From 7b5a9b2f23413f78021471bb97b46fdaaa4d8b26 Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Mon, 18 May 2026 14:59:29 -0600 Subject: [PATCH] kernel-7.0.9-202 * Mon May 18 2026 Justin M. Forbes [7.0.9-2] - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) - Revert fragnesia for so I can replace it with the newer one (Justin M. Forbes) - net/sched: act_pedit: extend the writable skb range per key (Zhang Cen) Resolves: Signed-off-by: Justin M. Forbes --- Patchlist.changelog | 9 ++++ kernel.changelog | 7 +++ kernel.spec | 9 ++-- patch-7.0-redhat.patch | 109 +++++++++++++++++++++++++++++++++-------- sources | 4 +- 5 files changed, 113 insertions(+), 25 deletions(-) diff --git a/Patchlist.changelog b/Patchlist.changelog index 0771c017c..24137cca7 100644 --- a/Patchlist.changelog +++ b/Patchlist.changelog @@ -1,3 +1,12 @@ +https://gitlab.com/cki-project/kernel-ark/-/commit/8148c63373b124fd1bf8d820d65687e99a00d31d + 8148c63373b124fd1bf8d820d65687e99a00d31d net/sched: fix pedit partial COW leading to page cache corruption + +https://gitlab.com/cki-project/kernel-ark/-/commit/2f2bc67b669031ce73d83507b5d23ef5aac7ff4c + 2f2bc67b669031ce73d83507b5d23ef5aac7ff4c net: skbuff: propagate shared-frag marker through frag-transfer helpers + +https://gitlab.com/cki-project/kernel-ark/-/commit/0e7c5384fd0fbc9d998593f6db29ec0f6fd45aca + 0e7c5384fd0fbc9d998593f6db29ec0f6fd45aca Revert fragnesia for so I can replace it with the newer one + https://gitlab.com/cki-project/kernel-ark/-/commit/ffdf20681f8d39c780e340491059ed02daf855bd ffdf20681f8d39c780e340491059ed02daf855bd net/sched: act_pedit: extend the writable skb range per key diff --git a/kernel.changelog b/kernel.changelog index 1ba7341b6..461136f8c 100644 --- a/kernel.changelog +++ b/kernel.changelog @@ -1,3 +1,10 @@ +* Mon May 18 2026 Justin M. Forbes [7.0.9-0] +- net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) +- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) +- Revert fragnesia for so I can replace it with the newer one (Justin M. Forbes) +- net/sched: act_pedit: extend the writable skb range per key (Zhang Cen) +Resolves: + * Sun May 17 2026 Justin M. Forbes [7.0.9-0] - Turn on XFS_ONLINE_REPAIR for Fedora (Justin M. Forbes) - Enable SND_DESIGNWARE for Fedora x86 (Justin M. Forbes) diff --git a/kernel.spec b/kernel.spec index d1e1d40a8..1d8129ad6 100644 --- a/kernel.spec +++ b/kernel.spec @@ -190,13 +190,13 @@ Summary: The Linux kernel %define specrpmversion 7.0.9 %define specversion 7.0.9 %define patchversion 7.0 -%define pkgrelease 201 +%define pkgrelease 202 %define kversion 7 %define tarfile_release 7.0.9 # This is needed to do merge window version magic %define patchlevel 0 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 201%{?buildid}%{?dist} +%define specrelease 202%{?buildid}%{?dist} # This defines the kabi tarball version %define kabiversion 7.0.9 @@ -4825,7 +4825,10 @@ fi\ # # %changelog -* Sun May 17 2026 Justin M. Forbes [7.0.9-201] +* Mon May 18 2026 Justin M. Forbes [7.0.9-2] +- net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) +- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) +- Revert fragnesia for so I can replace it with the newer one (Justin M. Forbes) - net/sched: act_pedit: extend the writable skb range per key (Zhang Cen) * Sun May 17 2026 Justin M. Forbes [7.0.9-0] diff --git a/patch-7.0-redhat.patch b/patch-7.0-redhat.patch index 445d435a8..9c8ad9abc 100644 --- a/patch-7.0-redhat.patch +++ b/patch-7.0-redhat.patch @@ -66,9 +66,9 @@ include/linux/security.h | 9 + kernel/module/signing.c | 9 +- net/core/gro.c | 4 + - net/core/skbuff.c | 3 + + net/core/skbuff.c | 9 +- net/ipv4/tcp_output.c | 1 + - net/sched/act_pedit.c | 36 +- + net/sched/act_pedit.c | 67 +- scripts/Makefile.lib | 3 + scripts/tags.sh | 2 + security/integrity/platform_certs/load_uefi.c | 6 +- @@ -76,7 +76,7 @@ security/lockdown/lockdown.c | 11 + tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/prog_tests/ksyms_btf.c | 31 - - 78 files changed, 5427 insertions(+), 562 deletions(-) + 78 files changed, 5459 insertions(+), 567 deletions(-) diff --git a/Documentation/admin-guide/media/amdisp4-1.rst b/Documentation/admin-guide/media/amdisp4-1.rst new file mode 100644 @@ -7512,7 +7512,7 @@ index 31d21de5b15a..9f8960789b2c 100644 return 0; diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 43ee86dcf2ea..758b5225b874 100644 +index 43ee86dcf2ea..7fe42c558736 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2258,6 +2258,7 @@ struct sk_buff *__pskb_copy_fclone(struct sk_buff *skb, int headroom, @@ -7532,6 +7532,26 @@ index 43ee86dcf2ea..758b5225b874 100644 skb_len_add(skb, -shiftlen); skb_len_add(tgt, shiftlen); +@@ -4983,7 +4986,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, + skb_copy_from_linear_data_offset(head_skb, offset, + skb_put(nskb, hsize), hsize); + +- skb_shinfo(nskb)->flags |= skb_shinfo(head_skb)->flags & ++ skb_shinfo(nskb)->flags |= (skb_shinfo(head_skb)->flags | ++ skb_shinfo(frag_skb)->flags) & + SKBFL_SHARED_FRAG; + + if (skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC)) +@@ -5000,6 +5004,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, + nfrags = skb_shinfo(list_skb)->nr_frags; + frag = skb_shinfo(list_skb)->frags; + frag_skb = list_skb; ++ ++ skb_shinfo(nskb)->flags |= skb_shinfo(frag_skb)->flags & SKBFL_SHARED_FRAG; ++ + if (!skb_headlen(list_skb)) { + BUG_ON(!nfrags); + } else { diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 326b58ff1118..691fc76c5508 100644 --- a/net/ipv4/tcp_output.c @@ -7545,10 +7565,36 @@ index 326b58ff1118..691fc76c5508 100644 skb_frag_page(fragfrom) == skb_frag_page(lastfrag) && skb_frag_off(fragfrom) == skb_frag_off(lastfrag) + diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c -index bc20f08a2789..58a8eae6d43e 100644 +index bc20f08a2789..e25b98d28808 100644 --- a/net/sched/act_pedit.c +++ b/net/sched/act_pedit.c -@@ -398,11 +398,12 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -323,8 +324,10 @@ static bool offset_valid(struct sk_buff *skb, int offset) + if (offset > 0 && offset > skb->len) + return false; + +- if (offset < 0 && -offset > skb_headroom(skb)) +- return false; ++ if (offset < 0) { ++ if (offset == INT_MIN || -offset > skb_headroom(skb)) ++ return false; ++ } + + return true; + } +@@ -393,17 +396,19 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, + struct tcf_pedit_key_ex *tkey_ex; + struct tcf_pedit_parms *parms; + struct tc_pedit_key *tkey; +- u32 max_offset; + int i; parms = rcu_dereference_bh(p->parms); @@ -7557,40 +7603,50 @@ index bc20f08a2789..58a8eae6d43e 100644 - skb_network_offset(skb)) + - parms->tcfp_off_max_hint; - if (skb_ensure_writable(skb, min(skb->len, max_offset))) -+ max_offset = min_t(u32, skb->len, -+ (skb_transport_header_was_set(skb) ? -+ skb_transport_offset(skb) : -+ skb_network_offset(skb)) + -+ parms->tcfp_off_max_hint); -+ if (skb_ensure_writable(skb, max_offset)) - goto done; +- goto done; ++ /* If the skb has shared frags the user is likely using zero-copy ++ * (e.g. sendfile). Those page frags may point to page-cache pages; ++ * writing into them would silently corrupt the page cache. ++ * Linearize so pedit operates on a private copy. ++ * TL;DR if you want to use ZC, don't use pedit */ ++ if (skb_has_shared_frag(skb)) { ++ if (__skb_linearize(skb)) ++ goto bad; ++ } tcf_lastuse_update(&p->tcf_tm); -@@ -414,8 +415,9 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, + tcf_action_update_bstats(&p->common, skb); +@@ -414,8 +419,9 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, for (i = parms->tcfp_nkeys; i > 0; i--, tkey++) { int offset = tkey->off; int hoffset = 0; -+ int write_offset; ++ int write_offset, write_len; u32 *ptr, hdata; - u32 val; + u32 val, write_end; int rc; if (tkey_ex) { -@@ -451,12 +453,26 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, +@@ -451,12 +457,45 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, } } - if (!offset_valid(skb, hoffset + offset)) { - pr_info_ratelimited("tc action pedit offset %d out of bounds\n", hoffset + offset); + write_offset = hoffset + offset; -+ if (!offset_valid(skb, write_offset)) { -+ pr_info_ratelimited("tc action pedit offset %d out of bounds\n", -+ write_offset); ++ if (unlikely(check_add_overflow(hoffset, offset, ++ &write_offset))) { ++ pr_info_ratelimited("tc action pedit offset overflow\n"); goto bad; } - ptr = skb_header_pointer(skb, hoffset + offset, ++ if (!offset_valid(skb, write_offset)) { ++ pr_info_ratelimited("tc action pedit offset %d out of bounds\n", ++ write_offset); ++ goto bad; ++ } ++ + /* Earlier edits can change later header-relative offsets, so + * grow the writable window from the final per-key store. + */ @@ -7603,11 +7659,24 @@ index bc20f08a2789..58a8eae6d43e 100644 + } + } + ++ if (write_offset < 0) { ++ if (skb_cow(skb, -write_offset)) ++ goto bad; ++ } else { ++ if (unlikely(check_add_overflow(write_offset, ++ (int)sizeof(hdata), ++ &write_len))) ++ goto bad; ++ if (skb_ensure_writable(skb, min_t(int, skb->len, ++ write_len))) ++ goto bad; ++ } ++ + ptr = skb_header_pointer(skb, write_offset, sizeof(hdata), &hdata); if (!ptr) goto bad; -@@ -475,7 +491,7 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, +@@ -475,7 +514,7 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, *ptr = ((*ptr & tkey->mask) ^ val); if (ptr == &hdata) diff --git a/sources b/sources index fe269bc0e..375de435e 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (linux-7.0.9.tar.xz) = 40a5553bcccd34216c4925a2e1e19abea1dbb5e33b4aa1608024f96615ba05b0bb3d063d038891f828fc2dd5c8500030a8336a7db83ef0bf1a5e082d7fb92334 -SHA512 (kernel-abi-stablelists-7.0.9.tar.xz) = 72727d5d94cbe9eae197a87c8c55ddc37b0f01e1794524cf809f28f9d140e66671d5ffe3156fd4f6401bdeccca297104d27a09a1aa3a24c04ad7f287922494ef -SHA512 (kernel-kabi-dw-7.0.9.tar.xz) = 9939a80b962e837cd5b68f33b215b6bd08be117898534590d3e12fea23a3b303245ba01fbfe01a8cd9fda3eb23555de69ebf123b568dbeffbcfb3f3b51ccb524 +SHA512 (kernel-abi-stablelists-7.0.9.tar.xz) = f750f833e6037d31902700eba018fc7dc7c1baad41a9d686846a625cffc3848f23001ff83c62414b478557acee08e27046b4b89be8028763afd0469f6410bdf5 +SHA512 (kernel-kabi-dw-7.0.9.tar.xz) = 12d0027e6c27480029ac71fc88a4a7d26b6156eea52b93ca412d171839a0bdb132dca83e0fe97377d3a551dcd7d184bb4b78534421c4c7f713812438ebc9e976