)]}'
{
  "commit": "35d9e3b6697ba2ffbb1510ad8882a4cbf22cbd84",
  "tree": "c1ed9d0cddc5491939c38db4a8bf631f7b1845c2",
  "parents": [
    "c06af89ced34c1b1328f305f99abc55cd3f496f5"
  ],
  "author": {
    "name": "Pierre Riteau",
    "email": "pierre@stackhpc.com",
    "time": "Thu Feb 13 23:36:10 2025 +0100"
  },
  "committer": {
    "name": "Arnav Kansal",
    "email": "rnv@google.com",
    "time": "Sat Mar 15 14:16:44 2025 -0700"
  },
  "message": "net/sched: cls_api: fix error handling causing NULL dereference\n\n[ Upstream commit 071ed42cff4fcdd89025d966d48eabef59913bf2 ]\n\ntcf_exts_miss_cookie_base_alloc() calls xa_alloc_cyclic() which can\nreturn 1 if the allocation succeeded after wrapping. This was treated as\nan error, with value 1 returned to caller tcf_exts_init_ex() which sets\nexts-\u003eactions to NULL and returns 1 to caller fl_change().\n\nfl_change() treats err \u003d\u003d 1 as success, calling tcf_exts_validate_ex()\nwhich calls tcf_action_init() with exts-\u003eactions as argument, where it\nis dereferenced.\n\nExample trace:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nCPU: 114 PID: 16151 Comm: handler114 Kdump: loaded Not tainted 5.14.0-503.16.1.el9_5.x86_64 #1\nRIP: 0010:tcf_action_init+0x1f8/0x2c0\nCall Trace:\n tcf_action_init+0x1f8/0x2c0\n tcf_exts_validate_ex+0x175/0x190\n fl_change+0x537/0x1120 [cls_flower]\n\nBUG\u003db/403502768\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2025-21857 in the Linux kernel.\n\ncos-patch: security-moderate\nFixes: 80cd22c35c90 (\"net/sched: cls_api: Support hardware miss to tc action\")\nChange-Id: I41f7ad432dae767b936e0a74a8d1fb1b0dc6d28e\nSigned-off-by: Pierre Riteau \u003cpierre@stackhpc.com\u003e\nReviewed-by: Michal Swiatkowski \u003cmichal.swiatkowski@linux.intel.com\u003e\nLink: https://patch.msgid.link/20250213223610.320278-1-pierre@stackhpc.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/96068\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Arnav Kansal \u003crnv@google.com\u003e\nReviewed-by: Shuo Yang \u003cgshuoy@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "84e18b5f72a305fba6165a67c4334b70766b7716",
      "old_mode": 33188,
      "old_path": "net/sched/cls_api.c",
      "new_id": "96c39e9a873c755611c070053fb8192f31f99148",
      "new_mode": 33188,
      "new_path": "net/sched/cls_api.c"
    }
  ]
}