[ciqlts9_6] ptrace: slightly saner 'get_dumpable()' logic

[ciq-kernel-automation]

Local test

[rnicolescu@localhost lts-9.6_tmp_2]$ git -C kernel-src-tree/ log -1 --format=%h
4ad67ae61606
[rnicolescu@localhost lts-9.6_tmp_2]$ uname -r
5.14.0-rnicolescu_ciqlts9_6_tmp_2-4ad67ae61606+                                                                      gcc -o dumpable_ptrace dumpable_ptrace.c && ./dumpable_ptrace dumpable_ptrace.c && ./dumpable_ptrace

=== ptrace dumpability bypass LPE (uid=1000 -> root) ===

[!] exploit did not land
[rnicolescu@localhost lts-9.6_tmp_2]$ cd ssh-keysign-pwn/
[rnicolescu@localhost ssh-keysign-pwn]$ make
cc -O2 -Wall -o sshkeysign_pwn sshkeysign_pwn.c
cc -O2 -Wall -o chage_pwn chage_pwn.c
cc -O2 -Wall -o vuln_target vuln_target.c
cc -O2 -Wall -o exploit_vuln_target exploit_vuln_target.c
[rnicolescu@localhost ssh-keysign-pwn]$ ./sshkeysign_pwn
uid=1000  target=/usr/libexec/openssh/ssh-keysign

no hit in 500 rounds
[rnicolescu@localhost ssh-keysign-pwn]$
[rnicolescu@localhost ssh-keysign-pwn]$ ./chage_pwn root
no hit in 500 rounds

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

ptrace: slightly saner 'get_dumpable()' logic

jira VULN-185424
cve CVE-2026-46333
commit-author Linus Torvalds <torvalds@linux-foundation.org>
commit 31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a
upstream-diff |
	In order to avoid kabi breakage, user_dumpable is added in rh_reserved
	area in task_struct.

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	32m 50s	33m 44s
aarch64	19m 0s	19m 51s

• View build logs

✅ Boot Verification

• Status: Passed (all architectures)
• View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	207	42	ciqlts9_6	✅ No regressions
aarch64	152	47	ciqlts9_6	✅ No regressions

• View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1453	82	ciqlts9_6	✅ No regressions
aarch64	1426	83	ciqlts9_6	✅ No regressions

• View LTP logs

aarch64 newly passing:

• af_alg04 (FAIL -> PASS)
• fcntl14 (FAIL -> PASS)
• fcntl14_64 (FAIL -> PASS)
• fork14 (FAIL -> PASS)
• mmap16 (FAIL -> PASS)

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 25942796667

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/25949578073

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit 436c753196f (ptrace: slightly saner 'get_dumpable()' logic) → upstream 31e62c2ebbfd
  Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1563,8 +1563,6 @@
 	*/
 	RH_KABI_REPLACE_SPLIT(long rh_reserved[64],
 		int rh_kabi_dummy,   /* 0 */ /* Use this one first */
-		/* Save user-dumpable when mm goes away */
-		unsigned user_dumpable:1,
 	)
 
 	/*

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1002,6 +1002,9 @@
 	unsigned			sched_rt_mutex:1;
 #endif
 
+	/* Save user-dumpable when mm goes away */
+	unsigned			user_dumpable:1;
+
 	/* Bit to tell TOMOYO we're in execve(): */
 	unsigned			in_execve:1;
 	unsigned			in_iowait:1;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -999,6 +999,6 @@
-	*/
-	RH_KABI_REPLACE_SPLIT(long rh_reserved[64],
-		int rh_kabi_dummy,   /* 0 */ /* Use this one first */
-	)
+	unsigned			sched_rt_mutex:1;
+#endif
 
-	/*
+	/* Bit to tell TOMOYO we're in execve(): */
+	unsigned			in_execve:1;
+	unsigned			in_iowait:1;

This is an automated interdiff check for backported commits.

[github-actions]

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/25949578073