almalinux/kernel
14
1
Fork 0
Code Issues Pull Requests Releases Activity

Import of kernel-6.12.0-211.46.1.el10_2

Browse Source
This commit is contained in:
almalinux-bot-kernel 2026-08-14 04:40:50 +00:00
parent afc717d8bf
commit 55d3eb33dc
27 changed files with 354 additions and 139 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

0
COPYING-6.12.0-211.44.1.el10 → COPYING-6.12.0-211.46.1.el10
View File

2
Makefile.rhelver
View File

@ -12,7 +12,7 @@ RHEL_MINOR = 2
#
# Use this spot to avoid future merge conflicts.
# Do not trim this comment.
RHEL_RELEASE = 211.44.1
RHEL_RELEASE = 211.46.1
#
# RHEL_REBASE_NUM

5
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
View File

@ -12220,6 +12220,11 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev,
}
if (dc_resource_is_dsc_encoding_supported(dc)) {
for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
dm_new_crtc_state = to_dm_crtc_state(new_crtc_state);
dm_new_crtc_state->mode_changed_independent_from_dsc = new_crtc_state->mode_changed;
}
for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) {
if (drm_atomic_crtc_needs_modeset(new_crtc_state)) {
ret = add_affected_mst_dsc_crtcs(state, crtc);

1
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h
View File

@ -962,6 +962,7 @@ struct dm_crtc_state {
bool freesync_vrr_info_changed;
bool mode_changed_independent_from_dsc;
bool dsc_force_changed;
bool vrr_supported;
struct mod_freesync_config freesync_config;

4
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c
View File

@ -1744,9 +1744,11 @@ int pre_validate_dsc(struct drm_atomic_state *state,
int ind = find_crtc_index_in_state_by_stream(state, stream);
if (ind >= 0) {
struct dm_crtc_state *dm_new_crtc_state = to_dm_crtc_state(state->crtcs[ind].new_state);
DRM_INFO_ONCE("%s:%d MST_DSC no mode changed for stream 0x%p\n",
__func__, __LINE__, stream);
state->crtcs[ind].new_state->mode_changed = 0;
dm_new_crtc_state->base.mode_changed = dm_new_crtc_state->mode_changed_independent_from_dsc;
}
}
}

13
drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
View File

@ -533,23 +533,16 @@ static void esw_update_vport_addr_list(struct mlx5_eswitch *esw,
struct mlx5_vport *vport, int list_type)
{
bool is_uc = list_type == MLX5_NVPRT_LIST_TYPE_UC;
u8 (*mac_list)[ETH_ALEN];
u8 (*mac_list)[ETH_ALEN] = NULL;
struct l2addr_node *node;
struct vport_addr *addr;
struct hlist_head *hash;
struct hlist_node *tmp;
int size;
int size = 0;
int err;
int hi;
int i;
size = is_uc ? MLX5_MAX_UC_PER_VPORT(esw->dev) :
MLX5_MAX_MC_PER_VPORT(esw->dev);
mac_list = kcalloc(size, ETH_ALEN, GFP_KERNEL);
if (!mac_list)
return;
hash = is_uc ? vport->uc_list : vport->mc_list;
for_each_l2hash_node(node, tmp, hash, hi) {
@ -561,7 +554,7 @@ static void esw_update_vport_addr_list(struct mlx5_eswitch *esw,
goto out;
err = mlx5_query_nic_vport_mac_list(esw->dev, vport->vport, list_type,
mac_list, &size);
&mac_list, &size);
if (err)
goto out;
esw_debug(esw->dev, "vport[%d] context update %s list size (%d)\n",

