Recreate RHEL 6.12.0-211.33.1 from CS10/upstream backports
- Drop AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes (1445, 1446), superseded by RHEL's CVE-2026-43499 copies in 211.33.1 - Add RHEL 211.33.1 backports recreated from CS10/upstream (1451-1455), including the futex/requeue guard and its same-release revert (net zero, kept for changelog fidelity)
This commit is contained in:
parent
df2a0315c5
commit
3dfb5d4267
@ -1,86 +0,0 @@
|
||||
From 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 Mon Sep 17 00:00:00 2001
|
||||
From: Keenan Dong <keenanat2000@gmail.com>
|
||||
Date: Wed, 8 Apr 2026 16:46:00 +0800
|
||||
Subject: [PATCH] rtmutex: Use waiter::task instead of current in
|
||||
remove_waiter()
|
||||
|
||||
remove_waiter() is used by the slowlock paths, but it is also used for
|
||||
proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from
|
||||
futex_requeue().
|
||||
|
||||
In the latter case waiter::task is not current, but remove_waiter()
|
||||
operates on current for the dequeue operation. That results in several
|
||||
problems:
|
||||
|
||||
1) the rbtree dequeue happens without waiter::task::pi_lock being held
|
||||
|
||||
2) the waiter task's pi_blocked_on state is not cleared, which leaves a
|
||||
dangling pointer primed for UAF around.
|
||||
|
||||
3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter
|
||||
task
|
||||
|
||||
Use waiter::task instead of current in all related operations in
|
||||
remove_waiter() to cure those problems.
|
||||
|
||||
[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the
|
||||
changelog ]
|
||||
|
||||
Fixes: 8161239a8bcc ("rtmutex: Simplify PI algorithm and make highest prio task get lock")
|
||||
Reported-by: Yuan Tan <yuantan098@gmail.com>
|
||||
Reported-by: Yifan Wu <yifanwucs@gmail.com>
|
||||
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
|
||||
Reported-by: Xin Liu <bird@lzu.edu.cn>
|
||||
Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
|
||||
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
|
||||
Cc: stable@vger.kernel.org
|
||||
|
||||
(cherry picked from commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349)
|
||||
[AlmaLinux: adapted to a10 (6.12); context/line offsets only. scoped_guard(raw_spinlock, ...) is available in this tree (include/linux/cleanup.h + DEFINE_LOCK_GUARD_1 raw_spinlock in include/linux/spinlock.h), so the upstream form is used verbatim.]
|
||||
---
|
||||
kernel/locking/rtmutex.c | 13 ++++++++-----
|
||||
1 file changed, 8 insertions(+), 5 deletions(-)
|
||||
|
||||
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
|
||||
index 4a8df18..e6f305d 100644
|
||||
--- a/kernel/locking/rtmutex.c
|
||||
+++ b/kernel/locking/rtmutex.c
|
||||
@@ -1534,20 +1534,23 @@ static bool rtmutex_spin_on_owner(struct rt_mutex_base *lock,
|
||||
*
|
||||
* Must be called with lock->wait_lock held and interrupts disabled. It must
|
||||
* have just failed to try_to_take_rt_mutex().
|
||||
+ *
|
||||
+ * When invoked from rt_mutex_start_proxy_lock() waiter::task != current !
