Skip to content

[rocky8_10] History rebuild for kernel-4.18.0-553.69.1.el8_10 #515

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 61 commits into from
Aug 20, 2025
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
61 commits
Select commit Hold shift + click to select a range
4666111
fs: dlm: handle -EINVAL as log_error()
PlaidCat Jul 22, 2025
1649f6c
dlm: fix possible lkb_resource null dereference
PlaidCat Jul 22, 2025
88a1860
mm/swapfile: add cond_resched() in get_swap_pages()
PlaidCat Jul 22, 2025
d17eb91
net: ch9200: fix uninitialised access during mii_nway_restart
PlaidCat Jul 22, 2025
ed6a9a6
tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink().
PlaidCat Jul 22, 2025
3bb436b
Rebuild rocky8_10 with kernel-4.18.0-553.63.1.el8_10
PlaidCat Jul 22, 2025
9cacd51
workqueue: fix state-dump console deadlock
PlaidCat Jul 29, 2025
573cfcd
workqueue: Introduce show_one_worker_pool and show_one_workqueue.
PlaidCat Jul 29, 2025
9bee11f
workqueue: Make show_pwq() use run-length encoding
PlaidCat Jul 29, 2025
8efb5fd
wifi: iwlwifi: limit printed string from FW file
PlaidCat Jul 29, 2025
d40163a
ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftr…
PlaidCat Jul 29, 2025
994bcd0
NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN
PlaidCat Jul 29, 2025
f5c2b45
sched/fair: Fix potential memory corruption in child_cfs_rq_on_list
PlaidCat Jul 29, 2025
4e0e0ed
Rebuild rocky8_10 with kernel-4.18.0-553.64.1.el8_10
PlaidCat Jul 29, 2025
c9e3370
ext4: avoid resizing to a partial cluster size
PlaidCat Aug 16, 2025
bdf4b25
HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove()
PlaidCat Aug 16, 2025
26bb1e9
memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove
PlaidCat Aug 16, 2025
c61fad0
net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done
PlaidCat Aug 16, 2025
2330527
net: tipc: fix refcount warning in tipc_aead_encrypt
PlaidCat Aug 16, 2025
4b646bc
smb: client: fix warning in generic_ip_connect()
PlaidCat Aug 16, 2025
7ca0cff
smb: client: Fix use-after-free of network namespace.
PlaidCat Aug 16, 2025
70e0a62
smb: client: fix TCP timers deadlock after rmmod
PlaidCat Aug 16, 2025
d04b2fa
smb: client: Fix netns refcount imbalance causing leaks and use-after…
PlaidCat Aug 16, 2025
42f3ff4
Revert "smb: client: Fix netns refcount imbalance causing leaks and u…
PlaidCat Aug 16, 2025
e404b2b
Revert "smb: client: fix TCP timers deadlock after rmmod"
PlaidCat Aug 16, 2025
7bb9410
crypto: algif_hash - fix double free in hash_accept
PlaidCat Aug 16, 2025
49a9f54
sch_hfsc: make hfsc_qlen_notify() idempotent
PlaidCat Aug 16, 2025
309bd6b
net_sched: hfsc: Fix a UAF vulnerability in class with netem as child…
PlaidCat Aug 16, 2025
801f6ca
sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
PlaidCat Aug 16, 2025
09625df
net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
PlaidCat Aug 16, 2025
4216b54
