[rpms/kernel] f43: kernel-7.1.4-101

[rpms/kernel] f43: kernel-7.1.4-101

[Justin M. Forbes]

            A new commit has been pushed.

            Repo   : rpms/kernel
            Branch : f43
            Commit : ad4d679b7893654da1ad0878eaad7244227deceb
            Author : Justin M. Forbes <jforbes@fedoraproject.org>
            Date   : 2026-07-20T14:20:02-06:00
            Stats  : +136/-6 in 6 file(s)
            URL    : https://src.fedoraproject.org/rpms/kernel/c/ad4d679b7893654da1ad0878eaad7244227deceb?branch=f43

            Log:
            kernel-7.1.4-101

* Mon Jul 20 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-1]
- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Lee Jones)
Resolves:

Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>

---
diff --git a/Makefile.rhelver b/Makefile.rhelver
index 95b9fd7..e810b89 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 99
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 0
+RHEL_RELEASE = 1
 
 #
 # RHEL_REBASE_NUM

diff --git a/Patchlist.changelog b/Patchlist.changelog
index 1816ea2..5acabaf 100644
--- a/Patchlist.changelog
+++ b/Patchlist.changelog
@@ -1,3 +1,6 @@
+https://gitlab.com/cki-project/kernel-ark/-/commit/398377259f01c70d2cdb14c206967ccf200ed6bd
+ 398377259f01c70d2cdb14c206967ccf200ed6bd can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
+
 https://gitlab.com/cki-project/kernel-ark/-/commit/7b8efc5af560ec18096b99f3d8b1b6b6ef101ee5
  7b8efc5af560ec18096b99f3d8b1b6b6ef101ee5 KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state
 

diff --git a/kernel.changelog b/kernel.changelog
index fbfe3ca..5f1b89b 100644
--- a/kernel.changelog
+++ b/kernel.changelog
@@ -1,3 +1,7 @@
+* Mon Jul 20 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-1]
+- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Lee Jones)
+Resolves: 
+
 * Sat Jul 18 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-0]
 - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Sean Christopherson)
 - drm/amd: Create a device link between APU display and XHCI devices (Mario Limonciello)

diff --git a/kernel.spec b/kernel.spec
index 9ad86bc..45ac61c 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -190,13 +190,13 @@ Summary: The Linux kernel
 %define specrpmversion 7.1.4
 %define specversion 7.1.4
 %define patchversion 7.1
-%define pkgrelease 100
+%define pkgrelease 101
 %define kversion 7
 %define tarfile_release 7.1.4
 # This is needed to do merge window version magic
 %define patchlevel 1
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 100%{?buildid}%{?dist}
+%define specrelease 101%{?buildid}%{?dist}
 # This defines the kabi tarball version
 %define kabiversion 7.1.4
 
@@ -4857,6 +4857,9 @@ fi\
 #
 #
 %changelog
+* Mon Jul 20 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-1]
+- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Lee Jones)
+
 * Sat Jul 18 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-0]
 - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Sean Christopherson)
 - drm/amd: Create a device link between APU display and XHCI devices (Mario Limonciello)

diff --git a/patch-7.1-redhat.patch b/patch-7.1-redhat.patch
index f2db0e4..5d12133 100644
--- a/patch-7.1-redhat.patch
+++ b/patch-7.1-redhat.patch
@@ -46,6 +46,7 @@
  include/linux/random.h                             |  10 +
  include/linux/security.h                           |   9 +
  kernel/module/signing.c                            |   9 +-
+ net/can/bcm.c                                      |  37 +-
  scripts/Makefile.lib                               |   3 +
  scripts/tags.sh                                    |   2 +
  security/integrity/platform_certs/load_uefi.c      |   6 +-
@@ -56,7 +57,7 @@
  tools/testing/selftests/bpf/DENYLIST.rhel          |  76 ++
  tools/testing/selftests/bpf/Makefile               |   2 +-
  tools/testing/selftests/bpf/prog_tests/ksyms_btf.c |  31 -
- 58 files changed, 2034 insertions(+), 142 deletions(-)
+ 59 files changed, 2068 insertions(+), 145 deletions(-)
 
 diff --git a/MAINTAINERS b/MAINTAINERS
 index f74da642290a..06c8bb2075e6 100644
@@ -2921,6 +2922,125 @@ index 590ba29c85ab..02153d857531 100644
  }
  
