[ciqlts8_6] Multiple patches tested (3 commits) by ciq-kernel-automation[bot] · Pull Request #1587 · ctrliq/kernel-src-tree

ciq-kernel-automation · 2026-09-08T20:04:05Z

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

ipc: limit next_id allocation to the valid ID range

jira VULN-189038
cve CVE-2026-52923
commit-author Linpu Yu <linpu5433@gmail.com>
commit fa0b9b2b7ae3539908d69c2b9ac0d144d9bc5139

ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

jira VULN-204565
cve CVE-2026-74597
commit-author Zhiling Zou <zhilinz@nebusec.ai>
commit f803c086399da277b5d0ff36a107d0f162751800

net: ipv6: clear suppressed fib6 rule result

jira VULN-204244
cve CVE-2026-74581
commit-author Zhiling Zou <zhilinz@nebusec.ai>
commit 6aea62e433fe1b586202a5fee8b5807ce635e1d7
upstream-diff Upstream clears the route with `res->rt6 = NULL` on
  struct fib6_result. This tree predates both the fib6_result
  conversion and d839b3f55194 ("ipv6: fix memory leak in
  fib6_rule_suppress"), so fib6_rule_suppress() has no `res` and no
  ip6_rt_put_flags(); it reads the route straight from arg->result
  (struct fib_lookup_arg). The equivalent clear is therefore
  `arg->result = NULL`. The leak path is unchanged: fib6_rule_lookup()
  returns arg.result after fib_rules_lookup(), which is what hands back
  the freed route. Taking the upstream form would require the
  fib6_result refactor, which changes the ->suppress function-pointer
  signature in struct fib_rules_ops (kABI).

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	21m 56s	22m 55s
aarch64	9m 58s	10m 40s

View build logs

✅ Boot Verification

Status: Passed (all architectures)
View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	108	31	ciqlts8_6	✅ No regressions
aarch64	66	21	ciqlts8_6	✅ No regressions

View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1438	13	ciqlts8_6	✅ No regressions
aarch64	1426	13	ciqlts8_6	✅ No regressions

View LTP logs

aarch64 newly passing:

starvation (FAIL -> PASS)

🤖 This PR was automatically generated by GitHub Actions
Run ID: 34249029955

jira VULN-189038 cve CVE-2026-52923 commit-author Linpu Yu <linpu5433@gmail.com> commit fa0b9b2 The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the valid tail of the SysV IPC id space is full, the allocation can spill beyond ipc_mni. The returned SysV IPC id still uses the normal index encoding, so later lookup and removal can target the wrong slot. This leaves the real IDR entry behind and breaks the IDR state for the object. The bug is in ipc_idr_alloc() in the checkpoint/restore path. 1. ids->next_id is passed to: idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), 0, ...) 2. The zero upper bound makes the allocation effectively open-ended. Once the valid SysV IPC tail is occupied, idr_alloc() can spill past ipc_mni and allocate an entry beyond the valid IPC id range. 3. The new object id is still encoded with the narrower SysV IPC index width: new->id = (new->seq << ipcmni_seq_shift()) + idx 4. Later removal goes through ipc_rmid(), which uses: ipcid_to_idx(ipcp->id) That truncates the real IDR index. An object actually stored at a high index can then be removed as if it lived at a low in-range index. 5. For shared memory, shm_destroy() frees the current object anyway, but the real high IDR slot is left behind as a dangling pointer. 6. A subsequent walk of /proc/sysvipc/shm reaches the stale IDR entry and dereferences freed memory. Prevent this by bounding the requested allocation to ipc_mni so the checkpoint/restore path fails once the valid range is exhausted. Link: https://lore.kernel.org/cover.1778336914.git.linpu5433@gmail.com Link: https://lore.kernel.org/2eebe949bfa7d1f6e13b5be6a92c64c850ce9d45.1778336914.git.linpu5433@gmail.com Fixes: 03f5956 ("ipc: add sysctl to specify desired next object id") Signed-off-by: Linpu Yu <linpu5433@gmail.com> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn> Reported-by: Yuan Tan <yuantan098@gmail.com> Reported-by: Yifan Wu <yifanwucs@gmail.com> Reported-by: Juefei Pu <tomapufckgml@gmail.com> Reported-by: Xin Liu <bird@lzu.edu.cn> Cc: Kees Cook <kees@kernel.org> Cc: Stanislav Kinsbursky <skinsbursky@parallels.com> Cc: Davidlohr Bueso <dave@stgolabs.net> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> (cherry picked from commit fa0b9b2) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-204565 cve CVE-2026-74597 commit-author Zhiling Zou <zhilinz@nebusec.ai> commit f803c08 ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb. If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info. Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack. Fixes: e490d1d ("[IPV6] IP6TUNNEL: Split out generic routine in ip6ip6_err().") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/fe1a5e765fbca88d69391887f0ed26a19e3e4d39.1785736562.git.zhilinz@nebusec.ai Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit f803c08) Signed-off-by: Shreeya Patel <spatel@ciq.com>

