomization (Peter Zijlstra ) [222473]
  - [ppc64] fixes removal of virtual cpu from dlpar (Brad Peters ) [432846]
  - [mm] inconsistent get_user_pages and memory mapped (Brad Peters ) [408781]
  - [s390] add missing TLB flush to hugetlb_cow (Hans-Joachim Picht ) [433799]
  - [xen] HV ignoring extended cpu model field (Geoff Gustafson ) [439254]
  - [xen] oprofile: support for Penryn-class processors (Geoff Gustafson ) [253056]
  - [xen] ia64: HV messages are not shown on VGA console (Tetsu Yamamoto ) [438789]
  - [xen] ia64: ftp stress test fixes between HVM/Dom0 (Tetsu Yamamoto ) [426015]
  - [xen] ia64: fix kernel panic on systems w/<=4GB RAM (Jarod Wilson ) [431001]


author: Don Zickus <dzickus@redhat.com> [2.6.18-89.el5]
changelog:
  - [xen] memory corruption due to VNIF increase (Tetsu Yamamoto ) [441390]
  - [crytpo] use scatterwalk_sg_next for xcbc (Thomas Graf ) [439874]
  - [video] PWC driver DoS (Pete Zaitcev ) [308531]
  - [s390] cio: fix vary off of paths (Hans-Joachim Picht ) [436106]
  - [pci] fix MSI interrupts on HT1000 based machines (Doug Ledford ) [438776]
  - [s390] cio: CHPID configuration event is ignored (Hans-Joachim Picht ) [431858]
  - [x86_64] add phys_base to vmcoreinfo (Muuhh IKEDA ) [439304]
  - [wd] disable hpwdt due to nmi problems (Prarit Bhargava ) [438741]
  - [nfs] fix the fsid revalidation in nfs_update_inode (Steve Dickson ) [431166]
  - [ppc64] SLB shadow buffer error cause random reboots (Brad Peters ) [440085]
  - [xen] check num of segments in block backend driver (Bill Burns ) [378291]
  - [sata] SB600: add 255-sector limit (Bhavana Nagendra ) [434741]
  - [x86_64] fix unprivileged crash on %cs corruption (Jarod Wilson ) [439788]
  - [scsi] qla4xxx: update driver version number (Marcus Barrow ) [439316]
  - [acpi] only ibm_acpi.c should report bay events (Prarit Bhargava ) [439380]
  - [x86] xen: fix SWIOTLB overflows (Stephen C. Tweedie ) [433554]
  - [x86] fix mprotect on PROT_NONE regions (Stephen C. Tweedie ) [437412]
  - [net] ESP: ensure IV is in linear part of the skb (Thomas Graf ) [427248]
  - [x86] fix 4 bit apicid assumption (Geoff Gustafson ) [437820]
  - [sata] SB700/SB800 64bit DMA support (Bhavana Nagendra ) [434741]


author: Don Zickus <dzickus@redhat.com> [2.6.18-90.el5]
changelog:
  - [x86_64] page faults from user mode are user faults (Dave Anderson ) [442101]
  - [ia64] kdump: add save_vmcore_info to INIT path (Neil Horman ) [442368]
  - [misc] infinite loop in highres timers (Michal Schmidt ) [440002]
  - [net] add aes-ctr algorithm to xfrm_nalgo (Neil Horman ) [441425]
  - [x86_64] 32-bit address space randomization (Peter Zijlstra ) [213483]
  - Revert: [scsi] qla2xxx: pci ee error handling support (Marcus Barrow ) [441779]
  - [pci] revert 'PCI: remove transparent bridge sizing' (Ed Pollard ) [252260]
  - [ppc64] eHEA: fixes receive packet handling (Brad Peters ) [441364]


