diff --git a/Patchlist.changelog b/Patchlist.changelog index 37e92c5b9..6a6f2c389 100644 --- a/Patchlist.changelog +++ b/Patchlist.changelog @@ -1,3 +1,45 @@ +https://gitlab.com/cki-project/kernel-ark/-/commit/e8406125b1518ccea6da3a6d24c083d1266e86c2 + e8406125b1518ccea6da3a6d24c083d1266e86c2 Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 + +https://gitlab.com/cki-project/kernel-ark/-/commit/6a286cd1edf4510f39fa76e9e9c74578dd6d066a + 6a286cd1edf4510f39fa76e9e9c74578dd6d066a ACPI: scan: Do not combine resources that overlap completely + +https://gitlab.com/cki-project/kernel-ark/-/commit/c83e3a20e2c864a3a262a68715b003e34cd83693 + c83e3a20e2c864a3a262a68715b003e34cd83693 ACPI: scan: Avoid registering platform devices with resource overlaps + +https://gitlab.com/cki-project/kernel-ark/-/commit/a3cf371d7ad3947bc73d6fb68226f2cb93b4e703 + a3cf371d7ad3947bc73d6fb68226f2cb93b4e703 page_pool: keep frag_offset aligned for odd-sized requests + +https://gitlab.com/cki-project/kernel-ark/-/commit/16fd65fad1784d16d1e38ca90bf672fe6dbd3703 + 16fd65fad1784d16d1e38ca90bf672fe6dbd3703 media: i2c: cvs: Pass link frequency explicitly to csi_set_link_cfg() + +https://gitlab.com/cki-project/kernel-ark/-/commit/dd40a4985ebc29b4d1e12960b4e7cf715128722b + dd40a4985ebc29b4d1e12960b4e7cf715128722b media: i2c: cvs: Add NVL ACPI ID + +https://gitlab.com/cki-project/kernel-ark/-/commit/2aafb1ce0a15a4453bcb2b6501e2b759c6558a7d + 2aafb1ce0a15a4453bcb2b6501e2b759c6558a7d media: i2c: cvs: Add IPU8 PCI device ID + +https://gitlab.com/cki-project/kernel-ark/-/commit/2efed24569953e88ce1f9a6ed579a71bafece833 + 2efed24569953e88ce1f9a6ed579a71bafece833 random: Drop the extrng module reference when import_ubuf() fails + +https://gitlab.com/cki-project/kernel-ark/-/commit/e597dba8c0eb131768f5aa3498822d52c6cb356a + e597dba8c0eb131768f5aa3498822d52c6cb356a crypto: af_alg - Stop after finding name in allowlist + +https://gitlab.com/cki-project/kernel-ark/-/commit/dfb9f20d58fe088049b7a4e5f7b0597fbe39a76d + dfb9f20d58fe088049b7a4e5f7b0597fbe39a76d crypto: af_alg - Replace 'bool privileged' with flags + +https://gitlab.com/cki-project/kernel-ark/-/commit/9ce90cf073745eb142bfe1669e9b8f6625a763b6 + 9ce90cf073745eb142bfe1669e9b8f6625a763b6 crypto: af_alg - Make cbc(paes) privileged-only + +https://gitlab.com/cki-project/kernel-ark/-/commit/76bcc03f09041646f7bdcf3020b756b5bd8e09db + 76bcc03f09041646f7bdcf3020b756b5bd8e09db crypto: af_alg - clean up kernel-doc warnings + +https://gitlab.com/cki-project/kernel-ark/-/commit/13d0095a68c6be26a179e14df996cab6be9ee9f1 + 13d0095a68c6be26a179e14df996cab6be9ee9f1 crypto: af_alg - Allow additional ciphers for cryptsetup + +https://gitlab.com/cki-project/kernel-ark/-/commit/e5a7d83cf810d0227ce161a6b2a94a1897f843ce + e5a7d83cf810d0227ce161a6b2a94a1897f843ce crypto: af_alg - Add af_alg_restrict sysctl, defaulting to 1 + https://gitlab.com/cki-project/kernel-ark/-/commit/d088d8766e390303a72e82a86d2970f17e6846df d088d8766e390303a72e82a86d2970f17e6846df redhat: Add DENYLIST.rhel to BPF selftests diff --git a/kernel.changelog b/kernel.changelog index 6d85e7e44..1ac197fc8 100644 --- a/kernel.changelog +++ b/kernel.changelog @@ -1,3 +1,22 @@ +* Wed Sep 02 2026 Justin M. Forbes [7.2.3-0] +- Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 (Junjie Cao) +- ACPI: scan: Do not combine resources that overlap completely (Rafael J. Wysocki) +- ACPI: scan: Avoid registering platform devices with resource overlaps (Rafael J. Wysocki) +- page_pool: keep frag_offset aligned for odd-sized requests (Florian Schauer) [2521546 2521847] +- media: i2c: cvs: Pass link frequency explicitly to csi_set_link_cfg() (Laurent Pinchart) +- media: i2c: cvs: Add NVL ACPI ID (Arun T) +- media: i2c: cvs: Add IPU8 PCI device ID (Arun T) +- random: Drop the extrng module reference when import_ubuf() fails (Junjie Cao) [2524262] +- Add mechanism to back out the af_alg_restrict sysctl (Justin M. Forbes) +- crypto: af_alg - Stop after finding name in allowlist (Eric Biggers) +- crypto: af_alg - Replace 'bool privileged' with flags (Eric Biggers) +- crypto: af_alg - Make cbc(paes) privileged-only (Eric Biggers) +- crypto: af_alg - clean up kernel-doc warnings (Randy Dunlap) +- crypto: af_alg - Allow additional ciphers for cryptsetup (Eric Biggers) +- crypto: af_alg - Add af_alg_restrict sysctl, defaulting to 1 (Eric Biggers) +- Linux v7.2.3 +Resolves: rhbz#2521546, rhbz#2521847, rhbz#2524262 + * Fri Aug 28 2026 Justin M. Forbes [7.2.2-0] - Linux v7.2.2 Resolves: diff --git a/kernel.spec b/kernel.spec index c787b400b..44fe40595 100644 --- a/kernel.spec +++ b/kernel.spec @@ -192,18 +192,18 @@ Summary: The Linux kernel # the --with-release option overrides