[CLK 6.18.35 Rebase] Multiple patches tested (89 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

Add CIQ configs

Adding configs based of Fedora-ARK default config from 6.18.2.

Add initial CIQ config tweaks

We are modifying these with the following configs where available
CONFIG_MODIFY_LDT_SYSCALL=n
CONFIG_LEGACY_VSYSCALL_NONE=n
These options are for old software support which adds performance
overhead and potential attack surfaces with go against the CIQ LT
kernels priority of performance and security.

github actions: Make Builds on Merge Request Work

Setting up the default build configs to ensure everything builds when we
update and rebase.

arm64: add kernel config option to lock down when in Secure Boot mode

jira LE-2629
feature Additional SecureBoot patches for dynamic lockdown
commit b24fbd012b781b752cc51d6ef1fe1c6d5875ae87
commit-source https://salsa.debian.org/kernel-team/linux.git
commit-patch-path debian/patches/features/all/lockdown
commit-info Checkout the commit sha above and move to the directory
            listed above to find Debian patches matching this commits
	    summary line.

efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode

jira LE-2629
feature Additional SecureBoot patches for dynamic lockdown
commit b24fbd012b781b752cc51d6ef1fe1c6d5875ae87
commit-source https://salsa.debian.org/kernel-team/linux.git
commit-patch-path debian/patches/features/all/lockdown
commit-info Checkout the commit sha above and move to the directory
            listed above to find Debian patches matching this commits
            summary line.
UEFI machines can be booted in Secure Boot mode.  Add an EFI_SECURE_BOOT
flag that can be passed to efi_enabled() to find out whether secure boot is
enabled.

efi: Lock down the kernel if booted in secure boot mode

jira LE-2629
feature Additional SecureBoot patches for dynamic lockdown
commit b24fbd012b781b752cc51d6ef1fe1c6d5875ae87
commit-source https://salsa.debian.org/kernel-team/linux.git
commit-patch-path debian/patches/features/all/lockdown
commit-info Checkout the commit sha above and move to the directory
            listed above to find Debian patches matching this commits
            summary line.

mtd: phram,slram: Disable when the kernel is locked down

jira LE-2629
feature Additional SecureBoot patches for dynamic lockdown
commit b24fbd012b781b752cc51d6ef1fe1c6d5875ae87
commit-source https://salsa.debian.org/kernel-team/linux.git
commit-patch-path debian/patches/features/all/lockdown
commit-info Checkout the commit sha above and move to the directory
            listed above to find Debian patches matching this commits
            summary line.

Add efi_status_to_str() and rework efi_status_to_err().

jira LE-2629
feature Fedora EFI status status
ommit 7a60169d168d6aae70aca10b7b71070666068529
commit-source https://gitlab.com/cki-project/kernel-ark/

[CIQ] v6.18.3 - rebased configs

CONFIG_SPI_MICROCHIP_CORE is no longer a valid config option in 6.18.3
 spi: microchip: rename driver file and internal identifiers
 Upstream 71c814e98696f2cd53e9e6cef7501c2d667d4c5a

[CIQ] v6.18.7 - rebased configs

Upstream commit 5ba2f0a15564 (mm: introduce deferred freeing for
kernel page tables) was backported which adds new config option
ASYNC_KERNEL_PGTABLE_FREE.  Then upsteam commit e37d5a2d60a3
(iommu/sva: invalidate stale IOTLB entries for kernel address space)
was backported which selects it by default for x86 configs that have
selected IOMMU_SVA (which our x86_64 configs have)
 iommu/sva: invalidate stale IOTLB entries for kernel address space
 Upstream e37d5a2d60a338c5917c45296bac65da1382eda5

[CIQ] v6.18.9 - rebased configs

The config dependency on DEVICE_PRIVATE for DRM_GPUSVM was removed,
causing it to be selected by default for configs with DRM_XE (like ours).
Because DRM_GPUSVM is now enabled, DRM_XE_USERPTR_INVAL_INJECT is valid,
but not selected by default.
 drm, drm/xe: Fix xe userptr in the absence of CONFIG_DEVICE_PRIVATE
 Upstrea: bdcdf968be314b6fc8835b99fb4519e7619671e6 upstream.

