Skip to content

[ciqlts9_4] Multiple patches tested (2 commits)#1220

Merged
bmastbergen merged 2 commits into
ciqlts9_4from
{ciq_kernel_automation}_ciqlts9_4
May 14, 2026
Merged

[ciqlts9_4] Multiple patches tested (2 commits)#1220
bmastbergen merged 2 commits into
ciqlts9_4from
{ciq_kernel_automation}_ciqlts9_4

Conversation

@ciq-kernel-automation

@ciq-kernel-automation ciq-kernel-automation Bot commented May 13, 2026

Copy link
Copy Markdown

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE

jira VULN-180396
cve CVE-2026-23401
commit-author Sean Christopherson <seanjc@google.com>
commit aad885e774966e97b675dfe928da164214a71605

can: raw: fix ro->uniq use-after-free in raw_rcv()

jira VULN-182365
cve CVE-2026-31532
commit-author Samuel Page <sam@bynar.io>
commit a535a9217ca3f2fccedaafb2fddb4c48f27d36dc

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 28m 24s 29m 15s
aarch64 21m 18s 22m 5s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 187 30 ciqlts9_4 ✅ No regressions
aarch64 142 33 ciqlts9_4 ✅ No regressions

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 1447 81 ciqlts9_4 ✅ No regressions
aarch64 1418 82 ciqlts9_4 ✅ No regressions

🤖 This PR was automatically generated by GitHub Actions
Run ID: 25785294523

CIQ Kernel Automation added 2 commits May 13, 2026 07:34
KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MM…
7ff5329 
…IO SPTE

jira VULN-180396
cve CVE-2026-23401
commit-author Sean Christopherson <seanjc@google.com>
commit aad885e

When installing an emulated MMIO SPTE, do so *after* dropping/zapping the
existing SPTE (if it's shadow-present).  While commit a54aa15 was
right about it being impossible to convert a shadow-present SPTE to an
MMIO SPTE due to a _guest_ write, it failed to account for writes to guest
memory that are outside the scope of KVM.

E.g. if host userspace modifies a shadowed gPTE to switch from a memslot
to emulted MMIO and then the guest hits a relevant page fault, KVM will
install the MMIO SPTE without first zapping the shadow-present SPTE.

  ------------[ cut here ]------------
  is_shadow_present_pte(*sptep)
  WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292
  Modules linked in: kvm_intel kvm irqbypass
  CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm]
  Call Trace:
   <TASK>
   mmu_set_spte+0x237/0x440 [kvm]
   ept_page_fault+0x535/0x7f0 [kvm]
   kvm_mmu_do_page_fault+0xee/0x1f0 [kvm]
   kvm_mmu_page_fault+0x8d/0x620 [kvm]
   vmx_handle_exit+0x18c/0x5a0 [kvm_intel]
   kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm]
   kvm_vcpu_ioctl+0x2d5/0x980 [kvm]
   __x64_sys_ioctl+0x8a/0xd0
   do_syscall_64+0xb5/0x730
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
  RIP: 0033:0x47fa3f
   </TASK>
  ---[ end trace 0000000000000000 ]---

	Reported-by: Alexander Bulekov <bkov@amazon.com>
	Debugged-by: Alexander Bulekov <bkov@amazon.com>
	Suggested-by: Fred Griffoul <fgriffo@amazon.co.uk>
Fixes: a54aa15 ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()")
	Cc: stable@vger.kernel.org
	Signed-off-by: Sean Christopherson <seanjc@google.com>
(cherry picked from commit aad885e)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
can: raw: fix ro->uniq use-after-free in raw_rcv()
838993e 
jira VULN-182365
cve CVE-2026-31532
commit-author Samuel Page <sam@bynar.io>
commit a535a92

raw_release() unregisters raw CAN receive filters via can_rx_unregister(),
but receiver deletion is deferred with call_rcu(). This leaves a window
where raw_rcv() may still be running in an RCU read-side critical section
after raw_release() frees ro->uniq, leading to a use-after-free of the
percpu uniq storage.

Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific
socket destructor. can_rx_unregister() takes an extra reference to the
socket and only drops it from the RCU callback, so freeing uniq from
sk_destruct ensures the percpu area is not released until the relevant
callbacks have drained.

Fixes: 514ac99 ("can: fix multiple delivery of a single CAN frame for overlapping CAN filters")
	Cc: stable@vger.kernel.org # v4.1+
Assisted-by: Bynario AI
	Signed-off-by: Samuel Page <sam@bynar.io>
Link: https://patch.msgid.link/26ec626d-cae7-4418-9782-7198864d070c@bynar.io
	Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
[mkl: applied manually]
	Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
(cherry picked from commit a535a92)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label May 13, 2026
@github-actions

github-actions Bot commented May 13, 2026

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/25797421564

@github-actions

github-actions Bot commented May 13, 2026

Copy link
Copy Markdown

🔍 Interdiff Analysis

  • ⚠️ PR commit 7ff53297072 (KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE) → upstream aad885e77496
    Differences found:
================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -2931,5 +3051,5 @@
 	}
 
 	if (is_shadow_present_pte(*sptep)) {
-		/*
-		 * If we overwrite a PTE page pointer with a 2MB PMD, unlink
+		if (prefetch && is_last_spte(*sptep, level) &&
+		    pfn == spte_to_pfn(*sptep))
@@ -2952,3 +3076,3 @@
 	wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch,
-			   true, host_writable, &spte);
+			   false, host_writable, &spte);
  • ⚠️ PR commit 838993e672b (can: raw: fix ro->uniq use-after-free in raw_rcv()) → upstream a535a9217ca3
    Differences found:
================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/can/raw.c
+++ b/net/can/raw.c
@@ -400,4 +433,5 @@
 	ro->bound = 0;
+	ro->dev = NULL;
 	ro->count = 0;
 	free_percpu(ro->uniq);

This is an automated interdiff check for backported commits.

@github-actions

github-actions Bot commented May 13, 2026

Copy link
Copy Markdown

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/25797421564

@roxanan1996 roxanan1996 requested a review from a team May 13, 2026 14:03
@bmastbergen bmastbergen self-requested a review May 13, 2026 14:23
bmastbergen
bmastbergen approved these changes May 13, 2026
View reviewed changes

@bmastbergen bmastbergen left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@bmastbergen bmastbergen merged commit 42f6438 into ciqlts9_4 May 14, 2026
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@roxanan1996 roxanan1996 roxanan1996 approved these changes
@bmastbergen bmastbergen bmastbergen approved these changes

Assignees

No one assigned

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@roxanan1996 @bmastbergen