Skip to content

[ciqlts8_6] Multiple patches tested (8 commits)#1174

Open
ciq-kernel-automation[bot] wants to merge 8 commits intociqlts8_6from
{ciq_kernel_automation}_ciqlts8_6
Open

[ciqlts8_6] Multiple patches tested (8 commits)#1174
ciq-kernel-automation[bot] wants to merge 8 commits intociqlts8_6from
{ciq_kernel_automation}_ciqlts8_6

Conversation

@ciq-kernel-automation
Copy link
Copy Markdown

@ciq-kernel-automation ciq-kernel-automation Bot commented May 4, 2026

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field

jira VULN-63619
cve CVE-2021-47385
commit-author Nadezda Lutovinova <lutovinova@ispras.ru>
commit 0f36b88173f028e372668ae040ab1a496834d278

isdn: mISDN: Fix sleeping function called from invalid context

jira VULN-4374
cve CVE-2021-47468
commit-author Zheyu Ma <zheyuma97@gmail.com>
commit 6510e80a0b81b5d814e3aea6297ba42f5e76f73c

ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port()

jira VULN-4390
cve CVE-2021-47548
commit-author Teng Qi <starmiku1207184332@gmail.com>
commit a66998e0fbf213d47d02813b9679426129d0d114

veth: ensure skb entering GRO are not cloned.

jira VULN-4259
cve CVE-2021-47099
commit-author Paolo Abeni <pabeni@redhat.com>
commit 9695b7de5b4760ed22132aca919570c0190cb0ce

net: amd-xgbe: Fix skb data length underflow

jira VULN-4422
cve CVE-2022-48743
commit-author Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
commit 5aac9108a180fc06e28d4e7fb00247ce603b72ee

perf: Fix list corruption in perf_cgroup_switch()

jira VULN-32747
cve CVE-2022-48799
commit-author Song Liu <song@kernel.org>
commit 5f4e5ce638e6a490b976ade4a40017b40abb2da0

xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create

jira VULN-32594
cve CVE-2022-48773
commit-author Dan Aloni <dan.aloni@vastdata.com>
commit a9c10b5b3b67b3750a10c8b089b2e05f5e176e33

KVM: x86: nSVM: fix potential NULL derefernce on nested migration

jira VULN-32710
cve CVE-2022-48793
commit-author Maxim Levitsky <mlevitsk@redhat.com>
commit e1779c2714c3023e4629825762bcbc43a3b943df

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 22m 59s 23m 57s
aarch64 9m 29s 10m 6s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 108 31 ciqlts8_6 ✅ No regressions
aarch64 67 20 ciqlts8_6 ✅ No regressions

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 1451 13 ciqlts8_6 ✅ No regressions
aarch64 1425 14 ciqlts8_6 ✅ No regressions

x86_64 newly passing:

  • check_keepcaps01 (PASS)
  • check_keepcaps02 (PASS)
  • check_keepcaps03 (PASS)
  • filecaps (PASS)
  • fs_perms01 (PASS)
  • fs_perms02 (PASS)
  • fs_perms03 (PASS)
  • fs_perms04 (PASS)
  • fs_perms05 (PASS)
  • fs_perms06 (PASS)
  • fs_perms07 (PASS)
  • fs_perms08 (PASS)
  • fs_perms09 (PASS)
  • fs_perms10 (PASS)
  • fs_perms11 (PASS)
  • fs_perms12 (PASS)
  • fs_perms13 (PASS)

🤖 This PR was automatically generated by GitHub Actions
Run ID: 25306444285

CIQ Kernel Automation added 8 commits May 4, 2026 07:19
hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary…
803c92a 
… structure field

jira VULN-63619
cve CVE-2021-47385
commit-author Nadezda Lutovinova <lutovinova@ispras.ru>
commit 0f36b88

If driver read val value sufficient for
(val & 0x08) && (!(val & 0x80)) && ((val & 0x7) == ((val >> 4) & 0x7))
from device then Null pointer dereference occurs.
(It is possible if tmp = 0b0xyz1xyz, where same literals mean same numbers)
Also lm75[] does not serve a purpose anymore after switching to
devm_i2c_new_dummy_device() in w83791d_detect_subclients().

The patch fixes possible NULL pointer dereference by removing lm75[].

Found by Linux Driver Verification project (linuxtesting.org).

