[rlc-9/5.14.0-687.17.1.el9_8] Multiple patches tested (11 commits)

[ciq-kernel-automation]

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

epoll: annotate racy check

cve-pre CVE-2026-46242
commit-author Christian Brauner <brauner@kernel.org>
commit 6474353a5e3d0b2cf610153cea0c61f576a36d0a

eventpoll: use hlist_is_singular_node() in __ep_remove()

cve-pre CVE-2026-46242
commit-author Christian Brauner <brauner@kernel.org>
commit 3d9fd0abc94d8cd430cc7cd7d37ce5e5aae2cd2b

eventpoll: split __ep_remove()

cve-pre CVE-2026-46242
commit-author Christian Brauner <brauner@kernel.org>
commit 0f7bdfd413000985de09fc39eb9efa1e091a3ce0

eventpoll: kill __ep_remove()

cve-pre CVE-2026-46242
commit-author Christian Brauner <brauner@kernel.org>
commit e9e5cd40d7c403e19f21d0f7b8b8ba3a76b58330

eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}()

cve-pre CVE-2026-46242
commit-author Christian Brauner <brauner@kernel.org>
commit 0feaf644f7180c4a91b6b405a881afbfd958f1cf

eventpoll: rename ep_remove_safe() back to ep_remove()

cve-pre CVE-2026-46242
commit-author Christian Brauner <brauner@kernel.org>
commit 0bade234723e40e4937be912e105785d6a51464e

eventpoll: move epi_fget() up

cve-pre CVE-2026-46242
commit-author Christian Brauner <brauner@kernel.org>
commit 86e87059e6d1fd5115a31949726450ed03c1073b
upstream-diff |
	Pure code motion, no functional change intended (matches upstream's
	own commit message). Kept this tree's existing epi_fget() body
	using atomic_long_inc_not_zero(&file->f_count) instead of upstream's
	file_ref_get(&file->f_ref); the file_ref_t/file_ref_get() API comes
	from a separate, unrelated whole-VFS struct file refcounting rework
	(commit 90ee6ed776c06 "fs: port files to file_ref", 2024-10-07) that
	is not present on this branch and is out of scope for this CVE fix.
	Both mechanisms provide the identical "pin the file, fail if it's
	already at zero refs" semantics the upcoming ep_remove() UAF fix
	depends on, so this substitution preserves the security property
	unchanged.

eventpoll: fix ep_remove struct eventpoll / struct file UAF

cve CVE-2026-46242
commit-author Christian Brauner <brauner@kernel.org>
commit a6dc643c69311677c574a0f17a3f4d66a5f3744b

eventpoll: defer struct eventpoll free to RCU grace period

cve CVE-2026-43074
commit-author Nicholas Carlini <nicholas@carlini.com>
commit 07712db80857d5d09ae08f3df85a708ecfc3b61f

rtmutex: Use waiter::task instead of current in remove_waiter()

cve CVE-2026-43499
commit-author Keenan Dong <keenanat2000@gmail.com>
commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349

locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

cve-pre CVE-2026-43499
commit-author Davidlohr Bueso <dave@stgolabs.net>
commit 40a25d59e85b3c8709ac2424d44f65610467871e

Test Results

✅ Build Stage

Architecture	Build Time	Total Time
x86_64	34m 1s	34m 57s
aarch64	20m 4s	20m 53s

• View build logs

✅ Boot Verification

• Status: Passed (all architectures)
• View boot logs

✅ Kernel Selftests

Architecture	Passed	Failed	Compared Against	Status
x86_64	206	49	rlc-9/5.14.0-687.17.1.el9_8	✅ No regressions
aarch64	154	49	rlc-9/5.14.0-687.17.1.el9_8	✅ No regressions

• View kselftest logs

✅ LTP Results

Architecture	Passed	Failed	Compared Against	Status
x86_64	1456	81	rlc-9/5.14.0-687.17.1.el9_8	✅ No regressions
aarch64	1429	82	rlc-9/5.14.0-687.17.1.el9_8	✅ No regressions

• View LTP logs

---

🤖 This PR was automatically generated by GitHub Actions
Run ID: 29009863403

[github-actions]

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/29025264866

[github-actions]

🔍 Upstream Linux Kernel Commit Check

• ⚠️ PR commit 62a8e2ce66d (rtmutex: Use waiter::task instead of current in remove_waiter()) references upstream commit
  3bfdc63936dd which has been referenced by a Fixes: tag in the upstream
  Linux kernel:

    74e144274af futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Ji'an Zhou) (CVE-2026-53166)

• ⚠️ PR commit 4ca99aa0825 (locking/rtmutex: Skip remove_waiter() when waiter is not enqueued) does not reference a CVE but
  upstream commit 40a25d59e85b is associated with CVE-2026-53163

This is an automated message from the kernel commit checker workflow.