this setting.) %define debugbuildsenabled 1 # define buildid .local -%define specrpmversion 7.2.2 -%define specversion 7.2.2 +%define specrpmversion 7.2.3 +%define specversion 7.2.3 %define patchversion 7.2 %define pkgrelease 300 %define kversion 7 -%define tarfile_release 7.2.2 +%define tarfile_release 7.2.3 # This is needed to do merge window version magic %define patchlevel 2 # This allows pkg_release to have configurable %%{?dist} tag %define specrelease 300%{?buildid}%{?dist} # This defines the kabi tarball version -%define kabiversion 7.2.2 +%define kabiversion 7.2.3 # If this variable is set to 1, a bpf selftests build failure will cause a # fatal kernel package build error @@ -4964,6 +4964,24 @@ fi\ # # %changelog +* Wed Sep 02 2026 Justin M. Forbes [7.2.3-0] +- Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728 (Junjie Cao) +- ACPI: scan: Do not combine resources that overlap completely (Rafael J. Wysocki) +- ACPI: scan: Avoid registering platform devices with resource overlaps (Rafael J. Wysocki) +- page_pool: keep frag_offset aligned for odd-sized requests (Florian Schauer) [2521546 2521847] +- media: i2c: cvs: Pass link frequency explicitly to csi_set_link_cfg() (Laurent Pinchart) +- media: i2c: cvs: Add NVL ACPI ID (Arun T) +- media: i2c: cvs: Add IPU8 PCI device ID (Arun T) +- random: Drop the extrng module reference when import_ubuf() fails (Junjie Cao) [2524262] +- Add mechanism to back out the af_alg_restrict sysctl (Justin M. Forbes) +- crypto: af_alg - Stop after finding name in allowlist (Eric Biggers) +- crypto: af_alg - Replace 'bool privileged' with flags (Eric Biggers) +- crypto: af_alg - Make cbc(paes) privileged-only (Eric Biggers) +- crypto: af_alg - clean up kernel-doc warnings (Randy Dunlap) +- crypto: af_alg - Allow additional ciphers for cryptsetup (Eric Biggers) +- crypto: af_alg - Add af_alg_restrict sysctl, defaulting to 1 (Eric Biggers) +- Linux v7.2.3 + * Fri Aug 28 2026 Justin M. Forbes [7.2.2-0] - Linux v7.2.2 diff --git a/patch-7.2-redhat.patch b/patch-7.2-redhat.patch index 2a034cdbc..250476a65 100644 --- a/patch-7.2-redhat.patch +++ b/patch-7.2-redhat.patch @@ -1,3 +1,5 @@ + Documentation/admin-guide/sysctl/crypto.rst | 36 ++++++ + Documentation/crypto/userspace-if.rst | 13 ++- Makefile | 30 +++++ arch/arm/Kconfig | 4 +- arch/arm64/Kconfig | 2 +- @@ -6,45 +8,133 @@ arch/s390/kernel/ipl.c | 5 + arch/s390/kernel/setup.c | 4 + arch/x86/kernel/setup.c | 22 ++-- + crypto/af_alg.c | 76 +++++++++++- crypto/akcipher.c | 3 +- + crypto/algif_aead.c | 11 ++ + crypto/algif_hash.c | 24 ++++ + crypto/algif_rng.c | 9 ++ + crypto/algif_skcipher.c | 27 ++++- crypto/dh.c | 25 ++++ crypto/seqiv.c | 15 ++- crypto/sig.c | 3 +- crypto/testmgr.c | 6 +- + drivers/acpi/acpi_platform.c | 45 +++++++- drivers/acpi/apei/hest.c | 8 ++ drivers/acpi/irq.c | 17 ++- drivers/acpi/scan.c | 9 ++ drivers/ata/libahci.c | 18 +++ + drivers/bluetooth/btrtl.c | 13 --- + drivers/bluetooth/btusb.c | 8 ++ drivers/char/ipmi/ipmi_dmi.c | 15 +++ drivers/char/ipmi/ipmi_msghandler.c | 16 ++- - drivers/char/random.c | 126 ++++++++++++++++++++- + drivers/char/random.c | 128 ++++++++++++++++++++- drivers/firmware/efi/Makefile | 1 + drivers/firmware/efi/efi.c | 124 +++++++++++++++----- drivers/firmware/efi/libstub/fdt.c | 5 + drivers/firmware/efi/libstub/secureboot.c | 14 ++- - drivers/firmware/efi/secureboot.c | 38 +++++++ - drivers/hwtracing/coresight/coresight-etm4x-core.c | 19 ++++ + drivers/firmware/efi/secureboot.c | 38 ++++++ + drivers/hwtracing/coresight/coresight-etm4x-core.c | 19 +++ drivers/iommu/iommu.c | 22 ++++ + drivers/media/i2c/cvs/core.c | 3 + + drivers/media/i2c/cvs/icvs.h | 2 - + drivers/media/i2c/cvs/v4l2.c | 17 ++- drivers/pci/quirks.c | 24 ++++ drivers/usb/core/hub.c | 7 ++ + include/crypto/if_alg.h | 42 ++++--- include/linux/crypto.h | 2 + include/linux/efi.h | 22 ++-- include/linux/lsm_hook_defs.h | 1 + include/linux/random.h | 10 ++ include/linux/security.h | 9 ++ kernel/module/signing.c | 9 +- + net/core/page_pool.c | 3 +- scripts/Makefile.lib | 3 + scripts/tags.sh | 2 + security/integrity/platform_certs/load_uefi.c | 6 +- security/lockdown/Kconfig | 13 +++ security/lockdown/lockdown.c | 11 ++ - tools/testing/selftests/bpf/DENYLIST.rhel | 76 +++++++++++++ + tools/testing/selftests/bpf/DENYLIST.rhel | 76 ++++++++++++ tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/prog_tests/ksyms_btf.c | 31 ----- - 43 files changed, 701 insertions(+), 106 deletions(-) + 58 files changed, 979 insertions(+), 159 deletions(-) +diff --git a/Documentation/admin-guide/sysctl/crypto.rst b/Documentation/admin-guide/sysctl/crypto.rst +index b707bd314a64..9a1bd53287f4 100644 +--- a/Documentation/admin-guide/sysctl/crypto.rst ++++ b/Documentation/admin-guide/sysctl/crypto.rst +@@ -7,6 +7,42 @@ kernel configuration: + + .. contents:: :local: + ++.. _af_alg_restrict: ++ ++af_alg_restrict ++=============== ++ ++Controls the level of restriction of AF_ALG. ++ ++AF_ALG is a deprecated and rarely-used userspace interface that is a ++frequent source of vulnerabilities. It also unnecessarily exposes a ++large number of kernel implementation details. For more information ++about AF_ALG, see :ref:`Documentation/crypto/userspace-if.rst ++`. ++ ++Starting in Linux v7.3, AF_ALG supports only a limited set of ++algorithms by default. This sysctl allows the system administrator to ++remove this restriction when needed for compatibility reasons, or to ++go further and disable AF_ALG entirely. The default value is 1. ++ ++=== ================================================================== ++0 AF_ALG is unrestricted. ++ ++1 AF_ALG is supported with a limited list of algorithms. The list ++ is designed for compatibility with known users such as iwd and ++ bluez that haven't yet been fixed to use userspace crypto code. ++ ++ Specifically, there is an allowlist for unprivileged processes ++ and a somewhat longer allowlist for processes that hold ++ CAP_SYS_ADMIN or CAP_NET_ADMIN in the initial user namespace. ++ ++ Attempts to bind() an AF_ALG socket with a disallowed algorithm ++ fail with ENOENT. ++ ++2 AF_ALG is completely disabled. Attempts to create an AF_ALG ++ socket fail with EAFNOSUPPORT. ++=== ================================================================== ++ + fips_enabled + ============ + +diff --git a/Documentation/crypto/userspace-if.rst b/Documentation/crypto/userspace-if.rst +index ab93300c8e04..d6194346e366 100644 +--- a/Documentation/crypto/userspace-if.rst ++++ b/Documentation/crypto/userspace-if.rst +@@ -1,3 +1,5 @@ ++.. _crypto_userspace_interface: ++ + User Space Interface + ==================== + +@@ -12,9 +14,14 @@ AF_ALG is insecure and is deprecated. Originally added to the kernel in 2010, + most kernel developers now consider it to be a mistake. Support for hardware + accelerators, which was the original purpose of AF_ALG, has been removed. + +-AF_ALG continues to be supported only for backwards compatibility. On systems +-where no programs using AF_ALG remain, the support for it should be disabled by +-disabling ``CONFIG_CRYPTO_USER_API_*``. ++AF_ALG continues to be supported only for backwards compatibility. ++ ++Starting in Linux v7.3, the set of algorithms supported by AF_ALG is limited by ++default. See :ref:`/proc/sys/crypto/af_alg_restrict `. ++ ++On systems where no programs using AF_ALG remain, the support for it should be ++disabled entirely by setting ``/proc/sys/crypto/af_alg_restrict`` to 2 or by ++disabling ``CONFIG_CRYPTO_USER_API_*`` in the kernel configuration. + + Deprecation + ----------- diff --git a/Makefile b/Makefile -index ee964fb0c056..a579dc02a0fe 100644 +index 150b1c1d7bed..de832cf47e7b 100644 --- a/Makefile +++ b/Makefile @@ -358,6 +358,17 @@ ifneq ($(filter install,$(MAKECMDGOALS)),) @@ -273,6 +363,140 @@ index 46882ce79c3a..9c73814c31e0 100644 reserve_initrd(); +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index cce000e8590e..ab84c4488a15 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -8,6 +8,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -22,10 +23,28 @@ + #include + #include + #include ++#include ++#include + #include + #include + #include + ++static int af_alg_restrict = 1; ++ ++static const struct ctl_table af_alg_table[] = { ++ { ++ .procname = "af_alg_restrict", ++ .data = &af_alg_restrict, ++ .maxlen = sizeof(int), ++ .mode = 0644, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = SYSCTL_ZERO, ++ .extra2 = SYSCTL_TWO, ++ }, ++}; ++ ++static struct ctl_table_header *af_alg_header; ++ + struct alg_type_list { + const struct af_alg_type *type; + struct list_head list; +@@ -110,6 +129,43 @@ int af_alg_unregister_type(const struct af_alg_type *type) + } + EXPORT_SYMBOL_GPL(af_alg_unregister_type); + ++static bool af_alg_capable(void) ++{ ++ return ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN) || ++ capable(CAP_SYS_ADMIN); ++} ++ ++int af_alg_check_restriction(const char *name, ++ const struct af_alg_allowlist_entry allowlist[]) ++{ ++ int level = READ_ONCE(af_alg_restrict); ++ ++ if (level == 0) ++ return 0; ++ if (level == 1) { ++ for (const struct af_alg_allowlist_entry *ent = allowlist; ++ ent->name; ent++) { ++ if (strcmp(name, ent->name) == 0) { ++ if ((ent->flags & AF_ALG_UNPRIVILEGED) || ++ af_alg_capable()) ++ return 0; ++ /* List contains at most one entry per name. */ ++ break; ++ } ++ } ++ } ++ /* ++ * Use -ENOENT (the error code for "algorithm not found") instead of ++ * -EACCES or -EPERM, for the highest chance of correctly triggering ++ * fallback code paths in userspace programs. ++ * ++ * Don't log a warning, since it would be noisy. iwd tries to bind a ++ * bunch of algorithms that it never uses. ++ */ ++ return -ENOENT; ++} ++EXPORT_SYMBOL_GPL(af_alg_check_restriction); ++ + static void alg_do_release(const struct af_alg_type *type, void *private) + { + if (!type) +@@ -506,6 +562,9 @@ static int alg_create(struct net *net, struct socket *sock, int protocol, + struct sock *sk; + int err; + ++ if (READ_ONCE(af_alg_restrict) == 2) ++ return -EAFNOSUPPORT; ++ + if (sock->type != SOCK_SEQPACKET) + return -ESOCKTNOSUPPORT; + if (protocol != 0) +@@ -1222,27 +1281,32 @@ EXPORT_SYMBOL_GPL(af_alg_get_rsgl); + + static int __init af_alg_init(void) + { +- int err = proto_register(&alg_proto, 0); ++ int err; ++ ++ af_alg_header = register_sysctl("crypto", af_alg_table); + ++ err = proto_register(&alg_proto, 0); + if (err) +- goto out; ++ goto out_unregister_sysctl; + + err = sock_register(&alg_family); +- if (err != 0) ++ if (err) + goto out_unregister_proto; + +-out: +- return err; ++ return 0; + + out_unregister_proto: + proto_unregister(&alg_proto); +- goto out; ++out_unregister_sysctl: ++ unregister_sysctl_table(af_alg_header); ++ return err; + } + + static void __exit af_alg_exit(void) + { + sock_unregister(PF_ALG); + proto_unregister(&alg_proto); ++ unregister_sysctl_table(af_alg_header); + } + + module_init(af_alg_init); diff --git a/crypto/akcipher.c b/crypto/akcipher.c index 630bb19738be..8da7eedce31e 100644 --- a/crypto/akcipher.c @@ -287,6 +511,151 @@ index 630bb19738be..8da7eedce31e 100644 if (!alg->set_priv_key) alg->set_priv_key = akcipher_default_set_key; +diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c +index 787aac8aeb24..5574e2d70539 100644 +--- a/crypto/algif_aead.c ++++ b/crypto/algif_aead.c +@@ -34,6 +34,11 @@ + #include + #include + ++static const struct af_alg_allowlist_entry aead_allowlist[] = { ++ { "ccm(aes)" }, /* bluez */ ++ {}, ++}; ++ + static inline bool aead_sufficient_data(struct sock *sk) + { + struct alg_sock *ask = alg_sk(sk); +@@ -344,6 +349,12 @@ static struct proto_ops algif_aead_ops_nokey = { + + static void *aead_bind(const char *name) + { ++ int err; ++ ++ err = af_alg_check_restriction(name, aead_allowlist); ++ if (err) ++ return ERR_PTR(err); ++ + return crypto_alloc_aead(name, 0, AF_ALG_CRYPTOAPI_MASK); + } + +diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c +index 5452ad6c1506..6e8b5fb82a7f 100644 +--- a/crypto/algif_hash.c ++++ b/crypto/algif_hash.c +@@ -16,6 +16,24 @@ + #include + #include + ++static const struct af_alg_allowlist_entry hash_allowlist[] = { ++ { "cmac(aes)" }, /* iwd, bluez */ ++ { "hmac(md5)" }, /* iwd */ ++ { "hmac(sha1)" }, /* iwd */ ++ { "hmac(sha224)" }, /* iwd */ ++ { "hmac(sha256)" }, /* iwd */ ++ { "hmac(sha384)" }, /* iwd */ ++ { "hmac(sha512)" }, /* iwd, sha512hmac */ ++ { "md4" }, /* iwd */ ++ { "md5" }, /* iwd */ ++ { "sha1", AF_ALG_UNPRIVILEGED }, /* iwd, iproute2 < 7.0 */ ++ { "sha224" }, /* iwd */ ++ { "sha256" }, /* iwd */ ++ { "sha384" }, /* iwd */ ++ { "sha512" }, /* iwd */ ++ {}, ++}; ++ + struct hash_ctx { + struct af_alg_sgl sgl; + +@@ -382,6 +400,12 @@ static struct proto_ops algif_hash_ops_nokey = { + + static void *hash_bind(const char *name) + { ++ int err; ++ ++ err = af_alg_check_restriction(name, hash_allowlist); ++ if (err) ++ return ERR_PTR(err); ++ + return crypto_alloc_ahash(name, 0, AF_ALG_CRYPTOAPI_MASK); + } + +diff --git a/crypto/algif_rng.c b/crypto/algif_rng.c +index 4dfe7899f8fa..bd522915d56d 100644 +--- a/crypto/algif_rng.c ++++ b/crypto/algif_rng.c +@@ -50,6 +50,10 @@ MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Stephan Mueller "); + MODULE_DESCRIPTION("User-space interface for random number generators"); + ++static const struct af_alg_allowlist_entry rng_allowlist[] = { ++ {}, ++}; ++ + struct rng_ctx { + #define MAXSIZE 128 + unsigned int len; +@@ -201,6 +205,11 @@ static void *rng_bind(const char *name) + { + struct rng_parent_ctx *pctx; + struct crypto_rng *rng; ++ int err; ++ ++ err = af_alg_check_restriction(name, rng_allowlist); ++ if (err) ++ return ERR_PTR(err); + + pctx = kzalloc_obj(*pctx); + if (!pctx) +diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c +index 035fed7db81f..d469a3ec1491 100644 +--- a/crypto/algif_skcipher.c ++++ b/crypto/algif_skcipher.c +@@ -35,6 +35,24 @@ + #include + #include + ++static const struct af_alg_allowlist_entry skcipher_allowlist[] = { ++ { "adiantum(xchacha12,aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */ ++ { "adiantum(xchacha20,aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */ ++ { "cbc(aes)" }, /* iwd */ ++ { "cbc(des)" }, /* iwd */ ++ { "cbc(des3_ede)" }, /* iwd */ ++ { "cbc(paes)" }, /* caam and others */ ++ { "ctr(aes)" }, /* iwd */ ++ { "ecb(aes)" }, /* iwd, bluez */ ++ { "ecb(des)" }, /* iwd */ ++ { "hctr2(aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */ ++ { "xts(aes)", AF_ALG_UNPRIVILEGED }, /* cryptsetup benchmark */ ++ { "xts(camellia)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */ ++ { "xts(serpent)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */ ++ { "xts(twofish)", AF_ALG_UNPRIVILEGED }, /* cryptsetup */ ++ {}, ++}; ++ + static int skcipher_sendmsg(struct socket *sock, struct msghdr *msg, + size_t size) + { +@@ -310,12 +328,13 @@ static struct proto_ops algif_skcipher_ops_nokey = { + + static void *skcipher_bind(const char *name) + { +- u32 mask = AF_ALG_CRYPTOAPI_MASK; ++ int err; + +- if (strcmp(name, "cbc(paes)") == 0) +- mask = 0; ++ err = af_alg_check_restriction(name, skcipher_allowlist); ++ if (err) ++ return ERR_PTR(err); + +- return crypto_alloc_skcipher(name, 0, mask); ++ return crypto_alloc_skcipher(name, 0, AF_ALG_CRYPTOAPI_MASK); + } + + static void skcipher_release(void *private) diff --git a/crypto/dh.c b/crypto/dh.c index 7ad4768716c8..01ccc24db074 100644 --- a/crypto/dh.c @@ -411,6 +780,78 @@ index 4958211fbfa9..ee6d34885696 100644 .suite = { .kpp = __VECS(ecdh_p384_tv_template) } +diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c +index a09636a4168e..e3c77a65f61c 100644 +--- a/drivers/acpi/acpi_platform.c ++++ b/drivers/acpi/acpi_platform.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -71,6 +72,42 @@ static struct notifier_block acpi_platform_notifier = { + .notifier_call = acpi_platform_device_remove_notify, + }; + ++static unsigned int acpi_platform_adjust_resources(struct acpi_device *adev, ++ struct resource *new_res, ++ struct resource *resources, ++ unsigned int count) ++{ ++ unsigned int i; ++ ++ if (!(new_res->flags & (IORESOURCE_IO | IORESOURCE_MEM))) ++ return count; ++ ++ for (i = 0; i < count; ) { ++ struct resource *res = &resources[i]; ++ ++ /* ++ * Look for overlaps of resources of the same type that would ++ * cause resource insertion to fail down the road. ++ */ ++ if (__resource_contains_unbound(res, new_res) || ++ __resource_contains_unbound(new_res, res) || ++ resource_type(new_res) != resource_type(res) || ++ !resource_union(new_res, res, new_res)) { ++ i++; ++ continue; ++ } ++ ++ dev_info(&adev->dev, "%pR expanded due to overlap\n", new_res); ++ /* ++ * Eliminate the previously processed resource that overlapped ++ * with the new one because it is not necessary any more. ++ */ ++ memmove(res, res + 1, (--count - i) * sizeof(*res)); ++ } ++ ++ return count; ++} ++ + static void acpi_platform_fill_resource(struct acpi_device *adev, + const struct resource *src, struct resource *dest) + { +@@ -151,10 +188,14 @@ struct platform_device *acpi_create_platform_device(struct acpi_device *adev, + return ERR_PTR(-ENOMEM); + } + count = 0; +- list_for_each_entry(rentry, &resource_list, node) ++ list_for_each_entry(rentry, &resource_list, node) { ++ count = acpi_platform_adjust_resources(adev, ++ rentry->res, ++ resources, ++ count); + acpi_platform_fill_resource(adev, rentry->res, + &resources[count++]); +- ++ } + acpi_dev_free_resource_list(&resource_list); + } + } diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c index 20d757687e3d..90a13f20f052 100644 --- a/drivers/acpi/apei/hest.c @@ -522,6 +963,63 @@ index 6d72eb017b49..0a6701eb8d37 100644 /* wait for engine to stop. This could be as long as 500 msec */ tmp = ata_wait_register(ap, port_mmio + PORT_CMD, PORT_CMD_LIST_ON, PORT_CMD_LIST_ON, 1, 500); +diff --git a/drivers/bluetooth/btrtl.c b/drivers/bluetooth/btrtl.c +index 7f54d2d2d13a..03fa9409e3ee 100644 +--- a/drivers/bluetooth/btrtl.c ++++ b/drivers/bluetooth/btrtl.c +@@ -1343,19 +1343,6 @@ void btrtl_set_quirks(struct hci_dev *hdev, struct btrtl_device_info *btrtl_dev) + if (!btrtl_dev->ic_info) + return; + +- switch (btrtl_dev->project_id) { +- case CHIP_ID_8761B: +- /* RTL8761B/BU reports HCI version 5.1 but does not support +- * the LE Extended Scan commands (Opcode 0x2042), causing +- * repeated -EBUSY failures when BlueZ attempts extended +- * scanning while a connection is active. +- */ +- hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN); +- break; +- default: +- break; +- } +- + switch (btrtl_dev->ic_info->lmp_subver) { + case RTL_ROM_LMP_8703B: + /* 8723CS reports two pages for local ext features, +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 184e95c1625e..adee77ebd9aa 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -67,6 +67,7 @@ static struct usb_driver btusb_driver; + #define BTUSB_INTEL_NO_WBS_SUPPORT BIT(26) + #define BTUSB_ACTIONS_SEMI BIT(27) + #define BTUSB_BARROT BIT(28) ++#define BTUSB_BROKEN_EXT_SCAN BIT(29) + + static const struct usb_device_id btusb_table[] = { + /* Generic Bluetooth USB device */ +@@ -615,6 +616,10 @@ static const struct usb_device_id quirks_table[] = { + { USB_DEVICE(0x0489, 0xe130), .driver_info = BTUSB_REALTEK | + BTUSB_WIDEBAND_SPEECH }, + ++ /* Realtek 8761BU Bluetooth devices */ ++ { USB_DEVICE(0x0bda, 0xa728), .driver_info = BTUSB_REALTEK | ++ BTUSB_BROKEN_EXT_SCAN }, ++ + /* Realtek Bluetooth devices */ + { USB_VENDOR_AND_INTERFACE_INFO(0x0bda, 0xe0, 0x01, 0x01), + .driver_info = BTUSB_REALTEK }, +@@ -4366,6 +4371,9 @@ static int btusb_probe(struct usb_interface *intf, + if (id->driver_info & BTUSB_INVALID_LE_STATES) + hci_set_quirk(hdev, HCI_QUIRK_BROKEN_LE_STATES); + ++ if (id->driver_info & BTUSB_BROKEN_EXT_SCAN) ++ hci_set_quirk(hdev, HCI_QUIRK_BROKEN_EXT_SCAN); ++ + if (id->driver_info & BTUSB_DIGIANSWER) { + data->cmdreq_type = USB_TYPE_VENDOR; + hci_set_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE); diff --git a/drivers/char/ipmi/ipmi_dmi.c b/drivers/char/ipmi/ipmi_dmi.c index 505e32911c34..26f7ee0ccf40 100644 --- a/drivers/char/ipmi/ipmi_dmi.c @@ -584,7 +1082,7 @@ index ab4c85f3d6fe..92de1165f6ef 100644 rv = ipmi_register_driver(); mutex_unlock(&ipmi_interfaces_mutex); diff --git a/drivers/char/random.c b/drivers/char/random.c -index b4da1fb976c1..1e112e2b405b 100644 +index b4da1fb976c1..7ff4dd4d9836 100644 --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -51,9 +51,11 @@ @@ -659,7 +1157,7 @@ index b4da1fb976c1..1e112e2b405b 100644 if (flags & ~(GRND_NONBLOCK | GRND_RANDOM | GRND_INSECURE)) return -EINVAL; -@@ -1392,6 +1417,21 @@ SYSCALL_DEFINE3(getrandom, char __user *, ubuf, size_t, len, unsigned int, flags +@@ -1392,6 +1417,23 @@ SYSCALL_DEFINE3(getrandom, char __user *, ubuf, size_t, len, unsigned int, flags if ((flags & (GRND_INSECURE | GRND_RANDOM)) == (GRND_INSECURE | GRND_RANDOM)) return -EINVAL; @@ -671,8 +1169,10 @@ index b4da1fb976c1..1e112e2b405b 100644 + + if (rng) { + ret = import_ubuf(ITER_DEST, ubuf, len, &iter); -+ if (unlikely(ret)) ++ if (unlikely(ret)) { ++ module_put(rng->owner); + return ret; ++ } + ret = rng->extrng_read_iter(&iter, !!(flags & GRND_RANDOM)); + module_put(rng->owner); + return ret; @@ -681,7 +1181,7 @@ index b4da1fb976c1..1e112e2b405b 100644 if (!crng_ready() && !(flags & GRND_INSECURE)) { if (flags & GRND_NONBLOCK) return -EAGAIN; -@@ -1412,6 +1452,12 @@ static __poll_t random_poll(struct file *file, poll_table *wait) +@@ -1412,6 +1454,12 @@ static __poll_t random_poll(struct file *file, poll_table *wait) return crng_ready() ? EPOLLIN | EPOLLRDNORM : EPOLLOUT | EPOLLWRNORM; } @@ -694,7 +1194,7 @@ index b4da1fb976c1..1e112e2b405b 100644 static ssize_t write_pool_user(struct iov_iter *iter) { u8 block[BLAKE2S_BLOCK_SIZE]; -@@ -1552,7 +1598,58 @@ static int random_fasync(int fd, struct file *filp, int on) +@@ -1552,7 +1600,58 @@ static int random_fasync(int fd, struct file *filp, int on) return fasync_helper(fd, filp, on, &fasync); } @@ -753,7 +1253,7 @@ index b4da1fb976c1..1e112e2b405b 100644 .read_iter = random_read_iter, .write_iter = random_write_iter, .poll = random_poll, -@@ -1565,6 +1662,7 @@ const struct file_operations random_fops = { +@@ -1565,6 +1664,7 @@ const struct file_operations random_fops = { }; const struct file_operations urandom_fops = { @@ -761,7 +1261,7 @@ index b4da1fb976c1..1e112e2b405b 100644 .read_iter = urandom_read_iter, .write_iter = random_write_iter, .unlocked_ioctl = random_ioctl, -@@ -1575,6 +1673,32 @@ const struct file_operations urandom_fops = { +@@ -1575,6 +1675,32 @@ const struct file_operations urandom_fops = { .splice_write = iter_file_splice_write, }; @@ -1138,6 +1638,118 @@ index e8f13dcebbde..dd7014ca962c 100644 /** * iommu_setup_default_domain - Set the default_domain for the group * @group: Group to change +diff --git a/drivers/media/i2c/cvs/core.c b/drivers/media/i2c/cvs/core.c +index fe9e59ac311c..d4a3b9c3bab1 100644 +--- a/drivers/media/i2c/cvs/core.c ++++ b/drivers/media/i2c/cvs/core.c +@@ -31,6 +31,7 @@ + + #define PCI_DEVICE_ID_INTEL_IPU7 0x645d /* MTL / LNL */ + #define PCI_DEVICE_ID_INTEL_IPU7P5 0xb05d /* ARL / PTL */ ++#define PCI_DEVICE_ID_INTEL_IPU8 0xd719 /* NVL */ + + /* + * IPU7 PCI device IDs not covered by ipu6_pci_tbl in ipu6-pci-table.h. +@@ -39,6 +40,7 @@ + static const struct pci_device_id icvs_ipu7_tbl[] = { + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IPU7) }, + { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IPU7P5) }, ++ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IPU8) }, + { } + }; + +@@ -962,6 +964,7 @@ static const struct acpi_device_id intel_cvs_acpi_match[] = { + { "INTC10DE" }, /* LNL */ + { "INTC10E0" }, /* ARL */ + { "INTC10E1" }, /* PTL */ ++ { "INTC10FA" }, /* NVL */ + { } + }; + MODULE_DEVICE_TABLE(acpi, intel_cvs_acpi_match); +diff --git a/drivers/media/i2c/cvs/icvs.h b/drivers/media/i2c/cvs/icvs.h +index cfa8ef5d975c..17beb0920dd2 100644 +--- a/drivers/media/i2c/cvs/icvs.h ++++ b/drivers/media/i2c/cvs/icvs.h +@@ -432,7 +432,6 @@ enum icvs_state { + * @freq_ctrl: (future) frequency control pointer + * @pads: Local media pads (sink/source) + * @nr_of_lanes: Active CSI-2 lane count +- * @link_freq: Current link frequency (Hz) + * @ipu_link: PM runtime device link (IPU consumer, CVS supplier) + * @res: Resource capability (light/full) + * @caps: Reported device protocol capabilities +@@ -458,7 +457,6 @@ struct icvs { + struct v4l2_ctrl *freq_ctrl; + struct media_pad pads[ICVS_CSI_NUM_PADS]; + u32 nr_of_lanes; +- u64 link_freq; + struct device_link *ipu_link; + enum icvs_resources res; + struct icvs_dev_capabilities caps; +diff --git a/drivers/media/i2c/cvs/v4l2.c b/drivers/media/i2c/cvs/v4l2.c +index 3a1ec0059ef7..9fadca7a3bee 100644 +--- a/drivers/media/i2c/cvs/v4l2.c ++++ b/drivers/media/i2c/cvs/v4l2.c +@@ -46,6 +46,7 @@ static const struct v4l2_mbus_framefmt cvs_csi_format_mbus_default = { + /** + * csi_set_link_cfg - Program default CSI-2 link parameters + * @ctx: CVS device context ++ * @link_freq: Link frequency (Hz) + * + * Populates a HOST_SET_MIPI_CONFIG command using current lane count and + * link frequency, then submits it to the device. +@@ -53,12 +54,12 @@ static const struct v4l2_mbus_framefmt cvs_csi_format_mbus_default = { + * + * Return: 0 on success or negative errno. + */ +-static int csi_set_link_cfg(struct icvs *ctx) ++static int csi_set_link_cfg(struct icvs *ctx, u64 link_freq) + { + struct icvs_cmd cmd = { + .cmd_id = cpu_to_be16(ICVS_HOST_SET_MIPI_CONFIG), + .param.conf.nr_of_lanes = ctx->nr_of_lanes, +- .param.conf.link_freq = ctx->link_freq, ++ .param.conf.link_freq = link_freq, + }; + size_t cmd_size = sizeof(cmd.cmd_id) + sizeof(cmd.param.conf); + +@@ -91,7 +92,7 @@ static int cvs_csi_enable_streams(struct v4l2_subdev *sd, + struct v4l2_subdev *remote_sd = + media_entity_to_v4l2_subdev(ctx->remote->entity); + struct device *dev = cvs_dev(ctx); +- s64 freq; ++ s64 link_freq; + int ret; + + /* cvs_set_link_owner(ICVS_CSI_LINK_HOST) */ +@@ -99,15 +100,14 @@ static int cvs_csi_enable_streams(struct v4l2_subdev *sd, + if (ret < 0) + return ret; + +- freq = v4l2_get_link_freq(ctx->remote, 0, 0); +- if (freq < 0) { +- ret = freq; ++ link_freq = v4l2_get_link_freq(ctx->remote, 0, 0); ++ if (link_freq < 0) { ++ ret = link_freq; + goto err_rpm_put; + } +- ctx->link_freq = freq; + + if (ctx->i2c_client) { +- ret = csi_set_link_cfg(ctx); ++ ret = csi_set_link_cfg(ctx, link_freq); + if (ret < 0) + goto err_rpm_put_sync; + } +@@ -345,7 +345,6 @@ static int cvs_csi_get_mbus_config(struct v4l2_subdev *sd, unsigned int pad, + if (freq < 0) + return -EINVAL; + +- ctx->link_freq = freq; + cfg->link_freq = freq; + + return 0; diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c index b09f27f7846f..b54fe538511a 100644 --- a/drivers/pci/quirks.c @@ -1174,10 +1786,10 @@ index b09f27f7846f..b54fe538511a 100644 * Intersil/Techwell TW686[4589]-based video capture cards have an empty (zero) * class code. Fix it. diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index d92bf887739d..039fd5620282 100644 +index 068c7bea3102..cecfac2b0bdc 100644 --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c -@@ -5902,6 +5902,13 @@ static void hub_event(struct work_struct *work) +@@ -5907,6 +5907,13 @@ static void hub_event(struct work_struct *work) (u16) hub->change_bits[0], (u16) hub->event_bits[0]); @@ -1191,6 +1803,108 @@ index d92bf887739d..039fd5620282 100644 /* Lock the device, then check to see if we were * disconnected while waiting for the lock to succeed. */ usb_lock_device(hdev); +diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h +index 7643ba954125..0d51428c1da4 100644 +--- a/include/crypto/if_alg.h ++++ b/include/crypto/if_alg.h +@@ -8,6 +8,7 @@ + #ifndef _CRYPTO_IF_ALG_H + #define _CRYPTO_IF_ALG_H + ++#include + #include + #include + #include +@@ -121,7 +122,7 @@ struct af_alg_async_req { + * @iv: IV for cipher operation + * @state: Existing state for continuing operation + * @aead_assoclen: Length of AAD for AEAD cipher operations +- * @completion: Work queue for synchronous operation ++ * @wait: For waiting for completion of async crypto ops + * @used: TX bytes sent to kernel. This variable is used to + * ensure that user space cannot cause the kernel + * to allocate too much memory in sendmsg operation. +@@ -161,9 +162,20 @@ struct af_alg_ctx { + unsigned int inflight; + }; + ++/* Flags for af_alg_allowlist_entry::flags: */ ++#define AF_ALG_UNPRIVILEGED BIT(0) /* Unprivileged use is allowed */ ++ ++struct af_alg_allowlist_entry { ++ const char *name; ++ u32 flags; ++}; ++ + int af_alg_register_type(const struct af_alg_type *type); + int af_alg_unregister_type(const struct af_alg_type *type); + ++int af_alg_check_restriction(const char *name, ++ const struct af_alg_allowlist_entry allowlist[]); ++ + int af_alg_release(struct socket *sock); + void af_alg_release_parent(struct sock *sk); + int af_alg_accept(struct sock *sk, struct socket *newsock, +@@ -177,10 +189,11 @@ static inline struct alg_sock *alg_sk(struct sock *sk) + } + + /** +- * Size of available buffer for sending data from user space to kernel. ++ * af_alg_sndbuf - Size of available buffer for sending data from user space to kernel. + * +- * @sk socket of connection to user space +- * @return number of bytes still available ++ * @sk: socket of connection to user space ++ * ++ * Returns: number of bytes still available + */ + static inline int af_alg_sndbuf(struct sock *sk) + { +@@ -192,10 +205,11 @@ static inline int af_alg_sndbuf(struct sock *sk) + } + + /** +- * Can the send buffer still be written to? ++ * af_alg_writable - Can the send buffer still be written to? ++ * ++ * @sk: socket of connection to user space + * +- * @sk socket of connection to user space +- * @return true => writable, false => not writable ++ * Returns: true => writable, false => not writable + */ + static inline bool af_alg_writable(struct sock *sk) + { +@@ -203,10 +217,11 @@ static inline bool af_alg_writable(struct sock *sk) + } + + /** +- * Size of available buffer used by kernel for the RX user space operation. ++ * af_alg_rcvbuf - Size of available buffer used by kernel for the RX user space operation. + * +- * @sk socket of connection to user space +- * @return number of bytes still available ++ * @sk: socket of connection to user space ++ * ++ * Returns: number of bytes still available + */ + static inline int af_alg_rcvbuf(struct sock *sk) + { +@@ -218,10 +233,11 @@ static inline int af_alg_rcvbuf(struct sock *sk) + } + + /** +- * Can the RX buffer still be written to? ++ * af_alg_readable - Can the RX buffer still be read from? ++ * ++ * @sk: socket of connection to user space + * +- * @sk socket of connection to user space +- * @return true => writable, false => not writable ++ * Returns: true => readable, false => not readable + */ + static inline bool af_alg_readable(struct sock *sk) + { diff --git a/include/linux/crypto.h b/include/linux/crypto.h index b7c97f1c47c9..0a484f45b24a 100644 --- a/include/linux/crypto.h @@ -1353,6 +2067,20 @@ index 590ba29c85ab..02153d857531 100644 } int module_sig_check(struct load_info *info, int flags) +diff --git a/net/core/page_pool.c b/net/core/page_pool.c +index 21dc4a9c8714..c8331e9cf5d9 100644 +--- a/net/core/page_pool.c ++++ b/net/core/page_pool.c +@@ -1063,7 +1063,8 @@ netmem_ref page_pool_alloc_frag_netmem(struct page_pool *pool, + if (WARN_ON(size > max_size)) + return 0; + +- size = ALIGN(size, dma_get_cache_alignment()); ++ size = ALIGN(size, max_t(unsigned int, dma_get_cache_alignment(), ++ __alignof__(struct skb_shared_info))); + *offset = pool->frag_offset; + + if (netmem && *offset + size > max_size) { diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib index 0a4fdd8bd975..dcb12dad419f 100644 --- a/scripts/Makefile.lib diff --git a/sources b/sources index a0d8841c5..e826d0ab7 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (linux-7.2.2.tar.xz) = 68317db0b38d12cc18fcfea9ff403172076ba347fcc8e09cd754c96a6f399848af11cdf2e4a1d66fae332c4f34a0e47f3c90adc91b8f20a9800a5c0497ceedb0 -SHA512 (kernel-abi-stablelists-7.2.2.tar.xz) = e90bf77d9ab78a91f1e98dfd19ccfcb3dac1c74735a79061d953b9db513be208f382f4f0761d70d12b150b6ca41e25140ee6b8cb4e2c96f8798e57ede1c155ad -SHA512 (kernel-kabi-dw-7.2.2.tar.xz) = 12791da7c3fd756fab70a70fbd91b27fb7aa7fd6b46f59e3cd883fee0d1c36dbf2fba861088e60bf7519641c94bfedf11dbea51a60e490ade095219140ea569a +SHA512 (linux-7.2.3.tar.xz) = 26f55349766553ede454e96253bd86280db21a11a1d1d3c1671b49e4afbaf4964cd976a8f9e983f1ab79a964159da3e4e57f210ce98ebbcc631f15afd4c1c18e +SHA512 (kernel-abi-stablelists-7.2.3.tar.xz) = fcfcc48b32e1ec45b74ebcd1a0fd05f107d2fdba7a55bc6bbdff164e9fea30a0817282f0d2b8e7757cb9d711eb24c5f05356d324f2806b849d0874c09c192a03 +SHA512 (kernel-kabi-dw-7.2.3.tar.xz) = 3aa66a108e53cafc7de7316e68c79ec31fb522a69f85412cd4ae8768b1eb41ee39b268dafde8038fb89cc95e8c909a75fb5f62ead38ea5de3d6832cf0967ee54