)]}'
{
  "commit": "8c963bd224ec959e77d66017e5a7750ea9a80a23",
  "tree": "4b545161a39466785c2014fa7b935cc53c614002",
  "parents": [
    "2bd3062b0c638fd466b7307eb1855efa5ef50eda"
  ],
  "author": {
    "name": "Tejun Heo",
    "email": "tj@kernel.org",
    "time": "Fri Dec 06 07:59:51 2024 -1000"
  },
  "committer": {
    "name": "Michael Kochera",
    "email": "kochera@google.com",
    "time": "Fri Feb 07 15:43:43 2025 -0800"
  },
  "message": "blk-cgroup: Fix UAF in blkcg_unpin_online()\n\ncommit 86e6ca55b83c575ab0f2e105cf08f98e58d3d7af upstream.\n\nblkcg_unpin_online() walks up the blkcg hierarchy putting the online pin. To\nwalk up, it uses blkcg_parent(blkcg) but it was calling that after\nblkcg_destroy_blkgs(blkcg) which could free the blkcg, leading to the\nfollowing UAF:\n\n  \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n  BUG: KASAN: slab-use-after-free in blkcg_unpin_online+0x15a/0x270\n  Read of size 8 at addr ffff8881057678c0 by task kworker/9:1/117\n\n  CPU: 9 UID: 0 PID: 117 Comm: kworker/9:1 Not tainted 6.13.0-rc1-work-00182-gb8f52214c61a-dirty #48\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022\n  Workqueue: cgwb_release cgwb_release_workfn\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x27/0x80\n   print_report+0x151/0x710\n   kasan_report+0xc0/0x100\n   blkcg_unpin_online+0x15a/0x270\n   cgwb_release_workfn+0x194/0x480\n   process_scheduled_works+0x71b/0xe20\n   worker_thread+0x82a/0xbd0\n   kthread+0x242/0x2c0\n   ret_from_fork+0x33/0x70\n   ret_from_fork_asm+0x1a/0x30\n   \u003c/TASK\u003e\n  ...\n  Freed by task 1944:\n   kasan_save_track+0x2b/0x70\n   kasan_save_free_info+0x3c/0x50\n   __kasan_slab_free+0x33/0x50\n   kfree+0x10c/0x330\n   css_free_rwork_fn+0xe6/0xb30\n   process_scheduled_works+0x71b/0xe20\n   worker_thread+0x82a/0xbd0\n   kthread+0x242/0x2c0\n   ret_from_fork+0x33/0x70\n   ret_from_fork_asm+0x1a/0x30\n\nNote that the UAF is not easy to trigger as the free path is indirected\nbehind a couple RCU grace periods and a work item execution. I could only\ntrigger it with artifical msleep() injected in blkcg_unpin_online().\n\nFix it by reading the parent pointer before destroying the blkcg\u0027s blkg\u0027s.\n\nBUG\u003db/388216141\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2024-56672 in the Linux kernel.\n\ncos-patch: security-high\nChange-Id: I02090b67c97b3b03c068c1e2db1bf211394a9107\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nReported-by: Abagail ren \u003crenzezhongucas@gmail.com\u003e\nSuggested-by: Linus Torvalds \u003ctorvalds@linuxfoundation.org\u003e\nFixes: 4308a434e5e0 (\"blkcg: don\u0027t offline parent blkcg first\")\nCc: stable@vger.kernel.org # v5.7+\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/91733\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Michael Kochera \u003ckochera@google.com\u003e\nReviewed-by: Anil Altinay \u003caaltinay@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "bc5c04d711bbc371a4374d4842bb5e367e411773",
      "old_mode": 33188,
      "old_path": "include/linux/blk-cgroup.h",
      "new_id": "27c363f6b281b66700f2ea10c9aa573b8915bc1a",
      "new_mode": 33188,
      "new_path": "include/linux/blk-cgroup.h"
    }
  ]
}