rpms/kernel
9
4
Fork 6
Code Issues Pull Requests Releases Activity

Recreate RHEL 6.12.0-211.34.1 from CS10/upstream backports

Browse Source 
Add the xfrm/esp single-frag length gate, the xfs data-fork resample fix
(CS10 MR 2912), and the crypto ccp IV copy fix (1456-1458).
This commit is contained in:
Andrew Lukoshko 2026-07-15 10:53:37 +00:00
parent 3dfb5d4267
commit 2fc0976aca
4 changed files with 229 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

61
1456-xfrm-esp-restore-combined-single-frag-length-gate.patch Normal file
View File

@ -0,0 +1,61 @@
From b84091ceddc9f133229dceab3ccc930bf27f9cba Mon Sep 17 00:00:00 2001
From: Jingguo Tan <tanjingguo@huawei.com>
Date: Mon, 18 May 2026 17:06:48 +0800
Subject: [PATCH] xfrm: esp: restore combined single-frag length gate
commit dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40 upstream.
The ESP out-of-place fast path appends the trailer in esp_output_head()
before esp_output_tail() allocates the destination page frag. The
head-side gate currently checks skb->data_len and tailen separately, but
the tail code allocates a single destination frag from the combined
post-trailer skb->data_len.
Reject the page-frag fast path when the combined aligned length exceeds a
page. Otherwise skb_page_frag_refill() may fall back to a single page while
the destination sg still spans the combined skb->data_len.
Restore this combined-length page gate for both IPv4 and IPv6.
Fixes: 5bd8baab087d ("esp: limit skb_page_frag_refill use to a single page")
Cc: stable@vger.kernel.org
Signed-off-by: Lin Ma <malin89@huawei.com>
Signed-off-by: Chenyuan Mi <michenyuan@huawei.com>
Signed-off-by: Jingguo Tan <tanjingguo@huawei.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 2f548900e238..6c8c789ded0e 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -419,8 +419,8 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
return err;
}
- if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE ||
- ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE)
+ if (ALIGN(skb->data_len + tailen, L1_CACHE_BYTES) >
+ PAGE_SIZE)
goto cow;
if (!skb_cloned(skb)) {
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index a797d5740d9b..80981596236a 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -448,8 +448,8 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
return err;
}
- if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE ||
- ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE)
+ if (ALIGN(skb->data_len + tailen, L1_CACHE_BYTES) >
+ PAGE_SIZE)
goto cow;
if (!skb_cloned(skb)) {
--
2.50.1 (Apple Git-155)

109
1457-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch Normal file
View File

@ -0,0 +1,109 @@
From d950b01691adb16980f23b10c7535b17ced653c7 Mon Sep 17 00:00:00 2001
From: Carlos Maiolino <cmaiolino@redhat.com>
Date: Fri, 10 Jul 2026 08:59:28 +0200
Subject: [PATCH] xfs: resample the data fork mapping after cycling ILOCK
JIRA: https://redhat.atlassian.net/browse/RHEL-193944
Upstream Status: git://git.kernel.org/pub/scm/fs/xfs/xfs-linux.git
commit 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7
Author: Darrick J. Wong <djwong@kernel.org>
xfs: resample the data fork mapping after cycling ILOCK
xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode,
a data fork mapping, and a cow fork mapping. Unfortunately, these two
helpers cycle the ILOCK to grab a transaction, which means that the
mappings are stale as soon as we reacquire the ILOCK. Currently we
refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but
we don't refresh the data fork mapping beforehand, which means that the
xfs_bmap_trim_cow in that function queries the refcount btree about the
wrong physical blocks and returns an inaccurate value in *shared.
If *shared is now false, the directio write proceeds with a stale data
fork mapping. Fix this by querying the data fork mapping if the
sequence counter changes across the ILOCK cycle.
Cc: hch@lst.de
Cc: stable@vger.kernel.org # v4.11
Fixes: 3c68d44a2b49a0 ("xfs: allocate direct I/O COW blocks in iomap_begin")
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Carlos Maiolino <cmaiolino@redhat.com>
---
fs/xfs/xfs_reflink.c | 36 ++++++++++++++++++++++++++++++++++++
1 file changed, 36 insertions(+)
diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c
index c077e2673676..05ec77b6561c 100644
--- a/fs/xfs/xfs_reflink.c
+++ b/fs/xfs/xfs_reflink.c
@@ -440,6 +440,7 @@ xfs_reflink_fill_cow_hole(
struct xfs_mount *mp = ip->i_mount;
struct xfs_trans *tp;
xfs_filblks_t resaligned;
+ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq);
unsigned int dblocks = 0, rblocks = 0;
int nimaps;
int error;
@@ -465,6 +466,22 @@ xfs_reflink_fill_cow_hole(
*lockmode = XFS_ILOCK_EXCL;
+ /*
+ * The data fork mapping may have changed while we dropped the ILOCK
+ * (a racing O_DIRECT writer under IOLOCK_SHARED can complete a full
+ * CoW cycle including xfs_reflink_end_cow(), which remaps this offset
+ * and drops the refcount of the old shared block). Re-read it so the
+ * shared-status recheck below and the caller's in-place iomap both
+ * operate on the current mapping rather than a stale physical block.
+ */
+ if (seq_before != READ_ONCE(ip->i_df.if_seq)) {
+ nimaps = 1;
+ error = xfs_bmapi_read(ip, imap->br_startoff,
+ imap->br_blockcount, imap, &nimaps, 0);
+ if (error)
+ goto out_trans_cancel;
+ }
+
error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, &found);
if (error || !*shared)
goto out_trans_cancel;
@@ -511,6 +528,8 @@ xfs_reflink_fill_delalloc(
bool found;
do {
+ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq);
+
xfs_iunlock(ip, *lockmode);
*lockmode = 0;
@@ -521,6 +540,23 @@ xfs_reflink_fill_delalloc(
*lockmode = XFS_ILOCK_EXCL;
+ /*
+ * The data fork mapping may have changed while we dropped the
+ * ILOCK (a racing O_DIRECT writer under IOLOCK_SHARED can
+ * complete a full CoW cycle including xfs_reflink_end_cow(),
+ * which remaps this offset and drops the refcount of the old
+ * shared block). Re-read it so the shared-status recheck
+ * below and the caller's in-place iomap both operate on the
+ * current mapping rather than a stale physical block.
+ */
+ if (seq_before != READ_ONCE(ip->i_df.if_seq)) {
+ nimaps = 1;
+ error = xfs_bmapi_read(ip, imap->br_startoff,
+ imap->br_blockcount, imap, &nimaps, 0);
+ if (error)
+ goto out_trans_cancel;
+ }
+
error = xfs_find_trim_cow_extent(ip, imap, cmap, shared,
&found);
if (error || !*shared)
--
GitLab

42
1458-crypto-ccp-copy-iv-using-skcipher-ivsize.patch Normal file
View File

@ -0,0 +1,42 @@
From bb01d8f1f385bc9034ca114d3508c7fdea24fc9a Mon Sep 17 00:00:00 2001
From: Paul Moses <p@1g4.org>
Date: Wed, 1 Apr 2026 03:07:49 -0500
Subject: [PATCH] crypto: ccp - copy IV using skcipher ivsize
[ Upstream commit a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4 ]
AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver.
ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV
buffer while RFC3686 skciphers expose an 8-byte IV, so the restore
overruns the provided buffer.
Use crypto_skcipher_ivsize() to copy only the algorithm's IV length.
Fixes: 2b789435d7f3 ("crypto: ccp - CCP AES crypto API support")
Signed-off-by: Paul Moses <p@1g4.org>
Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
diff --git a/drivers/crypto/ccp/ccp-crypto-aes.c b/drivers/crypto/ccp/ccp-crypto-aes.c
index d11daaf47f06..871886826cf0 100644
--- a/drivers/crypto/ccp/ccp-crypto-aes.c
+++ b/drivers/crypto/ccp/ccp-crypto-aes.c
@@ -29,8 +29,11 @@ static int ccp_aes_complete(struct crypto_async_request *async_req, int ret)
if (ret)
return ret;
- if (ctx->u.aes.mode != CCP_AES_MODE_ECB)
- memcpy(req->iv, rctx->iv, AES_BLOCK_SIZE);
+ if (ctx->u.aes.mode != CCP_AES_MODE_ECB) {
+ size_t ivsize = crypto_skcipher_ivsize(crypto_skcipher_reqtfm(req));
+
+ memcpy(req->iv, rctx->iv, ivsize);
+ }
return 0;
}
--
2.50.1 (Apple Git-155)

19
kernel.spec
View File

@ -176,13 +176,13 @@ Summary: The Linux kernel
%define specrpmversion 6.12.0
%define specversion 6.12.0
%define patchversion 6.12
%define pkgrelease 211.33.1
%define pkgrelease 211.34.1
%define kversion 6
%define tarfile_release 6.12.0-211.7.1.el10_2
# This is needed to do merge window version magic
%define patchlevel 12
# This allows pkg_release to have configurable %%{?dist} tag
%define specrelease 211.33.1%{?buildid}%{?dist}
%define specrelease 211.34.1%{?buildid}%{?dist}
# This defines the kabi tarball version
%define kabiversion 6.12.0-211.7.1.el10_2
@ -1482,6 +1482,9 @@ Patch1452: 1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patc
Patch1453: 1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch
Patch1454: 1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch
Patch1455: 1455-futex-requeue-revert-prevent-null-pointer-dereference.patch
Patch1456: 1456-xfrm-esp-restore-combined-single-frag-length-gate.patch
Patch1457: 1457-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch
Patch1458: 1458-crypto-ccp-copy-iv-using-skcipher-ivsize.patch
# END OF PATCH DEFINITIONS
%description
@ -2686,6 +2689,9 @@ ApplyPatch 1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patc
ApplyPatch 1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch
ApplyPatch 1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch
ApplyPatch 1455-futex-requeue-revert-prevent-null-pointer-dereference.patch
ApplyPatch 1456-xfrm-esp-restore-combined-single-frag-length-gate.patch
ApplyPatch 1457-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch
ApplyPatch 1458-crypto-ccp-copy-iv-using-skcipher-ivsize.patch
# END OF PATCH APPLICATIONS
# Any further pre-build tree manipulations happen here.
@ -5190,6 +5196,15 @@ fi\
#
#
%changelog
* Wed Jul 15 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.34.1
- Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458)
- RHEL changelog for 211.34.1 follows:
* Mon Jul 13 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.34.1.el10_2]
- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016}
- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945]
- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326]
* Mon Jul 13 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.33.1
- Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455)
- The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499