[ciqlts9_2] Multiple patches tested (8 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

RDMA/umem: Fix double dma_buf_unpin in failure path

jira VULN-184378
cve CVE-2026-43128
commit-author Jacob Moroni <jmoroni@google.com>
commit 104016eb671e19709721c1b0048dd912dc2e96be

Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout

jira VULN-65614
cve CVE-2024-27398
commit-author Duoming Zhou <duoming@zju.edu.cn>
commit 483bc08181827fc475643272ffb69c533007e546

Bluetooth: SCO: Fix UAF on sco_sock_timeout

jira VULN-8628
cve CVE-2024-50125
commit-author Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
commit 1bf4470a3939c678fb822073e9ea77a0560bc6bb
upstream-diff |
	Adjusted context in include/net/bluetooth/bluetooth.h due to missing
	bt_sock_alloc().

Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

jira VULN-180255
cve CVE-2026-31408
commit-author Hyunwoo Kim <imv4bel@gmail.com>
commit 598dbba9919c5e36c54fe1709b557d64120cb94b

netfilter: flowtable: strictly check for maximum number of actions

jira VULN-185474
cve CVE-2026-43329
commit-author Pablo Neira Ayuso <pablo@netfilter.org>
commit 76522fcdbc3a02b568f5d957f7e66fc194abb893

RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()

jira VULN-187923
cve CVE-2026-46181
commit-author Jason Gunthorpe <jgg@ziepe.ca>
commit c9341307ea16b9395c2e4c9c94d8499d91fe31d0
upstream-diff |
        refcount_set_release() does not exist.
        Instead of backporting the wrapper, atomic_set_release() was used
        directly on the underlying aromic_t.

RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path

jira VULN-188154
cve CVE-2026-46189
commit-author Jason Gunthorpe <jgg@ziepe.ca>
commit e38e86995df27f1f854063dab1f0c6a513db3faf

exit: prevent preemption of oopsing TASK_DEAD task

jira VULN-187123
cve CVE-2026-46173
commit-author Jann Horn <jannh@google.com>
commit c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	23m 1s	23m 51s
aarch64	12m 55s	13m 30s

• View build logs

✅ Boot Verification

• Status: Passed (all architectures)
• View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	173	25	ciqlts9_2	✅ No regressions
aarch64	141	27	ciqlts9_2	✅ No regressions

• View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1439	81	ciqlts9_2	✅ No regressions
aarch64	1409	83	ciqlts9_2	✅ No regressions

• View LTP logs

aarch64 newly passing:

• fcntl14_64 (FAIL -> PASS)

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 28935462447

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/28951716090

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit 520e82924fc (Bluetooth: SCO: Fix UAF on sco_sock_timeout) → upstream 1bf4470a3939
  Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -403,6 +403,7 @@
 void bt_sock_unregister(int proto);
 void bt_sock_link(struct bt_sock_list *l, struct sock *s);
 void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);
+bool bt_sock_linked(struct bt_sock_list *l, struct sock *s);
 struct sock *bt_sock_alloc(struct net *net, struct socket *sock,
 			   struct proto *prot, int proto, gfp_t prio, int kern);
 int  bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -380,2 +380,4 @@
 void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);
+struct sock *bt_sock_alloc(struct net *net, struct socket *sock,
+			   struct proto *prot, int proto, gfp_t prio, int kern);
 int  bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
--- b/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -153,6 +153,6 @@
 }
 EXPORT_SYMBOL(bt_sock_unlink);
 
 void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh)
 {
-	BT_DBG("parent %p, sk %p", parent, sk);
+	const struct cred *old_cred;

• ⚠️ PR commit 31a54a4ab10 (RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()) → upstream c9341307ea16
  Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/net/ethernet/mellanox/mlx4/srq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/srq.c
@@ -205,7 +205,7 @@
 		goto err_radix;
 
 	init_completion(&srq->free);
-	atomic_set_release(&srq->refcount.refs, 1);
+	refcount_set_release(&srq->refcount, 1);
 
 	return 0;

This is an automated interdiff check for backported commits.