|
||||
*/
|
||||
static void __sched remove_waiter(struct rt_mutex_base *lock,
|
||||
struct rt_mutex_waiter *waiter)
|
||||
{
|
||||
bool is_top_waiter = (waiter == rt_mutex_top_waiter(lock));
|
||||
struct task_struct *owner = rt_mutex_owner(lock);
|
||||
+ struct task_struct *waiter_task = waiter->task;
|
||||
struct rt_mutex_base *next_lock;
|
||||
|
||||
lockdep_assert_held(&lock->wait_lock);
|
||||
|
||||
- raw_spin_lock(¤t->pi_lock);
|
||||
- rt_mutex_dequeue(lock, waiter);
|
||||
- current->pi_blocked_on = NULL;
|
||||
- raw_spin_unlock(¤t->pi_lock);
|
||||
+ scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
|
||||
+ rt_mutex_dequeue(lock, waiter);
|
||||
+ waiter_task->pi_blocked_on = NULL;
|
||||
+ }
|
||||
|
||||
/*
|
||||
* Only update priority if the waiter was the highest priority
|
||||
@@ -1583,7 +1586,7 @@ static void __sched remove_waiter(struct rt_mutex_base *lock,
|
||||
raw_spin_unlock_irq(&lock->wait_lock);
|
||||
|
||||
rt_mutex_adjust_prio_chain(owner, RT_MUTEX_MIN_CHAINWALK, lock,
|
||||
- next_lock, NULL, current);
|
||||
+ next_lock, NULL, waiter_task);
|
||||
|
||||
raw_spin_lock_irq(&lock->wait_lock);
|
||||
}
|
||||
--
|
||||
2.50.1
|
||||
@ -0,0 +1,59 @@
|
||||
From 622d621bf4f92efbab9f783c7b3068020a577061 Mon Sep 17 00:00:00 2001
|
||||
From: Nigel Croxon <ncroxon@redhat.com>
|
||||
Date: Thu, 7 May 2026 06:08:27 -0400
|
||||
Subject: [PATCH] md/bitmap: fix GPF in write_page caused by resize race
|
||||
|
||||
JIRA: https://issues.redhat.com/browse/RHEL-129337
|
||||
|
||||
CVE: CVE-2026-43163
|
||||
|
||||
commit 46ef85f854dfa9d5226b3c1c46493d79556c9589
|
||||
Author: Jack Wang <jinpu.wang@ionos.com>
|
||||
Date: Tue Jan 20 11:24:56 2026 +0100
|
||||
|
||||
md/bitmap: fix GPF in write_page caused by resize race
|
||||
|
||||
A General Protection Fault occurs in write_page() during array resize:
|
||||
RIP: 0010:write_page+0x22b/0x3c0 [md_mod]
|
||||
|
||||
This is a use-after-free race between bitmap_daemon_work() and
|
||||
__bitmap_resize(). The daemon iterates over `bitmap->storage.filemap`
|
||||
without locking, while the resize path frees that storage via
|
||||
md_bitmap_file_unmap(). `quiesce()` does not stop the md thread,
|
||||
allowing concurrent access to freed pages.
|
||||
|
||||
Fix by holding `mddev->bitmap_info.mutex` during the bitmap update.
|
||||
|
||||
Link: https://lore.kernel.org/linux-raid/20260120102456.25169-1-jinpu.wang@ionos.com
|
||||
Closes: https://lore.kernel.org/linux-raid/CAMGffE=Mbfp=7xD_hYxXk1PAaCZNSEAVeQGKGy7YF9f2S4=NEA@mail.gmail.com/T/#u
|
||||
Cc: stable@vger.kernel.org
|
||||
Fixes: d60b479d177a ("md/bitmap: add bitmap_resize function to allow bitmap resizing.")
|
||||
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
|
||||
Signed-off-by: Yu Kuai <yukuai@fnnas.com>
|
||||
(cherry picked from commit 46ef85f854dfa9d5226b3c1c46493d79556c9589)
|
||||
Signed-off-by: Nigel Croxon <ncroxon@redhat.com>
|
||||
|
||||
diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
|
||||
index 84b7e2af6dba..7bb56d0491a2 100644
|
||||
--- a/drivers/md/md-bitmap.c
|
||||
+++ b/drivers/md/md-bitmap.c
|
||||
@@ -2453,6 +2453,7 @@ static int __bitmap_resize(struct bitmap *bitmap, sector_t blocks,
|
||||
