diff --git a/packages/kernel-6.1/1008-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch b/packages/kernel-6.1/1008-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch deleted file mode 100644 index 586cd505..00000000 --- a/packages/kernel-6.1/1008-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 40d30498c8ea3e3495642f8cc5c263cb13d55b76 Mon Sep 17 00:00:00 2001 -From: Wongi Lee -Date: Tue, 16 Jun 2026 22:38:29 +0900 -Subject: [PATCH] ipv4: account for fraggap on the paged allocation path - -In __ip_append_data(), when the paged-allocation branch is taken, -alloclen and pagedlen are computed as - - alloclen = fragheaderlen + transhdrlen; - pagedlen = datalen - transhdrlen; - -datalen already includes fraggap, but the fraggap bytes carried over -from the previous skb are copied into the new skb's linear area at -offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The -linear area is therefore undersized by fraggap bytes while pagedlen is -overstated by the same amount. - -The non-paged branch sets alloclen to fraglen, which already accounts -for fraggap because datalen does. Bring the paged branch in line by -adding fraggap to alloclen and subtracting it from pagedlen. - -After this adjustment, copy no longer collapses to -fraggap on the -paged path, so remove the stale comment describing that old arithmetic. - -Fixes: 8eb77cc73977 ("ipv4: avoid partial copy for zc") -Signed-off-by: Jungwoo Lee -Signed-off-by: Wongi Lee -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/ajFR1eLAIs42TN3g@DESKTOP-19IMU7U.localdomain -Signed-off-by: Jakub Kicinski - -[Resolve merge conflict caused by missing 5204ccbfa223 which wraps -INDIRECT_CALL_1. Resolve the merge conflict by keeping current logic.] - -Signed-off-by: Stanislav Uschakow -(cherry picked from commit d11d68214a0afab174ab8f712890452adcf7c196) ---- - net/ipv4/ip_output.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index f5a2ad2b2dbdf..778214137e4a2 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1117,8 +1117,8 @@ static int __ip_append_data(struct sock *sk, - !(rt->dst.dev->features & NETIF_F_SG))) - alloclen = fraglen; - else { -- alloclen = fragheaderlen + transhdrlen; -- pagedlen = datalen - transhdrlen; -+ alloclen = fragheaderlen + transhdrlen + fraggap; -+ pagedlen = datalen - transhdrlen - fraggap; - } - - alloclen += alloc_extra; --- -2.52.0 - diff --git a/packages/kernel-6.1/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch b/packages/kernel-6.1/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch deleted file mode 100644 index b8167ecd..00000000 --- a/packages/kernel-6.1/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 39ac6b1dc849d9aed2044d7ae77681b03b482ebc Mon Sep 17 00:00:00 2001 -From: Wongi Lee -Date: Tue, 16 Jun 2026 22:46:17 +0900 -Subject: [PATCH] ipv6: account for fraggap on the paged allocation path - -In __ip6_append_data(), when the paged-allocation branch is taken -(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are -computed as - - alloclen = fragheaderlen + transhdrlen; - pagedlen = datalen - transhdrlen; - -datalen already includes fraggap (datalen = length + fraggap). When -fraggap is non-zero, this is not the first skb and transhdrlen is zero. -The fraggap bytes carried over from the previous skb are copied just past -the fragment headers in the new skb's linear area. The linear area is -therefore undersized by fraggap bytes while pagedlen is overstated by the -same amount, and the copy writes past skb->end into the trailing -skb_shared_info. - -An unprivileged user can trigger this via a UDPv6 socket using -MSG_MORE together with MSG_SPLICE_PAGES. - -The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: -avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix -__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative -copy value caused -EINVAL to be returned. That later commit allowed -MSG_SPLICE_PAGES to proceed in this case, making the corruption -triggerable. - -The non-paged branch sets alloclen to fraglen, which already accounts -for fraggap because datalen does. Bring the paged branch in line by -adding fraggap to alloclen and subtracting it from pagedlen. - -After this adjustment, copy no longer collapses to -fraggap on the -paged path, so remove the stale comment describing that old arithmetic. -Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES -case, remove the MSG_SPLICE_PAGES exception from the negative copy check. - -Fixes: 773ba4fe9104 ("ipv6: avoid partial copy for zc") -Signed-off-by: Jungwoo Lee -Signed-off-by: Wongi Lee -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/ajFTqRljatR17fFy@DESKTOP-19IMU7U.localdomain -Signed-off-by: Jakub Kicinski -(cherry picked from commit 93e5d33ee907c1f053a83e108b6fa00fecc32ce2) ---- - net/ipv6/ip6_output.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 1e491fa7793ad..d8ce708fcb3c4 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1622,8 +1622,8 @@ static int __ip6_append_data(struct sock *sk, - !