Skip to content

[ciqlts9_6] Multiple patches tested (2 commits)#1265

Merged
bmastbergen merged 2 commits into
ciqlts9_6from
{shreeya_gro_uaf}_ciqlts9_6
May 26, 2026
Merged

[ciqlts9_6] Multiple patches tested (2 commits)#1265
bmastbergen merged 2 commits into
ciqlts9_6from
{shreeya_gro_uaf}_ciqlts9_6

Conversation

@ciq-kernel-automation

@ciq-kernel-automation ciq-kernel-automation Bot commented May 25, 2026

Copy link
Copy Markdown

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

net: gro: don't merge zcopy skbs

cve CVE-Pending
commit-author Sabrina Dubroca <sd@queasysnail.net>
commit 4db79a322db8c97f7b73b8a347395ef4d685eb40
upstream-diff |
  Context conflict in net/core/gro.c: 5.14 uses a local gro_max_size
  variable lookup instead of upstream's netif_get_gro_max_size() helper.
  The skb_zcopy() check was added at the same location, before the
  gro_max_size lookup. Functionally identical to upstream.
smb: client: reject userspace cifs.spnego descriptions

cve CVE-Pending
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 3da1fdf4efbc490041eb4f836bf596201203f8f2

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 33m 0s 33m 57s
aarch64 18m 29s 19m 15s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 207 42 ciqlts9_6 ✅ No regressions
aarch64 155 44 ciqlts9_6 ✅ No regressions

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 1452 83 ciqlts9_6 ❌ 1 regressions
aarch64 1426 83 ciqlts9_6 ✅ No regressions

x86_64 regressions:

  • cve-2017-5754 (PASS -> FAIL)

🤖 This PR was automatically generated by GitHub Actions
Run ID: 26462465739

@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label May 25, 2026
@github-actions

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/26403237520

@github-actions

Copy link
Copy Markdown

🔍 Interdiff Analysis

  • ⚠️ PR commit 3aabf55f1f4 (net: gro: don't merge zcopy skbs) → upstream 4db79a322db8
    Differences found:
################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -109,6 +109,9 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
+	if (skb_zcopy(p) || skb_zcopy(skb))
+		return -ETOOMANYREFS;
+
 	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
 		     NAPI_GRO_CB(skb)->flush))
 		return -E2BIG;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -106,6 +106,6 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
-	/* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */
-	gro_max_size = p->protocol == htons(ETH_P_IPV6) ?
-			READ_ONCE(p->dev->gro_max_size) :
+	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
+		     NAPI_GRO_CB(skb)->flush))
+		return -E2BIG;

This is an automated interdiff check for backported commits.

@github-actions

Copy link
Copy Markdown

JIRA PR Check Results

1 commit(s) with issues found:

Commit 3aabf55f1f4e

Summary: net: gro: don't merge zcopy skbs

❌ Errors:

  • VULN-: Failed to retrieve ticket: JiraError HTTP 404 url: https://ciqinc.atlassian.net/rest/api/2/issue/VULN-
    text: Issue does not exist or you do not have permission to see it.

    response headers = {'Content-Type': 'application/json;charset=UTF-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Date': 'Mon, 25 May 2026 13:36:58 GMT', 'Server': 'AtlassianEdge', 'Timing-Allow-Origin': '*', 'X-Arequestid': '52956599c98775b33437066faf1cfac9', 'X-Aaccountid': '712020%3A43f5a558-0b78-4cc1-ad9e-a61d9b0317de', 'Cache-Control': 'no-cache, no-store, no-transform', 'Ratelimit-Policy': '"jira-burst-based";q=150;w=1', 'Ratelimit': '"jira-burst-based";r=399;t=1', 'X-Ratelimit-Limit': '400', 'X-Ratelimit-Remaining': '399', 'Content-Encoding': 'gzip', 'X-Content-Type-Options': 'nosniff', 'X-Xss-Protection': '1; mode=block', 'Atl-Traceid': '42ea24be063a4771b12f7e96c068a9da', 'Atl-Request-Id': '42ea24be-063a-4771-b12f-7e96c068a9da', 'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload', 'Report-To': '{"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}', 'Nel': '{"failure_fraction": 0.01, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}', 'Server-Timing': 'atl-edge;dur=63,atl-edge-internal;dur=13,atl-edge-upstream;dur=50,atl-edge-pop;desc="aws-us-west-2"', 'X-Cache': 'Error from cloudfront', 'Via': '1.1 0dc4feb22bb4657ce2bb95fd05ec7122.cloudfront.net (CloudFront)', 'X-Amz-Cf-Pop': 'SFO5-P2', 'X-Amz-Cf-Id': 'K__CNbVkgBCouS1NXmF7x4D0tcciLO_FT5Kih0uyPgrsaMryMnCqJw=='}
    response text = {"errorMessages":["Issue does not exist or you do not have permission to see it."],"errors":{}}


Summary: Checked 1 commit(s) total.

