)]}'
{
  "commit": "576efcf4e8be2ce88f088293e31d0c4ae15f5484",
  "tree": "edf4bcb659724cee30691ea091e5d3077481a2d5",
  "parents": [
    "2ab9831e491cb40176a288e56b8cd617d2ace356"
  ],
  "author": {
    "name": "Cong Wang",
    "email": "xiyou.wangcong@gmail.com",
    "time": "Thu Mar 06 15:23:54 2025 -0800"
  },
  "committer": {
    "name": "Michael Kochera",
    "email": "kochera@google.com",
    "time": "Thu Apr 10 13:45:41 2025 -0700"
  },
  "message": "net_sched: Prevent creation of classes with TC_H_ROOT\n\n[ Upstream commit 0c3057a5a04d07120b3d0ec9c79568fceb9c921e ]\n\nThe function qdisc_tree_reduce_backlog() uses TC_H_ROOT as a termination\ncondition when traversing up the qdisc tree to update parent backlog\ncounters. However, if a class is created with classid TC_H_ROOT, the\ntraversal terminates prematurely at this class instead of reaching the\nactual root qdisc, causing parent statistics to be incorrectly maintained.\nIn case of DRR, this could lead to a crash as reported by Mingi Cho.\n\nPrevent the creation of any Qdisc class with classid TC_H_ROOT\n(0xFFFFFFFF) across all qdisc types, as suggested by Jamal.\n\nBUG\u003db/403931947\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed KCTF-0c3057a in the Linux kernel.\n\ncos-patch: security-high\nReported-by: Mingi Cho \u003cmincho@theori.io\u003e\nChange-Id: I5e3df07c5d07d71b87e313db1ad03c0ea991332a\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nFixes: 066a3b5b2346 (\"[NET_SCHED] sch_api: fix qdisc_tree_decrease_qlen() loop\")\nLink: https://patch.msgid.link/20250306232355.93864-2-xiyou.wangcong@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/98382\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Michael Kochera \u003ckochera@google.com\u003e\nReviewed-by: Arnav Kansal \u003crnv@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "cb379849c51a4e4cb3aa938b046d1a98c6633281",
      "old_mode": 33188,
      "old_path": "net/sched/sch_api.c",
      "new_id": "c395e7a98232d519fca04acfe7a675d0f4f8f18a",
      "new_mode": 33188,
      "new_path": "net/sched/sch_api.c"
    }
  ]
}