Skip to content

[ciqlts9_6] Multiple patches tested (5 commits)#1075

Merged
PlaidCat merged 5 commits intociqlts9_6from
{ciq_kernel_automation}_ciqlts9_6
Apr 6, 2026
Merged

[ciqlts9_6] Multiple patches tested (5 commits)#1075
PlaidCat merged 5 commits intociqlts9_6from
{ciq_kernel_automation}_ciqlts9_6

Conversation

@ciq-kernel-automation
Copy link
Copy Markdown

@ciq-kernel-automation ciq-kernel-automation Bot commented Apr 6, 2026 •
edited
Loading

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

can: j1939: j1939_session_new(): fix skb reference counting

jira VULN-167655
cve CVE-2024-56645
commit-author Dmitry Antipov <dmantipov@yandex.ru>
commit a8c695005bfe6569acd73d777ca298ddddd66105

drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies

jira VULN-162228
cve CVE-2025-40096
commit-author Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
commit 5801e65206b065b0b2af032f7f1eef222aa2fd83

mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats

jira VULN-173890
cve CVE-2025-68800
commit-author Ido Schimmel <idosch@nvidia.com>
commit 8ac1dacec458f55f871f7153242ed6ab60373b90

macvlan: fix error recovery in macvlan_common_newlink()

jira VULN-176351
cve CVE-2026-23209
commit-author Eric Dumazet <edumazet@google.com>
commit f8db6475a83649689c087a8f52486fcc53e627e9

macvlan: observe an RCU grace period in macvlan_common_newlink() error path

jira VULN-180239
cve CVE-2026-23273
commit-author Eric Dumazet <edumazet@google.com>
commit e3f000f0dee1bfab52e2e61ca6a3835d9e187e35

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 32m 24s 36m 27s
aarch64 18m 37s 21m 29s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed
x86_64 205 45
aarch64 153 46

Test Comparison

x86_64:

  • ✅ Status: Passed - Within acceptable threshold (±3 tests)
  • Compared against: ciqlts9_6

aarch64:

  • ✅ Status: Passed - Within acceptable threshold (±3 tests)
  • Compared against: ciqlts9_6

🤖 This PR was automatically generated by GitHub Actions
Run ID: 24033713079

CIQ Kernel Automation added 4 commits April 6, 2026 06:53
can: j1939: j1939_session_new(): fix skb reference counting
ab12653 
jira VULN-167655
cve CVE-2024-56645
commit-author Dmitry Antipov <dmantipov@yandex.ru>
commit a8c6950

Since j1939_session_skb_queue() does an extra skb_get() for each new
skb, do the same for the initial one in j1939_session_new() to avoid
refcount underflow.

	Reported-by: syzbot+d4e8dc385d9258220c31@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d4e8dc385d9258220c31
Fixes: 9d71dd0 ("can: add support of SAE J1939 protocol")
	Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
	Tested-by: Oleksij Rempel <o.rempel@pengutronix.de>
	Acked-by: Oleksij Rempel <o.rempel@pengutronix.de>
Link: https://patch.msgid.link/20241105094823.2403806-1-dmantipov@yandex.ru
[mkl: clean up commit message]
	Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
(cherry picked from commit a8c6950)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
drm/sched: Fix potential double free in drm_sched_job_add_resv_depend…
dc22d49 
…encies

jira VULN-162228
cve CVE-2025-40096
commit-author Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
commit 5801e65

When adding dependencies with drm_sched_job_add_dependency(), that
function consumes the fence reference both on success and failure, so in
the latter case the dma_fence_put() on the error path (xarray failed to
expand) is a double free.

Interestingly this bug appears to have been present ever since
commit ebd5f74 ("drm/sched: Add dependency tracking"), since the code
back then looked like this:

drm_sched_job_add_implicit_dependencies():
...
       for (i = 0; i < fence_count; i++) {
               ret = drm_sched_job_add_dependency(job, fences[i]);
               if (ret)
                       break;
       }

       for (; i < fence_count; i++)
               dma_fence_put(fences[i]);

Which means for the failing 'i' the dma_fence_put was already a double
free. Possibly there were no users at that time, or the test cases were
insufficient to hit it.

The bug was then only noticed and fixed after
commit 9c2ba26 ("drm/scheduler: use new iterator in drm_sched_job_add_implicit_dependencies v2")
landed, with its fixup of
commit 4eaf02d ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies").

At that point it was a slightly different flavour of a double free, which
commit 963d0b3 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder")
noticed and attempted to fix.

But it only moved the double free from happening inside the
drm_sched_job_add_dependency(), when releasing the reference not yet
obtained, to the caller, when releasing the reference already released by
the former in the failure case.

