rpms/kernel
8
2
Fork 6
Code Issues Pull Requests Releases Activity

kernel-6.12.0-89.el10

Browse Source 
* Thu May 22 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-89.el10]
- redhat: add downstream SBAT for UKI addons (Emanuele Giuseppe Esposito) [RHEL-92881]
- uki_addons: provide custom SBAT as input parameter (Emanuele Giuseppe Esposito) [RHEL-92881]
- uki_addons: remove completely sbat/sbat.conf (Emanuele Giuseppe Esposito) [RHEL-92881]
- redhat: create 'systemd-volatile-overlay' addon for UKI (Emanuele Giuseppe Esposito) [RHEL-92882]
- vfio/pci: Align huge faults to order (Alex Williamson) [RHEL-89852]
- cifs: Fix integer overflow while processing closetimeo mount option (CKI Backport Bot) [RHEL-87906] {CVE-2025-21962}
- scsi: iscsi: Fix missing scsi_host_put() in error path (Chris Leech) [RHEL-90551]
- scsi: qla4xxx: Constify 'struct bin_attribute' (Chris Leech) [RHEL-90551]
- scsi: qedi: Constify 'struct bin_attribute' (Chris Leech) [RHEL-90551]
- scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() (Chris Leech) [RHEL-90551]
- net: fix geneve_opt length integer overflow (CKI Backport Bot) [RHEL-87978] {CVE-2025-22055}
- tcp: drop secpath at the same time as we currently drop dst (Sabrina Dubroca) [RHEL-70101 RHEL-83227] {CVE-2025-21864}
Resolves: RHEL-70101, RHEL-83227, RHEL-87906, RHEL-87978, RHEL-89852, RHEL-90551, RHEL-92881, RHEL-92882

Signed-off-by: Julio Faracco <jfaracco@redhat.com>
This commit is contained in:
Julio Faracco 2025-05-23 01:02:28 -03:00
parent 5b0836cb92
commit 177b7eb267
6 changed files with 60 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Makefile.rhelver
View File

@ -12,7 +12,7 @@ RHEL_MINOR = 1
#
# Use this spot to avoid future merge conflicts.
# Do not trim this comment.
RHEL_RELEASE = 88
RHEL_RELEASE = 89
#
# RHEL_REBASE_NUM

15
kernel.changelog
View File

@ -1,3 +1,18 @@
* Thu May 22 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-89.el10]
- redhat: add downstream SBAT for UKI addons (Emanuele Giuseppe Esposito) [RHEL-92881]
- uki_addons: provide custom SBAT as input parameter (Emanuele Giuseppe Esposito) [RHEL-92881]
- uki_addons: remove completely sbat/sbat.conf (Emanuele Giuseppe Esposito) [RHEL-92881]
- redhat: create 'systemd-volatile-overlay' addon for UKI (Emanuele Giuseppe Esposito) [RHEL-92882]
- vfio/pci: Align huge faults to order (Alex Williamson) [RHEL-89852]
- cifs: Fix integer overflow while processing closetimeo mount option (CKI Backport Bot) [RHEL-87906] {CVE-2025-21962}
- scsi: iscsi: Fix missing scsi_host_put() in error path (Chris Leech) [RHEL-90551]
- scsi: qla4xxx: Constify 'struct bin_attribute' (Chris Leech) [RHEL-90551]
- scsi: qedi: Constify 'struct bin_attribute' (Chris Leech) [RHEL-90551]
- scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() (Chris Leech) [RHEL-90551]
- net: fix geneve_opt length integer overflow (CKI Backport Bot) [RHEL-87978] {CVE-2025-22055}
- tcp: drop secpath at the same time as we currently drop dst (Sabrina Dubroca) [RHEL-70101 RHEL-83227] {CVE-2025-21864}
Resolves: RHEL-70101, RHEL-83227, RHEL-87906, RHEL-87978, RHEL-89852, RHEL-90551, RHEL-92881, RHEL-92882
* Tue May 20 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-88.el10]
- s390/ism: add release function for struct device (Mete Durlu) [RHEL-73487] {CVE-2025-21856}
- s390/qeth: move netif_napi_add_tx() and napi_enable() from under BH (Mete Durlu) [RHEL-73487]

