[rocky8_10] History Rebuild through kernel-4.18.0-553.150.1.el8_10 - #1500
Open
PlaidCat wants to merge 13 commits into
Open
[rocky8_10] History Rebuild through kernel-4.18.0-553.150.1.el8_10#1500PlaidCat wants to merge 13 commits into
PlaidCat wants to merge 13 commits into
Conversation
jira KERNEL-1421 cve CVE-2026-46150 Rebuild_History Non-Buildable kernel-4.18.0-553.150.1.el8_10 commit-author Miklos Szeredi <[email protected]> commit 7746e3b Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.150.1.el8_10/7746e3bd.failed fsnotify_get_mark_safe() may return false for a mark on an unrelated group, which results in bypassing the permission check. Fix by skipping over detached marks that are not in the current group. CC: [email protected] Fixes: abc7757 ("fsnotify: Provide framework for dropping SRCU lock in ->handle_event") Signed-off-by: Miklos Szeredi <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jan Kara <[email protected]> (cherry picked from commit 7746e3b) Signed-off-by: Jonathan Maple <[email protected]> # Conflicts: # fs/notify/mark.c
jira KERNEL-1421 cve CVE-2026-31692 Rebuild_History Non-Buildable kernel-4.18.0-553.150.1.el8_10 commit-author Jakub Kicinski <[email protected]> commit c92bf26 Commit a293974 ("rtnetlink: avoid frame size warning in rtnl_newlink()") moved to allocating the largest attribute array of rtnl_newlink() on the heap. Kalle reports the stack has grown above 1k again: net/core/rtnetlink.c:3557:1: error: the frame size of 1104 bytes is larger than 1024 bytes [-Werror=frame-larger-than=] Move more attrs to the heap, wrap them in a struct. Don't bother with linkinfo, it's referenced a lot and we take its size so it's awkward to move, plus it's small (6 elements). Reported-by: Kalle Valo <[email protected]> Signed-off-by: Jakub Kicinski <[email protected]> Tested-by: Kalle Valo <[email protected]> Signed-off-by: Paolo Abeni <[email protected]> (cherry picked from commit c92bf26) Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-1421 cve CVE-2026-31692 Rebuild_History Non-Buildable kernel-4.18.0-553.150.1.el8_10 commit-author Jakub Kicinski <[email protected]> commit 63105e8 __rtnl_newlink() is 250LoC, but has a few clear sections. Move the part which creates a new netdev to a separate function. For ease of review code will be moved in the next change. Signed-off-by: Jakub Kicinski <[email protected]> Signed-off-by: Paolo Abeni <[email protected]> (cherry picked from commit 63105e8) Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-1421 cve CVE-2026-31692 Rebuild_History Non-Buildable kernel-4.18.0-553.150.1.el8_10 commit-author Jakub Kicinski <[email protected]> commit 02839cc Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.150.1.el8_10/02839cc8.failed Pure code move. Signed-off-by: Jakub Kicinski <[email protected]> Signed-off-by: Paolo Abeni <[email protected]> (cherry picked from commit 02839cc) Signed-off-by: Jonathan Maple <[email protected]> # Conflicts: # net/core/rtnetlink.c
jira KERNEL-1421 cve CVE-2026-31692 Rebuild_History Non-Buildable kernel-4.18.0-553.150.1.el8_10 commit-author Jakub Kicinski <[email protected]> commit f534f65 veth and vxcan need to make sure the ifindexes of the peer are not negative, core does not validate this. Using iproute2 with user-space-level checking removed: Before: # ./ip link add index 10 type veth peer index -1 # ip link show 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 2: enp1s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP mode DEFAULT group default qlen 1000 link/ether 52:54:00:74:b2:03 brd ff:ff:ff:ff:ff:ff 10: veth1@veth0: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether 8a:90:ff:57:6d:5d brd ff:ff:ff:ff:ff:ff -1: veth0@veth1: <BROADCAST,MULTICAST,M-DOWN> mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 link/ether ae:ed:18:e6:fa:7f brd ff:ff:ff:ff:ff:ff Now: $ ./ip link add index 10 type veth peer index -1 Error: ifindex can't be negative. This problem surfaced in net-next because an explicit WARN() was added, the root cause is older. Fixes: e6f8f1a ("veth: Allow to create peer link with given ifindex") Fixes: a8f820a ("can: add Virtual CAN Tunnel driver (vxcan)") Reported-by: [email protected] Signed-off-by: Jakub Kicinski <[email protected]> Reviewed-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]> (cherry picked from commit f534f65) Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-1421 cve CVE-2026-31692 Rebuild_History Non-Buildable kernel-4.18.0-553.150.1.el8_10 commit-author Kuniyuki Iwashima <[email protected]> commit 28690e5 