public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/kernel] f43: kernel-7.1.4-102
@ 2026-07-21 15:22 Justin M. Forbes
0 siblings, 0 replies; only message in thread
From: Justin M. Forbes @ 2026-07-21 15:22 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/kernel
Branch : f43
Commit : a926b083b28f94d5bb34490bdc1894ac872da360
Author : Justin M. Forbes <jforbes@fedoraproject.org>
Date : 2026-07-21T09:21:59-06:00
Stats : +269/-8 in 6 file(s)
URL : https://src.fedoraproject.org/rpms/kernel/c/a926b083b28f94d5bb34490bdc1894ac872da360?branch=f43
Log:
kernel-7.1.4-102
* Tue Jul 21 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-2]
- Revert "PCI/MSI: Unmap MSI-X region on error" (Yuanhe Shu)
- Revert "btrfs: fix the file offset calculation inside btrfs_decompress_buf2page()" (Matthew Wilcox (Oracle))
- drm/amdkfd: always resume_all after suspend_all (Alex Deucher)
- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Hyunwoo Kim)
- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (Venkatesh Srinivas)
- KVM: x86/mmu: Fix use-after-free on vendor module reload (Phil Rosenthal)
- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (Hyunwoo Kim)
- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson)
Resolves:
Signed-off-by: Justin M. Forbes <jforbes@fedoraproject.org>
---
diff --git a/Makefile.rhelver b/Makefile.rhelver
index e810b89..38f7de3 100644
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 99
#
# Use this spot to avoid future merge conflicts.
# Do not trim this comment.
-RHEL_RELEASE = 1
+RHEL_RELEASE = 2
#
# RHEL_REBASE_NUM
diff --git a/Patchlist.changelog b/Patchlist.changelog
index 5acabaf..457252e 100644
--- a/Patchlist.changelog
+++ b/Patchlist.changelog
@@ -1,3 +1,27 @@
+https://gitlab.com/cki-project/kernel-ark/-/commit/038190229a7c4ce9fd78a0ece5998a483e917b10
+ 038190229a7c4ce9fd78a0ece5998a483e917b10 Revert "PCI/MSI: Unmap MSI-X region on error"
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/c4b8fa261b601be3efe517f7e3556f2bfd033bfa
+ c4b8fa261b601be3efe517f7e3556f2bfd033bfa Revert "btrfs: fix the file offset calculation inside btrfs_decompress_buf2page()"
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/6ad64fbb803d084eda1f7b830040b74917abc494
+ 6ad64fbb803d084eda1f7b830040b74917abc494 drm/amdkfd: always resume_all after suspend_all
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/1cbc8746210f2e89a1eacd96824cba825c38fe9d
+ 1cbc8746210f2e89a1eacd96824cba825c38fe9d KVM: nVMX: Hide shadow VMCS right after VMCLEAR
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/d9fce3c9c9d63614ee75b5f754776c37b791906d
+ d9fce3c9c9d63614ee75b5f754776c37b791906d KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/5756e32f73944676e04836e6bbece6f93a39f0a0
+ 5756e32f73944676e04836e6bbece6f93a39f0a0 KVM: x86/mmu: Fix use-after-free on vendor module reload
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/57dc31ebbe44ece86899db083cdca9149312d50b
+ 57dc31ebbe44ece86899db083cdca9149312d50b KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots
+
+https://gitlab.com/cki-project/kernel-ark/-/commit/6f9d82f308cc06fdeb6cb1ca5d1ff162797f695f
+ 6f9d82f308cc06fdeb6cb1ca5d1ff162797f695f KVM: x86: Check for invalid/obsolete root *after* making MMU pages available
+
https://gitlab.com/cki-project/kernel-ark/-/commit/398377259f01c70d2cdb14c206967ccf200ed6bd
