@@ -1,6 +1,6 @@

 Summary:	Linux API header files

 Name:		linux-api-headers

-Version:	4.9.118

+Version:	4.9.120

 Release:	1%{?dist}

 License:	GPLv2

 URL:		http://www.kernel.org/

@@ -8,7 +8,7 @@ Group:		System Environment/Kernel

 Vendor:		VMware, Inc.

 Distribution: Photon

 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz

-%define sha1 linux=1f441c2113d0b7bba57dd8f6e5f5db07d222d47b

+%define sha1 linux=66f5b1a840e64ecf7fbc676abce9c9c40c21aec7

 BuildArch:	noarch

 Patch0:         Implement-the-f-xattrat-family-of-functions.patch

 %description

@@ -27,6 +27,8 @@ find /%{buildroot}%{_includedir} \( -name .install -o -name ..install.cmd \) -de

 %defattr(-,root,root)

 %{_includedir}/*

 %changelog

+*   Fri Aug 17 2018 Bo Gan <ganb@vmware.com> 4.9.120-1

+-   Update to version 4.9.120

 *   Tue Aug 07 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.118-1

 -   Update to version 4.9.118

 *   Mon Jul 30 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.116-1

deleted file mode 100644

@@ -1,88 +0,0 @@

-From 7debcc6438b4a0bdc9a7b509a751350dad883328 Mon Sep 17 00:00:00 2001

-From: Kees Cook <keescook@chromium.org>

-Date: Fri, 20 Apr 2018 14:55:31 -0700

-Subject: [PATCH] fork: unconditionally clear stack on fork

-

-commit e01e80634ecdde1dd113ac43b3adad21b47f3957 upstream.

-

-One of the classes of kernel stack content leaks[1] is exposing the

-contents of prior heap or stack contents when a new process stack is

-allocated.  Normally, those stacks are not zeroed, and the old contents

-remain in place.  In the face of stack content exposure flaws, those

-contents can leak to userspace.

-

-Fixing this will make the kernel no longer vulnerable to these flaws, as

-the stack will be wiped each time a stack is assigned to a new process.

-There's not a meaningful change in runtime performance; it almost looks

-like it provides a benefit.

-

-Performing back-to-back kernel builds before:

-	Run times: 157.86 157.09 158.90 160.94 160.80

-	Mean: 159.12

-	Std Dev: 1.54

-

-and after:

-	Run times: 159.31 157.34 156.71 158.15 160.81

-	Mean: 158.46

-	Std Dev: 1.46

-

-Instead of making this a build or runtime config, Andy Lutomirski

-recommended this just be enabled by default.

-

-[1] A noisy search for many kinds of stack content leaks can be seen here:

-https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=linux+kernel+stack+leak

-

-I did some more with perf and cycle counts on running 100,000 execs of

-/bin/true.

-

-before:

-Cycles: 218858861551 218853036130 214727610969 227656844122 224980542841

-Mean:  221015379122.60

-Std Dev: 4662486552.47

-

-after:

-Cycles: 213868945060 213119275204 211820169456 224426673259 225489986348

-Mean:  217745009865.40

-Std Dev: 5935559279.99

-

-It continues to look like it's faster, though the deviation is rather

-wide, but I'm not sure what I could do that would be less noisy.  I'm

-open to ideas!

-

-Link: http://lkml.kernel.org/r/20180221021659.GA37073@beast

-Signed-off-by: Kees Cook <keescook@chromium.org>

-Acked-by: Michal Hocko <mhocko@suse.com>

-Reviewed-by: Andrew Morton <akpm@linux-foundation.org>

-Cc: Andy Lutomirski <luto@kernel.org>

-Cc: Laura Abbott <labbott@redhat.com>

-Cc: Rasmus Villemoes <rasmus.villemoes@prevas.dk>

-Cc: Mel Gorman <mgorman@techsingularity.net>

-Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

-Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

-[ Srivatsa: Backported to 4.9.y ]

-Signed-off-by: Srivatsa S. Bhat <srivatsa@csail.mit.edu>

- include/linux/thread_info.h | 7 +------

- 1 file changed, 1 insertion(+), 6 deletions(-)

-

-diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h

-index 2873baf..5e64367 100644

-+++ b/include/linux/thread_info.h

-@@ -59,12 +59,7 @@ extern long do_no_restart_syscall(struct restart_block *parm);

- 

- #ifdef __KERNEL__

- 

--#ifdef CONFIG_DEBUG_STACK_USAGE

--# define THREADINFO_GFP		(GFP_KERNEL_ACCOUNT | __GFP_NOTRACK | \

--				 __GFP_ZERO)

