ctrliq · PlaidCat · Feb 13, 2026 · Feb 12, 2026 · Feb 12, 2026 · Feb 12, 2026
diff --git a/COPYING-6.12.0-124.31.1.el10_1 → COPYING-6.12.0-124.35.1.el10_1 b/COPYING-6.12.0-124.31.1.el10_1 → COPYING-6.12.0-124.35.1.el10_1
diff --git a/Documentation/networking/bonding.rst b/Documentation/networking/bonding.rst
@@ -562,6 +562,12 @@ lacp_rate
 
 	The default is slow.
 
+broadcast_neighbor
+
+	Option specifying whether to broadcast ARP/ND packets to all
+	active slaves.  This option has no effect in modes other than
+	802.3ad mode.  The default is off (0).
+
 max_bonds
 
 	Specifies the number of bonding devices to create for this

diff --git a/Makefile.rhelver b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 1
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 124.31.1
+RHEL_RELEASE = 124.35.1
 
 #
 # RHEL_REBASE_NUM

diff --git a/ciq/ciq_backports/kernel-6.12.0-124.35.1.el10_1/41b70df5.failed b/ciq/ciq_backports/kernel-6.12.0-124.35.1.el10_1/41b70df5.failed
@@ -0,0 +1,56 @@
+io_uring/net: commit partial buffers on retry
+
+jira KERNEL-602
+cve CVE-2025-38730
+Rebuild_History Non-Buildable kernel-6.12.0-124.35.1.el10_1
+commit-author Jens Axboe <axboe@kernel.dk>
+commit 41b70df5b38bc80967d2e0ed55cc3c3896bba781
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-6.12.0-124.35.1.el10_1/41b70df5.failed
+
+Ring provided buffers are potentially only valid within the single
+execution context in which they were acquired. io_uring deals with this
+and invalidates them on retry. But on the networking side, if
+MSG_WAITALL is set, or if the socket is of the streaming type and too
+little was processed, then it will hang on to the buffer rather than
+recycle or commit it. This is problematic for two reasons:
+
+1) If someone unregisters the provided buffer ring before a later retry,
+   then the req->buf_list will no longer be valid.
+
+2) If multiple sockers are using the same buffer group, then multiple
+   receives can consume the same memory. This can cause data corruption
+   in the application, as either receive could land in the same
+   userspace buffer.
+
+Fix this by disallowing partial retries from pinning a provided buffer
+across multiple executions, if ring provided buffers are used.
+
+	Cc: stable@vger.kernel.org
+	Reported-by: pt x <superman.xpt@gmail.com>
+Fixes: c56e022c0a27 ("io_uring: add support for user mapped provided buffer ring")
+	Signed-off-by: Jens Axboe <axboe@kernel.dk>
+(cherry picked from commit 41b70df5b38bc80967d2e0ed55cc3c3896bba781)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	io_uring/net.c
+diff --cc io_uring/net.c
+index 18507658a921,d69f2afa4f7a..000000000000
+--- a/io_uring/net.c
++++ b/io_uring/net.c
+@@@ -1037,8 -1078,7 +1044,12 @@@ retry_multishot
+  		}
+  		if (ret > 0 && io_net_retry(sock, flags)) {
+  			sr->done_io += ret;
+++<<<<<<< HEAD
+ +			req->flags |= REQ_F_BL_NO_RECYCLE;
+ +			return -EAGAIN;
+++=======
++ 			return io_net_kbuf_recyle(req, kmsg, ret);
+++>>>>>>> 41b70df5b38b (io_uring/net: commit partial buffers on retry)
+  		}
+  		if (ret == -ERESTARTSYS)
+  			ret = -EINTR;
+* Unmerged path io_uring/net.c
diff --git a/ciq/ciq_backports/kernel-6.12.0-124.35.1.el10_1/f57e53ea.failed b/ciq/ciq_backports/kernel-6.12.0-124.35.1.el10_1/f57e53ea.failed
@@ -0,0 +1,113 @@
+smb: client: let recv_done verify data_offset, data_length and remaining_data_length
+
+jira KERNEL-602
+cve CVE-2025-39933
+Rebuild_History Non-Buildable kernel-6.12.0-124.35.1.el10_1
+commit-author Stefan Metzmacher <metze@samba.org>
+commit f57e53ea252363234f86674db475839e5b87102e
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-6.12.0-124.35.1.el10_1/f57e53ea.failed
+
+This is inspired by the related server fixes.
