TEST TEST TEST PR Checker #615
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jira VULN-67698 jira VULN-67697 cve CVE-2025-37797 commit-author Cong Wang <[email protected]> commit 3df275e This patch fixes a Use-After-Free vulnerability in the HFSC qdisc class handling. The issue occurs due to a time-of-check/time-of-use condition in hfsc_change_class() when working with certain child qdiscs like netem or codel. The vulnerability works as follows: 1. hfsc_change_class() checks if a class has packets (q.qlen != 0) 2. It then calls qdisc_peek_len(), which for certain qdiscs (e.g., codel, netem) might drop packets and empty the queue 3. The code continues assuming the queue is still non-empty, adding the class to vttree 4. This breaks HFSC scheduler assumptions that only non-empty classes are in vttree 5. Later, when the class is destroyed, this can lead to a Use-After-Free The fix adds a second queue length check after qdisc_peek_len() to verify the queue wasn't emptied. Fixes: 21f4d5c ("net_sched/hfsc: fix curve activation in hfsc_change_class()") Reported-by: Gerrard Tai <[email protected]> Reviewed-by: Konstantin Khlebnikov <[email protected]> Signed-off-by: Cong Wang <[email protected]> Reviewed-by: Jamal Hadi Salim <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit 3df275e) Signed-off-by: Jonathan Maple <[email protected]>
jira VULN-136339 jira VULN-136338 cve CVE-2025-38718 commit-author Xin Long <[email protected]> commit fd60d8a A cloned head skb still shares these frag skbs in fraglist with the original head skb. It's not safe to access these frag skbs. syzbot reported two use-of-uninitialized-memory bugs caused by this: BUG: KMSAN: uninit-value in sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_inq_pop+0x15b7/0x1920 net/sctp/inqueue.c:211 sctp_assoc_bh_rcv+0x1a7/0xc50 net/sctp/associola.c:998 sctp_inq_push+0x2ef/0x380 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x397/0xdb0 net/sctp/input.c:331 sk_backlog_rcv+0x13b/0x420 include/net/sock.h:1122 __release_sock+0x1da/0x330 net/core/sock.c:3106 release_sock+0x6b/0x250 net/core/sock.c:3660 sctp_wait_for_connect+0x487/0x820 net/sctp/socket.c:9360 sctp_sendmsg_to_asoc+0x1ec1/0x1f00 net/sctp/socket.c:1885 sctp_sendmsg+0x32b9/0x4a80 net/sctp/socket.c:2031 inet_sendmsg+0x25a/0x280 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:718 [inline] and BUG: KMSAN: uninit-value in sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_assoc_bh_rcv+0x34e/0xbc0 net/sctp/associola.c:987 sctp_inq_push+0x2a3/0x350 net/sctp/inqueue.c:88 sctp_backlog_rcv+0x3c7/0xda0 net/sctp/input.c:331 sk_backlog_rcv+0x142/0x420 include/net/sock.h:1148 __release_sock+0x1d3/0x330 net/core/sock.c:3213 release_sock+0x6b/0x270 net/core/sock.c:3767 sctp_wait_for_connect+0x458/0x820 net/sctp/socket.c:9367 sctp_sendmsg_to_asoc+0x223a/0x2260 net/sctp/socket.c:1886 sctp_sendmsg+0x3910/0x49f0 net/sctp/socket.c:2032 inet_sendmsg+0x269/0x2a0 net/ipv4/af_inet.c:851 sock_sendmsg_nosec net/socket.c:712 [inline] This patch fixes it by linearizing cloned gso packets in sctp_rcv(). Fixes: 90017ac ("sctp: Add GSO support") Reported-by: [email protected] Reported-by: [email protected] Signed-off-by: Xin Long <[email protected]> Reviewed-by: Marcelo Ricardo Leitner <[email protected]> Link: https://patch.msgid.link/dd7dc337b99876d4132d0961f776913719f7d225.1754595611.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski <[email protected]> (cherry picked from commit fd60d8a) Signed-off-by: Jonathan Maple <[email protected]>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
PlaidCat
force-pushed
the
{jmaple}_fips-8-compliant/4.18.0-553.16.1
branch
from
22dabbc to
4edda16
Compare
PlaidCat
force-pushed
the
{jmaple}_fips-8-compliant/4.18.0-553.16.1
branch
from
4edda16 to
b65c1c6
Compare
JIRA PR Check Results3 commit(s) with issues found: Commit
|
jira VULN-136575 jira VULN-136574 jira VULN-136573 cve CVE-2025-39730 cve CVE-2025-1234556789 cve-bf CVE-2025-39730 commit-author Trond Myklebust <[email protected]> commit ef93a68 The function needs to check the minimal filehandle length before it can access the embedded filehandle. Reported-by: zhangjian <[email protected]> Fixes: 20fa190 ("nfs: add export operations") Signed-off-by: Trond Myklebust <[email protected]> (cherry picked from commit ef93a68) Signed-off-by: Jonathan Maple <[email protected]>
PlaidCat
force-pushed
the
{jmaple}_fips-8-compliant/4.18.0-553.16.1
branch
from
b65c1c6 to
3499125
Compare
JIRA PR Check Results3 commit(s) with issues found: Commit
|
JIRA PR Check Results3 commit(s) with issues found: Commit
|
We are going to use this github action to do all the PR git commit processing. Since the kernel-src-tree is so large we need to minimize the wasted cycles on common checkout actions.
We will be reaching into our JIRA to check the state of each commits jira. In this we want to ensure that the target branch matches the defined branch for that product and validate that the CVE ID is also correct for the ticket. It will also check to confirm that the tickets are in progress and have time logged, if either are untrue then it will produce a warning. In the event there are Product or CVE mis matches it will block the PR and request changes.
PlaidCat
force-pushed
the
{jmaple}_fips-8-compliant/4.18.0-553.16.1
branch
from
a145ba6 to
487b0da
Compare
JIRA PR Check Results3 commit(s) with issues found: Commit
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Just a test do not merge