diff --git a/SPECS/kernel-headers/kernel-headers.signatures.json b/SPECS/kernel-headers/kernel-headers.signatures.json index 41599a084f..6f9b8d32fa 100644 --- a/SPECS/kernel-headers/kernel-headers.signatures.json +++ b/SPECS/kernel-headers/kernel-headers.signatures.json @@ -1,5 +1,5 @@ { "Signatures": { - "linux-6.12.44.tar.gz": "fac0ed5371cbd46ebc8a2a1e152ac5fbb5fc2660e748a7fc1d28b8e399854a1a" + "linux-6.12.47.tar.gz": "6b05f6d6ee7d51d4def7e642cbdafec955812e1156548bc4197e38c89bc38fbc" } } diff --git a/SPECS/kernel-headers/kernel-headers.spec b/SPECS/kernel-headers/kernel-headers.spec index 67855e6ab3..716c1b3f30 100644 --- a/SPECS/kernel-headers/kernel-headers.spec +++ b/SPECS/kernel-headers/kernel-headers.spec @@ -13,14 +13,14 @@ Summary: Linux API header files Name: kernel-headers -Version: 6.12.44 +Version: 6.12.47 Release: 1%{?dist} License: GPLv2 Vendor: Intel Corporation Distribution: Edge Microvisor Toolkit Group: System Environment/Kernel URL: https://www.kernel.org/pub/linux/kernel -Source0: https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.44.tar.gz +Source0: https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.47.tar.gz # Historical name shipped by other distros Provides: glibc-kernheaders = %{version}-%{release} BuildArch: noarch @@ -41,7 +41,7 @@ cross-glibc package. %endif %prep -%setup -q -n linux-6.12.44 +%setup -q -n linux-6.12.47 %build make mrproper @@ -76,6 +76,9 @@ done %endif %changelog +* Thu Sep 18 2025 Ren Jiaojiao - 6.12.47-1 +- Update kernel to 6.12.47 + * Tue Sep 09 2025 Ren Jiaojiao - 6.12.44-1 - Update kernel to 6.12.44 diff --git a/SPECS/kernel-rt/0001-drm-virtio-Wait-until-the-control-and-cursor-queues-.sriov b/SPECS/kernel-rt/0001-drm-virtio-Wait-until-the-control-and-cursor-queues-.sriov new file mode 100644 index 0000000000..cbe23fa5a7 --- /dev/null +++ b/SPECS/kernel-rt/0001-drm-virtio-Wait-until-the-control-and-cursor-queues-.sriov @@ -0,0 +1,35 @@ +From c907329d449811f5aa58f2b2a3633b6012774e37 Mon Sep 17 00:00:00 2001 +From: Dongwon Kim +Date: Wed, 10 Sep 2025 20:48:45 -0700 +Subject: [PATCH] drm/virtio: Wait until the control and cursor queues are + fully emptied + +It is needed to wait until the queues are fully emptied before +doing freeze/suspend. + +Signed-off-by: Dongwon Kim +--- + drivers/gpu/drm/virtio/virtgpu_drv.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c +index d6fb1dbfaa27e..d1b189b1a9b75 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_drv.c ++++ b/drivers/gpu/drm/virtio/virtgpu_drv.c +@@ -176,6 +176,13 @@ static int virtgpu_freeze(struct virtio_device *vdev) + flush_work(&vgdev->ctrlq.dequeue_work); + flush_work(&vgdev->cursorq.dequeue_work); + flush_work(&vgdev->config_changed_work); ++ ++ wait_event(vgdev->ctrlq.ack_queue, ++ vgdev->ctrlq.vq->num_free == vgdev->ctrlq.vq->num_max); ++ ++ wait_event(vgdev->cursorq.ack_queue, ++ vgdev->cursorq.vq->num_free == vgdev->cursorq.vq->num_max); ++ + vdev->config->del_vqs(vdev); + + return 0; +-- +2.43.0 + diff --git a/SPECS/kernel-rt/CVE-2025-21807.patch b/SPECS/kernel-rt/CVE-2025-21807.patch deleted file mode 100644 index 08da1ab981..0000000000 --- a/SPECS/kernel-rt/CVE-2025-21807.patch +++ /dev/null @@ -1,169 +0,0 @@ -From dd680ab1ce367fde34fb89faaad97e92929a7f34 Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig -Date: Fri, 10 Jan 2025 06:47:14 +0100 -Subject: [PATCH 3/4] block: fix queue freeze vs limits lock order in sysfs - store methods - -queue_attr_store() always freezes a device queue before calling the -attribute store operation. For attributes that control queue limits, the -store operation will also lock the queue limits with a call to -queue_limits_start_update(). However, some drivers (e.g. SCSI sd) may -need to issue commands to a device to obtain limit values from the -hardware with the queue limits locked. This creates a potential ABBA -deadlock situation if a user attempts to modify a limit (thus freezing -the device queue) while the device driver starts a revalidation of the -device queue limits. - -Avoid such deadlock by not freezing the queue before calling the -->store_limit() method in struct queue_sysfs_entry and instead use the -queue_limits_commit_update_frozen helper to freeze the queue after taking -the limits lock. - -This also removes taking the sysfs lock for the store_limit method as -it doesn't protect anything here, but creates even more nesting. -Hopefully it will go away from the actual sysfs methods entirely soon. - -(commit log adapted from a similar patch from Damien Le Moal) - -Fixes: ff956a3be95b ("block: use queue_limits_commit_update in queue_discard_max_store") -Fixes: 0327ca9d53bf ("block: use queue_limits_commit_update in queue_max_sectors_store") -Signed-off-by: Christoph Hellwig -Reviewed-by: Ming Lei -Reviewed-by: Damien Le Moal -Reviewed-by: Martin K. Petersen -Reviewed-by: Nilay Shroff -Reviewed-by: Johannes Thumshirn -Link: https://lore.kernel.org/r/20250110054726.1499538-7-hch@lst.de -Signed-off-by: Jens Axboe ---- - block/blk-settings.c | 26 ++++++++++++++++++++++++++ - block/blk-sysfs.c | 33 +++++++++++++++++++++++++++------ - include/linux/blkdev.h | 2 ++ - 3 files changed, 55 insertions(+), 6 deletions(-) - -diff --git a/block/blk-settings.c b/block/blk-settings.c -index 7abf034089cd..3907ea71213f 100644 ---- a/block/blk-settings.c -+++ b/block/blk-settings.c -@@ -426,6 +426,32 @@ int queue_limits_commit_update(struct request_queue *q, - } - EXPORT_SYMBOL_GPL(queue_limits_commit_update); - -+ -+/** -+ * queue_limits_commit_update_frozen - commit an atomic update of queue limits -+ * @q: queue to update -+ * @lim: limits to apply -+ * -+ * Apply the limits in @lim that were obtained from queue_limits_start_update() -+ * and updated with the new values by the caller to @q. Freezes the queue -+ * before the update and unfreezes it after. -+ * -+ * Returns 0 if successful, else a negative error code. -+ */ -+int queue_limits_commit_update_frozen(struct request_queue *q, -+ struct queue_limits *lim) -+{ -+ int ret; -+ -+ blk_mq_freeze_queue(q); -+ ret = queue_limits_commit_update(q, lim); -+ blk_mq_unfreeze_queue(q); -+ -+ return ret; -+} -+EXPORT_SYMBOL_GPL(queue_limits_commit_update_frozen); -+ -+ - /** - * queue_limits_set - apply queue limits to queue - * @q: queue to update -diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c -index 692b27266220..69bdd48ceae2 100644 ---- a/block/blk-sysfs.c -+++ b/block/blk-sysfs.c -@@ -23,8 +23,10 @@ - struct queue_sysfs_entry { - struct attribute attr; - ssize_t (*show)(struct gendisk *disk, char *page); -- int (*load_module)(struct gendisk *disk, const char *page, size_t count); - ssize_t (*store)(struct gendisk *disk, const char *page, size_t count); -+ int (*store_limit)(struct gendisk *disk, const char *page, -+ size_t count, struct queue_limits *lim); -+ int (*load_module)(struct gendisk *disk, const char *page, size_t count); - }; - - static ssize_t -@@ -421,6 +423,13 @@ static struct queue_sysfs_entry _prefix##_entry = { \ - .store = _prefix##_store, \ - }; - -+#define QUEUE_LIM_RW_ENTRY(_prefix, _name) \ -+static struct queue_sysfs_entry _prefix##_entry = { \ -+ .attr = { .name = _name, .mode = 0644 }, \ -+ .show = _prefix##_show, \ -+ .store_limit = _prefix##_store, \ -+} -+ - #define QUEUE_RW_LOAD_MODULE_ENTRY(_prefix, _name) \ - static struct queue_sysfs_entry _prefix##_entry = { \ - .attr = { .name = _name, .mode = 0644 }, \ -@@ -683,7 +692,7 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, - struct request_queue *q = disk->queue; - ssize_t res; - -- if (!entry->store) -+ if (!entry->store_limit && !entry->store) - return -EIO; - - /* -@@ -691,17 +700,29 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, - * queue to ensure that the module file can be read when the request - * queue is the one for the device storing the module file. - */ -- if (entry->load_module) { -- res = entry->load_module(disk, page, length); -+ if (entry->load_module) -+ entry->load_module(disk, page, length); -+ -+ if (entry->store_limit) { -+ struct queue_limits lim = queue_limits_start_update(q); -+ -+ res = entry->store_limit(disk, page, length, &lim); -+ if (res < 0) { -+ queue_limits_cancel_update(q); -+ return res; -+ } -+ -+ res = queue_limits_commit_update_frozen(q, &lim); - if (res) - return res; -+ return length; - } - -- blk_mq_freeze_queue(q); - mutex_lock(&q->sysfs_lock); -+ blk_mq_freeze_queue(q); - res = entry->store(disk, page, length); -- mutex_unlock(&q->sysfs_lock); - blk_mq_unfreeze_queue(q); -+ mutex_unlock(&q->sysfs_lock); - return res; - } - -diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h -index 8f37c5dd52b2..69737a1551fe 100644 ---- a/include/linux/blkdev.h -+++ b/include/linux/blkdev.h -@@ -935,6 +935,8 @@ queue_limits_start_update(struct request_queue *q) - mutex_lock(&q->limits_lock); - return q->limits; - } -+int queue_limits_commit_update_frozen(struct request_queue *q, -+ struct queue_limits *lim); - int queue_limits_commit_update(struct request_queue *q, - struct queue_limits *lim); - int queue_limits_set(struct request_queue *q, struct queue_limits *lim); --- -2.25.1 - diff --git a/SPECS/kernel-rt/CVE-2025-21817.patch b/SPECS/kernel-rt/CVE-2025-21817.patch index ae8a91cef0..717fe82547 100644 --- a/SPECS/kernel-rt/CVE-2025-21817.patch +++ b/SPECS/kernel-rt/CVE-2025-21817.patch @@ -1,7 +1,7 @@ -From 961a8f3d5f63a1c4b1d93f9d12c2dc7264d4434e Mon Sep 17 00:00:00 2001 +From 1605aaf3ed80ecc295f493c28946af971d36389e Mon Sep 17 00:00:00 2001 From: Ming Lei Date: Mon, 13 Jan 2025 09:58:33 +0800 -Subject: [PATCH 4/4] block: mark GFP_NOIO around sysfs ->store() +Subject: [PATCH] block: mark GFP_NOIO around sysfs ->store() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -26,27 +26,27 @@ Signed-off-by: Jens Axboe 1 file changed, 3 insertions(+) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c -index 69bdd48ceae2..496564485bad 100644 +index 6a38f312e385..063c578d3e4b 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c -@@ -690,6 +690,7 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, +@@ -681,6 +681,7 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, struct queue_sysfs_entry *entry = to_queue(attr); struct gendisk *disk = container_of(kobj, struct gendisk, queue_kobj); struct request_queue *q = disk->queue; + unsigned int noio_flag; ssize_t res; - if (!entry->store_limit && !entry->store) -@@ -720,7 +721,9 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, + if (!entry->store) +@@ -699,7 +700,9 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, - mutex_lock(&q->sysfs_lock); blk_mq_freeze_queue(q); + mutex_lock(&q->sysfs_lock); + noio_flag = memalloc_noio_save(); res = entry->store(disk, page, length); + memalloc_noio_restore(noio_flag); - blk_mq_unfreeze_queue(q); mutex_unlock(&q->sysfs_lock); + blk_mq_unfreeze_queue(q); return res; -- -2.25.1 +2.43.0 diff --git a/SPECS/kernel-rt/CVE-2025-22103.patch b/SPECS/kernel-rt/CVE-2025-22103.patch deleted file mode 100644 index 0758824ca2..0000000000 --- a/SPECS/kernel-rt/CVE-2025-22103.patch +++ /dev/null @@ -1,61 +0,0 @@ -From a7feb0e9dda0ebb66c810ad9bd0bbeb2823bd89f Mon Sep 17 00:00:00 2001 -From: Wang Liang -Date: Fri, 21 Mar 2025 17:03:53 +0800 -Subject: [PATCH] net: fix NULL pointer dereference in l3mdev_l3_rcv - -When delete l3s ipvlan: - - ip link del link eth0 ipvlan1 type ipvlan mode l3s - -This may cause a null pointer dereference: - - Call trace: - ip_rcv_finish+0x48/0xd0 - ip_rcv+0x5c/0x100 - __netif_receive_skb_one_core+0x64/0xb0 - __netif_receive_skb+0x20/0x80 - process_backlog+0xb4/0x204 - napi_poll+0xe8/0x294 - net_rx_action+0xd8/0x22c - __do_softirq+0x12c/0x354 - -This is because l3mdev_l3_rcv() visit dev->l3mdev_ops after -ipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process -like this: - - (CPU1) | (CPU2) - l3mdev_l3_rcv() | - check dev->priv_flags: | - master = skb->dev; | - | - | ipvlan_l3s_unregister() - | set dev->priv_flags - | dev->l3mdev_ops = NULL; - | - visit master->l3mdev_ops | - -To avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan. - -Suggested-by: David Ahern -Fixes: c675e06a98a4 ("ipvlan: decouple l3s mode dependencies from other modes") -Signed-off-by: Wang Liang -Reviewed-by: Simon Horman -Link: https://patch.msgid.link/20250321090353.1170545-1-wangliang74@huawei.com -Signed-off-by: Jakub Kicinski ---- - drivers/net/ipvlan/ipvlan_l3s.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/drivers/net/ipvlan/ipvlan_l3s.c b/drivers/net/ipvlan/ipvlan_l3s.c -index d5b05e803219..ca35a50bb640 100644 ---- a/drivers/net/ipvlan/ipvlan_l3s.c -+++ b/drivers/net/ipvlan/ipvlan_l3s.c -@@ -224,5 +224,4 @@ void ipvlan_l3s_unregister(struct ipvl_port *port) - - dev->priv_flags &= ~IFF_L3MDEV_RX_HANDLER; - ipvlan_unregister_nf_hook(read_pnet(&port->pnet)); -- dev->l3mdev_ops = NULL; - } --- -2.25.1 - diff --git a/SPECS/kernel-rt/CVE-2025-22113-1.patch b/SPECS/kernel-rt/CVE-2025-22113-1.patch deleted file mode 100644 index 4a1c1cb639..0000000000 --- a/SPECS/kernel-rt/CVE-2025-22113-1.patch +++ /dev/null @@ -1,169 +0,0 @@ -From a38f34dafdd0c30fb3d2b3f35e1164f51442c215 Mon Sep 17 00:00:00 2001 -From: Ojaswin Mujoo -Date: Tue, 18 Mar 2025 13:22:56 +0530 -Subject: [PATCH 2/2] ext4: avoid journaling sb update on error if journal is - destroying - -Presently we always BUG_ON if trying to start a transaction on a journal marked -with JBD2_UNMOUNT, since this should never happen. However, while ltp running -stress tests, it was observed that in case of some error handling paths, it is -possible for update_super_work to start a transaction after the journal is -destroyed eg: - -(umount) -ext4_kill_sb - kill_block_super - generic_shutdown_super - sync_filesystem /* commits all txns */ - evict_inodes - /* might start a new txn */ - ext4_put_super - flush_work(&sbi->s_sb_upd_work) /* flush the workqueue */ - jbd2_journal_destroy - journal_kill_thread - journal->j_flags |= JBD2_UNMOUNT; - jbd2_journal_commit_transaction - jbd2_journal_get_descriptor_buffer - jbd2_journal_bmap - ext4_journal_bmap - ext4_map_blocks - ... - ext4_inode_error - ext4_handle_error - schedule_work(&sbi->s_sb_upd_work) - - /* work queue kicks in */ - update_super_work - jbd2_journal_start - start_this_handle - BUG_ON(journal->j_flags & - JBD2_UNMOUNT) - -Hence, introduce a new mount flag to indicate journal is destroying and only do -a journaled (and deferred) update of sb if this flag is not set. Otherwise, just -fallback to an un-journaled commit. - -Further, in the journal destroy path, we have the following sequence: - - 1. Set mount flag indicating journal is destroying - 2. force a commit and wait for it - 3. flush pending sb updates - -This sequence is important as it ensures that, after this point, there is no sb -update that might be journaled so it is safe to update the sb outside the -journal. (To avoid race discussed in 2d01ddc86606) - -Also, we don't need a similar check in ext4_grp_locked_error since it is only -called from mballoc and AFAICT it would be always valid to schedule work here. - -Fixes: 2d01ddc86606 ("ext4: save error info to sb through journal if available") -Reported-by: Mahesh Kumar -Signed-off-by: Ojaswin Mujoo -Reviewed-by: Jan Kara -Link: https://patch.msgid.link/9613c465d6ff00cd315602f99283d5f24018c3f7.1742279837.git.ojaswin@linux.ibm.com -Signed-off-by: Theodore Ts'o ---- - fs/ext4/ext4.h | 3 ++- - fs/ext4/ext4_jbd2.h | 15 +++++++++++++++ - fs/ext4/super.c | 16 ++++++++-------- - 3 files changed, 25 insertions(+), 9 deletions(-) - -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index bbffb76d9a90..27b633928eb1 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -1820,7 +1820,8 @@ static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino) - */ - enum { - EXT4_MF_MNTDIR_SAMPLED, -- EXT4_MF_FC_INELIGIBLE /* Fast commit ineligible */ -+ EXT4_MF_FC_INELIGIBLE, /* Fast commit ineligible */ -+ EXT4_MF_JOURNAL_DESTROY /* Journal is in process of destroying */ - }; - - static inline void ext4_set_mount_flag(struct super_block *sb, int bit) -diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h -index 930778e507cc..ada46189b086 100644 ---- a/fs/ext4/ext4_jbd2.h -+++ b/fs/ext4/ext4_jbd2.h -@@ -521,6 +521,21 @@ static inline int ext4_journal_destroy(struct ext4_sb_info *sbi, journal_t *jour - { - int err = 0; - -+ /* -+ * At this point only two things can be operating on the journal. -+ * JBD2 thread performing transaction commit and s_sb_upd_work -+ * issuing sb update through the journal. Once we set -+ * EXT4_JOURNAL_DESTROY, new ext4_handle_error() calls will not -+ * queue s_sb_upd_work and ext4_force_commit() makes sure any -+ * ext4_handle_error() calls from the running transaction commit are -+ * finished. Hence no new s_sb_upd_work can be queued after we -+ * flush it here. -+ */ -+ ext4_set_mount_flag(sbi->s_sb, EXT4_MF_JOURNAL_DESTROY); -+ -+ ext4_force_commit(sbi->s_sb); -+ flush_work(&sbi->s_sb_upd_work); -+ - err = jbd2_journal_destroy(journal); - sbi->s_journal = NULL; - -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index f26816854dd5..b10872abb9c9 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -719,9 +719,13 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error, - * In case the fs should keep running, we need to writeout - * superblock through the journal. Due to lock ordering - * constraints, it may not be safe to do it right here so we -- * defer superblock flushing to a workqueue. -+ * defer superblock flushing to a workqueue. We just need to be -+ * careful when the journal is already shutting down. If we get -+ * here in that case, just update the sb directly as the last -+ * transaction won't commit anyway. - */ -- if (continue_fs && journal) -+ if (continue_fs && journal && -+ !ext4_test_mount_flag(sb, EXT4_MF_JOURNAL_DESTROY)) - schedule_work(&EXT4_SB(sb)->s_sb_upd_work); - else - ext4_commit_super(sb); -@@ -1306,7 +1310,6 @@ static void ext4_put_super(struct super_block *sb) - ext4_unregister_li_request(sb); - ext4_quotas_off(sb, EXT4_MAXQUOTAS); - -- flush_work(&sbi->s_sb_upd_work); - destroy_workqueue(sbi->rsv_conversion_wq); - ext4_release_orphan_info(sb); - -@@ -1316,7 +1319,8 @@ static void ext4_put_super(struct super_block *sb) - if ((err < 0) && !aborted) { - ext4_abort(sb, -err, "Couldn't clean up the journal"); - } -- } -+ } else -+ flush_work(&sbi->s_sb_upd_work); - - ext4_es_unregister_shrinker(sbi); - timer_shutdown_sync(&sbi->s_err_report); -@@ -4944,8 +4948,6 @@ static int ext4_load_and_init_journal(struct super_block *sb, - return 0; - - out: -- /* flush s_sb_upd_work before destroying the journal. */ -- flush_work(&sbi->s_sb_upd_work); - ext4_journal_destroy(sbi, sbi->s_journal); - return -EINVAL; - } -@@ -5631,8 +5633,6 @@ failed_mount8: __maybe_unused - sbi->s_ea_block_cache = NULL; - - if (sbi->s_journal) { -- /* flush s_sb_upd_work before journal destroy. */ -- flush_work(&sbi->s_sb_upd_work); - ext4_journal_destroy(sbi, sbi->s_journal); - } - failed_mount3a: --- -2.25.1 - diff --git a/SPECS/kernel-rt/CVE-2025-22113.patch b/SPECS/kernel-rt/CVE-2025-22113.patch deleted file mode 100644 index 42b4dd4f27..0000000000 --- a/SPECS/kernel-rt/CVE-2025-22113.patch +++ /dev/null @@ -1,108 +0,0 @@ -From 1cb42376c3bb339074fd4d72232156af50dbd0a8 Mon Sep 17 00:00:00 2001 -From: Ojaswin Mujoo -Date: Tue, 18 Mar 2025 13:22:55 +0530 -Subject: [PATCH 1/2] ext4: define ext4_journal_destroy wrapper - -Define an ext4 wrapper over jbd2_journal_destroy to make sure we -have consistent behavior during journal destruction. This will also -come useful in the next patch where we add some ext4 specific logic -in the destroy path. - -Reviewed-by: Jan Kara -Reviewed-by: Baokun Li -Signed-off-by: Ojaswin Mujoo -Link: https://patch.msgid.link/c3ba78c5c419757e6d5f2d8ebb4a8ce9d21da86a.1742279837.git.ojaswin@linux.ibm.com -Signed-off-by: Theodore Ts'o ---- - fs/ext4/ext4_jbd2.h | 14 ++++++++++++++ - fs/ext4/super.c | 16 ++++++---------- - 2 files changed, 20 insertions(+), 10 deletions(-) - -diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h -index 0c77697d5e90..930778e507cc 100644 ---- a/fs/ext4/ext4_jbd2.h -+++ b/fs/ext4/ext4_jbd2.h -@@ -513,4 +513,18 @@ static inline int ext4_should_dioread_nolock(struct inode *inode) - return 1; - } - -+/* -+ * Pass journal explicitly as it may not be cached in the sbi->s_journal in some -+ * cases -+ */ -+static inline int ext4_journal_destroy(struct ext4_sb_info *sbi, journal_t *journal) -+{ -+ int err = 0; -+ -+ err = jbd2_journal_destroy(journal); -+ sbi->s_journal = NULL; -+ -+ return err; -+} -+ - #endif /* _EXT4_JBD2_H */ -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 4291ab3c20be..f26816854dd5 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -1312,8 +1312,7 @@ static void ext4_put_super(struct super_block *sb) - - if (sbi->s_journal) { - aborted = is_journal_aborted(sbi->s_journal); -- err = jbd2_journal_destroy(sbi->s_journal); -- sbi->s_journal = NULL; -+ err = ext4_journal_destroy(sbi, sbi->s_journal); - if ((err < 0) && !aborted) { - ext4_abort(sb, -err, "Couldn't clean up the journal"); - } -@@ -4947,8 +4946,7 @@ static int ext4_load_and_init_journal(struct super_block *sb, - out: - /* flush s_sb_upd_work before destroying the journal. */ - flush_work(&sbi->s_sb_upd_work); -- jbd2_journal_destroy(sbi->s_journal); -- sbi->s_journal = NULL; -+ ext4_journal_destroy(sbi, sbi->s_journal); - return -EINVAL; - } - -@@ -5635,8 +5633,7 @@ failed_mount8: __maybe_unused - if (sbi->s_journal) { - /* flush s_sb_upd_work before journal destroy. */ - flush_work(&sbi->s_sb_upd_work); -- jbd2_journal_destroy(sbi->s_journal); -- sbi->s_journal = NULL; -+ ext4_journal_destroy(sbi, sbi->s_journal); - } - failed_mount3a: - ext4_es_unregister_shrinker(sbi); -@@ -5944,7 +5941,7 @@ static journal_t *ext4_open_dev_journal(struct super_block *sb, - return journal; - - out_journal: -- jbd2_journal_destroy(journal); -+ ext4_journal_destroy(EXT4_SB(sb), journal); - out_bdev: - bdev_fput(bdev_file); - return ERR_PTR(errno); -@@ -6061,8 +6058,7 @@ static int ext4_load_journal(struct super_block *sb, - EXT4_SB(sb)->s_journal = journal; - err = ext4_clear_journal_err(sb, es); - if (err) { -- EXT4_SB(sb)->s_journal = NULL; -- jbd2_journal_destroy(journal); -+ ext4_journal_destroy(EXT4_SB(sb), journal); - return err; - } - -@@ -6080,7 +6076,7 @@ static int ext4_load_journal(struct super_block *sb, - return 0; - - err_out: -- jbd2_journal_destroy(journal); -+ ext4_journal_destroy(EXT4_SB(sb), journal); - return err; - } - --- -2.25.1 - diff --git a/SPECS/kernel-rt/CVE-2025-22124.patch b/SPECS/kernel-rt/CVE-2025-22124.patch deleted file mode 100644 index ba717d0c64..0000000000 --- a/SPECS/kernel-rt/CVE-2025-22124.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 31ea5fb2dc95a5ddc9ad67d53b5d1f151775f194 Mon Sep 17 00:00:00 2001 -From: Su Yue -Date: Mon, 3 Mar 2025 11:39:18 +0800 -Subject: [PATCH] md/md-bitmap: fix wrong bitmap_limit for clustermd when write - sb - -In clustermd, separate write-intent-bitmaps are used for each cluster -node: - -0 4k 8k 12k -------------------------------------------------------------------- -| idle | md super | bm super [0] + bits | -| bm bits[0, contd] | bm super[1] + bits | bm bits[1, contd] | -| bm super[2] + bits | bm bits [2, contd] | bm super[3] + bits | -| bm bits [3, contd] | | | - -So in node 1, pg_index in __write_sb_page() could equal to -bitmap->storage.file_pages. Then bitmap_limit will be calculated to -0. md_super_write() will be called with 0 size. -That means the first 4k sb area of node 1 will never be updated -through filemap_write_page(). -This bug causes hang of mdadm/clustermd_tests/01r1_Grow_resize. - -Here use (pg_index % bitmap->storage.file_pages) to make calculation -of bitmap_limit correct. - -Fixes: ab99a87542f1 ("md/md-bitmap: fix writing non bitmap pages") -Signed-off-by: Su Yue -Reviewed-by: Heming Zhao -Link: https://lore.kernel.org/linux-raid/20250303033918.32136-1-glass.su@suse.com -Signed-off-by: Yu Kuai ---- - drivers/md/md-bitmap.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c -index 2e3087556adb..4ab69fd1745a 100644 ---- a/drivers/md/md-bitmap.c -+++ b/drivers/md/md-bitmap.c -@@ -426,8 +426,8 @@ static int __write_sb_page(struct md_rdev *rdev, struct bitmap *bitmap, - struct block_device *bdev; - struct mddev *mddev = bitmap->mddev; - struct bitmap_storage *store = &bitmap->storage; -- unsigned int bitmap_limit = (bitmap->storage.file_pages - pg_index) << -- PAGE_SHIFT; -+ unsigned long num_pages = bitmap->storage.file_pages; -+ unsigned int bitmap_limit = (num_pages - pg_index % num_pages) << PAGE_SHIFT; - loff_t sboff, offset = mddev->bitmap_info.offset; - sector_t ps = pg_index * PAGE_SIZE / SECTOR_SIZE; - unsigned int size = PAGE_SIZE; -@@ -436,7 +436,7 @@ static int __write_sb_page(struct md_rdev *rdev, struct bitmap *bitmap, - - bdev = (rdev->meta_bdev) ? rdev->meta_bdev : rdev->bdev; - /* we compare length (page numbers), not page offset. */ -- if ((pg_index - store->sb_index) == store->file_pages - 1) { -+ if ((pg_index - store->sb_index) == num_pages - 1) { - unsigned int last_page_size = store->bytes & (PAGE_SIZE - 1); - - if (last_page_size == 0) --- -2.25.1 - diff --git a/SPECS/kernel-rt/CVE-2025-22125.patch b/SPECS/kernel-rt/CVE-2025-22125.patch deleted file mode 100644 index 6fffcf2b4d..0000000000 --- a/SPECS/kernel-rt/CVE-2025-22125.patch +++ /dev/null @@ -1,98 +0,0 @@ -From d6da5b46c7ccd873b769212a88ab847026a0ecbc Mon Sep 17 00:00:00 2001 -From: Yu Kuai -Date: Thu, 27 Feb 2025 20:16:57 +0800 -Subject: [PATCH 18/27] md/raid1,raid10: don't ignore IO flags - -If blk-wbt is enabled by default, it's found that raid write performance -is quite bad because all IO are throttled by wbt of underlying disks, -due to flag REQ_IDLE is ignored. And turns out this behaviour exist since -blk-wbt is introduced. - -Other than REQ_IDLE, other flags should not be ignored as well, for -example REQ_META can be set for filesystems, clearing it can cause priority -reverse problems; And REQ_NOWAIT should not be cleared as well, because -io will wait instead of failing directly in underlying disks. - -Fix those problems by keep IO flags from master bio. - -Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT") -Fixes: e34cbd307477 ("blk-wbt: add general throttling mechanism") -Fixes: 5404bc7a87b9 ("[PATCH] Allow file systems to differentiate between data and meta reads") -Link: https://lore.kernel.org/linux-raid/20250227121657.832356-1-yukuai1@huaweicloud.com -Signed-off-by: Yu Kuai ---- - drivers/md/raid1.c | 4 ---- - drivers/md/raid10.c | 7 ------- - 2 files changed, 11 deletions(-) - -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index fe1599db69c8..6e93e3b6bd8c 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -1315,8 +1315,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, - struct r1conf *conf = mddev->private; - struct raid1_info *mirror; - struct bio *read_bio; -- const enum req_op op = bio_op(bio); -- const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; - int max_sectors; - int rdisk; - bool r1bio_existed = !!r1_bio; -@@ -1399,7 +1397,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, - read_bio->bi_iter.bi_sector = r1_bio->sector + - mirror->rdev->data_offset; - read_bio->bi_end_io = raid1_end_read_request; -- read_bio->bi_opf = op | do_sync; - if (test_bit(FailFast, &mirror->rdev->flags) && - test_bit(R1BIO_FailFast, &r1_bio->state)) - read_bio->bi_opf |= MD_FAILFAST; -@@ -1619,7 +1616,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, - - mbio->bi_iter.bi_sector = (r1_bio->sector + rdev->data_offset); - mbio->bi_end_io = raid1_end_write_request; -- mbio->bi_opf = bio_op(bio) | (bio->bi_opf & (REQ_SYNC | REQ_FUA)); - if (test_bit(FailFast, &rdev->flags) && - !test_bit(WriteMostly, &rdev->flags) && - conf->raid_disks - mddev->degraded > 1) -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index 8825457f6a70..e2c6487456c1 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -1146,8 +1146,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, - { - struct r10conf *conf = mddev->private; - struct bio *read_bio; -- const enum req_op op = bio_op(bio); -- const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; - int max_sectors; - struct md_rdev *rdev; - char b[BDEVNAME_SIZE]; -@@ -1226,7 +1224,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, - read_bio->bi_iter.bi_sector = r10_bio->devs[slot].addr + - choose_data_offset(r10_bio, rdev); - read_bio->bi_end_io = raid10_end_read_request; -- read_bio->bi_opf = op | do_sync; - if (test_bit(FailFast, &rdev->flags) && - test_bit(R10BIO_FailFast, &r10_bio->state)) - read_bio->bi_opf |= MD_FAILFAST; -@@ -1240,9 +1237,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, - struct bio *bio, bool replacement, - int n_copy) - { -- const enum req_op op = bio_op(bio); -- const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; -- const blk_opf_t do_fua = bio->bi_opf & REQ_FUA; - unsigned long flags; - struct r10conf *conf = mddev->private; - struct md_rdev *rdev; -@@ -1261,7 +1255,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, - mbio->bi_iter.bi_sector = (r10_bio->devs[n_copy].addr + - choose_data_offset(r10_bio, rdev)); - mbio->bi_end_io = raid10_end_write_request; -- mbio->bi_opf = op | do_sync | do_fua; - if (!replacement && test_bit(FailFast, - &conf->mirrors[devnum].rdev->flags) - && enough(conf, devnum)) --- -2.43.0 - diff --git a/SPECS/kernel-rt/CVE-2025-23133.patch b/SPECS/kernel-rt/CVE-2025-23133.patch deleted file mode 100644 index 000000ed36..0000000000 --- a/SPECS/kernel-rt/CVE-2025-23133.