Skip to content

[ciqlts9_4] Multiple patches tested (8 commits)#1242

Open
ciq-kernel-automation[bot] wants to merge 8 commits into
ciqlts9_4from
{ciq_kernel_automation}_ciqlts9_4
Open

[ciqlts9_4] Multiple patches tested (8 commits)#1242
ciq-kernel-automation[bot] wants to merge 8 commits into
ciqlts9_4from
{ciq_kernel_automation}_ciqlts9_4

Conversation

@ciq-kernel-automation
Copy link
Copy Markdown

@ciq-kernel-automation ciq-kernel-automation Bot commented May 18, 2026 •
edited
Loading

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()

jira VULN-36120
cve CVE-2023-52877
commit-author Jimmy Hu <hhhuuu@google.com>
commit 4987daf86c152ff882d51572d154ad12e4ff3a4b

Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()

jira VULN-36025
cve CVE-2023-52840
commit-author Dan Carpenter <dan.carpenter@linaro.org>
commit eb988e46da2e4eae89f5337e047ce372fe33d5b1

virtio-blk: fix implicit overflow on virtio_max_dma_size

jira VULN-35743
cve CVE-2023-52762
commit-author zhenwei pi <pizhenwei@bytedance.com>
commit fafb51a67fb883eb2dde352539df939a251851be

SUNRPC: Fix RPC client cleaned up the freed pipefs dentries

jira VULN-35879
cve CVE-2023-52803
commit-author felix <fuzhen5@huawei.com>
commit bfca5fb4e97c46503ddfc582335917b0cc228264

wifi: rt2x00: restart beacon queue when hardware reset

jira VULN-35143
cve CVE-2023-52595
commit-author Shiji Yang <yangshiji66@outlook.com>
commit a11d965a218f0cd95b13fe44d0bcd8a20ce134a8

pwm: Fix double shift bug

jira VULN-35725
cve CVE-2023-52756
commit-author Dan Carpenter <dan.carpenter@linaro.org>
commit d27abbfd4888d79dd24baf50e774631046ac4732

bonding: stop the device in bond_setup_by_slave()

jira VULN-35786
cve CVE-2023-52784
commit-author Eric Dumazet <edumazet@google.com>
commit 3cffa2ddc4d3fcf70cde361236f5a614f81a09b2

usb: config: fix iteration issue in 'usb_get_bos_descriptor()'

jira VULN-35775
cve CVE-2023-52781
commit-author Niklas Neronin <niklas.neronin@linux.intel.com>
commit 974bba5c118f4c2baf00de0356e3e4f7928b4cbc

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 28m 16s 29m 19s
aarch64 15m 56s 16m 44s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 188 29 ciqlts9_4 ✅ No regressions
aarch64 145 30 ciqlts9_4 ✅ No regressions

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 1447 81 ciqlts9_4 ✅ No regressions
aarch64 1418 82 ciqlts9_4 ✅ No regressions

🤖 This PR was automatically generated by GitHub Actions
Run ID: 26055484296

@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label May 18, 2026
CIQ Kernel Automation added 8 commits May 18, 2026 15:24
@bmastbergen
usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm()
3b44651 
jira VULN-36120
cve CVE-2023-52877
commit-author Jimmy Hu <hhhuuu@google.com>
commit 4987daf

It is possible that typec_register_partner() returns ERR_PTR on failure.
When port->partner is an error, a NULL pointer dereference may occur as
shown below.

[91222.095236][  T319] typec port0: failed to register partner (-17)
...
[91225.061491][  T319] Unable to handle kernel NULL pointer dereference
at virtual address 000000000000039f
[91225.274642][  T319] pc : tcpm_pd_data_request+0x310/0x13fc
[91225.274646][  T319] lr : tcpm_pd_data_request+0x298/0x13fc
[91225.308067][  T319] Call trace:
[91225.308070][  T319]  tcpm_pd_data_request+0x310/0x13fc
[91225.308073][  T319]  tcpm_pd_rx_handler+0x100/0x9e8
[91225.355900][  T319]  kthread_worker_fn+0x178/0x58c
[91225.355902][  T319]  kthread+0x150/0x200
[91225.355905][  T319]  ret_from_fork+0x10/0x30

Add a check for port->partner to avoid dereferencing a NULL pointer.

