)]}'
{
  "commit": "d84153907f743d6d62ecb9be3216622a05d12bcc",
  "tree": "93bae58cb858b9f53764f563776cccf03117c7ae",
  "parents": [
    "d9df69268034afc858f088473d223e99ca7151a6"
  ],
  "author": {
    "name": "Baokun Li",
    "email": "libaokun1@huawei.com",
    "time": "Mon Aug 26 19:20:56 2024 +0800"
  },
  "committer": {
    "name": "Anil Altinay",
    "email": "aaltinay@google.com",
    "time": "Wed Oct 02 06:13:29 2024 +0000"
  },
  "message": "fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF\n\ncommit 72a6e22c604c95ddb3b10b5d3bb85b6ff4dbc34f upstream.\n\nThe fscache_cookie_lru_timer is initialized when the fscache module\nis inserted, but is not deleted when the fscache module is removed.\nIf timer_reduce() is called before removing the fscache module,\nthe fscache_cookie_lru_timer will be added to the timer list of\nthe current cpu. Afterwards, a use-after-free will be triggered\nin the softIRQ after removing the fscache module, as follows:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nBUG: unable to handle page fault for address: fffffbfff803c9e9\n PF: supervisor read access in kernel mode\n PF: error_code(0x0000) - not-present page\nPGD 21ffea067 P4D 21ffea067 PUD 21ffe6067 PMD 110a7c067 PTE 0\nOops: Oops: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G W 6.11.0-rc3 #855\nTainted: [W]\u003dWARN\nRIP: 0010:__run_timer_base.part.0+0x254/0x8a0\nCall Trace:\n \u003cIRQ\u003e\n tmigr_handle_remote_up+0x627/0x810\n __walk_groups.isra.0+0x47/0x140\n tmigr_handle_remote+0x1fa/0x2f0\n handle_softirqs+0x180/0x590\n irq_exit_rcu+0x84/0xb0\n sysvec_apic_timer_interrupt+0x6e/0x90\n \u003c/IRQ\u003e\n \u003cTASK\u003e\n asm_sysvec_apic_timer_interrupt+0x1a/0x20\nRIP: 0010:default_idle+0xf/0x20\n default_idle_call+0x38/0x60\n do_idle+0x2b5/0x300\n cpu_startup_entry+0x54/0x60\n start_secondary+0x20d/0x280\n common_startup_64+0x13e/0x148\n \u003c/TASK\u003e\nModules linked in: [last unloaded: netfs]\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nTherefore delete fscache_cookie_lru_timer when removing the fscahe module.\n\nBUG\u003db/369994025\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2024-46786 in the Linux kernel.\n\ncos-patch: security-high\nFixes: 12bb21a29c19 (\"fscache: Implement cookie user counting and resource pinning\")\nCc: stable@kernel.org\nChange-Id: Id2805d2accd308335215fff36ca765aca9c5e36a\nSigned-off-by: Baokun Li \u003clibaokun1@huawei.com\u003e\nLink: https://lore.kernel.org/r/20240826112056.2458299-1-libaokun@huaweicloud.com\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nSigned-off-by: Christian Brauner \u003cbrauner@kernel.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/82405\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Oleksandr Tymoshenko \u003covt@google.com\u003e\nReviewed-by: Anil Altinay \u003caaltinay@google.com\u003e\nReviewed-by: Arnav Kansal \u003crnv@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "dad85fd84f6f9f9245112b7bdcea4305313c8950",
      "old_mode": 33188,
      "old_path": "fs/fscache/main.c",
      "new_id": "7a60cd96e87ea2030b40e22e9d44aef3d9992a9a",
      "new_mode": 33188,
      "new_path": "fs/fscache/main.c"
    }
  ]
}