From a9e54a75eef20c18aca0325312fb63f1df79f044 Mon Sep 17 00:00:00 2001 From: Daniel Casota Date: Mon, 31 Aug 2026 11:55:05 +0200 Subject: [PATCH 1/2] linux, linux-esx: share the canister/.config logic via canister_config.inc linux.spec and linux-esx.spec implemented the same canister Kconfig handling in two different idioms, and they disagreed on one constellation. linux-esx.spec used %if 0%{?fips} / %else, and its %else branch cleaned the GCC_PLUGIN_{MATCH,PAD}_CANISTER_STRUCTS comments out of .config. linux.spec instead used two independent %if canister_build / %if canister_usage blocks with no %else, so when fips=0 nothing ran: the shipped .config kept the "is not set" comments, make olddefconfig dropped them, and the check_for_config_applicability.inc diff guard failed %prep. That is the generic aarch64 kernel - fips is set by %global inside %ifarch, so it is unconditionally 1 on x86_64 and cannot be overridden with -D, and acvp_build/kat_build force fips=1 even on aarch64. Move the three conditional blocks into SPECS/linux/canister_config.inc, pulled in by both specs as Source5 + %include, the same mechanism both already use for check_for_config_applicability.inc. Divergence between the two flavours is now impossible by construction. linux-esx.spec additionally gains the derived-flag block linux.spec already had (canister_build=0, canister_usage=fips), nested inside the existing %if fips so it does not shadow -D. esx never builds a canister - it untars a prebuilt one - so fips=1 implies canister_usage=1, reproducing the old branch exactly. Tested across 112 cells: 2 specs x {x86_64, aarch64} x subrelease {91, 92} x 14 flag combinations of fips / canister_build / canister_usage / acvp_build / kat_build. All x86_64 cells are byte-identical apart from the release string. The aarch64 fips=0 cells replace PR#14's broad sed with linux-esx's narrower pair; the two forms produce byte-identical output on all five shipped config files, because no config contains a CANISTER_STRUCTS=y form - only the "is not set" comment form. The esx aarch64 reordering is likewise a no-op: the canister and jitterentropy seds touch disjoint symbols. Change-Id: If4107c14d8f15752dff0c0f25c6b4dee504e3041 Signed-off-by: Daniel Casota --- SPECS/linux/canister_config.inc | 34 +++++++++++++++++++++++++++++++++ SPECS/linux/linux-esx.spec | 29 ++++++++++++++++++++-------- SPECS/linux/linux.spec | 21 +++++++++++--------- 3 files changed, 67 insertions(+), 17 deletions(-) create mode 100644 SPECS/linux/canister_config.inc diff --git a/SPECS/linux/canister_config.inc b/SPECS/linux/canister_config.inc new file mode 100644 index 0000000000..6ba748b128 --- /dev/null +++ b/SPECS/linux/canister_config.inc @@ -0,0 +1,34 @@ +%dnl Shared canister/.config manipulation for the Photon kernel flavours. +%dnl +%dnl Included by both SPECS/linux/linux.spec and SPECS/linux/linux-esx.spec so +%dnl that the FIPS canister Kconfig handling cannot diverge between the two +%dnl flavours again. Historically linux.spec had no fips=0 branch at all, so on +%dnl aarch64 (fips=0) the canister "is not set" comments were left in .config; +%dnl "make olddefconfig" silently drops symbols that do not exist in the tree +%dnl and the check_for_config_applicability.inc diff guard then failed. +%dnl +%dnl Expects, from the including spec: +%dnl fips 1 => build a FIPS kernel carrying the crypto canister +%dnl canister_build 1 => the canister is built from source in this build +%dnl canister_usage 1 => link against a prebuilt canister object file +%dnl (derived: !canister_build when fips=1, else 0) +%dnl +%dnl Expects .config to be in place already (cp of the flavour config Source). +%dnl +%dnl The GCC_PLUGIN_MATCH_CANISTER_STRUCTS / GCC_PLUGIN_PAD_CANISTER_STRUCTS +%dnl Kconfig symbols only exist once the fips canister plugin patches have been +%dnl applied, i.e. only when fips=1. +%if 0%{?canister_build} +sed -i "s/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS=y/" .config +sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config +%endif + +%if 0%{?canister_usage} +sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config +%endif + +%if 0%{?fips} == 0 +# Clean up .config of FIPS related configs +sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config +sed -i "/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/d" .config +%endif diff --git a/SPECS/linux/linux-esx.spec b/SPECS/linux/linux-esx.spec index ac009b1bdb..80626fbba6 100644 --- a/SPECS/linux/linux-esx.spec +++ b/SPECS/linux/linux-esx.spec @@ -26,10 +26,21 @@ %global fips 0 %endif +# The esx flavour never builds the canister itself, it always links against the +# prebuilt canister object file. Mirror linux.spec's derived flag model so the +# shared canister_config.inc behaves identically for both