Skip to content

[rocky9_6] History Rebuild for kernel-5.14.0-570.23.1.el9_6 #375

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 12 commits into from
Jun 27, 2025

Conversation

PlaidCat
Copy link
Collaborator

This is the attempt at a re-builder built on Cron and some internal tools, but the same process is as follows as previous rebuilds

  • Download all unprocessed src.rpm
  • for each src,pm
    • Find all commits in changelog up to last known tag ... in this case 5.14.0-570
    • Re-play commits in reverse order (oldest in change log to newest) with git cherry-pick
    • After replay replace ENTIRE code in branch with rpmbuild -bp from corresponding src.rpm.
    • Tag Rebuild branch
  • Use New Local Build with prodman and test (note test results will be different than usual)

Checking Rebuild Commits for potentially missing commits:

kernel-5.14.0-570.21.1.el9_6

Rebuild_History BUILDABLE
Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
Number of commits in upstream range v5.14~1..kernel-mainline: 309912
Number of commits in rpm: 13
Number of commits matched with upstream: 10 (76.92%)
Number of commits in upstream but not in rpm: 309902
Number of commits NOT found in upstream: 3 (23.08%)

Rebuilding Kernel on Branch rocky9_6_rebuild_kernel-5.14.0-570.23.1.el9_6 for kernel-5.14.0-570.23.1.el9_6
Clean Cherry Picks: 8 (80.00%)
Empty Cherry Picks: 2 (20.00%)
_______________________________

__EMPTY COMMITS__________________________
fd17e3a9a7886ec949ce269a396b67875b51ff45 media: i2c: Use accessors for pad config 'try_*' fields
c692696fc51c5acee555b94d391d328510b557c8 media: saa6752hs: Don't set format in sub-device state

__CHANGES NOT IN UPSTREAM________________
Porting to Rocky Linux 9, debranding and Rocky branding'
Ensure aarch64 kernel is not compressed'
redhat: configs: Enable CX231XX driver

Build (no build log from pod-man)

podman run --rm --pull=always --privileged -it --device=/dev/fuse --device=/dev/kvm --security-opt label=disable -v "$(pwd)/kernel-src-tree":/src -v "$(pwd)/podman_test":/output pulp.prod.ciq.dev/ciq/cicd/lts-images/builder build_kernel.sh -c rocky-9-kernel-builder

[jmaple@devbox podman_test]$ egrep -B 5 -A 5 "\[TIMER\]|^Starting Build" kbuild.log
Writing manifest to image destination
Container wasn't built with Peridot repos enabled, skipping Peridot repo
WARNING: DEPOT_DEV_USERNAME or DEPOT_DEV_TOKEN env var not set, so not enabling Depot repos
/src
-m not set, skipping make mrproper
[TIMER]{MRPROPER}: 0s
x86_64 architecture detected, copying config
'configs/kernel-x86_64-rhel.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-rocky9_6_rebuild-08b6475feb07"
Making olddefconfig
#
# configuration written to .config
#
Starting Build
  SYNC    include/config/auto.conf.cmd
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_32.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_64.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_x32.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
--
  BTF [M] sound/usb/snd-usb-audio.ko
  BTF [M] sound/virtio/virtio_snd.ko
  BTF [M] sound/x86/snd-hdmi-lpe-audio.ko
  BTF [M] sound/usb/usx2y/snd-usb-usx2y.ko
  BTF [M] sound/xen/snd_xen_front.ko
[TIMER]{BUILD}: 814s
Making Modules
  INSTALL /lib/modules/5.14.0-rocky9_6_rebuild-08b6475feb07/kernel/arch/x86/crypto/blake2s-x86_64.ko
  INSTALL /lib/modules/5.14.0-rocky9_6_rebuild-08b6475feb07/kernel/arch/x86/crypto/camellia-aesni-avx-x86_64.ko
  INSTALL /lib/modules/5.14.0-rocky9_6_rebuild-08b6475feb07/kernel/arch/x86/crypto/blowfish-x86_64.ko
  INSTALL /lib/modules/5.14.0-rocky9_6_rebuild-08b6475feb07/kernel/arch/x86/crypto/camellia-aesni-avx2.ko
--
  SIGN    /lib/modules/5.14.0-rocky9_6_rebuild-08b6475feb07/kernel/sound/virtio/virtio_snd.ko
  SIGN    /lib/modules/5.14.0-rocky9_6_rebuild-08b6475feb07/kernel/sound/usb/usx2y/snd-usb-usx2y.ko
  SIGN    /lib/modules/5.14.0-rocky9_6_rebuild-08b6475feb07/kernel/sound/x86/snd-hdmi-lpe-audio.ko
  SIGN    /lib/modules/5.14.0-rocky9_6_rebuild-08b6475feb07/kernel/sound/xen/snd_xen_front.ko
  DEPMOD  /lib/modules/5.14.0-rocky9_6_rebuild-08b6475feb07
[TIMER]{MODULES}: 10s
Making Install
sh ./arch/x86/boot/install.sh 5.14.0-rocky9_6_rebuild-08b6475feb07 \
	arch/x86/boot/bzImage System.map "/boot"
grub2-probe: error: failed to get canonical path of `fuse-overlayfs'.
No path or device is specified.
Usage: grub2-probe [OPTION...] [OPTION]... [PATH|DEVICE]
Try 'grub2-probe --help' or 'grub2-probe --usage' for more information.
dracut: WARNING: running in hostonly mode in a container!!
findmnt: can't read (null): No such file or directory
[TIMER]{INSTALL}: 14s
Building selftests
/src/tools/bpf/bpftool /src

