From 109f2b81af149f7efe5159709c1ed486a3017ca6 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:22 -0400 Subject: [PATCH 01/24] netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() jira KERNEL-1291 cve CVE-2026-43450 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Hyunwoo Kim commit 6dcee8496d53165b2d8a5909b3050b62ae71fe89 nfnl_cthelper_dump_table() has a 'goto restart' that jumps to a label inside the for loop body. When the "last" helper saved in cb->args[1] is deleted between dump rounds, every entry fails the (cur != last) check, so cb->args[1] is never cleared. The for loop finishes with cb->args[0] == nf_ct_helper_hsize, and the 'goto restart' jumps back into the loop body bypassing the bounds check, causing an 8-byte out-of-bounds read on nf_ct_helper_hash[nf_ct_helper_hsize]. The 'goto restart' block was meant to re-traverse the current bucket when "last" is no longer found, but it was placed after the for loop instead of inside it. Move the block into the for loop body so that the restart only occurs while cb->args[0] is still within bounds. BUG: KASAN: slab-out-of-bounds in nfnl_cthelper_dump_table+0x9f/0x1b0 Read of size 8 at addr ffff888104ca3000 by task poc_cthelper/131 Call Trace: nfnl_cthelper_dump_table+0x9f/0x1b0 netlink_dump+0x333/0x880 netlink_recvmsg+0x3e2/0x4b0 sock_recvmsg+0xde/0xf0 __sys_recvfrom+0x150/0x200 __x64_sys_recvfrom+0x76/0x90 do_syscall_64+0xc3/0x6e0 Allocated by task 1: __kvmalloc_node_noprof+0x21b/0x700 nf_ct_alloc_hashtable+0x65/0xd0 nf_conntrack_helper_init+0x21/0x60 nf_conntrack_init_start+0x18d/0x300 nf_conntrack_standalone_init+0x12/0xc0 Fixes: 12f7a505331e ("netfilter: add user-space connection tracking helper infrastructure") Signed-off-by: Hyunwoo Kim Signed-off-by: Florian Westphal (cherry picked from commit 6dcee8496d53165b2d8a5909b3050b62ae71fe89) Signed-off-by: Jonathan Maple --- net/netfilter/nfnetlink_cthelper.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c index 6b741ee27c72f..0abf49c6e5965 100644 --- a/net/netfilter/nfnetlink_cthelper.c +++ b/net/netfilter/nfnetlink_cthelper.c @@ -609,10 +609,10 @@ nfnl_cthelper_dump_table(struct sk_buff *skb, struct netlink_callback *cb) goto out; } } - } - if (cb->args[1]) { - cb->args[1] = 0; - goto restart; + if (cb->args[1]) { + cb->args[1] = 0; + goto restart; + } } out: rcu_read_unlock(); From 7432d498c4976cbde3f6722a611aa56807bb95f1 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:22 -0400 Subject: [PATCH 02/24] sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL jira KERNEL-1291 cve CVE-2026-46227 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Ben Morris commit abb5f36771cc4c05899b34000829a787572a8817 The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may drop the socket lock inside sctp_wait_for_sndbuf(). While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the association cached in @tmp, migrating it to a new endpoint via sctp_sock_migrate() (list_del_init() + list_add_tail() to newep->asocs), and optionally close the new socket which frees the association via kfree_rcu(). The cached @tmp can also be freed by a network ABORT for that association, processed in softirq while the lock is dropped. sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock via the "sk != asoc->base.sk" and "asoc->base.dead" checks, but nothing revalidates @tmp. After a successful return, the iterator advances to the stale @tmp, yielding either a use-after-free (if the peeled socket was closed) or a list-walk onto the new endpoint's list head (type confusion of &newep->asocs as a struct sctp_association *). Both are reachable from CapEff=0; the type-confusion path gives controlled indirect call via the outqueue.sched->init_sid pointer. Fix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc() returns. @asoc is known to still be on ep->asocs at that point: the only callers that list_del an association from ep->asocs are sctp_association_free() (which sets asoc->base.dead) and sctp_assoc_migrate() (which changes asoc->base.sk), and sctp_wait_for_sndbuf() checks both under the lock before any successful return; a tripped check propagates as err < 0 and the loop bails before the re-derive. The SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the loop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, so the @tmp cached by list_for_each_entry_safe() still covers the lock-held free that ba59fb027307 ("sctp: walk the list of asoc safely") was added for. Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg") Cc: stable@vger.kernel.org Signed-off-by: Ben Morris Acked-by: Xin Long Link: https://patch.msgid.link/20260508001455.3137-1-joycathacker@gmail.com Signed-off-by: Jakub Kicinski (cherry picked from commit abb5f36771cc4c05899b34000829a787572a8817) Signed-off-by: Jonathan Maple --- net/sctp/socket.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 84321c760caa5..415127386edfb 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -2021,6 +2021,15 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) goto out_unlock; iov_iter_revert(&msg->msg_iter, err); + + /* sctp_sendmsg_to_asoc() may have released the socket + * lock (sctp_wait_for_sndbuf), during which other + * associations on ep->asocs could have been peeled + * off or freed. @asoc itself is revalidated by the + * base.dead and base.sk checks in sctp_wait_for_sndbuf, + * so re-derive the cached cursor from it. + */ + tmp = list_next_entry(asoc, asocs); } goto out_unlock; From 167201ac7dd294bf1a8c6157980134a7cd75a1ab Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:23 -0400 Subject: [PATCH 03/24] drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() jira KERNEL-1291 cve CVE-2026-46209 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Ashutosh Desai commit 3d4c2268bd7243c3780fe32bf24ff876da272acf drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned int width = mode_cmd->width / (i ? info->hsub : 1); unsigned int height = mode_cmd->height / (i ? info->vsub : 1); However, the ioctl-level framebuffer_check() in drm_framebuffer.c uses drm_format_info_plane_width/height() which round up dimensions via DIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object size check for certain pixel format and dimension combinations. For example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the GEM size validation path sees height=0 instead of height=1. The expression (height - 1) then wraps to UINT_MAX as an unsigned int, causing min_size to overflow and wrap back to a small value. A tiny GEM object therefore passes the size guard, yet when the GPU accesses the chroma plane it will read or write memory beyond the object's bounds. Fix by replacing the open-coded divisions with drm_format_info_plane_width() and drm_format_info_plane_height(), which use DIV_ROUND_UP() and match the calculation already used in framebuffer_check(). Fixes: 4c3dbb2c312c ("drm: Add GEM backed framebuffer library") Cc: stable@vger.kernel.org # v4.14+ Reviewed-by: Thomas Zimmermann Signed-off-by: Ashutosh Desai Signed-off-by: Thomas Zimmermann Link: https://patch.msgid.link/20260420013637.457751-1-ashutoshdesai993@gmail.com (cherry picked from commit 3d4c2268bd7243c3780fe32bf24ff876da272acf) Signed-off-by: Jonathan Maple --- drivers/gpu/drm/drm_gem_framebuffer_helper.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c index 235a81c57b7e6..f010fae1e3422 100644 --- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c +++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c @@ -162,8 +162,8 @@ int drm_gem_fb_init_with_funcs(struct drm_device *dev, } for (i = 0; i < info->num_planes; i++) { - unsigned int width = mode_cmd->width / (i ? info->hsub : 1); - unsigned int height = mode_cmd->height / (i ? info->vsub : 1); + unsigned int width = drm_format_info_plane_width(info, mode_cmd->width, i); + unsigned int height = drm_format_info_plane_height(info, mode_cmd->height, i); unsigned int min_size; objs[i] = drm_gem_object_lookup(file, mode_cmd->handles[i]); From 33c19d79789ce6f07f501c88152d9ca1d0102fc7 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:23 -0400 Subject: [PATCH 04/24] procfs: fix missing RCU protection when reading real_parent in do_task_stat() jira KERNEL-1291 cve CVE-2026-46259 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Jinliang Zheng commit 76149d53502cf17ef3ae454ff384551236fba867 When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent without proper RCU protection, which leads to: cpu 0 cpu 1 ----- ----- do_task_stat var = task->real_parent release_task call_rcu(delayed_put_task_struct) task_tgid_nr_ns(var) rcu_read_lock <--- Too late to protect task->real_parent! task_pid_ptr <--- UAF! rcu_read_unlock This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add proper RCU protection for accessing task->real_parent. Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()") Signed-off-by: Jinliang Zheng Acked-by: Oleg Nesterov Cc: David Hildenbrand Cc: Ingo Molnar Cc: Lorenzo Stoakes Cc: Mateusz Guzik Cc: ruippan Cc: Usama Arif Signed-off-by: Andrew Morton (cherry picked from commit 76149d53502cf17ef3ae454ff384551236fba867) Signed-off-by: Jonathan Maple --- fs/proc/array.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/proc/array.c b/fs/proc/array.c index f4aa69a92be41..2ade0bae20cff 100644 --- a/fs/proc/array.c +++ b/fs/proc/array.c @@ -496,7 +496,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, } sid = task_session_nr_ns(task, ns); - ppid = task_tgid_nr_ns(task->real_parent, ns); + ppid = task_ppid_nr_ns(task, ns); pgid = task_pgrp_nr_ns(task, ns); unlock_task_sighand(task, &flags); From 810e8f092875b780d5c01844433140b1577affa8 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:23 -0400 Subject: [PATCH 05/24] tcp: fix potential race in tcp_v6_syn_recv_sock() jira KERNEL-1291 cve CVE-2026-43198 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Eric Dumazet commit 858d2a4f67ff69e645a43487ef7ea7f28f06deae Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/858d2a4f.failed Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot+937b5bbb6a815b3e5d0b@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/69949275.050a0220.2eeac1.0145.GAE@google.com/ Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Link: https://patch.msgid.link/20260217161205.2079883-1-edumazet@google.com Signed-off-by: Jakub Kicinski (cherry picked from commit 858d2a4f67ff69e645a43487ef7ea7f28f06deae) Signed-off-by: Jonathan Maple # Conflicts: # net/ipv6/tcp_ipv6.c --- .../858d2a4f.failed | 279 ++++++++++++++++++ 1 file changed, 279 insertions(+) create mode 100644 ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/858d2a4f.failed diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/858d2a4f.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/858d2a4f.failed new file mode 100644 index 0000000000000..a300ee0a55d9b --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/858d2a4f.failed @@ -0,0 +1,279 @@ +tcp: fix potential race in tcp_v6_syn_recv_sock() + +jira KERNEL-1291 +cve CVE-2026-43198 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Eric Dumazet +commit 858d2a4f67ff69e645a43487ef7ea7f28f06deae +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/858d2a4f.failed + +Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() +is done too late. + +After tcp_v4_syn_recv_sock(), the child socket is already visible +from TCP ehash table and other cpus might use it. + +Since newinet->pinet6 is still pointing to the listener ipv6_pinfo +bad things can happen as syzbot found. + +Move the problematic code in tcp_v6_mapped_child_init() +and call this new helper from tcp_v4_syn_recv_sock() before +the ehash insertion. + +This allows the removal of one tcp_sync_mss(), since +tcp_v4_syn_recv_sock() will call it with the correct +context. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") + Reported-by: syzbot+937b5bbb6a815b3e5d0b@syzkaller.appspotmail.com +Closes: https://lore.kernel.org/netdev/69949275.050a0220.2eeac1.0145.GAE@google.com/ + Signed-off-by: Eric Dumazet + Reviewed-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20260217161205.2079883-1-edumazet@google.com + Signed-off-by: Jakub Kicinski +(cherry picked from commit 858d2a4f67ff69e645a43487ef7ea7f28f06deae) + Signed-off-by: Jonathan Maple + +# Conflicts: +# net/ipv6/tcp_ipv6.c +diff --cc net/ipv6/tcp_ipv6.c +index 28bb5042eb1b,e46a0efae012..000000000000 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@@ -1097,15 -1351,16 +1132,17 @@@ static struct sock *tcp_v6_syn_recv_soc + struct request_sock *req, + struct dst_entry *dst, + struct request_sock *req_unhash, +- bool *own_req) ++ bool *own_req, ++ void (*opt_child_init)(struct sock *newsk, ++ const struct sock *sk)) + { + - const struct ipv6_pinfo *np = tcp_inet6_sk(sk); + struct inet_request_sock *ireq; + + struct ipv6_pinfo *newnp; + + const struct ipv6_pinfo *np = inet6_sk(sk); + struct ipv6_txoptions *opt; + + struct tcp6_sock *newtcp6sk; + struct inet_sock *newinet; + bool found_dup_sk = false; + - struct ipv6_pinfo *newnp; + struct tcp_sock *newtp; + struct sock *newsk; + #ifdef CONFIG_TCP_MD5SIG +@@@ -1113,62 -1368,11 +1150,69 @@@ + #endif + struct flowi6 fl6; + +++<<<<<<< HEAD + + if (skb->protocol == htons(ETH_P_IP)) { + + /* + + * v6 mapped + + */ + + + + newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst, + + req_unhash, own_req); + + + + if (!newsk) + + return NULL; + + + + newtcp6sk = (struct tcp6_sock *)newsk; + + inet_sk(newsk)->pinet6 = &newtcp6sk->inet6; + + + + newinet = inet_sk(newsk); + + newnp = inet6_sk(newsk); + + newtp = tcp_sk(newsk); + + + + memcpy(newnp, np, sizeof(struct ipv6_pinfo)); + + + + newnp->saddr = newsk->sk_v6_rcv_saddr; + + + + inet_csk(newsk)->icsk_af_ops = &ipv6_mapped; + + if (sk_is_mptcp(newsk)) + + mptcpv6_handle_mapped(newsk, true); + + newsk->sk_backlog_rcv = tcp_v4_do_rcv; + +#ifdef CONFIG_TCP_MD5SIG + + newtp->af_specific = &tcp_sock_ipv6_mapped_specific; + +#endif + + + + newnp->ipv6_mc_list = NULL; + + newnp->ipv6_ac_list = NULL; + + newnp->ipv6_fl_list = NULL; + + newnp->pktoptions = NULL; + + newnp->opt = NULL; + + newnp->mcast_oif = inet_iif(skb); + + newnp->mcast_hops = ip_hdr(skb)->ttl; + + newnp->rcv_flowinfo = 0; + + if (np->repflow) + + newnp->flow_label = 0; + + + + /* + + * No need to charge this sock to the relevant IPv6 refcnt debug socks count + + * here, tcp_create_openreq_child now does this for us, see the comment in + + * that function for the gory details. -acme + + */ + + + + /* It is tricky place. Until this moment IPv4 tcp + + worked with IPv6 icsk.icsk_af_ops. + + Sync it now. + + */ + + tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie); + + + + return newsk; + + } + + +++======= ++ if (skb->protocol == htons(ETH_P_IP)) ++ return tcp_v4_syn_recv_sock(sk, skb, req, dst, ++ req_unhash, own_req, ++ tcp_v6_mapped_child_init); +++>>>>>>> 858d2a4f67ff (tcp: fix potential race in tcp_v6_syn_recv_sock()) + ireq = inet_rsk(req); + + if (sk_acceptq_is_full(sk)) +diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h +index eb56297755ff..5c896d8b5da7 100644 +--- a/include/net/inet_connection_sock.h ++++ b/include/net/inet_connection_sock.h +@@ -43,7 +43,9 @@ struct inet_connection_sock_af_ops { + struct request_sock *req, + struct dst_entry *dst, + struct request_sock *req_unhash, +- bool *own_req); ++ bool *own_req, ++ void (*opt_child_init)(struct sock *newsk, ++ const struct sock *sk)); + u16 net_header_len; + u16 net_frag_header_len; + u16 sockaddr_len; +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 001fde1ab587..09d9a1421df4 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -461,7 +461,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, + struct request_sock *req, + struct dst_entry *dst, + struct request_sock *req_unhash, +- bool *own_req); ++ bool *own_req, ++ void (*opt_child_init)(struct sock *newsk, ++ const struct sock *sk)); + int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb); + int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len); + int tcp_connect(struct sock *sk); +diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c +index 30c03b68abd8..02fb72ec2573 100644 +--- a/net/ipv4/syncookies.c ++++ b/net/ipv4/syncookies.c +@@ -211,7 +211,7 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb, + bool own_req; + + child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst, +- NULL, &own_req); ++ NULL, &own_req, NULL); + if (child) { + refcount_set(&req->rsk_refcnt, 1); + tcp_sk(child)->tsoffset = tsoff; +diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c +index dd6347dd8e97..68698a75a84a 100644 +--- a/net/ipv4/tcp_fastopen.c ++++ b/net/ipv4/tcp_fastopen.c +@@ -226,7 +226,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk, + req->sk = NULL; + + child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, +- NULL, &own_req); ++ NULL, &own_req, NULL); + if (!child) + return NULL; + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 76b0753d79c0..daa48ad710d8 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1411,7 +1411,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, + struct request_sock *req, + struct dst_entry *dst, + struct request_sock *req_unhash, +- bool *own_req) ++ bool *own_req, ++ void (*opt_child_init)(struct sock *newsk, ++ const struct sock *sk)) + { + struct inet_request_sock *ireq; + bool found_dup_sk = false; +@@ -1460,6 +1462,10 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, + } + sk_setup_caps(newsk, dst); + ++#if IS_ENABLED(CONFIG_IPV6) ++ if (opt_child_init) ++ opt_child_init(newsk, sk); ++#endif + tcp_ca_openreq_child(newsk, dst); + + tcp_sync_mss(newsk, dst_mtu(dst)); +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index bfc953672833..02f589e03b75 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -752,7 +752,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, + * socket is created, wait for troubles. + */ + child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, +- req, &own_req); ++ req, &own_req, NULL); + if (!child) + goto listen_overflow; + +* Unmerged path net/ipv6/tcp_ipv6.c +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index ef4e4e0aa6ae..5bf87d1da933 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -610,7 +610,9 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, + struct request_sock *req, + struct dst_entry *dst, + struct request_sock *req_unhash, +- bool *own_req) ++ bool *own_req, ++ void (*opt_child_init)(struct sock *newsk, ++ const struct sock *sk)) + { + struct mptcp_subflow_context *listener = mptcp_subflow_ctx(sk); + struct mptcp_subflow_request_sock *subflow_req; +@@ -664,7 +666,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, + + create_child: + child = listener->icsk_af_ops->syn_recv_sock(sk, skb, req, dst, +- req_unhash, own_req); ++ req_unhash, own_req, opt_child_init); + + if (child && *own_req) { + struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(child); +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 64c40a93a924..02f2cf3b678b 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -118,7 +118,9 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, + struct request_sock *req, + struct dst_entry *dst, + struct request_sock *req_unhash, +- bool *own_req) ++ bool *own_req, ++ void (*opt_child_init)(struct sock *newsk, ++ const struct sock *sk)) + { + struct smc_sock *smc; + struct sock *child; +@@ -136,7 +138,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, + + /* passthrough to original syn recv sock fct */ + child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, +- own_req); ++ own_req, opt_child_init); + /* child must not inherit smc or its ops */ + if (child) { + rcu_assign_sk_user_data(child, NULL); From a9f5ae27d83f01c88af36bf44101a0f9779342f5 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:24 -0400 Subject: [PATCH 06/24] arm64: Add Neoverse-V2 part jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Besar Wicaksono commit f4d9d9dcc70b96b5e5d7801bd5fbf8491b07b13d Add the part number and MIDR for Neoverse-V2 Signed-off-by: Besar Wicaksono Reviewed-by: James Clark Link: https://lore.kernel.org/r/20240109192310.16234-2-bwicaksono@nvidia.com Signed-off-by: Will Deacon (cherry picked from commit f4d9d9dcc70b96b5e5d7801bd5fbf8491b07b13d) Signed-off-by: Jonathan Maple --- arch/arm64/include/asm/cputype.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index f9b0a2ee4a76d..914d5ee3d152f 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -91,6 +91,7 @@ #define ARM_CPU_PART_CORTEX_X2 0xD48 #define ARM_CPU_PART_NEOVERSE_N2 0xD49 #define ARM_CPU_PART_CORTEX_A78C 0xD4B +#define ARM_CPU_PART_NEOVERSE_V2 0xD4F #define APM_CPU_PART_XGENE 0x000 #define APM_CPU_VAR_POTENZA 0x00 @@ -138,6 +139,7 @@ #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) +#define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) From afdc3e172510a3344b57caff161511ac3e68d3e1 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:24 -0400 Subject: [PATCH 07/24] arm64: cputype: Add Cortex-X4 definitions jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland commit 02a0a04676fa7796d9cbc9eb5ca120aaa194d2dd Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/02a0a046.failed Add cputype definitions for Cortex-X4. These will be used for errata detection in subsequent patches. These values can be found in Table B-249 ("MIDR_EL1 bit descriptions") in issue 0002-05 of the Cortex-X4 TRM, which can be found at: https://developer.arm.com/documentation/102484/0002/?lang=en Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: James Morse Cc: Will Deacon Link: https://lore.kernel.org/r/20240508081400.235362-3-mark.rutland@arm.com Signed-off-by: Will Deacon (cherry picked from commit 02a0a04676fa7796d9cbc9eb5ca120aaa194d2dd) Signed-off-by: Jonathan Maple # Conflicts: # arch/arm64/include/asm/cputype.h --- .../02a0a046.failed | 59 +++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/02a0a046.failed diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/02a0a046.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/02a0a046.failed new file mode 100644 index 0000000000000..6857186bd50b4 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/02a0a046.failed @@ -0,0 +1,59 @@ +arm64: cputype: Add Cortex-X4 definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit 02a0a04676fa7796d9cbc9eb5ca120aaa194d2dd +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/02a0a046.failed + +Add cputype definitions for Cortex-X4. These will be used for errata +detection in subsequent patches. + +These values can be found in Table B-249 ("MIDR_EL1 bit descriptions") +in issue 0002-05 of the Cortex-X4 TRM, which can be found at: + + https://developer.arm.com/documentation/102484/0002/?lang=en + + Signed-off-by: Mark Rutland + Cc: Catalin Marinas + Cc: James Morse + Cc: Will Deacon +Link: https://lore.kernel.org/r/20240508081400.235362-3-mark.rutland@arm.com + Signed-off-by: Will Deacon +(cherry picked from commit 02a0a04676fa7796d9cbc9eb5ca120aaa194d2dd) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index 914d5ee3d152,2989c023c6f3..