398377259f01c70d2cdb14c206967ccf200ed6bd can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF
diff --git a/kernel.changelog b/kernel.changelog
index 5f1b89b..1b182f2 100644
--- a/kernel.changelog
+++ b/kernel.changelog
@@ -1,3 +1,14 @@
+* Tue Jul 21 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-2]
+- Revert "PCI/MSI: Unmap MSI-X region on error" (Yuanhe Shu)
+- Revert "btrfs: fix the file offset calculation inside btrfs_decompress_buf2page()" (Matthew Wilcox (Oracle))
+- drm/amdkfd: always resume_all after suspend_all (Alex Deucher)
+- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Hyunwoo Kim)
+- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (Venkatesh Srinivas)
+- KVM: x86/mmu: Fix use-after-free on vendor module reload (Phil Rosenthal)
+- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (Hyunwoo Kim)
+- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson)
+Resolves:
+
* Mon Jul 20 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-1]
- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Lee Jones)
Resolves:
diff --git a/kernel.spec b/kernel.spec
index 45ac61c..34de1e3 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -190,13 +190,13 @@ Summary: The Linux kernel
%define specrpmversion 7.1.4
%define specversion 7.1.4
%define patchversion 7.1
-%define pkgrelease 101
+%define pkgrelease 102
%define kversion 7
%define tarfile_release 7.1.4
# This is needed to do merge window version magic
%define patchlevel 1
# This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 101%{?buildid}%{?dist}
+%define specrelease 102%{?buildid}%{?dist}
# This defines the kabi tarball version
%define kabiversion 7.1.4
@@ -4857,6 +4857,16 @@ fi\
#
#
%changelog
+* Tue Jul 21 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-2]
+- Revert "PCI/MSI: Unmap MSI-X region on error" (Yuanhe Shu)
+- Revert "btrfs: fix the file offset calculation inside btrfs_decompress_buf2page()" (Matthew Wilcox (Oracle))
+- drm/amdkfd: always resume_all after suspend_all (Alex Deucher)
+- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Hyunwoo Kim)
+- KVM: x86: Only reset TSC Deadline Timer in apic_timer_expired on KVM_RUN (Venkatesh Srinivas)
+- KVM: x86/mmu: Fix use-after-free on vendor module reload (Phil Rosenthal)
+- KVM: x86/mmu: Preserve nested TDP shadow page tables if they are used as roots (Hyunwoo Kim)
+- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Sean Christopherson)
+
* Mon Jul 20 2026 Justin M. Forbes <jforbes@fedoraproject.org> [7.1.4-1]
- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Lee Jones)
diff --git a/patch-7.1-redhat.patch b/patch-7.1-redhat.patch
index 5d12133..5904c84 100644
--- a/patch-7.1-redhat.patch
+++ b/patch-7.1-redhat.patch
@@ -7,7 +7,10 @@
arch/s390/kernel/ipl.c | 5 +
arch/s390/kernel/setup.c | 4 +
arch/x86/kernel/setup.c | 22 +-
- arch/x86/kvm/vmx/nested.c | 2 +
+ arch/x86/kvm/lapic.c | 2 +-
+ arch/x86/kvm/mmu/mmu.c | 12 +-
+ arch/x86/kvm/mmu/paging_tmpl.h | 10 +-
+ arch/x86/kvm/vmx/nested.c | 13 +-
crypto/akcipher.c | 3 +-
crypto/dh.c | 25 +
crypto/drbg.c | 18 +-
@@ -27,6 +30,7 @@
drivers/firmware/efi/libstub/fdt.c | 5 +
drivers/firmware/efi/libstub/secureboot.c | 14 +-
drivers/firmware/efi/secureboot.c | 38 +
+ .../gpu/drm/amd/amdkfd/kfd_device_queue_manager.c | 20 +-
