)]}'
{
  "commit": "d76ca200c3330ac340c7df5b700cd96ec7a5d3e8",
  "tree": "f31522479f9534d45623fa4a3ecac64233b8492d",
  "parents": [
    "48e7107034ef2bb631eef05dd102bcf733590790"
  ],
  "author": {
    "name": "Heechan Kang",
    "email": "gganji11@naver.com",
    "time": "Sun May 17 03:47:09 2026 +0900"
  },
  "committer": {
    "name": "Kevin Liu",
    "email": "zhihuil@google.com",
    "time": "Mon Jun 15 10:39:39 2026 -0700"
  },
  "message": "io_uring/waitid: clear waitid info before copying it to userspace\n\ncommit 93d93f5f8da791e98159795c6ef683f45bd95d13 upstream.\n\nIORING_OP_WAITID stores its result fields in struct io_waitid::info and\nlater copies them to userspace siginfo. The prep path initializes the\nrequest arguments, but it does not initialize info itself.\n\nIf the wait operation completes without reporting a child event, the common\nwait code can return without writing wo_info. In that case io_waitid_finish()\nstill copies iw-\u003einfo to userspace, exposing stale bytes from the reused\nio_kiocb command storage.\n\nClear the result storage during prep so the io_uring path matches the\nregular waitid syscall, which uses a zero-initialized struct waitid_info.\n\nBUG\u003db/522217835\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2026-46315 in the Linux kernel.\n\ncos-patch: security-high\nFixes: f31ecf671ddc (\"io_uring: add IORING_OP_WAITID support\")\nCc: stable@vger.kernel.org # 6.7+\nChange-Id: Ia094a1293b4c8dca9d559a7f77f27577a0d426f3\nSigned-off-by: Heechan Kang \u003cgganji11@naver.com\u003e\nLink: https://patch.msgid.link/20260516184709.852814-1-gganji11@naver.com\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/160264\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Daniel Velasquez \u003crdvelasquez@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "ecaa358d0ad87b8adec066235a23b707d25ff5b3",
      "old_mode": 33188,
      "old_path": "io_uring/waitid.c",
      "new_id": "ef2283728c2b3a3f2d5ac5320757dd19b98850ec",
      "new_mode": 33188,
      "new_path": "io_uring/waitid.c"
    }
  ]
}