Rebuild rocky8_10 with kernel-4.18.0-553.66.1.el8_10
PlaidCat Aug 16, 2025
1d26c18
ftrace: Clean up hash direct_functions on register failures
PlaidCat Aug 16, 2025
f9d7b21
padata: fix UAF in padata_reorder
PlaidCat Aug 16, 2025
8610af8
mm/khugepaged: unify collapse pmd clear, flush and free
PlaidCat Aug 16, 2025
85cc006
mm/khugepaged: take the right locks for page table retraction
PlaidCat Aug 16, 2025
289cd02
mm/khugepaged: fix GUP-fast interaction by sending IPI
PlaidCat Aug 16, 2025
5fb42ad
mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma
PlaidCat Aug 16, 2025
e2c95cd
mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race
PlaidCat Aug 16, 2025
55a8639
net/ipv6: release expired exception dst cached in socket
PlaidCat Aug 16, 2025
92f294c
wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds
PlaidCat Aug 16, 2025
62e9194
can: peak_usb: fix use after free bugs
PlaidCat Aug 16, 2025
094ccf9
md: also clone new io if io accounting is disabled
PlaidCat Aug 16, 2025
f01d90a
raid5: fix missing io accounting in raid5_align_endio()
PlaidCat Aug 16, 2025
08e7649
md/raid1: switch to use md_account_bio() for io accounting
PlaidCat Aug 16, 2025
4642e8d
md/raid10: switch to use md_account_bio() for io accounting
PlaidCat Aug 16, 2025
81a47b5
md/md-multipath: enable io accounting
PlaidCat Aug 16, 2025
1638d42
md/md-linear: enable io accounting
PlaidCat Aug 16, 2025
68718c1
md/raid5: recheck if reshape has finished with device_lock held
PlaidCat Aug 16, 2025
241e394
md/md-bitmap: factor behind write counters out from bitmap_{start/end…
PlaidCat Aug 16, 2025
0d1cad1
md/md-bitmap: remove the last parameter for bimtap_ops->endwrite()
PlaidCat Aug 16, 2025
6d86b3e
md: add a new callback pers->bitmap_sector()
PlaidCat Aug 16, 2025
0f88be8
md/raid5: implement pers->bitmap_sector()
PlaidCat Aug 16, 2025
a3f3232
md/md-bitmap: move bitmap_{start, end}write to md upper layer
PlaidCat Aug 16, 2025
16f8aaf
ipv6: mcast: extend RCU protection in igmp6_send()
PlaidCat Aug 16, 2025
08ce88f
net/sched: Always pass notifications when child class becomes empty
PlaidCat Aug 16, 2025
5c697e0
sch_htb: make htb_deactivate() idempotent
PlaidCat Aug 16, 2025
f8ac26e
codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
PlaidCat Aug 16, 2025
7d98586
sch_qfq: make qfq_qlen_notify() idempotent
PlaidCat Aug 16, 2025
17cf481
sch_drr: make drr_qlen_notify() idempotent
PlaidCat Aug 16, 2025
5e58551
sch_htb: make htb_qlen_notify() idempotent
PlaidCat Aug 16, 2025
98b6d02
Rebuild rocky8_10 with kernel-4.18.0-553.69.1.el8_10
PlaidCat Aug 16, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions Kconfig
Original file line number Diff line number Diff line change
Expand Up @@ -20,4 +20,10 @@ config RH_KABI_SIZE_ALIGN_CHECKS
This option enables more stringent kabi checks. Those must be disable
in case of a debug-build because they allow to change struct sizes.

