[ciqcbr7_9] Multiple patches tested (4 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

netfilter: xt_tcpmss: check remaining length before reading optlen

jira VULN-184554
cve CVE-2026-43190
commit-author Florian Westphal <fw@strlen.de>
commit 735ee8582da3d239eb0c7a53adca61b79fb228b3

xfs: fix freemap adjustments when adding xattrs to leaf blocks

jira VULN-184484
cve CVE-2026-43158
commit-author Darrick J. Wong <djwong@kernel.org>
commit 3eefc0c2b78444b64feeb3783c017d6adc3cd3ce

RDMA/umad: Reject negative data_len in ib_umad_write

jira VULN-178537
cve CVE-2026-23243
commit-author YunJe Shin <yjshin0438@gmail.com>
commit 5551b02fdbfd85a325bb857f3a8f9c9f33397ed2
upstream-diff |
	cast second param `hdr_size(file) + hdr_len` in `check_sub_overflow`
	call to size_t to match the type of the first param `count` to fix
	build issue.

wifi: brcmfmac: validate bsscfg indices in IF events

jira VULN-185617
cve CVE-2026-43110
commit-author Pengpeng Hou <pengpeng@iscas.ac.cn>
commit 304950a467d83678bd0b0f46331882e2ac23b12d
upstream-diff |
	Use `brcmf_err` instead of `bphy_err` due to missing
	dcb1471bc6d05 ("brcmfmac: use bphy_err() in all wiphy-related code")

Test Results

✅ Build Stage

• Status: Passed (x86_64)

• Build Time: 12m 56s

• Total Time: 13m 59s

• View build logs

✅ Boot Verification

• Status: Passed (x86_64)
• View boot logs

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 28092236561

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/28094204789

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit 7e693efa3bed (xfs: fix freemap adjustments when adding xattrs to leaf blocks) → upstream 3eefc0c2b784
  Differences found:

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/fs/xfs/libxfs/xfs_attr_leaf.c
+++ b/fs/xfs/libxfs/xfs_attr_leaf.c
@@ -1434,5 +1580,5 @@
 				min_t(uint16_t, ichdr->freemap[i].size,
 						sizeof(xfs_attr_leaf_entry_t));
 		}
-	}
-	ichdr->usedbytes += xfs_attr_leaf_entsize(leaf, args->index);
+
+		/*

• ⚠️ PR commit b11d0d5f04a9 (RDMA/umad: Reject negative data_len in ib_umad_write) → upstream 5551b02fdbfd
  Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -546,7 +546,7 @@
 	}
 
 	base_version = ((struct ib_mad_hdr *)&packet->mad.data)->base_version;
-	if (check_sub_overflow(count, (size_t)(hdr_size(file) + hdr_len), &data_len)) {
+	if (check_sub_overflow(count, hdr_size(file) + hdr_len, &data_len)) {
 		ret = -EINVAL;
 		goto err_ah;
 	}

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/infiniband/core/user_mad.c
+++ b/drivers/infiniband/core/user_mad.c
@@ -471,5 +472,4 @@
 	struct ib_ah *ah;
-	struct ib_rmpp_mad *rmpp_mad;
 	__be64 *tid;
 	int ret, data_len, hdr_len, copy_offset, rmpp_active;
 	u8 base_version;

• ⚠️ PR commit 52769c4b0d30 (wifi: brcmfmac: validate bsscfg indices in IF events) → upstream 304950a467d8
  Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
@@ -162,7 +162,8 @@
 		return;
 	}
 	if (ifevent->bsscfgidx >= BRCMF_MAX_IFS) {
-		brcmf_err("invalid bsscfg index: %u\n", ifevent->bsscfgidx);
+		bphy_err(drvr, "invalid bsscfg index: %u\n",
+			 ifevent->bsscfgidx);
 		return;
 	}
 

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c
@@ -150,4 +150,4 @@
-		brcmf_err("invalid interface index: %u\n", ifevent->ifidx);
+		bphy_err(drvr, "invalid interface index: %u\n", ifevent->ifidx);
 		return;
 	}

This is an automated interdiff check for backported commits.

[github-actions]

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/28094204789

[PlaidCat]

I had Claude to a survey of incase there is a weird interaction with the cast to size_t from int and mostly concerned about overflow or negative bit set

hdr_size() returns int and hdr_len is int. The expression hdr_size(file) + hdr_len is evaluated in signed int arithmetic first, then cast to size_t. The values are small constants — hdr_size() returns either sizeof(struct ib_user_mad_hdr) or sizeof(struct ib_user_mad_hdr_old) (both small structs), and hdr_len is one of 24/36/40/56/64. There's no realistic scenario where that int addition overflows. The sum is always a small positive number in the range
~60-120 bytes.

[bmastbergen]

🥌