)]}'
{
  "commit": "e468c68a19c18e38b48ff36243a1bbdce8950a4c",
  "tree": "71bb77a1bc742df58b2f609de9bec467f8d12a51",
  "parents": [
    "1a94a13f43feacf9e835f5815f4581cbe734e480"
  ],
  "author": {
    "name": "Paulo Alcantara",
    "email": "pc@manguebit.com",
    "time": "Tue Jan 14 12:48:48 2025 -0300"
  },
  "committer": {
    "name": "Arnav Kansal",
    "email": "rnv@google.com",
    "time": "Fri Feb 07 15:40:00 2025 -0800"
  },
  "message": "smb: client: fix double free of TCP_Server_Info::hostname\n\n[ Upstream commit fa2f9906a7b333ba757a7dbae0713d8a5396186e ]\n\nWhen shutting down the server in cifs_put_tcp_session(), cifsd thread\nmight be reconnecting to multiple DFS targets before it realizes it\nshould exit the loop, so @server-\u003ehostname can\u0027t be freed as long as\ncifsd thread isn\u0027t done.  Otherwise the following can happen:\n\n  RIP: 0010:__slab_free+0x223/0x3c0\n  Code: 5e 41 5f c3 cc cc cc cc 4c 89 de 4c 89 cf 44 89 44 24 08 4c 89\n  1c 24 e8 fb cf 8e 00 44 8b 44 24 08 4c 8b 1c 24 e9 5f fe ff ff \u003c0f\u003e\n  0b 41 f7 45 08 00 0d 21 00 0f 85 2d ff ff ff e9 1f ff ff ff 80\n  RSP: 0018:ffffb26180dbfd08 EFLAGS: 00010246\n  RAX: ffff8ea34728e510 RBX: ffff8ea34728e500 RCX: 0000000000800068\n  RDX: 0000000000800068 RSI: 0000000000000000 RDI: ffff8ea340042400\n  RBP: ffffe112041ca380 R08: 0000000000000001 R09: 0000000000000000\n  R10: 6170732e31303000 R11: 70726f632e786563 R12: ffff8ea34728e500\n  R13: ffff8ea340042400 R14: ffff8ea34728e500 R15: 0000000000800068\n  FS: 0000000000000000(0000) GS:ffff8ea66fd80000(0000)\n  000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00007ffc25376080 CR3: 000000012a2ba001 CR4:\n  PKRU: 55555554\n  Call Trace:\n   \u003cTASK\u003e\n   ? show_trace_log_lvl+0x1c4/0x2df\n   ? show_trace_log_lvl+0x1c4/0x2df\n   ? __reconnect_target_unlocked+0x3e/0x160 [cifs]\n   ? __die_body.cold+0x8/0xd\n   ? die+0x2b/0x50\n   ? do_trap+0xce/0x120\n   ? __slab_free+0x223/0x3c0\n   ? do_error_trap+0x65/0x80\n   ? __slab_free+0x223/0x3c0\n   ? exc_invalid_op+0x4e/0x70\n   ? __slab_free+0x223/0x3c0\n   ? asm_exc_invalid_op+0x16/0x20\n   ? __slab_free+0x223/0x3c0\n   ? extract_hostname+0x5c/0xa0 [cifs]\n   ? extract_hostname+0x5c/0xa0 [cifs]\n   ? __kmalloc+0x4b/0x140\n   __reconnect_target_unlocked+0x3e/0x160 [cifs]\n   reconnect_dfs_server+0x145/0x430 [cifs]\n   cifs_handle_standard+0x1ad/0x1d0 [cifs]\n   cifs_demultiplex_thread+0x592/0x730 [cifs]\n   ? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]\n   kthread+0xdd/0x100\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork+0x29/0x50\n   \u003c/TASK\u003e\n\nBUG\u003db/394548945\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2025-21673 in the Linux kernel.\n\ncos-patch: security-moderate\nFixes: 7be3248f3139 (\"cifs: To match file servers, make sure the server hostname matches\")\nReported-by: Jay Shin \u003cjaeshin@redhat.com\u003e\nChange-Id: I7e0d8e0c8c1a138caaeac452d4a7c9aa24be50ba\nSigned-off-by: Paulo Alcantara (Red Hat) \u003cpc@manguebit.com\u003e\nSigned-off-by: Steve French \u003cstfrench@microsoft.com\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/92319\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Kevin Berry \u003ckpberry@google.com\u003e\nReviewed-by: Arnav Kansal \u003crnv@google.com\u003e\nReviewed-by: Michael Kochera \u003ckochera@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "20f303f2a5d75a451924e864bc54124e7b0de889",
      "old_mode": 33188,
      "old_path": "fs/smb/client/connect.c",
      "new_id": "dbcaaa274abdbf714c7839a120edeb1b8e7c6e13",
      "new_mode": 33188,
      "new_path": "fs/smb/client/connect.c"
    }
  ]
}