)]}'
{
  "commit": "8b4d5a73b054b07c3abedde85bd34343fffb9566",
  "tree": "822327d8fee622609eac1c6605a3936c4b9ae066",
  "parents": [
    "70ec24885ddac7ae6ffb6a5e02df50beadea24bc"
  ],
  "author": {
    "name": "Thomas Zimmermann",
    "email": "tzimmermann@suse.de",
    "time": "Tue May 05 02:00:00 2026 -0400"
  },
  "committer": {
    "name": "Kevin Berry",
    "email": "kpberry@google.com",
    "time": "Tue Jun 02 23:53:20 2026 -0700"
  },
  "message": "fbdev: defio: Disconnect deferred I/O from the lifetime of struct fb_info\n\n[ Upstream commit 9ded47ad003f09a94b6a710b5c47f4aa5ceb7429 ]\n\nHold state of deferred I/O in struct fb_deferred_io_state. Allocate an\ninstance as part of initializing deferred I/O and remove it only after\nthe final mapping has been closed. If the fb_info and the contained\ndeferred I/O meanwhile goes away, clear struct fb_deferred_io_state.info\nto invalidate the mapping. Any access will then result in a SIGBUS\nsignal.\n\nFixes a long-standing problem, where a device hot-unplug happens while\nuser space still has an active mapping of the graphics memory. The hot-\nunplug frees the instance of struct fb_info. Accessing the memory will\noperate on undefined state.\n\nBUG\u003db/517291329\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2026-46065 in the Linux kernel.\n\ncos-patch: security-moderate\nChange-Id: I1df013a798ae848a3dfa102d29bd7c6324266f33\nSigned-off-by: Thomas Zimmermann \u003ctzimmermann@suse.de\u003e\nFixes: 60b59beafba8 (\"fbdev: mm: Deferred IO support\")\nCc: Helge Deller \u003cdeller@gmx.de\u003e\nCc: linux-fbdev@vger.kernel.org\nCc: dri-devel@lists.freedesktop.org\nCc: stable@vger.kernel.org # v2.6.22+\nSigned-off-by: Helge Deller \u003cdeller@gmx.de\u003e\n[ replaced `kzalloc_obj` with `kzalloc`, and dropped `mutex_destroy(\u0026fbdefio-\u003elock)` ]\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/154998\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Kevin Liu \u003czhihuil@google.com\u003e\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b9607d5a370d4eb49116e1c7d0caaf5f3ca4c630",
      "old_mode": 33188,
      "old_path": "drivers/video/fbdev/core/fb_defio.c",
      "new_id": "f4812a76c3cc0eab2f6d5daa0d50996455e2699b",
      "new_mode": 33188,
      "new_path": "drivers/video/fbdev/core/fb_defio.c"
    },
    {
      "type": "modify",
      "old_id": "322b4d20afa558170bb46b9d9fa2f77786b46df3",
      "old_mode": 33188,
      "old_path": "include/linux/fb.h",
      "new_id": "8a9d949cc7e2d80a3a15fa03f50f955e6bebc577",
      "new_mode": 33188,
      "new_path": "include/linux/fb.h"
    }
  ]
}