From ade235faca53fd8fb120894b3282251e71aafacb Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Fri, 15 May 2026 08:02:56 -0600 Subject: [PATCH] kernel-6.19.14-104 * Fri May 15 2026 Justin M. Forbes [6.19.14-0] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) - Revert v3 of the fragnesia fix. V4 covers an additional path (Justin M. Forbes) - ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) - Revert old fragnesia fixes in favor of more complete solution (Justin M. Forbes) - Revert old fragnesia fixes in favor of more complete solution (Justin M. Forbes) Resolves: Signed-off-by: Justin M. Forbes --- Patchlist.changelog | 9 ++++ kernel.changelog | 9 ++++ kernel.spec | 11 +++-- patch-6.19-redhat.patch | 101 +++++++++++++++++++++++++++++++++++----- sources | 4 +- 5 files changed, 117 insertions(+), 17 deletions(-) diff --git a/Patchlist.changelog b/Patchlist.changelog index de6ec4896..cc823303d 100644 --- a/Patchlist.changelog +++ b/Patchlist.changelog @@ -1,3 +1,12 @@ +https://gitlab.com/cki-project/kernel-ark/-/commit/6c2c61f8bf60b90d25f0b345cc0b3b430b395cfd + 6c2c61f8bf60b90d25f0b345cc0b3b430b395cfd net: skbuff: propagate shared-frag marker through frag-transfer helpers + +https://gitlab.com/cki-project/kernel-ark/-/commit/068abdf865b6f2ded1d57c7e35466d5360acd92a + 068abdf865b6f2ded1d57c7e35466d5360acd92a Revert v3 of the fragnesia fix. V4 covers an additional path + +https://gitlab.com/cki-project/kernel-ark/-/commit/0f596c498b46472e144c956a858c9d8f1d653d65 + 0f596c498b46472e144c956a858c9d8f1d653d65 ptrace: slightly saner 'get_dumpable()' logic + https://gitlab.com/cki-project/kernel-ark/-/commit/55e3149ad9069766a049fa848589f71d144c3407 55e3149ad9069766a049fa848589f71d144c3407 net: skbuff: propagate shared-frag marker through frag-transfer helpers diff --git a/kernel.changelog b/kernel.changelog index e3a64e520..ad5888367 100644 --- a/kernel.changelog +++ b/kernel.changelog @@ -1,3 +1,12 @@ +* Fri May 15 2026 Justin M. Forbes [6.19.14-0] +- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) +- Revert v3 of the fragnesia fix. V4 covers an additional path (Justin M. Forbes) +- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) +- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) +- Revert old fragnesia fixes in favor of more complete solution (Justin M. Forbes) +- Revert old fragnesia fixes in favor of more complete solution (Justin M. Forbes) +Resolves: + * Wed May 13 2026 Justin M. Forbes [6.19.14-0] - net: skbuff: preserve shared-frag marker during coalescing (William Bowling) - net: skbuff: propagate shared-frag marker through pskb_copy() (Hyunwoo Kim) diff --git a/kernel.spec b/kernel.spec index c50af99a5..605ea0c95 100644 --- a/kernel.spec +++ b/kernel.spec @@ -187,13 +187,13 @@ Summary: The Linux kernel %define specrpmversion 6.19.14 %define specversion 6.19.14 %define patchversion 6.19 -%define pkgrelease 103 +%define pkgrelease 104 %define kversion 6 %define tarfile_release 6.19.14 # This is needed to do merge window version magic %define patchlevel 19 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 103%{?buildid}%{?dist} +%define specrelease 104%{?buildid}%{?dist} # This defines the kabi tarball version %define kabiversion 6.19.14 @@ -4695,11 +4695,16 @@ fi\ # # %changelog -* Thu May 14 2026 Justin M. Forbes [6.19.14-103] +* Fri May 15 2026 Justin M. Forbes [6.19.14-104] - Revert "redhat/kernel.spec.template: Fix indentation of uki-virt generation code" (Justin M. Forbes) - Revert "redhat/kernel.spec.template: Simplify uki-virt signing" (Justin M. Forbes) - Revert "redhat/kernel.spec.template: Add kernel-uki-dtbloader sub-package" (Justin M. Forbes) - Revert "redhat/kernel.spec.template: Make -uki-dtbloader provide kernel-core-uname-r" (Justin M. Forbes) + +* Fri May 15 2026 Justin M. Forbes [6.19.14-0] +- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) +- Revert v3 of the fragnesia fix. V4 covers an additional path (Justin M. Forbes) +- ptrace: slightly saner 'get_dumpable()' logic (Linus Torvalds) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) - Revert old fragnesia fixes in favor of more complete solution (Justin M. Forbes) - Revert old fragnesia fixes in favor of more complete solution (Justin M. Forbes) diff --git a/patch-6.19-redhat.patch b/patch-6.19-redhat.patch index 118d8af94..fa799d9b1 100644 --- a/patch-6.19-redhat.patch +++ b/patch-6.19-redhat.patch @@ -52,13 +52,17 @@ include/linux/lsm_hook_defs.h | 1 + include/linux/mfd/bcm2835-pm.h | 7 + include/linux/rmi.h | 1 + + include/linux/sched.h | 3 + include/linux/security.h | 9 + include/trace/events/rxrpc.h | 6 +- + kernel/exit.c | 1 + kernel/module/signing.c | 9 +- + kernel/ptrace.c | 22 +- net/core/gro.c | 4 + - net/core/skbuff.c | 5 + + net/core/skbuff.c | 3 + net/ipv4/esp4.c | 3 +- net/ipv4/ip_output.c | 2 + + net/ipv4/tcp_output.c | 1 + net/ipv6/esp6.c | 3 +- net/ipv6/ip6_output.c | 2 + net/rxrpc/ar-internal.h | 1 - @@ -75,7 +79,7 @@ security/lockdown/lockdown.c | 11 + tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/prog_tests/ksyms_btf.c | 31 - - 77 files changed, 2013 insertions(+), 556 deletions(-) + 81 files changed, 2032 insertions(+), 562 deletions(-) diff --git a/Documentation/hid/intel-ish-hid.rst b/Documentation/hid/intel-ish-hid.rst index 2adc174fb576..068a5906b177 100644 @@ -3738,6 +3742,20 @@ index ab7eea01ab42..fff7c5f737fc 100644 }; int rmi_register_transport_device(struct rmi_transport_dev *xport); +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 0719862970a2..205f659e4944 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1003,6 +1003,9 @@ struct task_struct { + unsigned sched_rt_mutex:1; + #endif + ++ /* Save user-dumpable when mm goes away */ ++ unsigned user_dumpable:1; ++ + /* Bit to tell TOMOYO we're in execve(): */ + unsigned in_execve:1; + unsigned in_iowait:1; diff --git a/include/linux/security.h b/include/linux/security.h index ee88dd2d2d1f..5c816f0b8b67 100644 --- a/include/linux/security.h @@ -3801,6 +3819,18 @@ index 578b8038b211..573f2df3a2c9 100644 EM(rxrpc_conn_queue_rx_work, "QUE rx-work ") \ EM(rxrpc_conn_see_new_service_conn, "SEE new-svc ") \ EM(rxrpc_conn_see_reap_service, "SEE reap-svc") \ +diff --git a/kernel/exit.c b/kernel/exit.c +index ede3117fa7d4..bbb44fd3ffba 100644 +--- a/kernel/exit.c ++++ b/kernel/exit.c +@@ -571,6 +571,7 @@ static void exit_mm(void) + */ + smp_mb__after_spinlock(); + local_irq_disable(); ++ current->user_dumpable = (get_dumpable(mm) == SUID_DUMP_USER); + current->mm = NULL; + membarrier_update_current_mm(NULL); + enter_lazy_tlb(mm, current); diff --git a/kernel/module/signing.c b/kernel/module/signing.c index a2ff4242e623..f0d2be1ee4f1 100644 --- a/kernel/module/signing.c @@ -3824,6 +3854,50 @@ index a2ff4242e623..f0d2be1ee4f1 100644 } int module_sig_check(struct load_info *info, int flags) +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index 392ec2f75f01..0e3ab697cff5 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -272,11 +272,24 @@ static bool ptrace_has_cap(struct user_namespace *ns, unsigned int mode) + return ns_capable(ns, CAP_SYS_PTRACE); + } + ++static bool task_still_dumpable(struct task_struct *task, unsigned int mode) ++{ ++ struct mm_struct *mm = task->mm; ++ if (mm) { ++ if (get_dumpable(mm) == SUID_DUMP_USER) ++ return true; ++ return ptrace_has_cap(mm->user_ns, mode); ++ } ++ ++ if (task->user_dumpable) ++ return true; ++ return ptrace_has_cap(&init_user_ns, mode); ++} ++ + /* Returns 0 on success, -errno on denial. */ + static int __ptrace_may_access(struct task_struct *task, unsigned int mode) + { + const struct cred *cred = current_cred(), *tcred; +- struct mm_struct *mm; + kuid_t caller_uid; + kgid_t caller_gid; + +@@ -337,11 +350,8 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) + * Pairs with a write barrier in commit_creds(). + */ + smp_rmb(); +- mm = task->mm; +- if (mm && +- ((get_dumpable(mm) != SUID_DUMP_USER) && +- !ptrace_has_cap(mm->user_ns, mode))) +- return -EPERM; ++ if (!task_still_dumpable(task, mode)) ++ return -EPERM; + + return security_ptrace_access_check(task, mode); + } diff --git a/net/core/gro.c b/net/core/gro.c index ef61695fbdbb..867611d171db 100644 --- a/net/core/gro.c @@ -3851,7 +3925,7 @@ index ef61695fbdbb..867611d171db 100644 return 0; diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index a95dc0638836..3509a95427b3 100644 +index a95dc0638836..fa21147d2188 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2226,6 +2226,7 @@ struct sk_buff *__pskb_copy_fclone(struct sk_buff *skb, int headroom, @@ -3871,15 +3945,6 @@ index a95dc0638836..3509a95427b3 100644 skb_len_add(skb, -shiftlen); skb_len_add(tgt, shiftlen); -@@ -6191,6 +6194,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, - from_shinfo->frags, - from_shinfo->nr_frags * sizeof(skb_frag_t)); - to_shinfo->nr_frags += from_shinfo->nr_frags; -+ if (from_shinfo->nr_frags) -+ to_shinfo->flags |= from_shinfo->flags & SKBFL_SHARED_FRAG; - - if (!skb_cloned(from)) - from_shinfo->nr_frags = 0; diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c index 6dfc0bcdef65..6a5febbdbee4 100644 --- a/net/ipv4/esp4.c @@ -3907,6 +3972,18 @@ index ff11d3a85a36..7c005263262f 100644 wmem_alloc_delta += copy; } else if (!zc) { int i = skb_shinfo(skb)->nr_frags; +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 479afb714bdf..968c5db581a3 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2544,6 +2544,7 @@ static int tcp_clone_payload(struct sock *sk, struct sk_buff *to, + todo = min_t(int, skb_frag_size(fragfrom), + probe_size - len); + len += todo; ++ skb_shinfo(to)->flags |= skb_shinfo(skb)->flags & SKBFL_SHARED_FRAG; + if (lastfrag && + skb_frag_page(fragfrom) == skb_frag_page(lastfrag) && + skb_frag_off(fragfrom) == skb_frag_off(lastfrag) + diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c index 9f75313734f8..9c06c5a1419d 100644 --- a/net/ipv6/esp6.c diff --git a/sources b/sources index a56274791..3c039f978 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (linux-6.19.14.tar.xz) = d9e52522dba3d8727265668b458d6e0231663f113f74aff4ab17328dee6689bf2a2865dca168c3ff47c3575f981c8fcc497297743859353462c3e0ebd314332c -SHA512 (kernel-abi-stablelists-6.19.14.tar.xz) = 4946b91fe91f9cab30b558d8e2f00dbc21387443eb2c45d4df8a8389bf3efceb7245895eca356ecbacd22fd4b4d38b16e92e925e2358d5d4c8e687599dd892d7 -SHA512 (kernel-kabi-dw-6.19.14.tar.xz) = ed74d36dbfd413db308f05e09a686c3658437141f0cb13fe55d8e12f312d41bbe5616e8ab8cbbf8302ae8fdd325e7a0b8523a785b283f7275007a02849b675eb +SHA512 (kernel-abi-stablelists-6.19.14.tar.xz) = fff6bed96f98e8bd5045ff330241bbee1a3922b96c47b1d2b6412184b42ec5f7c910ffb8a311393db5eff1e8c75f909e872eb89cf60826bf84fa4cef78a309da +SHA512 (kernel-kabi-dw-6.19.14.tar.xz) = 7bb93855824bfc0c4f362a3e3434ea7deaf7923d7be21f84e42bbdd07b4a2ef8f245cd3b2643f2085718029ff69a5b61017d29a7b1d9fd44073bf4bdfdee5672