[ciqlts9_6] Multiple patches tested (13 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()

jira VULN-167291
cve CVE-2024-54456
commit-author Zichen Xie <zichenxie0106@gmail.com>
commit 49fd4e34751e90e6df009b70cd0659dc839e7ca8

sched: sch_cake: add bounds checks to host bulk flow fairness counts

jira VULN-162575
cve CVE-2025-21647
commit-author Toke Høiland-Jørgensen <toke@redhat.com>
commit 737d4d91d35b5f7fa5bb442651472277318b0bfd

workqueue: Put the pwq after detaching the rescuer from the pool

jira VULN-161828
cve CVE-2025-21786
commit-author Lai Jiangshan <jiangshan.ljs@antgroup.com>
commit e76946110137703c16423baf6ee177b751a34b7e

vrf: use RCU protection in l3mdev_l3_out()

jira VULN-161822
cve CVE-2025-21791
commit-author Eric Dumazet <edumazet@google.com>
commit 6d0ce46a93135d96b7fa075a94a88fe0da8e8773

io_uring: prevent opcode speculation

jira VULN-161757
cve CVE-2025-21863
commit-author Pavel Begunkov <asml.silence@gmail.com>
commit 1e988c3fe1264708f4f92109203ac5b1d65de50b

RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem

jira VULN-161096
cve CVE-2025-38022
commit-author Zhu Yanjun <yanjun.zhu@linux.dev>
commit d0706bfd3ee40923c001c6827b786a309e2a8713

smb: client: Fix use-after-free in cifs_fill_dirent

jira VULN-161098
cve CVE-2025-38051
commit-author Wang Zhaolong <wangzhaolong1@huawei.com>
commit a7a8fe56e932a36f43e031b398aef92341bf5ea0

vsock: Ignore signal/timeout on connect() if already established

jira VULN-163768
cve CVE-2025-40248
commit-author Michal Luczaj <mhal@rbox.co>
commit 002541ef650b742a198e4be363881439bb9d86b4

Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern()

jira VULN-161211
cve CVE-2025-40294
commit-author Ilia Gavrilov <Ilia.Gavrilov@infotecs.ru>
commit 8d59fba49362c65332395789fd82771f1028d87e

fbdev: bitblit: bound-check glyph index in bit_putcs*

jira VULN-161274
cve CVE-2025-40322
commit-author Junjie Cao <junjie.cao@intel.com>
commit 18c4ef4e765a798b47980555ed665d78b71aeadf

libceph: fix potential use-after-free in have_mon_and_osd_map()

jira VULN-170015
cve CVE-2025-68285
commit-author Ilya Dryomov <idryomov@gmail.com>
commit 076381c261374c587700b3accf410bdd2dba334e

net: atlantic: fix fragment overflow handling in RX path

jira VULN-170101
cve CVE-2025-68301
commit-author Jiefeng Zhang <jiefeng.z.zhang@gmail.com>
commit 5ffcb7b890f61541201461580bb6622ace405aec

NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid

jira VULN-171922
cve CVE-2025-68349
commit-author Jonathan Curley <jcurley@purestorage.com>
commit e0f8058f2cb56de0b7572f51cd563ca5debce746

Test Results

✅ Build Stage

• Status: Passed
• Build Time: 32m 14s
• Total Time: 33m 52s
• View build logs

✅ Boot Verification

• Status: Passed
• View boot logs

✅ Kernel Selftests

• Passed: 174
• Failed: 44
• View kselftest logs

✅ Test Comparison

• Status: Passed - Within acceptable threshold (±3 tests)
• Compared against: ciqlts9_6

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 21972765442

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/21990481369

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit e1af865191f (fbdev: bitblit: bound-check glyph index in bit_putcs*) → upstream 18c4ef4e765a
  Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -116,9 +120,10 @@
 				       u8 *dst)
 {
 	u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
+	unsigned int charcnt = vc->vc_font.charcount;
 	u32 shift_low = 0, mod = vc->vc_font.width % 8;
 	u32 shift_high = 8;
 	u32 idx = vc->vc_font.width >> 3;
 	u8 *src;
 
 	while (cnt--) {
@@ -122,8 +127,11 @@
 	u8 *src;
 
 	while (cnt--) {
-		src = vc->vc_font.data + (scr_readw(s++)&
-					  charmask)*cellsize;
+		u16 ch = scr_readw(s++) & charmask;
+
+		if (ch >= charcnt)
+			ch = 0;
+		src = vc->vc_font.data + (unsigned int)ch * cellsize;
 
 		if (attr) {
 			update_attr(buf, src, attr, vc);