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -91,7 -85,8 +91,11 @@@ + #define ARM_CPU_PART_CORTEX_X2 0xD48 + #define ARM_CPU_PART_NEOVERSE_N2 0xD49 + #define ARM_CPU_PART_CORTEX_A78C 0xD4B +++<<<<<<< HEAD + +#define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++======= ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 +++>>>>>>> 02a0a04676fa (arm64: cputype: Add Cortex-X4 definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -139,7 -159,8 +143,11 @@@ + #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) + #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) + #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) +++<<<<<<< HEAD + +#define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++======= ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) +++>>>>>>> 02a0a04676fa (arm64: cputype: Add Cortex-X4 definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h From e4e36ed20cb288d0ec143c2e53d6c136655f3605 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:25 -0400 Subject: [PATCH 08/24] arm64: cputype: Add Neoverse-V3 definitions jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland commit 0ce85db6c2141b7ffb95709d76fc55a27ff3cdc1 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/0ce85db6.failed Add cputype definitions for Neoverse-V3. These will be used for errata detection in subsequent patches. These values can be found in Table B-249 ("MIDR_EL1 bit descriptions") in issue 0001-04 of the Neoverse-V3 TRM, which can be found at: https://developer.arm.com/documentation/107734/0001/?lang=en Signed-off-by: Mark Rutland Cc: Catalin Marinas Cc: James Morse Cc: Will Deacon Link: https://lore.kernel.org/r/20240508081400.235362-4-mark.rutland@arm.com Signed-off-by: Will Deacon (cherry picked from commit 0ce85db6c2141b7ffb95709d76fc55a27ff3cdc1) Signed-off-by: Jonathan Maple # Conflicts: # arch/arm64/include/asm/cputype.h --- .../0ce85db6.failed | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) create mode 100644 ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/0ce85db6.failed diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/0ce85db6.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/0ce85db6.failed new file mode 100644 index 0000000000000..1fa232d4298f8 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/0ce85db6.failed @@ -0,0 +1,61 @@ +arm64: cputype: Add Neoverse-V3 definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit 0ce85db6c2141b7ffb95709d76fc55a27ff3cdc1 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/0ce85db6.failed + +Add cputype definitions for Neoverse-V3. These will be used for errata +detection in subsequent patches. + +These values can be found in Table B-249 ("MIDR_EL1 bit descriptions") +in issue 0001-04 of the Neoverse-V3 TRM, which can be found at: + + https://developer.arm.com/documentation/107734/0001/?lang=en + + Signed-off-by: Mark Rutland + Cc: Catalin Marinas + Cc: James Morse + Cc: Will Deacon +Link: https://lore.kernel.org/r/20240508081400.235362-4-mark.rutland@arm.com + Signed-off-by: Will Deacon +(cherry picked from commit 0ce85db6c2141b7ffb95709d76fc55a27ff3cdc1) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index 914d5ee3d152,67a86926ae16..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -91,7 -85,9 +91,12 @@@ + #define ARM_CPU_PART_CORTEX_X2 0xD48 + #define ARM_CPU_PART_NEOVERSE_N2 0xD49 + #define ARM_CPU_PART_CORTEX_A78C 0xD4B +++<<<<<<< HEAD + +#define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++======= ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 +++>>>>>>> 0ce85db6c214 (arm64: cputype: Add Neoverse-V3 definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -139,7 -160,9 +144,12 @@@ + #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) + #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) + #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) +++<<<<<<< HEAD + +#define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++======= ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) +++>>>>>>> 0ce85db6c214 (arm64: cputype: Add Neoverse-V3 definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h From 352bd71979b153d51e14b4b5935cb2f582581573 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:25 -0400 Subject: [PATCH 09/24] arm64: cputype: Add Cortex-X3 definitions jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland commit be5a6f238700f38b534456608588723fba96c5ab Add cputype definitions for Cortex-X3. These will be used for errata detection in subsequent patches. These values can be found in Table A-263 ("MIDR_EL1 bit descriptions") in issue 07 of the Cortex-X3 TRM, which can be found at: https://developer.arm.com/documentation/101593/0102/?lang=en Signed-off-by: Mark Rutland Cc: James Morse Cc: Will Deacon Link: https://lore.kernel.org/r/20240603111812.1514101-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas (cherry picked from commit be5a6f238700f38b534456608588723fba96c5ab) Signed-off-by: Jonathan Maple --- arch/arm64/include/asm/cputype.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index 914d5ee3d152f..830bacf6dd894 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -91,6 +91,7 @@ #define ARM_CPU_PART_CORTEX_X2 0xD48 #define ARM_CPU_PART_NEOVERSE_N2 0xD49 #define ARM_CPU_PART_CORTEX_A78C 0xD4B +#define ARM_CPU_PART_CORTEX_X3 0xD4E #define ARM_CPU_PART_NEOVERSE_V2 0xD4F #define APM_CPU_PART_XGENE 0x000 @@ -139,6 +140,7 @@ #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) +#define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) From ddaef9d29a6fd20adc4c7182495320ca803b9983 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:26 -0400 Subject: [PATCH 10/24] arm64: cputype: Add Cortex-X925 definitions jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland commit fd2ff5f0b320f418288e7a1f919f648fbc8a0dfc Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fd2ff5f0.failed Add cputype definitions for Cortex-X925. These will be used for errata detection in subsequent patches. These values can be found in Table A-285 ("MIDR_EL1 bit descriptions") in issue 0001-05 of the Cortex-X925 TRM, which can be found at: https://developer.arm.com/documentation/102807/0001/?lang=en Signed-off-by: Mark Rutland Cc: James Morse Cc: Will Deacon Link: https://lore.kernel.org/r/20240603111812.1514101-4-mark.rutland@arm.com Signed-off-by: Catalin Marinas (cherry picked from commit fd2ff5f0b320f418288e7a1f919f648fbc8a0dfc) Signed-off-by: Jonathan Maple # Conflicts: # arch/arm64/include/asm/cputype.h --- .../fd2ff5f0.failed | 62 +++++++++++++++++++ 1 file changed, 62 insertions(+) create mode 100644 ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fd2ff5f0.failed diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fd2ff5f0.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fd2ff5f0.failed new file mode 100644 index 0000000000000..4c120f7ab32fd --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fd2ff5f0.failed @@ -0,0 +1,62 @@ +arm64: cputype: Add Cortex-X925 definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit fd2ff5f0b320f418288e7a1f919f648fbc8a0dfc +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fd2ff5f0.failed + +Add cputype definitions for Cortex-X925. These will be used for errata +detection in subsequent patches. + +These values can be found in Table A-285 ("MIDR_EL1 bit descriptions") +in issue 0001-05 of the Cortex-X925 TRM, which can be found at: + + https://developer.arm.com/documentation/102807/0001/?lang=en + + Signed-off-by: Mark Rutland + Cc: James Morse + Cc: Will Deacon +Link: https://lore.kernel.org/r/20240603111812.1514101-4-mark.rutland@arm.com + Signed-off-by: Catalin Marinas +(cherry picked from commit fd2ff5f0b320f418288e7a1f919f648fbc8a0dfc) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index 830bacf6dd89,1cb0704c6163..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -93,6 -88,10 +93,13 @@@ + #define ARM_CPU_PART_CORTEX_A78C 0xD4B + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 ++ #define ARM_CPU_PART_CORTEX_X925 0xD85 +++>>>>>>> fd2ff5f0b320 (arm64: cputype: Add Cortex-X925 definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -142,6 -167,10 +149,13 @@@ + #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) ++ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) +++>>>>>>> fd2ff5f0b320 (arm64: cputype: Add Cortex-X925 definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h From 47c428c51c83f08dac26528fce6a0179724f80e5 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:26 -0400 Subject: [PATCH 11/24] arm64: cputype: Add Cortex-X1C definitions jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland commit 58d245e03c324d083a0ec3b9ab8ebd46ec9848d7 Add cputype definitions for Cortex-X1C. These will be used for errata detection in subsequent patches. These values can be found in the Cortex-X1C TRM: https://developer.arm.com/documentation/101968/0002/ ... in section B2.107 ("MIDR_EL1, Main ID Register, EL1"). Signed-off-by: Mark Rutland Cc: James Morse Cc: Will Deacon Reviewed-by: Anshuman Khandual Link: https://lore.kernel.org/r/20240801101803.1982459-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas (cherry picked from commit 58d245e03c324d083a0ec3b9ab8ebd46ec9848d7) Signed-off-by: Jonathan Maple --- arch/arm64/include/asm/cputype.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index 830bacf6dd894..634f74d147e39 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -91,6 +91,7 @@ #define ARM_CPU_PART_CORTEX_X2 0xD48 #define ARM_CPU_PART_NEOVERSE_N2 0xD49 #define ARM_CPU_PART_CORTEX_A78C 0xD4B +#define ARM_CPU_PART_CORTEX_X1C 0xD4C #define ARM_CPU_PART_CORTEX_X3 0xD4E #define ARM_CPU_PART_NEOVERSE_V2 0xD4F @@ -140,6 +141,7 @@ #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) +#define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) From d5a8660b63d1193c4c12f147fe80f80a5f438c56 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:26 -0400 Subject: [PATCH 12/24] arm64: cputype: Add MIDR_CORTEX_A76AE jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Douglas Anderson commit a9b5bd81b294d30a747edd125e9f6aef2def7c79 >From the TRM, MIDR_CORTEX_A76AE has a partnum of 0xDOE and an implementor of 0x41 (ARM). Add the values. Cc: stable@vger.kernel.org # dependency of the next fix in the series Signed-off-by: Douglas Anderson Link: https://lore.kernel.org/r/20250107120555.v4.4.I151f3b7ee323bcc3082179b8c60c3cd03308aa94@changeid Signed-off-by: Catalin Marinas (cherry picked from commit a9b5bd81b294d30a747edd125e9f6aef2def7c79) Signed-off-by: Jonathan Maple --- arch/arm64/include/asm/cputype.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index 634f74d147e39..b2ded290fb1f4 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -84,6 +84,7 @@ #define ARM_CPU_PART_CORTEX_A76 0xD0B #define ARM_CPU_PART_NEOVERSE_N1 0xD0C #define ARM_CPU_PART_CORTEX_A77 0xD0D +#define ARM_CPU_PART_CORTEX_A76AE 0xD0E #define ARM_CPU_PART_NEOVERSE_V1 0xD40 #define ARM_CPU_PART_CORTEX_A78 0xD41 #define ARM_CPU_PART_CORTEX_X1 0xD44 @@ -134,6 +135,7 @@ #define MIDR_CORTEX_A76 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76) #define MIDR_NEOVERSE_N1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N1) #define MIDR_CORTEX_A77 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A77) +#define MIDR_CORTEX_A76AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76AE) #define MIDR_NEOVERSE_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1) #define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78) #define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1) From 0c3ed285152d456f9c9b0c134191f5dd1e7d6edd Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:27 -0400 Subject: [PATCH 13/24] arm64: cputype: Add Neoverse-V3AE definitions jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland commit 3bbf004c4808e2c3241e5c1ad6cc102f38a03c39 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/3bbf004c.failed Add cputype definitions for Neoverse-V3AE. These will be used for errata detection in subsequent patches. These values can be found in the Neoverse-V3AE TRM: https://developer.arm.com/documentation/SDEN-2615521/9-0/ ... in section A.6.1 ("MIDR_EL1, Main ID Register"). Signed-off-by: Mark Rutland Cc: James Morse Cc: Will Deacon Cc: Catalin Marinas Signed-off-by: Ryan Roberts Signed-off-by: Will Deacon (cherry picked from commit 3bbf004c4808e2c3241e5c1ad6cc102f38a03c39) Signed-off-by: Jonathan Maple # Conflicts: # arch/arm64/include/asm/cputype.h --- .../3bbf004c.failed | 72 +++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/3bbf004c.failed diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/3bbf004c.