(rt->dst.dev->features & NETIF_F_SG))) - alloclen = fraglen; - else { -- alloclen = fragheaderlen + transhdrlen; -- pagedlen = datalen - transhdrlen; -+ alloclen = fragheaderlen + transhdrlen + fraggap; -+ pagedlen = datalen - transhdrlen - fraggap; - } - alloclen += alloc_extra; - --- -2.52.0 - diff --git a/packages/kernel-6.1/Cargo.toml b/packages/kernel-6.1/Cargo.toml index f1605a7d..2d6ebe9c 100644 --- a/packages/kernel-6.1/Cargo.toml +++ b/packages/kernel-6.1/Cargo.toml @@ -13,8 +13,8 @@ path = "../packages.rs" [[package.metadata.build-package.external-files]] # Use latest-kernel-srpm-url.sh to get this. -url = "https://cdn.amazonlinux.com/al2023/blobstore/dd019b47c5df1a1b9dfbbcc124f610f7945b3ca28fb438ffa226409688b6adf2/kernel-6.1.175-219.359.amzn2023.src.rpm" -sha512 = "8a4f62667db6ca2f22cd651d9984ffcf7b95bbd30edfb660ca0394bd5239ab46505d30957d562d8326361e1ceb33ba5465b00c679089a1a3c9cc87cf52965205" +url = "https://cdn.amazonlinux.com/al2023/blobstore/c7221f61e6ea6a37ef89202b4d5c11c3efae0b766d1164d59cab3549f24227e4/kernel-6.1.176-220.360.amzn2023.src.rpm" +sha512 = "39414e0acdd048b6a33410e69958f4acf1e0b37ca71088ce652ec85d0471694ea3bc85fd475ca9327bafdf941e5d50d201303ab72fab26f0f55afc405128b026" force-upstream = true [build-dependencies] diff --git a/packages/kernel-6.1/config-full-bottlerocket-aarch64 b/packages/kernel-6.1/config-full-bottlerocket-aarch64 index 024ff95e..88c36249 100644 --- a/packages/kernel-6.1/config-full-bottlerocket-aarch64 +++ b/packages/kernel-6.1/config-full-bottlerocket-aarch64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.1.175 Kernel Configuration +# Linux/arm64 6.1.176 Kernel Configuration # CONFIG_CC_VERSION_TEXT="aarch64-bottlerocket-linux-gnu-gcc (Buildroot 2025.05.1) 13.4.0" CONFIG_CC_IS_GCC=y @@ -392,6 +392,7 @@ CONFIG_ARM64_ERRATUM_2457168=y CONFIG_ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD=y CONFIG_ARM64_ERRATUM_2966298=y CONFIG_ARM64_ERRATUM_3194386=y +CONFIG_ARM64_ERRATUM_4118414=y CONFIG_CAVIUM_ERRATUM_22375=y CONFIG_CAVIUM_ERRATUM_23144=y CONFIG_CAVIUM_ERRATUM_23154=y diff --git a/packages/kernel-6.1/config-full-bottlerocket-x86_64 b/packages/kernel-6.1/config-full-bottlerocket-x86_64 index 33319bf2..ba1ed377 100644 --- a/packages/kernel-6.1/config-full-bottlerocket-x86_64 +++ b/packages/kernel-6.1/config-full-bottlerocket-x86_64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.1.175 Kernel Configuration +# Linux/x86 6.1.176 Kernel Configuration # CONFIG_CC_VERSION_TEXT="x86_64-bottlerocket-linux-gnu-gcc (Buildroot 2025.05.1) 13.4.0" CONFIG_CC_IS_GCC=y diff --git a/packages/kernel-6.1/kernel-6.1.spec b/packages/kernel-6.1/kernel-6.1.spec index a4e5da7c..7199bf73 100644 --- a/packages/kernel-6.1/kernel-6.1.spec +++ b/packages/kernel-6.1/kernel-6.1.spec @@ -2,13 +2,13 @@ %global kmajor 6.1 Name: %{_cross_os}kernel-6.1 -Version: 6.1.175 +Version: 6.1.176 Release: 1%{?dist} Summary: The Linux kernel License: GPL-2.0 WITH Linux-syscall-note URL: https://www.kernel.org/ # Use latest-kernel-srpm-url.sh to get this. -Source0: https://cdn.amazonlinux.com/al2023/blobstore/dd019b47c5df1a1b9dfbbcc124f610f7945b3ca28fb438ffa226409688b6adf2/kernel-6.1.175-219.359.amzn2023.src.rpm +Source0: https://cdn.amazonlinux.com/al2023/blobstore/c7221f61e6ea6a37ef89202b4d5c11c3efae0b766d1164d59cab3549f24227e4/kernel-6.1.176-220.360.amzn2023.src.rpm Source1: gpgkey-B21C50FA44A99720EAA72F7FE951904AD832C631.asc # Custom Bottlerocket kernel configurations. @@ -48,9 +48,6 @@ Patch1005: 1005-Revert-Revert-drm-fb_helper-improve-CONFIG_FB-depend.patch Patch1006: 1006-strscpy-write-destination-buffer-only-once.patch # Disable incomplete measurement into PCR 9 on aarch64. Patch1007: 1007-efi-libstub-don-t-measure-kernel-command-line-into-P.patch -# Fix undersized linear allocation in IPv* paged path -Patch1008: 1008-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch -Patch1009: 1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch BuildRequires: bc BuildRequires: elfutils-devel diff --git a/packages/kernel-6.12/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch b/packages/kernel-6.12/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch deleted file mode 100644 index 93a7e119..00000000 --- a/packages/kernel-6.12/1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch +++ /dev/null @@ -1,80 +0,0 @@ -From e11f74586e81533758387d0cd1fca6de5daf589b Mon Sep 17 00:00:00 2001 -From: Wongi Lee -Date: Tue, 16 Jun 2026 22:46:17 +0900 -Subject: [PATCH] ipv6: account for fraggap on the paged allocation path - -In __ip6_append_data(), when the paged-allocation branch is taken -(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are -computed as - - alloclen = fragheaderlen + transhdrlen; - pagedlen = datalen - transhdrlen; - -datalen already includes fraggap (datalen = length + fraggap). When -fraggap is non-zero, this is not the first skb and transhdrlen is zero. -The fraggap bytes carried over from the previous skb are copied just past -the fragment headers in the new skb's linear area. The linear area is -therefore undersized by fraggap bytes while pagedlen is overstated by the -same amount, and the copy writes past skb->end into the trailing -skb_shared_info. - -An unprivileged user can trigger this via a UDPv6 socket using -MSG_MORE together with MSG_SPLICE_PAGES. - -The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: -avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix -__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative -copy value caused -EINVAL to be returned. That later commit allowed -MSG_SPLICE_PAGES to proceed in this case, making the corruption -triggerable. - -The non-paged branch sets alloclen to fraglen, which already accounts -for fraggap because datalen does. Bring the paged branch in line by -adding fraggap to alloclen and subtracting it from pagedlen. - -After this adjustment, copy no longer collapses to -fraggap on the -paged path, so remove the stale comment describing that old arithmetic. -Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES -case, remove the MSG_SPLICE_PAGES exception from the negative copy check. - -Fixes: 773ba4fe9104 ("ipv6: avoid partial copy for zc") -Signed-off-by: Jungwoo Lee -Signed-off-by: Wongi Lee -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/ajFTqRljatR17fFy@DESKTOP-19IMU7U.localdomain -Signed-off-by: Jakub Kicinski -(cherry picked from commit b8b9e9717384610556ade742dda516e6d060ef52) ---- - net/ipv6/ip6_output.c | 9 +++------ - 1 file changed, 3 insertions(+), 6 deletions(-) - -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 31021dc40e52..3804ead05a35 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1633,8 +1633,8 @@ static int __ip6_append_data(struct sock *sk, - !