From 25b73dde425975e787dacad55be29c4e70d461d2 Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Thu, 7 May 2026 11:57:49 -0600 Subject: [PATCH] kernel-7.0.4-100 * Thu May 07 2026 Justin M. Forbes [7.0.4-0] - wifi: mt76: mt7925: fix incorrect TLV length in CLC command (Quan Zhou) - ASoC: SOF: Don't allow pointer operations on unconfigured streams (Mark Brown) - Turn on DVB_PT3 for Fedora at user request (Justin M. Forbes) - Enable MEDIA_TUNER_MXL301RF for Fedora (Justin M. Forbes) - mfd: bcm2835-pm: Add BCM2712 PM device support (Phil Elwell) - mfd: bcm2835-pm: Introduce SoC-specific type identifier (Phil Elwell) - Linux v7.0.4 Resolves: Signed-off-by: Justin M. Forbes --- Patchlist.changelog | 6 +++ kernel.spec | 4 ++ patch-7.0-redhat.patch | 88 +++++++++++++++++++++++++++++++++++++++++- sources | 2 +- 4 files changed, 98 insertions(+), 2 deletions(-) diff --git a/Patchlist.changelog b/Patchlist.changelog index b090be9ba..8a6f27a8f 100644 --- a/Patchlist.changelog +++ b/Patchlist.changelog @@ -1,3 +1,9 @@ +https://gitlab.com/cki-project/kernel-ark/-/commit/eeaa13aa75f77515556db57762d369b57878725c + eeaa13aa75f77515556db57762d369b57878725c xfrm: esp: avoid in-place decrypt on shared skb frags + +https://gitlab.com/cki-project/kernel-ark/-/commit/ee4bed290fa3c8817aca92da2011e4904a7680ed + ee4bed290fa3c8817aca92da2011e4904a7680ed rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present + https://gitlab.com/cki-project/kernel-ark/-/commit/7ef39c4f44821b39eafbf92b6b8c3307f09c244e 7ef39c4f44821b39eafbf92b6b8c3307f09c244e wifi: mt76: mt7925: fix incorrect TLV length in CLC command diff --git a/kernel.spec b/kernel.spec index dc07cf53c..f88c1201e 100644 --- a/kernel.spec +++ b/kernel.spec @@ -4825,6 +4825,10 @@ fi\ # # %changelog +* Thu May 07 2026 Justin M. Forbes [7.0.4-100] +- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen) +- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim) + * Thu May 07 2026 Justin M. Forbes [7.0.4-0] - wifi: mt76: mt7925: fix incorrect TLV length in CLC command (Quan Zhou) - ASoC: SOF: Don't allow pointer operations on unconfigured streams (Mark Brown) diff --git a/patch-7.0-redhat.patch b/patch-7.0-redhat.patch index 51cce5221..380f696aa 100644 --- a/patch-7.0-redhat.patch +++ b/patch-7.0-redhat.patch @@ -66,6 +66,12 @@ include/linux/rmi.h | 1 + include/linux/security.h | 9 + kernel/module/signing.c | 9 +- + net/ipv4/esp4.c | 3 +- + net/ipv4/ip_output.c | 2 + + net/ipv6/esp6.c | 3 +- + net/ipv6/ip6_output.c | 2 + + net/rxrpc/call_event.c | 2 +- + net/rxrpc/conn_event.c | 2 +- scripts/Makefile.lib | 3 + scripts/tags.sh | 2 + security/integrity/platform_certs/load_uefi.c | 6 +- @@ -74,7 +80,7 @@ sound/soc/sof/compress.c | 3 + tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/prog_tests/ksyms_btf.c | 31 - - 76 files changed, 5408 insertions(+), 546 deletions(-) + 82 files changed, 5418 insertions(+), 550 deletions(-) diff --git a/Documentation/admin-guide/media/amdisp4-1.rst b/Documentation/admin-guide/media/amdisp4-1.rst new file mode 100644 @@ -7493,6 +7499,86 @@ index a2ff4242e623..f0d2be1ee4f1 100644 } int module_sig_check(struct load_info *info, int flags) +diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c +index 6dfc0bcdef65..6a5febbdbee4 100644 +--- a/net/ipv4/esp4.c ++++ b/net/ipv4/esp4.c +@@ -873,7 +873,8 