Skip to content

[ciqlts9_4] Multiple patches tested (6 commits) #1176

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ciq-kernel-automation wants to merge 6 commits into
base: ciqlts9_4
Choose a base branch
from
Open

[ciqlts9_4] Multiple patches tested (6 commits) #1176

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
02e36a9
mlxsw: spectrum_mr: Fix use-after-free when updating multicast route …
Apr 30, 2026
0f45548
mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure
Apr 30, 2026
b2c3b66
scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_c…
Apr 30, 2026
7fe6806
net: add skb_header_pointer_careful() helper
roxanan1996 Apr 23, 2026
cb06731
net/sched: cls_u32: use skb_header_pointer_careful()
Apr 30, 2026
ff31195
netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_…
Apr 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions drivers/net/ethernet/mellanox/mlxsw/spectrum_mr.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -440,7 +440,9 @@ int mlxsw_sp_mr_route_add(struct mlxsw_sp_mr_table *mr_table,
rhashtable_remove_fast(&mr_table->route_ht,
&mr_orig_route->ht_node,
mlxsw_sp_mr_route_ht_params);
mutex_lock(&mr_table->route_list_lock);
list_del(&mr_orig_route->node);
mutex_unlock(&mr_table->route_list_lock);
mlxsw_sp_mr_route_destroy(mr_table, mr_orig_route);
}

Expand Down
5 changes: 4 additions & 1 deletion drivers/target/iscsi/iscsi_target_util.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -785,8 +785,11 @@ void iscsit_dec_session_usage_count(struct iscsit_session *sess)
spin_lock_bh(&sess->session_usage_lock);
sess->session_usage_count--;

if (!sess->session_usage_count && sess->session_waiting_on_uc)
if (!sess->session_usage_count && sess->session_waiting_on_uc) {
spin_unlock_bh(&sess->session_usage_lock);
complete(&sess->session_waiting_on_uc_comp);
return;
}

spin_unlock_bh(&sess->session_usage_lock);
}
Expand Down
12 changes: 12 additions & 0 deletions include/linux/skbuff.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3933,6 +3933,18 @@ skb_header_pointer(const struct sk_buff *skb, int offset, int len, void *buffer)
skb_headlen(skb), buffer);
}

/* Variant of skb_header_pointer() where @offset is user-controlled
* and potentially negative.
*/
static inline void * __must_check
skb_header_pointer_careful(const struct sk_buff *skb, int offset,
int len, void *buffer)
{
if (unlikely(offset < 0 && -offset > skb_headroom(skb)))
return NULL;
return skb_header_pointer(skb, offset, len, buffer);
}

/**
* skb_needs_linearize - check if we need to linearize a given skb
* depending on the given device features.
Expand Down
5 changes: 3 additions & 2 deletions mm/damon/sysfs.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1772,7 +1772,7 @@ static int damon_sysfs_context_add_dirs(struct damon_sysfs_context *context)

err = damon_sysfs_context_set_targets(context);
if (err)
goto put_attrs_out;
goto rmdir_put_attrs_out;

err = damon_sysfs_context_set_schemes(context);
if (err)
Expand All @@ -1782,7 +1782,8 @@ static int damon_sysfs_context_add_dirs(struct damon_sysfs_context *context)
put_targets_attrs_out:
kobject_put(&context->targets->kobj);
context->targets = NULL;
put_attrs_out:
rmdir_put_attrs_out:
damon_sysfs_attrs_rm_dirs(context->attrs);
kobject_put(&context->attrs->kobj);
context->attrs = NULL;
return err;
Expand Down
2 changes: 1 addition & 1 deletion net/netfilter/nf_tables_api.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5227,7 +5227,7 @@ static void nft_map_catchall_activate(const struct nft_ctx *ctx,

list_for_each_entry(catchall, &set->catchall_list, list) {
ext = nft_set_elem_ext(set, catchall->elem);
if (!nft_set_elem_active(ext, genmask))
if (nft_set_elem_active(ext, genmask))
continue;

elem.priv = catchall->elem;
Expand Down
13 changes: 6 additions & 7 deletions net/sched/cls_u32.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,10 +151,8 @@ TC_INDIRECT_SCOPE int u32_classify(struct sk_buff *skb,
int toff = off + key->off + (off2 & key->offmask);
__be32 *data, hdata;

if (skb_headroom(skb) + toff > INT_MAX)
goto out;

data = skb_header_pointer(skb, toff, 4, &hdata);
data = skb_header_pointer_careful(skb, toff, 4,
&hdata);
if (!data)
goto out;
if ((*data ^ key->val) & key->mask) {
Expand Down Expand Up @@ -204,8 +202,9 @@ TC_INDIRECT_SCOPE int u32_classify(struct sk_buff *skb,
if (ht->divisor) {
__be32 *data, hdata;

data = skb_header_pointer(skb, off + n->sel.hoff, 4,
&hdata);
data = skb_header_pointer_careful(skb,
off + n->sel.hoff,
4, &hdata);
if (!data)
goto out;
sel = ht->divisor & u32_hash_fold(*data, &n->sel,
Expand All @@ -219,7 +218,7 @@ TC_INDIRECT_SCOPE int u32_classify(struct sk_buff *skb,
if (n->sel.flags & TC_U32_VAROFFSET) {
__be16 *data, hdata;

data = skb_header_pointer(skb,
data = skb_header_pointer_careful(skb,
off + n->sel.offoff,
2, &hdata);
if (!data)
Expand Down
Loading