)]}'
{
  "commit": "87b60cfacf9f17cf71933c6e33b66e68160af71d",
  "tree": "2515afd95734510a26052154f094c3064063777d",
  "parents": [
    "1bf960502e4c94425c3a3a985200834fb59839c6"
  ],
  "author": {
    "name": "Eric Dumazet",
    "email": "edumazet@google.com",
    "time": "Fri Feb 10 10:31:49 2017 -0800"
  },
  "committer": {
    "name": "David S. Miller",
    "email": "davem@davemloft.net",
    "time": "Sat Feb 11 21:38:58 2017 -0500"
  },
  "message": "net_sched: fix error recovery at qdisc creation\n\nDmitry reported uses after free in qdisc code [1]\n\nThe problem here is that ops-\u003einit() can return an error.\n\nqdisc_create_dflt() then call ops-\u003edestroy(),\nwhile qdisc_create() does _not_ call it.\n\nFour qdisc chose to call their own ops-\u003edestroy(), assuming their caller\nwould not.\n\nThis patch makes sure qdisc_create() calls ops-\u003edestroy()\nand fixes the four qdisc to avoid double free.\n\n[1]\nBUG: KASAN: use-after-free in mq_destroy+0x242/0x290 net/sched/sch_mq.c:33 at addr ffff8801d415d440\nRead of size 8 by task syz-executor2/5030\nCPU: 0 PID: 5030 Comm: syz-executor2 Not tainted 4.3.5-smp-DEV #119\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011\n 0000000000000046 ffff8801b435b870 ffffffff81bbbed4 ffff8801db000400\n ffff8801d415d440 ffff8801d415dc40 ffff8801c4988510 ffff8801b435b898\n ffffffff816682b1 ffff8801b435b928 ffff8801d415d440 ffff8801c49880c0\nCall Trace:\n [\u003cffffffff81bbbed4\u003e] __dump_stack lib/dump_stack.c:15 [inline]\n [\u003cffffffff81bbbed4\u003e] dump_stack+0x6c/0x98 lib/dump_stack.c:51\n [\u003cffffffff816682b1\u003e] kasan_object_err+0x21/0x70 mm/kasan/report.c:158\n [\u003cffffffff81668524\u003e] print_address_description mm/kasan/report.c:196 [inline]\n [\u003cffffffff81668524\u003e] kasan_report_error+0x1b4/0x4b0 mm/kasan/report.c:285\n [\u003cffffffff81668953\u003e] kasan_report mm/kasan/report.c:305 [inline]\n [\u003cffffffff81668953\u003e] __asan_report_load8_noabort+0x43/0x50 mm/kasan/report.c:326\n [\u003cffffffff82527b02\u003e] mq_destroy+0x242/0x290 net/sched/sch_mq.c:33\n [\u003cffffffff82524bdd\u003e] qdisc_destroy+0x12d/0x290 net/sched/sch_generic.c:953\n [\u003cffffffff82524e30\u003e] qdisc_create_dflt+0xf0/0x120 net/sched/sch_generic.c:848\n [\u003cffffffff8252550d\u003e] attach_default_qdiscs net/sched/sch_generic.c:1029 [inline]\n [\u003cffffffff8252550d\u003e] dev_activate+0x6ad/0x880 net/sched/sch_generic.c:1064\n [\u003cffffffff824b1db1\u003e] __dev_open+0x221/0x320 net/core/dev.c:1403\n [\u003cffffffff824b24ce\u003e] __dev_change_flags+0x15e/0x3e0 net/core/dev.c:6858\n [\u003cffffffff824b27de\u003e] dev_change_flags+0x8e/0x140 net/core/dev.c:6926\n [\u003cffffffff824f5bf6\u003e] dev_ifsioc+0x446/0x890 net/core/dev_ioctl.c:260\n [\u003cffffffff824f61fa\u003e] dev_ioctl+0x1ba/0xb80 net/core/dev_ioctl.c:546\n [\u003cffffffff82430509\u003e] sock_do_ioctl+0x99/0xb0 net/socket.c:879\n [\u003cffffffff82430d30\u003e] sock_ioctl+0x2a0/0x390 net/socket.c:958\n [\u003cffffffff816f3b68\u003e] vfs_ioctl fs/ioctl.c:44 [inline]\n [\u003cffffffff816f3b68\u003e] do_vfs_ioctl+0x8a8/0xe50 fs/ioctl.c:611\n [\u003cffffffff816f41a4\u003e] SYSC_ioctl fs/ioctl.c:626 [inline]\n [\u003cffffffff816f41a4\u003e] SyS_ioctl+0x94/0xc0 fs/ioctl.c:617\n [\u003cffffffff8123e357\u003e] entry_SYSCALL_64_fastpath+0x12/0x17\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReported-by: Dmitry Vyukov \u003cdvyukov@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "adeabaec0d0b8bd3115e8d8db756460227142c60",
      "old_mode": 33188,
      "old_path": "net/sched/sch_api.c",
      "new_id": "a13c15e8f08782f9a428690052bf5585c446b6fe",
      "new_mode": 33188,
      "new_path": "net/sched/sch_api.c"
    },
    {
      "type": "modify",
      "old_id": "e3d0458af17ba32cb203d4a5bed952baf9d22588",
      "old_mode": 33188,
      "old_path": "net/sched/sch_hhf.c",
      "new_id": "2fae8b5f1b80c017c4ae60df54c9143f82de4e9d",
      "new_mode": 33188,
      "new_path": "net/sched/sch_hhf.c"
    },
    {
      "type": "modify",
      "old_id": "2bc8d7f8df161005bc89245ca5ebc52f3360e3af",
      "old_mode": 33188,
      "old_path": "net/sched/sch_mq.c",
      "new_id": "20b7f1646f69270e08d8b7588759a0146f262e89",
      "new_mode": 33188,
      "new_path": "net/sched/sch_mq.c"
    },
    {
      "type": "modify",
      "old_id": "b5c502c781439c0440c088b000a7b859271e50b2",
      "old_mode": 33188,
      "old_path": "net/sched/sch_mqprio.c",
      "new_id": "922683418e53853cb71747d8d30ab0e4a989254b",
      "new_mode": 33188,
      "new_path": "net/sched/sch_mqprio.c"
    },
    {
      "type": "modify",
      "old_id": "83d06e251b93cda13938cc00d75ff7c45d7785ad",
      "old_mode": 33188,
      "old_path": "net/sched/sch_sfq.c",
      "new_id": "42e8c8615e6563a2deabbb3c3437e3985d01ae14",
      "new_mode": 33188,
      "new_path": "net/sched/sch_sfq.c"
    }
  ]
}