Upgrade iscsi-initiator-utils to version 2.1.12 for CVE-2026-44943, CVE-2026-44944

SPECS/iscsi-initiator-utils/0003-Use-DBROOT-in-iscsi-starter.-Include-iscsi-starter-i.patch

@@ -11,17 +11,17 @@ Subject: [PATCH 3/6] Use DBROOT in iscsi-starter. Include iscsi-starter in
  3 files changed, 4 insertions(+), 4 deletions(-)
 
 diff --git a/etc/Makefile b/etc/Makefile
-index 3f92054..6ec846f 100644
+index 4e705a2..2456f25 100644
 --- a/etc/Makefile
 +++ b/etc/Makefile
-@@ -46,7 +46,7 @@ INAME_DEST_FILE		= $(DESTDIR)$(HOMEDIR)/initiatorname.iscsi
+@@ -44,7 +44,7 @@ INAME_DEST_FILE			= $(DESTDIR)$(HOMEDIR)/initiatorname.iscsi
  all: $(SYSTEMD_SOURCES) $(SYSTEMD_GENERATED_SERVICE_FILES)
 
  $(SYSTEMD_GENERATED_SERVICE_FILES): systemd/%.service: systemd/%.service.template
 -	$(SED) -e 's:@SBINDIR@:$(SBINDIR):' $? > $@
 +	$(SED) -e 's:@SBINDIR@:$(SBINDIR):; s:@DBROOT@:$(DBROOT):' $? > $@
 
- install: install_systemd install_iface install_etc
+ install_etc: $(DESTDIR)$(HOMEDIR) $(ETC_DEST_FILES)
 
 diff --git a/etc/systemd/iscsi-starter.service.template b/etc/systemd/iscsi-starter.service.template
 index 5e97941..d3ea7cd 100644

SPECS/iscsi-initiator-utils/0007-Disable-Data-Digests.patch

@@ -9,10 +9,10 @@ Subject: [PATCH 6/6] Disable Data Digests
  2 files changed, 11 insertions(+), 11 deletions(-)
 
 diff --git a/etc/iscsid.conf b/etc/iscsid.conf
-index ec4d4df..e009c29 100644
+index d173437..7719522 100644
 --- a/etc/iscsid.conf
 +++ b/etc/iscsid.conf
-@@ -285,27 +285,23 @@ discovery.sendtargets.iscsi.MaxRecvDataSegmentLength = 32768
+@@ -308,27 +308,23 @@ discovery.sendtargets.iscsi.MaxRecvDataSegmentLength = 32768
 
  # To allow the targets to control the setting of the digest checking,
  # with the initiator requesting a preference of enabling the checking,
@@ -46,12 +46,12 @@ index ec4d4df..e009c29 100644
 +# The default is to never use HeaderDigests.
  #
 
- # For multipath configurations, you may want more than one session to be
+ # When using iSCSI over long range links with high round-trip time
 diff --git a/usr/idbm.c b/usr/idbm.c
-index ca4a4ec..32e99bc 100644
+index 22a1942..56490e7 100644
 --- a/usr/idbm.c
 +++ b/usr/idbm.c
-@@ -568,9 +568,13 @@ idbm_recinfo_node(node_rec_t *r, recinfo_t *ri)
+@@ -578,9 +578,13 @@ idbm_recinfo_node(node_rec_t *r, recinfo_t *ri)
  				 IDBM_SHOW, "None", "CRC32C", "CRC32C,None",
  				 "None,CRC32C", num, 1);
  		sprintf(key, CONN_DATA_DIGEST, i);

SPECS/iscsi-initiator-utils/0009-Coverity-scan-fixes.patch

@@ -4,88 +4,43 @@ Date: Wed, 5 Jun 2019 09:08:39 -0700
 Subject: [PATCH 1/1] Coverity scan fixes
 
 ---
- iscsiuio/src/unix/libs/qedi.c |  2 +-
- iscsiuio/src/unix/main.c      |  3 +++
- libopeniscsiusr/idbm.c        | 11 +++++------
- usr/idbm.c                    | 10 ++++------
- usr/iscsid.c                  |  2 +-
- 5 files changed, 14 insertions(+), 14 deletions(-)
+ iscsiuio/src/unix/libs/qedi.c | 2 +-
+ iscsiuio/src/unix/main.c      | 3 +++
+ usr/iscsid.c                  | 2 +-
+ 3 files changed, 5 insertions(+), 2 deletions(-)
 
 diff --git a/iscsiuio/src/unix/libs/qedi.c b/iscsiuio/src/unix/libs/qedi.c
-index 1af8d1b..9a814c6 100644
+index c26744d..e8d3a4e 100644
 --- a/iscsiuio/src/unix/libs/qedi.c
 +++ b/iscsiuio/src/unix/libs/qedi.c
 @@ -1034,7 +1034,7 @@ static int qedi_read(nic_t *nic, packet_t *pkt)
 
