diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst index 433acf4dddd50..3acbb8f834a48 100644 --- a/Documentation/arm64/silicon-errata.rst +++ b/Documentation/arm64/silicon-errata.rst @@ -88,16 +88,58 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A76 | #1463225 | ARM64_ERRATUM_1463225 | +----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A76 | #4193800 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A76AE | #4193801 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A55 | #1530923 | ARM64_ERRATUM_1530923 | +----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A77 | #1508412 | ARM64_ERRATUM_1508412 | +----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A77 | #4193798 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A78 | #4193791 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A78AE | #4193793 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A78C | #4193794 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A710 | #4193788 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-X1 | #4193791 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-X1C | #4193792 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-X2 | #4193788 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-X3 | #4193786 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-X4 | #4118414 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-X925 | #4193781 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ | ARM | Neoverse-N1 | #1188873,1418040| ARM64_ERRATUM_1418040 | +----------------+-----------------+-----------------+-----------------------------+ | ARM | Neoverse-N1 | #1349291 | N/A | +----------------+-----------------+-----------------+-----------------------------+ | ARM | Neoverse-N1 | #1542419 | ARM64_ERRATUM_1542419 | +----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-N1 | #4193800 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-N2 | #4193789 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-V1 | #4193790 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-V2 | #4193787 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-V3 | #4193784 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-V3AE | #4193784 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | C1-Premium | #4193780 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | C1-Ultra | #4193780 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ | ARM | MMU-500 | #841119,826419 | N/A | +----------------+-----------------+-----------------+-----------------------------+ +----------------+-----------------+-----------------+-----------------------------+ @@ -132,6 +174,7 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | NVIDIA | Carmel Core | N/A | NVIDIA_CARMEL_CNP_ERRATUM | +----------------+-----------------+-----------------+-----------------------------+ +| NVIDIA | Olympus core | T410-OLY-1029 | ARM64_ERRATUM_4118414 | +----------------+-----------------+-----------------+-----------------------------+ | Freescale/NXP | LS2080A/LS1043A | A-008585 | FSL_ERRATUM_A008585 | +----------------+-----------------+-----------------+-----------------------------+ @@ -164,3 +207,5 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Fujitsu | A64FX | E#010001 | FUJITSU_ERRATUM_010001 | +----------------+-----------------+-----------------+-----------------------------+ +| Microsoft | Azure Cobalt 100| #4193789 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ diff --git a/Makefile.rhelver b/Makefile.rhelver index 41403d4fcf073..540378aaa0fe5 100644 --- a/Makefile.rhelver +++ b/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 10 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 553.139.1 +RHEL_RELEASE = 553.141.1 # # ZSTREAM diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 7145a73106dfe..3747e410e6539 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -672,6 +672,44 @@ config ARM64_ERRATUM_1508412 If unsure, say Y. +config ARM64_ERRATUM_4118414 + bool "Various: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" + default y + select ARM64_WORKAROUND_REPEAT_TLBI + help + This option adds a workaround for the following errata: + + * ARM C1-Premium erratum 4193780 + * ARM C1-Ultra erratum 4193780 + * ARM Cortex-A76 erratum 4193800 + * ARM Cortex-A76AE erratum 4193801 + * ARM Cortex-A77 erratum 4193798 + * ARM Cortex-A78 erratum 4193791 + * ARM Cortex-A78AE erratum 4193793 + * ARM Cortex-A78C erratum 4193794 + * ARM Cortex-A710 erratum 4193788 + * ARM Cortex-X1 erratum 4193791 + * ARM Cortex-X1C erratum 4193792 + * ARM Cortex-X2 erratum 4193788 + * ARM Cortex-X3 erratum 4193786 + * ARM Cortex-X4 erratum 4118414 + * ARM Cortex-X925 erratum 4193781 + * ARM Neoverse-N1 erratum 4193800 + * ARM Neoverse-N2 erratum 4193789 + * ARM Neoverse-V1 erratum 4193790 + * ARM Neoverse-V2 erratum 4193787 + * ARM Neoverse-V3 erratum 4193784 + * ARM Neoverse-V3AE erratum 4193784 + * Microsoft Azure Cobalt 100 4193789 + * NVIDIA Olympus erratum T410-OLY-1029 + + On affected cores, some memory accesses might not be completed by + broadcast TLB invalidation. + + This issue is also known as CVE-2025-10263. + + If unsure, say Y. + config CAVIUM_ERRATUM_22375 bool "Cavium erratum 22375, 24313" default y diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index f9b0a2ee4a76d..02903c6d280af 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2012 ARM Ltd. + * Copyright (C) 2012, 2026 ARM Ltd. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as @@ -71,6 +71,7 @@ #define ARM_CPU_IMP_FUJITSU 0x46 #define ARM_CPU_IMP_HISI 0x48 #define ARM_CPU_IMP_AMPERE 0xC0 +#define ARM_CPU_IMP_MICROSOFT 0x6D #define ARM_CPU_PART_AEM_V8 0xD0F #define ARM_CPU_PART_FOUNDATION 0xD00 @@ -84,13 +85,30 @@ #define ARM_CPU_PART_CORTEX_A76 0xD0B #define ARM_CPU_PART_NEOVERSE_N1 0xD0C #define ARM_CPU_PART_CORTEX_A77 0xD0D +#define ARM_CPU_PART_CORTEX_A76AE 0xD0E #define ARM_CPU_PART_NEOVERSE_V1 0xD40 #define ARM_CPU_PART_CORTEX_A78 0xD41 +#define ARM_CPU_PART_CORTEX_A78AE 0xD42 #define ARM_CPU_PART_CORTEX_X1 0xD44 #define ARM_CPU_PART_CORTEX_A710 0xD47 +#define ARM_CPU_PART_CORTEX_A715 0xD4D #define ARM_CPU_PART_CORTEX_X2 0xD48 #define ARM_CPU_PART_NEOVERSE_N2 0xD49 #define ARM_CPU_PART_CORTEX_A78C 0xD4B +#define ARM_CPU_PART_CORTEX_X1C 0xD4C +#define ARM_CPU_PART_CORTEX_X3 0xD4E +#define ARM_CPU_PART_NEOVERSE_V2 0xD4F +#define ARM_CPU_PART_CORTEX_A720 0xD81 +#define ARM_CPU_PART_CORTEX_X4 0xD82 +#define ARM_CPU_PART_NEOVERSE_V3AE 0xD83 +#define ARM_CPU_PART_NEOVERSE_V3 0xD84 +#define ARM_CPU_PART_CORTEX_X925 0xD85 +#define ARM_CPU_PART_CORTEX_A725 0xD87 +#define ARM_CPU_PART_CORTEX_A720AE 0xD89 +#define ARM_CPU_PART_C1_ULTRA 0xD8C +#define ARM_CPU_PART_NEOVERSE_N3 0xD8E +#define ARM_CPU_PART_C1_PRO 0xD8B +#define ARM_CPU_PART_C1_PREMIUM 0xD90 #define APM_CPU_PART_XGENE 0x000 #define APM_CPU_VAR_POTENZA 0x00 @@ -114,6 +132,7 @@ #define NVIDIA_CPU_PART_DENVER 0x003 #define NVIDIA_CPU_PART_CARMEL 0x004 +#define NVIDIA_CPU_PART_OLYMPUS 0x010 #define FUJITSU_CPU_PART_A64FX 0x001 @@ -121,6 +140,8 @@ #define AMPERE_CPU_PART_AMPERE1 0xAC3 +#define MICROSOFT_CPU_PART_AZURE_COBALT_100 0xD49 /* Based on r0p0 of ARM Neoverse N2 */ + #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) @@ -131,13 +152,30 @@ #define MIDR_CORTEX_A76 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76) #define MIDR_NEOVERSE_N1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N1) #define MIDR_CORTEX_A77 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A77) +#define MIDR_CORTEX_A76AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76AE) #define MIDR_NEOVERSE_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1) #define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78) +#define