mirror of
https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10.git
synced 2026-09-09 00:07:04 +08:00
9d2c3bf254b04e66cec56700cc3836767d5d7146
1368468
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 CKI KWF Bot
|
9d2c3bf254 |
Merge: CVE-2026-53153 kernel: mm/list_lru: drain before clearing xarray entry on reparent [rhel-10.3]
MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-10/-/merge_requests/1832 JIRA: https://redhat.atlassian.net/browse/RHEL-227151 CVE: CVE-2026-53153 commit 98733f3f0becb1ae0701d021c1748e974e5fa55c Author: Shakeel Butt <shakeel.butt@linux.dev> Date: Mon Jun 1 09:15:01 2026 -0700 mm/list_lru: drain before clearing xarray entry on reparent Signed-off-by: Rafael Aquini <raquini@redhat.com> Approved-by: Ricardo Robaina <rrobaina@redhat.com> Approved-by: Jay Shin <jaeshin@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
cde8efee3f |
Merge: redhat: set defaults for RHEL 10.3
MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-10/-/merge_requests/1850 JIRA: INTERNAL Upstream Status: RHEL only Now that we have forked from CentOS Stream, we need to switch the release number to use the zstream scheme and update our default disttag to match that used by the brew build environment for RHEL 10.3. Signed-off-by: Shivani Chandanshive <schandan@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: Tales da Aparecida <tales.aparecida@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Approved-by: Oleksii Baranov <olebaran@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
 Shivani Chandanshive
|
357192ae02 |
redhat: set defaults for RHEL 10.3
JIRA: INTERNAL Upstream Status: RHEL only Now that we have forked from CentOS Stream, we need to switch the release number to use the zstream scheme and update our default disttag to match that used by the brew build environment for RHEL 10.3. Signed-off-by: Shivani Chandanshive <schandan@redhat.com> |
||
 Rafael Aquini
|
30eb170c14 |
mm/list_lru: drain before clearing xarray entry on reparent
JIRA: https://redhat.atlassian.net/browse/RHEL-227151 CVE: CVE-2026-53153 commit 98733f3f0becb1ae0701d021c1748e974e5fa55c Author: Shakeel Butt <shakeel.butt@linux.dev> Date: Mon Jun 1 09:15:01 2026 -0700 mm/list_lru: drain before clearing xarray entry on reparent memcg_reparent_list_lrus() clears the dying memcg's xarray entry with xas_store(&xas, NULL) before reparenting its per-node lists into the parent. This opens a window where a concurrent list_lru_del() arriving for the dying memcg sees xa_load() == NULL, walks to the parent in lock_list_lru_of_memcg(), takes the parent's per-node lock, and calls list_del_init() on an item still physically linked on the dying memcg's list. If another in-flight thread holds the dying memcg's per-node lock at the same moment (another list_lru_del, or a list_lru_walk_one running an isolate callback), both threads modify ->next/->prev pointers on the same physical list under different locks. Adjacent items can corrupt each other's links. Fix it by reversing the order: reparent each per-node list and mark the child's list lru dead and then clear the xarray entry. Any concurrent list_lru op that finds the still-set xarray entry either takes the dying memcg's per-node lock (synchronizing with the drain) or sees LONG_MIN and walks to the parent, where the items now live. Link: https://lore.kernel.org/20260601161501.1444829-1-shakeel.butt@linux.dev Fixes: fb56fdf8b9a2 ("mm/list_lru: split the lock to per-cgroup scope") Signed-off-by: Shakeel Butt <shakeel.butt@linux.dev> Reported-by: Chris Mason <clm@fb.com> Reviewed-by: Kairui Song <kasong@tencent.com> Acked-by: Muchun Song <muchun.song@linux.dev> Cc: Dave Chinner <david@fromorbit.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Roman Gushchin <roman.gushchin@linux.dev> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Rafael Aquini <raquini@redhat.com> |
||
|
CKI KWF Bot
|
afa81ddbe0 |
[redhat] kernel-6.12.0-264.el10
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
0a57f281ec |
Merge: net: Fix deadlock on netns change.
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2576 JIRA: https://redhat.atlassian.net/browse/RHEL-144808 Upstream Status: linux.git Backport upstream commit 7ca486d08a30 ("rtnetlink: Create link directly in target net namespace") and its dependencies, plus selftests. Signed-off-by: Guillaume Nault <gnault@redhat.com> Approved-by: Antoine Tenart <atenart@redhat.com> Approved-by: José Ignacio Tornos Martínez <jtornosm@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
618edff9f9 |
Merge: Backport AMD XDNA NPU driver from Linux 7.0.14
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3328 This backports the driver for the AMD XDNA NPU in AMD AI Ryzen processors, but does not enable it. When temporarily enabled, the driver loads successfully on AMD Strix Point, Strix Halo, and Krackan Point processors. JIRA: https://redhat.atlassian.net/browse/RHEL-222546 These fixes are false positives that do not affect the amdxdna driver: Omitted-fix: fd1d6b9d13f3 ("xz: fix arm fdt compile error for kmalloc replacement") Omitted-fix: 96a7b71c4438 ("ubd: Use pointer-to-pointers for io_thread_req arrays") Omitted-fix: 795469820c63 ("kcsan: test: Adjust "expect" allocation type for kmalloc_obj") Omitted-fix: 5548dd7fa845 ("tools/testing: fix testing/vma and testing/radix-tree build") Omitted-fix: 405ca72dc589 ("landlock: Fix formatting") Omitted-fix: 4c0134639694 ("KVM: PPC: e500: Fix build error due to using kmalloc_obj() with wrong type") Omitted-fix: 4c6d43db2a4d ("net: dst_metadata: fix false-positive memcpy overflow in tun_dst_unclone") Omitted-fix: c7ee592dccab ("drm/rockchip: include drm_print.h where needed") Omitted-fix: cb345f954eac ("drm/panfrost: Fix scheduler workqueue bug") Omitted-fix: 2d2b5507e598 ("btrfs: replace kcalloc() calls to kzalloc_objs()") Omitted-fix: 9f4ab0787e7b ("btrfs: do more kmalloc_obj()/kmalloc_objs() conversions") Omitted-fix: 37f1f51fba1a ("btrfs: convert kmalloc_array to kmalloc_objs in btrfs_calc_avail_data_space()") Omitted-fix: 218b15a3e975 ("accel/rocket: Fix