)]}'
{
  "commit": "9b0572c38f1c8b1d43f041fbb5c87dee0d2e22d2",
  "tree": "76c0583da651fdd013f3fd0d320deaa28f4308fa",
  "parents": [
    "19690e290ae314764ca51e951d5c61edda2cb757"
  ],
  "author": {
    "name": "Eric Dumazet",
    "email": "edumazet@google.com",
    "time": "Wed Apr 13 10:35:41 2022 -0700"
  },
  "committer": {
    "name": "COS Cherry Picker",
    "email": "cloud-image-release@prod.google.com",
    "time": "Sat Apr 23 12:07:19 2022 -0700"
  },
  "message": "net/sched: cls_u32: fix netns refcount changes in u32_change()\n\nWe are now able to detect extra put_net() at the moment\nthey happen, instead of much later in correct code paths.\n\nu32_init_knode() / tcf_exts_init() populates the -\u003eexts.net\npointer, but as mentioned in tcf_exts_init(),\nthe refcount on netns has not been elevated yet.\n\nThe refcount is taken only once tcf_exts_get_net()\nis called.\n\nSo the two u32_destroy_key() calls from u32_change()\nare attempting to release an invalid reference on the netns.\n\nsyzbot report:\n\nrefcount_t: decrement hit 0; leaking memory.\nWARNING: CPU: 0 PID: 21708 at lib/refcount.c:31 refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31\nModules linked in:\nCPU: 0 PID: 21708 Comm: syz-executor.5 Not tainted 5.18.0-rc2-next-20220412-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\nRIP: 0010:refcount_warn_saturate+0xbf/0x1e0 lib/refcount.c:31\nCode: 1d 14 b6 b2 09 31 ff 89 de e8 6d e9 89 fd 84 db 75 e0 e8 84 e5 89 fd 48 c7 c7 40 aa 26 8a c6 05 f4 b5 b2 09 01 e8 e5 81 2e 05 \u003c0f\u003e 0b eb c4 e8 68 e5 89 fd 0f b6 1d e3 b5 b2 09 31 ff 89 de e8 38\nRSP: 0018:ffffc900051af1b0 EFLAGS: 00010286\nRAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000\nRDX: 0000000000040000 RSI: ffffffff8160a0c8 RDI: fffff52000a35e28\nRBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000\nR10: ffffffff81604a9e R11: 0000000000000000 R12: 1ffff92000a35e3b\nR13: 00000000ffffffef R14: ffff8880211a0194 R15: ffff8880577d0a00\nFS:  00007f25d183e700(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f19c859c028 CR3: 0000000051009000 CR4: 00000000003506f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n __refcount_dec include/linux/refcount.h:344 [inline]\n refcount_dec include/linux/refcount.h:359 [inline]\n ref_tracker_free+0x535/0x6b0 lib/ref_tracker.c:118\n netns_tracker_free include/net/net_namespace.h:327 [inline]\n put_net_track include/net/net_namespace.h:341 [inline]\n tcf_exts_put_net include/net/pkt_cls.h:255 [inline]\n u32_destroy_key.isra.0+0xa7/0x2b0 net/sched/cls_u32.c:394\n u32_change+0xe01/0x3140 net/sched/cls_u32.c:909\n tc_new_tfilter+0x98d/0x2200 net/sched/cls_api.c:2148\n rtnetlink_rcv_msg+0x80d/0xb80 net/core/rtnetlink.c:6016\n netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2495\n netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]\n netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345\n netlink_sendmsg+0x904/0xe00 net/netlink/af_netlink.c:1921\n sock_sendmsg_nosec net/socket.c:705 [inline]\n sock_sendmsg+0xcf/0x120 net/socket.c:725\n ____sys_sendmsg+0x6e2/0x800 net/socket.c:2413\n ___sys_sendmsg+0xf3/0x170 net/socket.c:2467\n __sys_sendmsg+0xe5/0x1b0 net/socket.c:2496\n do_syscall_x64 arch/x86/entry/common.c:50 [inline]\n do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80\n entry_SYSCALL_64_after_hwframe+0x44/0xae\nRIP: 0033:0x7f25d0689049\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f25d183e168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f25d079c030 RCX: 00007f25d0689049\nRDX: 0000000000000000 RSI: 0000000020000340 RDI: 0000000000000005\nRBP: 00007f25d06e308d R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 00007ffd0b752e3f R14: 00007f25d183e300 R15: 0000000000022000\n \u003c/TASK\u003e\n\nFixes: 35c55fc156d8 (\"cls_u32: use tcf_exts_get_net() before call_rcu()\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: syzbot \u003csyzkaller@googlegroups.com\u003e\nCc: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n(cherry picked from commit 3db09e762dc79584a69c10d74a6b98f89a9979f8)\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\n\nBUG\u003db/230138536\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2022-29581 in the Linux kernel.\n\ncos-patch: security-high\nChange-Id: I8e8702820cd7db5c1b864df3aeaada87c22b84e6\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/32090\nReviewed-by: Oleksandr Tymoshenko \u003covt@google.com\u003e\nMain-Branch-Verified: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "54209a18d7fec2ee70664b365a2909fd913c6e01",
      "old_mode": 33188,
      "old_path": "net/sched/cls_u32.c",
      "new_id": "b61db335c49d15cb357e8f27eb2f2f6fdf17e014",
      "new_mode": 33188,
      "new_path": "net/sched/cls_u32.c"
    }
  ]
}