--#else

--# define THREADINFO_GFP		(GFP_KERNEL_ACCOUNT | __GFP_NOTRACK)

--#endif

-+#define THREADINFO_GFP	(GFP_KERNEL_ACCOUNT | __GFP_NOTRACK | __GFP_ZERO)

- 

- /*

-  * flag set/clear/test wrappers

-2.7.4

-

deleted file mode 100644

@@ -1,48 +0,0 @@

-commit 92d34134193e5b129dc24f8d79cb9196626e8d7a Mon Sep 17 00:00:00 2001

-

-Author: Shankara Pailoor <shankarapailoor@gmail.com>

-Date: Tue, 5 Jun 2018 08:33:27 -0500

-Subject: [PATCH] jfs: Fix inconsistency between memory allocation and

- ea_buf->max_size

-

-The code is assuming the buffer is max_size length, but we weren't

-allocating enough space for it.

-

-Signed-off-by: Shankara Pailoor <shankarapailoor@gmail.com>

-Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>

-

-[ Srinidhi Rao : Backported this change to 4.9 ]

-Signed-off-by: srinidhira0 <srinidhir@vmware.com>

- fs/jfs/xattr.c | 10 ++++++----

- 1 file changed, 6 insertions(+), 4 deletions(-)

-

-diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c

-index c60f3d3..a679798 100644

-+++ b/fs/jfs/xattr.c

-@@ -491,15 +491,17 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size)

- 	if (size > PSIZE) {

- 		/*

- 		 * To keep the rest of the code simple.  Allocate a

--		 * contiguous buffer to work with

-+		 * contiguous buffer to work with. Make the buffer large

-+		 * enough to make use of the whole extent.

- 		 */

--		ea_buf->xattr = kmalloc(size, GFP_KERNEL);

-+		ea_buf->max_size = (size + sb->s_blocksize - 1) &

-+		    ~(sb->s_blocksize - 1);

-+

-+		ea_buf->xattr = kmalloc(ea_buf->max_size, GFP_KERNEL);

- 		if (ea_buf->xattr == NULL)

- 			return -ENOMEM;

- 

- 		ea_buf->flag = EA_MALLOC;

--		ea_buf->max_size = (size + sb->s_blocksize - 1) &

--		    ~(sb->s_blocksize - 1);

- 

- 		if (ea_size == 0)

- 			return 0;

