kernel, perf, python security update

CentOS Errata and Security Advisory CESA-2015:1623

The kernel packages contain the Linux kernel, the core of any Linux
operating system.

Two flaws were found in the way the Linux kernel’s networking
implementation handled UDP packets with incorrect checksum values. A remote
attacker could potentially use these flaws to trigger an infinite loop in
the kernel, resulting in a denial of service on the system, or cause a
denial of service in applications using the edge triggered epoll
functionality. (CVE-2015-5364, CVE-2015-5366, Important)

This update also fixes the following bugs:

• When removing a directory, and a reference was held to that directory by
  a reference to a negative child dentry, the directory dentry was previously
  not killed. In addition, once the negative child dentry was killed, an
  unlinked and unused dentry was present in the cache. As a consequence,
  deadlock could be caused by forcing the dentry eviction while the file
  system in question was frozen. With this update, all unused dentries are
  unhashed and evicted just after a successful directory removal, which
  avoids the deadlock, and the system no longer hangs in the aforementioned
  scenario. (BZ#1243400)

• Due to the broken s_umount lock ordering, a race condition occurred when
  an unlinked file was closed and the sync (or syncfs) utility was run at the
  same time. As a consequence, deadlock occurred on a frozen file system
  between sync and a process trying to unfreeze the file system. With this
  update, sync (or syncfs) is skipped on a frozen file system, and deadlock
  no longer occurs in the aforementioned situation. (BZ#1243404)

• Previously, in the scenario when a file was opened by file handle
  (fhandle) with its dentry not present in dcache (“cold dcache”) and then
  making use of the unlink() and close() functions, the inode was not freed
  upon the close() system call. As a consequence, the iput() final was
  delayed indefinitely. A patch has been provided to fix this bug, and the
  inode is now freed as expected. (BZ#1243406)

• Due to a corrupted Executable and Linkable Format (ELF) header in the
  /proc/vmcore file, the kdump utility failed to provide any information.
  The underlying source code has been patched, and kdump now provides
  debuging information for kernel crashes as intended. (BZ#1245195)

• Previously, running the multipath request queue caused regressions in
  cases where paths failed regularly under I/O load. This regression
  manifested as I/O stalls that exceeded 300 seconds. This update reverts the
  changes aimed to reduce running the multipath request queue resulting in
  I/O completing in a timely manner. (BZ#1246095)

All kernel users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues. The system must be
rebooted for this update to take effect.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2015-August/083489.html

Affected packages:
kernel
kernel-abi-whitelists
kernel-debug
kernel-debug-devel
kernel-devel
kernel-doc
kernel-firmware
kernel-headers
perf
python-perf

Upstream details at:
https://access.redhat.com/errata/RHSA-2015:1623