diff --git a/1456-xfrm-esp-restore-combined-single-frag-length-gate.patch b/1456-xfrm-esp-restore-combined-single-frag-length-gate.patch new file mode 100644 index 000000000..c89982551 --- /dev/null +++ b/1456-xfrm-esp-restore-combined-single-frag-length-gate.patch @@ -0,0 +1,61 @@ +From b84091ceddc9f133229dceab3ccc930bf27f9cba Mon Sep 17 00:00:00 2001 +From: Jingguo Tan +Date: Mon, 18 May 2026 17:06:48 +0800 +Subject: [PATCH] xfrm: esp: restore combined single-frag length gate + +commit dfa0d7b0ff1eb6b2c416b8fdb9b4f2cefba57a40 upstream. + +The ESP out-of-place fast path appends the trailer in esp_output_head() +before esp_output_tail() allocates the destination page frag. The +head-side gate currently checks skb->data_len and tailen separately, but +the tail code allocates a single destination frag from the combined +post-trailer skb->data_len. + +Reject the page-frag fast path when the combined aligned length exceeds a +page. Otherwise skb_page_frag_refill() may fall back to a single page while +the destination sg still spans the combined skb->data_len. + +Restore this combined-length page gate for both IPv4 and IPv6. + +Fixes: 5bd8baab087d ("esp: limit skb_page_frag_refill use to a single page") +Cc: stable@vger.kernel.org +Signed-off-by: Lin Ma +Signed-off-by: Chenyuan Mi +Signed-off-by: Jingguo Tan +Reviewed-by: Sabrina Dubroca +Signed-off-by: Steffen Klassert +Signed-off-by: Greg Kroah-Hartman + +diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c +index 2f548900e238..6c8c789ded0e 100644 +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -419,8 +419,8 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info * + return err; + } + +- if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE || +- ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE) ++ if (ALIGN(skb->data_len + tailen, L1_CACHE_BYTES) > ++ PAGE_SIZE) + goto cow; + + if (!skb_cloned(skb)) { +diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c +index a797d5740d9b..80981596236a 100644 +--- a/net/ipv6/esp6.c ++++ b/net/ipv6/esp6.c +@@ -448,8 +448,8 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info + return err; + } + +- if (ALIGN(tailen, L1_CACHE_BYTES) > PAGE_SIZE || +- ALIGN(skb->data_len, L1_CACHE_BYTES) > PAGE_SIZE) ++ if (ALIGN(skb->data_len + tailen, L1_CACHE_BYTES) > ++ PAGE_SIZE) + goto cow; + + if (!skb_cloned(skb)) { +-- +2.50.1 (Apple Git-155) + diff --git a/1457-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch b/1457-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch new file mode 100644 index 000000000..8603d44bc --- /dev/null +++ b/1457-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch @@ -0,0 +1,109 @@ +From d950b01691adb16980f23b10c7535b17ced653c7 Mon Sep 17 00:00:00 2001 +From: Carlos Maiolino +Date: Fri, 10 Jul 2026 08:59:28 +0200 +Subject: [PATCH] xfs: resample the data fork mapping after cycling ILOCK + +JIRA: https://redhat.atlassian.net/browse/RHEL-193944 +Upstream Status: git://git.kernel.org/pub/scm/fs/xfs/xfs-linux.git +commit 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7 +Author: Darrick J. Wong + + xfs: resample the data fork mapping after cycling ILOCK + + xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, + a data fork mapping, and a cow fork mapping. Unfortunately, these two + helpers cycle the ILOCK to grab a transaction, which means that the + mappings are stale as soon as we reacquire the ILOCK. Currently we + refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but + we don't refresh the data fork mapping beforehand, which means that the + xfs_bmap_trim_cow in that function queries the refcount btree about the + wrong physical blocks and returns an inaccurate value in *shared. + + If *shared is now false, the directio write proceeds with a stale data + fork mapping. Fix this by querying the data fork mapping if the + sequence counter changes across the ILOCK cycle. + + Cc: hch@lst.de + Cc: stable@vger.kernel.org # v4.11 + Fixes: 3c68d44a2b49a0 ("xfs: allocate direct I/O COW blocks in iomap_begin") + Signed-off-by: "Darrick J. Wong" + Reviewed-by: Christoph Hellwig + Reviewed-by: Carlos Maiolino + Signed-off-by: Carlos Maiolino + +Signed-off-by: Carlos Maiolino +--- + fs/xfs/xfs_reflink.c | 36 ++++++++++++++++++++++++++++++++++++ + 1 file changed, 36 insertions(+) + +diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c +index c077e2673676..05ec77b6561c 100644 +--- a/fs/xfs/xfs_reflink.c ++++ b/fs/xfs/xfs_reflink.c +@@ -440,6 +440,7 @@ xfs_reflink_fill_cow_hole( + struct xfs_mount *mp = ip->i_mount; + struct xfs_trans *tp; + xfs_filblks_t resaligned; ++ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq); + unsigned int dblocks = 0, rblocks = 0; + int nimaps; + int error; +@@ -465,6 +466,22 @@ xfs_reflink_fill_cow_hole( + + *lockmode = XFS_ILOCK_EXCL; + ++ /* ++ * The data fork mapping may have changed while we dropped the ILOCK ++ * (a racing O_DIRECT writer under IOLOCK_SHARED can complete a full ++ * CoW cycle including xfs_reflink_end_cow(), which remaps this offset ++ * and drops the refcount of the old shared block). Re-read it so the ++ * shared-status recheck below and the caller's in-place iomap both ++ * operate on the current mapping rather than a stale physical block. ++ */ ++ if (seq_before != READ_ONCE(ip->i_df.if_seq)) { ++ nimaps = 1; ++ error = xfs_bmapi_read(ip, imap->br_startoff, ++ imap->br_blockcount, imap, &nimaps, 0); ++ if (error) ++ goto out_trans_cancel; ++ } ++ + error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, &found); + if (error || !*shared) + goto out_trans_cancel; +@@ -511,6 +528,8 @@ xfs_reflink_fill_delalloc( + bool found; + + do { ++ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq); ++ + xfs_iunlock(ip, *lockmode); + *lockmode = 0; + +@@ -521,6 +540,23 @@ xfs_reflink_fill_delalloc( + + *lockmode = XFS_ILOCK_EXCL; + ++ /* ++ * The data fork mapping may have changed while we dropped the ++ * ILOCK (a racing O_DIRECT writer under IOLOCK_SHARED can ++ * complete a full CoW cycle including xfs_reflink_end_cow(), ++ * which remaps this offset and drops the refcount of the old ++ * shared block). Re-read it so the shared-status recheck ++ * below and the caller's in-place iomap both operate on the ++ * current mapping rather than a stale physical block. ++ */ ++ if (seq_before != READ_ONCE(ip->i_df.if_seq)) { ++ nimaps = 1; ++ error = xfs_bmapi_read(ip, imap->br_startoff, ++ imap->br_blockcount, imap, &nimaps, 0); ++ if (error) ++ goto out_trans_cancel; ++ } ++ + error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, + &found); + if (error || !*shared) +-- +GitLab + diff --git a/1458-crypto-ccp-copy-iv-using-skcipher-ivsize.patch b/1458-crypto-ccp-copy-iv-using-skcipher-ivsize.patch new file mode 100644 index 000000000..e873f1b3b --- /dev/null +++ b/1458-crypto-ccp-copy-iv-using-skcipher-ivsize.patch @@ -0,0 +1,42 @@ +From bb01d8f1f385bc9034ca114d3508c7fdea24fc9a Mon Sep 17 00:00:00 2001 +From: Paul Moses +Date: Wed, 1 Apr 2026 03:07:49 -0500 +Subject: [PATCH] crypto: ccp - copy IV using skcipher ivsize + +[ Upstream commit a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4 ] + +AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. + +ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV +buffer while RFC3686 skciphers expose an 8-byte IV, so the restore +overruns the provided buffer. + +Use crypto_skcipher_ivsize() to copy only the algorithm's IV length. + +Fixes: 2b789435d7f3 ("crypto: ccp - CCP AES crypto API support") +Signed-off-by: Paul Moses +Reviewed-by: Tom Lendacky +Signed-off-by: Herbert Xu +Signed-off-by: Sasha Levin + +diff --git a/drivers/crypto/ccp/ccp-crypto-aes.c b/drivers/crypto/ccp/ccp-crypto-aes.c +index d11daaf47f06..871886826cf0 100644 +--- a/drivers/crypto/ccp/ccp-crypto-aes.c ++++ b/drivers/crypto/ccp/ccp-crypto-aes.c +@@ -29,8 +29,11 @@ static int ccp_aes_complete(struct crypto_async_request *async_req, int ret) + if (ret) + return ret; + +- if (ctx->u.aes.mode != CCP_AES_MODE_ECB) +- memcpy(req->iv, rctx->iv, AES_BLOCK_SIZE); ++ if (ctx->u.aes.mode != CCP_AES_MODE_ECB) { ++ size_t ivsize = crypto_skcipher_ivsize(crypto_skcipher_reqtfm(req)); ++ ++ memcpy(req->iv, rctx->iv, ivsize); ++ } + + return 0; + } +-- +2.50.1 (Apple Git-155) + diff --git a/kernel.spec b/kernel.spec index a4a9106d2..6ecc9ca9d 100644 --- a/kernel.spec +++ b/kernel.spec @@ -176,13 +176,13 @@ Summary: The Linux kernel %define specrpmversion 6.12.0 %define specversion 6.12.0 %define patchversion 6.12 -%define pkgrelease 211.33.1 +%define pkgrelease 211.34.1 %define kversion 6 %define tarfile_release 6.12.0-211.7.1.el10_2 # This is needed to do merge window version magic %define patchlevel 12 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 211.33.1%{?buildid}%{?dist} +%define specrelease 211.34.1%{?buildid}%{?dist} # This defines the kabi tarball version %define kabiversion 6.12.0-211.7.1.el10_2 @@ -1482,6 +1482,9 @@ Patch1452: 1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patc Patch1453: 1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch Patch1454: 1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch Patch1455: 1455-futex-requeue-revert-prevent-null-pointer-dereference.patch +Patch1456: 1456-xfrm-esp-restore-combined-single-frag-length-gate.patch +Patch1457: 1457-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch +Patch1458: 1458-crypto-ccp-copy-iv-using-skcipher-ivsize.patch # END OF PATCH DEFINITIONS %description @@ -2686,6 +2689,9 @@ ApplyPatch 1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patc ApplyPatch 1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch ApplyPatch 1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch ApplyPatch 1455-futex-requeue-revert-prevent-null-pointer-dereference.patch +ApplyPatch 1456-xfrm-esp-restore-combined-single-frag-length-gate.patch +ApplyPatch 1457-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch +ApplyPatch 1458-crypto-ccp-copy-iv-using-skcipher-ivsize.patch # END OF PATCH APPLICATIONS # Any further pre-build tree manipulations happen here. @@ -5190,6 +5196,15 @@ fi\ # # %changelog +* Wed Jul 15 2026 Andrew Lukoshko - 6.12.0-211.34.1 +- Recreate RHEL 6.12.0-211.34.1 from CentOS Stream 10 and upstream stable backports (1456-1458) +- RHEL changelog for 211.34.1 follows: + +* Mon Jul 13 2026 CKI KWF Bot [6.12.0-211.34.1.el10_2] +- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188463] {CVE-2026-53016} +- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193945] +- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178326] + * Mon Jul 13 2026 Andrew Lukoshko - 6.12.0-211.33.1 - Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499