Commit Graph

37 Commits

Author SHA1 Message Date
048f1efd0c CVE-2026-64561: KVM: x86: check for invalid/obsolete root after making MMU pages available
Taken verbatim from CentOS Stream 10 merge request 3068, which cherry-picks
upstream commit 2abd5287f083 ("KVM: x86: Check for invalid/obsolete root
*after* making MMU pages available") by Sean Christopherson and Paolo
Bonzini.

If reclaiming shadow pages zaps an in-use root, KVM would go on to map
memory into a root already marked invalid. Child shadow pages inherit
their parent's role, so any children created during the map/fetch land on
the list of active MMU pages while flagged invalid, breaking the invariant
introduced in 5.9 that invalid pages are never on that list. The fix moves
the is_page_fault_stale() check to after make_mmu_pages_available().

Applies with --fuzz=0 against arch/x86/kvm/mmu/{mmu.c,paging_tmpl.h}, no
fuzz and no offsets. Verified against the centos-stream-10 main branch: the
el10_2 z-stream tree this kernel is built from (6.12.0-211.38.1.el10_2) is
not published as a branch or tag, but both hunks sit in direct_page_fault()
and FNAME(page_fault)(), which are unchanged across 6.12 z-streams.

Note that MR 3068 is still a Draft upstream. If Red Hat revises it before
merge, this patch needs to be re-synced.

JIRA: RHEL-224013
2026-08-06 13:44:37 +02:00
5cbbe2cb09 gve: backport QPL page registration and max ring size support
Add two upstream commits for the Google gVNIC (gve) driver:

  07993df56091 gve: Update QPL page registration logic
  a2f19184014f gve: Enable reading max ring size from the device in
               DQO-QPL mode

Patches are taken as-is from rpms/kernel commit b4decc5e6c1b, where they
were already verified on the GCP branch. 07993df56091 needed a backport:
this 6.12 based kernel predates the split of gve_buffer_mgmt_dqo.c out
of gve_rx_dqo.c and the rename of the RX alloc cfg queue config field.
Those adjustments are documented in the patch header. a2f19184014f is
unchanged from upstream.

Both patches apply with --fuzz=0 on top of the AlmaLinux 10 kernel
6.12.0-211.38.1.el10_2 source, and the resulting driver builds clean,
including with W=1, against kernel-devel-6.12.0-211.38.1.el10_2.
2026-07-30 19:40:39 +02:00
AlmaLinux
6765ef77ef Sync with a10-beta 2026-07-17 12:27:09 +00:00
3972f069be Merge pull request 'fix(autopatch): Fixed three replace actions that broke when upstream added new Nvidia certs (SOURCE107/108), changed the SBAT suffix mec' (#10) from agent-fix/a10-20260717-115748 into a10
Reviewed-on: #10
2026-07-17 12:18:44 +00:00
root
8536ee9007 fix(autopatch): auto-fix for kernel on c10
Fixed three replace actions that broke when upstream added new Nvidia certs (SOURCE107/108), changed the SBAT suffix mechanism from shell variables to RPM macros, and already enabled Btrfs in several
2026-07-17 11:57:48 +00:00
eb74301905 Revert "crypto: algif_aead - Revert to operating out-of-place"
This reverts commit 46397f38a8.
2026-05-05 07:31:40 +00:00
475bb3fdbb Revert "CVE-2026-31431 (Copy Fail): backport crypto AEAD/algif fixes"
This reverts commit 8202b5cf93.
2026-05-05 07:31:37 +00:00
4e3eb5efbf Build kernel-doc and kABI stablelists on x86_64 instead of aarch64 2026-05-01 07:41:56 +02:00
8202b5cf93 CVE-2026-31431 (Copy Fail): backport crypto AEAD/algif fixes 2026-04-30 13:43:52 +02:00
46397f38a8 crypto: algif_aead - Revert to operating out-of-place 2026-04-29 23:49:28 +02:00
78d7e14a57 alsecureboot001 -> %{pesign_name_0} for UKI 2026-04-09 00:54:27 +00:00
771ae08d7f Replace pesign_name_0 with AlmaLinux secure boot cert name 2026-03-08 21:45:00 +00:00
170b7768c0 Update for 6.12.0-124.8.1.el10_1 2025-11-11 15:23:54 +00:00
eabdullin
ff8395c0fd Merge branch 'a10-beta' into a10 2025-11-11 10:50:59 +03:00
eabdullin
b2609bbb24 Add uki.sbat.template patching 2025-11-06 13:03:45 +00:00
eabdullin
24f47c4d3a Revert "Remove .git from kernel sources"
This reverts commit 0f2985ddd4.
2025-10-08 16:01:50 +03:00
0f2985ddd4 Remove .git from kernel sources 2025-08-26 09:49:59 +00:00
eabdullin
1b7fbfb24d Update config 2025-08-15 10:52:34 +03:00
eabdullin
2fdce1725b Remove automotive from v2 2025-08-12 18:33:15 +03:00
eabdullin
927acdd12a Remove automotive config 2025-08-12 18:19:49 +03:00
eabdullin
1a11d06cfe Add pre clean 2025-08-12 17:44:51 +03:00
d730699a10 Fix 0008-Bring-back-deprecated-pci-ids-to-megaraid_sas-driver.patch 2025-06-18 09:29:43 +00:00
3d5c3e4f6c Fix 0004-Bring-back-deprecated-pci-ids-to-qla2xxx-driver.patch 2025-06-18 09:07:40 +00:00
39106df464 Try again to remove # CONFIG_RAID6_PQ is not set 2025-05-30 21:55:48 +02:00
730020c194 Andrei -> Andrew 2025-05-30 21:47:39 +02:00
62829d6cbc Try again to remove # CONFIG_RAID6_PQ is not set 2025-05-30 21:44:48 +02:00
2705e57ce7 Fix applying config changes to kernel-s390x-zfcpdump-rhel.config 2025-05-30 21:22:56 +02:00
e53fa2bba7 Enable Btrfs support for all kernel variants 2025-05-30 21:15:06 +02:00
c902be2fd2 Add almalinuxnvidia1.x509 cert 2025-05-25 22:52:12 +02:00
966360efb3 Add almalinuxnvidia1.x509 cert 2025-05-24 17:08:21 +02:00
ba68066a0d Do not enable frame pointers 2025-05-19 22:16:50 +00:00
87a717bc5b Do not enable frame pointers 2025-05-19 22:16:24 +00:00
eabdullin
e22c589621 Update config 2025-02-06 10:58:55 +03:00
eabdullin
ec4f895e87 Update patch 2025-02-06 10:14:50 +03:00
eabdullin
7087e0feaf Use * for config files 2025-01-24 17:11:33 +03:00
eabdullin
f41c1533de add create_symlinks.sh and update config file 2025-01-24 16:10:33 +03:00
Sofia Boldyreva
345f6f450f Initial commit 2025-01-23 21:13:09 +01:00