diff --git a/packages/kernel-6.12/1009-nitro_enclaves-fix-use-after-free-on-SLOT_ALLOC-fail.patch b/packages/kernel-6.12/1009-nitro_enclaves-fix-use-after-free-on-SLOT_ALLOC-fail.patch deleted file mode 100644 index 41e5e4d2..00000000 --- a/packages/kernel-6.12/1009-nitro_enclaves-fix-use-after-free-on-SLOT_ALLOC-fail.patch +++ /dev/null @@ -1,56 +0,0 @@ -From: Yuxiao Wang -Date: Tue, 9 Sep 2026 12:44:00 +0000 -Subject: [PATCH] nitro_enclaves: fix use-after-free on SLOT_ALLOC failure - -When ne_create_vm_ioctl() fails the SLOT_ALLOC request after -anon_inode_getfile() has succeeded, the error path calls -fput(enclave_file) and then frees ne_enclave. - -In normal userspace context, fput() defers the final __fput() via -task_work. ne_enclave_release() therefore runs after ne_enclave has -already been freed and dereferences ne_enclave->slot_uid, causing a -use-after-free: KASAN: slab-use-after-free in ne_enclave_release. - -The enclave has no slot allocated and is not yet linked into the -enclaves list on this error path, so ne_enclave_release() is expected -to return early when slot_uid is zero. However, reading slot_uid -already accesses the freed object. - -Clear enclave_file->private_data before fput() on the error path. -ne_enclave_release() then returns immediately when private_data is -NULL, leaving the ioctl error path as the sole owner of ne_enclave. -This is safe because the file has not been fd_install()'d yet. - -Tested on an AWS EC2 m5.2xlarge with CONFIG_KASAN=y. Without the -patch, the reproducer triggers a KASAN slab-use-after-free on every -SLOT_ALLOC failure. With the patch, no KASAN report is produced and -the SLOT_ALLOC error is still returned. Normal enclave creation and -teardown are unaffected. - -Fixes: 9c8eb50fe9e2 ("nitro_enclaves: Add logic for terminating an enclave") -Cc: stable@vger.kernel.org -Co-developed-by: Zhaofeng Chen -Signed-off-by: Zhaofeng Chen -Signed-off-by: Yuxiao Wang -Reviewed-by: Alexander Graf -Link: https://lore.kernel.org/stable/20260909124400.27857-1-graf@amazon.com/T/#u -Signed-off-by: Maher Homsi ---- - drivers/virt/nitro_enclaves/ne_misc_dev.c | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/drivers/virt/nitro_enclaves/ne_misc_dev.c b/drivers/virt/nitro_enclaves/ne_misc_dev.c -index c91300a..0d7bdad 100644 ---- a/drivers/virt/nitro_enclaves/ne_misc_dev.c -+++ b/drivers/virt/nitro_enclaves/ne_misc_dev.c -@@ -1706,6 +1706,7 @@ static int ne_create_vm_ioctl(struct ne_pci_dev *ne_pci_dev, u64 __user *slot_ui - return enclave_fd; - - put_file: -+ enclave_file->private_data = NULL; - fput(enclave_file); - put_fd: - put_unused_fd(enclave_fd); --- -2.34.1 - diff --git a/packages/kernel-6.12/1011-xfs-initialise-args-total-for-parent-pointer-updates.patch b/packages/kernel-6.12/1011-xfs-initialise-args-total-for-parent-pointer-updates.patch deleted file mode 100644 index c93d3b54..00000000 --- a/packages/kernel-6.12/1011-xfs-initialise-args-total-for-parent-pointer-updates.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 9ad85bce62cadfdf4242f6e6bbff2a52e51d30f1 Mon Sep 17 00:00:00 2001 -From: Javier Tia -Date: Mon, 10 Aug 2026 17:06:17 -0600 -Subject: xfs: initialise args->total for parent pointer updates - -commit 8e4ebb6afaa34bd2e8ce52da231003d24111c2d6 upstream. - -xfs_parent_da_args_init() builds an xfs_da_args from a zeroed -xfs_parent_args (kmem_cache_zalloc), leaving args->total == 0. -xfs_da_grow_inode_int() treats that field as a running block reservation -and subtracts from it; because it is an xfs_extlen_t (uint32_t), the -first attr-fork growth wraps it to ~0U. That defeats the free-space -check in xfs_alloc_space_available(), and when it coincides with an AG -that has exactly zero available blocks the allocation is clamped to -maxlen 0 and returns -ENOSPC, which xfs_defer_finish_noroll() escalates -to a filesystem shutdown. - -Set args->total the way the log recovery path does -(xfs_attri_recover_work(), xfs_attr_item.c:706), in the add and replace -paths that can grow the fork. Removals and lookups never grow it, so -they leave the field alone, matching that switch. - -Fixes: b7c62d90c12c ("xfs: parent pointer attribute creation") -Cc: stable@vger.kernel.org # v6.10 -Signed-off-by: Javier Tia -Reviewed-by: Darrick J. Wong -Signed-off-by: Carlos Maiolino -[ Backported to 6.12.y and 6.18.y, whose fs/xfs/libxfs/xfs_parent.c are - byte-identical. These trees queue the operation with - xfs_attr_defer_add() instead of calling xfs_attr_setname() and - xfs_attr_replacename() directly, and spell the inode number - child->i_ino rather than I_INO(child), so the upstream hunks do not - apply as-is. The defect is unchanged: xfs_attr_defer_add() stores a - pointer to this same xfs_da_args, and xfs_attr_finish_item() resets - only args->trans, so the zeroed total still reaches - xfs_da_grow_inode_int(). The assignment therefore goes in the same - place, before the operation is queued. xfs_attr_calc_size() needs no - new include: it is declared in xfs_attr.h, which xfs_parent.c already - includes. ] -Signed-off-by: Javier Tia -Signed-off-by: Greg Kroah-Hartman -Signed-off-by: Craig Qian ---- - fs/xfs/libxfs/xfs_parent.c | 13 +++++++++++-- - 1 file changed, 11 insertions(+), 2 deletions(-) - -diff --git a/fs/xfs/libxfs/xfs_parent.c b/fs/xfs/libxfs/xfs_parent.c -index 69366c44a7015..f47dda640c0ef 100644 ---- a/fs/xfs/libxfs/xfs_parent.c -+++ b/fs/xfs/libxfs/xfs_parent.c -@@ -193,7 +193,7 @@ xfs_parent_addname( - const struct xfs_name *parent_name, - struct xfs_inode *child) - { -- int error; -+ int error, local; - - error = xfs_parent_iread_extents(tp, child); - if (error) -@@ -202,6 +202,11 @@ xfs_parent_addname( - xfs_inode_to_parent_rec(&ppargs->rec, dp); - xfs_parent_da_args_init(&ppargs->args, tp, &ppargs->rec, child, - child->i_ino, parent_name); -+ -+ /* Growing the attr fork needs a real reservation in args->total. */ -+ ppargs->args.total = xfs_attr_calc_size(&ppargs->args, &local); -+ ASSERT(local); -+ - xfs_attr_defer_add(&ppargs->args, XFS_ATTR_DEFER_SET); - return 0; - } -@@ -239,7 +244,7 @@ xfs_parent_replacename( - const struct xfs_name *new_name, - struct xfs_inode *child) - { -- int error; -+ int error, local; - - error = xfs_parent_iread_extents(tp, child); - if (error) -@@ -249,6 +254,10 @@ xfs_parent_replacename( - xfs_parent_da_args_init(&ppargs->args, tp, &ppargs->rec, child, - child->i_ino, old_name); - -+ /* Growing the attr fork needs a real reservation in args->total. */ -+ ppargs->args.total = xfs_attr_calc_size(&ppargs->args, &local); -+ ASSERT(local); -+ - xfs_inode_to_parent_rec(&ppargs->new_rec, new_dp); - ppargs->args.new_name = new_name->name; - ppargs->args.new_namelen = new_name->len; --- -cgit 1.3.1-korg - diff --git a/packages/kernel-6.12/1012-Revert-xarray-honor-XA_FLAGS_ACCOUNT-in-xas_split_a.patch b/packages/kernel-6.12/1012-Revert-xarray-honor-XA_FLAGS_ACCOUNT-in-xas_split_a.patch deleted file mode 100644 index df622973..00000000 --- a/packages/kernel-6.12/1012-Revert-xarray-honor-XA_FLAGS_ACCOUNT-in-xas_split_a.patch +++ /dev/null @@ -1,29 +0,0 @@ -From ad812805fea7108d9f8efc240e4810b513b46754 Mon Sep 17 00:00:00 2001 -From: Nathan Gao -Date: Mon, 5 Oct 2026 22:47:13 +0000 -Subject: [PATCH] Revert "xarray: honor XA_FLAGS_ACCOUNT in xas_split_alloc()" - -This reverts commit ad812805fea7108d9f8efc240e4810b513b46754. - -Signed-off-by: Nathan Gao -Signed-off-by: Shikha Vyaghra ---- - lib/xarray.c | 3 --- - 1 file changed, 3 deletions(-) - -diff --git a/lib/xarray.c b/lib/xarray.c ---- a/lib/xarray.c -+++ b/lib/xarray.c -@@ -1027,9 +1027,6 @@ void xas_split_alloc(struct xa_state *xas, void *entry, unsigned int order, - if (xas->xa_shift + XA_CHUNK_SHIFT > order) - return; - -- if (xas->xa->xa_flags & XA_FLAGS_ACCOUNT) -- gfp |= __GFP_ACCOUNT; -- - do { - unsigned int i; - void *sibling = NULL; --- -2.40.0 - diff --git a/packages/kernel-6.12/Cargo.toml b/packages/kernel-6.12/Cargo.toml index ad0e1b99..869f93be 100644 --- a/packages/kernel-6.12/Cargo.toml +++ b/packages/kernel-6.12/Cargo.toml @@ -13,8 +13,8 @@ path = "../packages.rs" [[package.metadata.build-package.external-files]] # Use latest-kernel-srpm-url.sh to get this. -url = "https://cdn.amazonlinux.com/al2023/blobstore/d0dc627f720e98b4afe1557287c2b445357e29b3d2abb600e3fb873af09f3924/kernel6.12-6.12.110-135.202.amzn2023.src.rpm" -sha512 = "6bcc12f5be6a8037c409818d251280fff308667e4e58f58648381b7c5ee7d4d34071c645965fe86559067cca8d635027d486d016c0e34c1505eb4f5464bbe0dd" +url = "https://cdn.amazonlinux.com/al2023/blobstore/72dd8b871c8d434ffb1975a45d3ed31bdec2db818fbf644a190926bad06f6ae8/kernel6.12-6.12.111-136.204.amzn2023.src.rpm" +sha512 = "b1ef2dd83c51e71f034676297b709cc6b1de53acc8f237057b59515f38608fbf93fa35e688ecc7bdaafd873916e6372b70a23a64ea59e7d97077ac23a3933e62" force-upstream = true [[package.metadata.build-package.external-files]] diff --git a/packages/kernel-6.12/config-full-bottlerocket-aarch64 b/packages/kernel-6.12/config-full-bottlerocket-aarch64 index adf7d9e3..9943b382 100644 --- a/packages/kernel-6.12/config-full-bottlerocket-aarch64 +++ b/packages/kernel-6.12/config-full-bottlerocket-aarch64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 6.12.110 Kernel Configuration +# Linux/arm64 6.12.111 Kernel Configuration # CONFIG_CC_VERSION_TEXT="aarch64-bottlerocket-linux-gnu-gcc (Buildroot 2025.05.1) 13.4.0" CONFIG_CC_IS_GCC=y diff --git a/packages/kernel-6.12/config-full-bottlerocket-x86_64 b/packages/kernel-6.12/config-full-bottlerocket-x86_64 index f8740730..a810b890 100644 --- a/packages/kernel-6.12/config-full-bottlerocket-x86_64 +++ b/packages/kernel-6.12/config-full-bottlerocket-x86_64 @@ -1,6 +1,6 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/x86 6.12.110 Kernel Configuration +# Linux/x86 6.12.111 Kernel Configuration # CONFIG_CC_VERSION_TEXT="x86_64-bottlerocket-linux-gnu-gcc (Buildroot 2025.05.1) 13.4.0" CONFIG_CC_IS_GCC=y diff --git a/packages/kernel-6.12/kernel-6.12.spec b/packages/kernel-6.12/kernel-6.12.spec index 7c4486c7..bc05f71e 100644 --- a/packages/kernel-6.12/kernel-6.12.spec +++ b/packages/kernel-6.12/kernel-6.12.spec @@ -6,13 +6,13 @@ %global neuron_inf1_ver 2.24.13 Name: %{_cross_os}kernel-%{kmajor} -Version: 6.12.110 +Version: 6.12.111 Release: 1%{?dist} Summary: The Linux kernel License: GPL-2.0 WITH Linux-syscall-note URL: https://www.kernel.org/ # Use latest-kernel-srpm-url.sh to get this. -Source0: https://cdn.amazonlinux.com/al2023/blobstore/d0dc627f720e98b4afe1557287c2b445357e29b3d2abb600e3fb873af09f3924/kernel6.12-6.12.110-135.202.amzn2023.src.rpm +Source0: https://cdn.amazonlinux.com/al2023/blobstore/72dd8b871c8d434ffb1975a45d3ed31bdec2db818fbf644a190926bad06f6ae8/kernel6.12-6.12.111-136.204.amzn2023.src.rpm Source1: gpgkey-B21C50FA44A99720EAA72F7FE951904AD832C631.asc # Custom Bottlerocket kernel configurations. @@ -75,14 +75,8 @@ Patch1006: 1006-Select-prerequisites-for-gpu-drivers.patch # Backport patch to ensure NUL-terminated task->comm buffer Patch1007: 1007-strscpy-write-destination-buffer-only-once.patch Patch1008: 1008-Revert-selinux-fix-overlayfs-mmap-and-mprotect-acces.patch -# Fix use-after-free in the Nitro Enclaves enclave-creation error path -Patch1009: 1009-nitro_enclaves-fix-use-after-free-on-SLOT_ALLOC-fail.patch # Backport patch to disable LZ4 rolling decompression on EROFS Patch1010: 1010-erofs-disable-LZ4-rolling-decompression-for-now.patch -# Reserve blocks for XFS parent pointer updates to avoid a filesystem shutdown -Patch1011: 1011-xfs-initialise-args-total-for-parent-pointer-updates.patch -# Revert accounting change that triggers a NULL-deref panic during memcg reclaim of split xarray nodes. -Patch1012: 1012-Revert-xarray-honor-XA_FLAGS_ACCOUNT-in-xas_split_a.patch BuildRequires: bc BuildRequires: elfutils-devel