Skip to content

Conversation

@kerneltoast
Copy link
Collaborator

No description provided.

@kerneltoast kerneltoast force-pushed the {sultan}_ciqlts8_6-test branch from 431c787 to fe3b30c Compare February 11, 2026 20:38
@github-actions

This comment was marked as outdated.

github-actions[bot]

This comment was marked as outdated.

jira VULN-4246
cve CVE-2023-51043
commit-author Daniel Vetter <[email protected]>
commit 4e076c7

This requires a bit of background.  Properly done a modeset driver's
unload/remove sequence should be

	drm_dev_unplug();
	drm_atomic_helper_shutdown();
	drm_dev_put();

The trouble is that the drm_dev_unplugged() checks are by design racy,
they do not synchronize against all outstanding ioctl.  This is because
those ioctl could block forever (both for modeset and for driver
specific ioctls), leading to deadlocks in hotunplug.  Instead the code
sections that touch the hardware need to be annotated with
drm_dev_enter/exit, to avoid accessing hardware resources after the
unload/remove has finished.

To avoid use-after-free issues all the involved userspace visible
objects are supposed to hold a reference on the underlying drm_device,
like drm_file does.

The issue now is that we missed one, the atomic modeset ioctl can be run
in a nonblocking fashion, and in that case it cannot rely on the implied
drm_device reference provided by the ioctl calling context.  This can
result in a use-after-free if an nonblocking atomic commit is carefully
raced against a driver unload.

Fix this by unconditionally grabbing a drm_device reference for any
drm_atomic_state structures.  Strictly speaking this isn't required for
blocking commits and TEST_ONLY calls, but it's the simpler approach.

Thanks to shanzhulig for the initial idea of grabbing an unconditional
reference, I just added comments, a condensed commit message and fixed a
minor potential issue in where exactly we drop the final reference.

	Reported-by: shanzhulig <[email protected]>
	Suggested-by: shanzhulig <[email protected]>
	Reviewed-by: Maxime Ripard <[email protected]>
	Cc: Maarten Lankhorst <[email protected]>
	Cc: Thomas Zimmermann <[email protected]>
	Cc: David Airlie <[email protected]>
	Cc: [email protected]
	Signed-off-by: Daniel Vetter <[email protected]>
	Signed-off-by: Daniel Vetter <[email protected]>
	Signed-off-by: Linus Torvalds <[email protected]>
(cherry picked from commit 4e076c7)
	Signed-off-by: Marcin Wcisło <[email protected]>
jira VULN-4230
cve CVE-2023-6606
commit-author Paulo Alcantara <[email protected]>
commit b35858b
upstream-diff Modified `fs/cifs/misc.c' instead of
  `fs/smb/client/misc.c' because of the missing refactoring commit
  38c8a9a ("smb: move client and server
  files to common directory fs/smb")

Validate @smb->WordCount to avoid reading off the end of @smb and thus
causing the following KASAN splat:

  BUG: KASAN: slab-out-of-bounds in smbCalcSize+0x32/0x40 [cifs]
  Read of size 2 at addr ffff88801c024ec5 by task cifsd/1328

  CPU: 1 PID: 1328 Comm: cifsd Not tainted 6.7.0-rc5 #9
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
  rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
  Call Trace:
   <TASK>
   dump_stack_lvl+0x4a/0x80
   print_report+0xcf/0x650
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? __phys_addr+0x46/0x90
   kasan_report+0xd8/0x110
   ? smbCalcSize+0x32/0x40 [cifs]
   ? smbCalcSize+0x32/0x40 [cifs]
   kasan_check_range+0x105/0x1b0
   smbCalcSize+0x32/0x40 [cifs]
   checkSMB+0x162/0x370 [cifs]
   ? __pfx_checkSMB+0x10/0x10 [cifs]
   cifs_handle_standard+0xbc/0x2f0 [cifs]
   ? srso_alias_return_thunk+0x5/0xfbef5
   cifs_demultiplex_thread+0xed1/0x1360 [cifs]
   ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? lockdep_hardirqs_on_prepare+0x136/0x210
   ? __pfx_lock_release+0x10/0x10
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? mark_held_locks+0x1a/0x90
   ? lockdep_hardirqs_on_prepare+0x136/0x210
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? srso_alias_return_thunk+0x5/0xfbef5
   ? __kthread_parkme+0xce/0xf0
   ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
   kthread+0x18d/0x1d0
   ? kthread+0xdb/0x1d0
   ? __pfx_kthread+0x10/0x10
   ret_from_fork+0x34/0x60
   ? __pfx_kthread+0x10/0x10
   ret_from_fork_asm+0x1b/0x30
   </TASK>

This fixes CVE-2023-6606.