memcpy(page_address(store.sb_page),
|
||||
page_address(bitmap->storage.sb_page),
|
||||
sizeof(bitmap_super_t));
|
||||
+ mutex_lock(&bitmap->mddev->bitmap_info.mutex);
|
||||
spin_lock_irq(&bitmap->counts.lock);
|
||||
md_bitmap_file_unmap(&bitmap->storage);
|
||||
bitmap->storage = store;
|
||||
@@ -2560,7 +2561,7 @@ static int __bitmap_resize(struct bitmap *bitmap, sector_t blocks,
|
||||
set_page_attr(bitmap, i, BITMAP_PAGE_DIRTY);
|
||||
}
|
||||
spin_unlock_irq(&bitmap->counts.lock);
|
||||
-
|
||||
+ mutex_unlock(&bitmap->mddev->bitmap_info.mutex);
|
||||
if (!init) {
|
||||
__bitmap_unplug(bitmap);
|
||||
bitmap->mddev->pers->quiesce(bitmap->mddev, 0);
|
||||
--
|
||||
2.50.1 (Apple Git-155)
|
||||
|
||||
@ -0,0 +1,91 @@
|
||||
From 7bba8926cefe321fdcbe281278ddaeb0a8f8cc2b Mon Sep 17 00:00:00 2001
|
||||
From: Waiman Long <longman@redhat.com>
|
||||
Date: Tue, 28 Apr 2026 15:46:48 -0400
|
||||
Subject: [PATCH] rtmutex: Use waiter::task instead of current in
|
||||
remove_waiter()
|
||||
|
||||
JIRA: https://redhat.atlassian.net/browse/RHEL-171746
|
||||
|
||||
commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349
|
||||
Author: Keenan Dong <keenanat2000@gmail.com>
|
||||
Date: Wed, 8 Apr 2026 16:46:00 +0800
|
||||
|
||||
rtmutex: Use waiter::task instead of current in remove_waiter()
|
||||
|
||||
remove_waiter() is used by the slowlock paths, but it is also used for
|
||||
proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from
|
||||
futex_requeue().
|
||||
|
||||
In the latter case waiter::task is not current, but remove_waiter()
|
||||
operates on current for the dequeue operation. That results in several
|
||||
problems:
|
||||
|
||||
1) the rbtree dequeue happens without waiter::task::pi_lock being held
|
||||
|
||||
2) the waiter task's pi_blocked_on state is not cleared, which leaves a
|
||||
dangling pointer primed for UAF around.
|
||||
|
||||
3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter
|
||||
task
|
||||
|
||||
Use waiter::task instead of current in all related operations in
|
||||
remove_waiter() to cure those problems.
|
||||
|
||||
[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the
|
||||
changelog ]
|
||||
|
||||
Fixes: 8161239a8bcc ("rtmutex: Simplify PI algorithm and make highest prio task get lock")
|
||||
Reported-by: Yuan Tan <yuantan098@gmail.com>
|
||||
Reported-by: Yifan Wu <yifanwucs@gmail.com>
|
||||
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
|
||||
Reported-by: Xin Liu <bird@lzu.edu.cn>
|
||||
Signed-off-by: Keenan Dong <keenanat2000@gmail.com>
|
||||
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
|
||||
Cc: stable@vger.kernel.org
|
||||
|
||||
Signed-off-by: Waiman Long <longman@redhat.com>
|
||||
|
||||
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
|
||||
index 4a8df1800cbb..e6f305dea2a6 100644
|
||||
--- a/kernel/locking/rtmutex.c
|
||||
+++ b/kernel/locking/rtmutex.c
|
||||
@@ -1534,20 +1534,23 @@ static bool rtmutex_spin_on_owner(struct rt_mutex_base *lock,
|
||||
*
|
||||
* Must be called with lock->wait_lock held and interrupts disabled. It must
|
||||
* have just failed to try_to_take_rt_mutex().
|
||||
+ *
|
||||
+ * When invoked from rt_mutex_start_proxy_lock() waiter::task != current !