MIDR_CORTEX_A78AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78AE) #define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1) #define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710) +#define MIDR_CORTEX_A715 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A715) #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) +#define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) +#define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) +#define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +#define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) +#define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) +#define MIDR_NEOVERSE_V3AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3AE) +#define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) +#define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) +#define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) +#define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) +#define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA) +#define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) +#define MIDR_C1_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PRO) +#define MIDR_C1_PREMIUM MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PREMIUM) #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) @@ -154,9 +192,11 @@ #define MIDR_QCOM_KRYO_4XX_SILVER MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_4XX_SILVER) #define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER) #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) +#define MIDR_NVIDIA_OLYMPUS MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_OLYMPUS) #define MIDR_FUJITSU_A64FX MIDR_CPU_MODEL(ARM_CPU_IMP_FUJITSU, FUJITSU_CPU_PART_A64FX) #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) #define MIDR_AMPERE1 MIDR_CPU_MODEL(ARM_CPU_IMP_AMPERE, AMPERE_CPU_PART_AMPERE1) +#define MIDR_MICROSOFT_AZURE_COBALT_100 MIDR_CPU_MODEL(ARM_CPU_IMP_MICROSOFT, MICROSOFT_CPU_PART_AZURE_COBALT_100) /* Fujitsu Erratum 010001 affects A64FX 1.0 and 1.1, (v0r0 and v1r0) */ #define MIDR_FUJITSU_ERRATUM_010001 MIDR_FUJITSU_A64FX diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index 8fc40a395babf..fdfdb1f4f0e58 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -684,6 +684,36 @@ static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = { { ERRATA_MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 0), }, +#endif +#ifdef CONFIG_ARM64_ERRATUM_4118414 + { + ERRATA_MIDR_RANGE_LIST(((const struct midr_range[]) { + MIDR_ALL_VERSIONS(MIDR_C1_PREMIUM), + MIDR_ALL_VERSIONS(MIDR_C1_ULTRA), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A76), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A76AE), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A77), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X3), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X4), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X925), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), + MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), + MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), + {} + })), + }, #endif {}, }; @@ -900,7 +930,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = { #endif #ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI { - .desc = "Qualcomm erratum 1009, or ARM erratum 1286807", + .desc = "Broken broadcast TLBI completion", .capability = ARM64_WORKAROUND_REPEAT_TLBI, .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, .matches = cpucap_multi_entry_cap_matches, diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/02a0a046.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/02a0a046.failed new file mode 100644 index 0000000000000..6857186bd50b4 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/02a0a046.failed @@ -0,0 +1,59 @@ +arm64: cputype: Add Cortex-X4 definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit 02a0a04676fa7796d9cbc9eb5ca120aaa194d2dd +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/02a0a046.failed + +Add cputype definitions for Cortex-X4. These will be used for errata +detection in subsequent patches. + +These values can be found in Table B-249 ("MIDR_EL1 bit descriptions") +in issue 0002-05 of the Cortex-X4 TRM, which can be found at: + + https://developer.arm.com/documentation/102484/0002/?lang=en + + Signed-off-by: Mark Rutland + Cc: Catalin Marinas + Cc: James Morse + Cc: Will Deacon +Link: https://lore.kernel.org/r/20240508081400.235362-3-mark.rutland@arm.com + Signed-off-by: Will Deacon +(cherry picked from commit 02a0a04676fa7796d9cbc9eb5ca120aaa194d2dd) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index 914d5ee3d152,2989c023c6f3..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -91,7 -85,8 +91,11 @@@ + #define ARM_CPU_PART_CORTEX_X2 0xD48 + #define ARM_CPU_PART_NEOVERSE_N2 0xD49 + #define ARM_CPU_PART_CORTEX_A78C 0xD4B +++<<<<<<< HEAD + +#define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++======= ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 +++>>>>>>> 02a0a04676fa (arm64: cputype: Add Cortex-X4 definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -139,7 -159,8 +143,11 @@@ + #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) + #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) + #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) +++<<<<<<< HEAD + +#define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++======= ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) +++>>>>>>> 02a0a04676fa (arm64: cputype: Add Cortex-X4 definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/0ce85db6.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/0ce85db6.failed new file mode 100644 index 0000000000000..1fa232d4298f8 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/0ce85db6.failed @@ -0,0 +1,61 @@ +arm64: cputype: Add Neoverse-V3 definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit 0ce85db6c2141b7ffb95709d76fc55a27ff3cdc1 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/0ce85db6.failed + +Add cputype definitions for Neoverse-V3. These will be used for errata +detection in subsequent patches. + +These values can be found in Table B-249 ("MIDR_EL1 bit descriptions") +in issue 0001-04 of the Neoverse-V3 TRM, which can be found at: + + https://developer.arm.com/documentation/107734/0001/?lang=en + + Signed-off-by: Mark Rutland + Cc: Catalin Marinas + Cc: James Morse + Cc: Will Deacon +Link: https://lore.kernel.org/r/20240508081400.235362-4-mark.rutland@arm.com + Signed-off-by: Will Deacon +(cherry picked from commit 0ce85db6c2141b7ffb95709d76fc55a27ff3cdc1) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index 914d5ee3d152,67a86926ae16..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -91,7 -85,9 +91,12 @@@ + #define ARM_CPU_PART_CORTEX_X2 0xD48 + #define ARM_CPU_PART_NEOVERSE_N2 0xD49 + #define ARM_CPU_PART_CORTEX_A78C 0xD4B +++<<<<<<< HEAD + +#define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++======= ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 +++>>>>>>> 0ce85db6c214 (arm64: cputype: Add Neoverse-V3 definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -139,7 -160,9 +144,12 @@@ + #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) + #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) + #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) +++<<<<<<< HEAD + +#define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++======= ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) +++>>>>>>> 0ce85db6c214 (arm64: cputype: Add Neoverse-V3 definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/2c995610.