)]}'
{
  "commit": "b4dd01604929b76fe2e6ea43dead75bffbfacc33",
  "tree": "b838879b75bb9e9bc60558326b2bd319799b5b3f",
  "parents": [
    "7d652a445dcf53f2d738dc02d7432bf0cd5bf60a"
  ],
  "author": {
    "name": "Eric Dumazet",
    "email": "edumazet@google.com",
    "time": "Fri Jul 25 14:07:23 2025 +0000"
  },
  "committer": {
    "name": "Robert Kolchmeyer",
    "email": "rkolchmeyer@google.com",
    "time": "Wed Sep 10 19:16:46 2025 -0700"
  },
  "message": "ipv6: prevent infinite loop in rt6_nlmsg_size()\n\n[ Upstream commit 54e6fe9dd3b0e7c481c2228782c9494d653546da ]\n\nWhile testing prior patch, I was able to trigger\nan infinite loop in rt6_nlmsg_size() in the following place:\n\nlist_for_each_entry_rcu(sibling, \u0026f6i-\u003efib6_siblings,\n\t\t\tfib6_siblings) {\n\trt6_nh_nlmsg_size(sibling-\u003efib6_nh, \u0026nexthop_len);\n}\n\nThis is because fib6_del_route() and fib6_add_rt2node()\nuses list_del_rcu(), which can confuse rcu readers,\nbecause they might no longer see the head of the list.\n\nRestart the loop if f6i-\u003efib6_nsiblings is zero.\n\nBUG\u003db/440032878\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2025-38588 in the Linux kernel.\n\ncos-patch: security-moderate\nFixes: d9ccb18f83ea (\"ipv6: Fix soft lockups in fib6_select_path under high next hop churn\")\nChange-Id: I733c600d7586b530d210fab98779638bf89d5d58\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20250725140725.3626540-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Robert Kolchmeyer \u003crkolchmeyer@google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/111073\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Chenglong Tang \u003cchenglongtang@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "b6a7cbd6bee0dbfb836d6bd8066253b109661619",
      "old_mode": 33188,
      "old_path": "net/ipv6/ip6_fib.c",
      "new_id": "bc70380eb4371c4b14c6fe11809bd9845f129d8f",
      "new_mode": 33188,
      "new_path": "net/ipv6/ip6_fib.c"
    },
    {
      "type": "modify",
      "old_id": "f674b8935536b4be9cd6644c59aa9227b3393b8c",
      "old_mode": 33188,
      "old_path": "net/ipv6/route.c",
      "new_id": "061a7a524e5e84d3e7f7b62cbbb7226abe482b9d",
      "new_mode": 33188,
      "new_path": "net/ipv6/route.c"
    }
  ]
}