Update kernel to 6.12.61

SPECS/kernel-headers/kernel-headers.signatures.json

@@ -1,5 +1,5 @@
 {
   "Signatures": {
-    "linux-6.12.59.tar.gz": "93dfe627d321f016291054449a8e4bf9051de19687fbf1a6f584a2b79f8f5d2c"
+    "linux-6.12.61.tar.gz": "7fb34abab0902a47ce1d47de58442e69e0e79d17f565b41fcb11249ea5b23801"
   }
 }

SPECS/kernel-headers/kernel-headers.spec

@@ -13,14 +13,14 @@
 
 Summary:        Linux API header files
 Name:           kernel-headers
-Version:        6.12.59
+Version:        6.12.61
 Release:        1%{?dist}
 License:        GPLv2
 Vendor:         Intel Corporation
 Distribution:   Edge Microvisor Toolkit
 Group:          System Environment/Kernel
 URL:            https://www.kernel.org/pub/linux/kernel
-Source0:        https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.59.tar.gz
+Source0:        https://www.kernel.org/pub/linux/kernel/v6.x/linux-6.12.61.tar.gz
 # Historical name shipped by other distros
 Provides:       glibc-kernheaders = %{version}-%{release}
 BuildArch:      noarch
@@ -41,7 +41,7 @@ cross-glibc package.
 %endif
 
 %prep
-%setup -q -n linux-6.12.59
+%setup -q -n linux-6.12.61
 
 %build
 make mrproper
@@ -76,6 +76,9 @@ done
 %endif
 
 %changelog
+* Fri Jan 2 2026 Lishan Liu <[email protected]> - 6.12.61-1
+- Update kernel to 6.12.61-1
+
 * Thu Dec 11 2025 Lishan Liu <[email protected]> - 6.12.59-1
 - Update kernel to 6.12.59
 

SPECS/kernel-rt/0001-drm-i915-no-force-probe-needed-for-mtl-platform.drm

@@ -0,0 +1,29 @@
+From f18bd93ea20bf2a8b7360b245db7a9119a2e54ac Mon Sep 17 00:00:00 2001
+From: Junxiao Chang <[email protected]>
+Date: Sat, 6 Dec 2025 17:11:22 +0800
+Subject: [PATCH] drm/i915: no force probe needed for mtl platform
+
+mtl has been supported in 6.12 kernel. No need to add require force
+probe flag.
+
+Fixes: 9fd5e45e3167 ("Revert "drm/i915: move platform_engine_mask and memory_regions to device info"")
+Signed-off-by: Junxiao Chang <[email protected]>
+---
+ drivers/gpu/drm/i915/i915_pci.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/drivers/gpu/drm/i915/i915_pci.c b/drivers/gpu/drm/i915/i915_pci.c
+index 8aff711aa887b..9eb8216389251 100644
+--- a/drivers/gpu/drm/i915/i915_pci.c
++++ b/drivers/gpu/drm/i915/i915_pci.c
+@@ -795,7 +795,6 @@ static const struct intel_device_info mtl_info = {
+ 	.has_pxp = 1,
+ 	.__runtime.memory_regions = BIT(INTEL_REGION_SMEM) | BIT(INTEL_REGION_STOLEN_LMEM),
+ 	.__runtime.platform_engine_mask = BIT(RCS0) | BIT(BCS0) | BIT(CCS0),
+-	.require_force_probe = 1,
+ 	MTL_CACHELEVEL,
+ };
+
+-- 
+2.43.0
+

SPECS/kernel-rt/CVE-2025-40215.patch

@@ -0,0 +1,191 @@
+From 39992c2053e7eff318860d12ae26b2a57385a772 Mon Sep 17 00:00:00 2001
+From: Sabrina Dubroca <[email protected]>
+Date: Fri, 4 Jul 2025 16:54:33 +0200
+Subject: [PATCH] xfrm: delete x->tunnel as we delete x
+
+The ipcomp fallback tunnels currently get deleted (from the various
+lists and hashtables) as the last user state that needed that fallback
+is destroyed (not deleted). If a reference to that user state still
+exists, the fallback state will remain on the hashtables/lists,
+triggering the WARN in xfrm_state_fini. Because of those remaining
+references, the fix in commit f75a2804da39 ("xfrm: destroy xfrm_state
+synchronously on net exit path") is not complete.
+
+We recently fixed one such situation in TCP due to defered freeing of
+skbs (commit 9b6412e6979f ("tcp: drop secpath at the same time as we
+currently drop dst")). This can also happen due to IP reassembly: skbs
+with a secpath remain on the reassembly queue until netns
+destruction. If we can't guarantee that the queues are flushed by the
+time xfrm_state_fini runs, there may still be references to a (user)
+xfrm_state, preventing the timely deletion of the corresponding
+fallback state.
+
+Instead of chasing each instance of skbs holding a secpath one by one,
+this patch fixes the issue directly within xfrm, by deleting the
+fallback state as soon as the last user state depending on it has been
+deleted. Destruction will still happen when the final reference is
+dropped.
+
+A separate lockdep class for the fallback state is required since
+we're going to lock x->tunnel while x is locked.
+
+Fixes: 9d4139c76905 ("netns xfrm: per-netns xfrm_state_all list")
+Signed-off-by: Sabrina Dubroca <[email protected]>
+Signed-off-by: Steffen Klassert <[email protected]>
+---
+ include/net/xfrm.h      |  1 -
+ net/ipv4/ipcomp.c       |  2 ++
+ net/ipv6/ipcomp6.c      |  2 ++
+ net/ipv6/xfrm6_tunnel.c |  2 +-
+ net/xfrm/xfrm_ipcomp.c  |  1 -
+ net/xfrm/xfrm_state.c   | 19 ++++++++-----------
+ 6 files changed, 13 insertions(+), 14 deletions(-)
+
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index caaff61601a0..d51204041bf7 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -424,7 +424,6 @@ int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo);
+ int xfrm_input_unregister_afinfo(const struct xfrm_input_afinfo *afinfo);
+
+ void xfrm_flush_gc(void);
+-void xfrm_state_delete_tunnel(struct xfrm_state *x);
+
+ struct xfrm_type {
+ 	struct module		*owner;
+diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
+index 5a4fb2539b08..9a45aed508d1 100644
+--- a/net/ipv4/ipcomp.c
++++ b/net/ipv4/ipcomp.c
+@@ -54,6 +54,7 @@ static int ipcomp4_err(struct sk_buff *skb, u32 info)
+ }
+
+ /* We always hold one tunnel user reference to indicate a tunnel */
++static struct lock_class_key xfrm_state_lock_key;
+ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
+ {
+ 	struct net *net = xs_net(x);
+@@ -62,6 +63,7 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
+ 	t = xfrm_state_alloc(net);
+ 	if (!t)
+ 		goto out;
++	lockdep_set_class(&t->lock, &xfrm_state_lock_key);
+
+ 	t->id.proto = IPPROTO_IPIP;
+ 	t->id.spi = x->props.saddr.a4;
+diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
+index 72d4858dec18..8607569de34f 100644
+--- a/net/ipv6/ipcomp6.c
++++ b/net/ipv6/ipcomp6.c
+@@ -71,6 +71,7 @@ static int ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
+ 	return 0;
+ }
+
++static struct lock_class_key xfrm_state_lock_key;
+ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
+ {
+ 	struct net *net = xs_net(x);
+@@ -79,6 +80,7 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
+ 	t = xfrm_state_alloc(net);
+ 	if (!t)
+ 		goto out;
++	lockdep_set_class(&t->lock, &xfrm_state_lock_key);
+
+ 	t->id.proto = IPPROTO_IPV6;
+ 	t->id.spi = xfrm6_tunnel_alloc_spi(net, (xfrm_address_t *)&x->props.saddr);
+diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
+index bf140ef781c1..7fd8bc08e6eb 100644
+--- a/net/ipv6/xfrm6_tunnel.c
++++ b/net/ipv6/xfrm6_tunnel.c
+@@ -334,8 +334,8 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)
+ 	struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
+ 	unsigned int i;
+
+-	xfrm_flush_gc();
+ 	xfrm_state_flush(net, 0, false, true);
++	xfrm_flush_gc();
+
+ 	for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
+ 		WARN_ON_ONCE(!hlist_empty(&xfrm6_tn->spi_byaddr[i]));
+diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c
+index 9c0fa0e1786a..f2e70e918f11 100644
+--- a/net/xfrm/xfrm_ipcomp.c
++++ b/net/xfrm/xfrm_ipcomp.c
+@@ -315,7 +315,6 @@ void ipcomp_destroy(struct xfrm_state *x)
+ 	struct ipcomp_data *ipcd = x->data;
+ 	if (!ipcd)
+ 		return;
+-	xfrm_state_delete_tunnel(x);
+ 	mutex_lock(&ipcomp_resource_mutex);
+ 	ipcomp_free_data(ipcd);
+ 	mutex_unlock(&ipcomp_resource_mutex);
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index f8cb033f102e..e4500d481e26 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -748,6 +748,7 @@ void __xfrm_state_destroy(struct xfrm_state *x, bool sync)
+ }
+ EXPORT_SYMBOL(__xfrm_state_destroy);
+
++static void xfrm_state_delete_tunnel(struct xfrm_state *x);
+ int __xfrm_state_delete(struct xfrm_state *x)
+ {
+ 	struct net *net = xs_net(x);
+@@ -775,6 +776,8 @@ int __xfrm_state_delete(struct xfrm_state *x)
+
+ 		xfrm_dev_state_delete(x);
+
++		xfrm_state_delete_tunnel(x);
++
+ 		/* All xfrm_state objects are created by xfrm_state_alloc.
+ 		 * The xfrm_state_alloc call gives a reference, and that
+ 		 * is what we are dropping here.
+@@ -878,10 +881,7 @@ int xfrm_state_flush(struct net *net, u8 proto, bool task_valid, bool sync)
+ 				err = xfrm_state_delete(x);
+ 				xfrm_audit_state_delete(x, err ? 0 : 1,
+ 							task_valid);
+-				if (sync)
+-					xfrm_state_put_sync(x);
+-				else
+-					xfrm_state_put(x);
++				xfrm_state_put(x);
+ 				if (!err)
+ 					cnt++;
+
+@@ -3008,20 +3008,17 @@ void xfrm_flush_gc(void)
+ }
+ EXPORT_SYMBOL(xfrm_flush_gc);
+
+-/* Temporarily located here until net/xfrm/xfrm_tunnel.c is created */
+-void xfrm_state_delete_tunnel(struct xfrm_state *x)
++static void xfrm_state_delete_tunnel(struct xfrm_state *x)
+ {
+ 	if (x->tunnel) {
+ 		struct xfrm_state *t = x->tunnel;
+
+-		if (atomic_read(&t->tunnel_users) == 2)
++		if (atomic_dec_return(&t->tunnel_users) == 1)
+ 			xfrm_state_delete(t);
+-		atomic_dec(&t->tunnel_users);
+-		xfrm_state_put_sync(t);
++		xfrm_state_put(t);
+ 		x->tunnel = NULL;
+ 	}
+ }
+-EXPORT_SYMBOL(xfrm_state_delete_tunnel);
+
+ u32 xfrm_state_mtu(struct xfrm_state *x, int mtu)
+ {
+@@ -3221,8 +3218,8 @@ void xfrm_state_fini(struct net *net)
+ 	unsigned int sz;
+
+ 	flush_work(&net->xfrm.state_hash_work);
+-	flush_work(&xfrm_state_gc_work);
+ 	xfrm_state_flush(net, 0, false, true);
++	flush_work(&xfrm_state_gc_work);
+
+ 	WARN_ON(!list_empty(&net->xfrm.state_all));
+
+-- 
+2.43.0
+

SPECS/kernel-rt/kernel-rt.signatures.json

@@ -5,6 +5,6 @@
   "cpupower": "d7518767bf2b1110d146a49c7d42e76b803f45eb8bd14d931aa6d0d346fae985",
   "cpupower.service": "b057fe9e5d0e8c36f485818286b80e3eba8ff66ff44797940e99b1fd5361bb98",
   "sha512hmac-openssl.sh": "02ab91329c4be09ee66d759e4d23ac875037c3b56e5a598e32fd1206da06a27f",
-  "linux-6.12.59.tar.gz": "93dfe627d321f016291054449a8e4bf9051de19687fbf1a6f584a2b79f8f5d2c"
+  "linux-6.12.61.tar.gz": "7fb34abab0902a47ce1d47de58442e69e0e79d17f565b41fcb11249ea5b23801"
  }
 }