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/2c995610.failed new file mode 100644 index 0000000000000..6e67135dd6192 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/2c995610.failed @@ -0,0 +1,72 @@ +arm64: cputype: Add C1-Pro definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Catalin Marinas +commit 2c99561016c591f4c3d5ad7d22a61b8726e79735 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/2c995610.failed + +Add cputype definitions for C1-Pro. These will be used for errata +detection in subsequent patches. + +These values can be found in "Table A-303: MIDR_EL1 bit descriptions" in +issue 07 of the C1-Pro TRM: + + https://documentation-service.arm.com/static/6930126730f8f55a656570af + + Acked-by: Mark Rutland + Cc: Will Deacon + Cc: James Morse + Reviewed-by: Will Deacon + Signed-off-by: Catalin Marinas +(cherry picked from commit 2c99561016c591f4c3d5ad7d22a61b8726e79735) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index a1f0424edc4b,7b518e81dd15..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -96,6 -90,15 +96,18 @@@ + #define ARM_CPU_PART_CORTEX_X1C 0xD4C + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3AE 0xD83 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 ++ #define ARM_CPU_PART_CORTEX_X925 0xD85 ++ #define ARM_CPU_PART_CORTEX_A725 0xD87 ++ #define ARM_CPU_PART_CORTEX_A720AE 0xD89 ++ #define ARM_CPU_PART_NEOVERSE_N3 0xD8E ++ #define ARM_CPU_PART_C1_PRO 0xD8B +++>>>>>>> 2c99561016c5 (arm64: cputype: Add C1-Pro definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -148,6 -182,15 +160,18 @@@ + #define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3AE) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) ++ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) ++ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) ++ #define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) ++ #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) ++ #define MIDR_C1_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PRO) +++>>>>>>> 2c99561016c5 (arm64: cputype: Add C1-Pro definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/3bbf004c.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/3bbf004c.failed new file mode 100644 index 0000000000000..9704e2ce919dd --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/3bbf004c.failed @@ -0,0 +1,72 @@ +arm64: cputype: Add Neoverse-V3AE definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit 3bbf004c4808e2c3241e5c1ad6cc102f38a03c39 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/3bbf004c.failed + +Add cputype definitions for Neoverse-V3AE. These will be used for errata +detection in subsequent patches. + +These values can be found in the Neoverse-V3AE TRM: + + https://developer.arm.com/documentation/SDEN-2615521/9-0/ + +... in section A.6.1 ("MIDR_EL1, Main ID Register"). + + Signed-off-by: Mark Rutland + Cc: James Morse + Cc: Will Deacon + Cc: Catalin Marinas + Signed-off-by: Ryan Roberts + Signed-off-by: Will Deacon +(cherry picked from commit 3bbf004c4808e2c3241e5c1ad6cc102f38a03c39) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index b2ded290fb1f,9b00b75acbf2..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -95,6 -90,14 +95,17 @@@ + #define ARM_CPU_PART_CORTEX_X1C 0xD4C + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3AE 0xD83 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 ++ #define ARM_CPU_PART_CORTEX_X925 0xD85 ++ #define ARM_CPU_PART_CORTEX_A725 0xD87 ++ #define ARM_CPU_PART_CORTEX_A720AE 0xD89 ++ #define ARM_CPU_PART_NEOVERSE_N3 0xD8E +++>>>>>>> 3bbf004c4808 (arm64: cputype: Add Neoverse-V3AE definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -146,6 -181,14 +157,17 @@@ + #define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3AE) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) ++ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) ++ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) ++ #define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) ++ #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) +++>>>>>>> 3bbf004c4808 (arm64: cputype: Add Neoverse-V3AE definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/83bea32a.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/83bea32a.failed new file mode 100644 index 0000000000000..7b4fe79fb5c20 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/83bea32a.failed @@ -0,0 +1,51 @@ +arm64: Add part number for Arm Cortex-A78AE + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Chanho Park +commit 83bea32ac7ed37bbda58733de61fc9369513f9f9 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/83bea32a.failed + +Add the MIDR part number info for the Arm Cortex-A78AE[1] and add it to +spectre-BHB affected list[2]. + +[1]: https://developer.arm.com/Processors/Cortex-A78AE +[2]: https://developer.arm.com/Arm%20Security%20Center/Spectre-BHB + + Cc: Catalin Marinas + Cc: Mark Rutland + Cc: Will Deacon + Cc: James Morse + Signed-off-by: Chanho Park +Link: https://lore.kernel.org/r/20220407091128.8700-1-chanho61.park@samsung.com + Signed-off-by: Will Deacon +(cherry picked from commit 83bea32ac7ed37bbda58733de61fc9369513f9f9) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/kernel/proton-pack.c +* Unmerged path arch/arm64/kernel/proton-pack.c +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index 700aab417968..b392a6aca719 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -87,6 +87,7 @@ + #define ARM_CPU_PART_CORTEX_A76AE 0xD0E + #define ARM_CPU_PART_NEOVERSE_V1 0xD40 + #define ARM_CPU_PART_CORTEX_A78 0xD41 ++#define ARM_CPU_PART_CORTEX_A78AE 0xD42 + #define ARM_CPU_PART_CORTEX_X1 0xD44 + #define ARM_CPU_PART_CORTEX_A710 0xD47 + #define ARM_CPU_PART_CORTEX_A715 0xD4D +@@ -140,6 +141,7 @@ + #define MIDR_CORTEX_A76AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76AE) + #define MIDR_NEOVERSE_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1) + #define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78) ++#define MIDR_CORTEX_A78AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78AE) + #define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1) + #define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710) + #define MIDR_CORTEX_A715 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A715) +* Unmerged path arch/arm64/kernel/proton-pack.c diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/858d2a4f.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/858d2a4f.failed new file mode 100644 index 0000000000000..a300ee0a55d9b --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/858d2a4f.failed @@ -0,0 +1,279 @@ +tcp: fix potential race in tcp_v6_syn_recv_sock() + +jira KERNEL-1291 +cve CVE-2026-43198 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Eric Dumazet +commit 858d2a4f67ff69e645a43487ef7ea7f28f06deae +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/858d2a4f.failed + +Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() +is done too late. + +After tcp_v4_syn_recv_sock(), the child socket is already visible +from TCP ehash table and other cpus might use it. + +Since newinet->pinet6 is still pointing to the listener ipv6_pinfo +bad things can happen as syzbot found. + +Move the problematic code in tcp_v6_mapped_child_init() +and call this new helper from tcp_v4_syn_recv_sock() before +the ehash insertion. + +This allows the removal of one tcp_sync_mss(), since +tcp_v4_syn_recv_sock() will call it with the correct +context. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") + Reported-by: syzbot+937b5bbb6a815b3e5d0b@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/69949275.050a0220.2eeac1.0145.GAE@google.com/ + Signed-off-by: Eric Dumazet + Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260217161205.2079883-1-edumazet@google.com + Signed-off-by: Jakub Kicinski +(cherry picked from commit 858d2a4f67ff69e645a43487ef7ea7f28f06deae) + Signed-off-by: Jonathan Maple + +# Conflicts: +# net/ipv6/tcp_ipv6.c +diff --cc net/ipv6/tcp_ipv6.c +index 28bb5042eb1b,e46a0efae012..000000000000 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@@ -1097,15 -1351,16 +1132,17 @@@ static struct sock *tcp_v6_syn_recv_soc + struct request_sock *req, + struct dst_entry *dst, + struct request_sock *req_unhash, +- bool *own_req) ++ bool *own_req, ++ void (*opt_child_init)(struct sock *newsk, ++ const struct sock *sk)) + { + - const struct ipv6_pinfo *np = tcp_inet6_sk(sk); + struct inet_request_sock *ireq; + + struct ipv6_pinfo *newnp; + + const struct ipv6_pinfo *np = inet6_sk(sk); + struct ipv6_txoptions *opt; + + struct tcp6_sock *newtcp6sk; + struct inet_sock *newinet; + bool found_dup_sk = false; + - struct ipv6_pinfo *newnp; + struct tcp_sock *newtp; + struct sock *newsk; + #ifdef CONFIG_TCP_MD5SIG +@@@ -1113,62 -1368,11 +1150,69 @@@ + #endif + struct flowi6 fl6; + +++<<<<<<< HEAD + + if (skb->protocol == htons(ETH_P_IP)) { + + /* + + * v6 mapped + + */ + + + + newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst, + + req_unhash, own_req); + + + + if (!newsk) + + return NULL; + + + + newtcp6sk = (struct tcp6_sock *)newsk; + + inet_sk(newsk)->pinet6 = &newtcp6sk->inet6; + + + + newinet = inet_sk(newsk); + + newnp = inet6_sk(newsk); + + newtp = tcp_sk(newsk); + + + + memcpy(newnp, np, sizeof(struct ipv6_pinfo)); + + + + newnp->saddr = newsk->sk_v6_rcv_saddr; + + + + inet_csk(newsk)->icsk_af_ops = &ipv6_mapped; + + if (sk_is_mptcp(newsk)) + + mptcpv6_handle_mapped(newsk, true); + + newsk->sk_backlog_rcv = tcp_v4_do_rcv; + +#ifdef CONFIG_TCP_MD5SIG + + newtp->af_specific = &tcp_sock_ipv6_mapped_specific; + +#endif + + + + newnp->ipv6_mc_list = NULL; + + newnp->ipv6_ac_list = NULL; + + newnp->ipv6_fl_list = NULL; + + newnp->pktoptions = NULL; + + newnp->opt = NULL; + + newnp->mcast_oif = inet_iif(skb); + + newnp->mcast_hops = ip_hdr(skb)->ttl; + + newnp->rcv_flowinfo = 0; + + if (np->repflow) + + newnp->flow_label = 0; + + + + /* + + * No need to charge this sock to the relevant IPv6 refcnt debug socks count + + * here, tcp_create_openreq_child now does this for us, see the comment in + + * that function for the gory details. -acme + + */ + + + + /* It is tricky place. Until this moment IPv4 tcp + + worked with IPv6 icsk.icsk_af_ops. + + Sync it now. + + */ + + tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie); + + + + return newsk; + + } + + +++======= ++ if (skb->protocol == htons(ETH_P_IP)) ++ return tcp_v4_syn_recv_sock(sk, skb, req, dst, ++ req_unhash, own_req, ++ tcp_v6_mapped_child_init); +++>>>>>>> 858d2a4f67ff (tcp: fix potential race in tcp_v6_syn_recv_sock()) + ireq = inet_rsk(req); + + if (sk_acceptq_is_full(sk)) +diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h +index eb56297755ff..5c896d8b5da7 100644 +--- a/include/net/inet_connection_sock.h ++++ b/include/net/inet_connection_sock.h +@@ -43,7 +43,9 @@ struct inet_connection_sock_af_ops { + struct request_sock *req, + struct dst_entry *dst, + struct request_sock *req_unhash, +- bool *own_req); ++ bool *own_req, ++ void (*opt_child_init)(struct sock *newsk, ++ const struct sock *sk)); + u16 net_header_len; + u16 net_frag_header_len; + u16 sockaddr_len; +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 001fde1ab587..09d9a1421df4 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -461,7 +461,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, + struct request_sock *req, + struct dst_entry *dst, + struct request_sock *req_unhash, +- bool *own_req); ++ bool *own_req, ++ void (*opt_child_init)(struct sock *newsk, ++ const struct sock *sk)); + int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb); + int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len); + int tcp_connect(struct sock *sk); +diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c +index 30c03b68abd8..02fb72ec2573 100644 +--- a/net/ipv4/syncookies.c ++++ b/net/ipv4/syncookies.c +@@ -211,7 +211,7 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb, + bool own_req; + + child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst, +- NULL, &own_req); ++ NULL, &own_req, NULL); + if (child) { + refcount_set(&req->rsk_refcnt, 1); + tcp_sk(child)->tsoffset = tsoff; +diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c +index dd6347dd8e97..68698a75a84a 100644 +--- a/net/ipv4/tcp_fastopen.c ++++ b/net/ipv4/tcp_fastopen.c +@@ -226,7 +226,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk, + req->sk = NULL; + + child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, +- NULL, &own_req); ++ NULL, &own_req, NULL); + if (!child) + return NULL; + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 76b0753d79c0..daa48ad710d8 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1411,7 +1411,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, + struct request_sock *req, + struct dst_entry *dst, + struct request_sock *req_unhash, +- bool *own_req) ++ bool *own_req, ++ void (*opt_child_init)(struct sock *newsk, ++ const struct sock *sk)) + { + struct inet_request_sock *ireq; + bool found_dup_sk = false; +@@ -1460,6 +1462,10 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, + } + sk_setup_caps(newsk, dst); + ++#if IS_ENABLED(CONFIG_IPV6) ++ if (opt_child_init) ++ opt_child_init(newsk, sk); ++#endif + tcp_ca_openreq_child(newsk, dst); + + tcp_sync_mss(newsk, dst_mtu(dst)); +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index bfc953672833..02f589e03b75 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -752,7 +752,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, + * socket is created, wait for troubles. + */ + child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, +- req, &own_req); ++ req, &own_req, NULL); + if (!child) + goto listen_overflow; + +* Unmerged path net/ipv6/tcp_ipv6.c +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index ef4e4e0aa6ae..5bf87d1da933 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -610,7 +610,9 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, + struct request_sock *req, + struct dst_entry *dst, + struct request_sock *req_unhash, +- bool *own_req) ++ bool *own_req, ++ void (*opt_child_init)(struct sock *newsk, ++ const struct sock *sk)) + { + struct mptcp_subflow_context *listener = mptcp_subflow_ctx(sk); + struct mptcp_subflow_request_sock *subflow_req; +@@ -664,7 +666,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, + + create_child: + child = listener->icsk_af_ops->syn_recv_sock(sk, skb, req, dst, +- req_unhash, own_req); ++ req_unhash, own_req, opt_child_init); + + if (child && *own_req) { + struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(child); +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 64c40a93a924..02f2cf3b678b 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -118,7 +118,9 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, + struct request_sock *req, + struct dst_entry *dst, + struct request_sock *req_unhash, +- bool *own_req) ++ bool *own_req, ++ void (*opt_child_init)(struct sock *newsk, ++ const struct sock *sk)) + { + struct smc_sock *smc; + struct sock *child; +@@ -136,7 +138,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, + + /* passthrough to original syn recv sock fct */ + child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, +- own_req); ++ own_req, opt_child_init); + /* child must not inherit smc or its ops */ + if (child) { + rcu_assign_sk_user_data(child, NULL); diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/92472570.