	Reported-by: [email protected]
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218218
	Cc: [email protected]
	Signed-off-by: Paulo Alcantara (SUSE) <[email protected]>
	Signed-off-by: Steve French <[email protected]>
(cherry picked from commit b35858b)
	Signed-off-by: Marcin Wcisło <[email protected]>
jira VULN-4131
cve CVE-2023-6610
commit-author Paulo Alcantara <[email protected]>
commit 567320c
upstream-diff |
  1. Modified different files due to missing
     38c8a9a ("smb: move client and
     server files to common directory fs/smb")
     - `fs/cifs/smb2ops.c' instead of `fs/smb/client/smb2ops.c'
     - `fs/cifs/smb2misc.c' instead of `fs/smb/client/smb2misc.c'
  2. Accounted for the missing commit
     0d35e38 ("cifs: Create a new shared
     file holding smb2 pdu definitions") in `fs/cifs/smb2ops.c' (although
     it's inconsequential because CONFIG_CIFS_DEBUG2 isn't enabled in any
     default configuration anyway).
  3. Accounted for the missing commit
     68ed144 ("cifs: remove unused server
     parameter from calc_smb_size()") in the `calc_smb_size()' call.

Validate SMB message with ->check_message() before calling
->calc_smb_size().

This fixes CVE-2023-6610.

	Reported-by: [email protected]
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218219
Cc; [email protected]
	Signed-off-by: Paulo Alcantara <[email protected]>
	Signed-off-by: Steve French <[email protected]>
(cherry picked from commit 567320c)
	Signed-off-by: Marcin Wcisło <[email protected]>
jira VULN-154751
cve CVE-2022-50341
commit-author Paulo Alcantara <[email protected]>
commit f7f291e
upstream-diff Used linux-5.10.y backport
  fe6ea04 for the (clean) cherry-pick

When running xfstests against Azure the following oops occurred on an
arm64 system

  Unable to handle kernel write to read-only memory at virtual address
  ffff0001221cf000
  Mem abort info:
    ESR = 0x9600004f
    EC = 0x25: DABT (current EL), IL = 32 bits
    SET = 0, FnV = 0
    EA = 0, S1PTW = 0
    FSC = 0x0f: level 3 permission fault
  Data abort info:
    ISV = 0, ISS = 0x0000004f
    CM = 0, WnR = 1
  swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000294f3000
  [ffff0001221cf000] pgd=18000001ffff8003, p4d=18000001ffff8003,
  pud=18000001ff82e003, pmd=18000001ff71d003, pte=00600001221cf787
  Internal error: Oops: 9600004f [#1] PREEMPT SMP
  ...
  pstate: 80000005 (Nzcv daif -PAN -UAO -TCO BTYPE=--)
  pc : __memcpy+0x40/0x230
  lr : scatterwalk_copychunks+0xe0/0x200
  sp : ffff800014e92de0
  x29: ffff800014e92de0 x28: ffff000114f9de80 x27: 0000000000000008
  x26: 0000000000000008 x25: ffff800014e92e78 x24: 0000000000000008
  x23: 0000000000000001 x22: 0000040000000000 x21: ffff000000000000
  x20: 0000000000000001 x19: ffff0001037c4488 x18: 0000000000000014
  x17: 235e1c0d6efa9661 x16: a435f9576b6edd6c x15: 0000000000000058
  x14: 0000000000000001 x13: 0000000000000008 x12: ffff000114f2e590
  x11: ffffffffffffffff x10: 0000040000000000 x9 : ffff8000105c3580
  x8 : 2e9413b10000001a x7 : 534b4410fb86b005 x6 : 534b4410fb86b005
  x5 : ffff0001221cf008 x4 : ffff0001037c4490 x3 : 0000000000000001
  x2 : 0000000000000008 x1 : ffff0001037c4488 x0 : ffff0001221cf000
  Call trace:
   __memcpy+0x40/0x230
   scatterwalk_map_and_copy+0x98/0x100
   crypto_ccm_encrypt+0x150/0x180
   crypto_aead_encrypt+0x2c/0x40
   crypt_message+0x750/0x880
   smb3_init_transform_rq+0x298/0x340
   smb_send_rqst.part.11+0xd8/0x180
   smb_send_rqst+0x3c/0x100
   compound_send_recv+0x534/0xbc0
   smb2_query_info_compound+0x32c/0x440
   smb2_set_ea+0x438/0x4c0
   cifs_xattr_set+0x5d4/0x7c0