@github-actions

Copy link
Copy Markdown

Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/26403237520

@github-actions

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/26442308470

@github-actions

Copy link
Copy Markdown

🔍 Interdiff Analysis

  • ⚠️ PR commit 3aabf55f1f4 (net: gro: don't merge zcopy skbs) → upstream 4db79a322db8
    Differences found:
################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -109,6 +109,9 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
+	if (skb_zcopy(p) || skb_zcopy(skb))
+		return -ETOOMANYREFS;
+
 	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
 		     NAPI_GRO_CB(skb)->flush))
 		return -E2BIG;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -106,6 +106,6 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
-	/* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */
-	gro_max_size = p->protocol == htons(ETH_P_IPV6) ?
-			READ_ONCE(p->dev->gro_max_size) :
+	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
+		     NAPI_GRO_CB(skb)->flush))
+		return -E2BIG;

This is an automated interdiff check for backported commits.

@github-actions

Copy link
Copy Markdown

JIRA PR Check Results

2 commit(s) with issues found:

Commit e5c97693a539

Summary: smb: client: reject userspace cifs.spnego descriptions

❌ Errors:

  • VULN-: Failed to retrieve ticket: JiraError HTTP 404 url: https://ciqinc.atlassian.net/rest/api/2/issue/VULN-
    text: Issue does not exist or you do not have permission to see it.

    response headers = {'Content-Type': 'application/json;charset=UTF-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Date': 'Tue, 26 May 2026 08:52:41 GMT', 'Server': 'AtlassianEdge', 'Timing-Allow-Origin': '*', 'X-Arequestid': '457c36077daff7ae49bd7e2bcadefffa', 'X-Aaccountid': '712020%3A43f5a558-0b78-4cc1-ad9e-a61d9b0317de', 'Cache-Control': 'no-cache, no-store, no-transform', 'Ratelimit-Policy': '"jira-burst-based";q=150;w=1', 'Ratelimit': '"jira-burst-based";r=399;t=1', 'X-Ratelimit-Limit': '400', 'X-Ratelimit-Remaining': '399', 'Content-Encoding': 'gzip', 'X-Content-Type-Options': 'nosniff', 'X-Xss-Protection': '1; mode=block', 'Atl-Traceid': '3b99670bcec447be9cb1940d8d6cd3d0', 'Atl-Request-Id': '3b99670b-cec4-47be-9cb1-940d8d6cd3d0', 'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload', 'Report-To': '{"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}', 'Nel': '{"failure_fraction": 0.01, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}', 'Server-Timing': 'atl-edge;dur=69,atl-edge-internal;dur=14,atl-edge-upstream;dur=55,atl-edge-pop;desc="aws-us-west-2"', 'X-Cache': 'Error from cloudfront', 'Via': '1.1 b64148f9fd3bae4c4335d0ca96ecbf92.cloudfront.net (CloudFront)', 'X-Amz-Cf-Pop': 'DFW56-P6', 'X-Amz-Cf-Id': 'yjS5s4J9aQ5t6kIF0-m5vrxNDV1-bQk0uiJpc8kVJrif4Fs6-bk__A=='}
    response text = {"errorMessages":["Issue does not exist or you do not have permission to see it."],"errors":{}}

Commit 3aabf55f1f4e

Summary: net: gro: don't merge zcopy skbs

❌ Errors:

  • VULN-: Failed to retrieve ticket: JiraError HTTP 404 url: https://ciqinc.atlassian.net/rest/api/2/issue/VULN-
    text: Issue does not exist or you do not have permission to see it.

