[rocky9_8] History Rebuild through kernel-5.14.0-687.31.1.el9_8

Makefile.rhelver

@@ -12,7 +12,7 @@ RHEL_MINOR = 8
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 687.30.1
+RHEL_RELEASE = 687.31.1
 
 #
 # ZSTREAM

block/blk-mq.c

@@ -3046,7 +3046,7 @@ static struct request *blk_mq_get_new_requests(struct request_queue *q,
 /*
  * Check if there is a suitable cached request and return it.
  */
-static struct request *blk_mq_peek_cached_request(struct blk_plug *plug,
+static struct request *blk_mq_get_cached_request(struct blk_plug *plug,
 		struct request_queue *q, blk_opf_t opf)
 {
 	enum hctx_type type = blk_mq_get_hctx_type(opf);
@@ -3062,27 +3062,10 @@ static struct request *blk_mq_peek_cached_request(struct blk_plug *plug,
 		return NULL;
 	if (op_is_flush(rq->cmd_flags) != op_is_flush(opf))
 		return NULL;
+	rq_list_pop(&plug->cached_rqs);
 	return rq;
 }
 
-static void blk_mq_use_cached_rq(struct request *rq, struct blk_plug *plug,
-		struct bio *bio)
-{
-	if (rq_list_pop(&plug->cached_rqs) != rq)
-		WARN_ON_ONCE(1);
-
-	/*
-	 * If any qos ->throttle() end up blocking, we will have flushed the
-	 * plug and hence killed the cached_rq list as well. Pop this entry
-	 * before we throttle.
-	 */
-	rq_qos_throttle(rq->q, bio);
-
-	blk_mq_rq_time_init(rq, blk_time_get_ns());
-	rq->cmd_flags = bio->bi_opf;
-	INIT_LIST_HEAD(&rq->queuelist);
-}
-
 static bool bio_unaligned(const struct bio *bio, struct request_queue *q)
 {
 	unsigned int bs_mask = queue_logical_block_size(q) - 1;
@@ -3120,7 +3103,7 @@ void blk_mq_submit_bio(struct bio *bio)
 	/*
 	 * If the plug has a cached request for this queue, try to use it.
 	 */
-	rq = blk_mq_peek_cached_request(plug, q, bio->bi_opf);
+	rq = blk_mq_get_cached_request(plug, q, bio->bi_opf);
 
 	/*
 	 * A BIO that was released from a zone write plug has already been
@@ -3179,7 +3162,10 @@ void blk_mq_submit_bio(struct bio *bio)
 
 new_request:
 	if (rq) {
-		blk_mq_use_cached_rq(rq, plug, bio);
+		rq_qos_throttle(rq->q, bio);
+		blk_mq_rq_time_init(rq, blk_time_get_ns());
+		rq->cmd_flags = bio->bi_opf;
+		INIT_LIST_HEAD(&rq->queuelist);
 	} else {
 		rq = blk_mq_get_new_requests(q, plug, bio);
 		if (unlikely(!rq)) {
@@ -3225,12 +3211,10 @@ void blk_mq_submit_bio(struct bio *bio)
 	return;
 
 queue_exit:
-	/*
-	 * Don't drop the queue reference if we were trying to use a cached
-	 * request and thus didn't acquire one.
-	 */
 	if (!rq)
 		blk_queue_exit(q);
+	else
+		rq_list_add_head(&plug->cached_rqs, rq);
 }
 