[github-actions]

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/28951716090

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/29031574144

[github-actions]

🔍 Upstream Linux Kernel Commit Check

• ⚠️ PR commit 337d3077208 (locking: Introduce __cleanup() based infrastructure) references upstream commit
  54da6a092431 which has been referenced by a Fixes: tag in the upstream
  Linux kernel:

    cd7eb8f83fc mm/slab: make __free(kfree) accept error pointers (Dan Carpenter) (CVE-2024-36890)

• ⚠️ PR commit e78344ba931 (eventpoll: don't decrement ep refcount while still holding the ep mutex) does not reference a CVE but
  upstream commit 8c2e52ebbe88 is associated with CVE-2025-38349

• ⚠️ PR commit 9d21a959f5e (rtmutex: Use waiter::task instead of current in remove_waiter()) references upstream commit
  3bfdc63936dd which has been referenced by a Fixes: tag in the upstream
  Linux kernel:

    74e144274af futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Ji'an Zhou) (CVE-2026-53166)

• ⚠️ PR commit 5d45c176c23 (locking/rtmutex: Skip remove_waiter() when waiter is not enqueued) does not reference a CVE but
  upstream commit 40a25d59e85b is associated with CVE-2026-53163

This is an automated message from the kernel commit checker workflow.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit c1656112476 (epoll: use refcount to reduce ep_mutex contention) → upstream 58c9b016e128
  Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -771,6 +809,8 @@
 	call_rcu(&epi->rcu, epi_rcu_free);
 
 	percpu_counter_dec(&ep->user->epoll_watches);
+	return ep_refcount_dec_and_test(ep);
+}
 
 	return 0;
 }

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -723,6 +732,6 @@
 	call_rcu(&epi->rcu, epi_rcu_free);
 
-	atomic_long_dec(&ep->user->epoll_watches);
+	percpu_counter_dec(&ep->user->epoll_watches);
 
 	return 0;
 }
@@ -735,7 +744,7 @@
 
 	/* We need to release all tasks waiting for these file */
 	if (waitqueue_active(&ep->poll_wait))
-		ep_poll_safewake(ep, NULL);
+		ep_poll_safewake(ep, NULL, 0);
 
 	/*
 	 * We need to lock this because we could be hit by

• ⚠️ PR commit 337d3077208 (locking: Introduce __cleanup() based infrastructure) → upstream 54da6a092431
  Differences found:

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/linux/compiler_attributes.h
+++ b/include/linux/compiler_attributes.h
@@ -66,5 +66,5 @@
  */
-#define __cold                          __attribute__((__cold__))
+#define __assume_aligned(a, ...)        __attribute__((__assume_aligned__(a, ## __VA_ARGS__)))
 
 /*
  * Note the long name.
--- b/include/linux/percpu.h
+++ b/include/linux/percpu.h
@@ -124,5 +124,5 @@
-extern void __percpu *__alloc_percpu_gfp(size_t size, size_t align, gfp_t gfp);
-extern void __percpu *__alloc_percpu(size_t size, size_t align);
+extern void __percpu *__alloc_percpu_gfp(size_t size, size_t align, gfp_t gfp) __alloc_size(1);
+extern void __percpu *__alloc_percpu(size_t size, size_t align) __alloc_size(1);
 extern void free_percpu(void __percpu *__pdata);
 extern phys_addr_t per_cpu_ptr_to_phys(void *addr);
 
--- b/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -29,4 +29,4 @@
 #include <linux/lockdep.h>
 #include <asm/processor.h>
 #include <linux/cpumask.h>
-
+#include <linux/context_tracking_irq.h>

================================================================================
*    ONLY IN PATCH2 - files not modified by patch1                             *
================================================================================

--- a/include/linux/preempt.h
+++ b/include/linux/preempt.h
@@ -8,6 +8,7 @@
  */
 
 #include <linux/linkage.h>
+#include <linux/cleanup.h>
 #include <linux/list.h>
 
 /*
@@ -463,4 +464,8 @@ static __always_inline void preempt_enable_nested(void)
 		preempt_enable();
 }
 
