[rocky10_2] History Rebuild through kernel-6.12.0-211.37.1.el10_2

Makefile.rhelver

@@ -12,7 +12,7 @@ RHEL_MINOR = 2
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 211.34.1
+RHEL_RELEASE = 211.37.1
 
 #
 # RHEL_REBASE_NUM

ciq/ciq_backports/kernel-6.12.0-211.37.1.el10_2/14acf965.failed

@@ -0,0 +1,130 @@
+xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
+
+jira KERNEL-1355
+cve CVE-2026-46116
+Rebuild_History Non-Buildable kernel-6.12.0-211.37.1.el10_2
+commit-author Michal Kosiorek <mkosiorek121@gmail.com>
+commit 14acf9652e5690de3c7486c6db5fb8dafd0a32a3
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-6.12.0-211.37.1.el10_2/14acf965.failed
+
+KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s
+hlist_del_rcu calls under syzkaller load on linux-6.12.y stable
+(reproduced on 6.12.47, also reachable via the same code path on
+torvalds/master and on the ipsec tree). Nine unique signatures cluster
+in the xfrm_state lifecycle, the load-bearing one being:
+
+  BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]
+  BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline]
+  BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c
+  Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435
+
+  Workqueue: netns cleanup_net
+  Call Trace:
+   __hlist_del / hlist_del_rcu
+   __xfrm_state_delete
+   xfrm_state_delete
+   xfrm_state_flush
+   xfrm_state_fini
+   ops_exit_list
+   cleanup_net
+
+The other observed signatures hit the same slab object from
+__xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB
+write variant of __xfrm_state_delete, all on the byseq/byspi
+hash chains.
+
+__xfrm_state_delete() guards its byseq and byspi unhashes with
+value-based predicates:
+
+	if (x->km.seq)
+		hlist_del_rcu(&x->byseq);
+	if (x->id.spi)
+		hlist_del_rcu(&x->byspi);
+
+while everywhere else in the file (e.g. state_cache, state_cache_input)
+the safer hlist_unhashed() check is used. xfrm_alloc_spi() sets
+x->id.spi = newspi inside xfrm_state_lock and then immediately inserts
+into byspi, but a path that observes x->id.spi != 0 outside of
+xfrm_state_lock can still skip-or-hit the byspi unhash inconsistently
+with whether x is actually on the list. The same holds for x->km.seq
+versus byseq, and the bydst/bysrc unhashes have no predicate at all,
+so a second __xfrm_state_delete() on the same object writes through
+LIST_POISON pprev.
+
+The defensive change here:
+
+  - Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst,
+    bysrc, byseq and byspi so a second deletion is a no-op rather
+    than a write through LIST_POISON pprev. The byseq/byspi nodes
+    are already initialised in xfrm_state_alloc().
+  - Test hlist_unhashed() rather than the value predicate for
+    byseq/byspi, so the unhash decision tracks list state rather than
+    mutable scalar fields.
+
+Empirical verification: applied this patch on top of v6.12.47, rebuilt,
+and re-ran the same syzkaller harness for 1h16m on a previously-crashy
+configuration that produced ~100 hits each of slab-use-after-free
+Read in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in
+__xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at
+~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo
+confirms the xfrm_state slab is actively allocated and freed during
+the run (~143 KiB resident), so the fuzzer is still exercising those
+code paths -- they just no longer crash.
+
+Reproduction:
+
+  - Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV
+  - syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db
+  - 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal
+  - 9 unique signatures collected in ~9h, all within xfrm_state
+    lifecycle
+
+Fixes: fe9f1d8779cb ("xfrm: add state hashtable keyed by seq")
+Fixes: 7b4dc3600e48 ("[XFRM]: Do not add a state whose SPI is zero to the SPI hash.")
+	Reported-by: Michal Kosiorek <mkosiorek121@gmail.com>
+	Tested-by: Michal Kosiorek <mkosiorek121@gmail.com>
+	Cc: stable@vger.kernel.org
+	Signed-off-by: Michal Kosiorek <mkosiorek121@gmail.com>
+	Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+(cherry picked from commit 14acf9652e5690de3c7486c6db5fb8dafd0a32a3)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	net/xfrm/xfrm_state.c
+diff --cc net/xfrm/xfrm_state.c
+index bbe17141f82a,686014d39429..000000000000
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@@ -749,14 -815,20 +749,28 @@@ int __xfrm_state_delete(struct xfrm_sta
+
+  	if (x->km.state != XFRM_STATE_DEAD) {
+  		x->km.state = XFRM_STATE_DEAD;
+ -
+  		spin_lock(&net->xfrm.xfrm_state_lock);
+  		list_del(&x->km.all);
+++<<<<<<< HEAD
+ +		hlist_del_rcu(&x->bydst);
+ +		hlist_del_rcu(&x->bysrc);
+ +		if (x->km.seq)
+ +			hlist_del_rcu(&x->byseq);
+ +		if (x->id.spi)
+ +			hlist_del_rcu(&x->byspi);
+++=======
++ 		hlist_del_init_rcu(&x->bydst);
++ 		hlist_del_init_rcu(&x->bysrc);
++ 		if (!hlist_unhashed(&x->byseq))
++ 			hlist_del_init_rcu(&x->byseq);
++ 		if (!hlist_unhashed(&x->state_cache))
++ 			hlist_del_rcu(&x->state_cache);
++ 		if (!hlist_unhashed(&x->state_cache_input))
++ 			hlist_del_rcu(&x->state_cache_input);
++ 
++ 		if (!hlist_unhashed(&x->byspi))
++ 			hlist_del_init_rcu(&x->byspi);
+++>>>>>>> 14acf9652e56 (xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete)
+  		net->xfrm.state_num--;
+  		xfrm_nat_keepalive_state_updated(x);
+  		spin_unlock(&net->xfrm.xfrm_state_lock);
+* Unmerged path net/xfrm/xfrm_state.c