This is because in scatterwalk_copychunks(), we attempted to write to
a buffer (@sign) that was allocated in the stack (vmalloc area) by
crypt_message() and thus accessing its remaining 8 (x2) bytes ended up
crossing a page boundary.

To simply fix it, we could just pass @sign kmalloc'd from
crypt_message() and then we're done.  Luckily, we don't seem to pass
any other vmalloc'd buffers in smb_rqst::rq_iov...

Instead, let's map the correct pages and offsets from vmalloc buffers
as well in cifs_sg_set_buf() and then avoiding such oopses.

	Signed-off-by: Paulo Alcantara (SUSE) <[email protected]>
	Cc: [email protected]
	Signed-off-by: Steve French <[email protected]>
(cherry picked from commit fe6ea04)
	Signed-off-by: Marcin Wcisło <[email protected]>
jira VULN-154751
cve-bf CVE-2022-50341
commit-author Yang Li <[email protected]>
commit d74f4a3

./fs/cifs/cifsglob.h: linux/scatterlist.h is included more than once.

Link: https://bugzilla.openanolis.cn/show_bug.cgi?id=3459
Fixes: f7f291e ("cifs: fix oops during encryption")
	Reported-by: Abaci Robot <[email protected]>
	Signed-off-by: Yang Li <[email protected]>
	Signed-off-by: Steve French <[email protected]>
(cherry picked from commit d74f4a3)
	Signed-off-by: Marcin Wcisło <[email protected]>
@kerneltoast kerneltoast force-pushed the {sultan}_ciqlts8_6-test branch from 515dd7d to fbd5b23 Compare February 11, 2026 20:45
@ctrliq ctrliq deleted a comment from github-actions bot Feb 11, 2026
@ctrliq ctrliq deleted a comment from github-actions bot Feb 11, 2026
@ctrliq ctrliq deleted a comment from github-actions bot Feb 11, 2026
@ctrliq ctrliq deleted a comment from github-actions bot Feb 11, 2026
@ctrliq ctrliq deleted a comment from github-actions bot Feb 11, 2026
@ctrliq ctrliq deleted a comment from github-actions bot Feb 11, 2026
@ctrliq ctrliq deleted a comment from github-actions bot Feb 11, 2026
github-actions[bot]

This comment was marked as outdated.

@github-actions
Copy link

🔍 Interdiff Analysis

  • ⚠️ PR commit fa29583e02d9 (drm/atomic: Fix potential use-after-free in nonblocking commits) → upstream 4e076c73e4f6
    Differences found:
================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/drivers/gpu/drm/drm_atomic.c
+++ b/drivers/gpu/drm/drm_atomic.c
@@ -135,6 +135,6 @@
 	if (!state->planes)
 		goto fail;
 
 	state->dev = dev;
 
-	DRM_DEBUG_ATOMIC("Allocated atomic state %p\n", state);
+	drm_dbg_atomic(dev, "Allocated atomic state %p\n", state);
  • ⚠️ PR commit 62f986c20467 (smb: client: fix potential OOB in smb2_dump_detail()) → upstream 567320c46a60
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/fs/cifs/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -327,10 +327,8 @@
 	cifs_server_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Mid: %llu Pid: %d\n",
 		 shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId,
 		 shdr->ProcessId);
-	if (!server->ops->check_message(buf, server->total_read, server)) {
-		cifs_server_dbg(VFS, "smb buf %p len %u\n", buf,
-				server->ops->calc_smb_size(buf, server));
-	}
+	cifs_server_dbg(VFS, "smb buf %p len %u\n", buf,
+		 server->ops->calc_smb_size(buf, server));
 #endif
 }
 