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 12 +
drivers/gpu/drm/amd/pm/swsmu/inc/amdgpu_smu.h | 11 +
.../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_0_ppt.c | 45 +
@@ -37,9 +41,11 @@
drivers/media/i2c/Makefile | 1 +
drivers/media/i2c/imx471.c | 957 +++++++++++++++++++++
drivers/media/pci/intel/ipu-bridge.c | 41 +
+ drivers/pci/msi/msi.c | 4 +-
drivers/pci/quirks.c | 24 +
drivers/platform/x86/intel/int3472/discrete.c | 18 +
drivers/usb/core/hub.c | 7 +
+ fs/btrfs/compression.c | 18 +-
include/linux/crypto.h | 3 +
include/linux/efi.h | 22 +-
include/linux/lsm_hook_defs.h | 1 +
@@ -57,7 +63,7 @@
tools/testing/selftests/bpf/DENYLIST.rhel | 76 ++
tools/testing/selftests/bpf/Makefile | 2 +-
tools/testing/selftests/bpf/prog_tests/ksyms_btf.c | 31 -
- 59 files changed, 2068 insertions(+), 145 deletions(-)
+ 65 files changed, 2100 insertions(+), 190 deletions(-)
diff --git a/MAINTAINERS b/MAINTAINERS
index f74da642290a..06c8bb2075e6 100644
@@ -306,11 +312,120 @@ index 46882ce79c3a..9c73814c31e0 100644
reserve_initrd();
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 92a1e69c5962..1cb243df0bc0 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -2052,7 +2052,7 @@ static void apic_timer_expired(struct kvm_lapic *apic, bool from_timer_fn)
+ if (apic_lvtt_tscdeadline(apic) || ktimer->hv_timer_in_use)
+ ktimer->expired_tscdeadline = ktimer->tscdeadline;
+
+- if (!from_timer_fn && apic->apicv_active) {
++ if (!from_timer_fn && apic->apicv_active && vcpu->wants_to_run) {
+ WARN_ON(kvm_get_running_vcpu() != vcpu);
+ kvm_apic_inject_pending_timer_irqs(apic);
+ return;
+diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c
+index 0c2e35e3ffbd..dc4fda3b9769 100644
+--- a/arch/x86/kvm/mmu/mmu.c
++++ b/arch/x86/kvm/mmu/mmu.c
+@@ -2635,6 +2635,7 @@ static int mmu_page_zap_pte(struct kvm *kvm, struct kvm_mmu_page *sp,
+ */
+ if (tdp_enabled && invalid_list &&
+ child->role.guest_mode &&
++ !child->root_count &&
+ !atomic_long_read(&child->parent_ptes.val))
+ return kvm_mmu_prepare_zap_page(kvm, child,
+ invalid_list);
+@@ -4837,16 +4838,17 @@ static int direct_page_fault(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
+ if (r != RET_PF_CONTINUE)
+ return r;
+
+- r = RET_PF_RETRY;
+ write_lock(&vcpu->kvm->mmu_lock);
+
+- if (is_page_fault_stale(vcpu, fault))
+- goto out_unlock;
+-
+ r = make_mmu_pages_available(vcpu);
+ if (r)
+ goto out_unlock;
+
++ if (is_page_fault_stale(vcpu, fault)) {
++ r = RET_PF_RETRY;
++ goto out_unlock;
++ }
++
+ r = direct_map(vcpu, fault);
+
+ out_unlock:
+@@ -7501,7 +7503,9 @@ void kvm_mmu_invalidate_mmio_sptes(struct kvm *kvm, u64 gen)
+ static void mmu_destroy_caches(void)
+ {
+ kmem_cache_destroy(pte_list_desc_cache);
++ pte_list_desc_cache = NULL;
+ kmem_cache_destroy(mmu_page_header_cache);
++ mmu_page_header_cache = NULL;
+ }
+
+ static void kvm_wake_nx_recovery_thread(struct kvm *kvm)
+diff --git a/arch/x86/kvm/mmu/paging_tmpl.h b/arch/x86/kvm/mmu/paging_tmpl.h
+index 901cd2bd40b8..6465de820e70 100644
+--- a/arch/x86/kvm/mmu/paging_tmpl.h
++++ b/arch/x86/kvm/mmu/paging_tmpl.h
+@@ -827,15 +827,17 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, struct kvm_page_fault *fault
+ }
+ #endif
+
+- r = RET_PF_RETRY;
+ write_lock(&vcpu->kvm->mmu_lock);
+
+- if (is_page_fault_stale(vcpu, fault))