flavours. +%if 0%{?fips} +%global canister_build 0 +%global canister_usage 1 +%else +%global canister_build 0 +%global canister_usage 0 +%endif + Summary: Kernel Name: linux-esx Version: 6.12.107 -Release: 8%{?dist} +Release: 9%{?dist} URL: http://www.kernel.org Group: System Environment/Kernel Vendor: VMware, Inc. @@ -44,6 +55,8 @@ Source2: initramfs.trigger # contains pre, postun, filetriggerun tasks Source3: scriptlets.inc Source4: check_for_config_applicability.inc +# shared canister/.config handling, also included by linux.spec +Source5: canister_config.inc Source19: spec_install_post.inc @@ -427,20 +440,15 @@ tar -xvf /usr/lib/fips-canister/fips-canister-%{fips_canister_version}.tar.bz2 # corresponding .cmd file. Empty content is ok, since we are not going # to rebuild it. touch crypto/.fips_canister.o.cmd - -sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config %else -# Clean up .config of FIPS related configs -sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config -sed -i "/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/d" .config - sed -i "s/# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2 is not set/CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_2=y/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_32=y/# CONFIG_CRYPTO_JITTERENTROPY_MEMSIZE_32 is not set/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=128/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKS=64/" .config sed -i "s/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=256/CONFIG_CRYPTO_JITTERENTROPY_MEMORY_BLOCKSIZE=32/" .config %endif - +%dnl canister/.config handling, shared with linux.spec +%include %{SOURCE5} %ifarch x86_64 sed -e "s,@@NAME@@,%{name},g" \ -e "s,@@VERSION_RELEASE@@,%{version}-%{release},g" \ @@ -559,6 +567,11 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %{_usrsrc}/linux-headers-%{uname_r} %changelog +* Wed Sep 09 2026 Daniel Casota 6.12.107-9 +- Move canister/.config handling into shared canister_config.inc (Source5), + included by both linux.spec and linux-esx.spec so the two flavours cannot + diverge again. Behaviour-preserving here: this spec already handled fips=0 + correctly in its else branch, and that logic is what the include adopts. * Tue Sep 08 2026 Brennan Lamoreaux 6.12.107-8 - Fixes CVE-2026-63853, CVE-2026-63879, CVE-2026-64036, CVE-2026-64058, CVE-2026-64078 * Tue Sep 08 2026 srinidhira0 6.12.107-7 diff --git a/SPECS/linux/linux.spec b/SPECS/linux/linux.spec index 2043fea121..894699fd96 100644 --- a/SPECS/linux/linux.spec +++ b/SPECS/linux/linux.spec @@ -80,7 +80,7 @@ Summary: Kernel Name: linux Version: 6.12.107 -Release: 8%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} +Release: 9%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} URL: http://www.kernel.org/ Group: System Environment/Kernel Vendor: VMware, Inc. @@ -99,6 +99,8 @@ Source3: https://github.com/amzn/amzn-drivers/archive/refs/tags/ena_linux %define efa_version 3.1.0 Source4: https://github.com/amzn/amzn-drivers/archive/refs/tags/efa_linux_%{efa_version}.tar.gz +# shared canister/.config handling, also included by linux-esx.spec +Source5: canister_config.inc # contains pre, postun, filetriggerun tasks Source6: scriptlets.inc Source7: check_for_config_applicability.inc @@ -693,14 +695,7 @@ cat %{SOURCE20} %{SOURCE21} > photon-cert-bundle.pem sed -i 's/CONFIG_LOCALVERSION=""/CONFIG_LOCALVERSION="-%{release}"/' .config -%if 0%{?canister_build} -sed -i "s/# CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_PAD_CANISTER_STRUCTS=y/" .config -sed -i "/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/d" .config -%endif - -%if 0%{?canister_usage} -sed -i "s/# CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS is not set/CONFIG_GCC_PLUGIN_MATCH_CANISTER_STRUCTS=y/" .config -%endif +%include %{SOURCE5} %ifarch x86_64 sed -e "s,@@NAME@@,%{name},g" \ @@ -983,6 +978,14 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %endif %changelog +* Wed Sep 09 2026 Daniel Casota 6.12.107-9 +- Move canister/.config handling into shared canister_config.inc (Source5), + included by both linux.spec and linux-esx.spec so the two flavours cannot + diverge again. This also fixes the fips=0 path here: linux.spec had two + independent canister_build/canister_usage blocks and no else branch, so on + aarch64 nothing stripped the GCC_PLUGIN_{MATCH,PAD}_CANISTER_STRUCTS + comments before olddefconfig and the check_for_config_applicability.inc + diff guard failed prep. linux-esx.spec had always handled this correctly. * Tue Sep 08 2026 Brennan Lamoreaux 6.12.107-8 - Fixes CVE-2026-63853, CVE-2026-63879, CVE-2026-64036, CVE-2026-64058, CVE-2026-64078 * Tue Sep 08 2026 srinidhira0 6.12.107-7 From c4a4e52a6204ae018859264697b904d3f9e754af Mon Sep 17 00:00:00 2001 From: Daniel Casota Date: Wed, 2 