ON HOLD [ciqlts9_2] Multiple patches tested (7 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

scsi: ses: Fix possible desc_ptr out-of-bounds accesses

jira VULN-158439
cve CVE-2023-53675
commit-author Tomas Henzl <thenzl@redhat.com>
commit 801ab13d50cf3d26170ee073ea8bb4eececb76ab

NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL

jira VULN-158471
cve CVE-2023-53680
commit-author Chuck Lever <chuck.lever@oracle.com>
commit 804d8e0a6e54427268790472781e03bc243f4ee3

nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

jira VULN-136357
cve CVE-2025-38724
commit-author Jeff Layton <jlayton@kernel.org>
commit 908e4ead7f757504d8b345452730636e298cbf68

smb: client: fix race with concurrent opens in rename(2)

jira VULN-155188
cve CVE-2025-39825
commit-author Paulo Alcantara <pc@manguebit.org>
commit d84291fc7453df7881a970716f8256273aca5747

Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync

jira VULN-158795
cve CVE-2025-39982
commit-author Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
commit 9e622804d57e2d08f0271200606bd1270f75126f

libceph: fix potential use-after-free in have_mon_and_osd_map()

jira VULN-170013
cve CVE-2025-68285
commit-author Ilya Dryomov <idryomov@gmail.com>
commit 076381c261374c587700b3accf410bdd2dba334e

usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

jira VULN-170018
cve CVE-2025-68287
commit-author Manish Nagar <manish.nagar@oss.qualcomm.com>
commit e4037689a366743c4233966f0e74bc455820d316

Test Results

✅ Build Stage

• Status: Passed
• Build Time: 24m 4s
• Total Time: 25m 43s
• View build logs

✅ Boot Verification

• Status: Passed
• View boot logs

✅ Kernel Selftests

• Passed: 137
• Failed: 26
• View kselftest logs

✅ Test Comparison

• Status: Passed - Within acceptable threshold (±3 tests)
• Compared against: ciqlts9_2

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 21000194059

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/21002982063

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit f7d91b22a78 (scsi: ses: Fix possible desc_ptr out-of-bounds accesses) → upstream 801ab13d50cf
  Differences found:

diff -u b/drivers/scsi/ses.c b/drivers/scsi/ses.c
--- b/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -556,4 +556,4 @@
-			int max_desc_len;
+			struct enclosure_component *ecomp;
 
 			if (desc_ptr) {
 				if (desc_ptr + 3 >= buf + page7_len) {

• ⚠️ PR commit 74f8ade72f6 (smb: client: fix race with concurrent opens in rename(2)) → upstream d84291fc7453
  Differences found:

diff -u b/fs/cifs/inode.c b/fs/smb/client/inode.c
--- b/fs/cifs/inode.c
+++ b/fs/smb/client/inode.c
@@ -2246,7 +2246,7 @@
 	}
 
 	/* force revalidate to go get info when needed */
-	CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
+		target_dir->i_mtime = current_time(source_dir);
 
 cifs_rename_exit:
 	kfree(info_buf_source);
@@ -2602,9 +2616,11 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 			goto cifs_rename_exit;
 		rc = cifs_do_rename(xid, source_dentry, from_name,
 				    target_dentry, to_name);
+		if (!rc)
+			rehash = false;
 	}
 
 	/* force revalidate to go get info when needed */
 	CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
 
 cifs_rename_exit:
@@ -2608,6 +2624,8 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 	CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
 
 cifs_rename_exit:
+	if (rehash)
+		d_rehash(target_dentry);
 	kfree(info_buf_source);
 	free_dentry_path(page2);
 	free_dentry_path(page1);

• ⚠️ PR commit f4c9f27c681 (libceph: fix potential use-after-free in have_mon_and_osd_map()) → upstream 076381c26137
  Differences found:

diff -u b/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
--- b/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -800,9 +793,29 @@ INTERDIFF: rejected hunk from patch1, cannot diff context
 	if (err < 0)
 		return err;
 
-	while (!have_mon_and_osd_map(client)) {
-		if (timeout && time_after_eq(jiffies, started + timeout))
-			return -ETIMEDOUT;
+	add_wait_queue(&client->auth_wq, &wait);
+	for (;;) {
+		mutex_lock(&client->monc.mutex);
+		err = client->auth_err;
+		have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+		mutex_unlock(&client->monc.mutex);
+
+		down_read(&client->osdc.lock);
+		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+		up_read(&client->osdc.lock);
+
+		if (err || (have_monmap && have_osdmap))
+			break;
+
+		if (signal_pending(current)) {
+			err = -ERESTARTSYS;
+			break;
+		}
+
+		if (!timeout) {
+			err = -ETIMEDOUT;
+			break;
+		}
 
 		/* wait */
 		dout("mount waiting for mon_map\n");
@@ -800,9 +793,29 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 	if (err < 0)
 		return err;
 
-	while (!have_mon_and_osd_map(client)) {
-		if (timeout && time_after_eq(jiffies, started + timeout))
-			return -ETIMEDOUT;
+	add_wait_queue(&client->auth_wq, &wait);
+	for (;;) {
+		mutex_lock(&client->monc.mutex);
+		err = client->auth_err;
+		have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+		mutex_unlock(&client->monc.mutex);
+
+		down_read(&client->osdc.lock);
+		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+		up_read(&client->osdc.lock);
+
+		if (err || (have_monmap && have_osdmap))
+			break;
+
+		if (signal_pending(current)) {
+			err = -ERESTARTSYS;
+			break;
+		}
+
+		if (!timeout) {
+			err = -ETIMEDOUT;
+			break;
+		}
 
 		/* wait */
 		dout("mount waiting for mon_map\n");

This is an automated interdiff check for backported commits.