• ⚠️ PR commit 8721449ea0f (libceph: fix potential use-after-free in have_mon_and_osd_map()) → upstream 076381c26137
  Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -800,9 +793,29 @@
 	if (err < 0)
 		return err;
 
-	while (!have_mon_and_osd_map(client)) {
-		if (timeout && time_after_eq(jiffies, started + timeout))
-			return -ETIMEDOUT;
+	add_wait_queue(&client->auth_wq, &wait);
+	for (;;) {
+		mutex_lock(&client->monc.mutex);
+		err = client->auth_err;
+		have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+		mutex_unlock(&client->monc.mutex);
+
+		down_read(&client->osdc.lock);
+		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+		up_read(&client->osdc.lock);
+
+		if (err || (have_monmap && have_osdmap))
+			break;
+
+		if (signal_pending(current)) {
+			err = -ERESTARTSYS;
+			break;
+		}
+
+		if (!timeout) {
+			err = -ETIMEDOUT;
+			break;
+		}
 
 		/* wait */
 		dout("mount waiting for mon_map\n");

This is an automated interdiff check for backported commits.

[github-actions]

JIRA PR Check Results

1 commit(s) with issues found:

Commit 0c0e1c6da71f

Summary: NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client()

❌ Errors:

• VULN-167291: Status is 'To Do', expected 'In Progress'

⚠️ Warnings:

• VULN-167291: No time logged - please log time manually

---

Summary: Checked 13 commit(s) total.

[github-actions]

❌ Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/21990481369

[PlaidCat]

🔍 Interdiff Analysis

* ⚠️ PR commit `e1af865191f (fbdev: bitblit: bound-check glyph index in bit_putcs*)` → upstream `18c4ef4e765a`
  **Differences found:**

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -116,9 +120,10 @@
 				       u8 *dst)
 {
 	u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
+	unsigned int charcnt = vc->vc_font.charcount;
 	u32 shift_low = 0, mod = vc->vc_font.width % 8;
 	u32 shift_high = 8;
 	u32 idx = vc->vc_font.width >> 3;
 	u8 *src;
 
 	while (cnt--) {
@@ -122,8 +127,11 @@
 	u8 *src;
 
 	while (cnt--) {
-		src = vc->vc_font.data + (scr_readw(s++)&
-					  charmask)*cellsize;
+		u16 ch = scr_readw(s++) & charmask;
+
+		if (ch >= charcnt)
+			ch = 0;
+		src = vc->vc_font.data + (unsigned int)ch * cellsize;
 
 		if (attr) {
 			update_attr(buf, src, attr, vc);

* ⚠️ PR commit `8721449ea0f (libceph: fix potential use-after-free in have_mon_and_osd_map())` → upstream `076381c26137`
  **Differences found:**

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -800,9 +793,29 @@
 	if (err < 0)
 		return err;
 
-	while (!have_mon_and_osd_map(client)) {
-		if (timeout && time_after_eq(jiffies, started + timeout))
-			return -ETIMEDOUT;
+	add_wait_queue(&client->auth_wq, &wait);
+	for (;;) {
+		mutex_lock(&client->monc.mutex);
+		err = client->auth_err;
+		have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+		mutex_unlock(&client->monc.mutex);
+
+		down_read(&client->osdc.lock);
+		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+		up_read(&client->osdc.lock);
+
+		if (err || (have_monmap && have_osdmap))
+			break;
+
+		if (signal_pending(current)) {
+			err = -ERESTARTSYS;
+			break;
+		}
+
+		if (!timeout) {
+			err = -ETIMEDOUT;
+			break;
+		}
 
 		/* wait */
 		dout("mount waiting for mon_map\n");

This is an automated interdiff check for backported commits.

These are not divergent from what I can see but this made it easier to parse with the new format