30
kernel.spec
View File

@ -162,15 +162,15 @@ Summary: The Linux kernel
%define specrpmversion 6.12.0
%define specversion 6.12.0
%define patchversion 6.12
%define pkgrelease 88
%define pkgrelease 89
%define kversion 6
%define tarfile_release 6.12.0-88.el10
%define tarfile_release 6.12.0-89.el10
# This is needed to do merge window version magic
%define patchlevel 12
# This allows pkg_release to have configurable %%{?dist} tag
%define specrelease 88%{?buildid}%{?dist}
%define specrelease 89%{?buildid}%{?dist}
# This defines the kabi tarball version
%define kabiversion 6.12.0-88.el10
%define kabiversion 6.12.0-89.el10
# If this variable is set to 1, a bpf selftests build failure will cause a
# fatal kernel package build error
@ -2699,6 +2699,12 @@ BuildKernel() {
EOF
)
ADDONS_SBAT=$(cat <<- EOF
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
kernel-uki-virt-addons.$SBATsuffix,1,Red Hat,kernel-uki-virt-addons,$KernelVer,mailto:secalert@redhat.com
EOF
)
KernelUnifiedImageDir="$RPM_BUILD_ROOT/lib/modules/$KernelVer"
KernelUnifiedImage="$KernelUnifiedImageDir/$InstallName-virt.efi"
@ -2720,7 +2726,7 @@ BuildKernel() {
KernelAddonsDirOut="$KernelUnifiedImage.extra.d"
mkdir -p $KernelAddonsDirOut
python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{primary_target} %{_target_cpu}
python3 %{SOURCE151} %{SOURCE152} $KernelAddonsDirOut virt %{primary_target} %{_target_cpu} "$ADDONS_SBAT"
%if %{signkernel}
%{log_msg "Sign the EFI UKI kernel"}
@ -4244,6 +4250,20 @@ fi\
#
#
%changelog
* Thu May 22 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-89.el10]
- redhat: add downstream SBAT for UKI addons (Emanuele Giuseppe Esposito) [RHEL-92881]
- uki_addons: provide custom SBAT as input parameter (Emanuele Giuseppe Esposito) [RHEL-92881]
- uki_addons: remove completely sbat/sbat.conf (Emanuele Giuseppe Esposito) [RHEL-92881]
- redhat: create 'systemd-volatile-overlay' addon for UKI (Emanuele Giuseppe Esposito) [RHEL-92882]
- vfio/pci: Align huge faults to order (Alex Williamson) [RHEL-89852]
- cifs: Fix integer overflow while processing closetimeo mount option (CKI Backport Bot) [RHEL-87906] {CVE-2025-21962}
- scsi: iscsi: Fix missing scsi_host_put() in error path (Chris Leech) [RHEL-90551]
- scsi: qla4xxx: Constify 'struct bin_attribute' (Chris Leech) [RHEL-90551]
- scsi: qedi: Constify 'struct bin_attribute' (Chris Leech) [RHEL-90551]
- scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() (Chris Leech) [RHEL-90551]
- net: fix geneve_opt length integer overflow (CKI Backport Bot) [RHEL-87978] {CVE-2025-22055}
- tcp: drop secpath at the same time as we currently drop dst (Sabrina Dubroca) [RHEL-70101 RHEL-83227] {CVE-2025-21864}
* Tue May 20 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-88.el10]
- s390/ism: add release function for struct device (Mete Durlu) [RHEL-73487] {CVE-2025-21856}
- s390/qeth: move netif_napi_add_tx() and napi_enable() from under BH (Mete Durlu) [RHEL-73487]

6
sources
View File

@ -1,5 +1,5 @@
SHA512 (kernel-abi-stablelists-6.6.0.tar.bz2) = 4f917598056dee5e23814621ec96ff2e4a411c8c4ba9d56ecb01b23cb96431825bedbecfcbaac9338efbf5cb21694d85497fa0bf43e7c80d9cd10bc6dd144dbd
SHA512 (kernel-kabi-dw-6.6.0.tar.bz2) = 19308cd976031d05e18ef7f5d093218acdb89446418bab0cd956ff12cf66369915b9e64bb66fa9f20939428a60e81884fec5be3529c6c7461738d6540d3cc5c6
SHA512 (linux-6.12.0-88.el10.tar.xz) = ea4bb16fdb065a0b517b4137ccc6b4e6ae7a8b83109886bde1afdfa61fc5260ddd1adbcb4329ec0ef50794a117e08b599e5573b6377f099b396bdc936eaeeed3
SHA512 (kernel-abi-stablelists-6.12.0-88.el10.tar.xz) = f687a39c4246d19baee4a3c0d876725527b141f629c820b4012376695cab474aed688f50342218cc4dae5517aefc0cb6c7509a2bb97b2afbaf12481911ea7ba0
SHA512 (kernel-kabi-dw-6.12.0-88.el10.tar.xz) = 60ebd251927400a2791c1844d03b746266ececf5424663b40ec83bd9b2495b3a5d3a56f00d41fc25757b9b6d5639406af26f1a104877c69785dbd17cc957484c
SHA512 (linux-6.12.0-89.el10.tar.xz) = 37d8c7222aa74e89a5c993ce1337f49b4240b93dcd75f5c686c681d96a41f7e2353d5988586b0cac1a1d7731695988822b7f42ed6263cb62263d8b4235976f4c
SHA512 (kernel-abi-stablelists-6.12.0-89.el10.tar.xz) = 66fec148b262530b9a5028493a73af965b8a640a834ca800beb8b9edd3fb10558467a4c9cec381d17abbf3d6619e525261467d68c75f686b942c6093a97378a5
SHA512 (kernel-kabi-dw-6.12.0-89.el10.tar.xz) = 60ebd251927400a2791c1844d03b746266ececf5424663b40ec83bd9b2495b3a5d3a56f00d41fc25757b9b6d5639406af26f1a104877c69785dbd17cc957484c

