[rlc-9/5.14.0-611.54.1.el9_7] Multiple patches tested (2 commits) by ciq-kernel-automation[bot] · Pull Request #1264 · ctrliq/kernel-src-tree

ciq-kernel-automation · 2026-05-25T13:21:03Z

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

net: gro: don't merge zcopy skbs

cve CVE-Pending
commit-author Sabrina Dubroca <sd@queasysnail.net>
commit 4db79a322db8c97f7b73b8a347395ef4d685eb40
upstream-diff |
  Context conflict in net/core/gro.c: 5.14 uses a local gro_max_size
  variable lookup instead of upstream's netif_get_gro_max_size() helper.
  The skb_zcopy() check was added at the same location, before the
  gro_max_size lookup. Functionally identical to upstream.

smb: client: reject userspace cifs.spnego descriptions

cve CVE-Pending
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 3da1fdf4efbc490041eb4f836bf596201203f8f2

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	33m 32s	34m 38s
aarch64	18m 45s	19m 26s

View build logs

✅ Boot Verification

Status: Passed (all architectures)
View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	205	47	rlc-9/5.14.0-611.54.1.el9_7	✅ No regressions
aarch64	151	49	rlc-9/5.14.0-611.54.1.el9_7	✅ No regressions

View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1456	81	rlc-9/5.14.0-611.54.1.el9_7	✅ No regressions
aarch64	1429	82	rlc-9/5.14.0-611.54.1.el9_7	✅ No regressions

View LTP logs

🤖 This PR was automatically generated by GitHub Actions
Run ID: 26462592898

github-actions · 2026-05-25T13:29:39Z

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/26402992586

github-actions · 2026-05-25T13:29:40Z

🔍 Interdiff Analysis

⚠️ PR commit 2736c288f91 (net: gro: don't merge zcopy skbs) → upstream 4db79a322db8
Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -109,6 +109,9 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
+	if (skb_zcopy(p) || skb_zcopy(skb))
+		return -ETOOMANYREFS;
+
 	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
 		     NAPI_GRO_CB(skb)->flush))
 		return -E2BIG;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -106,6 +106,6 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
-	/* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */
-	gro_max_size = p->protocol == htons(ETH_P_IPV6) ?
-			READ_ONCE(p->dev->gro_max_size) :
+	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
+		     NAPI_GRO_CB(skb)->flush))
+		return -E2BIG;

This is an automated interdiff check for backported commits.

github-actions · 2026-05-25T13:31:12Z

JIRA PR Check Results

1 commit(s) with issues found:

Commit `2736c288f91f`

Summary: net: gro: don't merge zcopy skbs

❌ Errors:

VULN-: Failed to retrieve ticket: JiraError HTTP 404 url: https://ciqinc.atlassian.net/rest/api/2/issue/VULN-
text: Issue does not exist or you do not have permission to see it.

response headers = {'Content-Type': 'application/json;charset=UTF-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Date': 'Mon, 25 May 2026 13:31:11 GMT', 'Server': 'AtlassianEdge', 'Timing-Allow-Origin': '*', 'X-Arequestid': '32fadd8313a8113cf69da3aaa8047682', 'X-Aaccountid': '712020%3A43f5a558-0b78-4cc1-ad9e-a61d9b0317de', 'Cache-Control': 'no-cache, no-store, no-transform', 'Ratelimit-Policy': '"jira-burst-based";q=150;w=1', 'Ratelimit': '"jira-burst-based";r=399;t=1', 'X-Ratelimit-Limit': '400', 'X-Ratelimit-Remaining': '399', 'Content-Encoding': 'gzip', 'X-Content-Type-Options': 'nosniff', 'X-Xss-Protection': '1; mode=block', 'Atl-Traceid': 'fe665baf96d24157a74a3a98e97dd1e3', 'Atl-Request-Id': 'fe665baf-96d2-4157-a74a-3a98e97dd1e3', 'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload', 'Report-To': '{"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}', 'Nel': '{"failure_fraction": 0.01, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}', 'Server-Timing': 'atl-edge;dur=60,atl-edge-internal;dur=14,atl-edge-upstream;dur=45,atl-edge-pop;desc="aws-us-west-2"', 'X-Cache': 'Error from cloudfront', 'Via': '1.1 3dde68f1f52282c9e1ee336d97233b0a.cloudfront.net (CloudFront)', 'X-Amz-Cf-Pop': 'SFO5-P2', 'X-Amz-Cf-Id': 'ZGikYG6avEzKHMxAKz_brYiJUZlSMrnuXN6oaAmypYROzpyYTkPowQ=='}
response text = {"errorMessages":["Issue does not exist or you do not have permission to see it."],"errors":{}}

