From e319e43f693541e7e24f354199982b4d60b81bfa Mon Sep 17 00:00:00 2001 From: Denys Vlasenko Date: Fri, 25 Aug 2023 17:25:10 +0200 Subject: [PATCH] kernel-rt-4.18.0-513.rt7.302.el8 * Fri Aug 25 2023 Denys Vlasenko [4.18.0-513.rt7.302.el8] - [rt] build kernel-rt-4.18.0-513.rt7.302.el8 [2180997] - redhat/configs: enable CONFIG_INET_DIAG_DESTROY (Andrea Claudi) [2230213] - net/sched: cls_u32: Fix reference counter leak leading to overflow (Davide Caratti) [2225202] {CVE-2023-3609} - cifs: fix bogus cifs_mount error handling in RHEL8 (Jeffrey Layton) [2215018] - KVM: nVMX: add missing consistency checks for CR0 and CR4 (Ricardo Robaina) [2190255] {CVE-2023-30456} - netfilter: snat: evict closing tcp entries on reply tuple collision (Florian Westphal) [2196717] - tun: avoid double free in tun_free_netdev (Jon Maloy) [2156366 2156371] {CVE-2022-4744} - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (Davide Caratti) [2225103] {CVE-2023-3776} - net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Davide Caratti) [2225196] {CVE-2023-3611} - net/sched: sch_qfq: reintroduce lmax bound check for MTU (Davide Caratti) [2225196] - net/sched: sch_qfq: refactor parsing of netlink parameters (Davide Caratti) [2225196] - net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2225512] {CVE-2023-4128} - net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2225512] {CVE-2023-4128} - net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2225512] {CVE-2023-4128} - scsi: lpfc: Remove reftag check in DIF paths (Paul Ely) [2229152] - scsi: lpfc: Modify when a node should be put in device recovery mode during RSCN (Paul Ely) [2229152] - scsi: lpfc: Make fabric zone discovery more robust when handling unsolicited LOGO (Paul Ely) [2229152] - scsi: lpfc: Set Establish Image Pair service parameter only for Target Functions (Paul Ely) [2229152] - scsi: lpfc: Revise ndlp kref handling for dev_loss_tmo_callbk and lpfc_drop_node (Paul Ely) [2229152] - scsi: lpfc: Qualify ndlp discovery state when processing RSCN (Paul Ely) [2229152] - gfs2: Fix freeze consistency check in gfs2_trans_add_meta (Andreas Gruenbacher) [2095340] - gfs2: gfs2_freeze_lock_shared cleanup (Andreas Gruenbacher) [2095340] - gfs2: Replace sd_freeze_state with SDF_FROZEN flag (Andreas Gruenbacher) [2095340] - gfs2: Rework freeze / thaw logic (Andreas Gruenbacher) [2095340] - gfs2: Rename SDF_{FS_FROZEN => FREEZE_INITIATOR} (Andreas Gruenbacher) [2095340] - gfs2: Reconfiguring frozen filesystem already rejected (Andreas Gruenbacher) [2095340] - gfs2: Rename gfs2_freeze_lock{ => _shared } (Andreas Gruenbacher) [2095340] - gfs2: Rename the {freeze,thaw}_super callbacks (Andreas Gruenbacher) [2095340] - gfs2: Rename remaining "transaction" glock references (Andreas Gruenbacher) [2095340] - gfs2: init