)]}'
{
  "commit": "e91f6ec6c0880a074dbbd99c020414cd16928d30",
  "tree": "c8ad8eca8ad49dcd81b006cb916e582cab4f7063",
  "parents": [
    "feba8bbb3ee9a00b4b2710a6a7e90a313d958050"
  ],
  "author": {
    "name": "valis",
    "email": "sec@valis.email",
    "time": "Sat Jul 29 08:32:01 2023 -0400"
  },
  "committer": {
    "name": "COS Cherry Picker",
    "email": "cloud-image-release@prod.google.com",
    "time": "Mon Aug 21 12:13:26 2023 -0700"
  },
  "message": "net/sched: cls_fw: No longer copy tcf_result on update to avoid use-after-free\n\n[ Upstream commit 76e42ae831991c828cffa8c37736ebfb831ad5ec ]\n\nWhen fw_change() is called on an existing filter, the whole\ntcf_result struct is always copied into the new instance of the filter.\n\nThis causes a problem when updating a filter bound to a class,\nas tcf_unbind_filter() is always called on the old instance in the\nsuccess path, decreasing filter_cnt of the still referenced class\nand allowing it to be deleted, leading to a use-after-free.\n\nFix this by no longer copying the tcf_result struct from the old filter.\n\nBUG\u003db/296442227\nSOURCE\u003dUPSTREAM(76e42ae83199)\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dNone\n\ncos-patch: security-high\nFixes: e35a8ee5993b (\"net: sched: fw use RCU\")\nReported-by: valis \u003csec@valis.email\u003e\nReported-by: Bing-Jhong Billy Jheng \u003cbilly@starlabs.sg\u003e\nChange-Id: I5de098ec7e2e64716276016ebb8f2353a051ac12\nSigned-off-by: valis \u003csec@valis.email\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Sasha Levin \u003csashal@kernel.org\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/55577\nMain-Branch-Verified: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nTested-by: Cusky Presubmit Bot \u003cpresubmit@cos-infra-prod.iam.gserviceaccount.com\u003e\nReviewed-by: Oleksandr Tymoshenko \u003covt@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "41f0898a5a5656744bda05d2c3781118653d102a",
      "old_mode": 33188,
      "old_path": "net/sched/cls_fw.c",
      "new_id": "08c41f1976c47ec73fb5d83822b766a90192efbd",
      "new_mode": 33188,
      "new_path": "net/sched/cls_fw.c"
    }
  ]
}