Skip to content

[ciqlts9_2] Multiple patches tested (5 commits) - #1628

Open
ciq-kernel-automation[bot] wants to merge 5 commits into
ciqlts9_2from
{maple}_ciqlts9_2
Open

[ciqlts9_2] Multiple patches tested (5 commits)#1628
ciq-kernel-automation[bot] wants to merge 5 commits into
ciqlts9_2from
{maple}_ciqlts9_2

Conversation

@ciq-kernel-automation

@ciq-kernel-automation ciq-kernel-automation Bot commented Sep 18, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

xfrm: ah6: validate routing header segments_left

jira VULN-211382
cve CVE-2026-80844
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 7bad4bda74dc4713f398d3b7624ff05478e3a568

net: tun: rebuild error handling in tun_get_user

jira VULN-209970
cve-pre CVE-2026-81000
commit-author Chuang Wang <nashuiliang@gmail.com>
commit ab00af85d2f886a8e4ace1342d9cc2b232eab6a8

net: tun: bound receive headroom

jira VULN-209970
cve CVE-2026-81000
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 447c9303942c439a117d9b76ce6d6e2116b38ee7

pppoe: reload header pointer after dev_hard_header()

jira VULN-197182
cve CVE-2026-68121
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit e9c238f6fe42fb1b4dba3a578277de32cb487937

sctp: prevent peer transport count overflow

jira VULN-207732
cve CVE-2026-74469
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit bd0e9289e2642f6a5c54faad304ce0f41e926d22

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 18m 58s 19m 47s
aarch64 12m 36s 13m 9s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 176 22 ciqlts9_2 ✅ No regressions
aarch64 139 29 ciqlts9_2 ✅ No regressions

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 1439 81 ciqlts9_2 ✅ No regressions
aarch64 1408 84 ciqlts9_2 ❌ 1 regressions

aarch64 regressions:

  • fcntl14_64 (PASS -> FAIL)

🤖 This PR was automatically generated by GitHub Actions
Run ID: 35398563540

@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Sep 18, 2026
@PlaidCat PlaidCat self-assigned this Sep 18, 2026
@PlaidCat
PlaidCat requested a review from a team September 18, 2026 17:29
bmastbergen
bmastbergen requested changes Sep 18, 2026
View reviewed changes
Comment thread drivers/net/tun.c
u8 ip_version;

if (!pskb_may_pull(skb, 1)) {
err = -EINVAL;

@bmastbergen bmastbergen Sep 18, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we need to define a drop_reason before the goto drop;, otherwise drop_reason is passed undefined to kfree_skb_reason.

@PlaidCat PlaidCat Sep 18, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch the 8.6 had the same but doesn't have the drop_reason ..
I chose to backport the precondition commit as it cleans up this jumping around awkwardly

@PlaidCat
xfrm: ah6: validate routing header segments_left
832fbb5 
jira VULN-211382
cve CVE-2026-80844
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 7bad4bd

AH6 rearranges routing-header addresses before computing or verifying the
ICV. ipv6_rearrange_rthdr() assumes that segments_left is not larger than
the number of addresses described by the routing header's hdrlen field.

That assumption does not hold for raw IPv6 HDRINCL packets. A packet with
hdrlen equal to 2 describes one address, but can carry an arbitrary
segments_left value. With segments_left equal to 255, the function moves
its address pointer 4,064 bytes backwards and passes a 4,064-byte length to
memmove(), resulting in an out-of-bounds access.

Validate the invariant locally before modifying the routing header or
performing any address-pointer arithmetic, and propagate malformed-header
errors to the existing AH6 input and output error paths.

Fixes: 1da177e ("Linux-2.6.12-rc2")
	Cc: stable@vger.kernel.org
Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
	Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
	Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
(cherry picked from commit 7bad4bd)
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@PlaidCat
net: tun: rebuild error handling in tun_get_user
0cca0af 
jira VULN-209970
cve-pre CVE-2026-81000
commit-author Chuang Wang <nashuiliang@gmail.com>
commit ab00af8

The error handling in tun_get_user is very scattered.
This patch unifies error handling, reduces duplication of code, and
makes the logic clearer.

	Signed-off-by: Chuang Wang <nashuiliang@gmail.com>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit ab00af8)
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@PlaidCat
net: tun: bound receive headroom
282dc3b 
jira VULN-209970
cve CVE-2026-81000
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 447c930

tun_get_user() uses tun->align both as skb headroom and when choosing how
much packet data to keep linear. OVS can propagate an oversized headroom
request from another port to TUN or TAP.

When align is larger than the usable space in a one-page skb head,
SKB_MAX_HEAD(align) underflows and the result becomes negative when stored
in good_linear. That value later wraps when assigned to the size_t linear
variable, and tun_alloc_skb() can place skb->data outside the allocated
head.

Bound the headroom stored by TUN to the one-page skb-head budget and the
largest non-sentinel 16-bit skb header offset. Leave one linear byte for
raw TUN and a complete Ethernet header for TAP, including NET_IP_ALIGN.

Also pull the raw-TUN protocol byte and the TAP Ethernet header before
accessing them, so these checks remain safe for nonlinear skbs supplied by
other allocation paths.

Fixes: eaea34b ("net/tun: implement ndo_set_rx_headroom")
	Cc: stable@vger.kernel.org
	Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
	Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260812012139.2134643-1-manizada@pm.me
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 447c930)
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@PlaidCat
pppoe: reload header pointer after dev_hard_header()
cd22bd1 
jira VULN-197182
cve CVE-2026-68121
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit e9c238f

pppoe_sendmsg() saves a pointer to the PPPoE header before calling
dev_hard_header(). Device header callbacks are allowed to reallocate the
skb head, invalidating pointers into it.

This can happen when a send is blocked in copy_from_user() while the first
non-Ethernet port is added to an empty team device. The team's delegated
GRE header callback then expands the skb head. PPPoE subsequently writes
six bytes through the stale pointer into the freed head.

Reload the PPPoE header through the skb's network-header offset after
device header creation. pskb_expand_head() updates that offset when it
relocates the head.

Fixes: 1da177e ("Linux-2.6.12-rc2")
	Cc: stable@vger.kernel.org
	Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
	Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
	Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260722093814.3017176-1-manizada@pm.me
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit e9c238f)
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@PlaidCat
sctp: prevent peer transport count overflow
d6ac555 
jira VULN-207732
cve CVE-2026-74469
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit bd0e928

sctp_assoc_add_peer() increments the association's 16-bit transport_count
for every new unique peer. Adding the 65,536th transport wraps the count to
zero.

SCTP sock_diag uses transport_count to reserve the INET_DIAG_PEERS payload,
then copies one sockaddr_storage for every entry in transport_addr_list.
After the wrap, a diagnostic dump reserves an empty payload and writes
8 MiB of peer addresses past the skb tail.

Reject a new unique peer when transport_count has reached U16_MAX. Perform
the check after the existing-peer lookup so a duplicate address continues
to return its existing transport at the limit.

Fixes: 8f840e4 ("sctp: add the sctp_diag.c file")
	Cc: stable@vger.kernel.org
	Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
	Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20260725032053.521705-1-manizada@pm.me
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit bd0e928)
Signed-off-by: Jonathan Maple <jmaple@ciq.com>
@github-actions

github-actions Bot commented Sep 18, 2026

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/35399092725

@github-actions

github-actions Bot commented Sep 18, 2026

Copy link
Copy Markdown

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/35399092725

@PlaidCat
PlaidCat requested a review from a team September 18, 2026 22:07
@ciq-kernel-automation ciq-kernel-automation Bot changed the title [ciqlts9_2] Multiple patches tested (4 commits) [ciqlts9_2] Multiple patches tested (5 commits) Sep 19, 2026
kerneltoast
kerneltoast approved these changes Sep 19, 2026
View reviewed changes

@kerneltoast kerneltoast left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@bmastbergen your block appears to be addressed

🚢

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@PlaidCat PlaidCat PlaidCat left review comments
@bmastbergen bmastbergen bmastbergen requested changes
@kerneltoast kerneltoast kerneltoast approved these changes

Requested changes must be addressed to merge this pull request.

Assignees

@PlaidCat PlaidCat

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@kerneltoast @PlaidCat @bmastbergen