Auto-detecting system features:
...                         clang-bpf-co-re: [ on  ]
--
The default is /boot/loader/entries/703a497aeac1420c806e50c07e8e94ae-5.14.0-rocky9_6_rebuild-08b6475feb07.conf with index 0 and kernel /boot/vmlinuz-5.14.0-rocky9_6_rebuild-08b6475feb07
The default is /boot/loader/entries/703a497aeac1420c806e50c07e8e94ae-5.14.0-rocky9_6_rebuild-08b6475feb07.conf with index 0 and kernel /boot/vmlinuz-5.14.0-rocky9_6_rebuild-08b6475feb07
Creating systemd service for kernel selftests
Created symlink /etc/systemd/system/multi-user.target.wants/kselftests.service → /etc/systemd/system/kselftests.service.
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 0s
[TIMER]{BUILD}: 814s
[TIMER]{MODULES}: 10s
[TIMER]{INSTALL}: 14s
[TIMER]{TOTAL} 876s

Kself Test

[jmaple@devbox podman_test]$ grep '^ok ' kselftests-rocky-9-kernel-builder.log  | wc -l
178

PlaidCat added 11 commits June 26, 2025 10:26
jira LE-3428
cve CVE-2025-23150
Rebuild_History Non-Buildable kernel-5.14.0-570.23.1.el9_6
commit-author Artem Sadovnikov <[email protected]>
commit 94824ac

Syzkaller detected a use-after-free issue in ext4_insert_dentry that was
caused by out-of-bounds access due to incorrect splitting in do_split.

BUG: KASAN: use-after-free in ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109
Write of size 251 at addr ffff888074572f14 by task syz-executor335/5847

CPU: 0 UID: 0 PID: 5847 Comm: syz-executor335 Not tainted 6.12.0-rc6-syzkaller-00318-ga9cda7c0ffed #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:488
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189
 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106
 ext4_insert_dentry+0x36a/0x6d0 fs/ext4/namei.c:2109
 add_dirent_to_buf+0x3d9/0x750 fs/ext4/namei.c:2154
 make_indexed_dir+0xf98/0x1600 fs/ext4/namei.c:2351
 ext4_add_entry+0x222a/0x25d0 fs/ext4/namei.c:2455
 ext4_add_nondir+0x8d/0x290 fs/ext4/namei.c:2796
 ext4_symlink+0x920/0xb50 fs/ext4/namei.c:3431
 vfs_symlink+0x137/0x2e0 fs/namei.c:4615
 do_symlinkat+0x222/0x3a0 fs/namei.c:4641
 __do_sys_symlink fs/namei.c:4662 [inline]
 __se_sys_symlink fs/namei.c:4660 [inline]
 __x64_sys_symlink+0x7a/0x90 fs/namei.c:4660
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

