diff --git a/SPECS/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch b/SPECS/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch index dafa0d351f..1e323e8eba 100644 --- a/SPECS/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch +++ b/SPECS/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch @@ -290,8 +290,8 @@ index bfde0f28c..a631b4905 100644 const unsigned int digest_size = req->dst_len; int err; -- if (WARN_ON(req->dst) || WARN_ON(!digest_size) || -+ if (fcw_warn_on(req->dst) || fcw_warn_on(!digest_size) || +- if (WARN_ON(req->dst) || !digest_size || ++ if (fcw_warn_on(req->dst) || !digest_size || !ctx->key_size || sig_size != ctx->key_size) return -EINVAL; diff --git a/SPECS/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch b/SPECS/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch index 7ab805cffc..12032503ba 100644 --- a/SPECS/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch +++ b/SPECS/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch @@ -86,7 +86,7 @@ index 9cac0a06b..d9b6d7d1d 100644 const unsigned int digest_size = req->dst_len; int err; - if (fcw_warn_on(req->dst) || fcw_warn_on(!digest_size) || + if (fcw_warn_on(req->dst) || !digest_size || - !ctx->key_size || sig_size != ctx->key_size) + !ctx->key_size || sig_size != ctx->key_size || + pkcs1pad_invalid_hash_len(digest_size, digest_info)) diff --git a/SPECS/linux/canister_config.inc b/SPECS/linux/canister_config.inc new file mode 100644 index 0000000000..6ba748b128 --- /dev/null +++ b/SPECS/linux/canister_config.inc @@ -0,0 +1,34 @@ +%dnl Shared canister/.config manipulation for the Photon kernel flavours. +%dnl +%dnl Included by both SPECS/linux/linux.spec and SPECS/linux/linux-esx.spec so +%dnl that the FIPS canister Kconfig handling cannot diverge between the two +%dnl flavours again. Historically linux.spec had no fips=0 branch at all, so on +%dnl aarch64 (fips=0) the canister "is not set" comments were left in .config; +%dnl "make olddefconfig" silently drops symbols that do not exist in the tree +%dnl and the check_for_config_applicability.inc diff guard then failed. +%dnl +%dnl Expects, from the including spec: +%dnl fips 1 => build a FIPS kernel carrying the crypto canister +%dnl canister_build 1 => the canister is built from source in this build +%dnl canister_usage 1 => link against a prebuilt canister object file +%dnl (derived: !canister_build when fips=1, else 0) +%dnl +%dnl Expects .config to be in place already (cp of the flavour config Source). +%dnl +%dnl The GCC_PLUGIN_MATCH_CANISTER_STRUCTS / GCC_PLUGIN_PAD_CANISTER_STRUCTS +%dnl Kconfig symbols only exist once the fips canister plugin patches have been +%dnl applied, i.e. only when fips=1. +%if 0%{?canister_build} +sed -i "s/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS=y/" .config +sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config +%endif + +%if 0%{?canister_usage} +sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config +%endif + +%if 0%{?fips} == 0 +# Clean up .config of FIPS related configs +sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config +sed -i "/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/d" .config +%endif diff --git a/SPECS/linux/linux-esx.spec b/SPECS/linux/linux-esx.spec index dc7298388a..4e0d2de5a8 100644 --- a/SPECS/linux/linux-esx.spec +++ b/SPECS/linux/linux-esx.spec @@ -26,10 +26,21 @@ %global fips 0 %endif +# The esx flavour never builds the canister itself, it always links against the +# prebuilt canister object file. Mirror linux.spec's derived flag model so the +# shared canister_config.inc behaves identically for both flavours. +%if 0%{?fips} +%global canister_build 0 +%global canister_usage 1 +%else +%global canister_build 0 +%global canister_usage 0 +%endif + Summary: Kernel Name: linux-esx Version: 6.12.109 -Release: 1%{?dist} +Release: 2%{?dist} URL: http://www.kernel.org Group: System Environment/Kernel Vendor: VMware, Inc. @@ -44,6 +55,8 @@ Source2: initramfs.trigger # contains pre, postun, filetriggerun tasks Source3: scriptlets.inc Source4: check_for_config_applicability.inc +# shared canister/.config handling, also included by linux.spec +Source5: canister_config.inc Source19: spec_install_post.inc @@ -436,20 +449,15 @@ tar -xvf /usr/lib/fips-canister/fips-canister-%{fips_canister_version}.tar.bz2 # corresponding .cmd file. Empty content is ok, since we are not going # to rebuild it. touch crypto/.fips_canister.o.cmd - -sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config %else -# Clean up .config of FIPS related configs -sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config -sed -i "/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/d" .config - sed -i "s/# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2 is not set/CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_32=y/# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_32 is not set/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=128/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=256/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32/" .config %endif - +%dnl canister/.config handling, shared with linux.spec +%include %{SOURCE5} %ifarch x86_64 sed -e "s,@@NAME@@,%{name},g" \ -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" \ @@ -568,6 +576,11 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %{_usrsrc}/linux-headers-%{uname_r} %changelog +* Fri Sep 11 2026 Daniel Casota 6.12.109-2 +- Move canister/.config handling into shared canister_config.inc (Source5), + included by both linux.spec and linux-esx.spec so the two flavours cannot + diverge again. Behaviour-preserving here: this spec already handled fips=0 + correctly in its else branch, and that logic is what the include adopts. * Fri Sep 11 2026 Ajay Kaher 6.12.109-1 - Update to version 6.12.109 * Fri Sep 11 2026 Ajay Kaher 6.12.107-11 diff --git a/SPECS/linux/linux.spec b/SPECS/linux/linux.spec index 5f33f496f3..edfc353e19 100644 --- a/SPECS/linux/linux.spec +++ b/SPECS/linux/linux.spec @@ -80,7 +80,7 @@ Summary: Kernel Name: linux Version: 6.12.109 -Release: 1%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} +Release: 3%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} URL: http://www.kernel.org/ Group: System Environment/Kernel Vendor: VMware, Inc. @@ -99,6 +99,8 @@ Source3: https://github.com/amzn/amzn-drivers/archive/refs/tags/ena_linux %define efa_version 3.1.0 Source4: https://github.com/amzn/amzn-drivers/archive/refs/tags/efa_linux_%{efa_version}.tar.gz +# shared canister/.config handling, also included by linux-esx.spec +Source5: canister_config.inc # contains pre, postun, filetriggerun tasks Source6: scriptlets.inc Source7: check_for_config_applicability.inc @@ -702,14 +704,7 @@ sed -i 's/CONFIG_LD_VERSION=23900/CONFIG_LD_VERSION=24601/' .config sed -i 's/CONFIG_GCC_ASM_GOTO_OUTPUT_BROKEN=y/CONFIG_CC_HAS_ASM_GOTO_OUTPUT=y\nCONFIG_CC_HAS_ASM_GOTO_TIED_OUTPUT=y/' .config %endif -%if 0%{?canister_build} -sed -i "s/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS=y/" .config -sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config -%endif - -%if 0%{?canister_usage} -sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config -%endif +%include %{SOURCE5} %ifarch x86_64 sed -e "s,@@NAME@@,%{name},g" \ @@ -992,6 +987,22 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %endif %changelog +* Fri Sep 11 2026 Daniel Casota 6.12.109-3 +- Rebase canister-creation patches 1004 and 1010 onto the 6.12 series. Upstream + dropped the WARN_ON() wrapper around !digest_size in pkcs1pad_verify(), and + that single line is context for both patches, so %prep failed at --fuzz=0 + with "1 out of 2 hunks FAILED -- crypto/rsa-pkcs1pad.c.rej". canister_build + could not build against the shipping kernel. In 1004 the conversion is not + cosmetic: WARN_ON emits a __bug_table entry and that patch exists to keep + __bug_table out of the canister. +* Fri Sep 11 2026 Daniel Casota 6.12.109-2 +- Move canister/.config handling into shared canister_config.inc (Source5), + included by both linux.spec and linux-esx.spec so the two flavours cannot + diverge again. This also fixes the fips=0 path here: linux.spec had two + independent canister_build/canister_usage blocks and no else branch, so on + aarch64 nothing stripped the GCC_PLUGIN_{MATCH,PAD}_CANISTER_STRUCTS + comments before olddefconfig and the check_for_config_applicability.inc + diff guard failed prep. linux-esx.spec had always handled this correctly. * Fri Sep 11 2026 Ajay Kaher 6.12.109-1 - Update to version 6.12.109 * Fri Sep 11 2026 Ajay Kaher 6.12.107-11