)]}'
{
  "commit": "edc4bd59140fb73445e9beff43a9caed44921451",
  "tree": "f24308e1741c943b11f41ffd0ac46cd40afd5c39",
  "parents": [
    "f28b7142c104510266615a552e63050d5946b997"
  ],
  "author": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Thu Feb 15 06:33:46 2024 -0800"
  },
  "committer": {
    "name": "Anil Altinay",
    "email": "aaltinay@google.com",
    "time": "Mon May 05 16:23:08 2025 -0700"
  },
  "message": "net/sched: act_mirred: don\u0027t override retval if we already lost the skb\n\ncommit 166c2c8a6a4dc2e4ceba9e10cfe81c3e469e3210 upstream.\n\nIf we\u0027re redirecting the skb, and haven\u0027t called tcf_mirred_forward(),\nyet, we need to tell the core to drop the skb by setting the retcode\nto SHOT. If we have called tcf_mirred_forward(), however, the skb\nis out of our hands and returning SHOT will lead to UaF.\n\nMove the retval override to the error path which actually need it.\n\nBUG\u003db/388468286\nTEST\u003dpresubmit\nRELEASE_NOTE\u003dFixed CVE-2024-26739 in the Linux kernel.\n\ncos-patch: security-high\nReviewed-by: Michal Swiatkowski \u003cmichal.swiatkowski@linux.intel.com\u003e\nFixes: e5cf1baf92cb (\"act_mirred: use TC_ACT_REINSERT when possible\")\nChange-Id: I14ed154eadced19bcd1fb7a6ae5c8ef9a7a739fc\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n[Minor conflict resolved due to code context change.]\nSigned-off-by: Jianqi Ren \u003cjianqi.ren.cn@windriver.com\u003e\nSigned-off-by: He Zhe \u003czhe.he@windriver.com\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nSigned-off-by: Kernel CVE Triage Automation \u003ccloud-image-kernel-cve-triage-automation@prod.google.com\u003e\nReviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/101584\nReviewed-by: Anil Altinay \u003caaltinay@google.com\u003e\nTested-by: Anil Altinay \u003caaltinay@google.com\u003e\nReviewed-by: Michael Kochera \u003ckochera@google.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "36395e5db3b40263ac0a1e60e1b7539194de695d",
      "old_mode": 33188,
      "old_path": "net/sched/act_mirred.c",
      "new_id": "bbc34987bd09bd9e42403b3ffc4405340f124f4a",
      "new_mode": 33188,
      "new_path": "net/sched/act_mirred.c"
    }
  ]
}