+- goto out_unlock;
+-
+ r = make_mmu_pages_available(vcpu);
+ if (r)
+ goto out_unlock;
++
++ if (is_page_fault_stale(vcpu, fault)) {
++ r = RET_PF_RETRY;
++ goto out_unlock;
++ }
++
+ r = FNAME(fetch)(vcpu, fault, &walker);
+
+ out_unlock:
diff --git a/arch/x86/kvm/vmx/nested.c b/arch/x86/kvm/vmx/nested.c
-index 3fe88f29be7a..f6fd3775ddac 100644
+index 3fe88f29be7a..2a50f8fab45d 100644
--- a/arch/x86/kvm/vmx/nested.c
+++ b/arch/x86/kvm/vmx/nested.c
-@@ -3755,6 +3755,8 @@ enum nvmx_vmentry_status nested_vmx_enter_non_root_mode(struct kvm_vcpu *vcpu,
+@@ -336,6 +336,7 @@ static void nested_put_vmcs12_pages(struct kvm_vcpu *vcpu)
+ static void free_nested(struct kvm_vcpu *vcpu)
+ {
+ struct vcpu_vmx *vmx = to_vmx(vcpu);
++ struct vmcs *shadow_vmcs;
+
+ if (WARN_ON_ONCE(vmx->loaded_vmcs != &vmx->vmcs01))
+ vmx_switch_vmcs(vcpu, &vmx->vmcs01);
+@@ -353,9 +354,15 @@ static void free_nested(struct kvm_vcpu *vcpu)
+ vmx->nested.current_vmptr = INVALID_GPA;
+ if (enable_shadow_vmcs) {
+ vmx_disable_shadow_vmcs(vmx);
+- vmcs_clear(vmx->vmcs01.shadow_vmcs);
+- free_vmcs(vmx->vmcs01.shadow_vmcs);
++
++ /*
++ * Keep the pointer visible until after VMCLEAR, so migration
++ * can clear an active shadow VMCS on the old CPU.
++ */
++ shadow_vmcs = vmx->vmcs01.shadow_vmcs;
++ vmcs_clear(shadow_vmcs);
+ vmx->vmcs01.shadow_vmcs = NULL;
++ free_vmcs(shadow_vmcs);
+ }
+ kfree(vmx->nested.cached_vmcs12);
+ vmx->nested.cached_vmcs12 = NULL;
+@@ -3755,6 +3762,8 @@ enum nvmx_vmentry_status nested_vmx_enter_non_root_mode(struct kvm_vcpu *vcpu,
if (!from_vmentry)
return NVMX_VMENTRY_VMEXIT;
@@ -1373,6 +1488,49 @@ index 000000000000..de0a3714a5d4
+ }
+ }
+}
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+index 31187ddbb79e..ee413117b0ff 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_device_queue_manager.c
+@@ -3095,32 +3095,24 @@ int kfd_dqm_suspend_bad_queue_mes(struct kfd_node *knode, u32 pasid, u32 doorbel
+
+ list_for_each_entry(q, &qpd->queues_list, list) {
+ if (q->doorbell_id == doorbell_id && q->properties.is_active) {
+- ret = suspend_all_queues_mes(dqm);
+- if (ret) {
+- dev_err(dev, "Suspending all queues failed");
+- goto out;
+- }
++ /* suspend all queues will save any good queues and mark the rest as bad */
++ suspend_all_queues_mes(dqm);
+
+ q->properties.is_evicted = true;
+ q->properties.is_active = false;
+ decrement_queue_count(dqm, qpd, q);
+
++ /* this will remove the bad queue and sched a GPU reset if needed */
+ ret = remove_queue_mes(dqm, q, qpd);
+- if (ret) {
+- dev_err(dev, "Removing bad queue failed");
+- goto out;
+- }
+-
+- ret = resume_all_queues_mes(dqm);
+ if (ret)
+- dev_err(dev, "Resuming all queues failed");
+-
++ dev_err(dev, "Removing bad queue failed");
++ /* resume the good queues */
++ resume_all_queues_mes(dqm);
+ break;
+ }
+ }
+ }
+
+-out:
+ dqm_unlock(dqm);
+ kfd_unref_process(p);
+ return ret;
diff --git a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
index 8faf7de7aaa9..f65bb1dc44ac 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -2677,6 +2835,28 @@ index fc6608e33de4..8cfa3282bf08 100644
{} /* Terminating entry */
};
+diff --git a/drivers/pci/msi/msi.c b/drivers/pci/msi/msi.c
+index 81d24a270a79..a3e0daff0988 100644
+--- a/drivers/pci/msi/msi.c
++++ b/drivers/pci/msi/msi.c
