)]}'
{
  "commit": "11e6911bf8d312f2fe013d2b756bdacd3aa55fa4",
  "tree": "be2500ed0fe6f9d425ec198abb41382e66894be1",
  "parents": [
    "ae42c861c01fe5cdeb8c94dfbe9f932f84799151"
  ],
  "author": {
    "name": "Pedro Tammela",
    "email": "pctammela@mojatatu.com",
    "time": "Thu Feb 09 11:37:39 2023 -0300"
  },
  "committer": {
    "name": "Robert Kolchmeyer",
    "email": "rkolchmeyer@google.com",
    "time": "Sat Mar 11 00:29:31 2023 +0000"
  },
  "message": "net/sched: tcindex: update imperfect hash filters respecting rcu\n\ncommit ee059170b1f7e94e55fa6cadee544e176a6e59c2 upstream.\n\nThe imperfect hash area can be updated while packets are traversing,\nwhich will cause a use-after-free when \u0027tcf_exts_exec()\u0027 is called\nwith the destroyed tcf_ext.\n\nCPU 0:               CPU 1:\ntcindex_set_parms    tcindex_classify\ntcindex_lookup\n                     tcindex_lookup\ntcf_exts_change\n                     tcf_exts_exec [UAF]\n\nStop operating on the shared area directly, by using a local copy,\nand update the filter with \u0027rcu_replace_pointer()\u0027. Delete the old\nfilter version only after a rcu grace period elapsed.\n\nFixes: 9b0d4446b569 (\"net: sched: avoid atomic swap in tcf_exts_change\")\nReported-by: valis \u003csec@valis.email\u003e\nSuggested-by: valis \u003csec@valis.email\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Pedro Tammela \u003cpctammela@mojatatu.com\u003e\nLink: https://lore.kernel.org/r/20230209143739.279867-1-pctammela@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit becf55394f6acb60dd60634a1c797e73c747f9da)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\n\nBUG\u003db/272275066\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed a use-after-free issue in net/sched in the Linux\nkernel.\n\nChange-Id: Ie890934cfd8b63dcd820883c16206a65ca8e7fa2\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/44711\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Oleksandr Tymoshenko \u003covt@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "8d1ef858db87de3b3b25e85bab74b52c456d556c",
      "old_mode": 33188,
      "old_path": "net/sched/cls_tcindex.c",
      "new_id": "ac3deffc24bfbb58f17507fd5519a5d7fcac7675",
      "new_mode": 33188,
      "new_path": "net/sched/cls_tcindex.c"
    }
  ]
}