)]}'
{
  "commit": "8b5dfa53eeb6c8bba5a035d38f6f8b981aebb622",
  "tree": "6622f5605f4c226e8971ad6cb9f0b1cc1fddb4d5",
  "parents": [
    "5d398ef38bfc37339583ad0bc587f53b01d1d7dd"
  ],
  "author": {
    "name": "Daniel Axtens",
    "email": "dja@axtens.net",
    "time": "Thu Jun 04 16:51:27 2020 -0700"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Sun Jun 07 13:17:54 2020 +0200"
  },
  "message": "kernel/relay.c: handle alloc_percpu returning NULL in relay_open\n\ncommit 54e200ab40fc14c863bcc80a51e20b7906608fce upstream.\n\nalloc_percpu() may return NULL, which means chan-\u003ebuf may be set to NULL.\nIn that case, when we do *per_cpu_ptr(chan-\u003ebuf, ...), we dereference an\ninvalid pointer:\n\n  BUG: Unable to handle kernel data access at 0x7dae0000\n  Faulting instruction address: 0xc0000000003f3fec\n  ...\n  NIP relay_open+0x29c/0x600\n  LR relay_open+0x270/0x600\n  Call Trace:\n     relay_open+0x264/0x600 (unreliable)\n     __blk_trace_setup+0x254/0x600\n     blk_trace_setup+0x68/0xa0\n     sg_ioctl+0x7bc/0x2e80\n     do_vfs_ioctl+0x13c/0x1300\n     ksys_ioctl+0x94/0x130\n     sys_ioctl+0x48/0xb0\n     system_call+0x5c/0x68\n\nCheck if alloc_percpu returns NULL.\n\nThis was found by syzkaller both on x86 and powerpc, and the reproducer\nit found on powerpc is capable of hitting the issue as an unprivileged\nuser.\n\nFixes: 017c59c042d0 (\"relay: Use per CPU constructs for the relay channel buffer pointers\")\nReported-by: syzbot+1e925b4b836afe85a1c6@syzkaller-ppc64.appspotmail.com\nReported-by: syzbot+587b2421926808309d21@syzkaller-ppc64.appspotmail.com\nReported-by: syzbot+58320b7171734bf79d26@syzkaller.appspotmail.com\nReported-by: syzbot+d6074fb08bdb2e010520@syzkaller.appspotmail.com\nSigned-off-by: Daniel Axtens \u003cdja@axtens.net\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Michael Ellerman \u003cmpe@ellerman.id.au\u003e\nReviewed-by: Andrew Donnellan \u003cajd@linux.ibm.com\u003e\nAcked-by: David Rientjes \u003crientjes@google.com\u003e\nCc: Akash Goel \u003cakash.goel@intel.com\u003e\nCc: Andrew Donnellan \u003cajd@linux.ibm.com\u003e\nCc: Guenter Roeck \u003clinux@roeck-us.net\u003e\nCc: Salvatore Bonaccorso \u003ccarnil@debian.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\t[4.10+]\nLink: http://lkml.kernel.org/r/20191219121256.26480-1-dja@axtens.net\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "9e0f52375487d7be47ee4c265ee0cbd5227186d0",
      "old_mode": 33188,
      "old_path": "kernel/relay.c",
      "new_id": "13c19f39e31e23e3d5f9ba2110699c5c7d079a82",
      "new_mode": 33188,
      "new_path": "kernel/relay.c"
    }
  ]
}