system threads before freeze lock (Bob Peterson) [2095340] - net: mana: Use the correct WQE count for ringing RQ doorbell (Bandan Das) [2222573] - net: mana: Batch ringing RX queue doorbell on receiving packets (Bandan Das) [2222573] - net: mana: Add support for vlan tagging (Bandan Das) [2222573] - net: mana: Fix perf regression: remove rx_cqes, tx_cqes counters (Bandan Das) [2222573] - net: mana: Check if netdev/napi_alloc_frag returns single page (Bandan Das) [2222573] - net: mana: Rename mana_refill_rxoob and remove some empty lines (Bandan Das) [2222573] - net: mana: Add support for jumbo frame (Bandan Das) [2222573] - net: mana: Enable RX path to handle various MTU sizes (Bandan Das) [2222573] - net: mana: Refactor RX buffer allocation code to prepare for various MTU (Bandan Das) [2222573] - net: mana: Use napi_build_skb in RX path (Bandan Das) [2222573] - net: mana: Remove redundant pci_clear_master (Bandan Das) [2222573] - net: mana: Add new MANA VF performance counters for easier troubleshooting (Bandan Das) [2222573] - ice: Fix NULL pointer deref during VF reset (Petr Oros) [2227743] - x86/kasan: Populate shadow for shared chunk of the CPU entry area (Rafael Aquini) [2232451] - x86/kasan: Add helpers to align shadow addresses up and down (Rafael Aquini) [2232451] - x86/kasan: Rename local CPU_ENTRY_AREA variables to shorten names (Rafael Aquini) [2232451] - x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area (Rafael Aquini) [2232451] - x86/mm: Recompute physical address for every page of per-CPU CEA mapping (Rafael Aquini) [2232451] Resolves: rhbz#2180997, rhbz#2156371, rhbz#2190255, rhbz#2228717, rhbz#2225566, rhbz#2225652, rhbz#2225497 Signed-off-by: Denys Vlasenko --- kernel-rt-aarch64-debug.config | 2 +- kernel-rt-aarch64.config | 2 +- kernel-rt-ppc64le-debug.config | 2 +- kernel-rt-ppc64le.config | 2 +- kernel-rt-s390x-debug.config | 2 +- kernel-rt-s390x-zfcpdump.config | 2 +- kernel-rt-s390x.config | 2 +- kernel-rt-x86_64-debug.config | 2 +- kernel-rt-x86_64.config | 2 +- kernel.spec | 58 ++++++++++++++++++++++++++++++--- sources | 2 +- 11 files changed, 64 insertions(+), 14 deletions(-) diff --git a/kernel-rt-aarch64-debug.config b/kernel-rt-aarch64-debug.config index 36d1fa0..32c7106 100644 --- a/kernel-rt-aarch64-debug.config +++ b/kernel-rt-aarch64-debug.config @@ -811,7 +811,6 @@ # CONFIG_IMA_NG_TEMPLATE is not set # CONFIG_IMA_TEMPLATE is not set # CONFIG_INA2XX_ADC is not set -# CONFIG_INET_DIAG_DESTROY is not set # CONFIG_INFINIBAND_EXP_LEGACY_VERBS_NEW_UAPI is not set # CONFIG_INFINIBAND_HFI1 is not set # CONFIG_INFINIBAND_HNS is not set @@ -3598,6 +3597,7 @@ CONFIG_INET6_XFRM_MODE_TUNNEL=m CONFIG_INET=y CONFIG_INET_AH=m CONFIG_INET_DIAG=m +CONFIG_INET_DIAG_DESTROY=y CONFIG_INET_ESP=m CONFIG_INET_ESPINTCP=y