(rt->dst.dev->features & NETIF_F_SG))) - alloclen = fraglen; - else { -- alloclen = fragheaderlen + transhdrlen; -- pagedlen = datalen - transhdrlen; -+ alloclen = fragheaderlen + transhdrlen + fraggap; -+ pagedlen = datalen - transhdrlen - fraggap; - } - alloclen += alloc_extra; - -@@ -1649,10 +1649,7 @@ static int __ip6_append_data(struct sock *sk, - fraglen = datalen + fragheaderlen; - - copy = datalen - transhdrlen - fraggap - pagedlen; -- /* [!] NOTE: copy may be negative if pagedlen>0 -- * because then the equation may reduces to -fraggap. -- */ -- if (copy < 0 && !(flags & MSG_SPLICE_PAGES)) { -+ if (copy < 0) { - err = -EINVAL; - goto error; - } --- -2.52.0 - diff --git a/packages/kernel-6.12/1010-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch b/packages/kernel-6.12/1010-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch deleted file mode 100644 index e7318a89..00000000 --- a/packages/kernel-6.12/1010-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch +++ /dev/null @@ -1,71 +0,0 @@ -From ee652c3f488fae4e2ded16484edeffbf9f21ab4f Mon Sep 17 00:00:00 2001 -From: Wongi Lee -Date: Tue, 16 Jun 2026 22:38:29 +0900 -Subject: [PATCH] ipv4: account for fraggap on the paged allocation path - -[Upstream commit eca856950f7cb1a221e02b99d758409f2c5cec42] - -In __ip_append_data(), when the paged-allocation branch is taken, -alloclen and pagedlen are computed as - - alloclen = fragheaderlen + transhdrlen; - pagedlen = datalen - transhdrlen; - -datalen already includes fraggap, but the fraggap bytes carried over -from the previous skb are copied into the new skb's linear area at -offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The -linear area is therefore undersized by fraggap bytes while pagedlen is -overstated by the same amount. - -The non-paged branch sets alloclen to fraglen, which already accounts -for fraggap because datalen does. Bring the paged branch in line by -adding fraggap to alloclen and subtracting it from pagedlen. - -After this adjustment, copy no longer collapses to -fraggap on the -paged path, so remove the stale comment describing that old arithmetic. - -Fixes: 8eb77cc73977 ("ipv4: avoid partial copy for zc") -Signed-off-by: Jungwoo Lee -Signed-off-by: Wongi Lee -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/ajFR1eLAIs42TN3g@DESKTOP-19IMU7U.localdomain -Signed-off-by: Jakub Kicinski - -[Resolve merge conflict caused by missing 5204ccbfa223 which wraps -INDIRECT_CALL_1. Resolve the merge conflict by keeping current logic.] - -Signed-off-by: Stanislav Uschakow -(cherry picked from commit 0cdc534c594541ceb3d3e4f0b6b3141177e652a0) ---- - net/ipv4/ip_output.c | 8 +++----- - 1 file changed, 3 insertions(+), 5 deletions(-) - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index ba51fc42531c..66e8d2181b62 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1118,8 +1118,8 @@ static int __ip_append_data(struct sock *sk, - !(rt->dst.dev->features & NETIF_F_SG))) - alloclen = fraglen; - else { -- alloclen = fragheaderlen + transhdrlen; -- pagedlen = datalen - transhdrlen; -+ alloclen = fragheaderlen + transhdrlen + fraggap; -+ pagedlen = datalen - transhdrlen - fraggap; - } - - alloclen += alloc_extra; -@@ -1166,9 +1166,7 @@ static int __ip_append_data(struct sock *sk, - } - - copy = datalen - transhdrlen - fraggap - pagedlen; -- /* [!] NOTE: copy will be negative if pagedlen>0 -- * because then the equation reduces to -fraggap. -- */ -+ - if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) { - err = -EFAULT; - kfree_skb(skb); --- -2.52.0 - diff --git a/packages/kernel-6.12/1011-eventpoll-split-__ep_remove.patch b/packages/kernel-6.12/1011-eventpoll-split-__ep_remove.patch deleted file mode 100644 index 6e18ba77..00000000 --- a/packages/kernel-6.12/1011-eventpoll-split-__ep_remove.patch +++ /dev/null @@ -1,84 +0,0 @@ -From 9006ec190b43983e2573444ff34fcd99c7b4693b Mon Sep 17 00:00:00 2001 -From: Christian Brauner -Date: Thu, 23 Apr 2026 11:56:05 +0200 -Subject: [PATCH] eventpoll: split __ep_remove() - -[ Upstream commit 0f7bdfd413000985de09fc39eb9efa1e091a3ce0 ] - -Split __ep_remove() to delineate file removal from epoll item removal. - -Suggested-by: Linus Torvalds -Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-2-2470f9eec0f5@kernel.org -Signed-off-by: Christian Brauner (Amutable) -[ squash 3d9fd0a ("eventpoll: use hlist_is_singular_node() in -__ep_remove()") in to fix diff in context lines ] -Signed-off-by: Mark Bundschuh -(cherry picked from commit e6c9db1c4d1bb7efe4c04451fb848b4c8bb393be) ---- - fs/eventpoll.c | 29 ++++++++++++++++++++++++----- - 1 file changed, 24 insertions(+), 5 deletions(-) - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index a860cb54658a3..1cba4ae4a076b 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -797,6 +797,9 @@ static void ep_free(struct eventpoll *ep) - kfree_rcu(ep, rcu); - } - -+static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file); -+static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi); -+ - /* - * Removes a "struct epitem" from the eventpoll RB tree and deallocates - * all the associated resources. Must be called with "mtx" held. -@@ -808,8 +811,6 @@ static void ep_free(struct eventpoll *ep) - static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - { - struct file *file = epi->ffd.file; -- struct epitems_head *to_free; -- struct hlist_head *head; - - lockdep_assert_irqs_enabled(); - -@@ -825,9 +826,22 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - return false; - } - -- to_free = NULL; -- head = file->f_ep; -- if (head->first == &epi->fllink && !epi->fllink.next) { -+ __ep_remove_file(ep, epi, file); -+ return __ep_remove_epi(ep, epi); -+} -+ -+/* -+ * Called with &file->f_lock held, -+ * returns with it released -+ */ -+static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file) -+{ -+ struct epitems_head *to_free = NULL; -+ struct hlist_head *head = file->f_ep; -+ -+ lockdep_assert_held(&ep->mtx); -+ -+ if (hlist_is_singular_node(&epi->fllink, head)) { - /* See eventpoll_release() for details. */ - WRITE_ONCE(file->f_ep, NULL); - if (!is_file_epoll(file)) { -@@ -840,6 +854,11 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - hlist_del_rcu(&epi->fllink); - spin_unlock(&file->f_lock); - free_ephead(to_free); -+} -+ -+static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi) -+{ -+ lockdep_assert_held(&ep->mtx); - - rb_erase_cached(&epi->rbn, &ep->rbr); - --- -2.52.0 - diff --git a/packages/kernel-6.12/1012-eventpoll-kill-__ep_remove.patch b/packages/kernel-6.12/1012-eventpoll-kill-__ep_remove.patch deleted file mode 100644 index 63337da6..00000000 --- a/packages/kernel-6.12/1012-eventpoll-kill-__ep_remove.patch +++ /dev/null @@ -1,130 +0,0 @@ -From 13405a0ac586f3bb7b1375d953fc2a5ae7d40c92 Mon Sep 17 00:00:00 2001 -From: Christian Brauner -Date: Thu, 23 Apr 2026 11:56:06 +0200 -Subject: [PATCH] eventpoll: kill __ep_remove() - -[ Upstream commit e9e5cd40d7c403e19f21d0f7b8b8ba3a76b58330 ] - -Remove the boolean conditional in __ep_remove() and restructure the code -so the check for racing with eventpoll_release_file() are only done in -the ep_remove_safe() path where they belong. - -Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-3-2470f9eec0f5@kernel.org -Signed-off-by: Christian Brauner (Amutable) -Signed-off-by: Mark Bundschuh -(cherry picked from commit 0f255709c784937c4d9d6f42b7af30c1cff1542b) ---- - fs/eventpoll.c | 67 ++++++++++++++++++++++---------------------------- - 1 file changed, 30 insertions(+), 37 deletions(-) - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 1cba4ae4a076b..3ac8a26c3522f 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -797,49 +797,18 @@ static void ep_free(struct eventpoll *ep) - kfree_rcu(ep, rcu); - } - --static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file); --static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi); -- --/* -- * Removes a "struct epitem" from the eventpoll RB tree and deallocates -- * all the associated resources. Must be called with "mtx" held. -- * If the dying flag is set, do the removal only if force is true. -- * This prevents ep_clear_and_put() from dropping all the ep references -- * while running concurrently with eventpoll_release_file(). -- * Returns true if the eventpoll can be disposed. -- */ --static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) --{ -- struct file *file = epi->ffd.file; -- -- lockdep_assert_irqs_enabled(); -- -- /* -- * Removes poll wait queue hooks. -- */ -- ep_unregister_pollwait(ep, epi); -- -- /* Remove the current item from the list of epoll hooks */ -- spin_lock(&file->f_lock); -- if (epi->dying && !force) { -- spin_unlock(&file->f_lock); -- return false; -- } -- -- __ep_remove_file(ep, epi, file); -- return __ep_remove_epi(ep, epi); --} -- - /* - * Called with &file->f_lock held, - * returns with it released - */ --static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file) -+static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, -+ struct file *file) - { - struct epitems_head *to_free = NULL; - struct hlist_head *head = file->f_ep; - - lockdep_assert_held(&ep->mtx); -+ lockdep_assert_held(&file->f_lock); - - if (hlist_is_singular_node(&epi->fllink, head)) { - /* See eventpoll_release() for details. */ -@@ -886,7 +855,25 @@ static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - */ - static void ep_remove_safe(struct eventpoll *ep, struct epitem *epi) - { -- if (__ep_remove(ep, epi, false)) -+ struct file *file = epi->ffd.file; -+ -+ lockdep_assert_irqs_enabled(); -+ lockdep_assert_held(&ep->mtx); -+ -+ ep_unregister_pollwait(ep, epi); -+ -+ /* sync with eventpoll_release_file() */ -+ if (unlikely(READ_ONCE(epi->dying))) -+ return; -+ -+ spin_lock(&file->f_lock); -+ if (epi->dying) { -+ spin_unlock(&file->f_lock); -+ return; -+ } -+ __ep_remove_file(ep, epi, file); -+ -+ if (__ep_remove_epi(ep, epi)) - WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); - } - -@@ -1118,7 +1105,7 @@ void eventpoll_release_file(struct file *file) - spin_lock(&file->f_lock); - if (file->f_ep && file->f_ep->first) { - epi = hlist_entry(file->f_ep->first, struct epitem, fllink); -- epi->dying = true; -+ WRITE_ONCE(epi->dying, true); - spin_unlock(&file->f_lock); - - /* -@@ -1127,7 +1114,13 @@ void eventpoll_release_file(struct file *file) - */ - ep = epi->ep; - mutex_lock(&ep->mtx); -- dispose = __ep_remove(ep, epi, true); -+ -+ ep_unregister_pollwait(ep, epi); -+ -+ spin_lock(&file->f_lock); -+ __ep_remove_file(ep, epi, file); -+ dispose = __ep_remove_epi(ep, epi); -+ - mutex_unlock(&ep->mtx); - - if (dispose && ep_refcount_dec_and_test(ep)) --- -2.52.0 - diff --git a/packages/kernel-6.12/1013-eventpoll-move-epi_fget-up.patch b/packages/kernel-6.12/1013-eventpoll-move-epi_fget-up.patch deleted file mode 100644 index 869dc45c..00000000 --- a/packages/kernel-6.12/1013-eventpoll-move-epi_fget-up.patch +++ /dev/null @@ -1,98 +0,0 @@ -From acb6b5f001ed053e1d66df425753089ab02092bd Mon Sep 17 00:00:00 2001 -From: Christian Brauner -Date: Thu, 23 Apr 2026 11:56:08 +0200 -Subject: [PATCH] eventpoll: move epi_fget() up - -[ Upstream commit 86e87059e6d1fd5115a31949726450ed03c1073b ] - -We'll need it when removing files so move it up. No functional