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/fs/cifs/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -403,8 +403,10 @@
 	cifs_server_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Mid: %llu Pid: %d\n",
 		 shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId,
 		 shdr->Id.SyncId.ProcessId);
-	cifs_server_dbg(VFS, "smb buf %p len %u\n", buf,
-		 server->ops->calc_smb_size(buf));
+	if (!server->ops->check_message(buf, server->total_read, server)) {
+		cifs_server_dbg(VFS, "smb buf %p len %u\n", buf,
+				server->ops->calc_smb_size(buf));
+	}
 #endif
 }
 

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/fs/cifs/smb2misc.c
+++ b/fs/smb/client/smb2misc.c
@@ -203,4 +210,4 @@
 
 	if (smb2_rsp_struct_sizes[command] != pdu->StructureSize2) {
 		if (command != SMB2_OPLOCK_BREAK_HE && (shdr->Status == 0 ||
-		    pdu->StructureSize2 != SMB2_ERROR_STRUCTURE_SIZE2)) {
+		    pdu->StructureSize2 != SMB2_ERROR_STRUCTURE_SIZE2_LE)) {
--- b/fs/cifs/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -324,8 +324,8 @@
 	cifs_server_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Mid: %llu Pid: %d\n",
 		 shdr->Command, shdr->Status, shdr->Flags, shdr->MessageId,
-		 shdr->ProcessId);
+		 shdr->Id.SyncId.ProcessId);
 	cifs_server_dbg(VFS, "smb buf %p len %u\n", buf,
-		 server->ops->calc_smb_size(buf, server));
+		 server->ops->calc_smb_size(buf));
 #endif
 }
  • ⚠️ PR commit 7b81b3b83294 (cifs: fix oops during encryption) → upstream f7f291e14dde
    Differences found:
================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -32,7 +32,6 @@
 #include <linux/scatterlist.h>
 #include <uapi/linux/cifs/cifs_mount.h>
 #include "smb2pdu.h"
-#include "smb2glob.h"
 
 #define CIFS_MAGIC_NUMBER 0xFF534D42      /* the first four bytes of SMB PDUs */
 
--- b/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -4338,7 +4353,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
-	kfree_sensitive(creq);
+	kfree(iv);
+free_sg:
+	kfree(sg);
+free_req:
+	kfree(req);
 	return rc;
 }
 

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -4374,21 +4385,6 @@
 		crypt_len += SMB2_SIGNATURE_SIZE;
 	}
 
-	sg = init_sg(num_rqst, rqst, sign);
-	if (!sg) {
-		cifs_server_dbg(VFS, "%s: Failed to init sg\n", __func__);
-		rc = -ENOMEM;
-		goto free_req;
-	}
-
-	iv_len = crypto_aead_ivsize(tfm);
-	iv = kzalloc(iv_len, GFP_KERNEL);
-	if (!iv) {
-		cifs_server_dbg(VFS, "%s: Failed to alloc iv\n", __func__);
-		rc = -ENOMEM;
-		goto free_sg;
-	}
-
 	if ((server->cipher_type == SMB2_ENCRYPTION_AES128_GCM) ||
 	    (server->cipher_type == SMB2_ENCRYPTION_AES256_GCM))
 		memcpy(iv, (char *)tr_hdr->Nonce, SMB3_AES_GCM_NONCE);
@@ -4410,11 +4407,7 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
-	kfree_sensitive(iv);
-free_sg:
-	kfree_sensitive(sg);
-free_req:
-	kfree_sensitive(req);
+	kfree_sensitive(creq);
 	return rc;
 }
 

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -1956,4 +2137,4 @@
-		tcon->share_flags & (SHI1005_FLAGS_DFS | SHI1005_FLAGS_DFS_ROOT);
+	dst->FileNameLength = src->FileNameLength;
 }
 