- 	LOG_DEBUG(PFX "%s:hw_prod %d bd_prod %d, rx_pkt_idx %d, rxlen %d",
+ 	ILOG_DEBUG(PFX "%s:hw_prod %d bd_prod %d, rx_pkt_idx %d, rxlen %d",
  		  nic->log_name, hw_prod, bd_prod, rx_bd->rx_pkt_index, len);
--	LOG_DEBUG(PFX "%s: sw_con %d bd_cons %d num BD %d",
-+	LOG_DEBUG(PFX "%s: sw_con %d bd_cons %d num BD %lu",
+-	ILOG_DEBUG(PFX "%s: sw_con %d bd_cons %d num BD %d",
++	ILOG_DEBUG(PFX "%s: sw_con %d bd_cons %d num BD %lu",
  		  nic->log_name, sw_cons, bd_cons, QEDI_NUM_RX_BD);
 
  	if (bd_cons != bd_prod) {
 diff --git a/iscsiuio/src/unix/main.c b/iscsiuio/src/unix/main.c
-index 0c9ad49..f83f305 100644
+index 645dbe8..b53a243 100644
 --- a/iscsiuio/src/unix/main.c
 +++ b/iscsiuio/src/unix/main.c
-@@ -391,6 +391,9 @@ int main(int argc, char *argv[])
+@@ -451,6 +451,9 @@ int main(int argc, char *argv[])
  	sigaddset(&set, SIGTERM);
  	sigaddset(&set, SIGUSR1);
  	rc = pthread_sigmask(SIG_SETMASK, &set, NULL);
 +	if (rc != 0) {
-+		LOG_ERR("Failed to set thread signal mask");
++		ILOG_ERR("Failed to set thread signal mask");
 +	}
 
  	/*  Spin off the signal handling thread */
  	pthread_attr_init(&attr);
-diff --git a/libopeniscsiusr/idbm.c b/libopeniscsiusr/idbm.c
-index 0910c63..6213e62 100644
---- a/libopeniscsiusr/idbm.c
-+++ b/libopeniscsiusr/idbm.c
-@@ -321,12 +321,11 @@ int _idbm_lock(struct iscsi_context *ctx)
- 		return 0;
- 	}
-
--	if (access(LOCK_DIR, F_OK) != 0) {
--		if (mkdir(LOCK_DIR, 0770) != 0) {
--			_error(ctx, "Could not open %s: %d %s", LOCK_DIR, errno,
--				_strerror(errno, strerr_buff));
--			return LIBISCSI_ERR_IDBM;
--		}
-+	if (((mkdir(LOCK_DIR, 0770) != 0) && (errno != EEXIST)) ||
-+	    (access(LOCK_DIR, F_OK) != 0)) {
-+		_error(ctx, "Could not open %s: %d %s", LOCK_DIR, errno,
-+			_strerror(errno, strerr_buff));
-+		return LIBISCSI_ERR_IDBM;
- 	}
-
- 	fd = open(LOCK_FILE, O_RDWR | O_CREAT, 0666);
-diff --git a/usr/idbm.c b/usr/idbm.c
-index b33ae42..1ac0b73 100644
---- a/usr/idbm.c
-+++ b/usr/idbm.c
-@@ -1461,12 +1461,10 @@ int idbm_lock(void)
- 		return 0;
- 	}
-
--	if (access(LOCK_DIR, F_OK) != 0) {
--		if (mkdir(LOCK_DIR, 0770) != 0) {
--			log_error("Could not open %s: %s", LOCK_DIR,
--				  strerror(errno));
--			return ISCSI_ERR_IDBM;
--		}
-+	if (((mkdir(LOCK_DIR, 0770) != 0) && (errno != EEXIST)) ||
-+	    (access(LOCK_DIR, F_OK) != 0)) {
-+		log_error("Could not open %s: %s", LOCK_DIR, strerror(errno));
-+		return ISCSI_ERR_IDBM;
- 	}
-
- 	fd = open(LOCK_FILE, O_RDWR | O_CREAT, 0666);
 diff --git a/usr/iscsid.c b/usr/iscsid.c
-index dc54fec..fde8894 100644
+index b6f157b..0154359 100644
 --- a/usr/iscsid.c
 +++ b/usr/iscsid.c
-@@ -510,8 +510,8 @@ int main(int argc, char *argv[])
+@@ -516,8 +516,8 @@ int main(int argc, char *argv[])
  				log_close(log_pid);
  				exit(ISCSI_ERR);
  			}