The following loop is located right above 'if' statement.

for (i = count-1; i >= 0; i--) {
	/* is more than half of this entry in 2nd half of the block? */
	if (size + map[i].size/2 > blocksize/2)
		break;
	size += map[i].size;
	move++;
}

'i' in this case could go down to -1, in which case sum of active entries
wouldn't exceed half the block size, but previous behaviour would also do
split in half if sum would exceed at the very last block, which in case of
having too many long name files in a single block could lead to
out-of-bounds access and following use-after-free.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.

	Cc: [email protected]
Fixes: 5872331 ("ext4: fix potential negative array index in do_split()")
	Signed-off-by: Artem Sadovnikov <[email protected]>
	Reviewed-by: Jan Kara <[email protected]>
Link: https://patch.msgid.link/[email protected]
	Signed-off-by: Theodore Ts'o <[email protected]>
(cherry picked from commit 94824ac)
	Signed-off-by: Jonathan Maple <[email protected]>
jira LE-3428
Rebuild_History Non-Buildable kernel-5.14.0-570.23.1.el9_6
commit-author Laurent Pinchart <[email protected]>
commit fd17e3a
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-5.14.0-570.23.1.el9_6/fd17e3a9.failed

The 'try_*' fields of the v4l2_subdev_pad_config structure are meant to
be accessed through helper functions. Replace direct access with usage
of the v4l2_subdev_get_pad_format(), v4l2_subdev_get_pad_crop() and
v4l2_subdev_get_pad_compose() helpers.

	Signed-off-by: Laurent Pinchart <[email protected]>
	Signed-off-by: Sakari Ailus <[email protected]>
	Signed-off-by: Mauro Carvalho Chehab <[email protected]>
(cherry picked from commit fd17e3a)
	Signed-off-by: Jonathan Maple <[email protected]>

# Conflicts:
#	drivers/media/i2c/ov2680.c
#	drivers/media/i2c/ov6650.c
jira LE-3428
Rebuild_History Non-Buildable kernel-5.14.0-570.23.1.el9_6
commit-author Sakari Ailus <[email protected]>
commit c692696
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-5.14.0-570.23.1.el9_6/c692696f.failed

For the purpose of setting old non-pad based sub-device try format as a
basis for VIDIOC_TRY_FMT implementation, there is no need to set the
format in the sub-device state. Drop the assignment to the state, which
would result in a NULL pointer dereference.

Fixes: fd17e3a ("media: i2c: Use accessors for pad config 'try_*' fields")
	Signed-off-by: Sakari Ailus <[email protected]>
	Reviewed-by: Laurent Pinchart <[email protected]>
	Signed-off-by: Hans Verkuil <[email protected]>
(cherry picked from commit c692696)
	Signed-off-by: Jonathan Maple <[email protected]>

# Conflicts:
#	drivers/media/i2c/saa6752hs.c
jira LE-3428
Rebuild_History Non-Buildable kernel-5.14.0-570.23.1.el9_6
commit-author Benjamin Gaignard <[email protected]>
commit 4545ca5

Use vb2_get_num_buffers() to avoid using queue num_buffers field directly.
This allows us to change how the number of buffers is computed in the
future.

	Signed-off-by: Benjamin Gaignard <[email protected]>
	Reviewed-by: Andrzej Pietrasiewicz <[email protected]>
	Signed-off-by: Hans Verkuil <[email protected]>
	Signed-off-by: Mauro Carvalho Chehab <[email protected]>
(cherry picked from commit 4545ca5)
	Signed-off-by: Jonathan Maple <[email protected]>
jira LE-3428
cve CVE-2025-21919
Rebuild_History Non-Buildable kernel-5.14.0-570.23.1.el9_6
commit-author Zecheng Li <[email protected]>
commit 3b4035d

child_cfs_rq_on_list attempts to convert a 'prev' pointer to a cfs_rq.
This 'prev' pointer can originate from struct rq's leaf_cfs_rq_list,
making the conversion invalid and potentially leading to memory
corruption. Depending on the relative positions of leaf_cfs_rq_list and
the task group (tg) pointer within the struct, this can cause a memory
fault or access garbage data.

