Skip to content

[rocky9_8] History Rebuild through kernel-5.14.0-687.33.1.el9_8 - #1499

Open
PlaidCat wants to merge 3 commits into
rocky9_8from
rocky9_8_rebuild
Open

[rocky9_8] History Rebuild through kernel-5.14.0-687.33.1.el9_8#1499
PlaidCat wants to merge 3 commits into
rocky9_8from
rocky9_8_rebuild

Conversation

@PlaidCat

@PlaidCat PlaidCat commented Aug 1, 2026 •
edited by atlassian Bot
Loading

Copy link
Copy Markdown
Collaborator

This is an automated kernel history rebuild using cron and internal tooling. It follows the same process used for previous history rebuilds:

  • Download all unprocessed src.rpm packages
  • For each src.rpm:
    • Identify all commits in the changelog up to the last known tag (5.14.0-687)
    • Replay commits in chronological order (oldest to newest in the changelog) using git cherry-pick
    • Replace the code in the branch with the output of rpmbuild -bp for the corresponding src.rpm
    • Tag the rebuild branch

JIRA Tickets

Rebuild Splat Inspection

kernel-5.14.0-687.33.1.el9_8

$ cat ciq/ciq_backports/kernel-5.14.0-687.33.1.el9_8/rebuild.details.txt
Rebuild_History BUILDABLE
Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
Number of commits in upstream range v5.14~1..kernel-mainline: 394115
Number of commits in rpm: 6
Number of commits matched with upstream: 2 (33.33%)
Number of commits in upstream but not in rpm: 394113
Number of commits NOT found in upstream: 4 (66.67%)

Rebuilding Kernel on Branch rocky9_8_rebuild_kernel-5.14.0-687.33.1.el9_8 for kernel-5.14.0-687.33.1.el9_8
Clean Cherry Picks: 2 (100.00%)
Empty Cherry Picks: 0 (0.00%)
_______________________________

__EMPTY COMMITS__________________________

__CHANGES NOT IN UPSTREAM________________
Replace sbat with Rocky Linux sbat
Change bug tracker URL
Ensure appended release in sbat is removed'
net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle

BUILD

$ grep -E -B 5 -A 5 "\[TIMER\]|^Starting Build" $(ls -t kbuild* | head -n1)
/mnt/code/kernel-src-tree-build
Running make mrproper...
  CLEAN   scripts/basic
  CLEAN   scripts/kconfig
  CLEAN   include/config include/generated
[TIMER]{MRPROPER}: 5s
x86_64 architecture detected, copying config
'configs/kernel-x86_64-rhel.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-rocky9_8_rebuild-b186dfd3b15c"
Making olddefconfig
--
  HOSTCC  scripts/kconfig/util.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
Starting Build
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_32.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_64.h
  SYSHDR  arch/x86/include/generated/uapi/asm/unistd_x32.h
  SYSTBL  arch/x86/include/generated/asm/syscalls_32.h
  SYSHDR  arch/x86/include/generated/asm/unistd_32_ia32.h
--
  LD [M]  sound/x86/snd-hdmi-lpe-audio.ko
  LD [M]  sound/xen/snd_xen_front.ko
  BTF [M] sound/virtio/virtio_snd.ko
  BTF [M] sound/x86/snd-hdmi-lpe-audio.ko
  BTF [M] sound/xen/snd_xen_front.ko
[TIMER]{BUILD}: 1592s
Making Modules
  INSTALL /lib/modules/5.14.0-rocky9_8_rebuild-b186dfd3b15c/kernel/arch/x86/crypto/blake2s-x86_64.ko
  INSTALL /lib/modules/5.14.0-rocky9_8_rebuild-b186dfd3b15c/kernel/arch/x86/crypto/blowfish-x86_64.ko
  INSTALL /lib/modules/5.14.0-rocky9_8_rebuild-b186dfd3b15c/kernel/arch/x86/crypto/camellia-aesni-avx-x86_64.ko
  INSTALL /lib/modules/5.14.0-rocky9_8_rebuild-b186dfd3b15c/kernel/arch/x86/crypto/camellia-aesni-avx2.ko
--
  SIGN    /lib/modules/5.14.0-rocky9_8_rebuild-b186dfd3b15c/kernel/sound/virtio/virtio_snd.ko
  SIGN    /lib/modules/5.14.0-rocky9_8_rebuild-b186dfd3b15c/kernel/sound/xen/snd_xen_front.ko
  STRIP   /lib/modules/5.14.0-rocky9_8_rebuild-b186dfd3b15c/kernel/sound/usb/snd-usb-audio.ko
  SIGN    /lib/modules/5.14.0-rocky9_8_rebuild-b186dfd3b15c/kernel/sound/usb/snd-usb-audio.ko
  DEPMOD  /lib/modules/5.14.0-rocky9_8_rebuild-b186dfd3b15c
[TIMER]{MODULES}: 11s
Making Install
sh ./arch/x86/boot/install.sh 5.14.0-rocky9_8_rebuild-b186dfd3b15c \
	arch/x86/boot/bzImage System.map "/boot"
[TIMER]{INSTALL}: 23s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-5.14.0-rocky9_8_rebuild-b186dfd3b15c and Index to 0
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 5s
[TIMER]{BUILD}: 1592s
[TIMER]{MODULES}: 11s
[TIMER]{INSTALL}: 23s
[TIMER]{TOTAL} 1636s
Rebooting in 10 seconds

KSelfTests

$ get_kselftest_diff.sh
kselftest.5.14.0-rocky9_8_rebuild-921aa25079a5.log
311
kselftest.5.14.0-rocky9_8_rebuild-f673b620c033.log
311
kselftest.5.14.0-rocky9_8_rebuild-47aa54c0c001.log
311
kselftest.5.14.0-rocky9_8_rebuild-b186dfd3b15c.log
311
Before: kselftest.5.14.0-rocky9_8_rebuild-47aa54c0c001.log
After: kselftest.5.14.0-rocky9_8_rebuild-b186dfd3b15c.log
Diff:
No differences found.

