[ciqlts9_4] Multiple patches tested (10 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

github actions: Inherit the Kernel CI Automated workflow from main branch

sctp: detect and prevent references to a freed transport in sendmsg

jira VULN-66666
cve CVE-2025-23142
commit-author Ricardo Cañuelo Navarro <rcn@igalia.com>
commit f1a69a940de58b16e8249dff26f74c8cc59b32be

nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm()

jira VULN-136358
cve CVE-2025-38724
commit-author Jeff Layton <jlayton@kernel.org>
commit 908e4ead7f757504d8b345452730636e298cbf68

smb: client: fix race with concurrent opens in rename(2)

jira VULN-155189
cve CVE-2025-39825
commit-author Paulo Alcantara <pc@manguebit.org>
commit d84291fc7453df7881a970716f8256273aca5747

i40e: fix idx validation in config queues msg

jira VULN-158752
cve CVE-2025-39971
commit-author Lukasz Czapnik <lukasz.czapnik@intel.com>
commit f1ad24c5abe1eaef69158bac1405a74b3c365115

Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync

jira VULN-158796
cve CVE-2025-39982
commit-author Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
commit 9e622804d57e2d08f0271200606bd1270f75126f

Bluetooth: ISO: Fix possible UAF on iso_conn_free

jira VULN-160179
cve CVE-2025-40141
commit-author Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
commit 9950f095d6c875dbe0c9ebfcf972ec88fdf26fc8

tls: wait for pending async decryptions if tls_strp_msg_hold fails

jira VULN-160284
cve CVE-2025-40176
commit-author Sabrina Dubroca <sd@queasysnail.net>
commit b8a6ff84abbcbbc445463de58704686011edc8e1

libceph: fix potential use-after-free in have_mon_and_osd_map()

jira VULN-170014
cve CVE-2025-68285
commit-author Ilya Dryomov <idryomov@gmail.com>
commit 076381c261374c587700b3accf410bdd2dba334e

usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths

jira VULN-170019
cve CVE-2025-68287
commit-author Manish Nagar <manish.nagar@oss.qualcomm.com>
commit e4037689a366743c4233966f0e74bc455820d316

Test Results

✅ Build Stage

• Status: Passed
• Build Time: 27m 36s
• Total Time: 29m 23s
• View build logs

✅ Boot Verification

• Status: Passed
• View boot logs

✅ Kernel Selftests

• Passed: 155
• Failed: 28
• View kselftest logs

✅ Test Comparison

• Status: Passed - Within acceptable threshold (±3 tests)
• Compared against: ciqlts9_4

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 21215426750

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/21218817342

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit 9cc764a639e (smb: client: fix race with concurrent opens in rename(2)) → upstream d84291fc7453
  Differences found:

diff -u b/fs/smb/client/inode.c b/fs/smb/client/inode.c
--- b/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -2275,7 +2275,7 @@
 	}
 
 	/* force revalidate to go get info when needed */
-	CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
+		target_dir->i_mtime = current_time(source_dir);
 
 cifs_rename_exit:
 	kfree(info_buf_source);
@@ -2602,9 +2616,11 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 			goto cifs_rename_exit;
 		rc = cifs_do_rename(xid, source_dentry, from_name,
 				    target_dentry, to_name);
+		if (!rc)
+			rehash = false;
 	}
 
 	/* force revalidate to go get info when needed */
 	CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
 
 cifs_rename_exit:
@@ -2608,6 +2624,8 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 	CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
 
 cifs_rename_exit:
+	if (rehash)
+		d_rehash(target_dentry);
 	kfree(info_buf_source);
 	free_dentry_path(page2);
 	free_dentry_path(page1);

• ⚠️ PR commit 94fb5091376 (libceph: fix potential use-after-free in have_mon_and_osd_map()) → upstream 076381c26137
  Differences found:

diff -u b/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
--- b/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -800,9 +793,29 @@ INTERDIFF: rejected hunk from patch1, cannot diff context
 	if (err < 0)
 		return err;
 
-	while (!have_mon_and_osd_map(client)) {
-		if (timeout && time_after_eq(jiffies, started + timeout))
-			return -ETIMEDOUT;
+	add_wait_queue(&client->auth_wq, &wait);
+	for (;;) {
+		mutex_lock(&client->monc.mutex);
+		err = client->auth_err;
+		have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+		mutex_unlock(&client->monc.mutex);
+
+		down_read(&client->osdc.lock);
+		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+		up_read(&client->osdc.lock);
+
+		if (err || (have_monmap && have_osdmap))
+			break;
+
+		if (signal_pending(current)) {
+			err = -ERESTARTSYS;
+			break;
+		}
+
+		if (!timeout) {
+			err = -ETIMEDOUT;
+			break;
+		}
 
