)]}'
{
  "commit": "39754e5eb6a303ec0db05e7cefac442983d8b50d",
  "tree": "c5240a2d17d8d068f81003bfba8ffacf1a58e36f",
  "parents": [
    "2f25fde01f205c6785d86638352f3c92d5d5edcb"
  ],
  "author": {
    "name": "Michael Bommarito",
    "email": "michael.bommarito@gmail.com",
    "time": "Wed Jul 15 21:15:58 2026 -0400"
  },
  "committer": {
    "name": "Angel Adetula",
    "email": "angeladetula@google.com",
    "time": "Mon Aug 10 13:32:23 2026 -0700"
  },
  "message": "smb: client: resolve SWN tcon from live registrations\n\n[ Upstream commit ec457f9afe5ae9538bdcd58fd4cb442b9787e183 ]\n\ncifs_swn_notify() looks up a witness registration by id under\ncifs_swnreg_idr_mutex, drops the mutex, and then uses the registration\u0027s\ncached tcon pointer.  That pointer is not a lifetime reference, and it is\nnot a stable representative once cifs_get_swn_reg() lets multiple tcons\nfor the same net/share name share one registration id.\n\nA same-share second mount can keep the cifs_swn_reg alive after the first\ntcon unregisters and is freed.  The registration then still points at the\nfreed first tcon, so taking tc_lock or incrementing tc_count through\nswnreg-\u003etcon only moves the use-after-free earlier.  Taking tc_lock while\nholding cifs_swnreg_idr_mutex also violates the documented CIFS lock\norder.\n\nFix this by making the registration store only the stable witness\nidentity: id, net name, share name, and notify flags.  When a notify\narrives, copy that identity under cifs_swnreg_idr_mutex, drop the mutex,\nthen find and pin a live witness tcon that currently matches the net/share\npair under the normal cifs_tcp_ses_lock -\u003e tc_lock order.  The notification\npath uses that pinned tcon directly and drops the reference when done.\n\nRegistration and unregister messages now use the live tcon passed by the\ncaller instead of a cached tcon in the registration.  The final unregister\nsend is folded into cifs_swn_unregister() while the registration is still\nprotected by cifs_swnreg_idr_mutex.  This removes the previous\nfind/drop/reacquire raw-pointer window.  The release path only removes the\nidr entry and frees the stable identity strings.\n\nThis preserves the intended one-registration/many-tcon behavior: a\nregistration id represents a net/share pair, and notify handling acts on a\nlive representative selected at use time.  It also preserves CLIENT_MOVE\nordering for the representative tcon because the old-IP unregister is sent\nbefore cifs_swn_register() sends the new-IP register.\n\nBUG\u003db/539153192\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2026-64401 in the Linux kernel.\n\nFixes: fed979a7e082 (\"cifs: Set witness notification handler for messages from userspace daemon\")\nCc: stable@vger.kernel.org\nChange-Id: Iabdcd8ba32a88cd486b3c0df754828ca5dc7a6cb\nSigned-off-by: Michael Bommarito \u003cmichael.bommarito@gmail.com\u003e\nAssisted-by: Claude:claude-opus-4-7\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Angel Adetula \u003cangeladetula@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/178767\nReviewed-by: Dom Huh \u003cdomhuh@google.com\u003e\nReviewed-by: Kevin Liu \u003czhihuil@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "35a3e73c1958062db6d68759eb0b0477fad26ab9",
      "old_mode": 33188,
      "old_path": "fs/smb/client/cifs_swn.c",
      "new_id": "693f609512e6b5ef15830050be2f504e84585ead",
      "new_mode": 33188,
      "new_path": "fs/smb/client/cifs_swn.c"
    },
    {
      "type": "modify",
      "old_id": "bd6e59b70872e4c9d9ae4d1fc4acb5bf3a0f0d1c",
      "old_mode": 33188,
      "old_path": "fs/smb/client/trace.h",
      "new_id": "036c7966e26009567ce757456fb863c2a72c6b11",
      "new_mode": 33188,
      "new_path": "fs/smb/client/trace.h"
    }
  ]
}