Conversation
jira KERNEL-1600 cve CVE-2026-43248 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Eugenio Pérez <eperezma@redhat.com> commit cd025c1 Remove duplication by consolidating these here. This reduces the posibility of a parent driver missing them. While we're at it, fix a bug in vdpa_sim where a valid ASID can be assigned to a group equal to ngroups, causing an out of bound write. Cc: stable@vger.kernel.org Fixes: bda324f ("vdpasim: control virtqueue support") Acked-by: Jason Wang <jasowang@redhat.com> Signed-off-by: Eugenio Pérez <eperezma@redhat.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Message-Id: <20260119143306.1818855-2-eperezma@redhat.com> (cherry picked from commit cd025c1) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 cve CVE-2026-52924 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Xin Long <lucien.xin@gmail.com> commit e374b22 sctp_stream_update() is only invoked when the association is moved into COOKIE_WAIT during association setup/reconfiguration. In this path, the outbound stream scheduler state (stream->out_curr) is expected to be clean, since no user data should have been transmitted yet unless the state machine has already partially progressed. However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a Stale Cookie ERROR is received, the association is rolled back from COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already have been queued and even bundled with the COOKIE-ECHO chunk. During the rollback, sctp_stream_update() frees the old stream table and installs a new one, but it does not invalidate stream->out_curr. As a result, out_curr may still point to a freed sctp_stream_out entry from the previous stream state. Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on stream->out_curr->ext, which can lead to use-after-free once the old stream state has been released via sctp_stream_free(). This results in crashes such as (reported by Yuqi): BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140 Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312 CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted 7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full) sctp_sched_fcfs_dequeue+0x13a/0x140 sctp_outq_flush+0x1603/0x33e0 sctp_do_sm+0x31c9/0x5d30 sctp_assoc_bh_rcv+0x392/0x6f0 sctp_inq_push+0x1db/0x270 sctp_rcv+0x138d/0x3c10 Fix this by fully purging the association outqueue when handling the Stale Cookie case. This ensures all pending transmit and retransmit state is dropped, and any scheduler cached pointers are invalidated, making it safe to rebuild stream state during COOKIE_WAIT restart. Updating only stream->out_curr would be insufficient, since queued and retransmittable data would still reference the old stream state and trigger later use-after-free in dequeue paths. Fixes: 5bbbbe3 ("sctp: introduce stream scheduler foundations") Reported-by: Yuan Tan <yuantan098@gmail.com> Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Reported-by: Zhengchuan Liang <zcliangcn@gmail.com> Reported-by: Xin Liu <bird@lzu.edu.cn> Reported-by: Yuqi Xu <xuyq21@lenovo.com> Reported-by: Ren Wei <n05ec@lzu.edu.cn> Signed-off-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/94318159b9052907a6cbb7256aee8b5f8dfbfccb.1780510304.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit e374b22) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
…how() jira KERNEL-1600 cve CVE-2026-46149 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Greg Kroah-Hartman <gregkh@linuxfoundation.org> commit 772a896 target_tg_pt_gp_members_show() formats LUN paths with snprintf() into a 256-byte stack buffer, then will memcpy() cur_len bytes from that buffer. snprintf() returns the length the output would have had, which can exceed the buffer size when the fabric WWN is long because iSCSI IQN names can be up to 223 bytes. The check at the memcpy() site only guards the destination page write, not the source read, so memcpy() will read past the stack buffer and copy adjacent stack contents to the sysfs reader, which when CONFIG_FORTIFY_SOURCE is enabled, fortify_panic() will be triggered. Commit 27e0665 ("scsi: target: target_core_configfs: Add length check to avoid buffer overflow") added the same bound to the target_lu_gp_members_show() but the tg_pt_gp variant was missed so resolve that here. Cc: Martin K. Petersen <martin.petersen@oracle.com> Fixes: c66ac9d ("[SCSI] target: Add LIO target core v4.0.0-rc6") Assisted-by: gregkh_clanker_t1000 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://patch.msgid.link/2026041159-garter-theft-3be0@gregkh Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> (cherry picked from commit 772a896) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 cve CVE-2026-63889 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Michael Bommarito <michael.bommarito@gmail.com> commit a9a3923 An adjacent Fibre Channel fabric actor that can deliver an FPIN ELS frame to an lpfc or qla2xxx Linux initiator can trigger a non-return in the generic FC transport. This is not a local userspace or IP network path; the attacker must be able to inject fabric traffic, for example as a compromised switch or fabric controller, or as a same-zone N_Port on a fabric that permits source spoofing. The Link-Integrity and Peer-Congestion FPIN walkers used a u8 loop counter against the 32-bit on-wire pname_count field, and did not bound pname_count by the descriptor body already validated by the TLV walker. A pname_count of 256 therefore wraps the counter and keeps the loop condition true indefinitely. Factor the shared pname_list[] walk into one helper, widen the counter to u32, and clamp pname_count against the entries that fit in the descriptor body before iterating. Fixes: 3dcfe0d ("scsi: fc: Parse FPIN packets and update statistics") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-7 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Reviewed-by: John Garry <john.g.garry@oracle.com> Link: https://patch.msgid.link/20260520133015.1018937-1-michael.bommarito@gmail.