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/3bbf004c.failed new file mode 100644 index 0000000000000..9704e2ce919dd --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/3bbf004c.failed @@ -0,0 +1,72 @@ +arm64: cputype: Add Neoverse-V3AE definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit 3bbf004c4808e2c3241e5c1ad6cc102f38a03c39 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/3bbf004c.failed + +Add cputype definitions for Neoverse-V3AE. These will be used for errata +detection in subsequent patches. + +These values can be found in the Neoverse-V3AE TRM: + + https://developer.arm.com/documentation/SDEN-2615521/9-0/ + +... in section A.6.1 ("MIDR_EL1, Main ID Register"). + + Signed-off-by: Mark Rutland + Cc: James Morse + Cc: Will Deacon + Cc: Catalin Marinas + Signed-off-by: Ryan Roberts + Signed-off-by: Will Deacon +(cherry picked from commit 3bbf004c4808e2c3241e5c1ad6cc102f38a03c39) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index b2ded290fb1f,9b00b75acbf2..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -95,6 -90,14 +95,17 @@@ + #define ARM_CPU_PART_CORTEX_X1C 0xD4C + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3AE 0xD83 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 ++ #define ARM_CPU_PART_CORTEX_X925 0xD85 ++ #define ARM_CPU_PART_CORTEX_A725 0xD87 ++ #define ARM_CPU_PART_CORTEX_A720AE 0xD89 ++ #define ARM_CPU_PART_NEOVERSE_N3 0xD8E +++>>>>>>> 3bbf004c4808 (arm64: cputype: Add Neoverse-V3AE definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -146,6 -181,14 +157,17 @@@ + #define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3AE) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) ++ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) ++ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) ++ #define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) ++ #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) +++>>>>>>> 3bbf004c4808 (arm64: cputype: Add Neoverse-V3AE definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h From afad9909c6ca58db68d99d4a47837d31ce010c0c Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:27 -0400 Subject: [PATCH 14/24] arm64: Add Cortex-715 CPU part definition jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Anshuman Khandual commit 07e39e60bbf0ccd5f895568e1afca032193705c0 Add the CPU Partnumbers for the new Arm designs. Cc: Catalin Marinas Cc: Will Deacon Cc: Suzuki K Poulose Cc: James Morse Cc: linux-arm-kernel@lists.infradead.org Cc: linux-kernel@vger.kernel.org Acked-by: Catalin Marinas Signed-off-by: Anshuman Khandual Link: https://lore.kernel.org/r/20221116140915.356601-2-anshuman.khandual@arm.com Signed-off-by: Will Deacon (cherry picked from commit 07e39e60bbf0ccd5f895568e1afca032193705c0) Signed-off-by: Jonathan Maple --- arch/arm64/include/asm/cputype.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index b2ded290fb1f4..a1f0424edc4ba 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -89,6 +89,7 @@ #define ARM_CPU_PART_CORTEX_A78 0xD41 #define ARM_CPU_PART_CORTEX_X1 0xD44 #define ARM_CPU_PART_CORTEX_A710 0xD47 +#define ARM_CPU_PART_CORTEX_A715 0xD4D #define ARM_CPU_PART_CORTEX_X2 0xD48 #define ARM_CPU_PART_NEOVERSE_N2 0xD49 #define ARM_CPU_PART_CORTEX_A78C 0xD4B @@ -140,6 +141,7 @@ #define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78) #define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1) #define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710) +#define MIDR_CORTEX_A715 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A715) #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) From 6cdc6e2c79198d1490841a9c2c0e76f9e40368f4 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:27 -0400 Subject: [PATCH 15/24] arm64: cputype: Add Cortex-A720 definitions jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland commit add332c40328cf06fe35e4b3cde8ec315c4629e5 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/add332c4.failed Add cputype definitions for Cortex-A720. These will be used for errata detection in subsequent patches. These values can be found in Table A-186 ("MIDR_EL1 bit descriptions") in issue 0002-05 of the Cortex-A720 TRM, which can be found at: https://developer.arm.com/documentation/102530/0002/?lang=en Signed-off-by: Mark Rutland Cc: James Morse Cc: Will Deacon Link: https://lore.kernel.org/r/20240603111812.1514101-3-mark.rutland@arm.com Signed-off-by: Catalin Marinas (cherry picked from commit add332c40328cf06fe35e4b3cde8ec315c4629e5) Signed-off-by: Jonathan Maple # Conflicts: # arch/arm64/include/asm/cputype.h --- .../add332c4.failed | 66 +++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/add332c4.failed diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/add332c4.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/add332c4.failed new file mode 100644 index 0000000000000..9e4e994090ae8 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/add332c4.failed @@ -0,0 +1,66 @@ +arm64: cputype: Add Cortex-A720 definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit add332c40328cf06fe35e4b3cde8ec315c4629e5 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/add332c4.failed + +Add cputype definitions for Cortex-A720. These will be used for errata +detection in subsequent patches. + +These values can be found in Table A-186 ("MIDR_EL1 bit descriptions") +in issue 0002-05 of the Cortex-A720 TRM, which can be found at: + + https://developer.arm.com/documentation/102530/0002/?lang=en + + Signed-off-by: Mark Rutland + Cc: James Morse + Cc: Will Deacon +Link: https://lore.kernel.org/r/20240603111812.1514101-3-mark.rutland@arm.com + Signed-off-by: Catalin Marinas +(cherry picked from commit add332c40328cf06fe35e4b3cde8ec315c4629e5) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index a1f0424edc4b,dcbac1ce6c25..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -93,9 -86,11 +93,15 @@@ + #define ARM_CPU_PART_CORTEX_X2 0xD48 + #define ARM_CPU_PART_NEOVERSE_N2 0xD49 + #define ARM_CPU_PART_CORTEX_A78C 0xD4B + +#define ARM_CPU_PART_CORTEX_X1C 0xD4C + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 +++>>>>>>> add332c40328 (arm64: cputype: Add Cortex-A720 definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -145,9 -164,11 +151,15 @@@ + #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2) + #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2) + #define MIDR_CORTEX_A78C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C) + +#define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) +++>>>>>>> add332c40328 (arm64: cputype: Add Cortex-A720 definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h From 6e38556f0ac158e043011beffb24f8eff97a7464 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:28 -0400 Subject: [PATCH 16/24] arm64: cputype: Add Cortex-A725 definitions jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland commit 9ef54a384526911095db465e77acc1cb5266b32c Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/9ef54a38.failed Add cputype definitions for Cortex-A725. These will be used for errata detection in subsequent patches. These values can be found in the Cortex-A725 TRM: https://developer.arm.com/documentation/107652/0001/ ... in table A-247 ("MIDR_EL1 bit descriptions"). Signed-off-by: Mark Rutland Cc: James Morse Cc: Will Deacon Reviewed-by: Anshuman Khandual Link: https://lore.kernel.org/r/20240801101803.1982459-3-mark.rutland@arm.com Signed-off-by: Catalin Marinas (cherry picked from commit 9ef54a384526911095db465e77acc1cb5266b32c) Signed-off-by: Jonathan Maple # Conflicts: # arch/arm64/include/asm/cputype.h --- .../9ef54a38.failed | 66 +++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/9ef54a38.failed diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/9ef54a38.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/9ef54a38.failed new file mode 100644 index 0000000000000..222c33ba37e94 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/9ef54a38.failed @@ -0,0 +1,66 @@ +arm64: cputype: Add Cortex-A725 definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit 9ef54a384526911095db465e77acc1cb5266b32c +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/9ef54a38.failed + +Add cputype definitions for Cortex-A725. These will be used for errata +detection in subsequent patches. + +These values can be found in the Cortex-A725 TRM: + + https://developer.arm.com/documentation/107652/0001/ + +... in table A-247 ("MIDR_EL1 bit descriptions"). + + Signed-off-by: Mark Rutland + Cc: James Morse + Cc: Will Deacon + Reviewed-by: Anshuman Khandual +Link: https://lore.kernel.org/r/20240801101803.1982459-3-mark.rutland@arm.com + Signed-off-by: Catalin Marinas +(cherry picked from commit 9ef54a384526911095db465e77acc1cb5266b32c) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index a1f0424edc4b,5fd7caea4419..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -96,6 -89,11 +96,14 @@@ + #define ARM_CPU_PART_CORTEX_X1C 0xD4C + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 ++ #define ARM_CPU_PART_CORTEX_X925 0xD85 ++ #define ARM_CPU_PART_CORTEX_A725 0xD87 +++>>>>>>> 9ef54a384526 (arm64: cputype: Add Cortex-A725 definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -148,6 -170,11 +156,14 @@@ + #define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) ++ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) ++ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) +++>>>>>>> 9ef54a384526 (arm64: cputype: Add Cortex-A725 definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h From 9a9b606989928354c6b75901df4b3d35ccb669b1 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:28 -0400 Subject: [PATCH 17/24] arm64: cputype: Add Neoverse-N3 definitions jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Mark Rutland commit 924725707d80bc2588cefafef76ff3f164d299bc Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/92472570.failed Add cputype definitions for Neoverse-N3. These will be used for errata detection in subsequent patches. These values can be found in Table A-261 ("MIDR_EL1 bit descriptions") in issue 02 of the Neoverse-N3 TRM, which can be found at: https://developer.arm.com/documentation/107997/0000/?lang=en Signed-off-by: Mark Rutland Cc: James Morse Cc: Will Deacon Link: https://lore.kernel.org/r/20240930111705.3352047-2-mark.rutland@arm.com Signed-off-by: Catalin Marinas (cherry picked from commit 924725707d80bc2588cefafef76ff3f164d299bc) Signed-off-by: Jonathan Maple # Conflicts: # arch/arm64/include/asm/cputype.h --- .../92472570.failed | 66 +++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/92472570.failed diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/92472570.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/92472570.failed new file mode 100644 index 0000000000000..c93fb48a68921 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/92472570.failed @@ -0,0 +1,66 @@ +arm64: cputype: Add Neoverse-N3 definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Mark Rutland +commit 924725707d80bc2588cefafef76ff3f164d299bc +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/92472570.failed + +Add cputype definitions for Neoverse-N3. These will be used for errata +detection in subsequent patches. + +These values can be found in Table A-261 ("MIDR_EL1 bit descriptions") +in issue 02 of the Neoverse-N3 TRM, which can be found at: + + https://developer.arm.com/documentation/107997/0000/?lang=en + + Signed-off-by: Mark Rutland + Cc: James Morse + Cc: Will Deacon +Link: https://lore.kernel.org/r/20240930111705.3352047-2-mark.rutland@arm.com + Signed-off-by: Catalin Marinas +(cherry picked from commit 924725707d80bc2588cefafef76ff3f164d299bc) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index a1f0424edc4b,488f8e751349..