Skip to content

Conversation

@PlaidCat
Copy link
Collaborator

This is the attempt at a re-builder built on Cron and some internal tools, but the same process is as follows as previous rebuilds

  • Download all unprocessed src.rpm
  • for each src,pm
    • Find all commits in changelog up to last known tag ... in this case 5.14.0-611
    • Re-play commits in reverse order (oldest in change log to newest) with git cherry-pick
    • After replay replace ENTIRE code in branch with rpmbuild -bp from corresponding src.rpm.
    • Tag Rebuild branch

Rebuild Splat Inspection

kernel-5.14.0-611.20.1.el9_7

[jmaple@devbox kernel-src-tree]$ cat ciq/ciq_backports/kernel-5.14.0-611.20.1.el9_7/rebuild.details.txt
Rebuild_History BUILDABLE
Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
Number of commits in upstream range v5.14~1..kernel-mainline: 351590
Number of commits in rpm: 22
Number of commits matched with upstream: 17 (77.27%)
Number of commits in upstream but not in rpm: 351573
Number of commits NOT found in upstream: 5 (22.73%)

Rebuilding Kernel on Branch rocky9_7_rebuild_kernel-5.14.0-611.20.1.el9_7 for kernel-5.14.0-611.20.1.el9_7
Clean Cherry Picks: 14 (82.35%)
Empty Cherry Picks: 3 (17.65%)
_______________________________

__EMPTY COMMITS__________________________
15383a0d63dbcd63dc7e8d9ec1bf3a0f7ebf64ac landlock: Add the errata interface
6d9ac5e4d70eba3e336f9809ba91ab2c49de6d87 landlock: Prepare to add second errata
c5efa393d82cf68812e0ae4d93e339873eabe9fe selftests/landlock: Add a new test for setuid()

__CHANGES NOT IN UPSTREAM________________
Replace sbat with Rocky Linux sbat
Change bug tracker URL
Ensure appended release in sbat is removed'
redhat: use RELEASE_LOCALVERSION also for dist-get-tag
redhat: introduce RELEASE_LOCALVERSION variable

BUILD

[jmaple@devbox code]$ egrep -B 5 -A 5 "\[TIMER\]|^Starting Build" $(ls -t kbuild* | head -n1)
/mnt/code/kernel-src-tree-build
Running make mrproper...
  CLEAN   scripts/basic
  CLEAN   scripts/kconfig
  CLEAN   include/config include/generated
[TIMER]{MRPROPER}: 6s
x86_64 architecture detected, copying config
'configs/kernel-x86_64-rhel.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-rocky9_7_rebuild-32032f84ebdc"
Making olddefconfig
--
  HOSTCC  scripts/kconfig/util.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
Starting Build
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_32.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_64.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_x32.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_32_ia32.h
--
  BTF [M] sound/usb/usx2y/snd-usb-us122l.ko
  BTF [M] sound/usb/usx2y/snd-usb-usx2y.ko
  BTF [M] sound/virtio/virtio_snd.ko
  BTF [M] sound/xen/snd_xen_front.ko
  BTF [M] sound/x86/snd-hdmi-lpe-audio.ko
[TIMER]{BUILD}: 1501s
Making Modules
  INSTALL /lib/modules/5.14.0-rocky9_7_rebuild-32032f84ebdc/kernel/arch/x86/crypto/blake2s-x86_64.ko
  INSTALL /lib/modules/5.14.0-rocky9_7_rebuild-32032f84ebdc/kernel/arch/x86/crypto/blowfish-x86_64.ko
  INSTALL /lib/modules/5.14.0-rocky9_7_rebuild-32032f84ebdc/kernel/arch/x86/crypto/camellia-aesni-avx-x86_64.ko
  INSTALL /lib/modules/5.14.0-rocky9_7_rebuild-32032f84ebdc/kernel/arch/x86/crypto/camellia-aesni-avx2.ko
--
  INSTALL /lib/modules/5.14.0-rocky9_7_rebuild-32032f84ebdc/kernel/sound/xen/snd_xen_front.ko
  SIGN    /lib/modules/5.14.0-rocky9_7_rebuild-32032f84ebdc/kernel/sound/virtio/virtio_snd.ko
  STRIP   /lib/modules/5.14.0-rocky9_7_rebuild-32032f84ebdc/kernel/sound/xen/snd_xen_front.ko
  SIGN    /lib/modules/5.14.0-rocky9_7_rebuild-32032f84ebdc/kernel/sound/xen/snd_xen_front.ko
  DEPMOD  /lib/modules/5.14.0-rocky9_7_rebuild-32032f84ebdc
[TIMER]{MODULES}: 8s
Making Install
sh ./arch/x86/boot/install.sh 5.14.0-rocky9_7_rebuild-32032f84ebdc \
        arch/x86/boot/bzImage System.map "/boot"
[TIMER]{INSTALL}: 21s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-rocky9_7_rebuild-32032f84ebdc and Index to 2
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 6s
[TIMER]{BUILD}: 1501s
[TIMER]{MODULES}: 8s
[TIMER]{INSTALL}: 21s
[TIMER]{TOTAL} 1540s
Rebooting in 10 seconds