Summary: Checked 1 commit(s) total.

github-actions · 2026-05-25T13:31:13Z

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/26402992586

github-actions · 2026-05-26T08:53:50Z

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/26442441037

github-actions · 2026-05-26T08:53:51Z

🔍 Interdiff Analysis

⚠️ PR commit 2736c288f91 (net: gro: don't merge zcopy skbs) → upstream 4db79a322db8
Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -109,6 +109,9 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
+	if (skb_zcopy(p) || skb_zcopy(skb))
+		return -ETOOMANYREFS;
+
 	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
 		     NAPI_GRO_CB(skb)->flush))
 		return -E2BIG;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -106,6 +106,6 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
-	/* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */
-	gro_max_size = p->protocol == htons(ETH_P_IPV6) ?
-			READ_ONCE(p->dev->gro_max_size) :
+	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
+		     NAPI_GRO_CB(skb)->flush))
+		return -E2BIG;

This is an automated interdiff check for backported commits.

github-actions · 2026-05-26T08:55:28Z

JIRA PR Check Results

2 commit(s) with issues found:

Commit `858a0f020898`

Summary: smb: client: reject userspace cifs.spnego descriptions

❌ Errors:

VULN-: Failed to retrieve ticket: JiraError HTTP 404 url: https://ciqinc.atlassian.net/rest/api/2/issue/VULN-
text: Issue does not exist or you do not have permission to see it.

response headers = {'Content-Type': 'application/json;charset=UTF-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Date': 'Tue, 26 May 2026 08:55:27 GMT', 'Server': 'AtlassianEdge', 'Timing-Allow-Origin': '*', 'X-Arequestid': '003c6c3e2befafcb9f610d0076e54cf9', 'X-Aaccountid': '712020%3A43f5a558-0b78-4cc1-ad9e-a61d9b0317de', 'Cache-Control': 'no-cache, no-store, no-transform', 'Ratelimit-Policy': '"jira-burst-based";q=150;w=1', 'Ratelimit': '"jira-burst-based";r=399;t=1', 'X-Ratelimit-Limit': '400', 'X-Ratelimit-Remaining': '399', 'Content-Encoding': 'gzip', 'X-Content-Type-Options': 'nosniff', 'X-Xss-Protection': '1; mode=block', 'Atl-Traceid': 'e5beddb94586465c8490ebf4b6292796', 'Atl-Request-Id': 'e5beddb9-4586-465c-8490-ebf4b6292796', 'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload', 'Report-To': '{"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}', 'Nel': '{"failure_fraction": 0.01, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}', 'Server-Timing': 'atl-edge;dur=62,atl-edge-internal;dur=13,atl-edge-upstream;dur=49,atl-edge-pop;desc="aws-us-west-2"', 'X-Cache': 'Error from cloudfront', 'Via': '1.1 0a207be11cfd2d90fff9212d2a692a7e.cloudfront.net (CloudFront)', 'X-Amz-Cf-Pop': 'IAD61-P9', 'X-Amz-Cf-Id': '2k10fcBQuDURCslac8Maj2ZUsOQJRBCczfWEmLxoZHcL2UJah0Ls4g=='}
response text = {"errorMessages":["Issue does not exist or you do not have permission to see it."],"errors":{}}