ciq/ciq_backports/kernel-6.12.0-211.37.1.el10_2/1a303baa.failed

@@ -0,0 +1,63 @@
+ice: fix double-free of tx_buf skb
+
+jira KERNEL-1355
+cve CVE-2026-53009
+Rebuild_History Non-Buildable kernel-6.12.0-211.37.1.el10_2
+commit-author Michal Schmidt <mschmidt@redhat.com>
+commit 1a303baa715e6b78d6a406aaf335f87ff35acfcd
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-6.12.0-211.37.1.el10_2/1a303baa.failed
+
+If ice_tso() or ice_tx_csum() fail, the error path in
+ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points
+to it and is marked as valid (ICE_TX_BUF_SKB).
+'next_to_use' remains unchanged, so the potential problem will
+likely fix itself when the next packet is transmitted and the tx_buf
+gets overwritten. But if there is no next packet and the interface is
+brought down instead, ice_clean_tx_ring() -> ice_unmap_and_free_tx_buf()
+will find the tx_buf and free the skb for the second time.
+
+The fix is to reset the tx_buf type to ICE_TX_BUF_EMPTY in the error
+path, so that ice_unmap_and_free_tx_buf().
+Move the initialization of 'first' up, to ensure it's already valid in
+case we hit the linearization error path.
+
+The bug was spotted by AI while I had it looking for something else.
+It also proposed an initial version of the patch.
+
+I reproduced the bug and tested the fix by adding code to inject
+failures, on a build with KASAN.
+
+I looked for similar bugs in related Intel drivers and did not find any.
+
+Fixes: d76a60ba7afb ("ice: Add support for VLANs and offloads")
+Assisted-by: Claude:claude-4.6-opus-high Cursor
+	Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
+	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
+Link: https://patch.msgid.link/20260416-iwl-net-submission-2026-04-14-v2-4-686c33c9828d@intel.com
+	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+(cherry picked from commit 1a303baa715e6b78d6a406aaf335f87ff35acfcd)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	drivers/net/ethernet/intel/ice/ice_txrx.c
+diff --cc drivers/net/ethernet/intel/ice/ice_txrx.c
+index bcf476b66fbe,7be9c062949b..000000000000
+--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
++++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
+@@@ -2158,8 -2158,8 +2158,13 @@@ ice_xmit_frame_ring(struct sk_buff *skb
+
+  	ice_trace(xmit_frame_ring, tx_ring, skb);
+
+++<<<<<<< HEAD
+ +	if (unlikely(ipv6_hopopt_jumbo_remove(skb)))
+ +		goto out_drop;
+++=======
++ 	/* record the location of the first descriptor for this packet */
++ 	first = &tx_ring->tx_buf[tx_ring->next_to_use];
+++>>>>>>> 1a303baa715e (ice: fix double-free of tx_buf skb)
+
+  	count = ice_xmit_desc_count(skb);
+  	if (ice_chk_linearize(skb, count)) {
+* Unmerged path drivers/net/ethernet/intel/ice/ice_txrx.c

ciq/ciq_backports/kernel-6.12.0-211.37.1.el10_2/rebuild.details.txt

@@ -0,0 +1,22 @@
+Rebuild_History BUILDABLE
+Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
+Number of commits in upstream range v6.12~1..kernel-mainline: 138299
+Number of commits in rpm: 64
+Number of commits matched with upstream: 60 (93.75%)
+Number of commits in upstream but not in rpm: 138239
+Number of commits NOT found in upstream: 4 (6.25%)
+
+Rebuilding Kernel on Branch rocky10_2_rebuild_kernel-6.12.0-211.37.1.el10_2 for kernel-6.12.0-211.37.1.el10_2
+Clean Cherry Picks: 58 (96.67%)
+Empty Cherry Picks: 2 (3.33%)
+_______________________________
+
+__EMPTY COMMITS__________________________
+14acf9652e5690de3c7486c6db5fb8dafd0a32a3 xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
+1a303baa715e6b78d6a406aaf335f87ff35acfcd ice: fix double-free of tx_buf skb
+
+__CHANGES NOT IN UPSTREAM________________
+Add partial riscv64 support for build root'
+Provide basic VisionFive 2 support'
+can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
+redhat/configs: disable CONFIG_PT_RECLAIM