As such it is not easy to identify the right target for the fixes tag so
lets keep it simple and just continue the chain.

While fixing we also improve the comment and explain the reason for taking
the reference and not dropping it.

	Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@igalia.com>
Fixes: 963d0b3 ("drm/scheduler: fix drm_sched_job_add_implicit_dependencies harder")
	Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/dri-devel/aNFbXq8OeYl3QSdm@stanley.mountain/
	Cc: Christian König <christian.koenig@amd.com>
	Cc: Rob Clark <robdclark@chromium.org>
	Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
	Cc: Matthew Brost <matthew.brost@intel.com>
	Cc: Danilo Krummrich <dakr@kernel.org>
	Cc: Philipp Stanner <phasta@kernel.org>
	Cc: Christian König <ckoenig.leichtzumerken@gmail.com>
	Cc: dri-devel@lists.freedesktop.org
	Cc: stable@vger.kernel.org # v5.16+
	Signed-off-by: Philipp Stanner <phasta@kernel.org>
Link: https://lore.kernel.org/r/20251015084015.6273-1-tvrtko.ursulin@igalia.com
(cherry picked from commit 5801e65)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
mlxsw: spectrum_mr: Fix use-after-free when updating multicast route …
d191473 
…stats

jira VULN-173890
cve CVE-2025-68800
commit-author Ido Schimmel <idosch@nvidia.com>
commit 8ac1dac

Cited commit added a dedicated mutex (instead of RTNL) to protect the
multicast route list, so that it will not change while the driver
periodically traverses it in order to update the kernel about multicast
route stats that were queried from the device.

One instance of list entry deletion (during route replace) was missed
and it can result in a use-after-free [1].

Fix by acquiring the mutex before deleting the entry from the list and
releasing it afterwards.

[1]
BUG: KASAN: slab-use-after-free in mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum]
Read of size 8 at addr ffff8881523c2fa8 by task kworker/2:5/22043

CPU: 2 UID: 0 PID: 22043 Comm: kworker/2:5 Not tainted 6.18.0-rc1-custom-g1a3d6d7cd014 #1 PREEMPT(full)
Hardware name: Mellanox Technologies Ltd. MSN2010/SA002610, BIOS 5.6.5 08/24/2017
Workqueue: mlxsw_core mlxsw_sp_mr_stats_update [mlxsw_spectrum]
Call Trace:
 <TASK>
 dump_stack_lvl+0xba/0x110
 print_report+0x174/0x4f5
 kasan_report+0xdf/0x110
 mlxsw_sp_mr_stats_update+0x4a5/0x540 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:1006 [mlxsw_spectrum]
 process_one_work+0x9cc/0x18e0
 worker_thread+0x5df/0xe40
 kthread+0x3b8/0x730
 ret_from_fork+0x3e9/0x560
 ret_from_fork_asm+0x1a/0x30
 </TASK>

Allocated by task 29933:
 kasan_save_stack+0x30/0x50
 kasan_save_track+0x14/0x30
 __kasan_kmalloc+0x8f/0xa0
 mlxsw_sp_mr_route_add+0xd8/0x4770 [mlxsw_spectrum]
 mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum]
 process_one_work+0x9cc/0x18e0
 worker_thread+0x5df/0xe40
 kthread+0x3b8/0x730
 ret_from_fork+0x3e9/0x560
 ret_from_fork_asm+0x1a/0x30

Freed by task 29933:
 kasan_save_stack+0x30/0x50
 kasan_save_track+0x14/0x30
 __kasan_save_free_info+0x3b/0x70
 __kasan_slab_free+0x43/0x70
 kfree+0x14e/0x700
 mlxsw_sp_mr_route_add+0x2dea/0x4770 drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c:444 [mlxsw_spectrum]
 mlxsw_sp_router_fibmr_event_work+0x371/0xad0 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:7965 [mlxsw_spectrum]
 process_one_work+0x9cc/0x18e0
 worker_thread+0x5df/0xe40
 kthread+0x3b8/0x730
 ret_from_fork+0x3e9/0x560
 ret_from_fork_asm+0x1a/0x30

Fixes: f38656d ("mlxsw: spectrum_mr: Protect multicast route list with a lock")
	Signed-off-by: Ido Schimmel <idosch@nvidia.com>
	Reviewed-by: Petr Machata <petrm@nvidia.com>
	Signed-off-by: Petr Machata <petrm@nvidia.com>
	Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/f996feecfd59fde297964bfc85040b6d83ec6089.1764695650.git.petrm@nvidia.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 8ac1dac)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
macvlan: fix error recovery in macvlan_common_newlink()
df791f3 
jira VULN-176351
cve CVE-2026-23209
commit-author Eric Dumazet <edumazet@google.com>
commit f8db647

valis provided a nice repro to crash the kernel:

ip link add p1 type veth peer p2
ip link set address 00:00:00:00:00:20 dev p1
ip link set up dev p1
ip link set up dev p2

ip link add mv0 link p2 type macvlan mode source
ip link add invalid% link p2 type macvlan mode source macaddr add 00:00:00:00:00:20

ping -c1 -I p1 1.2.3.4

He also gave a very detailed analysis:

<quote valis>

The issue is triggered when a new macvlan link is created  with
MACVLAN_MODE_SOURCE mode and MACVLAN_MACADDR_ADD (or
MACVLAN_MACADDR_SET) parameter, lower device already has a macvlan
port and register_netdevice() called from macvlan_common_newlink()
fails (e.g. because of the invalid link name).

In this case macvlan_hash_add_source is called from
macvlan_change_sources() / macvlan_common_newlink():

This adds a reference to vlan to the port's vlan_source_hash using
macvlan_source_entry.

vlan is a pointer to the priv data of the link that is being created.

When register_netdevice() fails, the error is returned from
macvlan_newlink() to rtnl_newlink_create():

        if (ops->newlink)
                err = ops->newlink(dev, &params, extack);
        else
                err = register_netdevice(dev);
        if (err < 0) {
                free_netdev(dev);
                goto out;
        }

and free_netdev() is called, causing a kvfree() on the struct
net_device that is still referenced in the source entry attached to
the lower device's macvlan port.

Now all packets sent on the macvlan port with a matching source mac
address will trigger a use-after-free in macvlan_forward_source().

</quote valis>

With all that, my fix is to make sure we call macvlan_flush_sources()
regardless of @create value whenever "goto destroy_macvlan_port;"
path is taken.

Many thanks to valis for following up on this issue.

Fixes: aa5fd0f ("driver: macvlan: Destroy new macvlan port if macvlan_common_newlink failed.")
	Signed-off-by: Eric Dumazet <edumazet@google.com>
	Reported-by: valis <sec@valis.email>
	Reported-by: syzbot+7182fbe91e58602ec1fe@syzkaller.appspotmail.com
Closes: https: //lore.kernel.org/netdev/695fb1e8.050a0220.1c677c.039f.GAE@google.com/T/#u
	Cc: Boudewijn van der Heide <boudewijn@delta-utec.com>
Link: https://patch.msgid.link/20260129204359.632556-1-edumazet@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit f8db647)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 6, 2026

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/24028130794

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 6, 2026

🔍 Upstream Linux Kernel Commit Check

  • ⚠️ PR commit 474b772c3d9 (macvlan: observe an RCU grace period in macvlan_common_newlink() error path) does not reference a CVE but
    upstream commit e3f000f0dee1 is associated with CVE-2026-23273

This is an automated message from the kernel commit checker workflow.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 6, 2026

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/24028130794

@bmastbergen bmastbergen requested review from a team and bmastbergen April 6, 2026 12:36
@bmastbergen
macvlan: observe an RCU grace period in macvlan_common_newlink() erro…
4b83289 
…r path

jira VULN-180239
cve CVE-2026-23273
commit-author Eric Dumazet <edumazet@google.com>
commit e3f000f

valis reported that a race condition still happens after my prior patch.

macvlan_common_newlink() might have made @dev visible before
detecting an error, and its caller will directly call free_netdev(dev).

We must respect an RCU period, either in macvlan or the core networking
stack.

After adding a temporary mdelay(1000) in macvlan_forward_source_one()
to open the race window, valis repro was:

ip link add p1 type veth peer p2
ip link set address 00:00:00:00:00:20 dev p1
ip link set up dev p1
ip link set up dev p2
ip link add mv0 link p2 type macvlan mode source

(ip link add invalid% link p2 type macvlan mode source macaddr add
00:00:00:00:00:20 &) ; sleep 0.5 ; ping -c1 -I p1 1.2.3.4
PING 1.2.3.4 (1.2.3.4): 56 data bytes
RTNETLINK answers: Invalid argument

BUG: KASAN: slab-use-after-free in macvlan_forward_source
(drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)
Read of size 8 at addr ffff888016bb89c0 by task e/175

CPU: 1 UID: 1000 PID: 175 Comm: e Not tainted 6.19.0-rc8+ #33 NONE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
Call Trace:
<IRQ>
dump_stack_lvl (lib/dump_stack.c:123)
print_report (mm/kasan/report.c:379 mm/kasan/report.c:482)
? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)
kasan_report (mm/kasan/report.c:597)
? macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)
macvlan_forward_source (drivers/net/macvlan.c:408 drivers/net/macvlan.c:444)
? tasklet_init (kernel/softirq.c:983)
macvlan_handle_frame (drivers/net/macvlan.c:501)

Allocated by task 169:
kasan_save_stack (mm/kasan/common.c:58)
kasan_save_track (./arch/x86/include/asm/current.h:25
mm/kasan/common.c:70 mm/kasan/common.c:79)
__kasan_kmalloc (mm/kasan/common.c:419)
__kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5657
mm/slub.c:7140)
alloc_netdev_mqs (net/core/dev.c:12012)
rtnl_create_link (net/core/rtnetlink.c:3648)
rtnl_newlink (net/core/rtnetlink.c:3830 net/core/rtnetlink.c:3957
net/core/rtnetlink.c:4072)
rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)
netlink_rcv_skb (net/netlink/af_netlink.c:2550)
netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
netlink_sendmsg (net/netlink/af_netlink.c:1894)
__sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206)
__x64_sys_sendto (net/socket.c:2209)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)

Freed by task 169:
kasan_save_stack (mm/kasan/common.c:58)
kasan_save_track (./arch/x86/include/asm/current.h:25
mm/kasan/common.c:70 mm/kasan/common.c:79)
kasan_save_free_info (mm/kasan/generic.c:587)
__kasan_slab_free (mm/kasan/common.c:287)
kfree (mm/slub.c:6674 mm/slub.c:6882)
rtnl_newlink (net/core/rtnetlink.c:3845 net/core/rtnetlink.c:3957
net/core/rtnetlink.c:4072)
rtnetlink_rcv_msg (net/core/rtnetlink.c:6958)
netlink_rcv_skb (net/netlink/af_netlink.c:2550)
netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344)
netlink_sendmsg (net/netlink/af_netlink.c:1894)
__sys_sendto (net/socket.c:727 net/socket.c:742 net/socket.c:2206)
__x64_sys_sendto (net/socket.c:2209)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:131)

Fixes: f8db647 ("macvlan: fix error recovery in macvlan_common_newlink()")
	Signed-off-by: Eric Dumazet <edumazet@google.com>
	Reported-by: valis <sec@valis.email>
Link: https://patch.msgid.link/20260213142557.3059043-1-edumazet@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit e3f000f)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@bmastbergen bmastbergen force-pushed the {ciq_kernel_automation}_ciqlts9_6 branch from 474b772 to 4b83289 Compare April 6, 2026 13:29
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 6, 2026

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/24034002375

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 6, 2026

JIRA PR Check Results

1 commit(s) with issues found:

Commit 4b832897b644

Summary: macvlan: observe an RCU grace period in macvlan_common_newlink() error path

❌ Errors:

  • VULN-180239: Status is 'To Do', expected 'In Progress'

Summary: Checked 5 commit(s) total.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 6, 2026

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/24034002375

@bmastbergen
Copy link
Copy Markdown
Collaborator

bmastbergen commented Apr 6, 2026

🔍 Upstream Linux Kernel Commit Check

  • ⚠️ PR commit 474b772c3d9 (macvlan: observe an RCU grace period in macvlan_common_newlink() error path) does not reference a CVE but
    upstream commit e3f000f0dee1 is associated with CVE-2026-23273

This is an automated message from the kernel commit checker workflow.

I fixed this:

    jira VULN-180239
    cve CVE-2026-23273

@bmastbergen
Copy link
Copy Markdown
Collaborator

bmastbergen commented Apr 6, 2026

JIRA PR Check Results

1 commit(s) with issues found:

Commit 4b832897b644

Summary: macvlan: observe an RCU grace period in macvlan_common_newlink() error path

❌ Errors:

  • VULN-180239: Status is 'To Do', expected 'In Progress'

Summary: Checked 5 commit(s) total.

Fixed

bmastbergen
bmastbergen approved these changes Apr 6, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@bmastbergen bmastbergen requested a review from a team April 6, 2026 13:42
@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 6, 2026

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/24034596667

@github-actions
Copy link
Copy Markdown

github-actions Bot commented Apr 6, 2026

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/24034596667

@PlaidCat PlaidCat merged commit 6629f60 into ciqlts9_6 Apr 6, 2026
16 checks passed
@PlaidCat PlaidCat deleted the {ciq_kernel_automation}_ciqlts9_6 branch April 6, 2026 18:34
This was referenced Apr 23, 2026
Closed
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bmastbergen bmastbergen bmastbergen approved these changes

@shreeya-patel98 shreeya-patel98 shreeya-patel98 approved these changes

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@bmastbergen @shreeya-patel98 @PlaidCat