author: Don Zickus <dzickus@redhat.com> [2.6.18-91.el5]
changelog:
  - [scsi] cciss: allow kexec to work (Chip Coldwell ) [230717]
  - [xen] ia64: set memory attribute in inline asm (Tetsu Yamamoto ) [426015]
  - [xen] fix VT-x2 FlexPriority (Bill Burns ) [252236]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-92.1.1.el5]
changelog:
  - [xen] netfront: send fake arp when link gets carrier (Herbert Xu ) [447684 441716]
  - [net] fix xfrm reverse flow lookup for icmp6 (Neil Horman ) [447688 446250]
  - [net] negotiate all algorithms when id bit mask zero (Neil Horman ) [447685 442820]
  - [net] 32/64 bit compat MCAST_ sock options support (Neil Horman ) [447687 444582]
  - [misc] add CPU hotplug support for relay functions (Kei Tokunaga ) [447522 441523]


author: Anton Arapov <aarapov@redhat.com> [2.6.18-92.1.2.el5]
changelog:
  - [misc] ttyS1 loses interrupt and stops transmitting (Simon McGrath ) [443071 440121]
  - [net] DCCP sanity check feature length (Anton Arapov ) [447395 447396] {CVE-2008-2358}
  - [misc] fix possible buffer overflow in ASN.1 parsing routine (Anton Arapov ) [444464 444465] {CVE-2008-1673}


author: Anton Arapov <aarapov@redhat.com> [2.6.18-92.1.3.el5]
changelog:
  - [x86_64] fix possible data leaks in copy_from_user() routine (Anton Arapov ) [433944 433945] {CVE-2008-0598}


author: Anton Arapov <aarapov@redhat.com> [2.6.18-92.1.5.el5]
changelog:
  - [x86_64] copy_user doesn't zero tail bytes on page fault (Vitaly Mayatskikh) [451275 451276] {CVE-2008-2729}


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.7.el5]
changelog:
  - [x86_64]: extend MCE banks support for Dunnington, Nehalem (Prarit Bhargava ) [451941 446673]
  - [nfs] address nfs rewrite performance regression in RHEL5 (Eric Sandeen ) [448685 436004]
  - [mm] Make mmap() with PROT_WRITE on RHEL5 (Larry Woodman ) [450758 448978]
  - [i386]: Add check for supported_cpus in powernow_k8 driver (Prarit Bhargava ) [450866 443853]
  - [i386]: Add check for dmi_data in powernow_k8 driver (Prarit Bhargava ) [450866 443853]
  - [net] fix recv return zero (Thomas Graf ) [452231 435657]
  - [misc] kernel crashes on futex (Anton Arapov ) [450336 435178]
  - [net] Fixing bonding rtnl_lock screwups (Fabio Olive Leite ) [451939 450219]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.8.el5]
changelog:
  - [net] randomize udp port allocation (Eugene Teo ) [454571 454572]
  - [tty] add NULL pointer checks (Aristeu Rozanski ) [453425 453154] {CVE-2008-2812}
  - [net] sctp: make sure sctp_addr does not overflow (David S. Miller ) [452482 452483] {CVE-2008-2826}
  - [sys] sys_setrlimit: prevent setting RLIMIT_CPU to 0 (Neil Horman ) [437121 437122] {CVE-2008-1294}
  - [net] sit: exploitable remote memory leak (Jiri Pirko ) [446038 446039] {CVE-2008-2136}
  - [misc] ttyS1 lost interrupt, stops transmitting v2 (Brian Maly ) [455256 451157]
  - [misc] ttyS1 loses interrupt and stops transmitting (Simon McGrath ) [443071 440121]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.9.el5]
changelog:
  - [misc] signaling msgrvc() should not pass back error (Jiri Pirko ) [455278 452533]
  - [ia64] properly unregister legacy interrupts (Prarit Bhargava ) [450337 445886]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.11.el5]
changelog:
  - [mm] xpmem: inhibit page swapping under heavy mem use (George Beshers ) [456946 456574]
  - [xen] HV: memory corruption with large number of cpus (Chris Lalancette ) [455768 449945]
  - [fs] missing check before setting mount propagation (Eugene Teo ) [454392 454393]
  - [openib] small ipoib packet can cause an oops (Doug Ledford ) [447913 445731]
  - [misc] fix race in switch_uid and user signal accounting (Vince Worthington ) [456235 441762 440830]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.12.el5]
changelog:
  - [mm] tmpfs: restore missing clear_highpage (Eugene Teo ) [426082 426083]{CVE-2007-6417}
  - [fs] vfs: fix lookup on deleted directory (Eugene Teo ) [457865 457866]{CVE-2008-3275}
  - [net] ixgbe: remove device ID for unsupported device (Andy Gospodarek ) [457484 454910]
  - [ppc] Event Queue overflow on eHCA adapters (Brad Peters ) [458779 446713]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.13.el5]
changelog:
  - [md] fix crashes in iterate_rdev (Doug Ledford ) [460128 455471]
  - [sound] snd_seq_oss_synth_make_info info leak (Eugene Teo ) [458000 458001] {CVE-2008-3272}
  - [ipmi] control BMC device ordering (peterm@redhat.com ) [459071 430157]
  - [ia64] fix to check module_free parameter (Masami Hiramatsu ) [460639 457961]
  -  [misc] NULL pointer dereference in kobject_get_path (Jiri Pirko ) [459776 455460]
  - [xen] ia64: SMP-unsafe with XENMEM_add_to_physmap on HVM (Tetsu Yamamoto ) [459780 457137]
  - [net] bridge: eliminate delay on carrier up (Herbert Xu ) [458783 453526]
  - [fs] dio: lock refcount operations (Jeff Moyer ) [459082 455750]
  - [misc]  serial: fix break handling for i82571 over LAN (Aristeu Rozanski ) [460509 440018]
  - [fs] dio: use kzalloc to zero out struct dio (Jeff Moyer ) [461091 439918]
  - [fs] lockd: nlmsvc_lookup_host called with f_sema held (Jeff Layton ) [459083 453094]
  - [net] bnx2x: chip reset and port type fixes (Andy Gospodarek ) [441259 442026]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.14.el5]
changelog:
  - [libata] ata_scsi_rbuf_get check for scatterlist usage (David Milburn ) [460638 455445]
  - [net] random32: seeding improvement (Jiri Pirko ) [458021 458019]
  - [x86_64] xen: local DOS due to NT bit leakage (Eugene Teo ) [457721 457722] {CVE-2006-5755}
  - [fs] cifs: fix O_APPEND on directio mounts (Jeff Layton ) [462591 460063]
  - [openib] race between QP async handler and destroy_qp (Brad Peters ) [458781 446109]
  - [net] dccp_setsockopt_change integer overflow (Vitaly Mayatskikh ) [459232 459235] {CVE-2008-3276}