[github-actions]

🔍 Interdiff Analysis

• ⚠️ PR commit 01f695a2ea2 (eventpoll: move epi_fget() up) → upstream 86e87059e6d1
  Differences found:

================================================================================
*    DELTA DIFFERENCES - code changes that differ between the patches          *
================================================================================

--- b/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -734,7 +734,7 @@
 	struct file *file;
 
 	file = epi->ffd.file;
-	if (!atomic_long_inc_not_zero(&file->f_count))
+	if (!file_ref_get(&file->f_ref))
 		file = NULL;
 	return file;
 }
@@ -912,4 +912,32 @@
 
 /*
+ * The ffd.file pointer may be in the process of being torn down due to
+ * being closed, but we may not have finished eventpoll_release() yet.
+ *
+ * Normally, even with the atomic_long_inc_not_zero, the file may have
+ * been free'd and then gotten re-allocated to something else (since
+ * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU).
+ *
+ * But for epoll, users hold the ep->mtx mutex, and as such any file in
+ * the process of being free'd will block in eventpoll_release_file()
+ * and thus the underlying file allocation will not be free'd, and the
+ * file re-use cannot happen.
+ *
+ * For the same reason we can avoid a rcu_read_lock() around the
+ * operation - 'ffd.file' cannot go away even if the refcount has
+ * reached zero (but we must still not call out to ->poll() functions
+ * etc).
+ */
+static struct file *epi_fget(const struct epitem *epi)
+{
+	struct file *file;
+
+	file = epi->ffd.file;
+	if (!atomic_long_inc_not_zero(&file->f_count))
+		file = NULL;
+	return file;
+}
+
+/*
  * Differs from ep_eventpoll_poll() in that internal callers already have
  * the ep->mtx so we need to start from depth=1, such that mutex_lock_nested()

################################################################################
!    REJECTED PATCH2 HUNKS - could not be compared; manual review needed       !
################################################################################

--- b/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1046,34 +1074,6 @@
 	return res;
 }
 
-/*
- * The ffd.file pointer may be in the process of being torn down due to
- * being closed, but we may not have finished eventpoll_release() yet.
- *
- * Normally, even with the atomic_long_inc_not_zero, the file may have
- * been free'd and then gotten re-allocated to something else (since
- * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU).
- *
- * But for epoll, users hold the ep->mtx mutex, and as such any file in
- * the process of being free'd will block in eventpoll_release_file()
- * and thus the underlying file allocation will not be free'd, and the
- * file re-use cannot happen.
- *
- * For the same reason we can avoid a rcu_read_lock() around the
- * operation - 'ffd.file' cannot go away even if the refcount has
- * reached zero (but we must still not call out to ->poll() functions
- * etc).
- */
-static struct file *epi_fget(const struct epitem *epi)
-{
-	struct file *file;
-
-	file = epi->ffd.file;
-	if (!file_ref_get(&file->f_ref))
-		file = NULL;
-	return file;
-}
-
 /*
  * Differs from ep_eventpoll_poll() in that internal callers already have
  * the ep->mtx so we need to start from depth=1, such that mutex_lock_nested()

This is an automated interdiff check for backported commits.

[github-actions]

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/29025264866

[roxanan1996]

🔍 Upstream Linux Kernel Commit Check

* ⚠️ PR commit `62a8e2ce66d (rtmutex: Use waiter::task instead of current in remove_waiter())` references upstream commit
  `3bfdc63936dd` which has been referenced by a `Fixes:` tag in the upstream
  Linux kernel:

    74e144274af futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Ji'an Zhou) (CVE-2026-53166)

* ⚠️ PR commit `4ca99aa0825 (locking/rtmutex: Skip remove_waiter() when waiter is not enqueued)` does not reference a CVE but
  upstream commit `40a25d59e85b` is associated with `CVE-2026-53163`

This is an automated message from the kernel commit checker workflow.

Same as here #1419 (comment)