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb) + nfrags = 1; + + goto skip_cow; +- } else if (!skb_has_frag_list(skb)) { ++ } else if (!skb_has_frag_list(skb) && ++ !skb_has_shared_frag(skb)) { + nfrags = skb_shinfo(skb)->nr_frags; + nfrags++; + +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index e4790cc7b5c2..5bcd73cbdb41 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1233,6 +1233,8 @@ static int __ip_append_data(struct sock *sk, + if (err < 0) + goto error; + copy = err; ++ if (!(flags & MSG_NO_SHARED_FRAGS)) ++ skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; + wmem_alloc_delta += copy; + } else if (!zc) { + int i = skb_shinfo(skb)->nr_frags; +diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c +index 9f75313734f8..9c06c5a1419d 100644 +--- a/net/ipv6/esp6.c ++++ b/net/ipv6/esp6.c +@@ -915,7 +915,8 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb) + nfrags = 1; + + goto skip_cow; +- } else if (!skb_has_frag_list(skb)) { ++ } else if (!skb_has_frag_list(skb) && ++ !skb_has_shared_frag(skb)) { + nfrags = skb_shinfo(skb)->nr_frags; + nfrags++; + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 8e2a6b28cea7..3f14e363c96e 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1765,6 +1765,8 @@ static int __ip6_append_data(struct sock *sk, + if (err < 0) + goto error; + copy = err; ++ if (!(flags & MSG_NO_SHARED_FRAGS)) ++ skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; + wmem_alloc_delta += copy; + } else if (!zc) { + int i = skb_shinfo(skb)->nr_frags; +diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c +index fdd683261226..6c924ef55208 100644 +--- a/net/rxrpc/call_event.c ++++ b/net/rxrpc/call_event.c +@@ -334,7 +334,7 @@ bool rxrpc_input_call_event(struct rxrpc_call *call) + + if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA && + sp->hdr.securityIndex != 0 && +- skb_cloned(skb)) { ++ (skb_cloned(skb) || skb->data_len)) { + /* Unshare the packet so that it can be + * modified by in-place decryption. + */ +diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c +index a2130d25aaa9..eab7c5f2517a 100644 +--- a/net/rxrpc/conn_event.c ++++ b/net/rxrpc/conn_event.c +@@ -245,7 +245,7 @@ static int rxrpc_verify_response(struct rxrpc_connection *conn, + { + int ret; + +- if (skb_cloned(skb)) { ++ if (skb_cloned(skb) || skb->data_len) { + /* Copy the packet if shared so that we can do in-place + * decryption. + */ diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib index 0718e39cedda..10e94a1b8b6e 100644 --- a/scripts/Makefile.lib diff --git a/sources b/sources index 328754834..9de168a9e 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (linux-7.0.4.tar.xz) = fb56c0bcf5b527d2dde70175b6090a91c6f841558763fe87388f42568c945bde283df4d8899a7c78dc2e29d1b2be75ca6d2f5b5e49264aee3796db1bcb916253 -SHA512 (kernel-abi-stablelists-7.0.4.tar.xz) = a4f89f88fa615d07d27fc4be86788501c4531a3eb86489f6431d360bde8af9b078c085e3828c4f627445b6ebe53e760cfa134961a05fc643e460df976a315584 +SHA512 (kernel-abi-stablelists-7.0.4.tar.xz) = 4b5d8c6994a0e87424e5822c6767ab5a13e19a4c1e6b0bafb5a84e692394069dcfe6d3ec4f2bc257930fd10f5e82e745ea9b72e0e9dffd140b0cf43e69935cf6 SHA512 (kernel-kabi-dw-7.0.4.tar.xz) = 1ae6c2ebcb6ca1b4399fe6f49cec43f4afe746c109509121f76c0a2c35229c553b0f2aeb21a6dfe513fa044f8b680b61507cdbb1ea0de2007675445d476e05d6