rpms/kernel
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

kernel-6.19.14-106

Browse source 
* Mon May 18 2026 Justin M. Forbes <jforbes@fedoraproject.org> [6.19.14-6]
- net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)
- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)
- Revert fragnesia v4 in favor of v5 (Justin M. Forbes)
- net/sched: act_pedit: extend the writable skb range per key (Zhang Cen)
Resolves:

Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
This commit is contained in:
Justin M. Forbes 2026-05-18 17:01:01 -06:00
commit e7adda8c1c
No known key found for this signature in database
GPG key ID: B8FA7924A4B1C140
5 changed files with 111 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

9
Patchlist.changelog
View file

@ -1,3 +1,12 @@
https://gitlab.com/cki-project/kernel-ark/-/commit/ecbcff8201e31c5781b4e90af70e1a58eb3c2525
ecbcff8201e31c5781b4e90af70e1a58eb3c2525 net/sched: fix pedit partial COW leading to page cache corruption
https://gitlab.com/cki-project/kernel-ark/-/commit/cf8007a143973a0e753052712373c69b18aeda26
cf8007a143973a0e753052712373c69b18aeda26 net: skbuff: propagate shared-frag marker through frag-transfer helpers
https://gitlab.com/cki-project/kernel-ark/-/commit/f3dd1e9b62ef6833cdd447a286daf095cce4eeab
f3dd1e9b62ef6833cdd447a286daf095cce4eeab Revert fragnesia v4 in favor of v5
https://gitlab.com/cki-project/kernel-ark/-/commit/a22b092248bfc0357ef3436dbf06fe653f3da375
a22b092248bfc0357ef3436dbf06fe653f3da375 net/sched: act_pedit: extend the writable skb range per key

7
kernel.changelog
View file

@ -1,3 +1,10 @@
* Mon May 18 2026 Justin M. Forbes <jforbes@fedoraproject.org> [6.19.14-0]
- net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)
- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)
- Revert fragnesia v4 in favor of v5 (Justin M. Forbes)
- net/sched: act_pedit: extend the writable skb range per key (Zhang Cen)
Resolves:
* Fri May 15 2026 Justin M. Forbes <jforbes@fedoraproject.org> [6.19.14-0]
- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)
- Revert v3 of the fragnesia fix. V4 covers an additional path (Justin M. Forbes)

11
kernel.spec
View file

@ -187,13 +187,13 @@ Summary: The Linux kernel
%define specrpmversion 6.19.14
%define specversion 6.19.14
%define patchversion 6.19
%define pkgrelease 105
%define pkgrelease 106
%define kversion 6
%define tarfile_release 6.19.14
# This is needed to do merge window version magic
%define patchlevel 19
# This allows pkg_release to have configurable %%{?dist} tag
%define specrelease 105%{?buildid}%{?dist}
%define specrelease 106%{?buildid}%{?dist}
# This defines the kabi tarball version
%define kabiversion 6.19.14
@ -4695,11 +4695,16 @@ fi\
#
#
%changelog
* Sun May 17 2026 Justin M. Forbes <jforbes@fedoraproject.org> [6.19.14-105]
* Mon May 18 2026 Justin M. Forbes <jforbes@fedoraproject.org> [6.19.14-106]
- Revert "redhat/kernel.spec.template: Fix indentation of uki-virt generation code" (Justin M. Forbes)
- Revert "redhat/kernel.spec.template: Simplify uki-virt signing" (Justin M. Forbes)
- Revert "redhat/kernel.spec.template: Add kernel-uki-dtbloader sub-package" (Justin M. Forbes)
- Revert "redhat/kernel.spec.template: Make -uki-dtbloader provide kernel-core-uname-r" (Justin M. Forbes)
* Mon May 18 2026 Justin M. Forbes <jforbes@fedoraproject.org> [6.19.14-6]
- net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta)
- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim)
- Revert fragnesia v4 in favor of v5 (Justin M. Forbes)
- net/sched: act_pedit: extend the writable skb range per key (Zhang Cen)
* Fri May 15 2026 Justin M. Forbes <jforbes@fedoraproject.org> [6.19.14-0]