[github-actions]

JIRA PR Check Results

2 commit(s) with issues found:

Commit ff13eeeda513

Summary: usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

❌ Errors:

• VULN-170018: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

• VULN-170018: No time logged - please log time manually

Commit f4c9f27c6810

Summary: libceph: fix potential use-after-free in have_mon_and_osd_map()

❌ Errors:

• VULN-170013: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

• VULN-170013: No time logged - please log time manually

---

Summary: Checked 7 commit(s) total.

[github-actions]

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/21002982063

[roxanan1996]

🔍 Interdiff Analysis

* ⚠️ PR commit `f7d91b22a78 (scsi: ses: Fix possible desc_ptr out-of-bounds accesses)` → upstream `801ab13d50cf`
  **Differences found:**

diff -u b/drivers/scsi/ses.c b/drivers/scsi/ses.c
--- b/drivers/scsi/ses.c
+++ b/drivers/scsi/ses.c
@@ -556,4 +556,4 @@
-			int max_desc_len;
+			struct enclosure_component *ecomp;
 
 			if (desc_ptr) {
 				if (desc_ptr + 3 >= buf + page7_len) {

@bmastbergen you may consider backporting db95d4d
scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses which is
CVE-2023-7324.

* ⚠️ PR commit `74f8ade72f6 (smb: client: fix race with concurrent opens in rename(2))` → upstream `d84291fc7453`
  **Differences found:**

diff -u b/fs/cifs/inode.c b/fs/smb/client/inode.c
--- b/fs/cifs/inode.c
+++ b/fs/smb/client/inode.c
@@ -2246,7 +2246,7 @@
 	}
 
 	/* force revalidate to go get info when needed */
-	CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
+		target_dir->i_mtime = current_time(source_dir);
 
 cifs_rename_exit:
 	kfree(info_buf_source);
@@ -2602,9 +2616,11 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 			goto cifs_rename_exit;
 		rc = cifs_do_rename(xid, source_dentry, from_name,
 				    target_dentry, to_name);
+		if (!rc)
+			rehash = false;
 	}
 
 	/* force revalidate to go get info when needed */
 	CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
 
 cifs_rename_exit:
@@ -2608,6 +2624,8 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 	CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
 
 cifs_rename_exit:
+	if (rehash)
+		d_rehash(target_dentry);
 	kfree(info_buf_source);
 	free_dentry_path(page2);
 	free_dentry_path(page1);

* ⚠️ PR commit `f4c9f27c681 (libceph: fix potential use-after-free in have_mon_and_osd_map())` → upstream `076381c26137`
  **Differences found:**

diff -u b/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
--- b/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -800,9 +793,29 @@ INTERDIFF: rejected hunk from patch1, cannot diff context
 	if (err < 0)
 		return err;
 
-	while (!have_mon_and_osd_map(client)) {
-		if (timeout && time_after_eq(jiffies, started + timeout))
-			return -ETIMEDOUT;
+	add_wait_queue(&client->auth_wq, &wait);
+	for (;;) {
+		mutex_lock(&client->monc.mutex);
+		err = client->auth_err;
+		have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+		mutex_unlock(&client->monc.mutex);
+
+		down_read(&client->osdc.lock);
+		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+		up_read(&client->osdc.lock);
+
+		if (err || (have_monmap && have_osdmap))
+			break;
+
+		if (signal_pending(current)) {
+			err = -ERESTARTSYS;
+			break;
+		}
+
+		if (!timeout) {
+			err = -ETIMEDOUT;
+			break;
+		}
 
 		/* wait */
 		dout("mount waiting for mon_map\n");
@@ -800,9 +793,29 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 	if (err < 0)
 		return err;
 
-	while (!have_mon_and_osd_map(client)) {
-		if (timeout && time_after_eq(jiffies, started + timeout))
-			return -ETIMEDOUT;
+	add_wait_queue(&client->auth_wq, &wait);
+	for (;;) {
+		mutex_lock(&client->monc.mutex);
+		err = client->auth_err;
+		have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+		mutex_unlock(&client->monc.mutex);
+
+		down_read(&client->osdc.lock);
+		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+		up_read(&client->osdc.lock);
+
+		if (err || (have_monmap && have_osdmap))
+			break;
+
+		if (signal_pending(current)) {
+			err = -ERESTARTSYS;
+			break;
+		}
+
+		if (!timeout) {
+			err = -ETIMEDOUT;
+			break;
+		}
 
 		/* wait */
 		dout("mount waiting for mon_map\n");

This is an automated interdiff check for backported commits.