)]}'
{
  "commit": "052d41c01b3a2e3371d66de569717353af489d63",
  "tree": "995570b6b32fea4c07ac142f608f40c6b2baa9fa",
  "parents": [
    "2118df93b5e1742931da358c2b8804c46fd64490"
  ],
  "author": {
    "name": "Cong Wang",
    "email": "xiyou.wangcong@gmail.com",
    "time": "Thu Nov 09 16:43:13 2017 -0800"
  },
  "committer": {
    "name": "David S. Miller",
    "email": "davem@davemloft.net",
    "time": "Sat Nov 11 19:35:32 2017 +0900"
  },
  "message": "vlan: fix a use-after-free in vlan_device_event()\n\nAfter refcnt reaches zero, vlan_vid_del() could free\ndev-\u003evlan_info via RCU:\n\n\tRCU_INIT_POINTER(dev-\u003evlan_info, NULL);\n\tcall_rcu(\u0026vlan_info-\u003ercu, vlan_info_rcu_free);\n\nHowever, the pointer \u0027grp\u0027 still points to that memory\nsince it is set before vlan_vid_del():\n\n        vlan_info \u003d rtnl_dereference(dev-\u003evlan_info);\n        if (!vlan_info)\n                goto out;\n        grp \u003d \u0026vlan_info-\u003egrp;\n\nDepends on when that RCU callback is scheduled, we could\ntrigger a use-after-free in vlan_group_for_each_dev()\nright following this vlan_vid_del().\n\nFix it by moving vlan_vid_del() before setting grp. This\nis also symmetric to the vlan_vid_add() we call in\nvlan_device_event().\n\nReported-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nFixes: efc73f4bbc23 (\"net: Fix memory leak - vlan_info struct\")\nCc: Alexander Duyck \u003calexander.duyck@gmail.com\u003e\nCc: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\nCc: Girish Moodalbail \u003cgirish.moodalbail@oracle.com\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nReviewed-by: Girish Moodalbail \u003cgirish.moodalbail@oracle.com\u003e\nTested-by: Fengguang Wu \u003cfengguang.wu@intel.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "9649579b5b9f38aff6ce7a990d2dc1ddb1d85e12",
      "old_mode": 33188,
      "old_path": "net/8021q/vlan.c",
      "new_id": "4a72ee4e2ae96b41faadb2959c968e0a757f3a0b",
      "new_mode": 33188,
      "new_path": "net/8021q/vlan.c"
    }
  ]
}