[CIQ] v6.18.14 - rebased configs

ATH9K_AHB now depends on OF to be selected by default.  x86_64
configs do not have OF.  This is fine since ahb bus is arm only.
 wifi: ath9k: add OF dependency to AHB
 upstream: 125e7b31f041cc0a4ede1e42bef69915f0a63a35

[CIQ] v6.18.17 - rebased configs

WARN_ALL_UNSEEDED_RANDOM was removed completely
 Remove WARN_ALL_UNSEEDED_RANDOM kernel config option
 Upstream: 7dff99b354601dd01829e1511711846e04340a69

configs: Enable INTEL_TDX_HOST for x86_64 configs

There are customers that will need this enabled by default

Import initial dist-git for 6.18.19

kernel.spec: Fix buildid and pkgrelease

This matches the 6.12 spec

Remove gating.yaml

Update sbat templates

We are defining the product as clk so if we ever need to revoke or
deny the cert we can target this specific product

Ensure all qdiscs are in modules-core

by design, kernel-ark blacklists all modules in modules-extra that have
a module alias. Now that qdiscs have their module alias [1], some of them
became blacklisted even if we didn't really intend to: move them back to
kernel-modules to preserve feature parity with other qdiscs (and
previous
releases).

Remove modules-rt-kvm references

We don't have that

Set buildid to .1

And define pkgrelease using buildid.

rocky: generalize rule for kunit and test kmod placement

Rename package to kernel-clk6.18

Remove gemini switch

This comes from kernel-ark and is part of their solution for a
kernel variant that should supplant the factory kernel.  Since thats
not what we want, remove this to avoid any confusion.

Add Provides/Conflicts for non-parallel installable kernel-* packages

Adds Provides and Conflicts tags to kernel-clk6.18-* packages that
cannot be parallel installed with stock Rocky kernel packages:
- kernel-doc
- kernel-headers
- kernel-cross-headers
- kernel-debuginfo-common
- kernel-tools
- kernel-tools-libs
- kernel-tools-libs-devel
- kernel-selftests-internal

Rename tool packages with pkg_suffix and add Provides/Conflicts

Introduce %{pkg_suffix} macro (clk%{patchversion}) and use it for:
- package_name: kernel-%{pkg_suffix}
- tool packages: perf, python3-perf, libperf, rtla, rv

Use gzip for symvers compression to match upstream

Switch Module.symvers compression from the dynamic %compression
macro (xz) to hardcoded gzip -c9, matching the upstream kernel spec.
Also fixes the ghost file permissions from 0644 to 0600.

Add +clk6.18 suffix to kernel version string (uname -r)

Inject +%{pkg_suffix} into KVERREL and the shell-level equivalents
(KernelVer, DevelDir, EXTRAVERSION) so that uname -r shows the CLK
kernel identity, e.g. 6.18.19-1.1.el9_ciq.x86_64+clk6.18.

Add kernel-clk6.18-default package to set default kernel

Consolidate spec version defines and prevent CLK kernel from hijacking boot default

Reduce duplicated version numbers in the spec to single sources of truth:
- kernel_major_minor, kernel_patch, and buildid are the base defines
- specversion, kversion, patchlevel, pkgrelease, specrelease, and
  tarfile_release are all derived from them
- Remove specrpmversion (identical to specversion)
- Add el_version for tarball naming

Rework -default package and clean up tool subpackage naming

Move -default subpackage out of %if %{with_tools} guard so it exists
independently of the tools build flag.  Add Requires(posttrans) on
-core to guarantee vmlinuz is installed before grubby runs.  Add
Provides/Conflicts on kernel-provider(default) for mutual exclusion.

Bundle bindgen-cli from source for Rocky 9.6 builds

The bindgen tool required for kernel Rust support is not packaged in
Rocky Linux 9.6. Replace the bindgen BuildRequires with a bundled
bindgen-cli crate built from vendored source during the RPM build.