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -96,6 -89,12 +96,15 @@@ + #define ARM_CPU_PART_CORTEX_X1C 0xD4C + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 ++ #define ARM_CPU_PART_CORTEX_X925 0xD85 ++ #define ARM_CPU_PART_CORTEX_A725 0xD87 ++ #define ARM_CPU_PART_NEOVERSE_N3 0xD8E +++>>>>>>> 924725707d80 (arm64: cputype: Add Neoverse-N3 definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -148,6 -172,12 +157,15 @@@ + #define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) ++ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) ++ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) ++ #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) +++>>>>>>> 924725707d80 (arm64: cputype: Add Neoverse-N3 definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h From 580f66460384f559263680cd9c6ec8c8b97b9489 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:29 -0400 Subject: [PATCH 18/24] arm64: cputype: Add Cortex-A720AE definitions jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Kuninori Morimoto commit f38c2c3e572ce0ce5c01de0358ed70328e0cb5af Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/f38c2c3e.failed Add cputype definitions for Cortex-A720AE. These will be used for errata detection in subsequent patches. These values can be found in the Cortex-A720AE TRM: https://developer.arm.com/documentation/102828/0001/ ... in Table A-187 Signed-off-by: Kuninori Morimoto Signed-off-by: Will Deacon (cherry picked from commit f38c2c3e572ce0ce5c01de0358ed70328e0cb5af) Signed-off-by: Jonathan Maple # Conflicts: # arch/arm64/include/asm/cputype.h --- .../f38c2c3e.failed | 66 +++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/f38c2c3e.failed diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/f38c2c3e.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/f38c2c3e.failed new file mode 100644 index 0000000000000..1fb8d3e6b1c33 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/f38c2c3e.failed @@ -0,0 +1,66 @@ +arm64: cputype: Add Cortex-A720AE definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Kuninori Morimoto +commit f38c2c3e572ce0ce5c01de0358ed70328e0cb5af +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/f38c2c3e.failed + +Add cputype definitions for Cortex-A720AE. These will be used for errata +detection in subsequent patches. + +These values can be found in the Cortex-A720AE TRM: + +https://developer.arm.com/documentation/102828/0001/ + +... in Table A-187 + + Signed-off-by: Kuninori Morimoto + Signed-off-by: Will Deacon +(cherry picked from commit f38c2c3e572ce0ce5c01de0358ed70328e0cb5af) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index a1f0424edc4b,b10eba7f5247..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -96,6 -91,13 +96,16 @@@ + #define ARM_CPU_PART_CORTEX_X1C 0xD4C + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 ++ #define ARM_CPU_PART_CORTEX_X925 0xD85 ++ #define ARM_CPU_PART_CORTEX_A725 0xD87 ++ #define ARM_CPU_PART_CORTEX_A720AE 0xD89 ++ #define ARM_CPU_PART_NEOVERSE_N3 0xD8E +++>>>>>>> f38c2c3e572c (arm64: cputype: Add Cortex-A720AE definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -148,6 -181,13 +158,16 @@@ + #define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) ++ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) ++ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) ++ #define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) ++ #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) +++>>>>>>> f38c2c3e572c (arm64: cputype: Add Cortex-A720AE definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h From 077a8eb6b68fec15a08da76ffa6ba073dbd160b2 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:29 -0400 Subject: [PATCH 19/24] arm64: cputype: Add C1-Pro definitions jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Catalin Marinas commit 2c99561016c591f4c3d5ad7d22a61b8726e79735 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/2c995610.failed Add cputype definitions for C1-Pro. These will be used for errata detection in subsequent patches. These values can be found in "Table A-303: MIDR_EL1 bit descriptions" in issue 07 of the C1-Pro TRM: https://documentation-service.arm.com/static/6930126730f8f55a656570af Acked-by: Mark Rutland Cc: Will Deacon Cc: James Morse Reviewed-by: Will Deacon Signed-off-by: Catalin Marinas (cherry picked from commit 2c99561016c591f4c3d5ad7d22a61b8726e79735) Signed-off-by: Jonathan Maple # Conflicts: # arch/arm64/include/asm/cputype.h --- .../2c995610.failed | 72 +++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/2c995610.failed diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/2c995610.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/2c995610.failed new file mode 100644 index 0000000000000..6e67135dd6192 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/2c995610.failed @@ -0,0 +1,72 @@ +arm64: cputype: Add C1-Pro definitions + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Catalin Marinas +commit 2c99561016c591f4c3d5ad7d22a61b8726e79735 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/2c995610.failed + +Add cputype definitions for C1-Pro. These will be used for errata +detection in subsequent patches. + +These values can be found in "Table A-303: MIDR_EL1 bit descriptions" in +issue 07 of the C1-Pro TRM: + + https://documentation-service.arm.com/static/6930126730f8f55a656570af + + Acked-by: Mark Rutland + Cc: Will Deacon + Cc: James Morse + Reviewed-by: Will Deacon + Signed-off-by: Catalin Marinas +(cherry picked from commit 2c99561016c591f4c3d5ad7d22a61b8726e79735) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/include/asm/cputype.h +diff --cc arch/arm64/include/asm/cputype.h +index a1f0424edc4b,7b518e81dd15..000000000000 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@@ -96,6 -90,15 +96,18 @@@ + #define ARM_CPU_PART_CORTEX_X1C 0xD4C + #define ARM_CPU_PART_CORTEX_X3 0xD4E + #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +++<<<<<<< HEAD +++======= ++ #define ARM_CPU_PART_CORTEX_A720 0xD81 ++ #define ARM_CPU_PART_CORTEX_X4 0xD82 ++ #define ARM_CPU_PART_NEOVERSE_V3AE 0xD83 ++ #define ARM_CPU_PART_NEOVERSE_V3 0xD84 ++ #define ARM_CPU_PART_CORTEX_X925 0xD85 ++ #define ARM_CPU_PART_CORTEX_A725 0xD87 ++ #define ARM_CPU_PART_CORTEX_A720AE 0xD89 ++ #define ARM_CPU_PART_NEOVERSE_N3 0xD8E ++ #define ARM_CPU_PART_C1_PRO 0xD8B +++>>>>>>> 2c99561016c5 (arm64: cputype: Add C1-Pro definitions) + + #define APM_CPU_PART_XGENE 0x000 + #define APM_CPU_VAR_POTENZA 0x00 +@@@ -148,6 -182,15 +160,18 @@@ + #define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) + #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) + #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +++<<<<<<< HEAD +++======= ++ #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) ++ #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) ++ #define MIDR_NEOVERSE_V3AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3AE) ++ #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) ++ #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) ++ #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) ++ #define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) ++ #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) ++ #define MIDR_C1_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PRO) +++>>>>>>> 2c99561016c5 (arm64: cputype: Add C1-Pro definitions) + #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) + #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) + #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) +* Unmerged path arch/arm64/include/asm/cputype.h From f1b516c20b372e65f6faf476055adf23e7d878ae Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:30 -0400 Subject: [PATCH 20/24] arm64: cputype: Add NVIDIA Olympus definitions jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Shanker Donthineni commit e185c8a0d84236d14af61faff8147c953a878a77 Add cpu part and model macro definitions for NVIDIA Olympus core. Signed-off-by: Shanker Donthineni Signed-off-by: Will Deacon (cherry picked from commit e185c8a0d84236d14af61faff8147c953a878a77) Signed-off-by: Jonathan Maple --- arch/arm64/include/asm/cputype.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index a1f0424edc4ba..700aab4179681 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -119,6 +119,7 @@ #define NVIDIA_CPU_PART_DENVER 0x003 #define NVIDIA_CPU_PART_CARMEL 0x004 +#define NVIDIA_CPU_PART_OLYMPUS 0x010 #define FUJITSU_CPU_PART_A64FX 0x001 @@ -164,6 +165,7 @@ #define MIDR_QCOM_KRYO_4XX_SILVER MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_4XX_SILVER) #define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER) #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) +#define MIDR_NVIDIA_OLYMPUS MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_OLYMPUS) #define MIDR_FUJITSU_A64FX MIDR_CPU_MODEL(ARM_CPU_IMP_FUJITSU, FUJITSU_CPU_PART_A64FX) #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) #define MIDR_AMPERE1 MIDR_CPU_MODEL(ARM_CPU_IMP_AMPERE, AMPERE_CPU_PART_AMPERE1) From e94a94b7afffc082f91db11090d28bb35751c13b Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:31 -0400 Subject: [PATCH 21/24] arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Easwar Hariharan commit fb091ff394792c018527b3211bbdfae93ea4ac02 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fb091ff3.failed Add the MIDR value of Microsoft Azure Cobalt 100, which is a Microsoft implemented CPU based on r0p0 of the ARM Neoverse N2 CPU, and therefore suffers from all the same errata. CC: stable@vger.kernel.org # 5.15+ Signed-off-by: Easwar Hariharan Reviewed-by: Anshuman Khandual Acked-by: Mark Rutland Acked-by: Marc Zyngier Reviewed-by: Oliver Upton Link: https://lore.kernel.org/r/20240214175522.2457857-1-eahariha@linux.microsoft.com Signed-off-by: Will Deacon (cherry picked from commit fb091ff394792c018527b3211bbdfae93ea4ac02) Signed-off-by: Jonathan Maple # Conflicts: # Documentation/arm64/silicon-errata.rst # arch/arm64/kernel/cpu_errata.c --- .../fb091ff3.failed | 157 ++++++++++++++++++ 1 file changed, 157 insertions(+) create mode 100644 ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fb091ff3.failed diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fb091ff3.