72
drivers/net/ethernet/mellanox/mlx5/core/vport.c
View File

@ -250,35 +250,63 @@ int mlx5_modify_nic_vport_mtu(struct mlx5_core_dev *mdev, u16 mtu)
}
EXPORT_SYMBOL_GPL(mlx5_modify_nic_vport_mtu);
static int mlx5_vport_max_mac_list_size(struct mlx5_core_dev *dev, u16 vport,
enum mlx5_list_type list_type)
{
void *query_ctx, *hca_caps;
int ret = 0;
if (!vport && !mlx5_core_is_ecpf(dev))
return list_type == MLX5_NVPRT_LIST_TYPE_UC ?
1 << MLX5_CAP_GEN(dev, log_max_current_uc_list) :
1 << MLX5_CAP_GEN(dev, log_max_current_mc_list);
query_ctx = kzalloc(MLX5_ST_SZ_BYTES(query_hca_cap_out), GFP_KERNEL);
if (!query_ctx)
return -ENOMEM;
ret = mlx5_vport_get_other_func_general_cap(dev, vport, query_ctx);
if (ret)
goto out;
hca_caps = MLX5_ADDR_OF(query_hca_cap_out, query_ctx, capability);
ret = list_type == MLX5_NVPRT_LIST_TYPE_UC ?
1 << MLX5_GET(cmd_hca_cap, hca_caps, log_max_current_uc_list) :
1 << MLX5_GET(cmd_hca_cap, hca_caps, log_max_current_mc_list);
out:
kfree(query_ctx);
return ret;
}
int mlx5_query_nic_vport_mac_list(struct mlx5_core_dev *dev,
u16 vport,
enum mlx5_list_type list_type,
u8 addr_list[][ETH_ALEN],
int *list_size)
u8 (**addr_list)[ETH_ALEN],
int *addr_list_size)
{
u32 in[MLX5_ST_SZ_DW(query_nic_vport_context_in)] = {0};
int allowed_list_size;
void *nic_vport_ctx;
int max_list_size;
int req_list_size;
int out_sz;
void *out;
int err;
int i;
req_list_size = *list_size;
if (!addr_list || !addr_list_size)
return -EINVAL;
max_list_size = list_type == MLX5_NVPRT_LIST_TYPE_UC ?
1 << MLX5_CAP_GEN(dev, log_max_current_uc_list) :
1 << MLX5_CAP_GEN(dev, log_max_current_mc_list);
*addr_list = NULL;
*addr_list_size = 0;
if (req_list_size > max_list_size) {
mlx5_core_warn(dev, "Requested list size (%d) > (%d) max_list_size\n",
req_list_size, max_list_size);
req_list_size = max_list_size;
}
max_list_size = mlx5_vport_max_mac_list_size(dev, vport, list_type);
if (max_list_size < 0)
return max_list_size;
out_sz = MLX5_ST_SZ_BYTES(query_nic_vport_context_out) +
req_list_size * MLX5_ST_SZ_BYTES(mac_address_layout);
max_list_size * MLX5_ST_SZ_BYTES(mac_address_layout);
out = kvzalloc(out_sz, GFP_KERNEL);
if (!out)
@ -297,16 +325,24 @@ int mlx5_query_nic_vport_mac_list(struct mlx5_core_dev *dev,
nic_vport_ctx = MLX5_ADDR_OF(query_nic_vport_context_out, out,
nic_vport_context);
req_list_size = MLX5_GET(nic_vport_context, nic_vport_ctx,
allowed_list_size);
allowed_list_size = MLX5_GET(nic_vport_context, nic_vport_ctx,
allowed_list_size);
if (!allowed_list_size)
goto out;
*list_size = req_list_size;
for (i = 0; i < req_list_size; i++) {
*addr_list = kcalloc(allowed_list_size, ETH_ALEN, GFP_KERNEL);
if (!*addr_list) {
err = -ENOMEM;
goto out;
}
for (i = 0; i < allowed_list_size; i++) {
u8 *mac_addr = MLX5_ADDR_OF(nic_vport_context,
nic_vport_ctx,
current_uc_mac_address[i]) + 2;
ether_addr_copy(addr_list[i], mac_addr);
ether_addr_copy((*addr_list)[i], mac_addr);
}
*addr_list_size = allowed_list_size;
out:
kvfree(out);
return err;

7
drivers/s390/crypto/pkey_api.c
View File

@ -332,6 +332,13 @@ static int pkey_ioctl_verifyprotk(struct pkey_verifyprotk __user *uvp)
if (copy_from_user(&kvp, uvp, sizeof(kvp)))
return -EFAULT;
if (kvp.protkey.len > sizeof(kvp.protkey.protkey)) {
PKEY_DBF_ERR("%s protkey length %u exceeds protkey buffer size\n",
__func__, kvp.protkey.len);
memzero_explicit(&kvp, sizeof(kvp));
return -EINVAL;
}
keytype = pkey_aes_bitsize_to_keytype(8 * kvp.protkey.len);
if (!keytype) {
PKEY_DBF_ERR("%s unknown/unsupported protkey length %u\n",

