Skip to content

[ciqlts9_6] Multiple patches tested (3 commits) - #1721

Open
ciq-kernel-automation[bot] wants to merge 3 commits into
ciqlts9_6from
{bmastbergen_seco-689}_ciqlts9_6
Open

ciq-kernel-automation[bot] wants to merge 3 commits into
ciqlts9_6from
{bmastbergen_seco-689}_ciqlts9_6

Conversation

@ciq-kernel-automation

Copy link
Copy Markdown

Summary

This PR has been automatically created after successful completion of all CI stages.

Commit Message(s)

ipv6: exthdrs: get rid of indirect calls in ip6_parse_tlv()

jira VULN-193292
cve-pre CVE-2026-63922
commit-author Eric Dumazet <edumazet@google.com>
commit 51b8f812e5b327b343232685ea7969e02348d5dd
upstream-diff This kernel doesn't handle IPV6_TLV_IOAM so those
              chunks of the upstream commit were omitted
ipv6: exthdrs: refresh nh after handling HAO option

jira VULN-193292
cve CVE-2026-63922
commit-author Zhengchuan Liang <zcliangcn@gmail.com>
commit f7b52afe3592eae66e160586b45a3f2242972c63
ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

jira VULN-193298
cve CVE-2026-63924
commit-author Justin Iurman <justin.iurman@gmail.com>
commit d47548a36639095939f4747d4c43f2271366f565

Test Results

✅ Build Stage

Architecture Build Time Total Time
x86_64 33m 9s 34m 8s
aarch64 19m 0s 19m 55s

✅ Boot Verification

✅ Kernel Selftests

Architecture Passed Failed Compared Against Status
x86_64 208 41 ciqlts9_6 ✅ No regressions
aarch64 153 46 ciqlts9_6 ✅ No regressions

✅ LTP Results

Architecture Passed Failed Compared Against Status
x86_64 1453 82 ciqlts9_6 ✅ No regressions
aarch64 1426 83 ciqlts9_6 ✅ No regressions

x86_64 newly passing:

  • cve-2017-5754 (FAIL -> PASS)

🤖 This PR was automatically generated by GitHub Actions
Run ID: 39464171998

jira VULN-193292
cve-pre CVE-2026-63922
commit-author Eric Dumazet <edumazet@google.com>
commit 51b8f81
upstream-diff This kernel doesn't handle IPV6_TLV_IOAM so those
              chunks of the upstream commit were omitted

As presented last month in our "BIG TCP" talk at netdev 0x15,
we plan using IPv6 jumbograms.

One of the minor problem we talked about is the fact that
ip6_parse_tlv() is currently using tables to list known tlvs,
thus using potentially expensive indirect calls.

While we could mitigate this cost using macros from
indirect_call_wrapper.h, we also can get rid of the tables
and let the compiler emit optimized code.

	Signed-off-by: Eric Dumazet <edumazet@google.com>
	Cc: Justin Iurman <justin.iurman@uliege.be>
	Cc: Coco Li <lixiaoyan@google.com>
	Signed-off-by: David S. Miller <davem@davemloft.net>
(cherry picked from commit 51b8f81)
	Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>
jira VULN-193292
cve CVE-2026-63922
commit-author Zhengchuan Liang <zcliangcn@gmail.com>
commit f7b52af

ip6_parse_tlv() caches skb_network_header(skb) in nh while walking
IPv6 TLVs.

ipv6_dest_hao() may call pskb_expand_head() for a cloned skb, which can
move the skb head and invalidate the cached network header pointer.
Refresh nh after ipv6_dest_hao() returns so any trailing padding or TLVs
are parsed from the current skb head.

This matches the existing pattern used in ip6_parse_tlv() after helpers
that can modify skb header storage.

Fixes: a831f5b ("[IPV6] MIP6: Add inbound interface of home address option.")
	Cc: stable@kernel.org
	Reported-by: Yuan Tan <yuantan098@gmail.com>
	Reported-by: Xin Liu <bird@lzu.edu.cn>
Co-developed-by: Luxing Yin <tr0jan@lzu.edu.cn>
	Signed-off-by: Luxing Yin <tr0jan@lzu.edu.cn>
	Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com>
	Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
	Reviewed-by: Justin Iurman <justin.iurman@gmail.com>
	Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/7aba1debc2196189172499e5769802b026f8caf8.1779247873.git.zcliangcn@gmail.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit f7b52af)
	Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>
jira VULN-193298
cve CVE-2026-63924
commit-author Justin Iurman <justin.iurman@gmail.com>
commit d47548a

ipv6_hop_jumbo() calls pskb_trim_rcsum(), which can change skb pointers.
Let's recompute nh pointer to make sure any change won't mess things up.

Fixes: 1da177e ("Linux-2.6.12-rc2")
	Cc: stable@vger.kernel.org
	Signed-off-by: Justin Iurman <justin.iurman@gmail.com>
	Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260522112013.12342-1-justin.iurman@gmail.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit d47548a)
	Signed-off-by: Brett Mastbergen <bmastbergen@ciq.com>
@ciq-kernel-automation ciq-kernel-automation Bot added the created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI) label Oct 20, 2026
@github-actions

Copy link
Copy Markdown

🔍 Diffofdiffs: 1 of 3 backports differs from upstream

View the diffofdiffs report.

Open to anyone signed in to GitHub. Report expires 2027-01-18 21:14 UTC.

# Subject Backport Upstream
1 ipv6: exthdrs: get rid of indirect calls in ip6_parse_tlv() c6778a57f46c 51b8f812e5b3

Checked PR revision 929bab391e5e against base 9d25a81fe134.

@github-actions

Copy link
Copy Markdown

🤖 Validation Checks In Progress Workflow run: https://github.com/ctrliq/kernel-src-tree/actions/runs/39499770659

@github-actions

Copy link
Copy Markdown

✅ Validation checks completed successfully View full results: https://github.com/ctrliq/kernel-src-tree/actions/runs/39499770659

@PlaidCat
PlaidCat requested a review from a team October 20, 2026 21:34

@PlaidCat PlaidCat left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

:shipit:

@PlaidCat
PlaidCat requested a review from a team October 20, 2026 22:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

created-by-kernelci Tag PRs that were automatically created when a user branch was pushed to the repo (kernelCI)

Development

Successfully merging this pull request may close these issues.

2 participants