KSelfTests

[jmaple@devbox code]$ ~/workspace/auto_kernel_history_rebuild/Rocky10/rocky10/code/get_kselftest_diff.sh
kselftest.5.14.0-rocky9_7_rebuild-386d677a861c.log
313
kselftest.5.14.0-rocky9_7_rebuild-2d407efe1dcc.log
313
kselftest.5.14.0-rocky9_7_rebuild-03fef51f5457.log
313
kselftest.5.14.0-rocky9_7_rebuild-32032f84ebdc.log
313
Before: kselftest.5.14.0-rocky9_7_rebuild-03fef51f5457.log
After: kselftest.5.14.0-rocky9_7_rebuild-32032f84ebdc.log
Diff:
No differences found.

…on memory

jira KERNEL-445
cve CVE-2025-39883
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Miaohe Lin <[email protected]>
commit d613f53

When I did memory failure tests, below panic occurs:

page dumped because: VM_BUG_ON_PAGE(PagePoisoned(page))
kernel BUG at include/linux/page-flags.h:616!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP NOPTI
CPU: 3 PID: 720 Comm: bash Not tainted 6.10.0-rc1-00195-g148743902568 #40
RIP: 0010:unpoison_memory+0x2f3/0x590
RSP: 0018:ffffa57fc8787d60 EFLAGS: 00000246
RAX: 0000000000000037 RBX: 0000000000000009 RCX: ffff9be25fcdc9c8
RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff9be25fcdc9c0
RBP: 0000000000300000 R08: ffffffffb4956f88 R09: 0000000000009ffb
R10: 0000000000000284 R11: ffffffffb4926fa0 R12: ffffe6b00c000000
R13: ffff9bdb453dfd00 R14: 0000000000000000 R15: fffffffffffffffe
FS:  00007f08f04e4740(0000) GS:ffff9be25fcc0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564787a30410 CR3: 000000010d4e2000 CR4: 00000000000006f0
Call Trace:
 <TASK>
 unpoison_memory+0x2f3/0x590
 simple_attr_write_xsigned.constprop.0.isra.0+0xb3/0x110
 debugfs_attr_write+0x42/0x60
 full_proxy_write+0x5b/0x80
 vfs_write+0xd5/0x540
 ksys_write+0x64/0xe0
 do_syscall_64+0xb9/0x1d0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f08f0314887
RSP: 002b:00007ffece710078 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 00007f08f0314887
RDX: 0000000000000009 RSI: 0000564787a30410 RDI: 0000000000000001
RBP: 0000564787a30410 R08: 000000000000fefe R09: 000000007fffffff
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000009
R13: 00007f08f041b780 R14: 00007f08f0417600 R15: 00007f08f0416a00
 </TASK>
Modules linked in: hwpoison_inject
---[ end trace 0000000000000000 ]---
RIP: 0010:unpoison_memory+0x2f3/0x590
RSP: 0018:ffffa57fc8787d60 EFLAGS: 00000246
RAX: 0000000000000037 RBX: 0000000000000009 RCX: ffff9be25fcdc9c8
RDX: 0000000000000000 RSI: 0000000000000027 RDI: ffff9be25fcdc9c0
RBP: 0000000000300000 R08: ffffffffb4956f88 R09: 0000000000009ffb
R10: 0000000000000284 R11: ffffffffb4926fa0 R12: ffffe6b00c000000
R13: ffff9bdb453dfd00 R14: 0000000000000000 R15: fffffffffffffffe
FS:  00007f08f04e4740(0000) GS:ffff9be25fcc0000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564787a30410 CR3: 000000010d4e2000 CR4: 00000000000006f0
Kernel panic - not syncing: Fatal exception
Kernel Offset: 0x31c00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
---[ end Kernel panic - not syncing: Fatal exception ]---

