Backport of Patch CVE-2025-21751 to kernel 6.12.43

Backport of Patch CVE-2025-21751 to kernel 6.12.43

[Subramaniam, Sujana]

[-- Attachment #1.1: Type: text/plain, Size: 409 bytes --]

Dear Kernel Developers,

Hereby we attach patch backported from kernel 6.13 (as proposed by Greg k-h on the full disclosure mailing list) to 6.12 for CVE-2025-21751 vulnerability.

This patch was tested on metal and virtual machines and rolled out in production.

I hope patch is sufficient for cherry-pick. Please let us know if something has to be updated/modified.

Regards,
Sujana, Akendo




[-- Attachment #1.2: Type: text/html, Size: 2495 bytes --]

[-- Attachment #2: 0001-Fix-CVE-2025-21751.patch --]
[-- Type: application/octet-stream, Size: 2448 bytes --]

From d7ec3c1b2af20e239e7c48bf283ff2f080b459cf Mon Sep 17 00:00:00 2001
From: sujanas <sujana.subramaniam@sap.com>
Date: Mon, 25 Aug 2025 13:56:49 +0200
Subject: [PATCH] Fix CVE-2025-21751

Signed-off-by: sujanas <sujana.subramaniam@sap.com>
---
 .../mlx5/core/steering/hws/mlx5hws_matcher.c  | 25 ++++++-------------
 1 file changed, 8 insertions(+), 17 deletions(-)

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_matcher.c
index 61a1155d4b4f..273b4ef1730c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_matcher.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws_matcher.c
@@ -165,14 +165,14 @@ static int hws_matcher_disconnect(struct mlx5hws_matcher *matcher)
 						    next->match_ste.rtc_0_id,
 						    next->match_ste.rtc_1_id);
 		if (ret) {
-			mlx5hws_err(tbl->ctx, "Failed to disconnect matcher\n");
-			goto matcher_reconnect;
+			mlx5hws_err(tbl->ctx, "Fatal error, failed to disconnect matcher\n");
+			return ret;
 		}
 	} else {
 		ret = mlx5hws_table_connect_to_miss_table(tbl, tbl->default_miss.miss_tbl);
 		if (ret) {
-			mlx5hws_err(tbl->ctx, "Failed to disconnect last matcher\n");
-			goto matcher_reconnect;
+			mlx5hws_err(tbl->ctx, "Fatal error, failed to disconnect last matcher\n");
+			return ret;
 		}
 	}
 
@@ -180,29 +180,20 @@ static int hws_matcher_disconnect(struct mlx5hws_matcher *matcher)
 	if (prev_ft_id == tbl->ft_id) {
 		ret = mlx5hws_table_update_connected_miss_tables(tbl);
 		if (ret) {
-			mlx5hws_err(tbl->ctx, "Fatal error, failed to update connected miss table\n");
-			goto matcher_reconnect;
+			mlx5hws_err(tbl->ctx,
+				    "Fatal error, failed to update connected miss table\n");
+			return ret;
 		}
 	}
 
 	ret = mlx5hws_table_ft_set_default_next_ft(tbl, prev_ft_id);
 	if (ret) {
 		mlx5hws_err(tbl->ctx, "Fatal error, failed to restore matcher ft default miss\n");
-		goto matcher_reconnect;
+		return ret;
 	}
 
 	return 0;
 
-matcher_reconnect:
-	if (list_empty(&tbl->matchers_list) || !prev)
-		list_add(&matcher->list_node, &tbl->matchers_list);
-	else
-		/* insert after prev matcher */
-		list_add(&matcher->list_node, &prev->list_node);
-
-	return ret;
-}
-
 static void hws_matcher_set_rtc_attr_sz(struct mlx5hws_matcher *matcher,
 					struct mlx5hws_cmd_rtc_create_attr *rtc_attr,
 					enum mlx5hws_matcher_rtc_type rtc_type,
-- 

Re: Backport of Patch CVE-2025-21751 to kernel 6.12.43

[Greg KH]

On Mon, Aug 25, 2025 at 01:12:27PM +0000, Subramaniam, Sujana wrote:
> Dear Kernel Developers,
> 
> Hereby we attach patch backported from kernel 6.13 (as proposed by Greg k-h on the full disclosure mailing list) to 6.12 for CVE-2025-21751 vulnerability.
> 
> This patch was tested on metal and virtual machines and rolled out in production.
> 
> I hope patch is sufficient for cherry-pick. Please let us know if something has to be updated/modified.

What is the git id of this in Linus's tree?  And why not use your
correct name in the signed-off-by area and provide the full changelog?

thanks,

greg k-h

Re: Backport of Patch CVE-2025-21751 to kernel 6.12.43

[Sasha Levin]

On Mon, Aug 25, 2025 at 01:12:27PM +0000, Subramaniam, Sujana wrote:
>   Dear Kernel Developers,
>
>
>   Hereby we attach patch backported from kernel 6.13 (as proposed by Greg
>   k-h on the full disclosure mailing list) to 6.12 for CVE-2025-21751
>   vulnerability.
>
>
>   This patch was tested on metal and virtual machines and rolled out in
>   production.
>
>
>   I hope patch is sufficient for cherry-pick. Please let us know if
>   something has to be updated/modified.

Hi Sujana,

Thanks for the backports! There are a few issues that needs to be addressed first:

1. Every stable backport must reference the upstream commit being backported.
The patch description must contain the line "commit XXXX upstream" where XXXX
is the full SHA-1 of the mainline commit. This is mandatory per
Documentation/process/stable-kernel-rules.rst section 2. Without this
reference, we cannot verify what is being backported or whether it has been
properly tested upstream.

2. Stable patches cannot be submitted as attachments, especially not
base64-encoded ones. All patches must be sent inline in the email body using
git send-email. This allows for proper review, commenting, and application by
maintainers. See Documentation/process/submitting-patches.rst section 7 "No
MIME, no links, no compression, no attachments. Just plain text" and
Documentation/process/email-clients.rst for configuration guidance.

3. Missing original commit message: The patch must include the complete
original upstream commit message, including the problem description, solution
explanation, and all tags (Signed-off-by, Reviewed-by, etc.) from the original
commit. You cannot replace this with your own description. The original commit
message documents why the change was made and is essential for understanding
the fix. See Documentation/process/stable-kernel-rules.rst which states
backports should be "equivalent" to the upstream commit or a subset thereof.

Please resubmit following the documented process. You can find examples of
properly formatted stable backports on the stable mailing list archives.

-- 
Thanks,
Sasha