[CIQ] v6.18.20 - updated spec

[CIQ] v6.18.21 - updated spec

github actions: Inherit the Kernel CI Automated workflow from main

spec: Skip certificate setup for noarch builds

Update spec for ciq_kernel-6.18.21-2

We've picked up a source code change to fix a kallsym issue and
a spec file change to address noarch builds while secure boot signing

github actions: Use trigger for kernelCI

Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>

github actions: Trigger kernelCI on ciq-6.18.y-next branches

[CIQ] v6.18.22 - updated spec

spec: Fix posttrans script to handle noarch package expansion

[CIQ] ciq_kernel-6.18.22-2 - updated spec

spec: update branding in package descriptions and log messages

github actions: add RPM build workflow for x86_64 and aarch64

configs: enable legacy iptables/ip6tables support for all architectures

A customer running anetd (Google's GKE networking agent, a fork of
Cilium) reported that their nodes fail to reach Ready status because
anetd fatally exits when it cannot load the ip6_tables, ip6table_filter,
ip6table_mangle, and ip6table_raw kernel modules.

Add generic kernel Provides to spec

Adds 'Provides: kernel = version' to base package for compatibility
with packages depending on generic kernel capability.

Add generic kernel-headers and kernel-devel Provides to spec

Add versioned Provides for kernel-headers, kernel-devel, and
kernel-devel-<arch> so the namespaced CLK packages satisfy the same
dependency capabilities as stock Rocky kernel packages.

bundle_bindgen: add set -e, curl --fail, and SHA256 verification

- Add set -e so the script exits on any command failure
- Add -f (--fail) to curl so HTTP errors are caught
- Verify the downloaded crate against the known SHA256 from crates.io
  before extracting

[CIQ] v6.18.27 - rebased configs

ARM64_ERRATUM_4193714 was added and defaults to y if
you have ARM64 (which our aarch64 configs have)
 arm64: errata: Work around early CME DVMSync acknowledgement
 Upstream: 0baba94a9779c13c857f6efc55807e6a45b1d4e4

[CIQ] v6.18.27 - updated spec

generate_tarball: Also strip leading v from tags

[CIQ] v6.18.28 - updated spec

[CIQ] ciq_kernel-6.18.28-2 - updated spec

[CIQ] v6.18.31 - updated spec

[CIQ] v6.18.33 - updated spec

bundle_bindgen: add User-Agent header to crates.io request

crates.io returns 403 for API requests without a User-Agent header.

[CIQ] ciq_kernel-6.18.33-2 - updated spec

kernel-clk6.18: require ciq-kmod and ship %clk_version macro file

- Add Requires: ciq-kmod to the main meta package
- Install macros.kernel-clk6.18-<ver>-<rel> into %{buildroot}/usr/lib/rpm/macros.d/
  during BuildKernel() (base variant only); defines %clk_version for kmod builds
- Versioned filename avoids collisions when multiple installonly devel packages coexist
- Ship as a real file in kernel-clk6.18-devel (no ghost, no scriptlets)

random: Add hook to override device reads and getrandom(2)

commit-author Herbert Xu <herbert.xu@redhat.com>
commit 6892c65de813d311f20443401e528b4dc56872ff
commit-source https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10

crypto: rng - Override drivers/char/random in FIPS mode

commit-author Herbert Xu <herbert.xu@redhat.com>
commit 8b0beca705b3877e24cccdd672422c66bbd75635
commit-source https://gitlab.com/cki-project/kernel-ark

not upstream: Disable vdso getrandom when FIPS is enabled

commit-author Herbert Xu <herbert.xu@redhat.com>
commit 248b8056b11ed8e4b9004f401c75b7c72c3b27e4
commit-source https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-10

crypto: ecdh - implement FIPS PCT

commit -
commit-source https://build.opensuse.org/public/source/SUSE:SLE-15-SP6:GA/kernel-source/patches.suse.tar.bz2
commit-patch-path patches.suse/crypto-ecdh-implement-FIPS-PCT.patch

crypto: essiv - Zeroize keys on exit in essiv_aead_setkey()

In essiv_aead_setkey(), use the same logic as crypto_authenc_esn_setkey()
to zeroize keys on exit.

crypto: drbg - Align buffers to at least a cache line

None of the ciphers used by the DRBG have an alignment requirement; thus,
they all return 0 from .crypto_init, resulting in inconsistent alignment
across all buffers.

mm/gup: introduce pin_user_pages_fast_only()

Like pin_user_pages_fast(), but with the internal-only FOLL_FAST_ONLY flag.