4
drivers/s390/crypto/pkey_pckmo.c
View File

@ -257,6 +257,10 @@ static int pckmo_key2protkey(const u8 *key, u32 keylen,
goto out;
break;
}
if (t->len > *protkeylen) {
rc = -EINVAL;
goto out;
}
memcpy(protkey, t->protkey, t->len);
*protkeylen = t->len;
*protkeytype = t->keytype;

50
fs/libfs.c
View File

@ -369,22 +369,22 @@ int simple_offset_empty(struct dentry *dentry)
* User space expects the directory offset value of the replaced
* (new) directory entry to be unchanged after a rename.
*
* Returns zero on success, a negative errno value on failure.
* Caller must have grabbed a slot for new_dentry in the maple_tree
* associated with new_dir, even if dentry is negative.
*/
int simple_offset_rename(struct inode *old_dir, struct dentry *old_dentry,
struct inode *new_dir, struct dentry *new_dentry)
void simple_offset_rename(struct inode *old_dir, struct dentry *old_dentry,
struct inode *new_dir, struct dentry *new_dentry)
{
struct offset_ctx *old_ctx = old_dir->i_op->get_offset_ctx(old_dir);
struct offset_ctx *new_ctx = new_dir->i_op->get_offset_ctx(new_dir);
long new_offset = dentry2offset(new_dentry);
simple_offset_remove(old_ctx, old_dentry);
if (WARN_ON(!new_offset))
return;
if (new_offset) {
offset_set(new_dentry, 0);
return simple_offset_replace(new_ctx, old_dentry, new_offset);
}
return simple_offset_add(new_ctx, old_dentry);
simple_offset_remove(old_ctx, old_dentry);
offset_set(new_dentry, 0);
WARN_ON(simple_offset_replace(new_ctx, old_dentry, new_offset));
}
/**
@ -411,31 +411,23 @@ int simple_offset_rename_exchange(struct inode *old_dir,
long new_index = dentry2offset(new_dentry);
int ret;
simple_offset_remove(old_ctx, old_dentry);
simple_offset_remove(new_ctx, new_dentry);
if (WARN_ON(!old_index || !new_index))
return -EINVAL;
ret = simple_offset_replace(new_ctx, old_dentry, new_index);
if (ret)
goto out_restore;
ret = mtree_store(&new_ctx->mt, new_index, old_dentry, GFP_KERNEL);
if (WARN_ON(ret))
return ret;
ret = simple_offset_replace(old_ctx, new_dentry, old_index);
if (ret) {
simple_offset_remove(new_ctx, old_dentry);
goto out_restore;
ret = mtree_store(&old_ctx->mt, old_index, new_dentry, GFP_KERNEL);
if (WARN_ON(ret)) {
mtree_store(&new_ctx->mt, new_index, new_dentry, GFP_KERNEL);
return ret;
}
ret = simple_rename_exchange(old_dir, old_dentry, new_dir, new_dentry);
if (ret) {
simple_offset_remove(new_ctx, old_dentry);
simple_offset_remove(old_ctx, new_dentry);
goto out_restore;
}
offset_set(old_dentry, new_index);
offset_set(new_dentry, old_index);
simple_rename_exchange(old_dir, old_dentry, new_dir, new_dentry);
return 0;
out_restore:
(void)simple_offset_replace(old_ctx, old_dentry, old_index);
(void)simple_offset_replace(new_ctx, new_dentry, new_index);
return ret;
}
/**

12
fs/notify/mark.c
View File

@ -138,8 +138,11 @@ static void fsnotify_get_sb_watched_objects(struct super_block *sb)
static void fsnotify_put_sb_watched_objects(struct super_block *sb)
{
if (atomic_long_dec_and_test(fsnotify_sb_watched_objects(sb)))
wake_up_var(fsnotify_sb_watched_objects(sb));
atomic_long_t *watched_objects = fsnotify_sb_watched_objects(sb);
/* the superblock can go away after this decrement */
if (atomic_long_dec_and_test(watched_objects))
wake_up_var(watched_objects);
}
static void fsnotify_get_inode_ref(struct inode *inode)
@ -150,8 +153,11 @@ static void fsnotify_get_inode_ref(struct inode *inode)
static void fsnotify_put_inode_ref(struct inode *inode)
{
fsnotify_put_sb_watched_objects(inode->i_sb);
/* read ->i_sb before the inode can go away */
struct super_block *sb = inode->i_sb;
iput(inode);
fsnotify_put_sb_watched_objects(sb);
}
/*

2
include/linux/fs.h
View File

@ -3522,7 +3522,7 @@ void simple_offset_init(struct offset_ctx *octx);
int simple_offset_add(struct offset_ctx *octx, struct dentry *dentry);
void simple_offset_remove(struct offset_ctx *octx, struct dentry *dentry);
int simple_offset_empty(struct dentry *dentry);
int simple_offset_rename(struct inode *old_dir, struct dentry *old_dentry,
void simple_offset_rename(struct inode *old_dir, struct dentry *old_dentry,
struct inode *new_dir, struct dentry *new_dentry);
int simple_offset_rename_exchange(struct inode *old_dir,
struct dentry *old_dentry,

11
include/linux/mempolicy.h
View File

@ -54,8 +54,15 @@ struct mempolicy {
nodemask_t cpuset_mems_allowed; /* relative to these nodes */
nodemask_t user_nodemask; /* nodemask passed by user */
} w;
RH_KABI_RESERVE(1)
RH_KABI_RESERVE(2)
RH_KABI_USE(1, 2, struct rcu_head rcu)
/*
* RH Note:
* Struct mempolicy is always dynamically allocated with the policy_cache
* in mpol_new(), __mpol_dup() and shared_policy_replace() of mm/memplicy.c.
* It is also not embedded in any other data structures. So it can be
* safely extended with RH_KABI_EXTEND() here.
*/
};
/*

4
include/linux/mlx5/vport.h
View File

@ -96,8 +96,8 @@ int mlx5_query_hca_vport_node_guid(struct mlx5_core_dev *dev,
int mlx5_query_nic_vport_mac_list(struct mlx5_core_dev *dev,
u16 vport,
enum mlx5_list_type list_type,
u8 addr_list[][ETH_ALEN],
int *list_size);
u8 (**mac_list)[ETH_ALEN],
int *mac_list_size);
int mlx5_modify_nic_vport_mac_list(struct mlx5_core_dev *dev,
enum mlx5_list_type list_type,
u8 addr_list[][ETH_ALEN],

2
ipc/util.c
View File

@ -253,7 +253,7 @@ static inline int ipc_idr_alloc(struct ipc_ids *ids, struct kern_ipc_perm *new)
} else {
new->seq = ipcid_to_seqx(next_id);
idx = idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id),
0, GFP_NOWAIT);
ipc_mni, GFP_NOWAIT);
}
if (idx >= 0)
new->id = (new->seq << ipcmni_seq_shift()) + idx;

2
kernel.sbat
View File

@ -1,2 +1,2 @@
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
kernel.almalinux,1,AlmaLinux,kernel-core,6.12.0-211.44.1.el10.x86_64,mailto:security@almalinux.org
kernel.almalinux,1,AlmaLinux,kernel-core,6.12.0-211.46.1.el10.x86_64,mailto:security@almalinux.org

2
kernel/futex/core.c
View File

@ -342,7 +342,7 @@ static int __futex_key_to_node(struct mm_struct *mm, unsigned long addr)
if (!vma)
return FUTEX_NO_NODE;
mpol = vma_policy(vma);
mpol = READ_ONCE(vma->vm_policy);
if (!mpol)
return FUTEX_NO_NODE;

3
kernel/futex/pi.c
View File

@ -918,7 +918,7 @@ int fixup_pi_owner(u32 __user *uaddr, struct futex_q *q, int locked)
int futex_lock_pi(u32 __user *uaddr, unsigned int flags, ktime_t *time, int trylock)
{
struct hrtimer_sleeper timeout, *to;
struct task_struct *exiting = NULL;
struct task_struct *exiting;
struct rt_mutex_waiter rt_waiter;
struct futex_q q = futex_q_init;
DEFINE_WAKE_Q(wake_q);
@ -933,6 +933,7 @@ int futex_lock_pi(u32 __user *uaddr, unsigned int flags, ktime_t *time, int tryl
to = futex_setup_timer(time, &timeout, flags, 0);
retry:
exiting = NULL;
ret = get_futex_key(uaddr, flags, &q.key, FUTEX_WRITE);
if (unlikely(ret != 0))
goto out;

13
kernel/futex/requeue.c
View File

@ -319,8 +319,11 @@ futex_proxy_trylock_atomic(u32 __user *pifutex, struct futex_hash_bucket *hb1,
return -EINVAL;
/* Ensure that this does not race against an early wakeup */
if (!futex_requeue_pi_prepare(top_waiter, NULL))
if (!futex_requeue_pi_prepare(top_waiter, NULL)) {
plist_del(&top_waiter->list, &hb1->chain);
futex_hb_waiters_dec(hb1);
return -EAGAIN;
}
/*
* Try to take the lock for top_waiter and set the FUTEX_WAITERS bit
@ -722,10 +725,12 @@ int handle_early_requeue_pi_wakeup(struct futex_hash_bucket *hb,
/*
* We were woken prior to requeue by a timeout or a signal.
* Unqueue the futex_q and determine which it was.
* Conditionally unqueue the futex_q and determine which it was.
*/
plist_del(&q->list, &hb->chain);
futex_hb_waiters_dec(hb);
if (!plist_node_empty(&q->list)) {
plist_del(&q->list, &hb->chain);
futex_hb_waiters_dec(hb);
}
/* Handle spurious wakeups gracefully */
ret = -EWOULDBLOCK;

8
kernel/futex/syscalls.c
View File

@ -459,6 +459,14 @@ SYSCALL_DEFINE4(futex_requeue,
if (ret)
return ret;
/*
* For now mandate both flags are identical, like the sys_futex()
* interface has. If/when we merge the variable sized futex support,
* that patch can modify this test to allow a difference in size.
*/
if (futexes[0].w.flags != futexes[1].w.flags)
return -EINVAL;
cmpval = futexes[0].w.val;
return futex_requeue(u64_to_user_ptr(futexes[0].w.uaddr), futexes[0].w.flags,

10
mm/mempolicy.c
View File

@ -376,7 +376,13 @@ void __mpol_put(struct mempolicy *pol)
{
if (!atomic_dec_and_test(&pol->refcnt))
return;
kmem_cache_free(policy_cache, pol);
/*
* Required to allow mmap_lock_speculative*() access, see for example
* futex_key_to_node_opt(). All accesses are serialized by mmap_lock,
* however the speculative lock section unbound by the normal lock
* boundaries, requiring RCU freeing.
*/
kfree_rcu(pol, rcu);
}
static void mpol_rebind_default(struct mempolicy *pol, const nodemask_t *nodes)
@ -837,7 +843,7 @@ static int vma_replace_policy(struct vm_area_struct *vma,
}
old = vma->vm_policy;
vma->vm_policy = new; /* protected by mmap_lock */
WRITE_ONCE(vma->vm_policy, new); /* protected by mmap_lock */
mpol_put(old);
return 0;

24
mm/shmem.c
View File

@ -3794,6 +3794,7 @@ static int shmem_rename2(struct mnt_idmap *idmap,
{
struct inode *inode = d_inode(old_dentry);
int they_are_dirs = S_ISDIR(inode->i_mode);
bool had_offset = false;
int error;
if (flags & ~(RENAME_NOREPLACE | RENAME_EXCHANGE | RENAME_WHITEOUT))
@ -3806,16 +3807,23 @@ static int shmem_rename2(struct mnt_idmap *idmap,
if (!simple_offset_empty(new_dentry))
return -ENOTEMPTY;
if (flags & RENAME_WHITEOUT) {
error = shmem_whiteout(idmap, old_dir, old_dentry);
if (error)
return error;
}
error = simple_offset_rename(old_dir, old_dentry, new_dir, new_dentry);
if (error)
error = simple_offset_add(shmem_get_offset_ctx(new_dir), new_dentry);
if (error == -EBUSY)
had_offset = true;
else if (unlikely(error))
return error;
if (flags & RENAME_WHITEOUT) {
error = shmem_whiteout(idmap, old_dir, old_dentry);
if (error) {
if (!had_offset)
simple_offset_remove(shmem_get_offset_ctx(new_dir),
new_dentry);
return error;
}
}
simple_offset_rename(old_dir, old_dentry, new_dir, new_dentry);
if (d_really_is_positive(new_dentry)) {
(void) shmem_unlink(new_dir, new_dentry);
if (they_are_dirs) {