CONFIG_INET_ESP_OFFLOAD=m diff --git a/kernel-rt-aarch64.config b/kernel-rt-aarch64.config index ebda4fc..c65bd1f 100644 --- a/kernel-rt-aarch64.config +++ b/kernel-rt-aarch64.config @@ -864,7 +864,6 @@ # CONFIG_IMA_NG_TEMPLATE is not set # CONFIG_IMA_TEMPLATE is not set # CONFIG_INA2XX_ADC is not set -# CONFIG_INET_DIAG_DESTROY is not set # CONFIG_INFINIBAND_EXP_LEGACY_VERBS_NEW_UAPI is not set # CONFIG_INFINIBAND_HFI1 is not set # CONFIG_INFINIBAND_HNS is not set @@ -3614,6 +3613,7 @@ CONFIG_INET6_XFRM_MODE_TUNNEL=m CONFIG_INET=y CONFIG_INET_AH=m CONFIG_INET_DIAG=m +CONFIG_INET_DIAG_DESTROY=y CONFIG_INET_ESP=m CONFIG_INET_ESPINTCP=y CONFIG_INET_ESP_OFFLOAD=m diff --git a/kernel-rt-ppc64le-debug.config b/kernel-rt-ppc64le-debug.config index 3d14f7c..7371b58 100644 --- a/kernel-rt-ppc64le-debug.config +++ b/kernel-rt-ppc64le-debug.config @@ -726,7 +726,6 @@ # CONFIG_IMA_NG_TEMPLATE is not set # CONFIG_IMA_TEMPLATE is not set # CONFIG_INA2XX_ADC is not set -# CONFIG_INET_DIAG_DESTROY is not set # CONFIG_INFINIBAND_EFA is not set # CONFIG_INFINIBAND_EXP_LEGACY_VERBS_NEW_UAPI is not set # CONFIG_INFINIBAND_HFI1 is not set @@ -3245,6 +3244,7 @@ CONFIG_INET6_XFRM_MODE_TUNNEL=m CONFIG_INET=y CONFIG_INET_AH=m CONFIG_INET_DIAG=m +CONFIG_INET_DIAG_DESTROY=y CONFIG_INET_ESP=m CONFIG_INET_ESPINTCP=y CONFIG_INET_ESP_OFFLOAD=m diff --git a/kernel-rt-ppc64le.config b/kernel-rt-ppc64le.config index fdc82c9..70f18bd 100644 --- a/kernel-rt-ppc64le.config +++ b/kernel-rt-ppc64le.config @@ -782,7 +782,6 @@ # CONFIG_IMA_NG_TEMPLATE is not set # CONFIG_IMA_TEMPLATE is not set # CONFIG_INA2XX_ADC is not set -# CONFIG_INET_DIAG_DESTROY is not set # CONFIG_INFINIBAND_EFA is not set # CONFIG_INFINIBAND_EXP_LEGACY_VERBS_NEW_UAPI is not set # CONFIG_INFINIBAND_HFI1 is not set @@ -3258,6 +3257,7 @@ CONFIG_INET6_XFRM_MODE_TUNNEL=m CONFIG_INET=y CONFIG_INET_AH=m CONFIG_INET_DIAG=m +CONFIG_INET_DIAG_DESTROY=y CONFIG_INET_ESP=m CONFIG_INET_ESPINTCP=y CONFIG_INET_ESP_OFFLOAD=m diff --git a/kernel-rt-s390x-debug.config b/kernel-rt-s390x-debug.config index 98b3fc8..6d2cafc 100644 --- a/kernel-rt-s390x-debug.config +++ b/kernel-rt-s390x-debug.config @@ -765,7 +765,6 @@ # CONFIG_IMA_NG_TEMPLATE is not set # CONFIG_IMA_TEMPLATE is not set # CONFIG_INA2XX_ADC is not set -# CONFIG_INET_DIAG_DESTROY is not set # CONFIG_INFINIBAND_BNXT_RE is not set # CONFIG_INFINIBAND_EFA is not set # CONFIG_INFINIBAND_EXP_LEGACY_VERBS_NEW_UAPI is not set @@ -3308,6 +3307,7 @@ CONFIG_INET6_XFRM_MODE_TUNNEL=m CONFIG_INET=y CONFIG_INET_AH=m CONFIG_INET_DIAG=m +CONFIG_INET_DIAG_DESTROY=y CONFIG_INET_ESP=m CONFIG_INET_ESPINTCP=y CONFIG_INET_ESP_OFFLOAD=m diff --git a/kernel-rt-s390x-zfcpdump.config b/kernel-rt-s390x-zfcpdump.config index b82f994..4a5a0a6 100644 --- a/kernel-rt-s390x-zfcpdump.config +++ b/kernel-rt-s390x-zfcpdump.config @@ -890,7 +890,6 @@ # CONFIG_IMA_TEMPLATE is not set # CONFIG_INA2XX_ADC is not set # CONFIG_INET is not set -# CONFIG_INET_DIAG_DESTROY is not set # CONFIG_INFINIBAND_BNXT_RE is not set # CONFIG_INFINIBAND_EFA is not set # CONFIG_INFINIBAND_EXP_LEGACY_VERBS_NEW_UAPI is not set @@ -3450,6 +3449,7 @@ CONFIG_INET6_XFRM_MODE_TRANSPORT=m CONFIG_INET6_XFRM_MODE_TUNNEL=m CONFIG_INET_AH=m CONFIG_INET_DIAG=m +CONFIG_INET_DIAG_DESTROY=y CONFIG_INET_ESP=m CONFIG_INET_ESPINTCP=y CONFIG_INET_ESP_OFFLOAD=m diff --git a/kernel-rt-s390x.config b/kernel-rt-s390x.config index 8dfe545..b58d105 100644 --- a/kernel-rt-s390x.config +++ b/kernel-rt-s390x.config @@ -820,7 +820,6 @@ # CONFIG_IMA_NG_TEMPLATE is not set # CONFIG_IMA_TEMPLATE is not set # CONFIG_INA2XX_ADC is not set -# CONFIG_INET_DIAG_DESTROY is not set # CONFIG_INFINIBAND_BNXT_RE is not set # CONFIG_INFINIBAND_EFA is not set # CONFIG_INFINIBAND_EXP_LEGACY_VERBS_NEW_UAPI is not set @@ -3323,6 +3322,7 @@ CONFIG_INET6_XFRM_MODE_TUNNEL=m CONFIG_INET=y CONFIG_INET_AH=m CONFIG_INET_DIAG=m +CONFIG_INET_DIAG_DESTROY=y CONFIG_INET_ESP=m CONFIG_INET_ESPINTCP=y CONFIG_INET_ESP_OFFLOAD=m diff --git a/kernel-rt-x86_64-debug.config b/kernel-rt-x86_64-debug.config index e658616..7bb6280 100644 --- a/kernel-rt-x86_64-debug.config +++ b/kernel-rt-x86_64-debug.config @@ -733,7 +733,6 @@ # CONFIG_IMA_NG_TEMPLATE is not set # CONFIG_IMA_TEMPLATE is not set # CONFIG_INA2XX_ADC is not set -# CONFIG_INET_DIAG_DESTROY is not set # CONFIG_INFINIBAND_EXP_LEGACY_VERBS_NEW_UAPI is not set # CONFIG_INFINIBAND_HNS is not set # CONFIG_INFINIBAND_HNS_HIP08 is not set @@ -3477,6 +3476,7 @@ CONFIG_INET6_XFRM_MODE_TUNNEL=m CONFIG_INET=y CONFIG_INET_AH=m CONFIG_INET_DIAG=m +CONFIG_INET_DIAG_DESTROY=y CONFIG_INET_ESP=m CONFIG_INET_ESPINTCP=y CONFIG_INET_ESP_OFFLOAD=m diff --git a/kernel-rt-x86_64.config b/kernel-rt-x86_64.config index bbab97b..7f40cb1 100644 --- a/kernel-rt-x86_64.config +++ b/kernel-rt-x86_64.config @@ -787,7 +787,6 @@ # CONFIG_IMA_NG_TEMPLATE is not set # CONFIG_IMA_TEMPLATE is not set # CONFIG_INA2XX_ADC is not set -# CONFIG_INET_DIAG_DESTROY is not set # CONFIG_INFINIBAND_EXP_LEGACY_VERBS_NEW_UAPI is not set # CONFIG_INFINIBAND_HNS is not set # CONFIG_INFINIBAND_HNS_HIP08 is not set @@ -3491,6 +3490,7 @@ CONFIG_INET6_XFRM_MODE_TUNNEL=m CONFIG_INET=y CONFIG_INET_AH=m CONFIG_INET_DIAG=m +CONFIG_INET_DIAG_DESTROY=y CONFIG_INET_ESP=m CONFIG_INET_ESPINTCP=y CONFIG_INET_ESP_OFFLOAD=m diff --git a/kernel.spec b/kernel.spec index ceff48f..30e982a 100644 --- a/kernel.spec +++ b/kernel.spec @@ -12,7 +12,7 @@ # change below to w4T.xzdio): %define _binary_payload w3T.xzdio -%global distro_build 512 +%global distro_build 513 # Sign the x86_64 kernel for secure boot authentication %ifarch x86_64 aarch64 