change. - -Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-5-2470f9eec0f5@kernel.org -Signed-off-by: Christian Brauner (Amutable) -[ Kept epi_fget() using atomic_long_inc_not_zero(&file->f_count) instead - of the upstream file_ref_get(&file->f_ref): 6.12 has not ported struct - file to file_ref (commit 90ee6ed776c0 "fs: port files to file_ref" is - absent). No functional change relative to the existing 6.12 epi_fget(). ] -Signed-off-by: Mark Bundschuh -(cherry picked from commit e0a83603948ff3d2b55bd06d63259a577f95d4f3) ---- - fs/eventpoll.c | 56 +++++++++++++++++++++++++------------------------- - 1 file changed, 28 insertions(+), 28 deletions(-) - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 3ac8a26c3522f..86f5cbc8a7d61 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -797,6 +797,34 @@ static void ep_free(struct eventpoll *ep) - kfree_rcu(ep, rcu); - } - -+/* -+ * The ffd.file pointer may be in the process of being torn down due to -+ * being closed, but we may not have finished eventpoll_release() yet. -+ * -+ * Normally, even with the atomic_long_inc_not_zero, the file may have -+ * been free'd and then gotten re-allocated to something else (since -+ * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU). -+ * -+ * But for epoll, users hold the ep->mtx mutex, and as such any file in -+ * the process of being free'd will block in eventpoll_release_file() -+ * and thus the underlying file allocation will not be free'd, and the -+ * file re-use cannot happen. -+ * -+ * For the same reason we can avoid a rcu_read_lock() around the -+ * operation - 'ffd.file' cannot go away even if the refcount has -+ * reached zero (but we must still not call out to ->poll() functions -+ * etc). -+ */ -+static struct file *epi_fget(const struct epitem *epi) -+{ -+ struct file *file; -+ -+ file = epi->ffd.file; -+ if (!atomic_long_inc_not_zero(&file->f_count)) -+ file = NULL; -+ return file; -+} -+ - /* - * Called with &file->f_lock held, - * returns with it released -@@ -989,34 +1017,6 @@ static __poll_t __ep_eventpoll_poll(struct file *file, poll_table *wait, int dep - return res; - } - --/* -- * The ffd.file pointer may be in the process of being torn down due to -- * being closed, but we may not have finished eventpoll_release() yet. -- * -- * Normally, even with the atomic_long_inc_not_zero, the file may have -- * been free'd and then gotten re-allocated to something else (since -- * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU). -- * -- * But for epoll, users hold the ep->mtx mutex, and as such any file in -- * the process of being free'd will block in eventpoll_release_file() -- * and thus the underlying file allocation will not be free'd, and the -- * file re-use cannot happen. -- * -- * For the same reason we can avoid a rcu_read_lock() around the -- * operation - 'ffd.file' cannot go away even if the refcount has -- * reached zero (but we must still not call out to ->poll() functions -- * etc). -- */ --static struct file *epi_fget(const struct epitem *epi) --{ -- struct file *file; -- -- file = epi->ffd.file; -- if (!atomic_long_inc_not_zero(&file->f_count)) -- file = NULL; -- return file; --} -- - /* - * Differs from ep_eventpoll_poll() in that internal callers already have - * the ep->mtx so we need to start from depth=1, such that mutex_lock_nested() --- -2.52.0 - diff --git a/packages/kernel-6.12/1014-eventpoll-fix-ep_remove-struct-eventpoll-struct-file.patch b/packages/kernel-6.12/1014-eventpoll-fix-ep_remove-struct-eventpoll-struct-file.patch deleted file mode 100644 index 306466b4..00000000 --- a/packages/kernel-6.12/1014-eventpoll-fix-ep_remove-struct-eventpoll-struct-file.patch +++ /dev/null @@ -1,103 +0,0 @@ -From 8e1e13aec8cfa1c7f3cfd76b4b8905bca8cb6d42 Mon Sep 17 00:00:00 2001 -From: Christian Brauner -Date: Thu, 23 Apr 2026 11:56:09 +0200 -Subject: [PATCH] eventpoll: fix ep_remove struct eventpoll / struct file UAF - -[ Upstream commit a6dc643c69311677c574a0f17a3f4d66a5f3744b ] - -ep_remove() (via ep_remove_file()) cleared file->f_ep under -file->f_lock but then kept using @file inside the critical section -(is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). -A concurrent __fput() taking the eventpoll_release() fastpath in -that window observed the transient NULL, skipped -eventpoll_release_file() and ran to f_op->release / file_free(). - -For the epoll-watches-epoll case, f_op->release is -ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which -kfree()s the watched struct eventpoll. Its embedded ->refs -hlist_head is exactly where epi->fllink.pprev points, so the -subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed -kmalloc-192 memory. - -In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot -backing @file could be recycled by alloc_empty_file() -- -reinitializing f_lock and f_ep -- while ep_remove() is still -nominally inside that lock. The upshot is an attacker-controllable -kmem_cache_free() against the wrong slab cache. - -Pin @file via epi_fget() at the top of ep_remove() and gate the -critical section on the pin succeeding. With the pin held @file -cannot reach refcount zero, which holds __fput() off and -transitively keeps the watched struct eventpoll alive across the -hlist_del_rcu() and the f_lock use, closing both UAFs. - -If the pin fails @file has already reached refcount zero and its -__fput() is in flight. Because we bailed before clearing f_ep, -that path takes the eventpoll_release() slow path into -eventpoll_release_file() and blocks on ep->mtx until the waiter -side's ep_clear_and_put() drops it. The bailed epi's share of -ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() -in ep_clear_and_put() cannot free the eventpoll out from under -eventpoll_release_file(); the