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 73cb277b4f7485c9b3c2e4490474ec7708808b32 Mon Sep 17 00:00:00 2001 -From: Wen Gong -Date: Fri, 17 Jan 2025 14:17:36 +0800 -Subject: [PATCH 13/27] wifi: ath11k: update channel list in reg notifier - instead reg worker - -Currently when ath11k gets a new channel list, it will be processed -according to the following steps: -1. update new channel list to cfg80211 and queue reg_work. -2. cfg80211 handles new channel list during reg_work. -3. update cfg80211's handled channel list to firmware by -ath11k_reg_update_chan_list(). - -But ath11k will immediately execute step 3 after reg_work is just -queued. Since step 2 is asynchronous, cfg80211 may not have completed -handling the new channel list, which may leading to an out-of-bounds -write error: -BUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list -Call Trace: - ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k] - kfree+0x109/0x3a0 - ath11k_regd_update+0x1cf/0x350 [ath11k] - ath11k_regd_update_work+0x14/0x20 [ath11k] - process_one_work+0xe35/0x14c0 - -Should ensure step 2 is completely done before executing step 3. Thus -Wen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set, -cfg80211 will notify ath11k after step 2 is done. - -So enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will -notify ath11k after step 2 is done. At this time, there will be no -KASAN bug during the execution of the step 3. - -[1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/ - -Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3 - -Fixes: f45cb6b29cd3 ("wifi: ath11k: avoid deadlock during regulatory update in ath11k_regd_update()") -Signed-off-by: Wen Gong -Signed-off-by: Kang Yang -Reviewed-by: Aditya Kumar Singh -Link: https://patch.msgid.link/20250117061737.1921-2-quic_kangyang@quicinc.com -Signed-off-by: Jeff Johnson ---- - drivers/net/wireless/ath/ath11k/reg.c | 22 +++++++++++++++------- - 1 file changed, 15 insertions(+), 7 deletions(-) - -diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c -index b0f289784dd3..7bfe47ad62a0 100644 ---- a/drivers/net/wireless/ath/ath11k/reg.c -+++ b/drivers/net/wireless/ath/ath11k/reg.c -@@ -1,7 +1,7 @@ - // SPDX-License-Identifier: BSD-3-Clause-Clear - /* - * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. -- * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. - */ - #include - -@@ -55,6 +55,19 @@ ath11k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request) - ath11k_dbg(ar->ab, ATH11K_DBG_REG, - "Regulatory Notification received for %s\n", wiphy_name(wiphy)); - -+ if (request->initiator == NL80211_REGDOM_SET_BY_DRIVER) { -+ ath11k_dbg(ar->ab, ATH11K_DBG_REG, -+ "driver initiated regd update\n"); -+ if (ar->state != ATH11K_STATE_ON) -+ return; -+ -+ ret = ath11k_reg_update_chan_list(ar, true); -+ if (ret) -+ ath11k_warn(ar->ab, "failed to update channel list: %d\n", ret); -+ -+ return; -+ } -+ - /* Currently supporting only General User Hints. Cell base user - * hints to be handled later. - * Hints from other sources like Core, Beacons are not expected for -@@ -293,12 +306,6 @@ int ath11k_regd_update(struct ath11k *ar) - if (ret) - goto err; - -- if (ar->state == ATH11K_STATE_ON) { -- ret = ath11k_reg_update_chan_list(ar, true); -- if (ret) -- goto err; -- } -- - return 0; - err: - ath11k_warn(ab, "failed to perform regd update : %d\n", ret); -@@ -977,6 +984,7 @@ void ath11k_regd_update_work(struct work_struct *work) - void ath11k_reg_init(struct ath11k *ar) - { - ar->hw->wiphy->regulatory_flags = REGULATORY_WIPHY_SELF_MANAGED; -+ ar->hw->wiphy->flags |= WIPHY_FLAG_NOTIFY_REGDOM_BY_DRIVER; - ar->hw->wiphy->reg_notifier = ath11k_reg_notifier; - } - --- -2.43.0 - diff --git a/SPECS/kernel-rt/CVE-2025-38272-1.patch b/SPECS/kernel-rt/CVE-2025-38272-1.patch deleted file mode 100644 index f39cee293a..0000000000 --- a/SPECS/kernel-rt/CVE-2025-38272-1.patch +++ /dev/null @@ -1,89 +0,0 @@ -From adcc861c6c71dfa145c2cc86a306060438899793 Mon Sep 17 00:00:00 2001 -From: "Russell King (Oracle)" -Date: Tue, 10 Dec 2024 14:18:26 +0000 -Subject: [PATCH 06/27] net: dsa: b53/bcm_sf2: implement .support_eee() method - -Implement the .support_eee() method to indicate that EEE is not -supported by two switch variants, rather than making these checks in -the .set_mac_eee() and .get_mac_eee() methods. - -Signed-off-by: Russell King (Oracle) -Reviewed-by: Florian Fainelli -Reviewed-by: Vladimir Oltean -Link: https://patch.msgid.link/E1tL14E-006cZU-Nc@rmk-PC.armlinux.org.uk -Signed-off-by: Jakub Kicinski ---- - drivers/net/dsa/b53/b53_common.c | 13 +++++++------ - drivers/net/dsa/b53/b53_priv.h | 1 + - drivers/net/dsa/bcm_sf2.c | 1 + - 3 files changed, 9 insertions(+), 6 deletions(-) - -diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index 71c30a81c36d..f36dae40d70c 100644 ---- a/drivers/net/dsa/b53/b53_common.c -+++ b/drivers/net/dsa/b53/b53_common.c -@@ -2344,13 +2344,16 @@ int b53_eee_init(struct dsa_switch *ds, int port, struct phy_device *phy) - } - EXPORT_SYMBOL(b53_eee_init); - --int b53_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_keee *e) -+bool b53_support_eee(struct dsa_switch *ds, int port) - { - struct b53_device *dev = ds->priv; - -- if (is5325(dev) || is5365(dev)) -- return -EOPNOTSUPP; -+ return !is5325(dev) && !is5365(dev); -+} -+EXPORT_SYMBOL(b53_support_eee); - -+int b53_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_keee *e) -+{ - return 0; - } - EXPORT_SYMBOL(b53_get_mac_eee); -@@ -2360,9 +2363,6 @@ int b53_set_mac_eee(struct dsa_switch *ds, int port, struct ethtool_keee *e) - struct b53_device *dev = ds->priv; - struct ethtool_keee *p = &dev->ports[port].eee; - -- if (is5325(dev) || is5365(dev)) -- return -EOPNOTSUPP; -- - p->eee_enabled = e->eee_enabled; - b53_eee_enable_set(ds, port, e->eee_enabled); - -@@ -2419,6 +2419,7 @@ static const struct dsa_switch_ops b53_switch_ops = { - .port_setup = b53_setup_port, - .port_enable = b53_enable_port, - .port_disable = b53_disable_port, -+ .support_eee = b53_support_eee, - .get_mac_eee = b53_get_mac_eee, - .set_mac_eee = b53_set_mac_eee, - .port_bridge_join = b53_br_join, -diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h -index 4f8c97098d2a..e908397e8b9a 100644 ---- a/drivers/net/dsa/b53/b53_priv.h -+++ b/drivers/net/dsa/b53/b53_priv.h -@@ -387,6 +387,7 @@ int b53_enable_port(struct dsa_switch *ds, int port, struct phy_device *phy); - void b53_disable_port(struct dsa_switch *ds, int port); - void b53_brcm_hdr_setup(struct dsa_switch *ds, int port); - int b53_eee_init(struct dsa_switch *ds, int port, struct phy_device *phy); -+bool b53_support_eee(struct dsa_switch *ds, int port); - int b53_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_keee *e); - int b53_set_mac_eee(struct dsa_switch *ds, int port, struct ethtool_keee *e); - -diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c -index c4771a07878e..f1372830d5fa 100644 ---- a/drivers/net/dsa/bcm_sf2.c -+++ b/drivers/net/dsa/bcm_sf2.c -@@ -1233,6 +1233,7 @@ static const struct dsa_switch_ops bcm_sf2_ops = { - .port_setup = b53_setup_port, - .port_enable = bcm_sf2_port_setup, - .port_disable = bcm_sf2_port_disable, -+ .support_eee = b53_support_eee, - .get_mac_eee = b53_get_mac_eee, - .set_mac_eee = b53_set_mac_eee, - .port_bridge_join = b53_br_join, --- -2.43.0 - diff --git a/SPECS/kernel-rt/CVE-2025-38272-2.patch b/SPECS/kernel-rt/CVE-2025-38272-2.patch deleted file mode 100644 index b5abe20ba0..0000000000 --- a/SPECS/kernel-rt/CVE-2025-38272-2.patch +++ /dev/null @@ -1,52 +0,0 @@ -From e6ce4c185e8582c3627f71245ded22194363f954 Mon Sep 17 00:00:00 2001 -From: Jonas Gorski -Date: Mon, 2 Jun 2025 21:39:49 +0200 -Subject: [PATCH 07/27] net: dsa: b53: do not enable EEE on bcm63xx -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BCM63xx internal switches do not support EEE, but provide multiple RGMII -ports where external PHYs may be connected. If one of these PHYs are EEE -capable, we may try to enable EEE for the MACs, which then hangs the -system on access of the (non-existent) EEE registers. - -Fix this by checking if the switch actually supports EEE before -attempting to configure it. - -Fixes: 22256b0afb12 ("net: dsa: b53: Move EEE functions to b53") -Reviewed-by: Florian Fainelli -Tested-by: Álvaro Fernández Rojas -Signed-off-by: Jonas Gorski -Link: https://patch.msgid.link/20250602193953.1010487-2-jonas.gorski@gmail.com -Signed-off-by: Paolo Abeni ---- - drivers/net/dsa/b53/b53_common.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index f36dae40d70c..daee9302b56f 100644 ---- a/drivers/net/dsa/b53/b53_common.c -+++ b/drivers/net/dsa/b53/b53_common.c -@@ -2334,6 +2334,9 @@ int b53_eee_init(struct dsa_switch *ds, int port, struct phy_device *phy) - { - int ret; - -+ if (!b53_support_eee(ds, port)) -+ return 0; -+ - ret = phy_init_eee(phy, false); - if (ret) - return 0; -@@ -2348,7 +2351,7 @@ bool b53_support_eee(struct dsa_switch *ds, int port) - { - struct b53_device *dev = ds->priv; - -- return !is5325(dev) && !is5365(dev); -+ return !is5325(dev) && !is5365(dev) && !is63xx(dev); - } - EXPORT_SYMBOL(b53_support_eee); - --- -2.43.0 - diff --git a/SPECS/kernel-rt/CVE-2025-38272.patch b/SPECS/kernel-rt/CVE-2025-38272.patch deleted file mode 100644 index d8bb66ec17..0000000000 --- a/SPECS/kernel-rt/CVE-2025-38272.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 232555317cddf41ff4f9c8ec66c5ff89547ea1e7 Mon Sep 17 00:00:00 2001 -From: "Russell King (Oracle)" -Date: Tue, 10 Dec 2024 14:18:16 +0000 -Subject: [PATCH 05/27] net: dsa: add hook to determine whether EEE is - supported - -Add a hook to determine whether the switch supports EEE. This will -return false if the switch does not, or true if it does. If the -method is not implemented, we assume (currently) that the switch -supports EEE. - -Signed-off-by: Russell King (Oracle) -Reviewed-by: Florian Fainelli -Reviewed-by: Vladimir Oltean -Link: https://patch.msgid.link/E1tL144-006cZD-El@rmk-PC.armlinux.org.uk -Signed-off-by: Jakub Kicinski ---- - include/net/dsa.h | 1 + - net/dsa/user.c | 8 ++++++++ - 2 files changed, 9 insertions(+) - -diff --git a/include/net/dsa.h b/include/net/dsa.h -index d7a6c2930277..fa99fc5249e9 100644 ---- a/include/net/dsa.h -+++ b/include/net/dsa.h -@@ -1003,6 +1003,7 @@ struct dsa_switch_ops { - /* - * Port's MAC EEE settings - */ -+ bool (*support_eee)(struct dsa_switch *ds, int port); - int (*set_mac_eee)(struct dsa_switch *ds, int port, - struct ethtool_keee *e); - int (*get_mac_eee)(struct dsa_switch *ds, int port, -diff --git a/net/dsa/user.c b/net/dsa/user.c -index 64f660d2334b..06267c526dc4 100644 ---- a/net/dsa/user.c -+++ b/net/dsa/user.c -@@ -1231,6 +1231,10 @@ static int dsa_user_set_eee(struct net_device *dev, struct ethtool_keee *e) - struct dsa_switch *ds = dp->ds; - int ret; - -+ /* Check whether the switch supports EEE */ -+ if (ds->ops->support_eee && !ds->ops->support_eee(ds, dp->index)) -+ return -EOPNOTSUPP; -+ - /* Port's PHY and MAC both need to be EEE capable */ - if (!dev->phydev || !dp->pl) - return -ENODEV; -@@ -1251,6 +1255,10 @@ static int dsa_user_get_eee(struct net_device *dev, struct ethtool_keee *e) - struct dsa_switch *ds = dp->ds; - int ret; - -+ /* Check whether the switch supports EEE */ -+ if (ds->ops->support_eee && !ds->ops->support_eee(ds, dp->index)) -+ return -EOPNOTSUPP; -+ - /* Port's PHY and MAC both need to be EEE capable */ - if (!dev->phydev || !dp->pl) - return -ENODEV; --- -2.43.0 - diff --git a/SPECS/kernel-rt/CVE-2025-38306.patch b/SPECS/kernel-rt/CVE-2025-38306.patch deleted file mode 100644 index 2725894164..0000000000 --- a/SPECS/kernel-rt/CVE-2025-38306.patch +++ /dev/null @@ -1,136 +0,0 @@ -From 53ca1616118eb6c5c4e21109c6b5426535e12eb2 Mon Sep 17 00:00:00 2001 -From: Al Viro -Date: Sun, 1 Jun 2025 14:23:52 -0400 -Subject: [PATCH] fs/fhandle.c: fix a race in call of has_locked_children() - -may_decode_fh() is calling has_locked_children() while holding no locks. -That's an oopsable race... - -The rest of the callers are safe since they are holding namespace_sem and -are guaranteed a positive refcount on the mount in question. - -Rename the current has_locked_children() to __has_locked_children(), make -it static and switch the fs/namespace.c users to it. - -Make has_locked_children() a wrapper for __has_locked_children(), calling -the latter under read_seqlock_excl(&mount_lock). - -Reviewed-by: Christian Brauner -Reviewed-by: Jeff Layton -Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks") -Signed-off-by: Al Viro ---- - fs/namespace.c | 62 +++++++++++++++++++++++++++++--------------------- - 1 file changed, 36 insertions(+), 26 deletions(-) - -diff --git a/fs/namespace.c b/fs/namespace.c -index 962fda4fa246..066c06c8a188 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -2227,7 +2227,7 @@ void drop_collected_mounts(struct vfsmount *mnt) - namespace_unlock(); - } - --bool has_locked_children(struct mount *mnt, struct dentry *dentry) -+static bool __has_locked_children(struct mount *mnt, struct dentry *dentry) - { - struct mount *child; - -@@ -2241,6 +2241,38 @@ bool has_locked_children(struct mount *mnt, struct dentry *dentry) - return false; - } - -+bool has_locked_children(struct mount *mnt, struct dentry *dentry) -+{ -+ bool res; -+ -+ read_seqlock_excl(&mount_lock); -+ res = __has_locked_children(mnt, dentry); -+ read_sequnlock_excl(&mount_lock); -+ return res; -+} -+ -+/* -+ * Check that there aren't references to earlier/same mount namespaces in the -+ * specified subtree. Such references can act as pins for mount namespaces -+ * that aren't checked by the mount-cycle checking code, thereby allowing -+ * cycles to be made. -+ */ -+static bool check_for_nsfs_mounts(struct mount *subtree) -+{ -+ struct mount *p; -+ bool ret = false; -+ -+ lock_mount_hash(); -+ for (p = subtree; p; p = next_mnt(p, subtree)) -+ if (mnt_ns_loop(p->mnt.mnt_root)) -+ goto out; -+ -+ ret = true; -+out: -+ unlock_mount_hash(); -+ return ret; -+} -+ - /** - * clone_private_mount - create a private clone of a path - * @path: path to clone -@@ -2268,7 +2300,7 @@ struct vfsmount *clone_private_mount(const struct path *path) - return ERR_PTR(-EPERM); - } - -- if (has_locked_children(old_mnt, path->dentry)) -+ if (__has_locked_children(old_mnt, path->dentry)) - goto invalid; - - new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE); -@@ -2762,7 +2794,7 @@ static struct mount *__do_loopback(struct path *old_path, int recurse) - if (!check_mnt(old) && old_path->dentry->d_op != &ns_dentry_operations) - return mnt; - -- if (!recurse && has_locked_children(old, old_path->dentry)) -+ if (!recurse && __has_locked_children(old, old_path->dentry)) - return mnt; - - if (recurse) -@@ -3097,28 +3129,6 @@ static inline int tree_contains_unbindable(struct mount *mnt) - return 0; - } - --/* -- * Check that there aren't references to earlier/same mount namespaces in the -- * specified subtree. Such references can act as pins for mount namespaces -- * that aren't checked by the mount-cycle checking code, thereby allowing -- * cycles to be made. -- */ --static bool check_for_nsfs_mounts(struct mount *subtree) --{ -- struct mount *p; -- bool ret = false; -- -- lock_mount_hash(); -- for (p = subtree; p; p = next_mnt(p, subtree)) -- if (mnt_ns_loop(p->mnt.mnt_root)) -- goto out; -- -- ret = true; --out: -- unlock_mount_hash(); -- return ret; --} -- - static int do_set_group(struct path *from_path, struct path *to_path) - { - struct mount *from, *to; -@@ -3152,7 +3162,7 @@ static int do_set_group(struct path *from_path, struct path *to_path) - goto out; - - /* From mount should not have locked children in place of To's root */ -- if (has_locked_children(from, to->mnt.mnt_root)) -+ if (__has_locked_children(from, to->mnt.mnt_root)) - goto out; - - /* Setting sharing groups is only allowed on private mounts */ --- -2.43.0 - diff --git a/SPECS/kernel-rt/CVE-2025-38502.patch b/SPECS/kernel-rt/CVE-2025-38502.patch deleted file mode 100644 index ada07fcfbf..0000000000 --- a/SPECS/kernel-rt/CVE-2025-38502.patch +++ /dev/null @@ -1,143 +0,0 @@ -From 948ea4b9d31826977c5bd558e47de2322afeb52b Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann -Date: Thu, 31 Jul 2025 01:47:33 +0200 -Subject: [PATCH 2/4] bpf: Fix oob access in cgroup local storage - -Lonial reported that an out-of-bounds access in cgroup local storage -can be crafted via tail calls. Given two programs each utilizing a -cgroup local storage with a different value size, and one program -doing a tail call into the other. The verifier will validate each of -the indivial programs just fine. However, in the runtime context -the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the -BPF program as well as any cgroup local storage flavor the program -uses. Helpers such as bpf_get_local_storage() pick this up from the -runtime context: - - ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx); - storage = ctx->prog_item->cgroup_storage[stype]; - - if (stype == BPF_CGROUP_STORAGE_SHARED) - ptr = &READ_ONCE(storage->buf)->data[0]; - else - ptr = this_cpu_ptr(storage->percpu_buf); - -For the second program which was called from the originally attached -one, this means bpf_get_local_storage() will pick up the former -program's map, not its own. With mismatching sizes, this can result -in an unintended out-of-bounds access. - -To fix this issue, we need to extend bpf_map_owner with an array of -storage_cookie[] to match on i) the exact maps from the original -program if the second program was using bpf_get_local_storage(), or -ii) allow the tail call combination if the second program was not -using any of the cgroup local storage maps. - -Fixes: 7d9c3427894f ("bpf: Make cgroup storages shared between programs on the same cgroup") -Reported-by: Lonial Con -Signed-off-by: Daniel Borkmann -Link: https://lore.kernel.org/r/20250730234733.530041-4-daniel@iogearbox.net -Signed-off-by: Alexei Starovoitov ---- ---- - include/linux/bpf.h | 25 +++++++++++++++++-------- - kernel/bpf/core.c | 15 +++++++++++++++ - 2 files changed, 32 insertions(+), 8 deletions(-) - -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 1150a595aa54..66a0ffe9bae3 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -205,6 +205,21 @@ enum btf_field_type { - BPF_WORKQUEUE = (1 << 10), - }; - -+enum bpf_cgroup_storage_type { -+ BPF_CGROUP_STORAGE_SHARED, -+ BPF_CGROUP_STORAGE_PERCPU, -+ __BPF_CGROUP_STORAGE_MAX -+}; -+ -+#define MAX_BPF_CGROUP_STORAGE_TYPE __BPF_CGROUP_STORAGE_MAX -+ -+#ifdef CONFIG_CGROUP_BPF -+# define for_each_cgroup_storage_type(stype) \ -+ for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++) -+#else -+# define for_each_cgroup_storage_type(stype) for (; false; ) -+#endif /* CONFIG_CGROUP_BPF */ -+ - typedef void (*btf_dtor_kfunc_t)(void *); - - struct btf_field_kptr { -@@ -298,6 +313,7 @@ struct bpf_map { - spinlock_t lock; - enum bpf_prog_type type; - bool jited; -+ u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; - bool xdp_has_frags; - } owner; - bool bypass_spec_v1; -@@ -306,6 +322,7 @@ struct bpf_map { - bool free_after_rcu_gp; - atomic64_t sleepable_refcnt; - s64 __percpu *elem_count; -+ u64 cookie; /* write-once */ - }; - - static inline const char *btf_field_type_name(enum btf_field_type type) -@@ -1025,14 +1042,6 @@ struct bpf_prog_offload { - u32 jited_len; - }; - --enum bpf_cgroup_storage_type { -- BPF_CGROUP_STORAGE_SHARED, -- BPF_CGROUP_STORAGE_PERCPU, -- __BPF_CGROUP_STORAGE_MAX --}; -- --#define MAX_BPF_CGROUP_STORAGE_TYPE __BPF_CGROUP_STORAGE_MAX -- - /* The longest tracepoint has 12 args. - * See include/trace/bpf_probe.h - */ -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index 767dcb8471f6..b714362a297c 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -2312,6 +2312,8 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, - enum bpf_prog_type prog_type = resolve_prog_type(fp); - bool ret; - struct bpf_prog_aux *aux = fp->aux; -+ enum bpf_cgroup_storage_type i; -+ u64 cookie; - - if (fp->kprobe_override) - return false; -@@ -2325,11 +2327,24 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, - map->owner.jited = fp->jited; - map->owner.xdp_has_frags = aux->xdp_has_frags; - map->owner.attach_func_proto = aux->attach_func_proto; -+ for_each_cgroup_storage_type(i) { -+ map->owner.storage_cookie[i] = -+ aux->cgroup_storage[i] ? -+ aux->cgroup_storage[i]->cookie : 0; -+ } - ret = true; - } else { - ret = map->owner.type == prog_type && - map->owner.jited == fp->jited && - map->owner.xdp_has_frags == aux->xdp_has_frags; -+ for_each_cgroup_storage_type(i) { -+ if (!ret) -+ break; -+ cookie = aux->cgroup_storage[i] ? -+ aux->cgroup_storage[i]->cookie : 0; -+ ret = map->owner.storage_cookie[i] == cookie || -+ !cookie; -+ } - if (ret && - map->owner.attach_func_proto != aux->attach_func_proto) { - switch (prog_type) { --- -2.43.0 - diff --git a/SPECS/kernel-rt/CVE-2025-39677.patch b/SPECS/kernel-rt/CVE-2025-39677.patch new file mode 100644 index 0000000000..6f075526c7 --- /dev/null +++ b/SPECS/kernel-rt/CVE-2025-39677.patch @@ -0,0 +1,313 @@ +From 6475c4fdc534ff8302069efc313e47a9617963fc Mon Sep 17 00:00:00 2001 +From: William Liu +Date: Tue, 12 Aug 2025 23:57:57 +0000 +Subject: [PATCH 4/4] net/sched: Fix backlog accounting in + qdisc_dequeue_internal + +This issue applies for the following qdiscs: hhf, fq, fq_codel, and +fq_pie, and occurs in their change handlers when adjusting to the new +limit. The problem is the following in the values passed to the +subsequent qdisc_tree_reduce_backlog call given a tbf parent: + + When the tbf parent runs out of tokens, skbs of these qdiscs will + be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued, + which accounts for both qlen and backlog. However, in the case of + qdisc_dequeue_internal, ONLY qlen is accounted for when pulling + from gso_skb. This means that these qdiscs are missing a + qdisc_qstats_backlog_dec when dropping packets to satisfy the + new limit in their change handlers. + + One can observe this issue with the following (with tc patched to + support a limit of 0): + + export TARGET=fq + tc qdisc del dev lo root + tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms + tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000 + echo ''; echo 'add child'; tc -s -d qdisc show dev lo + ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2>&1 >/dev/null + echo ''; echo 'after ping'; tc -s -d qdisc show dev lo + tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0 + echo ''; echo 'after limit drop'; tc -s -d qdisc show dev lo + tc qdisc replace dev lo handle 2: parent 1:1 sfq + echo ''; echo 'post graft'; tc -s -d qdisc show dev lo + + The second to last show command shows 0 packets but a positive + number (74) of backlog bytes. The problem becomes clearer in the + last show command, where qdisc_purge_queue triggers + qdisc_tree_reduce_backlog with the positive backlog and causes an + underflow in the tbf parent's backlog (4096 Mb instead of 0). + +To fix this issue, the codepath for all clients of qdisc_dequeue_internal +has been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel. +qdisc_dequeue_internal handles the backlog adjustments for all cases that +do not directly use the dequeue handler. + +The old fq_codel_change limit adjustment loop accumulated the arguments to +the subsequent qdisc_tree_reduce_backlog call through the cstats field. +However, this is confusing and error prone as fq_codel_dequeue could also +potentially mutate this field (which qdisc_dequeue_internal calls in the +non gso_skb case), so we have unified the code here with other qdiscs. + +Fixes: 2d3cbfd6d54a ("net_sched: Flush gso_skb list too during ->change()") +Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM") +Fixes: 10239edf86f1 ("net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc") +Signed-off-by: William Liu +Reviewed-by: Savino Dicanosa +Link: https://patch.msgid.link/20250812235725.45243-1-will@willsroot.io +Signed-off-by: Jakub Kicinski +--- + include/net/sch_generic.h | 11 ++++++++--- + net/sched/sch_codel.c | 12 +++++++----- + net/sched/sch_fq.c | 12 +++++++----- + net/sched/sch_fq_codel.c | 12 +++++++----- + net/sched/sch_fq_pie.c | 12 +++++++----- + net/sched/sch_hhf.c | 12 +++++++----- + net/sched/sch_pie.c | 12 +++++++----- + 7 files changed, 50 insertions(+), 33 deletions(-) + +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index a9d7e9ecee6b5..f0f64beb9486f 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -1038,12 +1038,17 @@ static inline struct sk_buff *qdisc_dequeue_internal(struct Qdisc *sch, bool dir + skb = __skb_dequeue(&sch->gso_skb); + if (skb) { + sch->q.qlen--; ++ qdisc_qstats_backlog_dec(sch, skb); + return skb; + } +- if (direct) +- return __qdisc_dequeue_head(&sch->q); +- else ++ if (direct) { ++ skb = __qdisc_dequeue_head(&sch->q); ++ if (skb) ++ qdisc_qstats_backlog_dec(sch, skb); ++ return skb; ++ } else { + return sch->dequeue(sch); ++ } + } + + static inline struct sk_buff *qdisc_dequeue_head(struct Qdisc *sch) +diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c +index afd9805cb68e2..655eb64cd1761 100644 +--- a/net/sched/sch_codel.c ++++ b/net/sched/sch_codel.c +@@ -100,9 +100,9 @@ static const struct nla_policy codel_policy[TCA_CODEL_MAX + 1] = { + static int codel_change(struct Qdisc *sch, struct nlattr *opt, + struct netlink_ext_ack *extack) + { ++ unsigned int dropped_pkts = 0, dropped_bytes = 0; + struct codel_sched_data *q = qdisc_priv(sch); + struct nlattr *tb[TCA_CODEL_MAX + 1]; +- unsigned int qlen, dropped = 0; + int err; + + err = nla_parse_nested_deprecated(tb, TCA_CODEL_MAX, opt, +@@ -141,15 +141,17 @@ static int codel_change(struct Qdisc *sch, struct nlattr *opt, + WRITE_ONCE(q->params.ecn, + !!nla_get_u32(tb[TCA_CODEL_ECN])); + +- qlen = sch->q.qlen; + while (sch->q.qlen > sch->limit) { + struct sk_buff *skb = qdisc_dequeue_internal(sch, true); + +- dropped += qdisc_pkt_len(skb); +- qdisc_qstats_backlog_dec(sch, skb); ++ if (!skb) ++ break; ++ ++ dropped_pkts++; ++ dropped_bytes += qdisc_pkt_len(skb); + rtnl_qdisc_drop(skb, sch); + } +- qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, dropped); ++ qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); + + sch_tree_unlock(sch); + return 0; +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index 1af9768cd8ff6..df11a54e390cf 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -1001,11 +1001,11 @@ static int fq_load_priomap(struct fq_sched_data *q, + static int fq_change(struct Qdisc *sch, struct nlattr *opt, + struct netlink_ext_ack *extack) + { ++ unsigned int dropped_pkts = 0, dropped_bytes = 0; + struct fq_sched_data *q = qdisc_priv(sch); + struct nlattr *tb[TCA_FQ_MAX + 1]; +- int err, drop_count = 0; +- unsigned drop_len = 0; + u32 fq_log; ++ int err; + + err = nla_parse_nested_deprecated(tb, TCA_FQ_MAX, opt, fq_policy, + NULL); +@@ -1112,16 +1112,18 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt, + err = fq_resize(sch, fq_log); + sch_tree_lock(sch); + } ++ + while (sch->q.qlen > sch->limit) { + struct sk_buff *skb = qdisc_dequeue_internal(sch, false); + + if (!skb) + break; +- drop_len += qdisc_pkt_len(skb); ++ ++ dropped_pkts++; ++ dropped_bytes += qdisc_pkt_len(skb); + rtnl_kfree_skbs(skb, skb); +- drop_count++; + } +- qdisc_tree_reduce_backlog(sch, drop_count, drop_len); ++ qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); + + sch_tree_unlock(sch); + return err; +diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c +index 551b7cbdae90c..5e4c69d4df419 100644 +--- a/net/sched/sch_fq_codel.c ++++ b/net/sched/sch_fq_codel.c +@@ -365,6 +365,7 @@ static const struct nla_policy fq_codel_policy[TCA_FQ_CODEL_MAX + 1] = { + static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, + struct netlink_ext_ack *extack) + { ++ unsigned int dropped_pkts = 0, dropped_bytes = 0; + struct fq_codel_sched_data *q = qdisc_priv(sch); + struct nlattr *tb[TCA_FQ_CODEL_MAX + 1]; + u32 quantum = 0; +@@ -442,13 +443,14 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, + q->memory_usage > q->memory_limit) { + struct sk_buff *skb = qdisc_dequeue_internal(sch, false); + +- q->cstats.drop_len += qdisc_pkt_len(skb); ++ if (!skb) ++ break; ++ ++ dropped_pkts++; ++ dropped_bytes += qdisc_pkt_len(skb); + rtnl_kfree_skbs(skb, skb); +- q->cstats.drop_count++; + } +- qdisc_tree_reduce_backlog(sch, q->cstats.drop_count, q->cstats.drop_len); +- q->cstats.drop_count = 0; +- q->cstats.drop_len = 0; ++ qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); + + sch_tree_unlock(sch); + return 0; +diff --git a/net/sched/sch_fq_pie.c b/net/sched/sch_fq_pie.c +index 6ed08b705f8a5..5881d34d58b49 100644 +--- a/net/sched/sch_fq_pie.c ++++ b/net/sched/sch_fq_pie.c +@@ -285,10 +285,9 @@ static struct sk_buff *fq_pie_qdisc_dequeue(struct Qdisc *sch) + static int fq_pie_change(struct Qdisc *sch, struct nlattr *opt, + struct netlink_ext_ack *extack) + { ++ unsigned int dropped_pkts = 0, dropped_bytes = 0; + struct fq_pie_sched_data *q = qdisc_priv(sch); + struct nlattr *tb[TCA_FQ_PIE_MAX + 1]; +- unsigned int len_dropped = 0; +- unsigned int num_dropped = 0; + int err; + + err = nla_parse_nested(tb, TCA_FQ_PIE_MAX, opt, fq_pie_policy, extack); +@@ -366,11 +365,14 @@ static int fq_pie_change(struct Qdisc *sch, struct nlattr *opt, + while (sch->q.qlen > sch->limit) { + struct sk_buff *skb = qdisc_dequeue_internal(sch, false); + +- len_dropped += qdisc_pkt_len(skb); +- num_dropped += 1; ++ if (!skb) ++ break; ++ ++ dropped_pkts++; ++ dropped_bytes += qdisc_pkt_len(skb); + rtnl_kfree_skbs(skb, skb); + } +- qdisc_tree_reduce_backlog(sch, num_dropped, len_dropped); ++ qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); + + sch_tree_unlock(sch); + return 0; +diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c +index 5aa434b467073..2d4855e28a286 100644 +--- a/net/sched/sch_hhf.c ++++ b/net/sched/sch_hhf.c +@@ -508,9 +508,9 @@ static const struct nla_policy hhf_policy[TCA_HHF_MAX + 1] = { + static int hhf_change(struct Qdisc *sch, struct nlattr *opt, + struct netlink_ext_ack *extack) + { ++ unsigned int dropped_pkts = 0, dropped_bytes = 0; + struct hhf_sched_data *q = qdisc_priv(sch); + struct nlattr *tb[TCA_HHF_MAX + 1]; +- unsigned int qlen, prev_backlog; + int err; + u64 non_hh_quantum; + u32 new_quantum = q->quantum; +@@ -561,15 +561,17 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt, + usecs_to_jiffies(us)); + } + +- qlen = sch->q.qlen; +- prev_backlog = sch->qstats.backlog; + while (sch->q.qlen > sch->limit) { + struct sk_buff *skb = qdisc_dequeue_internal(sch, false); + ++ if (!skb) ++ break; ++ ++ dropped_pkts++; ++ dropped_bytes += qdisc_pkt_len(skb); + rtnl_kfree_skbs(skb, skb); + } +- qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, +- prev_backlog - sch->qstats.backlog); ++ qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); + + sch_tree_unlock(sch); + return 0; +diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c +index db61cbc21b138..a6a5874f4c3a9 100644 +--- a/net/sched/sch_pie.c ++++ b/net/sched/sch_pie.c +@@ -138,9 +138,9 @@ static const struct nla_policy pie_policy[TCA_PIE_MAX + 1] = { + static int pie_change(struct Qdisc *sch, struct nlattr *opt, + struct netlink_ext_ack *extack) + { ++ unsigned int dropped_pkts = 0, dropped_bytes = 0; + struct pie_sched_data *q = qdisc_priv(sch); + struct nlattr *tb[TCA_PIE_MAX + 1]; +- unsigned int qlen, dropped = 0; + int err; + + err = nla_parse_nested_deprecated(tb, TCA_PIE_MAX, opt, pie_policy, +@@ -190,15 +190,17 @@ static int pie_change(struct Qdisc *sch, struct nlattr *opt, + nla_get_u32(tb[TCA_PIE_DQ_RATE_ESTIMATOR])); + + /* Drop excess packets if new limit is lower */ +- qlen = sch->q.qlen; + while (sch->q.qlen > sch->limit) { + struct sk_buff *skb = qdisc_dequeue_internal(sch, true); + +- dropped += qdisc_pkt_len(skb); +- qdisc_qstats_backlog_dec(sch, skb); ++ if (!skb) ++ break; ++ ++ dropped_pkts++; ++ dropped_bytes += qdisc_pkt_len(skb); + rtnl_qdisc_drop(skb, sch); + } +- qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, dropped); ++ qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); + + sch_tree_unlock(sch); + return 0; +-- +2.43.0 + diff --git a/SPECS/kernel-rt/CVE-2025-39745.patch b/SPECS/kernel-rt/CVE-2025-39745.patch new file mode 100644 index 0000000000..86b7b34554 --- /dev/null +++ b/SPECS/kernel-rt/CVE-2025-39745.patch @@ -0,0 +1,52 @@ +From 75aa7cb87d85ed76966c409bd5d80266d9c77b17 Mon Sep 17 00:00:00 2001 +From: Zqiang +Date: Wed, 7 May 2025 19:26:03 +0800 +Subject: [PATCH 3/4] rcutorture: Fix rcutorture_one_extend_check() splat in RT + kernels + +For built with CONFIG_PREEMPT_RT=y kernels, running rcutorture +tests resulted in the following splat: + +[ 68.797425] rcutorture_one_extend_check during change: Current 0x1 To add 0x1 To remove 0x0 preempt_count() 0x0 +[ 68.797533] WARNING: CPU: 2 PID: 512 at kernel/rcu/rcutorture.c:1993 rcutorture_one_extend_check+0x419/0x560 [rcutorture] +[ 68.797601] Call Trace: +[ 68.797602] +[ 68.797619] ? lockdep_softirqs_off+0xa5/0x160 +[ 68.797631] rcutorture_one_extend+0x18e/0xcc0 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] +[ 68.797646] ? local_clock+0x19/0x40 +[ 68.797659] rcu_torture_one_read+0xf0/0x280 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] +[ 68.797678] ? __pfx_rcu_torture_one_read+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] +[ 68.797804] ? __pfx_rcu_torture_timer+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] +[ 68.797815] rcu-torture: rcu_torture_reader task started +[ 68.797824] rcu-torture: Creating rcu_torture_reader task +[ 68.797824] rcu_torture_reader+0x238/0x580 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] +[ 68.797836] ? kvm_sched_clock_read+0x15/0x30 + +Disable BH does not change the SOFTIRQ corresponding bits in +preempt_count() for RT kernels, this commit therefore use +softirq_count() to check the if BH is disabled. + +Reviewed-by: Paul E. McKenney +Signed-off-by: Zqiang +Signed-off-by: Joel Fernandes +Signed-off-by: Neeraj Upadhyay (AMD) +--- + kernel/rcu/rcutorture.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c +index 609687fd742d5..b3c8651f14729 100644 +--- a/kernel/rcu/rcutorture.c ++++ b/kernel/rcu/rcutorture.c +@@ -430,7 +430,7 @@ rcu_read_delay(struct torture_random_state *rrsp, struct rt_read_seg *rtrsp) + !