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/92472570.failed new file mode 100644 index 0000000000000..c93fb48a68921 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/92472570.failed @@ -0,0 +1,66 @@ +arm64: cputype: Add Neoverse-N3 definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit 924725707d80bc2588cefafef76ff3f164d299bc +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/92472570.failed + +Add cputype definitions for Neoverse-N3. These will be used for errata +detection in subsequent patches. + +These values can be found in Table A-261 ("MIDR_EL1 bit descriptions") +in issue 02 of the Neoverse-N3 TRM, which can be found at: + + https://developer.arm.com/documentation/107997/0000/?lang=en + + Signed-off-by: Mark Rutland + Cc: James Morse + Cc: Will Deacon +Link: https://lore.kernel.org/r/20240930111705.3352047-2-mark.rutland@arm.com + Signed-off-by: Catalin Marinas +(cherry picked from commit 924725707d80bc2588cefafef76ff3f164d299bc) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index a1f0424edc4b,488f8e751349..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -96,6 -89,12 +96,15 @@@ + #define ARM_CPU_PART_CORTEX_X1C 0xD4C + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 ++ #define ARM_CPU_PART_CORTEX_X925 0xD85 ++ #define ARM_CPU_PART_CORTEX_A725 0xD87 ++ #define ARM_CPU_PART_NEOVERSE_N3 0xD8E +++>>>>>>> 924725707d80 (arm64: cputype: Add Neoverse-N3 definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -148,6 -172,12 +157,15 @@@ + #define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) ++ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) ++ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) ++ #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) +++>>>>>>> 924725707d80 (arm64: cputype: Add Neoverse-N3 definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/9ef54a38.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/9ef54a38.failed new file mode 100644 index 0000000000000..222c33ba37e94 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/9ef54a38.failed @@ -0,0 +1,66 @@ +arm64: cputype: Add Cortex-A725 definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit 9ef54a384526911095db465e77acc1cb5266b32c +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/9ef54a38.failed + +Add cputype definitions for Cortex-A725. These will be used for errata +detection in subsequent patches. + +These values can be found in the Cortex-A725 TRM: + + https://developer.arm.com/documentation/107652/0001/ + +... in table A-247 ("MIDR_EL1 bit descriptions"). + + Signed-off-by: Mark Rutland + Cc: James Morse + Cc: Will Deacon + Reviewed-by: Anshuman Khandual +Link: https://lore.kernel.org/r/20240801101803.1982459-3-mark.rutland@arm.com + Signed-off-by: Catalin Marinas +(cherry picked from commit 9ef54a384526911095db465e77acc1cb5266b32c) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index a1f0424edc4b,5fd7caea4419..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -96,6 -89,11 +96,14 @@@ + #define ARM_CPU_PART_CORTEX_X1C 0xD4C + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 ++ #define ARM_CPU_PART_CORTEX_X925 0xD85 ++ #define ARM_CPU_PART_CORTEX_A725 0xD87 +++>>>>>>> 9ef54a384526 (arm64: cputype: Add Cortex-A725 definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -148,6 -170,11 +156,14 @@@ + #define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) ++ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) ++ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) +++>>>>>>> 9ef54a384526 (arm64: cputype: Add Cortex-A725 definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/add332c4.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/add332c4.failed new file mode 100644 index 0000000000000..9e4e994090ae8 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/add332c4.failed @@ -0,0 +1,66 @@ +arm64: cputype: Add Cortex-A720 definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit add332c40328cf06fe35e4b3cde8ec315c4629e5 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/add332c4.failed + +Add cputype definitions for Cortex-A720. These will be used for errata +detection in subsequent patches. + +These values can be found in Table A-186 ("MIDR_EL1 bit descriptions") +in issue 0002-05 of the Cortex-A720 TRM, which can be found at: + + https://developer.arm.com/documentation/102530/0002/?lang=en + + Signed-off-by: Mark Rutland + Cc: James Morse + Cc: Will Deacon +Link: https://lore.kernel.org/r/20240603111812.1514101-3-mark.rutland@arm.com + Signed-off-by: Catalin Marinas +(cherry picked from commit add332c40328cf06fe35e4b3cde8ec315c4629e5) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index a1f0424edc4b,dcbac1ce6c25..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -93,9 -86,11 +93,15 @@@ + #define ARM_CPU_PART_CORTEX_X2 0xD48 + #define ARM_CPU_PART_NEOVERSE_N2 0xD49 + #define ARM_CPU_PART_CORTEX_A78C 0xD4B + +#define ARM_CPU_PART_CORTEX_X1C 0xD4C + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 +++>>>>>>> add332c40328 (arm64: cputype: Add Cortex-A720 definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -145,9 -164,11 +151,15 @@@ + #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) + #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) + #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) + +#define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) +++>>>>>>> add332c40328 (arm64: cputype: Add Cortex-A720 definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/f38c2c3e.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/f38c2c3e.failed new file mode 100644 index 0000000000000..1fb8d3e6b1c33 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/f38c2c3e.failed @@ -0,0 +1,66 @@ +arm64: cputype: Add Cortex-A720AE definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Kuninori Morimoto +commit f38c2c3e572ce0ce5c01de0358ed70328e0cb5af +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/f38c2c3e.failed + +Add cputype definitions for Cortex-A720AE. These will be used for errata +detection in subsequent patches. + +These values can be found in the Cortex-A720AE TRM: + +https://developer.arm.com/documentation/102828/0001/ + +... in Table A-187 + + Signed-off-by: Kuninori Morimoto + Signed-off-by: Will Deacon +(cherry picked from commit f38c2c3e572ce0ce5c01de0358ed70328e0cb5af) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index a1f0424edc4b,b10eba7f5247..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -96,6 -91,13 +96,16 @@@ + #define ARM_CPU_PART_CORTEX_X1C 0xD4C + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 ++ #define ARM_CPU_PART_CORTEX_X925 0xD85 ++ #define ARM_CPU_PART_CORTEX_A725 0xD87 ++ #define ARM_CPU_PART_CORTEX_A720AE 0xD89 ++ #define ARM_CPU_PART_NEOVERSE_N3 0xD8E +++>>>>>>> f38c2c3e572c (arm64: cputype: Add Cortex-A720AE definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -148,6 -181,13 +158,16 @@@ + #define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) ++ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) ++ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) ++ #define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) ++ #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) +++>>>>>>> f38c2c3e572c (arm64: cputype: Add Cortex-A720AE definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fb091ff3.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fb091ff3.failed new file mode 100644 index 0000000000000..97bbacdb53ac7 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fb091ff3.failed @@ -0,0 +1,157 @@ +arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Easwar Hariharan +commit fb091ff394792c018527b3211bbdfae93ea4ac02 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fb091ff3.failed + +Add the MIDR value of Microsoft Azure Cobalt 100, which is a Microsoft +implemented CPU based on r0p0 of the ARM Neoverse N2 CPU, and therefore +suffers from all the same errata. + +CC: stable@vger.kernel.org # 5.15+ + Signed-off-by: Easwar Hariharan + Reviewed-by: Anshuman Khandual + Acked-by: Mark Rutland + Acked-by: Marc Zyngier + Reviewed-by: Oliver Upton +Link: https://lore.kernel.org/r/20240214175522.2457857-1-eahariha@linux.microsoft.com + Signed-off-by: Will Deacon +(cherry picked from commit fb091ff394792c018527b3211bbdfae93ea4ac02) + Signed-off-by: Jonathan Maple + +# Conflicts: +# Documentation/arm64/silicon-errata.rst +# arch/arm64/kernel/cpu_errata.c +diff --cc Documentation/arm64/silicon-errata.rst +index 433acf4dddd5,45a7f4932fe0..000000000000 +--- a/Documentation/arm64/silicon-errata.rst ++++ b/Documentation/arm64/silicon-errata.rst +@@@ -164,3 -235,18 +164,16 @@@ stable kernels + +----------------+-----------------+-----------------+-----------------------------+ + | Fujitsu | A64FX | E#010001 | FUJITSU_ERRATUM_010001 | + +----------------+-----------------+-----------------+-----------------------------+ +++<<<<<<< HEAD:Documentation/arm64/silicon-errata.rst +++======= ++ +----------------+-----------------+-----------------+-----------------------------+ ++ | ASR | ASR8601 | #8601001 | N/A | ++ +----------------+-----------------+-----------------+-----------------------------+ ++ +----------------+-----------------+-----------------+-----------------------------+ ++ | Microsoft | Azure Cobalt 100| #2139208 | ARM64_ERRATUM_2139208 | ++ +----------------+-----------------+-----------------+-----------------------------+ ++ | Microsoft | Azure Cobalt 100| #2067961 | ARM64_ERRATUM_2067961 | ++ +----------------+-----------------+-----------------+-----------------------------+ ++ | Microsoft | Azure Cobalt 100| #2253138 | ARM64_ERRATUM_2253138 | ++ +----------------+-----------------+-----------------+-----------------------------+ +++>>>>>>> fb091ff39479 (arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata):Documentation/arch/arm64/silicon-errata.rst +diff --cc arch/arm64/kernel/cpu_errata.c +index 8fc40a395bab,76b8dd37092a..000000000000 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@@ -815,6 -370,68 +815,71 @@@ static const struct midr_range erratum_ + }; + #endif + +++<<<<<<< HEAD +++======= ++ #ifdef CONFIG_ARM64_WORKAROUND_TRBE_OVERWRITE_FILL_MODE ++ static const struct midr_range trbe_overwrite_fill_mode_cpus[] = { ++ #ifdef CONFIG_ARM64_ERRATUM_2139208 ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), ++ MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), ++ #endif ++ #ifdef CONFIG_ARM64_ERRATUM_2119858 ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), ++ MIDR_RANGE(MIDR_CORTEX_X2, 0, 0, 2, 0), ++ #endif ++ {}, ++ }; ++ #endif /* CONFIG_ARM64_WORKAROUND_TRBE_OVERWRITE_FILL_MODE */ ++ ++ #ifdef CONFIG_ARM64_WORKAROUND_TSB_FLUSH_FAILURE ++ static const struct midr_range tsb_flush_fail_cpus[] = { ++ #ifdef CONFIG_ARM64_ERRATUM_2067961 ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), ++ MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), ++ #endif ++ #ifdef CONFIG_ARM64_ERRATUM_2054223 ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), ++ #endif ++ {}, ++ }; ++ #endif /* CONFIG_ARM64_WORKAROUND_TSB_FLUSH_FAILURE */ ++ ++ #ifdef CONFIG_ARM64_WORKAROUND_TRBE_WRITE_OUT_OF_RANGE ++ static struct midr_range trbe_write_out_of_range_cpus[] = { ++ #ifdef CONFIG_ARM64_ERRATUM_2253138 ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), ++ MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), ++ #endif ++ #ifdef CONFIG_ARM64_ERRATUM_2224489 ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), ++ MIDR_RANGE(MIDR_CORTEX_X2, 0, 0, 2, 0), ++ #endif ++ {}, ++ }; ++ #endif /* CONFIG_ARM64_WORKAROUND_TRBE_WRITE_OUT_OF_RANGE */ ++ ++ #ifdef CONFIG_ARM64_ERRATUM_1742098 ++ static struct midr_range broken_aarch32_aes[] = { ++ MIDR_RANGE(MIDR_CORTEX_A57, 0, 1, 0xf, 0xf), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A72), ++ {}, ++ }; ++ #endif /* CONFIG_ARM64_WORKAROUND_TRBE_WRITE_OUT_OF_RANGE */ ++ ++ #ifdef CONFIG_ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD ++ static const struct midr_range erratum_spec_unpriv_load_list[] = { ++ #ifdef CONFIG_ARM64_ERRATUM_3117295 ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A510), ++ #endif ++ #ifdef CONFIG_ARM64_ERRATUM_2966298 ++ /* Cortex-A520 r0p0 to r0p1 */ ++ MIDR_REV_RANGE(MIDR_CORTEX_A520, 0, 0, 1), ++ #endif ++ {}, ++ }; ++ #endif ++ +++>>>>>>> fb091ff39479 (arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata) + const struct arm64_cpu_capabilities arm64_errata[] = { + #ifdef CONFIG_ARM64_WORKAROUND_CLEAN_CACHE + { +* Unmerged path Documentation/arm64/silicon-errata.rst +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index 700aab417968..52185ac37aa9 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -71,6 +71,7 @@ + #define ARM_CPU_IMP_FUJITSU 0x46 + #define ARM_CPU_IMP_HISI 0x48 + #define ARM_CPU_IMP_AMPERE 0xC0 ++#define ARM_CPU_IMP_MICROSOFT 0x6D + + #define ARM_CPU_PART_AEM_V8 0xD0F + #define ARM_CPU_PART_FOUNDATION 0xD00 +@@ -127,6 +128,8 @@ + + #define AMPERE_CPU_PART_AMPERE1 0xAC3 + ++#define MICROSOFT_CPU_PART_AZURE_COBALT_100 0xD49 /* Based on r0p0 of ARM Neoverse N2 */ ++ + #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) + #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) + #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) +@@ -169,6 +172,7 @@ + #define MIDR_FUJITSU_A64FX MIDR_CPU_MODEL(ARM_CPU_IMP_FUJITSU, FUJITSU_CPU_PART_A64FX) + #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) + #define MIDR_AMPERE1 MIDR_CPU_MODEL(ARM_CPU_IMP_AMPERE, AMPERE_CPU_PART_AMPERE1) ++#define MIDR_MICROSOFT_AZURE_COBALT_100 MIDR_CPU_MODEL(ARM_CPU_IMP_MICROSOFT, MICROSOFT_CPU_PART_AZURE_COBALT_100) + + /* Fujitsu Erratum 010001 affects A64FX 1.0 and 1.1, (v0r0 and v1r0) */ + #define MIDR_FUJITSU_ERRATUM_010001 MIDR_FUJITSU_A64FX +* Unmerged path arch/arm64/kernel/cpu_errata.c diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fd2ff5f0.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fd2ff5f0.failed new file mode 100644 index 0000000000000..4c120f7ab32fd --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fd2ff5f0.failed @@ -0,0 +1,62 @@ +arm64: cputype: Add Cortex-X925 definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit fd2ff5f0b320f418288e7a1f919f648fbc8a0dfc +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fd2ff5f0.failed + +Add cputype definitions for Cortex-X925. These will be used for errata +detection in subsequent patches. + +These values can be found in Table A-285 ("MIDR_EL1 bit descriptions") +in issue 0001-05 of the Cortex-X925 TRM, which can be found at: + + https://developer.arm.com/documentation/102807/0001/?lang=en + + Signed-off-by: Mark Rutland + Cc: James Morse + Cc: Will Deacon +Link: https://lore.kernel.org/r/20240603111812.1514101-4-mark.rutland@arm.com + Signed-off-by: Catalin Marinas +(cherry picked from commit fd2ff5f0b320f418288e7a1f919f648fbc8a0dfc) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index 830bacf6dd89,1cb0704c6163..