-2.7.4

-

@@ -1,6 +1,6 @@

 #

 # Automatically generated file; DO NOT EDIT.

-# Linux/x86 4.9.111 Kernel Configuration

+# Linux/x86 4.9.120 Kernel Configuration

 #

 CONFIG_64BIT=y

 CONFIG_X86_64=y

@@ -243,6 +243,7 @@ CONFIG_SYSTEM_DATA_VERIFICATION=y

 CONFIG_PROFILING=y

 CONFIG_TRACEPOINTS=y

 CONFIG_KEXEC_CORE=y

+CONFIG_HOTPLUG_SMT=y

 CONFIG_OPROFILE=m

 CONFIG_OPROFILE_EVENT_MULTIPLEX=y

 CONFIG_HAVE_OPROFILE=y

@@ -1,6 +1,6 @@

 #

 # Automatically generated file; DO NOT EDIT.

-# Linux/x86 4.9.111 Kernel Configuration

+# Linux/x86 4.9.120 Kernel Configuration

 #

 CONFIG_64BIT=y

 CONFIG_X86_64=y

@@ -246,6 +246,7 @@ CONFIG_SYSTEM_DATA_VERIFICATION=y

 CONFIG_PROFILING=y

 CONFIG_TRACEPOINTS=y

 CONFIG_KEXEC_CORE=y

+CONFIG_HOTPLUG_SMT=y

 CONFIG_OPROFILE=m

 CONFIG_OPROFILE_EVENT_MULTIPLEX=y

 CONFIG_HAVE_OPROFILE=y

@@ -554,7 +555,6 @@ CONFIG_TRANSPARENT_HUGE_PAGECACHE=y

 CONFIG_CLEANCACHE=y

 CONFIG_FRONTSWAP=y

 # CONFIG_CMA is not set

-CONFIG_MEM_SOFT_DIRTY=y

 CONFIG_ZSWAP=y

 CONFIG_ZPOOL=y

 CONFIG_ZBUD=m

@@ -2368,7 +2368,7 @@ CONFIG_POWER_SUPPLY=y

 # CONFIG_CHARGER_BQ2415X is not set

 # CONFIG_CHARGER_SMB347 is not set

 # CONFIG_BATTERY_GAUGE_LTC2941 is not set

-CONFIG_HWMON=m

+CONFIG_HWMON=y

 # CONFIG_HWMON_VID is not set

 # CONFIG_HWMON_DEBUG_CHIP is not set

@@ -3295,7 +3295,6 @@ CONFIG_MXM_WMI=m

 # Clock Source drivers

 #

 CONFIG_CLKEVT_I8253=y

-CONFIG_I8253_LOCK=y

 CONFIG_CLKBLD_I8253=y

 # CONFIG_ATMEL_PIT is not set

 # CONFIG_SH_TIMER_CMT is not set

@@ -3421,7 +3420,7 @@ CONFIG_EXT4_FS_SECURITY=y

 CONFIG_EXT4_DEBUG=y

 CONFIG_JBD2=y

 CONFIG_JBD2_DEBUG=y

-CONFIG_FS_MBCACHE=m

+CONFIG_FS_MBCACHE=y

 # CONFIG_REISERFS_FS is not set

 CONFIG_JFS_FS=m

 CONFIG_JFS_POSIX_ACL=y

@@ -4219,7 +4218,7 @@ CONFIG_GENERIC_IO=y

 CONFIG_ARCH_USE_CMPXCHG_LOCKREF=y

 CONFIG_ARCH_HAS_FAST_MULTIPLIER=y

 CONFIG_CRC_CCITT=m

-CONFIG_CRC16=m

+CONFIG_CRC16=y

 CONFIG_CRC_T10DIF=y

 CONFIG_CRC_ITU_T=m

 CONFIG_CRC32=y

@@ -4265,6 +4264,7 @@ CONFIG_TEXTSEARCH=y

 CONFIG_TEXTSEARCH_KMP=m

 CONFIG_TEXTSEARCH_BM=m

 CONFIG_TEXTSEARCH_FSM=m

+CONFIG_INTERVAL_TREE=y

 CONFIG_RADIX_TREE_MULTIORDER=y

 CONFIG_ASSOCIATIVE_ARRAY=y

 CONFIG_HAS_IOMEM=y

@@ -1,6 +1,6 @@

 #

 # Automatically generated file; DO NOT EDIT.

-# Linux/x86 4.9.109 Kernel Configuration

+# Linux/x86 4.9.120 Kernel Configuration

 #

 CONFIG_64BIT=y

 CONFIG_X86_64=y

@@ -238,6 +238,7 @@ CONFIG_SLAB=y

 # CONFIG_SLAB_FREELIST_RANDOM is not set

 CONFIG_SYSTEM_DATA_VERIFICATION=y

 # CONFIG_PROFILING is not set

+CONFIG_HOTPLUG_SMT=y

 CONFIG_HAVE_OPROFILE=y

 CONFIG_OPROFILE_NMI_TIMER=y

 # CONFIG_KPROBES is not set

@@ -1,6 +1,6 @@

 #

 # Automatically generated file; DO NOT EDIT.

-# Linux/x86 4.9.78 Kernel Configuration

+# Linux/x86 4.9.120 Kernel Configuration

 #

 CONFIG_64BIT=y

 CONFIG_X86_64=y

@@ -242,6 +242,7 @@ CONFIG_SLUB_CPU_PARTIAL=y

 CONFIG_SYSTEM_DATA_VERIFICATION=y

 CONFIG_PROFILING=y

 CONFIG_TRACEPOINTS=y

+CONFIG_HOTPLUG_SMT=y

 CONFIG_OPROFILE=m

 CONFIG_OPROFILE_EVENT_MULTIPLEX=y

 CONFIG_HAVE_OPROFILE=y

@@ -494,7 +495,6 @@ CONFIG_ARCH_SPARSEMEM_ENABLE=y

 CONFIG_ARCH_SPARSEMEM_DEFAULT=y

 CONFIG_ARCH_SELECT_MEMORY_MODEL=y

 CONFIG_ARCH_MEMORY_PROBE=y

-CONFIG_ARCH_PROC_KCORE_TEXT=y

 CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000

 CONFIG_SELECT_MEMORY_MODEL=y

 CONFIG_SPARSEMEM_MANUAL=y

@@ -1,15 +1,15 @@

 %global security_hardening none

 Summary:        Kernel

 Name:           linux-aws

-Version:        4.9.118

-Release:        2%{?kat_build:.%kat_build}%{?dist}

+Version:        4.9.120

+Release:        1%{?kat_build:.%kat_build}%{?dist}

 License:    	GPLv2

 URL:        	http://www.kernel.org/

 Group:        	System Environment/Kernel

 Vendor:         VMware, Inc.