(torture_random(rrsp) % (nrealreaders * 2000 * longdelay_ms))) { + started = cur_ops->get_gp_seq(); + ts = rcu_trace_clock_local(); +- if (preempt_count() & (SOFTIRQ_MASK | HARDIRQ_MASK)) ++ if ((preempt_count() & HARDIRQ_MASK) || softirq_count()) + longdelay_ms = 5; /* Avoid triggering BH limits. */ + mdelay(longdelay_ms); + rtrsp->rt_delay_ms = longdelay_ms; +-- +2.43.0 + diff --git a/SPECS/kernel-rt/CVE-2025-39764.patch b/SPECS/kernel-rt/CVE-2025-39764.patch new file mode 100644 index 0000000000..51b13efc30 --- /dev/null +++ b/SPECS/kernel-rt/CVE-2025-39764.patch @@ -0,0 +1,160 @@ +From 8dbe282d028de5d53c830caa6f801089803b0dbf Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 1 Aug 2025 17:25:09 +0200 +Subject: [PATCH 2/4] netfilter: ctnetlink: remove refcounting in expectation + dumpers + +Same pattern as previous patch: do not keep the expectation object +alive via refcount, only store a cookie value and then use that +as the skip hint for dump resumption. + +AFAICS this has the same issue as the one resolved in the conntrack +dumper, when we do + if (!refcount_inc_not_zero(&exp->use)) + +to increment the refcount, there is a chance that exp == last, which +causes a double-increment of the refcount and subsequent memory leak. + +Fixes: cf6994c2b981 ("[NETFILTER]: nf_conntrack_netlink: sync expectation dumping with conntrack table dumping") +Fixes: e844a928431f ("netfilter: ctnetlink: allow to dump expectation per master conntrack") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +--- + net/netfilter/nf_conntrack_netlink.c | 41 ++++++++++++---------------- + 1 file changed, 17 insertions(+), 24 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 18a91c031554c..13836723223e0 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -3146,23 +3146,27 @@ ctnetlink_expect_event(unsigned int events, const struct nf_exp_event *item) + return 0; + } + #endif +-static int ctnetlink_exp_done(struct netlink_callback *cb) ++ ++static unsigned long ctnetlink_exp_id(const struct nf_conntrack_expect *exp) + { +- if (cb->args[1]) +- nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]); +- return 0; ++ unsigned long id = (unsigned long)exp; ++ ++ id += nf_ct_get_id(exp->master); ++ id += exp->class; ++ ++ return id ? id : 1; + } + + static int + ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + { + struct net *net = sock_net(skb->sk); +- struct nf_conntrack_expect *exp, *last; + struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); + u_int8_t l3proto = nfmsg->nfgen_family; ++ unsigned long last_id = cb->args[1]; ++ struct nf_conntrack_expect *exp; + + rcu_read_lock(); +- last = (struct nf_conntrack_expect *)cb->args[1]; + for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) { + restart: + hlist_for_each_entry_rcu(exp, &nf_ct_expect_hash[cb->args[0]], +@@ -3174,7 +3178,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + continue; + + if (cb->args[1]) { +- if (exp != last) ++ if (ctnetlink_exp_id(exp) != last_id) + continue; + cb->args[1] = 0; + } +@@ -3183,9 +3187,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + cb->nlh->nlmsg_seq, + IPCTNL_MSG_EXP_NEW, + exp) < 0) { +- if (!refcount_inc_not_zero(&exp->use)) +- continue; +- cb->args[1] = (unsigned long)exp; ++ cb->args[1] = ctnetlink_exp_id(exp); + goto out; + } + } +@@ -3196,32 +3198,30 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + } + out: + rcu_read_unlock(); +- if (last) +- nf_ct_expect_put(last); +- + return skb->len; + } + + static int + ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + { +- struct nf_conntrack_expect *exp, *last; + struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); + struct nf_conn *ct = cb->data; + struct nf_conn_help *help = nfct_help(ct); + u_int8_t l3proto = nfmsg->nfgen_family; ++ unsigned long last_id = cb->args[1]; ++ struct nf_conntrack_expect *exp; + + if (cb->args[0]) + return 0; + + rcu_read_lock(); +- last = (struct nf_conntrack_expect *)cb->args[1]; ++ + restart: + hlist_for_each_entry_rcu(exp, &help->expectations, lnode) { + if (l3proto && exp->tuple.src.l3num != l3proto) + continue; + if (cb->args[1]) { +- if (exp != last) ++ if (ctnetlink_exp_id(exp) != last_id) + continue; + cb->args[1] = 0; + } +@@ -3229,9 +3229,7 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + cb->nlh->nlmsg_seq, + IPCTNL_MSG_EXP_NEW, + exp) < 0) { +- if (!refcount_inc_not_zero(&exp->use)) +- continue; +- cb->args[1] = (unsigned long)exp; ++ cb->args[1] = ctnetlink_exp_id(exp); + goto out; + } + } +@@ -3242,9 +3240,6 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + cb->args[0] = 1; + out: + rcu_read_unlock(); +- if (last) +- nf_ct_expect_put(last); +- + return skb->len; + } + +@@ -3263,7 +3258,6 @@ static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl, + struct nf_conntrack_zone zone; + struct netlink_dump_control c = { + .dump = ctnetlink_exp_ct_dump_table, +- .done = ctnetlink_exp_done, + }; + + err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, +@@ -3313,7 +3307,6 @@ static int ctnetlink_get_expect(struct sk_buff *skb, + else { + struct netlink_dump_control c = { + .dump = ctnetlink_exp_dump_table, +- .done = ctnetlink_exp_done, + }; + return netlink_dump_start(info->sk, skb, info->nlh, &c); + } +-- +2.43.0 + diff --git a/SPECS/kernel-rt/CVE-2025-39789.patch b/SPECS/kernel-rt/CVE-2025-39789.patch new file mode 100644 index 0000000000..10a29845b4 --- /dev/null +++ b/SPECS/kernel-rt/CVE-2025-39789.patch @@ -0,0 +1,119 @@ +From b3cebc12805fd709f20b6c0bbe9bbeffce7169ce Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Mon, 15 Sep 2025 15:51:56 +0800 +Subject: [PATCH 1/4] crypto: x86/aegis - Add missing error checks + +The skcipher_walk functions can allocate memory and can fail, so +checking for errors is necessary. + +Fixes: 1d373d4e8e15 ("crypto: x86 - Add optimized AEGIS implementations") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +--- + arch/x86/crypto/aegis128-aesni-glue.c | 36 +++++++++++++++++++-------- + 1 file changed, 26 insertions(+), 10 deletions(-) + +diff --git a/arch/x86/crypto/aegis128-aesni-glue.c b/arch/x86/crypto/aegis128-aesni-glue.c +index 4623189000d89..f3a8f0c4d0b07 100644 +--- a/arch/x86/crypto/aegis128-aesni-glue.c ++++ b/arch/x86/crypto/aegis128-aesni-glue.c +@@ -114,22 +114,27 @@ static void crypto_aegis128_aesni_process_ad( + } + } + +-static void crypto_aegis128_aesni_process_crypt( ++static int crypto_aegis128_aesni_process_crypt( + struct aegis_state *state, struct skcipher_walk *walk, + const struct aegis_crypt_ops *ops) + { ++ int err = 0; ++ + while (walk->nbytes >= AEGIS128_BLOCK_SIZE) { + ops->crypt_blocks(state, + round_down(walk->nbytes, AEGIS128_BLOCK_SIZE), + walk->src.virt.addr, walk->dst.virt.addr); +- skcipher_walk_done(walk, walk->nbytes % AEGIS128_BLOCK_SIZE); ++ err = skcipher_walk_done(walk, walk->nbytes % AEGIS128_BLOCK_SIZE); ++ if (err) ++ break; + } + +- if (walk->nbytes) { ++ if (walk->nbytes && !err) { + ops->crypt_tail(state, walk->nbytes, walk->src.virt.addr, + walk->dst.virt.addr); +- skcipher_walk_done(walk, 0); ++ err = skcipher_walk_done(walk, 0); + } ++ return err; + } + + static struct aegis_ctx *crypto_aegis128_aesni_ctx(struct crypto_aead *aead) +@@ -162,7 +167,7 @@ static int crypto_aegis128_aesni_setauthsize(struct crypto_aead *tfm, + return 0; + } + +-static void crypto_aegis128_aesni_crypt(struct aead_request *req, ++static int crypto_aegis128_aesni_crypt(struct aead_request *req, + struct aegis_block *tag_xor, + unsigned int cryptlen, + const struct aegis_crypt_ops *ops) +@@ -171,17 +176,22 @@ static void crypto_aegis128_aesni_crypt(struct aead_request *req, + struct aegis_ctx *ctx = crypto_aegis128_aesni_ctx(tfm); + struct skcipher_walk walk; + struct aegis_state state; ++ int err; + +- ops->skcipher_walk_init(&walk, req, true); ++ err = ops->skcipher_walk_init(&walk, req, true); ++ if (err) ++ return err; + + kernel_fpu_begin(); + + crypto_aegis128_aesni_init(&state, ctx->key.bytes, req->iv); + crypto_aegis128_aesni_process_ad(&state, req->src, req->assoclen); +- crypto_aegis128_aesni_process_crypt(&state, &walk, ops); +- crypto_aegis128_aesni_final(&state, tag_xor, req->assoclen, cryptlen); ++ err = crypto_aegis128_aesni_process_crypt(&state, &walk, ops); ++ if (err == 0) ++ crypto_aegis128_aesni_final(&state, tag_xor, req->assoclen, cryptlen); + + kernel_fpu_end(); ++ return err; + } + + static int crypto_aegis128_aesni_encrypt(struct aead_request *req) +@@ -196,8 +206,11 @@ static int crypto_aegis128_aesni_encrypt(struct aead_request *req) + struct aegis_block tag = {}; + unsigned int authsize = crypto_aead_authsize(tfm); + unsigned int cryptlen = req->cryptlen; ++ int err; + +- crypto_aegis128_aesni_crypt(req, &tag, cryptlen, &OPS); ++ err = crypto_aegis128_aesni_crypt(req, &tag, cryptlen, &OPS); ++ if (err) ++ return err; + + scatterwalk_map_and_copy(tag.bytes, req->dst, + req->assoclen + cryptlen, authsize, 1); +@@ -218,11 +231,14 @@ static int crypto_aegis128_aesni_decrypt(struct aead_request *req) + struct aegis_block tag; + unsigned int authsize = crypto_aead_authsize(tfm); + unsigned int cryptlen = req->cryptlen - authsize; ++ int err; + + scatterwalk_map_and_copy(tag.bytes, req->src, + req->assoclen + cryptlen, authsize, 0); + +- crypto_aegis128_aesni_crypt(req, &tag, cryptlen, &OPS); ++ err = crypto_aegis128_aesni_crypt(req, &tag, cryptlen, &OPS); ++ if (err) ++ return err; + + return crypto_memneq(tag.bytes, zeros.bytes, authsize) ? -EBADMSG : 0; + } +-- +2.43.0 + diff --git a/SPECS/kernel-rt/kernel-rt.signatures.json b/SPECS/kernel-rt/kernel-rt.signatures.json index 0d99fb3890..b095867a24 100644 --- a/SPECS/kernel-rt/kernel-rt.signatures.json +++ b/SPECS/kernel-rt/kernel-rt.signatures.json @@ -5,6 +5,6 @@ "cpupower": "d7518767bf2b1110d146a49c7d42e76b803f45eb8bd14d931aa6d0d346fae985", "cpupower.service": "b057fe9e5d0e8c36f485818286b80e3eba8ff66ff44797940e99b1fd5361bb98", "sha512hmac-openssl.sh": "02ab91329c4be09ee66d759e4d23ac875037c3b56e5a598e32fd1206da06a27f", - "linux-6.12.44.tar.gz": "fac0ed5371cbd46ebc8a2a1e152ac5fbb5fc2660e748a7fc1d28b8e399854a1a" + "linux-6.12.47.tar.gz": "6b05f6d6ee7d51d4def7e642cbdafec955812e1156548bc4197e38c89bc38fbc" } } diff --git a/SPECS/kernel-rt/kernel-rt.spec b/SPECS/kernel-rt/kernel-rt.spec index 8b9490f0a0..c7779d9cda 100644 --- a/SPECS/kernel-rt/kernel-rt.spec +++ b/SPECS/kernel-rt/kernel-rt.spec @@ -1,13 +1,13 @@ Summary: Preempt RT Linux Kernel Name: kernel-rt -Version: 6.12.44 +Version: 6.12.47 Release: 1%{?dist} License: GPLv2 Vendor: Intel Corporation Distribution: Edge Microvisor Toolkit Group: System Environment/Kernel URL: https://www.kernel.org/pub/linux/kernel -Source0: https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.44.tar.gz +Source0: https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.47.tar.gz Source1: config Source3: sha512hmac-openssl.sh Source4: emt-ca-20211013.pem @@ -73,451 +73,440 @@ Patch53: 0001-virtio-hookup-irq_get_affinity-callback.sriov Patch54: 0002-virtio-break-and-reset-virtio-devices-on-device_shut.sriov Patch55: 0003-virtgpu-don-t-reset-on-shutdown.sriov Patch56: 0004-drm-virtio-implement-virtio_gpu_shutdown.sriov +Patch57: 0001-drm-virtio-Wait-until-the-control-and-cursor-queues-.sriov #security -Patch57: 0001-mei-bus-add-api-to-query-capabilities-of-ME-clien.security -Patch58: 0002-mei-virtio-virtualization-frontend-driver.security -Patch59: 0003-INTEL_DII-mei-avoid-reset-if-fw-is-down.security -Patch60: 0004-INTEL_DII-FIXME-mei-iaf-add-iaf-Intel-Accelerator.security -Patch61: 0005-INTEL_DII-mei-add-check-for-offline-bit-in-every-.security -Patch62: 0006-INTEL_DII-mei-add-empty-handlers-for-ops-function.security -Patch63: 0007-INTEL_DII-mei-gsc-add-fields-to-support-force-wak.security -Patch64: 0008-INTEL_DII-mei-add-waitqueue-for-device-state-chan.security -Patch65: 0009-INTEL_DII-mei-add-force-wake-workaround-infra.security -Patch66: 0010-INTEL_DII-mei-add-force-wake-workaround-in-init.security -Patch67: 0011-INTEL_DII-mei-add-force-wake-workaround-on-sessio.security -Patch68: 0012-INTEL_DII-mei-add-force-wake-workaround-in-runtim.security -Patch69: 0013-INTEL_DII-mei-add-force-wake-workaround-in-resume.security -Patch70: 0014-INTEL_DII-mei-disable-immediate-enum-if-forcewake.security -Patch71: 0015-INTEL_DII-mei-put-force-wake-in-error-flows.security -Patch72: 0016-INTEL_DII-mei-add-force-wake-callbacks-to-empty-h.security -Patch73: 0017-INTEL_DII-mei-optimize-force-wake-wait.security -Patch74: 0018-mei-me-apply-GSC-error-supression-to-systems-with.security -Patch75: 0019-INTEL_DII-mei-bus-fixup-disable-version-retrieval.security +Patch58: 0001-mei-bus-add-api-to-query-capabilities-of-ME-clien.security +Patch59: 0002-mei-virtio-virtualization-frontend-driver.security +Patch60: 0003-INTEL_DII-mei-avoid-reset-if-fw-is-down.security +Patch61: 0004-INTEL_DII-FIXME-mei-iaf-add-iaf-Intel-Accelerator.security +Patch62: 0005-INTEL_DII-mei-add-check-for-offline-bit-in-every-.security +Patch63: 0006-INTEL_DII-mei-add-empty-handlers-for-ops-function.security +Patch64: 0007-INTEL_DII-mei-gsc-add-fields-to-support-force-wak.security +Patch65: 0008-INTEL_DII-mei-add-waitqueue-for-device-state-chan.security +Patch66: 0009-INTEL_DII-mei-add-force-wake-workaround-infra.security +Patch67: 0010-INTEL_DII-mei-add-force-wake-workaround-in-init.security +Patch68: 0011-INTEL_DII-mei-add-force-wake-workaround-on-sessio.security +Patch69: 0012-INTEL_DII-mei-add-force-wake-workaround-in-runtim.security +Patch70: 0013-INTEL_DII-mei-add-force-wake-workaround-in-resume.security +Patch71: 0014-INTEL_DII-mei-disable-immediate-enum-if-forcewake.security +Patch72: 0015-INTEL_DII-mei-put-force-wake-in-error-flows.security +Patch73: 0016-INTEL_DII-mei-add-force-wake-callbacks-to-empty-h.security +Patch74: 0017-INTEL_DII-mei-optimize-force-wake-wait.security +Patch75: 0018-mei-me-apply-GSC-error-supression-to-systems-with.security +Patch76: 0019-INTEL_DII-mei-bus-fixup-disable-version-retrieval.security #tgpio -Patch76: 0001-Revert-timekeeping-Add-function-to-convert-realtime-.tgpio -Patch77: 0002-Revert-x86-tsc-Remove-obsolete-ART-to-TSC-conversion.tgpio -Patch78: 0003-Revert-ice-ptp-Remove-convert_art_to_tsc.tgpio -Patch79: 0004-Revert-ALSA-hda-Remove-convert_art_to_tsc.tgpio -Patch80: 0005-Revert-stmmac-intel-Remove-convert_art_to_tsc.tgpio -Patch81: 0006-Revert-igc-Remove-convert_art_ns_to_tsc.tgpio -Patch82: 0007-Revert-e1000e-Replace-convert_art_to_tsc.tgpio -Patch83: 0008-Revert-x86-tsc-Provide-ART-base-clock-information-fo.tgpio -Patch84: 0009-Revert-timekeeping-Provide-infrastructure-for-conver.tgpio -Patch85: 0010-drivers-ptp-Add-Enhanced-handling-of-reserve-fields.tgpio -Patch86: 0011-drivers-ptp-Add-PEROUT2-ioctl-frequency-adjustment-i.tgpio -Patch87: 0012-drivers-ptp-Add-user-space-input-polling-interface.tgpio -Patch88: 0013-x86-tsc-Add-TSC-support-functions-to-support-ART-dri.tgpio -Patch89: 0014-drivers-ptp-Add-support-for-PMC-Time-Aware-GPIO-Driv.tgpio -Patch90: 0015-x86-core-TSC-reliable-kernel-arg-prevents-DQ-of-TSC-.tgpio -Patch91: 0016-mfd-intel-ehl-gpio-Introduce-MFD-framework-to-PSE-GP.tgpio -Patch92: 0017-TGPIO-Calling-power-management-calls-without-enterin.tgpio -Patch93: 0018-TGPIO-Fix-PSE-TGPIO-PTP-driver-ioctls-fail.tgpio -Patch94: 0019-Kernel-Argument-Bypassing-ART-Detection.tgpio -Patch95: 0020-GPIO-Fix-for-PSE-GPIO-generating-only-one-event-as-i.tgpio -Patch96: 0021-Added-TGPIO-pin-check-before-input-event-read.tgpio -Patch97: 0022-Added-an-Example-to-adjust-frequency-for-output.tgpio -Patch98: 0023-ptp-tgpio-PSE-TGPIO-crosststamp-counttstamp.tgpio -Patch99: 0024-ptp-Fixed-read-issue-on-PHC-with-zero-n_pins.tgpio -Patch100: 0025-ptp-S-W-workaround-for-PMC-TGPIO-h-w-bug.tgpio -Patch101: 0026-ptp-Fix-for-PSE-TGPIO-Oneshot-output-and-counttstamp.tgpio -Patch102: 0027-ptp-Fix-for-PSE-TGPIO-frequency-Adjustment-issue.tgpio -Patch103: 0028-tgpio-Fix-compilation-errors-for-PSE-TGPIO.tgpio -Patch104: 0029-Added-single-shot-output-mode-support-for-TGPIO.tgpio -Patch105: 0030-Added-an-example-to-poll-for-edges.tgpio -Patch106: 0031-Added-support-to-get-TGPIO-System-Clock-Offset.tgpio -Patch107: 0032-Added-single-shot-output-mode-option-for-TGPIO-pin.tgpio -Patch108: 0033-selftests-ptp-Added-COMPV-GPIO-Input-Mode-for-TGPIO.tgpio -Patch109: 0034-ptp-Introduce-PTP_PINDESC_INPUTPOLL-for-Intel-PMC-TG.tgpio -Patch110: 0035-drivers-ptp-Add-COMPV-GPIO-Mode-for-PSE-TGPIO.tgpio -Patch111: 0036-net-ice-fix-braces-around-scalar-initializer.tgpio -Patch112: 0037-ptp-Add-PTP_EVENT_COUNTER_MODE-in-v1-valid-flags.tgpio -Patch113: 0038-ptp-Enable-preempt-if-it-is-disabled.tgpio -Patch114: 0039-ptp-Generate-sqaure-wave-on-PSE-TGPIO.tgpio -Patch115: 0040-ptp-tgpio-Add-an-edge-if-the-output-signal-ends-high.tgpio -Patch116: 0041-ptp-pmc-tgpio-Initialize-variable-to-zero.tgpio -Patch117: 0042-ptp-tgpio-Fix-return-type-of-remove-function-in-tgpi.tgpio -Patch118: 0043-net-mlx5-reuse-convert_art_ns_to_tsc-to-convert-ART-.tgpio +Patch77: 0001-Revert-timekeeping-Add-function-to-convert-realtime-.tgpio +Patch78: 0002-Revert-x86-tsc-Remove-obsolete-ART-to-TSC-conversion.tgpio +Patch79: 0003-Revert-ice-ptp-Remove-convert_art_to_tsc.tgpio +Patch80: 0004-Revert-ALSA-hda-Remove-convert_art_to_tsc.tgpio +Patch81: 0005-Revert-stmmac-intel-Remove-convert_art_to_tsc.tgpio +Patch82: 0006-Revert-igc-Remove-convert_art_ns_to_tsc.tgpio +Patch83: 0007-Revert-e1000e-Replace-convert_art_to_tsc.tgpio +Patch84: 0008-Revert-x86-tsc-Provide-ART-base-clock-information-fo.tgpio +Patch85: 0009-Revert-timekeeping-Provide-infrastructure-for-conver.tgpio +Patch86: 0010-drivers-ptp-Add-Enhanced-handling-of-reserve-fields.tgpio +Patch87: 0011-drivers-ptp-Add-PEROUT2-ioctl-frequency-adjustment-i.tgpio +Patch88: 0012-drivers-ptp-Add-user-space-input-polling-interface.tgpio +Patch89: 0013-x86-tsc-Add-TSC-support-functions-to-support-ART-dri.tgpio +Patch90: 0014-drivers-ptp-Add-support-for-PMC-Time-Aware-GPIO-Driv.tgpio +Patch91: 0015-x86-core-TSC-reliable-kernel-arg-prevents-DQ-of-TSC-.tgpio +Patch92: 0016-mfd-intel-ehl-gpio-Introduce-MFD-framework-to-PSE-GP.tgpio +Patch93: 0017-TGPIO-Calling-power-management-calls-without-enterin.tgpio +Patch94: 0018-TGPIO-Fix-PSE-TGPIO-PTP-driver-ioctls-fail.tgpio +Patch95: 0019-Kernel-Argument-Bypassing-ART-Detection.tgpio +Patch96: 0020-GPIO-Fix-for-PSE-GPIO-generating-only-one-event-as-i.tgpio +Patch97: 0021-Added-TGPIO-pin-check-before-input-event-read.tgpio +Patch98: 0022-Added-an-Example-to-adjust-frequency-for-output.tgpio +Patch99: 0023-ptp-tgpio-PSE-TGPIO-crosststamp-counttstamp.tgpio +Patch100: 0024-ptp-Fixed-read-issue-on-PHC-with-zero-n_pins.tgpio +Patch101: 0025-ptp-S-W-workaround-for-PMC-TGPIO-h-w-bug.tgpio +Patch102: 0026-ptp-Fix-for-PSE-TGPIO-Oneshot-output-and-counttstamp.tgpio +Patch103: 0027-ptp-Fix-for-PSE-TGPIO-frequency-Adjustment-issue.tgpio +Patch104: 0028-tgpio-Fix-compilation-errors-for-PSE-TGPIO.tgpio +Patch105: 0029-Added-single-shot-output-mode-support-for-TGPIO.tgpio +Patch106: 0030-Added-an-example-to-poll-for-edges.tgpio +Patch107: 0031-Added-support-to-get-TGPIO-System-Clock-Offset.tgpio +Patch108: 0032-Added-single-shot-output-mode-option-for-TGPIO-pin.tgpio +Patch109: 0033-selftests-ptp-Added-COMPV-GPIO-Input-Mode-for-TGPIO.tgpio +Patch110: 0034-ptp-Introduce-PTP_PINDESC_INPUTPOLL-for-Intel-PMC-TG.tgpio +Patch111: 0035-drivers-ptp-Add-COMPV-GPIO-Mode-for-PSE-TGPIO.tgpio +Patch112: 0036-net-ice-fix-braces-around-scalar-initializer.tgpio +Patch113: 0037-ptp-Add-PTP_EVENT_COUNTER_MODE-in-v1-valid-flags.tgpio +Patch114: 0038-ptp-Enable-preempt-if-it-is-disabled.tgpio +Patch115: 0039-ptp-Generate-sqaure-wave-on-PSE-TGPIO.tgpio +Patch116: 0040-ptp-tgpio-Add-an-edge-if-the-output-signal-ends-high.tgpio +Patch117: 0041-ptp-pmc-tgpio-Initialize-variable-to-zero.tgpio +Patch118: 0042-ptp-tgpio-Fix-return-type-of-remove-function-in-tgpi.tgpio +Patch119: 0043-net-mlx5-reuse-convert_art_ns_to_tsc-to-convert-ART-.tgpio #edac -Patch119: 0001-x86-mce-Add-MCACOD-code-for-generic-I-O-error.edac -Patch120: 0002-EDAC-ieh-Add-I-O-device-EDAC-driver-for-Intel-CPUs-wi.edac -Patch121: 0003-EDAC-ieh-Add-I-O-device-EDAC-support-for-Intel-Tiger-.edac -Patch122: 0004-EDAC-igen6-Add-registration-APIs-for-In-Band-ECC-erro.edac -Patch123: 0005-EDAC-i10nm-Print-DRAM-rules-debug-purpose.edac -Patch124: 0006-EDAC-skx_common-skx-i10nm-Make-skx_register_mci-indep.edac -Patch125: 0007-EDAC-skx_common-Prepare-skx_get_edac_list.edac -Patch126: 0008-EDAC-skx_common-Prepare-skx_set_hi_lo.edac -Patch127: 0009-EDAC-igen6-Add-Intel-Pnther-Lake-H-SoCs-support.edac -Patch128: 0002-EDAC-ie31200-Add-Kaby-Lake-S-dual-core-host-bridge-ID.edac -Patch129: 0006-EDAC-ie31200-Fix-the-3rd-parameter-name-of-populate_d.edac -Patch130: 0007-EDAC-ie31200-Simplify-the-pci_device_id-table.edac -Patch131: 0008-EDAC-ie31200-Make-the-memory-controller-resources-con.edac -Patch132: 0009-EDAC-ie31200-Make-struct-dimm_data-contain-decoded-in.edac -Patch133: 0010-EDAC-ie31200-Fold-the-two-channel-loops-into-one-loop.edac -Patch134: 0011-EDAC-ie31200-Break-up-ie31200_probe1.edac -Patch135: 0012-EDAC-ie31200-Add-Intel-Raptor-Lake-S-SoCs-support.edac -Patch136: 0013-EDAC-ie31200-Switch-Raptor-Lake-S-to-interrupt-mode.edac -Patch137: 0001-EDAC-ie31200-Add-two-Intel-SoCs-for-EDAC-support.edac -Patch138: 0002-ie31200-EDAC-Add-Intel-Bartlett-Lake-S-SoCs-support.edac +Patch120: 0001-x86-mce-Add-MCACOD-code-for-generic-I-O-error.edac +Patch121: 0002-EDAC-ieh-Add-I-O-device-EDAC-driver-for-Intel-CPUs-wi.edac +Patch122: 0003-EDAC-ieh-Add-I-O-device-EDAC-support-for-Intel-Tiger-.edac +Patch123: 0004-EDAC-igen6-Add-registration-APIs-for-In-Band-ECC-erro.edac +Patch124: 0005-EDAC-i10nm-Print-DRAM-rules-debug-purpose.edac +Patch125: 0006-EDAC-skx_common-skx-i10nm-Make-skx_register_mci-indep.edac +Patch126: 0007-EDAC-skx_common-Prepare-skx_get_edac_list.edac +Patch127: 0008-EDAC-skx_common-Prepare-skx_set_hi_lo.edac +Patch128: 0009-EDAC-igen6-Add-Intel-Pnther-Lake-H-SoCs-support.edac +Patch129: 0002-EDAC-ie31200-Add-Kaby-Lake-S-dual-core-host-bridge-ID.edac +Patch130: 0006-EDAC-ie31200-Fix-the-3rd-parameter-name-of-populate_d.edac +Patch131: 0007-EDAC-ie31200-Simplify-the-pci_device_id-table.edac +Patch132: 0008-EDAC-ie31200-Make-the-memory-controller-resources-con.edac +Patch133: 0009-EDAC-ie31200-Make-struct-dimm_data-contain-decoded-in.edac +Patch134: 0010-EDAC-ie31200-Fold-the-two-channel-loops-into-one-loop.edac +Patch135: 0011-EDAC-ie31200-Break-up-ie31200_probe1.edac +Patch136: 0012-EDAC-ie31200-Add-Intel-Raptor-Lake-S-SoCs-support.edac +Patch137: 0013-EDAC-ie31200-Switch-Raptor-Lake-S-to-interrupt-mode.edac +Patch138: 0001-EDAC-ie31200-Add-two-Intel-SoCs-for-EDAC-support.edac +Patch139: 0002-ie31200-EDAC-Add-Intel-Bartlett-Lake-S-SoCs-support.edac #tsn -Patch139: 0001-net-pcs-xpcs-enable-xpcs-reset-skipping.tsn -Patch140: 0002-net-stmmac-Bugfix-on-stmmac_interrupt-for-WOL.tsn -Patch141: 0003-net-phy-increase-gpy-loopback-test-delay.tsn -Patch142: 0004-net-stmmac-Resolve-poor-line-rate-after-switching-from.tsn -Patch143: 0005-net-phy-dp83867-perform-restart-AN-after-modifying-AN-.tsn -Patch144: 0006-stmmac-intel-Separate-ADL-N-and-RPL-P-device-ID-from-T.tsn -Patch145: 0007-net-stmmac-Adjust-mac_capabilities-for-Intel-mGbE-2.5G.tsn -Patch146: 0008-stmmac-intel-skip-xpcs-reset-for-2.5Gbps-on-Intel-Alde.tsn -Patch147: 0009-net-stmmac-add-check-for-2.5G-mode-to-prevent-MAC-capa.tsn -Patch148: 0010-stmmac-intel-Enable-PHY-WoL-in-ADL-N.tsn -Patch149: 0011-net-phy-reconfigure-PHY-WoL-when-WoL-option-is-enabled.tsn -Patch150: 0012-net-stmmac-fix-MAC-and-phylink-mismatch-issue-after-re.tsn -Patch151: 0013-net-stmmac-restructure-Rx-Tx-hardware-timestamping-fun.tsn -Patch152: 0014-net-stmmac-Add-per-packet-time-based-scheduling-for-XD.tsn -Patch153: 0015-net-stmmac-introduce-AF_XDP-ZC-RX-HW-timestamps.tsn -Patch154: 0016-net-stmmac-add-fsleep-in-HW-Rx-timestamp-checking-loop.tsn -Patch155: 0017-net-stmmac-select-PCS-negotiation-mode-according-to-th.tsn -Patch156: 0018-net-pcs-xpcs-re-initiate-clause-37-Auto-negotiation.tsn -Patch157: 0019-arch-x86-Add-IPC-mailbox-accessor-function-and-add-SoC.tsn -Patch158: 0020-net-stmmac-configure-SerDes-according-to-the-interface.tsn -Patch159: 0021-stmmac-intel-interface-switching-support-for-intel-pla.tsn -Patch160: 0022-net-stmmac-Set-mac_managed_pm-flag-from-stmmac-to-reso.tsn -Patch161: 0023-net-phylink-Add-module_exit.tsn -Patch162: 0024-net-stmmac-introduce-AF_XDP-ZC-TX-HW-timestamps.tsn -Patch163: 0025-net-sched-taprio-fix-too-early-schedules-switching.tsn -Patch164: 0026-net-sched-taprio-fix-cycle-time-adjustment-for-next-en.tsn -Patch165: 0027-net-sched-taprio-fix-impacted-fields-value-during-cycl.tsn -Patch166: 0028-net-sched-taprio-get-corrected-value-of-cycle_time-and.tsn -Patch167: 0029-xsk-add-txtime-field-in-xdp_desc-struct.tsn -Patch168: 0030-Revert-net-stmmac-silence-FPE-kernel-logs.tsn -Patch169: 0031-Revert-net-stmmac-support-fp-parameter-of-tc-taprio.tsn -Patch170: 0032-Revert-net-stmmac-support-fp-parameter-of-tc-mqprio.tsn -Patch171: 0033-Revert-net-stmmac-configure-FPE-via-ethtool-mm.tsn -Patch172: 0034-Revert-net-stmmac-refactor-FPE-verification-process.tsn -Patch173: 0035-Revert-net-stmmac-drop-stmmac_fpe_handshake.tsn -Patch174: 0036-Revert-net-stmmac-move-stmmac_fpe_cfg-to-stmmac_priv-d.tsn -Patch175: 0037-net-stmmac-add-FPE-preempt-setting-for-TxQ-preemptible.tsn -Patch176: 0038-taprio-Add-support-for-frame-preemption-offload.tsn -Patch177: 0039-net-stmmac-set-initial-EEE-policy-configuration.tsn -Patch178: 0040-net-phy-fix-phylib-s-dual-eee_enabled.tsn -Patch179: 0041-net-phy-ensure-that-genphy_c45_an_config_eee_aneg-sees.tsn -Patch180: 0042-net-phy-fix-phy_ethtool_set_eee-incorrectly-enabling-L.tsn -Patch181: 0001-igc-Set-the-RX-packet-buffer-size-for-TSN-mode.tsn -Patch182: 0002-igc-Only-dump-registers-if-configured-to-dump-HW-infor.tsn -Patch183: 0003-ethtool-Add-support-for-configuring-frame-preemption.tsn -Patch184: 0004-ethtool-Add-support-for-Frame-Preemption-verification.tsn -Patch185: 0005-igc-Add-support-for-enabling-frame-preemption-via-etht.tsn -Patch186: 0006-igc-Add-support-for-TC_SETUP_PREEMPT.tsn -Patch187: 0007-igc-Add-support-for-setting-frame-preemption-configura.tsn -Patch188: 0008-igc-Add-support-for-Frame-Preemption-verification.tsn -Patch189: 0009-igc-Add-support-for-exposing-frame-preemption-stats-re.tsn -Patch190: 0010-igc-Optimize-the-packet-buffer-utilization.tsn -Patch191: 0011-igc-Add-support-for-enabling-all-packets-to-be-receive.tsn -Patch192: 0012-igc-Add-support-for-DMA-timestamp-for-non-PTP-packets.tsn -Patch193: 0013-bpf-add-btf-register-unregister-API.tsn -Patch194: 0014-net-core-XDP-metadata-BTF-netlink-API.tsn -Patch195: 0015-rtnetlink-Fix-unchecked-return-value-of-dev_xdp_query_.tsn -Patch196: 0016-rtnetlink-Add-return-value-check.tsn -Patch197: 0017-tools-bpf-Query-XDP-metadata-BTF-ID.tsn -Patch198: 0018-tools-bpf-Add-xdp-set-command-for-md-btf.tsn -Patch199: 0019-igc-Add-BTF-based-metadata-for-XDP.tsn -Patch200: 0020-igc-Enable-HW-RX-Timestamp-for-AF_XDP-ZC.tsn -Patch201: 0021-igc-Take-care-of-DMA-timestamp-rollover.tsn -Patch202: 0022-igc-Add-SO_TXTIME-for-AF_XDP-ZC.tsn -Patch203: 0023-igc-Reodering-the-empty-packet-buffers-and-descriptors.tsn -Patch204: 0024-Revert-igc-Add-support-for-PTP-.getcyclesx64.tsn -Patch205: 0025-core-Introduce-netdev_tc_map_to_queue_mask.tsn -Patch206: 0026-taprio-Replace-tc_map_to_queue_mask.tsn -Patch207: 0027-mqprio-Add-support-for-frame-preemption-offload.tsn -Patch208: 0030-igc-Reduce-retry-count-to-a-more-reasonable-number.tsn -Patch209: 0001-igc-Enable-HW-TX-Timestamp-for-AF_XDP-ZC.tsn -Patch210: 0002-igc-Enable-trace-for-HW-TX-Timestamp-AF_XDP-ZC.tsn -Patch211: 0003-igc-Remove-the-CONFIG_DEBUG_MISC-condition-for-trace.tsn -Patch212: 0006-Revert-net-stmmac-set-initial-EEE-policy-configurati.tsn -Patch213: 0001-net-phy-Set-eee_cfg.eee_enabled-according-to-PHY.tsn -Patch214: 0001-Revert-net-stmmac-add-FPE-preempt-setting-for-TxQ-pree.tsn -Patch215: 0002-Reapply-net-stmmac-move-stmmac_fpe_cfg-to-stmmac_priv-.tsn -Patch216: 0003-Reapply-net-stmmac-drop-stmmac_fpe_handshake.tsn -Patch217: 0004-Reapply-net-stmmac-refactor-FPE-verification-process.tsn -Patch218: 0005-Reapply-net-stmmac-configure-FPE-via-ethtool-mm.tsn -Patch219: 0006-Reapply-net-stmmac-support-fp-parameter-of-tc-mqprio.tsn -Patch220: 0007-Reapply-net-stmmac-support-fp-parameter-of-tc-taprio.tsn -Patch221: 0008-Reapply-net-stmmac-silence-FPE-kernel-logs.tsn +Patch140: 0001-net-pcs-xpcs-enable-xpcs-reset-skipping.tsn +Patch141: 0002-net-stmmac-Bugfix-on-stmmac_interrupt-for-WOL.tsn +Patch142: 0003-net-phy-increase-gpy-loopback-test-delay.tsn +Patch143: 0004-net-stmmac-Resolve-poor-line-rate-after-switching-from.tsn +Patch144: 0005-net-phy-dp83867-perform-restart-AN-after-modifying-AN-.tsn +Patch145: 0006-stmmac-intel-Separate-ADL-N-and-RPL-P-device-ID-from-T.tsn +Patch146: 0007-net-stmmac-Adjust-mac_capabilities-for-Intel-mGbE-2.5G.tsn +Patch147: 0008-stmmac-intel-skip-xpcs-reset-for-2.5Gbps-on-Intel-Alde.tsn +Patch148: 0009-net-stmmac-add-check-for-2.5G-mode-to-prevent-MAC-capa.tsn +Patch149: 0010-stmmac-intel-Enable-PHY-WoL-in-ADL-N.tsn +Patch150: 0011-net-phy-reconfigure-PHY-WoL-when-WoL-option-is-enabled.tsn +Patch151: 0012-net-stmmac-fix-MAC-and-phylink-mismatch-issue-after-re.tsn +Patch152: 0013-net-stmmac-restructure-Rx-Tx-hardware-timestamping-fun.tsn +Patch153: 0014-net-stmmac-Add-per-packet-time-based-scheduling-for-XD.tsn +Patch154: 0015-net-stmmac-introduce-AF_XDP-ZC-RX-HW-timestamps.tsn +Patch155: 0016-net-stmmac-add-fsleep-in-HW-Rx-timestamp-checking-loop.tsn +Patch156: 0017-net-stmmac-select-PCS-negotiation-mode-according-to-th.tsn +Patch157: 0018-net-pcs-xpcs-re-initiate-clause-37-Auto-negotiation.tsn +Patch158: 0019-arch-x86-Add-IPC-mailbox-accessor-function-and-add-SoC.tsn +Patch159: 0020-net-stmmac-configure-SerDes-according-to-the-interface.tsn +Patch160: 0021-stmmac-intel-interface-switching-support-for-intel-pla.tsn +Patch161: 0022-net-stmmac-Set-mac_managed_pm-flag-from-stmmac-to-reso.tsn +Patch162: 0023-net-phylink-Add-module_exit.tsn +Patch163: 0024-net-stmmac-introduce-AF_XDP-ZC-TX-HW-timestamps.tsn +Patch164: 0025-net-sched-taprio-fix-too-early-schedules-switching.tsn +Patch165: 0026-net-sched-taprio-fix-cycle-time-adjustment-for-next-en.tsn +Patch166: 0027-net-sched-taprio-fix-impacted-fields-value-during-cycl.tsn +Patch167: 0028-net-sched-taprio-get-corrected-value-of-cycle_time-and.tsn +Patch168: 0029-xsk-add-txtime-field-in-xdp_desc-struct.tsn +Patch169: 0030-Revert-net-stmmac-silence-FPE-kernel-logs.tsn +Patch170: 0031-Revert-net-stmmac-support-fp-parameter-of-tc-taprio.tsn +Patch171: 0032-Revert-net-stmmac-support-fp-parameter-of-tc-mqprio.tsn +Patch172: 0033-Revert-net-stmmac-configure-FPE-via-ethtool-mm.tsn +Patch173: 0034-Revert-net-stmmac-refactor-FPE-verification-process.tsn +Patch174: 0035-Revert-net-stmmac-drop-stmmac_fpe_handshake.tsn +Patch175: 0036-Revert-net-stmmac-move-stmmac_fpe_cfg-to-stmmac_priv-d.tsn +Patch176: 0037-net-stmmac-add-FPE-preempt-setting-for-TxQ-preemptible.tsn +Patch177: 0038-taprio-Add-support-for-frame-preemption-offload.tsn +Patch178: 0039-net-stmmac-set-initial-EEE-policy-configuration.tsn +Patch179: 0040-net-phy-fix-phylib-s-dual-eee_enabled.tsn +Patch180: 0041-net-phy-ensure-that-genphy_c45_an_config_eee_aneg-sees.tsn +Patch181: 0042-net-phy-fix-phy_ethtool_set_eee-incorrectly-enabling-L.tsn +Patch182: 0001-igc-Set-the-RX-packet-buffer-size-for-TSN-mode.tsn +Patch183: 0002-igc-Only-dump-registers-if-configured-to-dump-HW-infor.tsn +Patch184: 0003-ethtool-Add-support-for-configuring-frame-preemption.tsn +Patch185: 0004-ethtool-Add-support-for-Frame-Preemption-verification.tsn +Patch186: 0005-igc-Add-support-for-enabling-frame-preemption-via-etht.tsn +Patch187: 0006-igc-Add-support-for-TC_SETUP_PREEMPT.tsn +Patch188: 0007-igc-Add-support-for-setting-frame-preemption-configura.tsn +Patch189: 0008-igc-Add-support-for-Frame-Preemption-verification.tsn +Patch190: 0009-igc-Add-support-for-exposing-frame-preemption-stats-re.tsn +Patch191: 0010-igc-Optimize-the-packet-buffer-utilization.tsn +Patch192: 0011-igc-Add-support-for-enabling-all-packets-to-be-receive.tsn +Patch193: 0012-igc-Add-support-for-DMA-timestamp-for-non-PTP-packets.tsn +Patch194: 0013-bpf-add-btf-register-unregister-API.tsn +Patch195: 0014-net-core-XDP-metadata-BTF-netlink-API.tsn +Patch196: 0015-rtnetlink-Fix-unchecked-return-value-of-dev_xdp_query_.tsn +Patch197: 0016-rtnetlink-Add-return-value-check.tsn +Patch198: 0017-tools-bpf-Query-XDP-metadata-BTF-ID.tsn +Patch199: 0018-tools-bpf-Add-xdp-set-command-for-md-btf.tsn +Patch200: 0019-igc-Add-BTF-based-metadata-for-XDP.tsn +Patch201: 0020-igc-Enable-HW-RX-Timestamp-for-AF_XDP-ZC.tsn +Patch202: 0021-igc-Take-care-of-DMA-timestamp-rollover.tsn +Patch203: 0022-igc-Add-SO_TXTIME-for-AF_XDP-ZC.tsn +Patch204: 