config RH_KABI_STABLE_ASM_OFFSETS
bool "Enables asm-offsets.c constant stabilization"
default n
help
This option extends check-kabi to test a subset of asm-offsets.c
constants.

2 changes: 1 addition & 1 deletion Makefile.rhelver
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ RHEL_MINOR = 10
#
# Use this spot to avoid future merge conflicts.
# Do not trim this comment.
RHEL_RELEASE = 553.62.1
RHEL_RELEASE = 553.69.1

#
# ZSTREAM
Expand Down
20 changes: 14 additions & 6 deletions arch/x86/kernel/alternative.c
Original file line number Diff line number Diff line change
Expand Up @@ -801,9 +801,10 @@ __ro_after_init unsigned long poking_addr;

static void *__text_poke(void *addr, const void *opcode, size_t len)
{
bool cross_page_boundary = offset_in_page(addr) + len > PAGE_SIZE;
struct page *pages[2] = {NULL, NULL};
unsigned long flags;
char *vaddr;
struct page *pages[2];
int i;

/*
Expand All @@ -814,21 +815,28 @@ static void *__text_poke(void *addr, const void *opcode, size_t len)

if (!core_kernel_text((unsigned long)addr)) {
pages[0] = vmalloc_to_page(addr);
pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
if (cross_page_boundary)
pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
} else {
pages[0] = virt_to_page(addr);
WARN_ON(!PageReserved(pages[0]));
pages[1] = virt_to_page(addr + PAGE_SIZE);
if (cross_page_boundary)
pages[1] = virt_to_page(addr + PAGE_SIZE);
}
BUG_ON(!pages[0]);
/*
* If something went wrong, crash and burn since recovery paths are not
* implemented.
*/
BUG_ON(!pages[0] || (cross_page_boundary && !pages[1]));

local_irq_save(flags);
set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
if (pages[1])
if (cross_page_boundary)
set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
clear_fixmap(FIX_TEXT_POKE0);
if (pages[1])
if (cross_page_boundary)
clear_fixmap(FIX_TEXT_POKE1);
local_flush_tlb();
sync_core();
Expand Down
81 changes: 81 additions & 0 deletions ciq/ciq_backports/kernel-4.18.0-553.63.1.el8_10/9ac8ba46.failed
Original file line number Diff line number Diff line change
@@ -0,0 +1,81 @@
fs: dlm: handle -EINVAL as log_error()

jira LE-3629
Rebuild_History Non-Buildable kernel-4.18.0-553.63.1.el8_10
commit-author Alexander Aring <[email protected]>
commit 9ac8ba46a701b863be3f197d7eece4c635d0afe4
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-4.18.0-553.63.1.el8_10/9ac8ba46.failed

If the user generates -EINVAL it's probably because they are
using DLM incorrectly. Change the log level to make these
errors more visible.

Signed-off-by: Alexander Aring <[email protected]>
Signed-off-by: David Teigland <[email protected]>
(cherry picked from commit 9ac8ba46a701b863be3f197d7eece4c635d0afe4)
Signed-off-by: Jonathan Maple <[email protected]>

# Conflicts:
# fs/dlm/lock.c
diff --cc fs/dlm/lock.c
index 0733727c255c,354f79254d62..000000000000
--- a/fs/dlm/lock.c
+++ b/fs/dlm/lock.c
@@@ -2920,11 -2895,24 +2920,27 @@@ static int validate_lock_args(struct dl
lkb->lkb_lksb = args->lksb;
lkb->lkb_lvbptr = args->lksb->sb_lvbptr;
lkb->lkb_ownpid = (int) current->pid;
-#ifdef CONFIG_DLM_DEPRECATED_API
lkb->lkb_timeout_cs = args->timeout;
-#endif
rv = 0;
out:
++<<<<<<< HEAD
+ if (rv)
+ log_debug(ls, "validate_lock_args %d %x %x %x %d %d %s",
++=======
+ switch (rv) {
+ case 0:
+ break;
+ case -EINVAL:
+ /* annoy the user because dlm usage is wrong */
+ WARN_ON(1);
+ log_error(ls, "%s %d %x %x %x %d %d %s", __func__,
+ rv, lkb->lkb_id, lkb->lkb_flags, args->flags,
+ lkb->lkb_status, lkb->lkb_wait_type,
+ lkb->lkb_resource->res_name);
+ break;
+ default:
+ log_debug(ls, "%s %d %x %x %x %d %d %s", __func__,
++>>>>>>> 9ac8ba46a701 (fs: dlm: handle -EINVAL as log_error())
rv, lkb->lkb_id, lkb->lkb_flags, args->flags,
lkb->lkb_status, lkb->lkb_wait_type,
lkb->lkb_resource->res_name);
@@@ -3060,8 -3051,19 +3079,24 @@@ static int validate_unlock_args(struct
lkb->lkb_astparam = args->astparam;
rv = 0;
out:
++<<<<<<< HEAD
+ if (rv)
+ log_debug(ls, "validate_unlock_args %d %x %x %x %x %d %s", rv,
++=======
+ switch (rv) {
+ case 0:
+ break;
+ case -EINVAL:
+ /* annoy the user because dlm usage is wrong */
+ WARN_ON(1);
+ log_error(ls, "%s %d %x %x %x %x %d %s", __func__, rv,
+ lkb->lkb_id, lkb->lkb_flags, lkb->lkb_exflags,
+ args->flags, lkb->lkb_wait_type,
+ lkb->lkb_resource->res_name);
+ break;
+ default:
+ log_debug(ls, "%s %d %x %x %x %x %d %s", __func__, rv,
++>>>>>>> 9ac8ba46a701 (fs: dlm: handle -EINVAL as log_error())
lkb->lkb_id, lkb->lkb_flags, lkb->lkb_exflags,
args->flags, lkb->lkb_wait_type,
lkb->lkb_resource->res_name);
* Unmerged path fs/dlm/lock.c
74 changes: 74 additions & 0 deletions ciq/ciq_backports/kernel-4.18.0-553.63.1.el8_10/b98333c6.failed
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
dlm: fix possible lkb_resource null dereference