SPECS/iscsi-initiator-utils/0010-use-Red-Hat-version-string-to-match-RPM-package-vers.patch

@@ -16,8 +16,8 @@ index a0859b7..7ae461a 100644
  DESTDIR ?=
 
  # our VERSION String
--ISCSI_VERSION_STR ?= 2.1.9
-+ISCSI_VERSION_STR ?= 6.2.1.9
+-ISCSI_VERSION_STR ?= 2.1.12
++ISCSI_VERSION_STR ?= 6.2.1.12
 
  prefix = /usr
  exec_prefix =
@@ -29,8 +29,8 @@ index d49afbb..ab67096 100644
 
  project('open-iscsi', 'c',
    meson_version: '>= 0.54.0',
--  version: '2.1.9',
-+  version: '6.2.1.9',
+-  version: '2.1.12',
++  version: '6.2.1.12',
    license: 'LGPL-2.1-or-later',
    default_options: [
      'c_std=gnu99',

SPECS/iscsi-initiator-utils/0101-libiscsi.patch

@@ -3344,7 +3344,7 @@ index 0000000..caa4e66
 --- /dev/null
 +++ b/libiscsi/setup.py
 @@ -0,0 +1,9 @@
-+from distutils.core import setup, Extension
++from setuptools import setup, Extension
 +
 +module1 = Extension('libiscsi',
 +                    sources = ['pylibiscsi.c'],

SPECS/iscsi-initiator-utils/0103-fix-libiscsi-firmware-discovery-issue-with-NULL-drec.patch

@@ -6,8 +6,7 @@ Subject: [PATCH 1/1] fix libiscsi firmware discovery issue with NULL drec
 
 ---
  libiscsi/libiscsi.c | 2 +-
- usr/idbm.c          | 2 +-
- 2 files changed, 2 insertions(+), 2 deletions(-)
+ 1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/libiscsi/libiscsi.c b/libiscsi/libiscsi.c
 index c598aee..bddf9fc 100644
@@ -22,18 +21,5 @@ index c598aee..bddf9fc 100644
 
  		strlcpy(new_node->name, rec->name, LIBISCSI_VALUE_MAXLEN);
  		new_node->tpgt = rec->tpgt;
-diff --git a/usr/idbm.c b/usr/idbm.c
-index e9025bf..9cc9c40 100644
---- a/usr/idbm.c
-+++ b/usr/idbm.c
-@@ -2536,7 +2536,7 @@ int idbm_add_node(node_rec_t *newrec, discovery_rec_t *drec, int overwrite)
- 		if (rc)
- 			goto unlock;
-
--		if (drec->type == DISCOVERY_TYPE_FW) {
-+		if (drec && drec->type == DISCOVERY_TYPE_FW) {
- 			log_debug(8, "setting firmware node 'startup' to 'onboot'");
- 			newrec->startup = ISCSI_STARTUP_ONBOOT;
- 			newrec->conn[0].startup = ISCSI_STARTUP_ONBOOT;
 -- 
 2.36.1

SPECS/iscsi-initiator-utils/iscsi-initiator-utils.signatures.json

@@ -2,6 +2,6 @@
  "Signatures": {
   "04-iscsi": "7973dbc4f86506289fcf64255475598a9c6e153465c73633589961d96d2621af",
   "iscsi-tmpfiles.conf": "fd7766bfba489e4de4cc57713014c2a92c06164b49b135b97c8da679832e7146",
-  "open-iscsi-2.1.9-c26218d9f8afdca44a492a4c3811648bd2880b26.tar.gz": "fd93e4e1a36236f7ec8b54859b386f3be940e899988a257ec87663b187c6ba63"
+  "open-iscsi-2.1.12.tar.gz": "e2441b61e4b05cd5f0f94b35dcdf460e8d542e40d71b480882628170d6462d9a"
  }
 }

SPECS/iscsi-initiator-utils/iscsi-initiator-utils.spec

@@ -1,18 +1,16 @@
-%global commit0			c26218d9f8afdca44a492a4c3811648bd2880b26
-
 # Disable python2 build by default
 %bcond_with python2
 %bcond_without python3
 
 Summary:        iSCSI daemon and utility programs
 Name:           iscsi-initiator-utils
-Version:        2.1.9
+Version:        2.1.12
 Release:        1%{?dist}
 License:        GPLv2+
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
 URL:            https://www.open-iscsi.com/
-Source0:        https://github.com/open-iscsi/open-iscsi/archive/%{commit0}.tar.gz#/open-iscsi-%{version}-%{commit0}.tar.gz
+Source0:        https://github.com/open-iscsi/open-iscsi/archive/refs/tags/%{version}.tar.gz#/open-iscsi-%{version}.tar.gz
 Source4:        04-iscsi
 Source5:        iscsi-tmpfiles.conf
 