0023-igc-Reodering-the-empty-packet-buffers-and-descriptors.tsn +Patch205: 0024-Revert-igc-Add-support-for-PTP-.getcyclesx64.tsn +Patch206: 0025-core-Introduce-netdev_tc_map_to_queue_mask.tsn +Patch207: 0026-taprio-Replace-tc_map_to_queue_mask.tsn +Patch208: 0027-mqprio-Add-support-for-frame-preemption-offload.tsn +Patch209: 0030-igc-Reduce-retry-count-to-a-more-reasonable-number.tsn +Patch210: 0001-igc-Enable-HW-TX-Timestamp-for-AF_XDP-ZC.tsn +Patch211: 0002-igc-Enable-trace-for-HW-TX-Timestamp-AF_XDP-ZC.tsn +Patch212: 0003-igc-Remove-the-CONFIG_DEBUG_MISC-condition-for-trace.tsn +Patch213: 0006-Revert-net-stmmac-set-initial-EEE-policy-configurati.tsn +Patch214: 0001-net-phy-Set-eee_cfg.eee_enabled-according-to-PHY.tsn +Patch215: 0001-Revert-net-stmmac-add-FPE-preempt-setting-for-TxQ-pree.tsn +Patch216: 0002-Reapply-net-stmmac-move-stmmac_fpe_cfg-to-stmmac_priv-.tsn +Patch217: 0003-Reapply-net-stmmac-drop-stmmac_fpe_handshake.tsn +Patch218: 0004-Reapply-net-stmmac-refactor-FPE-verification-process.tsn +Patch219: 0005-Reapply-net-stmmac-configure-FPE-via-ethtool-mm.tsn +Patch220: 0006-Reapply-net-stmmac-support-fp-parameter-of-tc-mqprio.tsn +Patch221: 0007-Reapply-net-stmmac-support-fp-parameter-of-tc-taprio.tsn +Patch222: 0008-Reapply-net-stmmac-silence-FPE-kernel-logs.tsn #camera -Patch222: 0001-media-intel-ipu6-remove-buttress-ish-structure.camera -Patch223: 0001-media-i2c-Add-ar0234-camera-sensor-driver.camera -Patch224: 0002-media-i2c-add-support-for-lt6911uxe.camera -Patch225: 0003-INT3472-Support-LT6911UXE.camera -Patch226: 0004-upstream-Use-module-parameter-to-set-isys-freq.camera -Patch227: 0005-upstream-Use-module-parameter-to-set-psys-freq.camera -Patch228: 0006-media-pci-Enable-ISYS-reset.camera -Patch229: 0007-media-i2c-add-support-for-ar0234-and-lt6911uxe.camera -Patch230: 0008-driver-media-i2c-remove-useless-header-file.camera -Patch231: 0009-media-i2c-update-lt6911uxe-for-upstream-and-bug-fix.camera -Patch232: 0010-media-i2c-add-support-for-lt6911uxc.camera -Patch233: 0011-media-i2c-add-lt6911uxc-driver-and-enable-in-ipu-br.camera -Patch234: 0012-media-pci-intel-psys-driver.camera -Patch235: 0013-media-i2c-Remove-unused-variables-in-Lontium-driver.camera -Patch236: 0001-media-intel-ipu6-remove-buttress-ish-structure-1.camera -Patch237: 0002-media-pci-intel-include-psys-driver.camera -Patch238: 0003-Revert-media-ipu6-use-the-IPU6-DMA-mapping-APIs-to-.camera -Patch239: 0004-Revert-media-ipu6-remove-architecture-DMA-ops-depen.camera -Patch240: 0005-Revert-media-ipu6-not-override-the-dma_ops-of-devic.camera -Patch241: 0001-Reapply-media-ipu6-not-override-the-dma_ops-of-devi.camera -Patch242: 0002-Reapply-media-ipu6-remove-architecture-DMA-ops-depe.camera -Patch243: 0003-Reapply-media-ipu6-use-the-IPU6-DMA-mapping-APIs-to.camera -Patch244: 0001-media-pci-update-IPU6-PSYS-driver.camera -Patch245: 0002-media-i2c-update-lt6911uxc-driver-to-fix-COV-issue.camera -Patch246: 0003-lt6911-2-pads-linked-to-ipu-2-ports-for-split-mode.camera -Patch247: 0004-media-i2c-add-dv_timings-api-in-lt6911uxe.camera -Patch248: 0005-media-intel-ipu6-use-vc1-dma-for-MTL-and-ARL.camera -Patch249: 0006-media-i2c-some-changes-in-lt6911uxe.camera -Patch250: 0001-Revert-media-intel-ipu6-use-vc1-dma-for-MTL-and-ARL.camera -Patch251: 0002-media-i2c-update-format-in-irq-for-lt6911uxe.camera -Patch252: 0003-media-i2c-remove-unused-func-in-lt6911uxe.camera -Patch253: 0001-media-intel-ipu6-use-vc1-dma-for-MTL-and-ARL.camera -Patch254: 0002-media-ipu-Dma-sync-at-buffer_prepare-callback-as-DM.camera -Patch255: 0003-Support-IPU6-ISYS-FW-trace-dump-for-upstream-driver.camera -Patch256: 0004-Support-IPU6-PSYS-FW-trace-dump-for-upstream-driver.camera -Patch257: 0005-media-pci-The-order-of-return-buffers-should-be-FIF.camera -Patch258: 0006-media-i2c-fix-power-on-issue-for-on-board-LT6911UXC.camera -Patch259: 0007-media-i2c-fix-power-on-issue-for-on-board-LT6911UXE.camera -Patch260: 0001-media-pci-Modify-enble-disable-stream-in-CSI2.camera -Patch261: 0002-media-pci-Set-the-correct-SOF-for-different-stream.camera -Patch262: 0003-media-pci-support-imx390-for-6.11.0-rc3.camera -Patch263: 0004-i2c-media-fix-cov-issue.camera -Patch264: 0005-mv-ipu-acpi-module-to-linux-drivers.camera -Patch265: 0006-kernel-enable-VC-support-in-v4l2.camera -Patch266: 0007-media-pci-intel-support-PDATA-in-Kconfig-Makefile.camera -Patch267: 0008-media-pci-unregister-i2c-device-to-complete-ext_sub.camera -Patch268: 0009-media-pci-align-params-for-non-MIPI-split-and-split.camera -Patch269: 0010-media-pci-add-missing-if-for-PDATA.camera -Patch270: 0011-media-platform-fix-allyesconfig-build-error.camera -Patch271: 0012-media-pci-refine-PDATA-related-config.camera -Patch272: 0013-kernel-align-ACPI-PDATA-and-ACPI-fwnode-build-for-E.camera -Patch273: 0014-media-i2c-add-gmsl-isx031-support.camera -Patch274: 0015-media-i2c-add-support-for-isx031-max9296.camera -Patch275: 0016-fix-S4-issue-on-TWL.camera -Patch276: 0017-code-changes-for-link-frequency-and-sensor-physical.camera +Patch223: 0001-media-intel-ipu6-remove-buttress-ish-structure.camera +Patch224: 0001-media-i2c-Add-ar0234-camera-sensor-driver.camera +Patch225: 0002-media-i2c-add-support-for-lt6911uxe.camera +Patch226: 0003-INT3472-Support-LT6911UXE.camera +Patch227: 0004-upstream-Use-module-parameter-to-set-isys-freq.camera +Patch228: 0005-upstream-Use-module-parameter-to-set-psys-freq.camera +Patch229: 0006-media-pci-Enable-ISYS-reset.camera +Patch230: 0007-media-i2c-add-support-for-ar0234-and-lt6911uxe.camera +Patch231: 0008-driver-media-i2c-remove-useless-header-file.camera +Patch232: 0009-media-i2c-update-lt6911uxe-for-upstream-and-bug-fix.camera +Patch233: 0010-media-i2c-add-support-for-lt6911uxc.camera +Patch234: 0011-media-i2c-add-lt6911uxc-driver-and-enable-in-ipu-br.camera +Patch235: 0012-media-pci-intel-psys-driver.camera +Patch236: 0013-media-i2c-Remove-unused-variables-in-Lontium-driver.camera +Patch237: 0001-media-intel-ipu6-remove-buttress-ish-structure-1.camera +Patch238: 0002-media-pci-intel-include-psys-driver.camera +Patch239: 0003-Revert-media-ipu6-use-the-IPU6-DMA-mapping-APIs-to-.camera +Patch240: 0004-Revert-media-ipu6-remove-architecture-DMA-ops-depen.camera +Patch241: 0005-Revert-media-ipu6-not-override-the-dma_ops-of-devic.camera +Patch242: 0001-Reapply-media-ipu6-not-override-the-dma_ops-of-devi.camera +Patch243: 0002-Reapply-media-ipu6-remove-architecture-DMA-ops-depe.camera +Patch244: 0003-Reapply-media-ipu6-use-the-IPU6-DMA-mapping-APIs-to.camera +Patch245: 0001-media-pci-update-IPU6-PSYS-driver.camera +Patch246: 0002-media-i2c-update-lt6911uxc-driver-to-fix-COV-issue.camera +Patch247: 0003-lt6911-2-pads-linked-to-ipu-2-ports-for-split-mode.camera +Patch248: 0004-media-i2c-add-dv_timings-api-in-lt6911uxe.camera +Patch249: 0005-media-intel-ipu6-use-vc1-dma-for-MTL-and-ARL.camera +Patch250: 0006-media-i2c-some-changes-in-lt6911uxe.camera +Patch251: 0001-Revert-media-intel-ipu6-use-vc1-dma-for-MTL-and-ARL.camera +Patch252: 0002-media-i2c-update-format-in-irq-for-lt6911uxe.camera +Patch253: 0003-media-i2c-remove-unused-func-in-lt6911uxe.camera +Patch254: 0001-media-intel-ipu6-use-vc1-dma-for-MTL-and-ARL.camera +Patch255: 0002-media-ipu-Dma-sync-at-buffer_prepare-callback-as-DM.camera +Patch256: 0003-Support-IPU6-ISYS-FW-trace-dump-for-upstream-driver.camera +Patch257: 0004-Support-IPU6-PSYS-FW-trace-dump-for-upstream-driver.camera +Patch258: 0005-media-pci-The-order-of-return-buffers-should-be-FIF.camera +Patch259: 0006-media-i2c-fix-power-on-issue-for-on-board-LT6911UXC.camera +Patch260: 0007-media-i2c-fix-power-on-issue-for-on-board-LT6911UXE.camera +Patch261: 0001-media-pci-Modify-enble-disable-stream-in-CSI2.camera +Patch262: 0002-media-pci-Set-the-correct-SOF-for-different-stream.camera +Patch263: 0003-media-pci-support-imx390-for-6.11.0-rc3.camera +Patch264: 0004-i2c-media-fix-cov-issue.camera +Patch265: 0005-mv-ipu-acpi-module-to-linux-drivers.camera +Patch266: 0006-kernel-enable-VC-support-in-v4l2.camera +Patch267: 0007-media-pci-intel-support-PDATA-in-Kconfig-Makefile.camera +Patch268: 0008-media-pci-unregister-i2c-device-to-complete-ext_sub.camera +Patch269: 0009-media-pci-align-params-for-non-MIPI-split-and-split.camera +Patch270: 0010-media-pci-add-missing-if-for-PDATA.camera +Patch271: 0011-media-platform-fix-allyesconfig-build-error.camera +Patch272: 0012-media-pci-refine-PDATA-related-config.camera +Patch273: 0013-kernel-align-ACPI-PDATA-and-ACPI-fwnode-build-for-E.camera +Patch274: 0014-media-i2c-add-gmsl-isx031-support.camera +Patch275: 0015-media-i2c-add-support-for-isx031-max9296.camera +Patch276: 0016-fix-S4-issue-on-TWL.camera +Patch277: 0017-code-changes-for-link-frequency-and-sensor-physical.camera #wwan -Patch277: 0001-Revert-bus-mhi-host-pci_generic-add-support-for-sc828.wwan -Patch278: 0002-wwan-add-SAHARA-device.wwan -Patch279: 0003-bus-mhi-host-allow-SBL-as-initial-EE.wwan -Patch280: 0004-drivers-bus-mhi-let-userspace-manage-xfp-fw-update-st.wwan -Patch281: 0005-wwan-add-NMEA-type.wwan -Patch282: 0006-drivers-bus-mhi-add-FN980-v2-support.wwan -Patch283: 0007-drivers-bus-mhi-add-FN990-NMEA-and-DIAG-in-SBL-device.wwan -Patch284: 0008-drivers-net-wwan-add-simple-DTR-driver.wwan -Patch285: 0009-drivers-bus-mhi-host-fix-recovery-process-when-modem-.wwan -Patch286: 0001-Revert-drivers-bus-mhi-host-fix-recovery-process-when.wwan -Patch287: 0002-Revert-drivers-net-wwan-add-simple-DTR-driver.wwan -Patch288: 0003-Revert-drivers-bus-mhi-add-FN990-NMEA-and-DIAG-in-SBL.wwan -Patch289: 0004-Revert-drivers-bus-mhi-add-FN980-v2-support.wwan -Patch290: 0005-Revert-wwan-add-NMEA-type.wwan -Patch291: 0006-Revert-drivers-bus-mhi-let-userspace-manage-xfp-fw-up.wwan -Patch292: 0007-Revert-bus-mhi-host-allow-SBL-as-initial-EE.wwan -Patch293: 0008-Revert-wwan-add-SAHARA-device.wwan -Patch294: 0009-Revert-Revert-bus-mhi-host-pci_generic-add-support-fo.wwan +Patch278: 0001-Revert-bus-mhi-host-pci_generic-add-support-for-sc828.wwan +Patch279: 0002-wwan-add-SAHARA-device.wwan +Patch280: 0003-bus-mhi-host-allow-SBL-as-initial-EE.wwan +Patch281: 0004-drivers-bus-mhi-let-userspace-manage-xfp-fw-update-st.wwan +Patch282: 0005-wwan-add-NMEA-type.wwan +Patch283: 0006-drivers-bus-mhi-add-FN980-v2-support.wwan +Patch284: 0007-drivers-bus-mhi-add-FN990-NMEA-and-DIAG-in-SBL-device.wwan +Patch285: 0008-drivers-net-wwan-add-simple-DTR-driver.wwan +Patch286: 0009-drivers-bus-mhi-host-fix-recovery-process-when-modem-.wwan +Patch287: 0001-Revert-drivers-bus-mhi-host-fix-recovery-process-when.wwan +Patch288: 0002-Revert-drivers-net-wwan-add-simple-DTR-driver.wwan +Patch289: 0003-Revert-drivers-bus-mhi-add-FN990-NMEA-and-DIAG-in-SBL.wwan +Patch290: 0004-Revert-drivers-bus-mhi-add-FN980-v2-support.wwan +Patch291: 0005-Revert-wwan-add-NMEA-type.wwan +Patch292: 0006-Revert-drivers-bus-mhi-let-userspace-manage-xfp-fw-up.wwan +Patch293: 0007-Revert-bus-mhi-host-allow-SBL-as-initial-EE.wwan +Patch294: 0008-Revert-wwan-add-SAHARA-device.wwan +Patch295: 0009-Revert-Revert-bus-mhi-host-pci_generic-add-support-fo.wwan #pmc_core -Patch295: 0001-platform-x86-intel-pmc-Add-Arrow-Lake-U-H-support.pmc_core -Patch296: 0002-platform-x86-intel-pmc-Add-Bartlett-Lake-support-to-.pmc_core -Patch297: 0001-platform-x86-intel-pmc-Fix-Arrow-Lake-U-H-NPU-PCI.pmc_core +Patch296: 0001-platform-x86-intel-pmc-Add-Arrow-Lake-U-H-support.pmc_core +Patch297: 0002-platform-x86-intel-pmc-Add-Bartlett-Lake-support-to-.pmc_core +Patch298: 0001-platform-x86-intel-pmc-Fix-Arrow-Lake-U-H-NPU-PCI.pmc_core #lpss -Patch298: 0001-Added-spi_set_cs-for-more-stable-r-w-operations-in-S.lpss -Patch299: 0002-mtd-core-Don-t-fail-mtd_device_parse_register-if-OTP.lpss -Patch300: 0003-spi-intel-pci-Add-support-for-Arrow-Lake-H-SPI-seria.lpss -Patch301: 0004-spi-intel-Add-protected-and-locked-attributes.lpss +Patch299: 0001-Added-spi_set_cs-for-more-stable-r-w-operations-in-S.lpss +Patch300: 0002-mtd-core-Don-t-fail-mtd_device_parse_register-if-OTP.lpss +Patch301: 0003-spi-intel-pci-Add-support-for-Arrow-Lake-H-SPI-seria.lpss +Patch302: 0004-spi-intel-Add-protected-and-locked-attributes.lpss #preempt_rt patches backported -Patch302: 0001-Revert-sched-core-Remove-the-unnecessary-need_resche.rt -Patch303: 0001-hrtimer-Use-__raise_softirq_irqoff-to-raise-the-softirq.rt -Patch304: 0002-timers-Use-__raise_softirq_irqoff-to-raise-the-softirq.rt -Patch305: 0003-softirq-Use-a-dedicated-thread-for-timer-wakeups-on-PRE.rt -Patch306: 0004-serial-8250-Switch-to-nbcon-console.rt -Patch307: 0005-serial-8250-Revert-drop-lockdep-annotation-from-serial8.rt -Patch308: 0006-locking-rt-Remove-one-__cond_lock-in-RT-s-spin_trylock_.rt -Patch309: 0007-locking-rt-Add-sparse-annotation-for-RCU.rt -Patch310: 0008-locking-rt-Annotate-unlock-followed-by-lock-for-sparse.rt -Patch311: 0009-drm-i915-Use-preempt_disable-enable_rt-where-recommende.rt -Patch312: 0010-drm-i915-Don-t-disable-interrupts-on-PREEMPT_RT-during-.rt -Patch313: 0011-drm-i915-Don-t-check-for-atomic-context-on-PREEMPT_RT.rt -Patch314: 0012-drm-i915-Disable-tracing-points-on-PREEMPT_RT.rt -Patch315: 0013-drm-i915-gt-Use-spin_lock_irq-instead-of-local_irq_disa.rt -Patch316: 0014-drm-i915-Drop-the-irqs_disabled-check.rt -Patch317: 0015-drm-i915-guc-Consider-also-RCU-depth-in-busy-loop.rt -Patch318: 0016-Revert-drm-i915-Depend-on-PREEMPT_RT.rt -Patch319: 0017-sched-Add-TIF_NEED_RESCHED_LAZY-infrastructure.rt -Patch320: 0018-sched-Add-Lazy-preemption-model.rt -Patch321: 0019-sched-Enable-PREEMPT_DYNAMIC-for-PREEMPT_RT.rt -Patch322: 0020-sched-x86-Enable-Lazy-preemption.rt -Patch323: 0021-sched-Add-laziest-preempt-model.rt -Patch324: 0022-sched-Fixup-the-IS_ENABLED-check-for-PREEMPT_LAZY.rt -Patch325: 0023-tracing-Remove-TRACE_FLAG_IRQS_NOSUPPORT.rt -Patch326: 0024-tracing-Record-task-flag-NEED_RESCHED_LAZY.rt -Patch327: 0025-sysfs-Add-sys-kernel-realtime-entry.rt -Patch328: 0001-serial-8250-enable-original-console-by-default.rt -Patch329: 0001-kernel-trace-Add-DISALLOW_TRACE_PRINTK-make-option.rt -Patch330: 0002-Revert-scripts-remove-bin2c.rt -Patch331: 0003-extend-uio-driver-to-supports-msix.rt -Patch332: 0004-virtio-add-VIRTIO_PMD-support.rt -Patch333: 0005-virt-acrn-Introduce-interfaces-for-PIO-device.rt -Patch334: 0006-Add-hypercall-to-access-MSR.rt -Patch335: 0007-Revert-spi-Remove-unused-function-spi_busnum_to_master.rt -Patch336: 0008-igc-add-CONFIG_IGC_TSN_TRACE-conditional-trace_printk-u.rt -Patch337: 0009-stmmac_pci-add-CONFIG_STMMAC_TSN_TRACE-conditional-trac.rt -Patch338: 0010-igb-prepare-for-AF_XDP-zero-copy-support.rt -Patch339: 0011-igb-Introduce-XSK-data-structures-and-helpers.rt -Patch340: 0012-igb-add-AF_XDP-zero-copy-Rx-support.rt -Patch341: 0013-igb-add-AF_XDP-zero-copy-Tx-support.rt -Patch342: 0014-igb-Add-BTF-based-metadata-for-XDP.rt -Patch343: 0015-ANDROID-trace-power-add-trace_clock_set_parent.rt -Patch344: 0016-ANDROID-trace-net-use-pK-for-kernel-pointers.rt -Patch345: 0017-ANDROID-trace-add-non-hierarchical-function_graph-optio.rt -Patch346: 0018-virtio-fix-VIRTIO_PMD-support.rt -Patch347: 0019-drm-i915-add-i915-perf-event-capacity.rt -Patch348: 0020-drm-xe-pm-allow-xe-with-CONFIG_PM.rt +Patch303: 0001-Revert-sched-core-Remove-the-unnecessary-need_resche.rt +Patch304: 0001-hrtimer-Use-__raise_softirq_irqoff-to-raise-the-softirq.rt +Patch305: 0002-timers-Use-__raise_softirq_irqoff-to-raise-the-softirq.rt +Patch306: 0003-softirq-Use-a-dedicated-thread-for-timer-wakeups-on-PRE.rt +Patch307: 0004-serial-8250-Switch-to-nbcon-console.rt +Patch308: 0005-serial-8250-Revert-drop-lockdep-annotation-from-serial8.rt +Patch309: 0006-locking-rt-Remove-one-__cond_lock-in-RT-s-spin_trylock_.rt +Patch310: 0007-locking-rt-Add-sparse-annotation-for-RCU.rt +Patch311: 0008-locking-rt-Annotate-unlock-followed-by-lock-for-sparse.rt +Patch312: 0009-drm-i915-Use-preempt_disable-enable_rt-where-recommende.rt +Patch313: 0010-drm-i915-Don-t-disable-interrupts-on-PREEMPT_RT-during-.rt +Patch314: 0011-drm-i915-Don-t-check-for-atomic-context-on-PREEMPT_RT.rt +Patch315: 0012-drm-i915-Disable-tracing-points-on-PREEMPT_RT.rt +Patch316: 0013-drm-i915-gt-Use-spin_lock_irq-instead-of-local_irq_disa.rt +Patch317: 0014-drm-i915-Drop-the-irqs_disabled-check.rt +Patch318: 0015-drm-i915-guc-Consider-also-RCU-depth-in-busy-loop.rt +Patch319: 0016-Revert-drm-i915-Depend-on-PREEMPT_RT.rt +Patch320: 0017-sched-Add-TIF_NEED_RESCHED_LAZY-infrastructure.rt +Patch321: 0018-sched-Add-Lazy-preemption-model.rt +Patch322: 0019-sched-Enable-PREEMPT_DYNAMIC-for-PREEMPT_RT.rt +Patch323: 0020-sched-x86-Enable-Lazy-preemption.rt +Patch324: 0021-sched-Add-laziest-preempt-model.rt +Patch325: 0022-sched-Fixup-the-IS_ENABLED-check-for-PREEMPT_LAZY.rt +Patch326: 0023-tracing-Remove-TRACE_FLAG_IRQS_NOSUPPORT.rt +Patch327: 0024-tracing-Record-task-flag-NEED_RESCHED_LAZY.rt +Patch328: 0025-sysfs-Add-sys-kernel-realtime-entry.rt +Patch329: 0001-serial-8250-enable-original-console-by-default.rt +Patch330: 0001-kernel-trace-Add-DISALLOW_TRACE_PRINTK-make-option.rt +Patch331: 0002-Revert-scripts-remove-bin2c.rt +Patch332: 0003-extend-uio-driver-to-supports-msix.rt +Patch333: 0004-virtio-add-VIRTIO_PMD-support.rt +Patch334: 0005-virt-acrn-Introduce-interfaces-for-PIO-device.rt +Patch335: 0006-Add-hypercall-to-access-MSR.rt +Patch336: 0007-Revert-spi-Remove-unused-function-spi_busnum_to_master.rt +Patch337: 0008-igc-add-CONFIG_IGC_TSN_TRACE-conditional-trace_printk-u.rt +Patch338: 0009-stmmac_pci-add-CONFIG_STMMAC_TSN_TRACE-conditional-trac.rt +Patch339: 0010-igb-prepare-for-AF_XDP-zero-copy-support.rt +Patch340: 0011-igb-Introduce-XSK-data-structures-and-helpers.rt +Patch341: 0012-igb-add-AF_XDP-zero-copy-Rx-support.rt +Patch342: 0013-igb-add-AF_XDP-zero-copy-Tx-support.rt +Patch343: 0014-igb-Add-BTF-based-metadata-for-XDP.rt +Patch344: 0015-ANDROID-trace-power-add-trace_clock_set_parent.rt +Patch345: 0016-ANDROID-trace-net-use-pK-for-kernel-pointers.rt +Patch346: 0017-ANDROID-trace-add-non-hierarchical-function_graph-optio.rt +Patch347: 0018-virtio-fix-VIRTIO_PMD-support.rt +Patch348: 0019-drm-i915-add-i915-perf-event-capacity.rt +Patch349: 0020-drm-xe-pm-allow-xe-with-CONFIG_PM.rt #drm -Patch349: 0001-drm-i915-enable-guc-submission-for-ADLs-by-default.drm -Patch350: 0001-drm-i915-disable-a-couple-of-RT-functions-if-RT-is-d.drm -Patch351: 0001-drm-i915-disable-dGPU-support-with-RT-kernel.drm -Patch352: 0001-i915-Update-GUC-to-v70.44.1-for-i915-platforms.drm -Patch353: 0001-Revert-drm-i915-disable-dGPU-support-with-RT-kernel.drm -Patch354: 0001-drm-i915-gt-Avoid-using-masked-workaround-for-CCS_MODE.drm -Patch355: 0002-drm-i915-gt-Move-the-CCS-mode-variable-to-a-global-pos.drm -Patch356: 0003-drm-i915-gt-Allow-the-creation-of-multi-mode-CCS-masks.drm -Patch357: 0004-drm-i915-gt-Refactor-uabi-engine-class-instance-list-c.drm -Patch358: 0005-drm-i915-gem-Mark-and-verify-UABI-engine-validity.drm -Patch359: 0006-drm-i915-gt-Introduce-for_each_enabled_engine-and-appl.drm -Patch360: 0007-drm-i915-gt-Manage-CCS-engine-creation-within-UABI-exp.drm -Patch361: 0008-drm-i915-gt-Remove-cslices-mask-value-from-the-CCS-str.drm -Patch362: 0009-drm-i915-gt-Expose-the-number-of-total-CCS-slices.drm -Patch363: 0010-drm-i915-gt-Store-engine-related-sysfs-kobjects.drm -Patch364: 0011-drm-i915-gt-Store-active-CCS-mask.drm -Patch365: 0012-drm-i915-Protect-access-to-the-UABI-engines-list-with-.drm -Patch366: 0013-drm-i915-gt-Isolate-single-sysfs-engine-file-creation.drm -Patch367: 0014-drm-i915-gt-Implement-creation-and-removal-routines-fo.drm -Patch368: 0015-drm-i915-gt-Allow-the-user-to-change-the-CCS-mode-thro.drm -Patch369: 0016-drm-i915-gt-Refactor-CCS-mode-handling-and-improve-app.drm -Patch370: 0017-drm-i915-no-waiting-for-page-flip-in-vpp-case.drm -Patch371: 0001-Remove-unneeded-files.patch +Patch350: 0001-drm-i915-enable-guc-submission-for-ADLs-by-default.drm +Patch351: 0001-drm-i915-disable-a-couple-of-RT-functions-if-RT-is-d.drm +Patch352: 0001-drm-i915-disable-dGPU-support-with-RT-kernel.drm +Patch353: 0001-i915-Update-GUC-to-v70.44.1-for-i915-platforms.drm +Patch354: 0001-Revert-drm-i915-disable-dGPU-support-with-RT-kernel.drm +Patch355: 0001-drm-i915-gt-Avoid-using-masked-workaround-for-CCS_MODE.drm +Patch356: 0002-drm-i915-gt-Move-the-CCS-mode-variable-to-a-global-pos.drm +Patch357: 0003-drm-i915-gt-Allow-the-creation-of-multi-mode-CCS-masks.drm +Patch358: 0004-drm-i915-gt-Refactor-uabi-engine-class-instance-list-c.drm +Patch359: 0005-drm-i915-gem-Mark-and-verify-UABI-engine-validity.drm +Patch360: 0006-drm-i915-gt-Introduce-for_each_enabled_engine-and-appl.drm +Patch361: 0007-drm-i915-gt-Manage-CCS-engine-creation-within-UABI-exp.drm +Patch362: 0008-drm-i915-gt-Remove-cslices-mask-value-from-the-CCS-str.drm +Patch363: 0009-drm-i915-gt-Expose-the-number-of-total-CCS-slices.drm +Patch364: 0010-drm-i915-gt-Store-engine-related-sysfs-kobjects.drm +Patch365: 0011-drm-i915-gt-Store-active-CCS-mask.drm +Patch366: 0012-drm-i915-Protect-access-to-the-UABI-engines-list-with-.drm +Patch367: 0013-drm-i915-gt-Isolate-single-sysfs-engine-file-creation.drm +Patch368: 0014-drm-i915-gt-Implement-creation-and-removal-routines-fo.drm +Patch369: 0015-drm-i915-gt-Allow-the-user-to-change-the-CCS-mode-thro.drm +Patch370: 0016-drm-i915-gt-Refactor-CCS-mode-handling-and-improve-app.drm +Patch371: 0017-drm-i915-no-waiting-for-page-flip-in-vpp-case.drm +Patch372: 0001-Remove-unneeded-files.patch #rapl -Patch372: 0001-powercap-intel_rapl-Add-support-for-Bartlett-Lake-pl.rapl +Patch373: 0001-powercap-intel_rapl-Add-support-for-Bartlett-Lake-pl.rapl #misc -Patch373: 0001-Add-security.md-file.misc +Patch374: 0001-Add-security.md-file.misc #emt-drm -Patch374: 0075-drm-xe-gsc-mei-interrupt-top-half-should-be-in-irq-d.patch -# CVE Patches +Patch375: 0075-drm-xe-gsc-mei-interrupt-top-half-should-be-in-irq-d.patch #CVE-2025-21709 -Patch375: CVE-2025-21709.patch -#CVE-2025-21807 -Patch376: CVE-2025-21807.patch +Patch376: CVE-2025-21709.patch #CVE-2025-21817 Patch377: CVE-2025-21817.patch -#CVE-2025-22103 -Patch378: CVE-2025-22103.patch #CVE-2025-22104 -Patch379: CVE-2025-22104.patch +Patch378: CVE-2025-22104.patch #CVE-2025-22105 -Patch380: CVE-2025-22105.patch -Patch381: CVE-2025-22105-1.patch +Patch379: CVE-2025-22105.patch +Patch380: CVE-2025-22105-1.patch #CVE-2025-22106 -Patch382: CVE-2025-22106.patch +Patch381: CVE-2025-22106.patch #CVE-2025-22108 -Patch383: CVE-2025-22108.patch +Patch382: CVE-2025-22108.patch #CVE-2025-22111 -Patch384: CVE-2025-22111.patch -#CVE-2025-22113 -Patch385: CVE-2025-22113.patch -Patch386: CVE-2025-22113-1.patch +Patch383: CVE-2025-22111.patch #CVE-2025-22116 -Patch387: CVE-2025-22116.patch +Patch384: CVE-2025-22116.patch #CVE-2025-22117 -Patch388: CVE-2025-22117.patch +Patch385: CVE-2025-22117.patch #CVE-2025-22121 -Patch389: CVE-2025-22121.patch -Patch390: CVE-2025-22121-1.patch -#CVE-2025-22124 -Patch391: CVE-2025-22124.patch +Patch386: CVE-2025-22121.patch +Patch387: CVE-2025-22121-1.patch #CVE-2025-23131 -Patch392: CVE-2025-23131.patch +Patch388: CVE-2025-23131.patch #CVE-2025-37746 -Patch393: CVE-2025-37746.patch -Patch394: CVE-2025-37746-1.patch +Patch389: CVE-2025-37746.patch +Patch390: CVE-2025-37746-1.patch #CVE-2025-37906 -Patch395: CVE-2025-37906.patch +Patch391: CVE-2025-37906.patch #CVE-2025-38041 -Patch396: CVE-2025-38041.patch -Patch397: CVE-2025-38041-1.patch -Patch398: CVE-2025-38041-2.patch +Patch392: CVE-2025-38041.patch +Patch393: CVE-2025-38041-1.patch +Patch394: CVE-2025-38041-2.patch #CVE-2025-38029 -Patch399: CVE-2025-38029.patch +Patch395: CVE-2025-38029.patch #CVE-2025-38311 -Patch400: CVE-2025-38311.patch -#CVE-2025-38306 -Patch401: CVE-2025-38306.patch +Patch396: CVE-2025-38311.patch #CVE-2025-38248 -Patch402: CVE-2025-38248.patch +Patch397: CVE-2025-38248.patch #CVE-2025-38234 -Patch403: CVE-2025-38234.patch +Patch398: CVE-2025-38234.patch #CVE-2025-38207 -Patch404: CVE-2025-38207.patch +Patch399: CVE-2025-38207.patch #CVE-2025-38137 -Patch405: CVE-2025-38137.patch +Patch400: CVE-2025-38137.patch #CVE-2025-38105 -Patch406: CVE-2025-38105.patch +Patch401: CVE-2025-38105.patch #CVE-2025-40325 -Patch407: CVE-2025-40325.patch +Patch402: CVE-2025-40325.patch #CVE-2025-38284 -Patch408: CVE-2025-38284.patch -Patch409: CVE-2025-38284-1.patch -Patch410: CVE-2025-38284-2.patch -#CVE-2025-38272 -Patch411: CVE-2025-38272.patch -Patch412: CVE-2025-38272-1.patch -Patch413: CVE-2025-38272-2.patch +Patch403: CVE-2025-38284.patch +Patch404: CVE-2025-38284-1.patch +Patch405: CVE-2025-38284-2.patch #CVE-2025-38199 -Patch414: CVE-2025-38199.patch +Patch406: CVE-2025-38199.patch #CVE-2025-38140 -Patch415: CVE-2025-38140.patch +Patch407: CVE-2025-38140.patch #CVE-2025-38132 -Patch416: CVE-2025-38132.patch -Patch417: CVE-2025-38132-1.patch +Patch408: CVE-2025-38132.patch +Patch409: CVE-2025-38132-1.patch #CVE-2025-37743 -Patch418: CVE-2025-37743.patch -#CVE-2025-23133 -Patch419: CVE-2025-23133.patch +Patch410: CVE-2025-37743.patch #CVE-2025-23132 -Patch420: CVE-2025-23132.patch +Patch411: CVE-2025-23132.patch #CVE-2025-23130 -Patch421: CVE-2025-23130.patch +Patch412: CVE-2025-23130.patch #CVE-2025-23129 -Patch422: CVE-2025-23129.patch +Patch413: CVE-2025-23129.patch #CVE-2025-22127 -Patch423: CVE-2025-22127.patch -#CVE-2025-22125 -Patch424: CVE-2025-22125.patch +Patch414: CVE-2025-22127.patch #CVE-2025-22109 -Patch425: CVE-2025-22109.patch +Patch415: CVE-2025-22109.patch #CVE-2025-21752 -Patch426: CVE-2025-21752.patch -Patch427: CVE-2025-21752-1.patch +Patch416: CVE-2025-21752.patch +Patch417: CVE-2025-21752-1.patch #CVE-2025-37860 -Patch428: CVE-2025-37860.patch +Patch418: CVE-2025-37860.patch #CVE-2024-58095 -Patch429: CVE-2024-58095.patch +Patch419: CVE-2024-58095.patch #CVE-2024-58094 -Patch430: CVE-2024-58094.patch +Patch420: CVE-2024-58094.patch #CVE-2024-57995 -Patch431: CVE-2024-57995.patch +Patch421: CVE-2024-57995.patch #CVE-2024-52560 -Patch432: CVE-2024-52560.patch -Patch433: CVE-2024-52560-1.patch +Patch422: CVE-2024-52560.patch +Patch423: CVE-2024-52560-1.patch #CVE-2025-38621 -Patch434: CVE-2025-38621.patch -#CVE-2025-38502 -Patch435: CVE-2025-38502.patch +Patch424: CVE-2025-38621.patch #CVE-2025-38627 -Patch436: CVE-2025-38627.patch +Patch425: CVE-2025-38627.patch #CVE-2025-38643 -Patch437: CVE-2025-38643.patch +Patch426: CVE-2025-38643.patch +#CVE-2025-39789 +Patch427: CVE-2025-39789.patch +#CVE-2025-39764 +Patch428: CVE-2025-39764.patch +#CVE-2025-39745 +Patch429: CVE-2025-39745.patch +#CVE-2025-39677 +Patch430: CVE-2025-39677.patch +# CVE Patches + %global security_hardening none %global sha512hmac bash %{_sourcedir}/sha512hmac-openssl.sh @@ -665,8 +654,8 @@ manipulation of eBPF programs and maps. %prep %define _default_patch_flags -p1 --fuzz=3 --force -%setup -q -n linux-6.12.44 -%autosetup -p1 -n linux-6.12.44 +%setup -q -n linux-6.12.47 +%autosetup -p1 -n linux-6.12.47 # %patch 0 -p1 make mrproper @@ -938,6 +927,9 @@ ln -sf linux-%{uname_r}.cfg /boot/mariner.cfg %{_sysconfdir}/bash_completion.d/bpftool %changelog +* Thu Sep 18 2025 Ren Jiaojiao - 6.12.47-1 +- Update kernel to 6.12.47 + * Tue Sep 09 2025 Ren Jiaojiao - 6.12.44-1 - Update kernel to 6.12.44 diff --git a/SPECS/kernel-rt/series b/SPECS/kernel-rt/series index 77137c69c1..179f535971 100644 --- a/SPECS/kernel-rt/series +++ b/SPECS/kernel-rt/series @@ -1,5 +1,5 @@ -# Series file for v6.12.44 linux kernel -# 11a24528d080a Linux 6.12.44 +# Series file for v6.12.47 linux kernel +# f6cf124428f51 Linux 6.12.47 #sriov 0001-drm-i915-mtl-Add-C10-table-for-HDMI-Clock-25175.sriov 0002-drm-i915-mtl-Copy-c10-phy-pll-sw-state-from-master-t.sriov @@ -58,6 +58,7 @@ 0002-virtio-break-and-reset-virtio-devices-on-device_shut.sriov 0003-virtgpu-don-t-reset-on-shutdown.sriov 0004-drm-virtio-implement-virtio_gpu_shutdown.sriov +0001-drm-virtio-Wait-until-the-control-and-cursor-queues-.sriov #security 0001-mei-bus-add-api-to-query-capabilities-of-ME-clien.security 0002-mei-virtio-virtualization-frontend-driver.security @@ -392,15 +393,9 @@ #CVE-2025-21709 CVE-2025-21709.patch -#CVE-2025-21807 -CVE-2025-21807.patch - #CVE-2025-21817 CVE-2025-21817.patch -#CVE-2025-22103 -CVE-2025-22103.patch - #CVE-2025-22104 CVE-2025-22104.patch @@ -417,10 +412,6 @@ CVE-2025-22108.patch #CVE-2025-22111 CVE-2025-22111.patch -#CVE-2025-22113 -CVE-2025-22113.patch -CVE-2025-22113-1.patch - #CVE-2025-22116 CVE-2025-22116.patch @@ -431,9 +422,6 @@ CVE-2025-22117.patch CVE-2025-22121.patch CVE-2025-22121-1.patch -#CVE-2025-22124 -CVE-2025-22124.patch - #CVE-2025-23131 CVE-2025-23131.patch @@ -455,9 +443,6 @@ CVE-2025-38029.patch #CVE-2025-38311 CVE-2025-38311.patch -#CVE-2025-38306 -CVE-2025-38306.patch - #CVE-2025-38248 CVE-2025-38248.patch @@ -481,11 +466,6 @@ CVE-2025-38284.patch CVE-2025-38284-1.patch CVE-2025-38284-2.patch -#CVE-2025-38272 -CVE-2025-38272.patch -CVE-2025-38272-1.patch -CVE-2025-38272-2.patch - #CVE-2025-38199 CVE-2025-38199.patch @@ -499,9 +479,6 @@ CVE-2025-38132-1.patch #CVE-2025-37743 CVE-2025-37743.patch -#CVE-2025-23133 -CVE-2025-23133.patch - #CVE-2025-23132 CVE-2025-23132.patch @@ -514,9 +491,6 @@ CVE-2025-23129.patch #CVE-2025-22127 CVE-2025-22127.patch -#CVE-2025-22125 -CVE-2025-22125.patch - #CVE-2025-22109 CVE-2025-22109.patch @@ -543,11 +517,20 @@ CVE-2024-52560-1.patch #CVE-2025-38621 CVE-2025-38621.patch -#CVE-2025-38502 -CVE-2025-38502.patch - #CVE-2025-38627 CVE-2025-38627.patch #CVE-2025-38643 CVE-2025-38643.patch + +#CVE-2025-39789 +CVE-2025-39789.patch + +#CVE-2025-39764 +CVE-2025-39764.patch + +#CVE-2025-39745 +CVE-2025-39745.patch + +#CVE-2025-39677 +CVE-2025-39677.patch diff --git a/SPECS/kernel/0001-drm-virtio-Wait-until-the-control-and-cursor-queues-.sriov b/SPECS/kernel/0001-drm-virtio-Wait-until-the-control-and-cursor-queues-.sriov new file mode 100644 index 0000000000..cbe23fa5a7 --- /dev/null +++ b/SPECS/kernel/0001-drm-virtio-Wait-until-the-control-and-cursor-queues-.sriov @@ -0,0 +1,35 @@ +From c907329d449811f5aa58f2b2a3633b6012774e37 Mon Sep 17 00:00:00 2001 +From: Dongwon Kim +Date: Wed, 10 Sep 2025 20:48:45 -0700 +Subject: [PATCH] drm/virtio: Wait until the control and cursor queues are + fully emptied + +It is needed to wait until the queues are fully emptied before +doing freeze/suspend. + +Signed-off-by: Dongwon Kim +--- + drivers/gpu/drm/virtio/virtgpu_drv.