  int module_sig_check(struct load_info *info, int flags)
+diff --git a/net/can/bcm.c b/net/can/bcm.c
+index a4bef2c48a55..bdf53241bd7b 100644
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -58,6 +58,7 @@
+ #include <linux/can/skb.h>
+ #include <linux/can/bcm.h>
+ #include <linux/slab.h>
++#include <linux/workqueue.h>
+ #include <linux/spinlock.h>
+ #include <net/can.h>
+ #include <net/sock.h>
+@@ -92,6 +93,8 @@ MODULE_ALIAS("can-proto-2");
+ 
+ #define BCM_MIN_NAMELEN CAN_REQUIRED_SIZE(struct sockaddr_can, can_ifindex)
+ 
++static struct workqueue_struct *bcm_wq;
++
+ /*
+  * easy access to the first 64 bit of can(fd)_frame payload. cp->data is
+  * 64 bit aligned so the offset has to be multiples of 8 which is ensured
+@@ -105,6 +108,7 @@ static inline u64 get_u64(const struct canfd_frame *cp, int offset)
+ struct bcm_op {
+ 	struct list_head list;
+ 	struct rcu_head rcu;
++	struct work_struct work;
+ 	int ifindex;
+ 	canid_t can_id;
+ 	u32 flags;
+@@ -793,9 +797,12 @@ static struct bcm_op *bcm_find_op(struct list_head *ops,
+ 	return NULL;
+ }
+ 
+-static void bcm_free_op_rcu(struct rcu_head *rcu_head)
++static void bcm_free_op_work(struct work_struct *work)
+ {
+-	struct bcm_op *op = container_of(rcu_head, struct bcm_op, rcu);
++	struct bcm_op *op = container_of(work, struct bcm_op, work);
++
++	hrtimer_cancel(&op->timer);
++	hrtimer_cancel(&op->thrtimer);
+ 
+ 	if ((op->frames) && (op->frames != &op->sframe))
+ 		kfree(op->frames);
+@@ -803,9 +810,23 @@ static void bcm_free_op_rcu(struct rcu_head *rcu_head)
+ 	if ((op->last_frames) && (op->last_frames != &op->last_sframe))
+ 		kfree(op->last_frames);
+ 
++	/* the last possible access to op->timer/op->thrtimer has now
++	 * happened above via hrtimer_cancel() - op->sk is no longer
++	 * needed by any pending timer callback, so drop our reference
++	 */
++	sock_put(op->sk);
++
+ 	kfree(op);
+ }
+ 
++static void bcm_free_op_rcu(struct rcu_head *rcu_head)
++{
++	struct bcm_op *op = container_of(rcu_head, struct bcm_op, rcu);
++
++	INIT_WORK(&op->work, bcm_free_op_work);
++	queue_work(bcm_wq, &op->work);
++}
++
+ static void bcm_remove_op(struct bcm_op *op)
+ {
+ 	hrtimer_cancel(&op->timer);
+@@ -1060,6 +1081,7 @@ static int bcm_tx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ 
+ 		/* bcm_can_tx / bcm_tx_timeout_handler needs this */
+ 		op->sk = sk;
++		sock_hold(sk);
+ 		op->ifindex = ifindex;
+ 
+ 		/* initialize uninitialized (kzalloc) structure */
+@@ -1221,6 +1243,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
+ 
+ 		/* bcm_can_tx / bcm_tx_timeout_handler needs this */
+ 		op->sk = sk;
++		sock_hold(sk);
+ 		op->ifindex = ifindex;
+ 
+ 		/* ifindex for timeout events w/o previous frame reception */
+@@ -1839,11 +1862,15 @@ static int __init bcm_module_init(void)
+ {
+ 	int err;
+ 
++	bcm_wq = alloc_workqueue("can-bcm-wq", WQ_UNBOUND, 0);
++	if (!bcm_wq)
++		return -ENOMEM;
++
+ 	pr_info("can: broadcast manager protocol\n");
+ 
+ 	err = register_pernet_subsys(&canbcm_pernet_ops);
+ 	if (err)
+-		return err;
++		goto register_pernet_failed;
+ 
+ 	err = register_netdevice_notifier(&canbcm_notifier);
+ 	if (err)
+@@ -1861,6 +1888,8 @@ static int __init bcm_module_init(void)
+ 	unregister_netdevice_notifier(&canbcm_notifier);
+ register_notifier_failed:
+ 	unregister_pernet_subsys(&canbcm_pernet_ops);
++register_pernet_failed:
++	destroy_workqueue(bcm_wq);
+ 	return err;
+ }
+ 
+@@ -1869,6 +1898,8 @@ static void __exit bcm_module_exit(void)
+ 	can_proto_unregister(&bcm_can_proto);
+ 	unregister_netdevice_notifier(&canbcm_notifier);
+ 	unregister_pernet_subsys(&canbcm_pernet_ops);
++	rcu_barrier();
++	destroy_workqueue(bcm_wq);
+ }
+ 
+ module_init(bcm_module_init);
 diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib
 index 0718e39cedda..10e94a1b8b6e 100644
 --- a/scripts/Makefile.lib

diff --git a/sources b/sources
index d4c04ac..e91a915 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
 SHA512 (linux-7.1.4.tar.xz) = 164f7c0353dfcf1eaacf886530273271d473314a9f99d9441a63bfc24368c8d2f194552bd4800dd440bf824598cbd74263b1b544dc61307517b8208acf9b4a7a
-SHA512 (kernel-abi-stablelists-7.1.4.tar.xz) = d2ed3ee6a6b8f1aae32eeeba1e22e599e92f0a653083ae27e26b373f932a1a2fb052fe1ae4f5a4ea2210e84527b489d5115764ef0f46f01ae901810ed1fcbaf3
-SHA512 (kernel-kabi-dw-7.1.4.tar.xz) = d8d89633a4474b1ad9522ab066c97907e217f72fde3290b3a02bbddadd79b5d82514ae1a6b0b1dccd770cd0717df0a45e9e6aaa4bc9f45aba1ee9be44d1e832b
+SHA512 (kernel-abi-stablelists-7.1.4.tar.xz) = 3aad661ee210bb15e56c20341c0888bfbaa99724746d5227a3714d66bbcf1d979699f495152ed5e6f59a279f20c2440f24af1feca89c13e427c3935b3fbedaf2
+SHA512 (kernel-kabi-dw-7.1.4.tar.xz) = bf880002eb61ae0c19a5692db25c281152d08404e60023770660fe3bbbd57055ae1a7a0ec770e57a871bd3d8a531d401951743b95731cb93ff26a0623f9bd217