orphaned epi is then cleaned up -there. - -A successful pin also proves we are not racing -eventpoll_release_file() on this epi, so drop the now-redundant -re-check of epi->dying under f_lock. The cheap lockless -READ_ONCE(epi->dying) fast-path bailout stays. - -Fixes: 58c9b016e128 ("epoll: use refcount to reduce ep_mutex contention") -Reported-by: Jaeyoung Chung -Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-6-2470f9eec0f5@kernel.org -Signed-off-by: Christian Brauner (Amutable) -[ change context lines: use __ep_remove_file instead of -ep_remove_file since 0feaf64 ("eventpoll: drop vestigial __ prefix -from ep_remove_{file,epi}()") hasn't landed yet, similarly keep -ep_remove_safe instead of ep_remove since 0bade23 ("eventpoll: rename -ep_remove_safe() back to ep_remove()") hasn't landed yet ] -Signed-off-by: Mark Bundschuh -(cherry picked from commit 735677721062287b94dc72fcd38d1ed2e53cf9ea) ---- - fs/eventpoll.c | 16 ++++++++++------ - 1 file changed, 10 insertions(+), 6 deletions(-) - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 86f5cbc8a7d61..0d68799422d18 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -883,22 +883,26 @@ static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - */ - static void ep_remove_safe(struct eventpoll *ep, struct epitem *epi) - { -- struct file *file = epi->ffd.file; -+ struct file *file __free(fput) = NULL; - - lockdep_assert_irqs_enabled(); - lockdep_assert_held(&ep->mtx); - - ep_unregister_pollwait(ep, epi); - -- /* sync with eventpoll_release_file() */ -+ /* cheap sync with eventpoll_release_file() */ - if (unlikely(READ_ONCE(epi->dying))) - return; - -- spin_lock(&file->f_lock); -- if (epi->dying) { -- spin_unlock(&file->f_lock); -+ /* -+ * If we manage to grab a reference it means we're not in -+ * eventpoll_release_file() and aren't going to be. -+ */ -+ file = epi_fget(epi); -+ if (!file) - return; -- } -+ -+ spin_lock(&file->f_lock); - __ep_remove_file(ep, epi, file); - - if (__ep_remove_epi(ep, epi)) --- -2.52.0 - diff --git a/packages/kernel-6.12/Cargo.toml b/packages/kernel-6.12/Cargo.toml index 1c8b2828..dba93eb1 100644 --- a/packages/kernel-6.12/Cargo.toml +++ b/packages/kernel-6.12/Cargo.toml @@ -13,8 +13,8 @@ path = "../packages.rs" [[package.metadata.build-package.external-files]] # Use latest-kernel-srpm-url.sh to get this. -url = "https://cdn.amazonlinux.com/al2023/blobstore/a574749641e3197ca8ed993adfd500106b6f413dfc9e9c1d0bf17f3833fe230e/kernel6.12-6.12.92-122.168.amzn2023.src.rpm" -sha512 = "a1231a7d77fe80c4b113273d2fd7947944e1eee44104506e1f07db22bf06c492e9a0d2621320860360b56d9588c4f8ddac58df3420bdda11c620c155c9cfe05e" +url = "https://cdn.amazonlinux.com/al2023/blobstore/24acb6df83dcc77b3a4e83e670731ba122af62a8b7666ecfdda946985aa8dfb6/kernel6.12-6.12.94-123.176.amzn2023.src.rpm" +sha512 = "7b6d7c0b614ba1f14c9e39c3d59f1360a7d079975cf39521832fff2d57da678649a1a9fc1ea3985820ba34dc3200894e661a09ed6305f4c5bbc610336d9a06b7" force-upstream = true [build-dependencies] diff --git a/packages/kernel-6.12/config-full-bottlerocket-aarch64 b/packages/kernel-6.12/config-full-bottlerocket-aarch64 index 67ade649..07d9b917 100644 --- a/packages/kernel-6.12/config-full-bottlerocket-aarch64 +++ b/packages/kernel-6.12/config-full-bottlerocket-aarch64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.12.92 Kernel Configuration +# Linux/arm64 6.12.94 Kernel Configuration # CONFIG_CC_VERSION_TEXT="aarch64-bottlerocket-linux-gnu-gcc (Buildroot 2025.05.1) 13.4.0" CONFIG_CC_IS_GCC=y @@ -417,6 +417,7 @@ CONFIG_ARM64_WORKAROUND_SPECULATIVE_UNPRIV_LOAD=y CONFIG_ARM64_ERRATUM_2966298=y CONFIG_ARM64_ERRATUM_3117295=y CONFIG_ARM64_ERRATUM_3194386=y +CONFIG_ARM64_ERRATUM_4118414=y CONFIG_CAVIUM_ERRATUM_22375=y CONFIG_CAVIUM_ERRATUM_23144=y CONFIG_CAVIUM_ERRATUM_23154=y diff --git a/packages/kernel-6.12/config-full-bottlerocket-x86_64 b/packages/kernel-6.12/config-full-bottlerocket-x86_64 index 3b50954b..392200ae 100644 --- a/packages/kernel-6.12/config-full-bottlerocket-x86_64 +++ b/packages/kernel-6.12/config-full-bottlerocket-x86_64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.12.92 Kernel Configuration +# Linux/x86 6.12.94 Kernel Configuration # CONFIG_CC_VERSION_TEXT="x86_64-bottlerocket-linux-gnu-gcc (Buildroot 2025.05.1) 13.4.0" CONFIG_CC_IS_GCC=y diff --git a/packages/kernel-6.12/kernel-6.12.spec b/packages/kernel-6.12/kernel-6.12.spec index c4188ff3..7497dc4a 100644 --- a/packages/kernel-6.12/kernel-6.12.spec +++ b/packages/kernel-6.12/kernel-6.12.spec @@ -4,13 +4,13 @@ %global kmajor 6.12 Name: %{_cross_os}kernel-%{kmajor} -Version: 6.12.92 +Version: 6.12.94 Release: 1%{?dist} Summary: The Linux kernel License: GPL-2.0 WITH Linux-syscall-note URL: https://www.kernel.org/ # Use latest-kernel-srpm-url.sh to get this. -Source0: https://cdn.amazonlinux.com/al2023/blobstore/a574749641e3197ca8ed993adfd500106b6f413dfc9e9c1d0bf17f3833fe230e/kernel6.12-6.12.92-122.168.amzn2023.src.rpm +Source0: https://cdn.amazonlinux.com/al2023/blobstore/24acb6df83dcc77b3a4e83e670731ba122af62a8b7666ecfdda946985aa8dfb6/kernel6.12-6.12.94-123.176.amzn2023.src.rpm Source1: gpgkey-B21C50FA44A99720EAA72F7FE951904AD832C631.asc # Custom Bottlerocket kernel configurations. @@ -50,14 +50,6 @@ Patch1006: 1006-Select-prerequisites-for-gpu-drivers.patch Patch1007: 1007-strscpy-write-destination-buffer-only-once.patch # Disable incomplete measurement into PCR 9 on aarch64. Patch1008: 1008-efi-libstub-don-t-measure-kernel-command-line-into-P.patch -# Fix undersized linear allocation in IPv* paged path -Patch1009: 1009-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch -Patch1010: 1010-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch -# Fix use-after-free race in eventpoll file removal path -Patch1011: 