The root cause is that unpoison_memory() tries to check the PG_HWPoison
flags of an uninitialized page.  So VM_BUG_ON_PAGE(PagePoisoned(page)) is
triggered.  This can be reproduced by below steps:

1.Offline memory block:

 echo offline > /sys/devices/system/memory/memory12/state

2.Get offlined memory pfn:

 page-types -b n -rlN

3.Write pfn to unpoison-pfn

 echo <pfn> > /sys/kernel/debug/hwpoison/unpoison-pfn

This scenario can be identified by pfn_to_online_page() returning NULL.
And ZONE_DEVICE pages are never expected, so we can simply fail if
pfn_to_online_page() == NULL to fix the bug.

Link: https://lkml.kernel.org/r/[email protected]
Fixes: f1dd2cd ("mm, memory_hotplug: do not associate hotadded memory to zones until online")
	Signed-off-by: Miaohe Lin <[email protected]>
	Suggested-by: David Hildenbrand <[email protected]>
	Acked-by: David Hildenbrand <[email protected]>
	Cc: Naoya Horiguchi <[email protected]>
	Cc: <[email protected]>
	Signed-off-by: Andrew Morton <[email protected]>
(cherry picked from commit d613f53)
	Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-445
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Paulo Alcantara <[email protected]>
commit 72ed55b

There is no need to force a lookup by unhashing the moved dentry after
successfully renaming the file on server.  The file metadata will be
re-fetched from server, if necessary, in the next call to
->d_revalidate() anyways.

	Signed-off-by: Paulo Alcantara (Red Hat) <[email protected]>
	Reviewed-by: David Howells <[email protected]>
	Cc: [email protected]
	Cc: [email protected]
	Signed-off-by: Steve French <[email protected]>
(cherry picked from commit 72ed55b)
	Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-445
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Paulo Alcantara <[email protected]>
commit fac56c4

In very rare cases, DFS mounts could end up with SMB sessions without
any IPC connections.  These mounts are only possible when having
unexpired cached DFS referrals, hence not requiring any IPC
connections during the mount process.

Try to establish those missing IPC connections when refreshing DFS
referrals.  If the server is still rejecting it, then simply ignore
and leave expired cached DFS referral for any potential DFS failovers.

	Reported-by: Jay Shin <[email protected]>
	Signed-off-by: Paulo Alcantara (Red Hat) <[email protected]>
	Cc: David Howells <[email protected]>
	Cc: [email protected]
	Signed-off-by: Steve French <[email protected]>
(cherry picked from commit fac56c4)
	Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-445
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Dai Ngo <[email protected]>
commit 7ef6010

After the delegation is returned to the NFS server remove it
from the server's delegations list to reduce the time it takes
to scan this list.