  - [acpi] error attaching device data (peterm@redhat.com ) [460868 459670]
  - [mm] optimize ZERO_PAGE in 'get_user_pages' and fix XIP (Anton Arapov ) [452667 452668] {CVE-2008-2372}
  - [xen] xennet: coordinate ARP with backend network status (Herbert Xu ) [461457 458934]
  - [xen] event channel lock and barrier (Markus Armbruster ) [461099 457086]
  - [fs] fix bad unlock_page in pip_to_file() error path (Larry Woodman ) [462436 439917]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.15.el5]
changelog:
  - [pci] fix problems with msi interrupt management (Neil Horman ) [461894 428696]
  - [x86_64] revert time syscall changes (Prarit Bhargava ) [466427 461184]
  - [xen] allow guests to hide the TSC from applications (Chris Lalancette ) [378471 378481] {CVE-2007-5907}
  - [scsi] qla2xxx: additional residual-count correction (Marcus Barrow ) [465741 462117]
  - [char] add range_is_allowed check to mmap_mem (Eugene Teo ) [460858 460857]
  - [fs] binfmt_misc: avoid potential kernel stack overflow (Vitaly Mayatskikh ) [459464 459463]
  - [misc] cpufreq: fix format string bug (Vitaly Mayatskikh ) [459461 459460]
  - [dlm] user.c input validation fixes (David Teigland ) [458759 458760]
  - [nfs] pages of a memory mapped file get corrupted (Peter Staubach ) [450335 435291]
  - [x86_64] gettimeofday fixes for HPET, PMTimer, TSC (Prarit Bhargava ) [462860 250708]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.16.el5]
changelog:
  - [i386] vDSO: use install_special_mapping (Peter Zijlstra ) [460275 460276] {CVE-2008-3527}
  - [scsi] aacraid: remove some quirk AAC_QUIRK_SCSI_32 bits (Tomas Henzl ) [466885 453472]
  - [fs] remove SUID when splicing into an inode (Eric Sandeen ) [464451 464452] {CVE-2008-3833}
  - [fs] open() allows setgid bit when user is not in group (Eugene Teo ) [463867 463687] {CVE-2008-4210}
  - [xen] ia64: fix INIT injection (Tetsu Yamamoto ) [467105 464445]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.19.el5]
changelog:
  - Revert: [xen] allow guests to hide the TSC from applications (Chris Lalancette ) [378471 378481] {CVE-2007-5907}
  - Revert: [xen] x86: allow the kernel to boot on pre-64 bit hw (Chris Lalancette ) [470040 468083]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.20.el5]
changelog:
  - [input] atkbd: cancel delayed work before freeing struct (Jiri Pirko ) [461232 461233]
  - [drm] i915 driver arbitrary ioremap (Eugene Teo ) [464508 464509] {CVE-2008-3831}
  - [fs] don't allow splice to files opened with O_APPEND (Eugene Teo ) [466709 466710] {CVE-2008-4554}
  - [xen] x86: allow the kernel to boot on pre-64 bit hw (Chris Lalancette ) [470040 468083]
  - [net] ipv4: fix byte value boundary check (Jiri Pirko ) [469649 468148]
  - [ia64] fix ptrace hangs when following threads (Denys Vlasenko ) [469150 461456]
  - [net] sctp: INIT-ACK indicates no AUTH peer support oops (Eugene Teo ) [466081 466082] {CVE-2008-4576}
  - [input] atkbd: delay executing of LED switching request (Jiri Pirko ) [461232 461233]
  - [xen] ia64: make viosapic SMP-safe by adding lock/unlock (Tetsu Yamamoto ) [467727 466552]
  - [xen] allow guests to hide the TSC from applications (Chris Lalancette ) [378471 378481] {CVE-2007-5907}
  - [nfs] v4: don't reuse expired nfs4_state_owner structs (Jeff Layton ) [469650 441884]
  - [nfs] v4: credential ref leak in nfs4_get_state_owner (Jeff Layton ) [469650 441884]
  - [nfs] v4: Poll aggressively when handling NFS4ERR_DELAY (Jeff Layton ) [469650 441884]
  - [xen] ia64: speed up hypercall for guest domain creation (Tetsu Yamamoto ) [459080 456171]
  - [xen] use unlocked_ioctl in evtchn, gntdev and privcmd (Tetsu Yamamoto ) [459080 456171]
  - [xen] page scrub: serialise softirq with a new lock (Tetsu Yamamoto ) [459080 456171]
  - [xen] serialize scrubbing pages (Tetsu Yamamoto ) [459080 456171]
  - [nfs] pages of a memory mapped file get corrupted (Peter Staubach ) [450335 435291]
  - [x86_64] xen: fix syscall return when tracing (Chris Lalancette ) [470853 453394]


author: Jiri Pirko <jpirko@redhat.com> [2.6.18-92.1.22.el5]
changelog:
  - [misc] hugepages: ia64 stack overflow and corrupt memory (Larry Woodman ) [474347 472802]
  - [misc] allow hugepage allocation to use most of memory (Larry Woodman ) [474760 438889]