+
+	Cc: Tom Talpey <tom@talpey.com>
+	Cc: Long Li <longli@microsoft.com>
+	Cc: linux-cifs@vger.kernel.org
+	Cc: samba-technical@lists.samba.org
+	Reviewed-by: Namjae Jeon <linkinjeon@kernel.org>
+Fixes: f198186aa9bb ("CIFS: SMBD: Establish SMB Direct connection")
+	Signed-off-by: Stefan Metzmacher <metze@samba.org>
+	Signed-off-by: Steve French <stfrench@microsoft.com>
+(cherry picked from commit f57e53ea252363234f86674db475839e5b87102e)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	fs/smb/client/smbdirect.c
+diff --cc fs/smb/client/smbdirect.c
+index 754e94a0e07f,dafa3ed4a630..000000000000
+--- a/fs/smb/client/smbdirect.c
++++ b/fs/smb/client/smbdirect.c
+@@@ -454,13 -450,18 +454,25 @@@ static void smbd_post_send_credits(stru
+  static void recv_done(struct ib_cq *cq, struct ib_wc *wc)
+  {
+  	struct smbdirect_data_transfer *data_transfer;
+++<<<<<<< HEAD
+ +	struct smbd_response *response =
+ +		container_of(wc->wr_cqe, struct smbd_response, cqe);
+ +	struct smbd_connection *info = response->info;
+ +	int data_length = 0;
+++=======
++ 	struct smbdirect_recv_io *response =
++ 		container_of(wc->wr_cqe, struct smbdirect_recv_io, cqe);
++ 	struct smbdirect_socket *sc = response->socket;
++ 	struct smbdirect_socket_parameters *sp = &sc->parameters;
++ 	struct smbd_connection *info =
++ 		container_of(sc, struct smbd_connection, socket);
++ 	u32 data_offset = 0;
++ 	u32 data_length = 0;
++ 	u32 remaining_data_length = 0;
+++>>>>>>> f57e53ea2523 (smb: client: let recv_done verify data_offset, data_length and remaining_data_length)
+
+  	log_rdma_recv(INFO, "response=0x%p type=%d wc status=%d wc opcode %d byte_len=%d pkey_index=%u\n",
+ -		      response, sc->recv_io.expected, wc->status, wc->opcode,
+ +		      response, response->type, wc->status, wc->opcode,
+  		      wc->byte_len, wc->pkey_index);
+
+  	if (wc->status != IB_WC_SUCCESS || wc->opcode != IB_WC_RECV) {
+@@@ -476,27 -476,39 +488,47 @@@
+  		response->sge.length,
+  		DMA_FROM_DEVICE);
+
+ -	switch (sc->recv_io.expected) {
+ +	switch (response->type) {
+  	/* SMBD negotiation response */
+ -	case SMBDIRECT_EXPECT_NEGOTIATE_REP:
+ -		dump_smbdirect_negotiate_resp(smbdirect_recv_io_payload(response));
+ -		sc->recv_io.reassembly.full_packet_received = true;
+ +	case SMBD_NEGOTIATE_RESP:
+ +		dump_smbdirect_negotiate_resp(smbd_response_payload(response));
+ +		info->full_packet_received = true;
+  		info->negotiate_done =
+  			process_negotiation_response(response, wc->byte_len);
+ -		put_receive_buffer(info, response);
+  		complete(&info->negotiate_completion);
+ -		return;
+ +		break;
+
+  	/* SMBD data transfer packet */
+++<<<<<<< HEAD
+ +	case SMBD_TRANSFER_DATA:
+ +		data_transfer = smbd_response_payload(response);
+++=======
++ 	case SMBDIRECT_EXPECT_DATA_TRANSFER:
++ 		data_transfer = smbdirect_recv_io_payload(response);
++ 
++ 		if (wc->byte_len <
++ 		    offsetof(struct smbdirect_data_transfer, padding))
++ 			goto error;
++ 
++ 		remaining_data_length = le32_to_cpu(data_transfer->remaining_data_length);
++ 		data_offset = le32_to_cpu(data_transfer->data_offset);
+++>>>>>>> f57e53ea2523 (smb: client: let recv_done verify data_offset, data_length and remaining_data_length)
+  		data_length = le32_to_cpu(data_transfer->data_length);
++ 		if (wc->byte_len < data_offset ||
++ 		    (u64)wc->byte_len < (u64)data_offset + data_length)
++ 			goto error;
++ 
++ 		if (remaining_data_length > sp->max_fragmented_recv_size ||
++ 		    data_length > sp->max_fragmented_recv_size ||
++ 		    (u64)remaining_data_length + (u64)data_length > (u64)sp->max_fragmented_recv_size)
++ 			goto error;
+
+ +		/*
+ +		 * If this is a packet with data playload place the data in