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/virtgpu_drv.c +index d6fb1dbfaa27e..d1b189b1a9b75 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_drv.c ++++ b/drivers/gpu/drm/virtio/virtgpu_drv.c +@@ -176,6 +176,13 @@ static int virtgpu_freeze(struct virtio_device *vdev) + flush_work(&vgdev->ctrlq.dequeue_work); + flush_work(&vgdev->cursorq.dequeue_work); + flush_work(&vgdev->config_changed_work); ++ ++ wait_event(vgdev->ctrlq.ack_queue, ++ vgdev->ctrlq.vq->num_free == vgdev->ctrlq.vq->num_max); ++ ++ wait_event(vgdev->cursorq.ack_queue, ++ vgdev->cursorq.vq->num_free == vgdev->cursorq.vq->num_max); ++ + vdev->config->del_vqs(vdev); + + return 0; +-- +2.43.0 + diff --git a/SPECS/kernel/CVE-2025-21807.patch b/SPECS/kernel/CVE-2025-21807.patch deleted file mode 100644 index 08da1ab981..0000000000 --- a/SPECS/kernel/CVE-2025-21807.patch +++ /dev/null @@ -1,169 +0,0 @@ -From dd680ab1ce367fde34fb89faaad97e92929a7f34 Mon Sep 17 00:00:00 2001 -From: Christoph Hellwig -Date: Fri, 10 Jan 2025 06:47:14 +0100 -Subject: [PATCH 3/4] block: fix queue freeze vs limits lock order in sysfs - store methods - -queue_attr_store() always freezes a device queue before calling the -attribute store operation. For attributes that control queue limits, the -store operation will also lock the queue limits with a call to -queue_limits_start_update(). However, some drivers (e.g. SCSI sd) may -need to issue commands to a device to obtain limit values from the -hardware with the queue limits locked. This creates a potential ABBA -deadlock situation if a user attempts to modify a limit (thus freezing -the device queue) while the device driver starts a revalidation of the -device queue limits. - -Avoid such deadlock by not freezing the queue before calling the -->store_limit() method in struct queue_sysfs_entry and instead use the -queue_limits_commit_update_frozen helper to freeze the queue after taking -the limits lock. - -This also removes taking the sysfs lock for the store_limit method as -it doesn't protect anything here, but creates even more nesting. -Hopefully it will go away from the actual sysfs methods entirely soon. - -(commit log adapted from a similar patch from Damien Le Moal) - -Fixes: ff956a3be95b ("block: use queue_limits_commit_update in queue_discard_max_store") -Fixes: 0327ca9d53bf ("block: use queue_limits_commit_update in queue_max_sectors_store") -Signed-off-by: Christoph Hellwig -Reviewed-by: Ming Lei -Reviewed-by: Damien Le Moal -Reviewed-by: Martin K. Petersen -Reviewed-by: Nilay Shroff -Reviewed-by: Johannes Thumshirn -Link: https://lore.kernel.org/r/20250110054726.1499538-7-hch@lst.de -Signed-off-by: Jens Axboe ---- - block/blk-settings.c | 26 ++++++++++++++++++++++++++ - block/blk-sysfs.c | 33 +++++++++++++++++++++++++++------ - include/linux/blkdev.h | 2 ++ - 3 files changed, 55 insertions(+), 6 deletions(-) - -diff --git a/block/blk-settings.c b/block/blk-settings.c -index 7abf034089cd..3907ea71213f 100644 ---- a/block/blk-settings.c -+++ b/block/blk-settings.c -@@ -426,6 +426,32 @@ int queue_limits_commit_update(struct request_queue *q, - } - EXPORT_SYMBOL_GPL(queue_limits_commit_update); - -+ -+/** -+ * queue_limits_commit_update_frozen - commit an atomic update of queue limits -+ * @q: queue to update -+ * @lim: limits to apply -+ * -+ * Apply the limits in @lim that were obtained from queue_limits_start_update() -+ * and updated with the new values by the caller to @q. Freezes the queue -+ * before the update and unfreezes it after. -+ * -+ * Returns 0 if successful, else a negative error code. -+ */ -+int queue_limits_commit_update_frozen(struct request_queue *q, -+ struct queue_limits *lim) -+{ -+ int ret; -+ -+ blk_mq_freeze_queue(q); -+ ret = queue_limits_commit_update(q, lim); -+ blk_mq_unfreeze_queue(q); -+ -+ return ret; -+} -+EXPORT_SYMBOL_GPL(queue_limits_commit_update_frozen); -+ -+ - /** - * queue_limits_set - apply queue limits to queue - * @q: queue to update -diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c -index 692b27266220..69bdd48ceae2 100644 ---- a/block/blk-sysfs.c -+++ b/block/blk-sysfs.c -@@ -23,8 +23,10 @@ - struct queue_sysfs_entry { - struct attribute attr; - ssize_t (*show)(struct gendisk *disk, char *page); -- int (*load_module)(struct gendisk *disk, const char *page, size_t count); - ssize_t (*store)(struct gendisk *disk, const char *page, size_t count); -+ int (*store_limit)(struct gendisk *disk, const char *page, -+ size_t count, struct queue_limits *lim); -+ int (*load_module)(struct gendisk *disk, const char *page, size_t count); - }; - - static ssize_t -@@ -421,6 +423,13 @@ static struct queue_sysfs_entry _prefix##_entry = { \ - .store = _prefix##_store, \ - }; - -+#define QUEUE_LIM_RW_ENTRY(_prefix, _name) \ -+static struct queue_sysfs_entry _prefix##_entry = { \ -+ .attr = { .name = _name, .mode = 0644 }, \ -+ .show = _prefix##_show, \ -+ .store_limit = _prefix##_store, \ -+} -+ - #define QUEUE_RW_LOAD_MODULE_ENTRY(_prefix, _name) \ - static struct queue_sysfs_entry _prefix##_entry = { \ - .attr = { .name = _name, .mode = 0644 }, \ -@@ -683,7 +692,7 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, - struct request_queue *q = disk->queue; - ssize_t res; - -- if (!entry->store) -+ if (!entry->store_limit && !entry->store) - return -EIO; - - /* -@@ -691,17 +700,29 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, - * queue to ensure that the module file can be read when the request - * queue is the one for the device storing the module file. - */ -- if (entry->load_module) { -- res = entry->load_module(disk, page, length); -+ if (entry->load_module) -+ entry->load_module(disk, page, length); -+ -+ if (entry->store_limit) { -+ struct queue_limits lim = queue_limits_start_update(q); -+ -+ res = entry->store_limit(disk, page, length, &lim); -+ if (res < 0) { -+ queue_limits_cancel_update(q); -+ return res; -+ } -+ -+ res = queue_limits_commit_update_frozen(q, &lim); - if (res) - return res; -+ return length; - } - -- blk_mq_freeze_queue(q); - mutex_lock(&q->sysfs_lock); -+ blk_mq_freeze_queue(q); - res = entry->store(disk, page, length); -- mutex_unlock(&q->sysfs_lock); - blk_mq_unfreeze_queue(q); -+ mutex_unlock(&q->sysfs_lock); - return res; - } - -diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h -index 8f37c5dd52b2..69737a1551fe 100644 ---- a/include/linux/blkdev.h -+++ b/include/linux/blkdev.h -@@ -935,6 +935,8 @@ queue_limits_start_update(struct request_queue *q) - mutex_lock(&q->limits_lock); - return q->limits; - } -+int queue_limits_commit_update_frozen(struct request_queue *q, -+ struct queue_limits *lim); - int queue_limits_commit_update(struct request_queue *q, - struct queue_limits *lim); - int queue_limits_set(struct request_queue *q, struct queue_limits *lim); --- -2.25.1 - diff --git a/SPECS/kernel/CVE-2025-21817.patch b/SPECS/kernel/CVE-2025-21817.patch index ae8a91cef0..717fe82547 100644 --- a/SPECS/kernel/CVE-2025-21817.patch +++ b/SPECS/kernel/CVE-2025-21817.patch @@ -1,7 +1,7 @@ -From 961a8f3d5f63a1c4b1d93f9d12c2dc7264d4434e Mon Sep 17 00:00:00 2001 +From 1605aaf3ed80ecc295f493c28946af971d36389e Mon Sep 17 00:00:00 2001 From: Ming Lei Date: Mon, 13 Jan 2025 09:58:33 +0800 -Subject: [PATCH 4/4] block: mark GFP_NOIO around sysfs ->store() +Subject: [PATCH] block: mark GFP_NOIO around sysfs ->store() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit @@ -26,27 +26,27 @@ Signed-off-by: Jens Axboe 1 file changed, 3 insertions(+) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c -index 69bdd48ceae2..496564485bad 100644 +index 6a38f312e385..063c578d3e4b 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c -@@ -690,6 +690,7 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, +@@ -681,6 +681,7 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, struct queue_sysfs_entry *entry = to_queue(attr); struct gendisk *disk = container_of(kobj, struct gendisk, queue_kobj); struct request_queue *q = disk->queue; + unsigned int noio_flag; ssize_t res; - if (!entry->store_limit && !entry->store) -@@ -720,7 +721,9 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, + if (!entry->store) +@@ -699,7 +700,9 @@ queue_attr_store(struct kobject *kobj, struct attribute *attr, - mutex_lock(&q->sysfs_lock); blk_mq_freeze_queue(q); + mutex_lock(&q->sysfs_lock); + noio_flag = memalloc_noio_save(); res = entry->store(disk, page, length); + memalloc_noio_restore(noio_flag); - blk_mq_unfreeze_queue(q); mutex_unlock(&q->sysfs_lock); + blk_mq_unfreeze_queue(q); return res; -- -2.25.1 +2.43.0 diff --git a/SPECS/kernel/CVE-2025-22103.patch b/SPECS/kernel/CVE-2025-22103.patch deleted file mode 100644 index 0758824ca2..0000000000 --- a/SPECS/kernel/CVE-2025-22103.patch +++ /dev/null @@ -1,61 +0,0 @@ -From a7feb0e9dda0ebb66c810ad9bd0bbeb2823bd89f Mon Sep 17 00:00:00 2001 -From: Wang Liang -Date: Fri, 21 Mar 2025 17:03:53 +0800 -Subject: [PATCH] net: fix NULL pointer dereference in l3mdev_l3_rcv - -When delete l3s ipvlan: - - ip link del link eth0 ipvlan1 type ipvlan mode l3s - -This may cause a null pointer dereference: - - Call trace: - ip_rcv_finish+0x48/0xd0 - ip_rcv+0x5c/0x100 - __netif_receive_skb_one_core+0x64/0xb0 - __netif_receive_skb+0x20/0x80 - process_backlog+0xb4/0x204 - napi_poll+0xe8/0x294 - net_rx_action+0xd8/0x22c - __do_softirq+0x12c/0x354 - -This is because l3mdev_l3_rcv() visit dev->l3mdev_ops after -ipvlan_l3s_unregister() assign the dev->l3mdev_ops to NULL. The process -like this: - - (CPU1) | (CPU2) - l3mdev_l3_rcv() | - check dev->priv_flags: | - master = skb->dev; | - | - | ipvlan_l3s_unregister() - | set dev->priv_flags - | dev->l3mdev_ops = NULL; - | - visit master->l3mdev_ops | - -To avoid this by do not set dev->l3mdev_ops when unregister l3s ipvlan. - -Suggested-by: David Ahern -Fixes: c675e06a98a4 ("ipvlan: decouple l3s mode dependencies from other modes") -Signed-off-by: Wang Liang -Reviewed-by: Simon Horman -Link: https://patch.msgid.link/20250321090353.1170545-1-wangliang74@huawei.com -Signed-off-by: Jakub Kicinski ---- - drivers/net/ipvlan/ipvlan_l3s.c | 1 - - 1 file changed, 1 deletion(-) - -diff --git a/drivers/net/ipvlan/ipvlan_l3s.c b/drivers/net/ipvlan/ipvlan_l3s.c -index d5b05e803219..ca35a50bb640 100644 ---- a/drivers/net/ipvlan/ipvlan_l3s.c -+++ b/drivers/net/ipvlan/ipvlan_l3s.c -@@ -224,5 +224,4 @@ void ipvlan_l3s_unregister(struct ipvl_port *port) - - dev->priv_flags &= ~IFF_L3MDEV_RX_HANDLER; - ipvlan_unregister_nf_hook(read_pnet(&port->pnet)); -- dev->l3mdev_ops = NULL; - } --- -2.25.1 - diff --git a/SPECS/kernel/CVE-2025-22113-1.patch b/SPECS/kernel/CVE-2025-22113-1.patch deleted file mode 100644 index 4a1c1cb639..0000000000 --- a/SPECS/kernel/CVE-2025-22113-1.patch +++ /dev/null @@ -1,169 +0,0 @@ -From a38f34dafdd0c30fb3d2b3f35e1164f51442c215 Mon Sep 17 00:00:00 2001 -From: Ojaswin Mujoo -Date: Tue, 18 Mar 2025 13:22:56 +0530 -Subject: [PATCH 2/2] ext4: avoid journaling sb update on error if journal is - destroying - -Presently we always BUG_ON if trying to start a transaction on a journal marked -with JBD2_UNMOUNT, since this should never happen. However, while ltp running -stress tests, it was observed that in case of some error handling paths, it is -possible for update_super_work to start a transaction after the journal is -destroyed eg: - -(umount) -ext4_kill_sb - kill_block_super - generic_shutdown_super - sync_filesystem /* commits all txns */ - evict_inodes - /* might start a new txn */ - ext4_put_super - flush_work(&sbi->s_sb_upd_work) /* flush the workqueue */ - jbd2_journal_destroy - journal_kill_thread - journal->j_flags |= JBD2_UNMOUNT; - jbd2_journal_commit_transaction - jbd2_journal_get_descriptor_buffer - jbd2_journal_bmap - ext4_journal_bmap - ext4_map_blocks - ... - ext4_inode_error - ext4_handle_error - schedule_work(&sbi->s_sb_upd_work) - - /* work queue kicks in */ - update_super_work - jbd2_journal_start - start_this_handle - BUG_ON(journal->j_flags & - JBD2_UNMOUNT) - -Hence, introduce a new mount flag to indicate journal is destroying and only do -a journaled (and deferred) update of sb if this flag is not set. Otherwise, just -fallback to an un-journaled commit. - -Further, in the journal destroy path, we have the following sequence: - - 1. Set mount flag indicating journal is destroying - 2. force a commit and wait for it - 3. flush pending sb updates - -This sequence is important as it ensures that, after this point, there is no sb -update that might be journaled so it is safe to update the sb outside the -journal. (To avoid race discussed in 2d01ddc86606) - -Also, we don't need a similar check in ext4_grp_locked_error since it is only -called from mballoc and AFAICT it would be always valid to schedule work here. - -Fixes: 2d01ddc86606 ("ext4: save error info to sb through journal if available") -Reported-by: Mahesh Kumar -Signed-off-by: Ojaswin Mujoo -Reviewed-by: Jan Kara -Link: https://patch.msgid.link/9613c465d6ff00cd315602f99283d5f24018c3f7.1742279837.git.ojaswin@linux.ibm.com -Signed-off-by: Theodore Ts'o ---- - fs/ext4/ext4.h | 3 ++- - fs/ext4/ext4_jbd2.h | 15 +++++++++++++++ - fs/ext4/super.c | 16 ++++++++-------- - 3 files changed, 25 insertions(+), 9 deletions(-) - -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index bbffb76d9a90..27b633928eb1 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -1820,7 +1820,8 @@ static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino) - */ - enum { - EXT4_MF_MNTDIR_SAMPLED, -- EXT4_MF_FC_INELIGIBLE /* Fast commit ineligible */ -+ EXT4_MF_FC_INELIGIBLE, /* Fast commit ineligible */ -+ EXT4_MF_JOURNAL_DESTROY /* Journal is in process of destroying */ - }; - - static inline void ext4_set_mount_flag(struct super_block *sb, int bit) -diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h -index 930778e507cc..ada46189b086 100644 ---- a/fs/ext4/ext4_jbd2.h -+++ b/fs/ext4/ext4_jbd2.h -@@ -521,6 +521,21 @@ static inline int ext4_journal_destroy(struct ext4_sb_info *sbi, journal_t *jour - { - int err = 0; - -+ /* -+ * At this point only two things can be operating on the journal. -+ * JBD2 thread performing transaction commit and s_sb_upd_work -+ * issuing sb update through the journal. Once we set -+ * EXT4_JOURNAL_DESTROY, new ext4_handle_error() calls will not -+ * queue s_sb_upd_work and ext4_force_commit() makes sure any -+ * ext4_handle_error() calls from the running transaction commit are -+ * finished. Hence no new s_sb_upd_work can be queued after we -+ * flush it here. -+ */ -+ ext4_set_mount_flag(sbi->s_sb, EXT4_MF_JOURNAL_DESTROY); -+ -+ ext4_force_commit(sbi->s_sb); -+ flush_work(&sbi->s_sb_upd_work); -+ - err = jbd2_journal_destroy(journal); - sbi->s_journal = NULL; - -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index f26816854dd5..b10872abb9c9 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -719,9 +719,13 @@ static void ext4_handle_error(struct super_block *sb, bool force_ro, int error, - * In case the fs should keep running, we need to writeout - * superblock through the journal. Due to lock ordering - * constraints, it may not be safe to do it right here so we -- * defer superblock flushing to a workqueue. -+ * defer superblock flushing to a workqueue. We just need to be -+ * careful when the journal is already shutting down. If we get -+ * here in that case, just update the sb directly as the last -+ * transaction won't commit anyway. - */ -- if (continue_fs && journal) -+ if (continue_fs && journal && -+ !ext4_test_mount_flag(sb, EXT4_MF_JOURNAL_DESTROY)) - schedule_work(&EXT4_SB(sb)->s_sb_upd_work); - else - ext4_commit_super(sb); -@@ -1306,7 +1310,6 @@ static void ext4_put_super(struct super_block *sb) - ext4_unregister_li_request(sb); - ext4_quotas_off(sb, EXT4_MAXQUOTAS); - -- flush_work(&sbi->s_sb_upd_work); - destroy_workqueue(sbi->rsv_conversion_wq); - ext4_release_orphan_info(sb); - -@@ -1316,7 +1319,8 @@ static void ext4_put_super(struct super_block *sb) - if ((err < 0) && !aborted) { - ext4_abort(sb, -err, "Couldn't clean up the journal"); - } -- } -+ } else -+ flush_work(&sbi->s_sb_upd_work); - - ext4_es_unregister_shrinker(sbi); - timer_shutdown_sync(&sbi->s_err_report); -@@ -4944,8 +4948,6 @@ static int ext4_load_and_init_journal(struct super_block *sb, - return 0; - - out: -- /* flush s_sb_upd_work before destroying the journal. */ -- flush_work(&sbi->s_sb_upd_work); - ext4_journal_destroy(sbi, sbi->s_journal); - return -EINVAL; - } -@@ -5631,8 +5633,6 @@ failed_mount8: __maybe_unused - sbi->s_ea_block_cache = NULL; - - if (sbi->s_journal) { -- /* flush s_sb_upd_work before journal destroy. */ -- flush_work(&sbi->s_sb_upd_work); - ext4_journal_destroy(sbi, sbi->s_journal); - } - failed_mount3a: --- -2.25.1 - diff --git a/SPECS/kernel/CVE-2025-22113.patch b/SPECS/kernel/CVE-2025-22113.patch deleted file mode 100644 index 42b4dd4f27..0000000000 --- a/SPECS/kernel/CVE-2025-22113.patch +++ /dev/null @@ -1,108 +0,0 @@ -From 1cb42376c3bb339074fd4d72232156af50dbd0a8 Mon Sep 17 00:00:00 2001 -From: Ojaswin Mujoo -Date: Tue, 18 Mar 2025 13:22:55 +0530 -Subject: [PATCH 1/2] ext4: define ext4_journal_destroy wrapper - -Define an ext4 wrapper over jbd2_journal_destroy to make sure we -have consistent behavior during journal destruction. This will also -come useful in the next patch where we add some ext4 specific logic -in the destroy path. - -Reviewed-by: Jan Kara -Reviewed-by: Baokun Li -Signed-off-by: Ojaswin Mujoo -Link: https://patch.msgid.link/c3ba78c5c419757e6d5f2d8ebb4a8ce9d21da86a.1742279837.git.ojaswin@linux.ibm.com -Signed-off-by: Theodore Ts'o ---- - fs/ext4/ext4_jbd2.h | 14 ++++++++++++++ - fs/ext4/super.c | 16 ++++++---------- - 2 files changed, 20 insertions(+), 10 deletions(-) - -diff --git a/fs/ext4/ext4_jbd2.h b/fs/ext4/ext4_jbd2.h -index 0c77697d5e90..930778e507cc 100644 ---- a/fs/ext4/ext4_jbd2.h -+++ b/fs/ext4/ext4_jbd2.h -@@ -513,4 +513,18 @@ static inline int ext4_should_dioread_nolock(struct inode *inode) - return 1; - } - -+/* -+ * Pass journal explicitly as it may not be cached in the sbi->s_journal in some -+ * cases -+ */ -+static inline int ext4_journal_destroy(struct ext4_sb_info *sbi, journal_t *journal) -+{ -+ int err = 0; -+ -+ err = jbd2_journal_destroy(journal); -+ sbi->s_journal = NULL; -+ -+ return err; -+} -+ - #endif /* _EXT4_JBD2_H */ -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 4291ab3c20be..f26816854dd5 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -1312,8 +1312,7 @@ static void ext4_put_super(struct super_block *sb) - - if (sbi->s_journal) { - aborted = is_journal_aborted(sbi->s_journal); -- err = jbd2_journal_destroy(sbi->s_journal); -- sbi->s_journal = NULL; -+ err = ext4_journal_destroy(sbi, sbi->s_journal); - if ((err < 0) && !aborted) { - ext4_abort(sb, -err, "Couldn't clean up the journal"); - } -@@ -4947,8 +4946,7 @@ static int ext4_load_and_init_journal(struct super_block *sb, - out: - /* flush s_sb_upd_work before destroying the journal. */ - flush_work(&sbi->s_sb_upd_work); -- jbd2_journal_destroy(sbi->s_journal); -- sbi->s_journal = NULL; -+ ext4_journal_destroy(sbi, sbi->s_journal); - return -EINVAL; - } - -@@ -5635,8 +5633,7 @@ failed_mount8: __maybe_unused - if (sbi->s_journal) { - /* flush s_sb_upd_work before journal destroy. */ - flush_work(&sbi->s_sb_upd_work); -- jbd2_journal_destroy(sbi->s_journal); -- sbi->s_journal = NULL; -+ ext4_journal_destroy(sbi, sbi->s_journal); - } - failed_mount3a: - ext4_es_unregister_shrinker(sbi); -@@ -5944,7 +5941,7 @@ static journal_t *ext4_open_dev_journal(struct super_block *sb, - return journal; - - out_journal: -- jbd2_journal_destroy(journal); -+ ext4_journal_destroy(EXT4_SB(sb), journal); - out_bdev: - bdev_fput(bdev_file); - return ERR_PTR(errno); -@@ -6061,8 +6058,7 @@ static int ext4_load_journal(struct super_block *sb, - EXT4_SB(sb)->s_journal = journal; - err = ext4_clear_journal_err(sb, es); - if (err) { -- EXT4_SB(sb)->s_journal = NULL; -- jbd2_journal_destroy(journal); -+ ext4_journal_destroy(EXT4_SB(sb), journal); - return err; - } - -@@ -6080,7 +6076,7 @@ static int ext4_load_journal(struct super_block *sb, - return 0; - - err_out: -- jbd2_journal_destroy(journal); -+ ext4_journal_destroy(EXT4_SB(sb), journal); - return err; - } - --- -2.25.1 - diff --git a/SPECS/kernel/CVE-2025-22124.patch b/SPECS/kernel/CVE-2025-22124.patch deleted file mode 100644 index ba717d0c64..0000000000 --- a/SPECS/kernel/CVE-2025-22124.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 31ea5fb2dc95a5ddc9ad67d53b5d1f151775f194 Mon Sep 17 00:00:00 2001 -From: Su Yue -Date: Mon, 3 Mar 2025 11:39:18 +0800 -Subject: [PATCH] md/md-bitmap: fix wrong bitmap_limit for clustermd when write - sb - -In clustermd, separate write-intent-bitmaps are used for each cluster -node: - -0 4k 8k 12k -------------------------------------------------------------------- -| idle | md super | bm super [0] + bits | -| bm bits[0, contd] | bm super[1] + bits | bm bits[1, contd] | -| bm super[2] + bits | bm bits [2, contd] | bm super[3] + bits | -| bm bits [3, contd] | | | - -So in node 1, pg_index in __write_sb_page() could equal to -bitmap->storage.file_pages. Then bitmap_limit will be calculated to -0. md_super_write() will be called with 0 size. -That means the first 4k sb area of node 1 will never be updated -through filemap_write_page(). -This bug causes hang of mdadm/clustermd_tests/01r1_Grow_resize. - -Here use (pg_index % bitmap->storage.file_pages) to make calculation -of bitmap_limit correct. - -Fixes: ab99a87542f1 ("md/md-bitmap: fix writing non bitmap pages") -Signed-off-by: Su Yue -Reviewed-by: Heming Zhao -Link: https://lore.kernel.org/linux-raid/20250303033918.32136-1-glass.su@suse.com -Signed-off-by: Yu Kuai ---- - drivers/md/md-bitmap.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c -index 2e3087556adb..4ab69fd1745a 100644 ---- a/drivers/md/md-bitmap.c -+++ b/drivers/md/md-bitmap.c -@@ -426,8 +426,8 @@ static int __write_sb_page(struct md_rdev *rdev, struct bitmap *bitmap, - struct block_device *bdev; - struct mddev *mddev = bitmap->mddev; - struct bitmap_storage *store = &bitmap->storage; -- unsigned int bitmap_limit = (bitmap->storage.file_pages - pg_index) << -- PAGE_SHIFT; -+ unsigned long num_pages = bitmap->storage.file_pages; -+ unsigned int bitmap_limit = (num_pages - pg_index % num_pages) << PAGE_SHIFT; - loff_t sboff, offset = mddev->bitmap_info.offset; - sector_t ps = pg_index * PAGE_SIZE / SECTOR_SIZE; - unsigned int size = PAGE_SIZE; -@@ -436,7 +436,7 @@ static int __write_sb_page(struct md_rdev *rdev, struct bitmap *bitmap, - - bdev = (rdev->meta_bdev) ? rdev->meta_bdev : rdev->bdev; - /* we compare length (page numbers), not page offset. */ -- if ((pg_index - store->sb_index) == store->file_pages - 1) { -+ if ((pg_index - store->sb_index) == num_pages - 1) { - unsigned int last_page_size = store->bytes & (PAGE_SIZE - 1); - - if (last_page_size == 0) --- -2.25.1 - diff --git a/SPECS/kernel/CVE-2025-22125.patch b/SPECS/kernel/CVE-2025-22125.patch deleted file mode 100644 index 6fffcf2b4d..0000000000 --- a/SPECS/kernel/CVE-2025-22125.patch +++ /dev/null @@ -1,98 +0,0 @@ -From d6da5b46c7ccd873b769212a88ab847026a0ecbc Mon Sep 17 00:00:00 2001 -From: Yu Kuai -Date: Thu, 27 Feb 2025 20:16:57 +0800 -Subject: [PATCH 18/27] md/raid1,raid10: don't ignore IO flags - -If blk-wbt is enabled by default, it's found that raid write performance -is quite bad because all IO are throttled by wbt of underlying disks, -due to flag REQ_IDLE is ignored. And turns out this behaviour exist since -blk-wbt is introduced. - -Other than REQ_IDLE, other flags should not be ignored as well, for -example REQ_META can be set for filesystems, clearing it can cause priority -reverse problems; And REQ_NOWAIT should not be cleared as well, because -io will wait instead of failing directly in underlying disks. - -Fix those problems by keep IO flags from master bio. - -Fises: f51d46d0e7cb ("md: add support for REQ_NOWAIT") -Fixes: e34cbd307477 ("blk-wbt: add general throttling mechanism") -Fixes: 5404bc7a87b9 ("[PATCH] Allow file systems to differentiate between data and meta reads") -Link: https://lore.kernel.org/linux-raid/20250227121657.832356-1-yukuai1@huaweicloud.com -Signed-off-by: Yu Kuai ---- - drivers/md/raid1.c | 4 ---- - drivers/md/raid10.c | 7 ------- - 2 files changed, 11 deletions(-) - -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index fe1599db69c8..6e93e3b6bd8c 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -1315,8 +1315,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, - struct r1conf *conf = mddev->private; - struct raid1_info *mirror; - struct bio *read_bio; -- const enum req_op op = bio_op(bio); -- const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; - int max_sectors; - int rdisk; - bool r1bio_existed = !!r1_bio; -@@ -1399,7 +1397,6 @@ static void raid1_read_request(struct mddev *mddev, struct bio *bio, - read_bio->bi_iter.bi_sector = r1_bio->sector + - mirror->rdev->data_offset; - read_bio->bi_end_io = raid1_end_read_request; -- read_bio->bi_opf = op | do_sync; - if (test_bit(FailFast, &mirror->rdev->flags) && - test_bit(R1BIO_FailFast, &r1_bio->state)) - read_bio->bi_opf |= MD_FAILFAST; -@@ -1619,7 +1616,6 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, - - mbio->bi_iter.bi_sector = (r1_bio->sector + rdev->data_offset); - mbio->bi_end_io = raid1_end_write_request; -- mbio->bi_opf = bio_op(bio) | (bio->bi_opf & (REQ_SYNC | REQ_FUA)); - if (test_bit(FailFast, &rdev->flags) && - !test_bit(WriteMostly, &rdev->flags) && - conf->raid_disks - mddev->degraded > 1) -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index 8825457f6a70..e2c6487456c1 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -1146,8 +1146,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, - { - struct r10conf *conf = mddev->private; - struct bio *read_bio; -- const enum req_op op = bio_op(bio); -- const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; - int max_sectors; - struct md_rdev *rdev; - char b[BDEVNAME_SIZE]; -@@ -1226,7 +1224,6 @@ static void raid10_read_request(struct mddev *mddev, struct bio *bio, - read_bio->bi_iter.bi_sector = r10_bio->devs[slot].addr + - choose_data_offset(r10_bio, rdev); - read_bio->bi_end_io = raid10_end_read_request; -- read_bio->bi_opf = op | do_sync; - if (test_bit(FailFast, &rdev->flags) && - test_bit(R10BIO_FailFast, &r10_bio->state)) - read_bio->bi_opf |= MD_FAILFAST; -@@ -1240,9 +1237,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, - struct bio *bio, bool replacement, - int n_copy) - { -- const enum req_op op = bio_op(bio); -- const blk_opf_t do_sync = bio->bi_opf & REQ_SYNC; -- const blk_opf_t do_fua = bio->bi_opf & REQ_FUA; - unsigned long flags; - struct r10conf *conf = mddev->private; - struct md_rdev *rdev; -@@ -1261,7 +1255,6 @@ static void raid10_write_one_disk(struct mddev *mddev, struct r10bio *r10_bio, - mbio->bi_iter.bi_sector = (r10_bio->devs[n_copy].addr + - choose_data_offset(r10_bio, rdev)); - mbio->bi_end_io = raid10_end_write_request; -- mbio->bi_opf = op | do_sync | do_fua; - if (!replacement && test_bit(FailFast, - &conf->mirrors[devnum].rdev->flags) - && enough(conf, devnum)) --- -2.43.0 - diff --git a/SPECS/kernel/CVE-2025-23133.patch b/SPECS/kernel/CVE-2025-23133.patch deleted file mode 100644 index 000000ed36..0000000000 --- a/SPECS/kernel/CVE-2025-23133.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 73cb277b4f7485c9b3c2e4490474ec7708808b32 Mon Sep 17 00:00:00 2001 -From: Wen Gong -Date: Fri, 17 Jan 2025 14:17:36 +0800 -Subject: [PATCH 13/27] wifi: ath11k: update channel list in reg notifier - instead reg worker - -Currently when ath11k gets a new channel list, it will be processed -according to the following steps: -1. update new channel list to cfg80211 and queue reg_work. -2. cfg80211 handles new channel list during reg_work. -3. update cfg80211's handled channel list to firmware by -ath11k_reg_update_chan_list(). - -But ath11k will immediately execute step 3 after reg_work is just -queued. Since step 2 is asynchronous, cfg80211 may not have completed -handling the new channel list, which may leading to an out-of-bounds -write error: -BUG: KASAN: slab-out-of-bounds in ath11k_reg_update_chan_list -Call Trace: - ath11k_reg_update_chan_list+0xbfe/0xfe0 [ath11k] - kfree+0x109/0x3a0 - ath11k_regd_update+0x1cf/0x350 [ath11k] - ath11k_regd_update_work+0x14/0x20 [ath11k] - process_one_work+0xe35/0x14c0 - -Should ensure step 2 is completely done before executing step 3. Thus -Wen raised patch[1]. When flag NL80211_REGDOM_SET_BY_DRIVER is set, -cfg80211 will notify ath11k after step 2 is done. - -So enable the flag NL80211_REGDOM_SET_BY_DRIVER then cfg80211 will -notify ath11k after step 2 is done. At this time, there will be no -KASAN bug during the execution of the step 3. - -[1] https://patchwork.kernel.org/project/linux-wireless/patch/20230201065313.27203-1-quic_wgong@quicinc.com/ - -Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3 - -Fixes: f45cb6b29cd3 ("wifi: ath11k: avoid deadlock during regulatory update in ath11k_regd_update()") -Signed-off-by: Wen Gong -Signed-off-by: Kang Yang -Reviewed-by: Aditya Kumar Singh -Link: https://patch.msgid.link/20250117061737.1921-2-quic_kangyang@quicinc.com -Signed-off-by: Jeff Johnson ---- - drivers/net/wireless/ath/ath11k/reg.c | 22 +++++++++++++++------- - 1 file changed, 15 insertions(+), 7 deletions(-) - -diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c -index b0f289784dd3..7bfe47ad62a0 100644 ---- a/drivers/net/wireless/ath/ath11k/reg.c -+++ b/drivers/net/wireless/ath/ath11k/reg.c -@@ -1,7 +1,7 @@ - // SPDX-License-Identifier: BSD-3-Clause-Clear - /* - * Copyright (c) 2018-2019 The Linux Foundation. All rights reserved. -- * Copyright (c) 2021-2024 Qualcomm Innovation Center, Inc. All rights reserved. -+ * Copyright (c) 2021-2025 Qualcomm Innovation Center, Inc. All rights reserved. - */ - #include - -@@ -55,6 +55,19 @@ ath11k_reg_notifier(struct wiphy *wiphy, struct regulatory_request *request) - ath11k_dbg(ar->ab, ATH11K_DBG_REG, - "Regulatory Notification received for %s\n", wiphy_name(wiphy)); - -+ if (request->initiator == NL80211_REGDOM_SET_BY_DRIVER) { -+ ath11k_dbg(ar->ab, ATH11K_DBG_REG, -+ "driver initiated regd update\n"); -+ if (ar->state != ATH11K_STATE_ON) -+ return; -+ -+ ret = ath11k_reg_update_chan_list(ar, true); -+ if (ret) -+ ath11k_warn(ar->ab, "failed to update channel list: %d\n", ret); -+ -+ return; -+ } -+ - /* Currently supporting only General User Hints. Cell base user - * hints to be handled later. - * Hints from other sources like Core, Beacons are not expected for -@@ -293,12 +306,6 @@ int ath11k_regd_update(struct ath11k *ar) - if (ret) - goto err; - -- if (ar->state == ATH11K_STATE_ON) { -- ret = ath11k_reg_update_chan_list(ar, true); -- if (ret) -- goto err; -- } -- - return 0; - err: - ath11k_warn(ab, "failed to perform regd update : %d\n", ret); -@@ -977,6 +984,7 @@ void ath11k_regd_update_work(struct work_struct *work) - void ath11k_reg_init(struct ath11k *ar) - { - ar->hw->wiphy->regulatory_flags = REGULATORY_WIPHY_SELF_MANAGED; -+ ar->hw->wiphy->flags |= WIPHY_FLAG_NOTIFY_REGDOM_BY_DRIVER; - ar->hw->wiphy->reg_notifier = ath11k_reg_notifier; - } - --- -2.43.0 - diff --git a/SPECS/kernel/CVE-2025-38272-1.patch b/SPECS/kernel/CVE-2025-38272-1.patch deleted file mode 100644 index f39cee293a..0000000000 --- a/SPECS/kernel/CVE-2025-38272-1.patch +++ /dev/null @@ -1,89 +0,0 @@ -From adcc861c6c71dfa145c2cc86a306060438899793 Mon Sep 17 00:00:00 2001 -From: "Russell King (Oracle)" -Date: Tue, 10 Dec 2024 14:18:26 +0000 -Subject: [PATCH 06/27] net: dsa: b53/bcm_sf2: implement .support_eee() method - -Implement the .support_eee() method to indicate that EEE is not -supported by two switch variants, rather than making these checks in -the .set_mac_eee() and .get_mac_eee() methods. - -Signed-off-by: Russell King (Oracle) -Reviewed-by: Florian Fainelli -Reviewed-by: Vladimir Oltean -Link: https://patch.msgid.link/E1tL14E-006cZU-Nc@rmk-PC.armlinux.org.uk -Signed-off-by: Jakub Kicinski ---- - drivers/net/dsa/b53/b53_common.c | 13 +++++++------ - drivers/net/dsa/b53/b53_priv.h | 1 + - drivers/net/dsa/bcm_sf2.c | 1 + - 3 files changed, 9 insertions(+), 6 deletions(-) - -diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index 71c30a81c36d..f36dae40d70c 100644 ---- a/drivers/net/dsa/b53/b53_common.c -+++ b/drivers/net/dsa/b53/b53_common.c -@@ -2344,13 +2344,16 @@ int b53_eee_init(struct dsa_switch *ds, int port, struct phy_device *phy) - } - EXPORT_SYMBOL(b53_eee_init); - --int b53_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_keee *e) -+bool b53_support_eee(struct dsa_switch *ds, int port) - { - struct b53_device *dev = ds->priv; - -- if (is5325(dev) || is5365(dev)) -- return -EOPNOTSUPP; -+ return !is5325(dev) && !is5365(dev); -+} -+EXPORT_SYMBOL(b53_support_eee); - -+int b53_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_keee *e) -+{ - return 0; - } - EXPORT_SYMBOL(b53_get_mac_eee); -@@ -2360,9 +2363,6 @@ int b53_set_mac_eee(struct dsa_switch *ds, int port, struct ethtool_keee *e) - struct b53_device *dev = ds->priv; - struct ethtool_keee *p = &dev->ports[port].eee; - -- if (is5325(dev) || is5365(dev)) -- return -EOPNOTSUPP; -- - p->eee_enabled = e->eee_enabled; - b53_eee_enable_set(ds, port, e->eee_enabled); - -@@ -2419,6 +2419,7 @@ static const struct dsa_switch_ops b53_switch_ops = { - .port_setup = b53_setup_port, - .port_enable = b53_enable_port, - .port_disable = b53_disable_port, -+ .support_eee = b53_support_eee, - .get_mac_eee = b53_get_mac_eee, - .set_mac_eee = b53_set_mac_eee, - .port_bridge_join = b53_br_join, -diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h -index 4f8c97098d2a..e908397e8b9a 100644 ---- a/drivers/net/dsa/b53/b53_priv.h -+++ b/drivers/net/dsa/b53/b53_priv.h -@@ -387,6 +387,7 @@ int b53_enable_port(struct dsa_switch *ds, int port, struct phy_device *phy); - void b53_disable_port(struct dsa_switch *ds, int port); - void b53_brcm_hdr_setup(struct dsa_switch *ds, int port); - int b53_eee_init(struct dsa_switch *ds, int port, struct phy_device *phy); -+bool b53_support_eee(struct dsa_switch *ds, int port); - int b53_get_mac_eee(struct dsa_switch *ds, int port, struct ethtool_keee *e); - int b53_set_mac_eee(struct dsa_switch *ds, int port, struct ethtool_keee *e); - -diff --git a/drivers/net/dsa/bcm_sf2.c b/drivers/net/dsa/bcm_sf2.c -index c4771a07878e..f1372830d5fa 100644 ---- a/drivers/net/dsa/bcm_sf2.c -+++ b/drivers/net/dsa/bcm_sf2.c -@@ -1233,6 +1233,7 @@ static const struct dsa_switch_ops bcm_sf2_ops = { - .port_setup = b53_setup_port, - .port_enable = bcm_sf2_port_setup, - .port_disable = bcm_sf2_port_disable, -+ .support_eee = b53_support_eee, - .get_mac_eee = b53_get_mac_eee, - .set_mac_eee = b53_set_mac_eee, - .port_bridge_join = b53_br_join, --- -2.43.0 - diff --git a/SPECS/kernel/CVE-2025-38272-2.patch b/SPECS/kernel/CVE-2025-38272-2.patch deleted file mode 100644 index b5abe20ba0..0000000000 --- a/SPECS/kernel/CVE-2025-38272-2.patch +++ /dev/null @@ -1,52 +0,0 @@ -From e6ce4c185e8582c3627f71245ded22194363f954 Mon Sep 17 00:00:00 2001 -From: Jonas Gorski -Date: Mon, 2 Jun 2025 21:39:49 +0200 -Subject: [PATCH 07/27] net: dsa: b53: do not enable EEE on bcm63xx -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -BCM63xx internal switches do not support EEE, but provide multiple RGMII -ports where external PHYs may be connected. If one of these PHYs are EEE -capable, we may try to enable EEE for the MACs, which then hangs the -system on access of the (non-existent) EEE registers. - -Fix this by checking if the switch actually supports EEE before -attempting to configure it. - -Fixes: 22256b0afb12 ("net: dsa: b53: Move EEE functions to b53") -Reviewed-by: Florian Fainelli -Tested-by: Álvaro Fernández Rojas -Signed-off-by: Jonas Gorski -Link: https://patch.msgid.link/20250602193953.1010487-2-jonas.gorski@gmail.com -Signed-off-by: Paolo Abeni ---- - drivers/net/dsa/b53/b53_common.c | 5 ++++- - 1 file changed, 4 insertions(+), 1 deletion(-) - -diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c -index f36dae40d70c..daee9302b56f 100644 ---- a/drivers/net/dsa/b53/b53_common.c -+++ b/drivers/net/dsa/b53/b53_common.c -@@ -2334,6 +2334,9 @@ int b53_eee_init(struct dsa_switch *ds, int port, struct phy_device *phy) - { - int ret; - -+ if (!b53_support_eee(ds, port)) -+ return 0; -+ - ret = phy_init_eee(phy, false); - if (ret) - return 0; -@@ -2348,7 +2351,7 @@ bool b53_support_eee(struct dsa_switch *ds, int port) - { - struct b53_device *dev = ds->priv; - -- return !is5325(dev) && !is5365(dev); -+ return !is5325(dev) && !is5365(dev) && !is63xx(dev); - } - EXPORT_SYMBOL(b53_support_eee); - --- -2.43.0 - diff --git a/SPECS/kernel/CVE-2025-38272.patch b/SPECS/kernel/CVE-2025-38272.patch deleted file mode 100644 index d8bb66ec17..0000000000 --- a/SPECS/kernel/CVE-2025-38272.