 #ifdef CONFIG_BLK_MQ_STACKING

ciq/ciq_backports/kernel-5.14.0-687.31.1.el9_8/94f39804.failed

@@ -0,0 +1,128 @@
+xfrm: Duplicate SPI Handling
+
+jira KERNEL-1399
+cve CVE-2025-39797
+Rebuild_History Non-Buildable kernel-5.14.0-687.31.1.el9_8
+commit-author Aakash Kumar S <saakashkumar@marvell.com>
+commit 94f39804d891cffe4ce17737d295f3b195bc7299
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-5.14.0-687.31.1.el9_8/94f39804.failed
+
+The issue originates when Strongswan initiates an XFRM_MSG_ALLOCSPI
+Netlink message, which triggers the kernel function xfrm_alloc_spi().
+This function is expected to ensure uniqueness of the Security Parameter
+Index (SPI) for inbound Security Associations (SAs). However, it can
+return success even when the requested SPI is already in use, leading
+to duplicate SPIs assigned to multiple inbound SAs, differentiated
+only by their destination addresses.
+
+This behavior causes inconsistencies during SPI lookups for inbound packets.
+Since the lookup may return an arbitrary SA among those with the same SPI,
+packet processing can fail, resulting in packet drops.
+
+According to RFC 4301 section 4.4.2 , for inbound processing a unicast SA
+is uniquely identified by the SPI and optionally protocol.
+
+Reproducing the Issue Reliably:
+To consistently reproduce the problem, restrict the available SPI range in
+charon.conf : spi_min = 0x10000000 spi_max = 0x10000002
+This limits the system to only 2 usable SPI values.
+Next, create more than 2 Child SA. each using unique pair of src/dst address.
+As soon as the 3rd Child SA is initiated, it will be assigned a duplicate
+SPI, since the SPI pool is already exhausted.
+With a narrow SPI range, the issue is consistently reproducible.
+With a broader/default range, it becomes rare and unpredictable.
+
+Current implementation:
+xfrm_spi_hash() lookup function computes hash using daddr, proto, and family.
+So if two SAs have the same SPI but different destination addresses, then
+they will:
+a. Hash into different buckets
+b. Be stored in different linked lists (byspi + h)
+c. Not be seen in the same hlist_for_each_entry_rcu() iteration.
+As a result, the lookup will result in NULL and kernel allows that Duplicate SPI
+
+Proposed Change:
+xfrm_state_lookup_spi_proto() does a truly global search - across all states,
+regardless of hash bucket and matches SPI and proto.
+
+	Signed-off-by: Aakash Kumar S <saakashkumar@marvell.com>
+	Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+	Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+(cherry picked from commit 94f39804d891cffe4ce17737d295f3b195bc7299)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	net/xfrm/xfrm_state.c
+diff --cc net/xfrm/xfrm_state.c
+index 93a8144d43d0,b3950234b150..000000000000
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@@ -2331,39 -2590,35 +2349,57 @@@ int xfrm_alloc_spi(struct xfrm_state *x
+
+  	err = -ENOENT;
+
+- 	if (minspi == maxspi) {
+- 		x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family);
+- 		if (x0) {
+- 			NL_SET_ERR_MSG(extack, "Requested SPI is already in use");
+- 			xfrm_state_put(x0);
++ 	for (h = 0; h < range; h++) {
++ 		u32 spi = (low == high) ? low : get_random_u32_inclusive(low, high);
++ 		newspi = htonl(spi);
++ 
++ 		spin_lock_bh(&net->xfrm.xfrm_state_lock);
++ 		x0 = xfrm_state_lookup_spi_proto(net, newspi, x->id.proto);
++ 		if (!x0) {
++ 			x->id.spi = newspi;
++ 			h = xfrm_spi_hash(net, &x->id.daddr, newspi, x->id.proto, x->props.family);
++ 			XFRM_STATE_INSERT(byspi, &x->byspi, net->xfrm.state_byspi + h, x->xso.type);
++ 			spin_unlock_bh(&net->xfrm.xfrm_state_lock);
++ 			err = 0;
+  			goto unlock;
+  		}
+++<<<<<<< HEAD
+ +		newspi = minspi;
+ +	} else {
+ +		u32 spi = 0;
+ +		for (h = 0; h < high-low+1; h++) {
+ +			spi = low + prandom_u32()%(high-low+1);
+ +			x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
+ +			if (x0 == NULL) {
+ +				newspi = htonl(spi);
+ +				break;
+ +			}
+ +			xfrm_state_put(x0);
+ +		}
+ +	}
+ +	if (newspi) {
+ +		spin_lock_bh(&net->xfrm.xfrm_state_lock);
+ +		x->id.spi = newspi;
+ +		h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
+ +		XFRM_STATE_INSERT(byspi, &x->byspi, net->xfrm.state_byspi + h,
+ +				  x->xso.type);
+++=======
++ 		xfrm_state_put(x0);
+++>>>>>>> 94f39804d891 (xfrm: Duplicate SPI Handling)
+  		spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+
+- 		err = 0;
+- 	} else {
+- 		NL_SET_ERR_MSG(extack, "No SPI available in the requested range");
++ 		if (signal_pending(current)) {
++ 			err = -ERESTARTSYS;
++ 			goto unlock;
++ 		}
++ 
++ 		if (low == high)
++ 			break;
+  	}
+
++ 	if (err)
++ 		NL_SET_ERR_MSG(extack, "No SPI available in the requested range");
++ 
+  unlock:
+  	spin_unlock_bh(&x->lock);
+
+* Unmerged path net/xfrm/xfrm_state.c