Network trace captured while running the below script shows the
time taken to service the CB_RECALL increases gradually due to
the overhead of traversing the delegation list in
nfs_delegation_find_inode_server.

The NFS server in this test is a Solaris server which issues
CB_RECALL when receiving the all-zero stateid in the SETATTR.

mount=/mnt/data
for i in $(seq 1 20)
do
   echo $i
   mkdir $mount/testtarfile$i
   time  tar -C $mount/testtarfile$i -xf 5000_files.tar
done

	Signed-off-by: Dai Ngo <[email protected]>
	Reviewed-by: Trond Myklebust <[email protected]>
	Signed-off-by: Anna Schumaker <[email protected]>
(cherry picked from commit 7ef6010)
	Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-445
cve CVE-2025-39840
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Stanislav Fort <[email protected]>
commit 4540f1d

When a watch on dir=/ is combined with an fsnotify event for a
single-character name directly under / (e.g., creating /a), an
out-of-bounds read can occur in audit_compare_dname_path().

The helper parent_len() returns 1 for "/". In audit_compare_dname_path(),
when parentlen equals the full path length (1), the code sets p = path + 1
and pathlen = 1 - 1 = 0. The subsequent loop then dereferences
p[pathlen - 1] (i.e., p[-1]), causing an out-of-bounds read.

Fix this by adding a pathlen > 0 check to the while loop condition
to prevent the out-of-bounds access.

	Cc: [email protected]
Fixes: e92eebb ("audit: fix suffixed '/' filename matching")
	Reported-by: Stanislav Fort <[email protected]>
	Suggested-by: Linus Torvalds <[email protected]>
	Signed-off-by: Stanislav Fort <[email protected]>
[PM: subject tweak, sign-off email fixes]
	Signed-off-by: Paul Moore <[email protected]>
(cherry picked from commit 4540f1d)
	Signed-off-by: Jonathan Maple <[email protected]>
…ndling

jira KERNEL-445
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author David Jeffery <[email protected]>
commit b37d70c

The st ioctl function currently interleaves code for handling various st
specific ioctls with parts of code needed for handling ioctls common to
all SCSI devices. Separate out st's code for the common ioctls into a
more manageable, separate function.

	Signed-off-by: David Jeffery <[email protected]>
	Tested-by: Laurence Oberman <[email protected]>
	Acked-by: Kai Mäkisara <[email protected]>
	Reviewed-by: John Meneghini <[email protected]>
	Tested-by: John Meneghini <[email protected]>
Link: https://patch.msgid.link/[email protected]
	Signed-off-by: Martin K. Petersen <[email protected]>
(cherry picked from commit b37d70c)
	Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-445
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author David Jeffery <[email protected]>
commit d27418a

With commit 9604eea ("scsi: st: Add third party poweron reset
handling") some customer tape applications fail from being unable to
complete ioctls to verify ID information for the device when there has
been any type of reset event to their tape devices.

The st driver currently will fail all standard SCSI ioctls if a call to
flush_buffer() fails in st_ioctl(). This causes ioctls which otherwise
have no effect on tape state to succeed or fail based on events
unrelated to the requested ioctl.

This makes SCSI information ioctls unreliable after a reset even if no
buffering is in use. With a reset setting the pos_unknown field,
flush_buffer() will report failure and fail all ioctls. So any
application expecting to use ioctls to check the identify the device
will be unable to do so in such a state.

For SCSI information ioctls, avoid the need for a buffer flush and allow
the ioctls to execute regardless of buffer state.