crypto: rng - Convert crypto_default_rng_refcnt into an unsigned int

There is no reason this refcount should be a signed int. Convert it to an
unsigned int, thereby also making it less likely to ever overflow.

crypto: rng - Fix priority inversions due to mutex locks

Since crypto_devrandom_read_iter() is invoked directly by user tasks and is
accessible by every task in the system, there are glaring priority
inversions on crypto_reseed_rng_lock and crypto_default_rng_lock.

crypto: rng - Implement fast per-CPU DRBG instances

When the kernel is booted with fips=1, the RNG exposed to userspace is
hijacked away from the CRNG and redirects to crypto_devrandom_read_iter(),
which utilizes the DRBG.

lib/crypto: Add FIPS self-tests for SHA-1 and SHA-2

commit-author Eric Biggers <ebiggers@kernel.org>
commit 04cadb4fe0341304741ef60a297366b553f0ce36

byteorder: Add le64_to_cpu_array() and cpu_to_le64_array()

commit-author Eric Biggers <ebiggers@kernel.org>
commit c99d30706043481a1d631bbd9c7a4b70fe002a2b

lib/crypto: blake2b: Add BLAKE2b library functions

commit-author Eric Biggers <ebiggers@kernel.org>
commit 23a16c9533ed92cc639c8f5bd9eb104809fe2919

btrfs: switch to library APIs for checksums

commit-author Eric Biggers <ebiggers@kernel.org>
commit fe11ac191ce0ad910f6fda0c628bcff19fcff47d
upstream-diff |
    NB. This was a back-port not a cherry-pick as some of
    the underlying code had been changed in prior upstream
    commits: cc38d178ff33543cdb0bd58cfbb9a7c41372ff75
	btrfs: enable large data folio support under CONFIG_BTRFS_EXPERIMENTAL
    and commit: 62bcbdca0ea9b1add9c22f400b51c56184902053
	btrfs: make btrfs_csum_one_bio() handle bs > ps without large folios
    and others unknown.
    These changes were judged too large to bring back
    from upstream as they are CONFIG_BTRFS_EXPERIMENTAL.

crypto: testmgr - block Crypto API xxhash64 in FIPS mode

commit-author Joachim Vandersmissen <git@jvdsn.com>
commit -
commit-source https://lore.kernel.org/linux-crypto/20260303060509.246038-1-git@jvdsn.com/

When in fips mode, self-test errors must panic.

Requested by the lab.

When in fips mode, self-test errors must panic.

Requested by the lab.

Change CONFIG_CRYPTO_JITTERENTROPY_OSR from 1 to 3 in all configs.

Retquested by the lab.

dh_compute_value misses the check SP800-56Arev3, 5.6.2.1.4 which is typically implemented after dh_is_pubkey_valid.

Requested by lab.

In crypto_kdf108_ctr_generate() there is no minimum length check for the digest to be generated - it must be at least 112 bits.

Requested by the lab.

Add fips_approved flag to SHA1 and HMAC-SHA1 structs.

Ensure this is initialized correctly based on system state
and key length.

Add fips_approved flag to SHA224 and HMAC-SHA224 structs.

Ensure this is initialized correctly based on system state
and key length.

Add fips_approved flag to SHA256 and HMAC-SHA256 structs.

Ensure this is initialized correctly based on system state
and key length.

Add fips_approved flag to SHA384 and HMAC-SHA384 structs.

Ensure this is initialized correctly based on system state
and key length.

Add fips_approved flag to SHA512 and HMAC-SHA512 structs.

Ensure this is initialized correctly based on system state
and key length.

Add fips_approved indicator to struct crypto_aes_ctx.

Requested by lab.

Add CONFIG_CRYPTO_FIPS_CUSTOM_VERSION=y, CONFIG_CRYPTO_FIPS_VERSION="ciq.6.18.20260531"

Requested by lab. Will be changed for rpm builds.

Unset CRYPTO_JITTERENTROPY_MEMSIZE_2, set CRYPTO_JITTERENTROPY_MEMSIZE_128.

Requested by lab.

github actions: Add FIPS protected directory check for PRs

Adds a workflow that runs on PRs targeting ciq-*-next branches and
checks whether new upstream commits touch FIPS protected directories.
Posts a PR comment alerting reviewers if changes are found.