The issue arises in list_add_leaf_cfs_rq, where both
cfs_rq->leaf_cfs_rq_list and rq->leaf_cfs_rq_list are added to the same
leaf list. Also, rq->tmp_alone_branch can be set to rq->leaf_cfs_rq_list.

This adds a check `if (prev == &rq->leaf_cfs_rq_list)` after the main
conditional in child_cfs_rq_on_list. This ensures that the container_of
operation will convert a correct cfs_rq struct.

This check is sufficient because only cfs_rqs on the same CPU are added
to the list, so verifying the 'prev' pointer against the current rq's list
head is enough.

Fixes a potential memory corruption issue that due to current struct
layout might not be manifesting as a crash but could lead to unpredictable
behavior when the layout changes.

Fixes: fdaba61 ("sched/fair: Ensure that the CFS parent is added after unthrottling")
	Signed-off-by: Zecheng Li <[email protected]>
Reviewed-and-tested-by: K Prateek Nayak <[email protected]>
	Signed-off-by: Peter Zijlstra (Intel) <[email protected]>
	Reviewed-by: Vincent Guittot <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
(cherry picked from commit 3b4035d)
	Signed-off-by: Jonathan Maple <[email protected]>
jira LE-3428
cve CVE-2025-21883
Rebuild_History Non-Buildable kernel-5.14.0-570.23.1.el9_6
commit-author Paul Greenwalt <[email protected]>
commit 59f4d59

E830 adds hardware support to prevent the VF from overflowing the PF
mailbox with VIRTCHNL messages. E830 will use the hardware feature
(ICE_F_MBX_LIMIT) instead of the software solution ice_is_malicious_vf().

To prevent a VF from overflowing the PF, the PF sets the number of
messages per VF that can be in the PF's mailbox queue
(ICE_MBX_OVERFLOW_WATERMARK). When the PF processes a message from a VF,
the PF decrements the per VF message count using the E830_MBX_VF_DEC_TRIG
register.

	Signed-off-by: Paul Greenwalt <[email protected]>
	Reviewed-by: Alexander Lobakin <[email protected]>
	Tested-by: Rafal Romanowski <[email protected]>
	Signed-off-by: Tony Nguyen <[email protected]>
(cherry picked from commit 59f4d59)
	Signed-off-by: Jonathan Maple <[email protected]>
jira LE-3428
cve CVE-2025-21883
Rebuild_History Non-Buildable kernel-5.14.0-570.23.1.el9_6
commit-author Marcin Szycik <[email protected]>
commit 79990cf

If ice_ena_vfs() fails after calling ice_create_vf_entries(), it frees
all VFs without removing them from snapshot PF-VF mailbox list, leading
to list corruption.

Reproducer:
  devlink dev eswitch set $PF1_PCI mode switchdev
  ip l s $PF1 up
  ip l s $PF1 promisc on
  sleep 1
  echo 1 > /sys/class/net/$PF1/device/sriov_numvfs
  sleep 1
  echo 1 > /sys/class/net/$PF1/device/sriov_numvfs

Trace (minimized):
  list_add corruption. next->prev should be prev (ffff8882e241c6f0), but was 0000000000000000. (next=ffff888455da1330).
  kernel BUG at lib/list_debug.c:29!
  RIP: 0010:__list_add_valid_or_report+0xa6/0x100
   ice_mbx_init_vf_info+0xa7/0x180 [ice]
   ice_initialize_vf_entry+0x1fa/0x250 [ice]
   ice_sriov_configure+0x8d7/0x1520 [ice]
   ? __percpu_ref_switch_mode+0x1b1/0x5d0
   ? __pfx_ice_sriov_configure+0x10/0x10 [ice]

Sometimes a KASAN report can be seen instead with a similar stack trace:
  BUG: KASAN: use-after-free in __list_add_valid_or_report+0xf1/0x100

VFs are added to this list in ice_mbx_init_vf_info(), but only removed
in ice_free_vfs(). Move the removing to ice_free_vf_entries(), which is
also being called in other places where VFs are being removed (including
ice_free_vfs() itself).