	Signed-off-by: David Jeffery <[email protected]>
	Tested-by: Laurence Oberman <[email protected]>
	Acked-by: Kai Mäkisara <[email protected]>
	Reviewed-by: John Meneghini <[email protected]>
	Tested-by: John Meneghini <[email protected]>
Link: https://patch.msgid.link/[email protected]
	Signed-off-by: Martin K. Petersen <[email protected]>
(cherry picked from commit d27418a)
	Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-445
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Tahera Fahimi <[email protected]>
commit 54a6e6b

Currently, a sandbox process is not restricted to sending a signal (e.g.
SIGKILL) to a process outside the sandbox environment.  The ability to
send a signal for a sandboxed process should be scoped the same way
abstract UNIX sockets are scoped. Therefore, we extend the "scoped"
field in a ruleset with LANDLOCK_SCOPE_SIGNAL to specify that a ruleset
will deny sending any signal from within a sandbox process to its parent
(i.e. any parent sandbox or non-sandboxed processes).

This patch adds file_set_fowner and file_free_security hooks to set and
release a pointer to the file owner's domain. This pointer, fown_domain
in landlock_file_security will be used in file_send_sigiotask to check
if the process can send a signal.

The ruleset_with_unknown_scope test is updated to support
LANDLOCK_SCOPE_SIGNAL.

This depends on two new changes:
- commit 1934b21 ("file: reclaim 24 bytes from f_owner"): replace
  container_of(fown, struct file, f_owner) with fown->file .
- commit 26f2043 ("fs: Fix file_set_fowner LSM hook
  inconsistencies"): lock before calling the hook.

	Signed-off-by: Tahera Fahimi <[email protected]>
Closes: landlock-lsm/linux#8
Link: https://lore.kernel.org/r/df2b4f880a2ed3042992689a793ea0951f6798a5.1725657727.git.fahimitahera@gmail.com
[mic: Update landlock_get_current_domain()'s return type, improve and
fix locking in hook_file_set_fowner(), simplify and fix sleepable call
and locking issue in hook_file_send_sigiotask() and rebase on the latest
VFS tree, simplify hook_task_kill() and quickly return when not
sandboxed, improve comments, rename LANDLOCK_SCOPED_SIGNAL]
Co-developed-by: Mickaël Salaün <[email protected]>
	Signed-off-by: Mickaël Salaün <[email protected]>
(cherry picked from commit 54a6e6b)
	Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-445
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Tahera Fahimi <[email protected]>
commit ea29236

Provide tests for the signal scoping.  If the signal is 0, no signal
will be sent, but the permission of a process to send a signal will be
checked.  Likewise, this test consider one signal for each signal
category: SIGTRAP, SIGURG, SIGHUP, and SIGTSTP.

	Signed-off-by: Tahera Fahimi <[email protected]>
Link: https://lore.kernel.org/r/15dc202bb7f0a462ddeaa0c1cd630d2a7c6fa5c5.1725657728.git.fahimitahera@gmail.com
[mic: Fix commit message, use dedicated variables per process, properly
close FDs, extend send_sig_to_parent to make sure scoping works as
expected]
	Signed-off-by: Mickaël Salaün <[email protected]>
(cherry picked from commit ea29236)
	Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-445
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Tahera Fahimi <[email protected]>
commit c899496

Expand the signal scoping tests with pthread_kill(3).  Test if a scoped
thread can send signal to a process in the same scoped domain, or a
non-sandboxed thread.

	Signed-off-by: Tahera Fahimi <[email protected]>
Link: https://lore.kernel.org/r/c15e9eafbb2da1210e46ba8db7b8907f5ea11009.1725657728.git.fahimitahera@gmail.com
[mic: Improve commit message]
	Signed-off-by: Mickaël Salaün <[email protected]>
(cherry picked from commit c899496)
	Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-445
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Mickaël Salaün <[email protected]>
commit 15383a0
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-5.14.0-611.20.1.el9_7/15383a0d.failed

Some fixes may require user space to check if they are applied on the
running kernel before using a specific feature.  For instance, this
applies when a restriction was previously too restrictive and is now
getting relaxed (e.g. for compatibility reasons).  However, non-visible
changes for legitimate use (e.g. security fixes) do not require an
erratum.

