Skip to content

[rlc-8/4.18.0-553.123.1.el8_10] smb: client: reject userspace cifs.spnego descriptions#1272

Merged
bmastbergen merged 1 commit into
rlc-8/4.18.0-553.123.1.el8_10from
{shreeya_cifs_spnego}_rlc-8/4.18.0-553.123.1.el8_10
May 26, 2026
Merged

[rlc-8/4.18.0-553.123.1.el8_10] smb: client: reject userspace cifs.spnego descriptions#1272
bmastbergen merged 1 commit into
rlc-8/4.18.0-553.123.1.el8_10from
{shreeya_cifs_spnego}_rlc-8/4.18.0-553.123.1.el8_10

Conversation

@ciq-kernel-automation

@ciq-kernel-automation ciq-kernel-automation Bot commented May 26, 2026

Copy link
Copy Markdown

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

smb: client: reject userspace cifs.spnego descriptions

cve CVE-Pending
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 3da1fdf4efbc490041eb4f836bf596201203f8f2
upstream-diff |
  File path: upstream uses fs/smb/client/cifs_spnego.c, this branch
  uses fs/cifs/cifs_spnego.c. Code is identical.

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 25m 26s 26m 22s
aarch64 10m 42s 11m 23s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 122 34 rlc-8/4.18.0-553.123.1.el8_10 ✅ No regressions
aarch64 72 32 rlc-8/4.18.0-553.123.1.el8_10 ✅ No regressions

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 1409 83 rlc-8/4.18.0-553.123.1.el8_10 ✅ No regressions
aarch64 1381 83 rlc-8/4.18.0-553.123.1.el8_10 ✅ No regressions

x86_64 newly passing:

  • fs_perms05 (PASS)
  • fs_perms06 (PASS)
  • fs_perms07 (PASS)
  • fs_perms08 (PASS)
  • fs_perms09 (PASS)
  • fs_perms10 (PASS)
  • fs_perms11 (PASS)
  • fs_perms12 (PASS)
  • fs_perms13 (PASS)
  • fs_perms14 (PASS)
  • fs_perms15 (PASS)
  • fs_perms16 (PASS)
  • fs_perms17 (PASS)
  • fs_perms18 (PASS)
  • futex_wake02 (FAIL -> PASS)
    aarch64 newly passing:
  • starvation (FAIL -> PASS)

🤖 This PR was automatically generated by GitHub Actions
Run ID: 26462479444

@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label May 26, 2026
@github-actions

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/26451698646

@github-actions

Copy link
Copy Markdown

JIRA PR Check Results

1 commit(s) with issues found:

Commit a404545daab7

Summary: smb: client: reject userspace cifs.spnego descriptions

❌ Errors:

  • VULN-: Failed to retrieve ticket: JiraError HTTP 404 url: https://ciqinc.atlassian.net/rest/api/2/issue/VULN-
    text: Issue does not exist or you do not have permission to see it.

    response headers = {'Content-Type': 'application/json;charset=UTF-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Date': 'Tue, 26 May 2026 13:42:47 GMT', 'Server': 'AtlassianEdge', 'Timing-Allow-Origin': '*', 'X-Arequestid': '9d5d040a26d437e4debabeeed2f4e878', 'X-Aaccountid': '712020%3A43f5a558-0b78-4cc1-ad9e-a61d9b0317de', 'Cache-Control': 'no-cache, no-store, no-transform', 'Ratelimit-Policy': '"jira-burst-based";q=150;w=1', 'Ratelimit': '"jira-burst-based";r=399;t=1', 'X-Ratelimit-Limit': '400', 'X-Ratelimit-Remaining': '399', 'Content-Encoding': 'gzip', 'X-Content-Type-Options': 'nosniff', 'X-Xss-Protection': '1; mode=block', 'Atl-Traceid': '9438d83e00194262859880709387f883', 'Atl-Request-Id': '9438d83e-0019-4262-8598-80709387f883', 'Strict-Transport-Security': 'max-age=63072000; includeSubDomains; preload', 'Report-To': '{"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600}', 'Nel': '{"failure_fraction": 0.01, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"}', 'Server-Timing': 'atl-edge;dur=66,atl-edge-internal;dur=18,atl-edge-upstream;dur=45,atl-edge-pop;desc="aws-us-west-2"', 'X-Cache': 'Error from cloudfront', 'Via': '1.1 e1cf5d3ee29d62658c3f4aba1bb6c6f0.cloudfront.net (CloudFront)', 'X-Amz-Cf-Pop': 'ORD58-P3', 'X-Amz-Cf-Id': 'eL2ag2PJ3IO5uSE3uyVNLbFOPQ1SOQW7CwWcahkG3kMHgfdbP2UKWg=='}
    response text = {"errorMessages":["Issue does not exist or you do not have permission to see it."],"errors":{}}


Summary: Checked 1 commit(s) total.

@github-actions

Copy link
Copy Markdown

Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/26451698646

cve CVE-Pending
commit-author Asim Viladi Oglu Manizada <manizada@pm.me>
commit 3da1fdf
upstream-diff |
  File path: upstream uses fs/smb/client/cifs_spnego.c, this branch
  uses fs/cifs/cifs_spnego.c. Code is identical.

cifs.spnego key descriptions contain authority-bearing fields such as
pid, uid, creduid, and upcall_target that cifs.upcall treats as
kernel-originating inputs. However, userspace can also create keys of
this type through request_key(2) or add_key(2), allowing those fields to
be supplied without CIFS origin.

Only accept cifs.spnego descriptions while CIFS is using its private
spnego_cred to request the key.

Fixes: f1d662a ("[CIFS] Add upcall files for cifs to use spnego/kerberos")
Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
Reviewed-by: David Howells <dhowells@redhat.com>
Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Shreeya Patel <spatel@ciq.com>
@bmastbergen bmastbergen force-pushed the {shreeya_cifs_spnego}_rlc-8/4.18.0-553.123.1.el8_10 branch from a404545 to 14c516a Compare May 26, 2026 16:53
@github-actions

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/26462999588

@github-actions

Copy link
Copy Markdown

Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/26462999588

@bmastbergen bmastbergen left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@bmastbergen bmastbergen requested a review from a team May 26, 2026 17:41
@bmastbergen bmastbergen merged commit 7a84477 into rlc-8/4.18.0-553.123.1.el8_10 May 26, 2026
4 checks passed
@bmastbergen bmastbergen deleted the {shreeya_cifs_spnego}_rlc-8/4.18.0-553.123.1.el8_10 branch May 26, 2026 18:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Development

Successfully merging this pull request may close these issues.

2 participants