Fixes: 8cd8a6b ("ice: move VF overflow message count into struct ice_mbx_vf_info")
	Reported-by: Sujai Buvaneswaran <[email protected]>
Closes: https://lore.kernel.org/intel-wired-lan/PH0PR11MB50138B635F2E5CEB7075325D961F2@PH0PR11MB5013.namprd11.prod.outlook.com
	Reviewed-by: Martyna Szapar-Mudlaw <[email protected]>
	Signed-off-by: Marcin Szycik <[email protected]>
	Reviewed-by: Simon Horman <[email protected]>
	Tested-by: Sujai Buvaneswaran <[email protected]>
	Signed-off-by: Tony Nguyen <[email protected]>
Link: https://patch.msgid.link/[email protected]
	Signed-off-by: Jakub Kicinski <[email protected]>
(cherry picked from commit 79990cf)
	Signed-off-by: Jonathan Maple <[email protected]>
jira LE-3428
cve CVE-2025-21883
Rebuild_History Non-Buildable kernel-5.14.0-570.23.1.el9_6
commit-author Marcin Szycik <[email protected]>
commit 5c07be9

As part of switchdev environment setup, uplink VSI is configured as
default for both Tx and Rx. Default Rx VSI is also used by promiscuous
mode. If promisc mode is enabled and an attempt to enter switchdev mode
is made, the setup will fail because Rx VSI is already configured as
default (rule exists).

Reproducer:
  devlink dev eswitch set $PF1_PCI mode switchdev
  ip l s $PF1 up
  ip l s $PF1 promisc on
  echo 1 > /sys/class/net/$PF1/device/sriov_numvfs

In switchdev setup, use ice_set_dflt_vsi() instead of plain
ice_cfg_dflt_vsi(), which avoids repeating setting default VSI for Rx if
it's already configured.

Fixes: 50d6202 ("ice: default Tx rule instead of to queue")
	Reported-by: Sujai Buvaneswaran <[email protected]>
Closes: https://lore.kernel.org/intel-wired-lan/PH0PR11MB50138B635F2E5CEB7075325D961F2@PH0PR11MB5013.namprd11.prod.outlook.com
	Reviewed-by: Martyna Szapar-Mudlaw <[email protected]>
	Signed-off-by: Marcin Szycik <[email protected]>
	Reviewed-by: Simon Horman <[email protected]>
	Tested-by: Sujai Buvaneswaran <[email protected]>
	Signed-off-by: Tony Nguyen <[email protected]>
Link: https://patch.msgid.link/[email protected]
	Signed-off-by: Jakub Kicinski <[email protected]>
(cherry picked from commit 5c07be9)
	Signed-off-by: Jonathan Maple <[email protected]>
jira LE-3428
cve CVE-2025-22104
Rebuild_History Non-Buildable kernel-5.14.0-570.23.1.el9_6
commit-author Nick Child <[email protected]>
commit d93a6ca

Previously, when the driver was printing hex dumps, the buffer was cast
to an 8 byte long and printed using string formatters. If the buffer
size was not a multiple of 8 then a read buffer overflow was possible.

Therefore, create a new ibmvnic function that loops over a buffer and
calls hex_dump_to_buffer instead.