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> (cherry picked from commit a9a3923) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 cve CVE-2026-53131 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Zhengchuan Liang <zcliangcn@gmail.com> commit 62443dc `ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and `hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)` after either assuming that the skb is associated with an Ethernet device or checking only that the `ETH_HLEN` bytes at `skb_mac_header(skb)` lie between `skb->head` and `skb->data`. Make these paths first verify that the skb is associated with an Ethernet device, that the MAC header was set, and that it spans at least a full Ethernet header before accessing `eth_hdr(skb)`. Suggested-by: Florian Westphal <fw@strlen.de> Tested-by: Ren Wei <enjou1224z@gmail.com> Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Signed-off-by: Florian Westphal <fw@strlen.de> (cherry picked from commit 62443dc) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 cve CVE-2025-40149 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@google.com> commit c65f27b get_netdev_for_sock() is called during setsockopt(), so not under RCU. Using sk_dst_get(sk)->dev could trigger UAF. Let's use __sk_dst_get() and dst_dev_rcu(). Note that the only ->ndo_sk_get_lower_dev() user is bond_sk_get_lower_dev(), which uses RCU. Fixes: e8f6979 ("net/tls: Add generic NIC offload infrastructure") Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Link: https://patch.msgid.link/20250916214758.650211-6-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit c65f27b) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 cve CVE-2026-64111 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Stephen Smalley <stephen.smalley.work@gmail.com> commit 4a9b165 Just as proc_pid_attr_write() already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allow the transition. Cc: stable@vger.kernel.org Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Paul Moore <paul@paul-moore.com> (cherry picked from commit 4a9b165) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 cve CVE-2025-68745 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Tony Battersby <tonyb@cybernetics.com> commit d46c69a Commit aefed3e ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") caused two problems: 1. Commands sent to FW, after chip reset got stuck and never freed as FW is not going to respond to them anymore. 2. BUG_ON(cmd->sg_mapped) in qlt_free_cmd(). Commit 26f9ce5 ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands") attempted to fix this, but introduced another bug under different circumstances when two different CPUs were racing to call qlt_unmap_sg() at the same time: BUG_ON(!valid_dma_direction(dir)) in dma_unmap_sg_attrs(). So revert "scsi: qla2xxx: Fix missed DMA unmap for aborted commands" and partially revert "scsi: qla2xxx: target: Fix offline port handling and host reset handling" at __qla2x00_abort_all_cmds. Fixes: aefed3e ("scsi: qla2xxx: target: Fix offline port handling and host reset handling") Fixes: 26f9ce5 ("scsi: qla2xxx: Fix missed DMA unmap for aborted commands") Co-developed-by: Dmitry Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Dmitry Bogdanov <d.bogdanov@yadro.com> Signed-off-by: Tony Battersby <tonyb@cybernetics.com> Link: https://patch.msgid.link/0e7e5d26-e7a0-42d1-8235-40eeb27f3e98@cybernetics.com Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com> (cherry picked from commit d46c69a) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 cve CVE-2026-53246 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Xin Long <lucien.xin@gmail.com> commit 0861615 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-6.12.0-211.55.1.el10_2/0861615c.failed When a listening SCTP server processes a COOKIE_ECHO chunk, the cached peer INIT chunk embedded after the cookie is parsed and its parameters are later walked by sctp_process_init() using sctp_walk_params(). However, the chunk header length of this cached INIT chunk was not validated against the remaining buffer in the COOKIE_ECHO payload. If the length field is inflated, the parameter walk can run beyond the actual received data, leading to out-of-bounds reads and potential memory corruption during later parameter handling (e.g. STATE_COOKIE processing and kmemdup() copies). Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT chunk length does not exceed the available data in the COOKIE_ECHO buffer before it is used. Fixes: 1da177e ("Linux-2.6.12-rc2") Reported-by: Brian Geffon <bgeffon@google.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/eb60825fa22d6f9e663c7d4dbb69f397b5d34d42.1780362366.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 0861615) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # net/sctp/sm_make_chunk.c
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Xin Long <lucien.xin@gmail.com> commit 6f4c80a Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-6.12.0-211.55.1.el10_2/6f4c80a2.failed sctp_unpack_cookie() only checked that the embedded INIT chunk length did not exceed the remaining cookie payload, but did not ensure that the INIT chunk is large enough to contain a complete INIT header. A malformed COOKIE_ECHO can therefore carry a truncated INIT chunk whose length field is smaller than sizeof(struct sctp_init_chunk). Later, sctp_process_init() accesses INIT parameters unconditionally, which may lead to out-of-bounds reads. In addition, raw_addr_list_len is not fully validated against the remaining cookie payload. When cookie authentication is disabled, an attacker can supply an oversized raw_addr_list_len and cause sctp_raw_to_bind_addrs() to read beyond the end of the cookie. The address parser also lacks sufficient bounds checks for parameter headers and lengths, allowing malformed address parameters to trigger out-of-bounds reads. Fix this by: - requiring the embedded INIT chunk length to be at least sizeof(struct sctp_init_chunk); - validating that the INIT chunk and raw address list together fit within the cookie payload; - verifying sufficient data exists for each address parameter header and payload before parsing it. Note that sctp_verify_init() must be called after sctp_unpack_cookie() and before sctp_process_init() when cookie authentication is disabled. This will be addressed in a separate patch. Fixes: 1da177e ("Linux-2.6.12-rc2") Reported-by: Sashiko <sashiko-bot@kernel.org> Signed-off-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/75af23a89adf881a0895d511775e4770da367cbf.1780873427.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 6f4c80a) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # net/sctp/sm_make_chunk.c
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@amazon.com> commit 84960bf net/af_unix.h is included by core and some LSMs, but most definitions need not be. Let's move struct unix_{vertex,edge} to net/unix/garbage.c and other definitions to net/unix/af_unix.h. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Joe Damato <jdamato@fastly.com> Link: https://patch.msgid.link/20250318034934.86708-3-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 84960bf) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Stephen Rothwell <sfr@canb.auug.org.au> commit 705094f After merging the apparmor tree, today's linux-next build (x86_64 allmodconfig) failed like this: security/apparmor/af_unix.c: In function 'unix_state_double_lock': security/apparmor/af_unix.c:627:17: error: implicit declaration of function 'unix_state_lock'; did you mean 'unix_state_double_lock'? [-Wimplicit-function-declaration] 627 | unix_state_lock(sk1); | ^~~~~~~~~~~~~~~ | unix_state_double_lock security/apparmor/af_unix.c: In function 'unix_state_double_unlock': security/apparmor/af_unix.c:642:17: error: implicit declaration of function 'unix_state_unlock'; did you mean 'unix_state_double_lock'? [-Wimplicit-function-declaration] 642 | unix_state_unlock(sk1); | ^~~~~~~~~~~~~~~~~ | unix_state_double_lock Caused by commit c05e705 ("apparmor: add fine grained af_unix mediation") interacting with commit 84960bf ("af_unix: Move internal definitions to net/unix/.") from the net-next tree. Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com> Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au> Link: https://patch.msgid.link/20250326150148.72d9138d@canb.auug.org.au Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 705094f) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@amazon.com> commit f9af583 This is a prep patch to make the following changes cleaner. No functional change intended. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Reviewed-by: Joe Damato <jdamato@fastly.com> Link: https://patch.msgid.link/20250318034934.86708-2-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit f9af583) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@amazon.com> commit 3056172 include/net/af_unix.h indirectly includes some definitions for structs. Let's include such headers explicitly. linux/atomic.h : scm_stat.nr_fds linux/net.h : unix_sock.peer_wq linux/path.h : unix_sock.path linux/spinlock.h : unix_sock.lock linux/wait.h : unix_sock.peer_wake uapi/linux/un.h : unix_address.name[] linux/socket.h is removed as the structs there are not used directly, and linux/un.h is clarified with uapi as un.h only exists under include/uapi. While at it, duplicate headers are removed from .c files. Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://patch.msgid.link/20250318034934.86708-4-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 3056172) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@amazon.com> commit 0083e3e net/unix/*.c include many unnecessary header files (rtnetlink.h, netdevice.h, etc). Let's clean them up. af_unix.c: +uapi/linux/sockios.h : Only exist under include/uapi +uapi/linux/termios.h : Only exist under include/uapi -linux/freezer.h : No longer use freezable_schedule_timeout() -linux/in.h : No ipv4_is_XXX() etc -linux/module.h : No longer support CONFIG_UNIX=m -linux/netdevice.h : No dev used -linux/rtnetlink.h : Not part of rtnetlink API -linux/signal.h : signal_pending() is defined in sched/signal.h -linux/stat.h : No struct stat used -net/checksum.h : CHECKSUM_UNNECESSARY is defined in skbuff.h diag.c: +linux/dcache.h : struct dentry in sk_diag_dump_vfs() +linux/user_namespace.h : struct user_namespace in sk_diag_dump_uid() +uapi/linux/unix_diag.h : Only exist under include/uapi/ garbage.c: +linux/list.h : struct unix_{vertex,edge}, etc +linux/workqueue.h : DECLARE_WORK(unix_gc_work, ...) -linux/file.h : No fget() etc -linux/kernel.h : No cond_resched() etc -linux/netdevice.h : No dev used -linux/proc_fs.h : No procfs provided -linux/string.h : No memcpy(), kmemdup(), etc sysctl_net_unix.c: +linux/string.h : kmemdup() +net/net_namespace.h : struct net, net_eq() -linux/mm.h : slab.h is enough Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Link: https://patch.msgid.link/20250318034934.86708-5-kuniyu@amazon.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 0083e3e) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@google.com> commit 60e6489 Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro. The repro consists of three stages. 1) 1-a. Create a single cyclic reference with many sockets 1-b. close() all sockets 1-c. Trigger GC 2) 2-a. Pass sk-A to an embryo sk-B 2-b. Pass sk-X to sk-X 2-c. Trigger GC 3) 3-a. accept() the embryo sk-B 3-b. Pass sk-B to sk-C 3-c. close() the in-flight sk-A 3-d. Trigger GC As of 2-c, sk-A and sk-X are linked to unix_unvisited_vertices, and unix_walk_scc() groups them into two different SCCs: unix_sk(sk-A)->vertex->scc_index = 2 (UNIX_VERTEX_INDEX_START) unix_sk(sk-X)->vertex->scc_index = 3 Once GC completes, unix_graph_grouped is set to true. Also, unix_graph_maybe_cyclic is set to true due to sk-X's cyclic self-reference, which makes close() trigger GC. At 3-b, unix_add_edge() allocates unix_sk(sk-B)->vertex and links it to unix_unvisited_vertices. unix_update_graph() is called at 3-a. and 3-b., but neither unix_graph_grouped nor unix_graph_maybe_cyclic is changed because both sk-B's listener and sk-C are not in-flight. 3-c decrements sk-A's file refcnt to 1. Since unix_graph_grouped is true at 3-d, unix_walk_scc_fast() is finally called and iterates 3 sockets sk-A, sk-B, and sk-X: sk-A -> sk-B (-> sk-C) sk-X -> sk-X This is totally fine. All of them are not yet close()d and should be grouped into different SCCs. However, unix_vertex_dead() misjudges that sk-A and sk-B are in the same SCC and sk-A is dead. unix_sk(sk-A)->scc_index == unix_sk(sk-B)->scc_index <-- Wrong! && sk-A's file refcnt == unix_sk(sk-A)->vertex->out_degree ^-- 1 in-flight count for sk-B -> sk-A is dead !? The problem is that unix_add_edge() does not initialise scc_index. Stage 1) is used for heap spraying, making a newly allocated vertex have vertex->scc_index == 2 (UNIX_VERTEX_INDEX_START) set by unix_walk_scc() at 1-c. Let's track the max SCC index from the previous unix_walk_scc() call and assign the max + 1 to a new vertex's scc_index. This way, we can continue to avoid Tarjan's algorithm while preventing misjudgments. Fixes: ad08192 ("af_unix: Avoid Tarjan's algorithm if unnecessary.") Reported-by: Quang Le <quanglex97@gmail.com> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20251109025233.3659187-1-kuniyu@google.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> (cherry picked from commit 60e6489) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@google.com> commit 58b47c7 __unix_walk_scc() and unix_walk_scc_fast() call unix_scc_cyclic() for each SCC to check if it forms a cyclic reference, so that we can skip GC at the following invocations in case all SCCs do not have any cycles. If we count the number of cyclic SCCs in __unix_walk_scc(), we can simplify unix_walk_scc_fast() because the number of cyclic SCCs only changes when it garbage-collects a SCC. So, let's count cyclic SCC in __unix_walk_scc() and decrement it in unix_walk_scc_fast() when performing garbage collection. Note that we will use this counter in a later patch to check if a cycle existed in the previous GC run. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20251115020935.2643121-2-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 58b47c7) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@google.com> commit 6b6f3c7 GC manages its state by two variables, unix_graph_maybe_cyclic and unix_graph_grouped, both of which are set to false in the initial state. When an AF_UNIX socket is passed to an in-flight AF_UNIX socket, unix_update_graph() sets unix_graph_maybe_cyclic to true and unix_graph_grouped to false, making the next GC invocation call unix_walk_scc() to group SCCs. Once unix_walk_scc() finishes, sockets in the same SCC are linked via vertex->scc_entry. Then, unix_graph_grouped is set to true so that the following GC invocations can skip Tarjan's algorithm and simply iterate through the list in unix_walk_scc_fast(). In addition, if we know there is at least one cyclic reference, we set unix_graph_maybe_cyclic to true so that we do not skip GC. So the state transitions as follows: (unix_graph_maybe_cyclic, unix_graph_grouped) = (false, false) -> (true, false) -> (true, true) or (false, true) ^.______________/________________/ There is no transition to the initial state where both variables are false. If we consider the initial state as grouped, we can see that the GC actually has a tristate. Let's consolidate two variables into one enum. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20251115020935.2643121-3-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 6b6f3c7) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@google.com> commit da8fc7a Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-6.12.0-211.55.1.el10_2/da8fc7a3.failed We have been triggering GC on every close() if there is even one inflight AF_UNIX socket. This is because the old GC implementation had no idea of the graph shape formed by SCM_RIGHTS references. The new GC knows whether there could be a cyclic reference or not, and we can do better. Let's not trigger GC from close() if there is no cyclic reference or GC is already in progress. While at it, unix_gc() is renamed to unix_schedule_gc() as it does not actually perform GC since commit 8b90a9f ("af_unix: Run GC on only one CPU."). Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20251115020935.2643121-4-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit da8fc7a) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # net/unix/af_unix.c
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@google.com> commit 3849005 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-6.12.0-211.55.1.el10_2/38490054.failed We have been calling wait_for_unix_gc() on every sendmsg() in case there are too many inflight AF_UNIX sockets. This is also because the old GC implementation had poor knowledge of the inflight sockets and had to suspect every sendmsg(). This was improved by commit d9f21b3 ("af_unix: Try to run GC async."), but we do not even need to call wait_for_unix_gc() if the process is not sending AF_UNIX sockets. The wait_for_unix_gc() call only helps when a malicious process continues to create cyclic references, and we can detect that in a better place and slow it down. Let's move wait_for_unix_gc() to unix_prepare_fpl() that is called only when AF_UNIX socket fd is passed via SCM_RIGHTS. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20251115020935.2643121-5-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 3849005) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # net/unix/af_unix.c # net/unix/af_unix.h
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@google.com> commit e29c7a4 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-6.12.0-211.55.1.el10_2/e29c7a4c.failed unix_tot_inflight is a poor metric, only telling the number of inflight AF_UNXI sockets, and we should use unix_graph_state instead. Also, if the receiver is catching up with the passed fds, the sender does not need to schedule GC. GC only helps unreferenced cyclic SCM_RIGHTS references, and in such a situation, the malicious sendmsg() will continue to call wait_for_unix_gc() and hit the UNIX_INFLIGHT_SANE_USER condition. Let's make only malicious users schedule GC and wait for it to finish if a cyclic reference exists during the previous GC run. Then, sane users will pay almost no cost for wait_for_unix_gc(). Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20251115020935.2643121-6-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit e29c7a4) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # net/unix/garbage.c
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@google.com> commit ab8b231 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-6.12.0-211.55.1.el10_2/ab8b2315.failed unix_tot_inflight is no longer used. Let's remove it. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20251115020935.2643121-7-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit ab8b231) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # net/unix/garbage.c
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@google.com> commit 24fa77d Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-6.12.0-211.55.1.el10_2/24fa77da.failed unix_schedule_gc() and wait_for_unix_gc() share some code. Let's consolidate the two. Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20251115020935.2643121-8-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 24fa77d) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # net/unix/af_unix.c # net/unix/af_unix.h # net/unix/garbage.c
jira KERNEL-1600 cve CVE-2026-23394 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@google.com> commit e5b31d9 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-6.12.0-211.55.1.el10_2/e5b31d98.failed Igor Ushakov reported that GC purged the receive queue of an alive socket due to a race with MSG_PEEK with a nice repro. This is the exact same issue previously fixed by commit cbcf011 ("af_unix: fix garbage collect vs MSG_PEEK"). After GC was replaced with the current algorithm, the cited commit removed the locking dance in unix_peek_fds() and reintroduced the same issue. The problem is that MSG_PEEK bumps a file refcount without interacting with GC. Consider an SCC containing sk-A and sk-B, where sk-A is close()d but can be recv()ed via sk-B. The bad thing happens if sk-A is recv()ed with MSG_PEEK from sk-B and sk-B is close()d while GC is checking unix_vertex_dead() for sk-A and sk-B. GC thread User thread --------- ----------- unix_vertex_dead(sk-A) -> true <------. \ `------ recv(sk-B, MSG_PEEK) invalidate !! -> sk-A's file refcount : 1 -> 2 close(sk-B) -> sk-B's file refcount : 2 -> 1 unix_vertex_dead(sk-B) -> true Initially, sk-A's file refcount is 1 by the inflight fd in sk-B recvq. GC thinks sk-A is dead because