+DEFINE_LOCK_GUARD_0(preempt, preempt_disable(), preempt_enable())
+DEFINE_LOCK_GUARD_0(preempt_notrace, preempt_disable_notrace(), preempt_enable_notrace())
+DEFINE_LOCK_GUARD_0(migrate, migrate_disable(), migrate_enable())
+
 #endif /* __LINUX_PREEMPT_H */

• ⚠️ PR commit a1f8a6cde0f (file: add fput() cleanup helper) → upstream 257b1c2c78c2
  Differences found:

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/linux/file.h
+++ b/include/linux/file.h
@@ -92,6 +92,6 @@
 
 DEFINE_CLASS(get_unused_fd, int, if (_T >= 0) put_unused_fd(_T),
 	     get_unused_fd_flags(flags), unsigned flags)
 
-extern void fd_install(unsigned int fd, struct file *file);
-
+/*
+ * take_fd() will take care to set @fd to -EBADF ensuring that

• ⚠️ PR commit e78344ba931 (eventpoll: don't decrement ep refcount while still holding the ep mutex) → upstream 8c2e52ebbe88
  Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -828,7 +828,7 @@
 	kfree_rcu(epi, rcu);
 
 	percpu_counter_dec(&ep->user->epoll_watches);
-	return ep_refcount_dec_and_test(ep);
+	return true;
 }
 
 /*

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -760,5 +761,5 @@
 
-	atomic_long_dec(&ep->user->epoll_watches);
+	percpu_counter_dec(&ep->user->epoll_watches);
 	return ep_refcount_dec_and_test(ep);
 }

• ⚠️ PR commit 99dd29e429d (eventpoll: move epi_fget() up) → upstream 86e87059e6d1
  Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -724,7 +724,7 @@
 	struct file *file;
 
 	file = epi->ffd.file;
-	if (!atomic_long_inc_not_zero(&file->f_count))
+	if (!file_ref_get(&file->f_ref))
 		file = NULL;
 	return file;
 }

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1046,34 +1074,6 @@
 	return res;
 }
 
-/*
- * The ffd.file pointer may be in the process of being torn down due to
- * being closed, but we may not have finished eventpoll_release() yet.
- *
- * Normally, even with the atomic_long_inc_not_zero, the file may have
- * been free'd and then gotten re-allocated to something else (since
- * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU).
- *
- * But for epoll, users hold the ep->mtx mutex, and as such any file in
- * the process of being free'd will block in eventpoll_release_file()
- * and thus the underlying file allocation will not be free'd, and the
- * file re-use cannot happen.
- *
- * For the same reason we can avoid a rcu_read_lock() around the
- * operation - 'ffd.file' cannot go away even if the refcount has
- * reached zero (but we must still not call out to ->poll() functions
- * etc).
- */
-static struct file *epi_fget(const struct epitem *epi)
-{
-	struct file *file;
-
-	file = epi->ffd.file;
-	if (!file_ref_get(&file->f_ref))
-		file = NULL;
-	return file;
-}
-
 /*
  * Differs from ep_eventpoll_poll() in that internal callers already have
  * the ep->mtx so we need to start from depth=1, such that mutex_lock_nested()

• ⚠️ PR commit 9d21a959f5e (rtmutex: Use waiter::task instead of current in remove_waiter()) → upstream 3bfdc63936dd
  Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1487,10 +1487,10 @@
 
 	lockdep_assert_held(&lock->wait_lock);
 
-	raw_spin_lock(&waiter_task->pi_lock);
-	rt_mutex_dequeue(lock, waiter);
-	waiter_task->pi_blocked_on = NULL;
-	raw_spin_unlock(&waiter_task->pi_lock);
+	scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
+		rt_mutex_dequeue(lock, waiter);
+		waiter_task->pi_blocked_on = NULL;
+	}
 
