[ciqcbr7_9] Multiple patches tested (4 commits) by ciq-kernel-automation[bot] · Pull Request #1621 · ctrliq/kernel-src-tree

ciq-kernel-automation · 2026-09-17T21:19:16Z

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

xfrm: ah6: validate routing header segments_left

jira VULN-211045
cve CVE-2026-80844
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 7bad4bda74dc4713f398d3b7624ff05478e3a568

pppoe: reload header pointer after dev_hard_header()

jira VULN-197176
cve CVE-2026-68121
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit e9c238f6fe42fb1b4dba3a578277de32cb487937

sctp: prevent peer transport count overflow

jira VULN-207726
cve CVE-2026-74469
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit bd0e9289e2642f6a5c54faad304ce0f41e926d22
upstream-diff |
	context diff due to missing:
	4e7696d90b51a1a73ce0e8174f3aff58b914619c
	[sctp: get netns from asoc and ep base]

net: tun: bound receive headroom

jira VULN-209964
cve CVE-2026-81000
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 447c9303942c439a117d9b76ce6d6e2116b38ee7
commit-source-sha ad715e713610d2d5473c3a6498c825ccecf26491
commit-source stable-5.10.y
upstream-diff |
	This kernel does not have the NAPI frags plumbing
	  * 96aa1b22bd6bb9fccf62f6261f390ed6f3e7967f
	  tun: correct header offsets in napi frags mode
	  * 90e33d45940793def6f773b2d528e9f3c84ffdc7
	  tun: enable napi_gro_frags() for TUN/TAP driver
	Its also missing the drop label so needed to do local inplace
	allocation cleanup
	  * ab00af85d2f886a8e4ace1342d9cc2b232eab6a8
	  net: tun: rebuild error handling in tun_get_user
	We also need to keep the origin ip_version check due to keeping
	the original case statements.

Test Results

✅ Build Stage

Status: Passed (x86_64)
Build Time: 10m 34s
Total Time: 11m 36s
View build logs

✅ Boot Verification

Status: Passed (x86_64)
View boot logs

🤖 This PR was automatically generated by GitHub Actions
Run ID: 35352841597

jira VULN-211045 cve CVE-2026-80844 commit-author Asim Viladi Oglu Manizada <manizada@pm.me> commit 7bad4bd AH6 rearranges routing-header addresses before computing or verifying the ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than the number of addresses described by the routing header's hdrlen field. That assumption does not hold for raw IPv6 HDRINCL packets. A packet with hdrlen equal to 2 describes one address, but can carry an arbitrary segments_left value. With segments_left equal to 255, the function moves its address pointer 4,064 bytes backwards and passes a 4,064-byte length to memmove(), resulting in an out-of-bounds access. Validate the invariant locally before modifying the routing header or performing any address-pointer arithmetic, and propagate malformed-header errors to the existing AH6 input and output error paths. Fixes: 1da177e ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me> Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com> (cherry picked from commit 7bad4bd) Signed-off-by: Jonathan Maple <jmaple@ciq.com>

jira VULN-197176 cve CVE-2026-68121 commit-author Asim Viladi Oglu Manizada <manizada@pm.me> commit e9c238f pppoe_sendmsg() saves a pointer to the PPPoE header before calling dev_hard_header(). Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This can happen when a send is blocked in copy_from_user() while the first non-Ethernet port is added to an empty team device. The team's delegated GRE header callback then expands the skb head. PPPoE subsequently writes six bytes through the stale pointer into the freed head. Reload the PPPoE header through the skb's network-header offset after device header creation. pskb_expand_head() updates that offset when it relocates the head. Fixes: 1da177e ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me> Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev> Reviewed-by: Eric Dumazet <edumazet@google.com> Link: https://patch.msgid.link/20260722093814.3017176-1-manizada@pm.me Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit e9c238f) Signed-off-by: Jonathan Maple <jmaple@ciq.com>

jira VULN-207726 cve CVE-2026-74469 commit-author Asim Viladi Oglu Manizada <manizada@pm.me> commit bd0e928 upstream-diff | context diff due to missing: 4e7696d [sctp: get netns from asoc and ep base] sctp_assoc_add_peer() increments the association's 16-bit transport_count for every new unique peer. Adding the 65,536th transport wraps the count to zero. SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload, then copies one sockaddr_storage for every entry in transport_addr_list. After the wrap, a diagnostic dump reserves an empty payload and writes 8 MiB of peer addresses past the skb tail. Reject a new unique peer when transport_count has reached U16_MAX. Perform the check after the existing-peer lookup so a duplicate address continues to return its existing transport at the limit. Fixes: 8f840e4 ("sctp: add the sctp_diag.c file") Cc: stable@vger.kernel.org Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me> Acked-by: Xin Long <lucien.xin@gmail.com> Link: https://patch.msgid.link/20260725032053.521705-1-manizada@pm.me Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit bd0e928) Signed-off-by: Jonathan Maple <jmaple@ciq.com>

github-actions · 2026-09-17T21:37:47Z

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/35277728033

github-actions · 2026-09-17T21:37:49Z

🔍 Interdiff Analysis

⚠️ PR commit 902d73039cd7 (xfrm: ah6: validate routing header segments_left) → upstream 7bad4bda74dc
Differences found:

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -285,4 +295,4 @@
 			ipv6_rearrange_rthdr(iph, exthdr.rth);
 			break;
 
-		default :
+		default:

⚠️ PR commit 856ffe94d3c6 (sctp: prevent peer transport count overflow) → upstream bd0e9289e264
Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -614,6 +614,9 @@
 		return peer;
 	}
 
+	if (asoc->peer.transport_count == U16_MAX)
+		return NULL;
+
 	peer = sctp_transport_new(asoc->base.net, addr, gfp);
 	if (!peer)
 		return NULL;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -612,5 +612,5 @@
 	}
 
-	peer = sctp_transport_new(net, addr, gfp);
+	peer = sctp_transport_new(asoc->base.net, addr, gfp);
 	if (!peer)
 		return NULL;

⚠️ PR commit 917791875d5b (net: tun: bound receive headroom) → upstream 447c9303942c
Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -988,7 +988,6 @@
 		max_headroom -= 1;
 
 	tun->align = clamp_t(int, new_hr, NET_SKB_PAD, max_headroom);
-
 }
 
 static int tun_net_change_carrier(struct net_device *dev, bool new_carrier)
@@ -1405,16 +1404,7 @@
 	switch (tun->flags & TUN_TYPE_MASK) {
 	case IFF_TUN:
 		if (tun->flags & IFF_NO_PI) {
-			u8 ip_version;
-
-			if (!pskb_may_pull(skb, 1)) {
-				this_cpu_inc(tun->pcpu_stats->rx_dropped);
-				kfree_skb(skb);
-				return -EINVAL;
-			}
-			ip_version = skb->data[0] & 0xf0;
-
-			switch (ip_version) {
+			switch (skb->data[0] & 0xf0) {
 			case 0x40:
 				pi.proto = htons(ETH_P_IP);
 				break;
@@ -1433,11 +1423,6 @@
 		skb->dev = tun->dev;
 		break;
 	case IFF_TAP:
-		if (!pskb_may_pull(skb, ETH_HLEN)) {
-			this_cpu_inc(tun->pcpu_stats->rx_dropped);
-			kfree_skb(skb);
-			return -ENOMEM;
-		}
 		skb->protocol = eth_type_trans(skb, tun->dev);
 		break;
 	}

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1827,7 +1832,13 @@
 	switch (tun->flags & TUN_TYPE_MASK) {
 	case IFF_TUN:
 		if (tun->flags & IFF_NO_PI) {
-			u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0;
+			u8 ip_version;
+
+			if (!pskb_may_pull(skb, 1)) {
+				err = -EINVAL;
+				goto drop;
+			}
+			ip_version = skb->data[0] >> 4;
 
 			switch (ip_version) {
 			case 4:
@@ -1847,7 +1858,7 @@
 		skb->dev = tun->dev;
 		break;
 	case IFF_TAP:
-		if (frags && !pskb_may_pull(skb, ETH_HLEN)) {
+		if (!pskb_may_pull(skb, ETH_HLEN)) {
 			err = -ENOMEM;
 			drop_reason = SKB_DROP_REASON_HDR_TRUNC;
 			goto drop;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -985,4 +1114,4 @@
 	tun->align = new_hr;
 }
 
-static int tun_net_change_carrier(struct net_device *dev, bool new_carrier)
+static void
@@ -1399,7 +1822,7 @@
 	switch (tun->flags & TUN_TYPE_MASK) {
 	case IFF_TUN:
 		if (tun->flags & IFF_NO_PI) {
-			switch (skb->data[0] & 0xf0) {
-			case 0x40:
-				pi.proto = htons(ETH_P_IP);
-				break;
+			u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0;
+
+			switch (ip_version) {
+			case 4:
@@ -1418,6 +1842,7 @@
 		skb->dev = tun->dev;
 		break;
 	case IFF_TAP:
-		skb->protocol = eth_type_trans(skb, tun->dev);
-		break;
-	}
+		if (frags && !pskb_may_pull(skb, ETH_HLEN)) {
+			err = -ENOMEM;
+			drop_reason = SKB_DROP_REASON_HDR_TRUNC;
+			goto drop;

This is an automated interdiff check for backported commits.

github-actions · 2026-09-17T21:38:38Z

JIRA PR Check Results

2 commit(s) with issues found:

Commit `917791875d5b`

Summary: net: tun: bound receive headroom

⚠️ Warnings:

VULN-209964: No time logged - please log time manually

Commit `856ffe94d3c6`

Summary: sctp: prevent peer transport count overflow

❌ Errors:

VULN-207726: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

VULN-207726: No time logged - please log time manually

Summary: Checked 4 commit(s) total.

github-actions · 2026-09-17T21:38:39Z

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/35277728033

jira VULN-209964 cve CVE-2026-81000 commit-author Asim Viladi Oglu Manizada <manizada@pm.me> commit 447c930 commit-source-sha ad715e713610d2d5473c3a6498c825ccecf26491 commit-source stable-5.10.y upstream-diff | This kernel does not have the NAPI frags plumbing * 96aa1b2 tun: correct header offsets in napi frags mode * 90e33d4 tun: enable napi_gro_frags() for TUN/TAP driver Its also missing the drop label so needed to do local inplace allocation cleanup * ab00af8 net: tun: rebuild error handling in tun_get_user We also need to keep the origin ip_version check due to keeping the original case statements. commit 447c930 upstream. tun_get_user() uses tun->align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is larger than the usable space in a one-page skb head, SKB_MAX_HEAD(align) underflows and the result becomes negative when stored in good_linear. That value later wraps when assigned to the size_t linear variable, and tun_alloc_skb() can place skb->data outside the allocated head. Bound the headroom stored by TUN to the one-page skb-head budget and the largest non-sentinel 16-bit skb header offset. Leave one linear byte for raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN. Also pull the raw-TUN protocol byte and the TAP Ethernet header before accessing them, so these checks remain safe for nonlinear skbs supplied by other allocation paths. Fixes: eaea34b ("net/tun: implement ndo_set_rx_headroom") Cc: stable@vger.kernel.org Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/20260812012139.2134643-1-manizada@pm.me Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> (cherry picked from commit ad715e713610d2d5473c3a6498c825ccecf26491) Signed-off-by: Jonathan Maple <jmaple@ciq.com>

github-actions · 2026-09-18T14:03:58Z

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/35353924267

github-actions · 2026-09-18T14:03:59Z

🔍 Interdiff Analysis

⚠️ PR commit 902d73039cd7 (xfrm: ah6: validate routing header segments_left) → upstream 7bad4bda74dc
Differences found:

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -285,4 +295,4 @@
 			ipv6_rearrange_rthdr(iph, exthdr.rth);
 			break;
 
-		default :
+		default:

⚠️ PR commit 856ffe94d3c6 (sctp: prevent peer transport count overflow) → upstream bd0e9289e264
Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -614,6 +614,9 @@
 		return peer;
 	}
 
+	if (asoc->peer.transport_count == U16_MAX)
+		return NULL;
+
 	peer = sctp_transport_new(asoc->base.net, addr, gfp);
 	if (!peer)
 		return NULL;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -612,5 +612,5 @@
 	}
 
-	peer = sctp_transport_new(net, addr, gfp);
+	peer = sctp_transport_new(asoc->base.net, addr, gfp);
 	if (!peer)
 		return NULL;

⚠️ PR commit 6b0ce62a0cfe (net: tun: bound receive headroom) → upstream 447c9303942c
Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1404,16 +1404,7 @@
 	switch (tun->flags & TUN_TYPE_MASK) {
 	case IFF_TUN:
 		if (tun->flags & IFF_NO_PI) {
-			u8 ip_version;
-
-			if (!pskb_may_pull(skb, 1)) {
-				this_cpu_inc(tun->pcpu_stats->rx_dropped);
-				kfree_skb(skb);
-				return -EINVAL;
-			}
-			ip_version = skb->data[0] & 0xf0;
-
-			switch (ip_version) {
+			switch (skb->data[0] & 0xf0) {
 			case 0x40:
 				pi.proto = htons(ETH_P_IP);
 				break;
@@ -1432,11 +1423,6 @@
 		skb->dev = tun->dev;
 		break;
 	case IFF_TAP:
-		if (!pskb_may_pull(skb, ETH_HLEN)) {
-			this_cpu_inc(tun->pcpu_stats->rx_dropped);
-			kfree_skb(skb);
-			return -ENOMEM;
-		}
 		skb->protocol = eth_type_trans(skb, tun->dev);
 		break;
 	}

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1827,7 +1832,13 @@
 	switch (tun->flags & TUN_TYPE_MASK) {
 	case IFF_TUN:
 		if (tun->flags & IFF_NO_PI) {
-			u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0;
+			u8 ip_version;
+
+			if (!pskb_may_pull(skb, 1)) {
+				err = -EINVAL;
+				goto drop;
+			}
+			ip_version = skb->data[0] >> 4;
 
 			switch (ip_version) {
 			case 4:
@@ -1847,7 +1858,7 @@
 		skb->dev = tun->dev;
 		break;
 	case IFF_TAP:
-		if (frags && !pskb_may_pull(skb, ETH_HLEN)) {
+		if (!pskb_may_pull(skb, ETH_HLEN)) {
 			err = -ENOMEM;
 			drop_reason = SKB_DROP_REASON_HDR_TRUNC;
 			goto drop;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -985,4 +1114,4 @@
 	tun->align = new_hr;
 }
 
-static int tun_net_change_carrier(struct net_device *dev, bool new_carrier)
+static void
@@ -1399,7 +1822,7 @@
 	switch (tun->flags & TUN_TYPE_MASK) {
 	case IFF_TUN:
 		if (tun->flags & IFF_NO_PI) {
-			switch (skb->data[0] & 0xf0) {
-			case 0x40:
-				pi.proto = htons(ETH_P_IP);
-				break;
+			u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0;
+
+			switch (ip_version) {
+			case 4:
@@ -1418,6 +1842,7 @@
 		skb->dev = tun->dev;
 		break;
 	case IFF_TAP:
-		skb->protocol = eth_type_trans(skb, tun->dev);
-		break;
-	}
+		if (frags && !pskb_may_pull(skb, ETH_HLEN)) {
+			err = -ENOMEM;
+			drop_reason = SKB_DROP_REASON_HDR_TRUNC;
+			goto drop;

This is an automated interdiff check for backported commits.

github-actions · 2026-09-18T14:04:52Z

JIRA PR Check Results

2 commit(s) with issues found:

Commit `6b0ce62a0cfe`

Summary: net: tun: bound receive headroom

⚠️ Warnings:

VULN-209964: No time logged - please log time manually

Commit `856ffe94d3c6`

Summary: sctp: prevent peer transport count overflow

❌ Errors:

VULN-207726: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

VULN-207726: No time logged - please log time manually

Summary: Checked 4 commit(s) total.

github-actions · 2026-09-18T14:04:53Z

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/35353924267

bmastbergen

🥌

kerneltoast

xfrm: ah6: validate routing header segments_left adds a new error return value to ipv6_clear_mutable_options(). But in 7.9, the return value of ipv6_clear_mutable_options() isn't propagated correctly because of a missing fix.

Backport the tiny upstream commit a5ebcbd (ah6: fix error return code in ah6_input()) to fix it, just in case the lack of error code propagation could result in DirtyAH6 not getting fully fixed.

PlaidCat added 3 commits September 17, 2026 10:27

ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Sep 17, 2026

kerneltoast reviewed Sep 17, 2026

View reviewed changes

Comment thread drivers/net/tun.c Outdated

PlaidCat force-pushed the {maple}_ciqcbr7_9 branch from 9177918 to 6b0ce62 Compare September 18, 2026 13:52

PlaidCat self-assigned this Sep 18, 2026

PlaidCat requested a review from a team September 18, 2026 13:53

bmastbergen approved these changes Sep 18, 2026

View reviewed changes

PlaidCat requested review from a team and kerneltoast September 18, 2026 17:31

kerneltoast requested changes Sep 19, 2026

View reviewed changes

Navigation Menu

[ciqcbr7_9] Multiple patches tested (4 commits) - #1621

[ciqcbr7_9] Multiple patches tested (4 commits)#1621
ciq-kernel-automation[bot] wants to merge 4 commits into
ciqcbr7_9from
{maple}_ciqcbr7_9

ciq-kernel-automation Bot commented Sep 17, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

bmastbergen left a comment

Uh oh!

kerneltoast left a comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Conversation

ciq-kernel-automation Bot commented Sep 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Commit Message(s)

Test Results

✅ Build Stage

✅ Boot Verification

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

github-actions Bot commented Sep 17, 2026

🔍 Interdiff Analysis

Uh oh!

github-actions Bot commented Sep 17, 2026

JIRA PR Check Results

Commit 917791875d5b

Commit 856ffe94d3c6

Uh oh!

github-actions Bot commented Sep 17, 2026

Uh oh!

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

github-actions Bot commented Sep 18, 2026

🔍 Interdiff Analysis

Uh oh!

github-actions Bot commented Sep 18, 2026

JIRA PR Check Results

Commit 6b0ce62a0cfe

Commit 856ffe94d3c6

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

bmastbergen left a comment

Choose a reason for hiding this comment

Uh oh!

kerneltoast left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

ciq-kernel-automation Bot commented Sep 17, 2026 •

edited

Loading

Commit `917791875d5b`

Commit `856ffe94d3c6`

Commit `6b0ce62a0cfe`

Commit `856ffe94d3c6`