(RHSA-2016:0224) Important: kernel-rt security, bug fix, and enhancement update

The kernel-rt packages contain the Linux kernel, the core of any Linux
operating system.

• It was found that the Linux kernel’s keys subsystem did not correctly
  garbage collect uninstantiated keyrings. A local attacker could use this
  flaw to crash the system or, potentially, escalate their privileges on the
  system. (CVE-2015-7872, Important)

• A flaw was found in the way the Linux kernel handled IRET faults during
  the processing of NMIs. An unprivileged, local user could use this flaw to
  crash the system or, potentially (although highly unlikely), escalate their
  privileges on the system. (CVE-2015-5157, Moderate)

This update provides a build of the kernel-rt package for Red Hat
Enterprise MRG 2.5 that is layered on Red Hat Enterprise Linux 6, and
provides a number of bug fixes and enhancements, including:

• [md] dm: fix AB-BA deadlock in __dm_destroy()

• [md] revert "dm-mpath: fix stalls when handling invalid ioctl

• [cpufreq] intel_pstate: Fix limits->max_perf and limits->max_policy_pct
  rounding errors

• [cpufreq] revert “intel_pstate: fix rounding error in max_freq_pct”

• [crypto] nx: 842 - Add CRC and validation support

• [of] return NUMA_NO_NODE from fallback of_node_to_nid()

(BZ#1277670)

The HP Smart Array (hpsa) SCSI driver has been updated to the latest
version included in a Red Hat release. (BZ#1224096)

This update also fixes the following bugs:

• A heavy load of incoming packets on a fast networking driver (like the
  i40e) will both stress the softirq mechanism on the realtime kernel (as
  described in BZ#1293229) and exercise the possible livelock in the netpoll
  NAPI/busy polling routines (as described in BZ#1293230). The fixes applied
  to both BZ#1293229 and BZ#1293230 will address these issues by hardening
  the locking mechanism for the netpoll NAPI/busy polling and by enhancing
  the way softirqs are serviced. These fixes also create a failsafe to
  avoiding RCU stalls on a heavily loaded system and allows the networking
  driver to work as expected. (BZ#1200766)

• The nohz_full code in older versions of the MRG-Realtime kernels was
  incomplete and known to be problematic due to the way the old
  implementation interacted with the real time features in the kernel.
  The nohz_full kernel code has been updated enabling this feature to
  function as expected and allowing this feature to be enabled in the
  realtime kernel. (BZ#1278511)

• Because the realtime kernel replaces most of the spinlocks with
  rtmutexes, the locking scheme used in both NAPI polling and busy polling
  could become out of synchronization with the State Machine they protected.
  This could cause system performance degradation or even a livelock
  situation when a machine with faster NICs (10g or 40g) was subject to a
  heavy pressure receiving network packets. The locking schemes on NAPI
  polling and busy polling routines were hardened to enforce the State
  machine sanity to help ensure the system continues to function properly
  under pressure. (BZ#1295884)

• A possible livelock in the NAPI polling and busy polling routines could
  lead the system to a livelock on threads running at high, realtime,
  priorities. The threads running at priorities lower than the ones of the
  threads involved in the livelock would be prevented from running on the
  CPUs affected by the livelock. Among those lower priority threads are the
  rcuc/ threads. Right before (4 jiffies) a RCU stall is detected, the rcuc/
  threads on the CPUs facing the livelock have their priorities boosted above
  the priority of the threads involved in the livelock. The softirq code was
  also updated to be more robust. These modifications allowed the rcuc/
  threads to execute even under system pressure, mitigating the RCU stalls.
  (BZ#1295885)

All kernel-rt users are advised to upgrade to these updated packages, which
correct these issues and add these enhancements. The system must be
rebooted for this update to take effect.