Commit `2736c288f91f`

Summary: net: gro: don't merge zcopy skbs

❌ Errors:

VULN-: Failed to retrieve ticket: JiraError HTTP 404 url: https://ciqinc.atlassian.net/rest/api/2/issue/VULN-
text: Issue does not exist or you do not have permission to see it.

response headers = {'Content-Type': 'application/json;charset=UTF-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Date': 'Tue, 26 May 2026 08:55:27 GMT', 'Server': 'AtlassianEdge', 'Timing-Allow-Origin': '*', 'X-Arequestid': '8decdd99b2eb180f32111beee493bc97', 'X-Aaccountid': '712020%3A43f5a558-0b78-4cc1-ad9e-a61d9b0317de', 'Cache-Control': 'no-cache, no-store, no-transform', 'Ratelimit-Policy': '"jira-burst-based";q=150;w=1', 'Ratelimit': '"jira-burst-based";r=398;t=1', 'X-Ratelimit-Limit': '400', 'X-Ratelimit-Remaining': '398', 'Content-Encoding': 'gzip', 'X-Content-Type-Options': 'nosniff', 'X-Xss-Protection': '1; mode=block', 'Atl-Traceid': 'a30234d8eb8b489384e52a35e5908604', 'Atl-Request-Id': 'a30234d8-eb8b-4893-84e5-2a35e5908604', 'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload', 'Report-To': '{"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}', 'Nel': '{"failure_fraction": 0.01, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}', 'Server-Timing': 'atl-edge;dur=64,atl-edge-internal;dur=14,atl-edge-upstream;dur=50,atl-edge-pop;desc="aws-us-west-2"', 'X-Cache': 'Error from cloudfront', 'Via': '1.1 0a207be11cfd2d90fff9212d2a692a7e.cloudfront.net (CloudFront)', 'X-Amz-Cf-Pop': 'IAD61-P9', 'X-Amz-Cf-Id': 'GVSP8tTbG7FdJnb--ZjDzzDZKgAhwbVnIjAp9bXFRL2pTc-0ZXj8Kw=='}
response text = {"errorMessages":["Issue does not exist or you do not have permission to see it."],"errors":{}}

Summary: Checked 2 commit(s) total.

github-actions · 2026-05-26T08:55:29Z

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/26442441037

cve CVE-Pending commit-author Sabrina Dubroca <sd@queasysnail.net> commit 4db79a3 upstream-diff | Context conflict in net/core/gro.c: 5.14 uses a local gro_max_size variable lookup instead of upstream's netif_get_gro_max_size() helper. The skb_zcopy() check was added at the same location, before the gro_max_size lookup. Functionally identical to upstream. skb_gro_receive() can currently copy frags between the source and GRO skb, without checking the zerocopy status, and in particular the SKBFL_MANAGED_FRAG_REFS flag. When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference on the pages in shinfo->frags. Appending those frags to another skb's frags without fixing up the page refcount can lead to UAF. When either the last skb in the GRO chain (the one we would append frags to) or the source skb is zerocopy, don't merge the skbs. Fixes: 753f1ca ("net: introduce managed frags infrastructure") Reported-by: Huzaifa Sidhpurwala <huzaifas@redhat.com> Signed-off-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/c3b7f906bbfcbdfd7b4fa9d6c18a438870df85be.1779307748.git.sd@queasysnail.net Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Shreeya Patel <spatel@ciq.com>