1011-eventpoll-split-__ep_remove.patch -Patch1012: 1012-eventpoll-kill-__ep_remove.patch -Patch1013: 1013-eventpoll-move-epi_fget-up.patch -Patch1014: 1014-eventpoll-fix-ep_remove-struct-eventpoll-struct-file.patch BuildRequires: bc BuildRequires: elfutils-devel diff --git a/packages/kernel-6.18/1007-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch b/packages/kernel-6.18/1007-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch deleted file mode 100644 index 4df30c5a..00000000 --- a/packages/kernel-6.18/1007-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch +++ /dev/null @@ -1,63 +0,0 @@ -From c75fbac419a8772b7f42d16b12ae986d1eb0d85e Mon Sep 17 00:00:00 2001 -From: Wongi Lee -Date: Tue, 16 Jun 2026 22:38:29 +0900 -Subject: [PATCH] ipv4: account for fraggap on the paged allocation path - -In __ip_append_data(), when the paged-allocation branch is taken, -alloclen and pagedlen are computed as - - alloclen = fragheaderlen + transhdrlen; - pagedlen = datalen - transhdrlen; - -datalen already includes fraggap, but the fraggap bytes carried over -from the previous skb are copied into the new skb's linear area at -offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The -linear area is therefore undersized by fraggap bytes while pagedlen is -overstated by the same amount. - -The non-paged branch sets alloclen to fraglen, which already accounts -for fraggap because datalen does. Bring the paged branch in line by -adding fraggap to alloclen and subtracting it from pagedlen. - -After this adjustment, copy no longer collapses to -fraggap on the -paged path, so remove the stale comment describing that old arithmetic. - -Fixes: 8eb77cc73977 ("ipv4: avoid partial copy for zc") -Signed-off-by: Jungwoo Lee -Signed-off-by: Wongi Lee -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/ajFR1eLAIs42TN3g@DESKTOP-19IMU7U.localdomain -Signed-off-by: Jakub Kicinski -(cherry picked from commit dab46d2102cc219b12017a0447b57a42358895c8) ---- - net/ipv4/ip_output.c | 7 ++----- - 1 file changed, 2 insertions(+), 5 deletions(-) - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index 7c005263262ff..7eaf35a6e24ba 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1117,8 +1117,8 @@ static int __ip_append_data(struct sock *sk, - !(rt->dst.dev->features & NETIF_F_SG))) - alloclen = fraglen; - else { -- alloclen = fragheaderlen + transhdrlen; -- pagedlen = datalen - transhdrlen; -+ alloclen = fragheaderlen + transhdrlen + fraggap; -+ pagedlen = datalen - transhdrlen - fraggap; - } - - alloclen += alloc_extra; -@@ -1165,9 +1165,6 @@ static int __ip_append_data(struct sock *sk, - } - - copy = datalen - transhdrlen - fraggap - pagedlen; -- /* [!] NOTE: copy will be negative if pagedlen>0 -- * because then the equation reduces to -fraggap. -- */ - if (copy > 0 && - INDIRECT_CALL_1(getfrag, ip_generic_getfrag, - from, data + transhdrlen, offset, --- -2.52.0 - diff --git a/packages/kernel-6.18/1008-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch b/packages/kernel-6.18/1008-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch deleted file mode 100644 index d106ee6b..00000000 --- a/packages/kernel-6.18/1008-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 1f422250a5022141881fddd368c3038a687fa438 Mon Sep 17 00:00:00 2001 -From: Wongi Lee -Date: Tue, 16 Jun 2026 22:46:17 +0900 -Subject: [PATCH] ipv6: account for fraggap on the paged allocation path - -In __ip6_append_data(), when the paged-allocation branch is taken -(MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are -computed as - - alloclen = fragheaderlen + transhdrlen; - pagedlen = datalen - transhdrlen; - -datalen already includes fraggap (datalen = length + fraggap). When -fraggap is non-zero, this is not the first skb and transhdrlen is zero. -The fraggap bytes carried over from the previous skb are copied just past -the fragment headers in the new skb's linear area. The linear area is -therefore undersized by fraggap bytes while pagedlen is overstated by the -same amount, and the copy writes past skb->end into the trailing -skb_shared_info. - -An unprivileged user can trigger this via a UDPv6 socket using -MSG_MORE together with MSG_SPLICE_PAGES. - -The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: -avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix -__ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative -copy value caused -EINVAL to be returned. That later commit allowed -MSG_SPLICE_PAGES to proceed in this case, making the corruption -triggerable. - -The non-paged branch sets alloclen to fraglen, which already accounts -for fraggap because datalen does. Bring the paged branch in line by -adding fraggap to alloclen and subtracting it from pagedlen. - -After this adjustment, copy no longer collapses to -fraggap on the -paged path, so remove the stale comment describing that old arithmetic. -Since a negative copy is no longer expected for a valid MSG_SPLICE_PAGES -case, remove the MSG_SPLICE_PAGES exception from the negative copy check. - -Fixes: 773ba4fe9104 ("ipv6: avoid partial copy for zc") -Signed-off-by: Jungwoo Lee -Signed-off-by: Wongi Lee -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/ajFTqRljatR17fFy@DESKTOP-19IMU7U.localdomain -Signed-off-by: Jakub Kicinski -(cherry picked from commit 836f5052c83121849fd12c8e88f736b0e0ed89be) ---- - net/ipv6/ip6_output.c | 9 +++------ - 1 file changed, 3 insertions(+), 6 deletions(-) - -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index f5ca0267e7706..8f37c9cc868b0 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1648,8 +1648,8 @@ static int __ip6_append_data(struct sock *sk, - !