Because fixes are backported down to a specific Landlock ABI, we need a
way to avoid cherry-pick conflicts.  The solution is to only update a
file related to the lower ABI impacted by this issue.  All the ABI files
are then used to create a bitmask of fixes.

The new errata interface is similar to the one used to get the supported
Landlock ABI version, but it returns a bitmask instead because the order
of fixes may not match the order of versions, and not all fixes may
apply to all versions.

The actual errata will come with dedicated commits.  The description is
not actually used in the code but serves as documentation.

Create the landlock_abi_version symbol and use its value to check errata
consistency.

Update test_base's create_ruleset_checks_ordering tests and add errata
tests.

This commit is backportable down to the first version of Landlock.

Fixes: 3532b0b ("landlock: Enable user space to infer supported features")
	Cc: Günther Noack <[email protected]>
	Cc: [email protected]
Link: https://lore.kernel.org/r/[email protected]
	Signed-off-by: Mickaël Salaün <[email protected]>
(cherry picked from commit 15383a0)
	Signed-off-by: Jonathan Maple <[email protected]>

# Conflicts:
#	security/landlock/setup.c
jira KERNEL-445
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Mickaël Salaün <[email protected]>
commit 6d9ac5e
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-5.14.0-611.20.1.el9_7/6d9ac5e4.failed

Potentially include errata for Landlock ABI v5 (Linux 6.10) and v6
(Linux 6.12).  That will be useful for the following signal scoping
erratum.

As explained in errata.h, this commit should be backportable without
conflict down to ABI v5.  It must then not include the errata/abi-6.h
file.

Fixes: 54a6e6b ("landlock: Add signal scoping")
	Cc: Günther Noack <[email protected]>
	Cc: [email protected]
Link: https://lore.kernel.org/r/[email protected]
	Signed-off-by: Mickaël Salaün <[email protected]>
(cherry picked from commit 6d9ac5e)
	Signed-off-by: Jonathan Maple <[email protected]>

# Conflicts:
#	security/landlock/errata.h
jira KERNEL-445
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Mickaël Salaün <[email protected]>
commit 18eb75f

Because Linux credentials are managed per thread, user space relies on
some hack to synchronize credential update across threads from the same
process.  This is required by the Native POSIX Threads Library and
implemented by set*id(2) wrappers and libcap(3) to use tgkill(2) to
synchronize threads.  See nptl(7) and libpsx(3).  Furthermore, some
runtimes like Go do not enable developers to have control over threads
[1].

To avoid potential issues, and because threads are not security
boundaries, let's relax the Landlock (optional) signal scoping to always
allow signals sent between threads of the same process.  This exception
is similar to the __ptrace_may_access() one.

hook_file_set_fowner() now checks if the target task is part of the same
process as the caller.  If this is the case, then the related signal
triggered by the socket will always be allowed.

Scoping of abstract UNIX sockets is not changed because kernel objects
(e.g. sockets) should be tied to their creator's domain at creation
time.

Note that creating one Landlock domain per thread puts each of these
threads (and their future children) in their own scope, which is
probably not what users expect, especially in Go where we do not control
threads.  However, being able to drop permissions on all threads should
not be restricted by signal scoping.  We are working on a way to make it
possible to atomically restrict all threads of a process with the same
domain [2].

Add erratum for signal scoping.

Closes: landlock-lsm/go-landlock#36
Fixes: 54a6e6b ("landlock: Add signal scoping")
Fixes: c899496 ("selftests/landlock: Test signal scoping for threads")
Depends-on: 26f2043 ("fs: Fix file_set_fowner LSM hook inconsistencies")
Link: https://pkg.go.dev/kernel.org/pub/linux/libs/security/libcap/psx [1]
Link: landlock-lsm/linux#2 [2]
	Cc: Günther Noack <[email protected]>
	Cc: Paul Moore <[email protected]>
	Cc: Serge Hallyn <[email protected]>
	Cc: Tahera Fahimi <[email protected]>
	Cc: [email protected]
	Acked-by: Christian Brauner <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
[mic: Add extra pointer check and RCU guard, and ease backport]
	Signed-off-by: Mickaël Salaün <[email protected]>
(cherry picked from commit 18eb75f)
	Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-445
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Mickaël Salaün <[email protected]>
commit bbe7227

Split signal_scoping_threads tests into signal_scoping_thread_before
and signal_scoping_thread_after.