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.150.1.el8_10/28690e53.failed In ops->newlink(), veth, vxcan, and netkit call rtnl_link_get_net() with a net pointer, which is the first argument of ->newlink(). rtnl_link_get_net() could return another netns based on IFLA_NET_NS_PID and IFLA_NET_NS_FD in the peer device's attributes. We want to get it and fill rtnl_nets->nets[] in advance in rtnl_newlink() for per-netns RTNL. All of the three get the peer netns in the same way: 1. Call rtnl_nla_parse_ifinfomsg() 2. Call ops->validate() (vxcan doesn't have) 3. Call rtnl_link_get_net_tb() Let's add a new field peer_type to struct rtnl_link_ops and prefetch netns in the peer ifla to add it to rtnl_nets in rtnl_newlink(). Signed-off-by: Kuniyuki Iwashima <[email protected]> Reviewed-by: Eric Dumazet <[email protected]> Reviewed-by: Nikolay Aleksandrov <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit 28690e5) Signed-off-by: Jonathan Maple <[email protected]> # Conflicts: # include/net/rtnetlink.h # net/core/rtnetlink.c
jira KERNEL-1421 cve CVE-2026-31692 Rebuild_History Non-Buildable kernel-4.18.0-553.150.1.el8_10 commit-author Kuniyuki Iwashima <[email protected]> commit 0eb87b0 For per-netns RTNL, we need to prefetch the peer device's netns. Let's set rtnl_link_ops.peer_type and accordingly remove duplicated validation in ->newlink(). Signed-off-by: Kuniyuki Iwashima <[email protected]> Reviewed-by: Eric Dumazet <[email protected]> Reviewed-by: Nikolay Aleksandrov <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit 0eb87b0) Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-1421 cve CVE-2026-31692 Rebuild_History Non-Buildable kernel-4.18.0-553.150.1.el8_10 commit-author Kuniyuki Iwashima <[email protected]> commit 6b84e55 For per-netns RTNL, we need to prefetch the peer device's netns. Let's set rtnl_link_ops.peer_type and accordingly remove duplicated validation in ->newlink(). Signed-off-by: Kuniyuki Iwashima <[email protected]> Reviewed-by: Eric Dumazet <[email protected]> Reviewed-by: Nikolay Aleksandrov <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit 6b84e55) Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-1421 cve CVE-2026-31692 Rebuild_History Non-Buildable kernel-4.18.0-553.150.1.el8_10 commit-author Cong Wang <[email protected]> commit 4832756 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.150.1.el8_10/48327566.failed Currently rtnl_link_get_net_ifla() gets called twice when we create peer devices, once in rtnl_add_peer_net() and once in each ->newlink() implementation. This looks safer, however, it leads to a classic Time-of-Check to Time-of-Use (TOCTOU) bug since IFLA_NET_NS_PID is very dynamic. And because of the lack of checking error pointer of the second call, it also leads to a kernel crash as reported by syzbot. Fix this by getting rid of the second call, which already becomes redudant after Kuniyuki's work. We have to propagate the result of the first rtnl_link_get_net_ifla() down to each ->newlink(). Reported-by: [email protected] Closes: https://syzkaller.appspot.com/bug?extid=21ba4d5adff0b6a7cfc6 Fixes: 0eb87b0 ("veth: Set VETH_INFO_PEER to veth_link_ops.peer_type.") Fixes: 6b84e55 ("vxcan: Set VXCAN_INFO_PEER to vxcan_link_ops.peer_type.") Fixes: fefd5d0 ("netkit: Set IFLA_NETKIT_PEER_INFO to netkit_link_ops.peer_type.") Cc: Kuniyuki Iwashima <[email protected]> Signed-off-by: Cong Wang <[email protected]> Reviewed-by: Kuniyuki Iwashima <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Paolo Abeni <[email protected]> (cherry picked from commit 4832756) Signed-off-by: Jonathan Maple <[email protected]> # Conflicts: # drivers/net/netkit.c # net/core/rtnetlink.c
jira KERNEL-1421 cve CVE-2026-31692 Rebuild_History Non-Buildable kernel-4.18.0-553.150.1.el8_10 commit-author Kuniyuki Iwashima <[email protected]> commit 954a2b4 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.150.1.el8_10/954a2b40.failed Xiao Liang reported that the cited commit changed netns handling in newlink() of netkit, veth, and vxcan. Before the patch, if we don't find a netns attribute in the peer device attributes, we tried to find another netns attribute in the outer netlink attributes by passing it to rtnl_link_get_net(). Let's restore the original behaviour. Fixes: 4832756 ("rtnetlink: fix double call of rtnl_link_get_net_ifla()") Reported-by: Xiao Liang <[email protected]> Closes: https://lore.kernel.org/netdev/CABAhCORBVVU8P6AHcEkENMj+gD2d3ce9t=A_o48E0yOQp8_wUQ@mail.gmail.com/#t Signed-off-by: Kuniyuki Iwashima <[email protected]> Tested-by: Xiao Liang <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit 954a2b4) Signed-off-by: Jonathan Maple <[email protected]> # Conflicts: # net/core/rtnetlink.c
