[rocky10_0] History Rebuild to kernel-6.12.0-55.32.1.el10_0

Makefile.rhelver

@@ -12,7 +12,7 @@ RHEL_MINOR = 0
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 55.30.1
+RHEL_RELEASE = 55.32.1
 
 #
 # RHEL_REBASE_NUM

ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/00817f0f.failed

@@ -0,0 +1,53 @@
+nvme-ioctl: fix leaked requests on mapping error
+
+jira LE-4192
+Rebuild_History Non-Buildable kernel-6.12.0-55.31.1.el10_0
+commit-author Keith Busch <kbusch@kernel.org>
+commit 00817f0f1c45b007965f5676b9a2013bb39c7228
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/00817f0f.failed
+
+All the callers assume nvme_map_user_request() frees the request on a
+failure. This wasn't happening on invalid metadata or io_uring command
+flags, so we've been leaking those requests.
+
+Fixes: 23fd22e55b767b ("nvme: wire up fixed buffer support for nvme passthrough")
+Fixes: 7c2fd76048e95d ("nvme: fix metadata handling in nvme-passthrough")
+	Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
+	Reviewed-by: Kanchan Joshi <joshi.k@samsung.com>
+	Reviewed-by: Christoph Hellwig <hch@lst.de>
+	Signed-off-by: Keith Busch <kbusch@kernel.org>
+(cherry picked from commit 00817f0f1c45b007965f5676b9a2013bb39c7228)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	drivers/nvme/host/ioctl.c
+diff --cc drivers/nvme/host/ioctl.c
+index a96976b22fa7,24e2c702da7a..000000000000
+--- a/drivers/nvme/host/ioctl.c
++++ b/drivers/nvme/host/ioctl.c
+@@@ -124,8 -125,17 +124,22 @@@ static int nvme_map_user_request(struc
+  	struct bio *bio = NULL;
+  	int ret;
+
+++<<<<<<< HEAD
+ +	if (has_metadata && !supports_metadata)
+ +		return -EINVAL;
+++=======
++ 	if (!nvme_ctrl_sgl_supported(ctrl))
++ 		dev_warn_once(ctrl->device, "using unchecked data buffer\n");
++ 	if (has_metadata) {
++ 		if (!supports_metadata) {
++ 			ret = -EINVAL;
++ 			goto out;
++ 		}
++ 		if (!nvme_ctrl_meta_sgl_supported(ctrl))
++ 			dev_warn_once(ctrl->device,
++ 				      "using unchecked metadata buffer\n");
++ 	}
+++>>>>>>> 00817f0f1c45 (nvme-ioctl: fix leaked requests on mapping error)
+
+  	if (ioucmd && (ioucmd->flags & IORING_URING_CMD_FIXED)) {
+  		struct iov_iter iter;
+* Unmerged path drivers/nvme/host/ioctl.c

ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/021ba7f1.failed

@@ -0,0 +1,57 @@
+udmabuf: fix a buf size overflow issue during udmabuf creation
+
+jira LE-4192
+cve CVE-2025-37803
+Rebuild_History Non-Buildable kernel-6.12.0-55.31.1.el10_0
+commit-author Xiaogang Chen <xiaogang.chen@amd.com>
+commit 021ba7f1babd029e714d13a6bf2571b08af96d0f
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/021ba7f1.failed
+
+by casting size_limit_mb to u64  when calculate pglimit.
+
+	Signed-off-by: Xiaogang Chen<Xiaogang.Chen@amd.com>
+Link: https://patchwork.freedesktop.org/patch/msgid/20250321164126.329638-1-xiaogang.chen@amd.com
+	Signed-off-by: Christian König <christian.koenig@amd.com>
+(cherry picked from commit 021ba7f1babd029e714d13a6bf2571b08af96d0f)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	drivers/dma-buf/udmabuf.c
+diff --cc drivers/dma-buf/udmabuf.c
+index 5e836e4e5b44,e74e36a8ecda..000000000000
+--- a/drivers/dma-buf/udmabuf.c
++++ b/drivers/dma-buf/udmabuf.c
+@@@ -358,17 -393,21 +358,21 @@@ static long udmabuf_create(struct miscd
+  	if (!ubuf)
+  		return -ENOMEM;
+
+++<<<<<<< HEAD
+ +	INIT_LIST_HEAD(&ubuf->unpin_list);
+ +	pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
+++=======
++ 	pglimit = ((u64)size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
+++>>>>>>> 021ba7f1babd (udmabuf: fix a buf size overflow issue during udmabuf creation)
+  	for (i = 0; i < head->count; i++) {
+ -		pgoff_t subpgcnt;
+ -
+  		if (!PAGE_ALIGNED(list[i].offset))
+ -			goto err_noinit;
+ +			goto err;
+  		if (!PAGE_ALIGNED(list[i].size))
+ -			goto err_noinit;
+ +			goto err;
+
+ -		subpgcnt = list[i].size >> PAGE_SHIFT;
+ -		pgcnt += subpgcnt;
+ +		pgcnt += list[i].size >> PAGE_SHIFT;
+  		if (pgcnt > pglimit)
+ -			goto err_noinit;
+ -
+ -		max_nr_folios = max_t(unsigned long, subpgcnt, max_nr_folios);
+ +			goto err;
+  	}
+
+  	if (!pgcnt)
+* Unmerged path drivers/dma-buf/udmabuf.c

ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/eada7546.failed

@@ -0,0 +1,50 @@
+nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer
+
+jira LE-4192
+Rebuild_History Non-Buildable kernel-6.12.0-55.31.1.el10_0
+commit-author Caleb Sander Mateos <csander@purestorage.com>
+commit eada75467fca0b016b9b22212637c07216135c20
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/eada7546.failed
+
+The vectorized io_uring NVMe passthru opcodes don't yet support fixed
+buffers. But since userspace can trigger this condition based on the
+io_uring SQE parameters, it shouldn't cause a kernel warning.
+
+	Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
+	Reviewed-by: Jens Axboe <axboe@kernel.dk>
+	Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
+	Reviewed-by: Christoph Hellwig <hch@lst.de>
+Fixes: 23fd22e55b76 ("nvme: wire up fixed buffer support for nvme passthrough")
+	Signed-off-by: Keith Busch <kbusch@kernel.org>
+(cherry picked from commit eada75467fca0b016b9b22212637c07216135c20)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	drivers/nvme/host/ioctl.c
+diff --cc drivers/nvme/host/ioctl.c
+index a96976b22fa7,f81748096841..000000000000
+--- a/drivers/nvme/host/ioctl.c
++++ b/drivers/nvme/host/ioctl.c
+@@@ -131,10 -142,13 +131,17 @@@ static int nvme_map_user_request(struc
+  		struct iov_iter iter;
+
+  		/* fixedbufs is only for non-vectored io */
+++<<<<<<< HEAD
+ +		if (WARN_ON_ONCE(flags & NVME_IOCTL_VEC))
+ +			return -EINVAL;
+++=======
++ 		if (flags & NVME_IOCTL_VEC) {
++ 			ret = -EINVAL;
++ 			goto out;
++ 		}
+++>>>>>>> eada75467fca (nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer)
+  		ret = io_uring_cmd_import_fixed(ubuffer, bufflen,
+ -				rq_data_dir(req), &iter, ioucmd,
+ -				iou_issue_flags);
+ +				rq_data_dir(req), &iter, ioucmd);
+  		if (ret < 0)
+  			goto out;
+  		ret = blk_rq_map_user_iov(q, req, NULL, &iter, GFP_KERNEL);
+* Unmerged path drivers/nvme/host/ioctl.c

ciq/ciq_backports/kernel-6.12.0-55.31.1.el10_0/rebuild.details.txt

@@ -0,0 +1,23 @@
+Rebuild_History BUILDABLE
+Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
+Number of commits in upstream range v6.12~1..kernel-mainline: 66177
+Number of commits in rpm: 22
+Number of commits matched with upstream: 18 (81.82%)
+Number of commits in upstream but not in rpm: 66159
+Number of commits NOT found in upstream: 4 (18.18%)
+
+Rebuilding Kernel on Branch rocky10_0_rebuild_kernel-6.12.0-55.31.1.el10_0 for kernel-6.12.0-55.31.1.el10_0
+Clean Cherry Picks: 10 (55.56%)
+Empty Cherry Picks: 3 (16.67%)
+_______________________________
+
+__EMPTY COMMITS__________________________
+00817f0f1c45b007965f5676b9a2013bb39c7228 nvme-ioctl: fix leaked requests on mapping error
+eada75467fca0b016b9b22212637c07216135c20 nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer
+021ba7f1babd029e714d13a6bf2571b08af96d0f udmabuf: fix a buf size overflow issue during udmabuf creation
+
+__CHANGES NOT IN UPSTREAM________________
+Porting to Rocky Linux 10, debranding and Rocky Linux branding'
+Add partial riscv64 support for build root'
+Provide basic VisionFive 2 support'
+Revert "cxl/acpi: Fix load failures due to single window creation failure"