18
mm/slub.c
View File

@ -4109,15 +4109,17 @@ bool slab_post_alloc_hook(struct kmem_cache *s, struct list_lru *lru,
gfp_t init_flags = flags & gfp_allowed_mask;
/*
* For kmalloc object, the allocated memory size(object_size) is likely
* larger than the requested size(orig_size). If redzone check is
* enabled for the extra space, don't zero it, as it will be redzoned
* soon. The redzone operation for this extra space could be seen as a
* replacement of current poisoning under certain debug option, and
* won't break other sanity checks.
* For kmalloc object, the allocated size (object_size) can be larger
* than the requested size (orig_size). We however need to zero the
* whole object_size to handle possible later krealloc() with
*__GFP_ZERO properly.
*
* But if we keep track of the requested size, krealloc() uses that
* information. Additionally if red zoning is enabled, the extra space
* is also red zone, so we should not overwrite it. So limit zeroing to
* orig_size if we track it.
*/
if (kmem_cache_debug_flags(s, SLAB_STORE_USER | SLAB_RED_ZONE) &&
(s->flags & SLAB_KMALLOC))
if (slub_debug_orig_size(s))
zero_size = orig_size;
/*

201
net/openvswitch/flow_netlink.c
View File

@ -2533,13 +2533,56 @@ static inline int add_nested_action_start(struct sw_flow_actions **sfa,
return used;
}
static inline void add_nested_action_end(struct sw_flow_actions *sfa,
int st_offset)
static inline int add_nested_action_end(struct sw_flow_actions *sfa,
int st_offset)
{
struct nlattr *a = (struct nlattr *) ((unsigned char *)sfa->actions +
st_offset);
struct nlattr *a;
u32 attr_len;
a->nla_len = sfa->actions_len - st_offset;
if (WARN_ON_ONCE(st_offset < 0 ||
(u32)st_offset > sfa->actions_len))
return -EINVAL;
attr_len = sfa->actions_len - (u32)st_offset;
if (WARN_ON_ONCE(attr_len < NLA_HDRLEN))
return -EINVAL;
if (attr_len > U16_MAX)
return -EMSGSIZE;
a = (struct nlattr *)((u8 *)sfa->actions + st_offset);
a->nla_len = attr_len;
return 0;
}
/* Free the generated action-list tail at @start and truncate it.
* If @nested, @start points to its containing nlattr header.
*/
static void ovs_nla_trim(struct sw_flow_actions *sfa, int start, bool nested)
{
const struct nlattr *actions;
u32 len;
if (start < 0)
return;
if (WARN_ON_ONCE((u32)start > sfa->actions_len))
return;
actions = (const struct nlattr *)((u8 *)sfa->actions + start);
len = sfa->actions_len - (u32)start;
if (nested) {
if (len < NLA_HDRLEN)
goto out;
actions = (const struct nlattr *)((u8 *)actions + NLA_HDRLEN);
len -= NLA_HDRLEN;
}
ovs_nla_free_nested_actions(actions, len);
out:
sfa->actions_len = start;
}
static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
@ -2559,6 +2602,7 @@ static int validate_and_copy_sample(struct net *net, const struct nlattr *attr,
const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1];
const struct nlattr *probability, *actions;
const struct nlattr *a;
int actions_start;
int rem, start, err;
struct sample_arg arg;
@ -2602,18 +2646,27 @@ static int validate_and_copy_sample(struct net *net, const struct nlattr *attr,
err = ovs_nla_add_action(sfa, OVS_SAMPLE_ATTR_ARG, &arg, sizeof(arg),
log);
if (err)
return err;
goto err;
actions_start = (*sfa)->actions_len;
err = __ovs_nla_copy_actions(net, actions, key, sfa,
eth_type, vlan_tci, mpls_label_count, log,
depth + 1);
if (err)
return err;
goto err_free;
add_nested_action_end(*sfa, start);
err = add_nested_action_end(*sfa, start);
if (err)
goto err_free;
return 0;
err_free:
ovs_nla_trim(*sfa, actions_start, false);
err:
(*sfa)->actions_len = start;
return err;
}
static int validate_and_copy_dec_ttl(struct net *net,
@ -2661,18 +2714,31 @@ static int validate_and_copy_dec_ttl(struct net *net,
return start;
action_start = add_nested_action_start(sfa, OVS_DEC_TTL_ATTR_ACTION, log);
if (action_start < 0)
return action_start;
if (action_start < 0) {
err = action_start;
goto err;
}
err = __ovs_nla_copy_actions(net, actions, key, sfa, eth_type,
vlan_tci, mpls_label_count, log,
depth + 1);
if (err)
return err;
goto err_free;
add_nested_action_end(*sfa, action_start);
add_nested_action_end(*sfa, start);
err = add_nested_action_end(*sfa, action_start);
if (err)
goto err_free;
err = add_nested_action_end(*sfa, start);
if (err)
goto err_free;
return 0;
err_free:
ovs_nla_trim(*sfa, action_start, true);
err:
(*sfa)->actions_len = start;
return err;
}
static int validate_and_copy_clone(struct net *net,
@ -2683,6 +2749,7 @@ static int validate_and_copy_clone(struct net *net,
u32 mpls_label_count, bool log, bool last,
u32 depth)
{
int actions_start;
int start, err;
u32 exec;
@ -2698,17 +2765,26 @@ static int validate_and_copy_clone(struct net *net,
err = ovs_nla_add_action(sfa, OVS_CLONE_ATTR_EXEC, &exec,
sizeof(exec), log);
if (err)
return err;
goto err;
actions_start = (*sfa)->actions_len;
err = __ovs_nla_copy_actions(net, attr, key, sfa,
eth_type, vlan_tci, mpls_label_count, log,
depth + 1);
if (err)
return err;
goto err_free;
add_nested_action_end(*sfa, start);
err = add_nested_action_end(*sfa, start);
if (err)
goto err_free;
return 0;
err_free:
ovs_nla_trim(*sfa, actions_start, false);
err:
(*sfa)->actions_len = start;
return err;
}
void ovs_match_init(struct sw_flow_match *match,
@ -2800,20 +2876,20 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
tun_dst = metadata_dst_alloc(key.tun_opts_len, METADATA_IP_TUNNEL,
GFP_KERNEL);
if (!tun_dst)
return -ENOMEM;
if (!tun_dst) {
err = -ENOMEM;
goto err;
}
err = dst_cache_init(&tun_dst->u.tun_info.dst_cache, GFP_KERNEL);
if (err) {
dst_release((struct dst_entry *)tun_dst);
return err;
}
if (err)
goto err_free_tun_dst;
a = __add_action(sfa, OVS_KEY_ATTR_TUNNEL_INFO, NULL,
sizeof(*ovs_tun), log);
if (IS_ERR(a)) {
dst_release((struct dst_entry *)tun_dst);
return PTR_ERR(a);
err = PTR_ERR(a);
goto err_free_tun_dst;
}
ovs_tun = nla_data(a);
@ -2834,8 +2910,16 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
ip_tunnel_info_opts_set(tun_info,
TUN_METADATA_OPTS(&key, key.tun_opts_len),
key.tun_opts_len, dst_opt_type);
add_nested_action_end(*sfa, start);
err = add_nested_action_end(*sfa, start);
if (WARN_ON_ONCE(err))
goto err_free_tun_dst;
return 0;
err_free_tun_dst:
dst_release((struct dst_entry *)tun_dst);
err:
(*sfa)->actions_len = start;
return err;
}
@ -3010,7 +3094,7 @@ static int validate_set(const struct nlattr *a,
/* Convert non-masked non-tunnel set actions to masked set actions. */
if (!masked && key_type != OVS_KEY_ATTR_TUNNEL) {
int start, len = key_len * 2;
int err, start, len = key_len * 2;
struct nlattr *at;
*skip_copy = true;
@ -3022,8 +3106,11 @@ static int validate_set(const struct nlattr *a,
return start;
at = __add_action(sfa, key_type, NULL, len, log);
if (IS_ERR(at))
return PTR_ERR(at);
if (IS_ERR(at)) {
err = PTR_ERR(at);
(*sfa)->actions_len = start;
return err;
}
memcpy(nla_data(at), nla_data(ovs_key), key_len); /* Key. */
memset(nla_data(at) + key_len, 0xff, key_len); /* Mask. */
@ -3033,7 +3120,11 @@ static int validate_set(const struct nlattr *a,
mask->ipv6_label &= htonl(0x000FFFFF);
}
add_nested_action_end(*sfa, start);
err = add_nested_action_end(*sfa, start);
if (WARN_ON_ONCE(err)) {
(*sfa)->actions_len = start;
return err;
}
}
return 0;
@ -3079,7 +3170,8 @@ static int validate_and_copy_check_pkt_len(struct net *net,
const struct nlattr *acts_if_greater, *acts_if_lesser_eq;
struct nlattr *a[OVS_CHECK_PKT_LEN_ATTR_MAX + 1];
struct check_pkt_len_arg arg;
int nested_acts_start;
int greater_acts_start = -1;
int lesser_acts_start = -1;
int start, err;
err = nla_parse_deprecated_strict(a, OVS_CHECK_PKT_LEN_ATTR_MAX,
@ -3114,37 +3206,58 @@ static int validate_and_copy_check_pkt_len(struct net *net,
err = ovs_nla_add_action(sfa, OVS_CHECK_PKT_LEN_ATTR_ARG, &arg,
sizeof(arg), log);
if (err)
return err;
goto err_free;
nested_acts_start = add_nested_action_start(sfa,
OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL, log);
if (nested_acts_start < 0)
return nested_acts_start;
lesser_acts_start =
add_nested_action_start(sfa,
OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL,
log);
if (lesser_acts_start < 0) {
err = lesser_acts_start;
goto err_free;
}
err = __ovs_nla_copy_actions(net, acts_if_lesser_eq, key, sfa,
eth_type, vlan_tci, mpls_label_count, log,
depth + 1);
if (err)
return err;
goto err_free;
add_nested_action_end(*sfa, nested_acts_start);
err = add_nested_action_end(*sfa, lesser_acts_start);
if (err)
goto err_free;
nested_acts_start = add_nested_action_start(sfa,
OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER, log);
if (nested_acts_start < 0)
return nested_acts_start;
greater_acts_start =
add_nested_action_start(sfa,
OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER,
log);
if (greater_acts_start < 0) {
err = greater_acts_start;
goto err_free;
}
err = __ovs_nla_copy_actions(net, acts_if_greater, key, sfa,
eth_type, vlan_tci, mpls_label_count, log,
depth + 1);
if (err)
return err;
goto err_free;
add_nested_action_end(*sfa, nested_acts_start);
add_nested_action_end(*sfa, start);
err = add_nested_action_end(*sfa, greater_acts_start);
if (err)
goto err_free;
err = add_nested_action_end(*sfa, start);
if (err)
goto err_free;
return 0;
err_free:
ovs_nla_trim(*sfa, greater_acts_start, true);
ovs_nla_trim(*sfa, lesser_acts_start, true);
ovs_nla_trim(*sfa, start, false);
return err;
}
static int validate_psample(const struct nlattr *attr)