 Distribution: 	Photon

 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz

-%define sha1 linux=1f441c2113d0b7bba57dd8f6e5f5db07d222d47b

+%define sha1 linux=66f5b1a840e64ecf7fbc676abce9c9c40c21aec7

 Source1:	config-aws

 Source2:	initramfs.trigger

 # common

@@ -65,10 +65,6 @@ Patch45:        0001-xfs-set-format-back-to-extents-if-xfs_bmap_extents_t.patch

 Patch46:        0001-xfs-move-inode-fork-verifiers-to-xfs-dinode-verify.patch

 Patch47:        0002-xfs-verify-dinode-header-first.patch

 Patch48:        0003-xfs-enhance-dinode-verifier.patch

-# Fix for CVE-2018-12233

-Patch49:        0001-jfs-Fix-inconsistency-between-memory-allocation-and-ea_buf_maxsize.patch

-

-Patch70: 0001-fork-unconditionally-clear-stack-on-fork.patch

 # Out-of-tree patches from AppArmor:

 Patch71: 0001-UBUNTU-SAUCE-AppArmor-basic-networking-rules.patch

@@ -235,9 +231,6 @@ This package contains the 'perf' performance analysis tools for Linux kernel.

 %patch46 -p1

 %patch47 -p1

 %patch48 -p1

-%patch49 -p1

-

-%patch70 -p1

 %patch71 -p1

 %patch72 -p1

@@ -447,6 +440,8 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg

 /usr/share/doc/*

 %changelog

+*   Fri Aug 17 2018 Bo Gan <ganb@vmware.com> 4.9.120-1

+-   Update to version 4.9.120 (l1tf fixes)

 *   Thu Aug 09 2018 Srinidhi Rao <srinidhir@vmware.com> 4.9.118-2

 -   Fix CVE-2018-12233

 *   Tue Aug 07 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.118-1

@@ -1,15 +1,15 @@

 %global security_hardening none

 Summary:        Kernel

 Name:           linux-esx

-Version:        4.9.118

-Release:        2%{?dist}

+Version:        4.9.120

+Release:        1%{?dist}

 License:        GPLv2

 URL:            http://www.kernel.org/

 Group:          System Environment/Kernel

 Vendor:         VMware, Inc.

 Distribution:   Photon

 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz

-%define sha1 linux=1f441c2113d0b7bba57dd8f6e5f5db07d222d47b

+%define sha1 linux=66f5b1a840e64ecf7fbc676abce9c9c40c21aec7

 Source1:        config-esx

 Source2:        initramfs.trigger

 # common

@@ -62,10 +62,6 @@ Patch45:        0001-xfs-set-format-back-to-extents-if-xfs_bmap_extents_t.patch

 Patch46:        0001-xfs-move-inode-fork-verifiers-to-xfs-dinode-verify.patch

 Patch47:        0002-xfs-verify-dinode-header-first.patch

 Patch48:        0003-xfs-enhance-dinode-verifier.patch

-# Fix for CVE-2018-12233

-Patch49:        0001-jfs-Fix-inconsistency-between-memory-allocation-and-ea_buf_maxsize.patch

-

-Patch70: 0001-fork-unconditionally-clear-stack-on-fork.patch

 BuildRequires: bc

@@ -145,9 +141,7 @@ The Linux package contains the Linux kernel doc files

 %patch46 -p1

 %patch47 -p1

 %patch48 -p1

-%patch49 -p1

-%patch70 -p1

 %build

 # patch vmw_balloon driver

@@ -244,6 +238,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg

 /usr/src/linux-headers-%{uname_r}

 %changelog

+*   Fri Aug 17 2018 Bo Gan <ganb@vmware.com> 4.9.120-1

+-   Update to version 4.9.120 (l1tf fixes)

 *   Thu Aug 09 2018 Srinidhi Rao <srinidhir@vmware.com> 4.9.118-2

 -   Fix CVE-2018-12233

 *   Tue Aug 07 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.118-1

@@ -1,15 +1,15 @@

 %global security_hardening none

 Summary:        Kernel

 Name:           linux-secure

-Version:        4.9.118

-Release:        2%{?kat_build:.%kat_build}%{?dist}

+Version:        4.9.120

+Release:        1%{?kat_build:.%kat_build}%{?dist}

 License:        GPLv2

 URL:            http://www.kernel.org/

 Group:          System Environment/Kernel

 Vendor:         VMware, Inc.

