)]}'
{
  "commit": "8935ea9dc29fcbed1b899f88e5d9ba38d6f2e9a0",
  "tree": "3b37a5f06543f031c9ed46856cecb01eedfc1fad",
  "parents": [
    "208d6e1a64e623b491a290b6a8ecc563f2b99dde"
  ],
  "author": {
    "name": "Pedro Tammela",
    "email": "pctammela@mojatatu.com",
    "time": "Thu Feb 09 11:37:39 2023 -0300"
  },
  "committer": {
    "name": "Robert Kolchmeyer",
    "email": "rkolchmeyer@google.com",
    "time": "Mon Mar 13 17:31:02 2023 +0000"
  },
  "message": "net/sched: tcindex: update imperfect hash filters respecting rcu\n\ncommit ee059170b1f7e94e55fa6cadee544e176a6e59c2 upstream.\n\nThe imperfect hash area can be updated while packets are traversing,\nwhich will cause a use-after-free when \u0027tcf_exts_exec()\u0027 is called\nwith the destroyed tcf_ext.\n\nCPU 0:               CPU 1:\ntcindex_set_parms    tcindex_classify\ntcindex_lookup\n                     tcindex_lookup\ntcf_exts_change\n                     tcf_exts_exec [UAF]\n\nStop operating on the shared area directly, by using a local copy,\nand update the filter with \u0027rcu_replace_pointer()\u0027. Delete the old\nfilter version only after a rcu grace period elapsed.\n\nFixes: 9b0d4446b569 (\"net: sched: avoid atomic swap in tcf_exts_change\")\nReported-by: valis \u003csec@valis.email\u003e\nSuggested-by: valis \u003csec@valis.email\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Pedro Tammela \u003cpctammela@mojatatu.com\u003e\nLink: https://lore.kernel.org/r/20230209143739.279867-1-pctammela@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n(cherry picked from commit eb8e9d8572d1d9df17272783ad8a84843ce559d4)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\n\nBUG\u003db/272275066\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed a use-after-free issue in net/sched in the Linux kernel.\n\ncos-patch: bug\nChange-Id: I3d70d94547a4d5919632d2b717a7e846e07bdbce\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/44767\nReviewed-by: Oleksandr Tymoshenko \u003covt@google.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e9a8a2c86bbdd033b3dca556fcdb1e79b835b5cd",
      "old_mode": 33188,
      "old_path": "net/sched/cls_tcindex.c",
      "new_id": "dc87feaa3cb35a9e41a1209db82ebc5cef399462",
      "new_mode": 33188,
      "new_path": "net/sched/cls_tcindex.c"
    }
  ]
}