Restore CRYPTO_TFM_FIPS_COMPLIANCE flag as an indicator to differentiate between internal and external IV generation when AES-GCM
encryption is performed.

Required by lab.

[CIQ] v6.18.35 - updated spec

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	37m 2s	37m 50s
aarch64	24m 32s	25m 8s

• View build logs

✅ Boot Verification

• Status: Passed (all architectures)
• View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	443	64	ciq-6.18.y-next	⚠️ No baseline available
aarch64	375	56	ciq-6.18.y-next	✅ No regressions

• View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1481	81	ciq-6.18.y-next	✅ No regressions
aarch64	1454	82	ciq-6.18.y-next	✅ No regressions

• View LTP logs

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 27230021851

[ciq-kernel-automation]

⚠️ FIPS Protected Directory Changes Detected

New upstream commits in this rebase touch FIPS protected directories.
Please consult the CIQ FIPS / Security team before merging.

Details

[fips-check] Checking for FIPS protected changes in 83657f4189612e5cbcabc3058acd36c0bd120729..origin/ciq-6.18.y-next
[fips-check] Protected directories: arch/x86/crypto/, crypto/asymmetric_keys/, crypto/, drivers/crypto/, drivers/char/random.c, include/crypto
[fips-check] Checking for FIPS protected changes
[fips-check] Getting SHAS 83657f4189612e5cbcabc3058acd36c0bd120729..origin/ciq-6.18.y-next
[fips-check] Number of commits to check:  697
[fips-check] Checking modifications of shas
[fips-check] Checked 69 of 697 commits
[fips-check] Checked 138 of 697 commits
[fips-check] Checked 207 of 697 commits
[fips-check] Checked 276 of 697 commits
[fips-check] Checked commit b'585f9f6aef5c4542ac9d6ec45cd7dbc7df9af3ff' touched 2 FIPS protected files
  - b'include/crypto'
  - b'crypto/'
[fips-check] Checked 345 of 697 commits
[fips-check] Checked 414 of 697 commits
[fips-check] Checked 483 of 697 commits
[fips-check] Checked 552 of 697 commits
[fips-check] Checked 621 of 697 commits
[fips-check] Checked 690 of 697 commits
[fips-check] 1 of 697 commits have FIPS protected changes

[fips-check] ========================================
[fips-check] FIPS protected changes detected
[fips-check] ========================================
[fips-check] 1 commit(s) touch FIPS protected directories:

## Commit 585f9f6aef5c4542ac9d6ec45cd7dbc7df9af3ff
commit 585f9f6aef5c4542ac9d6ec45cd7dbc7df9af3ff
Author: David Howells <dhowells@redhat.com>
Date:   Sat May 16 00:05:13 2026 +0100

    crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks
    
    [ Upstream commit 2b50aceafe6606ea52ed42aadd1b4d44a188aade ]
    
    Change the krb5 crypto library to provide facilities to precheck the length
    of the message about to be decrypted or verified.
    
    Fix AF_RXRPC to make use of this to validate DATA packets secured with
    RxGK.
    
    Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
    Closes: https://sashiko.dev/#/patchset/20260511160753.607296-1-dhowells%40redhat.com
    Signed-off-by: David Howells <dhowells@redhat.com>
    cc: Herbert Xu <herbert@gondor.apana.org.au>
    cc: Simon Horman <horms@kernel.org>
    cc: Chuck Lever <chuck.lever@oracle.com>
    cc: linux-afs@lists.infradead.org
    Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
    Tested-by: Marc Dionne <marc.dionne@auristor.com>
    Link: https://patch.msgid.link/20260515230516.2718212-2-dhowells@redhat.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 Documentation/crypto/krb5.rst | 17 ++++++++++----
 crypto/krb5/krb5_api.c        | 54 ++++++++++++++++++++++++++++++++++++++-----
 include/crypto/krb5.h         |  9 +++++---
 include/trace/events/rxrpc.h  |  1 +
 net/rxrpc/rxgk.c              | 15 ++++++++++--
 5 files changed, 81 insertions(+), 15 deletions(-)

  FIPS directory: crypto/
  FIPS directory: include/crypto

[fips-check] --fips-override set, continuing despite FIPS protected changes

[bmastbergen]

⚠️ FIPS Protected Directory Changes Detected

New upstream commits in this rebase touch FIPS protected directories. Please consult the CIQ FIPS / Security team before merging.