Rockchip NPU compilation") These fixes are part of 7.1 and 7.2, and will be included in the DRM backport: Omitted-fix: f844177c6811 ("accel/amdxdna: Handle DETACH_DEBUG_BO through config_debug_bo path") Omitted-fix: 62c1671f6454 ("accel/amdxdna: Return errors for failed debug BO commands") Omitted-fix: 7caf2a2351d4 ("accel/amdxdna: Use caller client for debug BO sync") Omitted-fix: e35c9cf55128 ("accel/amdxdna: Prevent PM resume deadlock in hwctx_sync_debug_bo()") Omitted-fix: ec3304ddfd99 ("accel/amdxdna: Fix use-after-free in debug BO command handling") Omitted-fix: c8d2530791cb ("accel/amdxdna: Fix deadlock on debug BO command timeout") Omitted-fix: d946347edc4f ("accel/amdxdna: Fix leak when pinning ubuf pages") Omitted-fix: 457b046b7dfc ("accel/amdxdna: Remove mmap and export support for ubuf") Omitted-fix: 1ba02717e821 ("accel/amdxdna: Fix VMA access race") Omitted-fix: 2f41af638c92 ("accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()") Omitted-fix: 5c72124186d6 ("accel/amdxdna: Fix notifier_wq lifetime race during device removal") Omitted-fix: 63bbf9ac5dde ("accel/amdxdna: Fix use-after-free in amdxdna_gem_dmabuf_mmap()") Omitted-fix: 14f172eff9c1 ("accel/amdxdna: Fix potential amdxdna_umap lifetime race") Omitted-fix: 8d51e0fd3e69 ("accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()") Omitted-fix: 4a19f7ab5972 ("accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()") Omitted-fix: 6c916e301fa1 ("accel/amdxdna: Skip unmapped range in aie2_populate_range()") Omitted-fix: c83ad8ea6b0a ("accel/amdxdna: Fix order of canceled mailbox messages") Omitted-fix: 6e87001fe19f ("accel/amdxdna: Adjust size for copy_to_user()") Omitted-fix: ada61841caed ("accel/amdxdna: Fix clflush buffer size") Omitted-fix: 44d8fddf1c87 ("accel/amdxdna: Check init_srcu_struct() return value") Omitted-fix: 261c1fe3327a ("accel/amdxdna: reject user command submission without a command BO") Omitted-fix: 38953513d731 ("accel/amdxdna: reject command submission on devices without a submit op") Omitted-fix: faebb7ba1ac6 ("accel/amdxdna: Fix use-after-free of mm_struct in job scheduler") Omitted-fix: 18aaebdf4336 ("accel/amdxdna: Use unsigned long for nr_pages in amdxdna_hmm_register()") Omitted-fix: 1dbbc7f98cde ("accel/amdxdna: Fix amdxdna_client lifetime race during device removal") Omitted-fix: d1c73884858c ("accel/amdxdna: fix missing newline in pr_err message") Omitted-fix: 506255d46bdb ("accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer") Omitted-fix: 0f092793a7b5 ("accel/amdxdna: Check drmm_mutex_init() return value") Signed-off-by: Peter Colberg <pcolberg@redhat.com> Approved-by: Karol Herbst <kherbst@redhat.com> Approved-by: marpagan <marpagan@redhat.com> Approved-by: Anusha Srivatsa <asrivats@redhat.com> Approved-by: John Wiele <jwiele@redhat.com> Approved-by: Oliver Gutiérrez <ogutsua@protonmail.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
19b3294cb3 |
Merge: sctp: validate cached peer INIT chunk in cookie
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3227 JIRA: https://issues.redhat.com/browse/RHEL-190192 CVE: CVE-2026-53246 Patch 1 is CVE fix, and patch 2 is a similar fix for cookie. Signed-off-by: Xin Long <lxin@redhat.com> Approved-by: Jamie Bainbridge <jbainbri@redhat.com> Approved-by: Marcelo Ricardo Leitner <mleitner@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
6e25e46b40 |
Merge: CVE-2026-64564: sctp: don't free the ASCONF's own transport in DEL-IP processing
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3203
JIRA: https://redhat.atlassian.net/browse/RHEL-234289
CVE: CVE-2026-64564
Backported from tree(s): linux
```
sctp: don't free the ASCONF's own transport in DEL-IP processing
sctp_process_asconf() caches the transport the ASCONF chunk is processed
against in asconf->transport (== chunk->transport, set once in sctp_rcv()).
For an ASCONF located through its Address Parameter by
__sctp_rcv_asconf_lookup(), that cached transport corresponds to the
Address Parameter, which need not be the packet's source address.
sctp_process_asconf_param() rejects a DEL-IP for the packet source address
(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport.
A single ASCONF can therefore carry, in order:
[Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]
where L differs from the source. The DEL-IP for L passes the D8 check and
calls sctp_assoc_rm_peer() on the transport that asconf->transport still
points at, freeing it (RCU-deferred). The following wildcard DEL-IP then
reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and
sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed
transport (->ipaddr, ->state) and plants the dangling pointer into
asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping
only the pointer that is no longer on the list, removes every real
transport, leaving the association with a transport_count of 0 and
primary_path/active_path pointing at freed memory.
Reject a DEL-IP that targets the transport the ASCONF is being processed
against, mirroring the existing source-address guard, so the wildcard
branch can never reuse a freed transport.
Fixes:
|
||
|
CKI KWF Bot
|
a0bcbb573b |
Merge: CVE-2026-64276: Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3152
JIRA: https://redhat.atlassian.net/browse/RHEL-230267
CVE: CVE-2026-64276
Backported from tree(s): linux
```
Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count
rmi_f30_map_gpios() allocates gpioled_key_map with
min(gpioled_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f30_attention() iterates the full f30->gpioled_count (device query
register, range 0..31) and dereferences gpioled_key_map[i], and
input->keycodemax is set to the full gpioled_count while input->keycode
points at the 6-entry allocation.
A device that reports gpioled_count > 6 with GPIO support enabled
therefore causes an out-of-bounds read on the attention interrupt and
out-of-bounds read/write through the EVIOCGKEYCODE/EVIOCSKEYCODE ioctls,
which bound the index only against keycodemax. This is the same defect
as the F3A handler, which was copied from F30.