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 232555317cddf41ff4f9c8ec66c5ff89547ea1e7 Mon Sep 17 00:00:00 2001 -From: "Russell King (Oracle)" -Date: Tue, 10 Dec 2024 14:18:16 +0000 -Subject: [PATCH 05/27] net: dsa: add hook to determine whether EEE is - supported - -Add a hook to determine whether the switch supports EEE. This will -return false if the switch does not, or true if it does. If the -method is not implemented, we assume (currently) that the switch -supports EEE. - -Signed-off-by: Russell King (Oracle) -Reviewed-by: Florian Fainelli -Reviewed-by: Vladimir Oltean -Link: https://patch.msgid.link/E1tL144-006cZD-El@rmk-PC.armlinux.org.uk -Signed-off-by: Jakub Kicinski ---- - include/net/dsa.h | 1 + - net/dsa/user.c | 8 ++++++++ - 2 files changed, 9 insertions(+) - -diff --git a/include/net/dsa.h b/include/net/dsa.h -index d7a6c2930277..fa99fc5249e9 100644 ---- a/include/net/dsa.h -+++ b/include/net/dsa.h -@@ -1003,6 +1003,7 @@ struct dsa_switch_ops { - /* - * Port's MAC EEE settings - */ -+ bool (*support_eee)(struct dsa_switch *ds, int port); - int (*set_mac_eee)(struct dsa_switch *ds, int port, - struct ethtool_keee *e); - int (*get_mac_eee)(struct dsa_switch *ds, int port, -diff --git a/net/dsa/user.c b/net/dsa/user.c -index 64f660d2334b..06267c526dc4 100644 ---- a/net/dsa/user.c -+++ b/net/dsa/user.c -@@ -1231,6 +1231,10 @@ static int dsa_user_set_eee(struct net_device *dev, struct ethtool_keee *e) - struct dsa_switch *ds = dp->ds; - int ret; - -+ /* Check whether the switch supports EEE */ -+ if (ds->ops->support_eee && !ds->ops->support_eee(ds, dp->index)) -+ return -EOPNOTSUPP; -+ - /* Port's PHY and MAC both need to be EEE capable */ - if (!dev->phydev || !dp->pl) - return -ENODEV; -@@ -1251,6 +1255,10 @@ static int dsa_user_get_eee(struct net_device *dev, struct ethtool_keee *e) - struct dsa_switch *ds = dp->ds; - int ret; - -+ /* Check whether the switch supports EEE */ -+ if (ds->ops->support_eee && !ds->ops->support_eee(ds, dp->index)) -+ return -EOPNOTSUPP; -+ - /* Port's PHY and MAC both need to be EEE capable */ - if (!dev->phydev || !dp->pl) - return -ENODEV; --- -2.43.0 - diff --git a/SPECS/kernel/CVE-2025-38306.patch b/SPECS/kernel/CVE-2025-38306.patch deleted file mode 100644 index 2725894164..0000000000 --- a/SPECS/kernel/CVE-2025-38306.patch +++ /dev/null @@ -1,136 +0,0 @@ -From 53ca1616118eb6c5c4e21109c6b5426535e12eb2 Mon Sep 17 00:00:00 2001 -From: Al Viro -Date: Sun, 1 Jun 2025 14:23:52 -0400 -Subject: [PATCH] fs/fhandle.c: fix a race in call of has_locked_children() - -may_decode_fh() is calling has_locked_children() while holding no locks. -That's an oopsable race... - -The rest of the callers are safe since they are holding namespace_sem and -are guaranteed a positive refcount on the mount in question. - -Rename the current has_locked_children() to __has_locked_children(), make -it static and switch the fs/namespace.c users to it. - -Make has_locked_children() a wrapper for __has_locked_children(), calling -the latter under read_seqlock_excl(&mount_lock). - -Reviewed-by: Christian Brauner -Reviewed-by: Jeff Layton -Fixes: 620c266f3949 ("fhandle: relax open_by_handle_at() permission checks") -Signed-off-by: Al Viro ---- - fs/namespace.c | 62 +++++++++++++++++++++++++++++--------------------- - 1 file changed, 36 insertions(+), 26 deletions(-) - -diff --git a/fs/namespace.c b/fs/namespace.c -index 962fda4fa246..066c06c8a188 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -2227,7 +2227,7 @@ void drop_collected_mounts(struct vfsmount *mnt) - namespace_unlock(); - } - --bool has_locked_children(struct mount *mnt, struct dentry *dentry) -+static bool __has_locked_children(struct mount *mnt, struct dentry *dentry) - { - struct mount *child; - -@@ -2241,6 +2241,38 @@ bool has_locked_children(struct mount *mnt, struct dentry *dentry) - return false; - } - -+bool has_locked_children(struct mount *mnt, struct dentry *dentry) -+{ -+ bool res; -+ -+ read_seqlock_excl(&mount_lock); -+ res = __has_locked_children(mnt, dentry); -+ read_sequnlock_excl(&mount_lock); -+ return res; -+} -+ -+/* -+ * Check that there aren't references to earlier/same mount namespaces in the -+ * specified subtree. Such references can act as pins for mount namespaces -+ * that aren't checked by the mount-cycle checking code, thereby allowing -+ * cycles to be made. -+ */ -+static bool check_for_nsfs_mounts(struct mount *subtree) -+{ -+ struct mount *p; -+ bool ret = false; -+ -+ lock_mount_hash(); -+ for (p = subtree; p; p = next_mnt(p, subtree)) -+ if (mnt_ns_loop(p->mnt.mnt_root)) -+ goto out; -+ -+ ret = true; -+out: -+ unlock_mount_hash(); -+ return ret; -+} -+ - /** - * clone_private_mount - create a private clone of a path - * @path: path to clone -@@ -2268,7 +2300,7 @@ struct vfsmount *clone_private_mount(const struct path *path) - return ERR_PTR(-EPERM); - } - -- if (has_locked_children(old_mnt, path->dentry)) -+ if (__has_locked_children(old_mnt, path->dentry)) - goto invalid; - - new_mnt = clone_mnt(old_mnt, path->dentry, CL_PRIVATE); -@@ -2762,7 +2794,7 @@ static struct mount *__do_loopback(struct path *old_path, int recurse) - if (!check_mnt(old) && old_path->dentry->d_op != &ns_dentry_operations) - return mnt; - -- if (!recurse && has_locked_children(old, old_path->dentry)) -+ if (!recurse && __has_locked_children(old, old_path->dentry)) - return mnt; - - if (recurse) -@@ -3097,28 +3129,6 @@ static inline int tree_contains_unbindable(struct mount *mnt) - return 0; - } - --/* -- * Check that there aren't references to earlier/same mount namespaces in the -- * specified subtree. Such references can act as pins for mount namespaces -- * that aren't checked by the mount-cycle checking code, thereby allowing -- * cycles to be made. -- */ --static bool check_for_nsfs_mounts(struct mount *subtree) --{ -- struct mount *p; -- bool ret = false; -- -- lock_mount_hash(); -- for (p = subtree; p; p = next_mnt(p, subtree)) -- if (mnt_ns_loop(p->mnt.mnt_root)) -- goto out; -- -- ret = true; --out: -- unlock_mount_hash(); -- return ret; --} -- - static int do_set_group(struct path *from_path, struct path *to_path) - { - struct mount *from, *to; -@@ -3152,7 +3162,7 @@ static int do_set_group(struct path *from_path, struct path *to_path) - goto out; - - /* From mount should not have locked children in place of To's root */ -- if (has_locked_children(from, to->mnt.mnt_root)) -+ if (__has_locked_children(from, to->mnt.mnt_root)) - goto out; - - /* Setting sharing groups is only allowed on private mounts */ --- -2.43.0 - diff --git a/SPECS/kernel/CVE-2025-38502.patch b/SPECS/kernel/CVE-2025-38502.patch deleted file mode 100644 index ada07fcfbf..0000000000 --- a/SPECS/kernel/CVE-2025-38502.patch +++ /dev/null @@ -1,143 +0,0 @@ -From 948ea4b9d31826977c5bd558e47de2322afeb52b Mon Sep 17 00:00:00 2001 -From: Daniel Borkmann -Date: Thu, 31 Jul 2025 01:47:33 +0200 -Subject: [PATCH 2/4] bpf: Fix oob access in cgroup local storage - -Lonial reported that an out-of-bounds access in cgroup local storage -can be crafted via tail calls. Given two programs each utilizing a -cgroup local storage with a different value size, and one program -doing a tail call into the other. The verifier will validate each of -the indivial programs just fine. However, in the runtime context -the bpf_cg_run_ctx holds an bpf_prog_array_item which contains the -BPF program as well as any cgroup local storage flavor the program -uses. Helpers such as bpf_get_local_storage() pick this up from the -runtime context: - - ctx = container_of(current->bpf_ctx, struct bpf_cg_run_ctx, run_ctx); - storage = ctx->prog_item->cgroup_storage[stype]; - - if (stype == BPF_CGROUP_STORAGE_SHARED) - ptr = &READ_ONCE(storage->buf)->data[0]; - else - ptr = this_cpu_ptr(storage->percpu_buf); - -For the second program which was called from the originally attached -one, this means bpf_get_local_storage() will pick up the former -program's map, not its own. With mismatching sizes, this can result -in an unintended out-of-bounds access. - -To fix this issue, we need to extend bpf_map_owner with an array of -storage_cookie[] to match on i) the exact maps from the original -program if the second program was using bpf_get_local_storage(), or -ii) allow the tail call combination if the second program was not -using any of the cgroup local storage maps. - -Fixes: 7d9c3427894f ("bpf: Make cgroup storages shared between programs on the same cgroup") -Reported-by: Lonial Con -Signed-off-by: Daniel Borkmann -Link: https://lore.kernel.org/r/20250730234733.530041-4-daniel@iogearbox.net -Signed-off-by: Alexei Starovoitov ---- ---- - include/linux/bpf.h | 25 +++++++++++++++++-------- - kernel/bpf/core.c | 15 +++++++++++++++ - 2 files changed, 32 insertions(+), 8 deletions(-) - -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 1150a595aa54..66a0ffe9bae3 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -205,6 +205,21 @@ enum btf_field_type { - BPF_WORKQUEUE = (1 << 10), - }; - -+enum bpf_cgroup_storage_type { -+ BPF_CGROUP_STORAGE_SHARED, -+ BPF_CGROUP_STORAGE_PERCPU, -+ __BPF_CGROUP_STORAGE_MAX -+}; -+ -+#define MAX_BPF_CGROUP_STORAGE_TYPE __BPF_CGROUP_STORAGE_MAX -+ -+#ifdef CONFIG_CGROUP_BPF -+# define for_each_cgroup_storage_type(stype) \ -+ for (stype = 0; stype < MAX_BPF_CGROUP_STORAGE_TYPE; stype++) -+#else -+# define for_each_cgroup_storage_type(stype) for (; false; ) -+#endif /* CONFIG_CGROUP_BPF */ -+ - typedef void (*btf_dtor_kfunc_t)(void *); - - struct btf_field_kptr { -@@ -298,6 +313,7 @@ struct bpf_map { - spinlock_t lock; - enum bpf_prog_type type; - bool jited; -+ u64 storage_cookie[MAX_BPF_CGROUP_STORAGE_TYPE]; - bool xdp_has_frags; - } owner; - bool bypass_spec_v1; -@@ -306,6 +322,7 @@ struct bpf_map { - bool free_after_rcu_gp; - atomic64_t sleepable_refcnt; - s64 __percpu *elem_count; -+ u64 cookie; /* write-once */ - }; - - static inline const char *btf_field_type_name(enum btf_field_type type) -@@ -1025,14 +1042,6 @@ struct bpf_prog_offload { - u32 jited_len; - }; - --enum bpf_cgroup_storage_type { -- BPF_CGROUP_STORAGE_SHARED, -- BPF_CGROUP_STORAGE_PERCPU, -- __BPF_CGROUP_STORAGE_MAX --}; -- --#define MAX_BPF_CGROUP_STORAGE_TYPE __BPF_CGROUP_STORAGE_MAX -- - /* The longest tracepoint has 12 args. - * See include/trace/bpf_probe.h - */ -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index 767dcb8471f6..b714362a297c 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -2312,6 +2312,8 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, - enum bpf_prog_type prog_type = resolve_prog_type(fp); - bool ret; - struct bpf_prog_aux *aux = fp->aux; -+ enum bpf_cgroup_storage_type i; -+ u64 cookie; - - if (fp->kprobe_override) - return false; -@@ -2325,11 +2327,24 @@ static bool __bpf_prog_map_compatible(struct bpf_map *map, - map->owner.jited = fp->jited; - map->owner.xdp_has_frags = aux->xdp_has_frags; - map->owner.attach_func_proto = aux->attach_func_proto; -+ for_each_cgroup_storage_type(i) { -+ map->owner.storage_cookie[i] = -+ aux->cgroup_storage[i] ? -+ aux->cgroup_storage[i]->cookie : 0; -+ } - ret = true; - } else { - ret = map->owner.type == prog_type && - map->owner.jited == fp->jited && - map->owner.xdp_has_frags == aux->xdp_has_frags; -+ for_each_cgroup_storage_type(i) { -+ if (!ret) -+ break; -+ cookie = aux->cgroup_storage[i] ? -+ aux->cgroup_storage[i]->cookie : 0; -+ ret = map->owner.storage_cookie[i] == cookie || -+ !cookie; -+ } - if (ret && - map->owner.attach_func_proto != aux->attach_func_proto) { - switch (prog_type) { --- -2.43.0 - diff --git a/SPECS/kernel/CVE-2025-39677.patch b/SPECS/kernel/CVE-2025-39677.patch new file mode 100644 index 0000000000..6f075526c7 --- /dev/null +++ b/SPECS/kernel/CVE-2025-39677.patch @@ -0,0 +1,313 @@ +From 6475c4fdc534ff8302069efc313e47a9617963fc Mon Sep 17 00:00:00 2001 +From: William Liu +Date: Tue, 12 Aug 2025 23:57:57 +0000 +Subject: [PATCH 4/4] net/sched: Fix backlog accounting in + qdisc_dequeue_internal + +This issue applies for the following qdiscs: hhf, fq, fq_codel, and +fq_pie, and occurs in their change handlers when adjusting to the new +limit. The problem is the following in the values passed to the +subsequent qdisc_tree_reduce_backlog call given a tbf parent: + + When the tbf parent runs out of tokens, skbs of these qdiscs will + be placed in gso_skb. Their peek handlers are qdisc_peek_dequeued, + which accounts for both qlen and backlog. However, in the case of + qdisc_dequeue_internal, ONLY qlen is accounted for when pulling + from gso_skb. This means that these qdiscs are missing a + qdisc_qstats_backlog_dec when dropping packets to satisfy the + new limit in their change handlers. + + One can observe this issue with the following (with tc patched to + support a limit of 0): + + export TARGET=fq + tc qdisc del dev lo root + tc qdisc add dev lo root handle 1: tbf rate 8bit burst 100b latency 1ms + tc qdisc replace dev lo handle 3: parent 1:1 $TARGET limit 1000 + echo ''; echo 'add child'; tc -s -d qdisc show dev lo + ping -I lo -f -c2 -s32 -W0.001 127.0.0.1 2>&1 >/dev/null + echo ''; echo 'after ping'; tc -s -d qdisc show dev lo + tc qdisc change dev lo handle 3: parent 1:1 $TARGET limit 0 + echo ''; echo 'after limit drop'; tc -s -d qdisc show dev lo + tc qdisc replace dev lo handle 2: parent 1:1 sfq + echo ''; echo 'post graft'; tc -s -d qdisc show dev lo + + The second to last show command shows 0 packets but a positive + number (74) of backlog bytes. The problem becomes clearer in the + last show command, where qdisc_purge_queue triggers + qdisc_tree_reduce_backlog with the positive backlog and causes an + underflow in the tbf parent's backlog (4096 Mb instead of 0). + +To fix this issue, the codepath for all clients of qdisc_dequeue_internal +has been simplified: codel, pie, hhf, fq, fq_pie, and fq_codel. +qdisc_dequeue_internal handles the backlog adjustments for all cases that +do not directly use the dequeue handler. + +The old fq_codel_change limit adjustment loop accumulated the arguments to +the subsequent qdisc_tree_reduce_backlog call through the cstats field. +However, this is confusing and error prone as fq_codel_dequeue could also +potentially mutate this field (which qdisc_dequeue_internal calls in the +non gso_skb case), so we have unified the code here with other qdiscs. + +Fixes: 2d3cbfd6d54a ("net_sched: Flush gso_skb list too during ->change()") +Fixes: 4b549a2ef4be ("fq_codel: Fair Queue Codel AQM") +Fixes: 10239edf86f1 ("net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc") +Signed-off-by: William Liu +Reviewed-by: Savino Dicanosa +Link: https://patch.msgid.link/20250812235725.45243-1-will@willsroot.io +Signed-off-by: Jakub Kicinski +--- + include/net/sch_generic.h | 11 ++++++++--- + net/sched/sch_codel.c | 12 +++++++----- + net/sched/sch_fq.c | 12 +++++++----- + net/sched/sch_fq_codel.c | 12 +++++++----- + net/sched/sch_fq_pie.c | 12 +++++++----- + net/sched/sch_hhf.c | 12 +++++++----- + net/sched/sch_pie.c | 12 +++++++----- + 7 files changed, 50 insertions(+), 33 deletions(-) + +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index a9d7e9ecee6b5..f0f64beb9486f 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -1038,12 +1038,17 @@ static inline struct sk_buff *qdisc_dequeue_internal(struct Qdisc *sch, bool dir + skb = __skb_dequeue(&sch->gso_skb); + if (skb) { + sch->q.qlen--; ++ qdisc_qstats_backlog_dec(sch, skb); + return skb; + } +- if (direct) +- return __qdisc_dequeue_head(&sch->q); +- else ++ if (direct) { ++ skb = __qdisc_dequeue_head(&sch->q); ++ if (skb) ++ qdisc_qstats_backlog_dec(sch, skb); ++ return skb; ++ } else { + return sch->dequeue(sch); ++ } + } + + static inline struct sk_buff *qdisc_dequeue_head(struct Qdisc *sch) +diff --git a/net/sched/sch_codel.c b/net/sched/sch_codel.c +index afd9805cb68e2..655eb64cd1761 100644 +--- a/net/sched/sch_codel.c ++++ b/net/sched/sch_codel.c +@@ -100,9 +100,9 @@ static const struct nla_policy codel_policy[TCA_CODEL_MAX + 1] = { + static int codel_change(struct Qdisc *sch, struct nlattr *opt, + struct netlink_ext_ack *extack) + { ++ unsigned int dropped_pkts = 0, dropped_bytes = 0; + struct codel_sched_data *q = qdisc_priv(sch); + struct nlattr *tb[TCA_CODEL_MAX + 1]; +- unsigned int qlen, dropped = 0; + int err; + + err = nla_parse_nested_deprecated(tb, TCA_CODEL_MAX, opt, +@@ -141,15 +141,17 @@ static int codel_change(struct Qdisc *sch, struct nlattr *opt, + WRITE_ONCE(q->params.ecn, + !!nla_get_u32(tb[TCA_CODEL_ECN])); + +- qlen = sch->q.qlen; + while (sch->q.qlen > sch->limit) { + struct sk_buff *skb = qdisc_dequeue_internal(sch, true); + +- dropped += qdisc_pkt_len(skb); +- qdisc_qstats_backlog_dec(sch, skb); ++ if (!skb) ++ break; ++ ++ dropped_pkts++; ++ dropped_bytes += qdisc_pkt_len(skb); + rtnl_qdisc_drop(skb, sch); + } +- qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, dropped); ++ qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); + + sch_tree_unlock(sch); + return 0; +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index 1af9768cd8ff6..df11a54e390cf 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -1001,11 +1001,11 @@ static int fq_load_priomap(struct fq_sched_data *q, + static int fq_change(struct Qdisc *sch, struct nlattr *opt, + struct netlink_ext_ack *extack) + { ++ unsigned int dropped_pkts = 0, dropped_bytes = 0; + struct fq_sched_data *q = qdisc_priv(sch); + struct nlattr *tb[TCA_FQ_MAX + 1]; +- int err, drop_count = 0; +- unsigned drop_len = 0; + u32 fq_log; ++ int err; + + err = nla_parse_nested_deprecated(tb, TCA_FQ_MAX, opt, fq_policy, + NULL); +@@ -1112,16 +1112,18 @@ static int fq_change(struct Qdisc *sch, struct nlattr *opt, + err = fq_resize(sch, fq_log); + sch_tree_lock(sch); + } ++ + while (sch->q.qlen > sch->limit) { + struct sk_buff *skb = qdisc_dequeue_internal(sch, false); + + if (!skb) + break; +- drop_len += qdisc_pkt_len(skb); ++ ++ dropped_pkts++; ++ dropped_bytes += qdisc_pkt_len(skb); + rtnl_kfree_skbs(skb, skb); +- drop_count++; + } +- qdisc_tree_reduce_backlog(sch, drop_count, drop_len); ++ qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); + + sch_tree_unlock(sch); + return err; +diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c +index 551b7cbdae90c..5e4c69d4df419 100644 +--- a/net/sched/sch_fq_codel.c ++++ b/net/sched/sch_fq_codel.c +@@ -365,6 +365,7 @@ static const struct nla_policy fq_codel_policy[TCA_FQ_CODEL_MAX + 1] = { + static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, + struct netlink_ext_ack *extack) + { ++ unsigned int dropped_pkts = 0, dropped_bytes = 0; + struct fq_codel_sched_data *q = qdisc_priv(sch); + struct nlattr *tb[TCA_FQ_CODEL_MAX + 1]; + u32 quantum = 0; +@@ -442,13 +443,14 @@ static int fq_codel_change(struct Qdisc *sch, struct nlattr *opt, + q->memory_usage > q->memory_limit) { + struct sk_buff *skb = qdisc_dequeue_internal(sch, false); + +- q->cstats.drop_len += qdisc_pkt_len(skb); ++ if (!skb) ++ break; ++ ++ dropped_pkts++; ++ dropped_bytes += qdisc_pkt_len(skb); + rtnl_kfree_skbs(skb, skb); +- q->cstats.drop_count++; + } +- qdisc_tree_reduce_backlog(sch, q->cstats.drop_count, q->cstats.drop_len); +- q->cstats.drop_count = 0; +- q->cstats.drop_len = 0; ++ qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); + + sch_tree_unlock(sch); + return 0; +diff --git a/net/sched/sch_fq_pie.c b/net/sched/sch_fq_pie.c +index 6ed08b705f8a5..5881d34d58b49 100644 +--- a/net/sched/sch_fq_pie.c ++++ b/net/sched/sch_fq_pie.c +@@ -285,10 +285,9 @@ static struct sk_buff *fq_pie_qdisc_dequeue(struct Qdisc *sch) + static int fq_pie_change(struct Qdisc *sch, struct nlattr *opt, + struct netlink_ext_ack *extack) + { ++ unsigned int dropped_pkts = 0, dropped_bytes = 0; + struct fq_pie_sched_data *q = qdisc_priv(sch); + struct nlattr *tb[TCA_FQ_PIE_MAX + 1]; +- unsigned int len_dropped = 0; +- unsigned int num_dropped = 0; + int err; + + err = nla_parse_nested(tb, TCA_FQ_PIE_MAX, opt, fq_pie_policy, extack); +@@ -366,11 +365,14 @@ static int fq_pie_change(struct Qdisc *sch, struct nlattr *opt, + while (sch->q.qlen > sch->limit) { + struct sk_buff *skb = qdisc_dequeue_internal(sch, false); + +- len_dropped += qdisc_pkt_len(skb); +- num_dropped += 1; ++ if (!skb) ++ break; ++ ++ dropped_pkts++; ++ dropped_bytes += qdisc_pkt_len(skb); + rtnl_kfree_skbs(skb, skb); + } +- qdisc_tree_reduce_backlog(sch, num_dropped, len_dropped); ++ qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); + + sch_tree_unlock(sch); + return 0; +diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c +index 5aa434b467073..2d4855e28a286 100644 +--- a/net/sched/sch_hhf.c ++++ b/net/sched/sch_hhf.c +@@ -508,9 +508,9 @@ static const struct nla_policy hhf_policy[TCA_HHF_MAX + 1] = { + static int hhf_change(struct Qdisc *sch, struct nlattr *opt, + struct netlink_ext_ack *extack) + { ++ unsigned int dropped_pkts = 0, dropped_bytes = 0; + struct hhf_sched_data *q = qdisc_priv(sch); + struct nlattr *tb[TCA_HHF_MAX + 1]; +- unsigned int qlen, prev_backlog; + int err; + u64 non_hh_quantum; + u32 new_quantum = q->quantum; +@@ -561,15 +561,17 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt, + usecs_to_jiffies(us)); + } + +- qlen = sch->q.qlen; +- prev_backlog = sch->qstats.backlog; + while (sch->q.qlen > sch->limit) { + struct sk_buff *skb = qdisc_dequeue_internal(sch, false); + ++ if (!skb) ++ break; ++ ++ dropped_pkts++; ++ dropped_bytes += qdisc_pkt_len(skb); + rtnl_kfree_skbs(skb, skb); + } +- qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, +- prev_backlog - sch->qstats.backlog); ++ qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); + + sch_tree_unlock(sch); + return 0; +diff --git a/net/sched/sch_pie.c b/net/sched/sch_pie.c +index db61cbc21b138..a6a5874f4c3a9 100644 +--- a/net/sched/sch_pie.c ++++ b/net/sched/sch_pie.c +@@ -138,9 +138,9 @@ static const struct nla_policy pie_policy[TCA_PIE_MAX + 1] = { + static int pie_change(struct Qdisc *sch, struct nlattr *opt, + struct netlink_ext_ack *extack) + { ++ unsigned int dropped_pkts = 0, dropped_bytes = 0; + struct pie_sched_data *q = qdisc_priv(sch); + struct nlattr *tb[TCA_PIE_MAX + 1]; +- unsigned int qlen, dropped = 0; + int err; + + err = nla_parse_nested_deprecated(tb, TCA_PIE_MAX, opt, pie_policy, +@@ -190,15 +190,17 @@ static int pie_change(struct Qdisc *sch, struct nlattr *opt, + nla_get_u32(tb[TCA_PIE_DQ_RATE_ESTIMATOR])); + + /* Drop excess packets if new limit is lower */ +- qlen = sch->q.qlen; + while (sch->q.qlen > sch->limit) { + struct sk_buff *skb = qdisc_dequeue_internal(sch, true); + +- dropped += qdisc_pkt_len(skb); +- qdisc_qstats_backlog_dec(sch, skb); ++ if (!skb) ++ break; ++ ++ dropped_pkts++; ++ dropped_bytes += qdisc_pkt_len(skb); + rtnl_qdisc_drop(skb, sch); + } +- qdisc_tree_reduce_backlog(sch, qlen - sch->q.qlen, dropped); ++ qdisc_tree_reduce_backlog(sch, dropped_pkts, dropped_bytes); + + sch_tree_unlock(sch); + return 0; +-- +2.43.0 + diff --git a/SPECS/kernel/CVE-2025-39745.patch b/SPECS/kernel/CVE-2025-39745.patch new file mode 100644 index 0000000000..86b7b34554 --- /dev/null +++ b/SPECS/kernel/CVE-2025-39745.patch @@ -0,0 +1,52 @@ +From 75aa7cb87d85ed76966c409bd5d80266d9c77b17 Mon Sep 17 00:00:00 2001 +From: Zqiang +Date: Wed, 7 May 2025 19:26:03 +0800 +Subject: [PATCH 3/4] rcutorture: Fix rcutorture_one_extend_check() splat in RT + kernels + +For built with CONFIG_PREEMPT_RT=y kernels, running rcutorture +tests resulted in the following splat: + +[ 68.797425] rcutorture_one_extend_check during change: Current 0x1 To add 0x1 To remove 0x0 preempt_count() 0x0 +[ 68.797533] WARNING: CPU: 2 PID: 512 at kernel/rcu/rcutorture.c:1993 rcutorture_one_extend_check+0x419/0x560 [rcutorture] +[ 68.797601] Call Trace: +[ 68.797602] +[ 68.797619] ? lockdep_softirqs_off+0xa5/0x160 +[ 68.797631] rcutorture_one_extend+0x18e/0xcc0 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] +[ 68.797646] ? local_clock+0x19/0x40 +[ 68.797659] rcu_torture_one_read+0xf0/0x280 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] +[ 68.797678] ? __pfx_rcu_torture_one_read+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] +[ 68.797804] ? __pfx_rcu_torture_timer+0x10/0x10 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] +[ 68.797815] rcu-torture: rcu_torture_reader task started +[ 68.797824] rcu-torture: Creating rcu_torture_reader task +[ 68.797824] rcu_torture_reader+0x238/0x580 [rcutorture 2466dbd2ff34dbaa36049cb323a80c3306ac997c] +[ 68.797836] ? kvm_sched_clock_read+0x15/0x30 + +Disable BH does not change the SOFTIRQ corresponding bits in +preempt_count() for RT kernels, this commit therefore use +softirq_count() to check the if BH is disabled. + +Reviewed-by: Paul E. McKenney +Signed-off-by: Zqiang +Signed-off-by: Joel Fernandes +Signed-off-by: Neeraj Upadhyay (AMD) +--- + kernel/rcu/rcutorture.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/kernel/rcu/rcutorture.c b/kernel/rcu/rcutorture.c +index 609687fd742d5..b3c8651f14729 100644 +--- a/kernel/rcu/rcutorture.c ++++ b/kernel/rcu/rcutorture.c +@@ -430,7 +430,7 @@ rcu_read_delay(struct torture_random_state *rrsp, struct rt_read_seg *rtrsp) + !