Fixes: 5e1d4c4 ("usb: typec: tcpm: Determine common SVDM Version")
	Cc: stable@vger.kernel.org
	Signed-off-by: Jimmy Hu <hhhuuu@google.com>
Link: https://lore.kernel.org/r/20231020012132.100960-1-hhhuuu@google.com
	Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 4987daf)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@bmastbergen
Input: synaptics-rmi4 - fix use after free in rmi_unregister_function()
fce654f 
jira VULN-36025
cve CVE-2023-52840
commit-author Dan Carpenter <dan.carpenter@linaro.org>
commit eb988e4

The put_device() calls rmi_release_function() which frees "fn" so the
dereference on the next line "fn->num_of_irqs" is a use after free.
Move the put_device() to the end to fix this.

Fixes: 24d28e4 ("Input: synaptics-rmi4 - convert irq distribution to irq_domain")
	Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/706efd36-7561-42f3-adfa-dd1d0bd4f5a1@moroto.mountain
	Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
(cherry picked from commit eb988e4)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@bmastbergen
virtio-blk: fix implicit overflow on virtio_max_dma_size
e99350b 
jira VULN-35743
cve CVE-2023-52762
commit-author zhenwei pi <pizhenwei@bytedance.com>
commit fafb51a

The following codes have an implicit conversion from size_t to u32:
(u32)max_size = (size_t)virtio_max_dma_size(vdev);

This may lead overflow, Ex (size_t)4G -> (u32)0. Once
virtio_max_dma_size() has a larger size than U32_MAX, use U32_MAX
instead.

	Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Message-Id: <20230904061045.510460-1-pizhenwei@bytedance.com>
	Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
(cherry picked from commit fafb51a)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@bmastbergen
SUNRPC: Fix RPC client cleaned up the freed pipefs dentries
fd5af3e 
jira VULN-35879
cve CVE-2023-52803
commit-author felix <fuzhen5@huawei.com>
commit bfca5fb

RPC client pipefs dentries cleanup is in separated rpc_remove_pipedir()
workqueue,which takes care about pipefs superblock locking.
In some special scenarios, when kernel frees the pipefs sb of the
current client and immediately alloctes a new pipefs sb,
rpc_remove_pipedir function would misjudge the existence of pipefs
sb which is not the one it used to hold. As a result,
the rpc_remove_pipedir would clean the released freed pipefs dentries.

To fix this issue, rpc_remove_pipedir should check whether the
current pipefs sb is consistent with the original pipefs sb.