+@@ -749,7 +749,7 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+
+ ret = msix_setup_interrupts(dev, entries, nvec, affd);
+ if (ret)
+- goto out_unmap;
++ goto out_disable;
+
+ /* Disable INTX */
+ pci_intx_for_msi(dev, 0);
+@@ -770,8 +770,6 @@ static int msix_capability_init(struct pci_dev *dev, struct msix_entry *entries,
+ pcibios_free_irq(dev);
+ return 0;
+
+-out_unmap:
+- iounmap(dev->msix_base);
+ out_disable:
+ dev->msix_enabled = 0;
+ pci_msix_clear_and_set_ctrl(dev, PCI_MSIX_FLAGS_MASKALL | PCI_MSIX_FLAGS_ENABLE, 0);
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index dd0025d3914e..e57d10dc843c 100644
--- a/drivers/pci/quirks.c
@@ -2759,6 +2939,42 @@ index 24960ba9caa9..32597cdb72ef 100644
/* Lock the device, then check to see if we were
* disconnected while waiting for the lock to succeed. */
usb_lock_device(hdev);
+diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
+index a02b62e0a8f3..2ceb5661e071 100644
+--- a/fs/btrfs/compression.c
++++ b/fs/btrfs/compression.c
+@@ -1191,22 +1191,6 @@ void __cold btrfs_exit_compress(void)
+ bioset_exit(&btrfs_compressed_bioset);
+ }
+
+-/*
+- * The bvec is a single page bvec from a bio that contains folios from a filemap.
+- *
+- * Since the folio may be a large one, and if the bv_page is not a head page of
+- * a large folio, then page->index is unreliable.
+- *
+- * Thus we need this helper to grab the proper file offset.
+- */
+-static u64 file_offset_from_bvec(const struct bio_vec *bvec)
+-{
+- const struct page *page = bvec->bv_page;
+- const struct folio *folio = page_folio(page);
+-
+- return (page_pgoff(folio, page) << PAGE_SHIFT) + bvec->bv_offset;
+-}
+-
+ /*
+ * Copy decompressed data from working buffer to pages.
+ *
+@@ -1259,7 +1243,7 @@ int btrfs_decompress_buf2page(const char *buf, u32 buf_len,
+ * cb->start may underflow, but subtracting that value can still
+ * give us correct offset inside the full decompressed extent.
+ */
+- bvec_offset = file_offset_from_bvec(&bvec) - cb->start;
++ bvec_offset = page_offset(bvec.bv_page) + bvec.bv_offset - cb->start;
+
+ /* Haven't reached the bvec range, exit */
+ if (decompressed + buf_len <= bvec_offset)
diff --git a/include/linux/crypto.h b/include/linux/crypto.h
index a2137e19be7d..df268ca70170 100644
--- a/include/linux/crypto.h
diff --git a/sources b/sources
index e91a915..b43ff40 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
SHA512 (linux-7.1.4.tar.xz) = 164f7c0353dfcf1eaacf886530273271d473314a9f99d9441a63bfc24368c8d2f194552bd4800dd440bf824598cbd74263b1b544dc61307517b8208acf9b4a7a
-SHA512 (kernel-abi-stablelists-7.1.4.tar.xz) = 3aad661ee210bb15e56c20341c0888bfbaa99724746d5227a3714d66bbcf1d979699f495152ed5e6f59a279f20c2440f24af1feca89c13e427c3935b3fbedaf2
+SHA512 (kernel-abi-stablelists-7.1.4.tar.xz) = 61a4a24555341e7633341ef9ab55439cf715fe6f901928b4daa86a725dd567ff840563c1de46d832f3ad710864810b7be76c9c6923cae3d2f486ebb7eb5304d3
SHA512 (kernel-kabi-dw-7.1.4.tar.xz) = bf880002eb61ae0c19a5692db25c281152d08404e60023770660fe3bbbd57055ae1a7a0ec770e57a871bd3d8a531d401951743b95731cb93ff26a0623f9bd217
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-21 15:22 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-21 15:22 [rpms/kernel] f43: kernel-7.1.4-102 Justin M. Forbes
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox