Skip to content

[ciqlts8_6] Multiple patches tested (3 commits)#1135

Merged
roxanan1996 merged 3 commits into
ciqlts8_6from
{rnicolescu}_ciqlts8_6
Apr 24, 2026
Merged

[ciqlts8_6] Multiple patches tested (3 commits)#1135
roxanan1996 merged 3 commits into
ciqlts8_6from
{rnicolescu}_ciqlts8_6

Conversation

@ciq-kernel-automation

Copy link
Copy Markdown

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().

jira VULN-160251
cve CVE-2025-40168
commit-author Kuniyuki Iwashima <kuniyu@google.com>
commit 235f81045c008169cc4e1955b4a64e118eebe61b
net: add skb_header_pointer_careful() helper

jira VULN-176127
cve-pre CVE-2026-23204
commit-author Eric Dumazet <edumazet@google.com>
commit 13e00fdc9236bd4d0bff4109d2983171fbcb74c4
upstream-diff |
	Adjusted context because skb_pointer_if_linear does not exist.
	Introduced in 6f5a630d7c57c ("bpf, net: Introduce skb_pointer_if_linear().")
net/sched: cls_u32: use skb_header_pointer_careful()

jira VULN-176127
cve CVE-2026-23204
commit-author Eric Dumazet <edumazet@google.com>
commit cabd1a976375780dabab888784e356f574bbaed8

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 23m 18s 24m 15s
aarch64 9m 52s 10m 30s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 108 31 ciqlts8_6 ✅ No regressions
aarch64 66 21 ciqlts8_6 ✅ No regressions

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 N/A N/A ciqlts8_6 ⚠️ No baseline available
aarch64 N/A N/A ciqlts8_6 ⚠️ No baseline available

🤖 This PR was automatically generated by GitHub Actions
Run ID: 24839884545

CIQ Kernel Automation and others added 3 commits April 23, 2026 12:40
jira VULN-160251
cve CVE-2025-40168
commit-author Kuniyuki Iwashima <kuniyu@google.com>
commit 235f810

smc_clc_prfx_match() is called from smc_listen_work() and
not under RCU nor RTNL.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dst_dev_rcu().

Note that the returned value of smc_clc_prfx_match() is not
used in the caller.

Fixes: a046d57 ("smc: CLC handshake (incl. preparation steps)")
	Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
	Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250916214758.650211-4-kuniyu@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 235f810)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
jira VULN-176127
cve-pre CVE-2026-23204
commit-author Eric Dumazet <edumazet@google.com>
commit 13e00fd
upstream-diff |
	Adjusted context because skb_pointer_if_linear does not exist.
	Introduced in 6f5a630 ("bpf, net: Introduce skb_pointer_if_linear().")

This variant of skb_header_pointer() should be used in contexts
where @offset argument is user-controlled and could be negative.

Negative offsets are supported, as long as the zone starts
between skb->head and skb->data.

	Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260128141539.3404400-2-edumazet@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 13e00fd)
	Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
jira VULN-176127
cve CVE-2026-23204
commit-author Eric Dumazet <edumazet@google.com>
commit cabd1a9

skb_header_pointer() does not fully validate negative @offset values.

Use skb_header_pointer_careful() instead.

GangMin Kim provided a report and a repro fooling u32_classify():

BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0
net/sched/cls_u32.c:221

Fixes: fbc2e7d ("cls_u32: use skb_header_pointer() to dereference data safely")
	Reported-by: GangMin Kim <km.kim1503@gmail.com>
Closes: https://lore.kernel.org/netdev/CANn89iJkyUZ=mAzLzC4GdcAgLuPnUoivdLaOs6B9rq5_erj76w@mail.gmail.com/T/
	Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260128141539.3404400-3-edumazet@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit cabd1a9)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Apr 23, 2026
@github-actions

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/24848820709

@github-actions

Copy link
Copy Markdown

🔍 Interdiff Analysis

  • ⚠️ PR commit 49c0b7900d67 (net: add skb_header_pointer_careful() helper) → upstream 13e00fdc9236
    Differences found:
################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -4301,6 +4301,18 @@
 				    skb_headlen(skb), buffer);
 }
 
+/* Variant of skb_header_pointer() where @offset is user-controlled
+ * and potentially negative.
+ */
+static inline void * __must_check
+skb_header_pointer_careful(const struct sk_buff *skb, int offset,
+			   int len, void *buffer)
+{
+	if (unlikely(offset < 0 && -offset > skb_headroom(skb)))
+		return NULL;
+	return skb_header_pointer(skb, offset, len, buffer);
+}
+
 static inline void * __must_check
 skb_pointer_if_linear(const struct sk_buff *skb, int offset, int len)
 {

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -3687,6 +3687,6 @@
 				    skb_headlen(skb), buffer);
 }
 
-/**
- *	skb_needs_linearize - check if we need to linearize a given skb
- *			      depending on the given device features.
+static inline void * __must_check
+skb_pointer_if_linear(const struct sk_buff *skb, int offset, int len)
+{

This is an automated interdiff check for backported commits.

@github-actions

Copy link
Copy Markdown

Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/24848820709

@PlaidCat PlaidCat left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@PlaidCat PlaidCat requested a review from a team April 23, 2026 23:04

@bmastbergen bmastbergen left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@roxanan1996 roxanan1996 merged commit d841588 into ciqlts8_6 Apr 24, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Development

Successfully merging this pull request may close these issues.

3 participants