 #endif	/* _CIFS_GLOB_H */
--- b/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -592,5 +592,5 @@
-		    struct sdesc **sdesc);
-void cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc);
+int cifs_alloc_hash(const char *name, struct shash_desc **sdesc);
+void cifs_free_hash(struct shash_desc **sdesc);
 
 extern void rqst_page_get_length(struct smb_rqst *rqst, unsigned int page,
 				unsigned int *len, unsigned int *offset);
--- b/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -4254,5 +4307,5 @@
 	u8 sign[SMB2_SIGNATURE_SIZE] = {};
-	u8 key[SMB3_SIGN_KEY_SIZE];
+	u8 key[SMB3_ENC_DEC_KEY_SIZE];
 	struct aead_request *req;
 	char *iv;
 	unsigned int iv_len;
@@ -4265,3 +4322,3 @@
 
-	rc = smb2_get_enc_key(server, tr_hdr->SessionId, enc, key);
+	rc = smb2_get_enc_key(server, le64_to_cpu(tr_hdr->SessionId), enc, key);
 	if (rc) {
@@ -4324,11 +4381,11 @@
 	if (!rc && enc)
 		memcpy(&tr_hdr->Signature, sign, SMB2_SIGNATURE_SIZE);
 
-	kfree(iv);
+	kfree_sensitive(iv);
 free_sg:
-	kfree(sg);
+	kfree_sensitive(sg);
 free_req:
-	kfree(req);
+	kfree_sensitive(req);
 	return rc;
 }
  • ⚠️ PR commit fbd5b235c5a9 (cifs: Remove duplicated include in cifsglob.h) → upstream d74f4a3f6d88
    Differences found:
================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -24,2 +24,3 @@
 #include <uapi/linux/cifs/cifs_mount.h>
+#include "../smbfs_common/smb2pdu.h"
 #include "smb2pdu.h"

This is an automated interdiff check for backported commits.

@ctrliq ctrliq deleted a comment from github-actions bot Feb 11, 2026
@ctrliq ctrliq deleted a comment from github-actions bot Feb 11, 2026
@ctrliq ctrliq deleted a comment from github-actions bot Feb 11, 2026
@ctrliq ctrliq deleted a comment from github-actions bot Feb 11, 2026
@github-actions
Copy link

JIRA PR Check Results

5 commit(s) with issues found:

Commit fbd5b235c5a9

Summary: cifs: Remove duplicated include in cifsglob.h

❌ Errors:

  • VULN-154751: Status is 'Publish CSAF', expected 'In Progress'
  • VULN-154751: LTS product 'lts-8.6' expects branch 'ciqlts8_6', but merge target is 'test-ciqlts8_6'

Commit 7b81b3b83294

Summary: cifs: fix oops during encryption

❌ Errors:

  • VULN-154751: Status is 'Publish CSAF', expected 'In Progress'
  • VULN-154751: LTS product 'lts-8.6' expects branch 'ciqlts8_6', but merge target is 'test-ciqlts8_6'

Commit 62f986c20467

Summary: smb: client: fix potential OOB in smb2_dump_detail()

❌ Errors:

  • VULN-4131: Status is 'Publish CSAF', expected 'In Progress'
  • VULN-4131: LTS product 'lts-8.6' expects branch 'ciqlts8_6', but merge target is 'test-ciqlts8_6'

Commit a610ea5d0355

Summary: smb: client: fix OOB in smbCalcSize()

❌ Errors:

  • VULN-4230: Status is 'Publish CSAF', expected 'In Progress'
  • VULN-4230: LTS product 'lts-8.6' expects branch 'ciqlts8_6', but merge target is 'test-ciqlts8_6'

Commit fa29583e02d9

Summary: drm/atomic: Fix potential use-after-free in nonblocking commits

❌ Errors:

  • VULN-4246: Status is 'Publish CSAF', expected 'In Progress'
  • VULN-4246: LTS product 'lts-8.6' expects branch 'ciqlts8_6', but merge target is 'test-ciqlts8_6'

Summary: Checked 5 commit(s) total.

Copy link

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ This PR contains VULN tickets that do not match the target LTS product. Please review the JIRA ticket assignments and ensure they match the merge target branch.

@github-actions
Copy link

Validation checks completed with issues View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/21922695100

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants