From 2cad47b89fc31b39fab5bf855d651005df55432a Mon Sep 17 00:00:00 2001 From: Shreeya Patel Date: Wed, 5 Nov 2025 15:37:18 +0000 Subject: [PATCH 1/2] Use target branch name into the PR subject line Signed-off-by: Shreeya Patel --- .github/workflows/kernel-build-and-test-x86_64.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/kernel-build-and-test-x86_64.yml b/.github/workflows/kernel-build-and-test-x86_64.yml index 474db71aa387..2794ca343de5 100644 --- a/.github/workflows/kernel-build-and-test-x86_64.yml +++ b/.github/workflows/kernel-build-and-test-x86_64.yml @@ -512,13 +512,13 @@ jobs: if [ -n "$EXISTING_PR" ]; then echo "PR #$EXISTING_PR already exists, updating it" gh pr edit "$EXISTING_PR" \ - --title "[${{ github.ref_name }}] ${{ steps.commit_msg.outputs.commit_subject }}" \ + --title "[$BASE_BRANCH] ${{ steps.commit_msg.outputs.commit_subject }}" \ --body-file pr_body.md else echo "Creating new PR from ${{ github.ref_name }} to $BASE_BRANCH" gh pr create \ --base "$BASE_BRANCH" \ --head "${{ github.ref_name }}" \ - --title "[${{ github.ref_name }}] ${{ steps.commit_msg.outputs.commit_subject }}" \ + --title "[$BASE_BRANCH] ${{ steps.commit_msg.outputs.commit_subject }}" \ --body-file pr_body.md fi From f0e27bd0e6369257fbd0dedac37af491354ce546 Mon Sep 17 00:00:00 2001 From: Shreeya Patel Date: Tue, 4 Nov 2025 15:28:48 +0000 Subject: [PATCH 2/2] NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() jira VULN-136577 cve CVE-2025-39730 commit-author Trond Myklebust commit ef93a685e01a281b5e2a25ce4e3428cf9371a205 The function needs to check the minimal filehandle length before it can access the embedded filehandle. Reported-by: zhangjian Fixes: 20fa19027286 ("nfs: add export operations") Signed-off-by: Trond Myklebust (cherry picked from commit ef93a685e01a281b5e2a25ce4e3428cf9371a205) Signed-off-by: Shreeya Patel --- fs/nfs/export.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/fs/nfs/export.c b/fs/nfs/export.c index 01596f2d0a1e..0ad412ab10f6 100644 --- a/fs/nfs/export.c +++ b/fs/nfs/export.c @@ -66,14 +66,21 @@ nfs_fh_to_dentry(struct super_block *sb, struct fid *fid, { struct nfs_fattr *fattr = NULL; struct nfs_fh *server_fh = nfs_exp_embedfh(fid->raw); - size_t fh_size = offsetof(struct nfs_fh, data) + server_fh->size; + size_t fh_size = offsetof(struct nfs_fh, data); const struct nfs_rpc_ops *rpc_ops; struct dentry *dentry; struct inode *inode; - int len = EMBED_FH_OFF + XDR_QUADLEN(fh_size); + int len = EMBED_FH_OFF; u32 *p = fid->raw; int ret; + /* Initial check of bounds */ + if (fh_len < len + XDR_QUADLEN(fh_size) || + fh_len > XDR_QUADLEN(NFS_MAXFHSIZE)) + return NULL; + /* Calculate embedded filehandle size */ + fh_size += server_fh->size; + len += XDR_QUADLEN(fh_size); /* NULL translates to ESTALE */ if (fh_len < len || fh_type != len) return NULL;