Details

[fips-check] Checking for FIPS protected changes in 83657f4189612e5cbcabc3058acd36c0bd120729..origin/ciq-6.18.y-next
[fips-check] Protected directories: arch/x86/crypto/, crypto/asymmetric_keys/, crypto/, drivers/crypto/, drivers/char/random.c, include/crypto
[fips-check] Checking for FIPS protected changes
[fips-check] Getting SHAS 83657f4189612e5cbcabc3058acd36c0bd120729..origin/ciq-6.18.y-next
[fips-check] Number of commits to check:  697
[fips-check] Checking modifications of shas
[fips-check] Checked 69 of 697 commits
[fips-check] Checked 138 of 697 commits
[fips-check] Checked 207 of 697 commits
[fips-check] Checked 276 of 697 commits
[fips-check] Checked commit b'585f9f6aef5c4542ac9d6ec45cd7dbc7df9af3ff' touched 2 FIPS protected files
  - b'include/crypto'
  - b'crypto/'
[fips-check] Checked 345 of 697 commits
[fips-check] Checked 414 of 697 commits
[fips-check] Checked 483 of 697 commits
[fips-check] Checked 552 of 697 commits
[fips-check] Checked 621 of 697 commits
[fips-check] Checked 690 of 697 commits
[fips-check] 1 of 697 commits have FIPS protected changes

[fips-check] ========================================
[fips-check] FIPS protected changes detected
[fips-check] ========================================
[fips-check] 1 commit(s) touch FIPS protected directories:

## Commit 585f9f6aef5c4542ac9d6ec45cd7dbc7df9af3ff
commit 585f9f6aef5c4542ac9d6ec45cd7dbc7df9af3ff
Author: David Howells <dhowells@redhat.com>
Date:   Sat May 16 00:05:13 2026 +0100

    crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks
    
    [ Upstream commit 2b50aceafe6606ea52ed42aadd1b4d44a188aade ]
    
    Change the krb5 crypto library to provide facilities to precheck the length
    of the message about to be decrypted or verified.
    
    Fix AF_RXRPC to make use of this to validate DATA packets secured with
    RxGK.
    
    Fixes: 9d1d2b59341f ("rxrpc: rxgk: Implement the yfs-rxgk security class (GSSAPI)")
    Closes: https://sashiko.dev/#/patchset/20260511160753.607296-1-dhowells%40redhat.com
    Signed-off-by: David Howells <dhowells@redhat.com>
    cc: Herbert Xu <herbert@gondor.apana.org.au>
    cc: Simon Horman <horms@kernel.org>
    cc: Chuck Lever <chuck.lever@oracle.com>
    cc: linux-afs@lists.infradead.org
    Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
    Tested-by: Marc Dionne <marc.dionne@auristor.com>
    Link: https://patch.msgid.link/20260515230516.2718212-2-dhowells@redhat.com
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>

 Documentation/crypto/krb5.rst | 17 ++++++++++----
 crypto/krb5/krb5_api.c        | 54 ++++++++++++++++++++++++++++++++++++++-----
 include/crypto/krb5.h         |  9 +++++---
 include/trace/events/rxrpc.h  |  1 +
 net/rxrpc/rxgk.c              | 15 ++++++++++--
 5 files changed, 81 insertions(+), 15 deletions(-)

  FIPS directory: crypto/
  FIPS directory: include/crypto

[fips-check] --fips-override set, continuing despite FIPS protected changes

@jallisonciq @jason-rodri

Since this branch now carries FIPS patches, we've added a workflow to look for changes to protected directories when we rebase onto a new upstream LT version. This is our first hit. Please advise as to whether this change has FIPS cert ramifications. Thanks!

[jallisonciq]

Commit: 585f9f6

crypto/krb5, rxrpc: Fix lack of pre-decrypt/pre-verify length checks

Does not have any FIPS crypto certification implications. LGTM.

[PlaidCat]

[bmastbergen]

🥌

[bmastbergen]

/lt_rebase_merge

[ciq-kernel-automation]

✅ LT Rebase Merge completed successfully

Successfully completed LT 6.18 rebase merge

Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/27290437416