(rt->dst.dev->features & NETIF_F_SG))) - alloclen = fraglen; - else { -- alloclen = fragheaderlen + transhdrlen; -- pagedlen = datalen - transhdrlen; -+ alloclen = fragheaderlen + transhdrlen + fraggap; -+ pagedlen = datalen - transhdrlen - fraggap; - } - alloclen += alloc_extra; - -@@ -1664,10 +1664,7 @@ static int __ip6_append_data(struct sock *sk, - fraglen = datalen + fragheaderlen; - - copy = datalen - transhdrlen - fraggap - pagedlen; -- /* [!] NOTE: copy may be negative if pagedlen>0 -- * because then the equation may reduces to -fraggap. -- */ -- if (copy < 0 && !(flags & MSG_SPLICE_PAGES)) { -+ if (copy < 0) { - err = -EINVAL; - goto error; - } --- -2.52.0 - diff --git a/packages/kernel-6.18/Cargo.toml b/packages/kernel-6.18/Cargo.toml index 4c303947..69df9e00 100644 --- a/packages/kernel-6.18/Cargo.toml +++ b/packages/kernel-6.18/Cargo.toml @@ -13,8 +13,8 @@ path = "../packages.rs" [[package.metadata.build-package.external-files]] # Use latest-kernel-srpm-url.sh to get this. -url = "https://cdn.amazonlinux.com/al2023/blobstore/725168caabe36cbf64ecb9c978ba432de3b1f469b7097dfc53b27dd476b9a02d/kernel6.18-6.18.35-68.129.amzn2023.src.rpm" -sha512 = "bdc51899ad64415c8a98435a9aa9a338d66f3807ca75911cf67feef20fba108bb19e67de5c9a6171ba27fc729f28b666fb1c0caeb389b0aa54fd461224064972" +url = "https://cdn.amazonlinux.com/al2023/blobstore/f98d081f48d4676cb65cdc7389b90a080a44cbeebff7335352f7e520005c75d4/kernel6.18-6.18.36-69.136.amzn2023.src.rpm" +sha512 = "835bfa08073b4160b42ec95851ebff6fe0edac053fb556fcfd7f2677c69889cb90c2e348c8e37296117310475a0fa99161776a30298afe1aa62df8e363fe71d2" force-upstream = true [build-dependencies] diff --git a/packages/kernel-6.18/config-full-bottlerocket-aarch64-on-aarch64 b/packages/kernel-6.18/config-full-bottlerocket-aarch64-on-aarch64 index 99676bea..c8291508 100644 --- a/packages/kernel-6.18/config-full-bottlerocket-aarch64-on-aarch64 +++ b/packages/kernel-6.18/config-full-bottlerocket-aarch64-on-aarch64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.18.35 Kernel Configuration +# Linux/arm64 6.18.36 Kernel Configuration # CONFIG_CC_VERSION_TEXT="aarch64-bottlerocket-linux-gnu-gcc (Buildroot 2025.05.1) 13.4.0" CONFIG_CC_IS_GCC=y @@ -443,6 +443,7 @@ CONFIG_ARM64_ERRATUM_2966298=y CONFIG_ARM64_ERRATUM_3117295=y CONFIG_ARM64_ERRATUM_3194386=y CONFIG_ARM64_ERRATUM_4193714=y +CONFIG_ARM64_ERRATUM_4118414=y CONFIG_CAVIUM_ERRATUM_22375=y CONFIG_CAVIUM_ERRATUM_23144=y CONFIG_CAVIUM_ERRATUM_23154=y diff --git a/packages/kernel-6.18/config-full-bottlerocket-aarch64-on-x86_64 b/packages/kernel-6.18/config-full-bottlerocket-aarch64-on-x86_64 index 99676bea..c8291508 100644 --- a/packages/kernel-6.18/config-full-bottlerocket-aarch64-on-x86_64 +++ b/packages/kernel-6.18/config-full-bottlerocket-aarch64-on-x86_64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.18.35 Kernel Configuration +# Linux/arm64 6.18.36 Kernel Configuration # CONFIG_CC_VERSION_TEXT="aarch64-bottlerocket-linux-gnu-gcc (Buildroot 2025.05.1) 13.4.0" CONFIG_CC_IS_GCC=y @@ -443,6 +443,7 @@ CONFIG_ARM64_ERRATUM_2966298=y CONFIG_ARM64_ERRATUM_3117295=y CONFIG_ARM64_ERRATUM_3194386=y CONFIG_ARM64_ERRATUM_4193714=y +CONFIG_ARM64_ERRATUM_4118414=y CONFIG_CAVIUM_ERRATUM_22375=y CONFIG_CAVIUM_ERRATUM_23144=y CONFIG_CAVIUM_ERRATUM_23154=y diff --git a/packages/kernel-6.18/config-full-bottlerocket-x86_64-on-aarch64 b/packages/kernel-6.18/config-full-bottlerocket-x86_64-on-aarch64 index 911372d7..f8cd96cd 100644 --- a/packages/kernel-6.18/config-full-bottlerocket-x86_64-on-aarch64 +++ b/packages/kernel-6.18/config-full-bottlerocket-x86_64-on-aarch64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.18.35 Kernel Configuration +# Linux/x86 6.18.36 Kernel Configuration # CONFIG_CC_VERSION_TEXT="x86_64-bottlerocket-linux-gnu-gcc (Buildroot 2025.05.1) 13.4.0" CONFIG_CC_IS_GCC=y diff --git a/packages/kernel-6.18/config-full-bottlerocket-x86_64-on-x86_64 b/packages/kernel-6.18/config-full-bottlerocket-x86_64-on-x86_64 index 0201277f..9426a65e 100644 --- a/packages/kernel-6.18/config-full-bottlerocket-x86_64-on-x86_64 +++ b/packages/kernel-6.18/config-full-bottlerocket-x86_64-on-x86_64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.18.35 Kernel Configuration +# Linux/x86 6.18.36 Kernel Configuration # CONFIG_CC_VERSION_TEXT="x86_64-bottlerocket-linux-gnu-gcc (Buildroot 2025.05.1) 13.4.0" CONFIG_CC_IS_GCC=y diff --git a/packages/kernel-6.18/kernel-6.18.spec b/packages/kernel-6.18/kernel-6.18.spec index ed3c35da..c3e3a16f 100644 --- a/packages/kernel-6.18/kernel-6.18.spec +++ b/packages/kernel-6.18/kernel-6.18.spec @@ -6,13 +6,13 @@ %global host_arch %(uname -m) Name: %{_cross_os}kernel-%{kmajor} -Version: 6.18.35 +Version: 6.18.36 Release: 1%{?dist} Summary: The Linux kernel License: GPL-2.0 WITH Linux-syscall-note URL: https://www.kernel.org/ # Use latest-kernel-srpm-url.sh to get this. -Source0: https://cdn.amazonlinux.com/al2023/blobstore/725168caabe36cbf64ecb9c978ba432de3b1f469b7097dfc53b27dd476b9a02d/kernel6.18-6.18.35-68.129.amzn2023.src.rpm +Source0: https://cdn.amazonlinux.com/al2023/blobstore/f98d081f48d4676cb65cdc7389b90a080a44cbeebff7335352f7e520005c75d4/kernel6.18-6.18.36-69.136.amzn2023.src.rpm Source1: gpgkey-B21C50FA44A99720EAA72F7FE951904AD832C631.asc # Custom Bottlerocket kernel configurations. @@ -44,9 +44,6 @@ Patch1004: 1004-af_unix-increase-default-max_dgram_qlen-to-512.patch Patch1005: 1005-drm-simpledrm-Select-prerequisites-for-gpu-drivers.patch # Disable incomplete measurement into PCR 9 on aarch64. Patch1006: 1006-efi-libstub-don-t-measure-kernel-command-line-into-P.patch -# Fix undersized linear allocation in IPv* paged path -Patch1007: 1007-ipv4-account-for-fraggap-on-the-paged-allocation-pat.patch -Patch1008: 1008-ipv6-account-for-fraggap-on-the-paged-allocation-pat.patch BuildRequires: bc BuildRequires: elfutils-devel