	Cc: stable@vger.kernel.org
	Signed-off-by: Nadezda Lutovinova <lutovinova@ispras.ru>
Link: https://lore.kernel.org/r/20210921155153.28098-2-lutovinova@ispras.ru
[groeck: Dropped unnecessary continuation lines, fixed multipline alignment]
	Signed-off-by: Guenter Roeck <linux@roeck-us.net>
(cherry picked from commit 0f36b88)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
isdn: mISDN: Fix sleeping function called from invalid context
7c3cbf4 
jira VULN-4374
cve CVE-2021-47468
commit-author Zheyu Ma <zheyuma97@gmail.com>
commit 6510e80

The driver can call card->isac.release() function from an atomic
context.

Fix this by calling this function after releasing the lock.

The following log reveals it:

[   44.168226 ] BUG: sleeping function called from invalid context at kernel/workqueue.c:3018
[   44.168941 ] in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 5475, name: modprobe
[   44.169574 ] INFO: lockdep is turned off.
[   44.169899 ] irq event stamp: 0
[   44.170160 ] hardirqs last  enabled at (0): [<0000000000000000>] 0x0
[   44.170627 ] hardirqs last disabled at (0): [<ffffffff814209ed>] copy_process+0x132d/0x3e00
[   44.171240 ] softirqs last  enabled at (0): [<ffffffff81420a1a>] copy_process+0x135a/0x3e00
[   44.171852 ] softirqs last disabled at (0): [<0000000000000000>] 0x0
[   44.172318 ] Preemption disabled at:
[   44.172320 ] [<ffffffffa009b0a9>] nj_release+0x69/0x500 [netjet]
[   44.174441 ] Call Trace:
[   44.174630 ]  dump_stack_lvl+0xa8/0xd1
[   44.174912 ]  dump_stack+0x15/0x17
[   44.175166 ]  ___might_sleep+0x3a2/0x510
[   44.175459 ]  ? nj_release+0x69/0x500 [netjet]
[   44.175791 ]  __might_sleep+0x82/0xe0
[   44.176063 ]  ? start_flush_work+0x20/0x7b0
[   44.176375 ]  start_flush_work+0x33/0x7b0
[   44.176672 ]  ? trace_irq_enable_rcuidle+0x85/0x170
[   44.177034 ]  ? kasan_quarantine_put+0xaa/0x1f0
[   44.177372 ]  ? kasan_quarantine_put+0xaa/0x1f0
[   44.177711 ]  __flush_work+0x11a/0x1a0
[   44.177991 ]  ? flush_work+0x20/0x20
[   44.178257 ]  ? lock_release+0x13c/0x8f0
[   44.178550 ]  ? __kasan_check_write+0x14/0x20
[   44.178872 ]  ? do_raw_spin_lock+0x148/0x360
[   44.179187 ]  ? read_lock_is_recursive+0x20/0x20
[   44.179530 ]  ? __kasan_check_read+0x11/0x20
[   44.179846 ]  ? do_raw_spin_unlock+0x55/0x900
[   44.180168 ]  ? ____kasan_slab_free+0x116/0x140
[   44.180505 ]  ? _raw_spin_unlock_irqrestore+0x41/0x60
[   44.180878 ]  ? skb_queue_purge+0x1a3/0x1c0
[   44.181189 ]  ? kfree+0x13e/0x290
[   44.181438 ]  flush_work+0x17/0x20
[   44.181695 ]  mISDN_freedchannel+0xe8/0x100
[   44.182006 ]  isac_release+0x210/0x260 [mISDNipac]
[   44.182366 ]  nj_release+0xf6/0x500 [netjet]
[   44.182685 ]  nj_remove+0x48/0x70 [netjet]
[   44.182989 ]  pci_device_remove+0xa9/0x250

	Signed-off-by: Zheyu Ma <zheyuma97@gmail.com>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 6510e80)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflo…
56d120a 
…w in hns_dsaf_ge_srst_by_port()

jira VULN-4390
cve CVE-2021-47548
commit-author Teng Qi <starmiku1207184332@gmail.com>
commit a66998e

The if statement:
  if (port >= DSAF_GE_NUM)
        return;

limits the value of port less than DSAF_GE_NUM (i.e., 8).
However, if the value of port is 6 or 7, an array overflow could occur:
  port_rst_off = dsaf_dev->mac_cb[port]->port_rst_off;

because the length of dsaf_dev->mac_cb is DSAF_MAX_PORT_NUM (i.e., 6).

To fix this possible array overflow, we first check port and if it is
greater than or equal to DSAF_MAX_PORT_NUM, the function returns.

	Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
	Signed-off-by: Teng Qi <starmiku1207184332@gmail.com>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit a66998e)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
veth: ensure skb entering GRO are not cloned.
379e791 
jira VULN-4259
cve CVE-2021-47099
commit-author Paolo Abeni <pabeni@redhat.com>
commit 9695b7d

After commit d3256ef ("veth: allow enabling NAPI even without XDP"),
if GRO is enabled on a veth device and TSO is disabled on the peer
device, TCP skbs will go through the NAPI callback. If there is no XDP
program attached, the veth code does not perform any share check, and
shared/cloned skbs could enter the GRO engine.

Ignat reported a BUG triggered later-on due to the above condition:

[   53.970529][    C1] kernel BUG at net/core/skbuff.c:3574!
[   53.981755][    C1] invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
[   53.982634][    C1] CPU: 1 PID: 19 Comm: ksoftirqd/1 Not tainted 5.16.0-rc5+ #25
[   53.982634][    C1] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
[   53.982634][    C1] RIP: 0010:skb_shift+0x13ef/0x23b0
[   53.982634][    C1] Code: ea 03 0f b6 04 02 48 89 fa 83 e2 07 38 d0
7f 08 84 c0 0f 85 41 0c 00 00 41 80 7f 02 00 4d 8d b5 d0 00 00 00 0f
85 74 f5 ff ff <0f> 0b 4d 8d 77 20 be 04 00 00 00 4c 89 44 24 78 4c 89
f7 4c 89 8c
[   53.982634][    C1] RSP: 0018:ffff8881008f7008 EFLAGS: 00010246
[   53.982634][    C1] RAX: 0000000000000000 RBX: ffff8881180b4c80 RCX: 0000000000000000
[   53.982634][    C1] RDX: 0000000000000002 RSI: ffff8881180b4d3c RDI: ffff88810bc9cac2
[   53.982634][    C1] RBP: ffff8881008f70b8 R08: ffff8881180b4cf4 R09: ffff8881180b4cf0
[   53.982634][    C1] R10: ffffed1022999e5c R11: 0000000000000002 R12: 0000000000000590
[   53.982634][    C1] R13: ffff88810f940c80 R14: ffff88810f940d50 R15: ffff88810bc9cac0
[   53.982634][    C1] FS:  0000000000000000(0000) GS:ffff888235880000(0000) knlGS:0000000000000000
[   53.982634][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   53.982634][    C1] CR2: 00007ff5f9b86680 CR3: 0000000108ce8004 CR4: 0000000000170ee0
[   53.982634][    C1] Call Trace:
[   53.982634][    C1]  <TASK>
[   53.982634][    C1]  tcp_sacktag_walk+0xaba/0x18e0
[   53.982634][    C1]  tcp_sacktag_write_queue+0xe7b/0x3460
[   53.982634][    C1]  tcp_ack+0x2666/0x54b0
[   53.982634][    C1]  tcp_rcv_established+0x4d9/0x20f0
[   53.982634][    C1]  tcp_v4_do_rcv+0x551/0x810
[   53.982634][    C1]  tcp_v4_rcv+0x22ed/0x2ed0
[   53.982634][    C1]  ip_protocol_deliver_rcu+0x96/0xaf0
[   53.982634][    C1]  ip_local_deliver_finish+0x1e0/0x2f0
[   53.982634][    C1]  ip_sublist_rcv_finish+0x211/0x440
[   53.982634][    C1]  ip_list_rcv_finish.constprop.0+0x424/0x660
[   53.982634][    C1]  ip_list_rcv+0x2c8/0x410
[   53.982634][    C1]  __netif_receive_skb_list_core+0x65c/0x910
[   53.982634][    C1]  netif_receive_skb_list_internal+0x5f9/0xcb0
[   53.982634][    C1]  napi_complete_done+0x188/0x6e0
[   53.982634][    C1]  gro_cell_poll+0x10c/0x1d0
[   53.982634][    C1]  __napi_poll+0xa1/0x530
[   53.982634][    C1]  net_rx_action+0x567/0x1270
[   53.982634][    C1]  __do_softirq+0x28a/0x9ba
[   53.982634][    C1]  run_ksoftirqd+0x32/0x60
[   53.982634][    C1]  smpboot_thread_fn+0x559/0x8c0
[   53.982634][    C1]  kthread+0x3b9/0x490
[   53.982634][    C1]  ret_from_fork+0x22/0x30
[   53.982634][    C1]  </TASK>

Address the issue by skipping the GRO stage for shared or cloned skbs.
To reduce the chance of OoO, try to unclone the skbs before giving up.

v1 -> v2:
 - use avoid skb_copy and fallback to netif_receive_skb  - Eric

	Reported-by: Ignat Korchagin <ignat@cloudflare.com>
Fixes: d3256ef ("veth: allow enabling NAPI even without XDP")
	Signed-off-by: Paolo Abeni <pabeni@redhat.com>
	Tested-by: Ignat Korchagin <ignat@cloudflare.com>
	Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/b5f61c5602aab01bac8d711d8d1bfab0a4817db7.1640197544.git.pabeni@redhat.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 9695b7d)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
net: amd-xgbe: Fix skb data length underflow
13f2c77 
jira VULN-4422
cve CVE-2022-48743
commit-author Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
commit 5aac910

There will be BUG_ON() triggered in include/linux/skbuff.h leading to
intermittent kernel panic, when the skb length underflow is detected.

Fix this by dropping the packet if such length underflows are seen
because of inconsistencies in the hardware descriptors.

Fixes: 622c36f ("amd-xgbe: Fix jumbo MTU processing on newer hardware")
	Suggested-by: Tom Lendacky <thomas.lendacky@amd.com>
	Signed-off-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
	Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Link: https://lore.kernel.org/r/20220127092003.2812745-1-Shyam-sundar.S-k@amd.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 5aac910)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
perf: Fix list corruption in perf_cgroup_switch()
71ed131 
jira VULN-32747
cve CVE-2022-48799
commit-author Song Liu <song@kernel.org>
commit 5f4e5ce

There's list corruption on cgrp_cpuctx_list. This happens on the
following path:

  perf_cgroup_switch: list_for_each_entry(cgrp_cpuctx_list)
      cpu_ctx_sched_in
         ctx_sched_in
            ctx_pinned_sched_in
              merge_sched_in
                  perf_cgroup_event_disable: remove the event from the list

Use list_for_each_entry_safe() to allow removing an entry during
iteration.

Fixes: 058fe1c ("perf/core: Make cgroup switch visit only cpuctxs with cgroup events")
	Signed-off-by: Song Liu <song@kernel.org>
	Reviewed-by: Rik van Riel <riel@surriel.com>
	Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20220204004057.2961252-1-song@kernel.org
(cherry picked from commit 5f4e5ce)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create
92655bf 
jira VULN-32594
cve CVE-2022-48773
commit-author Dan Aloni <dan.aloni@vastdata.com>
commit a9c10b5

If there are failures then we must not leave the non-NULL pointers with
the error value, otherwise `rpcrdma_ep_destroy` gets confused and tries
free them, resulting in an Oops.

	Signed-off-by: Dan Aloni <dan.aloni@vastdata.com>
	Acked-by: Chuck Lever <chuck.lever@oracle.com>
	Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
(cherry picked from commit a9c10b5)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
KVM: x86: nSVM: fix potential NULL derefernce on nested migration
94a3454 
jira VULN-32710
cve CVE-2022-48793
commit-author Maxim Levitsky <mlevitsk@redhat.com>
commit e1779c2

Turns out that due to review feedback and/or rebases
I accidentally moved the call to nested_svm_load_cr3 to be too early,
before the NPT is enabled, which is very wrong to do.

KVM can't even access guest memory at that point as nested NPT
is needed for that, and of course it won't initialize the walk_mmu,
which is main issue the patch was addressing.

Fix this for real.

Fixes: 232f75d ("KVM: nSVM: call nested_svm_load_cr3 on nested state load")
	Cc: stable@vger.kernel.org

	Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Message-Id: <20220207155447.840194-3-mlevitsk@redhat.com>
	Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit e1779c2)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label May 4, 2026
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 4, 2026

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/25315920771

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 4, 2026

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/25315920771

@roxanan1996 roxanan1996 requested a review from a team May 4, 2026 11:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@roxanan1996 roxanan1996 roxanan1996 approved these changes

@shreeya-patel98 shreeya-patel98 shreeya-patel98 approved these changes

Assignees

No one assigned

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@roxanan1996 @shreeya-patel98