    response headers = {'Content-Type': 'application/json;charset=UTF-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Date': 'Tue, 26 May 2026 08:52:41 GMT', 'Server': 'AtlassianEdge', 'Timing-Allow-Origin': '*', 'X-Arequestid': '1c13dbb681486e788f8d1f5697491da3', 'X-Aaccountid': '712020%3A43f5a558-0b78-4cc1-ad9e-a61d9b0317de', 'Cache-Control': 'no-cache, no-store, no-transform', 'Ratelimit-Policy': '"jira-burst-based";q=150;w=1', 'Ratelimit': '"jira-burst-based";r=398;t=1', 'X-Ratelimit-Limit': '400', 'X-Ratelimit-Remaining': '398', 'Content-Encoding': 'gzip', 'X-Content-Type-Options': 'nosniff', 'X-Xss-Protection': '1; mode=block', 'Atl-Traceid': '0708623a3fa9485f80d1fc47baa81293', 'Atl-Request-Id': '0708623a-3fa9-485f-80d1-fc47baa81293', 'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload', 'Report-To': '{"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}', 'Nel': '{"failure_fraction": 0.01, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}', 'Server-Timing': 'atl-edge;dur=60,atl-edge-internal;dur=13,atl-edge-upstream;dur=47,atl-edge-pop;desc="aws-us-west-2"', 'X-Cache': 'Error from cloudfront', 'Via': '1.1 b64148f9fd3bae4c4335d0ca96ecbf92.cloudfront.net (CloudFront)', 'X-Amz-Cf-Pop': 'DFW56-P6', 'X-Amz-Cf-Id': 'D_VLKobWSE60IykJRNLwEGjw83bxbkkuVvx00fCVvYaRXcj6a0wQZQ=='}
    response text = {"errorMessages":["Issue does not exist or you do not have permission to see it."],"errors":{}}


Summary: Checked 2 commit(s) total.

@github-actions

Copy link
Copy Markdown

Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/26442308470

@shreeya-patel98 shreeya-patel98 force-pushed the {shreeya_gro_uaf}_ciqlts9_6 branch from e5c9769 to c14184c Compare May 26, 2026 13:39
@github-actions

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/26452045138

@github-actions

Copy link
Copy Markdown

🔍 Interdiff Analysis

  • ⚠️ PR commit 3aabf55f1f4 (net: gro: don't merge zcopy skbs) → upstream 4db79a322db8
    Differences found:
################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -109,6 +109,9 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
+	if (skb_zcopy(p) || skb_zcopy(skb))
+		return -ETOOMANYREFS;
+
 	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
 		     NAPI_GRO_CB(skb)->flush))
 		return -E2BIG;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -106,6 +106,6 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
-	/* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */
-	gro_max_size = p->protocol == htons(ETH_P_IPV6) ?
-			READ_ONCE(p->dev->gro_max_size) :
+	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
+		     NAPI_GRO_CB(skb)->flush))
+		return -E2BIG;

This is an automated interdiff check for backported commits.

@github-actions

Copy link
Copy Markdown

JIRA PR Check Results

1 commit(s) with issues found:

Commit 3aabf55f1f4e

Summary: net: gro: don't merge zcopy skbs

❌ Errors:

  • VULN-: Failed to retrieve ticket: JiraError HTTP 404 url: https://ciqinc.atlassian.net/rest/api/2/issue/VULN-
    text: Issue does not exist or you do not have permission to see it.

    response headers = {'Content-Type': 'application/json;charset=UTF-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Date': 'Tue, 26 May 2026 13:49:05 GMT', 'Server': 'AtlassianEdge', 'Timing-Allow-Origin': '*', 'X-Arequestid': '8458d1589ed208cc4ac8a767ae9f55e5', 'X-Aaccountid': '712020%3A43f5a558-0b78-4cc1-ad9e-a61d9b0317de', 'Cache-Control': 'no-cache, no-store, no-transform', 'Ratelimit-Policy': '"jira-burst-based";q=150;w=1', 'Ratelimit': '"jira-burst-based";r=399;t=1', 'X-Ratelimit-Limit': '400', 'X-Ratelimit-Remaining': '399', 'Content-Encoding': 'gzip', 'X-Content-Type-Options': 'nosniff', 'X-Xss-Protection': '1; mode=block', 'Atl-Traceid': 'ed30ad37be664d1b8c3279b0dbd6c3b5', 'Atl-Request-Id': 'ed30ad37-be66-4d1b-8c32-79b0dbd6c3b5', 'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload', 'Report-To': '{"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}', 'Nel': '{"failure_fraction": 0.01, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}', 'Server-Timing': 'atl-edge;dur=53,atl-edge-internal;dur=13,atl-edge-upstream;dur=39,atl-edge-pop;desc="aws-us-west-2"', 'X-Cache': 'Error from cloudfront', 'Via': '1.1 b808d6c4f695daffb0238c2dbdae5c3e.cloudfront.net (CloudFront)', 'X-Amz-Cf-Pop': 'ORD58-P6', 'X-Amz-Cf-Id': '9japrkHrJHzipDuIS-bbhs1RztnPG4jjxR8YmyQ9BUbKpDba_OR-VA=='}
    response text = {"errorMessages":["Issue does not exist or you do not have permission to see it."],"errors":{}}


Summary: Checked 2 commit(s) total.