ciq/ciq_backports/kernel-6.12.0-55.32.1.el10_0/rebuild.details.txt

@@ -0,0 +1,19 @@
+Rebuild_History BUILDABLE
+Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
+Number of commits in upstream range v6.12~1..kernel-mainline: 66177
+Number of commits in rpm: 4
+Number of commits matched with upstream: 1 (25.00%)
+Number of commits in upstream but not in rpm: 66176
+Number of commits NOT found in upstream: 3 (75.00%)
+
+Rebuilding Kernel on Branch rocky10_0_rebuild_kernel-6.12.0-55.32.1.el10_0 for kernel-6.12.0-55.32.1.el10_0
+Clean Cherry Picks: 1 (100.00%)
+Empty Cherry Picks: 0 (0.00%)
+_______________________________
+
+__EMPTY COMMITS__________________________
+
+__CHANGES NOT IN UPSTREAM________________
+Porting to Rocky Linux 10, debranding and Rocky Linux branding'
+Add partial riscv64 support for build root'
+Provide basic VisionFive 2 support'

drivers/cxl/acpi.c

@@ -340,20 +340,24 @@ static int add_or_reset_cxl_resource(struct resource *parent, struct resource *r
 DEFINE_FREE(put_cxlrd, struct cxl_root_decoder *,
 	    if (!IS_ERR_OR_NULL(_T)) put_device(&_T->cxlsd.cxld.dev))
 DEFINE_FREE(del_cxl_resource, struct resource *, if (_T) del_cxl_resource(_T))
-static int __cxl_parse_cfmws(struct acpi_cedt_cfmws *cfmws,
-			     struct cxl_cfmws_context *ctx)
+static int cxl_parse_cfmws(union acpi_subtable_headers *header, void *arg,
+			   const unsigned long end)
 {
 	int target_map[CXL_DECODER_MAX_INTERLEAVE];
+	struct cxl_cfmws_context *ctx = arg;
 	struct cxl_port *root_port = ctx->root_port;
 	struct cxl_cxims_context cxims_ctx;
 	struct device *dev = ctx->dev;
+	struct acpi_cedt_cfmws *cfmws;
 	struct cxl_decoder *cxld;
 	unsigned int ways, i, ig;
 	int rc;
 
+	cfmws = (struct acpi_cedt_cfmws *) header;
+
 	rc = cxl_acpi_cfmws_verify(dev, cfmws);
 	if (rc)
-		return rc;
+		return 0;
 
 	rc = eiw_to_ways(cfmws->interleave_ways, &ways);
 	if (rc)
@@ -378,7 +382,7 @@ static int __cxl_parse_cfmws(struct acpi_cedt_cfmws *cfmws,
 		cxl_root_decoder_alloc(root_port, ways);
 
 	if (IS_ERR(cxlrd))
-		return PTR_ERR(cxlrd);
+		return 0;
 
