)]}'
{
  "commit": "292c022b57a02a84aa84cb97e809da06a7bbd8ac",
  "tree": "2c26c72450e4f3bdd2c61c7035cf417a4d0e89ff",
  "parents": [
    "700027f791820393a602a71c68ea7215ddf20246"
  ],
  "author": {
    "name": "Cen Zhang (Microsoft)",
    "email": "blbllhy@gmail.com",
    "time": "Tue Jul 07 12:41:15 2026 -0400"
  },
  "committer": {
    "name": "Angel Adetula",
    "email": "angeladetula@google.com",
    "time": "Wed Aug 05 09:15:32 2026 -0700"
  },
  "message": "rhashtable: clear stale iter-\u003ep on table restart\n\nrhashtable_walk_start_check() has two restart paths when resuming a walk.\nWhen iter-\u003ewalker.tbl is valid, it re-validates iter-\u003ep against the table\nand sets iter-\u003ep \u003d NULL if the object is gone.  When iter-\u003ewalker.tbl is\nNULL (table was freed during resize), it resets slot and skip but forgets\nto clear iter-\u003ep.\n\nrhashtable_walk_next() then dereferences the stale iter-\u003ep, reading\nfreed memory.  This is a use-after-free.\n\nAny caller that does multi-fragment rhashtable walks across\nwalk_stop/walk_start boundaries is affected.  Concrete cases include\nnetlink_diag (__netlink_diag_dump in net/netlink/diag.c) and TIPC\n(tipc_nl_sk_walk in net/tipc/socket.c).\n\nCrash stack (netlink_diag):\n  BUG: KASAN: slab-use-after-free in rhashtable_walk_next+0x365/0x3c0\n  Read of size 8 at addr ffff88801a9d2438 (freed kmalloc-2k, offset 1080)\n  Call Trace:\n   rhashtable_walk_next+0x365/0x3c0 (lib/rhashtable.c:1016)\n   __netlink_diag_dump+0x160/0x760 (net/netlink/diag.c:122)\n   netlink_diag_dump+0xc2/0x240\n   netlink_dump+0x5bc/0x1270\n   netlink_recvmsg+0x7a3/0x980\n   sock_recvmsg+0x1bc/0x200\n   __sys_recvfrom+0x1d4/0x2c0\n\nBUG\u003db/540524940\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed KCTF-8173f7e in the Linux Kernel.\n\nFixes: 5d240a8936f6 (\"rhashtable: improve rhashtable_walk stability when stop/start used.\")\nCc: \u003cstable@vger.kernel.org\u003e\nReported-by: AutonomousCodeSecurity@microsoft.com\nReported-by: Yuan Tan \u003cyuantan098@gmail.com\u003e\nCloses: https://lore.kernel.org/linux-crypto/CAB8m9Wh559e+\u003dn8z51gB8DrbEyCc2mc0MgGjrRR6_VXBmU\u003d2AQ@mail.gmail.com\nChange-Id: I35786f98a530ad8705d73d768e497e778de65dfe\nSigned-off-by: Cen Zhang (Microsoft) \u003cblbllhy@gmail.com\u003e\nReviewed-by: NeilBrown \u003cneil@brown.name\u003e\nSigned-off-by: Herbert Xu \u003cherbert@gondor.apana.org.au\u003e\nSigned-off-by: Angel Adetula \u003cangeladetula@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/178149\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Dom Huh \u003cdomhuh@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "fde0f0e556f87cafae5c2555be5aceb7bb33ddd0",
      "old_mode": 33188,
      "old_path": "lib/rhashtable.c",
      "new_id": "fcc7bd22d86ef4ff4b0c4a4c869e96cc4c0c71d3",
      "new_mode": 33188,
      "new_path": "lib/rhashtable.c"
    }
  ]
}