kernel-7.0.4-200

* Thu May 07 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.0.4-0]
- wifi: mt76: mt7925: fix incorrect TLV length in CLC command (Quan Zhou)
- ASoC: SOF: Don't allow pointer operations on unconfigured streams (Mark Brown)
- Turn on DVB_PT3 for Fedora at user request (Justin M. Forbes)
- Enable MEDIA_TUNER_MXL301RF for Fedora (Justin M. Forbes)
- mfd: bcm2835-pm: Add BCM2712 PM device support (Phil Elwell)
- mfd: bcm2835-pm: Introduce SoC-specific type identifier (Phil Elwell)
- Linux v7.0.4
Resolves:

Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
This commit is contained in:
Justin M. Forbes 2026-05-07 11:56:51 -06:00
commit 2a2ab9aa9a
No known key found for this signature in database
GPG key ID: B8FA7924A4B1C140
4 changed files with 98 additions and 2 deletions

View file

@ -1,3 +1,9 @@
https://gitlab.com/cki-project/kernel-ark/-/commit/eeaa13aa75f77515556db57762d369b57878725c
eeaa13aa75f77515556db57762d369b57878725c xfrm: esp: avoid in-place decrypt on shared skb frags
https://gitlab.com/cki-project/kernel-ark/-/commit/ee4bed290fa3c8817aca92da2011e4904a7680ed
ee4bed290fa3c8817aca92da2011e4904a7680ed rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
https://gitlab.com/cki-project/kernel-ark/-/commit/7ef39c4f44821b39eafbf92b6b8c3307f09c244e
7ef39c4f44821b39eafbf92b6b8c3307f09c244e wifi: mt76: mt7925: fix incorrect TLV length in CLC command

View file

@ -4825,6 +4825,10 @@ fi\
#
#
%changelog
* Thu May 07 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.0.4-200]
- xfrm: esp: avoid in-place decrypt on shared skb frags (Kuan-Ting Chen)
- rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present (Hyunwoo Kim)
* Thu May 07 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.0.4-0]
- wifi: mt76: mt7925: fix incorrect TLV length in CLC command (Quan Zhou)
- ASoC: SOF: Don't allow pointer operations on unconfigured streams (Mark Brown)

View file

@ -66,6 +66,12 @@
include/linux/rmi.h | 1 +
include/linux/security.h | 9 +
kernel/module/signing.c | 9 +-
net/ipv4/esp4.c | 3 +-
net/ipv4/ip_output.c | 2 +
net/ipv6/esp6.c | 3 +-
net/ipv6/ip6_output.c | 2 +
net/rxrpc/call_event.c | 2 +-
net/rxrpc/conn_event.c | 2 +-
scripts/Makefile.lib | 3 +
scripts/tags.sh | 2 +
security/integrity/platform_certs/load_uefi.c | 6 +-
@ -74,7 +80,7 @@
sound/soc/sof/compress.c | 3 +
tools/testing/selftests/bpf/Makefile | 2 +-
tools/testing/selftests/bpf/prog_tests/ksyms_btf.c | 31 -
76 files changed, 5408 insertions(+), 546 deletions(-)
82 files changed, 5418 insertions(+), 550 deletions(-)
diff --git a/Documentation/admin-guide/media/amdisp4-1.rst b/Documentation/admin-guide/media/amdisp4-1.rst
new file mode 100644
@ -7493,6 +7499,86 @@ index a2ff4242e623..f0d2be1ee4f1 100644
}
int module_sig_check(struct load_info *info, int flags)
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 6dfc0bcdef65..6a5febbdbee4 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -873,7 +873,8 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
nfrags = 1;
goto skip_cow;
- } else if (!skb_has_frag_list(skb)) {
+ } else if (!skb_has_frag_list(skb) &&
+ !skb_has_shared_frag(skb)) {
nfrags = skb_shinfo(skb)->nr_frags;
nfrags++;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index e4790cc7b5c2..5bcd73cbdb41 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1233,6 +1233,8 @@ static int __ip_append_data(struct sock *sk,
if (err < 0)
goto error;
copy = err;
+ if (!(flags & MSG_NO_SHARED_FRAGS))
+ skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
wmem_alloc_delta += copy;
} else if (!zc) {
int i = skb_shinfo(skb)->nr_frags;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 9f75313734f8..9c06c5a1419d 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -915,7 +915,8 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb)
nfrags = 1;
goto skip_cow;
- } else if (!skb_has_frag_list(skb)) {
+ } else if (!skb_has_frag_list(skb) &&
+ !skb_has_shared_frag(skb)) {
nfrags = skb_shinfo(skb)->nr_frags;
nfrags++;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 8e2a6b28cea7..3f14e363c96e 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1765,6 +1765,8 @@ static int __ip6_append_data(struct sock *sk,
if (err < 0)
goto error;
copy = err;
+ if (!(flags & MSG_NO_SHARED_FRAGS))
+ skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG;
wmem_alloc_delta += copy;
} else if (!zc) {
int i = skb_shinfo(skb)->nr_frags;
diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index fdd683261226..6c924ef55208 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -334,7 +334,7 @@ bool rxrpc_input_call_event(struct rxrpc_call *call)
if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
sp->hdr.securityIndex != 0 &&
- skb_cloned(skb)) {
+ (skb_cloned(skb) || skb->data_len)) {
/* Unshare the packet so that it can be
* modified by in-place decryption.
*/
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index a2130d25aaa9..eab7c5f2517a 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -245,7 +245,7 @@ static int rxrpc_verify_response(struct rxrpc_connection *conn,
{
int ret;
- if (skb_cloned(skb)) {
+ if (skb_cloned(skb) || skb->data_len) {
/* Copy the packet if shared so that we can do in-place
* decryption.
*/
diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
index 0718e39cedda..10e94a1b8b6e 100644
--- a/scripts/Makefile.lib

View file

@ -1,3 +1,3 @@
SHA512 (linux-7.0.4.tar.xz) = fb56c0bcf5b527d2dde70175b6090a91c6f841558763fe87388f42568c945bde283df4d8899a7c78dc2e29d1b2be75ca6d2f5b5e49264aee3796db1bcb916253
SHA512 (kernel-abi-stablelists-7.0.4.tar.xz) = ff24de9286422fd6e3e2ceec5240720a0bc22efefdd8a44edb36f8a4f6e549d9594fe767f54cc5e5fb64e98fa485181c18281fac59fd9de7ade8030a432b0a89
SHA512 (kernel-abi-stablelists-7.0.4.tar.xz) = 1d03553a6955ddbf4a62d30d0c6b5396e3aca9bd7aa815db1243b34f6fb01f8d908b316c39d7a25c80bf180ed6f4326e178ded157869183e83f4a8a4a4525bbc
SHA512 (kernel-kabi-dw-7.0.4.tar.xz) = 1ae6c2ebcb6ca1b4399fe6f49cec43f4afe746c109509121f76c0a2c35229c553b0f2aeb21a6dfe513fa044f8b680b61507cdbb1ea0de2007675445d476e05d6