Size the keymap for the full gpioled_count; the mapping loop still
assigns only the first min(gpioled_count, TRACKSTICK_RANGE_END) entries.
Fixes:
|
||
|
CKI KWF Bot
|
4a59f80382 |
Merge: sctp: prevent peer transport count overflow [10.3]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3016
JIRA: https://redhat.atlassian.net/browse/RHEL-214458
Backported from tree(s): net
```
sctp: prevent peer transport count overflow
sctp_assoc_add_peer() increments the association's 16-bit transport_count
for every new unique peer. Adding the 65,536th transport wraps the count to
zero.
SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,
then copies one sockaddr_storage for every entry in transport_addr_list.
After the wrap, a diagnostic dump reserves an empty payload and writes
8 MiB of peer addresses past the skb tail.
Reject a new unique peer when transport_count has reached U16_MAX. Perform
the check after the existing-peer lookup so a duplicate address continues
to return its existing transport at the limit.
Fixes:
|
||
|
CKI KWF Bot
|
d3af6f158f |
Merge: redhat/configs: re-enable CONFIG_PT_RECLAIM
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2963
JIRA: https://redhat.atlassian.net/browse/RHEL-186753
Upstream Status: RHEL-only
The MM rebase to v6.16 (RHEL-145694), brought in the fixes needed to
avoid the race that triggers a UAF in page->ptl during concurrent
MADV_DONNEED calls (RHEL-185104). Therefore, re-enable
CONFIG_PT_RECLAIM.
This essentially reverts commit
|
||
|
CKI KWF Bot
|
0c6a1a2f4c |
Merge: sctp: hold socket lock when dumping endpoints in sctp_diag
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2956 JIRA: https://redhat.atlassian.net/browse/RHEL-137943 7d8297e26b4e ("sctp: hold socket lock when dumping endpoints in sctp_diag") Signed-off-by: Jamie Bainbridge <jbainbri@redhat.com> Approved-by: Xin Long <lxin@redhat.com> Approved-by: Marcelo Ricardo Leitner <mleitner@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
16f09a98b2 |
Merge: rh_message.h: Disable ConnectX-10 NVLink-C2C device
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2943 JIRA: https://redhat.atlassian.net/browse/RHEL-211847 Update rh_messages.h to be in line with hardware-removal-support.git commit 59b817e ("Merge branch 'RHEL-142604' into 'main'") Signed-off-by: Benjamin Poirier <bpoirier@redhat.com> Approved-by: Scott Weaver <scweaver@redhat.com> Approved-by: Kamal Heib <kheib@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
0d3943da43 |
Merge: KVM: x86: Fix shadow paging use-after-free due to unexpected GFN
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2915 # Merge Request Required Information ## Summary of Changes KVM: x86: Fix shadow paging use-after-free due to unexpected role ``` JIRA: https://redhat.atlassian.net/browse/RHEL-192401 CVE: CVE-2026-53359 Backported from tree(s): linux KVM: x86: Fix shadow paging use-after-free due to unexpected role Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due to unexpected GFN") fixed a shadow paging mismatch between stored and computed GFNs; the bug could be triggered by changing a PDE mapping from outside the guest, and then deleting a memslot. The rmap_remove() call would miss entries created after the PDE change because the GFN of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. A similar hole however remains if the modified PDE points to a non-leaf page. In this case the gfn can be made to match, but the role does not match: the original large 2MB page creates a kvm_mmu_page with direct=1, while the new 4KB needs a kvm_mmu_page with direct=0. However, kvm_mmu_get_child_sp() does not compare the role, and therefore reuses the page. The next step is installing a leaf (4KB) SPTE on the new path which records an rmap entry under the gfn resolved by the walk. But when that child is zapped its parent kvm_mmu_page has direct=1 and kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] in older kernels). It therefore fails to remove the recorded entry. When the memslot is dropped the shadow page is freed but the rmap entry survives, as in the scenario that was already fixed. Code that later walks that gfn (dirty logging, MMU notifier invalidation, and so on) dereferences an sptep that lies in the freed page, causing the use-after-free. Fixes: |
||
|
CKI KWF Bot
|
09a534b1d6 |
Merge: firmware: arm_ffa: driver update to v7.2
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2908 JIRA: https://issues.redhat.com/browse/RHEL-179031 JIRA: https://issues.redhat.com/browse/RHEL-183180 Update the ARM Firmware Framework driver from v6.15 to v7.2-rc4. Omitted-fix: 677042afb97ac (`tpm: tpm_crb_ffa: revert defered_probed when tpm_crb_ffa is built-in`) Signed-off-by: Jennifer Berringer <jberring@redhat.com> Approved-by: Mark Langsdorf <mlangsdo@redhat.com> Approved-by: ekovsky <ekovsky@redhat.com> Approved-by: Charles Mirabile <cmirabil@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
8b335a099f |
Merge: CVE-2026-52924: sctp: purge outqueue on stale COOKIE-ECHO handling
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2800
JIRA: https://redhat.atlassian.net/browse/RHEL-188204
CVE: CVE-2026-52924
Backported from tree(s): linux
```
sctp: purge outqueue on stale COOKIE-ECHO handling
sctp_stream_update() is only invoked when the association is moved into
COOKIE_WAIT during association setup/reconfiguration. In this path, the
outbound stream scheduler state (stream->out_curr) is expected to be
clean, since no user data should have been transmitted yet unless the
state machine has already partially progressed.
However, a corner case exists in sctp_sf_do_5_2_6_stale(): when a
Stale Cookie ERROR is received, the association is rolled back from
COOKIE_ECHOED to COOKIE_WAIT. In this scenario, user data may already
have been queued and even bundled with the COOKIE-ECHO chunk.
During the rollback, sctp_stream_update() frees the old stream table
and installs a new one, but it does not invalidate stream->out_curr.
As a result, out_curr may still point to a freed sctp_stream_out
entry from the previous stream state.
Later, SCTP scheduler dequeue paths (FCFS, RR, PRIO, etc.) rely on
stream->out_curr->ext, which can lead to use-after-free once the old
stream state has been released via sctp_stream_free().