|
||||
*/
|
||||
static void __sched remove_waiter(struct rt_mutex_base *lock,
|
||||
struct rt_mutex_waiter *waiter)
|
||||
{
|
||||
bool is_top_waiter = (waiter == rt_mutex_top_waiter(lock));
|
||||
struct task_struct *owner = rt_mutex_owner(lock);
|
||||
+ struct task_struct *waiter_task = waiter->task;
|
||||
struct rt_mutex_base *next_lock;
|
||||
|
||||
lockdep_assert_held(&lock->wait_lock);
|
||||
|
||||
- raw_spin_lock(¤t->pi_lock);
|
||||
- rt_mutex_dequeue(lock, waiter);
|
||||
- current->pi_blocked_on = NULL;
|
||||
- raw_spin_unlock(¤t->pi_lock);
|
||||
+ scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
|
||||
+ rt_mutex_dequeue(lock, waiter);
|
||||
+ waiter_task->pi_blocked_on = NULL;
|
||||
+ }
|
||||
|
||||
/*
|
||||
* Only update priority if the waiter was the highest priority
|
||||
@@ -1583,7 +1586,7 @@ static void __sched remove_waiter(struct rt_mutex_base *lock,
|
||||
raw_spin_unlock_irq(&lock->wait_lock);
|
||||
|
||||
rt_mutex_adjust_prio_chain(owner, RT_MUTEX_MIN_CHAINWALK, lock,
|
||||
- next_lock, NULL, current);
|
||||
+ next_lock, NULL, waiter_task);
|
||||
|
||||
raw_spin_lock_irq(&lock->wait_lock);
|
||||
}
|
||||
--
|
||||
2.50.1 (Apple Git-155)
|
||||
|
||||
@ -1,9 +1,11 @@
|
||||
From 40a25d59e85b3c8709ac2424d44f65610467871e Mon Sep 17 00:00:00 2001
|
||||
From 5799f9bd7fee40370b93ab1ddf001cdc7017c14d Mon Sep 17 00:00:00 2001
|
||||
From: Davidlohr Bueso <dave@stgolabs.net>
|
||||
Date: Thu, 7 May 2026 04:29:13 -0700
|
||||
Date: Tue, 16 Jun 2026 15:06:01 -0400
|
||||
Subject: [PATCH] locking/rtmutex: Skip remove_waiter() when waiter is not
|
||||
enqueued
|
||||
|
||||
[ Upstream commit 40a25d59e85b3c8709ac2424d44f65610467871e ]
|
||||
|
||||
syzbot triggered the following splat in remove_waiter() via
|
||||
FUTEX_CMP_REQUEUE_PI:
|
||||
|
||||
@ -31,19 +33,14 @@ Signed-off-by: Thomas Gleixner <tglx@kernel.org>
|
||||
Cc: stable@vger.kernel.org
|
||||
Closes: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/
|
||||
Link: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net
|
||||
|
||||
(cherry picked from commit 40a25d59e85b3c8709ac2424d44f65610467871e)
|
||||
[AlmaLinux: adapted to a10 (6.12); context/line offsets only. Both hunks apply: remove_waiter() in kernel/locking/rtmutex.c (depends on waiter_task local from 3bfdc63936dd) and rt_mutex_start_proxy_lock() in kernel/locking/rtmutex_api.c. In this tree __rt_mutex_start_proxy_lock() returns 1 on try_to_take_rt_mutex() success, so the ret<0 tightening is required to avoid calling remove_waiter() on lock acquisition.]
|
||||
---
|
||||
kernel/locking/rtmutex.c | 3 +++
|
||||
kernel/locking/rtmutex_api.c | 2 +-
|
||||
2 files changed, 4 insertions(+), 1 deletion(-)
|
||||
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||||
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||||
|
||||
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
|
||||
index e6f305d..15111dc 100644
|
||||
index 8fdbd2931801..7110ee98391e 100644
|
||||
--- a/kernel/locking/rtmutex.c
|
||||
+++ b/kernel/locking/rtmutex.c
|
||||
@@ -1547,6 +1547,9 @@ static void __sched remove_waiter(struct rt_mutex_base *lock,
|
||||
@@ -1550,6 +1550,9 @@ static void __sched remove_waiter(struct rt_mutex_base *lock,
|
||||
|
||||
lockdep_assert_held(&lock->wait_lock);
|
||||
|
||||
@ -54,7 +51,7 @@ index e6f305d..15111dc 100644
|
||||
rt_mutex_dequeue(lock, waiter);
|
||||
waiter_task->pi_blocked_on = NULL;
|
||||
diff --git a/kernel/locking/rtmutex_api.c b/kernel/locking/rtmutex_api.c
|
||||
index 6614ccd..341a540 100644
|
||||
index 2bc14c049a64..091b109acdc5 100644
|
||||
--- a/kernel/locking/rtmutex_api.c
|
||||
+++ b/kernel/locking/rtmutex_api.c
|
||||
@@ -347,7 +347,7 @@ int __sched rt_mutex_start_proxy_lock(struct rt_mutex_base *lock,
|
||||
@ -67,4 +64,5 @@ index 6614ccd..341a540 100644
|
||||
preempt_disable();
|
||||
raw_spin_unlock_irq(&lock->wait_lock);
|
||||
--
|
||||
2.50.1
|
||||
2.50.1 (Apple Git-155)
|
||||
|
||||
@ -0,0 +1,42 @@
|
||||
From 74e144274af39935b0f410c0ee4d2b91c3730414 Mon Sep 17 00:00:00 2001
|
||||
From: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
|
||||
Date: Tue, 2 Jun 2026 09:12:04 +0000
|
||||
Subject: [PATCH] futex/requeue: Prevent NULL pointer dereference in
|
||||
remove_waiter() on self-deadlock
|
||||
|
||||
When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the
|
||||
target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting
|
||||
waiter->task.