Use local variables for thread synchronization.  Fix exported function.
Replace some asserts with expects.

Fixes: c899496 ("selftests/landlock: Test signal scoping for threads")
	Cc: Günther Noack <[email protected]>
	Cc: Tahera Fahimi <[email protected]>
	Cc: [email protected]
Link: https://lore.kernel.org/r/[email protected]
	Signed-off-by: Mickaël Salaün <[email protected]>
(cherry picked from commit bbe7227)
	Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-445
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Mickaël Salaün <[email protected]>
commit c5efa39
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-5.14.0-611.20.1.el9_7/c5efa393.failed

The new signal_scoping_thread_setuid tests check that the libc's
setuid() function works as expected even when a thread is sandboxed with
scoped signal restrictions.

Before the signal scoping fix, this test would have failed with the
setuid() call:

  [pid    65] getpid()                    = 65
  [pid    65] tgkill(65, 66, SIGRT_1)     = -1 EPERM (Operation not permitted)
  [pid    65] futex(0x40a66cdc, FUTEX_WAKE_PRIVATE, 1) = 0
  [pid    65] setuid(1001)                = 0

After the fix, tgkill(2) is successfully leveraged to synchronize
credentials update across threads:

  [pid    65] getpid()                    = 65
  [pid    65] tgkill(65, 66, SIGRT_1)     = 0
  [pid    66] <... read resumed>0x40a65eb7, 1) = ? ERESTARTSYS (To be restarted if SA_RESTART is set)
  [pid    66] --- SIGRT_1 {si_signo=SIGRT_1, si_code=SI_TKILL, si_pid=65, si_uid=1000} ---
  [pid    66] getpid()                    = 65
  [pid    66] setuid(1001)                = 0
  [pid    66] futex(0x40a66cdc, FUTEX_WAKE_PRIVATE, 1) = 0
  [pid    66] rt_sigreturn({mask=[]})     = 0
  [pid    66] read(3,  <unfinished ...>
  [pid    65] setuid(1001)                = 0

Test coverage for security/landlock is 92.9% of 1137 lines according to
gcc/gcov-14.

Fixes: c899496 ("selftests/landlock: Test signal scoping for threads")
	Cc: Günther Noack <[email protected]>
	Cc: Tahera Fahimi <[email protected]>
	Cc: [email protected]
Link: https://lore.kernel.org/r/[email protected]
[mic: Update test coverage]
	Signed-off-by: Mickaël Salaün <[email protected]>
(cherry picked from commit c5efa39)
	Signed-off-by: Jonathan Maple <[email protected]>

# Conflicts:
#	tools/testing/selftests/landlock/scoped_signal_test.c
jira KERNEL-445
cve CVE-2025-40240
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Alexey Simakov <[email protected]>
commit 441f064

chunk->skb pointer is dereferenced in the if-block where it's supposed
to be NULL only.

chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list
instead and do it just before replacing chunk->skb. We're sure that
otherwise chunk->skb is non-NULL because of outer if() condition.