+ +		 * reassembly queue and wake up the reading thread
+ +		 */
+  		if (data_length) {
+ -			if (sc->recv_io.reassembly.full_packet_received)
+ +			if (info->full_packet_received)
+  				response->first_segment = true;
+
+  			if (le32_to_cpu(data_transfer->remaining_data_length))
+* Unmerged path fs/smb/client/smbdirect.c
diff --git a/ciq/ciq_backports/kernel-6.12.0-124.35.1.el10_1/rebuild.details.txt b/ciq/ciq_backports/kernel-6.12.0-124.35.1.el10_1/rebuild.details.txt
@@ -0,0 +1,23 @@
+Rebuild_History BUILDABLE
+Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
+Number of commits in upstream range v6.12~1..kernel-mainline: 93416
+Number of commits in rpm: 20
+Number of commits matched with upstream: 15 (75.00%)
+Number of commits in upstream but not in rpm: 93401
+Number of commits NOT found in upstream: 5 (25.00%)
+
+Rebuilding Kernel on Branch rocky10_1_rebuild_kernel-6.12.0-124.35.1.el10_1 for kernel-6.12.0-124.35.1.el10_1
+Clean Cherry Picks: 13 (86.67%)
+Empty Cherry Picks: 2 (13.33%)
+_______________________________
+
+__EMPTY COMMITS__________________________
+f57e53ea252363234f86674db475839e5b87102e smb: client: let recv_done verify data_offset, data_length and remaining_data_length
+41b70df5b38bc80967d2e0ed55cc3c3896bba781 io_uring/net: commit partial buffers on retry
+
+__CHANGES NOT IN UPSTREAM________________
+Add partial riscv64 support for build root'
+Provide basic VisionFive 2 support'
+Patch MMU for riscv64'
+ice: Fix kernel panic due to page refcount underflow
+ice: prevent NULL deref in ice_lag_move_new_vf_nodes()
diff --git a/configs/kernel-6.12.0-aarch64-64k-debug.config b/configs/kernel-6.12.0-aarch64-64k-debug.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-aarch64-64k.config b/configs/kernel-6.12.0-aarch64-64k.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-aarch64-debug.config b/configs/kernel-6.12.0-aarch64-debug.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-aarch64-rt-64k-debug.config b/configs/kernel-6.12.0-aarch64-rt-64k-debug.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-aarch64-rt-64k.config b/configs/kernel-6.12.0-aarch64-rt-64k.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-aarch64-rt-debug.config b/configs/kernel-6.12.0-aarch64-rt-debug.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-aarch64-rt.config b/configs/kernel-6.12.0-aarch64-rt.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-aarch64.config b/configs/kernel-6.12.0-aarch64.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-ppc64le-debug.config b/configs/kernel-6.12.0-ppc64le-debug.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-ppc64le.config b/configs/kernel-6.12.0-ppc64le.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-riscv64-debug.config b/configs/kernel-6.12.0-riscv64-debug.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-riscv64.config b/configs/kernel-6.12.0-riscv64.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-s390x-debug.config b/configs/kernel-6.12.0-s390x-debug.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-s390x-zfcpdump.config b/configs/kernel-6.12.0-s390x-zfcpdump.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-s390x.config b/configs/kernel-6.12.0-s390x.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y

diff --git a/configs/kernel-6.12.0-x86_64-debug.config b/configs/kernel-6.12.0-x86_64-debug.config
@@ -12,8 +12,8 @@ CONFIG_AS_VERSION=25000
 CONFIG_LD_IS_BFD=y
 CONFIG_LD_VERSION=25000
 CONFIG_LLD_VERSION=0
-CONFIG_RUSTC_VERSION=0
-CONFIG_RUSTC_LLVM_VERSION=0
+CONFIG_RUSTC_VERSION=107600
+CONFIG_RUSTC_LLVM_VERSION=170006
 CONFIG_CC_CAN_LINK=y
 CONFIG_CC_CAN_LINK_STATIC=y
 CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y