MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3355
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
JIRA: https://redhat.atlassian.net/browse/RHEL-248146
commit 337bd95507a16063687cfc286ea90de5cca48c37
Author: Thomas Richter tmricht@linux.ibm.com
Date: Tue Aug 11 15:39:01 2026 +0200
```
s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks
The command 'perf stat -e cycles -- <command>' crashes the kernel
when CPUs are hotplug added during that run.
Root cause is the allocation of struct cpu_cf_events at first
event initialization. The allocation is dynamic and the first
event that has task context creates such a structure for
each online CPU. This is not sufficient. CPUs may be offline
during event creation and can be set online during the
perf run time. For example commands
# echo 0 > /sys/devices/system/cpu/cpu1/online
# perf stat -e cycles -i -- stress-ng -t10s --matrix X
# sleep 1
# echo 1 > /sys/devices/system/cpu/cpu1/online
create an event for CPUs 0,2-X. Since the events are created with
task-context, the scheduler will eventually schedule the program
on CPU1. This CPU has not created and initialized any per
CPU event infrastructure as that CPU was not online at the time
of the perf invocation. Thus when the scheduler runs stress-ng
on CPU1, the function cpumf_pmu_add() refers to a NULL pointer:
struct cpu_cf_events *cpuhw = this_cpu_cfhw();
This function call is invoked after the task stress-ng has been
made runnable on CPU1. And this_cpu_cfhw() returns NULL.
The result is a panic:
Unable to handle kernel pointer dereference in virtual kernel address space
Failing address: 0000000000000000 TEID: 0000000000000483
....
Krnl PSW : 0404d00180000000 000003ef8291fd0c (cpumf_pmu_add+0x3c/0x80)
....
Call Trace:
[<000003ef8291fd0c>] cpumf_pmu_add+0x3c/0x80
[<000003ef82bb5e3e>] event_sched_in+0xae/0x190
[<000003ef82bb60d6>] merge_sched_in+0x1b6/0x390
[<000003ef82bb65b8>] visit_groups_merge.constprop.0.isra.0+0x308/0x5b0
[<000003ef82bb689a>] pmu_groups_sched_in+0x3a/0x50
[<000003ef82bb6a30>] ctx_sched_in+0x180/0x260
[<000003ef82bb780c>] perf_event_context_sched_in+0x11c/0x2d0
[<000003ef82bb79ee>] __perf_event_task_sched_in+0x2e/0xc0
[<000003ef82994834>] finish_task_switch.isra.0+0x1a4/0x250
....
Last Breaking-Event-Address:
[<000003ef8291f1d8>] this_cpu_cfhw+0x38/0x40
The issue arises only in per-task context when the CPUMF facility is
used and the scheduler picks a random CPU for such a process to run on.
The scheduler enables the CPUMF infrastructure via PMU callback
functions pmu::add() and pmu::del().
Introduce a CPU hotplug prepare/dead callback pair which creates and
removes the per CPU counter data while the CPU is offline. Count the
users which track every CPU (cpu == -1), that is perf_event_open()
events with task context and /dev/hwctr device sessions, in the new
counter cpu_cf_root::tskcnt, protected by pmc_reserve_mutex.
This ensures the infrastructure is available when
new CPU is selected to run the per-task context process.
In cpum_cf_free_root() and cpum_cf_free_cpu() ensure the reference
pointer to data structures is set to NULL before the data is freed
to prevent interrupt handlers to access stale data.
[gor@linux.ibm.com: change commit message]
Fixes: 9b9cf3c77e ("s390/cpum_cf: rework PER_CPU_DEFINE of struct cpu_cf_events")
Cc: stable@vger.kernel.org # v6.5+
Suggested-by: Heiko Carstens <hca@linux.ibm.com>
Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Thomas Richter <tmricht@linux.ibm.com>
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
```
Signed-off-by: Jan Polensky <jpolensk@redhat.com>
Approved-by: Steve Best <sbest@redhat.com>
Approved-by: Tony Camuso <tcamuso@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3302
JIRA: https://issues.redhat.com/browse/RHEL-143335
Update the i3c master driver with all features added up to upstream
v6.19 and most fixes up to v7.2-rc7.
ACPI support for i3c is taken from one patch series in linux-next.
---
This MR includes a partial backport for only the hunks affecting i3c
from a couple treewide patches upstream. All of these fixes are related
to excluded hunks.
Omitted-fix: fd1d6b9d13f3 (`xz: fix arm fdt compile error for kmalloc replacement`)
Omitted-fix: 96a7b71c4438 (`ubd: Use pointer-to-pointers for io_thread_req arrays`)
Omitted-fix: 795469820c63 (`kcsan: test: Adjust "expect" allocation type for kmalloc_obj`)
Omitted-fix: 5548dd7fa845 (`tools/testing: fix testing/vma and testing/radix-tree build`)
Omitted-fix: 405ca72dc589 (`landlock: Fix formatting`)
Omitted-fix: 4c0134639694 (`KVM: PPC: e500: Fix build error due to using kmalloc_obj() with wrong type`)
Omitted-fix: 2d2b5507e598 (`btrfs: replace kcalloc() calls to kzalloc_objs()`)
Omitted-fix: 9f4ab0787e7b (`btrfs: do more kmalloc_obj()/kmalloc_objs() conversions`)
Omitted-fix: 37f1f51fba1a (`btrfs: convert kmalloc_array to kmalloc_objs in btrfs_calc_avail_data_space()`)
Omitted-fix: 4c6d43db2a4d (`net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone`)
Signed-off-by: Jennifer Berringer <jberring@redhat.com>
Approved-by: Mark Langsdorf <mlangsdo@redhat.com>
Approved-by: Mark Salter <msalter@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3328
This backports the driver for the AMD XDNA NPU in AMD AI Ryzen processors, but does not enable it.
When temporarily enabled, the driver loads successfully on AMD Strix Point, Strix Halo, and Krackan Point processors.
JIRA: https://redhat.atlassian.net/browse/RHEL-222546
These fixes are false positives that do not affect the amdxdna driver:
Omitted-fix: fd1d6b9d13f3 ("xz: fix arm fdt compile error for kmalloc replacement")
Omitted-fix: 96a7b71c4438 ("ubd: Use pointer-to-pointers for io_thread_req arrays")
Omitted-fix: 795469820c63 ("kcsan: test: Adjust "expect" allocation type for kmalloc_obj")
Omitted-fix: 5548dd7fa845 ("tools/testing: fix testing/vma and testing/radix-tree build")
Omitted-fix: 405ca72dc589 ("landlock: Fix formatting")
Omitted-fix: 4c0134639694 ("KVM: PPC: e500: Fix build error due to using kmalloc_obj() with wrong type")
Omitted-fix: 4c6d43db2a4d ("net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone")
Omitted-fix: c7ee592dccab ("drm/rockchip: include drm_print.h where needed")
Omitted-fix: cb345f954eac ("drm/panfrost: Fix scheduler workqueue bug")
Omitted-fix: 2d2b5507e598 ("btrfs: replace kcalloc() calls to kzalloc_objs()")
Omitted-fix: 9f4ab0787e7b ("btrfs: do more kmalloc_obj()/kmalloc_objs() conversions")
Omitted-fix: 37f1f51fba1a ("btrfs: convert kmalloc_array to kmalloc_objs in btrfs_calc_avail_data_space()")
Omitted-fix: 218b15a3e975 ("accel/rocket: Fix Rockchip NPU compilation")
These fixes are part of 7.1 and 7.2, and will be included in the DRM backport:
Omitted-fix: f844177c6811 ("accel/amdxdna: Handle DETACH_DEBUG_BO through config_debug_bo path")
Omitted-fix: 62c1671f6454 ("accel/amdxdna: Return errors for failed debug BO commands")
Omitted-fix: 7caf2a2351d4 ("accel/amdxdna: Use caller client for debug BO sync")
Omitted-fix: e35c9cf55128 ("accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()")
Omitted-fix: ec3304ddfd99 ("accel/amdxdna: Fix use-after-free in debug BO command handling")
Omitted-fix: c8d2530791cb ("accel/amdxdna: Fix deadlock on debug BO command timeout")
Omitted-fix: d946347edc4f ("accel/amdxdna: Fix leak when pinning ubuf pages")
Omitted-fix: 457b046b7dfc ("accel/amdxdna: Remove mmap and export support for ubuf")
Omitted-fix: 1ba02717e821 ("accel/amdxdna: Fix VMA access race")
Omitted-fix: 2f41af638c92 ("accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()")
Omitted-fix: 5c72124186d6 ("accel/amdxdna: Fix notifier_wq lifetime race during device removal")
Omitted-fix: 63bbf9ac5dde ("accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()")
Omitted-fix: 14f172eff9c1 ("accel/amdxdna: Fix potential amdxdna_umap lifetime race")
Omitted-fix: 8d51e0fd3e69 ("accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()")
Omitted-fix: 4a19f7ab5972 ("accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()")
Omitted-fix: 6c916e301fa1 ("accel/amdxdna: Skip unmapped range in aie2_populate_range()")
Omitted-fix: c83ad8ea6b0a ("accel/amdxdna: Fix order of canceled mailbox messages")
Omitted-fix: 6e87001fe19f ("accel/amdxdna: Adjust size for copy_to_user()")
Omitted-fix: ada61841caed ("accel/amdxdna: Fix clflush buffer size")
Omitted-fix: 44d8fddf1c87 ("accel/amdxdna: Check init_srcu_struct() return value")
Omitted-fix: 261c1fe3327a ("accel/amdxdna: reject user command submission without a command BO")
Omitted-fix: 38953513d731 ("accel/amdxdna: reject command submission on devices without a submit op")
Omitted-fix: faebb7ba1ac6 ("accel/amdxdna: Fix use-after-free of mm_struct in job scheduler")
Omitted-fix: 18aaebdf4336 ("accel/amdxdna: Use unsigned long for nr_pages in amdxdna_hmm_register()")
Omitted-fix: 1dbbc7f98cde ("accel/amdxdna: Fix amdxdna_client lifetime race during device removal")
Omitted-fix: d1c73884858c ("accel/amdxdna: fix missing newline in pr_err message")
Omitted-fix: 506255d46bdb ("accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer")
Omitted-fix: 0f092793a7b5 ("accel/amdxdna: Check drmm_mutex_init() return value")
Signed-off-by: Peter Colberg <pcolberg@redhat.com>
Approved-by: Karol Herbst <kherbst@redhat.com>
Approved-by: marpagan <marpagan@redhat.com>
Approved-by: Anusha Srivatsa <asrivats@redhat.com>
Approved-by: John Wiele <jwiele@redhat.com>
Approved-by: Oliver Gutiérrez <ogutsua@protonmail.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2915
# Merge Request Required Information
## Summary of Changes
KVM: x86: Fix shadow paging use-after-free due to unexpected role
```
JIRA: https://redhat.atlassian.net/browse/RHEL-192401
CVE: CVE-2026-53359
Backported from tree(s): linux
KVM: x86: Fix shadow paging use-after-free due to unexpected role
Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due
to unexpected GFN") fixed a shadow paging mismatch between stored and
computed GFNs; the bug could be triggered by changing a PDE mapping from
outside the guest, and then deleting a memslot. The rmap_remove()
call would miss entries created after the PDE change because the GFN
of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.
A similar hole however remains if the modified PDE points to a non-leaf
page. In this case the gfn can be made to match, but the role does not
match: the original large 2MB page creates a kvm_mmu_page with direct=1,
while the new 4KB needs a kvm_mmu_page with direct=0. However,
kvm_mmu_get_child_sp() does not compare the role, and therefore reuses
the page.
The next step is installing a leaf (4KB) SPTE on the new path which
records an rmap entry under the gfn resolved by the walk. But when
that child is zapped its parent kvm_mmu_page has direct=1 and
kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as
sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[]
in older kernels). It therefore fails to remove the recorded entry.
When the memslot is dropped the shadow page is freed but the rmap
entry survives, as in the scenario that was already fixed. Code that
later walks that gfn (dirty logging, MMU notifier invalidation, and
so on) dereferences an sptep that lies in the freed page, causing the
use-after-free.
Fixes: 2032a93d66 ("KVM: MMU: Don't allocate gfns page for direct mmu pages")
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Aidan Wallace <awallace@redhat.com>
(cherry picked from commit 81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb)
```
KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
```
JIRA: https://redhat.atlassian.net/browse/RHEL-186699
CVE: CVE-2026-46113
Backported from tree(s): linux
KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus
the SPTE index. This assumption breaks for shadow paging if the guest
page tables are modified between VM entries (similar to commit
aad885e77496, "KVM: x86/mmu: Drop/zap existing present SPTE even
when creating an MMIO SPTE", 2026-03-27). The flow is as follows:
- a PDE is installed for a 2MB mapping, and a page in that area is
accessed. KVM creates a kvm_mmu_page consisting of 512 4KB pages;
the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because
the guest's mapping is a huge page (and thus contiguous).
- the PDE mapping is changed from outside the guest.
- the guest accesses another page in the same 2MB area. KVM installs
a new leaf SPTE and rmap entry; the SPTE uses the "correct" GFN
(i.e. based on the new mapping, as changed in the previous step) but
that GFN is outside of the [sp->gfn, sp->gfn + 511] range; therefore
the rmap entry cannot be found and removed when the kvm_mmu_page
is zapped.
- the memslot that covers the first 2MB mapping is deleted, and the
kvm_mmu_page for the now-invalid GPA is zapped. However, rmap_remove()
only looks at the [sp->gfn, sp->gfn + 511] range established in step 1,
and fails to find the rmap entry that was recorded by step 3.
- any operation that causes an rmap walk for the same page accessed
by step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page.
This includes dirty logging or MMU notifier invalidations (e.g., from
MADV_DONTNEED).
The underlying issue is that KVM's walking of shadow PTEs assumes that
if a SPTE is present when KVM wants to install a non-leaf SPTE, then the
existing kvm_mmu_page must be for the correct gfn. Because the only way
for the gfn to be wrong is if KVM messed up and failed to zap a SPTE...
which shouldn't happen, but *actually* only happens in response to a
guest write.
That bug dates back literally forever, as even the first version of KVM
assumes that the GFN matches and walks into the "wrong" shadow page.
However, that was only an imprecision until 2032a93d66 ("KVM: MMU:
Don't allocate gfns page for direct mmu pages") came along.
Fix it by checking for a target gfn mismatch and zapping the existing
SPTE. That way the old SP and rmap entries are gone, KVM installs
the rmap in the right location, and everyone is happy.
Fixes: 2032a93d66 ("KVM: MMU: Don't allocate gfns page for direct mmu pages")
Fixes: 6aa8b732ca ("kvm: userspace interface")
Reported-by: Alexander Bulekov <bkov@amazon.com>
Reported-by: Fred Griffoul <fgriffo@amazon.co.uk>
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Link: https://patch.msgid.link/20260503201029.106481-1-pbonzini@redhat.com/
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 0cb2af2ea66ad8ff195c156ea690f11216285bdf)
Signed-off-by: Aidan Wallace <awallace@redhat.com>
```
## Approved Development Ticket(s)
JIRAs:
https://redhat.atlassian.net/browse/RHEL-192401https://redhat.atlassian.net/browse/RHEL-186699
<details>
<summary>Click for formatting instructions</summary>
Please follow the CentOS Stream [contribution documentation](https://docs.centos.org/centos-stream-docs/contributors-guide/) for how to file this ticket and have it approved.
List tickets each on their own line of this description using the format "Resolves: RHEL-76229", "Related: RHEL-76229" or "Reverts: RHEL-76229", as appropriate.
</details>
Approved-by: Paolo Bonzini <bonzini@gnu.org>
Approved-by: Maxim Levitsky <mlevitsk@redhat.com>
Approved-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3301
JIRA: https://issues.redhat.com/browse/RHEL-231823
CVE: CVE-2026-53062
Tested: Reproducer and dm cache tests
Upstream Status: kernel/git/torvalds/linux.git
commit d3f0a606b9f278ece8a0df626ded9c4044071235
Author: Guangshuo Li <lgs201920130244@gmail.com>
Date: Fri May 29 23:57:45 2026 +0800
dm cache policy smq: check allocation under invalidate lock
commit 2d1f7b65f5de ("dm cache policy smq: fix missing locks in
invalidating cache blocks") added mq->lock around the destructive part of
smq_invalidate_mapping(), but left the e->allocated check outside the
critical section.
That leaves a check-then-act race. Two concurrent invalidators can both
observe e->allocated as true before either of them takes mq->lock. The
first invalidator that acquires the lock removes the entry from the
queues and hash table and then calls free_entry(), which clears
e->allocated and puts the entry back on the free list. The second
invalidator can then acquire mq->lock and continue with the stale result
of the unlocked check.
This can corrupt the SMQ queues or hash table by deleting an entry that
is no longer on those structures. It can also hit the allocation check in
free_entry() when the same entry is freed again.
Move the allocation check under mq->lock so the predicate and the
destructive operations are serialized by the same lock.
Fixes: 2d1f7b65f5de ("dm cache policy smq: fix missing locks in invalidating cache blocks")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com>
Approved-by: Matthew Sakai <msakai@redhat.com>
Approved-by: Ming Hung Tsai <mtsai@redhat.com>
Approved-by: Kenneth Raeburn <raeburn@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2746
JIRA: https://redhat.atlassian.net/browse/RHEL-154157
JIRA: https://redhat.atlassian.net/browse/RHEL-154159
JIRA: https://redhat.atlassian.net/browse/RHEL-184801
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2746
Omitted-fix: d9b40d7262a2 ("selftests/x86: Add selftests include path for kselftest.h after centralization")
This series backports most of relevant cgroup selftests commits in linux
mainline and mm-stable maintainer tree to reduce the failure rate of
the cgroup selftests. This commits do not fix all the test failures but
still many of them should be gone.
By running the cgroup selftests 100 times on an arm64 and x86-64
systems, the table below shows the number of test failures before and
after applying the patches.
x86-64
======
Test Before After
---- ------ -----
test_cpucg_nested_weight_overprovisioned 62 66
test_cpucg_stats 50 50
test_cpucg_weight_overprovisioned 62 66
test_memcg_low 100 6
test_memcg_min 29 1
test_memcg_sock 100 0
test_zswap_writeback_disabled 100 0
test_zswap_writeback_enabled 100 0
test_zswapin 100 0
aarch64
=======
Test Before After
---- ------ -----
test_cpucg_max 39 44
test_cpucg_max_nested 25 23
test_cpucg_nested_weight_overprovisioned 57 58
test_cpucg_nested_weight_underprovisioned 2 3
test_cpucg_nice 95 79
test_cpucg_stats 50 50
test_cpucg_weight_overprovisioned 95 91
test_cgfreezer_ptrace 50 53
test_memcg_low 100 0
test_memcg_min 82 85
test_memcg_sock 100 100
test_zswap_usage 100 0
test_zswap_writeback_disabled 100 0
test_zswap_writeback_enabled 100 0
test_zswapin 100 0
The test_zswap failures are all gone and some of the test_memcontrol
failures are gone. However this MR has no real impact on test_cpu and
test_freezer failures.
Signed-off-by: Waiman Long <longman@redhat.com>
Approved-by: Herton R. Krzesinski <herton@redhat.com>
Approved-by: Phil Auld <pauld@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3256
## Summary of Changes
CONFIG_MD=y has no effect in automotive; the subsystem's Makefile
doesn't have any obj-y additions, and the only Kconfigs enabled in
automotive that are used in the subsystem's Makefile are:
$ git grep -Pho '\$\(CONFIG_[^)]+\)' drivers/md/Makefile |
sort -u |
tr -d '$()' |
xargs -I{} grep -F "{}=" redhat/configs/kernel-*-automotive*.config
redhat/configs/kernel-6.12.0-aarch64-automotive.config:CONFIG_BLK_DEV_ZONED=y
redhat/configs/kernel-6.12.0-aarch64-automotive-debug.config:CONFIG_BLK_DEV_ZONED=y
redhat/configs/kernel-6.12.0-x86_64-automotive.config:CONFIG_BLK_DEV_ZONED=y
redhat/configs/kernel-6.12.0-x86_64-automotive-debug.config:CONFIG_BLK_DEV_ZONED=y
redhat/configs/kernel-6.12.0-aarch64-automotive.config:CONFIG_IMA=y
redhat/configs/kernel-6.12.0-aarch64-automotive-debug.config:CONFIG_IMA=y
redhat/configs/kernel-6.12.0-x86_64-automotive.config:CONFIG_IMA=y
redhat/configs/kernel-6.12.0-x86_64-automotive-debug.config:CONFIG_IMA=y
These Kconfigs are only used to modify dm-mod.o, which isn't built in
automotive kernels since it depends on CONFIG_BLK_DEV_DM.
CONFIG_MD is also the only MD-related Kconfig that's enabled in
automotive:
$ grep -P 'CONFIG_(.+_)?MD[_=]' redhat/configs/kernel-*-automotive*.config
redhat/configs/kernel-6.12.0-aarch64-automotive.config:CONFIG_MD=y
redhat/configs/kernel-6.12.0-aarch64-automotive-debug.config:CONFIG_MD=y
redhat/configs/kernel-6.12.0-x86_64-automotive.config:CONFIG_MD=y
redhat/configs/kernel-6.12.0-x86_64-automotive-debug.config:CONFIG_MD=y
Since the Kconfig is essentially a no-op, disable it in automotive
kernels.
## Approved Development Ticket(s)
JIRA: https://redhat.atlassian.net/browse/RHEL-237678
Upstream ARK MR: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/4642
Signed-off-by: Jared Kangas <jkangas@redhat.com>
Approved-by: Eric Chanudet <echanude@redhat.com>
Approved-by: Mattijs Korpershoek <mkorpershoek@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3204
JIRA: https://redhat.atlassian.net/browse/RHEL-212122
xe OA and EU-stall paths open-code a partial copy of the system-wide
perf CPU-event permission check:
if (xe_observation_paranoid && !perfmon_capable())
return -EACCES;
This open-coded check skips two things perf_allow_cpu() handles: the
graduated kernel.perf_event_paranoid policy that an administrator
may have tuned, and the security_perf_event_open() LSM hook.
Introduce xe_observation_paranoid_check() to wrap perf_allow_cpu(),
and convert the open-coded sites in xe_oa.c and xe_eu_stall.c. The
dev.xe.observation_paranoid sysctl still acts as an escape hatch
when cleared.
xe observation now consults kernel.perf_event_paranoid and the LSM
perf hook on every open. Sites that have already configured an LSM
perf policy or tuned the paranoid sysctl will see those settings
extend to xe.
Signed-off-by: Michael Petlan <mpetlan@redhat.com>
Approved-by: ashelat <ashelat@redhat.com>
Approved-by: tallison1 <tallison@redhat.com>
Approved-by: Gary Guo <gguo@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3249
JIRA: https://redhat.atlassian.net/browse/RHEL-218473
CVE: CVE-2026-64300
upstream
========
commit 5948aaf64f81f217a25dcc2bf6c0779bca19566c
Author: Lee Jia Jie <jiajie.lee@starlabs.sg>
Date: Thu Jul 9 21:56:19 2026 +0800
description
===========
map_range() reads rb->aux_pages[], rb->aux_nr_pages and rb->aux_pgoff via
perf_mmap_to_page() while holding only event->mmap_mutex. Those fields are
serialized by rb->aux_mutex, and mmap_mutex is per event.
Thus, two events sharing one rb via PERF_EVENT_IOC_SET_OUTPUT can race
rb_alloc_aux() with map_range(), leading to a page-UAF scenario as follows:
CPU 0 CPU 1
===== =====
rb_alloc_aux() map_range()
[1]: allocate rb->aux_pages[0]
[2]: rb->aux_nr_pages++
[3]: perf_mmap_to_page()
returns rb->aux_pages[0]
[4]: map it as VM_PFNMAP
[5]: rb->aux_pgoff = 1
munmap the page
[6]: free rb->aux_pages[0]
Pages mapped as VM_PFNMAP have no refcount protection, so CPU 1 holds a
mapping to a freed physical frame.
Fix this by taking rb->aux_mutex across the page walk in map_range().
Fixes: b709eb872e19 ("perf: map pages in advance")
Signed-off-by: Lee Jia Jie <jiajie.lee@starlabs.sg>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: stable@vger.kernel.org
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Michael Petlan <mpetlan@redhat.com>
Approved-by: tallison1 <tallison@redhat.com>
Approved-by: ashelat <ashelat@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3289
JIRA: https://redhat.atlassian.net/browse/RHEL-239086
commit a213dfaa2596c1c0dc4dae91c14fbfa499c03223
Author: Breno Leitao <leitao@debian.org>
Date: Mon Aug 3 02:47:40 2026 -0700
x86/mce: Set up the polling timer before CMCI discovery
I hit the following on one of my machines:
mce: CPU0 BANK15 CMCI inherited storm
------------[ cut here ]------------
ODEBUG: assert_init not available (active state 0) object: (____ptrval____) object type: timer_list hint: 0x0
WARNING: lib/debugobjects.c:632 at debug_object_assert_init+0x178/0x230, CPU#0: swapper/0/0
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc5 #3 PREEMPTLAZY
RIP: 0010:debug_object_assert_init+0x18f/0x230
Call Trace:
<TASK>
__mod_timer
mce_timer_kick
cmci_discover
intel_init_cmci
mce_intel_feature_init
mcheck_cpu_init
identify_cpu
identify_boot_cpu
arch_cpu_finalize_init
start_kernel
A second splat follows right after, from timer_setup() finding that same
timer already queued:
ODEBUG: init active (active state 0) object: (____ptrval____) object type: timer_list hint: stub_timer+0x0/0x10
This is happening because CMCI storm detection is trying to modify the timer
before latter was properly set up.
Set up the timer first. __mcheck_cpu_setup_timer() only calls timer_setup(),
and depends on neither the generic nor the vendor init.
[ bp: Massage commit message. ]
Fixes: 1f68ce2a02 ("x86/mce: Handle Intel threshold interrupt storms")
Signed-off-by: Breno Leitao <leitao@debian.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260803-mce_timer_init-v1-1-9539db424330@debian.org
Signed-off-by: Steve Best <sbest@redhat.com>
Approved-by: David Arcari <darcari@redhat.com>
Approved-by: Tony Camuso <tcamuso@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3279
# Merge Request Required Information
## Summary of Changes
JIRA: https://redhat.atlassian.net/browse/RHEL-231666
CVE: CVE-2026-63886
In the Linux kernel, the following vulnerability has been resolved:
scsi: target: iscsi: Validate CHAP_R length before base64 decode
chap_server_compute_hash() allocates client_digest as
kzalloc(chap->digest_size) and then, for BASE64-encoded responses,
passes chap_r directly to chap_base64_decode() without checking whether
the input length could produce more than digest_size bytes of output.
chap_base64_decode() writes to the destination unconditionally as long
as there is input to consume. With MAX_RESPONSE_LENGTH set to 128 and
the "0b" prefix stripped by extract_param(), up to 127 base64 characters
can reach the decoder. 127 characters decode to 95 bytes. For SHA-256
(digest_size=32) this overflows client_digest by 63 bytes; for MD5
(digest_size=16) the overflow is 79 bytes.
The length check at line 344 fires after the write has already happened.
The HEX branch in the same switch statement already validates the length
up front. Apply the same approach to the BASE64 branch: strip trailing
base64 padding characters, then reject any input whose data length
exceeds DIV_ROUND_UP(digest_size * 4, 3) before calling the decoder.
Stripping trailing '=' before the comparison handles both padded and
unpadded encodings. chap_base64_decode() already returns early on '=',
so the full original string is still passed to the decoder unchanged.
The mutual CHAP path decodes CHAP_C into initiatorchg_binhex, which is
kzalloc(CHAP_CHALLENGE_STR_LEN). extract_param() caps initiatorchg at
CHAP_CHALLENGE_STR_LEN characters, so at most CHAP_CHALLENGE_STR_LEN-1
base64 characters reach the decoder. The maximum decoded size,
DIV_ROUND_UP((CHAP_CHALLENGE_STR_LEN-1) * 3, 4), is less than
CHAP_CHALLENGE_STR_LEN, so no overflow is possible there. A comment is
added at the call site to document this.
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
## Approved Development Ticket(s)
All submissions to CentOS Stream must reference a ticket in [Red Hat Jira](https://issues.redhat.com/).
<details><summary>Click for formatting instructions</summary>
Please follow the CentOS Stream [contribution documentation](https://docs.centos.org/centos-stream-docs/contributors-guide/) for how to file this ticket and have it approved.
List tickets each on their own line of this description using the format "Resolves: RHEL-76229", "Related: RHEL-76229" or "Reverts: RHEL-76229", as appropriate.
</details>
Approved-by: Laurence Oberman <loberman@redhat.com>
Approved-by: djeffery1 <djeffery@redhat.com>
Approved-by: Chris Leech <cleech@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2819
This is the usual rebase of the HID subsystem up to kernel v7.1 for 10.3.
```
JIRA: https://issues.redhat.com/browse/RHEL-170872
JIRA: https://redhat.atlassian.net/browse/RHEL-183865
Depends: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2636
All following omitted-fix are not in drivers/hid/ and can thus safely be ignored:
Omitted-fix: fd1d6b9d13f35dccbacbae25ed53593cd9086f84 # xz not part of this MR
Omitted-fix: 96a7b71c4438d3b72d6c95e3efdc9e8e8aee6b78 # ubd not part of this MR
Omitted-fix: 795469820c638b4449f3bb90ee5e98ebccfbc480 # kcsan not part of this MR
Omitted-fix: 5548dd7fa84510f7bbce67c35cc3b388c86aeddf # testing/vma and testing/radix-tree not parts of this MR
Omitted-fix: 405ca72dc589dd746e5ee5378bb9d9ee7f844010 # landlock not part of this MR
Omitted-fix: 4c0134639694fcdc4ab041d7c53d6188a3e18040 # KVM not part of this MR
Omitted-fix: 4c6d43db2a4d2cef3921e885cf34798f790d34ea # net: dst_metadata not part of this MR
Omitted-fix: 01793374319cdb685bd487633bbd8bd57f416172 # m68k: defconfig not part of this MR
Omitted-fix: 94ff7c59cdfde3a16ab830531acbcb3091b292eb # RDMA not part of this MR
Omitted-fix: 2d2b5507e598984f5832f0c5193f35733c42995e # btrfs not part of this MR
Omitted-fix: 94ff7c59cdfde3a16ab830531acbcb3091b292eb # RDMA not part of this MR
Omitted-fix: 9f4ab0787e7bf6d2c709207317e9d4cd43909869 # btrfs not part of this MR
Omitted-fix: 37f1f51fba1a4320149b1ea3b21d254d4b221b0a # btrfs not part of this MR
Following one was silently dropped from Linus's tree during 7.2 pull request from Jiri Kosina, my HID co-maintainer:
Omitted-fix: d0ff08d946c83b51359a8063c41e9f5af067e628 # not making any effect in 7.2-rc1, silently dropped in a merge commit
```
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Approved-by: Jarod Wilson <jarod@redhat.com>
Approved-by: Tony Camuso <tcamuso@redhat.com>
Approved-by: Eric Chanudet <echanude@redhat.com>
Approved-by: Andrea Arcangeli <aarcange@redhat.com>
Approved-by: David Arcari <darcari@redhat.com>
Approved-by: Barry Dunn <badunn@redhat.com>
Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com>
CKI KWF Bot