 		/* wait */
 		dout("mount waiting for mon_map\n");
@@ -800,9 +793,29 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 	if (err < 0)
 		return err;
 
-	while (!have_mon_and_osd_map(client)) {
-		if (timeout && time_after_eq(jiffies, started + timeout))
-			return -ETIMEDOUT;
+	add_wait_queue(&client->auth_wq, &wait);
+	for (;;) {
+		mutex_lock(&client->monc.mutex);
+		err = client->auth_err;
+		have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+		mutex_unlock(&client->monc.mutex);
+
+		down_read(&client->osdc.lock);
+		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+		up_read(&client->osdc.lock);
+
+		if (err || (have_monmap && have_osdmap))
+			break;
+
+		if (signal_pending(current)) {
+			err = -ERESTARTSYS;
+			break;
+		}
+
+		if (!timeout) {
+			err = -ETIMEDOUT;
+			break;
+		}
 
 		/* wait */
 		dout("mount waiting for mon_map\n");

This is an automated interdiff check for backported commits.

[github-actions]

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/21218817342

[PlaidCat]

🔍 Interdiff Analysis

* ⚠️ PR commit `9cc764a639e (smb: client: fix race with concurrent opens in rename(2))` → upstream `d84291fc7453`
  **Differences found:**

diff -u b/fs/smb/client/inode.c b/fs/smb/client/inode.c
--- b/fs/smb/client/inode.c
+++ b/fs/smb/client/inode.c
@@ -2275,7 +2275,7 @@
 	}
 
 	/* force revalidate to go get info when needed */
-	CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
+		target_dir->i_mtime = current_time(source_dir);
 
 cifs_rename_exit:
 	kfree(info_buf_source);
@@ -2602,9 +2616,11 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 			goto cifs_rename_exit;
 		rc = cifs_do_rename(xid, source_dentry, from_name,
 				    target_dentry, to_name);
+		if (!rc)
+			rehash = false;
 	}
 
 	/* force revalidate to go get info when needed */
 	CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
 
 cifs_rename_exit:
@@ -2608,6 +2624,8 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 	CIFS_I(source_dir)->time = CIFS_I(target_dir)->time = 0;
 
 cifs_rename_exit:
+	if (rehash)
+		d_rehash(target_dentry);
 	kfree(info_buf_source);
 	free_dentry_path(page2);
 	free_dentry_path(page1);

This due to contextual difference our code has enough delta to gnereate an additional hunk where as usptream doestn')

* ⚠️ PR commit `94fb5091376 (libceph: fix potential use-after-free in have_mon_and_osd_map())` → upstream `076381c26137`
  **Differences found:**

diff -u b/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
--- b/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -800,9 +793,29 @@ INTERDIFF: rejected hunk from patch1, cannot diff context
 	if (err < 0)
 		return err;
 
-	while (!have_mon_and_osd_map(client)) {
-		if (timeout && time_after_eq(jiffies, started + timeout))
-			return -ETIMEDOUT;
+	add_wait_queue(&client->auth_wq, &wait);
+	for (;;) {
+		mutex_lock(&client->monc.mutex);
+		err = client->auth_err;
+		have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+		mutex_unlock(&client->monc.mutex);
+
+		down_read(&client->osdc.lock);
+		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+		up_read(&client->osdc.lock);
+
+		if (err || (have_monmap && have_osdmap))
+			break;
+
+		if (signal_pending(current)) {
+			err = -ERESTARTSYS;
+			break;
+		}
+
+		if (!timeout) {
+			err = -ETIMEDOUT;
+			break;
+		}
 
 		/* wait */
 		dout("mount waiting for mon_map\n");
@@ -800,9 +793,29 @@ INTERDIFF: rejected hunk from patch2, cannot diff context
 	if (err < 0)
 		return err;
 
-	while (!have_mon_and_osd_map(client)) {
-		if (timeout && time_after_eq(jiffies, started + timeout))
-			return -ETIMEDOUT;
+	add_wait_queue(&client->auth_wq, &wait);
+	for (;;) {
+		mutex_lock(&client->monc.mutex);
+		err = client->auth_err;
+		have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+		mutex_unlock(&client->monc.mutex);
+
+		down_read(&client->osdc.lock);
+		have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+		up_read(&client->osdc.lock);
+
+		if (err || (have_monmap && have_osdmap))
+			break;
+
+		if (signal_pending(current)) {
+			err = -ERESTARTSYS;
+			break;
+		}
+
+		if (!timeout) {
+			err = -ETIMEDOUT;
+			break;
+		}
 
 		/* wait */
 		dout("mount waiting for mon_map\n");

This is an automated interdiff check for backported commits.

I cannot tell why this one is mad

[shreeya-patel98]

Happy to see that the test comparison actually worked 🎉