This error can be catched by KASAN:
=========================================================
[  250.497700] BUG: KASAN: slab-use-after-free in dget_parent+0x195/0x200
[  250.498315] Read of size 4 at addr ffff88800a2ab804 by task kworker/0:18/106503
[  250.500549] Workqueue: events rpc_free_client_work
[  250.501001] Call Trace:
[  250.502880]  kasan_report+0xb6/0xf0
[  250.503209]  ? dget_parent+0x195/0x200
[  250.503561]  dget_parent+0x195/0x200
[  250.503897]  ? __pfx_rpc_clntdir_depopulate+0x10/0x10
[  250.504384]  rpc_rmdir_depopulate+0x1b/0x90
[  250.504781]  rpc_remove_client_dir+0xf5/0x150
[  250.505195]  rpc_free_client_work+0xe4/0x230
[  250.505598]  process_one_work+0x8ee/0x13b0
...
[   22.039056] Allocated by task 244:
[   22.039390]  kasan_save_stack+0x22/0x50
[   22.039758]  kasan_set_track+0x25/0x30
[   22.040109]  __kasan_slab_alloc+0x59/0x70
[   22.040487]  kmem_cache_alloc_lru+0xf0/0x240
[   22.040889]  __d_alloc+0x31/0x8e0
[   22.041207]  d_alloc+0x44/0x1f0
[   22.041514]  __rpc_lookup_create_exclusive+0x11c/0x140
[   22.041987]  rpc_mkdir_populate.constprop.0+0x5f/0x110
[   22.042459]  rpc_create_client_dir+0x34/0x150
[   22.042874]  rpc_setup_pipedir_sb+0x102/0x1c0
[   22.043284]  rpc_client_register+0x136/0x4e0
[   22.043689]  rpc_new_client+0x911/0x1020
[   22.044057]  rpc_create_xprt+0xcb/0x370
[   22.044417]  rpc_create+0x36b/0x6c0
...
[   22.049524] Freed by task 0:
[   22.049803]  kasan_save_stack+0x22/0x50
[   22.050165]  kasan_set_track+0x25/0x30
[   22.050520]  kasan_save_free_info+0x2b/0x50
[   22.050921]  __kasan_slab_free+0x10e/0x1a0
[   22.051306]  kmem_cache_free+0xa5/0x390
[   22.051667]  rcu_core+0x62c/0x1930
[   22.051995]  __do_softirq+0x165/0x52a
[   22.052347]
[   22.052503] Last potentially related work creation:
[   22.052952]  kasan_save_stack+0x22/0x50
[   22.053313]  __kasan_record_aux_stack+0x8e/0xa0
[   22.053739]  __call_rcu_common.constprop.0+0x6b/0x8b0
[   22.054209]  dentry_free+0xb2/0x140
[   22.054540]  __dentry_kill+0x3be/0x540
[   22.054900]  shrink_dentry_list+0x199/0x510
[   22.055293]  shrink_dcache_parent+0x190/0x240
[   22.055703]  do_one_tree+0x11/0x40
[   22.056028]  shrink_dcache_for_umount+0x61/0x140
[   22.056461]  generic_shutdown_super+0x70/0x590
[   22.056879]  kill_anon_super+0x3a/0x60
[   22.057234]  rpc_kill_sb+0x121/0x200

Fixes: 0157d02 ("SUNRPC: handle RPC client pipefs dentries by network namespace aware routines")
	Signed-off-by: felix <fuzhen5@huawei.com>
	Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
(cherry picked from commit bfca5fb)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@bmastbergen
wifi: rt2x00: restart beacon queue when hardware reset
0661eb5 
jira VULN-35143
cve CVE-2023-52595
commit-author Shiji Yang <yangshiji66@outlook.com>
commit a11d965

When a hardware reset is triggered, all registers are reset, so all
queues are forced to stop in hardware interface. However, mac80211
will not automatically stop the queue. If we don't manually stop the
beacon queue, the queue will be deadlocked and unable to start again.
This patch fixes the issue where Apple devices cannot connect to the
AP after calling ieee80211_restart_hw().

	Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
	Acked-by: Stanislaw Gruszka <stf_xl@wp.pl>
	Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/TYAP286MB031530EB6D98DCE4DF20766CBCA4A@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM
(cherry picked from commit a11d965)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@bmastbergen
pwm: Fix double shift bug
8b14d37 
jira VULN-35725
cve CVE-2023-52756
commit-author Dan Carpenter <dan.carpenter@linaro.org>
commit d27abbf

These enums are passed to set/test_bit().  The set/test_bit() functions
take a bit number instead of a shifted value.  Passing a shifted value
is a double shift bug like doing BIT(BIT(1)).  The double shift bug
doesn't cause a problem here because we are only checking 0 and 1 but
if the value was 5 or above then it can lead to a buffer overflow.

	Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
	Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
	Reviewed-by: Sam Protsenko <semen.protsenko@linaro.org>
	Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
(cherry picked from commit d27abbf)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@bmastbergen
bonding: stop the device in bond_setup_by_slave()
132ced2 
jira VULN-35786
cve CVE-2023-52784
commit-author Eric Dumazet <edumazet@google.com>
commit 3cffa2d

Commit 9eed321 ("net: lapbether: only support ethernet devices")
has been able to keep syzbot away from net/lapb, until today.

In the following splat [1], the issue is that a lapbether device has
been created on a bonding device without members. Then adding a non
ARPHRD_ETHER member forced the bonding master to change its type.

The fix is to make sure we call dev_close() in bond_setup_by_slave()
so that the potential linked lapbether devices (or any other devices
having assumptions on the physical device) are removed.

A similar bug has been addressed in commit 40baec2
("bonding: fix panic on non-ARPHRD_ETHER enslave failure")

[1]
skbuff: skb_under_panic: text:ffff800089508810 len:44 put:40 head:ffff0000c78e7c00 data:ffff0000c78e7bea tail:0x16 end:0x140 dev:bond0
kernel BUG at net/core/skbuff.c:192 !
Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
Modules linked in:
CPU: 0 PID: 6007 Comm: syz-executor383 Not tainted 6.6.0-rc3-syzkaller-gbf6547d8715b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : skb_panic net/core/skbuff.c:188 [inline]
pc : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202
lr : skb_panic net/core/skbuff.c:188 [inline]
lr : skb_under_panic+0x13c/0x140 net/core/skbuff.c:202
sp : ffff800096a06aa0
x29: ffff800096a06ab0 x28: ffff800096a06ba0 x27: dfff800000000000
x26: ffff0000ce9b9b50 x25: 0000000000000016 x24: ffff0000c78e7bea
x23: ffff0000c78e7c00 x22: 000000000000002c x21: 0000000000000140
x20: 0000000000000028 x19: ffff800089508810 x18: ffff800096a06100
x17: 0000000000000000 x16: ffff80008a629a3c x15: 0000000000000001
x14: 1fffe00036837a32 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000201 x10: 0000000000000000 x9 : cb50b496c519aa00
x8 : cb50b496c519aa00 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800096a063b8 x4 : ffff80008e280f80 x3 : ffff8000805ad11c
x2 : 0000000000000001 x1 : 0000000100000201 x0 : 0000000000000086
Call trace:
skb_panic net/core/skbuff.c:188 [inline]
skb_under_panic+0x13c/0x140 net/core/skbuff.c:202
skb_push+0xf0/0x108 net/core/skbuff.c:2446
ip6gre_header+0xbc/0x738 net/ipv6/ip6_gre.c:1384
dev_hard_header include/linux/netdevice.h:3136 [inline]
lapbeth_data_transmit+0x1c4/0x298 drivers/net/wan/lapbether.c:257
lapb_data_transmit+0x8c/0xb0 net/lapb/lapb_iface.c:447
lapb_transmit_buffer+0x178/0x204 net/lapb/lapb_out.c:149
lapb_send_control+0x220/0x320 net/lapb/lapb_subr.c:251
__lapb_disconnect_request+0x9c/0x17c net/lapb/lapb_iface.c:326
lapb_device_event+0x288/0x4e0 net/lapb/lapb_iface.c:492
notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461
call_netdevice_notifiers_info net/core/dev.c:1970 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2008 [inline]
call_netdevice_notifiers net/core/dev.c:2022 [inline]
__dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508
dev_close_many+0x1e0/0x470 net/core/dev.c:1559
dev_close+0x174/0x250 net/core/dev.c:1585
lapbeth_device_event+0x2e4/0x958 drivers/net/wan/lapbether.c:466
notifier_call_chain+0x1a4/0x510 kernel/notifier.c:93
raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:461
call_netdevice_notifiers_info net/core/dev.c:1970 [inline]
call_netdevice_notifiers_extack net/core/dev.c:2008 [inline]
call_netdevice_notifiers net/core/dev.c:2022 [inline]
__dev_close_many+0x1b8/0x3c4 net/core/dev.c:1508
dev_close_many+0x1e0/0x470 net/core/dev.c:1559
dev_close+0x174/0x250 net/core/dev.c:1585
bond_enslave+0x2298/0x30cc drivers/net/bonding/bond_main.c:2332
bond_do_ioctl+0x268/0xc64 drivers/net/bonding/bond_main.c:4539
dev_ifsioc+0x754/0x9ac
dev_ioctl+0x4d8/0xd34 net/core/dev_ioctl.c:786
sock_do_ioctl+0x1d4/0x2d0 net/socket.c:1217
sock_ioctl+0x4e8/0x834 net/socket.c:1322
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:857
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591
Code: aa1803e6 aa1903e7 a90023f5 94785b8b (d4210000)