ciq/ciq_backports/kernel-5.14.0-687.31.1.el9_8/cd8ae32e.failed

@@ -0,0 +1,106 @@
+xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
+
+jira KERNEL-1399
+cve CVE-2025-39797
+Rebuild_History Non-Buildable kernel-5.14.0-687.31.1.el9_8
+commit-author Sabrina Dubroca <sd@queasysnail.net>
+commit cd8ae32e4e4652db55bce6b9c79267d8946765a9
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-5.14.0-687.31.1.el9_8/cd8ae32e.failed
+
+x->id.spi == 0 means "no SPI assigned", but since commit
+94f39804d891 ("xfrm: Duplicate SPI Handling"), we now create states
+and add them to the byspi list with this value.
+
+__xfrm_state_delete doesn't remove those states from the byspi list,
+since they shouldn't be there, and this shows up as a UAF the next
+time we go through the byspi list.
+
+	Reported-by: syzbot+a25ee9d20d31e483ba7b@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=a25ee9d20d31e483ba7b
+Fixes: 94f39804d891 ("xfrm: Duplicate SPI Handling")
+	Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+	Reviewed-by: Simon Horman <horms@kernel.org>
+	Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
+(cherry picked from commit cd8ae32e4e4652db55bce6b9c79267d8946765a9)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	net/xfrm/xfrm_state.c
+diff --cc net/xfrm/xfrm_state.c
+index 93a8144d43d0,d213ca3653a8..000000000000
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@@ -2331,38 -2581,37 +2331,69 @@@ int xfrm_alloc_spi(struct xfrm_state *x
+
+  	err = -ENOENT;
+
+++<<<<<<< HEAD
+ +	if (minspi == maxspi) {
+ +		x0 = xfrm_state_lookup(net, mark, &x->id.daddr, minspi, x->id.proto, x->props.family);
+ +		if (x0) {
+ +			NL_SET_ERR_MSG(extack, "Requested SPI is already in use");
+ +			xfrm_state_put(x0);
+++=======
++ 	for (h = 0; h < range; h++) {
++ 		u32 spi = (low == high) ? low : get_random_u32_inclusive(low, high);
++ 		if (spi == 0)
++ 			goto next;
++ 		newspi = htonl(spi);
++ 
++ 		spin_lock_bh(&net->xfrm.xfrm_state_lock);
++ 		x0 = xfrm_state_lookup_spi_proto(net, newspi, x->id.proto);
++ 		if (!x0) {
++ 			x->id.spi = newspi;
++ 			h = xfrm_spi_hash(net, &x->id.daddr, newspi, x->id.proto, x->props.family);
++ 			XFRM_STATE_INSERT(byspi, &x->byspi, net->xfrm.state_byspi + h, x->xso.type);
++ 			spin_unlock_bh(&net->xfrm.xfrm_state_lock);
++ 			err = 0;
+++>>>>>>> cd8ae32e4e46 (xfrm: xfrm_alloc_spi shouldn't use 0 as SPI)
+  			goto unlock;
+  		}
+ -		xfrm_state_put(x0);
+ +		newspi = minspi;
+ +	} else {
+ +		u32 spi = 0;
+ +		for (h = 0; h < high-low+1; h++) {
+ +			spi = low + prandom_u32()%(high-low+1);
+ +			x0 = xfrm_state_lookup(net, mark, &x->id.daddr, htonl(spi), x->id.proto, x->props.family);
+ +			if (x0 == NULL) {
+ +				newspi = htonl(spi);
+ +				break;
+ +			}
+ +			xfrm_state_put(x0);
+ +		}
+ +	}
+ +	if (newspi) {
+ +		spin_lock_bh(&net->xfrm.xfrm_state_lock);
+ +		x->id.spi = newspi;
+ +		h = xfrm_spi_hash(net, &x->id.daddr, x->id.spi, x->id.proto, x->props.family);
+ +		XFRM_STATE_INSERT(byspi, &x->byspi, net->xfrm.state_byspi + h,
+ +				  x->xso.type);
+  		spin_unlock_bh(&net->xfrm.xfrm_state_lock);
+
+++<<<<<<< HEAD
+ +		err = 0;
+ +	} else {
+++=======
++ next:
++ 		if (signal_pending(current)) {
++ 			err = -ERESTARTSYS;
++ 			goto unlock;
++ 		}
++ 
++ 		if (low == high)
++ 			break;
++ 	}
++ 
++ 	if (err)
+++>>>>>>> cd8ae32e4e46 (xfrm: xfrm_alloc_spi shouldn't use 0 as SPI)
+  		NL_SET_ERR_MSG(extack, "No SPI available in the requested range");
+ +	}
+
+  unlock:
+  	spin_unlock_bh(&x->lock);
+* Unmerged path net/xfrm/xfrm_state.c

ciq/ciq_backports/kernel-5.14.0-687.31.1.el9_8/rebuild.details.txt

@@ -0,0 +1,22 @@
+Rebuild_History BUILDABLE
+Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
+Number of commits in upstream range v5.14~1..kernel-mainline: 394115
+Number of commits in rpm: 25
+Number of commits matched with upstream: 21 (84.00%)
+Number of commits in upstream but not in rpm: 394094
+Number of commits NOT found in upstream: 4 (16.00%)
+
+Rebuilding Kernel on Branch rocky9_8_rebuild_kernel-5.14.0-687.31.1.el9_8 for kernel-5.14.0-687.31.1.el9_8
+Clean Cherry Picks: 19 (90.48%)
+Empty Cherry Picks: 2 (9.52%)
+_______________________________
+
+__EMPTY COMMITS__________________________
+94f39804d891cffe4ce17737d295f3b195bc7299 xfrm: Duplicate SPI Handling
+cd8ae32e4e4652db55bce6b9c79267d8946765a9 xfrm: xfrm_alloc_spi shouldn't use 0 as SPI
+
+__CHANGES NOT IN UPSTREAM________________
+Replace sbat with Rocky Linux sbat
+Change bug tracker URL
+Ensure appended release in sbat is removed'
+redhat/configs: enable watchdog pretimout panic functionality for x86