jira LE-3629
Rebuild_History Non-Buildable kernel-4.18.0-553.63.1.el8_10
commit-author Alexander Aring <[email protected]>
commit b98333c67daf887c724cd692e88e2db9418c0861
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-4.18.0-553.63.1.el8_10/b98333c6.failed

This patch fixes a possible null pointer dereference when this function is
called from request_lock() as lkb->lkb_resource is not assigned yet,
only after validate_lock_args() by calling attach_lkb(). Another issue
is that a resource name could be a non printable bytearray and we cannot
assume to be ASCII coded.

The log functionality is probably never being hit when DLM is used in
normal way and no debug logging is enabled. The null pointer dereference
can only occur on a new created lkb that does not have the resource
assigned yet, it probably never hits the null pointer dereference but we
should be sure that other changes might not change this behaviour and we
actually can hit the mentioned null pointer dereference.

In this patch we just drop the printout of the resource name, the lkb id
is enough to make a possible connection to a resource name if this
exists.

Signed-off-by: Alexander Aring <[email protected]>
Signed-off-by: David Teigland <[email protected]>
(cherry picked from commit b98333c67daf887c724cd692e88e2db9418c0861)
Signed-off-by: Jonathan Maple <[email protected]>

# Conflicts:
# fs/dlm/lock.c
diff --cc fs/dlm/lock.c
index 0733727c255c,dddedaef5e93..000000000000
--- a/fs/dlm/lock.c
+++ b/fs/dlm/lock.c
@@@ -2920,14 -2853,25 +2920,34 @@@ static int validate_lock_args(struct dl
lkb->lkb_lksb = args->lksb;
lkb->lkb_lvbptr = args->lksb->sb_lvbptr;
lkb->lkb_ownpid = (int) current->pid;
+ lkb->lkb_timeout_cs = args->timeout;
rv = 0;
out:
++<<<<<<< HEAD
+ if (rv)
+ log_debug(ls, "validate_lock_args %d %x %x %x %d %d %s",
+ rv, lkb->lkb_id, lkb->lkb_flags, args->flags,
+ lkb->lkb_status, lkb->lkb_wait_type,
+ lkb->lkb_resource->res_name);
++=======
+ switch (rv) {
+ case 0:
+ break;
+ case -EINVAL:
+ /* annoy the user because dlm usage is wrong */
+ WARN_ON(1);
+ log_error(ls, "%s %d %x %x %x %d %d", __func__,
+ rv, lkb->lkb_id, dlm_iflags_val(lkb), args->flags,
+ lkb->lkb_status, lkb->lkb_wait_type);
+ break;
+ default:
+ log_debug(ls, "%s %d %x %x %x %d %d", __func__,
+ rv, lkb->lkb_id, dlm_iflags_val(lkb), args->flags,
+ lkb->lkb_status, lkb->lkb_wait_type);
+ break;
+ }
+
++>>>>>>> b98333c67daf (dlm: fix possible lkb_resource null dereference)
return rv;
}

* Unmerged path fs/dlm/lock.c
Loading