3
uki_addons.json
View File

@ -23,6 +23,9 @@
],
"debug.addon": [
"debug"
],
"systemd-volatile-overlay.addon": [
"systemd.volatile=overlay"
]
},
"virt": {

41
uki_create_addons.py
View File

@ -4,7 +4,7 @@
# creates an addon for each key/value pair matching the given uki, distro and
# arch provided in input.
#
# Usage: python uki_create_addons.py input_json out_dir uki distro arch
# Usage: python uki_create_addons.py input_json out_dir uki distro arch [sbat]
#
# This tool requires the systemd-ukify and systemd-boot packages.
#
@ -26,14 +26,6 @@
# json['virt']['common']['test.addon'] = ['test2'], any other uki except virt
# will have a test.addon.efi with text "test1", and virt will have a
# test.addon.efi with "test2"
#
# sbat.conf
#----------
# This dict is containing the sbat string for *all* addons being created.
# This dict is optional, but when used has to be put in a sub-dict with
# { 'sbat' : { 'sbat.conf' : ['your text here'] }}
# It follows the same syntax as the addon files, meaning '#' is comment and
# the rest is taken as sbat string and feed to ukify.
import os
import sys
@ -45,7 +37,7 @@ import subprocess
UKIFY_PATH = '/usr/lib/systemd/ukify'
def usage(err):
print(f'Usage: {os.path.basename(__file__)} input_json output_dir uki distro arch')
print(f'Usage: {os.path.basename(__file__)} input_json output_dir uki distro arch [sbat]')
print(f'Error:{err}')
sys.exit(1)
@ -62,9 +54,8 @@ def check_clean_arguments(input_json, out_dir):
UKICmdlineAddon = collections.namedtuple('UKICmdlineAddon', ['name', 'cmdline'])
uki_addons_list = []
uki_addons = {}
addon_sbat_string = None
def parse_lines(lines, rstrip=True):
def parse_lines(lines):
cmdline = ''
for l in lines:
l = l.lstrip()
@ -72,27 +63,17 @@ def parse_lines(lines, rstrip=True):
continue
if l[0] == '#':
continue
# rstrip is used only for addons cmdline, not sbat.conf, as it replaces
# return lines with spaces.
if rstrip:
l = l.rstrip() + ' '
cmdline += l
cmdline += l.rstrip() + ' '
if cmdline == '':
return ''
return cmdline
def parse_all_addons(in_obj):
global addon_sbat_string
for el in in_obj.keys():
# addon found: copy it in our global dict uki_addons
if el.endswith('.addon'):
uki_addons[el] = in_obj[el]
if 'sbat' in in_obj and 'sbat.conf' in in_obj['sbat']:
# sbat.conf found: override sbat with the most specific one found
addon_sbat_string = parse_lines(in_obj['sbat']['sbat.conf'], rstrip=False)
def recursively_find_addons(in_obj, folder_list):
# end of recursion, leaf directory. Search all addons here
if len(folder_list) == 0:
@ -121,21 +102,21 @@ def parse_in_json(in_json, uki_name, distro, arch):
if cmdline:
uki_addons_list.append(UKICmdlineAddon(addon_full_name, cmdline))
def create_addons(out_dir):
def create_addons(out_dir, sbat):
for uki_addon in uki_addons_list:
out_path = os.path.join(out_dir, uki_addon.name)
cmd = [
f'{UKIFY_PATH}', 'build',
'--cmdline', uki_addon.cmdline,
'--output', out_path]
if addon_sbat_string:
cmd.extend(['--sbat', addon_sbat_string.rstrip()])
if sbat:
cmd.extend(['--sbat', sbat.rstrip()])
subprocess.check_call(cmd, text=True)
if __name__ == "__main__":
argc = len(sys.argv) - 1
if argc != 5:
if argc < 5 or argc > 6:
usage('too few or too many parameters!')
input_json = sys.argv[1]
@ -144,8 +125,12 @@ if __name__ == "__main__":
distro = sys.argv[4]
arch = sys.argv[5]
custom_sbat = None
if argc == 6:
custom_sbat = sys.argv[6]
out_dir = check_clean_arguments(input_json, out_dir)
parse_in_json(input_json, uki_name, distro, arch)
create_addons(out_dir)
create_addons(out_dir, custom_sbat)