[rocky9_8] History Rebuild through kernel-5.14.0-687.49.1.el9_8

Makefile.rhelver

@@ -12,7 +12,7 @@ RHEL_MINOR = 8
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 687.46.1
+RHEL_RELEASE = 687.49.1
 
 #
 # ZSTREAM

ciq/ciq_backports/kernel-5.14.0-687.47.1.el9_8/0861615c.failed

@@ -0,0 +1,90 @@
+sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
+
+jira KERNEL-1590
+cve CVE-2026-53246
+Rebuild_History Non-Buildable kernel-5.14.0-687.47.1.el9_8
+commit-author Xin Long <lucien.xin@gmail.com>
+commit 0861615c28de668669d748ef4eb913ea9262d13b
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-5.14.0-687.47.1.el9_8/0861615c.failed
+
+When a listening SCTP server processes a COOKIE_ECHO chunk, the cached
+peer INIT chunk embedded after the cookie is parsed and its parameters
+are later walked by sctp_process_init() using sctp_walk_params().
+
+However, the chunk header length of this cached INIT chunk was not
+validated against the remaining buffer in the COOKIE_ECHO payload. If
+the length field is inflated, the parameter walk can run beyond the
+actual received data, leading to out-of-bounds reads and potential
+memory corruption during later parameter handling (e.g. STATE_COOKIE
+processing and kmemdup() copies).
+
+Add a bounds check in sctp_unpack_cookie() to ensure the cached INIT
+chunk length does not exceed the available data in the COOKIE_ECHO
+buffer before it is used.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+	Reported-by: Brian Geffon <bgeffon@google.com>
+	Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Link: https://patch.msgid.link/eb60825fa22d6f9e663c7d4dbb69f397b5d34d42.1780362366.git.lucien.xin@gmail.com
+	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+(cherry picked from commit 0861615c28de668669d748ef4eb913ea9262d13b)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	net/sctp/sm_make_chunk.c
+diff --cc net/sctp/sm_make_chunk.c
+index c8f4ec5d5f98,85264862fb6b..000000000000
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@@ -1748,7 -1730,7 +1748,11 @@@ struct sctp_association *sctp_unpack_co
+  	struct sctp_signed_cookie *cookie;
+  	struct sk_buff *skb = chunk->skb;
+  	struct sctp_cookie *bear_cookie;
+++<<<<<<< HEAD
+ +	__u8 *digest = ep->digest;
+++=======
++ 	struct sctp_chunkhdr *ch;
+++>>>>>>> 0861615c28de (sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing)
+  	enum sctp_scope scope;
+  	unsigned int len;
+  	ktime_t kt;
+@@@ -1778,20 -1760,19 +1782,30 @@@
+  	cookie = chunk->subh.cookie_hdr;
+  	bear_cookie = &cookie->c;
+
+++<<<<<<< HEAD
+ +	if (!sctp_sk(ep->base.sk)->hmac)
+ +		goto no_hmac;
+++=======
++ 	ch = (struct sctp_chunkhdr *)(bear_cookie + 1);
++ 	if (ntohs(ch->length) > len - fixed_size)
++ 		goto malformed;
++ 
++ 	/* Verify the cookie's MAC, if cookie authentication is enabled. */
++ 	if (sctp_sk(ep->base.sk)->cookie_auth_enable) {
++ 		u8 mac[SHA256_DIGEST_SIZE];
+ -
+ -		hmac_sha256(&ep->cookie_auth_key, (const u8 *)bear_cookie,
+ -			    bodysize, mac);
+ -		static_assert(sizeof(cookie->mac) == sizeof(mac));
+ -		if (crypto_memneq(mac, cookie->mac, sizeof(mac))) {
+ -			*error = -SCTP_IERROR_BAD_SIG;
+++>>>>>>> 0861615c28de (sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing)
+ +
+ +	/* Check the signature.  */
+ +	{
+ +		struct crypto_shash *tfm = sctp_sk(ep->base.sk)->hmac;
+ +		int err;
+ +
+ +		err = crypto_shash_setkey(tfm, ep->secret_key,
+ +					  sizeof(ep->secret_key)) ?:
+ +		      crypto_shash_tfm_digest(tfm, (u8 *)bear_cookie, bodysize,
+ +					      digest);
+ +		if (err) {
+ +			*error = -SCTP_IERROR_NOMEM;
+  			goto fail;
+  		}
+  	}
+* Unmerged path net/sctp/sm_make_chunk.c

