)]}'
{
  "commit": "6282bbbf15f49e3d92ed337dc1178a3b46f01e6d",
  "tree": "f1638eaa1ab375433e0842410a945d46d225778f",
  "parents": [
    "0daccddf2255ea4e1b332ec918fcd404e19ba1e5"
  ],
  "author": {
    "name": "Jann Horn",
    "email": "jannh@google.com",
    "time": "Thu Dec 03 02:25:04 2020 +0100"
  },
  "committer": {
    "name": "Roy Yang",
    "email": "royyang@google.com",
    "time": "Wed Dec 16 01:07:01 2020 +0000"
  },
  "message": "tty: Fix -\u003epgrp locking in tiocspgrp()\n\ncommit 54ffccbf053b5b6ca4f6e45094b942fab92a25fc upstream.\n\ntiocspgrp() takes two tty_struct pointers: One to the tty that userspace\npassed to ioctl() (`tty`) and one to the TTY being changed (`real_tty`).\nThese pointers are different when ioctl() is called with a master fd.\n\nTo properly lock real_tty-\u003epgrp, we must take real_tty-\u003ectrl_lock.\n\nThis bug makes it possible for racing ioctl(TIOCSPGRP, ...) calls on\nboth sides of a PTY pair to corrupt the refcount of `struct pid`,\nleading to use-after-free errors.\n\nBUG\u003db/175451845\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2020-29661\nSOURCE\u003dUPSTREAM(54ffccbf053b5b6ca4f6e45094b942fab92a25fc)\n\ncos-patch: security-high\nFixes: 47f86834bbd4 (\"redo locking of tty-\u003epgrp\")\nCC: stable@kernel.org\nSigned-off-by: Jann Horn \u003cjannh@google.com\u003e\nReviewed-by: Jiri Slaby \u003cjirislaby@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nChange-Id: Ida97fd8d7e5e21724e9af173438c144ef7322f96\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/9620\nReviewed-by: Vaibhav Rustagi \u003cvaibhavrustagi@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "f8ed50a16848140f699885e233425fe3fc9b6315",
      "old_mode": 33188,
      "old_path": "drivers/tty/tty_jobctrl.c",
      "new_id": "af508957ff0557c0d32bf64281ec133d6999adb7",
      "new_mode": 33188,
      "new_path": "drivers/tty/tty_jobctrl.c"
    }
  ]
}