From fc0fd802a6349c1fc129ab15b2fbe8fc4ab0689d Mon Sep 17 00:00:00 2001
From: boypt <1033514+boypt@users.noreply.github.com>
Date: Fri, 7 Aug 2026 16:01:40 +0800
Subject: [PATCH] refactor: rename aarch64-kernel-panic patch to
 uos20-kernel-panic, switch to Patch999

The do_dup2() NULL pointer dereference panic affects all UOS 20 systems,
not just aarch64, so the patch name is generalized. Move the patch slot
from Patch100 (which collides with 10.4-fix-gssapi.patch in other specs)
to Patch999. Add an inline comment documenting the panic call trace and
fix mechanism.
---
 ...h => openssh-uos20-kernel-panic-fix.patch} |  0
 el7/SPECS/openssh.uos20.spec                  | 21 +++++++++++++++++--
 2 files changed, 19 insertions(+), 2 deletions(-)
 rename el7/SOURCES/{openssh-aarch64-kernel-panic-fix.patch => openssh-uos20-kernel-panic-fix.patch} (100%)

diff --git a/el7/SOURCES/openssh-aarch64-kernel-panic-fix.patch b/el7/SOURCES/openssh-uos20-kernel-panic-fix.patch
similarity index 100%
rename from el7/SOURCES/openssh-aarch64-kernel-panic-fix.patch
rename to el7/SOURCES/openssh-uos20-kernel-panic-fix.patch
diff --git a/el7/SPECS/openssh.uos20.spec b/el7/SPECS/openssh.uos20.spec
index bcfc8df..8172143 100644
--- a/el7/SPECS/openssh.uos20.spec
+++ b/el7/SPECS/openssh.uos20.spec
@@ -70,7 +70,24 @@ Source2: sshd.pam.el7
 %if %{with_openssl} == 2
 Source3: https://www.openssl.org/source/openssl-%{opensslver}.tar.gz
 %endif
-Patch100: openssh-aarch64-kernel-panic-fix.patch
+# Patch999: fix for kernel NULL pointer dereference panic in do_dup2() that
+# affects all UOS 20 systems (not just aarch64) when sshd performs a re-exec
+# with stdin/stdout/config fd dup2() before closing the existing descriptor.
+# Without this patch, certain UOS 20 kernels crash with:
+#
+#   BUG: unable to handle kernel NULL pointer dereference at 000000000000003f
+#   IP: filp_close+0x9/0x70
+#   Call Trace: do_dup2+xxx sys_dup2 entry_SYSCALL_64
+#   PID: xxx Comm: sshd
+#
+#   [<Txxxx>] Kernel panic - not syncing: Fatal exception
+#   [<Txxxx>] Kernel Offset: 0x13000000 from 0xffffffff81000000
+#   [<Txxxx>] kexec: Bye!
+#
+# The fix closes STDIN/STDOUT/REEXEC_CONFIG_PASS_FD before the corresponding
+# dup2() calls in sshd.c, so the kernel's filp_close() always operates on a
+# valid file pointer.
+Patch999: openssh-uos20-kernel-panic-fix.patch
 # systemd support
 Source7: sshd.sysconfig
 Source9: sshd@.service
@@ -183,7 +200,7 @@ environment.
 %else
 %setup -q
 %endif
-%patch100 -p0
+%patch999 -p0
 
 %if %{with_openssl} == 2
 # Add content below to use source code of OpenSSL