From 88c4dfe6d0b07111cad09ade908a3c2e1afe7f52 Mon Sep 17 00:00:00 2001
From: almalinux-bot-kernel <almalinux-bot-kernel@almalinux.org>
Date: Wed, 5 Aug 2026 05:08:31 +0000
Subject: [PATCH] Import of kernel-4.18.0-553.151.1.el8_10

---
 Makefile.rhelver             |  2 +-
 arch/s390/kvm/interrupt.c    | 13 ++++++++++++
 ipc/util.c                   |  2 +-
 kernel.sbat                  |  2 +-
 net/dns_resolver/dns_query.c | 39 +++++++++---------------------------
 5 files changed, 25 insertions(+), 33 deletions(-)

diff --git a/Makefile.rhelver b/Makefile.rhelver
index ae63dba4fb..0a99869cb2 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 10
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 553.150.1
+RHEL_RELEASE = 553.151.1
 
 #
 # ZSTREAM
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index 2cf20f22fd..629d2c4622 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -2778,6 +2778,9 @@ static unsigned long get_ind_bit(__u64 addr, unsigned long bit_nr, bool swap)
 
 	bit = bit_nr + (addr % PAGE_SIZE) * 8;
 
+	/* kvm_set_routing_entry() should never allow this to happen */
+	WARN_ON_ONCE(bit > (PAGE_SIZE * BITS_PER_BYTE - 1));
+
 	return swap ? (bit ^ (BITS_PER_LONG - 1)) : bit;
 }
 
@@ -2899,12 +2902,22 @@ int kvm_set_routing_entry(struct kvm *kvm,
 			  struct kvm_kernel_irq_routing_entry *e,
 			  const struct kvm_irq_routing_entry *ue)
 {
+	const struct kvm_irq_routing_s390_adapter *adapter;
 	u64 uaddr;
 
 	switch (ue->type) {
 	/* we store the userspace addresses instead of the guest addresses */
 	case KVM_IRQ_ROUTING_S390_ADAPTER:
 		e->set = set_adapter_int;
+
+		adapter = &ue->u.adapter;
+		if (adapter->summary_addr + (adapter->summary_offset / 8) >=
+		    (adapter->summary_addr & PAGE_MASK) + PAGE_SIZE)
+			return -EINVAL;
+		if (adapter->ind_addr + (adapter->ind_offset / 8) >=
+		    (adapter->ind_addr & PAGE_MASK) + PAGE_SIZE)
+			return -EINVAL;
+
 		uaddr =  gmap_translate(kvm->arch.gmap, ue->u.adapter.summary_addr);
 		if (uaddr == -EFAULT)
 			return -EFAULT;
diff --git a/ipc/util.c b/ipc/util.c
index a2423a8904..6396f7cac1 100644
--- a/ipc/util.c
+++ b/ipc/util.c
@@ -253,7 +253,7 @@ static inline int ipc_idr_alloc(struct ipc_ids *ids, struct kern_ipc_perm *new)
 	} else {
 		new->seq = ipcid_to_seqx(next_id);
 		idx = idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id),
-				0, GFP_NOWAIT);
+				ipc_mni, GFP_NOWAIT);
 	}
 	if (idx >= 0)
 		new->id = (new->seq << ipcmni_seq_shift()) + idx;
diff --git a/kernel.sbat b/kernel.sbat
index d046c197f8..6503ea8564 100644
--- a/kernel.sbat
+++ b/kernel.sbat
@@ -1,2 +1,2 @@
 sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
-kernel.centos,1,Red Hat,kernel-core,4.18.0-553.150.1.el8.x86_64,mailto:secalert@redhat.com
+kernel.centos,1,Red Hat,kernel-core,4.18.0-553.151.1.el8.x86_64,mailto:secalert@redhat.com
diff --git a/net/dns_resolver/dns_query.c b/net/dns_resolver/dns_query.c
index 49da67034f..b7e5826fce 100644
--- a/net/dns_resolver/dns_query.c
+++ b/net/dns_resolver/dns_query.c
@@ -71,49 +71,28 @@
 int dns_query(const char *type, const char *name, size_t namelen,
 	      const char *options, char **_result, time64_t *_expiry)
 {
-	struct key *rkey;
 	struct user_key_payload *upayload;
 	const struct cred *saved_cred;
-	size_t typelen, desclen;
-	char *desc, *cp;
+	struct key *rkey;
 	int ret, len;
+	char *desc;
 
 	kenter("%s,%*.*s,%zu,%s",
 	       type, (int)namelen, (int)namelen, name, namelen, options);
 
-	if (!name || namelen == 0)
+	if (!name || namelen < 1 || namelen > 255)
+		return -EINVAL;
+	if (type && *type == '\0')
 		return -EINVAL;
 
 	/* construct the query key description as "[<type>:]<name>" */
-	typelen = 0;
-	desclen = 0;
-	if (type) {
-		typelen = strlen(type);
-		if (typelen < 1)
-			return -EINVAL;
-		desclen += typelen + 1;
-	}
-
-	if (!namelen)
-		namelen = strnlen(name, 256);
-	if (namelen < 3 || namelen > 255)
-		return -EINVAL;
-	desclen += namelen + 1;
-
-	desc = kmalloc(desclen, GFP_KERNEL);
+	if (type)
+		desc = kasprintf(GFP_KERNEL, "%s:%.*s", type, (int)namelen, name);
+	else
+		desc = kmemdup_nul(name, namelen, GFP_KERNEL);
 	if (!desc)
 		return -ENOMEM;
 
-	cp = desc;
-	if (type) {
-		memcpy(cp, type, typelen);
-		cp += typelen;
-		*cp++ = ':';
-	}
-	memcpy(cp, name, namelen);
-	cp += namelen;
-	*cp = '\0';
-
 	if (!options)
 		options = "";
 	kdebug("call request_key(,%s,%s)", desc, options);