 Distribution:   Photon

 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz

-%define sha1 linux=1f441c2113d0b7bba57dd8f6e5f5db07d222d47b

+%define sha1 linux=66f5b1a840e64ecf7fbc676abce9c9c40c21aec7

 Source1:        config-secure

 Source2:        aufs4.9.tar.gz

 %define sha1 aufs=ebe716ce4b638a3772c7cd3161abbfe11d584906

@@ -71,10 +71,7 @@ Patch47:        0001-xfs-set-format-back-to-extents-if-xfs_bmap_extents_t.patch

 Patch48:        0001-xfs-move-inode-fork-verifiers-to-xfs-dinode-verify.patch

 Patch49:        0002-xfs-verify-dinode-header-first.patch

 Patch50:        0003-xfs-enhance-dinode-verifier.patch

-# Fix for CVE-2018-12233

-Patch51:        0001-jfs-Fix-inconsistency-between-memory-allocation-and-ea_buf_maxsize.patch

-Patch70: 0001-fork-unconditionally-clear-stack-on-fork.patch

 # Out-of-tree patches from AppArmor:

 Patch71: 0001-UBUNTU-SAUCE-AppArmor-basic-networking-rules.patch

@@ -201,9 +198,7 @@ EOF

 %patch48 -p1

 %patch49 -p1

 %patch50 -p1

-%patch51 -p1

-%patch70 -p1

 %patch71 -p1

 %patch72 -p1

@@ -339,6 +334,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg

 /usr/src/linux-headers-%{uname_r}

 %changelog

+*   Fri Aug 17 2018 Bo Gan <ganb@vmware.com> 4.9.120-1

+-   Update to version 4.9.120 (l1tf fixes)

 *   Thu Aug 09 2018 Srinidhi Rao <srinidhir@vmware.com> 4.9.118-2

 -   Fix CVE-2018-12233

 *   Tue Aug 07 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.118-1

@@ -1,15 +1,15 @@

 %global security_hardening none

 Summary:        Kernel

 Name:           linux

-Version:        4.9.118

-Release:        2%{?kat_build:.%kat_build}%{?dist}

+Version:        4.9.120

+Release:        1%{?kat_build:.%kat_build}%{?dist}

 License:    	GPLv2

 URL:        	http://www.kernel.org/

 Group:        	System Environment/Kernel

 Vendor:         VMware, Inc.

 Distribution: 	Photon

 Source0:        http://www.kernel.org/pub/linux/kernel/v4.x/linux-%{version}.tar.xz

-%define sha1 linux=1f441c2113d0b7bba57dd8f6e5f5db07d222d47b

+%define sha1 linux=66f5b1a840e64ecf7fbc676abce9c9c40c21aec7

 Source1:	config

 Source2:	initramfs.trigger

 %define ena_version 1.1.3

@@ -70,10 +70,6 @@ Patch45:        0001-xfs-set-format-back-to-extents-if-xfs_bmap_extents_t.patch

 Patch46:        0001-xfs-move-inode-fork-verifiers-to-xfs-dinode-verify.patch

 Patch47:        0002-xfs-verify-dinode-header-first.patch

 Patch48:        0003-xfs-enhance-dinode-verifier.patch

-# Fix for CVE-2018-12233

-Patch49:        0001-jfs-Fix-inconsistency-between-memory-allocation-and-ea_buf_maxsize.patch

-

-Patch70: 0001-fork-unconditionally-clear-stack-on-fork.patch

 # Out-of-tree patches from AppArmor:

 Patch71: 0001-UBUNTU-SAUCE-AppArmor-basic-networking-rules.patch

@@ -193,9 +189,6 @@ This package contains the 'perf' performance analysis tools for Linux kernel.

 %patch46 -p1

 %patch47 -p1

 %patch48 -p1

-%patch49 -p1

-

-%patch70 -p1

 %patch71 -p1

 %patch72 -p1

@@ -370,6 +363,8 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg

 /usr/share/doc/*

 %changelog

+*   Fri Aug 17 2018 Bo Gan <ganb@vmware.com> 4.9.120-1

+-   Update to version 4.9.120 (l1tf fixes)

 *   Thu Aug 09 2018 Srinidhi Rao <srinidhir@vmware.com> 4.9.118-2

 -   Fix CVE-2018-12233

 *   Tue Aug 07 2018 Srivatsa S. Bhat <srivatsa@csail.mit.edu> 4.9.118-1