Skip to content

[ciqlts9_2] Multiple patches tested (6 commits)#1109

Open
ciq-kernel-automation[bot] wants to merge 6 commits intociqlts9_2from
{rnicolescu}_ciqlts9_2
Open

[ciqlts9_2] Multiple patches tested (6 commits)#1109
ciq-kernel-automation[bot] wants to merge 6 commits intociqlts9_2from
{rnicolescu}_ciqlts9_2

Conversation

@ciq-kernel-automation
Copy link
Copy Markdown

@ciq-kernel-automation ciq-kernel-automation bot commented Apr 10, 2026 •
edited
Loading

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

exfat: fix double free in delayed_free

jira VULN-72067
cve CVE-2025-38206
commit-author Namjae Jeon <linkinjeon@kernel.org>
commit 1f3d9724e16d62c7d42c67d6613b8512f2887c22

net: atm: add lec_mutex

jira VULN-72441
cve CVE-2025-38323
commit-author Eric Dumazet <edumazet@google.com>
commit d13a3824bfd2b4774b671a75cf766a16637a0e67

net: atm: fix /proc/net/atm/lec handling

jira VULN-71958
cve CVE-2025-38180
commit-author Eric Dumazet <edumazet@google.com>
commit d03b79f459c7935cff830d98373474f440bd03ae

sctp: avoid NULL dereference when chunk data buffer is missing

jira VULN-160764
cve CVE-2025-40240
commit-author Alexey Simakov <bigalex934@gmail.com>
commit 441f0647f7673e0e64d4910ef61a5fb8f16bfb82

ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()

jira VULN-174033
cve CVE-2025-71085
commit-author Will Rosenberg <whrosenb@asu.edu>
commit 58fc7342b529803d3c221101102fe913df7adb83

macvlan: fix possible UAF in macvlan_forward_source()

jira VULN-174917
cve CVE-2026-23001
commit-author Eric Dumazet <edumazet@google.com>
commit 7470a7a63dc162f07c26dbf960e41ee1e248d80e

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 24m 18s 26m 35s
aarch64 13m 5s 14m 49s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed
x86_64 174 25
aarch64 140 28

Test Comparison

x86_64:

  • ✅ Status: Passed - Within acceptable threshold (±3 tests)
  • Compared against: ciqlts9_2

aarch64:

  • ✅ Status: Passed - Within acceptable threshold (±3 tests)
  • Compared against: ciqlts9_2

🤖 This PR was automatically generated by GitHub Actions
Run ID: 24243051645

@ciq-kernel-automation ciq-kernel-automation bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Apr 10, 2026
CIQ Kernel Automation and others added 6 commits April 10, 2026 14:30
@roxanan1996
exfat: fix double free in delayed_free
3d2336a 
jira VULN-72067
cve CVE-2025-38206
commit-author Namjae Jeon <linkinjeon@kernel.org>
commit 1f3d972

The double free could happen in the following path.

exfat_create_upcase_table()
        exfat_create_upcase_table() : return error
        exfat_free_upcase_table() : free ->vol_utbl
        exfat_load_default_upcase_table : return error
     exfat_kill_sb()
           delayed_free()
                  exfat_free_upcase_table() <--------- double free
This patch set ->vol_util as NULL after freeing it.

	Reported-by: Jianzhou Zhao <xnxc22xnxc22@qq.com>
	Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
(cherry picked from commit 1f3d972)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@roxanan1996
net: atm: add lec_mutex
d28331f 
jira VULN-72441
cve CVE-2025-38323
commit-author Eric Dumazet <edumazet@google.com>
commit d13a382

syzbot found its way in net/atm/lec.c, and found an error path
in lecd_attach() could leave a dangling pointer in dev_lec[].

Add a mutex to protect dev_lecp[] uses from lecd_attach(),
lec_vcc_attach() and lec_mcast_attach().

Following patch will use this mutex for /proc/net/atm/lec.

BUG: KASAN: slab-use-after-free in lecd_attach net/atm/lec.c:751 [inline]
BUG: KASAN: slab-use-after-free in lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008
Read of size 8 at addr ffff88807c7b8e68 by task syz.1.17/6142

CPU: 1 UID: 0 PID: 6142 Comm: syz.1.17 Not tainted 6.16.0-rc1-syzkaller-00239-g08215f5486ec #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <TASK>
  __dump_stack lib/dump_stack.c:94 [inline]
  dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
  print_address_description mm/kasan/report.c:408 [inline]
  print_report+0xcd/0x680 mm/kasan/report.c:521
  kasan_report+0xe0/0x110 mm/kasan/report.c:634
  lecd_attach net/atm/lec.c:751 [inline]
  lane_ioctl+0x2224/0x23e0 net/atm/lec.c:1008
  do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159
  sock_do_ioctl+0x118/0x280 net/socket.c:1190
  sock_ioctl+0x227/0x6b0 net/socket.c:1311
  vfs_ioctl fs/ioctl.c:51 [inline]
  __do_sys_ioctl fs/ioctl.c:907 [inline]
  __se_sys_ioctl fs/ioctl.c:893 [inline]
  __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
  do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