Sep 2026 09:24:31 +0200 Subject: [PATCH 2/2] linux: rebase the canister patch series onto 6.12.107 canister_build could not build against the shipping kernel at all. %prep died at --fuzz=0 with 1 out of 2 hunks FAILED -- saving rejects to crypto/rsa-pkcs1pad.c.rej Upstream dropped the WARN_ON() wrapper around !digest_size in pkcs1pad_verify(), and that single line is context for both 1004 and 1010. In 1004 the conversion is not cosmetic: WARN_ON emits a __bug_table entry, and keeping __bug_table out of the canister is the entire point of that patch. Verified with rpmbuild -bp on a staged topdir: the whole series applies with no rejects and pkcs1pad_verify() comes out as if (fcw_warn_on(req->dst) || !digest_size || !ctx->key_size || sig_size != ctx->key_size || pkcs1pad_invalid_hash_len(digest_size, digest_info)) Stacked on the canister_config.inc change, which took -12; this takes -13. The two are stacked in fact, not just in numbering: a tree carrying only the include refactor has a spec that claims canister support the patch series cannot deliver. An earlier version of this change also made fips_canister_version and fips_certified_kernel_version overridable via a %{!?name: ...} guard. That is dropped. rpm expands the guarded form correctly, but Photon's own SpecParser does not: _isDefinition() matches only a line STARTING with %define/%global, so the guard is invisible to it and ExtraBuildRequiresSansSnapshot kept %{fips_canister_version} literal - the build then asked tdnf for a package called "linux-fips-canister-%{fips_canister_version}" and both kernel flavours failed to build. Overridability needs a mechanism that parser understands, and is not needed for this fix. Change-Id: Ifae87ab0fbfc289436a62b91bdfbff00e9d98b6c Signed-off-by: Daniel Casota Co-Authored-By: Claude Opus 5 Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01JW73JTCUGRcaNTUEQcAMtf --- ...-__bug_table-section-to-fips_canister_wrapper.patch | 4 ++-- ...s1pad-Add-invalid_hash_len-check-in-sign-veri.patch | 2 +- SPECS/linux/linux.spec | 10 +++++++++- 3 files changed, 12 insertions(+), 4 deletions(-) diff --git a/SPECS/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch b/SPECS/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch index dafa0d351f..1e323e8eba 100644 --- a/SPECS/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch +++ b/SPECS/linux/canister_builder/patches/1004-Move-__bug_table-section-to-fips_canister_wrapper.patch @@ -290,8 +290,8 @@ index bfde0f28c..a631b4905 100644 const unsigned int digest_size = req->dst_len; int err; -- if (WARN_ON(req->dst) || WARN_ON(!digest_size) || -+ if (fcw_warn_on(req->dst) || fcw_warn_on(!digest_size) || +- if (WARN_ON(req->dst) || !digest_size || ++ if (fcw_warn_on(req->dst) || !digest_size || !ctx->key_size || sig_size != ctx->key_size) return -EINVAL; diff --git a/SPECS/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch b/SPECS/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch index 7ab805cffc..12032503ba 100644 --- a/SPECS/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch +++ b/SPECS/linux/canister_builder/patches/1010-rsa-pkcs1pad-Add-invalid_hash_len-check-in-sign-veri.patch @@ -86,7 +86,7 @@ index 9cac0a06b..d9b6d7d1d 100644 const unsigned int digest_size = req->dst_len; int err; - if (fcw_warn_on(req->dst) || fcw_warn_on(!digest_size) || + if (fcw_warn_on(req->dst) || !digest_size || - !ctx->key_size || sig_size != ctx->key_size) + !ctx->key_size || sig_size != ctx->key_size || + pkcs1pad_invalid_hash_len(digest_size, digest_info)) diff --git a/SPECS/linux/linux.spec b/SPECS/linux/linux.spec index 894699fd96..d0f9d6d003 100644 --- a/SPECS/linux/linux.spec +++ b/SPECS/linux/linux.spec @@ -80,7 +80,7 @@ Summary: Kernel Name: linux Version: 6.12.107 -Release: 9%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} +Release: 10%{?acvp_build:.acvp}%{?kat_build:.kat}%{?dist} URL: http://www.kernel.org/ Group: System Environment/Kernel Vendor: VMware, Inc. @@ -978,6 +978,14 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg %endif %changelog +* Wed Sep 09 2026 Daniel Casota 6.12.107-10 +- Rebase canister-creation patches 1004 and 1010 onto 6.12.107. Upstream + dropped the WARN_ON() wrapper around !digest_size in pkcs1pad_verify(), and + that single line is context for both patches, so %prep failed at --fuzz=0 + with "1 out of 2 hunks FAILED -- crypto/rsa-pkcs1pad.c.rej". canister_build + could not build against the shipping kernel. In 1004 the conversion is not + cosmetic: WARN_ON emits a __bug_table entry and that patch exists to keep + __bug_table out of the canister. * Wed Sep 09 2026 Daniel Casota 6.12.107-9 - Move canister/.config handling into shared canister_config.inc (Source5), included by both linux.spec and linux-esx.spec so the two flavours cannot