This results in crashes such as (reported by Yuqi):
BUG: KASAN: slab-use-after-free in sctp_sched_fcfs_dequeue+0x13a/0x140
Read of size 8 at addr ff1100004d4d3208 by task mini_poc/9312
CPU: 1 UID: 1001 PID: 9312 Comm: mini_poc Not tainted
7.1.0-rc1-00305-gbd3a4795d574 #5 PREEMPT(full)
sctp_sched_fcfs_dequeue+0x13a/0x140
sctp_outq_flush+0x1603/0x33e0
sctp_do_sm+0x31c9/0x5d30
sctp_assoc_bh_rcv+0x392/0x6f0
sctp_inq_push+0x1db/0x270
sctp_rcv+0x138d/0x3c10
Fix this by fully purging the association outqueue when handling the
Stale Cookie case. This ensures all pending transmit and retransmit
state is dropped, and any scheduler cached pointers are invalidated,
making it safe to rebuild stream state during COOKIE_WAIT restart.
Updating only stream->out_curr would be insufficient, since queued
and retransmittable data would still reference the old stream state and
trigger later use-after-free in dequeue paths.
Fixes:
|
||
|
CKI KWF Bot
|
3a4c716a67 |
Merge: CVE-2026-31669: mptcp: fix slab-use-after-free in __inet_lookup_established
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2479
JIRA: https://redhat.atlassian.net/browse/RHEL-171511
CVE: CVE-2026-31669
```
commit 9b55b253907e7431210483519c5ad711a37dafa1
Author: Jiayuan Chen <jiayuan.chen@linux.dev>
Date: Mon Apr 6 11:15:10 2026 +0800
mptcp: fix slab-use-after-free in __inet_lookup_established
The ehash table lookups are lockless and rely on
SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability
during RCU read-side critical sections. Both tcp_prot and
tcpv6_prot have their slab caches created with this flag
via proto_register().
However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into
tcpv6_prot_override during inet_init() (fs_initcall, level 5),
before inet6_init() (module_init/device_initcall, level 6) has
called proto_register(&tcpv6_prot). At that point,
tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab
remains NULL permanently.
This causes MPTCP v6 subflow child sockets to be allocated via
kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab
cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so
when these sockets are freed without SOCK_RCU_FREE (which is
cleared for child sockets by design), the memory can be
immediately reused. Concurrent ehash lookups under
rcu_read_lock can then access freed memory, triggering a
slab-use-after-free in __inet_lookup_established.
Fix this by splitting the IPv6-specific initialization out of
mptcp_subflow_init() into a new mptcp_subflow_v6_init(), called
from mptcp_proto_v6_init() before protocol registration. This
ensures tcpv6_prot_override.slab correctly inherits the
SLAB_TYPESAFE_BY_RCU slab cache.
Fixes:
|
||
|
CKI KWF Bot
|
4e43be9c27 |
Merge: net: lockless and NUMA aware skb_attempt_defer_free
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2445 JIRA: https://issues.redhat.com/browse/RHEL-123212 This should improve performances for a number of scenari on multi-NUMA hosts. Signed-off-by: Antoine Tenart <atenart@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: Xin Long <lxin@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
d6e9752f2d |
Merge: l2tp: stable backport for 10.3 phase 1
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2407 JIRA: https://redhat.atlassian.net/browse/RHEL-152732 Upstream Status: linux.git L2TP fixes for RHEL 10.3. Signed-off-by: Guillaume Nault <gnault@redhat.com> Approved-by: Florian Westphal <fwestpha@redhat.com> Approved-by: Antoine Tenart <atenart@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
0278666955 |
Merge: mpls: stable backport for 10.3 phase 1
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2382 JIRA: https://redhat.atlassian.net/browse/RHEL-152709 Upstream Status: linux.git MPLS fixes for RHEL 10.3. Signed-off-by: Guillaume Nault <gnault@redhat.com> Approved-by: Jamie Bainbridge <jbainbri@redhat.com> Approved-by: Marcelo Ricardo Leitner <mleitner@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
a29e895ace |
Merge: ppp: stable backport for 10.3 phase 1
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2380 JIRA: https://redhat.atlassian.net/browse/RHEL-152724 Upstream Status: linux.git PPP fixes for RHEL 10.3. Signed-off-by: Guillaume Nault <gnault@redhat.com> Approved-by: Jarod Wilson <jarod@redhat.com> Approved-by: Paolo Abeni <pabeni@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
1273f0fb36 |
Merge: srv6: stable backport for 10.3 phase 1
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2330 JIRA: https://redhat.atlassian.net/browse/RHEL-152736 * 01c411238c06 seg6: Extend seg6_lookup_any_nexthop() with an oif argument * 3159671855d4 seg6: Call seg6_lookup_any_nexthop() from End.X behavior * a2840d4e2527 seg6: Allow End.X behavior to accept an oif * 04d752d60c19 selftests: seg6: Add test cases for End.X with link-local nexthop * db3e2ceab3c7 seg6: fix lenghts typo in a comment * 3bedaff19bd8 selftests: seg6: fix instaces typo in comments * 064137935262 ipv6: add NULL checks for idev in SRv6 paths Signed-off-by: CKI Backport Bot <cki-ci-bot+cki-gitlab-backport-bot@redhat.com> [^footer]: Created 2026-03-31 04:59 UTC by backporter - [KWF FAQ](https://red.ht/kernel_workflow_doc) - [Slack #team-kernel-workflow](https://redhat-internal.slack.com/archives/C04LRUPMJQ5) - [Source](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/webhook/utils/backporter.py) - [Documentation](https://gitlab.com/cki-project/kernel-workflow/-/blob/main/docs/README.backporter.md) - [Report an issue](https://redhat.atlassian.net/secure/CreateIssueDetails!init.jspa?pid=12334433&issuetype=1&priority=4&summary=backporter+webhook+issue&components=kernel-workflow+/+backporter) [^footer] Approved-by: Guillaume Nault <gnault@redhat.com> Approved-by: Florian Westphal <fwestpha@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
e2de28aaf5 |
[redhat] kernel-6.12.0-263.el10
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> |
||
|
CKI KWF Bot
|
d66016048e |
Merge: mm: consider non-anon swap cache folios in folio_expected_ref_count()
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3330 JIRA: https://redhat.atlassian.net/browse/RHEL-224504 Upstream Status: v6.19-rc4 Tested: PCDIMM can be hot removed after stress-ng workload This picks upstream commit f183663901f2 ("mm: consider non-anon swap cache folios in folio_expected_ref_count()"), which corrects the reference count for non-anon swap cache folios. Otherwise, the hot added PCDIMM can't be hot removed in an aarch64 guest after the excercise with 'stress-ng'. Signed-off-by: Gavin Shan <gshan@redhat.com> Approved-by: Waiman Long <longman@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: Eric Auger <eric.auger@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
8456a25e8b |
Merge: dm cache policy smq: check allocation under invalidate lock
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3301 JIRA: https://issues.redhat.com/browse/RHEL-231823 CVE: CVE-2026-53062 Tested: Reproducer and dm cache tests Upstream Status: kernel/git/torvalds/linux.git commit d3f0a606b9f278ece8a0df626ded9c4044071235 Author: Guangshuo Li <lgs201920130244@gmail.com> Date: Fri May 29 23:57:45 2026 +0800 dm cache policy smq: check allocation under invalidate lock commit 2d1f7b65f5de ("dm cache policy smq: fix missing locks in invalidating cache blocks") added mq->lock around the destructive part of smq_invalidate_mapping(), but left the e->allocated check outside the critical section. That leaves a check-then-act race. Two concurrent invalidators can both observe e->allocated as true before either of them takes mq->lock. The first invalidator that acquires the lock removes the entry from the queues and hash table and then calls free_entry(), which clears e->allocated and puts the entry back on the free list. The second invalidator can then acquire mq->lock and continue with the stale result of the unlocked check. This can corrupt the SMQ queues or hash table by deleting an entry that is no longer on those structures. It can also hit the allocation check in free_entry() when the same entry is freed again. Move the allocation check under mq->lock so the predicate and the destructive operations are serialized by the same lock. Fixes: 2d1f7b65f5de ("dm cache policy smq: fix missing locks in invalidating cache blocks") Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com> Approved-by: Matthew Sakai <msakai@redhat.com> Approved-by: Ming Hung Tsai <mtsai@redhat.com> Approved-by: Kenneth Raeburn <raeburn@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
50ebb3393f |
Merge: CVE-2026-43493 kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests [rhel-10.3]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3255 JIRA: https://redhat.atlassian.net/browse/RHEL-226716 CVE: CVE-2026-43493 commit 915b692e6cb723aac658c25eb82c58fd81235110 Author: Herbert Xu <herbert@gondor.apana.org.au> Date: Thu Apr 16 17:00:50 2026 +0800 crypto: pcrypt - Fix handling of MAY_BACKLOG requests Signed-off-by: Ricardo Robaina <rrobaina@redhat.com> Approved-by: Bruno Meneguele <bmeneg@redhat.com> Approved-by: Phil Auld <pauld@redhat.com> Approved-by: Vladislav Dronov <vdronov@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
b3607ff92b |
Merge: CVE-2026-64277: Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/3170
JIRA: https://redhat.atlassian.net/browse/RHEL-231458
CVE: CVE-2026-64277
Backported from tree(s): linux
```
Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count
rmi_f3a_initialize() takes the GPIO count from the device query register
(f3a->gpio_count = buf & RMI_F3A_GPIO_COUNT, range 0..127).
rmi_f3a_map_gpios() then allocates gpio_key_map with
min(gpio_count, TRACKSTICK_RANGE_END) == at most 6 entries, but
rmi_f3a_attention() iterates the full gpio_count and dereferences
gpio_key_map[i], and input->keycodemax is set to the full gpio_count
while input->keycode points at the 6-entry allocation.
A device that reports gpio_count > 6 therefore causes an out-of-bounds
read of gpio_key_map[] on every attention interrupt, and out-of-bounds
accesses through the input core's default keymap ioctls: EVIOCGKEYCODE
reads past the buffer (leaking adjacent slab memory to user space) and
EVIOCSKEYCODE writes a caller-controlled value past it, for any process
able to open the evdev node, since input_default_getkeycode() and
input_default_setkeycode() only bound the index against keycodemax.
Size the keymap for the full gpio_count. The mapping loop is unchanged:
it still assigns only the first min(gpio_count, TRACKSTICK_RANGE_END)
entries; the remaining slots stay KEY_RESERVED (devm_kcalloc zero-fills)
and are skipped when reporting.
Fixes:
|
||
|
CKI KWF Bot
|
eae2ba4280 |
Merge: [RHEL-10.3] Recent upstream fixes for IOMMU subsystem
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2982 # Merge Request Required Information JIRA: https://issues.redhat.com/browse/RHEL-213791 Upstream-Status: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git CVE: CVE-2026-53053 CVE: CVE-2026-53372 CVE: CVE-2026-64149 CVE: CVE-2026-53283 CVE: CVE-2026-53164 CVE: CVE-2026-64186 CVE: CVE-2026-64151 CVE: CVE-2026-64152 ## Summary of Changes Recent upstream fixes touching commits in RHEL10. Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com> Approved-by: Eder Zulian <ezulian@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: Jocelyn Falempe <jfalempe@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
7e818a1b98 |
Merge: CVE-2025-21834 kernel: seccomp: passthrough uretprobe systemcall without filtering
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2931 JIRA: https://issues.redhat.com/browse/RHEL-210962 CVE: CVE-2025-21834 Backport of upstream commit cf6cb56ef244 ("seccomp: passthrough uretprobe systemcall without filtering") to fix the CVE aforementioned. Signed-off-by: Ricardo Robaina <rrobaina@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Approved-by: Bruno Meneguele <bmeneg@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
ce8e83a3e2 |
Merge: perf: Add Intel DMR and NVL support
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2891 JIRA: https://redhat.atlassian.net/browse/RHEL-95668 JIRA: https://redhat.atlassian.net/browse/RHEL-115120 JIRA: https://redhat.atlassian.net/browse/RHEL-115122 JIRA: https://redhat.atlassian.net/browse/RHEL-115124 JIRA: https://redhat.atlassian.net/browse/RHEL-117335 JIRA: https://redhat.atlassian.net/browse/RHEL-117337 JIRA: https://redhat.atlassian.net/browse/RHEL-120357 This MR brings PMU support for Intel Diamond Rapids and Nova Lake models. The features are split into multiple JIRA tickets, but make sense to merge together in one batch. This brings uncore, core and cstate support plus some fixes and extensions required by the mentioned platforms. Signed-off-by: Michael Petlan <mpetlan@redhat.com> Approved-by: Steve Best <sbest@redhat.com> Approved-by: tallison1 <tallison@redhat.com> Approved-by: ashelat <ashelat@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
42630645f0 |
Merge: CVE-2026-52923 kernel: ipc: limit next_id allocation to the valid ID range [rhel-10.3]
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2839 JIRA: https://redhat.atlassian.net/browse/RHEL-188220 CVE: CVE-2026-52923 commit fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139 Author: Linpu Yu <linpu5433@gmail.com> Date: Sun May 10 13:43:30 2026 +0800 ipc: limit next_id allocation to the valid ID range Signed-off-by: Rafael Aquini <raquini@redhat.com> Approved-by: Phil Auld <pauld@redhat.com> Approved-by: Luiz Capitulino <luizcap@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
5ff962f661 |
Merge: KVM: arm64: pickup fixes up to v7.1
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2818 JIRA: https://redhat.atlassian.net/browse/RHEL-180320 Testing done: basic host regression test, basic VM tests, kvm selftests, kvm-unit-tests. Backport fixes up to kernel 7.1 . Signed-off-by: Sebastian Ott <sebott@redhat.com> Approved-by: Eric Auger <eric.auger@redhat.com> Approved-by: Gavin Shan <gshan@redhat.com> Approved-by: Rafael Aquini <raquini@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
f837733be2 |
Merge: selftests/cgroup: Backport cgroup selftests updates and fixes
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2746 JIRA: https://redhat.atlassian.net/browse/RHEL-154157 JIRA: https://redhat.atlassian.net/browse/RHEL-154159 JIRA: https://redhat.atlassian.net/browse/RHEL-184801 MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2746 Omitted-fix: d9b40d7262a2 ("selftests/x86: Add selftests include path for kselftest.h after centralization") This series backports most of relevant cgroup selftests commits in linux mainline and mm-stable maintainer tree to reduce the failure rate of the cgroup selftests. This commits do not fix all the test failures but still many of them should be gone. By running the cgroup selftests 100 times on an arm64 and x86-64 systems, the table below shows the number of test failures before and after applying the patches. x86-64 ====== Test Before After ---- ------ ----- test_cpucg_nested_weight_overprovisioned 62 66 test_cpucg_stats 50 50 test_cpucg_weight_overprovisioned 62 66 test_memcg_low 100 6 test_memcg_min 29 1 test_memcg_sock 100 0 test_zswap_writeback_disabled 100 0 test_zswap_writeback_enabled 100 0 test_zswapin 100 0 aarch64 ======= Test Before After ---- ------ ----- test_cpucg_max 39 44 test_cpucg_max_nested 25 23 test_cpucg_nested_weight_overprovisioned 57 58 test_cpucg_nested_weight_underprovisioned 2 3 test_cpucg_nice 95 79 test_cpucg_stats 50 50 test_cpucg_weight_overprovisioned 95 91 test_cgfreezer_ptrace 50 53 test_memcg_low 100 0 test_memcg_min 82 85 test_memcg_sock 100 100 test_zswap_usage 100 0 test_zswap_writeback_disabled 100 0 test_zswap_writeback_enabled 100 0 test_zswapin 100 0 The test_zswap failures are all gone and some of the test_memcontrol failures are gone. However this MR has no real impact on test_cpu and test_freezer failures. Signed-off-by: Waiman Long <longman@redhat.com> Approved-by: Herton R. Krzesinski <herton@redhat.com> Approved-by: Phil Auld <pauld@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
|
CKI KWF Bot
|
86281d3ba1 |
Merge: net: ipv6: P1 backports for 10.3
MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10/-/merge_requests/2724 A set of various fixes and improvements in the IPv6 area for 10.3; backported as part of our P1 backports. JIRA: https://redhat.atlassian.net/browse/RHEL-152712 Omitted-fix: fdd973148a11 ("selftests: net: add ipv6 RA route to ECMP merge test"). This is a false positive (only refers to a commit backported in there, not fixing anything). Signed-off-by: Antoine Tenart <atenart@redhat.com> Approved-by: Jamie Bainbridge <jbainbri@redhat.com> Approved-by: Sabrina Dubroca <sdubroca@redhat.com> Approved-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> Merged-by: CKI GitLab Kmaint Pipeline Bot <26919896-cki-kmaint-pipeline-bot@users.noreply.gitlab.com> |
||
 Peter Colberg
|
75a3fa3bf2 |
accel/amdxdna: Fix mm_struct reference leak in aie2_populate_range()
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0.13 commit 21dfec59939120b20d2c7794caaa421f9450be0a Author: Lizhi Hou <lizhi.hou@amd.com> AuthorDate: Wed Jun 10 08:11:27 2026 -0700 Commit: Greg Kroah-Hartman <gregkh@linuxfoundation.org> CommitDate: Fri Jun 19 13:47:55 2026 +0200 [ Upstream commit 2f41af638c92bac6f1f9275ea2d1901baef578f3 ] aie2_populate_range() jumps back to the again label without calling mmput(mm), leaking a reference to the mm_struct. Add the missing mmput() before jumping to again. Fixes: e486147c912f ("accel/amdxdna: Add BO import and export") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260610151127.2994185-1-lizhi.hou@amd.com Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
d0ecf3efdc |
accel/amdxdna: fix missing newline in pr_err message
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0.10 commit c932aef23cdc9d1d06aa13994ac6f00279a31686 Author: haoyu.lu <hechushiguitu666@gmail.com> AuthorDate: Mon Mar 23 11:49:32 2026 +0800 Commit: Greg Kroah-Hartman <gregkh@linuxfoundation.org> CommitDate: Sat May 23 13:08:47 2026 +0200 [ Upstream commit d1c73884858cb3ce2a0f761988a6f279bff32b91 ] Add missing newline to pr_err message in amdxdna_mailbox.c. Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox") Signed-off-by: haoyu.lu <hechushiguitu666@gmail.com> Reviewed-by: Lizhi.hou <lizhi.hou@amd.com> Signed-off-by: Lizhi.hou <lizhi.hou@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260323034933.216-1-hechushiguitu666@gmail.com Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
15e7e6e2ad |
accel/amdxdna: Fix runtime suspend deadlock when there is pending job