@github-actions

Copy link
Copy Markdown

Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/26452045138

@ciq-kernel-automation ciq-kernel-automation Bot changed the title [ciqlts9_6] net: gro: don't merge zcopy skbs [ciqlts9_6] Multiple patches tested (2 commits) May 26, 2026
qsn and others added 2 commits May 26, 2026 12:50
cve CVE-Pending
commit-author Sabrina Dubroca <sd@queasysnail.net>
commit 4db79a3
upstream-diff |
  Context conflict in net/core/gro.c: 5.14 uses a local gro_max_size
  variable lookup instead of upstream's netif_get_gro_max_size() helper.
  The skb_zcopy() check was added at the same location, before the
  gro_max_size lookup. Functionally identical to upstream.

skb_gro_receive() can currently copy frags between the source and GRO
skb, without checking the zerocopy status, and in particular the
SKBFL_MANAGED_FRAG_REFS flag.

When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference
on the pages in shinfo->frags. Appending those frags to another skb's
frags without fixing up the page refcount can lead to UAF.

When either the last skb in the GRO chain (the one we would append
frags to) or the source skb is zerocopy, don't merge the skbs.

Fixes: 753f1ca ("net: introduce managed frags infrastructure")
Reported-by: Huzaifa Sidhpurwala <huzaifas@redhat.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/c3b7f906bbfcbdfd7b4fa9d6c18a438870df85be.1779307748.git.sd@queasysnail.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Shreeya Patel <spatel@ciq.com>
cve CVE-Pending
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 3da1fdf

cifs.spnego key descriptions contain authority-bearing fields such as
pid, uid, creduid, and upcall_target that cifs.upcall treats as
kernel-originating inputs. However, userspace can also create keys of
this type through request_key(2) or add_key(2), allowing those fields to
be supplied without CIFS origin.

Only accept cifs.spnego descriptions while CIFS is using its private
spnego_cred to request the key.

Fixes: f1d662a ("[CIFS] Add upcall files for cifs to use spnego/kerberos")
Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Shreeya Patel <spatel@ciq.com>
@bmastbergen bmastbergen force-pushed the {shreeya_gro_uaf}_ciqlts9_6 branch from c14184c to 6326773 Compare May 26, 2026 16:51
@github-actions

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/26462815852

@github-actions

Copy link
Copy Markdown

🔍 Interdiff Analysis

  • ⚠️ PR commit c05705eed78 (net: gro: don't merge zcopy skbs) → upstream 4db79a322db8
    Differences found:
################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -109,6 +109,9 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
+	if (skb_zcopy(p) || skb_zcopy(skb))
+		return -ETOOMANYREFS;
+
 	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
 		     NAPI_GRO_CB(skb)->flush))
 		return -E2BIG;

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/core/gro.c
+++ b/net/core/gro.c
@@ -106,6 +106,6 @@
 	if (p->pp_recycle != skb->pp_recycle)
 		return -ETOOMANYREFS;
 
-	/* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */
-	gro_max_size = p->protocol == htons(ETH_P_IPV6) ?
-			READ_ONCE(p->dev->gro_max_size) :
+	if (unlikely(p->len + len >= netif_get_gro_max_size(p->dev, p) ||
+		     NAPI_GRO_CB(skb)->flush))
+		return -E2BIG;

This is an automated interdiff check for backported commits.

@github-actions

Copy link
Copy Markdown

Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/26462815852

@bmastbergen bmastbergen left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@bmastbergen bmastbergen requested a review from a team May 26, 2026 17:40
@bmastbergen bmastbergen merged commit 9f123cf into ciqlts9_6 May 26, 2026
6 of 7 checks passed
@bmastbergen bmastbergen deleted the {shreeya_gro_uaf}_ciqlts9_6 branch May 26, 2026 18:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Development

Successfully merging this pull request may close these issues.

3 participants