s390x ppc64le @@ -38,10 +38,10 @@ # define buildid .local %define rpmversion 4.18.0 -%define pkgrelease 512.rt7.301.el8 +%define pkgrelease 513.rt7.302.el8 # allow pkg_release to have configurable %%{?dist} tag -%define specrelease 512.rt7.301%{?dist} +%define specrelease 513.rt7.302%{?dist} %define pkg_release %{specrelease}%{?buildid} @@ -147,7 +147,7 @@ # The preempt RT patch level %global rttag .rt7 # realtimeN -%global rtbuild .301 +%global rtbuild .302 %define with_doc 0 %define with_headers 0 %define with_cross_headers 0 @@ -2698,6 +2698,56 @@ fi # # %changelog +* Fri Aug 25 2023 Denys Vlasenko [4.18.0-513.rt7.302.el8] +- [rt] build kernel-rt-4.18.0-513.rt7.302.el8 [2180997] +- redhat/configs: enable CONFIG_INET_DIAG_DESTROY (Andrea Claudi) [2230213] +- net/sched: cls_u32: Fix reference counter leak leading to overflow (Davide Caratti) [2225202] {CVE-2023-3609} +- cifs: fix bogus cifs_mount error handling in RHEL8 (Jeffrey Layton) [2215018] +- KVM: nVMX: add missing consistency checks for CR0 and CR4 (Ricardo Robaina) [2190255] {CVE-2023-30456} +- netfilter: snat: evict closing tcp entries on reply tuple collision (Florian Westphal) [2196717] +- tun: avoid double free in tun_free_netdev (Jon Maloy) [2156366 2156371] {CVE-2022-4744} +- net/sched: cls_fw: Fix improper refcount update leads to use-after-free (Davide Caratti) [2225103] {CVE-2023-3776} +- net/sched: sch_qfq: account for stab overhead in qfq_enqueue (Davide Caratti) [2225196] {CVE-2023-3611} +- net/sched: sch_qfq: reintroduce lmax bound check for MTU (Davide Caratti) [2225196] +- net/sched: sch_qfq: refactor parsing of netlink parameters (Davide Caratti) [2225196] +- net/sched: cls_route: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2225512] {CVE-2023-4128} +- net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2225512] {CVE-2023-4128} +- net/sched: cls_u32: No longer copy tcf_result on update to avoid use-after-free (Davide Caratti) [2225512] {CVE-2023-4128} +- scsi: lpfc: Remove reftag check in DIF paths (Paul Ely) [2229152] +- scsi: lpfc: Modify when a node should be put in device recovery mode during RSCN (Paul Ely) [2229152] +- scsi: lpfc: Make fabric zone discovery more robust when handling unsolicited LOGO (Paul Ely) [2229152] +- scsi: lpfc: Set Establish Image Pair service parameter only for Target Functions (Paul Ely) [2229152] +- scsi: lpfc: Revise ndlp kref handling for dev_loss_tmo_callbk and lpfc_drop_node (Paul Ely) [2229152] +- scsi: lpfc: Qualify ndlp discovery state when processing RSCN (Paul Ely) [2229152] +- gfs2: Fix freeze consistency check in gfs2_trans_add_meta (Andreas Gruenbacher) [2095340] +- gfs2: gfs2_freeze_lock_shared cleanup (Andreas Gruenbacher) [2095340] +- gfs2: Replace sd_freeze_state with SDF_FROZEN flag (Andreas