)]}'
{
  "commit": "b0f61c19b0f70b3abb9a2bc3092d0f9f8281f55d",
  "tree": "cc47bc5812e4d37b193bf3c343b928e9e45ff5f4",
  "parents": [
    "c3bc41077afd8e01997c009d4060e2cb07ef1f7a"
  ],
  "author": {
    "name": "Chuck Lever",
    "email": "chuck.lever@oracle.com",
    "time": "Thu Sep 01 15:10:12 2022 -0400"
  },
  "committer": {
    "name": "Oleksandr Tymoshenko",
    "email": "ovt@google.com",
    "time": "Thu Nov 10 01:58:59 2022 +0000"
  },
  "message": "NFSD: Protect against send buffer overflow in NFSv3 READDIR\n\ncommit 640f87c190e0d1b2a0fcb2ecf6d2cd53b1c41991 upstream.\n\nSince before the git era, NFSD has conserved the number of pages\nheld by each nfsd thread by combining the RPC receive and send\nbuffers into a single array of pages. This works because there are\nno cases where an operation needs a large RPC Call message and a\nlarge RPC Reply message at the same time.\n\nOnce an RPC Call has been received, svc_process() updates\nsvc_rqst::rq_res to describe the part of rq_pages that can be\nused for constructing the Reply. This means that the send buffer\n(rq_res) shrinks when the received RPC record containing the RPC\nCall is large.\n\nA client can force this shrinkage on TCP by sending a correctly-\nformed RPC Call header contained in an RPC record that is\nexcessively large. The full maximum payload size cannot be\nconstructed in that case.\n\nThanks to Aleksi Illikainen and Kari Hulkko for uncovering this\nissue.\n\nBUG\u003db/258184692\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2022-43945 in the Linux kernel.\n\ncos-patch: security-high\nReported-by: Ben Ronallo \u003cBenjamin.Ronallo@synopsys.com\u003e\nCc: \u003cstable@vger.kernel.org\u003e\nSigned-off-by: Chuck Lever \u003cchuck.lever@oracle.com\u003e\nReviewed-by: Jeff Layton \u003cjlayton@kernel.org\u003e\nSigned-off-by: Chuck Lever \u003cchuck.lever@oracle.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nChange-Id: I6b574ef2983f4be7365e3271146c7daf2b2c5461\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/38493\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Meena Shanmugam \u003cmeenashanmugam@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "88d5d5b1034437a3a3a639d9476a15cf36f552c8",
      "old_mode": 33188,
      "old_path": "fs/nfsd/nfs3proc.c",
      "new_id": "eaf785aec0708974151500d58b32e9f2c2d77330",
      "new_mode": 33188,
      "new_path": "fs/nfsd/nfs3proc.c"
    }
  ]
}