diff --git a/Makefile.rhelver b/Makefile.rhelver index 95b9fd7b5..e810b8948 100644 --- a/Makefile.rhelver +++ b/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 99 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 0 +RHEL_RELEASE = 1 # # RHEL_REBASE_NUM diff --git a/Patchlist.changelog b/Patchlist.changelog index 1816ea228..5acabaf1f 100644 --- a/Patchlist.changelog +++ b/Patchlist.changelog @@ -1,3 +1,6 @@ +https://gitlab.com/cki-project/kernel-ark/-/commit/398377259f01c70d2cdb14c206967ccf200ed6bd + 398377259f01c70d2cdb14c206967ccf200ed6bd can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF + https://gitlab.com/cki-project/kernel-ark/-/commit/7b8efc5af560ec18096b99f3d8b1b6b6ef101ee5 7b8efc5af560ec18096b99f3d8b1b6b6ef101ee5 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state diff --git a/kernel.changelog b/kernel.changelog index fbfe3caa2..5f1b89b4f 100644 --- a/kernel.changelog +++ b/kernel.changelog @@ -1,3 +1,7 @@ +* Mon Jul 20 2026 Justin M. Forbes [7.1.4-1] +- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Lee Jones) +Resolves: + * Sat Jul 18 2026 Justin M. Forbes [7.1.4-0] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Sean Christopherson) - drm/amd: Create a device link between APU display and XHCI devices (Mario Limonciello) diff --git a/kernel.spec b/kernel.spec index 900ba247e..074dc6ddb 100644 --- a/kernel.spec +++ b/kernel.spec @@ -190,13 +190,13 @@ Summary: The Linux kernel %define specrpmversion 7.1.4 %define specversion 7.1.4 %define patchversion 7.1 -%define pkgrelease 200 +%define pkgrelease 201 %define kversion 7 %define tarfile_release 7.1.4 # This is needed to do merge window version magic %define patchlevel 1 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 200%{?buildid}%{?dist} +%define specrelease 201%{?buildid}%{?dist} # This defines the kabi tarball version %define kabiversion 7.1.4 @@ -4857,6 +4857,9 @@ fi\ # # %changelog +* Mon Jul 20 2026 Justin M. Forbes [7.1.4-1] +- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Lee Jones) + * Sat Jul 18 2026 Justin M. Forbes [7.1.4-0] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Sean Christopherson) - drm/amd: Create a device link between APU display and XHCI devices (Mario Limonciello) diff --git a/patch-7.1-redhat.patch b/patch-7.1-redhat.patch index f2db0e4bc..5d121333d 100644 --- a/patch-7.1-redhat.patch +++ b/patch-7.1-redhat.patch @@ -46,6 +46,7 @@ include/linux/random.h | 10 + include/linux/security.h | 9 + kernel/module/signing.c | 9 +- + net/can/bcm.c | 37 +- scripts/Makefile.lib | 3 + scripts/tags.sh | 2 + security/integrity/platform_certs/load_uefi.c | 6 +- @@ -56,7 +57,7 @@ tools/testing/selftests/bpf/DENYLIST.rhel | 76 ++ tools/testing/selftests/bpf/Makefile | 2 +- tools/testing/selftests/bpf/prog_tests/ksyms_btf.c | 31 - - 58 files changed, 2034 insertions(+), 142 deletions(-) + 59 files changed, 2068 insertions(+), 145 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index f74da642290a..06c8bb2075e6 100644 @@ -2921,6 +2922,125 @@ index 590ba29c85ab..02153d857531 100644 } int module_sig_check(struct load_info *info, int flags) +diff --git a/net/can/bcm.c b/net/can/bcm.c +index a4bef2c48a55..bdf53241bd7b 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -58,6 +58,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -92,6 +93,8 @@ MODULE_ALIAS("can-proto-2"); + + #define BCM_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex) + ++static struct workqueue_struct *bcm_wq; ++ + /* + * easy access to the first 64 bit of can(fd)_frame payload. cp->data is + * 64 bit aligned so the offset has to be multiples of 8 which is ensured +@@ -105,6 +108,7 @@ static inline u64 get_u64(const struct canfd_frame *cp, int offset) + struct bcm_op { + struct list_head list; + struct rcu_head rcu; ++ struct