[rlc-9/5.14.0-611.54.1.el9_7] ptrace: slightly saner 'get_dumpable()' logic

[ciq-kernel-automation]

Local test

[rnicolescu@localhost rlc-9]$ git -C kernel-src-tree/ log -1 --format=%h
499ad3bc51cc
[rnicolescu@localhost rlc-9]$ uname -r
5.14.0-rnicolescu_rlc-9_5.14.0-611.54.1.el9_7_tmp-499ad3bc51+                                                 gcc -o dumpable_ptrace dumpable_ptrace.c && ./dumpable_ptracedumpable_ptrace.c && ./dumpable_ptrace
cc1: fatal error: dumpable_ptrace.c: No such file or directory
compilation terminated.
[rnicolescu@localhost rlc-9]$ gcc -o dumpable_ptrace dumpable_ptrace.c && ./dumpable_ptrace

=== ptrace dumpability bypass LPE (uid=1000 -> root) ===

[!] exploit did not land
[rnicolescu@localhost rlc-9]$ cd
dumpable_ptrace                 kernel-dist-git/
dumpable_ptrace.c               kernel-src-tree/
kernel-build-before.log         ssh-keysign-pwn/
kernel-build-without-fixes.log
[rnicolescu@localhost rlc-9]$ cd ssh-keysign-pwn/
[rnicolescu@localhost ssh-keysign-pwn]$ make
cc -O2 -Wall -o sshkeysign_pwn sshkeysign_pwn.c
cc -O2 -Wall -o chage_pwn chage_pwn.c
cc -O2 -Wall -o vuln_target vuln_target.c
cc -O2 -Wall -o exploit_vuln_target exploit_vuln_target.c
[rnicolescu@localhost ssh-keysign-pwn]$ ./sshkeysign_pwn
uid=1000  target=/usr/libexec/openssh/ssh-keysign
no hit in 500 rounds
[rnicolescu@localhost ssh-keysign-pwn]$ ./chage_pwn root
no hit in 500 rounds

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

ptrace: slightly saner 'get_dumpable()' logic

cve CVE-2026-46333
commit-author Linus Torvalds <torvalds@linux-foundation.org>
commit 31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a
upstream-diff |
	In order to avoid kabi breakage, user_dumpable is added in rh_reserved
	area in task_struct.

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	33m 42s	34m 40s
aarch64	19m 0s	19m 43s

• View build logs

✅ Boot Verification

• Status: Passed (all architectures)
• View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	206	46	rlc-9/5.14.0-611.54.1.el9_7	✅ No regressions
aarch64	153	47	rlc-9/5.14.0-611.54.1.el9_7	✅ No regressions

• View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1455	82	rlc-9/5.14.0-611.54.1.el9_7	❌ 1 regressions
aarch64	1429	82	rlc-9/5.14.0-611.54.1.el9_7	✅ No regressions

• View LTP logs

x86_64 regressions:

• cve-2017-5754 (PASS -> FAIL)

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 25937916392

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/25946480068

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit 7387288b360 (ptrace: slightly saner 'get_dumpable()' logic) → upstream 31e62c2ebbfd
  Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1581,8 +1581,6 @@
 	*/
 	RH_KABI_REPLACE_SPLIT(long rh_reserved[64],
 		int rh_kabi_dummy,   /* 0 */ /* Use this one first */
-		/* Save user-dumpable when mm goes away */
-		unsigned user_dumpable:1,
 	)
 
 	/*

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1002,6 +1002,9 @@
 	unsigned			sched_rt_mutex:1;
 #endif
 
+	/* Save user-dumpable when mm goes away */
+	unsigned			user_dumpable:1;
+
 	/* Bit to tell TOMOYO we're in execve(): */
 	unsigned			in_execve:1;
 	unsigned			in_iowait:1;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -999,6 +999,6 @@
-	*/
-	RH_KABI_REPLACE_SPLIT(long rh_reserved[64],
-		int rh_kabi_dummy,   /* 0 */ /* Use this one first */
-	)
+	unsigned			sched_rt_mutex:1;
+#endif
 
-	/*
+	/* Bit to tell TOMOYO we're in execve(): */
+	unsigned			in_execve:1;
+	unsigned			in_iowait:1;

This is an automated interdiff check for backported commits.

[github-actions]

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/25946480068