cve CVE-Pending commit-author Asim Viladi Oglu Manizada <manizada@pm.me> commit 3da1fdf cifs.spnego key descriptions contain authority-bearing fields such as pid, uid, creduid, and upcall_target that cifs.upcall treats as kernel-originating inputs. However, userspace can also create keys of this type through request_key(2) or add_key(2), allowing those fields to be supplied without CIFS origin. Only accept cifs.spnego descriptions while CIFS is using its private spnego_cred to request the key. Fixes: f1d662a ("[CIFS] Add upcall files for cifs to use spnego/kerberos") Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix Reviewed-by: David Howells <dhowells@redhat.com> Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me> Signed-off-by: Steve French <stfrench@microsoft.com> Signed-off-by: Shreeya Patel <spatel@ciq.com>

github-actions · 2026-05-26T17:03:50Z

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/26462996457

github-actions · 2026-05-26T17:03:51Z

🔍 Interdiff Analysis

⚠️ PR commit ad70f99c554 (net: gro: don't merge zcopy skbs) → upstream 4db79a322db8
Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -109,6 +109,9 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
+	if (skb_zcopy(p) || skb_zcopy(skb))
+		return -ETOOMANYREFS;
+
 	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
 		     NAPI_GRO_CB(skb)->flush))
 		return -E2BIG;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -106,6 +106,6 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
-	/* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */
-	gro_max_size = p->protocol == htons(ETH_P_IPV6) ?
-			READ_ONCE(p->dev->gro_max_size) :
+	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
+		     NAPI_GRO_CB(skb)->flush))
+		return -E2BIG;

This is an automated interdiff check for backported commits.

github-actions · 2026-05-26T17:05:23Z

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/26462996457

bmastbergen

🥌

ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label May 25, 2026

ciq-kernel-automation Bot changed the title ~~[rlc-9/5.14.0-611.54.1.el9_7] net: gro: don't merge zcopy skbs~~ [rlc-9/5.14.0-611.54.1.el9_7] Multiple patches tested (2 commits) May 26, 2026

qsn and others added 2 commits May 26, 2026 12:54

bmastbergen force-pushed the {shreeya_gro_uaf}_rlc-9/5.14.0-611.54.1.el9_7 branch from 858a0f0 to 7c41ef4 Compare May 26, 2026 16:55

bmastbergen approved these changes May 26, 2026

View reviewed changes

bmastbergen requested a review from a team May 26, 2026 17:40

shreeya-patel98 approved these changes May 26, 2026

View reviewed changes

bmastbergen merged commit 2ededa2 into rlc-9/5.14.0-611.54.1.el9_7 May 26, 2026
6 checks passed

bmastbergen deleted the {shreeya_gro_uaf}_rlc-9/5.14.0-611.54.1.el9_7 branch May 26, 2026 18:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[rlc-9/5.14.0-611.54.1.el9_7] Multiple patches tested (2 commits)#1264

[rlc-9/5.14.0-611.54.1.el9_7] Multiple patches tested (2 commits)#1264
bmastbergen merged 2 commits into
rlc-9/5.14.0-611.54.1.el9_7from
{shreeya_gro_uaf}_rlc-9/5.14.0-611.54.1.el9_7

ciq-kernel-automation Bot commented May 25, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

bmastbergen left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

ciq-kernel-automation Bot commented May 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Commit Message(s)

Test Results

✅ Build Stage

✅ Boot Verification

✅ Kernel Selftests

✅ LTP Results

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 25, 2026

🔍 Interdiff Analysis

Uh oh!

github-actions Bot commented May 25, 2026

JIRA PR Check Results

Commit 2736c288f91f

Uh oh!

github-actions Bot commented May 25, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

🔍 Interdiff Analysis

Uh oh!

github-actions Bot commented May 26, 2026

JIRA PR Check Results

Commit 858a0f020898

Commit 2736c288f91f

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

github-actions Bot commented May 26, 2026

🔍 Interdiff Analysis

Uh oh!

github-actions Bot commented May 26, 2026

Uh oh!

bmastbergen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

ciq-kernel-automation Bot commented May 25, 2026 •

edited

Loading

Commit `2736c288f91f`

Commit `858a0f020898`

Commit `2736c288f91f`