[rocky8_10] History Rebuild through kernel-4.18.0-553.164.1.el8_10

Makefile.rhelver

@@ -12,7 +12,7 @@ RHEL_MINOR = 10
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 553.162.1
+RHEL_RELEASE = 553.164.1
 
 #
 # ZSTREAM

arch/x86/kvm/svm/svm.c

@@ -2149,12 +2149,13 @@ static int vmload_vmsave_interception(struct kvm_vcpu *vcpu, bool vmload)
 
 	ret = kvm_skip_emulated_instruction(vcpu);
 
+	/* KVM always performs VMLOAD/VMSAVE on VMCB01 (see __svm_vcpu_run()) */
 	if (vmload) {
-		svm_copy_vmloadsave_state(svm->vmcb, vmcb12);
+		svm_copy_vmloadsave_state(svm->vmcb01.ptr, vmcb12);
 		svm->sysenter_eip_hi = 0;
 		svm->sysenter_esp_hi = 0;
 	} else {
-		svm_copy_vmloadsave_state(vmcb12, svm->vmcb);
+		svm_copy_vmloadsave_state(vmcb12, svm->vmcb01.ptr);
 	}
 
 	kvm_vcpu_unmap(vcpu, &map, true);

block/blk-cgroup.c

@@ -123,18 +123,8 @@ static void blkg_free(struct blkcg_gq *blkg)
 static void __blkg_release(struct rcu_head *rcu)
 {
 	struct blkcg_gq *blkg = container_of(rcu, struct blkcg_gq, rcu_head);
-	struct blkcg *blkcg = blkg->blkcg;
-	int cpu;
 
 	WARN_ON(!bio_list_empty(&blkg->async_bios));
-	/*
-	 * Flush all the non-empty percpu lockless lists before releasing
-	 * us, given these stat belongs to us.
-	 *
-	 * blkg_stat_lock is for serializing blkg stat update
-	 */
-	for_each_possible_cpu(cpu)
-		__blkcg_rstat_flush(blkcg, cpu);
 
 	/* release the blkcg and parent blkg refs this blkg has been holding */
 	css_put(&blkg->blkcg->css);
@@ -154,6 +144,17 @@ static void __blkg_release(struct rcu_head *rcu)
 static void blkg_release(struct percpu_ref *ref)
 {
 	struct blkcg_gq *blkg = container_of(ref, struct blkcg_gq, refcnt);
+	struct blkcg *blkcg = blkg->blkcg;
+	int cpu;
+
+	/*
+	 * Flush all the non-empty percpu lockless lists before releasing
+	 * us, given these stat belongs to us.
+	 *
+	 * blkg_stat_lock is for serializing blkg stat update
+	 */
+	for_each_possible_cpu(cpu)
+		__blkcg_rstat_flush(blkcg, cpu);
 