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -93,6 -88,10 +93,13 @@@ + #define ARM_CPU_PART_CORTEX_A78C 0xD4B + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 ++ #define ARM_CPU_PART_CORTEX_X925 0xD85 +++>>>>>>> fd2ff5f0b320 (arm64: cputype: Add Cortex-X925 definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -142,6 -167,10 +149,13 @@@ + #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) ++ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) +++>>>>>>> fd2ff5f0b320 (arm64: cputype: Add Cortex-X925 definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/rebuild.details.txt b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/rebuild.details.txt new file mode 100644 index 0000000000000..26d89dafe5a3d --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/rebuild.details.txt @@ -0,0 +1,39 @@ +Rebuild_History BUILDABLE +Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50% +Number of commits in upstream range v4.18~1..kernel-mainline: 625874 +Number of commits in rpm: 36 +Number of commits matched with upstream: 25 (69.44%) +Number of commits in upstream but not in rpm: 625851 +Number of commits NOT found in upstream: 11 (30.56%) + +Rebuilding Kernel on Branch rocky8_10_rebuild_kernel-4.18.0-553.141.1.el8_10 for kernel-4.18.0-553.141.1.el8_10 +Clean Cherry Picks: 11 (44.00%) +Empty Cherry Picks: 12 (48.00%) +_______________________________ + +__EMPTY COMMITS__________________________ +858d2a4f67ff69e645a43487ef7ea7f28f06deae tcp: fix potential race in tcp_v6_syn_recv_sock() +02a0a04676fa7796d9cbc9eb5ca120aaa194d2dd arm64: cputype: Add Cortex-X4 definitions +0ce85db6c2141b7ffb95709d76fc55a27ff3cdc1 arm64: cputype: Add Neoverse-V3 definitions +fd2ff5f0b320f418288e7a1f919f648fbc8a0dfc arm64: cputype: Add Cortex-X925 definitions +3bbf004c4808e2c3241e5c1ad6cc102f38a03c39 arm64: cputype: Add Neoverse-V3AE definitions +add332c40328cf06fe35e4b3cde8ec315c4629e5 arm64: cputype: Add Cortex-A720 definitions +9ef54a384526911095db465e77acc1cb5266b32c arm64: cputype: Add Cortex-A725 definitions +924725707d80bc2588cefafef76ff3f164d299bc arm64: cputype: Add Neoverse-N3 definitions +f38c2c3e572ce0ce5c01de0358ed70328e0cb5af arm64: cputype: Add Cortex-A720AE definitions +2c99561016c591f4c3d5ad7d22a61b8726e79735 arm64: cputype: Add C1-Pro definitions +fb091ff394792c018527b3211bbdfae93ea4ac02 arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata +83bea32ac7ed37bbda58733de61fc9369513f9f9 arm64: Add part number for Arm Cortex-A78AE + +__CHANGES NOT IN UPSTREAM________________ +Adding prod certs and changed cert date to 20210620 +Adding Rocky secure boot certs +Fixing vmlinuz removal +Fixing UEFI CA path +Porting to 8.10, debranding and Rocky branding +Fixing pesign_key_name values +Enable workaround for ARM64 ERRATUM 4118414 +arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU +arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU +arm64: errata: Mitigate TLBI errata on various Arm CPUs +vfs: validate inode i_link before use in get_link() diff --git a/configs/kernel-4.18.0-aarch64-debug.config b/configs/kernel-4.18.0-aarch64-debug.config index c41cff40f6e7d..2fb186afad59b 100644 --- a/configs/kernel-4.18.0-aarch64-debug.config +++ b/configs/kernel-4.18.0-aarch64-debug.config @@ -587,6 +587,7 @@ CONFIG_ARM64_ERRATUM_1286807=y CONFIG_ARM64_ERRATUM_1463225=y CONFIG_ARM64_ERRATUM_1542419=y CONFIG_ARM64_ERRATUM_1508412=y +CONFIG_ARM64_ERRATUM_4118414=y CONFIG_CAVIUM_ERRATUM_22375=y CONFIG_CAVIUM_ERRATUM_23144=y CONFIG_CAVIUM_ERRATUM_23154=y diff --git a/configs/kernel-4.18.0-aarch64.config b/configs/kernel-4.18.0-aarch64.config index b4dce2ffa35a2..c1e13f91b5bf6 100644 --- a/configs/kernel-4.18.0-aarch64.config +++ b/configs/kernel-4.18.0-aarch64.config @@ -607,6 +607,7 @@ CONFIG_ARM64_ERRATUM_1286807=y CONFIG_ARM64_ERRATUM_1463225=y CONFIG_ARM64_ERRATUM_1542419=y CONFIG_ARM64_ERRATUM_1508412=y +CONFIG_ARM64_ERRATUM_4118414=y CONFIG_CAVIUM_ERRATUM_22375=y CONFIG_CAVIUM_ERRATUM_23144=y CONFIG_CAVIUM_ERRATUM_23154=y diff --git a/configs/kernel-aarch64-debug.config b/configs/kernel-aarch64-debug.config index 0c86124df8b76..2ec7d3767b111 100644 --- a/configs/kernel-aarch64-debug.config +++ b/configs/kernel-aarch64-debug.config @@ -2532,6 +2532,7 @@ CONFIG_ARM64_CRYPTO=y CONFIG_ARM64_E0PD=y CONFIG_ARM64_ERRATUM_1024718=y CONFIG_ARM64_ERRATUM_1542419=y +CONFIG_ARM64_ERRATUM_4118414=y CONFIG_ARM64_ERRATUM_819472=y CONFIG_ARM64_ERRATUM_824069=y CONFIG_ARM64_ERRATUM_826319=y diff --git a/configs/kernel-aarch64.config b/configs/kernel-aarch64.config index 4f2cd521c77cf..fc112c2e95b9e 100644 --- a/configs/kernel-aarch64.config +++ b/configs/kernel-aarch64.config @@ -2604,6 +2604,7 @@ CONFIG_ARM64_CRYPTO=y CONFIG_ARM64_E0PD=y CONFIG_ARM64_ERRATUM_1024718=y CONFIG_ARM64_ERRATUM_1542419=y +CONFIG_ARM64_ERRATUM_4118414=y CONFIG_ARM64_ERRATUM_819472=y CONFIG_ARM64_ERRATUM_824069=y CONFIG_ARM64_ERRATUM_826319=y diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c index 235a81c57b7e6..f010fae1e3422 100644 --- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c +++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c @@ -162,8 +162,8 @@ int drm_gem_fb_init_with_funcs(struct drm_device *dev, } for (i = 0; i < info->num_planes; i++) { - unsigned int width = mode_cmd->width / (i ? info->hsub : 1); - unsigned int height = mode_cmd->height / (i ? info->vsub : 1); + unsigned int width = drm_format_info_plane_width(info, mode_cmd->width, i); + unsigned int height = drm_format_info_plane_height(info, mode_cmd->height, i); unsigned int min_size; objs[i] = drm_gem_object_lookup(file, mode_cmd->handles[i]); diff --git a/fs/cifs/fs_context.c b/fs/cifs/fs_context.c index 2ecdd4c94cad6..72c1449839c9a 100644 --- a/fs/cifs/fs_context.c +++ b/fs/cifs/fs_context.c @@ -471,6 +471,10 @@ char *cifs_sanitize_prepath(char *prepath, gfp_t gfp) while (IS_DELIM(*cursor1)) cursor1++; + /* exit in case of only delimiters */ + if (!*cursor1) + return NULL; + /* copy the first letter */ *cursor2 = *cursor1; diff --git a/fs/namei.c b/fs/namei.c index 5e46b0a359d53..7fb5075901e17 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1142,6 +1142,9 @@ const char *get_link(struct nameidata *nd) return ERR_PTR(error); nd->last_type = LAST_BIND; + if (nd->flags & LOOKUP_RCU && + unlikely(read_seqcount_retry(&dentry->d_seq, last->seq))) + return ERR_PTR(-ECHILD); res = READ_ONCE(inode->i_link); if (!res) { const char * (*get)(struct dentry *, struct inode *, diff --git a/fs/proc/array.c b/fs/proc/array.c index f4aa69a92be41..2ade0bae20cff 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -496,7 +496,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, } sid = task_session_nr_ns(task, ns); - ppid = task_tgid_nr_ns(task->real_parent, ns); + ppid = task_ppid_nr_ns(task, ns); pgid = task_pgrp_nr_ns(task, ns); unlock_task_sighand(task, &flags); diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h index eb56297755ffe..5c896d8b5da72 100644 --- a/include/net/inet_connection_sock.h +++ b/include/net/inet_connection_sock.h @@ -43,7 +43,9 @@ struct inet_connection_sock_af_ops { struct request_sock *req, struct dst_entry *dst, struct request_sock *req_unhash, - bool *own_req); + bool *own_req, + void (*opt_child_init)(struct sock *newsk, + const struct sock *sk)); u16 net_header_len; u16 net_frag_header_len; u16 sockaddr_len; diff --git a/include/net/tcp.h b/include/net/tcp.h index 001fde1ab5877..09d9a1421df42 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -461,7 +461,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, struct request_sock *req, struct dst_entry *dst, struct request_sock *req_unhash, - bool *own_req); + bool *own_req, + void (*opt_child_init)(struct sock *newsk, + const struct sock *sk)); int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb); int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len); int tcp_connect(struct sock *sk); diff --git a/kernel.sbat b/kernel.sbat index b650c3a57d6ae..9ff3aa0ba526b 100644 --- a/kernel.sbat +++ b/kernel.sbat @@ -1,2 +1,2 @@ sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md -kernel.centos,1,Red Hat,kernel-core,4.18.0-553.139.1.el8_10.x86_64,mailto:secalert@redhat.com +kernel.rocky,1,RESF,kernel-core,4.18.0-553.141.1.el8_10.x86_64,mailto:security@rockylinux.org diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c index 30c03b68abd8b..02fb72ec2573f 100644 --- a/net/ipv4/syncookies.c +++ b/net/ipv4/syncookies.c @@ -211,7 +211,7 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb, bool own_req; child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst, - NULL, &own_req); + NULL, &own_req, NULL); if (child) { refcount_set(&req->rsk_refcnt, 1); tcp_sk(child)->tsoffset = tsoff; diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c index dd6347dd8e97c..68698a75a84a9 100644 --- a/net/ipv4/tcp_fastopen.c +++ b/net/ipv4/tcp_fastopen.c @@ -226,7 +226,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk, req->sk = NULL; child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, - NULL, &own_req); + NULL, &own_req, NULL); if (!child) return NULL; diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 76b0753d79c06..daa48ad710d87 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1411,7 +1411,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, struct request_sock *req, struct dst_entry *dst, struct request_sock *req_unhash, - bool *own_req) + bool *own_req, + void (*opt_child_init)(struct sock *newsk, + const struct sock *sk)) { struct inet_request_sock *ireq; bool found_dup_sk = false; @@ -1460,6 +1462,10 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, } sk_setup_caps(newsk, dst); +#if IS_ENABLED(CONFIG_IPV6) + if (opt_child_init) + opt_child_init(newsk, sk); +#endif tcp_ca_openreq_child(newsk, dst); tcp_sync_mss(newsk, dst_mtu(dst)); diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index bfc953672833d..02f589e03b758 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -752,7 +752,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, * socket is created, wait for troubles. */ child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, - req, &own_req); + req, &own_req, NULL); if (!child) goto listen_overflow; diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 28bb5042eb1bc..6b9ac21df0304 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1093,11 +1093,50 @@ static void tcp_v6_restore_cb(struct sk_buff *skb) sizeof(struct inet6_skb_parm)); } +/* Called from tcp_v4_syn_recv_sock() for v6_mapped children. */ +static void tcp_v6_mapped_child_init(struct sock *newsk, const struct sock *sk) +{ + struct inet_sock *newinet = inet_sk(newsk); + struct tcp6_sock *newtcp6sk; + struct ipv6_pinfo *newnp; + + newtcp6sk = (struct tcp6_sock *)newsk; + newinet->pinet6 = newnp = &newtcp6sk->inet6; + + memcpy(newnp, inet6_sk(sk), sizeof(struct ipv6_pinfo)); + + newnp->saddr = newsk->sk_v6_rcv_saddr; + + inet_csk(newsk)->icsk_af_ops = &ipv6_mapped; + if (sk_is_mptcp(newsk)) + mptcpv6_handle_mapped(newsk, true); + newsk->sk_backlog_rcv = tcp_v4_do_rcv; +#if defined(CONFIG_TCP_MD5SIG) + tcp_sk(newsk)->af_specific = &tcp_sock_ipv6_mapped_specific; +#endif + + newnp->ipv6_mc_list = NULL; + newnp->ipv6_ac_list = NULL; + newnp->ipv6_fl_list = NULL; + newnp->pktoptions = NULL; + newnp->opt = NULL; + + /* tcp_v4_syn_recv_sock() has initialized newinet->mc_{index,ttl} */ + newnp->mcast_oif = newinet->mc_index; + newnp->mcast_hops = newinet->mc_ttl; + + newnp->rcv_flowinfo = 0; + if (inet6_sk(sk)->repflow) + newnp->flow_label = 0; +} + static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, struct request_sock *req, struct dst_entry *dst, struct request_sock *req_unhash, - bool *own_req) + bool *own_req, + void (*opt_child_init)(struct sock *newsk, + const struct sock *sk)) { struct inet_request_sock *ireq; struct ipv6_pinfo *newnp; @@ -1113,62 +1152,10 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * #endif struct flowi6 fl6; - if (skb->protocol == htons(ETH_P_IP)) { - /* - * v6 mapped - */ - - newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst, - req_unhash, own_req); - - if (!newsk) - return NULL; - - newtcp6sk = (struct tcp6_sock *)newsk; - inet_sk(newsk)->pinet6 = &newtcp6sk->inet6; - - newinet = inet_sk(newsk); - newnp = inet6_sk(newsk); - newtp = tcp_sk(newsk); - - memcpy(newnp, np, sizeof(struct ipv6_pinfo)); - - newnp->saddr = newsk->sk_v6_rcv_saddr; - - inet_csk(newsk)->icsk_af_ops = &ipv6_mapped; - if (sk_is_mptcp(newsk)) - mptcpv6_handle_mapped(newsk, true); - newsk->sk_backlog_rcv = tcp_v4_do_rcv; -#ifdef CONFIG_TCP_MD5SIG - newtp->af_specific = &tcp_sock_ipv6_mapped_specific; -#endif - - newnp->ipv6_mc_list = NULL; - newnp->ipv6_ac_list = NULL; - newnp->ipv6_fl_list = NULL; - newnp->pktoptions = NULL; - newnp->opt = NULL; - newnp->mcast_oif = inet_iif(skb); - newnp->mcast_hops = ip_hdr(skb)->ttl; - newnp->rcv_flowinfo = 0; - if (np->repflow) - newnp->flow_label = 0; - - /* - * No need to charge this sock to the relevant IPv6 refcnt debug socks count - * here, tcp_create_openreq_child now does this for us, see the comment in - * that function for the gory details. -acme - */ - - /* It is tricky place. Until this moment IPv4 tcp - worked with IPv6 icsk.icsk_af_ops. - Sync it now. - */ - tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie); - - return newsk; - } - + if (skb->protocol == htons(ETH_P_IP)) + return tcp_v4_syn_recv_sock(sk, skb, req, dst, + req_unhash, own_req, + tcp_v6_mapped_child_init); ireq = inet_rsk(req); if (sk_acceptq_is_full(sk)) diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index ef4e4e0aa6aeb..5bf87d1da9335 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -610,7 +610,9 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, struct request_sock *req, struct dst_entry *dst, struct request_sock *req_unhash, - bool *own_req) + bool *own_req, + void (*opt_child_init)(struct sock *newsk, + const struct sock *sk)) { struct mptcp_subflow_context *listener = mptcp_subflow_ctx(sk); struct mptcp_subflow_request_sock *subflow_req; @@ -664,7 +666,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, create_child: child = listener->icsk_af_ops->syn_recv_sock(sk, skb, req, dst, - req_unhash, own_req); + req_unhash, own_req, opt_child_init); if (child && *own_req) { struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(child); diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c index 6b741ee27c72f..0abf49c6e5965 100644 --- a/net/netfilter/nfnetlink_cthelper.c +++ b/net/netfilter/nfnetlink_cthelper.c @@ -609,10 +609,10 @@ nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb) goto out; } } - } - if (cb->args[1]) { - cb->args[1] = 0; - goto restart; + if (cb->args[1]) { + cb->args[1] = 0; + goto restart; + } } out: rcu_read_unlock(); diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 84321c760caa5..415127386edfb 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -2021,6 +2021,15 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) goto out_unlock; iov_iter_revert(&msg->msg_iter, err); + + /* sctp_sendmsg_to_asoc() may have released the socket + * lock (sctp_wait_for_sndbuf), during which other + * associations on ep->asocs could have been peeled + * off or freed. @asoc itself is revalidated by the + * base.dead and base.sk checks in sctp_wait_for_sndbuf, + * so re-derive the cached cursor from it. + */ + tmp = list_next_entry(asoc, asocs); } goto out_unlock; diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 64c40a93a924d..02f2cf3b678b0 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -118,7 +118,9 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, struct request_sock *req, struct dst_entry *dst, struct request_sock *req_unhash, - bool *own_req) + bool *own_req, + void (*opt_child_init)(struct sock *newsk, + const struct sock *sk)) { struct smc_sock *smc; struct sock *child; @@ -136,7 +138,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, /* passthrough to original syn recv sock fct */ child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, - own_req); + own_req, opt_child_init); /* child must not inherit smc or its ops */ if (child) { rcu_assign_sk_user_data(child, NULL);