the file refcount is the same as the number of its inflight fds. However, sk-A's file refcount is bumped silently by MSG_PEEK, which invalidates the previous evaluation. At this moment, sk-B's file refcount is 2; one by the open fd, and one by the inflight fd in sk-A. The subsequent close() releases one refcount by the former. Finally, GC incorrectly concludes that both sk-A and sk-B are dead. One option is to restore the locking dance in unix_peek_fds(), but we can resolve this more elegantly thanks to the new algorithm. The point is that the issue does not occur without the subsequent close() and we actually do not need to synchronise MSG_PEEK with the dead SCC detection. When the issue occurs, close() and GC touch the same file refcount. If GC sees the refcount being decremented by close(), it can just give up garbage-collecting the SCC. Therefore, we only need to signal the race during MSG_PEEK with a proper memory barrier to make it visible to the GC. Let's use seqcount_t to notify GC when MSG_PEEK occurs and let it defer the SCC to the next run. This way no locking is needed on the MSG_PEEK side, and we can avoid imposing a penalty on every MSG_PEEK unnecessarily. Note that we can retry within unix_scc_dead() if MSG_PEEK is detected, but we do not do so to avoid hung task splat from abusive MSG_PEEK calls. Fixes: 118f457 ("af_unix: Remove lock dance in unix_peek_fds().") Reported-by: Igor Ushakov <sysroot314@gmail.com> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260311054043.1231316-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit e5b31d9) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # net/unix/af_unix.h # net/unix/garbage.c
jira KERNEL-1600 cve CVE-2026-53361 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@google.com> commit d82ba05 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-6.12.0-211.55.1.el10_2/d82ba052.failed Igor Ushakov reported that unix_gc() could run with gc_in_progress being false if the work is scheduled while running: Thread 1 Thread 2 Thread 3 -------- -------- -------- unix_schedule_gc() unix_schedule_gc() `- if (!gc_in_progress) `- if (!gc_in_progress) |- gc_in_progress = true | `- queue_work() | unix_gc() <----------------/ | | |- gc_in_progress = true ... `- queue_work() | | `- gc_in_progress = false | | unix_gc() <---------------------------------------------' | ... /* gc_in_progress == false */ | `- gc_in_progress = false unix_peek_fpl() relies on gc_in_progress not to confuse GC by MSG_PEEK. Let's set gc_in_progress to true in unix_gc(). Fixes: 8b90a9f ("af_unix: Run GC on only one CPU.") Reported-by: Igor Ushakov <sysroot314@gmail.com> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260501073945.1884564-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit d82ba05) Signed-off-by: Jonathan Maple <jmaple@ciq.com> # Conflicts: # net/unix/garbage.c
jira KERNEL-1600 cve CVE-2026-63921 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Maoyi Xie <maoyixie.tju@gmail.com> commit 8b484ef After patch 1/2 in this series, vti6_update() unlinks and relinks the tunnel through t->net. vti6_siocdevprivate() still uses dev_net(dev) for the collision lookup. For a tunnel moved through IFLA_NET_NS_FD, dev_net(dev) is the new netns, not t->net. SIOCCHGTUNNEL on a migrated tunnel then runs: net = dev_net(dev) /* migrated netns */ t = vti6_locate(net, &p1, false) /* misses target in t->net */ ... t = netdev_priv(dev) vti6_update(t, &p1, false) /* mutates t->net's hash */ A caller in the migrated netns picks params that match a tunnel in the creation netns. The lookup in dev_net(dev) finds nothing. vti6_update() prepends the migrated tunnel at the head of the creation netns hash bucket for those params. Later lookups in the creation netns resolve to the migrated device. xfrm receive delivers the matched packets through a device the caller controls. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts. Switch the SIOCCHGTUNNEL path on a non fallback device to use t->net for the lookup. The lookup now matches the netns vti6_update() operates on. Also add ns_capable(self->net->user_ns, CAP_NET_ADMIN) before the lookup. The check at the top of the case is against dev_net(dev)->user_ns, which after migration is the attacker's netns. A caller there can pick params absent from self->net, the lookup returns NULL, t becomes self, and vti6_update() inserts the device into the creation netns hash. The new check requires CAP_NET_ADMIN in the creation netns user_ns too. SIOCADDTUNNEL and SIOCCHGTUNNEL on the fallback device keep dev_net(dev), which equals init_net there. Fixes: 61220ab ("vti6: Enable namespace changing") Suggested-by: Jakub Kicinski <kuba@kernel.org> Suggested-by: Xiao Liang <shaw.leon@gmail.com> Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Maoyi Xie <maoyixie.tju@gmail.com> Link: https://patch.msgid.link/20260521130555.3421684-3-maoyixie.tju@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> (cherry picked from commit 8b484ef) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 cve CVE-2026-63917 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Kuniyuki Iwashima <kuniyu@google.com> commit 11b326f ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6_test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6_test netns ns2 ip -n ns2 link set vti6_test type vti6 remote ::3 local ::4 key 9 ip netns del ns2 ip netns del ns1 [ 132.495484] ------------[ cut here ]------------ [ 132.497609] kernel BUG at net/core/dev.c:12376! Commit 61220ab ("vti6: Enable namespace changing") dropped NETIF_F_NETNS_LOCAL from vti6 devices. A vti6 tunnel can then move through IFLA_NET_NS_FD. After the move dev_net(dev) points at the new netns while t->net stays at the creation netns. vti6_changelink() and vti6_update() still use dev_net(dev) and dev_net(t->dev). They unlink from one per netns hash and relink into another. The creation netns is left with a stale entry. cleanup_net() of that netns later walks freed memory. Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). Cross tenant scope on container hosts. Fixes: 61220ab ("vti6: Enable namespace changing") Reported-by: Maoyi Xie <maoyi.xie@ntu.edu.sg> Reviewed-by: Eric Dumazet <edumazet@google.com> Cc: stable@vger.kernel.org # v5.15+ Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260521130555.3421684-2-maoyixie.tju@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> (cherry picked from commit 11b326f) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