 	call_rcu(&blkg->rcu_head, __blkg_release);
 }

ciq/ciq_backports/kernel-4.18.0-553.163.1.el8_10/ebf71dd4.failed

@@ -0,0 +1,113 @@
+net/rds: Restrict use of RDS/IB to the initial network namespace
+
+jira KERNEL-1605
+cve CVE-2026-68294
+Rebuild_History Non-Buildable kernel-4.18.0-553.163.1.el8_10
+Rebuild_CHGLOG: - net: qrtr: restrict socket creation to the initial network namespace (Jose Ignacio Tornos Martinez) [RHEL-239090] {CVE-2026-68294}
+Rebuild_FUZZ: 80.30%
+commit-author Greg Jumper <greg.jumper@oracle.com>
+commit ebf71dd4aff46e8e421d455db3e231ba43d2fa8a
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-4.18.0-553.163.1.el8_10/ebf71dd4.failed
+
+Prevent using RDS/IB in network namespaces other than the initial one.
+The existing RDS/IB code will not work properly in non-initial network
+namespaces.
+
+Fixes: d5a8ac28a7ff ("RDS-TCP: Make RDS-TCP work correctly when it is set up in a netns other than init_net")
+	Reported-by: syzbot+da8e060735ae02c8f3d1@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=da8e060735ae02c8f3d1
+	Signed-off-by: Greg Jumper <greg.jumper@oracle.com>
+	Signed-off-by: Allison Henderson <achender@kernel.org>
+Link: https://patch.msgid.link/20260408080420.540032-3-achender@kernel.org
+	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+(cherry picked from commit ebf71dd4aff46e8e421d455db3e231ba43d2fa8a)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	net/rds/af_rds.c
+#	net/rds/ib.c
+diff --cc net/rds/af_rds.c
+index ab751a150f70,76f625986a7f..000000000000
+--- a/net/rds/af_rds.c
++++ b/net/rds/af_rds.c
+@@@ -258,8 -357,8 +258,13 @@@ static int rds_cong_monitor(struct rds_
+  	return ret;
+  }
+
+++<<<<<<< HEAD
+ +static int rds_set_transport(struct rds_sock *rs, char __user *optval,
+ +			     int optlen)
+++=======
++ static int rds_set_transport(struct net *net, struct rds_sock *rs,
++ 			     sockptr_t optval, int optlen)
+++>>>>>>> ebf71dd4aff4 (net/rds: Restrict use of RDS/IB to the initial network namespace)
+  {
+  	int t_type;
+
+@@@ -329,9 -435,10 +338,10 @@@ static int rds_recv_track_latency(struc
+  }
+
+  static int rds_setsockopt(struct socket *sock, int level, int optname,
+ -			  sockptr_t optval, unsigned int optlen)
+ +			  char __user *optval, unsigned int optlen)
+  {
+  	struct rds_sock *rs = rds_sk_to_rs(sock->sk);
++ 	struct net *net = sock_net(sock->sk);
+  	int ret;
+
+  	if (level != SOL_RDS) {
+@@@ -360,12 -467,13 +370,12 @@@
+  		break;
+  	case SO_RDS_TRANSPORT:
+  		lock_sock(sock->sk);
+- 		ret = rds_set_transport(rs, optval, optlen);
++ 		ret = rds_set_transport(net, rs, optval, optlen);
+  		release_sock(sock->sk);
+  		break;
+ -	case SO_TIMESTAMP_OLD:
+ -	case SO_TIMESTAMP_NEW:
+ +	case SO_TIMESTAMP:
+  		lock_sock(sock->sk);
+ -		ret = rds_enable_recvtstamp(sock->sk, optval, optlen, optname);
+ +		ret = rds_enable_recvtstamp(sock->sk, optval, optlen);
+  		release_sock(sock->sk);
+  		break;
+  	case SO_RDS_MSG_RXPATH_LATENCY:
+diff --cc net/rds/ib.c
+index 45ae449ff7a1,39f87272e071..000000000000
+--- a/net/rds/ib.c
++++ b/net/rds/ib.c
+@@@ -373,6 -487,26 +373,29 @@@ static int rds_ib_laddr_check(struct ne
+  	return ret;
+  }
+
+++<<<<<<< HEAD
+++=======
++ static int rds_ib_laddr_check(struct net *net, const struct in6_addr *addr,
++ 			      __u32 scope_id)
++ {
++ 	struct rds_ib_device *rds_ibdev = NULL;
++ 
++ 	/* RDS/IB is restricted to the initial network namespace */
++ 	if (!net_eq(net, &init_net))
++ 		return -EPROTOTYPE;
++ 
++ 	if (ipv6_addr_v4mapped(addr)) {
++ 		rds_ibdev = rds_ib_get_device(addr->s6_addr32[3]);
++ 		if (rds_ibdev) {
++ 			rds_ib_dev_put(rds_ibdev);
++ 			return 0;
++ 		}
++ 	}
++ 
++ 	return rds_ib_laddr_check_cm(net, addr, scope_id);
++ }
++ 
+++>>>>>>> ebf71dd4aff4 (net/rds: Restrict use of RDS/IB to the initial network namespace)
+  static void rds_ib_unregister_client(void)
+  {
+  	ib_unregister_client(&rds_ib_client);
+* Unmerged path net/rds/af_rds.c
+* Unmerged path net/rds/ib.c

ciq/ciq_backports/kernel-4.18.0-553.163.1.el8_10/rebuild.details.txt

@@ -0,0 +1,27 @@
+Rebuild_History BUILDABLE
+Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
+Number of commits in upstream range v4.18~1..kernel-mainline: 625874
+Number of commits in rpm: 19
+Number of commits matched with upstream: 9 (47.37%)
+Number of commits in upstream but not in rpm: 625865
+Number of commits NOT found in upstream: 10 (52.63%)
+
+Rebuilding Kernel on Branch rocky8_10_rebuild_kernel-4.18.0-553.163.1.el8_10 for kernel-4.18.0-553.163.1.el8_10
+Clean Cherry Picks: 7 (77.78%)
+Empty Cherry Picks: 1 (11.11%)
+_______________________________
+
+__EMPTY COMMITS__________________________
+ebf71dd4aff46e8e421d455db3e231ba43d2fa8a net/rds: Restrict use of RDS/IB to the initial network namespace
+
+__CHANGES NOT IN UPSTREAM________________
+Adding prod certs and changed cert date to 20210620
+Adding Rocky secure boot certs
+Fixing vmlinuz removal
+Fixing UEFI CA path
+Porting to 8.10, debranding and Rocky branding
+Fixing pesign_key_name values
+scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
+dm-verity: fix buffer overflow in FEC calculation
+wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request
+net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove

ciq/ciq_backports/kernel-4.18.0-553.164.1.el8_10/1c428b03.failed

@@ -0,0 +1,190 @@
+xfrm: hold dev ref until after transport_finish NF_HOOK
+
+jira KERNEL-1623
+cve CVE-2026-31663
+Rebuild_History Non-Buildable kernel-4.18.0-553.164.1.el8_10
+commit-author Qi Tang <tpluszz77@gmail.com>
+commit 1c428b03840094410c5fb6a5db30640486bbbfcb
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-4.18.0-553.164.1.el8_10/1c428b03.failed
+
+After async crypto completes, xfrm_input_resume() calls dev_put()
+immediately on re-entry before the skb reaches transport_finish.
+The skb->dev pointer is then used inside NF_HOOK and its okfn,
+which can race with device teardown.
+
+Remove the dev_put from the async resumption entry and instead
+drop the reference after the NF_HOOK call in transport_finish,
+using a saved device pointer since NF_HOOK may consume the skb.
+This covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip
+the okfn.
+
+For non-transport exits (decaps, gro, drop) and secondary
+async return points, release the reference inline when
+async is set.
+
+	Suggested-by: Florian Westphal <fw@strlen.de>
+Fixes: acf568ee859f ("xfrm: Reinject transport-mode packets through tasklet")
+	Cc: stable@vger.kernel.org
+	Signed-off-by: Qi Tang <tpluszz77@gmail.com>
+	Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+(cherry picked from commit 1c428b03840094410c5fb6a5db30640486bbbfcb)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	net/ipv6/xfrm6_input.c
+#	net/xfrm/xfrm_input.c
+diff --cc net/ipv6/xfrm6_input.c
+index 086605fbec35,699a001ac166..000000000000
+--- a/net/ipv6/xfrm6_input.c
++++ b/net/ipv6/xfrm6_input.c
+@@@ -46,7 -43,8 +46,12 @@@ static int xfrm6_transport_finish2(stru
+  int xfrm6_transport_finish(struct sk_buff *skb, int async)
+  {
+  	struct xfrm_offload *xo = xfrm_offload(skb);
+++<<<<<<< HEAD
+ +	int nhlen = skb->data - skb_network_header(skb);
+++=======
++ 	struct net_device *dev = skb->dev;
++ 	int nhlen = -skb_network_offset(skb);
+++>>>>>>> 1c428b038400 (xfrm: hold dev ref until after transport_finish NF_HOOK)
+
+  	skb_network_header(skb)[IP6CB(skb)->nhoff] =
+  		XFRM_MODE_SKB_CB(skb)->protocol;
+diff --cc net/xfrm/xfrm_input.c
+index faefb4eb4d3e,f65291eba1f6..000000000000
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@@ -525,13 -506,11 +525,12 @@@ int xfrm_input(struct sk_buff *skb, in
+  		/* An encap_type of -1 indicates async resumption. */
+  		if (encap_type == -1) {
+  			async = 1;
+- 			dev_put(skb->dev);
+  			seq = XFRM_SKB_CB(skb)->seq.input.low;
+ -			spin_lock(&x->lock);
+  			goto resume;
+  		}
+ -		/* GRO call */
+ +
+ +		/* encap_type < -1 indicates a GRO call. */
+ +		encap_type = 0;
+  		seq = XFRM_SPI_SKB_CB(skb)->seq;
+
+  		if (xo && (xo->flags & CRYPTO_DONE)) {
+@@@ -669,13 -658,16 +668,16 @@@ lock
+  			dev_hold(skb->dev);
+
+  			nexthdr = x->type->input(x, skb);
+- 			if (nexthdr == -EINPROGRESS)
++ 			if (nexthdr == -EINPROGRESS) {
++ 				if (async)
++ 					dev_put(skb->dev);
+  				return 0;
++ 			}
+
+  			dev_put(skb->dev);
+ -			spin_lock(&x->lock);
+  		}
+  resume:
+ +		spin_lock(&x->lock);
+  		if (nexthdr < 0) {
+  			if (nexthdr == -EBADMSG) {
+  				xfrm_audit_state_icvfail(x, skb,
+@@@ -703,17 -696,12 +705,26 @@@
+
+  		XFRM_MODE_SKB_CB(skb)->protocol = nexthdr;
+
+++<<<<<<< HEAD
+ +		inner_mode = x->inner_mode;
+ +
+ +		if (x->sel.family == AF_UNSPEC) {
+ +			inner_mode = xfrm_ip2inner_mode(x, XFRM_MODE_SKB_CB(skb)->protocol);
+ +			if (inner_mode == NULL) {
+ +				XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR);
+ +				goto drop;
+ +			}
+ +		}
+ +
+ +		if (xfrm_inner_mode_input(x, inner_mode, skb)) {
+++=======
++ 		err = xfrm_inner_mode_input(x, skb);
++ 		if (err == -EINPROGRESS) {
++ 			if (async)
++ 				dev_put(skb->dev);
++ 			return 0;
++ 		} else if (err) {
+++>>>>>>> 1c428b038400 (xfrm: hold dev ref until after transport_finish NF_HOOK)
+  			XFRM_INC_STATS(net, LINUX_MIB_XFRMINSTATEMODEERROR);
+  			goto drop;
+  		}
+@@@ -742,12 -730,16 +753,22 @@@
+  	if (err)
+  		goto drop;
+
+ -	nf_reset_ct(skb);
+ +	nf_reset(skb);
+
+  	if (decaps) {
+++<<<<<<< HEAD
+ +		if (skb->sp)
+ +			skb->sp->olen = 0;
+ +		skb_dst_drop(skb);
+++=======
++ 		sp = skb_sec_path(skb);
++ 		if (sp)
++ 			sp->olen = 0;
++ 		if (skb_valid_dst(skb))
++ 			skb_dst_drop(skb);
++ 		if (async)
++ 			dev_put(skb->dev);
+++>>>>>>> 1c428b038400 (xfrm: hold dev ref until after transport_finish NF_HOOK)
+  		gro_cells_receive(&gro_cells, skb);
+  		return 0;
+  	} else {
+@@@ -762,9 -754,13 +783,19 @@@
+  			err = afinfo->transport_finish(skb, xfrm_gro || async);
+  		rcu_read_unlock();
+  		if (xfrm_gro) {
+++<<<<<<< HEAD
+ +			if (skb->sp)
+ +				skb->sp->olen = 0;
+ +			skb_dst_drop(skb);
+++=======
++ 			sp = skb_sec_path(skb);
++ 			if (sp)
++ 				sp->olen = 0;
++ 			if (skb_valid_dst(skb))
++ 				skb_dst_drop(skb);
++ 			if (async)
++ 				dev_put(skb->dev);
+++>>>>>>> 1c428b038400 (xfrm: hold dev ref until after transport_finish NF_HOOK)
+  			gro_cells_receive(&gro_cells, skb);
+  			return err;
+  		}
+diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
+index 3feda5ad2af4..39a9f7ff7e8a 100644
+--- a/net/ipv4/xfrm4_input.c
++++ b/net/ipv4/xfrm4_input.c
+@@ -53,6 +53,7 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async)
+ {
+ 	struct xfrm_offload *xo = xfrm_offload(skb);
+ 	struct iphdr *iph = ip_hdr(skb);
++	struct net_device *dev = skb->dev;
+
+ 	iph->protocol = XFRM_MODE_SKB_CB(skb)->protocol;
+
+@@ -72,8 +73,10 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async)
+ 	}
+
+ 	NF_HOOK(NFPROTO_IPV4, NF_INET_PRE_ROUTING,
+-		dev_net(skb->dev), NULL, skb, skb->dev, NULL,
++		dev_net(dev), NULL, skb, dev, NULL,
+ 		xfrm4_rcv_encap_finish);
++	if (async)
++		dev_put(dev);
+ 	return 0;
+ }
+
+* Unmerged path net/ipv6/xfrm6_input.c
+* Unmerged path net/xfrm/xfrm_input.c