This patch address KASAN reports like the one below:
  ibmvnic 30000003 env3: Login Buffer:
  ibmvnic 30000003 env3: 01000000af000000
  <...>
  ibmvnic 30000003 env3: 2e6d62692e736261
  ibmvnic 30000003 env3: 65050003006d6f63
  ==================================================================
  BUG: KASAN: slab-out-of-bounds in ibmvnic_login+0xacc/0xffc [ibmvnic]
  Read of size 8 at addr c0000001331a9aa8 by task ip/17681
  <...>
  Allocated by task 17681:
  <...>
  ibmvnic_login+0x2f0/0xffc [ibmvnic]
  ibmvnic_open+0x148/0x308 [ibmvnic]
  __dev_open+0x1ac/0x304
  <...>
  The buggy address is located 168 bytes inside of
                allocated 175-byte region [c0000001331a9a00, c0000001331a9aaf)
  <...>
  =================================================================
  ibmvnic 30000003 env3: 000000000033766e

Fixes: 032c5e8 ("Driver for IBM System i/p VNIC protocol")
	Signed-off-by: Nick Child <[email protected]>
	Reviewed-by: Dave Marquardt <[email protected]>
	Reviewed-by: Simon Horman <[email protected]>
Link: https://patch.msgid.link/[email protected]
	Signed-off-by: Jakub Kicinski <[email protected]>
(cherry picked from commit d93a6ca)
	Signed-off-by: Jonathan Maple <[email protected]>
jira LE-3428
cve CVE-2025-37738
Rebuild_History Non-Buildable kernel-5.14.0-570.23.1.el9_6
commit-author Bhupesh <[email protected]>
commit c8e008b

Once inside 'ext4_xattr_inode_dec_ref_all' we should
ignore xattrs entries past the 'end' entry.

This fixes the following KASAN reported issue:

==================================================================
BUG: KASAN: slab-use-after-free in ext4_xattr_inode_dec_ref_all+0xb8c/0xe90
Read of size 4 at addr ffff888012c120c4 by task repro/2065

CPU: 1 UID: 0 PID: 2065 Comm: repro Not tainted 6.13.0-rc2+ #11
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0x1fd/0x300
 ? tcp_gro_dev_warn+0x260/0x260
 ? _printk+0xc0/0x100
 ? read_lock_is_recursive+0x10/0x10
 ? irq_work_queue+0x72/0xf0
 ? __virt_addr_valid+0x17b/0x4b0
 print_address_description+0x78/0x390
 print_report+0x107/0x1f0
 ? __virt_addr_valid+0x17b/0x4b0
 ? __virt_addr_valid+0x3ff/0x4b0
 ? __phys_addr+0xb5/0x160
 ? ext4_xattr_inode_dec_ref_all+0xb8c/0xe90
 kasan_report+0xcc/0x100
 ? ext4_xattr_inode_dec_ref_all+0xb8c/0xe90
 ext4_xattr_inode_dec_ref_all+0xb8c/0xe90
 ? ext4_xattr_delete_inode+0xd30/0xd30
 ? __ext4_journal_ensure_credits+0x5f0/0x5f0
 ? __ext4_journal_ensure_credits+0x2b/0x5f0
 ? inode_update_timestamps+0x410/0x410
 ext4_xattr_delete_inode+0xb64/0xd30
 ? ext4_truncate+0xb70/0xdc0
 ? ext4_expand_extra_isize_ea+0x1d20/0x1d20
 ? __ext4_mark_inode_dirty+0x670/0x670
 ? ext4_journal_check_start+0x16f/0x240
 ? ext4_inode_is_fast_symlink+0x2f2/0x3a0
 ext4_evict_inode+0xc8c/0xff0
 ? ext4_inode_is_fast_symlink+0x3a0/0x3a0
 ? do_raw_spin_unlock+0x53/0x8a0
 ? ext4_inode_is_fast_symlink+0x3a0/0x3a0
 evict+0x4ac/0x950
 ? proc_nr_inodes+0x310/0x310
 ? trace_ext4_drop_inode+0xa2/0x220
 ? _raw_spin_unlock+0x1a/0x30
 ? iput+0x4cb/0x7e0
 do_unlinkat+0x495/0x7c0
 ? try_break_deleg+0x120/0x120
 ? 0xffffffff81000000
 ? __check_object_size+0x15a/0x210
 ? strncpy_from_user+0x13e/0x250
 ? getname_flags+0x1dc/0x530
 __x64_sys_unlinkat+0xc8/0xf0
 do_syscall_64+0x65/0x110
 entry_SYSCALL_64_after_hwframe+0x67/0x6f
RIP: 0033:0x434ffd
Code: 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 8
RSP: 002b:00007ffc50fa7b28 EFLAGS: 00000246 ORIG_RAX: 0000000000000107
RAX: ffffffffffffffda RBX: 00007ffc50fa7e18 RCX: 0000000000434ffd
RDX: 0000000000000000 RSI: 0000000020000240 RDI: 0000000000000005
RBP: 00007ffc50fa7be0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007ffc50fa7e08 R14: 00000000004bbf30 R15: 0000000000000001
 </TASK>