(torture_random(rrsp) % (nrealreaders * 2000 * longdelay_ms))) { + started = cur_ops->get_gp_seq(); + ts = rcu_trace_clock_local(); +- if (preempt_count() & (SOFTIRQ_MASK | HARDIRQ_MASK)) ++ if ((preempt_count() & HARDIRQ_MASK) || softirq_count()) + longdelay_ms = 5; /* Avoid triggering BH limits. */ + mdelay(longdelay_ms); + rtrsp->rt_delay_ms = longdelay_ms; +-- +2.43.0 + diff --git a/SPECS/kernel/CVE-2025-39764.patch b/SPECS/kernel/CVE-2025-39764.patch new file mode 100644 index 0000000000..51b13efc30 --- /dev/null +++ b/SPECS/kernel/CVE-2025-39764.patch @@ -0,0 +1,160 @@ +From 8dbe282d028de5d53c830caa6f801089803b0dbf Mon Sep 17 00:00:00 2001 +From: Florian Westphal +Date: Fri, 1 Aug 2025 17:25:09 +0200 +Subject: [PATCH 2/4] netfilter: ctnetlink: remove refcounting in expectation + dumpers + +Same pattern as previous patch: do not keep the expectation object +alive via refcount, only store a cookie value and then use that +as the skip hint for dump resumption. + +AFAICS this has the same issue as the one resolved in the conntrack +dumper, when we do + if (!refcount_inc_not_zero(&exp->use)) + +to increment the refcount, there is a chance that exp == last, which +causes a double-increment of the refcount and subsequent memory leak. + +Fixes: cf6994c2b981 ("[NETFILTER]: nf_conntrack_netlink: sync expectation dumping with conntrack table dumping") +Fixes: e844a928431f ("netfilter: ctnetlink: allow to dump expectation per master conntrack") +Signed-off-by: Florian Westphal +Signed-off-by: Pablo Neira Ayuso +--- + net/netfilter/nf_conntrack_netlink.c | 41 ++++++++++++---------------- + 1 file changed, 17 insertions(+), 24 deletions(-) + +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 18a91c031554c..13836723223e0 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -3146,23 +3146,27 @@ ctnetlink_expect_event(unsigned int events, const struct nf_exp_event *item) + return 0; + } + #endif +-static int ctnetlink_exp_done(struct netlink_callback *cb) ++ ++static unsigned long ctnetlink_exp_id(const struct nf_conntrack_expect *exp) + { +- if (cb->args[1]) +- nf_ct_expect_put((struct nf_conntrack_expect *)cb->args[1]); +- return 0; ++ unsigned long id = (unsigned long)exp; ++ ++ id += nf_ct_get_id(exp->master); ++ id += exp->class; ++ ++ return id ? id : 1; + } + + static int + ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + { + struct net *net = sock_net(skb->sk); +- struct nf_conntrack_expect *exp, *last; + struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); + u_int8_t l3proto = nfmsg->nfgen_family; ++ unsigned long last_id = cb->args[1]; ++ struct nf_conntrack_expect *exp; + + rcu_read_lock(); +- last = (struct nf_conntrack_expect *)cb->args[1]; + for (; cb->args[0] < nf_ct_expect_hsize; cb->args[0]++) { + restart: + hlist_for_each_entry_rcu(exp, &nf_ct_expect_hash[cb->args[0]], +@@ -3174,7 +3178,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + continue; + + if (cb->args[1]) { +- if (exp != last) ++ if (ctnetlink_exp_id(exp) != last_id) + continue; + cb->args[1] = 0; + } +@@ -3183,9 +3187,7 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + cb->nlh->nlmsg_seq, + IPCTNL_MSG_EXP_NEW, + exp) < 0) { +- if (!refcount_inc_not_zero(&exp->use)) +- continue; +- cb->args[1] = (unsigned long)exp; ++ cb->args[1] = ctnetlink_exp_id(exp); + goto out; + } + } +@@ -3196,32 +3198,30 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + } + out: + rcu_read_unlock(); +- if (last) +- nf_ct_expect_put(last); +- + return skb->len; + } + + static int + ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + { +- struct nf_conntrack_expect *exp, *last; + struct nfgenmsg *nfmsg = nlmsg_data(cb->nlh); + struct nf_conn *ct = cb->data; + struct nf_conn_help *help = nfct_help(ct); + u_int8_t l3proto = nfmsg->nfgen_family; ++ unsigned long last_id = cb->args[1]; ++ struct nf_conntrack_expect *exp; + + if (cb->args[0]) + return 0; + + rcu_read_lock(); +- last = (struct nf_conntrack_expect *)cb->args[1]; ++ + restart: + hlist_for_each_entry_rcu(exp, &help->expectations, lnode) { + if (l3proto && exp->tuple.src.l3num != l3proto) + continue; + if (cb->args[1]) { +- if (exp != last) ++ if (ctnetlink_exp_id(exp) != last_id) + continue; + cb->args[1] = 0; + } +@@ -3229,9 +3229,7 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + cb->nlh->nlmsg_seq, + IPCTNL_MSG_EXP_NEW, + exp) < 0) { +- if (!refcount_inc_not_zero(&exp->use)) +- continue; +- cb->args[1] = (unsigned long)exp; ++ cb->args[1] = ctnetlink_exp_id(exp); + goto out; + } + } +@@ -3242,9 +3240,6 @@ ctnetlink_exp_ct_dump_table(struct sk_buff *skb, struct netlink_callback *cb) + cb->args[0] = 1; + out: + rcu_read_unlock(); +- if (last) +- nf_ct_expect_put(last); +- + return skb->len; + } + +@@ -3263,7 +3258,6 @@ static int ctnetlink_dump_exp_ct(struct net *net, struct sock *ctnl, + struct nf_conntrack_zone zone; + struct netlink_dump_control c = { + .dump = ctnetlink_exp_ct_dump_table, +- .done = ctnetlink_exp_done, + }; + + err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_MASTER, +@@ -3313,7 +3307,6 @@ static int ctnetlink_get_expect(struct sk_buff *skb, + else { + struct netlink_dump_control c = { + .dump = ctnetlink_exp_dump_table, +- .done = ctnetlink_exp_done, + }; + return netlink_dump_start(info->sk, skb, info->nlh, &c); + } +-- +2.43.0 + diff --git a/SPECS/kernel/CVE-2025-39789.patch b/SPECS/kernel/CVE-2025-39789.patch new file mode 100644 index 0000000000..10a29845b4 --- /dev/null +++ b/SPECS/kernel/CVE-2025-39789.patch @@ -0,0 +1,119 @@ +From b3cebc12805fd709f20b6c0bbe9bbeffce7169ce Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Mon, 15 Sep 2025 15:51:56 +0800 +Subject: [PATCH 1/4] crypto: x86/aegis - Add missing error checks + +The skcipher_walk functions can allocate memory and can fail, so +checking for errors is necessary. + +Fixes: 1d373d4e8e15 ("crypto: x86 - Add optimized AEGIS implementations") +Cc: stable@vger.kernel.org +Signed-off-by: Eric Biggers +Signed-off-by: Herbert Xu +--- + arch/x86/crypto/aegis128-aesni-glue.c | 36 +++++++++++++++++++-------- + 1 file changed, 26 insertions(+), 10 deletions(-) + +diff --git a/arch/x86/crypto/aegis128-aesni-glue.c b/arch/x86/crypto/aegis128-aesni-glue.c +index 4623189000d89..f3a8f0c4d0b07 100644 +--- a/arch/x86/crypto/aegis128-aesni-glue.c ++++ b/arch/x86/crypto/aegis128-aesni-glue.c +@@ -114,22 +114,27 @@ static void crypto_aegis128_aesni_process_ad( + } + } + +-static void crypto_aegis128_aesni_process_crypt( ++static int crypto_aegis128_aesni_process_crypt( + struct aegis_state *state, struct skcipher_walk *walk, + const struct aegis_crypt_ops *ops) + { ++ int err = 0; ++ + while (walk->nbytes >= AEGIS128_BLOCK_SIZE) { + ops->crypt_blocks(state, + round_down(walk->nbytes, AEGIS128_BLOCK_SIZE), + walk->src.virt.addr, walk->dst.virt.addr); +- skcipher_walk_done(walk, walk->nbytes % AEGIS128_BLOCK_SIZE); ++ err = skcipher_walk_done(walk, walk->nbytes % AEGIS128_BLOCK_SIZE); ++ if (err) ++ break; + } + +- if (walk->nbytes) { ++ if (walk->nbytes && !err) { + ops->crypt_tail(state, walk->nbytes, walk->src.virt.addr, + walk->dst.virt.addr); +- skcipher_walk_done(walk, 0); ++ err = skcipher_walk_done(walk, 0); + } ++ return err; + } + + static struct aegis_ctx *crypto_aegis128_aesni_ctx(struct crypto_aead *aead) +@@ -162,7 +167,7 @@ static int crypto_aegis128_aesni_setauthsize(struct crypto_aead *tfm, + return 0; + } + +-static void crypto_aegis128_aesni_crypt(struct aead_request *req, ++static int crypto_aegis128_aesni_crypt(struct aead_request *req, + struct aegis_block *tag_xor, + unsigned int cryptlen, + const struct aegis_crypt_ops *ops) +@@ -171,17 +176,22 @@ static void crypto_aegis128_aesni_crypt(struct aead_request *req, + struct aegis_ctx *ctx = crypto_aegis128_aesni_ctx(tfm); + struct skcipher_walk walk; + struct aegis_state state; ++ int err; + +- ops->skcipher_walk_init(&walk, req, true); ++ err = ops->skcipher_walk_init(&walk, req, true); ++ if (err) ++ return err; + + kernel_fpu_begin(); + + crypto_aegis128_aesni_init(&state, ctx->key.bytes, req->iv); + crypto_aegis128_aesni_process_ad(&state, req->src, req->assoclen); +- crypto_aegis128_aesni_process_crypt(&state, &walk, ops); +- crypto_aegis128_aesni_final(&state, tag_xor, req->assoclen, cryptlen); ++ err = crypto_aegis128_aesni_process_crypt(&state, &walk, ops); ++ if (err == 0) ++ crypto_aegis128_aesni_final(&state, tag_xor, req->assoclen, cryptlen); + + kernel_fpu_end(); ++ return err; + } + + static int crypto_aegis128_aesni_encrypt(struct aead_request *req) +@@ -196,8 +206,11 @@ static int crypto_aegis128_aesni_encrypt(struct aead_request *req) + struct aegis_block tag = {}; + unsigned int authsize = crypto_aead_authsize(tfm); + unsigned int cryptlen = req->cryptlen; ++ int err; + +- crypto_aegis128_aesni_crypt(req, &tag, cryptlen, &OPS); ++ err = crypto_aegis128_aesni_crypt(req, &tag, cryptlen, &OPS); ++ if (err) ++ return err; + + scatterwalk_map_and_copy(tag.bytes, req->dst, + req->assoclen + cryptlen, authsize, 1); +@@ -218,11 +231,14 @@ static int crypto_aegis128_aesni_decrypt(struct aead_request *req) + struct aegis_block tag; + unsigned int authsize = crypto_aead_authsize(tfm); + unsigned int cryptlen = req->cryptlen - authsize; ++ int err; + + scatterwalk_map_and_copy(tag.bytes, req->src, + req->assoclen + cryptlen, authsize, 0); + +- crypto_aegis128_aesni_crypt(req, &tag, cryptlen, &OPS); ++ err = crypto_aegis128_aesni_crypt(req, &tag, cryptlen, &OPS); ++ if (err) ++ return err; + + return crypto_memneq(tag.bytes, zeros.bytes, authsize) ? -EBADMSG : 0; + } +-- +2.43.0 + diff --git a/SPECS/kernel/kernel-uki.spec b/SPECS/kernel/kernel-uki.spec index 1f65e4952d..97ccabdbb3 100644 --- a/SPECS/kernel/kernel-uki.spec +++ b/SPECS/kernel/kernel-uki.spec @@ -12,7 +12,7 @@ Summary: Unified Kernel Image Name: kernel-uki -Version: 6.12.44 +Version: 6.12.47 Release: 1%{?dist} License: GPLv2 Vendor: Intel Corporation @@ -70,6 +70,9 @@ cp %{buildroot}/boot/vmlinuz-uki-%{kernelver}.efi %{buildroot}/boot/efi/EFI/Linu /boot/efi/EFI/Linux/vmlinuz-uki-%{kernelver}.efi %changelog +* Thu Sep 18 2025 Ren Jiaojiao - 6.12.47-1 +- Update kernel to 6.12.47 + * Tue Sep 09 2025 Ren Jiaojiao - 6.12.44-1 - Update kernel to 6.12.44 diff --git a/SPECS/kernel/kernel.signatures.json b/SPECS/kernel/kernel.signatures.json index a3b8d7cb05..07e847c08b 100644 --- a/SPECS/kernel/kernel.signatures.json +++ b/SPECS/kernel/kernel.signatures.json @@ -5,6 +5,6 @@ "cpupower": "d7518767bf2b1110d146a49c7d42e76b803f45eb8bd14d931aa6d0d346fae985", "cpupower.service": "b057fe9e5d0e8c36f485818286b80e3eba8ff66ff44797940e99b1fd5361bb98", "sha512hmac-openssl.sh": "02ab91329c4be09ee66d759e4d23ac875037c3b56e5a598e32fd1206da06a27f", - "linux-6.12.44.tar.gz": "fac0ed5371cbd46ebc8a2a1e152ac5fbb5fc2660e748a7fc1d28b8e399854a1a" + "linux-6.12.47.tar.gz": "6b05f6d6ee7d51d4def7e642cbdafec955812e1156548bc4197e38c89bc38fbc" } } diff --git a/SPECS/kernel/kernel.spec b/SPECS/kernel/kernel.spec index a99dc77c18..0f6b636e8d 100644 --- a/SPECS/kernel/kernel.spec +++ b/SPECS/kernel/kernel.spec @@ -1,13 +1,13 @@ Summary: Linux Kernel Name: kernel -Version: 6.12.44 +Version: 6.12.47 Release: 1%{?dist} License: GPLv2 Vendor: Intel Corporation Distribution: Edge Microvisor Toolkit Group: System Environment/Kernel URL: https://www.kernel.org/pub/linux/kernel -Source0: https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.44.tar.gz +Source0: https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.47.tar.gz Source1: config Source3: sha512hmac-openssl.sh Source4: emt-ca-20211013.pem @@ -73,451 +73,439 @@ Patch53: 0001-virtio-hookup-irq_get_affinity-callback.sriov Patch54: 0002-virtio-break-and-reset-virtio-devices-on-device_shut.sriov Patch55: 0003-virtgpu-don-t-reset-on-shutdown.sriov Patch56: 0004-drm-virtio-implement-virtio_gpu_shutdown.sriov +Patch57: 0001-drm-virtio-Wait-until-the-control-and-cursor-queues-.sriov #security -Patch57: 0001-mei-bus-add-api-to-query-capabilities-of-ME-clien.security -Patch58: 0002-mei-virtio-virtualization-frontend-driver.security -Patch59: 0003-INTEL_DII-mei-avoid-reset-if-fw-is-down.security -Patch60: 0004-INTEL_DII-FIXME-mei-iaf-add-iaf-Intel-Accelerator.security -Patch61: 0005-INTEL_DII-mei-add-check-for-offline-bit-in-every-.security -Patch62: 0006-INTEL_DII-mei-add-empty-handlers-for-ops-function.security -Patch63: 0007-INTEL_DII-mei-gsc-add-fields-to-support-force-wak.security -Patch64: 0008-INTEL_DII-mei-add-waitqueue-for-device-state-chan.security -Patch65: 0009-INTEL_DII-mei-add-force-wake-workaround-infra.security -Patch66: 0010-INTEL_DII-mei-add-force-wake-workaround-in-init.security -Patch67: 0011-INTEL_DII-mei-add-force-wake-workaround-on-sessio.security -Patch68: 0012-INTEL_DII-mei-add-force-wake-workaround-in-runtim.security -Patch69: 0013-INTEL_DII-mei-add-force-wake-workaround-in-resume.security -Patch70: 0014-INTEL_DII-mei-disable-immediate-enum-if-forcewake.security -Patch71: 0015-INTEL_DII-mei-put-force-wake-in-error-flows.security -Patch72: 0016-INTEL_DII-mei-add-force-wake-callbacks-to-empty-h.security -Patch73: 0017-INTEL_DII-mei-optimize-force-wake-wait.security -Patch74: 0018-mei-me-apply-GSC-error-supression-to-systems-with.security -Patch75: 0019-INTEL_DII-mei-bus-fixup-disable-version-retrieval.security +Patch58: 0001-mei-bus-add-api-to-query-capabilities-of-ME-clien.security +Patch59: 0002-mei-virtio-virtualization-frontend-driver.security +Patch60: 0003-INTEL_DII-mei-avoid-reset-if-fw-is-down.security +Patch61: 0004-INTEL_DII-FIXME-mei-iaf-add-iaf-Intel-Accelerator.security +Patch62: 0005-INTEL_DII-mei-add-check-for-offline-bit-in-every-.security +Patch63: 0006-INTEL_DII-mei-add-empty-handlers-for-ops-function.security +Patch64: 0007-INTEL_DII-mei-gsc-add-fields-to-support-force-wak.security +Patch65: 0008-INTEL_DII-mei-add-waitqueue-for-device-state-chan.security +Patch66: 0009-INTEL_DII-mei-add-force-wake-workaround-infra.security +Patch67: 0010-INTEL_DII-mei-add-force-wake-workaround-in-init.security +Patch68: 0011-INTEL_DII-mei-add-force-wake-workaround-on-sessio.security +Patch69: 0012-INTEL_DII-mei-add-force-wake-workaround-in-runtim.security +Patch70: 0013-INTEL_DII-mei-add-force-wake-workaround-in-resume.security +Patch71: 0014-INTEL_DII-mei-disable-immediate-enum-if-forcewake.security +Patch72: 0015-INTEL_DII-mei-put-force-wake-in-error-flows.security +Patch73: 0016-INTEL_DII-mei-add-force-wake-callbacks-to-empty-h.security +Patch74: 0017-INTEL_DII-mei-optimize-force-wake-wait.security +Patch75: 0018-mei-me-apply-GSC-error-supression-to-systems-with.security +Patch76: 0019-INTEL_DII-mei-bus-fixup-disable-version-retrieval.security #tgpio -Patch76: 0001-Revert-timekeeping-Add-function-to-convert-realtime-.tgpio -Patch77: 0002-Revert-x86-tsc-Remove-obsolete-ART-to-TSC-conversion.tgpio -Patch78: 0003-Revert-ice-ptp-Remove-convert_art_to_tsc.tgpio -Patch79: 0004-Revert-ALSA-hda-Remove-convert_art_to_tsc.tgpio -Patch80: 0005-Revert-stmmac-intel-Remove-convert_art_to_tsc.tgpio -Patch81: 0006-Revert-igc-Remove-convert_art_ns_to_tsc.tgpio -Patch82: 0007-Revert-e1000e-Replace-convert_art_to_tsc.tgpio -Patch83: 0008-Revert-x86-tsc-Provide-ART-base-clock-information-fo.tgpio -Patch84: 0009-Revert-timekeeping-Provide-infrastructure-for-conver.tgpio -Patch85: 0010-drivers-ptp-Add-Enhanced-handling-of-reserve-fields.tgpio -Patch86: 0011-drivers-ptp-Add-PEROUT2-ioctl-frequency-adjustment-i.tgpio -Patch87: 0012-drivers-ptp-Add-user-space-input-polling-interface.tgpio -Patch88: 0013-x86-tsc-Add-TSC-support-functions-to-support-ART-dri.tgpio -Patch89: 0014-drivers-ptp-Add-support-for-PMC-Time-Aware-GPIO-Driv.tgpio -Patch90: 0015-x86-core-TSC-reliable-kernel-arg-prevents-DQ-of-TSC-.tgpio -Patch91: 0016-mfd-intel-ehl-gpio-Introduce-MFD-framework-to-PSE-GP.tgpio -Patch92: 0017-TGPIO-Calling-power-management-calls-without-enterin.tgpio -Patch93: 0018-TGPIO-Fix-PSE-TGPIO-PTP-driver-ioctls-fail.tgpio -Patch94: 0019-Kernel-Argument-Bypassing-ART-Detection.tgpio -Patch95: 0020-GPIO-Fix-for-PSE-GPIO-generating-only-one-event-as-i.tgpio -Patch96: 0021-Added-TGPIO-pin-check-before-input-event-read.tgpio -Patch97: 0022-Added-an-Example-to-adjust-frequency-for-output.tgpio -Patch98: 0023-ptp-tgpio-PSE-TGPIO-crosststamp-counttstamp.tgpio -Patch99: 0024-ptp-Fixed-read-issue-on-PHC-with-zero-n_pins.tgpio -Patch100: 0025-ptp-S-W-workaround-for-PMC-TGPIO-h-w-bug.tgpio -Patch101: 0026-ptp-Fix-for-PSE-TGPIO-Oneshot-output-and-counttstamp.tgpio -Patch102: 0027-ptp-Fix-for-PSE-TGPIO-frequency-Adjustment-issue.tgpio -Patch103: 0028-tgpio-Fix-compilation-errors-for-PSE-TGPIO.tgpio -Patch104: 0029-Added-single-shot-output-mode-support-for-TGPIO.tgpio -Patch105: 0030-Added-an-example-to-poll-for-edges.tgpio -Patch106: 0031-Added-support-to-get-TGPIO-System-Clock-Offset.tgpio -Patch107: 0032-Added-single-shot-output-mode-option-for-TGPIO-pin.tgpio -Patch108: 0033-selftests-ptp-Added-COMPV-GPIO-Input-Mode-for-TGPIO.tgpio -Patch109: 0034-ptp-Introduce-PTP_PINDESC_INPUTPOLL-for-Intel-PMC-TG.tgpio -Patch110: 0035-drivers-ptp-Add-COMPV-GPIO-Mode-for-PSE-TGPIO.tgpio -Patch111: 0036-net-ice-fix-braces-around-scalar-initializer.tgpio -Patch112: 0037-ptp-Add-PTP_EVENT_COUNTER_MODE-in-v1-valid-flags.tgpio -Patch113: 0038-ptp-Enable-preempt-if-it-is-disabled.tgpio -Patch114: 0039-ptp-Generate-sqaure-wave-on-PSE-TGPIO.tgpio -Patch115: 0040-ptp-tgpio-Add-an-edge-if-the-output-signal-ends-high.tgpio -Patch116: 0041-ptp-pmc-tgpio-Initialize-variable-to-zero.tgpio -Patch117: 0042-ptp-tgpio-Fix-return-type-of-remove-function-in-tgpi.tgpio -Patch118: 0043-net-mlx5-reuse-convert_art_ns_to_tsc-to-convert-ART-.tgpio +Patch77: 0001-Revert-timekeeping-Add-function-to-convert-realtime-.tgpio +Patch78: 0002-Revert-x86-tsc-Remove-obsolete-ART-to-TSC-conversion.tgpio +Patch79: 0003-Revert-ice-ptp-Remove-convert_art_to_tsc.tgpio +Patch80: 0004-Revert-ALSA-hda-Remove-convert_art_to_tsc.tgpio +Patch81: 0005-Revert-stmmac-intel-Remove-convert_art_to_tsc.tgpio +Patch82: 0006-Revert-igc-Remove-convert_art_ns_to_tsc.tgpio +Patch83: 0007-Revert-e1000e-Replace-convert_art_to_tsc.tgpio +Patch84: 0008-Revert-x86-tsc-Provide-ART-base-clock-information-fo.tgpio +Patch85: 0009-Revert-timekeeping-Provide-infrastructure-for-conver.tgpio +Patch86: 0010-drivers-ptp-Add-Enhanced-handling-of-reserve-fields.tgpio +Patch87: 0011-drivers-ptp-Add-PEROUT2-ioctl-frequency-adjustment-i.tgpio +Patch88: 0012-drivers-ptp-Add-user-space-input-polling-interface.tgpio +Patch89: 0013-x86-tsc-Add-TSC-support-functions-to-support-ART-dri.tgpio +Patch90: 0014-drivers-ptp-Add-support-for-PMC-Time-Aware-GPIO-Driv.tgpio +Patch91: 0015-x86-core-TSC-reliable-kernel-arg-prevents-DQ-of-TSC-.tgpio +Patch92: 0016-mfd-intel-ehl-gpio-Introduce-MFD-framework-to-PSE-GP.tgpio +Patch93: 0017-TGPIO-Calling-power-management-calls-without-enterin.tgpio +Patch94: 0018-TGPIO-Fix-PSE-TGPIO-PTP-driver-ioctls-fail.tgpio +Patch95: 0019-Kernel-Argument-Bypassing-ART-Detection.tgpio +Patch96: 0020-GPIO-Fix-for-PSE-GPIO-generating-only-one-event-as-i.tgpio +Patch97: 0021-Added-TGPIO-pin-check-before-input-event-read.tgpio +Patch98: 0022-Added-an-Example-to-adjust-frequency-for-output.tgpio +Patch99: 0023-ptp-tgpio-PSE-TGPIO-crosststamp-counttstamp.tgpio +Patch100: 0024-ptp-Fixed-read-issue-on-PHC-with-zero-n_pins.tgpio +Patch101: 0025-ptp-S-W-workaround-for-PMC-TGPIO-h-w-bug.tgpio +Patch102: 0026-ptp-Fix-for-PSE-TGPIO-Oneshot-output-and-counttstamp.tgpio +Patch103: 0027-ptp-Fix-for-PSE-TGPIO-frequency-Adjustment-issue.tgpio +Patch104: 0028-tgpio-Fix-compilation-errors-for-PSE-TGPIO.tgpio +Patch105: 0029-Added-single-shot-output-mode-support-for-TGPIO.tgpio +Patch106: 0030-Added-an-example-to-poll-for-edges.tgpio +Patch107: 0031-Added-support-to-get-TGPIO-System-Clock-Offset.tgpio +Patch108: 0032-Added-single-shot-output-mode-option-for-TGPIO-pin.tgpio +Patch109: 0033-selftests-ptp-Added-COMPV-GPIO-Input-Mode-for-TGPIO.tgpio +Patch110: 0034-ptp-Introduce-PTP_PINDESC_INPUTPOLL-for-Intel-PMC-TG.tgpio +Patch111: 0035-drivers-ptp-Add-COMPV-GPIO-Mode-for-PSE-TGPIO.tgpio +Patch112: 0036-net-ice-fix-braces-around-scalar-initializer.tgpio +Patch113: 0037-ptp-Add-PTP_EVENT_COUNTER_MODE-in-v1-valid-flags.tgpio +Patch114: 0038-ptp-Enable-preempt-if-it-is-disabled.tgpio +Patch115: 0039-ptp-Generate-sqaure-wave-on-PSE-TGPIO.tgpio +Patch116: 0040-ptp-tgpio-Add-an-edge-if-the-output-signal-ends-high.tgpio +Patch117: 0041-ptp-pmc-tgpio-Initialize-variable-to-zero.tgpio +Patch118: 0042-ptp-tgpio-Fix-return-type-of-remove-function-in-tgpi.tgpio +Patch119: 0043-net-mlx5-reuse-convert_art_ns_to_tsc-to-convert-ART-.tgpio #edac -Patch119: 0001-x86-mce-Add-MCACOD-code-for-generic-I-O-error.edac -Patch120: 0002-EDAC-ieh-Add-I-O-device-EDAC-driver-for-Intel-CPUs-wi.edac -Patch121: 0003-EDAC-ieh-Add-I-O-device-EDAC-support-for-Intel-Tiger-.edac -Patch122: 0004-EDAC-igen6-Add-registration-APIs-for-In-Band-ECC-erro.edac -Patch123: 0005-EDAC-i10nm-Print-DRAM-rules-debug-purpose.edac -Patch124: 0006-EDAC-skx_common-skx-i10nm-Make-skx_register_mci-indep.edac -Patch125: 0007-EDAC-skx_common-Prepare-skx_get_edac_list.edac -Patch126: 0008-EDAC-skx_common-Prepare-skx_set_hi_lo.edac -Patch127: 0009-EDAC-igen6-Add-Intel-Pnther-Lake-H-SoCs-support.edac -Patch128: 0002-EDAC-ie31200-Add-Kaby-Lake-S-dual-core-host-bridge-ID.edac -Patch129: 0006-EDAC-ie31200-Fix-the-3rd-parameter-name-of-populate_d.edac -Patch130: 0007-EDAC-ie31200-Simplify-the-pci_device_id-table.edac -Patch131: 0008-EDAC-ie31200-Make-the-memory-controller-resources-con.edac -Patch132: 0009-EDAC-ie31200-Make-struct-dimm_data-contain-decoded-in.edac -Patch133: 0010-EDAC-ie31200-Fold-the-two-channel-loops-into-one-loop.edac -Patch134: 0011-EDAC-ie31200-Break-up-ie31200_probe1.edac -Patch135: 0012-EDAC-ie31200-Add-Intel-Raptor-Lake-S-SoCs-support.edac -Patch136: 0013-EDAC-ie31200-Switch-Raptor-Lake-S-to-interrupt-mode.edac -Patch137: 0001-EDAC-ie31200-Add-two-Intel-SoCs-for-EDAC-support.edac -Patch138: 0002-ie31200-EDAC-Add-Intel-Bartlett-Lake-S-SoCs-support.edac +Patch120: 0001-x86-mce-Add-MCACOD-code-for-generic-I-O-error.edac +Patch121: 0002-EDAC-ieh-Add-I-O-device-EDAC-driver-for-Intel-CPUs-wi.edac +Patch122: 0003-EDAC-ieh-Add-I-O-device-EDAC-support-for-Intel-Tiger-.edac +Patch123: 0004-EDAC-igen6-Add-registration-APIs-for-In-Band-ECC-erro.edac +Patch124: 0005-EDAC-i10nm-Print-DRAM-rules-debug-purpose.edac +Patch125: 0006-EDAC-skx_common-skx-i10nm-Make-skx_register_mci-indep.edac +Patch126: 0007-EDAC-skx_common-Prepare-skx_get_edac_list.edac +Patch127: 0008-EDAC-skx_common-Prepare-skx_set_hi_lo.edac +Patch128: 0009-EDAC-igen6-Add-Intel-Pnther-Lake-H-SoCs-support.edac +Patch129: 0002-EDAC-ie31200-Add-Kaby-Lake-S-dual-core-host-bridge-ID.edac +Patch130: 0006-EDAC-ie31200-Fix-the-3rd-parameter-name-of-populate_d.edac +Patch131: 0007-EDAC-ie31200-Simplify-the-pci_device_id-table.edac +Patch132: 0008-EDAC-ie31200-Make-the-memory-controller-resources-con.edac +Patch133: 0009-EDAC-ie31200-Make-struct-dimm_data-contain-decoded-in.edac +Patch134: 0010-EDAC-ie31200-Fold-the-two-channel-loops-into-one-loop.edac +Patch135: 0011-EDAC-ie31200-Break-up-ie31200_probe1.edac +Patch136: 0012-EDAC-ie31200-Add-Intel-Raptor-Lake-S-SoCs-support.edac +Patch137: 0013-EDAC-ie31200-Switch-Raptor-Lake-S-to-interrupt-mode.edac +Patch138: 0001-EDAC-ie31200-Add-two-Intel-SoCs-for-EDAC-support.edac +Patch139: 0002-ie31200-EDAC-Add-Intel-Bartlett-Lake-S-SoCs-support.edac #tsn -Patch139: 0001-net-pcs-xpcs-enable-xpcs-reset-skipping.tsn -Patch140: 0002-net-stmmac-Bugfix-on-stmmac_interrupt-for-WOL.tsn -Patch141: 0003-net-phy-increase-gpy-loopback-test-delay.tsn -Patch142: 0004-net-stmmac-Resolve-poor-line-rate-after-switching-from.tsn -Patch143: 0005-net-phy-dp83867-perform-restart-AN-after-modifying-AN-.tsn -Patch144: 0006-stmmac-intel-Separate-ADL-N-and-RPL-P-device-ID-from-T.tsn -Patch145: 0007-net-stmmac-Adjust-mac_capabilities-for-Intel-mGbE-2.5G.tsn -Patch146: 0008-stmmac-intel-skip-xpcs-reset-for-2.5Gbps-on-Intel-Alde.tsn -Patch147: 0009-net-stmmac-add-check-for-2.5G-mode-to-prevent-MAC-capa.tsn -Patch148: 0010-stmmac-intel-Enable-PHY-WoL-in-ADL-N.tsn -Patch149: 0011-net-phy-reconfigure-PHY-WoL-when-WoL-option-is-enabled.tsn -Patch150: 0012-net-stmmac-fix-MAC-and-phylink-mismatch-issue-after-re.tsn -Patch151: 0013-net-stmmac-restructure-Rx-Tx-hardware-timestamping-fun.tsn -Patch152: 0014-net-stmmac-Add-per-packet-time-based-scheduling-for-XD.tsn -Patch153: 0015-net-stmmac-introduce-AF_XDP-ZC-RX-HW-timestamps.tsn -Patch154: 0016-net-stmmac-add-fsleep-in-HW-Rx-timestamp-checking-loop.tsn -Patch155: 0017-net-stmmac-select-PCS-negotiation-mode-according-to-th.tsn -Patch156: 0018-net-pcs-xpcs-re-initiate-clause-37-Auto-negotiation.tsn -Patch157: 0019-arch-x86-Add-IPC-mailbox-accessor-function-and-add-SoC.tsn -Patch158: 0020-net-stmmac-configure-SerDes-according-to-the-interface.tsn -Patch159: 0021-stmmac-intel-interface-switching-support-for-intel-pla.tsn -Patch160: 0022-net-stmmac-Set-mac_managed_pm-flag-from-stmmac-to-reso.tsn -Patch161: 0023-net-phylink-Add-module_exit.tsn -Patch162: 0024-net-stmmac-introduce-AF_XDP-ZC-TX-HW-timestamps.tsn -Patch163: 0025-net-sched-taprio-fix-too-early-schedules-switching.tsn -Patch164: 0026-net-sched-taprio-fix-cycle-time-adjustment-for-next-en.tsn -Patch165: 0027-net-sched-taprio-fix-impacted-fields-value-during-cycl.tsn -Patch166: 0028-net-sched-taprio-get-corrected-value-of-cycle_time-and.tsn -Patch167: 0029-xsk-add-txtime-field-in-xdp_desc-struct.tsn -Patch168: 0030-Revert-net-stmmac-silence-FPE-kernel-logs.tsn -Patch169: 0031-Revert-net-stmmac-support-fp-parameter-of-tc-taprio.tsn -Patch170: 0032-Revert-net-stmmac-support-fp-parameter-of-tc-mqprio.tsn -Patch171: 0033-Revert-net-stmmac-configure-FPE-via-ethtool-mm.tsn -Patch172: 0034-Revert-net-stmmac-refactor-FPE-verification-process.tsn -Patch173: 0035-Revert-net-stmmac-drop-stmmac_fpe_handshake.tsn -Patch174: 0036-Revert-net-stmmac-move-stmmac_fpe_cfg-to-stmmac_priv-d.tsn -Patch175: 0037-net-stmmac-add-FPE-preempt-setting-for-TxQ-preemptible.tsn -Patch176: 0038-taprio-Add-support-for-frame-preemption-offload.tsn -Patch177: 0039-net-stmmac-set-initial-EEE-policy-configuration.tsn -Patch178: 0040-net-phy-fix-phylib-s-dual-eee_enabled.tsn -Patch179: 0041-net-phy-ensure-that-genphy_c45_an_config_eee_aneg-sees.tsn -Patch180: 0042-net-phy-fix-phy_ethtool_set_eee-incorrectly-enabling-L.tsn -Patch181: 0001-igc-Set-the-RX-packet-buffer-size-for-TSN-mode.tsn -Patch182: 0002-igc-Only-dump-registers-if-configured-to-dump-HW-infor.tsn -Patch183: 0003-ethtool-Add-support-for-configuring-frame-preemption.tsn -Patch184: 0004-ethtool-Add-support-for-Frame-Preemption-verification.tsn -Patch185: 0005-igc-Add-support-for-enabling-frame-preemption-via-etht.tsn -Patch186: 0006-igc-Add-support-for-TC_SETUP_PREEMPT.tsn -Patch187: 0007-igc-Add-support-for-setting-frame-preemption-configura.tsn -Patch188: 0008-igc-Add-support-for-Frame-Preemption-verification.tsn -Patch189: 0009-igc-Add-support-for-exposing-frame-preemption-stats-re.tsn -Patch190: 0010-igc-Optimize-the-packet-buffer-utilization.tsn -Patch191: 0011-igc-Add-support-for-enabling-all-packets-to-be-receive.tsn -Patch192: 0012-igc-Add-support-for-DMA-timestamp-for-non-PTP-packets.tsn -Patch193: 0013-bpf-add-btf-register-unregister-API.tsn -Patch194: 0014-net-core-XDP-metadata-BTF-netlink-API.tsn -Patch195: 0015-rtnetlink-Fix-unchecked-return-value-of-dev_xdp_query_.tsn -Patch196: 0016-rtnetlink-Add-return-value-check.tsn -Patch197: 0017-tools-bpf-Query-XDP-metadata-BTF-ID.tsn -Patch198: 0018-tools-bpf-Add-xdp-set-command-for-md-btf.tsn -Patch199: 0019-igc-Add-BTF-based-metadata-for-XDP.tsn -Patch200: 0020-igc-Enable-HW-RX-Timestamp-for-AF_XDP-ZC.tsn -Patch201: 0021-igc-Take-care-of-DMA-timestamp-rollover.tsn -Patch202: 0022-igc-Add-SO_TXTIME-for-AF_XDP-ZC.tsn -Patch203: 0023-igc-Reodering-the-empty-packet-buffers-and-descriptors.tsn -Patch204: 0024-Revert-igc-Add-support-for-PTP-.getcyclesx64.tsn -Patch205: 0025-core-Introduce-netdev_tc_map_to_queue_mask.tsn -Patch206: 0026-taprio-Replace-tc_map_to_queue_mask.tsn -Patch207: 0027-mqprio-Add-support-for-frame-preemption-offload.tsn -Patch208: 0030-igc-Reduce-retry-count-to-a-more-reasonable-number.tsn -Patch209: 0001-igc-Enable-HW-TX-Timestamp-for-AF_XDP-ZC.tsn -Patch210: 0002-igc-Enable-trace-for-HW-TX-Timestamp-AF_XDP-ZC.tsn -Patch211: 0003-igc-Remove-the-CONFIG_DEBUG_MISC-condition-for-trace.tsn -Patch212: 0006-Revert-net-stmmac-set-initial-EEE-policy-configurati.tsn -Patch213: 0001-net-phy-Set-eee_cfg.eee_enabled-according-to-PHY.tsn -Patch214: 0001-Revert-net-stmmac-add-FPE-preempt-setting-for-TxQ-pree.tsn -Patch215: 0002-Reapply-net-stmmac-move-stmmac_fpe_cfg-to-stmmac_priv-.tsn -Patch216: 0003-Reapply-net-stmmac-drop-stmmac_fpe_handshake.tsn -Patch217: 0004-Reapply-net-stmmac-refactor-FPE-verification-process.tsn -Patch218: 0005-Reapply-net-stmmac-configure-FPE-via-ethtool-mm.tsn -Patch219: 0006-Reapply-net-stmmac-support-fp-parameter-of-tc-mqprio.tsn -Patch220: 0007-Reapply-net-stmmac-support-fp-parameter-of-tc-taprio.tsn -Patch221: 0008-Reapply-net-stmmac-silence-FPE-kernel-logs.tsn +Patch140: 0001-net-pcs-xpcs-enable-xpcs-reset-skipping.tsn +Patch141: 0002-net-stmmac-Bugfix-on-stmmac_interrupt-for-WOL.tsn +Patch142: 0003-net-phy-increase-gpy-loopback-test-delay.tsn +Patch143: 0004-net-stmmac-Resolve-poor-line-rate-after-switching-from.tsn +Patch144: 0005-net-phy-dp83867-perform-restart-AN-after-modifying-AN-.tsn +Patch145: 0006-stmmac-intel-Separate-ADL-N-and-RPL-P-device-ID-from-T.tsn +Patch146: 0007-net-stmmac-Adjust-mac_capabilities-for-Intel-mGbE-2.5G.tsn +Patch147: 0008-stmmac-intel-skip-xpcs-reset-for-2.5Gbps-on-Intel-Alde.tsn +Patch148: 0009-net-stmmac-add-check-for-2.5G-mode-to-prevent-MAC-capa.tsn +Patch149: 0010-stmmac-intel-Enable-PHY-WoL-in-ADL-N.tsn +Patch150: 0011-net-phy-reconfigure-PHY-WoL-when-WoL-option-is-enabled.tsn +Patch151: 0012-net-stmmac-fix-MAC-and-phylink-mismatch-issue-after-re.tsn +Patch152: 0013-net-stmmac-restructure-Rx-Tx-hardware-timestamping-fun.tsn +Patch153: 0014-net-stmmac-Add-per-packet-time-based-scheduling-for-XD.tsn +Patch154: 0015-net-stmmac-introduce-AF_XDP-ZC-RX-HW-timestamps.tsn +Patch155: 0016-net-stmmac-add-fsleep-in-HW-Rx-timestamp-checking-loop.tsn +Patch156: 0017-net-stmmac-select-PCS-negotiation-mode-according-to-th.tsn +Patch157: 0018-net-pcs-xpcs-re-initiate-clause-37-Auto-negotiation.tsn +Patch158: 0019-arch-x86-Add-IPC-mailbox-accessor-function-and-add-SoC.tsn +Patch159: 0020-net-stmmac-configure-SerDes-according-to-the-interface.tsn +Patch160: 0021-stmmac-intel-interface-switching-support-for-intel-pla.tsn +Patch161: 0022-net-stmmac-Set-mac_managed_pm-flag-from-stmmac-to-reso.tsn +Patch162: 0023-net-phylink-Add-module_exit.tsn +Patch163: 0024-net-stmmac-introduce-AF_XDP-ZC-TX-HW-timestamps.tsn +Patch164: 0025-net-sched-taprio-fix-too-early-schedules-switching.tsn +Patch165: 0026-net-sched-taprio-fix-cycle-time-adjustment-for-next-en.tsn +Patch166: 0027-net-sched-taprio-fix-impacted-fields-value-during-cycl.tsn +Patch167: 0028-net-sched-taprio-get-corrected-value-of-cycle_time-and.tsn +Patch168: 0029-xsk-add-txtime-field-in-xdp_desc-struct.tsn +Patch169: 0030-Revert-net-stmmac-silence-FPE-kernel-logs.tsn +Patch170: 0031-Revert-net-stmmac-support-fp-parameter-of-tc-taprio.tsn +Patch171: 0032-Revert-net-stmmac-support-fp-parameter-of-tc-mqprio.tsn +Patch172: 0033-Revert-net-stmmac-configure-FPE-via-ethtool-mm.tsn +Patch173: 0034-Revert-net-stmmac-refactor-FPE-verification-process.tsn +Patch174: 0035-Revert-net-stmmac-drop-stmmac_fpe_handshake.tsn +Patch175: 0036-Revert-net-stmmac-move-stmmac_fpe_cfg-to-stmmac_priv-d.tsn +Patch176: 0037-net-stmmac-add-FPE-preempt-setting-for-TxQ-preemptible.tsn +Patch177: 0038-taprio-Add-support-for-frame-preemption-offload.tsn +Patch178: 0039-net-stmmac-set-initial-EEE-policy-configuration.tsn +Patch179: 0040-net-phy-fix-phylib-s-dual-eee_enabled.tsn +Patch180: 0041-net-phy-ensure-that-genphy_c45_an_config_eee_aneg-sees.tsn +Patch181: 0042-net-phy-fix-phy_ethtool_set_eee-incorrectly-enabling-L.tsn +Patch182: 0001-igc-Set-the-RX-packet-buffer-size-for-TSN-mode.tsn +Patch183: 0002-igc-Only-dump-registers-if-configured-to-dump-HW-infor.tsn +Patch184: 0003-ethtool-Add-support-for-configuring-frame-preemption.tsn +Patch185: 0004-ethtool-Add-support-for-Frame-Preemption-verification.tsn +Patch186: 0005-igc-Add-support-for-enabling-frame-preemption-via-etht.tsn +Patch187: 0006-igc-Add-support-for-TC_SETUP_PREEMPT.tsn +Patch188: 0007-igc-Add-support-for-setting-frame-preemption-configura.tsn +Patch189: 0008-igc-Add-support-for-Frame-Preemption-verification.tsn +Patch190: 0009-igc-Add-support-for-exposing-frame-preemption-stats-re.tsn +Patch191: 0010-igc-Optimize-the-packet-buffer-utilization.tsn +Patch192: 0011-igc-Add-support-for-enabling-all-packets-to-be-receive.tsn +Patch193: 0012-igc-Add-support-for-DMA-timestamp-for-non-PTP-packets.tsn +Patch194: 0013-bpf-add-btf-register-unregister-API.tsn +Patch195: 0014-net-core-XDP-metadata-BTF-netlink-API.tsn +Patch196: 0015-rtnetlink-Fix-unchecked-return-value-of-dev_xdp_query_.tsn +Patch197: 0016-rtnetlink-Add-return-value-check.tsn +Patch198: 0017-tools-bpf-Query-XDP-metadata-BTF-ID.tsn +Patch199: 0018-tools-bpf-Add-xdp-set-command-for-md-btf.tsn +Patch200: 0019-igc-Add-BTF-based-metadata-for-XDP.tsn +Patch201: 0020-igc-Enable-HW-RX-Timestamp-for-AF_XDP-ZC.tsn +Patch202: 0021-igc-Take-care-of-DMA-timestamp-rollover.tsn +Patch203: 0022-igc-Add-SO_TXTIME-for-AF_XDP-ZC.tsn +Patch204: 0023-igc-Reodering-the-empty-packet-buffers-and-descriptors.tsn +Patch205: 0024-Revert-igc-Add-support-for-PTP-.getcyclesx64.tsn +Patch206: 0025-core-Introduce-netdev_tc_map_to_queue_mask.tsn +Patch207: 0026-taprio-Replace-tc_map_to_queue_mask.tsn +Patch208: 0027-mqprio-Add-support-for-frame-preemption-offload.tsn +Patch209: 0030-igc-Reduce-retry-count-to-a-more-reasonable-number.tsn +Patch210: 0001-igc-Enable-HW-TX-Timestamp-for-AF_XDP-ZC.tsn +Patch211: 0002-igc-Enable-trace-for-HW-TX-Timestamp-AF_XDP-ZC.tsn +Patch212: 0003-igc-Remove-the-CONFIG_DEBUG_MISC-condition-for-trace.tsn +Patch213: 0006-Revert-net-stmmac-set-initial-EEE-policy-configurati.tsn +Patch214: 0001-net-phy-Set-eee_cfg.eee_enabled-according-to-PHY.tsn +Patch215: 0001-Revert-net-stmmac-add-FPE-preempt-setting-for-TxQ-pree.tsn +Patch216: 0002-Reapply-net-stmmac-move-stmmac_fpe_cfg-to-stmmac_priv-.tsn +Patch217: 0003-Reapply-net-stmmac-drop-stmmac_fpe_handshake.tsn +Patch218: 0004-Reapply-net-stmmac-refactor-FPE-verification-process.tsn +Patch219: 0005-Reapply-net-stmmac-configure-FPE-via-ethtool-mm.tsn +Patch220: 0006-Reapply-net-stmmac-support-fp-parameter-of-tc-mqprio.tsn +Patch221: 0007-Reapply-net-stmmac-support-fp-parameter-of-tc-taprio.tsn +Patch222: 0008-Reapply-net-stmmac-silence-FPE-kernel-logs.tsn #camera -Patch222: 0001-media-intel-ipu6-remove-buttress-ish-structure.camera -Patch223: 0001-media-i2c-Add-ar0234-camera-sensor-driver.camera -Patch224: 0002-media-i2c-add-support-for-lt6911uxe.camera -Patch225: 0003-INT3472-Support-LT6911UXE.camera -Patch226: 0004-upstream-Use-module-parameter-to-set-isys-freq.camera -Patch227: 0005-upstream-Use-module-parameter-to-set-psys-freq.camera -Patch228: 0006-media-pci-Enable-ISYS-reset.camera -Patch229: 0007-media-i2c-add-support-for-ar0234-and-lt6911uxe.camera -Patch230: 0008-driver-media-i2c-remove-useless-header-file.camera -Patch231: 0009-media-i2c-update-lt6911uxe-for-upstream-and-bug-fix.camera -Patch232: 0010-media-i2c-add-support-for-lt6911uxc.camera -Patch233: 0011-media-i2c-add-lt6911uxc-driver-and-enable-in-ipu-br.camera -Patch234: 0012-media-pci-intel-psys-driver.camera -Patch235: 0013-media-i2c-Remove-unused-variables-in-Lontium-driver.camera -Patch236: 0001-media-intel-ipu6-remove-buttress-ish-structure-1.camera -Patch237: 0002-media-pci-intel-include-psys-driver.camera -Patch238: 0003-Revert-media-ipu6-use-the-IPU6-DMA-mapping-APIs-to-.camera -Patch239: 0004-Revert-media-ipu6-remove-architecture-DMA-ops-depen.camera -Patch240: 0005-Revert-media-ipu6-not-override-the-dma_ops-of-devic.camera -Patch241: 0001-Reapply-media-ipu6-not-override-the-dma_ops-of-devi.camera -Patch242: 0002-Reapply-media-ipu6-remove-architecture-DMA-ops-depe.camera -Patch243: 0003-Reapply-media-ipu6-use-the-IPU6-DMA-mapping-APIs-to.camera -Patch244: 0001-media-pci-update-IPU6-PSYS-driver.camera -Patch245: 0002-media-i2c-update-lt6911uxc-driver-to-fix-COV-issue.camera -Patch246: 0003-lt6911-2-pads-linked-to-ipu-2-ports-for-split-mode.camera -Patch247: 0004-media-i2c-add-dv_timings-api-in-lt6911uxe.camera -Patch248: 0005-media-intel-ipu6-use-vc1-dma-for-MTL-and-ARL.camera -Patch249: 0006-media-i2c-some-changes-in-lt6911uxe.camera -Patch250: 0001-Revert-media-intel-ipu6-use-vc1-dma-for-MTL-and-ARL.camera -Patch251: 0002-media-i2c-update-format-in-irq-for-lt6911uxe.camera -Patch252: 0003-media-i2c-remove-unused-func-in-lt6911uxe.camera -Patch253: 0001-media-intel-ipu6-use-vc1-dma-for-MTL-and-ARL.camera -Patch254: 0002-media-ipu-Dma-sync-at-buffer_prepare-callback-as-DM.camera -Patch255: 0003-Support-IPU6-ISYS-FW-trace-dump-for-upstream-driver.camera -Patch256: 0004-Support-IPU6-PSYS-FW-trace-dump-for-upstream-driver.camera -Patch257: 0005-media-pci-The-order-of-return-buffers-should-be-FIF.camera -Patch258: 0006-media-i2c-fix-power-on-issue-for-on-board-LT6911UXC.camera -Patch259: 0007-media-i2c-fix-power-on-issue-for-on-board-LT6911UXE.camera -Patch260: 0001-media-pci-Modify-enble-disable-stream-in-CSI2.camera -Patch261: 0002-media-pci-Set-the-correct-SOF-for-different-stream.camera -Patch262: 0003-media-pci-support-imx390-for-6.11.0-rc3.camera -Patch263: 0004-i2c-media-fix-cov-issue.camera -Patch264: 0005-mv-ipu-acpi-module-to-linux-drivers.camera -Patch265: 0006-kernel-enable-VC-support-in-v4l2.camera -Patch266: 0007-media-pci-intel-support-PDATA-in-Kconfig-Makefile.camera -Patch267: 0008-media-pci-unregister-i2c-device-to-complete-ext_sub.camera -Patch268: 0009-media-pci-align-params-for-non-MIPI-split-and-split.camera -Patch269: 0010-media-pci-add-missing-if-for-PDATA.camera -Patch270: 0011-media-platform-fix-allyesconfig-build-error.camera -Patch271: 0012-media-pci-refine-PDATA-related-config.camera -Patch272: 0013-kernel-align-ACPI-PDATA-and-ACPI-fwnode-build-for-E.camera -Patch273: 0014-media-i2c-add-gmsl-isx031-support.camera -Patch274: 0015-media-i2c-add-support-for-isx031-max9296.camera -Patch275: 0016-fix-S4-issue-on-TWL.camera -Patch276: 0017-code-changes-for-link-frequency-and-sensor-physical.camera +Patch223: 0001-media-intel-ipu6-remove-buttress-ish-structure.camera +Patch224: 0001-media-i2c-Add-ar0234-camera-sensor-driver.camera +Patch225: 0002-media-i2c-add-support-for-lt6911uxe.camera +Patch226: 0003-INT3472-Support-LT6911UXE.camera +Patch227: 0004-upstream-Use-module-parameter-to-set-isys-freq.camera +Patch228: 0005-upstream-Use-module-parameter-to-set-psys-freq.camera +Patch229: 0006-media-pci-Enable-ISYS-reset.camera +Patch230: 0007-media-i2c-add-support-for-ar0234-and-lt6911uxe.camera +Patch231: 0008-driver-media-i2c-remove-useless-header-file.camera +Patch232: 0009-media-i2c-update-lt6911uxe-for-upstream-and-bug-fix.camera +Patch233: 0010-media-i2c-add-support-for-lt6911uxc.camera +Patch234: 0011-media-i2c-add-lt6911uxc-driver-and-enable-in-ipu-br.camera +Patch235: 0012-media-pci-intel-psys-driver.camera +Patch236: 0013-media-i2c-Remove-unused-variables-in-Lontium-driver.camera +Patch237: 0001-media-intel-ipu6-remove-buttress-ish-structure-1.camera +Patch238: 0002-media-pci-intel-include-psys-driver.camera +Patch239: 0003-Revert-media-ipu6-use-the-IPU6-DMA-mapping-APIs-to-.camera +Patch240: 0004-Revert-media-ipu6-remove-architecture-DMA-ops-depen.camera +Patch241: 0005-Revert-media-ipu6-not-override-the-dma_ops-of-devic.camera +Patch242: 0001-Reapply-media-ipu6-not-override-the-dma_ops-of-devi.camera +Patch243: 0002-Reapply-media-ipu6-remove-architecture-DMA-ops-depe.camera +Patch244: 0003-Reapply-media-ipu6-use-the-IPU6-DMA-mapping-APIs-to.camera +Patch245: 0001-media-pci-update-IPU6-PSYS-driver.camera +Patch246: 0002-media-i2c-update-lt6911uxc-driver-to-fix-COV-issue.camera +Patch247: 0003-lt6911-2-pads-linked-to-ipu-2-ports-for-split-mode.camera +Patch248: 0004-media-i2c-add-dv_timings-api-in-lt6911uxe.camera +Patch249: 0005-media-intel-ipu6-use-vc1-dma-for-MTL-and-ARL.camera +Patch250: 0006-media-i2c-some-changes-in-lt6911uxe.camera +Patch251: 0001-Revert-media-intel-ipu6-use-vc1-dma-for-MTL-and-ARL.camera +Patch252: 0002-media-i2c-update-format-in-irq-for-lt6911uxe.camera +Patch253: 0003-media-i2c-remove-unused-func-in-lt6911uxe.camera +Patch254: 0001-media-intel-ipu6-use-vc1-dma-for-MTL-and-ARL.camera +Patch255: 0002-media-ipu-Dma-sync-at-buffer_prepare-callback-as-DM.camera +Patch256: 0003-Support-IPU6-ISYS-FW-trace-dump-for-upstream-driver.camera +Patch257: 0004-Support-IPU6-PSYS-FW-trace-dump-for-upstream-driver.camera +Patch258: 0005-media-pci-The-order-of-return-buffers-should-be-FIF.camera +Patch259: 0006-media-i2c-fix-power-on-issue-for-on-board-LT6911UXC.camera +Patch260: 0007-media-i2c-fix-power-on-issue-for-on-board-LT6911UXE.camera +Patch261: 0001-media-pci-Modify-enble-disable-stream-in-CSI2.camera +Patch262: 0002-media-pci-Set-the-correct-SOF-for-different-stream.camera +Patch263: 0003-media-pci-support-imx390-for-6.11.0-rc3.camera +Patch264: 0004-i2c-media-fix-cov-issue.camera +Patch265: 0005-mv-ipu-acpi-module-to-linux-drivers.camera +Patch266: 0006-kernel-enable-VC-support-in-v4l2.camera +Patch267: 0007-media-pci-intel-support-PDATA-in-Kconfig-Makefile.camera +Patch268: 0008-media-pci-unregister-i2c-device-to-complete-ext_sub.camera +Patch269: 0009-media-pci-align-params-for-non-MIPI-split-and-split.camera +Patch270: 0010-media-pci-add-missing-if-for-PDATA.camera +Patch271: 0011-media-platform-fix-allyesconfig-build-error.camera +Patch272: 0012-media-pci-refine-PDATA-related-config.camera +Patch273: 0013-kernel-align-ACPI-PDATA-and-ACPI-fwnode-build-for-E.camera +Patch274: 0014-media-i2c-add-gmsl-isx031-support.camera +Patch275: 0015-media-i2c-add-support-for-isx031-max9296.camera +Patch276: 0016-fix-S4-issue-on-TWL.camera +Patch277: 0017-code-changes-for-link-frequency-and-sensor-physical.camera #wwan -Patch277: 0001-Revert-bus-mhi-host-pci_generic-add-support-for-sc828.wwan -Patch278: 0002-wwan-add-SAHARA-device.wwan -Patch279: 0003-bus-mhi-host-allow-SBL-as-initial-EE.wwan -Patch280: 0004-drivers-bus-mhi-let-userspace-manage-xfp-fw-update-st.wwan -Patch281: 0005-wwan-add-NMEA-type.wwan -Patch282: 0006-drivers-bus-mhi-add-FN980-v2-support.wwan -Patch283: 0007-drivers-bus-mhi-add-FN990-NMEA-and-DIAG-in-SBL-device.wwan -Patch284: 0008-drivers-net-wwan-add-simple-DTR-driver.wwan -Patch285: 0009-drivers-bus-mhi-host-fix-recovery-process-when-modem-.wwan -Patch286: 0001-Revert-drivers-bus-mhi-host-fix-recovery-process-when.wwan -Patch287: 0002-Revert-drivers-net-wwan-add-simple-DTR-driver.wwan -Patch288: 0003-Revert-drivers-bus-mhi-add-FN990-NMEA-and-DIAG-in-SBL.wwan -Patch289: 0004-Revert-drivers-bus-mhi-add-FN980-v2-support.wwan -Patch290: 0005-Revert-wwan-add-NMEA-type.wwan -Patch291: 0006-Revert-drivers-bus-mhi-let-userspace-manage-xfp-fw-up.wwan -Patch292: 0007-Revert-bus-mhi-host-allow-SBL-as-initial-EE.wwan -Patch293: 0008-Revert-wwan-add-SAHARA-device.wwan -Patch294: 0009-Revert-Revert-bus-mhi-host-pci_generic-add-support-fo.wwan +Patch278: 0001-Revert-bus-mhi-host-pci_generic-add-support-for-sc828.wwan +Patch279: 0002-wwan-add-SAHARA-device.wwan +Patch280: 0003-bus-mhi-host-allow-SBL-as-initial-EE.wwan +Patch281: 0004-drivers-bus-mhi-let-userspace-manage-xfp-fw-update-st.wwan +Patch282: 0005-wwan-add-NMEA-type.wwan +Patch283: 0006-drivers-bus-mhi-add-FN980-v2-support.wwan +Patch284: 0007-drivers-bus-mhi-add-FN990-NMEA-and-DIAG-in-SBL-device.wwan +Patch285: 0008-drivers-net-wwan-add-simple-DTR-driver.wwan +Patch286: 0009-drivers-bus-mhi-host-fix-recovery-process-when-modem-.wwan +Patch287: 0001-Revert-drivers-bus-mhi-host-fix-recovery-process-when.wwan +Patch288: 0002-Revert-drivers-net-wwan-add-simple-DTR-driver.wwan +Patch289: 0003-Revert-drivers-bus-mhi-add-FN990-NMEA-and-DIAG-in-SBL.wwan +Patch290: 0004-Revert-drivers-bus-mhi-add-FN980-v2-support.wwan +Patch291: 0005-Revert-wwan-add-NMEA-type.wwan +Patch292: 0006-Revert-drivers-bus-mhi-let-userspace-manage-xfp-fw-up.wwan +Patch293: 0007-Revert-bus-mhi-host-allow-SBL-as-initial-EE.wwan +Patch294: 0008-Revert-wwan-add-SAHARA-device.wwan +Patch295: 0009-Revert-Revert-bus-mhi-host-pci_generic-add-support-fo.wwan #pmc_core -Patch295: 0001-platform-x86-intel-pmc-Add-Arrow-Lake-U-H-support.pmc_core -Patch296: 0002-platform-x86-intel-pmc-Add-Bartlett-Lake-support-to-.pmc_core -Patch297: 0001-platform-x86-intel-pmc-Fix-Arrow-Lake-U-H-NPU-PCI.pmc_core +Patch296: 0001-platform-x86-intel-pmc-Add-Arrow-Lake-U-H-support.pmc_core +Patch297: 0002-platform-x86-intel-pmc-Add-Bartlett-Lake-support-to-.pmc_core +Patch298: 0001-platform-x86-intel-pmc-Fix-Arrow-Lake-U-H-NPU-PCI.pmc_core #lpss -Patch298: 0001-Added-spi_set_cs-for-more-stable-r-w-operations-in-S.lpss -Patch299: 0002-mtd-core-Don-t-fail-mtd_device_parse_register-if-OTP.lpss -Patch300: 0003-spi-intel-pci-Add-support-for-Arrow-Lake-H-SPI-seria.lpss -Patch301: 0004-spi-intel-Add-protected-and-locked-attributes.lpss +Patch299: 0001-Added-spi_set_cs-for-more-stable-r-w-operations-in-S.lpss +Patch300: 0002-mtd-core-Don-t-fail-mtd_device_parse_register-if-OTP.lpss +Patch301: 0003-spi-intel-pci-Add-support-for-Arrow-Lake-H-SPI-seria.lpss +Patch302: 0004-spi-intel-Add-protected-and-locked-attributes.lpss #preempt_rt patches backported -Patch302: 0001-Revert-sched-core-Remove-the-unnecessary-need_resche.rt -Patch303: 0001-hrtimer-Use-__raise_softirq_irqoff-to-raise-the-softirq.rt -Patch304: 0002-timers-Use-__raise_softirq_irqoff-to-raise-the-softirq.rt -Patch305: 0003-softirq-Use-a-dedicated-thread-for-timer-wakeups-on-PRE.rt -Patch306: 0004-serial-8250-Switch-to-nbcon-console.rt -Patch307: 0005-serial-8250-Revert-drop-lockdep-annotation-from-serial8.rt -Patch308: 0006-locking-rt-Remove-one-__cond_lock-in-RT-s-spin_trylock_.rt -Patch309: 0007-locking-rt-Add-sparse-annotation-for-RCU.rt -Patch310: 0008-locking-rt-Annotate-unlock-followed-by-lock-for-sparse.rt -Patch311: 0009-drm-i915-Use-preempt_disable-enable_rt-where-recommende.rt -Patch312: 0010-drm-i915-Don-t-disable-interrupts-on-PREEMPT_RT-during-.rt -Patch313: 0011-drm-i915-Don-t-check-for-atomic-context-on-PREEMPT_RT.rt -Patch314: 0012-drm-i915-Disable-tracing-points-on-PREEMPT_RT.rt -Patch315: 0013-drm-i915-gt-Use-spin_lock_irq-instead-of-local_irq_disa.rt -Patch316: 0014-drm-i915-Drop-the-irqs_disabled-check.rt -Patch317: 0015-drm-i915-guc-Consider-also-RCU-depth-in-busy-loop.rt -Patch318: 0016-Revert-drm-i915-Depend-on-PREEMPT_RT.rt -Patch319: 0017-sched-Add-TIF_NEED_RESCHED_LAZY-infrastructure.rt -Patch320: 0018-sched-Add-Lazy-preemption-model.rt -Patch321: 0019-sched-Enable-PREEMPT_DYNAMIC-for-PREEMPT_RT.rt -Patch322: 0020-sched-x86-Enable-Lazy-preemption.rt -Patch323: 0021-sched-Add-laziest-preempt-model.rt -Patch324: 0022-sched-Fixup-the-IS_ENABLED-check-for-PREEMPT_LAZY.rt -Patch325: 0023-tracing-Remove-TRACE_FLAG_IRQS_NOSUPPORT.rt -Patch326: 0024-tracing-Record-task-flag-NEED_RESCHED_LAZY.rt -Patch327: 0025-sysfs-Add-sys-kernel-realtime-entry.rt -Patch328: 0001-serial-8250-enable-original-console-by-default.rt -Patch329: 0001-kernel-trace-Add-DISALLOW_TRACE_PRINTK-make-option.rt -Patch330: 0002-Revert-scripts-remove-bin2c.rt -Patch331: 0003-extend-uio-driver-to-supports-msix.rt -Patch332: 0004-virtio-add-VIRTIO_PMD-support.rt -Patch333: 0005-virt-acrn-Introduce-interfaces-for-PIO-device.rt -Patch334: 0006-Add-hypercall-to-access-MSR.rt -Patch335: 0007-Revert-spi-Remove-unused-function-spi_busnum_to_master.rt -Patch336: 0008-igc-add-CONFIG_IGC_TSN_TRACE-conditional-trace_printk-u.rt -Patch337: 0009-stmmac_pci-add-CONFIG_STMMAC_TSN_TRACE-conditional-trac.rt -Patch338: 0010-igb-prepare-for-AF_XDP-zero-copy-support.rt -Patch339: 0011-igb-Introduce-XSK-data-structures-and-helpers.rt -Patch340: 0012-igb-add-AF_XDP-zero-copy-Rx-support.rt -Patch341: 0013-igb-add-AF_XDP-zero-copy-Tx-support.rt -Patch342: 0014-igb-Add-BTF-based-metadata-for-XDP.rt -Patch343: 0015-ANDROID-trace-power-add-trace_clock_set_parent.rt -Patch344: 0016-ANDROID-trace-net-use-pK-for-kernel-pointers.rt -Patch345: 0017-ANDROID-trace-add-non-hierarchical-function_graph-optio.rt -Patch346: 0018-virtio-fix-VIRTIO_PMD-support.rt -Patch347: 0019-drm-i915-add-i915-perf-event-capacity.rt -Patch348: 0020-drm-xe-pm-allow-xe-with-CONFIG_PM.rt +Patch303: 0001-Revert-sched-core-Remove-the-unnecessary-need_resche.rt +Patch304: 0001-hrtimer-Use-__raise_softirq_irqoff-to-raise-the-softirq.rt +Patch305: 0002-timers-Use-__raise_softirq_irqoff-to-raise-the-softirq.rt +Patch306: 0003-softirq-Use-a-dedicated-thread-for-timer-wakeups-on-PRE.rt +Patch307: 0004-serial-8250-Switch-to-nbcon-console.rt +Patch308: 0005-serial-8250-Revert-drop-lockdep-annotation-from-serial8.rt +Patch309: 0006-locking-rt-Remove-one-__cond_lock-in-RT-s-spin_trylock_.rt +Patch310: 0007-locking-rt-Add-sparse-annotation-for-RCU.rt +Patch311: 0008-locking-rt-Annotate-unlock-followed-by-lock-for-sparse.rt +Patch312: 0009-drm-i915-Use-preempt_disable-enable_rt-where-recommende.rt +Patch313: 0010-drm-i915-Don-t-disable-interrupts-on-PREEMPT_RT-during-.rt +Patch314: 0011-drm-i915-Don-t-check-for-atomic-context-on-PREEMPT_RT.rt +Patch315: 0012-drm-i915-Disable-tracing-points-on-PREEMPT_RT.rt +Patch316: 0013-drm-i915-gt-Use-spin_lock_irq-instead-of-local_irq_disa.rt +Patch317: 0014-drm-i915-Drop-the-irqs_disabled-check.rt +Patch318: 0015-drm-i915-guc-Consider-also-RCU-depth-in-busy-loop.rt +Patch319: 0016-Revert-drm-i915-Depend-on-PREEMPT_RT.rt +Patch320: 0017-sched-Add-TIF_NEED_RESCHED_LAZY-infrastructure.rt +Patch321: 0018-sched-Add-Lazy-preemption-model.rt +Patch322: 0019-sched-Enable-PREEMPT_DYNAMIC-for-PREEMPT_RT.rt +Patch323: 0020-sched-x86-Enable-Lazy-preemption.rt +Patch324: 0021-sched-Add-laziest-preempt-model.rt +Patch325: 0022-sched-Fixup-the-IS_ENABLED-check-for-PREEMPT_LAZY.rt +Patch326: 0023-tracing-Remove-TRACE_FLAG_IRQS_NOSUPPORT.rt +Patch327: 0024-tracing-Record-task-flag-NEED_RESCHED_LAZY.rt +Patch328: 0025-sysfs-Add-sys-kernel-realtime-entry.rt +Patch329: 0001-serial-8250-enable-original-console-by-default.rt +Patch330: 0001-kernel-trace-Add-DISALLOW_TRACE_PRINTK-make-option.rt +Patch331: 0002-Revert-scripts-remove-bin2c.rt +Patch332: 0003-extend-uio-driver-to-supports-msix.rt +Patch333: 0004-virtio-add-VIRTIO_PMD-support.rt +Patch334: 0005-virt-acrn-Introduce-interfaces-for-PIO-device.rt +Patch335: 0006-Add-hypercall-to-access-MSR.rt +Patch336: 0007-Revert-spi-Remove-unused-function-spi_busnum_to_master.rt +Patch337: 0008-igc-add-CONFIG_IGC_TSN_TRACE-conditional-trace_printk-u.rt +Patch338: 0009-stmmac_pci-add-CONFIG_STMMAC_TSN_TRACE-conditional-trac.rt +Patch339: 0010-igb-prepare-for-AF_XDP-zero-copy-support.rt +Patch340: 0011-igb-Introduce-XSK-data-structures-and-helpers.rt +Patch341: 0012-igb-add-AF_XDP-zero-copy-Rx-support.rt +Patch342: 0013-igb-add-AF_XDP-zero-copy-Tx-support.rt +Patch343: 0014-igb-Add-BTF-based-metadata-for-XDP.rt +Patch344: 0015-ANDROID-trace-power-add-trace_clock_set_parent.rt +Patch345: 0016-ANDROID-trace-net-use-pK-for-kernel-pointers.rt +Patch346: 0017-ANDROID-trace-add-non-hierarchical-function_graph-optio.rt +Patch347: 0018-virtio-fix-VIRTIO_PMD-support.rt +Patch348: 0019-drm-i915-add-i915-perf-event-capacity.rt +Patch349: 0020-drm-xe-pm-allow-xe-with-CONFIG_PM.rt #drm -Patch349: 0001-drm-i915-enable-guc-submission-for-ADLs-by-default.drm -Patch350: 0001-drm-i915-disable-a-couple-of-RT-functions-if-RT-is-d.drm -Patch351: 0001-drm-i915-disable-dGPU-support-with-RT-kernel.drm -Patch352: 0001-i915-Update-GUC-to-v70.44.1-for-i915-platforms.drm -Patch353: 0001-Revert-drm-i915-disable-dGPU-support-with-RT-kernel.drm -Patch354: 0001-drm-i915-gt-Avoid-using-masked-workaround-for-CCS_MODE.drm -Patch355: 0002-drm-i915-gt-Move-the-CCS-mode-variable-to-a-global-pos.drm -Patch356: 0003-drm-i915-gt-Allow-the-creation-of-multi-mode-CCS-masks.drm -Patch357: 0004-drm-i915-gt-Refactor-uabi-engine-class-instance-list-c.drm -Patch358: 0005-drm-i915-gem-Mark-and-verify-UABI-engine-validity.drm -Patch359: 0006-drm-i915-gt-Introduce-for_each_enabled_engine-and-appl.drm -Patch360: 0007-drm-i915-gt-Manage-CCS-engine-creation-within-UABI-exp.drm -Patch361: 0008-drm-i915-gt-Remove-cslices-mask-value-from-the-CCS-str.drm -Patch362: 0009-drm-i915-gt-Expose-the-number-of-total-CCS-slices.drm -Patch363: 0010-drm-i915-gt-Store-engine-related-sysfs-kobjects.drm -Patch364: 0011-drm-i915-gt-Store-active-CCS-mask.drm -Patch365: 0012-drm-i915-Protect-access-to-the-UABI-engines-list-with-.drm -Patch366: 0013-drm-i915-gt-Isolate-single-sysfs-engine-file-creation.drm -Patch367: 0014-drm-i915-gt-Implement-creation-and-removal-routines-fo.drm -Patch368: 0015-drm-i915-gt-Allow-the-user-to-change-the-CCS-mode-thro.drm -Patch369: 0016-drm-i915-gt-Refactor-CCS-mode-handling-and-improve-app.drm -Patch370: 0017-drm-i915-no-waiting-for-page-flip-in-vpp-case.drm -Patch371: 0001-Remove-unneeded-files.patch +Patch350: 0001-drm-i915-enable-guc-submission-for-ADLs-by-default.drm +Patch351: 0001-drm-i915-disable-a-couple-of-RT-functions-if-RT-is-d.drm +Patch352: 0001-drm-i915-disable-dGPU-support-with-RT-kernel.drm +Patch353: 0001-i915-Update-GUC-to-v70.44.1-for-i915-platforms.drm +Patch354: 0001-Revert-drm-i915-disable-dGPU-support-with-RT-kernel.drm +Patch355: 0001-drm-i915-gt-Avoid-using-masked-workaround-for-CCS_MODE.drm +Patch356: 0002-drm-i915-gt-Move-the-CCS-mode-variable-to-a-global-pos.drm +Patch357: 0003-drm-i915-gt-Allow-the-creation-of-multi-mode-CCS-masks.drm +Patch358: 0004-drm-i915-gt-Refactor-uabi-engine-class-instance-list-c.drm +Patch359: 0005-drm-i915-gem-Mark-and-verify-UABI-engine-validity.drm +Patch360: 0006-drm-i915-gt-Introduce-for_each_enabled_engine-and-appl.drm +Patch361: 0007-drm-i915-gt-Manage-CCS-engine-creation-within-UABI-exp.drm +Patch362: 0008-drm-i915-gt-Remove-cslices-mask-value-from-the-CCS-str.drm +Patch363: 0009-drm-i915-gt-Expose-the-number-of-total-CCS-slices.drm +Patch364: 0010-drm-i915-gt-Store-engine-related-sysfs-kobjects.drm +Patch365: 0011-drm-i915-gt-Store-active-CCS-mask.drm +Patch366: 0012-drm-i915-Protect-access-to-the-UABI-engines-list-with-.drm +Patch367: 0013-drm-i915-gt-Isolate-single-sysfs-engine-file-creation.drm +Patch368: 0014-drm-i915-gt-Implement-creation-and-removal-routines-fo.drm +Patch369: 0015-drm-i915-gt-Allow-the-user-to-change-the-CCS-mode-thro.drm +Patch370: 0016-drm-i915-gt-Refactor-CCS-mode-handling-and-improve-app.drm +Patch371: 0017-drm-i915-no-waiting-for-page-flip-in-vpp-case.drm +Patch372: 0001-Remove-unneeded-files.patch #rapl -Patch372: 0001-powercap-intel_rapl-Add-support-for-Bartlett-Lake-pl.rapl +Patch373: 0001-powercap-intel_rapl-Add-support-for-Bartlett-Lake-pl.rapl #misc -Patch373: 0001-Add-security.md-file.misc +Patch374: 0001-Add-security.md-file.misc #emt-drm -Patch374: 0075-drm-xe-gsc-mei-interrupt-top-half-should-be-in-irq-d.patch -# CVE Patches +Patch375: 0075-drm-xe-gsc-mei-interrupt-top-half-should-be-in-irq-d.patch #CVE-2025-21709 -Patch375: CVE-2025-21709.patch -#CVE-2025-21807 -Patch376: CVE-2025-21807.patch +Patch376: CVE-2025-21709.patch #CVE-2025-21817 Patch377: CVE-2025-21817.patch -#CVE-2025-22103 -Patch378: CVE-2025-22103.patch #CVE-2025-22104 -Patch379: CVE-2025-22104.patch +Patch378: CVE-2025-22104.patch #CVE-2025-22105 -Patch380: CVE-2025-22105.patch -Patch381: CVE-2025-22105-1.patch +Patch379: CVE-2025-22105.patch +Patch380: CVE-2025-22105-1.patch #CVE-2025-22106 -Patch382: CVE-2025-22106.patch +Patch381: CVE-2025-22106.patch #CVE-2025-22108 -Patch383: CVE-2025-22108.patch +Patch382: CVE-2025-22108.patch #CVE-2025-22111 -Patch384: CVE-2025-22111.patch -#CVE-2025-22113 -Patch385: CVE-2025-22113.patch -Patch386: CVE-2025-22113-1.patch +Patch383: CVE-2025-22111.patch #CVE-2025-22116 -Patch387: CVE-2025-22116.patch +Patch384: CVE-2025-22116.patch #CVE-2025-22117 -Patch388: CVE-2025-22117.patch +Patch385: CVE-2025-22117.patch #CVE-2025-22121 -Patch389: CVE-2025-22121.patch -Patch390: CVE-2025-22121-1.patch -#CVE-2025-22124 -Patch391: CVE-2025-22124.patch +Patch386: CVE-2025-22121.patch +Patch387: CVE-2025-22121-1.patch #CVE-2025-23131 -Patch392: CVE-2025-23131.patch +Patch388: CVE-2025-23131.patch #CVE-2025-37746 -Patch393: CVE-2025-37746.patch -Patch394: CVE-2025-37746-1.patch +Patch389: CVE-2025-37746.patch +Patch390: CVE-2025-37746-1.patch #CVE-2025-37906 -Patch395: CVE-2025-37906.patch +Patch391: CVE-2025-37906.patch #CVE-2025-38041 -Patch396: CVE-2025-38041.patch -Patch397: CVE-2025-38041-1.patch -Patch398: CVE-2025-38041-2.patch +Patch392: CVE-2025-38041.patch +Patch393: CVE-2025-38041-1.patch +Patch394: CVE-2025-38041-2.patch #CVE-2025-38029 -Patch399: CVE-2025-38029.patch +Patch395: CVE-2025-38029.patch #CVE-2025-38311 -Patch400: CVE-2025-38311.patch -#CVE-2025-38306 -Patch401: CVE-2025-38306.patch +Patch396: CVE-2025-38311.patch #CVE-2025-38248 -Patch402: CVE-2025-38248.patch +Patch397: CVE-2025-38248.patch #CVE-2025-38234 -Patch403: CVE-2025-38234.patch +Patch398: CVE-2025-38234.patch #CVE-2025-38207 -Patch404: CVE-2025-38207.patch +Patch399: CVE-2025-38207.patch #CVE-2025-38137 -Patch405: CVE-2025-38137.patch +Patch400: CVE-2025-38137.patch #CVE-2025-38105 -Patch406: CVE-2025-38105.patch +Patch401: CVE-2025-38105.patch #CVE-2025-40325 -Patch407: CVE-2025-40325.patch +Patch402: CVE-2025-40325.patch #CVE-2025-38284 -Patch408: CVE-2025-38284.patch -Patch409: CVE-2025-38284-1.patch -Patch410: CVE-2025-38284-2.patch -#CVE-2025-38272 -Patch411: CVE-2025-38272.patch -Patch412: CVE-2025-38272-1.patch -Patch413: CVE-2025-38272-2.patch +Patch403: CVE-2025-38284.patch +Patch404: CVE-2025-38284-1.patch +Patch405: CVE-2025-38284-2.patch #CVE-2025-38199 -Patch414: CVE-2025-38199.patch +Patch406: CVE-2025-38199.patch #CVE-2025-38140 -Patch415: CVE-2025-38140.patch +Patch407: CVE-2025-38140.patch #CVE-2025-38132 -Patch416: CVE-2025-38132.patch -Patch417: CVE-2025-38132-1.patch +Patch408: CVE-2025-38132.patch +Patch409: CVE-2025-38132-1.patch #CVE-2025-37743 -Patch418: CVE-2025-37743.patch -#CVE-2025-23133 -Patch419: CVE-2025-23133.patch +Patch410: CVE-2025-37743.patch #CVE-2025-23132 -Patch420: CVE-2025-23132.patch +Patch411: CVE-2025-23132.patch #CVE-2025-23130 -Patch421: CVE-2025-23130.patch +Patch412: CVE-2025-23130.patch #CVE-2025-23129 -Patch422: CVE-2025-23129.patch +Patch413: CVE-2025-23129.patch #CVE-2025-22127 -Patch423: CVE-2025-22127.patch -#CVE-2025-22125 -Patch424: CVE-2025-22125.patch +Patch414: CVE-2025-22127.patch #CVE-2025-22109 -Patch425: CVE-2025-22109.patch +Patch415: CVE-2025-22109.patch #CVE-2025-21752 -Patch426: CVE-2025-21752.patch -Patch427: CVE-2025-21752-1.patch +Patch416: CVE-2025-21752.patch +Patch417: CVE-2025-21752-1.patch #CVE-2025-37860 -Patch428: CVE-2025-37860.patch +Patch418: CVE-2025-37860.patch #CVE-2024-58095 -Patch429: CVE-2024-58095.patch +Patch419: CVE-2024-58095.patch #CVE-2024-58094 -Patch430: CVE-2024-58094.patch +Patch420: CVE-2024-58094.patch #CVE-2024-57995 -Patch431: CVE-2024-57995.patch +Patch421: CVE-2024-57995.patch #CVE-2024-52560 -Patch432: CVE-2024-52560.patch -Patch433: CVE-2024-52560-1.patch +Patch422: CVE-2024-52560.patch +Patch423: CVE-2024-52560-1.patch #CVE-2025-38621 -Patch434: CVE-2025-38621.patch -#CVE-2025-38502 -Patch435: CVE-2025-38502.patch +Patch424: CVE-2025-38621.patch #CVE-2025-38627 -Patch436: CVE-2025-38627.patch +Patch425: CVE-2025-38627.patch #CVE-2025-38643 -Patch437: CVE-2025-38643.patch +Patch426: CVE-2025-38643.patch +#CVE-2025-39789 +Patch427: CVE-2025-39789.patch +#CVE-2025-39764 +Patch428: CVE-2025-39764.patch +#CVE-2025-39745 +Patch429: CVE-2025-39745.patch +#CVE-2025-39677 +Patch430: CVE-2025-39677.patch +# CVE Patches %global security_hardening none %global sha512hmac bash %{_sourcedir}/sha512hmac-openssl.sh @@ -666,8 +654,8 @@ manipulation of eBPF programs and maps. %prep %define _default_patch_flags -p1 --fuzz=3 --force -%setup -q -n linux-6.12.44 -%autosetup -p1 -n linux-6.12.44 +%setup -q -n linux-6.12.47 +%autosetup -p1 -n linux-6.12.47 # %patch 0 -p1 make mrproper @@ -913,6 +901,9 @@ echo "initrd of kernel %{uname_r} removed" >&2 %{_sysconfdir}/bash_completion.d/bpftool %changelog +* Thu Sep 18 2025 Ren Jiaojiao - 6.12.47-1 +- Update kernel to 6.12.47 + * Tue Sep 09 2025 Ren Jiaojiao - 6.12.44-1 - Update kernel to 6.12.44 diff --git a/SPECS/kernel/series b/SPECS/kernel/series index 77137c69c1..179f535971 100644 --- a/SPECS/kernel/series +++ b/SPECS/kernel/series @@ -1,5 +1,5 @@ -# Series file for v6.12.44 linux kernel -# 11a24528d080a Linux 6.12.44 +# Series file for v6.12.47 linux kernel +# f6cf124428f51 Linux 6.12.47 #sriov 0001-drm-i915-mtl-Add-C10-table-for-HDMI-Clock-25175.sriov 0002-drm-i915-mtl-Copy-c10-phy-pll-sw-state-from-master-t.sriov @@ -58,6 +58,7 @@ 0002-virtio-break-and-reset-virtio-devices-on-device_shut.sriov 0003-virtgpu-don-t-reset-on-shutdown.sriov 0004-drm-virtio-implement-virtio_gpu_shutdown.sriov +0001-drm-virtio-Wait-until-the-control-and-cursor-queues-.sriov #security 0001-mei-bus-add-api-to-query-capabilities-of-ME-clien.security 0002-mei-virtio-virtualization-frontend-driver.security @@ -392,15 +393,9 @@ #CVE-2025-21709 CVE-2025-21709.patch -#CVE-2025-21807 -CVE-2025-21807.patch - #CVE-2025-21817 CVE-2025-21817.patch -#CVE-2025-22103 -CVE-2025-22103.patch - #CVE-2025-22104 CVE-2025-22104.patch @@ -417,10 +412,6 @@ CVE-2025-22108.patch #CVE-2025-22111 CVE-2025-22111.patch -#CVE-2025-22113 -CVE-2025-22113.patch -CVE-2025-22113-1.patch - #CVE-2025-22116 CVE-2025-22116.patch @@ -431,9 +422,6 @@ CVE-2025-22117.patch CVE-2025-22121.patch CVE-2025-22121-1.patch -#CVE-2025-22124 -CVE-2025-22124.patch - #CVE-2025-23131 CVE-2025-23131.patch @@ -455,9 +443,6 @@ CVE-2025-38029.patch #CVE-2025-38311 CVE-2025-38311.patch -#CVE-2025-38306 -CVE-2025-38306.patch - #CVE-2025-38248 CVE-2025-38248.patch @@ -481,11 +466,6 @@ CVE-2025-38284.patch CVE-2025-38284-1.patch CVE-2025-38284-2.patch -#CVE-2025-38272 -CVE-2025-38272.patch -CVE-2025-38272-1.patch -CVE-2025-38272-2.patch - #CVE-2025-38199 CVE-2025-38199.patch @@ -499,9 +479,6 @@ CVE-2025-38132-1.patch #CVE-2025-37743 CVE-2025-37743.patch -#CVE-2025-23133 -CVE-2025-23133.patch - #CVE-2025-23132 CVE-2025-23132.patch @@ -514,9 +491,6 @@ CVE-2025-23129.patch #CVE-2025-22127 CVE-2025-22127.patch -#CVE-2025-22125 -CVE-2025-22125.patch - #CVE-2025-22109 CVE-2025-22109.patch @@ -543,11 +517,20 @@ CVE-2024-52560-1.patch #CVE-2025-38621 CVE-2025-38621.patch -#CVE-2025-38502 -CVE-2025-38502.patch - #CVE-2025-38627 CVE-2025-38627.patch #CVE-2025-38643 CVE-2025-38643.patch + +#CVE-2025-39789 +CVE-2025-39789.patch + +#CVE-2025-39764 +CVE-2025-39764.patch + +#CVE-2025-39745 +CVE-2025-39745.patch + +#CVE-2025-39677 +CVE-2025-39677.patch diff --git a/SPECS/nvidia-data-center-driver/nvidia-data-center-driver.spec b/SPECS/nvidia-data-center-driver/nvidia-data-center-driver.spec index 63109f7018..e0d21b4873 100644 --- a/SPECS/nvidia-data-center-driver/nvidia-data-center-driver.spec +++ b/SPECS/nvidia-data-center-driver/nvidia-data-center-driver.spec @@ -10,7 +10,7 @@ Summary: nvidia gpu driver kernel module for data center devices Name: nvidia-data-center-driver Version: 570.133.20 -Release: 5%{?dist} +Release: 6%{?dist} License: Public Domain Source0: https://us.download.nvidia.com/tesla/%{version}/NVIDIA-Linux-x86_64-%{version}.run Vendor: Intel Corporation @@ -51,6 +51,9 @@ make INSTALL_MOD_PATH=%{buildroot} modules_install /sbin/depmod -a %changelog +* Thu Sep 18 2025 Ren Jiaojiao - 570.133.20-6 +- Bump release to rebuild + * Tue Sep 09 2025 Ren Jiaojiao - 570.133.20-5 - Bump release to rebuild diff --git a/cgmanifest.json b/cgmanifest.json index 60c75d29f3..4d18d3deb8 100644 --- a/cgmanifest.json +++ b/cgmanifest.json @@ -8491,8 +8491,8 @@ "type": "other", "other": { "name": "kernel", - "version": "6.12.44", - "downloadUrl": "https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.44.tar.gz" + "version": "6.12.47", + "downloadUrl": "https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.47.tar.gz" } } }, @@ -8511,8 +8511,8 @@ "type": "other", "other": { "name": "kernel-headers", - "version": "6.12.44", - "downloadUrl": "https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.44.tar.gz" + "version": "6.12.47", + "downloadUrl": "https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.47.tar.gz" } } }, @@ -8551,8 +8551,8 @@ "type": "other", "other": { "name": "kernel-rt", - "version": "6.12.44", - "downloadUrl": "https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.44.tar.gz" + "version": "6.12.47", + "downloadUrl": "https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.47.tar.gz" } } }, diff --git a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt index f637097a25..c4b04e2e52 100644 --- a/toolkit/resources/manifests/package/pkggen_core_x86_64.txt +++ b/toolkit/resources/manifests/package/pkggen_core_x86_64.txt @@ -1,5 +1,5 @@ filesystem-1.1-21.emt3.x86_64.rpm -kernel-headers-6.12.44-1.emt3.noarch.rpm +kernel-headers-6.12.47-1.emt3.noarch.rpm glibc-2.38-10.emt3.x86_64.rpm glibc-devel-2.38-10.emt3.x86_64.rpm glibc-i18n-2.38-10.emt3.x86_64.rpm diff --git a/toolkit/resources/manifests/package/toolchain_x86_64.txt b/toolkit/resources/manifests/package/toolchain_x86_64.txt index 922dfef534..b6782b9a85 100644 --- a/toolkit/resources/manifests/package/toolchain_x86_64.txt +++ b/toolkit/resources/manifests/package/toolchain_x86_64.txt @@ -150,8 +150,8 @@ intltool-0.51.0-7.emt3.noarch.rpm itstool-2.0.7-1.emt3.noarch.rpm kbd-2.2.0-2.emt3.x86_64.rpm kbd-debuginfo-2.2.0-2.emt3.x86_64.rpm -kernel-cross-headers-6.12.44-1.emt3.noarch.rpm -kernel-headers-6.12.44-1.emt3.noarch.rpm +kernel-cross-headers-6.12.47-1.emt3.noarch.rpm +kernel-headers-6.12.47-1.emt3.noarch.rpm kmod-30-1.emt3.x86_64.rpm kmod-debuginfo-30-1.emt3.x86_64.rpm kmod-devel-30-1.emt3.x86_64.rpm diff --git a/toolkit/scripts/toolchain/container/Dockerfile b/toolkit/scripts/toolchain/container/Dockerfile index 08ca561498..7c9cc86de2 100644 --- a/toolkit/scripts/toolchain/container/Dockerfile +++ b/toolkit/scripts/toolchain/container/Dockerfile @@ -63,7 +63,7 @@ RUN wget -nv --no-clobber --timeout=30 --continue --input-file=$LFS/tools/toolch # Disable downloading from remote sources by default. The 'toolchain-local-wget-list' generated for the above line will download from $(SOURCE_URL) # The 'toolchain-remote-wget-list' is still available and can be used as an alternate to $(SOURCE_URL) if desired. #RUN wget -nv --no-clobber --timeout=30 --continue --input-file=$LFS/tools/toolchain-remote-wget-list --directory-prefix=$LFS/sources; exit 0 -RUN wget -nv --no-clobber --timeout=30 --continue https://github.com/intel/linux-intel-lts/archive/refs/tags/lts-v6.12.44-emt-250903T203906Z.tar.gz -O lts-v6.12.44-emt-250903T203906Z.tar.gz --directory-prefix=$LFS/sources; exit 0 +RUN wget -nv --no-clobber --timeout=30 --continue https://github.com/intel/linux-intel-lts/archive/refs/tags/lts-v6.12.47-emt-250915T223915Z.tar.gz -O lts-v6.12.47-emt-250915T223915Z.tar.gz --directory-prefix=$LFS/sources; exit 0 USER root RUN mkdir -pv $LFS/{etc,var} $LFS/usr/{bin,lib,sbin} && \ diff --git a/toolkit/scripts/toolchain/container/toolchain-sha256sums b/toolkit/scripts/toolchain/container/toolchain-sha256sums index 2d1afafe1c..5417aab603 100644 --- a/toolkit/scripts/toolchain/container/toolchain-sha256sums +++ b/toolkit/scripts/toolchain/container/toolchain-sha256sums @@ -28,7 +28,7 @@ a3c2b80201b89e68616f4ad30bc66aee4927c3ce50e33929ca819d5c43538898 gmp-6.3.0.tar. 1db2aedde89d0dea42b16d9528f894c8d15dae4e190b59aecc78f5a951276eab grep-3.11.tar.xz 6b9757f592b7518b4902eb6af7e54570bdccba37a871fddb2d30ae3863511c13 groff-1.23.0.tar.gz 7454eb6935db17c6655576c2e1b0fabefd38b4d0936e0f87f48cd062ce91a057 gzip-1.13.tar.xz -fac0ed5371cbd46ebc8a2a1e152ac5fbb5fc2660e748a7fc1d28b8e399854a1a linux-6.12.44.tar.gz +6b05f6d6ee7d51d4def7e642cbdafec955812e1156548bc4197e38c89bc38fbc linux-6.12.47.tar.gz 5d24e40819768f74daf846b99837fc53a3a9dcdf3ce1c2003fe0596db850f0f0 libarchive-3.7.1.tar.gz f311f8f3dad84699d0566d1d6f7ec943a9298b28f714cae3c931dfd57492d7eb libcap-2.69.tar.xz b8b45194989022a79ec1317f64a2a75b1551b2a55bea06f67704cb2a2e4690b0 libpipeline-1.5.7.tar.gz diff --git a/toolkit/scripts/toolchain/container/toolchain_build_temp_tools.sh b/toolkit/scripts/toolchain/container/toolchain_build_temp_tools.sh index 856269d55f..f79c3ea0f2 100755 --- a/toolkit/scripts/toolchain/container/toolchain_build_temp_tools.sh +++ b/toolkit/scripts/toolchain/container/toolchain_build_temp_tools.sh @@ -86,9 +86,9 @@ rm -rf gcc-13.2.0 touch $LFS/logs/temptoolchain/status_gcc_pass1_complete -KERNEL_VERSION="6.12.44" +KERNEL_VERSION="6.12.47" echo Linux-${KERNEL_VERSION} API Headers -tar xf linux-6.12.44.tar.gz +tar xf linux-6.12.47.tar.gz pushd linux-${KERNEL_VERSION} make mrproper make headers