19
redhat/kernel.changelog-10.2
View File

@ -1,3 +1,22 @@
* Mon Aug 10 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.46.1.el10_2]
- mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223405] {CVE-2026-64368}
Resolves: RHEL-223405
* Fri Aug 07 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.45.1.el10_2]
- s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-222503]
- s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-222505]
- net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222499] {CVE-2026-64531}
- futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193528] {CVE-2026-52977}
- futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193528] {CVE-2026-31554}
- futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193528] {CVE-2026-31555}
- futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193528] {CVE-2026-23415}
- net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213035]
- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-193676] {CVE-2026-31488}
- shmem: fix recovery on rename failures (Rafael Aquini) [RHEL-189571] {CVE-2025-71072}
- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188217] {CVE-2026-52923}
- fsnotify: Fix ordering of iput() and watched_objects decrement (Jay Shin) [RHEL-175860] {CVE-2024-53143}
Resolves: RHEL-175860, RHEL-188217, RHEL-189571, RHEL-193528, RHEL-193676, RHEL-213035, RHEL-222499, RHEL-222503, RHEL-222505
* Tue Aug 04 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.44.1.el10_2]
- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-193134]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-193134]

2
uki-addons.sbat
View File

@ -1,2 +1,2 @@
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
kernel-uki-virt-addons.almalinux,1,AlmaLinux,kernel-uki-virt-addons,6.12.0-211.44.1.el10.x86_64,mailto:security@almalinux.org
kernel-uki-virt-addons.almalinux,1,AlmaLinux,kernel-uki-virt-addons,6.12.0-211.46.1.el10.x86_64,mailto:security@almalinux.org

2
uki.sbat
View File

@ -1,2 +1,2 @@
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
kernel-uki-virt.almalinux,1,AlmaLinux,kernel-uki-virt,6.12.0-211.44.1.el10.x86_64,mailto:security@almalinux.org
kernel-uki-virt.almalinux,1,AlmaLinux,kernel-uki-virt,6.12.0-211.46.1.el10.x86_64,mailto:security@almalinux.org