The buggy address belongs to the object at ffff888012c12000
 which belongs to the cache filp of size 360
The buggy address is located 196 bytes inside of
 freed 360-byte region [ffff888012c12000, ffff888012c12168)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12c12
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x40(head|node=0|zone=0)
page_type: f5(slab)
raw: 0000000000000040 ffff888000ad7640 ffffea0000497a00 dead000000000004
raw: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
head: 0000000000000040 ffff888000ad7640 ffffea0000497a00 dead000000000004
head: 0000000000000000 0000000000100010 00000001f5000000 0000000000000000
head: 0000000000000001 ffffea00004b0481 ffffffffffffffff 0000000000000000
head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888012c11f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888012c12000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff888012c12080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                           ^
 ffff888012c12100: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
 ffff888012c12180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================

	Reported-by: [email protected]
Closes: https://syzkaller.appspot.com/bug?extid=b244bda78289b00204ed
	Suggested-by: Thadeu Lima de Souza Cascardo <[email protected]>
	Signed-off-by: Bhupesh <[email protected]>
Link: https://patch.msgid.link/[email protected]
	Signed-off-by: Theodore Ts'o <[email protected]>
(cherry picked from commit c8e008b)
	Signed-off-by: Jonathan Maple <[email protected]>
Rebuild_History BUILDABLE
Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
Number of commits in upstream range v5.14~1..kernel-mainline: 309912
Number of commits in rpm: 13
Number of commits matched with upstream: 10 (76.92%)
Number of commits in upstream but not in rpm: 309902
Number of commits NOT found in upstream: 3 (23.08%)

Rebuilding Kernel on Branch rocky9_6_rebuild_kernel-5.14.0-570.23.1.el9_6 for kernel-5.14.0-570.23.1.el9_6
Clean Cherry Picks: 8 (80.00%)
Empty Cherry Picks: 2 (20.00%)
_______________________________

Full Details Located here:
ciq/ciq_backports/kernel-5.14.0-570.23.1.el9_6/rebuild.details.txt

Includes:
* git commit header above
* Empty Commits with upstream SHA
* RPM ChangeLog Entries that could not be matched

Individual Empty Commit failures contained in the same containing directory.
The git message for empty commits will have the path for the failed commit.
File names are the first 8 characters of the upstream SHA
thefossguy-ciq
thefossguy-ciq previously approved these changes Jun 27, 2025
Copy link

@thefossguy-ciq thefossguy-ciq left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI builds successfully and the diff of the commits cherry picked cleanly look good.
🚤

bmastbergen
bmastbergen previously approved these changes Jun 27, 2025
Copy link
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@PlaidCat PlaidCat dismissed stale reviews from bmastbergen and thefossguy-ciq via 564742b June 27, 2025 14:34
@PlaidCat PlaidCat force-pushed the rocky9_6_rebuild branch 4 times, most recently from c3403c2 to 28ba8d7 Compare June 27, 2025 15:05
Starting 2025.06.26 some of the actions required efltools to have devel
enabled.
@PlaidCat PlaidCat merged commit 9679450 into rocky9_6 Jun 27, 2025
4 checks passed
@PlaidCat PlaidCat deleted the rocky9_6_rebuild branch June 27, 2025 16:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

3 participants