jira VULN-204244 cve CVE-2026-74581 commit-author Zhiling Zou <zhilinz@nebusec.ai> commit 6aea62e upstream-diff Upstream clears the route with `res->rt6 = NULL` on struct fib6_result. This tree predates both the fib6_result conversion and d839b3f ("ipv6: fix memory leak in fib6_rule_suppress"), so fib6_rule_suppress() has no `res` and no ip6_rt_put_flags(); it reads the route straight from arg->result (struct fib_lookup_arg). The equivalent clear is therefore `arg->result = NULL`. The leak path is unchanged: fib6_rule_lookup() returns arg.result after fib_rules_lookup(), which is what hands back the freed route. Taking the upstream form would require the fib6_result refactor, which changes the ->suppress function-pointer signature in struct fib_rules_ops (kABI). fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release(). Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one. Fixes: cdef485 ("ipv6: fix memory leak in fib6_rule_suppress") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai> Signed-off-by: Ren Wei <enjou1224z@gmail.com> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/4b8acb7787d54e440155585dd32ebdf0bef7d122.1784710966.git.zhilinz@nebusec.ai Signed-off-by: Jakub Kicinski <kuba@kernel.org> (cherry picked from commit 6aea62e) Signed-off-by: Shreeya Patel <spatel@ciq.com>

github-actions · 2026-09-08T20:15:08Z

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/34273681914

github-actions · 2026-09-08T20:15:09Z

🔍 Interdiff Analysis

⚠️ PR commit 9b26496f0a81 (net: ipv6: clear suppressed fib6 rule result) → upstream 6aea62e433fe
Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -289,7 +289,6 @@
 
 suppress_route:
 	ip6_rt_put(rt);
-	arg->result = NULL;
 	return true;
 }
 

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -308,6 +308,7 @@
 
 suppress_route:
 	ip6_rt_put_flags(rt, flags);
+	res->rt6 = NULL;
 	return true;
 }
 

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -286,6 +286,6 @@
 
 suppress_route:
-	ip6_rt_put(rt);
+	ip6_rt_put_flags(rt, flags);
 	return true;
 }

This is an automated interdiff check for backported commits.

github-actions · 2026-09-08T20:16:19Z

JIRA PR Check Results

3 commit(s) with issues found:

Commit `9b26496f0a81`

Summary: net: ipv6: clear suppressed fib6 rule result

❌ Errors:

VULN-204244: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

VULN-204244: No time logged - please log time manually

Commit `d5c691d51ba7`

Summary: ip6_tunnel: clear skb2->cb[] in ip6ip6_err()

❌ Errors:

VULN-204565: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

VULN-204565: No time logged - please log time manually

Commit `bd6303415342`

Summary: ipc: limit next_id allocation to the valid ID range

❌ Errors:

VULN-189038: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

VULN-189038: No time logged - please log time manually

Summary: Checked 3 commit(s) total.

github-actions · 2026-09-08T20:16:20Z

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/34273681914

kerneltoast

bmastbergen

🥌

shreeya-patel98 added 3 commits September 8, 2026 16:00

ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Sep 8, 2026

kerneltoast approved these changes Sep 9, 2026

View reviewed changes

bmastbergen approved these changes Sep 9, 2026

View reviewed changes

shreeya-patel98 merged commit 3423ffd into ciqlts8_6 Sep 10, 2026
5 of 6 checks passed

shreeya-patel98 deleted the {shreeya_nebusec}_ciqlts8_6 branch September 10, 2026 08:01

Navigation Menu

Uh oh!

[ciqlts8_6] Multiple patches tested (3 commits) - #1587

[ciqlts8_6] Multiple patches tested (3 commits)#1587
shreeya-patel98 merged 3 commits into
ciqlts8_6from
{shreeya_nebusec}_ciqlts8_6

ciq-kernel-automation Bot commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

kerneltoast left a comment

Uh oh!

bmastbergen left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

ciq-kernel-automation Bot commented Sep 8, 2026

Summary

Commit Message(s)

Test Results

✅ Build Stage

✅ Boot Verification

✅ Kernel Selftests

✅ LTP Results

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

github-actions Bot commented Sep 8, 2026

🔍 Interdiff Analysis

Uh oh!

github-actions Bot commented Sep 8, 2026

JIRA PR Check Results

Commit 9b26496f0a81

Commit d5c691d51ba7

Commit bd6303415342

Uh oh!

github-actions Bot commented Sep 8, 2026

Uh oh!

kerneltoast left a comment

Choose a reason for hiding this comment

Uh oh!

bmastbergen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

3 participants

Commit `9b26496f0a81`

Commit `d5c691d51ba7`

Commit `bd6303415342`