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0-rc4 CVE: CVE-2026-43446 commit 6b13cb8f48a42ddf6dd98865b673a82e37ff238b Author: Lizhi Hou <lizhi.hou@amd.com> AuthorDate: Tue Mar 10 11:00:58 2026 -0700 Commit: Lizhi Hou <lizhi.hou@amd.com> CommitDate: Tue Mar 10 11:46:40 2026 -0700 The runtime suspend callback drains the running job workqueue before suspending the device. If a job is still executing and calls pm_runtime_resume_and_get(), it can deadlock with the runtime suspend path. Fix this by moving pm_runtime_resume_and_get() from the job execution routine to the job submission routine, ensuring the device is resumed before the job is queued and avoiding the deadlock during runtime suspend. Fixes: 063db451832b ("accel/amdxdna: Enhance runtime power management") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260310180058.336348-1-lizhi.hou@amd.com Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
24b492560a |
accel/amdxdna: Split mailbox channel create function
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0-rc3 commit d5b8b0347fa8470b751a506fb801797e271d7548 Author: Lizhi Hou <lizhi.hou@amd.com> AuthorDate: Wed Mar 4 22:20:41 2026 -0800 Commit: Lizhi Hou <lizhi.hou@amd.com> CommitDate: Thu Mar 5 09:24:33 2026 -0800 The management channel used for firmware control command submission is currently created after the firmware is started. If channel creation fails (for example, due to memory allocation failure or workqueue creation interruption), the firmware remains in a pending state and is unable to receive any control commands. To avoid leaving the firmware in this inconsistent state, split xdna_mailbox_create_channel() into two separate functions so that resource allocation can be completed before interacting with the hardware. xdna_mailbox_alloc_channel() Allocates memory and initializes the workqueue. This can be called earlier, before interacting with the hardware. xdna_mailbox_start_channel() Performs the hardware interaction required to start the channel. Rename xdna_mailbox_destroy_channel() to xdna_mailbox_free_channel(). Ensure that xdna_mailbox_stop_channel() and xdna_mailbox_free_channel() properly unwind the corresponding start and allocation steps, respectively. Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260305062041.3954024-1-lizhi.hou@amd.com Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
e73eaff827 |
accel/amdxdna: Fix major version check on NPU1 platform
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0-rc3 commit f82859c84a9862e242c904e72fb0625fef9b24e7 Author: Lizhi Hou <lizhi.hou@amd.com> AuthorDate: Wed Mar 4 11:50:12 2026 -0800 Commit: Lizhi Hou <lizhi.hou@amd.com> CommitDate: Wed Mar 4 12:05:02 2026 -0800 Add the missing major number in npu1_fw_feature_table. Without the major version specified, the firmware feature check fails, preventing new firmware commands from being enabled on the NPU1 platform. With the correct major version populated, the driver properly detects firmware support and enables the new command. Fixes: f1eac46fe5f7 ("accel/amdxdna: Update firmware version check for latest firmware") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260304195012.3616908-1-lizhi.hou@amd.com Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
73bfb80675 |
accel/amdxdna: Fix NULL pointer dereference of mgmt_chann
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0-rc3 CVE: CVE-2026-23328 commit 6270ee26e1edd862ea17e3eba148ca8fb2c99dc9 Author: Lizhi Hou <lizhi.hou@amd.com> AuthorDate: Thu Feb 26 13:38:57 2026 -0800 Commit: Lizhi Hou <lizhi.hou@amd.com> CommitDate: Mon Mar 2 09:43:22 2026 -0800 mgmt_chann may be set to NULL if the firmware returns an unexpected error in aie2_send_mgmt_msg_wait(). This can later lead to a NULL pointer dereference in aie2_hw_stop(). Fix this by introducing a dedicated helper to destroy mgmt_chann and by adding proper NULL checks before accessing it. Fixes: b87f920b9344 ("accel/amdxdna: Support hardware mailbox") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260226213857.3068474-1-lizhi.hou@amd.com Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
5a09909467 |
accel/amdxdna: Fill invalid payload for failed command
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0-rc3 commit 89ff45359abbf9d8d3c4aa3f5a57ed0be82b5a12 Author: Lizhi Hou <lizhi.hou@amd.com> AuthorDate: Thu Feb 26 16:48:41 2026 -0800 Commit: Lizhi Hou <lizhi.hou@amd.com> CommitDate: Fri Feb 27 23:01:36 2026 -0800 Newer userspace applications may read the payload of a failed command to obtain detailed error information. However, the driver and old firmware versions may not support returning advanced error information. In this case, initialize the command payload with an invalid value so userspace can detect that no detailed error information is available. Fixes: aac243092b70 ("accel/amdxdna: Add command execution") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260227004841.3080241-1-lizhi.hou@amd.com Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
8ed5cad830 |
accel/amdxdna: Use a different name for latest firmware
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0-rc2 commit 75c151ceaacf5ca8f2f34ebf863d88002fb12587 Author: Lizhi Hou <lizhi.hou@amd.com> AuthorDate: Wed Feb 25 12:47:52 2026 -0800 Commit: Lizhi Hou <lizhi.hou@amd.com> CommitDate: Wed Feb 25 13:51:31 2026 -0800 Using legacy driver with latest firmware causes a power off issue. Fix this by assigning a different filename (npu_7.sbin) to the latest firmware. The driver attempts to load the latest firmware first and falls back to the previous firmware version if loading fails. Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5009 Fixes: f1eac46fe5f7 ("accel/amdxdna: Update firmware version check for latest firmware") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260225204752.2711734-1-lizhi.hou@amd.com Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
bcc5331d33 |
accel/amdxdna: Validate command buffer payload count
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0-rc2 CVE: CVE-2026-23424 commit 901ec3470994006bc8dd02399e16b675566c3416 Author: Lizhi Hou <lizhi.hou@amd.com> AuthorDate: Thu Feb 19 13:19:46 2026 -0800 Commit: Lizhi Hou <lizhi.hou@amd.com> CommitDate: Mon Feb 23 09:24:21 2026 -0800 The count field in the command header is used to determine the valid payload size. Verify that the valid payload does not exceed the remaining buffer space. Fixes: aac243092b70 ("accel/amdxdna: Add command execution") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260219211946.1920485-1-lizhi.hou@amd.com Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