@@ -113,7 +111,7 @@ libiscsi interface for interacting with %{name}
 # ended with python3
 
 %prep
-%autosetup -p1 -n open-iscsi-%{commit0} -Sgit_am
+%autosetup -p1 -n open-iscsi-%{version} -Sgit_am
 
 %build
 # avoid undefined references linking failures
@@ -152,14 +150,11 @@ rm $RPM_BUILD_ROOT/etc/iscsi/initiatorname.iscsi
 rm $RPM_BUILD_ROOT/etc/udev/rules.d/50-iscsi-firmware-login.rules
 rm $RPM_BUILD_ROOT/usr/lib/systemd/system-generators/ibft-rule-generator
 rm $RPM_BUILD_ROOT/usr/sbin/brcm_iscsiuio
-rm $RPM_BUILD_ROOT/usr/sbin/iscsi-gen-initiatorname
 rm $RPM_BUILD_ROOT/usr/sbin/iscsi_discovery
 rm $RPM_BUILD_ROOT/usr/sbin/iscsi_fw_login
 rm $RPM_BUILD_ROOT/usr/sbin/iscsi_offload
-rm $RPM_BUILD_ROOT/usr/share/man/man8/iscsi-gen-initiatorname.8
 rm $RPM_BUILD_ROOT/usr/share/man/man8/iscsi_discovery.8
 rm $RPM_BUILD_ROOT/usr/share/man/man8/iscsi_fw_login.8
-rm $RPM_BUILD_ROOT/var/lib/iscsi/ifaces/iface.example
 
 %{__install} -d $RPM_BUILD_ROOT%{_libexecdir}
 %{__install} -pm 755 etc/systemd/iscsi-mark-root-nodes $RPM_BUILD_ROOT%{_libexecdir}
@@ -187,6 +182,10 @@ pushd libiscsi
 %endif
 popd
 
+%check
+# libopeniscsiusr mkdir's only the leaf of its compiled-in DBROOT.
+mkdir -p %{_sharedstatedir}/iscsi/ifaces
+%meson_test
 
 %post
 %systemd_post iscsi.service iscsi-starter.service iscsid.service iscsid.socket iscsi-onboot.service iscsi-init.service iscsi-shutdown.service
@@ -211,6 +210,7 @@ popd
 systemctl --no-reload preset iscsi.service iscsi-starter.service &>/dev/null || :
 
 %files
+%license COPYING
 %doc README
 %dir %{_sharedstatedir}/iscsi
 %dir %{_sharedstatedir}/iscsi/nodes
@@ -233,11 +233,13 @@ systemctl --no-reload preset iscsi.service iscsi-starter.service &>/dev/null ||
 %{_tmpfilesdir}/iscsi.conf
 %dir %{_sysconfdir}/iscsi
 %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/iscsi/iscsid.conf
+%{_sbindir}/iscsi-gen-initiatorname
 %{_sbindir}/iscsi-iname
 %{_sbindir}/iscsiadm
 %{_sbindir}/iscsid
 %{_sbindir}/iscsistart
 %{_libdir}/libiscsi.so.0
+%{_mandir}/man8/iscsi-gen-initiatorname.8.gz
 %{_mandir}/man8/iscsi-iname.8.gz
 %{_mandir}/man8/iscsiadm.8.gz
 %{_mandir}/man8/iscsid.8.gz
@@ -276,6 +278,14 @@ systemctl --no-reload preset iscsi.service iscsi-starter.service &>/dev/null ||
 %endif
 
 %changelog
+* Wed Aug 05 2026 Sumit Jena <v-sumitjena@microsoft.com> - 2.1.12-1
+- Update source to v2.1.12 to fix CVE-2026-44943 and CVE-2026-44944
+- Rebase downstream patches onto v2.1.12
+- Drop removal of no longer installed 'iface.example'
+- Retain 'iscsi-gen-initiatorname' required by 'iscsi-init.service'
+- Add '%%check' running the upstream 'libopeniscsiusr' test suite
+- Add missing '%%license' macro
+
 * Tue Jan 09 2024 Brian Fjeldstad <bfjelds@microsoft.com> - 2.1.9
 - Update source to v2.1.9
 

cgmanifest.json

@@ -7691,8 +7691,8 @@
         "type": "other",
         "other": {
           "name": "iscsi-initiator-utils",
-          "version": "2.1.9",
-          "downloadUrl": "https://github.com/open-iscsi/open-iscsi/archive/c26218d9f8afdca44a492a4c3811648bd2880b26.tar.gz"
+          "version": "2.1.12",
+          "downloadUrl": "https://github.com/open-iscsi/open-iscsi/archive/refs/tags/2.1.12.tar.gz"
         }
       }
     },