 	/*
 	 * Only update priority if the waiter was the highest priority

• ⚠️ PR commit 5d45c176c23 (locking/rtmutex: Skip remove_waiter() when waiter is not enqueued) → upstream 40a25d59e85b
  Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1558,6 +1558,9 @@
 
 	lockdep_assert_held(&lock->wait_lock);
 
+	if (!waiter_task) /* never enqueued */
+		return;
+
 	scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
 		rt_mutex_dequeue(lock, waiter);
 		waiter_task->pi_blocked_on = NULL;
--- b/kernel/locking/rtmutex_api.c
+++ b/kernel/locking/rtmutex_api.c
@@ -365,7 +365,7 @@
 
 	raw_spin_lock_irq(&lock->wait_lock);
 	ret = __rt_mutex_start_proxy_lock(lock, waiter, task, &wake_q);
-	if (unlikely(ret))
+	if (unlikely(ret < 0))
 		remove_waiter(lock, waiter);
 	preempt_disable();
 	raw_spin_unlock_irq(&lock->wait_lock);

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -1484,6 +1484,6 @@
 
 	lockdep_assert_held(&lock->wait_lock);
 
-	raw_spin_lock(&waiter_task->pi_lock);
-	rt_mutex_dequeue(lock, waiter);
-	waiter_task->pi_blocked_on = NULL;
+	scoped_guard(raw_spinlock, &waiter_task->pi_lock) {
+		rt_mutex_dequeue(lock, waiter);
+		waiter_task->pi_blocked_on = NULL;
--- b/kernel/locking/rtmutex_api.c
+++ b/kernel/locking/rtmutex_api.c
@@ -342,5 +342,6 @@
 	raw_spin_lock_irq(&lock->wait_lock);
-	ret = __rt_mutex_start_proxy_lock(lock, waiter, task);
+	ret = __rt_mutex_start_proxy_lock(lock, waiter, task, &wake_q);
 	if (unlikely(ret))
 		remove_waiter(lock, waiter);
+	preempt_disable();
 	raw_spin_unlock_irq(&lock->wait_lock);

This is an automated interdiff check for backported commits.

[github-actions]

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/29031574144

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/29032132656

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit 520e82924fc (Bluetooth: SCO: Fix UAF on sco_sock_timeout) → upstream 1bf4470a3939
  Differences found:

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -403,6 +403,7 @@
 void bt_sock_unregister(int proto);
 void bt_sock_link(struct bt_sock_list *l, struct sock *s);
 void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);
+bool bt_sock_linked(struct bt_sock_list *l, struct sock *s);
 struct sock *bt_sock_alloc(struct net *net, struct socket *sock,
 			   struct proto *prot, int proto, gfp_t prio, int kern);
 int  bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,

================================================================================
*    CONTEXT DIFFERENCES - surrounding code differences between the patches    *
================================================================================

--- b/include/net/bluetooth/bluetooth.h
+++ b/include/net/bluetooth/bluetooth.h
@@ -380,2 +380,4 @@
 void bt_sock_unlink(struct bt_sock_list *l, struct sock *s);
+struct sock *bt_sock_alloc(struct net *net, struct socket *sock,
+			   struct proto *prot, int proto, gfp_t prio, int kern);
 int  bt_sock_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
--- b/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -153,6 +153,6 @@
 }
 EXPORT_SYMBOL(bt_sock_unlink);
 
 void bt_accept_enqueue(struct sock *parent, struct sock *sk, bool bh)
 {
-	BT_DBG("parent %p, sk %p", parent, sk);
+	const struct cred *old_cred;

• ⚠️ PR commit 31a54a4ab10 (RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event()) → upstream c9341307ea16
  Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/drivers/net/ethernet/mellanox/mlx4/srq.c
+++ b/drivers/net/ethernet/mellanox/mlx4/srq.c
@@ -205,7 +205,7 @@
 		goto err_radix;
 
 	init_completion(&srq->free);
-	atomic_set_release(&srq->refcount.refs, 1);
+	refcount_set_release(&srq->refcount, 1);
 
 	return 0;

This is an automated interdiff check for backported commits.

[github-actions]

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/29032132656