work_struct work; + int ifindex; + canid_t can_id; + u32 flags; +@@ -793,9 +797,12 @@ static struct bcm_op *bcm_find_op(struct list_head *ops, + return NULL; + } + +-static void bcm_free_op_rcu(struct rcu_head *rcu_head) ++static void bcm_free_op_work(struct work_struct *work) + { +- struct bcm_op *op = container_of(rcu_head, struct bcm_op, rcu); ++ struct bcm_op *op = container_of(work, struct bcm_op, work); ++ ++ hrtimer_cancel(&op->timer); ++ hrtimer_cancel(&op->thrtimer); + + if ((op->frames) && (op->frames != &op->sframe)) + kfree(op->frames); +@@ -803,9 +810,23 @@ static void bcm_free_op_rcu(struct rcu_head *rcu_head) + if ((op->last_frames) && (op->last_frames != &op->last_sframe)) + kfree(op->last_frames); + ++ /* the last possible access to op->timer/op->thrtimer has now ++ * happened above via hrtimer_cancel() - op->sk is no longer ++ * needed by any pending timer callback, so drop our reference ++ */ ++ sock_put(op->sk); ++ + kfree(op); + } + ++static void bcm_free_op_rcu(struct rcu_head *rcu_head) ++{ ++ struct bcm_op *op = container_of(rcu_head, struct bcm_op, rcu); ++ ++ INIT_WORK(&op->work, bcm_free_op_work); ++ queue_work(bcm_wq, &op->work); ++} ++ + static void bcm_remove_op(struct bcm_op *op) + { + hrtimer_cancel(&op->timer); +@@ -1060,6 +1081,7 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + + /* bcm_can_tx / bcm_tx_timeout_handler needs this */ + op->sk = sk; ++ sock_hold(sk); + op->ifindex = ifindex; + + /* initialize uninitialized (kzalloc) structure */ +@@ -1221,6 +1243,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + + /* bcm_can_tx / bcm_tx_timeout_handler needs this */ + op->sk = sk; ++ sock_hold(sk); + op->ifindex = ifindex; + + /* ifindex for timeout events w/o previous frame reception */ +@@ -1839,11 +1862,15 @@ static int __init bcm_module_init(void) + { + int err; + ++ bcm_wq = alloc_workqueue("can-bcm-wq", WQ_UNBOUND, 0); ++ if (!bcm_wq) ++ return -ENOMEM; ++ + pr_info("can: broadcast manager protocol\n"); + + err = register_pernet_subsys(&canbcm_pernet_ops); + if (err) +- return err; ++ goto register_pernet_failed; + + err = register_netdevice_notifier(&canbcm_notifier); + if (err) +@@ -1861,6 +1888,8 @@ static int __init bcm_module_init(void) + unregister_netdevice_notifier(&canbcm_notifier); + register_notifier_failed: + unregister_pernet_subsys(&canbcm_pernet_ops); ++register_pernet_failed: ++ destroy_workqueue(bcm_wq); + return err; + } + +@@ -1869,6 +1898,8 @@ static void __exit bcm_module_exit(void) + can_proto_unregister(&bcm_can_proto); + unregister_netdevice_notifier(&canbcm_notifier); + unregister_pernet_subsys(&canbcm_pernet_ops); ++ rcu_barrier(); ++ destroy_workqueue(bcm_wq); + } + + module_init(bcm_module_init); diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib index 0718e39cedda..10e94a1b8b6e 100644 --- a/scripts/Makefile.lib diff --git a/sources b/sources index f55e2a7e3..fce0dcf09 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (linux-7.1.4.tar.xz) = 164f7c0353dfcf1eaacf886530273271d473314a9f99d9441a63bfc24368c8d2f194552bd4800dd440bf824598cbd74263b1b544dc61307517b8208acf9b4a7a -SHA512 (kernel-abi-stablelists-7.1.4.tar.xz) = f5bc5d159e0503a7e53ed241ab4a4f4cdb20ede32d00915fa4e1404a19024276e169c8675eef900d4d0b2e9d6a55f814bbbddcfdf6f38e19a1d0957533848573 -SHA512 (kernel-kabi-dw-7.1.4.tar.xz) = d8d89633a4474b1ad9522ab066c97907e217f72fde3290b3a02bbddadd79b5d82514ae1a6b0b1dccd770cd0717df0a45e9e6aaa4bc9f45aba1ee9be44d1e832b +SHA512 (kernel-abi-stablelists-7.1.4.tar.xz) = 77a0b54baff4e889f8f7c5b035da71e5ff22071e5daf8e2b48fd67ae6ec2d0720842da6e2b8fbedbc8b5c62074fe71d5f2aa53558e9fd22837c54cb1835d095a +SHA512 (kernel-kabi-dw-7.1.4.tar.xz) = bf880002eb61ae0c19a5692db25c281152d08404e60023770660fe3bbbd57055ae1a7a0ec770e57a871bd3d8a531d401951743b95731cb93ff26a0623f9bd217