 	cxld = &cxlrd->cxlsd.cxld;
 	cxld->flags = cfmws_to_decoder_flags(cfmws->restrictions);
@@ -421,29 +425,16 @@ static int __cxl_parse_cfmws(struct acpi_cedt_cfmws *cfmws,
 	rc = cxl_decoder_add(cxld, target_map);
 	if (rc)
 		return rc;
-	return cxl_root_decoder_autoremove(dev, no_free_ptr(cxlrd));
-}
-
-static int cxl_parse_cfmws(union acpi_subtable_headers *header, void *arg,
-			   const unsigned long end)
-{
-	struct acpi_cedt_cfmws *cfmws = (struct acpi_cedt_cfmws *)header;
-	struct cxl_cfmws_context *ctx = arg;
-	struct device *dev = ctx->dev;
-	int rc;
-
-	rc = __cxl_parse_cfmws(cfmws, ctx);
-	if (rc)
-		dev_err(dev,
-			"Failed to add decode range: [%#llx - %#llx] (%d)\n",
-			cfmws->base_hpa,
-			cfmws->base_hpa + cfmws->window_size - 1, rc);
-	else
-		dev_dbg(dev, "decode range: node: %d range [%#llx - %#llx]\n",
-			phys_to_target_node(cfmws->base_hpa), cfmws->base_hpa,
-			cfmws->base_hpa + cfmws->window_size - 1);
+	rc = cxl_root_decoder_autoremove(dev, no_free_ptr(cxlrd));
+	if (rc) {
+		dev_err(dev, "Failed to add decode range: %pr", res);
+		return rc;
+	}
+	dev_dbg(dev, "add: %s node: %d range [%#llx - %#llx]\n",
+		dev_name(&cxld->dev),
+		phys_to_target_node(cxld->hpa_range.start),
+		cxld->hpa_range.start, cxld->hpa_range.end);
 
-	/* never fail cxl_acpi load for a single window failure */
 	return 0;
 }
 

drivers/dma-buf/udmabuf.c

@@ -359,7 +359,7 @@ static long udmabuf_create(struct miscdevice *device,
 		return -ENOMEM;
 
 	INIT_LIST_HEAD(&ubuf->unpin_list);
-	pglimit = (size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
+	pglimit = ((u64)size_limit_mb * 1024 * 1024) >> PAGE_SHIFT;
 	for (i = 0; i < head->count; i++) {
 		if (!PAGE_ALIGNED(list[i].offset))
 			goto err;

drivers/gpu/drm/drm_framebuffer.c

@@ -860,11 +860,23 @@ void drm_framebuffer_free(struct kref *kref)
 int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
 			 const struct drm_framebuffer_funcs *funcs)
 {
+	unsigned int i;
 	int ret;
+	bool exists;
 
 	if (WARN_ON_ONCE(fb->dev != dev || !fb->format))
 		return -EINVAL;
 
+	for (i = 0; i < fb->format->num_planes; i++) {
+		if (drm_WARN_ON_ONCE(dev, fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i)))
+			fb->internal_flags &= ~DRM_FRAMEBUFFER_HAS_HANDLE_REF(i);
+		if (fb->obj[i]) {
+			exists = drm_gem_object_handle_get_if_exists_unlocked(fb->obj[i]);
+			if (exists)
+				fb->internal_flags |= DRM_FRAMEBUFFER_HAS_HANDLE_REF(i);
+		}
+	}
+
 	INIT_LIST_HEAD(&fb->filp_head);
 
 	fb->funcs = funcs;
@@ -873,15 +885,24 @@ int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
 	ret = __drm_mode_object_add(dev, &fb->base, DRM_MODE_OBJECT_FB,
 				    false, drm_framebuffer_free);
 	if (ret)
-		goto out;
+		goto err;
 
 	mutex_lock(&dev->mode_config.fb_lock);
 	dev->mode_config.num_fb++;
 	list_add(&fb->head, &dev->mode_config.fb_list);
 	mutex_unlock(&dev->mode_config.fb_lock);
 
 	drm_mode_object_register(dev, &fb->base);
-out:
+
+	return 0;
+
+err:
+	for (i = 0; i < fb->format->num_planes; i++) {
+		if (fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i)) {
+			drm_gem_object_handle_put_unlocked(fb->obj[i]);
+			fb->internal_flags &= ~DRM_FRAMEBUFFER_HAS_HANDLE_REF(i);
+		}
+	}
 	return ret;
 }
 EXPORT_SYMBOL(drm_framebuffer_init);
@@ -958,6 +979,12 @@ EXPORT_SYMBOL(drm_framebuffer_unregister_private);
 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
 {
 	struct drm_device *dev = fb->dev;
+	unsigned int i;
+
+	for (i = 0; i < fb->format->num_planes; i++) {
+		if (fb->internal_flags & DRM_FRAMEBUFFER_HAS_HANDLE_REF(i))
+			drm_gem_object_handle_put_unlocked(fb->obj[i]);
+	}
 
 	mutex_lock(&dev->mode_config.fb_lock);
 	list_del(&fb->head);