…ctx() jira KERNEL-1600 cve CVE-2026-53239 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Sanghyun Park <sanghyun.park.cnu@gmail.com> commit 7f2d76c Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_prune_bin() directly since the lock is already held. The wrapper xfrm_policy_inexact_prune_bin() becomes unused and is removed. Race: CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO) ========================== ========================== xfrm_policy_bysel_ctx(): spin_lock_bh(xfrm_policy_lock) bin = xfrm_policy_inexact_lookup() __xfrm_policy_unlink(pol) spin_unlock_bh(xfrm_policy_lock) xfrm_policy_kill(ret) // wide window, lock not held xfrm_hash_rebuild(): spin_lock_bh(xfrm_policy_lock) __xfrm_policy_inexact_flush(): kfree_rcu(bin) // bin freed spin_unlock_bh(xfrm_policy_lock) xfrm_policy_inexact_prune_bin(bin) // UAF: bin is freed Fixes: 6be3b0d ("xfrm: policy: add inexact policy search tree infrastructure") Signed-off-by: Sanghyun Park <sanghyun.park.cnu@gmail.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> (cherry picked from commit 7f2d76c) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 cve CVE-2026-63919 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Zhengchuan Liang <zcliangcn@gmail.com> commit c16f74d Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must stay valid until the deferred callback runs. Take a netns reference when queueing deferred reinjection work and drop it after the callback completes. Use maybe_get_net() so the queueing path does not revive a namespace that is already being torn down. This keeps the existing workqueue design and fixes the netns lifetime handling in one place for all users of xfrm_trans_queue_net(). Fixes: 7b38019 ("xfrm: introduce xfrm_trans_queue_net") Cc: stable@kernel.org Reported-by: Yuan Tan <yuantan098@gmail.com> Reported-by: Xin Liu <bird@lzu.edu.cn> Co-developed-by: Luxing Yin <tr0jan@lzu.edu.cn> Signed-off-by: Luxing Yin <tr0jan@lzu.edu.cn> Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Assisted-by: Codex:gpt-5.4 Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> (cherry picked from commit c16f74d) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 cve CVE-2026-31663 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Jianbo Liu <jianbol@nvidia.com> commit b05d42e The dev_hold() on skb->dev during packet reception was originally added to prevent the device from being released prematurely during asynchronous decryption operations. As current hardware can offload decryption, this asynchronous path is not always utilized. This often results in a pattern of dev_hold() immediately followed by dev_put() for each packet, creating unnecessary reference counting overhead detrimental to performance. This patch optimizes this by skipping the dev_hold() and subsequent dev_put() when asynchronous decryption is not being performed. Signed-off-by: Jianbo Liu <jianbol@nvidia.com> Reviewed-by: Cosmin Ratiu <cratiu@nvidia.com> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> (cherry picked from commit b05d42e) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
…tings jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Han Xu <han.xu@nxp.com> commit 1ecd8b6 Set the edma tcd transfer attribution settings for the src and dst based on their respective dma_addr values, to remove the previous 32-byte alignment limitation in the EDMA memcpy function. Signed-off-by: Han Xu <han.xu@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251119163255.502070-1-han.xu@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org> (cherry picked from commit 1ecd8b6) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Johan Hovold <johan@kernel.org> commit 03adb0e The driver has never supported anything but OF probe so drop the unused platform module alias. Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20251120114524.8431-4-johan@kernel.org Signed-off-by: Vinod Koul <vkoul@kernel.org> (cherry picked from commit 03adb0e) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Jared Kangas <jkangas@redhat.com> commit 666c53e The clocks in fsl_edma_engine::muxclk are allocated and enabled with devm_clk_get_enabled(), which automatically cleans these resources up, but these clocks are also manually disabled in fsl_edma_remove(). This causes warnings on driver removal for each clock: edma_module already disabled WARNING: CPU: 0 PID: 418 at drivers/clk/clk.c:1200 clk_core_disable+0x198/0x1c8 [...] Call trace: clk_core_disable+0x198/0x1c8 (P) clk_disable+0x34/0x58 fsl_edma_remove+0x74/0xe8 [fsl_edma] [...] ---[ end trace 0000000000000000 ]--- edma_module already unprepared WARNING: CPU: 0 PID: 418 at drivers/clk/clk.c:1059 clk_core_unprepare+0x1f8/0x220 [...] Call trace: clk_core_unprepare+0x1f8/0x220 (P) clk_unprepare+0x34/0x58 fsl_edma_remove+0x7c/0xe8 [fsl_edma] [...] ---[ end trace 0000000000000000 ]--- Fix these warnings by removing the unnecessary fsl_disable_clocks() call in fsl_edma_remove(). Fixes: a9903de ("dmaengine: fsl-edma: refactor using devm_clk_get_enabled") Signed-off-by: Jared Kangas <jkangas@redhat.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260113-fsl-edma-clock-removal-v1-1-2025b49e7bcc@redhat.com Signed-off-by: Vinod Koul <vkoul@kernel.org> (cherry picked from commit 666c53e) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Joy Zou <joy.zou@nxp.com> commit 75b28d7 Add documentation for the dma-channel-mask property in the fsl-edma binding. This property uses an inverted bit definition: bit value 0 indicates the channel is available, while bit value 1 indicates unavailable. That was already used widely for i.MX8, i.MX9. Correcting the definition will break backward compatibility. This reversal only impacts the eDMA dts node and driver, and doesn't impact DMA consumer. Therefore, keep the inverted definition. Also add a note at the top of the binding to highlight this inverted definition to prevent confusion. Signed-off-by: Joy Zou <joy.zou@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260211-b4-imx95-v2x-v4-1-10852754b267@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org> (cherry picked from commit 75b28d7) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Frank Li <Frank.Li@nxp.com> commit 3a00512 Add a managed API, devm_of_dma_controller_register(), to simplify DMA engine controller registration by automatically handling resource cleanup. Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260225-mxsdma-module-v3-1-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org> (cherry picked from commit 3a00512) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Frank Li <Frank.Li@nxp.com> commit 4035726 Use managed API dmaenginem_async_device_register() and devm_of_dma_controller_register() to simple code. Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260225-mxsdma-module-v3-11-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org> (cherry picked from commit 4035726) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Frank Li <Frank.Li@nxp.com> commit 804e18f Use dev_err_probe() to simplify code. No functional change. Signed-off-by: Frank Li <Frank.Li@nxp.com> Link: https://patch.msgid.link/20260225-mxsdma-module-v3-12-8f798b13baa6@nxp.com Signed-off-by: Vinod Koul <vkoul@kernel.org> (cherry picked from commit 804e18f) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Zicheng Qu <quzicheng@huawei.com> commit 3993ca4 In the fwnode_iio_channel_get_by_name(), iterating over parent nodes to acquire IIO channels via fwnode_for_each_parent_node(). The variable chan was mistakenly attempted on the original node instead of the current parent node. This patch corrects the logic to ensure that __fwnode_iio_channel_get_by_name() is called with the correct parent node. Cc: stable@vger.kernel.org # v6.6+ Fixes: 1e64b9c ("iio: inkern: move to fwnode properties") Signed-off-by: Zicheng Qu <quzicheng@huawei.com> Link: https://patch.msgid.link/20241102092525.2389952-1-quzicheng@huawei.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> (cherry picked from commit 3993ca4) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> commit 64f4389 In the error path of iio_channel_get_all(), iio_device_put() is called on all IIO devices, which can cause a refcount imbalance. Fix this error by calling iio_device_put() only on IIO devices whose refcounts were previously incremented by iio_device_get(). Fixes: 314be14 ("iio: Rename _st_ functions to loose the bit that meant the staging version.") Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp> Link: https://patch.msgid.link/20241204111342.1246706-1-joe@pf.is.s.u-tokyo.ac.jp Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> (cherry picked from commit 64f4389) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Andy Shevchenko <andriy.shevchenko@linux.intel.com> commit 4d9fccb Use devm_add_action_or_reset() instead of devres_alloc() and devres_add(), which works the same. This will simplify the code. There is no functional changes. While at it, inline devm_iio_kfifo_allocate() into its only user. Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> (cherry picked from commit 4d9fccb) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Salah Triki <salah.triki@gmail.com> commit 12b3934 Move device_initialize() after all error paths in viio_trigger_alloc(). Previously, put_device() should have been called on all error paths after device_initialize(), but that was not done. Rather than adding put_device(), move device_initialize() to avoid needing to unwind it on error. In addition move trig->dev initialization to just before device_initialize() to related code together. Signed-off-by: Salah Triki <salah.triki@gmail.com> Reviewed-by: David Lechner <dlechner@baylibre.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> (cherry picked from commit 12b3934) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author David Lechner <dlechner@baylibre.com> commit 78abd04 Check return value of iio_compute_scan_bytes() as it can return an error. The result is moved to an output parameter while we are touching this as we will need to add a second output parameter in a later change. The return type of iio_buffer_update_bytes_per_datum() also had to be changed to propagate the error. Signed-off-by: David Lechner <dlechner@baylibre.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> (cherry picked from commit 78abd04) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author David Lechner <dlechner@baylibre.com> commit cb27d8c Cache the offset (in bytes) for the timestamp element in a scan buffer. This will be used later to ensure proper alignment of the timestamp element in the scan buffer. The new field could not be placed in struct iio_dev_opaque because we will need to access it in a static inline function later, so we make it __private instead. It is only intended to be used by core IIO code. Signed-off-by: David Lechner <dlechner@baylibre.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> (cherry picked from commit cb27d8c) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author David Lechner <dlechner@baylibre.com> commit 9957725 Use roundup_pow_of_two() in the calculation of iio_storage_bytes_for_si() when scan_type->repeat > 1 to ensure that the size is a power of two. storagebits is always going to be a power of two bytes, so we only need to apply this to the repeat factor. The storage size is also used for alignment, and we want to ensure that all alignments are a power of two. The only repeat in use in the kernel currently is for quaternions, which have a repeat of 4, so this does not change the result for existing users. Signed-off-by: David Lechner <dlechner@baylibre.com> Reviewed-by: Nuno Sá <nuno.sa@analog.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> (cherry picked from commit 9957725) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Francesco Lavra <flavra@baylibre.com> commit fda05af This field is used to differentiate between signed and unsigned integers. A following commit will extend its use in order to add support for non- integer scan elements; therefore, replace it with a union that contains a more generic 'format' field. This union will be dropped when all drivers are changed to use the format field. Opportunistically replace character literals with symbolic constants that represent the set of allowed values for the format field. Signed-off-by: Francesco Lavra <flavra@baylibre.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> (cherry picked from commit fda05af) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Benoît Monin <benoit.monin@bootlin.com> commit a093999 iio_buffer_enqueue_dmabuf() allocates a struct iio_dma_fence (104 bytes, kmalloc-128) via kmalloc_obj()+dma_fence_init(), which sets the initial kref to 1. It then calls dma_resv_add_fence() which takes a second reference (kref=2), and stores a raw pointer in block->fence. On the success path the function returns without calling dma_fence_put() to release the initial reference, so every buffer enqueue permanently leaks one kmalloc-128 allocation. The iio_buffer_cleanup() work item only releases the temporary reference taken during completion signalling by iio_buffer_signal_dmabuf_done(); the initial reference from dma_fence_init() is never released. With four iio_rwdev instances at 240kHz and 512 samples per buffer, this produces ~1875 kmalloc-128 allocations per second matching the observed slab growth exactly. A test with ftrace confirmed that the dma_fence_destroy event was never triggered. Fix by calling dma_fence_put() after dma_resv_add_fence(), transferring ownership of the fence to the DMA reservation object. The DMA fence then gets properly discarded after being signalled. Fixes: 3e26d9f ("iio: core: Add new DMABUF interface infrastructure") Originally-by: James Nuss <jamesnuss@nanometrics.ca> Signed-off-by: Benoît Monin <benoit.monin@bootlin.com> Reviewed-by: Paul Cercueil <paul@crapouillou.net> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <jic23@kernel.org> (cherry picked from commit a093999) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Andy Shevchenko <andriy.shevchenko@linux.intel.com> commit c0536d6 iio_push_to_buffers_with_ts_unaligned() uses int64_t for timestamp. Move it from int64_t to s64 to make consistent with: - iio_push_to_buffers_with_ts() - all current users that supply s64 anyway This will reduce potential of wrong type being chosen when using this API. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org> (cherry picked from commit c0536d6) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Nuno Sá <nuno.sa@analog.com> commit 6d5dd48 Instead of open coding (kind of) simple_write_to_buffer(), use it. While at it, use ascii representation to terminate the string as that is the more common way of doing it. Signed-off-by: Nuno Sá <nuno.sa@analog.com> Reviewed-by: David Lechner <dlechner@baylibre.com> Link: https://patch.msgid.link/20250218-dev-iio-misc-v1-2-bf72b20a1eb8@analog.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> (cherry picked from commit 6d5dd48) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Markus Burri <markus.burri@mt.com> commit 16285a0 The buffer is set to 20 characters. If a caller write more characters, count is truncated to the max available space in "simple_write_to_buffer". To protect from OoB access, check that the input size fit into buffer and add a zero terminator after copy to the end of the copied data. Fixes: 6d5dd48 iio: core: make use of simple_write_to_buffer() Signed-off-by: Markus Burri <markus.burri@mt.com> Link: https://patch.msgid.link/20250508130612.82270-4-markus.burri@mt.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> (cherry picked from commit 16285a0) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Dan Carpenter <error27@gmail.com> commit ab92ed2 If *ppos is non-zero then simple_write_to_buffer() will not initialize the start of buf[]. Non zero values for *ppos aren't going to work anyway. Test for them at the start of the function and return -EINVAL. Fixes: 6d5dd48 ("iio: core: make use of simple_write_to_buffer()") Signed-off-by: Dan Carpenter <error27@gmail.com> Reviewed-by: Maxwell Doose <m32285159@gmail.com> Cc: <Stable@vger.kernel.org> Signed-off-by: Jonathan Cameron <jic23@kernel.org> (cherry picked from commit ab92ed2) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Felix Gu <ustc.gu@gmail.com> commit d1e13ac The readl_poll_timeout() macro returns a signed integer error code. In nxp_sar_adc_calibration_wait(), the return value is casted to u32 before being returned as int, which is unnecessary. Signed-off-by: Felix Gu <ustc.gu@gmail.com> Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com> (cherry picked from commit d1e13ac) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
…lure jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Stepan Ionichev <sozdayvek@gmail.com> commit ae696df nxp_sar_adc_isr_buffer() bails on the first channel-read failure without calling iio_trigger_notify_done(), so the trigger use_count is left incremented and iio_trigger_poll_chained() drops subsequent dispatches until the device is rebound. Reaching this path means a state machine has gone wrong (driver bug or the SAR ADC in an unexpected state) rather than a transient bus issue, so this is hardening rather than a bug fix. If the underlying condition persists the device is wedged and needs an unbind anyway. Call iio_trigger_notify_done() on the error exit too, matching the success path. The nxp_sar_adc_read_notify() duplication is intentional and avoids a goto label for a two-line bail-out, as suggested by David. Signed-off-by: Stepan Ionichev <sozdayvek@gmail.com> Signed-off-by: Jonathan Cameron <jic23@kernel.org> (cherry picked from commit ae696df) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> commit 65210e8 Add missing hex annotation to fix the SWT8 watchdog address in 'reg' property, as reported by dtc W=1: s32g3.dtsi:863.27-869.5: Warning (simple_bus_reg): /soc@0/watchdog@40500000: simple-bus unit address format error, expected "269fb20" Lack of hex '0x' meant address would be interpreted as decimal thus completely different value used as this device MMIO. If device was enabled this could lead to corruption of other device address space and broken boot. Cc: stable@vger.kernel.org Fixes: 6db84f0 ("arm64: dts: s32g3: Add the Software Timer Watchdog (SWT) nodes") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Daniel Lezcano <daniel.lezcano@oss.qualcomm.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> (cherry picked from commit 65210e8) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira KERNEL-1600 Rebuild_History Non-Buildable kernel-6.12.0-211.55.1.el10_2 commit-author Khristine Andreea Barbulescu <khristineandreea.barbulescu@oss.nxp.com> commit 7ca25f0 Add ADC0 and ADC1 for S32G2 and S32G3 SoCs. Signed-off-by: Khristine Andreea Barbulescu <khristineandreea.barbulescu@oss.nxp.com> Reviewed-by: Enric Balletbo i Serra <eballetb@redhat.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> (cherry picked from commit 7ca25f0) Signed-off-by: Jonathan Maple <jmaple@ciq.com>
Rebuild_History BUILDABLE Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50% Number of commits in upstream range v6.12~1..kernel-mainline: 138299 Number of commits in rpm: 141 Number of commits matched with upstream: 131 (92.91%) Number of commits in upstream but not in rpm: 138168 Number of commits NOT found in upstream: 10 (7.09%) Rebuilding Kernel on Branch rocky10_2_rebuild_kernel-6.12.0-211.55.1.el10_2 for kernel-6.12.0-211.55.1.el10_2 Clean Cherry Picks: 111 (84.73%) Empty Cherry Picks: 20 (15.27%) _______________________________ Full Details Located here: ciq/ciq_backports/kernel-6.12.0-211.55.1.el10_2/rebuild.details.txt Includes: * git commit header above * Empty Commits with upstream SHA * RPM ChangeLog Entries that could not be matched Individual Empty Commit failures contained in the same containing directory. The git message for empty commits will have the path for the failed commit. File names are the first 8 characters of the upstream SHA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automated kernel history rebuild using cron and internal tooling. It follows the same process used for previous history rebuilds:
src.rpmpackagessrc.rpm:6.12.0-211)git cherry-pickrpmbuild -bpfor the correspondingsrc.rpmJIRA Tickets
Rebuild Splat Inspection
kernel-6.12.0-211.55.1.el10_2
BUILD
KSelfTests