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fb091ff3.failed new file mode 100644 index 0000000000000..97bbacdb53ac7 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fb091ff3.failed @@ -0,0 +1,157 @@ +arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Easwar Hariharan +commit fb091ff394792c018527b3211bbdfae93ea4ac02 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/fb091ff3.failed + +Add the MIDR value of Microsoft Azure Cobalt 100, which is a Microsoft +implemented CPU based on r0p0 of the ARM Neoverse N2 CPU, and therefore +suffers from all the same errata. + +CC: stable@vger.kernel.org # 5.15+ + Signed-off-by: Easwar Hariharan + Reviewed-by: Anshuman Khandual + Acked-by: Mark Rutland + Acked-by: Marc Zyngier + Reviewed-by: Oliver Upton +Link: https://lore.kernel.org/r/20240214175522.2457857-1-eahariha@linux.microsoft.com + Signed-off-by: Will Deacon +(cherry picked from commit fb091ff394792c018527b3211bbdfae93ea4ac02) + Signed-off-by: Jonathan Maple + +# Conflicts: +# Documentation/arm64/silicon-errata.rst +# arch/arm64/kernel/cpu_errata.c +diff --cc Documentation/arm64/silicon-errata.rst +index 433acf4dddd5,45a7f4932fe0..000000000000 +--- a/Documentation/arm64/silicon-errata.rst ++++ b/Documentation/arm64/silicon-errata.rst +@@@ -164,3 -235,18 +164,16 @@@ stable kernels + +----------------+-----------------+-----------------+-----------------------------+ + | Fujitsu | A64FX | E#010001 | FUJITSU_ERRATUM_010001 | + +----------------+-----------------+-----------------+-----------------------------+ +++<<<<<<< HEAD:Documentation/arm64/silicon-errata.rst +++======= ++ +----------------+-----------------+-----------------+-----------------------------+ ++ | ASR | ASR8601 | #8601001 | N/A | ++ +----------------+-----------------+-----------------+-----------------------------+ ++ +----------------+-----------------+-----------------+-----------------------------+ ++ | Microsoft | Azure Cobalt 100| #2139208 | ARM64_ERRATUM_2139208 | ++ +----------------+-----------------+-----------------+-----------------------------+ ++ | Microsoft | Azure Cobalt 100| #2067961 | ARM64_ERRATUM_2067961 | ++ +----------------+-----------------+-----------------+-----------------------------+ ++ | Microsoft | Azure Cobalt 100| #2253138 | ARM64_ERRATUM_2253138 | ++ +----------------+-----------------+-----------------+-----------------------------+ +++>>>>>>> fb091ff39479 (arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata):Documentation/arch/arm64/silicon-errata.rst +diff --cc arch/arm64/kernel/cpu_errata.c +index 8fc40a395bab,76b8dd37092a..000000000000 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@@ -815,6 -370,68 +815,71 @@@ static const struct midr_range erratum_ + }; + #endif + +++<<<<<<< HEAD +++======= ++ #ifdef CONFIG_ARM64_WORKAROUND_TRBE_OVERWRITE_FILL_MODE ++ static const struct midr_range trbe_overwrite_fill_mode_cpus[] = { ++ #ifdef CONFIG_ARM64_ERRATUM_2139208 ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), ++ MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), ++ #endif ++ #ifdef CONFIG_ARM64_ERRATUM_2119858 ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), ++ MIDR_RANGE(MIDR_CORTEX_X2, 0, 0, 2, 0), ++ #endif ++ {}, ++ }; ++ #endif /* CONFIG_ARM64_WORKAROUND_TRBE_OVERWRITE_FILL_MODE */ ++ ++ #ifdef CONFIG_ARM64_WORKAROUND_TSB_FLUSH_FAILURE ++ static const struct midr_range tsb_flush_fail_cpus[] = { ++ #ifdef CONFIG_ARM64_ERRATUM_2067961 ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), ++ MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), ++ #endif ++ #ifdef CONFIG_ARM64_ERRATUM_2054223 ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), ++ #endif ++ {}, ++ }; ++ #endif /* CONFIG_ARM64_WORKAROUND_TSB_FLUSH_FAILURE */ ++ ++ #ifdef CONFIG_ARM64_WORKAROUND_TRBE_WRITE_OUT_OF_RANGE ++ static struct midr_range trbe_write_out_of_range_cpus[] = { ++ #ifdef CONFIG_ARM64_ERRATUM_2253138 ++ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), ++ MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), ++ #endif ++ #ifdef CONFIG_ARM64_ERRATUM_2224489 ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), ++ MIDR_RANGE(MIDR_CORTEX_X2, 0, 0, 2, 0), ++ #endif ++ {}, ++ }; ++ #endif /* CONFIG_ARM64_WORKAROUND_TRBE_WRITE_OUT_OF_RANGE */ ++ ++ #ifdef CONFIG_ARM64_ERRATUM_1742098 ++ static struct midr_range broken_aarch32_aes[] = { ++ MIDR_RANGE(MIDR_CORTEX_A57, 0, 1, 0xf, 0xf), ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A72), ++ {}, ++ }; ++ #endif /* CONFIG_ARM64_WORKAROUND_TRBE_WRITE_OUT_OF_RANGE */ ++ ++ #ifdef CONFIG_ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD ++ static const struct midr_range erratum_spec_unpriv_load_list[] = { ++ #ifdef CONFIG_ARM64_ERRATUM_3117295 ++ MIDR_ALL_VERSIONS(MIDR_CORTEX_A510), ++ #endif ++ #ifdef CONFIG_ARM64_ERRATUM_2966298 ++ /* Cortex-A520 r0p0 to r0p1 */ ++ MIDR_REV_RANGE(MIDR_CORTEX_A520, 0, 0, 1), ++ #endif ++ {}, ++ }; ++ #endif ++ +++>>>>>>> fb091ff39479 (arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata) + const struct arm64_cpu_capabilities arm64_errata[] = { + #ifdef CONFIG_ARM64_WORKAROUND_CLEAN_CACHE + { +* Unmerged path Documentation/arm64/silicon-errata.rst +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index 700aab417968..52185ac37aa9 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -71,6 +71,7 @@ + #define ARM_CPU_IMP_FUJITSU 0x46 + #define ARM_CPU_IMP_HISI 0x48 + #define ARM_CPU_IMP_AMPERE 0xC0 ++#define ARM_CPU_IMP_MICROSOFT 0x6D + + #define ARM_CPU_PART_AEM_V8 0xD0F + #define ARM_CPU_PART_FOUNDATION 0xD00 +@@ -127,6 +128,8 @@ + + #define AMPERE_CPU_PART_AMPERE1 0xAC3 + ++#define MICROSOFT_CPU_PART_AZURE_COBALT_100 0xD49 /* Based on r0p0 of ARM Neoverse N2 */ ++ + #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) + #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) + #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) +@@ -169,6 +172,7 @@ + #define MIDR_FUJITSU_A64FX MIDR_CPU_MODEL(ARM_CPU_IMP_FUJITSU, FUJITSU_CPU_PART_A64FX) + #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) + #define MIDR_AMPERE1 MIDR_CPU_MODEL(ARM_CPU_IMP_AMPERE, AMPERE_CPU_PART_AMPERE1) ++#define MIDR_MICROSOFT_AZURE_COBALT_100 MIDR_CPU_MODEL(ARM_CPU_IMP_MICROSOFT, MICROSOFT_CPU_PART_AZURE_COBALT_100) + + /* Fujitsu Erratum 010001 affects A64FX 1.0 and 1.1, (v0r0 and v1r0) */ + #define MIDR_FUJITSU_ERRATUM_010001 MIDR_FUJITSU_A64FX +* Unmerged path arch/arm64/kernel/cpu_errata.c From 65b078221913957c9ced147ce842f3fbee1e8b92 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:32 -0400 Subject: [PATCH 22/24] arm64: Add part number for Arm Cortex-A78AE jira KERNEL-1291 cve CVE-2025-10263 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Chanho Park commit 83bea32ac7ed37bbda58733de61fc9369513f9f9 Empty-Commit: Cherry-Pick Conflicts during history rebuild. Will be included in final tarball splat. Ref for failed cherry-pick at: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/83bea32a.failed Add the MIDR part number info for the Arm Cortex-A78AE[1] and add it to spectre-BHB affected list[2]. [1]: https://developer.arm.com/Processors/Cortex-A78AE [2]: https://developer.arm.com/Arm%20Security%20Center/Spectre-BHB Cc: Catalin Marinas Cc: Mark Rutland Cc: Will Deacon Cc: James Morse Signed-off-by: Chanho Park Link: https://lore.kernel.org/r/20220407091128.8700-1-chanho61.park@samsung.com Signed-off-by: Will Deacon (cherry picked from commit 83bea32ac7ed37bbda58733de61fc9369513f9f9) Signed-off-by: Jonathan Maple # Conflicts: # arch/arm64/kernel/proton-pack.c --- .../83bea32a.failed | 51 +++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/83bea32a.failed diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/83bea32a.failed b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/83bea32a.failed new file mode 100644 index 0000000000000..7b4fe79fb5c20 --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/83bea32a.failed @@ -0,0 +1,51 @@ +arm64: Add part number for Arm Cortex-A78AE + +jira KERNEL-1291 +cve CVE-2025-10263 +Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 +commit-author Chanho Park +commit 83bea32ac7ed37bbda58733de61fc9369513f9f9 +Empty-Commit: Cherry-Pick Conflicts during history rebuild. +Will be included in final tarball splat. Ref for failed cherry-pick at: +ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/83bea32a.failed + +Add the MIDR part number info for the Arm Cortex-A78AE[1] and add it to +spectre-BHB affected list[2]. + +[1]: https://developer.arm.com/Processors/Cortex-A78AE +[2]: https://developer.arm.com/Arm%20Security%20Center/Spectre-BHB + + Cc: Catalin Marinas + Cc: Mark Rutland + Cc: Will Deacon + Cc: James Morse + Signed-off-by: Chanho Park +Link: https://lore.kernel.org/r/20220407091128.8700-1-chanho61.park@samsung.com + Signed-off-by: Will Deacon +(cherry picked from commit 83bea32ac7ed37bbda58733de61fc9369513f9f9) + Signed-off-by: Jonathan Maple + +# Conflicts: +# arch/arm64/kernel/proton-pack.c +* Unmerged path arch/arm64/kernel/proton-pack.c +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index 700aab417968..b392a6aca719 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -87,6 +87,7 @@ + #define ARM_CPU_PART_CORTEX_A76AE 0xD0E + #define ARM_CPU_PART_NEOVERSE_V1 0xD40 + #define ARM_CPU_PART_CORTEX_A78 0xD41 ++#define ARM_CPU_PART_CORTEX_A78AE 0xD42 + #define ARM_CPU_PART_CORTEX_X1 0xD44 + #define ARM_CPU_PART_CORTEX_A710 0xD47 + #define ARM_CPU_PART_CORTEX_A715 0xD4D +@@ -140,6 +141,7 @@ + #define MIDR_CORTEX_A76AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76AE) + #define MIDR_NEOVERSE_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1) + #define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78) ++#define MIDR_CORTEX_A78AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78AE) + #define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1) + #define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710) + #define MIDR_CORTEX_A715 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A715) +* Unmerged path arch/arm64/kernel/proton-pack.c From 357357112237c9ba0aad8a42cf42d277d3ba2c04 Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:33 -0400 Subject: [PATCH 23/24] fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath jira KERNEL-1291 cve CVE-2026-43112 Rebuild_History Non-Buildable kernel-4.18.0-553.141.1.el8_10 commit-author Fredric Cover commit 78ec5bf2f589ec7fd8f169394bfeca541b077317 When cifs_sanitize_prepath is called with an empty string or a string containing only delimiters (e.g., "/"), the current logic attempts to check *(cursor2 - 1) before cursor2 has advanced. This results in an out-of-bounds read. This patch adds an early exit check after stripping prepended delimiters. If no path content remains, the function returns NULL. The bug was identified via manual audit and verified using a standalone test case compiled with AddressSanitizer, which triggered a SEGV on affected inputs. Signed-off-by: Fredric Cover Reviewed-by: Henrique Carvalho <[2]henrique.carvalho@suse.com> Signed-off-by: Steve French (cherry picked from commit 78ec5bf2f589ec7fd8f169394bfeca541b077317) Signed-off-by: Jonathan Maple --- fs/cifs/fs_context.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/cifs/fs_context.c b/fs/cifs/fs_context.c index 2ecdd4c94cad6..72c1449839c9a 100644 --- a/fs/cifs/fs_context.c +++ b/fs/cifs/fs_context.c @@ -471,6 +471,10 @@ char *cifs_sanitize_prepath(char *prepath, gfp_t gfp) while (IS_DELIM(*cursor1)) cursor1++; + /* exit in case of only delimiters */ + if (!*cursor1) + return NULL; + /* copy the first letter */ *cursor2 = *cursor1; From 0010a149b0116e339e68c5bf4946c4e43a7a558b Mon Sep 17 00:00:00 2001 From: Jonathan Maple Date: Fri, 10 Jul 2026 06:03:46 -0400 Subject: [PATCH 24/24] Rebuild rocky8_10 with kernel-4.18.0-553.141.1.el8_10 Rebuild_History BUILDABLE Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50% Number of commits in upstream range v4.18~1..kernel-mainline: 625874 Number of commits in rpm: 36 Number of commits matched with upstream: 25 (69.44%) Number of commits in upstream but not in rpm: 625851 Number of commits NOT found in upstream: 11 (30.56%) Rebuilding Kernel on Branch rocky8_10_rebuild_kernel-4.18.0-553.141.1.el8_10 for kernel-4.18.0-553.141.1.el8_10 Clean Cherry Picks: 11 (44.00%) Empty Cherry Picks: 12 (48.00%) _______________________________ Full Details Located here: ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/rebuild.details.txt Includes: * git commit header above * Empty Commits with upstream SHA * RPM ChangeLog Entries that could not be matched Individual Empty Commit failures contained in the same containing directory. The git message for empty commits will have the path for the failed commit. File names are the first 8 characters of the upstream SHA --- Documentation/arm64/silicon-errata.rst | 45 ++++++++ Makefile.rhelver | 2 +- arch/arm64/Kconfig | 38 +++++++ arch/arm64/include/asm/cputype.h | 30 +++++- arch/arm64/kernel/cpu_errata.c | 32 +++++- .../rebuild.details.txt | 39 +++++++ configs/kernel-4.18.0-aarch64-debug.config | 1 + configs/kernel-4.18.0-aarch64.config | 1 + configs/kernel-aarch64-debug.config | 1 + configs/kernel-aarch64.config | 1 + fs/namei.c | 3 + include/net/inet_connection_sock.h | 4 +- include/net/tcp.h | 4 +- kernel.sbat | 2 +- net/ipv4/syncookies.c | 2 +- net/ipv4/tcp_fastopen.c | 2 +- net/ipv4/tcp_ipv4.c | 8 +- net/ipv4/tcp_minisocks.c | 2 +- net/ipv6/tcp_ipv6.c | 101 ++++++++---------- net/mptcp/subflow.c | 6 +- net/smc/af_smc.c | 6 +- 21 files changed, 259 insertions(+), 71 deletions(-) create mode 100644 ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/rebuild.details.txt diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst index 433acf4dddd50..3acbb8f834a48 100644 --- a/Documentation/arm64/silicon-errata.rst +++ b/Documentation/arm64/silicon-errata.rst @@ -88,16 +88,58 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A76 | #1463225 | ARM64_ERRATUM_1463225 | +----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A76 | #4193800 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A76AE | #4193801 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A55 | #1530923 | ARM64_ERRATUM_1530923 | +----------------+-----------------+-----------------+-----------------------------+ | ARM | Cortex-A77 | #1508412 | ARM64_ERRATUM_1508412 | +----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A77 | #4193798 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A78 | #4193791 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A78AE | #4193793 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A78C | #4193794 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-A710 | #4193788 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-X1 | #4193791 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-X1C | #4193792 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-X2 | #4193788 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-X3 | #4193786 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-X4 | #4118414 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Cortex-X925 | #4193781 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ | ARM | Neoverse-N1 | #1188873,1418040| ARM64_ERRATUM_1418040 | +----------------+-----------------+-----------------+-----------------------------+ | ARM | Neoverse-N1 | #1349291 | N/A | +----------------+-----------------+-----------------+-----------------------------+ | ARM | Neoverse-N1 | #1542419 | ARM64_ERRATUM_1542419 | +----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-N1 | #4193800 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-N2 | #4193789 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-V1 | #4193790 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-V2 | #4193787 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-V3 | #4193784 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | Neoverse-V3AE | #4193784 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | C1-Premium | #4193780 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ +| ARM | C1-Ultra | #4193780 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ | ARM | MMU-500 | #841119,826419 | N/A | +----------------+-----------------+-----------------+-----------------------------+ +----------------+-----------------+-----------------+-----------------------------+ @@ -132,6 +174,7 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | NVIDIA | Carmel Core | N/A | NVIDIA_CARMEL_CNP_ERRATUM | +----------------+-----------------+-----------------+-----------------------------+ +| NVIDIA | Olympus core | T410-OLY-1029 | ARM64_ERRATUM_4118414 | +----------------+-----------------+-----------------+-----------------------------+ | Freescale/NXP | LS2080A/LS1043A | A-008585 | FSL_ERRATUM_A008585 | +----------------+-----------------+-----------------+-----------------------------+ @@ -164,3 +207,5 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Fujitsu | A64FX | E#010001 | FUJITSU_ERRATUM_010001 | +----------------+-----------------+-----------------+-----------------------------+ +| Microsoft | Azure Cobalt 100| #4193789 | ARM64_ERRATUM_4118414 | ++----------------+-----------------+-----------------+-----------------------------+ diff --git a/Makefile.rhelver b/Makefile.rhelver index 41403d4fcf073..540378aaa0fe5 100644 --- a/Makefile.rhelver +++ b/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 10 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 553.139.1 +RHEL_RELEASE = 553.141.1 # # ZSTREAM diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 7145a73106dfe..3747e410e6539 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -672,6 +672,44 @@ config ARM64_ERRATUM_1508412 If unsure, say Y. +config ARM64_ERRATUM_4118414 + bool "Various: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" + default y + select ARM64_WORKAROUND_REPEAT_TLBI + help + This option adds a workaround for the following errata: + + * ARM C1-Premium erratum 4193780 + * ARM C1-Ultra erratum 4193780 + * ARM Cortex-A76 erratum 4193800 + * ARM Cortex-A76AE erratum 4193801 + * ARM Cortex-A77 erratum 4193798 + * ARM Cortex-A78 erratum 4193791 + * ARM Cortex-A78AE erratum 4193793 + * ARM Cortex-A78C erratum 4193794 + * ARM Cortex-A710 erratum 4193788 + * ARM Cortex-X1 erratum 4193791 + * ARM Cortex-X1C erratum 4193792 + * ARM Cortex-X2 erratum 4193788 + * ARM Cortex-X3 erratum 4193786 + * ARM Cortex-X4 erratum 4118414 + * ARM Cortex-X925 erratum 4193781 + * ARM Neoverse-N1 erratum 4193800 + * ARM Neoverse-N2 erratum 4193789 + * ARM Neoverse-V1 erratum 4193790 + * ARM Neoverse-V2 erratum 4193787 + * ARM Neoverse-V3 erratum 4193784 + * ARM Neoverse-V3AE erratum 4193784 + * Microsoft Azure Cobalt 100 4193789 + * NVIDIA Olympus erratum T410-OLY-1029 + + On affected cores, some memory accesses might not be completed by + broadcast TLB invalidation. + + This issue is also known as CVE-2025-10263. + + If unsure, say Y. + config CAVIUM_ERRATUM_22375 bool "Cavium erratum 22375, 24313" default y diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h index 700aab4179681..02903c6d280af 100644 --- a/arch/arm64/include/asm/cputype.h +++ b/arch/arm64/include/asm/cputype.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2012 ARM Ltd. + * Copyright (C) 2012, 2026 ARM Ltd. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as @@ -71,6 +71,7 @@ #define ARM_CPU_IMP_FUJITSU 0x46 #define ARM_CPU_IMP_HISI 0x48 #define ARM_CPU_IMP_AMPERE 0xC0 +#define ARM_CPU_IMP_MICROSOFT 0x6D #define ARM_CPU_PART_AEM_V8 0xD0F #define ARM_CPU_PART_FOUNDATION 0xD00 @@ -87,6 +88,7 @@ #define ARM_CPU_PART_CORTEX_A76AE 0xD0E #define ARM_CPU_PART_NEOVERSE_V1 0xD40 #define ARM_CPU_PART_CORTEX_A78 0xD41 +#define ARM_CPU_PART_CORTEX_A78AE 0xD42 #define ARM_CPU_PART_CORTEX_X1 0xD44 #define ARM_CPU_PART_CORTEX_A710 0xD47 #define ARM_CPU_PART_CORTEX_A715 0xD4D @@ -96,6 +98,17 @@ #define ARM_CPU_PART_CORTEX_X1C 0xD4C #define ARM_CPU_PART_CORTEX_X3 0xD4E #define ARM_CPU_PART_NEOVERSE_V2 0xD4F +#define ARM_CPU_PART_CORTEX_A720 0xD81 +#define ARM_CPU_PART_CORTEX_X4 0xD82 +#define ARM_CPU_PART_NEOVERSE_V3AE 0xD83 +#define ARM_CPU_PART_NEOVERSE_V3 0xD84 +#define ARM_CPU_PART_CORTEX_X925 0xD85 +#define ARM_CPU_PART_CORTEX_A725 0xD87 +#define ARM_CPU_PART_CORTEX_A720AE 0xD89 +#define ARM_CPU_PART_C1_ULTRA 0xD8C +#define ARM_CPU_PART_NEOVERSE_N3 0xD8E +#define ARM_CPU_PART_C1_PRO 0xD8B +#define ARM_CPU_PART_C1_PREMIUM 0xD90 #define APM_CPU_PART_XGENE 0x000 #define APM_CPU_VAR_POTENZA 0x00 @@ -127,6 +140,8 @@ #define AMPERE_CPU_PART_AMPERE1 0xAC3 +#define MICROSOFT_CPU_PART_AZURE_COBALT_100 0xD49 /* Based on r0p0 of ARM Neoverse N2 */ + #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) @@ -140,6 +155,7 @@ #define MIDR_CORTEX_A76AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76AE) #define MIDR_NEOVERSE_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1) #define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78) +#define MIDR_CORTEX_A78AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78AE) #define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1) #define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710) #define MIDR_CORTEX_A715 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A715) @@ -149,6 +165,17 @@ #define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) #define MIDR_CORTEX_X3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X3) #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) +#define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) +#define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) +#define MIDR_NEOVERSE_V3AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3AE) +#define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) +#define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) +#define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) +#define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) +#define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA) +#define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) +#define MIDR_C1_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PRO) +#define MIDR_C1_PREMIUM MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PREMIUM) #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) @@ -169,6 +196,7 @@ #define MIDR_FUJITSU_A64FX MIDR_CPU_MODEL(ARM_CPU_IMP_FUJITSU, FUJITSU_CPU_PART_A64FX) #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) #define MIDR_AMPERE1 MIDR_CPU_MODEL(ARM_CPU_IMP_AMPERE, AMPERE_CPU_PART_AMPERE1) +#define MIDR_MICROSOFT_AZURE_COBALT_100 MIDR_CPU_MODEL(ARM_CPU_IMP_MICROSOFT, MICROSOFT_CPU_PART_AZURE_COBALT_100) /* Fujitsu Erratum 010001 affects A64FX 1.0 and 1.1, (v0r0 and v1r0) */ #define MIDR_FUJITSU_ERRATUM_010001 MIDR_FUJITSU_A64FX diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c index 8fc40a395babf..fdfdb1f4f0e58 100644 --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -684,6 +684,36 @@ static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = { { ERRATA_MIDR_RANGE(MIDR_CORTEX_A76, 0, 0, 3, 0), }, +#endif +#ifdef CONFIG_ARM64_ERRATUM_4118414 + { + ERRATA_MIDR_RANGE_LIST(((const struct midr_range[]) { + MIDR_ALL_VERSIONS(MIDR_C1_PREMIUM), + MIDR_ALL_VERSIONS(MIDR_C1_ULTRA), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A76), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A76AE), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A77), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), + MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X3), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X4), + MIDR_ALL_VERSIONS(MIDR_CORTEX_X925), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), + MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), + MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), + MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), + {} + })), + }, #endif {}, }; @@ -900,7 +930,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = { #endif #ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI { - .desc = "Qualcomm erratum 1009, or ARM erratum 1286807", + .desc = "Broken broadcast TLBI completion", .capability = ARM64_WORKAROUND_REPEAT_TLBI, .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, .matches = cpucap_multi_entry_cap_matches, diff --git a/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/rebuild.details.txt b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/rebuild.details.txt new file mode 100644 index 0000000000000..26d89dafe5a3d --- /dev/null +++ b/ciq/ciq_backports/kernel-4.18.0-553.141.1.el8_10/rebuild.details.txt @@ -0,0 +1,39 @@ +Rebuild_History BUILDABLE +Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50% +Number of commits in upstream range v4.18~1..kernel-mainline: 625874 +Number of commits in rpm: 36 +Number of commits matched with upstream: 25 (69.44%) +Number of commits in upstream but not in rpm: 625851 +Number of commits NOT found in upstream: 11 (30.56%) + +Rebuilding Kernel on Branch rocky8_10_rebuild_kernel-4.18.0-553.141.1.el8_10 for kernel-4.18.0-553.141.1.el8_10 +Clean Cherry Picks: 11 (44.00%) +Empty Cherry Picks: 12 (48.00%) +_______________________________ + +__EMPTY COMMITS__________________________ +858d2a4f67ff69e645a43487ef7ea7f28f06deae tcp: fix potential race in tcp_v6_syn_recv_sock() +02a0a04676fa7796d9cbc9eb5ca120aaa194d2dd arm64: cputype: Add Cortex-X4 definitions +0ce85db6c2141b7ffb95709d76fc55a27ff3cdc1 arm64: cputype: Add Neoverse-V3 definitions +fd2ff5f0b320f418288e7a1f919f648fbc8a0dfc arm64: cputype: Add Cortex-X925 definitions +3bbf004c4808e2c3241e5c1ad6cc102f38a03c39 arm64: cputype: Add Neoverse-V3AE definitions +add332c40328cf06fe35e4b3cde8ec315c4629e5 arm64: cputype: Add Cortex-A720 definitions +9ef54a384526911095db465e77acc1cb5266b32c arm64: cputype: Add Cortex-A725 definitions +924725707d80bc2588cefafef76ff3f164d299bc arm64: cputype: Add Neoverse-N3 definitions +f38c2c3e572ce0ce5c01de0358ed70328e0cb5af arm64: cputype: Add Cortex-A720AE definitions +2c99561016c591f4c3d5ad7d22a61b8726e79735 arm64: cputype: Add C1-Pro definitions +fb091ff394792c018527b3211bbdfae93ea4ac02 arm64: Subscribe Microsoft Azure Cobalt 100 to ARM Neoverse N2 errata +83bea32ac7ed37bbda58733de61fc9369513f9f9 arm64: Add part number for Arm Cortex-A78AE + +__CHANGES NOT IN UPSTREAM________________ +Adding prod certs and changed cert date to 20210620 +Adding Rocky secure boot certs +Fixing vmlinuz removal +Fixing UEFI CA path +Porting to 8.10, debranding and Rocky branding +Fixing pesign_key_name values +Enable workaround for ARM64 ERRATUM 4118414 +arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU +arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU +arm64: errata: Mitigate TLBI errata on various Arm CPUs +vfs: validate inode i_link before use in get_link() diff --git a/configs/kernel-4.18.0-aarch64-debug.config b/configs/kernel-4.18.0-aarch64-debug.config index c41cff40f6e7d..2fb186afad59b 100644 --- a/configs/kernel-4.18.0-aarch64-debug.config +++ b/configs/kernel-4.18.0-aarch64-debug.config @@ -587,6 +587,7 @@ CONFIG_ARM64_ERRATUM_1286807=y CONFIG_ARM64_ERRATUM_1463225=y CONFIG_ARM64_ERRATUM_1542419=y CONFIG_ARM64_ERRATUM_1508412=y +CONFIG_ARM64_ERRATUM_4118414=y CONFIG_CAVIUM_ERRATUM_22375=y CONFIG_CAVIUM_ERRATUM_23144=y CONFIG_CAVIUM_ERRATUM_23154=y diff --git a/configs/kernel-4.18.0-aarch64.config b/configs/kernel-4.18.0-aarch64.config index b4dce2ffa35a2..c1e13f91b5bf6 100644 --- a/configs/kernel-4.18.0-aarch64.config +++ b/configs/kernel-4.18.0-aarch64.config @@ -607,6 +607,7 @@ CONFIG_ARM64_ERRATUM_1286807=y CONFIG_ARM64_ERRATUM_1463225=y CONFIG_ARM64_ERRATUM_1542419=y CONFIG_ARM64_ERRATUM_1508412=y +CONFIG_ARM64_ERRATUM_4118414=y CONFIG_CAVIUM_ERRATUM_22375=y CONFIG_CAVIUM_ERRATUM_23144=y CONFIG_CAVIUM_ERRATUM_23154=y diff --git a/configs/kernel-aarch64-debug.config b/configs/kernel-aarch64-debug.config index 0c86124df8b76..2ec7d3767b111 100644 --- a/configs/kernel-aarch64-debug.config +++ b/configs/kernel-aarch64-debug.config @@ -2532,6 +2532,7 @@ CONFIG_ARM64_CRYPTO=y CONFIG_ARM64_E0PD=y CONFIG_ARM64_ERRATUM_1024718=y CONFIG_ARM64_ERRATUM_1542419=y +CONFIG_ARM64_ERRATUM_4118414=y CONFIG_ARM64_ERRATUM_819472=y CONFIG_ARM64_ERRATUM_824069=y CONFIG_ARM64_ERRATUM_826319=y diff --git a/configs/kernel-aarch64.config b/configs/kernel-aarch64.config index 4f2cd521c77cf..fc112c2e95b9e 100644 --- a/configs/kernel-aarch64.config +++ b/configs/kernel-aarch64.config @@ -2604,6 +2604,7 @@ CONFIG_ARM64_CRYPTO=y CONFIG_ARM64_E0PD=y CONFIG_ARM64_ERRATUM_1024718=y CONFIG_ARM64_ERRATUM_1542419=y +CONFIG_ARM64_ERRATUM_4118414=y CONFIG_ARM64_ERRATUM_819472=y CONFIG_ARM64_ERRATUM_824069=y CONFIG_ARM64_ERRATUM_826319=y diff --git a/fs/namei.c b/fs/namei.c index 5e46b0a359d53..7fb5075901e17 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -1142,6 +1142,9 @@ const char *get_link(struct nameidata *nd) return ERR_PTR(error); nd->last_type = LAST_BIND; + if (nd->flags & LOOKUP_RCU && + unlikely(read_seqcount_retry(&dentry->d_seq, last->seq))) + return ERR_PTR(-ECHILD); res = READ_ONCE(inode->i_link); if (!res) { const char * (*get)(struct dentry *, struct inode *, diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h index eb56297755ffe..5c896d8b5da72 100644 --- a/include/net/inet_connection_sock.h +++ b/include/net/inet_connection_sock.h @@ -43,7 +43,9 @@ struct inet_connection_sock_af_ops { struct request_sock *req, struct dst_entry *dst, struct request_sock *req_unhash, - bool *own_req); + bool *own_req, + void (*opt_child_init)(struct sock *newsk, + const struct sock *sk)); u16 net_header_len; u16 net_frag_header_len; u16 sockaddr_len; diff --git a/include/net/tcp.h b/include/net/tcp.h index 001fde1ab5877..09d9a1421df42 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -461,7 +461,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, struct request_sock *req, struct dst_entry *dst, struct request_sock *req_unhash, - bool *own_req); + bool *own_req, + void (*opt_child_init)(struct sock *newsk, + const struct sock *sk)); int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb); int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len); int tcp_connect(struct sock *sk); diff --git a/kernel.sbat b/kernel.sbat index b650c3a57d6ae..9ff3aa0ba526b 100644 --- a/kernel.sbat +++ b/kernel.sbat @@ -1,2 +1,2 @@ sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md -kernel.centos,1,Red Hat,kernel-core,4.18.0-553.139.1.el8_10.x86_64,mailto:secalert@redhat.com +kernel.rocky,1,RESF,kernel-core,4.18.0-553.141.1.el8_10.x86_64,mailto:security@rockylinux.org diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c index 30c03b68abd8b..02fb72ec2573f 100644 --- a/net/ipv4/syncookies.c +++ b/net/ipv4/syncookies.c @@ -211,7 +211,7 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb, bool own_req; child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst, - NULL, &own_req); + NULL, &own_req, NULL); if (child) { refcount_set(&req->rsk_refcnt, 1); tcp_sk(child)->tsoffset = tsoff; diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c index dd6347dd8e97c..68698a75a84a9 100644 --- a/net/ipv4/tcp_fastopen.c +++ b/net/ipv4/tcp_fastopen.c @@ -226,7 +226,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk, req->sk = NULL; child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, - NULL, &own_req); + NULL, &own_req, NULL); if (!child) return NULL; diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 76b0753d79c06..daa48ad710d87 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -1411,7 +1411,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, struct request_sock *req, struct dst_entry *dst, struct request_sock *req_unhash, - bool *own_req) + bool *own_req, + void (*opt_child_init)(struct sock *newsk, + const struct sock *sk)) { struct inet_request_sock *ireq; bool found_dup_sk = false; @@ -1460,6 +1462,10 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, } sk_setup_caps(newsk, dst); +#if IS_ENABLED(CONFIG_IPV6) + if (opt_child_init) + opt_child_init(newsk, sk); +#endif tcp_ca_openreq_child(newsk, dst); tcp_sync_mss(newsk, dst_mtu(dst)); diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index bfc953672833d..02f589e03b758 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -752,7 +752,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, * socket is created, wait for troubles. */ child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, - req, &own_req); + req, &own_req, NULL); if (!child) goto listen_overflow; diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 28bb5042eb1bc..6b9ac21df0304 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -1093,11 +1093,50 @@ static void tcp_v6_restore_cb(struct sk_buff *skb) sizeof(struct inet6_skb_parm)); } +/* Called from tcp_v4_syn_recv_sock() for v6_mapped children. */ +static void tcp_v6_mapped_child_init(struct sock *newsk, const struct sock *sk) +{ + struct inet_sock *newinet = inet_sk(newsk); + struct tcp6_sock *newtcp6sk; + struct ipv6_pinfo *newnp; + + newtcp6sk = (struct tcp6_sock *)newsk; + newinet->pinet6 = newnp = &newtcp6sk->inet6; + + memcpy(newnp, inet6_sk(sk), sizeof(struct ipv6_pinfo)); + + newnp->saddr = newsk->sk_v6_rcv_saddr; + + inet_csk(newsk)->icsk_af_ops = &ipv6_mapped; + if (sk_is_mptcp(newsk)) + mptcpv6_handle_mapped(newsk, true); + newsk->sk_backlog_rcv = tcp_v4_do_rcv; +#if defined(CONFIG_TCP_MD5SIG) + tcp_sk(newsk)->af_specific = &tcp_sock_ipv6_mapped_specific; +#endif + + newnp->ipv6_mc_list = NULL; + newnp->ipv6_ac_list = NULL; + newnp->ipv6_fl_list = NULL; + newnp->pktoptions = NULL; + newnp->opt = NULL; + + /* tcp_v4_syn_recv_sock() has initialized newinet->mc_{index,ttl} */ + newnp->mcast_oif = newinet->mc_index; + newnp->mcast_hops = newinet->mc_ttl; + + newnp->rcv_flowinfo = 0; + if (inet6_sk(sk)->repflow) + newnp->flow_label = 0; +} + static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, struct request_sock *req, struct dst_entry *dst, struct request_sock *req_unhash, - bool *own_req) + bool *own_req, + void (*opt_child_init)(struct sock *newsk, + const struct sock *sk)) { struct inet_request_sock *ireq; struct ipv6_pinfo *newnp; @@ -1113,62 +1152,10 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * #endif struct flowi6 fl6; - if (skb->protocol == htons(ETH_P_IP)) { - /* - * v6 mapped - */ - - newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst, - req_unhash, own_req); - - if (!newsk) - return NULL; - - newtcp6sk = (struct tcp6_sock *)newsk; - inet_sk(newsk)->pinet6 = &newtcp6sk->inet6; - - newinet = inet_sk(newsk); - newnp = inet6_sk(newsk); - newtp = tcp_sk(newsk); - - memcpy(newnp, np, sizeof(struct ipv6_pinfo)); - - newnp->saddr = newsk->sk_v6_rcv_saddr; - - inet_csk(newsk)->icsk_af_ops = &ipv6_mapped; - if (sk_is_mptcp(newsk)) - mptcpv6_handle_mapped(newsk, true); - newsk->sk_backlog_rcv = tcp_v4_do_rcv; -#ifdef CONFIG_TCP_MD5SIG - newtp->af_specific = &tcp_sock_ipv6_mapped_specific; -#endif - - newnp->ipv6_mc_list = NULL; - newnp->ipv6_ac_list = NULL; - newnp->ipv6_fl_list = NULL; - newnp->pktoptions = NULL; - newnp->opt = NULL; - newnp->mcast_oif = inet_iif(skb); - newnp->mcast_hops = ip_hdr(skb)->ttl; - newnp->rcv_flowinfo = 0; - if (np->repflow) - newnp->flow_label = 0; - - /* - * No need to charge this sock to the relevant IPv6 refcnt debug socks count - * here, tcp_create_openreq_child now does this for us, see the comment in - * that function for the gory details. -acme - */ - - /* It is tricky place. Until this moment IPv4 tcp - worked with IPv6 icsk.icsk_af_ops. - Sync it now. - */ - tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie); - - return newsk; - } - + if (skb->protocol == htons(ETH_P_IP)) + return tcp_v4_syn_recv_sock(sk, skb, req, dst, + req_unhash, own_req, + tcp_v6_mapped_child_init); ireq = inet_rsk(req); if (sk_acceptq_is_full(sk)) diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index ef4e4e0aa6aeb..5bf87d1da9335 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -610,7 +610,9 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, struct request_sock *req, struct dst_entry *dst, struct request_sock *req_unhash, - bool *own_req) + bool *own_req, + void (*opt_child_init)(struct sock *newsk, + const struct sock *sk)) { struct mptcp_subflow_context *listener = mptcp_subflow_ctx(sk); struct mptcp_subflow_request_sock *subflow_req; @@ -664,7 +666,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, create_child: child = listener->icsk_af_ops->syn_recv_sock(sk, skb, req, dst, - req_unhash, own_req); + req_unhash, own_req, opt_child_init); if (child && *own_req) { struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(child); diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index 64c40a93a924d..02f2cf3b678b0 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -118,7 +118,9 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, struct request_sock *req, struct dst_entry *dst, struct request_sock *req_unhash, - bool *own_req) + bool *own_req, + void (*opt_child_init)(struct sock *newsk, + const struct sock *sk)) { struct smc_sock *smc; struct sock *child; @@ -136,7 +138,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, /* passthrough to original syn recv sock fct */ child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, - own_req); + own_req, opt_child_init); /* child must not inherit smc or its ops */ if (child) { rcu_assign_sk_user_data(child, NULL);