Allocated by task 6132:
  kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
  kasan_save_track+0x14/0x30 mm/kasan/common.c:68
  poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
  __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
  kasan_kmalloc include/linux/kasan.h:260 [inline]
  __do_kmalloc_node mm/slub.c:4328 [inline]
  __kvmalloc_node_noprof+0x27b/0x620 mm/slub.c:5015
  alloc_netdev_mqs+0xd2/0x1570 net/core/dev.c:11711
  lecd_attach net/atm/lec.c:737 [inline]
  lane_ioctl+0x17db/0x23e0 net/atm/lec.c:1008
  do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159
  sock_do_ioctl+0x118/0x280 net/socket.c:1190
  sock_ioctl+0x227/0x6b0 net/socket.c:1311
  vfs_ioctl fs/ioctl.c:51 [inline]
  __do_sys_ioctl fs/ioctl.c:907 [inline]
  __se_sys_ioctl fs/ioctl.c:893 [inline]
  __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
  do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
  do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6132:
  kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
  kasan_save_track+0x14/0x30 mm/kasan/common.c:68
  kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
  poison_slab_object mm/kasan/common.c:247 [inline]
  __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
  kasan_slab_free include/linux/kasan.h:233 [inline]
  slab_free_hook mm/slub.c:2381 [inline]
  slab_free mm/slub.c:4643 [inline]
  kfree+0x2b4/0x4d0 mm/slub.c:4842
  free_netdev+0x6c5/0x910 net/core/dev.c:11892
  lecd_attach net/atm/lec.c:744 [inline]
  lane_ioctl+0x1ce8/0x23e0 net/atm/lec.c:1008
  do_vcc_ioctl+0x12c/0x930 net/atm/ioctl.c:159
  sock_do_ioctl+0x118/0x280 net/socket.c:1190
  sock_ioctl+0x227/0x6b0 net/socket.c:1311
  vfs_ioctl fs/ioctl.c:51 [inline]
  __do_sys_ioctl fs/ioctl.c:907 [inline]
  __se_sys_ioctl fs/ioctl.c:893 [inline]
  __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893

Fixes: 1da177e ("Linux-2.6.12-rc2")
	Reported-by: syzbot+8b64dec3affaed7b3af5@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6852c6f6.050a0220.216029.0018.GAE@google.com/T/#u
	Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250618140844.1686882-2-edumazet@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit d13a382)
	Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
@roxanan1996
net: atm: fix /proc/net/atm/lec handling
15aab9a 
jira VULN-71958
cve CVE-2025-38180
commit-author Eric Dumazet <edumazet@google.com>
commit d03b79f

/proc/net/atm/lec must ensure safety against dev_lec[] changes.

It appears it had dev_put() calls without prior dev_hold(),
leading to imbalance and UAF.

Fixes: 1da177e ("Linux-2.6.12-rc2")
	Signed-off-by: Eric Dumazet <edumazet@google.com>
	Acked-by: Francois Romieu <romieu@fr.zoreil.com> # Minor atm contributor
Link: https://patch.msgid.link/20250618140844.1686882-3-edumazet@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit d03b79f)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@roxanan1996
sctp: avoid NULL dereference when chunk data buffer is missing
74e5a83 
jira VULN-160764
cve CVE-2025-40240
commit-author Alexey Simakov <bigalex934@gmail.com>
commit 441f064

chunk->skb pointer is dereferenced in the if-block where it's supposed
to be NULL only.

chunk->skb can only be NULL if chunk->head_skb is not. Check for frag_list
instead and do it just before replacing chunk->skb. We're sure that
otherwise chunk->skb is non-NULL because of outer if() condition.

Fixes: 90017ac ("sctp: Add GSO support")
	Signed-off-by: Alexey Simakov <bigalex934@gmail.com>
	Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Link: https://patch.msgid.link/20251021130034.6333-1-bigalex934@gmail.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 441f064)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@roxanan1996
ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr()
5b870e1 
jira VULN-174033
cve CVE-2025-71085
commit-author Will Rosenberg <whrosenb@asu.edu>
commit 58fc734

There exists a kernel oops caused by a BUG_ON(nhead < 0) at
net/core/skbuff.c:2232 in pskb_expand_head().
This bug is triggered as part of the calipso_skbuff_setattr()
routine when skb_cow() is passed headroom > INT_MAX
(i.e. (int)(skb_headroom(skb) + len_delta) < 0).

The root cause of the bug is due to an implicit integer cast in
__skb_cow(). The check (headroom > skb_headroom(skb)) is meant to ensure
that delta = headroom - skb_headroom(skb) is never negative, otherwise
we will trigger a BUG_ON in pskb_expand_head(). However, if
headroom > INT_MAX and delta <= -NET_SKB_PAD, the check passes, delta
becomes negative, and pskb_expand_head() is passed a negative value for
nhead.

Fix the trigger condition in calipso_skbuff_setattr(). Avoid passing
"negative" headroom sizes to skb_cow() within calipso_skbuff_setattr()
by only using skb_cow() to grow headroom.

PoC:
	Using `netlabelctl` tool:

        netlabelctl map del default
        netlabelctl calipso add pass doi:7
        netlabelctl map add default address:0::1/128 protocol:calipso,7

        Then run the following PoC:

        int fd = socket(AF_INET6, SOCK_DGRAM, IPPROTO_UDP);

        // setup msghdr
        int cmsg_size = 2;
        int cmsg_len = 0x60;
        struct msghdr msg;
        struct sockaddr_in6 dest_addr;
        struct cmsghdr * cmsg = (struct cmsghdr *) calloc(1,
                        sizeof(struct cmsghdr) + cmsg_len);
        msg.msg_name = &dest_addr;
        msg.msg_namelen = sizeof(dest_addr);
        msg.msg_iov = NULL;
        msg.msg_iovlen = 0;
        msg.msg_control = cmsg;
        msg.msg_controllen = cmsg_len;
        msg.msg_flags = 0;

        // setup sockaddr
        dest_addr.sin6_family = AF_INET6;
        dest_addr.sin6_port = htons(31337);
        dest_addr.sin6_flowinfo = htonl(31337);
        dest_addr.sin6_addr = in6addr_loopback;
        dest_addr.sin6_scope_id = 31337;

        // setup cmsghdr
        cmsg->cmsg_len = cmsg_len;
        cmsg->cmsg_level = IPPROTO_IPV6;
        cmsg->cmsg_type = IPV6_HOPOPTS;
        char * hop_hdr = (char *)cmsg + sizeof(struct cmsghdr);
        hop_hdr[1] = 0x9; //set hop size - (0x9 + 1) * 8 = 80

        sendmsg(fd, &msg, 0);

Fixes: 2917f57 ("calipso: Allow the lsm to label the skbuff directly.")
	Suggested-by: Paul Moore <paul@paul-moore.com>
	Signed-off-by: Will Rosenberg <whrosenb@asu.edu>
	Acked-by: Paul Moore <paul@paul-moore.com>
Link: https://patch.msgid.link/20251219173637.797418-1-whrosenb@asu.edu
	Signed-off-by: Paolo Abeni <pabeni@redhat.com>
(cherry picked from commit 58fc734)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@roxanan1996
macvlan: fix possible UAF in macvlan_forward_source()
2e207cf 
jira VULN-174917
cve CVE-2026-23001
commit-author Eric Dumazet <edumazet@google.com>
commit 7470a7a

Add RCU protection on (struct macvlan_source_entry)->vlan.

Whenever macvlan_hash_del_source() is called, we must clear
entry->vlan pointer before RCU grace period starts.

This allows macvlan_forward_source() to skip over
entries queued for freeing.

Note that macvlan_dev are already RCU protected, as they
are embedded in a standard netdev (netdev_priv(ndev)).

Fixes: 79cf79a ("macvlan: add source mode")
	Reported-by: syzbot+7182fbe91e58602ec1fe@syzkaller.appspotmail.com
https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u
	Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260108133651.1130486-1-edumazet@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 7470a7a)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@roxanan1996 roxanan1996 force-pushed the {rnicolescu}_ciqlts9_2 branch from 9ae64dc to 2e207cf Compare April 10, 2026 12:30
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 10, 2026

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/24243320966

@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 10, 2026

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/24243320966

@roxanan1996 roxanan1996 requested a review from a team April 10, 2026 13:37
bmastbergen
bmastbergen approved these changes Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@bmastbergen bmastbergen requested a review from a team April 10, 2026 17:13
PlaidCat
PlaidCat approved these changes Apr 10, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@PlaidCat PlaidCat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PlaidCat PlaidCat PlaidCat approved these changes

@bmastbergen bmastbergen bmastbergen approved these changes

Assignees

No one assigned

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@PlaidCat @bmastbergen @roxanan1996