Fixes: 872254d ("net/bonding: Enable bonding to enslave non ARPHRD_ETHER")
	Reported-by: syzbot <syzkaller@googlegroups.com>
	Signed-off-by: Eric Dumazet <edumazet@google.com>
	Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
	Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://lore.kernel.org/r/20231109180102.4085183-1-edumazet@google.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 3cffa2d)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@bmastbergen
usb: config: fix iteration issue in 'usb_get_bos_descriptor()'
206334c 
jira VULN-35775
cve CVE-2023-52781
commit-author Niklas Neronin <niklas.neronin@linux.intel.com>
commit 974bba5

The BOS descriptor defines a root descriptor and is the base descriptor for
accessing a family of related descriptors.

Function 'usb_get_bos_descriptor()' encounters an iteration issue when
skipping the 'USB_DT_DEVICE_CAPABILITY' descriptor type. This results in
the same descriptor being read repeatedly.

To address this issue, a 'goto' statement is introduced to ensure that the
pointer and the amount read is updated correctly. This ensures that the
function iterates to the next descriptor instead of reading the same
descriptor repeatedly.

	Cc: stable@vger.kernel.org
Fixes: 3dd550a ("USB: usbcore: Fix slab-out-of-bounds bug during device reset")
	Signed-off-by: Niklas Neronin <niklas.neronin@linux.intel.com>
	Acked-by: Mathias Nyman <mathias.nyman@linux.intel.com>
	Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20231115121325.471454-1-niklas.neronin@linux.intel.com
	Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 974bba5)
	Signed-off-by: CIQ Kernel Automation <ciq_kernel_automation@ciq.com>
@bmastbergen bmastbergen force-pushed the {ciq_kernel_automation}_ciqlts9_4 branch from 40b9ac4 to 206334c Compare May 18, 2026 19:24
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 18, 2026

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/26055876560

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 18, 2026

[NOTE]: CVE-2023-52756 is not published, it has been rejected

🔍 Upstream Linux Kernel Commit Check

  • ❌ PR commit 8b14d377bc1 (pwm: Fix double shift bug) references CVE-2023-52756 but
    upstream commit d27abbfd4888 has no CVE assigned

This is an automated message from the kernel commit checker workflow.

@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 18, 2026

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/26055876560

@shreeya-patel98 shreeya-patel98 requested a review from a team May 19, 2026 12:49
@bmastbergen
Copy link
Copy Markdown
Collaborator

bmastbergen commented May 19, 2026

[NOTE]: CVE-2023-52756 is not published, it has been rejected

🔍 Upstream Linux Kernel Commit Check

  • ❌ PR commit 8b14d377bc1 (pwm: Fix double shift bug) references CVE-2023-52756 but
    upstream commit d27abbfd4888 has no CVE assigned

This is an automated message from the kernel commit checker workflow.

This CVE was rejected, but these changes did end up getting backported to all stables. Seems harmless to keep it.

bmastbergen
bmastbergen approved these changes May 19, 2026
View reviewed changes
Copy link
Copy Markdown
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bmastbergen bmastbergen bmastbergen approved these changes

@shreeya-patel98 shreeya-patel98 shreeya-patel98 approved these changes

Assignees

No one assigned

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bmastbergen @shreeya-patel98