)]}'
{
  "commit": "5303e06cb782ad8c7fc5ccf4e2cf228ab1373e60",
  "tree": "66e0f5801a03a34ad6fe77e97ef38ec59b30b1f2",
  "parents": [
    "d8e5574a78e3f031bc5c8747f6b5816757a5bf54"
  ],
  "author": {
    "name": "Cong Wang",
    "email": "cong.wang@bytedance.com",
    "time": "Mon Feb 03 16:58:40 2025 -0800"
  },
  "committer": {
    "name": "Arnav Kansal",
    "email": "rnv@google.com",
    "time": "Thu Feb 27 10:40:59 2025 -0800"
  },
  "message": "netem: Update sch-\u003eq.qlen before qdisc_tree_reduce_backlog()\n\n[ Upstream commit 638ba5089324796c2ee49af10427459c2de35f71 ]\n\nqdisc_tree_reduce_backlog() notifies parent qdisc only if child\nqdisc becomes empty, therefore we need to reduce the backlog of the\nchild qdisc before calling it. Otherwise it would miss the opportunity\nto call cops-\u003eqlen_notify(), in the case of DRR, it resulted in UAF\nsince DRR uses -\u003eqlen_notify() to maintain its active list.\n\nBUG\u003db/395542420\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed KCTF-638ba50 in the Linux kernel.\n\ncos-patch: security-high\nFixes: f8d4bc455047 (\"net/sched: netem: account for backlog updates from child qdisc\")\nCc: Martin Ottens \u003cmartin.ottens@fau.de\u003e\nReported-by: Mingi Cho \u003cmincho@theori.io\u003e\nChange-Id: I32c4315fdfd9d5f02a1ae82e7177d672618ab9e8\nSigned-off-by: Cong Wang \u003ccong.wang@bytedance.com\u003e\nLink: https://patch.msgid.link/20250204005841.223511-4-xiyou.wangcong@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/94099\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Arnav Kansal \u003crnv@google.com\u003e\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "f47ab622399f31338947bc6cb8e0e611671ee053",
      "old_mode": 33188,
      "old_path": "net/sched/sch_netem.c",
      "new_id": "cb38e58ee771d8148960a898a3d1649ad971dc3a",
      "new_mode": 33188,
      "new_path": "net/sched/sch_netem.c"
    }
  ]
}