jira KERNEL-1421 cve CVE-2026-31692 Rebuild_History Non-Buildable kernel-4.18.0-553.150.1.el8_10 commit-author Nikolaos Gkarlis <[email protected]> commit 7b735ef Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.150.1.el8_10/7b735ef8.failed rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allows an unprivileged user with a user namespace to create interfaces in arbitrary network namespaces, including init_net. Add a netlink_ns_capable() check for CAP_NET_ADMIN in the peer namespace before allowing device creation to proceed. Fixes: 81adee4 ("net: Support specifying the network namespace upon device creation.") Signed-off-by: Nikolaos Gkarlis <[email protected]> Reviewed-by: Kuniyuki Iwashima <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit 7b735ef) Signed-off-by: Jonathan Maple <[email protected]> # Conflicts: # net/core/rtnetlink.c
jira KERNEL-1421 cve CVE-2026-43116 Rebuild_History Non-Buildable kernel-4.18.0-553.150.1.el8_10 commit-author Pablo Neira Ayuso <[email protected]> commit bffcaad Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.150.1.el8_10/bffcaad9.failed Holding reference on the expectation is not sufficient, the master conntrack object can just go away, making exp->master invalid. To access exp->master safely: - Grab the nf_conntrack_expect_lock, this gets serialized with clean_from_lists() which also holds this lock when the master conntrack goes away. - Hold reference on master conntrack via nf_conntrack_find_get(). Not so easy since the master tuple to look up for the master conntrack is not available in the existing problematic paths. This patch goes for extending the nf_conntrack_expect_lock section to address this issue for simplicity, in the cases that are described below this is just slightly extending the lock section. The add expectation command already holds a reference to the master conntrack from ctnetlink_create_expect(). However, the delete expectation command needs to grab the spinlock before looking up for the expectation. Expand the existing spinlock section to address this to cover the expectation lookup. Note that, the nf_ct_expect_iterate_net() calls already grabs the spinlock while iterating over the expectation table, which is correct. The get expectation command needs to grab the spinlock to ensure master conntrack does not go away. This also expands the existing spinlock section to cover the expectation lookup too. I needed to move the netlink skb allocation out of the spinlock to keep it GFP_KERNEL. For the expectation events, the IPEXP_DESTROY event is already delivered under the spinlock, just move the delivery of IPEXP_NEW under the spinlock too because the master conntrack event cache is reached through exp->master. While at it, add lockdep notations to help identify what codepaths need to grab the spinlock. Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: Pablo Neira Ayuso <[email protected]> (cherry picked from commit bffcaad) Signed-off-by: Jonathan Maple <[email protected]> # Conflicts: # include/net/netfilter/nf_conntrack_core.h # net/netfilter/nf_conntrack_expect.c # net/netfilter/nf_conntrack_netlink.c
Rebuild_History BUILDABLE Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50% Number of commits in upstream range v4.18~1..kernel-mainline: 625874 Number of commits in rpm: 19 Number of commits matched with upstream: 12 (63.16%) Number of commits in upstream but not in rpm: 625862 Number of commits NOT found in upstream: 7 (36.84%) Rebuilding Kernel on Branch rocky8_10_rebuild_kernel-4.18.0-553.150.1.el8_10 for kernel-4.18.0-553.150.1.el8_10 Clean Cherry Picks: 5 (41.67%) Empty Cherry Picks: 7 (58.33%) _______________________________ Full Details Located here: ciq/ciq_backports/kernel-4.18.0-553.150.1.el8_10/rebuild.details.txt Includes: * git commit header above * Empty Commits with upstream SHA * RPM ChangeLog Entries that could not be matched Individual Empty Commit failures contained in the same containing directory. The git message for empty commits will have the path for the failed commit. File names are the first 8 characters of the upstream SHA
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This is an automated kernel history rebuild using cron and internal tooling. It follows the same process used for previous history rebuilds:
src.rpmpackagessrc.rpm:4.18.0-553)git cherry-pickrpmbuild -bpfor the correspondingsrc.rpmJIRA Tickets
Rebuild Splat Inspection
kernel-4.18.0-553.150.1.el8_10
BUILD
KSelfTests