100
patch-6.19-redhat.patch
View file

@ -59,7 +59,7 @@
kernel/module/signing.c | 9 +-
kernel/ptrace.c | 22 +-
net/core/gro.c | 4 +
net/core/skbuff.c | 3 +
net/core/skbuff.c | 9 +-
net/ipv4/esp4.c | 3 +-
net/ipv4/ip_output.c | 2 +
net/ipv4/tcp_output.c | 1 +
@ -72,7 +72,7 @@
net/rxrpc/rxgk_app.c | 1 +
net/rxrpc/rxkad.c | 112 ++-
net/rxrpc/skbuff.c | 9 -
net/sched/act_pedit.c | 36 +-
net/sched/act_pedit.c | 72 +-
scripts/Makefile.lib | 3 +
scripts/tags.sh | 2 +
security/integrity/platform_certs/load_uefi.c | 6 +-
@ -80,7 +80,7 @@
security/lockdown/lockdown.c | 11 +
tools/testing/selftests/bpf/Makefile | 2 +-
tools/testing/selftests/bpf/prog_tests/ksyms_btf.c | 31 -
82 files changed, 2058 insertions(+), 572 deletions(-)
82 files changed, 2096 insertions(+), 576 deletions(-)
diff --git a/Documentation/hid/intel-ish-hid.rst b/Documentation/hid/intel-ish-hid.rst
index 2adc174fb576..068a5906b177 100644
@ -3926,7 +3926,7 @@ index ef61695fbdbb..867611d171db 100644
return 0;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a95dc0638836..fa21147d2188 100644
index a95dc0638836..eb893e27b93f 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2226,6 +2226,7 @@ struct sk_buff *__pskb_copy_fclone(struct sk_buff *skb, int headroom,
@ -3946,6 +3946,26 @@ index a95dc0638836..fa21147d2188 100644
skb_len_add(skb, -shiftlen);
skb_len_add(tgt, shiftlen);
@@ -4951,7 +4954,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
skb_copy_from_linear_data_offset(head_skb, offset,
skb_put(nskb, hsize), hsize);
- skb_shinfo(nskb)->flags |= skb_shinfo(head_skb)->flags &
+ skb_shinfo(nskb)->flags |= (skb_shinfo(head_skb)->flags |
+ skb_shinfo(frag_skb)->flags) &
SKBFL_SHARED_FRAG;
if (skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC))
@@ -4968,6 +4972,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
nfrags = skb_shinfo(list_skb)->nr_frags;
frag = skb_shinfo(list_skb)->frags;
frag_skb = list_skb;
+
+ skb_shinfo(nskb)->flags |= skb_shinfo(frag_skb)->flags & SKBFL_SHARED_FRAG;
+
if (!skb_headlen(list_skb)) {
BUG_ON(!nfrags);
} else {
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 6dfc0bcdef65..6a5febbdbee4 100644
--- a/net/ipv4/esp4.c
@ -4442,10 +4462,31 @@ index 3bcd6ee80396..e2169d1a14b5 100644
* Note the destruction of a socket buffer.
*/
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 4b65901397a8..04ecd0ec5b80 100644
index 4b65901397a8..517e34056cd7 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -398,11 +398,12 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
@@ -16,6 +16,7 @@
#include <linux/ip.h>
#include <linux/ipv6.h>
#include <linux/slab.h>
+#include <linux/overflow.h>
#include <net/ipv6.h>
#include <net/netlink.h>
#include <net/pkt_sched.h>
@@ -323,8 +324,10 @@ static bool offset_valid(struct sk_buff *skb, int offset)
if (offset > 0 && offset > skb->len)
return false;
- if (offset < 0 && -offset > skb_headroom(skb))
- return false;
+ if (offset < 0) {
+ if (offset == INT_MIN || -offset > skb_headroom(skb))
+ return false;
+ }
return true;
}
@@ -398,12 +401,21 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
parms = rcu_dereference_bh(p->parms);
@ -4454,40 +4495,56 @@ index 4b65901397a8..04ecd0ec5b80 100644
- skb_network_offset(skb)) +
- parms->tcfp_off_max_hint;
- if (skb_ensure_writable(skb, min(skb->len, max_offset)))
- goto done;
+ max_offset = min_t(u32, skb->len,
+ (skb_transport_header_was_set(skb) ?
+ skb_transport_offset(skb) :
+ skb_network_offset(skb)) +
+ parms->tcfp_off_max_hint);
+ if (skb_ensure_writable(skb, max_offset))
goto done;
+
+ /* If the skb has shared frags the user is likely using zero-copy
+ * (e.g. sendfile). Those page frags may point to page-cache pages;
+ * writing into them would silently corrupt the page cache.
+ * Linearize so pedit operates on a private copy.
+ * TL;DR if you want to use ZC, don't use pedit */
+ if (skb_has_shared_frag(skb)) {
+ if (__skb_linearize(skb))
+ goto bad;
+ }
tcf_lastuse_update(&p->tcf_tm);
@@ -414,8 +415,9 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
tcf_action_update_bstats(&p->common, skb);
@@ -414,8 +426,9 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
for (i = parms->tcfp_nkeys; i > 0; i--, tkey++) {
int offset = tkey->off;
int hoffset = 0;
+ int write_offset;
+ int write_offset, write_len;
u32 *ptr, hdata;
- u32 val;
+ u32 val, write_end;
int rc;
if (tkey_ex) {
@@ -451,12 +453,26 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
@@ -451,12 +464,45 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
}
}
- if (!offset_valid(skb, hoffset + offset)) {
- pr_info_ratelimited("tc action pedit offset %d out of bounds\n", hoffset + offset);
+ write_offset = hoffset + offset;
+ if (!offset_valid(skb, write_offset)) {
+ pr_info_ratelimited("tc action pedit offset %d out of bounds\n",
+ write_offset);
+ if (unlikely(check_add_overflow(hoffset, offset,
+ &write_offset))) {
+ pr_info_ratelimited("tc action pedit offset overflow\n");
goto bad;
}
- ptr = skb_header_pointer(skb, hoffset + offset,
+ if (!offset_valid(skb, write_offset)) {
+ pr_info_ratelimited("tc action pedit offset %d out of bounds\n",
+ write_offset);
+ goto bad;
+ }
+
+ /* Earlier edits can change later header-relative offsets, so
+ * grow the writable window from the final per-key store.
+ */
@ -4500,11 +4557,24 @@ index 4b65901397a8..04ecd0ec5b80 100644
+ }
+ }
+
+ if (write_offset < 0) {
+ if (skb_cow(skb, -write_offset))
+ goto bad;
+ } else {
+ if (unlikely(check_add_overflow(write_offset,
+ (int)sizeof(hdata),
+ &write_len)))
+ goto bad;
+ if (skb_ensure_writable(skb, min_t(int, skb->len,
+ write_len)))
+ goto bad;
+ }
+
+ ptr = skb_header_pointer(skb, write_offset,
sizeof(hdata), &hdata);
if (!ptr)
goto bad;
@@ -475,7 +491,7 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
@@ -475,7 +521,7 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb,
*ptr = ((*ptr & tkey->mask) ^ val);
if (ptr == &hdata)

4
sources
View file

@ -1,3 +1,3 @@
SHA512 (linux-6.19.14.tar.xz) = d9e52522dba3d8727265668b458d6e0231663f113f74aff4ab17328dee6689bf2a2865dca168c3ff47c3575f981c8fcc497297743859353462c3e0ebd314332c
SHA512 (kernel-abi-stablelists-6.19.14.tar.xz) = b89c9e27b9178911916bb90c2715dcc83c8a040608c87f28b455b97f8c4443452e220f9614f26ea675c51870775fe575e0c2afaee8348ef22a08b82dac954fb8
SHA512 (kernel-kabi-dw-6.19.14.tar.xz) = 9939a80b962e837cd5b68f33b215b6bd08be117898534590d3e12fea23a3b303245ba01fbfe01a8cd9fda3eb23555de69ebf123b568dbeffbcfb3f3b51ccb524
SHA512 (kernel-abi-stablelists-6.19.14.tar.xz) = 71453c91a1eb195676deedf74355b3e5a2648ab2932c5cfd8aa7507d268f33b1de74c04917b31e4467d29ef3d3e94d38792994052ea37202f7d1fa10d16cffdc
SHA512 (kernel-kabi-dw-6.19.14.tar.xz) = 12d0027e6c27480029ac71fc88a4a7d26b6156eea52b93ca412d171839a0bdb132dca83e0fe97377d3a551dcd7d184bb4b78534421c4c7f713812438ebc9e976