PlaidCat added 3 commits August 1, 2026 00:16
@PlaidCat
tipc: fix double-free in tipc_buf_append()
44ad116 
jira KERNEL-1411
cve CVE-2026-52993
Rebuild_History Non-Buildable kernel-5.14.0-687.33.1.el9_8
commit-author Lee Jones <lee@kernel.org>
commit d293ca7

tipc_msg_validate() can potentially reallocate the skb it is validating,
freeing the old one.  In tipc_buf_append(), it was being called with a
pointer to a local variable which was a copy of the caller's skb
pointer.

If the skb was reallocated and validation subsequently failed, the error
handling path would free the original skb pointer, which had already
been freed, leading to double-free.

Fix this by checking if head now points to a newly allocated reassembled
skb.  If it does, reassign *headbuf for later freeing operations.

Fixes: d618d09 ("tipc: enforce valid ratio between skb truesize and contents")
	Suggested-by: Tung Nguyen <tung.quang.nguyen@est.tech>
	Signed-off-by: Lee Jones <lee@kernel.org>
	Reviewed-by: Tung Nguyen <tung.quang.nguyen@est.tech>
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit d293ca7)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@PlaidCat
ipc: limit next_id allocation to the valid ID range
a8c4b39 
jira KERNEL-1411
cve CVE-2026-52923
Rebuild_History Non-Buildable kernel-5.14.0-687.33.1.el9_8
commit-author Linpu Yu <linpu5433@gmail.com>
commit fa0b9b2

The checkpoint/restore sysctl path can request the next SysV IPC id
through ids->next_id.  ipc_idr_alloc() currently forwards that request to
idr_alloc() with an open-ended upper bound.

If the valid tail of the SysV IPC id space is full, the allocation can
spill beyond ipc_mni.  The returned SysV IPC id still uses the normal
index encoding, so later lookup and removal can target the wrong slot.
This leaves the real IDR entry behind and breaks the IDR state for the
object.

The bug is in ipc_idr_alloc() in the checkpoint/restore path.

1. ids->next_id is passed to:

       idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...)

2. The zero upper bound makes the allocation effectively open-ended.
   Once the valid SysV IPC tail is occupied, idr_alloc() can spill past
   ipc_mni and allocate an entry beyond the valid IPC id range.

3. The new object id is still encoded with the narrower SysV IPC index
   width:

       new->id = (new->seq << ipcmni_seq_shift()) + idx

4. Later removal goes through ipc_rmid(), which uses:

       ipcid_to_idx(ipcp->id)

   That truncates the real IDR index. An object actually stored at a
   high index can then be removed as if it lived at a low in-range
   index.

5. For shared memory, shm_destroy() frees the current object anyway, but
   the real high IDR slot is left behind as a dangling pointer.

6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry
   and dereferences freed memory.

Prevent this by bounding the requested allocation to ipc_mni so the
checkpoint/restore path fails once the valid range is exhausted.

Link: https://lore.kernel.org/cover.1778336914.git.linpu5433@gmail.com
Link: https://lore.kernel.org/2eebe949bfa7d1f6e13b5be6a92c64c850ce9d45.1778336914.git.linpu5433@gmail.com
Fixes: 03f5956 ("ipc: add sysctl to specify desired next object id")
	Signed-off-by: Linpu Yu <linpu5433@gmail.com>
	Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
	Reported-by: Yuan Tan <yuantan098@gmail.com>
	Reported-by: Yifan Wu <yifanwucs@gmail.com>
	Reported-by: Juefei Pu <tomapufckgml@gmail.com>
	Reported-by: Xin Liu <bird@lzu.edu.cn>
	Cc: Kees Cook <kees@kernel.org>
	Cc: Stanislav Kinsbursky <skinsbursky@parallels.com>
	Cc: Davidlohr Bueso <dave@stgolabs.net>
	Cc: <stable@vger.kernel.org>
	Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit fa0b9b2)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@PlaidCat
Rebuild rocky9_8 with kernel-5.14.0-687.33.1.el9_8
b186dfd 
Rebuild_History BUILDABLE
Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
Number of commits in upstream range v5.14~1..kernel-mainline: 394115
Number of commits in rpm: 6
Number of commits matched with upstream: 2 (33.33%)
Number of commits in upstream but not in rpm: 394113
Number of commits NOT found in upstream: 4 (66.67%)

Rebuilding Kernel on Branch rocky9_8_rebuild_kernel-5.14.0-687.33.1.el9_8 for kernel-5.14.0-687.33.1.el9_8
Clean Cherry Picks: 2 (100.00%)
Empty Cherry Picks: 0 (0.00%)
_______________________________

Full Details Located here:
ciq/ciq_backports/kernel-5.14.0-687.33.1.el9_8/rebuild.details.txt

Includes:
* git commit header above
* Empty Commits with upstream SHA
* RPM ChangeLog Entries that could not be matched

Individual Empty Commit failures contained in the same containing directory.
The git message for empty commits will have the path for the failed commit.
File names are the first 8 characters of the upstream SHA
@PlaidCat PlaidCat self-assigned this Aug 1, 2026
@PlaidCat
PlaidCat requested review from a team August 1, 2026 05:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@PlaidCat PlaidCat

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@PlaidCat