|
||||
|
||||
The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences
|
||||
the NULL waiter->task, causing a kernel crash.
|
||||
|
||||
Add a self-deadlock check for non-top waiters before calling
|
||||
rt_mutex_start_proxy_lock(), analogous to the top-waiter check in
|
||||
futex_lock_pi_atomic().
|
||||
|
||||
Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()")
|
||||
Signed-off-by: Ji'an Zhou <eilaimemedsnaimel@gmail.com>
|
||||
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
|
||||
Cc: stable@vger.kernel.org
|
||||
|
||||
diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c
|
||||
index b597cb3d17fc..1d99a84dc9ad 100644
|
||||
--- a/kernel/futex/requeue.c
|
||||
+++ b/kernel/futex/requeue.c
|
||||
@@ -643,6 +643,12 @@ int futex_requeue(u32 __user *uaddr1, unsigned int flags1,
|
||||
continue;
|
||||
}
|
||||
|
||||
+ /* Self-deadlock: non-top waiter already owns the PI futex. */
|
||||
+ if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) {
|
||||
+ ret = -EDEADLK;
|
||||
+ break;
|
||||
+ }
|
||||
+
|
||||
ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex,
|
||||
this->rt_waiter,
|
||||
this->task);
|
||||
--
|
||||
2.50.1 (Apple Git-155)
|
||||
|
||||
@ -0,0 +1,48 @@
|
||||
From 39def6d250d370298f86c116f4ac60093cefadaa Mon Sep 17 00:00:00 2001
|
||||
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
|
||||
Date: Wed, 1 Jul 2026 15:11:50 +0200
|
||||
Subject: [PATCH] futex/requeue: Revert "Prevent NULL pointer dereference in
|
||||
remove_waiter() on self-deadlock""
|
||||
|
||||
The commit cited below should not have been merged. It attemted to fix an
|
||||
existing problem ansd thereby introduced new problems by keeping the
|
||||
pi_state in state Q_REQUEUE_PI_IN_PROGRESS and leaking it.
|
||||
|
||||
Based on the commit description the intention was to handle the case
|
||||
when task_blocks_on_rt_mutex() returns -EDEADLK and the following
|
||||
remove_waiter() dereferences the NULL pointer in waiter->task.
|
||||
|
||||
That is already handled by Davidlohr in commit 40a25d59e85b3
|
||||
("locking/rtmutex: Skip remove_waiter() when waiter is not enqueued") and
|
||||
requires no further acting.
|
||||
|
||||
Revert the commit breaking the "waiter == owner" case again.
|
||||
|
||||
Fixes: 74e144274af39 ("futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock")
|
||||
Reported-by: Michael Bommarito <michael.bommarito@gmail.com>
|
||||
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
|
||||
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
|
||||
Cc: stable@vger.kernel.org
|
||||
Link: https://patch.msgid.link/20260701131150.0Ijhq4Dw@linutronix.de
|
||||
Closes: https://lore.kernel.org/all/20260629020049.2082397-1-michael.bommarito@gmail.com
|
||||
|
||||
diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c
|
||||
index 7384672916fb..79823ad13683 100644
|
||||
--- a/kernel/futex/requeue.c
|
||||
+++ b/kernel/futex/requeue.c
|
||||
@@ -645,12 +645,6 @@ int futex_requeue(u32 __user *uaddr1, unsigned int flags1,
|
||||
continue;
|
||||
}
|
||||
|
||||
- /* Self-deadlock: non-top waiter already owns the PI futex. */
|
||||
- if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) {
|
||||
- ret = -EDEADLK;
|
||||
- break;
|
||||
- }
|
||||
-
|
||||
ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex,
|
||||
this->rt_waiter,
|
||||
this->task);
|
||||
--
|
||||
2.50.1 (Apple Git-155)
|
||||
|
||||
31
kernel.spec
31
kernel.spec
@ -176,13 +176,13 @@ Summary: The Linux kernel
|
||||
%define specrpmversion 6.12.0
|
||||
%define specversion 6.12.0
|
||||
%define patchversion 6.12
|
||||
%define pkgrelease 211.32.1
|
||||
%define pkgrelease 211.33.1
|
||||
%define kversion 6
|
||||
%define tarfile_release 6.12.0-211.7.1.el10_2
|
||||
# This is needed to do merge window version magic
|
||||
%define patchlevel 12
|
||||
# This allows pkg_release to have configurable %%{?dist} tag
|
||||
%define specrelease 211.32.1%{?buildid}%{?dist}
|
||||
%define specrelease 211.33.1%{?buildid}%{?dist}
|
||||
# This defines the kabi tarball version
|
||||
%define kabiversion 6.12.0-211.7.1.el10_2
|
||||
|
||||
@ -1473,12 +1473,15 @@ Patch1441: 1441-eventpoll-fix-semi-unbounded-recursion.patch
|
||||
Patch1442: 1442-eventpoll-drop-vestigial-epi-dying-flag.patch
|
||||
Patch1443: 1443-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch
|
||||
Patch1444: 1444-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch
|
||||
Patch1445: 1445-rtmutex-use-waiter-task-in-remove-waiter.patch
|
||||
Patch1446: 1446-rtmutex-skip-remove-waiter-when-not-enqueued.patch
|
||||
Patch1447: 1447-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sctp-sendall.patch
|
||||
Patch1448: 1448-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch
|
||||
Patch1449: 1449-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch
|
||||
Patch1450: 1450-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch
|
||||
Patch1451: 1451-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch
|
||||
Patch1452: 1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch
|
||||
Patch1453: 1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch
|
||||
Patch1454: 1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch
|
||||
Patch1455: 1455-futex-requeue-revert-prevent-null-pointer-dereference.patch
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%description
|
||||
@ -2674,12 +2677,15 @@ ApplyPatch 1441-eventpoll-fix-semi-unbounded-recursion.patch
|
||||
ApplyPatch 1442-eventpoll-drop-vestigial-epi-dying-flag.patch
|
||||
ApplyPatch 1443-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch
|
||||
ApplyPatch 1444-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch
|
||||
ApplyPatch 1445-rtmutex-use-waiter-task-in-remove-waiter.patch
|
||||
ApplyPatch 1446-rtmutex-skip-remove-waiter-when-not-enqueued.patch
|
||||
ApplyPatch 1447-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sctp-sendall.patch
|
||||
ApplyPatch 1448-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch
|
||||
ApplyPatch 1449-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch
|
||||
ApplyPatch 1450-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch
|
||||
ApplyPatch 1451-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch
|
||||
ApplyPatch 1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch
|
||||
ApplyPatch 1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch
|
||||
ApplyPatch 1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch
|
||||
ApplyPatch 1455-futex-requeue-revert-prevent-null-pointer-dereference.patch
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
# Any further pre-build tree manipulations happen here.
|
||||
@ -5184,6 +5190,19 @@ fi\
|
||||
#
|
||||
#
|
||||
%changelog
|
||||
* Mon Jul 13 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.33.1
|
||||
- Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455)
|
||||
- The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499
|
||||
(1445, 1446) are superseded by RHEL's copies and dropped
|
||||
- RHEL changelog for 211.33.1 follows:
|
||||
|
||||
* Thu Jul 09 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.33.1.el10_2]
|
||||
- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166}
|
||||
- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499}
|
||||
- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
|
||||
- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499}
|
||||
- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163}
|
||||
|
||||
* Thu Jul 09 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 6.12.0-211.32.1
|
||||
- Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450)
|
||||
- The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are
|
||||
|
||||
Loading…
Reference in New Issue
Block a user