15533871f6 |
accel/amdxdna: Prevent ubuf size overflow
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0-rc2 CVE: CVE-2026-23280 commit 03808abb1d868aed7478a11a82e5bb4b3f1ca6d6 Author: Lizhi Hou <lizhi.hou@amd.com> AuthorDate: Tue Feb 17 11:28:15 2026 -0800 Commit: Lizhi Hou <lizhi.hou@amd.com> CommitDate: Mon Feb 23 09:24:21 2026 -0800 The ubuf size calculation may overflow, resulting in an undersized allocation and possible memory corruption. Use check_add_overflow() helpers to validate the size calculation before allocation. Fixes: bd72d4acda10 ("accel/amdxdna: Support user space allocated buffer") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260217192815.1784689-1-lizhi.hou@amd.com Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
8ef363d8ce |
accel/amdxdna: Fix out-of-bounds memset in command slot handling
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0-rc2 CVE: CVE-2026-23288 commit 1110a949675ebd56b3f0286e664ea543f745801c Author: Lizhi Hou <lizhi.hou@amd.com> AuthorDate: Tue Feb 17 10:54:15 2026 -0800 Commit: Lizhi Hou <lizhi.hou@amd.com> CommitDate: Mon Feb 23 09:24:20 2026 -0800 The remaining space in a command slot may be smaller than the size of the command header. Clearing the command header with memset() before verifying the available slot space can result in an out-of-bounds write and memory corruption. Fix this by moving the memset() call after the size validation. Fixes: 3d32eb7a5ecf ("accel/amdxdna: Fix cu_idx being cleared by memset() during command setup") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260217185415.1781908-1-lizhi.hou@amd.com Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
7d0056bebf |
accel/amdxdna: Fix command hang on suspended hardware context
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0-rc2 commit 07efce5a6611af6714ea3ef65694e0c8dd7e44f5 Author: Lizhi Hou <lizhi.hou@amd.com> AuthorDate: Wed Feb 11 12:53:41 2026 -0800 Commit: Lizhi Hou <lizhi.hou@amd.com> CommitDate: Mon Feb 23 09:24:19 2026 -0800 When a hardware context is suspended, the job scheduler is stopped. If a command is submitted while the context is suspended, the job is queued in the scheduler but aie2_sched_job_run() is never invoked to restart the hardware context. As a result, the command hangs. Fix this by modifying the hardware context suspend routine to keep the job scheduler running so that queued jobs can trigger context restart properly. Fixes: aac243092b70 ("accel/amdxdna: Add command execution") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260211205341.722982-1-lizhi.hou@amd.com Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
c4d0821068 |
accel/amdxdna: Fix suspend failure after enabling turbo mode
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0-rc2 commit fdb65acfe655f844ae1e88696b9656d3ef5bb8fb Author: Lizhi Hou <lizhi.hou@amd.com> AuthorDate: Wed Feb 11 12:47:16 2026 -0800 Commit: Lizhi Hou <lizhi.hou@amd.com> CommitDate: Mon Feb 23 09:24:19 2026 -0800 Enabling turbo mode disables hardware clock gating. Suspend requires hardware clock gating to be re-enabled, otherwise suspend will fail. Fix this by calling aie2_runtime_cfg() from aie2_hw_stop() to re-enable clock gating during suspend. Also ensure that firmware is initialized in aie2_hw_start() before modifying clock-gating settings during resume. Fixes: f4d7b8a6bc8c ("accel/amdxdna: Enhance power management settings") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260211204716.722788-1-lizhi.hou@amd.com Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
4c46517d99 |
accel/amdxdna: Fix dead lock for suspend and resume
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0-rc2 CVE: CVE-2026-23295 commit 1aa82181a3c285c7351523d587f7981ae4c015c8 Author: Lizhi Hou <lizhi.hou@amd.com> AuthorDate: Wed Feb 11 12:46:44 2026 -0800 Commit: Lizhi Hou <lizhi.hou@amd.com> CommitDate: Mon Feb 23 09:24:17 2026 -0800 When an application issues a query IOCTL while auto suspend is running, a deadlock can occur. The query path holds dev_lock and then calls pm_runtime_resume_and_get(), which waits for the ongoing suspend to complete. Meanwhile, the suspend callback attempts to acquire dev_lock and blocks, resulting in a deadlock. Fix this by releasing dev_lock before calling pm_runtime_resume_and_get() and reacquiring it after the call completes. Also acquire dev_lock in the resume callback to keep the locking consistent. Fixes: 063db451832b ("accel/amdxdna: Enhance runtime power management") Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260211204644.722758-1-lizhi.hou@amd.com Signed-off-by: Peter Colberg <pcolberg@redhat.com> |
||
|
Peter Colberg
|
2f76c4f4ca |
accel/amdxdna: Reduce log noise during process termination
JIRA: https://redhat.atlassian.net/browse/RHEL-222546 Upstream Status: v7.0-rc2 commit 57aa3917a3b3bd805a3679371f97a1ceda3c5510 Author: Mario Limonciello <mario.limonciello@amd.com> AuthorDate: Tue Feb 10 10:42:51 2026 -0600 Commit: Lizhi Hou <lizhi.hou@amd.com> CommitDate: Mon Feb 23 09:24:16 2026 -0800 During process termination, several error messages are logged that are not actual errors but expected conditions when a process is killed or interrupted. This creates unnecessary noise in the kernel log. The specific scenarios are: 1. HMM invalidation returns -ERESTARTSYS when the wait is interrupted by a signal during process cleanup. This is expected when a process is being terminated and should not be logged as an error. 2. Context destruction returns -ENODEV when the firmware or device has already stopped, which commonly occurs during cleanup if the device was already torn down. This is also an expected condition during orderly shutdown. Downgrade these expected error conditions from error level to debug level to reduce log noise while still keeping genuine errors visible. Fixes: 97f27573837e ("accel/amdxdna: Fix potential NULL pointer dereference in context cleanup") Reviewed-by: Lizhi Hou <lizhi.hou@amd.com> Signed-off-by: Mario Limonciello <mario.limonciello@amd.com> Signed-off-by: Lizhi Hou <lizhi.hou@amd.com> Link: https://patch.msgid.link/20260210164521.1094274-3-mario.limonciello@amd.com Signed-off-by: Peter Colberg <pcolberg@redhat.com> |