From ec9c42a864450be8c4deb3a199f3315412449999 Mon Sep 17 00:00:00 2001 From: eabdullin Date: Fri, 5 Sep 2025 14:56:56 +0000 Subject: [PATCH] Import of kernel-5.14.0-570.37.1.el9_6 --- ...-570.35.1.el9 => COPYING-5.14.0-570.37.1.el9 | 0 Makefile.rhelver | 2 +- .../gpu/drm/i915/display/intel_display_trace.h | 4 ++++ drivers/net/ethernet/intel/ice/ice_eswitch.c | 6 +++++- kernel/trace/ftrace.c | 5 ++--- net/ethtool/ioctl.c | 2 +- net/ipv4/udp.c | 16 +++++++--------- net/sched/sch_ets.c | 17 ++++++++++------- redhat/kernel.changelog-9.6 | 13 +++++++++++++ 9 files changed, 43 insertions(+), 22 deletions(-) rename COPYING-5.14.0-570.35.1.el9 => COPYING-5.14.0-570.37.1.el9 (100%) diff --git a/COPYING-5.14.0-570.35.1.el9 b/COPYING-5.14.0-570.37.1.el9 similarity index 100% rename from COPYING-5.14.0-570.35.1.el9 rename to COPYING-5.14.0-570.37.1.el9 diff --git a/Makefile.rhelver b/Makefile.rhelver index ae04818581..3640050bf8 100644 --- a/Makefile.rhelver +++ b/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 6 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 570.35.1 +RHEL_RELEASE = 570.37.1 # # ZSTREAM diff --git a/drivers/gpu/drm/i915/display/intel_display_trace.h b/drivers/gpu/drm/i915/display/intel_display_trace.h index fbd3f83df8..55d1893126 100644 --- a/drivers/gpu/drm/i915/display/intel_display_trace.h +++ b/drivers/gpu/drm/i915/display/intel_display_trace.h @@ -4,7 +4,11 @@ */ #undef TRACE_SYSTEM +#ifdef I915 #define TRACE_SYSTEM i915 +#else +#define TRACE_SYSTEM xe +#endif #if !defined(__INTEL_DISPLAY_TRACE_H__) || defined(TRACE_HEADER_MULTI_READ) #define __INTEL_DISPLAY_TRACE_H__ diff --git a/drivers/net/ethernet/intel/ice/ice_eswitch.c b/drivers/net/ethernet/intel/ice/ice_eswitch.c index d649c197cf..4c20188bf0 100644 --- a/drivers/net/ethernet/intel/ice/ice_eswitch.c +++ b/drivers/net/ethernet/intel/ice/ice_eswitch.c @@ -508,10 +508,14 @@ err_create_repr: */ int ice_eswitch_attach_vf(struct ice_pf *pf, struct ice_vf *vf) { - struct ice_repr *repr = ice_repr_create_vf(vf); struct devlink *devlink = priv_to_devlink(pf); + struct ice_repr *repr; int err; + if (!ice_is_eswitch_mode_switchdev(pf)) + return 0; + + repr = ice_repr_create_vf(vf); if (IS_ERR(repr)) return PTR_ERR(repr); diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 0eada1f52d..a8b9a44980 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -4579,7 +4579,7 @@ int ftrace_func_mapper_add_ip(struct ftrace_func_mapper *mapper, * @ip: The instruction pointer address to remove the data from * * Returns the data if it is found, otherwise NULL. - * Note, if the data pointer is used as the data itself, (see + * Note, if the data pointer is used as the data itself, (see * ftrace_func_mapper_find_ip(), then the return value may be meaningless, * if the data pointer was set to zero. */ @@ -5311,8 +5311,6 @@ int register_ftrace_direct(unsigned long ip, unsigned long addr) goto out_unlock; ret = ftrace_set_filter_ip(&direct_ops, ip, 0, 0); - if (ret) - remove_hash_entry(direct_functions, entry); if (!ret && !(direct_ops.flags & FTRACE_OPS_FL_ENABLED)) { ret = register_ftrace_function_nolock(&direct_ops); @@ -5321,6 +5319,7 @@ int register_ftrace_direct(unsigned long ip, unsigned long addr) } if (ret) { + remove_hash_entry(direct_functions, entry); kfree(entry); if (!direct->count) { list_del_rcu(&direct->next); diff --git a/net/ethtool/ioctl.c b/net/ethtool/ioctl.c index 65cfe76daf..c6020e744e 100644 --- a/net/ethtool/ioctl.c +++ b/net/ethtool/ioctl.c @@ -992,7 +992,7 @@ static noinline_for_stack int ethtool_set_rxnfc(struct net_device *dev, if (rc) return rc; - if (ops->get_rxfh) { + if (cmd == ETHTOOL_SRXFH && ops->get_rxfh) { struct ethtool_rxfh_param rxfh = {}; rc = ops->get_rxfh(dev, &rxfh); diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index a783cc8e33..e0ce6bf944 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1462,12 +1462,12 @@ static bool udp_skb_has_head_state(struct sk_buff *skb) } /* fully reclaim rmem/fwd memory allocated for skb */ -static void udp_rmem_release(struct sock *sk, int size, int partial, - bool rx_queue_lock_held) +static void udp_rmem_release(struct sock *sk, unsigned int size, + int partial, bool rx_queue_lock_held) { struct udp_sock *up = udp_sk(sk); struct sk_buff_head *sk_queue; - int amt; + unsigned int amt; if (likely(partial)) { up->forward_deficit += size; @@ -1487,10 +1487,8 @@ static void udp_rmem_release(struct sock *sk, int size, int partial, if (!rx_queue_lock_held) spin_lock(&sk_queue->lock); - - sk->sk_forward_alloc += size; - amt = (sk->sk_forward_alloc - partial) & ~(PAGE_SIZE - 1); - sk->sk_forward_alloc -= amt; + amt = (size + sk->sk_forward_alloc - partial) & ~(PAGE_SIZE - 1); + sk->sk_forward_alloc += (int)(size - amt); if (amt) __sk_mem_reduce_allocated(sk, amt >> PAGE_SHIFT); @@ -1675,7 +1673,7 @@ EXPORT_SYMBOL_GPL(skb_consume_udp); static struct sk_buff *__first_packet_length(struct sock *sk, struct sk_buff_head *rcvq, - int *total) + unsigned int *total) { struct sk_buff *skb; @@ -1708,8 +1706,8 @@ static int first_packet_length(struct sock *sk) { struct sk_buff_head *rcvq = &udp_sk(sk)->reader_queue; struct sk_buff_head *sk_queue = &sk->sk_receive_queue; + unsigned int total = 0; struct sk_buff *skb; - int total = 0; int res; spin_lock_bh(&rcvq->lock); diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c index f80bc05d4c..cc9baa719c 100644 --- a/net/sched/sch_ets.c +++ b/net/sched/sch_ets.c @@ -74,6 +74,11 @@ static const struct nla_policy ets_class_policy[TCA_ETS_MAX + 1] = { [TCA_ETS_QUANTA_BAND] = { .type = NLA_U32 }, }; +static bool cl_is_active(struct ets_class *cl) +{ + return !list_empty(&cl->alist); +} + static int ets_quantum_parse(struct Qdisc *sch, const struct nlattr *attr, unsigned int *quantum, struct netlink_ext_ack *extack) @@ -291,7 +296,7 @@ static void ets_class_qlen_notify(struct Qdisc *sch, unsigned long arg) * to remove them. */ if (!ets_class_is_strict(q, cl) && sch->q.qlen) - list_del(&cl->alist); + list_del_init(&cl->alist); } static int ets_class_dump(struct Qdisc *sch, unsigned long arg, @@ -414,7 +419,6 @@ static int ets_qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct ets_sched *q = qdisc_priv(sch); struct ets_class *cl; int err = 0; - bool first; cl = ets_classify(skb, sch, &err); if (!cl) { @@ -424,7 +428,6 @@ static int ets_qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch, return err; } - first = !cl->qdisc->q.qlen; err = qdisc_enqueue(skb, cl->qdisc, to_free); if (unlikely(err != NET_XMIT_SUCCESS)) { if (net_xmit_drop_count(err)) { @@ -434,7 +437,7 @@ static int ets_qdisc_enqueue(struct sk_buff *skb, struct Qdisc *sch, return err; } - if (first && !ets_class_is_strict(q, cl)) { + if (!cl_is_active(cl) && !ets_class_is_strict(q, cl)) { list_add_tail(&cl->alist, &q->active); cl->deficit = cl->quantum; } @@ -486,7 +489,7 @@ static struct sk_buff *ets_qdisc_dequeue(struct Qdisc *sch) if (unlikely(!skb)) goto out; if (cl->qdisc->q.qlen == 0) - list_del(&cl->alist); + list_del_init(&cl->alist); return ets_qdisc_dequeue_skb(sch, skb); } @@ -655,7 +658,7 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt, } for (i = q->nbands; i < oldbands; i++) { if (i >= q->nstrict && q->classes[i].qdisc->q.qlen) - list_del(&q->classes[i].alist); + list_del_init(&q->classes[i].alist); qdisc_tree_flush_backlog(q->classes[i].qdisc); } WRITE_ONCE(q->nstrict, nstrict); @@ -711,7 +714,7 @@ static void ets_qdisc_reset(struct Qdisc *sch) for (band = q->nstrict; band < q->nbands; band++) { if (q->classes[band].qdisc->q.qlen) - list_del(&q->classes[band].alist); + list_del_init(&q->classes[band].alist); } for (band = 0; band < q->nbands; band++) qdisc_reset(q->classes[band].qdisc); diff --git a/redhat/kernel.changelog-9.6 b/redhat/kernel.changelog-9.6 index d71fc66da4..3faa1d52ce 100644 --- a/redhat/kernel.changelog-9.6 +++ b/redhat/kernel.changelog-9.6 @@ -1,3 +1,16 @@ +* Sat Aug 16 2025 CKI KWF Bot [5.14.0-570.37.1.el9_6] +- ice: fix eswitch code memory leak in reset scenario (CKI Backport Bot) [RHEL-108152] {CVE-2025-38417} +- ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-105151] +- ethtool: Fix set RXNFC command with symmetric RSS hash (Mohammad Heib) [RHEL-103526] +- drm/i915: Give i915 and xe each their own display tracepoints (Jocelyn Falempe) [RHEL-94419] +Resolves: RHEL-103526, RHEL-105151, RHEL-108152, RHEL-94419 + +* Wed Aug 13 2025 CKI KWF Bot [5.14.0-570.36.1.el9_6] +- udp: Fix memory accounting leak. (Xin Long) [RHEL-104091] {CVE-2025-22058} +- net_sched: ets: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-104719] {CVE-2025-37914} +- sch_ets: make est_qlen_notify() idempotent (Ivan Vecera) [RHEL-104719] +Resolves: RHEL-104091, RHEL-104719 + * Sat Aug 09 2025 Patrick Talbert [5.14.0-570.35.1.el9_6] - s390/dasd: Remove DMA alignment (CKI Backport Bot) [RHEL-91593] - s390/cpumf: Update CPU Measurement facility extended counter set support (CKI Backport Bot) [RHEL-103066]