Gruenbacher) [2095340] +- gfs2: Rework freeze / thaw logic (Andreas Gruenbacher) [2095340] +- gfs2: Rename SDF_{FS_FROZEN => FREEZE_INITIATOR} (Andreas Gruenbacher) [2095340] +- gfs2: Reconfiguring frozen filesystem already rejected (Andreas Gruenbacher) [2095340] +- gfs2: Rename gfs2_freeze_lock{ => _shared } (Andreas Gruenbacher) [2095340] +- gfs2: Rename the {freeze,thaw}_super callbacks (Andreas Gruenbacher) [2095340] +- gfs2: Rename remaining "transaction" glock references (Andreas Gruenbacher) [2095340] +- gfs2: init system threads before freeze lock (Bob Peterson) [2095340] +- net: mana: Use the correct WQE count for ringing RQ doorbell (Bandan Das) [2222573] +- net: mana: Batch ringing RX queue doorbell on receiving packets (Bandan Das) [2222573] +- net: mana: Add support for vlan tagging (Bandan Das) [2222573] +- net: mana: Fix perf regression: remove rx_cqes, tx_cqes counters (Bandan Das) [2222573] +- net: mana: Check if netdev/napi_alloc_frag returns single page (Bandan Das) [2222573] +- net: mana: Rename mana_refill_rxoob and remove some empty lines (Bandan Das) [2222573] +- net: mana: Add support for jumbo frame (Bandan Das) [2222573] +- net: mana: Enable RX path to handle various MTU sizes (Bandan Das) [2222573] +- net: mana: Refactor RX buffer allocation code to prepare for various MTU (Bandan Das) [2222573] +- net: mana: Use napi_build_skb in RX path (Bandan Das) [2222573] +- net: mana: Remove redundant pci_clear_master (Bandan Das) [2222573] +- net: mana: Add new MANA VF performance counters for easier troubleshooting (Bandan Das) [2222573] +- ice: Fix NULL pointer deref during VF reset (Petr Oros) [2227743] +- x86/kasan: Populate shadow for shared chunk of the CPU entry area (Rafael Aquini) [2232451] +- x86/kasan: Add helpers to align shadow addresses up and down (Rafael Aquini) [2232451] +- x86/kasan: Rename local CPU_ENTRY_AREA variables to shorten names (Rafael Aquini) [2232451] +- x86/mm: Populate KASAN shadow for entire per-CPU range of CPU entry area (Rafael Aquini) [2232451] +- x86/mm: Recompute physical address for every page of per-CPU CEA mapping (Rafael Aquini) [2232451] + * Wed Aug 23 2023 Denys Vlasenko [4.18.0-512.rt7.301.el8] - [rt] build kernel-rt-4.18.0-512.rt7.301.el8 [2180997] - dm cache policy smq: ensure IO doesn't prevent cleaner policy progress (Benjamin Marzinski) [2227951] diff --git a/sources b/sources index 8cee97b..8625935 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (linux-4.18.0-512.rt7.301.el8.tar.xz) = 7df6a335181b0d53855f9cdfd34362cf3148a86431e9c40621519154474c4ee7738e3844338cc4b40b94f0407b3849594bdff633453010677052ad8e9c11219f +SHA512 (linux-4.18.0-513.rt7.302.el8.tar.xz) = 21b7e328aade75713d18a5a933ed61088e6ae4ab390e4aee3eeacb061488a7d3fed9b3ae4bcc530589e07f2ebf994af6c83520c0a0bf6d68024f38bcd665d366