ciq/ciq_backports/kernel-5.14.0-687.47.1.el9_8/225d02cb.failed

@@ -0,0 +1,68 @@
+drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove
+
+jira KERNEL-1590
+Rebuild_History Non-Buildable kernel-5.14.0-687.47.1.el9_8
+commit-author Matthew Brost <matthew.brost@intel.com>
+commit 225d02cb46d0e567eb788308168159f61735c8fe
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-5.14.0-687.47.1.el9_8/225d02cb.failed
+
+Async work (e.g., GuC queue teardowns) can call ggtt_node_remove, so the
+operation must be performed under the GGTT lock to ensure the GGTT
+online check remains stable. GGTT insertion and removal are heavyweight
+operations (e.g., queue create/destroy), so the additional serialization
+cost is negligible compared to ensuring correctness.
+
+Fixes: 4f3a998a173b ("drm/xe: Open-code GGTT MMIO access protection")
+	Signed-off-by: Matthew Brost <matthew.brost@intel.com>
+	Reviewed-by: Dnyaneshwar Bhadane <dnyaneshwar.bhadane@intel.com>
+Link: https://patch.msgid.link/20260326011207.62373-1-matthew.brost@intel.com
+(cherry picked from commit 225d02cb46d0e567eb788308168159f61735c8fe)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	drivers/gpu/drm/xe/xe_ggtt.c
+diff --cc drivers/gpu/drm/xe/xe_ggtt.c
+index 5edc0cad47e2,a848d1a41b9b..000000000000
+--- a/drivers/gpu/drm/xe/xe_ggtt.c
++++ b/drivers/gpu/drm/xe/xe_ggtt.c
+@@@ -334,29 -468,24 +334,35 @@@ static void xe_ggtt_initial_clear(struc
+  static void ggtt_node_remove(struct xe_ggtt_node *node)
+  {
+  	struct xe_ggtt *ggtt = node->ggtt;
+ +	struct xe_device *xe = tile_to_xe(ggtt->tile);
+  	bool bound;
+ +	int idx;
+ +
+ +	bound = drm_dev_enter(&xe->drm, &idx);
+
+  	mutex_lock(&ggtt->lock);
+ -	bound = ggtt->flags & XE_GGTT_FLAGS_ONLINE;
+  	if (bound)
+ -		xe_ggtt_clear(ggtt, xe_ggtt_node_addr(node), xe_ggtt_node_size(node));
+ +		xe_ggtt_clear(ggtt, node->base.start, node->base.size);
+  	drm_mm_remove_node(&node->base);
+  	node->base.size = 0;
++ 	if (bound && node->invalidate_on_remove)
++ 		xe_ggtt_invalidate(ggtt);
+  	mutex_unlock(&ggtt->lock);
+
+++<<<<<<< HEAD
+ +	if (!bound)
+ +		goto free_node;
+ +
+ +	if (node->invalidate_on_remove)
+ +		xe_ggtt_invalidate(ggtt);
+ +
+ +	drm_dev_exit(idx);
+ +
+ +free_node:
+ +	xe_ggtt_node_fini(node);
+++=======
++ 	ggtt_node_fini(node);
+++>>>>>>> 225d02cb46d0 (drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove)
+  }
+
+  static void ggtt_node_remove_work_func(struct work_struct *work)
+* Unmerged path drivers/gpu/drm/xe/xe_ggtt.c