From e7adda8c1c58b74b6fcafeb181f68d0e8ac4ebc0 Mon Sep 17 00:00:00 2001 From: "Justin M. Forbes" Date: Mon, 18 May 2026 17:01:01 -0600 Subject: [PATCH] kernel-6.19.14-106 * Mon May 18 2026 Justin M. Forbes [6.19.14-6] - net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) - Revert fragnesia v4 in favor of v5 (Justin M. Forbes) - net/sched: act_pedit: extend the writable skb range per key (Zhang Cen) Resolves: Signed-off-by: Justin M. Forbes --- Patchlist.changelog | 9 ++++ kernel.changelog | 7 +++ kernel.spec | 11 +++-- patch-6.19-redhat.patch | 100 ++++++++++++++++++++++++++++++++++------ sources | 4 +- 5 files changed, 111 insertions(+), 20 deletions(-) diff --git a/Patchlist.changelog b/Patchlist.changelog index 576b9ab6f..d06b05d4e 100644 --- a/Patchlist.changelog +++ b/Patchlist.changelog @@ -1,3 +1,12 @@ +https://gitlab.com/cki-project/kernel-ark/-/commit/ecbcff8201e31c5781b4e90af70e1a58eb3c2525 + ecbcff8201e31c5781b4e90af70e1a58eb3c2525 net/sched: fix pedit partial COW leading to page cache corruption + +https://gitlab.com/cki-project/kernel-ark/-/commit/cf8007a143973a0e753052712373c69b18aeda26 + cf8007a143973a0e753052712373c69b18aeda26 net: skbuff: propagate shared-frag marker through frag-transfer helpers + +https://gitlab.com/cki-project/kernel-ark/-/commit/f3dd1e9b62ef6833cdd447a286daf095cce4eeab + f3dd1e9b62ef6833cdd447a286daf095cce4eeab Revert fragnesia v4 in favor of v5 + https://gitlab.com/cki-project/kernel-ark/-/commit/a22b092248bfc0357ef3436dbf06fe653f3da375 a22b092248bfc0357ef3436dbf06fe653f3da375 net/sched: act_pedit: extend the writable skb range per key diff --git a/kernel.changelog b/kernel.changelog index ad5888367..817d0f1f0 100644 --- a/kernel.changelog +++ b/kernel.changelog @@ -1,3 +1,10 @@ +* Mon May 18 2026 Justin M. Forbes [6.19.14-0] +- net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) +- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) +- Revert fragnesia v4 in favor of v5 (Justin M. Forbes) +- net/sched: act_pedit: extend the writable skb range per key (Zhang Cen) +Resolves: + * Fri May 15 2026 Justin M. Forbes [6.19.14-0] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) - Revert v3 of the fragnesia fix. V4 covers an additional path (Justin M. Forbes) diff --git a/kernel.spec b/kernel.spec index e1aad75ac..86204604c 100644 --- a/kernel.spec +++ b/kernel.spec @@ -187,13 +187,13 @@ Summary: The Linux kernel %define specrpmversion 6.19.14 %define specversion 6.19.14 %define patchversion 6.19 -%define pkgrelease 105 +%define pkgrelease 106 %define kversion 6 %define tarfile_release 6.19.14 # This is needed to do merge window version magic %define patchlevel 19 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 105%{?buildid}%{?dist} +%define specrelease 106%{?buildid}%{?dist} # This defines the kabi tarball version %define kabiversion 6.19.14 @@ -4695,11 +4695,16 @@ fi\ # # %changelog -* Sun May 17 2026 Justin M. Forbes [6.19.14-105] +* Mon May 18 2026 Justin M. Forbes [6.19.14-106] - Revert "redhat/kernel.spec.template: Fix indentation of uki-virt generation code" (Justin M. Forbes) - Revert "redhat/kernel.spec.template: Simplify uki-virt signing" (Justin M. Forbes) - Revert "redhat/kernel.spec.template: Add kernel-uki-dtbloader sub-package" (Justin M. Forbes) - Revert "redhat/kernel.spec.template: Make -uki-dtbloader provide kernel-core-uname-r" (Justin M. Forbes) + +* Mon May 18 2026 Justin M. Forbes [6.19.14-6] +- net/sched: fix pedit partial COW leading to page cache corruption (Rajat Gupta) +- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Hyunwoo Kim) +- Revert fragnesia v4 in favor of v5 (Justin M. Forbes) - net/sched: act_pedit: extend the writable skb range per key (Zhang Cen) * Fri May 15 2026 Justin M. Forbes [6.19.14-0] diff --git a/patch-6.19-redhat.patch b/patch-6.19-redhat.patch index a5b8c190f..9b758ddc3 100644 --- a/patch-6.19-redhat.patch +++ b/patch-6.19-redhat.patch @@ -59,7 +59,7 @@ kernel/module/signing.c | 9 +- kernel/ptrace.c | 22 +- net/core/gro.c | 4 + - net/core/skbuff.c | 3 + + net/core/skbuff.c | 9 +- net/ipv4/esp4.c | 3 +- net/ipv4/ip_output.c | 2 + net/ipv4/tcp_output.c | 1 + @@ -72,7 +72,7 @@ net/rxrpc/rxgk_app.c | 1 + net/rxrpc/rxkad.c | 112 ++- net/rxrpc/skbuff.c | 9 - - net/sched/act_pedit.c | 36 +- + net/sched/act_pedit.c | 72 +- scripts/Makefile.lib | 3 + scripts/tags.sh | 2 + security/integrity/platform_certs/load_uefi.c | 6 +- @@ -80,7 +80,7 @@ security/lockdown/lockdown.c | 11 + tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/prog_tests/ksyms_btf.c | 31 - - 82 files changed, 2058 insertions(+), 572 deletions(-) + 82 files changed, 2096 insertions(+), 576 deletions(-) diff --git a/Documentation/hid/intel-ish-hid.rst b/Documentation/hid/intel-ish-hid.rst index 2adc174fb576..068a5906b177 100644 @@ -3926,7 +3926,7 @@ index ef61695fbdbb..867611d171db 100644 return 0; diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index a95dc0638836..fa21147d2188 100644 +index a95dc0638836..eb893e27b93f 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2226,6 +2226,7 @@ struct sk_buff *__pskb_copy_fclone(struct sk_buff *skb, int headroom, @@ -3946,6 +3946,26 @@ index a95dc0638836..fa21147d2188 100644 skb_len_add(skb, -shiftlen); skb_len_add(tgt, shiftlen); +@@ -4951,7 +4954,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, + skb_copy_from_linear_data_offset(head_skb, offset, + skb_put(nskb, hsize), hsize); + +- skb_shinfo(nskb)->flags |= skb_shinfo(head_skb)->flags & ++ skb_shinfo(nskb)->flags |= (skb_shinfo(head_skb)->flags | ++ skb_shinfo(frag_skb)->flags) & + SKBFL_SHARED_FRAG; + + if (skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC)) +@@ -4968,6 +4972,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, + nfrags = skb_shinfo(list_skb)->nr_frags; + frag = skb_shinfo(list_skb)->frags; + frag_skb = list_skb; ++ ++ skb_shinfo(nskb)->flags |= skb_shinfo(frag_skb)->flags & SKBFL_SHARED_FRAG; ++ + if (!skb_headlen(list_skb)) { + BUG_ON(!nfrags); + } else { diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c index 6dfc0bcdef65..6a5febbdbee4 100644 --- a/net/ipv4/esp4.c @@ -4442,10 +4462,31 @@ index 3bcd6ee80396..e2169d1a14b5 100644 * Note the destruction of a socket buffer. */ diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c -index 4b65901397a8..04ecd0ec5b80 100644 +index 4b65901397a8..517e34056cd7 100644 --- a/net/sched/act_pedit.c +++ b/net/sched/act_pedit.c -@@ -398,11 +398,12 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -323,8 +324,10 @@ static bool offset_valid(struct sk_buff *skb, int offset) + if (offset > 0 && offset > skb->len) + return false; + +- if (offset < 0 && -offset > skb_headroom(skb)) +- return false; ++ if (offset < 0) { ++ if (offset == INT_MIN || -offset > skb_headroom(skb)) ++ return false; ++ } + + return true; + } +@@ -398,12 +401,21 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, parms = rcu_dereference_bh(p->parms); @@ -4454,40 +4495,56 @@ index 4b65901397a8..04ecd0ec5b80 100644 - skb_network_offset(skb)) + - parms->tcfp_off_max_hint; - if (skb_ensure_writable(skb, min(skb->len, max_offset))) +- goto done; + max_offset = min_t(u32, skb->len, + (skb_transport_header_was_set(skb) ? + skb_transport_offset(skb) : + skb_network_offset(skb)) + + parms->tcfp_off_max_hint); -+ if (skb_ensure_writable(skb, max_offset)) - goto done; ++ ++ /* If the skb has shared frags the user is likely using zero-copy ++ * (e.g. sendfile). Those page frags may point to page-cache pages; ++ * writing into them would silently corrupt the page cache. ++ * Linearize so pedit operates on a private copy. ++ * TL;DR if you want to use ZC, don't use pedit */ ++ if (skb_has_shared_frag(skb)) { ++ if (__skb_linearize(skb)) ++ goto bad; ++ } tcf_lastuse_update(&p->tcf_tm); -@@ -414,8 +415,9 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, + tcf_action_update_bstats(&p->common, skb); +@@ -414,8 +426,9 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, for (i = parms->tcfp_nkeys; i > 0; i--, tkey++) { int offset = tkey->off; int hoffset = 0; -+ int write_offset; ++ int write_offset, write_len; u32 *ptr, hdata; - u32 val; + u32 val, write_end; int rc; if (tkey_ex) { -@@ -451,12 +453,26 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, +@@ -451,12 +464,45 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, } } - if (!offset_valid(skb, hoffset + offset)) { - pr_info_ratelimited("tc action pedit offset %d out of bounds\n", hoffset + offset); + write_offset = hoffset + offset; -+ if (!offset_valid(skb, write_offset)) { -+ pr_info_ratelimited("tc action pedit offset %d out of bounds\n", -+ write_offset); ++ if (unlikely(check_add_overflow(hoffset, offset, ++ &write_offset))) { ++ pr_info_ratelimited("tc action pedit offset overflow\n"); goto bad; } - ptr = skb_header_pointer(skb, hoffset + offset, ++ if (!offset_valid(skb, write_offset)) { ++ pr_info_ratelimited("tc action pedit offset %d out of bounds\n", ++ write_offset); ++ goto bad; ++ } ++ + /* Earlier edits can change later header-relative offsets, so + * grow the writable window from the final per-key store. + */ @@ -4500,11 +4557,24 @@ index 4b65901397a8..04ecd0ec5b80 100644 + } + } + ++ if (write_offset < 0) { ++ if (skb_cow(skb, -write_offset)) ++ goto bad; ++ } else { ++ if (unlikely(check_add_overflow(write_offset, ++ (int)sizeof(hdata), ++ &write_len))) ++ goto bad; ++ if (skb_ensure_writable(skb, min_t(int, skb->len, ++ write_len))) ++ goto bad; ++ } ++ + ptr = skb_header_pointer(skb, write_offset, sizeof(hdata), &hdata); if (!ptr) goto bad; -@@ -475,7 +491,7 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, +@@ -475,7 +521,7 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, *ptr = ((*ptr & tkey->mask) ^ val); if (ptr == &hdata) diff --git a/sources b/sources index 0e72a7ba1..87cba63db 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (linux-6.19.14.tar.xz) = d9e52522dba3d8727265668b458d6e0231663f113f74aff4ab17328dee6689bf2a2865dca168c3ff47c3575f981c8fcc497297743859353462c3e0ebd314332c -SHA512 (kernel-abi-stablelists-6.19.14.tar.xz) = b89c9e27b9178911916bb90c2715dcc83c8a040608c87f28b455b97f8c4443452e220f9614f26ea675c51870775fe575e0c2afaee8348ef22a08b82dac954fb8 -SHA512 (kernel-kabi-dw-6.19.14.tar.xz) = 9939a80b962e837cd5b68f33b215b6bd08be117898534590d3e12fea23a3b303245ba01fbfe01a8cd9fda3eb23555de69ebf123b568dbeffbcfb3f3b51ccb524 +SHA512 (kernel-abi-stablelists-6.19.14.tar.xz) = 71453c91a1eb195676deedf74355b3e5a2648ab2932c5cfd8aa7507d268f33b1de74c04917b31e4467d29ef3d3e94d38792994052ea37202f7d1fa10d16cffdc +SHA512 (kernel-kabi-dw-6.19.14.tar.xz) = 12d0027e6c27480029ac71fc88a4a7d26b6156eea52b93ca412d171839a0bdb132dca83e0fe97377d3a551dcd7d184bb4b78534421c4c7f713812438ebc9e976