Skip to content

Test CVE remediation ciqlts8 6/22632972853#937

Draft
roxanan1996 wants to merge 6 commits intociqlts8_6from
test-cve-remediation_ciqlts8_6/22632972853
Draft

Test CVE remediation ciqlts8 6/22632972853#937
roxanan1996 wants to merge 6 commits intociqlts8_6from
test-cve-remediation_ciqlts8_6/22632972853

Conversation

@roxanan1996
Copy link
Contributor

@roxanan1996 roxanan1996 commented Mar 3, 2026

No description provided.

@roxanan1996
mptcp: fix race condition in mptcp_schedule_work()
de60814 
jira VULN-160804
cve CVE-2025-40258
commit-author Eric Dumazet <edumazet@google.com>
commit 035bca3

syzbot reported use-after-free in mptcp_schedule_work() [1]

Issue here is that mptcp_schedule_work() schedules a work,
then gets a refcount on sk->sk_refcnt if the work was scheduled.
This refcount will be released by mptcp_worker().

[A] if (schedule_work(...)) {
[B]     sock_hold(sk);
        return true;
    }

Problem is that mptcp_worker() can run immediately and complete before [B]

We need instead :

    sock_hold(sk);
    if (schedule_work(...))
        return true;
    sock_put(sk);

[1]
refcount_t: addition on 0; use-after-free.
 WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25
Call Trace:
 <TASK>
 __refcount_add include/linux/refcount.h:-1 [inline]
  __refcount_inc include/linux/refcount.h:366 [inline]
  refcount_inc include/linux/refcount.h:383 [inline]
  sock_hold include/net/sock.h:816 [inline]
  mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943
  mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316
  call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
  expire_timers kernel/time/timer.c:1798 [inline]
  __run_timers kernel/time/timer.c:2372 [inline]
  __run_timer_base+0x648/0x970 kernel/time/timer.c:2384
  run_timer_base kernel/time/timer.c:2393 [inline]
  run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
  handle_softirqs+0x22f/0x710 kernel/softirq.c:622
  __do_softirq kernel/softirq.c:656 [inline]
  run_ktimerd+0xcf/0x190 kernel/softirq.c:1138
  smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160
  kthread+0x711/0x8a0 kernel/kthread.c:463
  ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

	Cc: stable@vger.kernel.org
Fixes: 3b1d621 ("mptcp: implement and use MPTCP-level retransmission")
	Reported-by: syzbot+355158e7e301548a1424@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6915b46f.050a0220.3565dc.0028.GAE@google.com/T/#u
	Signed-off-by: Eric Dumazet <edumazet@google.com>
	Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251113103924.3737425-1-edumazet@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 035bca3)
	Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
@roxanan1996
drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
2dbb156 
jira VULN-161152
cve CVE-2025-40277
commit-author Ian Forbes <ian.forbes@broadcom.com>
commit 32b415a

This data originates from userspace and is used in buffer offset
calculations which could potentially overflow causing an out-of-bounds
access.

Fixes: 8ce75f8 ("drm/vmwgfx: Update device includes for DX device functionality")
	Reported-by: Rohit Keshri <rkeshri@redhat.com>
	Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
	Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
	Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patch.msgid.link/20251021190128.13014-1-ian.forbes@broadcom.com
(cherry picked from commit 32b415a)
	Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
@roxanan1996
fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
ef1f004 
jira VULN-161229
cve CVE-2025-40304
commit-author Albin Babu Varghese <albinbabuvarghese20@gmail.com>
commit 3637d34

Add bounds checking to prevent writes past framebuffer boundaries when
rendering text near screen edges. Return early if the Y position is off-screen
and clip image height to screen boundary. Break from the rendering loop if the
X position is off-screen. When clipping image width to fit the screen, update
the character count to match the clipped width to prevent buffer size
mismatches.

Without the character count update, bit_putcs_aligned and bit_putcs_unaligned
receive mismatched parameters where the buffer is allocated for the clipped
width but cnt reflects the original larger count, causing out-of-bounds writes.

	Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
	Suggested-by: Helge Deller <deller@gmx.de>
	Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
	Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
	Signed-off-by: Helge Deller <deller@gmx.de>
(cherry picked from commit 3637d34)
	Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
@roxanan1996
fbdev: bitblit: bound-check glyph index in bit_putcs*
c1763d6 
jira VULN-161268
cve CVE-2025-40322
commit-author Junjie Cao <junjie.cao@intel.com>
commit 18c4ef4

bit_putcs_aligned()/unaligned() derived the glyph pointer from the
character value masked by 0xff/0x1ff, which may exceed the actual font's
glyph count and read past the end of the built-in font array.
Clamp the index to the actual glyph count before computing the address.

This fixes a global out-of-bounds read reported by syzbot.

	Reported-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2
	Tested-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
	Signed-off-by: Junjie Cao <junjie.cao@intel.com>
	Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
	Signed-off-by: Helge Deller <deller@gmx.de>
	Cc: stable@vger.kernel.org
(cherry picked from commit 18c4ef4)
	Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
@roxanan1996
NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_in…
bb10a8b 
…valid

jira VULN-171916
cve CVE-2025-68349
commit-author Jonathan Curley <jcurley@purestorage.com>
commit e0f8058

Fixes a crash when layout is null during this call stack:

write_inode
    -> nfs4_write_inode
        -> pnfs_layoutcommit_inode

pnfs_set_layoutcommit relies on the lseg refcount to keep the layout
around. Need to clear NFS_INO_LAYOUTCOMMIT otherwise we might attempt
to reference a null layout.

Fixes: fe1cf94 ("pNFS: Clear all layout segment state in pnfs_mark_layout_stateid_invalid")
	Signed-off-by: Jonathan Curley <jcurley@purestorage.com>
	Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
(cherry picked from commit e0f8058)
	Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
@roxanan1996
net/sched: Enforce that teql can only be used as root qdisc
42544b5 
jira VULN-175588
cve CVE-2026-23074
commit-author Jamal Hadi Salim <jhs@mojatatu.com>
commit 50da4b9

Design intent of teql is that it is only supposed to be used as root qdisc.
We need to check for that constraint.

Although not important, I will describe the scenario that unearthed this
issue for the curious.

GangMin Kim <km.kim1503@gmail.com> managed to concot a scenario as follows:

ROOT qdisc 1:0 (QFQ)
  ├── class 1:1 (weight=15, lmax=16384) netem with delay 6.4s
  └── class 1:2 (weight=1, lmax=1514) teql

GangMin sends a packet which is enqueued to 1:1 (netem).
Any invocation of dequeue by QFQ from this class will not return a packet
until after 6.4s. In the meantime, a second packet is sent and it lands on
1:2. teql's enqueue will return success and this will activate class 1:2.
Main issue is that teql only updates the parent visible qlen (sch->q.qlen)
at dequeue. Since QFQ will only call dequeue if peek succeeds (and teql's
peek always returns NULL), dequeue will never be called and thus the qlen
will remain as 0. With that in mind, when GangMin updates 1:2's lmax value,
the qfq_change_class calls qfq_deact_rm_from_agg. Since the child qdisc's
qlen was not incremented, qfq fails to deactivate the class, but still
frees its pointers from the aggregate. So when the first packet is
rescheduled after 6.4 seconds (netem's delay), a dangling pointer is
accessed causing GangMin's causing a UAF.

Fixes: 1da177e ("Linux-2.6.12-rc2")
	Reported-by: GangMin Kim <km.kim1503@gmail.com>
	Tested-by: Victor Nogueira <victor@mojatatu.com>
	Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://patch.msgid.link/20260114160243.913069-2-jhs@mojatatu.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 50da4b9)
	Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
@roxanan1996 roxanan1996 marked this pull request as draft March 3, 2026 17:07
@github-actions
Copy link

github-actions bot commented Mar 3, 2026

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/22634746396

@github-actions
Copy link

github-actions bot commented Mar 3, 2026

JIRA PR Check Results

6 commit(s) with issues found:

Commit 42544b538671

Summary: net/sched: Enforce that teql can only be used as root qdisc

❌ Errors:

  • VULN-175588: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

  • VULN-175588: No time logged - please log time manually

Commit bb10a8b971f1

Summary: NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

❌ Errors:

  • VULN-171916: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

  • VULN-171916: No time logged - please log time manually

Commit c1763d6ffaa4

Summary: fbdev: bitblit: bound-check glyph index in bit_putcs*

❌ Errors:

  • VULN-161268: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

  • VULN-161268: No time logged - please log time manually

Commit ef1f0046d3d4

Summary: fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds

❌ Errors:

  • VULN-161229: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

  • VULN-161229: No time logged - please log time manually

Commit 2dbb15602dec

Summary: drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE

❌ Errors:

  • VULN-161152: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

  • VULN-161152: No time logged - please log time manually

Commit de6081435d4a

Summary: mptcp: fix race condition in mptcp_schedule_work()

❌ Errors:

  • VULN-160804: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

  • VULN-160804: No time logged - please log time manually

Summary: Checked 6 commit(s) total.

@github-actions
Copy link

github-actions bot commented Mar 3, 2026

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/22634746396

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@roxanan1996