Fixes: 90017ac ("sctp: Add GSO support")
	Signed-off-by: Alexey Simakov <[email protected]>
	Acked-by: Marcelo Ricardo Leitner <[email protected]>
Link: https://patch.msgid.link/[email protected]
	Signed-off-by: Jakub Kicinski <[email protected]>
(cherry picked from commit 441f064)
	Signed-off-by: Jonathan Maple <[email protected]>
jira KERNEL-445
cve CVE-2025-39806
Rebuild_History Non-Buildable kernel-5.14.0-611.20.1.el9_7
commit-author Qasim Ijaz <[email protected]>
commit 0379eb8

A malicious HID device can trigger a slab out-of-bounds during
mt_report_fixup() by passing in report descriptor smaller than
607 bytes. mt_report_fixup() attempts to patch byte offset 607
of the descriptor with 0x25 by first checking if byte offset
607 is 0x15 however it lacks bounds checks to verify if the
descriptor is big enough before conducting this check. Fix
this bug by ensuring the descriptor size is at least 608
bytes before accessing it.

Below is the KASAN splat after the out of bounds access happens:

[   13.671954] ==================================================================
[   13.672667] BUG: KASAN: slab-out-of-bounds in mt_report_fixup+0x103/0x110
[   13.673297] Read of size 1 at addr ffff888103df39df by task kworker/0:1/10
[   13.673297]
[   13.673297] CPU: 0 UID: 0 PID: 10 Comm: kworker/0:1 Not tainted 6.15.0-00005-gec5d573d83f4-dirty #3
[   13.673297] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/04
[   13.673297] Call Trace:
[   13.673297]  <TASK>
[   13.673297]  dump_stack_lvl+0x5f/0x80
[   13.673297]  print_report+0xd1/0x660
[   13.673297]  kasan_report+0xe5/0x120
[   13.673297]  __asan_report_load1_noabort+0x18/0x20
[   13.673297]  mt_report_fixup+0x103/0x110
[   13.673297]  hid_open_report+0x1ef/0x810
[   13.673297]  mt_probe+0x422/0x960
[   13.673297]  hid_device_probe+0x2e2/0x6f0
[   13.673297]  really_probe+0x1c6/0x6b0
[   13.673297]  __driver_probe_device+0x24f/0x310
[   13.673297]  driver_probe_device+0x4e/0x220
[   13.673297]  __device_attach_driver+0x169/0x320
[   13.673297]  bus_for_each_drv+0x11d/0x1b0
[   13.673297]  __device_attach+0x1b8/0x3e0
[   13.673297]  device_initial_probe+0x12/0x20
[   13.673297]  bus_probe_device+0x13d/0x180
[   13.673297]  device_add+0xe3a/0x1670
[   13.673297]  hid_add_device+0x31d/0xa40
[...]

Fixes: c8000de ("HID: multitouch: Add support for GT7868Q")
	Cc: [email protected]
	Signed-off-by: Qasim Ijaz <[email protected]>
	Reviewed-by: Jiri Slaby <[email protected]>
	Signed-off-by: Jiri Kosina <[email protected]>
(cherry picked from commit 0379eb8)
	Signed-off-by: Jonathan Maple <[email protected]>
Rebuild_History BUILDABLE
Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
Number of commits in upstream range v5.14~1..kernel-mainline: 351590
Number of commits in rpm: 22
Number of commits matched with upstream: 17 (77.27%)
Number of commits in upstream but not in rpm: 351573
Number of commits NOT found in upstream: 5 (22.73%)

Rebuilding Kernel on Branch rocky9_7_rebuild_kernel-5.14.0-611.20.1.el9_7 for kernel-5.14.0-611.20.1.el9_7
Clean Cherry Picks: 14 (82.35%)
Empty Cherry Picks: 3 (17.65%)
_______________________________

Full Details Located here:
ciq/ciq_backports/kernel-5.14.0-611.20.1.el9_7/rebuild.details.txt

Includes:
* git commit header above
* Empty Commits with upstream SHA
* RPM ChangeLog Entries that could not be matched

Individual Empty Commit failures contained in the same containing directory.
The git message for empty commits will have the path for the failed commit.
File names are the first 8 characters of the upstream SHA
@PlaidCat PlaidCat requested review from a team January 16, 2026 21:10
@PlaidCat PlaidCat self-assigned this Jan 16, 2026
Copy link
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants